@cequrebackends/plugin-security 0.12.2

package/dist/index.js

@@ -0,0 +1,1199 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toCommonJS = (from) => {
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __moduleCache;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/mfa.ts
+import { sha256Hex as sha256Hex2, timingSafeEqual as timingSafeEqual2 } from "@cequrebackends/cequre-ts";
+function generateTOTPSecret() {
+  const bytes = crypto.getRandomValues(new Uint8Array(20));
+  let bits = 0, value = 0, output = "";
+  for (const byte of bytes) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      output += BASE32_ALPHABET[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0)
+    output += BASE32_ALPHABET[value << 5 - bits & 31];
+  return output;
+}
+function base32Decode(secret) {
+  const cleaned = secret.replace(/=+$/, "").replace(/\s/g, "").toUpperCase();
+  let bits = 0, value = 0, output = [];
+  for (const char of cleaned) {
+    const idx = BASE32_ALPHABET.indexOf(char);
+    if (idx === -1)
+      continue;
+    value = value << 5 | idx;
+    bits += 5;
+    if (bits >= 8) {
+      output.push(value >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return new Uint8Array(output);
+}
+async function generateTOTPAtCounter(secret, counter, digits = 6) {
+  const buffer = new ArrayBuffer(8);
+  const view = new DataView(buffer);
+  view.setUint32(0, Math.floor(counter / 4294967296));
+  view.setUint32(4, counter & 4294967295);
+  const key = await crypto.subtle.importKey("raw", base32Decode(secret), { name: "HMAC", hash: "SHA-1" }, false, ["sign"]);
+  const hmac = new Uint8Array(await crypto.subtle.sign("HMAC", key, buffer));
+  const offset = hmac[hmac.length - 1] & 15;
+  const code = ((hmac[offset] & 127) << 24 | hmac[offset + 1] << 16 | hmac[offset + 2] << 8 | hmac[offset + 3]) % Math.pow(10, digits);
+  return code.toString().padStart(digits, "0");
+}
+async function generateTOTP(secret, timeStep = 30, digits = 6) {
+  const counter = Math.floor(Date.now() / 1000 / timeStep);
+  return generateTOTPAtCounter(secret, counter, digits);
+}
+async function verifyTOTP(secret, code, window = 1) {
+  for (let i = -window;i <= window; i++) {
+    const counter = Math.floor(Date.now() / 1000 / 30) + i;
+    const expected = await generateTOTPAtCounter(secret, counter);
+    if (timingSafeEqual2(expected, code))
+      return true;
+  }
+  return false;
+}
+function generateOTPAuthURI(secret, account, issuer = "Cequre") {
+  const label = `${encodeURIComponent(issuer)}:${encodeURIComponent(account)}`;
+  const params = new URLSearchParams({ secret, issuer, algorithm: "SHA1", digits: "6", period: "30" });
+  return `otpauth://totp/${label}?${params.toString()}`;
+}
+function generateBackupCodes(count = 10) {
+  const codes = [];
+  for (let i = 0;i < count; i++) {
+    const bytes = crypto.getRandomValues(new Uint8Array(8));
+    const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+    codes.push(`${hex.slice(0, 5)}-${hex.slice(5, 10)}-${hex.slice(10, 16)}`);
+  }
+  return codes;
+}
+async function hashBackupCode(code) {
+  return sha256Hex2(code);
+}
+var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+var init_mfa = () => {};
+
+// src/auth-routes.ts
+var exports_auth_routes = {};
+__export(exports_auth_routes, {
+  setupAuthRoutes: () => setupAuthRoutes
+});
+import { parseDuration as parseDuration2 } from "@cequrebackends/cequre-ts";
+function validatePasswordPolicy(password, policy) {
+  if (!policy)
+    return null;
+  if (policy.minLength && password.length < policy.minLength) {
+    return `Password must be at least ${policy.minLength} characters`;
+  }
+  if (policy.requireUppercase && !/[A-Z]/.test(password)) {
+    return "Password must contain at least one uppercase letter";
+  }
+  if (policy.requireNumber && !/[0-9]/.test(password)) {
+    return "Password must contain at least one number";
+  }
+  return null;
+}
+function getRefreshTokenFromCookie(req, cookieName) {
+  const cookieHeader = req.headers.get("cookie");
+  if (!cookieHeader)
+    return;
+  const match = cookieHeader.match(new RegExp(`(^|;\\s*)${cookieName}_refresh=([^;]+)`));
+  return match ? match[2] : undefined;
+}
+function applyAuthCookies(headers, jwtConfig, tokens, clear = false) {
+  const config = jwtConfig?.cookies;
+  if (!config)
+    return;
+  const cookieName = config.name || "cequre_auth";
+  const domain = config.domain ? `Domain=${config.domain};` : "";
+  const sameSite = config.sameSite || "lax";
+  const secure = config.secure ? "Secure;" : "";
+  const httpOnly = config.httpOnly ? "HttpOnly;" : "";
+  if (clear) {
+    headers.append("Set-Cookie", `${cookieName}=; Path=/; Max-Age=0; SameSite=${sameSite}; ${secure} ${httpOnly} ${domain}`.trim());
+    if (config.refreshToken) {
+      const refreshCookieName = `${cookieName}_refresh`;
+      headers.append("Set-Cookie", `${refreshCookieName}=; Path=/; Max-Age=0; SameSite=${sameSite}; ${secure} ${httpOnly} ${domain}`.trim());
+    }
+  } else if (tokens) {
+    const maxAge = parseDuration2(config.timeout || "7d");
+    headers.append("Set-Cookie", `${cookieName}=${tokens.accessToken}; Path=/; Max-Age=${maxAge}; SameSite=${sameSite}; ${secure} ${httpOnly} ${domain}`.trim());
+    if (config.refreshToken) {
+      const refreshCookieName = `${cookieName}_refresh`;
+      const refreshMaxAge = parseDuration2(jwtConfig?.refreshTokenExpiry || "7d");
+      headers.append("Set-Cookie", `${refreshCookieName}=${tokens.refreshToken}; Path=/; Max-Age=${refreshMaxAge}; SameSite=${sameSite}; ${secure} ${httpOnly} ${domain}`.trim());
+    }
+  }
+}
+function setupAuthRoutes(cequre) {
+  const prefix = cequre.schema.core?.api?.prefix || "/api";
+  if (cequre.schema.collections) {
+    for (const collection of cequre.schema.collections) {
+      const basePath = `${prefix}/${collection.slug}`;
+      if (collection.auth) {
+        cequre.router.post(`${basePath}/register`, async (ctx) => {
+          const req = ctx.request;
+          let data = await req.json().catch(() => ({}));
+          const hookCtx = { ...ctx, collection: collection.slug };
+          if (cequre.hooksMap.get(collection.slug)?.beforeRegister) {
+            const mutated = await cequre.hooksMap.get(collection.slug)?.beforeRegister?.({ ...hookCtx, data });
+            if (mutated !== undefined)
+              data = mutated;
+          }
+          await cequre.checkAccess(collection.slug, "register", { ...ctx, data });
+          if (!data.email || !data.password)
+            return new Response(JSON.stringify({ error: "Email and password required" }), { status: 400 });
+          const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+          if (!emailRegex.test(data.email))
