@sonicjs-cms/core 2.18.1 → 3.0.0-beta.10

package/dist/chunk-IDCZBF35.js

@@ -0,0 +1,1186 @@
+import { RbacService } from './chunk-BLMTL57B.js';
+import { loadCollectionConfigs, getCollectionRegistry, PluginBootstrapService, getTelemetryService } from './chunk-PYVFXCSD.js';
+import { ensureScalarSchema, MigrationService } from './chunk-ALDRXTUO.js';
+import { init_admin_layout_catalyst_template, setBranchLabel } from './chunk-5V62WT6M.js';
+import { hasHookSystem, getHookSystem } from './chunk-RNZFGN4R.js';
+import { metricsTracker } from './chunk-FICTAGD4.js';
+import { z } from 'zod';
+import { sign, verify } from 'hono/jwt';
+import { getCookie, setCookie } from 'hono/cookie';
+
+// src/services/document-type-registry.ts
+function rowToDocumentType(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    displayName: row.display_name,
+    description: row.description,
+    schema: JSON.parse(row.schema),
+    queryableFields: JSON.parse(row.queryable_fields),
+    settings: JSON.parse(row.settings),
+    pluginId: row.plugin_id,
+    source: row.source,
+    schemaVersion: row.schema_version,
+    isSystem: row.is_system === 1,
+    isActive: row.is_active === 1,
+    isAuth: row.is_auth === 1,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+var DocumentTypeRegistry = class {
+  constructor(db) {
+    this.db = db;
+  }
+  cache = /* @__PURE__ */ new Map();
+  // Register or update a document type. Idempotent: bumps schema_version only when schema changes.
+  async register(def) {
+    const now = Math.floor(Date.now() / 1e3);
+    const existing = await this.findById(def.id);
+    const schemaJson = JSON.stringify({ queryableFields: def.queryableFields ?? [], settings: def.settings ?? {} });
+    const queryableJson = JSON.stringify(def.queryableFields ?? []);
+    const settingsJson = JSON.stringify(def.settings ?? {});
+    if (existing) {
+      const schemaChanged = schemaJson !== JSON.stringify(existing.schema);
+      const newVersion = schemaChanged ? existing.schemaVersion + 1 : existing.schemaVersion;
+      await this.db.prepare(
+        `UPDATE document_types SET
+             display_name = ?,
+             description = ?,
+             schema = ?,
+             queryable_fields = ?,
+             settings = ?,
+             plugin_id = ?,
+             schema_version = ?,
+             is_active = 1,
+             is_auth = ?,
+             updated_at = ?
+           WHERE id = ?`
+      ).bind(
+        def.displayName,
+        def.description ?? null,
+        schemaJson,
+        queryableJson,
+        settingsJson,
+        def.pluginId ?? null,
+        newVersion,
+        def.isAuth ? 1 : 0,
+        now,
+        def.id
+      ).run();
+      await ensureScalarSchema(this.db, def.id, def.queryableFields ?? []);
+      const updated = await this.findById(def.id);
+      this.cache.set(def.id, updated);
+      return updated;
+    }
+    await this.db.prepare(
+      `INSERT INTO document_types (id, name, display_name, description, schema, queryable_fields, settings, plugin_id, source, schema_version, is_system, is_active, is_auth, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 1, 0, 1, ?, ?, ?)`
+    ).bind(
+      def.id,
+      def.name ?? def.id,
+      def.displayName,
+      def.description ?? null,
+      schemaJson,
+      queryableJson,
+      settingsJson,
+      def.pluginId ?? null,
+      def.source ?? "code",
+      def.isAuth ? 1 : 0,
+      now,
+      now
+    ).run();
+    await ensureScalarSchema(this.db, def.id, def.queryableFields ?? []);
+    const created = await this.findById(def.id);
+    this.cache.set(def.id, created);
+    return created;
+  }
+  async findById(id) {
+    if (this.cache.has(id)) return this.cache.get(id);
+    const row = await this.db.prepare("SELECT * FROM document_types WHERE id = ?").bind(id).first();
+    if (!row) return null;
+    const dt = rowToDocumentType(row);
+    this.cache.set(id, dt);
+    return dt;
+  }
+  async findAll(activeOnly = true) {
+    const sql = activeOnly ? "SELECT * FROM document_types WHERE is_active = 1 ORDER BY name" : "SELECT * FROM document_types ORDER BY name";
+    const result = await this.db.prepare(sql).all();
+    return (result.results ?? []).map(rowToDocumentType);
+  }
+  async deactivate(id) {
+    const now = Math.floor(Date.now() / 1e3);
+    await this.db.prepare("UPDATE document_types SET is_active = 0, updated_at = ? WHERE id = ?").bind(now, id).run();
+    this.cache.delete(id);
+  }
+  clearCache() {
+    this.cache.clear();
+  }
+};
+
+// src/services/document-types-seed.ts
+var anyObject = z.record(z.string(), z.unknown());
+async function bootstrapDocumentTypes(db) {
+  const registry = new DocumentTypeRegistry(db);
+  await registry.register({
+    id: "site_settings",
+    name: "site_settings",
+    displayName: "Site Settings",
+    description: "Global site configuration (internal; managed via admin settings UI)",
+    source: "system",
+    schema: anyObject,
+    settings: {
+      internal: true,
