@sonicjs-cms/core 2.4.0 → 2.6.0

package/dist/{chunk-7I5INVNR.cjs → chunk-T3YIKW2A.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunkILZ3DP4I_cjs = require('./chunk-ILZ3DP4I.cjs');
-var chunk2MI3LZFH_cjs = require('./chunk-2MI3LZFH.cjs');
+var chunkMPT5PA6U_cjs = require('./chunk-MPT5PA6U.cjs');
+var chunkIIRVZSP2_cjs = require('./chunk-IIRVZSP2.cjs');
 var chunkRCQ2HIQD_cjs = require('./chunk-RCQ2HIQD.cjs');
 var jwt = require('hono/jwt');
 var cookie = require('hono/cookie');
@@ -20,17 +20,17 @@ function bootstrapMiddleware(config = {}) {
     try {
       console.log("[Bootstrap] Starting system initialization...");
       console.log("[Bootstrap] Running database migrations...");
-      const migrationService = new chunk2MI3LZFH_cjs.MigrationService(c.env.DB);
+      const migrationService = new chunkIIRVZSP2_cjs.MigrationService(c.env.DB);
       await migrationService.runPendingMigrations();
       console.log("[Bootstrap] Syncing collection configurations...");
       try {
-        await chunkILZ3DP4I_cjs.syncCollections(c.env.DB);
+        await chunkMPT5PA6U_cjs.syncCollections(c.env.DB);
       } catch (error) {
         console.error("[Bootstrap] Error syncing collections:", error);
       }
       if (!config.plugins?.disableAll) {
         console.log("[Bootstrap] Bootstrapping core plugins...");
-        const bootstrapService = new chunkILZ3DP4I_cjs.PluginBootstrapService(c.env.DB);
+        const bootstrapService = new chunkMPT5PA6U_cjs.PluginBootstrapService(c.env.DB);
         const needsBootstrap = await bootstrapService.isBootstrapNeeded();
         if (needsBootstrap) {
           await bootstrapService.bootstrapCorePlugins();
@@ -57,11 +57,11 @@ var AuthManager = class {
       // 24 hours
       iat: Math.floor(Date.now() / 1e3)
     };
-    return await jwt.sign(payload, JWT_SECRET);
+    return await jwt.sign(payload, JWT_SECRET, "HS256");
   }
   static async verifyToken(token) {
     try {
-      const payload = await jwt.verify(token, JWT_SECRET);
+      const payload = await jwt.verify(token, JWT_SECRET, "HS256");
       if (payload.exp < Math.floor(Date.now() / 1e3)) {
         return null;
       }
@@ -239,5 +239,5 @@ exports.requirePermission = requirePermission;
 exports.requireRole = requireRole;
 exports.securityHeaders = securityHeaders;
 exports.securityLoggingMiddleware = securityLoggingMiddleware;
-//# sourceMappingURL=chunk-7I5INVNR.cjs.map
-//# sourceMappingURL=chunk-7I5INVNR.cjs.map
+//# sourceMappingURL=chunk-T3YIKW2A.cjs.map
+//# sourceMappingURL=chunk-T3YIKW2A.cjs.map