+            return new Response(JSON.stringify({ error: "Invalid email format" }), { status: 400 });
+          const policyError = validatePasswordPolicy(data.password, cequre.schema.security?.auth?.passwordPolicy);
+          if (policyError)
+            return new Response(JSON.stringify({ error: policyError }), { status: 400, headers: { "Content-Type": "application/json" } });
+          const existing = await cequre.secureFind(collection.slug, { where: { email: { eq: data.email } }, limit: 1 });
+          if (existing.docs.length > 0)
+            return new Response(JSON.stringify({ error: "User already exists" }), { status: 409 });
+          const hashedPassword = await Bun.password.hash(data.password, "bcrypt");
+          const registerData = cequre.stripForbiddenFields(collection.slug, { ...data, password: hashedPassword });
+          registerData.password = hashedPassword;
+          const user = await cequre.secureCreate(collection.slug, registerData);
+          let tokens;
+          if (cequre.authEngine)
+            tokens = await cequre.authEngine.generateTokenPair(user, collection.slug);
+          const filteredUser = { ...user };
+          delete filteredUser.password;
+          if (cequre.hooksMap.get(collection.slug)?.afterRegister) {
+            await cequre.hooksMap.get(collection.slug)?.afterRegister?.({ ...hookCtx, data: { user: filteredUser, tokens } });
+          }
+          return new Response(JSON.stringify({
+            user: filteredUser,
+            ...tokens ? { accessToken: tokens.accessToken, refreshToken: tokens.refreshToken } : {},
+            message: "Registration successful"
+          }), { status: 201, headers: { "Content-Type": "application/json" } });
+        });
+        cequre.router.post(`${basePath}/login`, async (ctx) => {
+          const req = ctx.request;
+          let data = await req.json().catch(() => ({}));
+          const hookCtx = { ...ctx, collection: collection.slug };
+          if (cequre.hooksMap.get(collection.slug)?.beforeLogin) {
+            const mutated = await cequre.hooksMap.get(collection.slug)?.beforeLogin?.({ ...hookCtx, data });
+            if (mutated !== undefined)
+              data = mutated;
+          }
+          await cequre.checkAccess(collection.slug, "login", { ...ctx, data });
+          if (!data.email || !data.password)
+            return new Response(JSON.stringify({ error: "Email and password required" }), { status: 400 });
+          const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+          if (!emailRegex.test(data.email))
+            return new Response(JSON.stringify({ error: "Invalid email format" }), { status: 400 });
+          const lockoutConfig = cequre.schema.security?.auth?.lockout;
+          const lockoutState = await cequre.checkLockout(collection.slug, data.email, lockoutConfig);
+          if (lockoutState.locked) {
+            const mins = Math.ceil((lockoutState.remainingMs ?? 0) / 60000);
+            return new Response(JSON.stringify({ error: `Account temporarily locked. Try again in ${mins} minute(s).` }), { status: 429, headers: { "Content-Type": "application/json" } });
+          }
+          const result = await cequre.secureFind(collection.slug, { where: { email: { eq: data.email } }, limit: 1 });
+          const user = result.docs[0];
+          if (!user) {
+            await cequre.recordFailedLogin(collection.slug, data.email, lockoutConfig);
+            return new Response(JSON.stringify({ error: "Oops! The email or password credentials provided don't match our records." }), { status: 401 });
+          }
+          const valid = await Bun.password.verify(data.password, user.password);
+          if (!valid) {
+            await cequre.recordFailedLogin(collection.slug, data.email, lockoutConfig);
+            return new Response(JSON.stringify({ error: "Oops! The email or password credentials provided don't match our records." }), { status: 401 });
+          }
+          await cequre.clearFailedLogins(collection.slug, data.email);
+          if (user.mfaEnabled && user.mfaSecret) {
+            const mfaToken = await cequre.authEngine.generateMFAChallengeToken(user.id, collection.slug);
+            return new Response(JSON.stringify({
+              mfaRequired: true,
+              mfaToken
+            }), { status: 200, headers: { "Content-Type": "application/json" } });
+          }
+          let tokens;
+          if (cequre.authEngine)
+            tokens = await cequre.authEngine.generateTokenPair(user, collection.slug);
+          const filteredUser = { ...user };
+          delete filteredUser.password;
+          const headers = new Headers({ "Content-Type": "application/json" });
+          applyAuthCookies(headers, cequre.schema.security?.auth?.jwt, tokens);
+          if (cequre.hooksMap.get(collection.slug)?.afterLogin) {
+            await cequre.hooksMap.get(collection.slug)?.afterLogin?.({ ...hookCtx, data: { user: filteredUser, tokens } });
+          }
+          return new Response(JSON.stringify({
+            user: filteredUser,
+            ...tokens ? { accessToken: tokens.accessToken, refreshToken: tokens.refreshToken } : {},
+            message: "Login successful"
+          }), { status: 200, headers });
+        });
+        cequre.router.post(`${basePath}/refresh`, async (ctx) => {
+          const req = ctx.request;
+          let data = await req.json().catch(() => ({}));
+          await cequre.checkAccess(collection.slug, "refresh", { ...ctx, data });
+          const cookiesConfig = cequre.schema.security?.auth?.jwt?.cookies;
+          let refreshToken = data.refreshToken;
+          if (!refreshToken && cookiesConfig?.refreshToken) {
+            const cookieName = cookiesConfig.name || "cequre_auth";
+            refreshToken = getRefreshTokenFromCookie(req, cookieName);
+          }
+          if (!refreshToken)
+            return new Response(JSON.stringify({ error: "refreshToken required" }), { status: 400 });
+          if (!cequre.authEngine)
+            return new Response(JSON.stringify({ error: "JWT auth not configured" }), { status: 501 });
+          const tokens = await cequre.authEngine.refreshTokenPair(refreshToken);
+          if (!tokens)
+            return new Response(JSON.stringify({ error: "Invalid or expired refresh token" }), { status: 401 });
+          const headers = new Headers({ "Content-Type": "application/json" });
+          applyAuthCookies(headers, cequre.schema.security?.auth?.jwt, tokens);
+          return new Response(JSON.stringify({
+            user: tokens.user,
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken
+          }), { status: 200, headers });