+      maxVersionsPerRoot: 1,
+      baseGrants: { admin: ["read", "create", "update", "delete", "manage"] }
+    },
+    queryableFields: []
+  });
+  await registry.register({
+    id: "blog_post",
+    name: "blog_post",
+    displayName: "Blog Post",
+    description: "Blog post (document-backed; edited via the content collection UI)",
+    source: "system",
+    schema: anyObject,
+    settings: {
+      baseGrants: { public: ["read"], admin: ["read", "create", "update", "delete", "publish", "manage"], editor: ["read", "create", "update", "publish"], viewer: ["read"] },
+      maxVersionsPerRoot: 50
+    },
+    queryableFields: [
+      { name: "difficulty", kind: "scalar", type: "text", column: "q_blog_difficulty" },
+      { name: "author", kind: "scalar", type: "text", column: "q_blog_author" }
+    ]
+  });
+  await registry.register({
+    id: "plugin",
+    name: "plugin",
+    displayName: "Plugin",
+    description: "System plugin record (managed by the plugin bootstrap service)",
+    source: "system",
+    schema: anyObject,
+    settings: {
+      baseGrants: { admin: ["read", "create", "update", "delete", "publish", "manage"] },
+      maxVersionsPerRoot: 1,
+      internal: true
+    },
+    queryableFields: [
+      { name: "status", kind: "scalar", type: "text", column: "q_plugin_status" },
+      { name: "category", kind: "scalar", type: "text", column: "q_plugin_category" },
+      { name: "isCore", kind: "scalar", type: "integer", column: "q_plugin_is_core" }
+    ]
+  });
+  await registry.register({
+    id: "tenant",
+    name: "tenant",
+    displayName: "Tenant",
+    description: "Tenant record (managed by the multi-tenant plugin; slug = tenant id)",
+    source: "system",
+    schema: anyObject,
+    settings: {
+      baseGrants: { admin: ["read", "create", "update", "delete", "manage"] },
+      maxVersionsPerRoot: 1,
+      internal: true
+    },
+    queryableFields: [
+      { name: "status", kind: "scalar", type: "text", column: "q_tenant_status" },
+      { name: "domain", kind: "scalar", type: "text", column: "q_tenant_domain" }
+    ]
+  });
+  await registry.register({
+    id: "user_profile",
+    name: "user_profile",
+    displayName: "User Profile",
+    description: "Per-user profile record (auth-owned; one document per user, slug = userId)",
+    source: "system",
+    isAuth: true,
+    schema: anyObject,
+    settings: {
+      // Hidden from the content admin surfaces; a single mutable record (no version history).
+      internal: true,
+      maxVersionsPerRoot: 1,
+      pii: true,
+      baseGrants: { admin: ["read", "create", "update", "delete", "manage"] }
+    },
+    queryableFields: []
+  });
+  await registry.register({
+    id: "media_asset",
+    name: "media_asset",
+    displayName: "Media Asset",
+    description: "Uploaded media file metadata (managed via the media library; backs an R2 object)",
+    source: "system",
+    schema: anyObject,
+    settings: {
+      internal: true,
+      maxVersionsPerRoot: 5,
+      baseGrants: {
+        admin: ["read", "create", "update", "delete", "manage"],
+        editor: ["read", "create", "update"],
+        author: ["read", "create"],
+        viewer: ["read"]
+      }
+    },
+    queryableFields: [
+      { name: "mimeType", kind: "scalar", type: "text", column: "q_media_mime" },
+      { name: "folder", kind: "scalar", type: "text", column: "q_media_folder" },
+      { name: "size", kind: "scalar", type: "integer", column: "q_media_size" },
+      { name: "tags", kind: "facet", type: "text" }
+    ]
+  });
+  await registry.register({
+    id: "plugin_activity",
+    name: "plugin_activity",
+    displayName: "Plugin Activity",
+    description: "Plugin lifecycle event log (installed/activated/deactivated/settings_updated/error)",
+    source: "system",
+    schema: anyObject,
+    settings: {
+      internal: true,
+      maxVersionsPerRoot: 1,
+      baseGrants: { admin: ["read", "create", "manage"] }
+    },
+    queryableFields: [
+      { name: "pluginId", kind: "scalar", type: "text", column: "q_plugin_activity_plugin_id" },
+      { name: "action", kind: "scalar", type: "text", column: "q_plugin_activity_action" }
+    ]
+  });
+  await registry.register({
+    id: "security_event",
+    name: "security_event",
+    displayName: "Security Event",
+    description: "Security audit event (login attempts, lockouts, suspicious activity)",
+    source: "system",
+    schema: anyObject,
+    settings: {
+      internal: true,
+      maxVersionsPerRoot: 1,
+      baseGrants: { admin: ["read", "create", "manage"] }
+    },
+    queryableFields: [
+      { name: "eventType", kind: "scalar", type: "text", column: "q_sa_event_type" },
+      { name: "severity", kind: "scalar", type: "text", column: "q_sa_severity" },
+      { name: "userId", kind: "scalar", type: "text", column: "q_sa_user_id" },
+      { name: "email", kind: "scalar", type: "text", column: "q_sa_email" },
+      { name: "ipAddress", kind: "scalar", type: "text", column: "q_sa_ip_address" },