+        });
+        cequre.router.post(`${basePath}/logout`, async (ctx) => {
+          const req = ctx.request;
+          await cequre.checkAccess(collection.slug, "logout", ctx);
+          let data = await req.json().catch(() => ({}));
+          const cookiesConfig = cequre.schema.security?.auth?.jwt?.cookies;
+          let refreshToken = data.refreshToken;
+          if (!refreshToken && cookiesConfig?.refreshToken) {
+            const cookieName = cookiesConfig.name || "cequre_auth";
+            refreshToken = getRefreshTokenFromCookie(req, cookieName);
+          }
+          if (refreshToken && cequre.authEngine) {
+            await cequre.authEngine.revokeRefreshToken(refreshToken);
+          }
+          const headers = new Headers({ "Content-Type": "application/json" });
+          applyAuthCookies(headers, cequre.schema.security?.auth?.jwt, undefined, true);
+          return new Response(JSON.stringify({ message: "Logged out successfully" }), { status: 200, headers });
+        });
+        if (cequre.schema.security?.auth?.mfa?.enabled) {
+          cequre.router.post(`${basePath}/mfa/login`, async (ctx) => {
+            const req = ctx.request;
+            let data = await req.json().catch(() => ({}));
+            const hookCtx = { ...ctx, collection: collection.slug };
+            if (cequre.hooksMap.get(collection.slug)?.beforeMfaLogin) {
+              const mutated = await cequre.hooksMap.get(collection.slug)?.beforeMfaLogin?.({ ...hookCtx, data });
+              if (mutated !== undefined)
+                data = mutated;
+            }
+            await cequre.checkAccess(collection.slug, "mfaLogin", { ...ctx, data });
+            if (!data.mfaToken || !data.mfaCode)
+              return new Response(JSON.stringify({ error: "mfaToken and mfaCode required" }), { status: 400, headers: { "Content-Type": "application/json" } });
+            if (!cequre.authEngine)
+              return new Response(JSON.stringify({ error: "JWT auth not configured" }), { status: 501 });
+            const tokenInfo = await cequre.authEngine.verifyMFAChallengeToken(data.mfaToken);
+            if (!tokenInfo)
+              return new Response(JSON.stringify({ error: "Invalid or expired MFA token" }), { status: 401, headers: { "Content-Type": "application/json" } });
+            const user = await cequre.secureFindById(tokenInfo.collection, tokenInfo.userId);
+            if (!user || !user.mfaEnabled || !user.mfaSecret) {
+              return new Response(JSON.stringify({ error: "MFA not enabled for this user" }), { status: 400, headers: { "Content-Type": "application/json" } });
+            }
+            if (data.backupCode) {
+              const hashedInput = await hashBackupCode(data.backupCode);
+              const backupHashes = user.mfaBackupCodes || [];
+              const matchIdx = backupHashes.indexOf(hashedInput);
+              if (matchIdx >= 0) {
+                backupHashes.splice(matchIdx, 1);
+                await cequre.secureUpdate(tokenInfo.collection, tokenInfo.userId, { mfaBackupCodes: backupHashes });
+              } else {
+                return new Response(JSON.stringify({ error: "Invalid backup code" }), { status: 401, headers: { "Content-Type": "application/json" } });
+              }
+            } else {
+              const valid = await verifyTOTP(user.mfaSecret, data.mfaCode);
+              if (!valid)
+                return new Response(JSON.stringify({ error: "Invalid MFA code" }), { status: 401, headers: { "Content-Type": "application/json" } });
+            }
+            const tokens = await cequre.authEngine.generateTokenPair(user, tokenInfo.collection);
+            const filteredUser = { ...user };
+            delete filteredUser.password;
+            delete filteredUser.mfaSecret;
+            delete filteredUser.mfaBackupCodes;
+            const headers = new Headers({ "Content-Type": "application/json" });
+            applyAuthCookies(headers, cequre.schema.security?.auth?.jwt, tokens);
+            if (cequre.hooksMap.get(collection.slug)?.afterMfaLogin) {
+              await cequre.hooksMap.get(collection.slug)?.afterMfaLogin?.({ ...hookCtx, data: { user: filteredUser, tokens } });
+            }
+            return new Response(JSON.stringify({
+              user: filteredUser,
+              accessToken: tokens.accessToken,
+              refreshToken: tokens.refreshToken,
+              message: "Login successful"
+            }), { status: 200, headers });
+          });
+          cequre.router.post(`${basePath}/mfa/enroll`, async (ctx) => {
+            const req = ctx.request;
+            let data = await req.json().catch(() => ({}));
+            const hookCtx = { ...ctx, collection: collection.slug };
+            if (cequre.hooksMap.get(collection.slug)?.beforeMfaEnroll) {
+              const mutated = await cequre.hooksMap.get(collection.slug)?.beforeMfaEnroll?.({ ...hookCtx, data });
+              if (mutated !== undefined)
+                data = mutated;
+            }
+            await cequre.checkAccess(collection.slug, "mfaEnroll", { ...ctx, data });
+            const reqCtx = await cequre.getContext(req);
+            if (!reqCtx.user)
+              return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+            const user = await cequre.secureFindById(reqCtx.user.collection, reqCtx.user.id);
+            if (!user)
+              return new Response(JSON.stringify({ error: "User not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
+            const secret = generateTOTPSecret();
+            const issuer = cequre.schema.security?.auth?.mfa?.issuer || "Cequre";
+            const account = user.email || reqCtx.user.id;
+            const otpauthUri = generateOTPAuthURI(secret, account, issuer);
+            const backupCodeCount = cequre.schema.security?.auth?.mfa?.backupCodeCount ?? 10;
+            const backupCodes = generateBackupCodes(backupCodeCount);
+            const hashedBackupCodes = await Promise.all(backupCodes.map(hashBackupCode));
+            await cequre.secureUpdate(reqCtx.user.collection, reqCtx.user.id, {
+              mfaSecret: secret,
+              mfaBackupCodes: hashedBackupCodes,
+              mfaEnabled: false
+            });
+            if (cequre.hooksMap.get(collection.slug)?.afterMfaEnroll) {
+              await cequre.hooksMap.get(collection.slug)?.afterMfaEnroll?.({ ...hookCtx, data: { user } });
+            }
+            return new Response(JSON.stringify({
+              secret,
+              otpauthUri,
+              backupCodes,
+              message: "Scan the QR code with your authenticator app, then verify with a code to complete enrollment."
+            }), { status: 200, headers: { "Content-Type": "application/json" } });
+          });
+          cequre.router.post(`${basePath}/mfa/verify`, async (ctx) => {
+            const req = ctx.request;
+            let data = await req.json().catch(() => ({}));
+            const hookCtx = { ...ctx, collection: collection.slug };
+            if (cequre.hooksMap.get(collection.slug)?.beforeMfaVerify) {
+              const mutated = await cequre.hooksMap.get(collection.slug)?.beforeMfaVerify?.({ ...hookCtx, data });
+              if (mutated !== undefined)
+                data = mutated;
+            }
+            await cequre.checkAccess(collection.slug, "mfaVerify", { ...ctx, data });
+            const reqCtx = await cequre.getContext(req);
+            if (!reqCtx.user)
+              return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+            if (!data.mfaCode)
+              return new Response(JSON.stringify({ error: "mfaCode required" }), { status: 400, headers: { "Content-Type": "application/json" } });
+            const user = await cequre.secureFindById(reqCtx.user.collection, reqCtx.user.id);
+            if (!user || !user.mfaSecret) {
+              return new Response(JSON.stringify({ error: "MFA not initiated. Call /mfa/enroll first." }), { status: 400, headers: { "Content-Type": "application/json" } });
+            }
+            const valid = await verifyTOTP(user.mfaSecret, data.mfaCode);
+            if (!valid)
+              return new Response(JSON.stringify({ error: "Invalid MFA code" }), { status: 401, headers: { "Content-Type": "application/json" } });
+            await cequre.secureUpdate(reqCtx.user.collection, reqCtx.user.id, { mfaEnabled: true });
+            if (cequre.hooksMap.get(collection.slug)?.afterMfaVerify) {
+              await cequre.hooksMap.get(collection.slug)?.afterMfaVerify?.({ ...hookCtx, data: { user } });
+            }
+            return new Response(JSON.stringify({ message: "MFA enabled successfully" }), { status: 200, headers: { "Content-Type": "application/json" } });
+          });
+          cequre.router.post(`${basePath}/mfa/disable`, async (ctx) => {
+            const req = ctx.request;
+            let data = await req.json().catch(() => ({}));
+            await cequre.checkAccess(collection.slug, "mfaDisable", { ...ctx, data });
+            const reqCtx = await cequre.getContext(req);
+            if (!reqCtx.user)
+              return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+            if (!data.mfaCode)
+              return new Response(JSON.stringify({ error: "mfaCode required" }), { status: 400, headers: { "Content-Type": "application/json" } });
+            const user = await cequre.secureFindById(reqCtx.user.collection, reqCtx.user.id);
+            if (!user || !user.mfaEnabled || !user.mfaSecret) {
+              return new Response(JSON.stringify({ error: "MFA not enabled" }), { status: 400, headers: { "Content-Type": "application/json" } });
+            }
+            const valid = await verifyTOTP(user.mfaSecret, data.mfaCode);
+            if (!valid)
+              return new Response(JSON.stringify({ error: "Invalid MFA code" }), { status: 401, headers: { "Content-Type": "application/json" } });
+            await cequre.secureUpdate(reqCtx.user.collection, reqCtx.user.id, {
+              mfaEnabled: false,
+              mfaSecret: null,
+              mfaBackupCodes: null
+            });
+            return new Response(JSON.stringify({ message: "MFA disabled successfully" }), { status: 200, headers: { "Content-Type": "application/json" } });
+          });
+        }
+        cequre.router.post(`${basePath}/forgot-password`, async (ctx) => {
+          const req = ctx.request;
+          let data = await req.json().catch(() => ({}));
+          const hookCtx = { ...ctx, collection: collection.slug };
+          if (cequre.hooksMap.get(collection.slug)?.beforeForgotPassword) {
+            const mutated = await cequre.hooksMap.get(collection.slug)?.beforeForgotPassword?.({ ...hookCtx, data });
+            if (mutated !== undefined)
+              data = mutated;
+          }
+          await cequre.checkAccess(collection.slug, "forgotPassword", { ...ctx, data });
+          if (!data.email)
+            return new Response(JSON.stringify({ error: "Email required" }), { status: 400, headers: { "Content-Type": "application/json" } });
+          const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+          if (!emailRegex.test(data.email))
+            return new Response(JSON.stringify({ error: "Invalid email format" }), { status: 400, headers: { "Content-Type": "application/json" } });
+          const existing = await cequre.secureFind(collection.slug, { where: { email: { eq: data.email } }, limit: 1 });
+          const user = existing.docs[0];
+          if (user && cequre.authEngine && cequre.mailer) {
+            const token = await cequre.authEngine.generatePasswordResetToken(user.id, collection.slug);
+            const resetUrl = cequre.schema.email?.resetPasswordUrl ? `${cequre.schema.email.resetPasswordUrl}?token=${token}` : `http://localhost:3000/reset-password?token=${token}`;
+            await cequre.mailer.sendForgotPassword(user.email, resetUrl);
+            if (cequre.hooksMap.get(collection.slug)?.afterForgotPassword) {
+              await cequre.hooksMap.get(collection.slug)?.afterForgotPassword?.({ ...hookCtx, data: { user, resetUrl, token } });
+            }
+          }
+          return new Response(JSON.stringify({ message: "Password reset email sent (if account exists)" }), { status: 200, headers: { "Content-Type": "application/json" } });
+        });
+        cequre.router.post(`${basePath}/reset-password`, async (ctx) => {
+          const req = ctx.request;
+          let data = await req.json().catch(() => ({}));
+          const hookCtx = { ...ctx, collection: collection.slug };
+          if (cequre.hooksMap.get(collection.slug)?.beforeResetPassword) {
+            const mutated = await cequre.hooksMap.get(collection.slug)?.beforeResetPassword?.({ ...hookCtx, data });
+            if (mutated !== undefined)
+              data = mutated;
+          }
+          await cequre.checkAccess(collection.slug, "resetPassword", { ...ctx, data });
+          if (!data.token || !data.password) {
+            return new Response(JSON.stringify({ error: "Token and new password are required" }), { status: 400, headers: { "Content-Type": "application/json" } });
+          }
+          const policyError = validatePasswordPolicy(data.password, cequre.schema.security?.auth?.passwordPolicy);
+          if (policyError)
+            return new Response(JSON.stringify({ error: policyError }), { status: 400, headers: { "Content-Type": "application/json" } });
+          if (!cequre.authEngine)