+      { name: "blocked", kind: "scalar", type: "integer", column: "q_sa_blocked" }
+    ]
+  });
+  await registry.register({
+    id: "analytics_event",
+    name: "analytics_event",
+    displayName: "Analytics Event",
+    description: "Tracked analytics event (page view, user action, custom event)",
+    source: "system",
+    schema: anyObject,
+    settings: {
+      internal: true,
+      maxVersionsPerRoot: 1,
+      baseGrants: { admin: ["read", "create", "manage"] }
+    },
+    queryableFields: [
+      { name: "event", kind: "scalar", type: "text", column: "q_evt_event" },
+      { name: "category", kind: "scalar", type: "text", column: "q_evt_category" },
+      { name: "userId", kind: "scalar", type: "text", column: "q_evt_user_id" },
+      { name: "sessionId", kind: "scalar", type: "text", column: "q_evt_session_id" },
+      { name: "path", kind: "scalar", type: "text", column: "q_evt_path" }
+    ]
+  });
+  await registry.register({
+    id: "media_asset",
+    name: "media_asset",
+    displayName: "Media Asset",
+    description: "Media file metadata (R2 object key + intrinsic properties; URL derived at read time)",
+    source: "system",
+    schema: anyObject,
+    settings: {
+      baseGrants: { public: ["read"], admin: ["read", "create", "update", "delete", "publish", "manage"], editor: ["read", "create", "update"] },
+      maxVersionsPerRoot: 5
+    },
+    queryableFields: [
+      { name: "mimeType", kind: "scalar", type: "text", column: "q_media_mime" },
+      { name: "folder", kind: "scalar", type: "text", column: "q_media_folder" },
+      { name: "size", kind: "scalar", type: "integer", column: "q_media_size" },
+      { name: "tags", kind: "facet", type: "text" }
+    ]
+  });
+  for (const [id, displayName, description] of [
+    ["rbac_role", "RBAC Role", "Role record with embedded grants (auth-owned)"],
+    ["rbac_verb", "RBAC Verb", "Permission verb (auth-owned)"],
+    ["rbac_user_roles", "RBAC User Roles", "Per-user role assignments (auth-owned; slug = userId)"]
+  ]) {
+    await registry.register({
+      id,
+      name: id,
+      displayName,
+      description,
+      source: "system",
+      isAuth: true,
+      schema: anyObject,
+      settings: {
+        internal: true,
+        maxVersionsPerRoot: 1,
+        baseGrants: { admin: ["read", "create", "update", "delete", "manage"] }
+      },
+      queryableFields: []
+    });
+  }
+}
+async function autoRegisterCollectionDocumentTypes(db) {
+  const registry = new DocumentTypeRegistry(db);
+  const collections = getCollectionRegistry().listActive();
+  const registered = [];
+  for (const collection of collections) {
+    if (collection.internal) continue;
+    if (collection.name === "blog_post") continue;
+    try {
+      await registry.register({
+        id: collection.name,
+        name: collection.name,
+        displayName: collection.displayName,
+        description: collection.description,
+        source: "system",
+        schema: anyObject,
+        settings: {
+          baseGrants: {
+            public: ["read"],
+            admin: ["read", "create", "update", "delete", "publish", "manage"],
+            editor: ["read", "create", "update", "publish"],
+            viewer: ["read"]
+          },
+          maxVersionsPerRoot: 50,
+          ...collection.versioning ? { versioning: true } : {}
+        },
+        queryableFields: []
+      });
+      registered.push(collection.name);
+    } catch (error) {
+      console.error(`[document-types-seed] Failed to register collection "${collection.name}":`, error);
+    }
+  }
+  return registered;
+}
+
+// src/middleware/bootstrap.ts
+init_admin_layout_catalyst_template();
+var bootstrapComplete = false;
+function verifySecurityConfig(env) {
+  const warnings = [];
+  if (!env.JWT_SECRET) {
+    warnings.push(
+      "JWT_SECRET is not set \u2014 using hardcoded fallback. Set via `wrangler secret put JWT_SECRET`"
+    );
+  } else if (env.JWT_SECRET.includes("change-in-production")) {
+    warnings.push(
+      "JWT_SECRET contains the default value \u2014 tokens are forgeable. Generate a strong random secret"
+    );
+  }
+  if (!env.CORS_ORIGINS) {
+    warnings.push(
+      "CORS_ORIGINS is not set \u2014 all cross-origin API requests will be rejected"
+    );
+  }
+  if (!env.ENVIRONMENT) {
+    warnings.push(
+      'ENVIRONMENT is not set \u2014 HSTS header will not be applied. Set to "production" or "development"'
+    );
+  }
+  if (warnings.length === 0) {
+    return;
+  }
+  const isProduction = env.ENVIRONMENT === "production";
+  for (const warning of warnings) {
+    console.warn(`[SonicJS Security] ${warning}`);
+  }
+  if (isProduction) {
+    const hasCritical = !env.JWT_SECRET || env.JWT_SECRET.includes("change-in-production");
+    if (hasCritical) {
+      throw new Error(
+        "[SonicJS Security] CRITICAL: Production deployment is missing a secure JWT_SECRET. Set it via `wrangler secret put JWT_SECRET` before deploying."