+            return new Response(JSON.stringify({ error: "Auth engine not configured" }), { status: 500, headers: { "Content-Type": "application/json" } });
+          const verified = await cequre.authEngine.verifyPasswordResetToken(data.token);
+          if (!verified || verified.collection !== collection.slug) {
+            return new Response(JSON.stringify({ error: "Invalid or expired reset token" }), { status: 400, headers: { "Content-Type": "application/json" } });
+          }
+          const hashedPassword = await Bun.password.hash(data.password, "bcrypt");
+          await cequre.secureUpdate(collection.slug, verified.userId, { password: hashedPassword });
+          await cequre.authEngine.revokeAllForUser(verified.userId);
+          const user = await cequre.secureFindById(collection.slug, verified.userId);
+          if (user && cequre.mailer && user.email) {
+            await cequre.mailer.sendPasswordResetSuccess(user.email);
+          }
+          if (cequre.hooksMap.get(collection.slug)?.afterResetPassword) {
+            await cequre.hooksMap.get(collection.slug)?.afterResetPassword?.({ ...hookCtx, data: { user } });
+          }
+          return new Response(JSON.stringify({ message: "Password reset successfully" }), { status: 200, headers: { "Content-Type": "application/json" } });
+        });
+        cequre.router.get(`${basePath}/me`, async (ctx) => {
+          if (!ctx.user) {
+            return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+          }
+          if (ctx.user.collection !== collection.slug) {
+            return new Response(JSON.stringify({ error: "Unauthorized for this collection" }), { status: 403, headers: { "Content-Type": "application/json" } });
+          }
+          const result = await cequre.secureFindById(collection.slug, ctx.user.id);
+          if (!result) {
+            return new Response(JSON.stringify({ error: "User not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
+          }
+          const filteredUser = { ...result };
+          delete filteredUser.password;
+          return new Response(JSON.stringify(filteredUser), { status: 200, headers: { "Content-Type": "application/json" } });
+        });
+      }
+    }
+  }
+}
+var init_auth_routes = __esm(() => {
+  init_mfa();
+});
+
+// src/auth.ts
+import { SignJWT, jwtVerify } from "jose";
+
+// src/token-store.ts
+import { createLogger } from "@cequrebackends/cequre-ts";
+var log = createLogger("token-store");
+
+class InMemoryTokenStore {
+  store_ = new Map;
+  async store(hash, entry) {
+    this.store_.set(hash, entry);
+  }
+  async lookup(hash) {
+    return this.store_.get(hash) ?? null;
+  }
+  async revoke(hash) {
+    this.store_.delete(hash);
+  }
+  async revokeAllForUser(userId) {
+    for (const [hash, entry] of this.store_) {
+      if (entry.userId === userId)
+        this.store_.delete(hash);
+    }
+  }
+  async purgeExpired() {
+    const now = Date.now();
+    for (const [hash, entry] of this.store_) {
+      if (entry.expiresAt <= now)
+        this.store_.delete(hash);
+    }
+  }
+}
+var REFRESH_TOKEN_COLLECTION = "cequre_refresh_tokens";
+
+class AdapterTokenStore {
+  adapter;
+  constructor(adapter) {
+    this.adapter = adapter;
+  }
+  async store(hash, entry) {
+    const doc = {
+      id: hash,
+      tokenHash: hash,
+      userId: entry.userId,
+      collection: entry.collection,
+      expiresAt: entry.expiresAt
+    };
+    if (entry.role !== undefined && entry.role !== null) {
+      doc.role = entry.role;
+    }
+    try {
+      const existing = await this.adapter.findById(REFRESH_TOKEN_COLLECTION, hash);
+      if (existing) {
+        const updateData = {
+          userId: entry.userId,
+          collection: entry.collection,
+          expiresAt: entry.expiresAt
+        };
+        if (entry.role !== undefined && entry.role !== null) {
+          updateData.role = entry.role;
+        }
+        await this.adapter.update(REFRESH_TOKEN_COLLECTION, hash, updateData);
+      } else {
+        await this.adapter.create(REFRESH_TOKEN_COLLECTION, doc);
+      }
+    } catch (err) {
+      log.warn({ err }, "Failed to persist refresh token to adapter \u2014 table may not exist yet");
+    }
+  }
+  async lookup(hash) {
+    try {
+      const doc = await this.adapter.findById(REFRESH_TOKEN_COLLECTION, hash);
+      if (!doc)
+        return null;
+      return {
+        userId: doc.userId,
+        collection: doc.collection,
+        role: doc.role,
+        expiresAt: doc.expiresAt
+      };
+    } catch (err) {
+      log.warn({ err }, "Failed to look up refresh token from adapter \u2014 table may not exist yet");
+      return null;
+    }
+  }
+  async revoke(hash) {
+    try {
+      await this.adapter.delete(REFRESH_TOKEN_COLLECTION, hash);
+    } catch (err) {
+      log.warn({ err }, "Failed to revoke refresh token from adapter \u2014 table may not exist yet");
+    }
+  }
+  async revokeAllForUser(userId) {
+    try {
+      const result = await this.adapter.find(REFRESH_TOKEN_COLLECTION, {
+        where: { userId: { eq: userId } },
+        limit: 1000
+      });
+      for (const doc of result.docs) {
+        await this.adapter.delete(REFRESH_TOKEN_COLLECTION, doc.id);
+      }
+    } catch (err) {
+      if (err?.message === "Database not connected")
+        return;
+      log.warn({ err }, "Failed to revoke all refresh tokens for user \u2014 table may not exist yet");
+    }
+  }
+  async purgeExpired() {
+    const now = Date.now();
+    try {
+      const result = await this.adapter.find(REFRESH_TOKEN_COLLECTION, {
+        where: { expiresAt: { lt: now } },
+        limit: 1000
+      });
+      for (const doc of result.docs) {
+        await this.adapter.delete(REFRESH_TOKEN_COLLECTION, doc.id);
+      }
+    } catch (err) {
+      if (err?.message === "Database not connected")
+        return;
+      log.warn({ err }, "Failed to purge expired refresh tokens \u2014 table may not exist yet");
+    }
+  }
+}
+
+// src/auth.ts
+import { sha256Hex } from "@cequrebackends/cequre-ts";
+import { createLogger as createLogger2 } from "@cequrebackends/cequre-ts";
+import { ulid } from "@cequrebackends/cequre-ts";
+var log2 = createLogger2("auth");
+function generateId() {
+  return ulid();
+}
+
+class JWTAuthenticator {
+  config;
+  adapter;
+  tokenStore;
+  collections;
+  platformAdminCollection;
+  cleanupTimer;
+  constructor(config, adapter, tokenStore, collections, platformAdminCollection) {
+    this.config = config;
+    this.adapter = adapter;
+    this.tokenStore = tokenStore ?? new InMemoryTokenStore;
+    this.collections = collections;
+    this.platformAdminCollection = platformAdminCollection;
+    this.cleanupTimer = setInterval(() => this.tokenStore.purgeExpired(), 5 * 60 * 1000);
+    this.cleanupTimer.unref();
+  }
+  async generateTokenPair(user, collection) {
+    const userId = user.id;
+    const role = user.role;
+    const secretKey = new TextEncoder().encode(this.config.secret);
+    let additionalPayload = {};
+    if (this.platformAdminCollection && collection === this.platformAdminCollection) {
+      additionalPayload.isPlatformAdmin = true;
+    }
+    if (this.collections) {
+      const colConfig = this.collections.find((c) => c.slug === collection);
+      if (colConfig) {
+        for (const field of colConfig.fields ?? []) {
+          if (field.saveToJWT) {
+            if (field.type === "link" && field.on && field.target) {
+              try {
+                const linkRes = await this.adapter.find(field.target, { where: { [field.on]: { eq: userId } }, limit: 1 });
+                if (linkRes && linkRes.docs && linkRes.docs.length > 0) {
+                  additionalPayload[field.name] = linkRes.docs[0].id;
+                }
+              } catch (e) {}
+            } else if (user[field.name] !== undefined) {
+              additionalPayload[field.name] = user[field.name];
+            }
+          }
+        }
+      }
+    }
+    let accessBuilder = new SignJWT({ sub: userId, collection, role, ...additionalPayload }).setProtectedHeader({ alg: "HS256" }).setJti(generateId()).setExpirationTime(this.config.accessTokenExpiry ?? "15m");
+    const accessToken = await accessBuilder.sign(secretKey);
+    let refreshBuilder = new SignJWT({
+      sub: userId,
+      collection,
+      role,
+      type: "refresh"
+    }).setProtectedHeader({ alg: "HS256" }).setJti(generateId()).setExpirationTime(this.config.refreshTokenExpiry ?? "7d");
+    const refreshToken = await refreshBuilder.sign(secretKey);
+    const tokenHash = await sha256Hex(refreshToken);
+    const expiresAt = Date.now() + 7 * 24 * 60 * 60 * 1000;
+    await this.tokenStore.store(tokenHash, { userId, collection, role, expiresAt });
+    return {
+      accessToken,
+      refreshToken,
+      user: { id: userId, collection, role, ...user }
+    };
+  }
+  async refreshTokenPair(refreshToken) {
+    let result;
+    try {
+      result = await jwtVerify(refreshToken, new TextEncoder().encode(this.config.secret));
+    } catch {
+      return null;
+    }
+    const { payload } = result;
+    if (payload.type !== "refresh")
+      return null;
+    const tokenHash = await sha256Hex(refreshToken);
+    const entry = await this.tokenStore.lookup(tokenHash);
+    if (!entry)
+      return null;
+    await this.tokenStore.revoke(tokenHash);
+    try {
+      const user = await this.adapter.findById(payload.collection, payload.sub);
+      if (!user)
+        return null;
+      return this.generateTokenPair(user, payload.collection);
+    } catch (err) {
+      log2.error({ err }, "Failed to look up user during refresh token rotation");
+      return null;
+    }
+  }
+  async verifyAccessToken(token) {
+    try {
+      const { payload } = await jwtVerify(token, new TextEncoder().encode(this.config.secret));
+      const { sub, collection, role, exp, iat, nbf, iss, aud, jti, type, ...rest } = payload;
+      return {
+        id: sub,
+        collection,
+        role,
+        ...rest
+      };
+    } catch {
+      if (this.config.previousSecret) {
+        try {
+          const { payload } = await jwtVerify(token, new TextEncoder().encode(this.config.previousSecret));
+          const { sub, collection, role, exp, iat, nbf, iss, aud, jti, type, ...rest } = payload;
+          return {
+            id: sub,
+            collection,
+            role,
+            ...rest
+          };
+        } catch {
+          return null;
+        }
+      }
+      return null;
+    }
+  }
+  async revokeRefreshToken(refreshToken) {
+    const tokenHash = await sha256Hex(refreshToken);
+    await this.tokenStore.revoke(tokenHash);
+  }
+  async revokeAllForUser(userId) {
+    await this.tokenStore.revokeAllForUser(userId);
+  }
+  async generatePasswordResetToken(userId, collection) {
+    const secretKey = new TextEncoder().encode(this.config.secret);
+    let resetBuilder = new SignJWT({ sub: userId, collection, type: "reset" }).setProtectedHeader({ alg: "HS256" }).setJti(generateId()).setExpirationTime("1h");
+    return resetBuilder.sign(secretKey);
+  }
+  async verifyPasswordResetToken(token) {
+    return this.verifyTypedToken(token, "reset");
+  }
+  async generateMFAChallengeToken(userId, collection) {
+    const secretKey = new TextEncoder().encode(this.config.secret);
+    let mfaBuilder = new SignJWT({ sub: userId, collection, type: "mfa" }).setProtectedHeader({ alg: "HS256" }).setJti(generateId()).setExpirationTime("5m");
+    return mfaBuilder.sign(secretKey);
+  }
+  async verifyMFAChallengeToken(token) {
+    return this.verifyTypedToken(token, "mfa");
+  }
+  async verifyTypedToken(token, expectedType) {
+    for (const secret of [this.config.secret, this.config.previousSecret]) {
+      if (!secret)
+        continue;
+      try {
+        const { payload } = await jwtVerify(token, new TextEncoder().encode(secret));
+        if (payload.type !== expectedType)
+          return null;
+        return {
+          userId: payload.sub,
+          collection: payload.collection
+        };
+      } catch {}
+    }
+    return null;
+  }
+}
+
+// src/audit.ts
+import { timingSafeEqual } from "@cequrebackends/cequre-ts";
+var AUDIT_HKDF_LABEL = "cequre-audit-v1";
+async function resolveAuditSecret(config) {
+  const explicit = config.security?.audit?.secret ?? process.env.CEQURE_AUDIT_SECRET;
+  const baseKey = explicit ?? process.env.JWT_SECRET ?? "";
+  if (!baseKey) {
+    throw new Error("Audit secret could not be resolved: provide audit.secret, CEQURE_AUDIT_SECRET, or JWT_SECRET.");
+  }
+  if (explicit) {
+    return crypto.subtle.importKey("raw", new TextEncoder().encode(explicit), { name: "HMAC", hash: "SHA-256" }, false, [
+      "sign",
+      "verify"
+    ]);
+  }
+  const ikm = await crypto.subtle.importKey("raw", new TextEncoder().encode(baseKey), "HKDF", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt: new Uint8Array, info: new TextEncoder().encode(AUDIT_HKDF_LABEL) }, ikm, { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+}
+function canonicalAuditPayload(event, prevHmac) {
+  return JSON.stringify({
+    action: event.action,
+    collection: event.collection ?? null,
+    recordId: event.recordId ?? null,
+    userId: event.userId ?? null,
+    requestId: event.requestId ?? null,
+    metadata: event.metadata ?? {},
+    prevHmac
+  });
+}
+async function computeAuditHmac(key, event, prevHmac) {
+  const data = new TextEncoder().encode(canonicalAuditPayload(event, prevHmac));
+  const sig = await crypto.subtle.sign("HMAC", key, data);
+  return Buffer.from(new Uint8Array(sig)).toString("hex");
+}
+async function verifyAuditHmac(key, event, prevHmac, storedHmac) {
+  const expected = await computeAuditHmac(key, event, prevHmac);
+  return timingSafeEqual(expected, storedHmac);
+}
+async function verifyAuditChain(key, entries) {
+  let prevHmac = null;
+  for (let i = 0;i < entries.length; i++) {