+      );
+    }
+  }
+}
+function bootstrapMiddleware(config = {}) {
+  return async (c, next) => {
+    if (hasHookSystem()) {
+      c.set("hookSystem", getHookSystem());
+    }
+    if (bootstrapComplete) {
+      return next();
+    }
+    const path = c.req.path;
+    if (path.startsWith("/images/") || path.startsWith("/assets/") || path === "/health" || path.endsWith(".js") || path.endsWith(".css") || path.endsWith(".png") || path.endsWith(".jpg") || path.endsWith(".ico")) {
+      return next();
+    }
+    const host = c.req.header("host") || "";
+    const isLocalhost = host.includes("localhost") || host.includes("127.0.0.1");
+    const gitBranch = c.env.GIT_BRANCH;
+    setBranchLabel(isLocalhost && gitBranch ? gitBranch : void 0);
+    try {
+      console.log("[Bootstrap] Starting system initialization...");
+      console.log("[Bootstrap] Checking schema compatibility...");
+      const migrationService = new MigrationService(c.env.DB);
+      await migrationService.ensureSchemaCompatibility();
+      try {
+        const kv = c.env.CACHE_KV;
+        if (kv) {
+          const { setGlobalKVNamespace } = await import('./cache-DDARE4QE.js');
+          setGlobalKVNamespace(kv);
+        }
+      } catch (error) {
+        console.error("[Bootstrap] Error wiring CACHE_KV namespace:", error);
+      }
+      console.log("[Bootstrap] Populating collection registry...");
+      try {
+        const configs = await loadCollectionConfigs();
+        getCollectionRegistry().register(configs);
+        console.log(`[Bootstrap] Registry populated with ${configs.length} collection(s)`);
+      } catch (error) {
+        console.error("[Bootstrap] Error populating collection registry:", error);
+      }
+      console.log("[Bootstrap] Registering document types...");
+      try {
+        await bootstrapDocumentTypes(c.env.DB);
+      } catch (error) {
+        console.error("[Bootstrap] Error registering document types:", error);
+      }
+      try {
+        await repairMissingCredentialAccounts(c.env.DB);
+      } catch (error) {
+        console.error("[Bootstrap] Error repairing credential accounts:", error);
+      }
+      try {
+        const { RbacService: RbacService2 } = await import('./rbac-O73MFKDA.js');
+        await new RbacService2(c.env.DB, c.env.CACHE_KV).ensureSystemRbacSeed();
+      } catch (error) {
+        console.error("[Bootstrap] Error seeding RBAC documents:", error);
+      }
+      try {
+        const auto = await autoRegisterCollectionDocumentTypes(c.env.DB);
+        if (auto.length) console.log(`[Bootstrap] Document-backed collections registered: ${auto.join(", ")}`);
+      } catch (error) {
+        console.error("[Bootstrap] Error auto-registering collection document types:", error);
+      }
+      if (!config.plugins?.disableAll) {
+        console.log("[Bootstrap] Bootstrapping core plugins...");
+        const bootstrapService = new PluginBootstrapService(c.env.DB);
+        const needsBootstrap = await bootstrapService.isBootstrapNeeded();
+        if (needsBootstrap) {
+          await bootstrapService.bootstrapCorePlugins();
+        }
+      } else {
+        console.log("[Bootstrap] Plugin bootstrap skipped (disableAll is true)");
+      }
+      bootstrapComplete = true;
+      console.log("[Bootstrap] System initialization completed");
+      try {
+        const registry = getCollectionRegistry();
+        const collections = registry.listActive();
+        const countResult = await c.env.DB.prepare(
+          `SELECT type_id, COUNT(*) AS cnt FROM documents
+           WHERE is_current_draft = 1 AND deleted_at IS NULL GROUP BY type_id`
+        ).all();
+        const countMap = {};
+        let docTotal = 0;
+        for (const row of countResult.results ?? []) {
+          countMap[row.type_id] = row.cnt;
+          docTotal += row.cnt;
+        }
+        const fieldTypeHistogram = {};
+        for (const col of collections) {
+          const props = col.schema?.properties ?? {};
+          for (const field of Object.values(props)) {
+            const ft = field?.type ?? "unknown";
+            fieldTypeHistogram[ft] = (fieldTypeHistogram[ft] ?? 0) + 1;
+          }
+        }
+        const activePlugins = (config.plugins?.register ?? []).map((p) => p.name ?? "unknown");
+        let installationId = "unknown";
+        try {
+          const kv = c.env.KV;
+          if (kv) {
+            installationId = await kv.get("_sonicjs_installation_id") ?? "";
+            if (!installationId) {
+              installationId = crypto.randomUUID();
+              await kv.put("_sonicjs_installation_id", installationId);
+            }
+          }
+        } catch {
+        }
+        const telemetry = getTelemetryService();
+        await telemetry.trackProjectSnapshot({
+          installation_id: installationId,
+          collection_names: collections.map((c2) => c2.name),
+          collection_counts: countMap,
+          active_plugins: activePlugins,
+          field_type_histogram: fieldTypeHistogram,
+          doc_total: docTotal,
+          sonicjs_version: c.env.SONICJS_VERSION ?? "unknown"
+        });
+      } catch {
+      }
+    } catch (error) {
+      console.error("[Bootstrap] Error during system initialization:", error);
+    }
+    verifySecurityConfig(c.env);
+    return next();
+  };
+}
+async function repairMissingCredentialAccounts(db) {
+  const { results } = await db.prepare(`
+    SELECT u.id, u.password_hash
+    FROM auth_user u
+    WHERE u.password_hash IS NOT NULL AND u.password_hash != ''
+    AND NOT EXISTS (
+      SELECT 1 FROM auth_account a
+      WHERE a.user_id = u.id AND a.provider_id = 'credential'
+    )
+  `).all();
+  if (!results.length) return;
+  console.log(`[Bootstrap] Repairing ${results.length} user(s) missing credential auth_account rows`);
+  const nowSec = Math.floor(Date.now() / 1e3);
+  for (const user of results) {
+    await db.prepare(`
+      INSERT OR IGNORE INTO auth_account (id, user_id, account_id, provider_id, password, created_at, updated_at)
+      VALUES (?, ?, ?, 'credential', ?, ?, ?)
+    `).bind(`cred-${user.id}`, user.id, user.id, user.password_hash, nowSec, nowSec).run();
+  }
+  console.log(`[Bootstrap] Credential account repair complete (${results.length} repaired)`);
+}
+var JWT_SECRET_FALLBACK = "your-super-secret-jwt-key-change-in-production";
+var DEFAULT_JWT_EXPIRES_IN_SECONDS = 60 * 60 * 24 * 30;
+function parseDuration(input) {
+  if (input === void 0 || input === null || input === "") return null;
+  if (typeof input === "number" && Number.isFinite(input) && input > 0) {
+    return Math.floor(input);
+  }
+  const raw = String(input).trim();
+  if (/^\d+$/.test(raw)) {
+    const n = parseInt(raw, 10);
+    return n > 0 ? n : null;
+  }
+  const match = raw.match(/^(\d+)\s*(s|sec|secs|seconds|m|min|mins|minutes|h|hr|hrs|hours|d|day|days)$/i);
+  if (!match) return null;
+  const value = parseInt(match[1], 10);
+  const unit = match[2].toLowerCase();
+  if (unit.startsWith("s")) return value;
+  if (unit.startsWith("m")) return value * 60;
+  if (unit.startsWith("h")) return value * 60 * 60;
+  if (unit.startsWith("d")) return value * 60 * 60 * 24;
+  return null;
+}
+function getJwtExpirySeconds(env) {
+  const configured = parseDuration(env?.JWT_EXPIRES_IN);
+  return configured ?? DEFAULT_JWT_EXPIRES_IN_SECONDS;
+}
+async function getJwtExpirySecondsFromDb(db, env) {
+  const envParsed = parseDuration(env?.JWT_EXPIRES_IN);
+  if (envParsed) return envParsed;
+  if (db) {
+    try {
+      const row = await db.prepare("SELECT data FROM documents WHERE type_id = 'site_settings' AND slug = 'security' AND tenant_id = 'default' AND is_current_draft = 1 AND deleted_at IS NULL").first();
+      if (row?.data) {
+        const data = JSON.parse(row.data);
+        const parsed = parseDuration(data.jwtExpiresIn);
+        if (parsed) return parsed;
+      }
+    } catch (err) {
+      console.warn("Failed to read jwtExpiresIn from settings, falling back to default:", err);
+    }
+  }
+  return DEFAULT_JWT_EXPIRES_IN_SECONDS;
+}
+async function getJwtRefreshGraceSecondsFromDb(db, env) {
+  const DEFAULT_GRACE = 60 * 60 * 24 * 7;
+  const envParsed = parseDuration(env?.JWT_REFRESH_GRACE_SECONDS);
+  if (envParsed) return envParsed;
+  if (db) {
+    try {
+      const row = await db.prepare("SELECT data FROM documents WHERE type_id = 'site_settings' AND slug = 'security' AND tenant_id = 'default' AND is_current_draft = 1 AND deleted_at IS NULL").first();
+      if (row?.data) {
+        const data = JSON.parse(row.data);
+        const parsed = parseDuration(data.jwtRefreshGraceSeconds?.toString());
+        if (parsed) return parsed;
+      }
+    } catch (err) {
+      console.warn("Failed to read jwtRefreshGraceSeconds from settings:", err);
+    }
+  }
+  return DEFAULT_GRACE;
+}
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+    const json = atob(padded);
+    const obj = JSON.parse(json);
+    if (!obj || typeof obj.exp !== "number") return null;
+    return obj;
+  } catch {
+    return null;
+  }
+}
+function base64UrlToBytes(b64url) {
+  const b64 = b64url.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+  const bin = atob(padded);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return bytes;
+}
+async function verifyHs256Signature(token, secret) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return false;
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey(
+      "raw",
+      encoder.encode(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["verify"]
+    );
+    const signature = base64UrlToBytes(parts[2]);
+    const message = encoder.encode(`${parts[0]}.${parts[1]}`);
+    return await crypto.subtle.verify("HMAC", key, signature, message);
+  } catch {
+    return false;
+  }
+}
+var AuthManager = class _AuthManager {
+  static async generateToken(userId, email, role, secret, expiresInSeconds) {
+    const ttl = expiresInSeconds && expiresInSeconds > 0 ? Math.floor(expiresInSeconds) : DEFAULT_JWT_EXPIRES_IN_SECONDS;
+    const now = Math.floor(Date.now() / 1e3);
+    const payload = {
+      userId,
+      email,
+      role,
+      exp: now + ttl,
+      iat: now
+    };
+    return await sign(payload, secret || JWT_SECRET_FALLBACK, "HS256");
+  }
+  /**
+   * Verify a token's signature and expiration.
+   *
+   * IMPORTANT: pass the `JWT_SECRET` binding (e.g. `c.env.JWT_SECRET`) as the
+   * `secret` argument. If omitted, this falls back to a development-only
+   * placeholder secret — tokens signed with the real `JWT_SECRET` will then
+   * silently fail verification. From inside a Hono handler prefer
+   * `AuthManager.verifyAuthRequest(c)`, which handles header/cookie extraction
+   * and pulls the secret from `c.env` for you.
+   *
+   * If `graceSeconds` > 0, tokens whose `exp` is within the grace window
+   * (i.e. expired by no more than `graceSeconds`) are still returned. This
+   * supports a sliding-session refresh endpoint that accepts recently-expired
+   * tokens. Signature failures always return null.
+   */
+  static async verifyToken(token, secret, graceSeconds = 0) {
+    const effectiveSecret = secret || JWT_SECRET_FALLBACK;
+    try {
+      let payload = null;
+      try {
+        payload = await verify(token, effectiveSecret, "HS256");
+      } catch (verifyError) {
+        const name = verifyError?.name || "";
+        const message = String(verifyError?.message || "");
+        const isExpired = name === "JwtTokenExpired" || message.includes("expired");
+        if (!isExpired || graceSeconds <= 0) {
+          throw verifyError;
+        }
+        const signatureValid = await verifyHs256Signature(token, effectiveSecret);
+        if (!signatureValid) return null;
+        const decoded = decodeJwtPayload(token);
+        if (!decoded) return null;
+        payload = decoded;
+      }
+      if (!payload) return null;
+      const now = Math.floor(Date.now() / 1e3);
+      if (payload.exp < now - Math.max(0, Math.floor(graceSeconds))) {
+        return null;
+      }
+      return payload;
+    } catch (error) {
+      console.error("Token verification failed:", error);
+      return null;
+    }
+  }
+  /**
+   * Verify the JWT on an incoming Hono request using the `JWT_SECRET`
+   * binding from `c.env`. Reads the token from the `Authorization: Bearer …`
+   * header first, then falls back to the `auth_token` cookie. Returns the
+   * decoded payload, or null when the token is missing, malformed, expired,
+   * or signed with a different secret.
+   *
+   * Use this from custom Hono routes mounted alongside SonicJS — it
+   * resolves the secret the same way `requireAuth()` does, without forcing
+   * the caller to plumb it through manually.