+    const entry = entries[i];
+    if (!entry)
+      continue;
+    const parsedMetadata = typeof entry.metadata === "string" ? JSON.parse(entry.metadata) : entry.metadata;
+    const ok = await verifyAuditHmac(key, { action: entry.action, collection: entry.collection, recordId: entry.recordId, userId: entry.userId, requestId: entry.requestId, metadata: parsedMetadata }, prevHmac, entry.hmac);
+    if (!ok)
+      return { ok: false, firstBadIndex: i };
+    prevHmac = entry.hmac;
+  }
+  return { ok: true, firstBadIndex: null };
+}
+
+// src/encryption.ts
+import { createLogger as createLogger3 } from "@cequrebackends/cequre-ts";
+var log3 = createLogger3("encryption");
+var ENCRYPTION_PREFIX = "enc:v1:";
+var HKDF_LABEL = "cequre-field-encryption-v1";
+async function resolveEncryptionKey(passphrase) {
+  if (!passphrase || passphrase.length < 16) {
+    throw new Error("Encryption key must be at least 16 characters. Set CEQURE_ENCRYPTION_KEY.");
+  }
+  const ikm = await crypto.subtle.importKey("raw", new TextEncoder().encode(passphrase), "HKDF", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt: new Uint8Array, info: new TextEncoder().encode(HKDF_LABEL) }, ikm, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+async function encryptField(key, plaintext) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const encoded = new TextEncoder().encode(plaintext);
+  const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, encoded);
+  const ivB64 = Buffer.from(iv).toString("base64");
+  const ctB64 = Buffer.from(new Uint8Array(ciphertext)).toString("base64");
+  return `${ENCRYPTION_PREFIX}${ivB64}:${ctB64}`;
+}
+async function decryptField(key, value) {
+  if (!value || !value.startsWith(ENCRYPTION_PREFIX))
+    return null;
+  try {
+    const payload = value.slice(ENCRYPTION_PREFIX.length);
+    const colonIdx = payload.indexOf(":");
+    if (colonIdx === -1)
+      return null;
+    const ivB64 = payload.slice(0, colonIdx);
+    const ctB64 = payload.slice(colonIdx + 1);
+    if (!ivB64 || !ctB64)
+      return null;
+    const iv = Buffer.from(ivB64, "base64");
+    const ciphertext = Buffer.from(ctB64, "base64");
+    const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ciphertext);
+    return new TextDecoder().decode(plaintext);
+  } catch (err) {
+    log3.warn({ err }, "Field decryption failed \u2014 wrong key or tampered ciphertext");
+    return null;
+  }
+}
+function isEncrypted(value) {
+  return typeof value === "string" && value.startsWith(ENCRYPTION_PREFIX);
+}
+// src/rate-limiter.ts
+import { parseDuration } from "@cequrebackends/cequre-ts";
+import { extractPathname } from "@cequrebackends/cequre-ts";
+function resolveClientIP(request, trustedProxies) {
+  const remoteAddr = request.__remoteAddr;
+  if (remoteAddr) {
+    if (!trustedProxies || trustedProxies.length === 0) {
+      return remoteAddr;
+    }
+    if (!trustedProxies.includes(remoteAddr)) {
+      return remoteAddr;
+    }
+  }
+  const xff = request.headers.get("x-forwarded-for");
+  if (xff) {
+    const first = xff.split(",")[0]?.trim();
+    if (first)
+      return first;
+  }
+  const xRealIP = request.headers.get("x-real-ip");
+  if (xRealIP)
+    return xRealIP.trim();
+  return remoteAddr || "unknown-ip";
+}
+
+class RateLimiter {
+  kv;
+  schema;
+  hasRateLimit;
+  trustedProxies;
+  constructor(schema, kv, trustedProxies) {
+    this.kv = kv;
+    this.schema = schema;
+    this.hasRateLimit = !!schema.security?.rateLimit;
+    this.trustedProxies = trustedProxies ?? schema.core?.api?.trustedProxies ?? [];
+  }
+  check(request) {
+    if (!this.hasRateLimit)
+      return null;
+    const rateLimitConfig = this.schema.security.rateLimit;
+    const method = request.method;
+    const pathname = extractPathname(request.url);
+    const isLogin = method === "POST" && (pathname.endsWith("/login") || pathname.endsWith("/register"));
+    const isWrite = (method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE") && !isLogin;
+    const isRead = method === "GET";
+    let config;
+    let type = "";
+    if (isLogin && rateLimitConfig.login) {
+      config = rateLimitConfig.login;
+      type = "login";
+    } else if (isWrite && rateLimitConfig.write) {
+      config = rateLimitConfig.write;
+      type = "write";
+    } else if (isRead && rateLimitConfig.read) {
+      config = rateLimitConfig.read;
+      type = "read";
+    }
+    if (!config || !config.max)
+      return null;
+    const envMax = Number(globalThis.process?.env?.RATE_LIMIT_MAX);
+    if (!Number.isNaN(envMax) && envMax > 0) {
+      config = { ...config, max: Math.max(config.max, envMax) };
+    }
+    const windowSec = parseDuration(config.window || "1m");
+    const clientIP = resolveClientIP(request, this.trustedProxies);
+    const key = `ratelimit:${type}:${clientIP}`;
+    return this._doCheckAsync(key, config.max, windowSec);
+  }
+  async _doCheckAsync(key, max, windowSec) {
+    const current = await this.kv.get(key) || 0;
+    if (current >= max) {
+      return new Response(JSON.stringify({ error: "Too Many Requests" }), { status: 429, headers: { "Content-Type": "application/json" } });
+    }
+    await this.kv.set(key, current + 1, windowSec);
+    return null;
+  }
+}
+
+// src/index.ts
+init_mfa();
+
+// src/secrets.ts
+class EnvVarSecrets {
+  async getSecret(name) {
+    return process.env[name] ?? null;
+  }
+  async listSecrets() {
+    return Object.keys(process.env).filter((k) => k.startsWith("CEQURE_") || k === "JWT_SECRET");
+  }
+}
+// src/webhooks.ts
+var HEADER_PREFIX = "X-Cequre-Signature";
+async function signWebhook(secret, payload, timestamp) {
+  const ts = timestamp ?? Math.floor(Date.now() / 1000);
+  const signedPayload = `${ts}.${payload}`;
+  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(signedPayload));
+  const hex = Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return `t=${ts},v1=${hex}`;
+}
+var WEBHOOK_SIGNATURE_HEADER = HEADER_PREFIX;
+async function verifyWebhookSignature(secret, headerValue, payload, toleranceSeconds = 300) {
+  const parts = headerValue.split(",");
+  let ts = null;
+  let v1 = null;
+  for (const part of parts) {
+    const [key2, value] = part.split("=");
+    if (key2 === "t" && value)
+      ts = parseInt(value, 10);
+    if (key2 === "v1" && value)
+      v1 = value;
+  }
+  if (ts === null || v1 === null)
+    return false;
+  const now = Math.floor(Date.now() / 1000);
+  if (Math.abs(now - ts) > toleranceSeconds)
+    return false;
+  const signedPayload = `${ts}.${payload}`;
+  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(signedPayload));
+  const expectedHex = Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  if (expectedHex.length !== v1.length)
+    return false;
+  let diff = 0;
+  for (let i = 0;i < expectedHex.length; i++) {
+    diff |= expectedHex.charCodeAt(i) ^ v1.charCodeAt(i);
+  }
+  return diff === 0;
+}
+
+// src/index.ts