+   */
+  static async verifyAuthRequest(c) {
+    let token = c.req.header("Authorization")?.replace("Bearer ", "");
+    if (!token) {
+      token = getCookie(c, "auth_token");
+    }
+    if (!token) return null;
+    const secret = c.env?.JWT_SECRET;
+    return await _AuthManager.verifyToken(token, secret);
+  }
+  static async hashPassword(password) {
+    const iterations = 1e5;
+    const salt = new Uint8Array(16);
+    crypto.getRandomValues(salt);
+    const encoder = new TextEncoder();
+    const keyMaterial = await crypto.subtle.importKey(
+      "raw",
+      encoder.encode(password),
+      "PBKDF2",
+      false,
+      ["deriveBits"]
+    );
+    const hashBuffer = await crypto.subtle.deriveBits(
+      {
+        name: "PBKDF2",
+        salt,
+        iterations,
+        hash: "SHA-256"
+      },
+      keyMaterial,
+      256
+    );
+    const saltHex = Array.from(salt).map((b) => b.toString(16).padStart(2, "0")).join("");
+    const hashHex = Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+    return `pbkdf2:${iterations}:${saltHex}:${hashHex}`;
+  }
+  static async hashPasswordLegacy(password) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(password + "salt-change-in-production");
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+  static async verifyPassword(password, storedHash) {
+    if (storedHash.startsWith("pbkdf2:")) {
+      const parts = storedHash.split(":");
+      if (parts.length !== 4) return false;
+      const iterationsStr = parts[1];
+      const saltHex = parts[2];
+      const expectedHashHex = parts[3];
+      const iterations = parseInt(iterationsStr, 10);
+      const saltBytes = saltHex.match(/.{2}/g);
+      if (!saltBytes) return false;
+      const salt = new Uint8Array(saltBytes.map((byte) => parseInt(byte, 16)));
+      const encoder = new TextEncoder();
+      const keyMaterial = await crypto.subtle.importKey(
+        "raw",
+        encoder.encode(password),
+        "PBKDF2",
+        false,
+        ["deriveBits"]
+      );
+      const hashBuffer = await crypto.subtle.deriveBits(
+        {
+          name: "PBKDF2",
+          salt,
+          iterations,
+          hash: "SHA-256"
+        },
+        keyMaterial,
+        256
+      );
+      const actualHashHex = Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+      if (actualHashHex.length !== expectedHashHex.length) return false;
+      let result2 = 0;
+      for (let i = 0; i < actualHashHex.length; i++) {
+        result2 |= actualHashHex.charCodeAt(i) ^ expectedHashHex.charCodeAt(i);
+      }
+      return result2 === 0;
+    }
+    const legacyHash = await this.hashPasswordLegacy(password);
+    if (legacyHash.length !== storedHash.length) return false;
+    let result = 0;
+    for (let i = 0; i < legacyHash.length; i++) {
+      result |= legacyHash.charCodeAt(i) ^ storedHash.charCodeAt(i);
+    }
+    return result === 0;
+  }
+  static isLegacyHash(storedHash) {
+    return !storedHash.startsWith("pbkdf2:");
+  }
+  /**
+   * Set authentication cookie - useful for plugins implementing alternative auth methods
+   * @param c - Hono context
+   * @param token - JWT token to set in cookie
+   * @param options - Optional cookie configuration
+   */
+  static setAuthCookie(c, token, options) {
+    setCookie(c, "auth_token", token, {
+      httpOnly: options?.httpOnly ?? true,
+      secure: options?.secure ?? true,
+      sameSite: options?.sameSite ?? "Strict",
+      maxAge: options?.maxAge ?? getJwtExpirySeconds(c?.env)
+    });
+  }
+};
+var requireAuth = () => {
+  return async (c, next) => {
+    const user = c.get("user");
+    if (!user) {
+      const acceptHeader = c.req.header("Accept") || "";
+      if (acceptHeader.includes("text/html")) {
+        return c.redirect("/auth/login?error=Please login to access the admin area");
+      }
+      return c.json({ error: "Authentication required" }, 401);
+    }
+    return await next();
+  };
+};
+var requireRole = (requiredRole) => {
+  return async (c, next) => {
+    const user = c.get("user");
+    if (!user) {
+      const acceptHeader = c.req.header("Accept") || "";
+      if (acceptHeader.includes("text/html")) {
+        return c.redirect("/auth/login?error=Please login to access the admin area");
+      }
+      return c.json({ error: "Authentication required" }, 401);
+    }
+    const roles = Array.isArray(requiredRole) ? requiredRole : [requiredRole];
+    if (!roles.includes(user.role)) {
+      const acceptHeader = c.req.header("Accept") || "";
+      if (acceptHeader.includes("text/html")) {
+        return c.redirect("/auth/login?error=You do not have permission to access this area");
+      }
+      return c.json({ error: "Insufficient permissions" }, 403);
+    }
+    return await next();
+  };
+};
+var requireRbac = (resource, verb) => {
+  return async (c, next) => {
+    const user = c.get("user");
+    if (!user) {
+      const acceptHeader = c.req.header("Accept") || "";
+      if (acceptHeader.includes("text/html")) {
+        return c.redirect("/auth/login?error=Please login to access the admin area");
+      }
+      return c.json({ error: "Authentication required" }, 401);
+    }
+    const cachedPerms = c.get("rbacPerms");
+    let allowed;
+    if (cachedPerms !== void 0) {
+      allowed = cachedPerms.includes(`${resource}:${verb}`);
+    } else {
+      allowed = await new RbacService(c.env.DB).can(user.userId, resource, verb);
+    }
+    if (!allowed) {
+      const acceptHeader = c.req.header("Accept") || "";
+      if (acceptHeader.includes("text/html")) {
+        return c.redirect("/auth/login?error=You do not have permission to access this area");
+      }
+      return c.json({ error: "Insufficient permissions" }, 403);
+    }
+    return await next();
+  };
+};
+var optionalAuth = () => {
+  return async (_c, next) => {
+    return await next();
+  };
+};
+
+// src/middleware/metrics.ts
+var metricsMiddleware = () => {
+  return async (c, next) => {
+    const path = new URL(c.req.url).pathname;
+    if (path !== "/admin/dashboard/api/metrics") {
+      metricsTracker.recordRequest();
+    }
+    await next();
+  };
+};
+var JWT_SECRET_FALLBACK2 = "your-super-secret-jwt-key-change-in-production";
+function arrayBufferToBase64Url(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function getHmacKey(secret) {
+  const encoder = new TextEncoder();
+  return crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"]
+  );
+}
+async function generateCsrfToken(secret) {
+  const nonceBytes = new Uint8Array(32);
+  crypto.getRandomValues(nonceBytes);
+  const nonce = arrayBufferToBase64Url(nonceBytes.buffer);
+  const key = await getHmacKey(secret);
+  const encoder = new TextEncoder();
+  const signatureBuffer = await crypto.subtle.sign("HMAC", key, encoder.encode(nonce));
+  const signature = arrayBufferToBase64Url(signatureBuffer);
+  return `${nonce}.${signature}`;
+}
+async function validateCsrfToken(token, secret) {
+  if (!token || typeof token !== "string") return false;
+  const dotIndex = token.indexOf(".");
+  if (dotIndex === -1) return false;
+  const nonce = token.substring(0, dotIndex);
+  const signature = token.substring(dotIndex + 1);
+  if (!nonce || !signature) return false;
+  try {
+    const key = await getHmacKey(secret);
+    const encoder = new TextEncoder();
+    const sigPadded = signature.replace(/-/g, "+").replace(/_/g, "/");
+    const sigBinary = atob(sigPadded);
+    const sigBytes = new Uint8Array(sigBinary.length);
+    for (let i = 0; i < sigBinary.length; i++) {
+      sigBytes[i] = sigBinary.charCodeAt(i);
+    }
+    return await crypto.subtle.verify("HMAC", key, sigBytes.buffer, encoder.encode(nonce));
+  } catch {
+    return false;
+  }
+}
+var DEFAULT_EXEMPT_PATHS = [
+  "/auth/login",
+  "/auth/register",
+  "/auth/seed-admin",
+  "/test-seed-defaults",
+  "/test-cleanup",
+  "/auth/accept-invitation",
+  "/auth/reset-password",
+  "/auth/request-password-reset",
+  "/auth/otp",
+  "/auth/magic-link",
+  "/auth/sign-out",
+  "/auth/sign-in",
+  "/auth/sign-up",
+  "/auth/get-session",
+  "/auth/verify",
+  "/api/stripe/webhook",
+  "/api/events"
+];
+function isExemptPath(path, extraExemptPaths = []) {
+  if (path.startsWith("/forms/") || path.startsWith("/api/forms/") || path === "/forms" || path === "/api/forms") {
+    return true;
+  }
+  if (path.startsWith("/api/search")) {
+    return true;
+  }
+  const allExempt = [...DEFAULT_EXEMPT_PATHS, ...extraExemptPaths];
+  for (const exempt of allExempt) {
+    if (path === exempt || path.startsWith(exempt + "/")) {
+      return true;
+    }
+  }
+  return false;
+}
+function csrfProtection(options = {}) {
+  return async (c, next) => {
+    const method = c.req.method.toUpperCase();
+    const path = new URL(c.req.url).pathname;
+    const secret = c.env?.JWT_SECRET || JWT_SECRET_FALLBACK2;
+    if (c.env?.ENVIRONMENT === "production" && !c.env?.JWT_SECRET) {
+      console.warn(
+        "[CSRF] WARNING: JWT_SECRET is not set in production. CSRF tokens are signed with the fallback key, which is insecure."
+      );
+    }
+    if (method === "GET" || method === "HEAD" || method === "OPTIONS") {
+      await ensureCsrfCookie(c, secret);
+      await next();
+      return;
+    }
+    if (isExemptPath(path, options.exemptPaths)) {
+      await next();
+      return;
+    }
+    const authCookie = getCookie(c, "auth_token");
+    if (!authCookie) {
+      await next();
+      return;
+    }
+    const authHeader = c.req.header("Authorization");
+    if (authHeader) {
+      await next();
+      return;
+    }
+    const cookieToken = getCookie(c, "csrf_token");
+    let headerToken = c.req.header("X-CSRF-Token");
+    if (!headerToken) {
+      const contentType = c.req.header("Content-Type") || "";
+      if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+        try {
+          const body = await c.req.parseBody();
+          headerToken = body["_csrf"];
+        } catch {
+        }
+      }
+    }
+    if (!cookieToken || !headerToken) {
+      return csrfError(c, "CSRF token missing");
+    }
+    if (cookieToken !== headerToken) {
+      return csrfError(c, "CSRF token mismatch");
+    }
+    const isValid = await validateCsrfToken(cookieToken, secret);
+    if (!isValid) {
+      return csrfError(c, "CSRF token invalid");
+    }
+    await next();
+  };
+}
+async function ensureCsrfCookie(c, secret) {
+  const existing = getCookie(c, "csrf_token");
+  if (existing) {
+    const isValid = await validateCsrfToken(existing, secret);
+    if (isValid) {
+      c.set("csrfToken", existing);
+      return;
+    }
+  }
+  const token = await generateCsrfToken(secret);
+  c.set("csrfToken", token);
+  const isDev = c.env?.ENVIRONMENT === "development" || !c.env?.ENVIRONMENT;
+  setCookie(c, "csrf_token", token, {
+    httpOnly: false,
+    // JS must read this cookie
+    secure: !isDev,