+init_auth_routes();
+function defaultSecurity() {
+  return {
+    name: "core:security",
+    onInit: async (cequre) => {
+      if (cequre.schema.security?.auth?.strategies?.includes("jwt")) {
+        const secret = process.env.JWT_SECRET;
+        if (!secret) {
+          throw new Error("JWT_SECRET environment variable is required when JWT auth strategy is enabled in config.cequre.");
+        }
+        const jwtSettings = cequre.schema.security.auth.jwt || {};
+        const tokenStore = cequre.adapter.getSystemTableStatements ? new AdapterTokenStore(cequre.adapter) : new InMemoryTokenStore;
+        const { setupAuthRoutes: setupAuthRoutes2 } = (init_auth_routes(), __toCommonJS(exports_auth_routes));
+        setupAuthRoutes2(cequre);
+        cequre.setAuthEngine(new JWTAuthenticator({
+          secret,
+          previousSecret: process.env.JWT_PREVIOUS_SECRET || undefined,
+          accessTokenExpiry: jwtSettings.accessTokenExpiry || "15m",
+          refreshTokenExpiry: jwtSettings.refreshTokenExpiry || "7d"
+        }, cequre.adapter, tokenStore, cequre.schema.collections, cequre.schema.adminUI?.user));
+      }
+      if (cequre.schema.security?.audit?.enabled === true) {
+        cequre.enableAudit(resolveAuditSecret(cequre.schema), cequre.schema.security?.audit?.retentionDays);
+      }
+      if (cequre.schema.security?.secrets?.enabled) {
+        const keyEnvVar = cequre.schema.security.secrets.encryptionKey || "CEQURE_ENCRYPTION_KEY";
+        const passphrase = process.env[keyEnvVar];
+        if (!passphrase) {
+          console.error(`Field encryption is enabled but ${keyEnvVar} is not set. Encryption will not be active.`);
+        } else {
+          cequre.enableEncryption(resolveEncryptionKey(passphrase));
+        }
+      }
+      setupAuthRoutes(cequre);
+    },
+    onCompile: (ctx) => {
+      if (ctx.phase === "request.start") {
+        let snippet = "";
+        snippet += `
+          if (!!${ctx.vars.ctx}.options.rateLimiter) {
+            const rateResult = ${ctx.vars.ctx}.options.rateLimiter.check(${ctx.vars.request});
+            if (rateResult instanceof Promise) {
+              return rateResult.then((rateRes) => rateRes ?? dispatch(${ctx.vars.request}, ${ctx.vars.server}, ${ctx.vars.pluginState}));
+            }
+            if (rateResult) return ${ctx.vars.ctx}.hasResponseHeaders ? ${ctx.vars.ctx}.withHeaders(rateResult, ${ctx.vars.ctx}.requestResponseHeaders(${ctx.vars.request}, undefined)) : rateResult;
+          }
+        `;
+        snippet += `
+          if (!!${ctx.vars.ctx}.options.idempotencyKV && ["POST", "PUT", "PATCH"].includes(${ctx.vars.ctx}.route.method)) {
+            const idempotencyKey = ${ctx.vars.request}.headers.get("idempotency-key");
+            if (idempotencyKey) {
+              const cacheKey = \`idempotency:\${idempotencyKey}\`;
+              return ${ctx.vars.ctx}.options.idempotencyKV.get(cacheKey).then(async (cached) => {
+                if (cached) {
+                  const { status, body, contentType } = JSON.parse(cached);
+                  const cachedRes = new Response(body, { status, headers: { "Content-Type": contentType || "application/json", "X-Idempotent-Replay": "true" } });
+                  return ${ctx.vars.ctx}.hasResponseHeaders ? ${ctx.vars.ctx}.withHeaders(cachedRes, ${ctx.vars.ctx}.requestResponseHeaders(${ctx.vars.request}, undefined)) : cachedRes;
+                }
+                const res = dispatch(${ctx.vars.request}, ${ctx.vars.server}, ${ctx.vars.pluginState});
+                const resolved = res instanceof Promise ? await res : res;
+                if (resolved && resolved.status >= 200 && resolved.status < 400) {
+                  const resBody = await resolved.text();
+                  const entry = JSON.stringify({ status: resolved.status, body: resBody, contentType: resolved.headers.get("Content-Type") || "application/json" });
+                  await ${ctx.vars.ctx}.options.idempotencyKV.set(cacheKey, entry, 24 * 60 * 60);
+                  const newRes = new Response(resBody, { status: resolved.status, headers: { "Content-Type": resolved.headers.get("Content-Type") || "application/json" } });
+                  return ${ctx.vars.ctx}.hasResponseHeaders ? ${ctx.vars.ctx}.withHeaders(newRes, ${ctx.vars.ctx}.requestResponseHeaders(${ctx.vars.request}, undefined)) : newRes;
+                }
+                return resolved;
+              });
+            }
+          }
+        `;
+        return snippet;
+      }
+      if (ctx.phase === "beforeHandler") {
+        let snippet = "";
+        snippet += `
+          if (["POST", "PUT", "PATCH", "DELETE"].includes(${ctx.vars.ctx}.route.method)) {
+            const handlerReq = ${ctx.vars.routeCtx}.request;
+            const hasCookie = handlerReq.headers.has("cookie");
+            if (hasCookie) {
+              const origin = handlerReq.headers.get("origin");
+              const referer = handlerReq.headers.get("referer");
+              const host = handlerReq.headers.get("host");
+              const hasCustomHeader = handlerReq.headers.get("x-cequre-csrf") !== null ||
+                                      handlerReq.headers.get("x-csrf-token") !== null ||
+                                      handlerReq.headers.get("x-requested-with") !== null;
+
+              let isSameOrigin = false;
+              if (origin) {
+                try { isSameOrigin = new URL(origin).host === host; } catch {}
+              } else if (referer) {
+                try { isSameOrigin = new URL(referer).host === host; } catch {}
+              }
+              if (!isSameOrigin && origin && Array.isArray(${ctx.vars.ctx}.options.csrfTrustedOrigins)) {
+                isSameOrigin = ${ctx.vars.ctx}.options.csrfTrustedOrigins.includes(origin);
+              }
+
+              if (!isSameOrigin && !hasCustomHeader) {
+                throw new ${ctx.vars.ctx}.CequreError("CSRF verification failed. Missing secure origin or custom header.", "CSRF_ERROR", 403);
+              }
+            }
+          }
+        `;
+        snippet += `
+          if (${ctx.vars.ctx}.route.options?.authRequired === true && !${ctx.vars.routeCtx}.user) {
+            throw new ${ctx.vars.ctx}.CequreError("Authentication required", "UNAUTHORIZED", 401);
+          }
+        `;
+        return snippet;
+      }
+      return;
+    }
+  };
+}
+export {
+  verifyWebhookSignature,
+  verifyTOTP,
+  verifyAuditHmac,
+  verifyAuditChain,
+  signWebhook,
+  resolveEncryptionKey,
+  resolveClientIP,
+  resolveAuditSecret,
+  isEncrypted,
+  hashBackupCode,
+  generateTOTPSecret,
+  generateTOTP,
+  generateOTPAuthURI,
+  generateBackupCodes,
+  encryptField,
+  defaultSecurity,
+  decryptField,
+  computeAuditHmac,
+  WEBHOOK_SIGNATURE_HEADER,
+  RateLimiter,
+  REFRESH_TOKEN_COLLECTION,
+  JWTAuthenticator,
+  InMemoryTokenStore,
+  EnvVarSecrets,
+  AdapterTokenStore
+};