+    sameSite: "Strict",
+    path: "/",
+    maxAge: 86400
+    // 24 hours — browser-side expiry
+  });
+}
+function csrfError(c, message) {
+  const accept = c.req.header("Accept") || "";
+  if (accept.includes("text/html")) {
+    return c.html(
+      `<!DOCTYPE html><html><head><title>403 Forbidden</title></head><body><h1>403 Forbidden</h1><p>${message}</p></body></html>`,
+      403
+    );
+  }
+  return c.json({ error: message, status: 403 }, 403);
+}
+
+// src/middleware/rate-limit.ts
+function rateLimit(options) {
+  const { max, windowMs, keyPrefix } = options;
+  return async (c, next) => {
+    const kv = c.env?.CACHE_KV;
+    if (!kv) {
+      return await next();
+    }
+    const ip = c.req.header("cf-connecting-ip") || c.req.header("x-forwarded-for") || "unknown";
+    const key = `ratelimit:${keyPrefix}:${ip}`;
+    try {
+      const now = Date.now();
+      const stored = await kv.get(key, "json");
+      let entry;
+      if (stored && stored.resetAt > now) {
+        entry = stored;
+      } else {
+        entry = { count: 0, resetAt: now + windowMs };
+      }
+      entry.count++;
+      const ttlSeconds = Math.ceil((entry.resetAt - now) / 1e3);
+      if (entry.count > max) {
+        await kv.put(key, JSON.stringify(entry), { expirationTtl: Math.max(ttlSeconds, 60) });
+        const retryAfter = Math.ceil((entry.resetAt - now) / 1e3);
+        c.header("Retry-After", String(retryAfter));
+        c.header("X-RateLimit-Limit", String(max));
+        c.header("X-RateLimit-Remaining", "0");
+        c.header("X-RateLimit-Reset", String(Math.ceil(entry.resetAt / 1e3)));
+        return c.json({ error: "Too many requests. Please try again later." }, 429);
+      }
+      await kv.put(key, JSON.stringify(entry), { expirationTtl: Math.max(ttlSeconds, 60) });
+      c.header("X-RateLimit-Limit", String(max));
+      c.header("X-RateLimit-Remaining", String(max - entry.count));
+      c.header("X-RateLimit-Reset", String(Math.ceil(entry.resetAt / 1e3)));
+      return await next();
+    } catch (error) {
+      console.error("Rate limiter error (non-fatal):", error);
+      return await next();
+    }
+  };
+}
+
+// src/middleware/security-headers.ts
+var securityHeadersMiddleware = () => {
+  return async (c, next) => {
+    await next();
+    c.header("X-Content-Type-Options", "nosniff");
+    c.header("X-Frame-Options", "SAMEORIGIN");
+    c.header("Referrer-Policy", "strict-origin-when-cross-origin");
+    c.header("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
+    const environment = c.env?.ENVIRONMENT;
+    if (environment !== "development") {
+      c.header("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+    }
+  };
+};
+
+// src/middleware/plugin-middleware.ts
+async function isPluginActive(db, pluginId) {
+  try {
+    const docResult = await db.prepare(
+      `SELECT json_extract(data, '$.status') as status FROM documents
+         WHERE slug = ? AND type_id = 'plugin' AND tenant_id = 'default'
+           AND is_current_draft = 1 AND deleted_at IS NULL`
+    ).bind(pluginId).first();
+    return docResult?.status === "active";
+  } catch (error) {
+    console.error(`[isPluginActive] Error checking plugin status for ${pluginId}:`, error);
+    return false;
+  }
+}
+async function requireActivePlugin(db, pluginId) {
+  const isActive = await isPluginActive(db, pluginId);
+  if (!isActive) {
+    throw new Error(`Plugin '${pluginId}' is required but is not active`);
+  }
+}
+async function requireActivePlugins(db, pluginIds) {
+  for (const pluginId of pluginIds) {
+    await requireActivePlugin(db, pluginId);
+  }
+}
+async function getActivePlugins(db) {
+  try {
+    const { results } = await db.prepare(
+      `SELECT slug as id, json_extract(data, '$.status') as status, data FROM documents
+         WHERE type_id = 'plugin' AND tenant_id = 'default'
+           AND q_plugin_status = 'active' AND is_current_draft = 1 AND deleted_at IS NULL`
+    ).all();
+    return results || [];
+  } catch (error) {
+    console.error("[getActivePlugins] Error fetching active plugins:", error);
+    return [];
+  }
+}
+
+// src/middleware/index.ts
+var loggingMiddleware = () => async (_c, next) => await next();
+var detailedLoggingMiddleware = () => async (_c, next) => await next();
+var securityLoggingMiddleware = () => async (_c, next) => await next();
+var performanceLoggingMiddleware = () => async (_c, next) => await next();
+var cacheHeaders = () => async (_c, next) => await next();
+var compressionMiddleware = async (_c, next) => await next();
+var PermissionManager = {};
+var requirePermission = () => async (_c, next) => await next();
+var requireAnyPermission = () => async (_c, next) => await next();
+var logActivity = () => {
+};
+
+export { AuthManager, DocumentTypeRegistry, PermissionManager, bootstrapDocumentTypes, bootstrapMiddleware, cacheHeaders, compressionMiddleware, csrfProtection, detailedLoggingMiddleware, generateCsrfToken, getActivePlugins, getJwtExpirySeconds, getJwtExpirySecondsFromDb, getJwtRefreshGraceSecondsFromDb, isPluginActive, logActivity, loggingMiddleware, metricsMiddleware, optionalAuth, performanceLoggingMiddleware, rateLimit, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRbac, requireRole, securityHeadersMiddleware, securityLoggingMiddleware, validateCsrfToken, verifySecurityConfig };
+//# sourceMappingURL=chunk-IDCZBF35.js.map
+//# sourceMappingURL=chunk-IDCZBF35.js.map