package/dist/chunk-T3YIKW2A.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/middleware/bootstrap.ts","../src/middleware/auth.ts","../src/middleware/metrics.ts","../src/middleware/index.ts"],"names":["MigrationService","syncCollections","PluginBootstrapService","sign","verify","setCookie","getCookie","metricsTracker"],"mappings":";;;;;;;;;AAYA,IAAI,iBAAA,GAAoB,KAAA;AAMjB,SAAS,mBAAA,CAAoB,MAAA,GAAwB,EAAC,EAAG;AAC9D,EAAA,OAAO,OAAO,GAAoC,IAAA,KAAe;AAE/D,IAAA,IAAI,iBAAA,EAAmB;AACrB,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAGA,IAAA,MAAM,IAAA,GAAO,EAAE,GAAA,CAAI,IAAA;AACnB,IAAA,IACE,IAAA,CAAK,UAAA,CAAW,UAAU,CAAA,IAC1B,IAAA,CAAK,UAAA,CAAW,UAAU,CAAA,IAC1B,IAAA,KAAS,SAAA,IACT,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA,IACnB,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,IACpB,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,IACpB,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,IACpB,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,EACpB;AACA,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAEA,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,IAAI,+CAA+C,CAAA;AAG3D,MAAA,OAAA,CAAQ,IAAI,4CAA4C,CAAA;AACxD,MAAA,MAAM,gBAAA,GAAmB,IAAIA,kCAAA,CAAiB,CAAA,CAAE,IAAI,EAAE,CAAA;AACtD,MAAA,MAAM,iBAAiB,oBAAA,EAAqB;AAG5C,MAAA,OAAA,CAAQ,IAAI,kDAAkD,CAAA;AAC9D,MAAA,IAAI;AACF,QAAA,MAAMC,iCAAA,CAAgB,CAAA,CAAE,GAAA,CAAI,EAAE,CAAA;AAAA,MAChC,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,KAAA,CAAM,0CAA0C,KAAK,CAAA;AAAA,MAE/D;AAGA,MAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,UAAA,EAAY;AAC/B,QAAA,OAAA,CAAQ,IAAI,2CAA2C,CAAA;AACvD,QAAA,MAAM,gBAAA,GAAmB,IAAIC,wCAAA,CAAuB,CAAA,CAAE,IAAI,EAAE,CAAA;AAG5D,QAAA,MAAM,cAAA,GAAiB,MAAM,gBAAA,CAAiB,iBAAA,EAAkB;AAChE,QAAA,IAAI,cAAA,EAAgB;AAClB,UAAA,MAAM,iBAAiB,oBAAA,EAAqB;AAAA,QAC9C;AAAA,MACF,CAAA,MAAO;AACL,QAAA,OAAA,CAAQ,IAAI,2DAA2D,CAAA;AAAA,MACzE;AAGA,MAAA,iBAAA,GAAoB,IAAA;AACpB,MAAA,OAAA,CAAQ,IAAI,6CAA6C,CAAA;AAAA,IAC3D,SAAS,KAAA,EAAO;AACd,MAAA,OAAA,CAAQ,KAAA,CAAM,mDAAmD,KAAK,CAAA;AAAA,IAExE;AAEA,IAAA,OAAO,IAAA,EAAK;AAAA,EACd,CAAA;AACF;ACpEA,IAAM,UAAA,GAAa,gDAAA;AAEZ,IAAM,cAAN,MAAkB;AAAA,EACvB,aAAa,aAAA,CAAc,MAAA,EAAgB,KAAA,EAAe,IAAA,EAA+B;AACvF,IAAA,MAAM,OAAA,GAAsB;AAAA,MAC1B,MAAA;AAAA,MACA,KAAA;AAAA,MACA,IAAA;AAAA,MACA,GAAA,EAAK,KAAK,KAAA,CAAM,IAAA,CAAK,KAAI,GAAI,GAAI,CAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAAA;AAAA,MAChD,KAAK,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI;AAAA,KACnC;AAEA,IAAA,OAAO,MAAMC,QAAA,CAAK,OAAA,EAAS,UAAA,EAAY,OAAO,CAAA;AAAA,EAChD;AAAA,EAEA,aAAa,YAAY,KAAA,EAA2C;AAClE,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAMC,UAAA,CAAO,KAAA,EAAO,YAAY,OAAO,CAAA;AAGvD,MAAA,IAAI,OAAA,CAAQ,MAAM,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAA,EAAG;AAC/C,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,OAAO,OAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,OAAA,CAAQ,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,aAAa,aAAa,QAAA,EAAmC;AAE3D,IAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,CAAO,QAAA,GAAW,2BAA2B,CAAA;AAClE,IAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AAC7D,IAAA,MAAM,YAAY,KAAA,CAAM,IAAA,CAAK,IAAI,UAAA,CAAW,UAAU,CAAC,CAAA;AACvD,IAAA,OAAO,SAAA,CAAU,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAAA,EACpE;AAAA,EAEA,aAAa,cAAA,CAAe,QAAA,EAAkB,IAAA,EAAgC;AAC5E,IAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,YAAA,CAAa,QAAQ,CAAA;AACrD,IAAA,OAAO,YAAA,KAAiB,IAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,aAAA,CAAc,CAAA,EAAY,KAAA,EAAe,OAAA,EAKvC;AACP,IAAAC,gBAAA,CAAU,CAAA,EAAG,cAAc,KAAA,EAAO;AAAA,MAChC,QAAA,EAAU,SAAS,QAAA,IAAY,IAAA;AAAA,MAC/B,MAAA,EAAQ,SAAS,MAAA,IAAU,IAAA;AAAA,MAC3B,QAAA,EAAU,SAAS,QAAA,IAAY,QAAA;AAAA,MAC/B,MAAA,EAAQ,OAAA,EAAS,MAAA,IAAW,EAAA,GAAK,EAAA,GAAK;AAAA;AAAA,KACvC,CAAA;AAAA,EACH;AACF;AAGO,IAAM,cAAc,MAAM;AAC/B,EAAA,OAAO,OAAO,GAAY,IAAA,KAAe;AACvC,IAAA,IAAI;AAEF,MAAA,IAAI,KAAA,GAAQ,EAAE,GAAA,CAAI,MAAA,CAAO,eAAe,CAAA,EAAG,OAAA,CAAQ,WAAW,EAAE,CAAA;AAGhE,MAAA,IAAI,CAAC,KAAA,EAAO;AACV,QAAA,KAAA,GAAQC,gBAAA,CAAU,GAAG,YAAY,CAAA;AAAA,MACnC;AAEA,MAAA,IAAI,CAAC,KAAA,EAAO;AAEV,QAAA,MAAM,YAAA,GAAe,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,IAAK,EAAA;AAC/C,QAAA,IAAI,YAAA,CAAa,QAAA,CAAS,WAAW,CAAA,EAAG;AACtC,UAAA,OAAO,CAAA,CAAE,SAAS,yDAAyD,CAAA;AAAA,QAC7E;AACA,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,yBAAA,IAA6B,GAAG,CAAA;AAAA,MACzD;AAGA,MAAA,MAAM,EAAA,GAAK,EAAE,GAAA,EAAK,EAAA;AAClB,MAAA,IAAI,OAAA,GAA6B,IAAA;AAEjC,MAAA,IAAI,EAAA,EAAI;AACN,QAAA,MAAM,WAAW,CAAA,KAAA,EAAQ,KAAA,CAAM,SAAA,CAAU,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AAC/C,QAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,GAAA,CAAI,UAAU,MAAM,CAAA;AAC5C,QAAA,IAAI,MAAA,EAAQ;AACV,UAAA,OAAA,GAAU,MAAA;AAAA,QACZ;AAAA,MACF;AAGA,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,OAAA,GAAU,MAAM,WAAA,CAAY,WAAA,CAAY,KAAK,CAAA;AAG7C,QAAA,IAAI,WAAW,EAAA,EAAI;AACjB,UAAA,MAAM,WAAW,CAAA,KAAA,EAAQ,KAAA,CAAM,SAAA,CAAU,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AAC/C,UAAA,MAAM,EAAA,CAAG,GAAA,CAAI,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG,EAAE,aAAA,EAAe,GAAA,EAAK,CAAA;AAAA,QACxE;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,OAAA,EAAS;AAEZ,QAAA,MAAM,YAAA,GAAe,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,IAAK,EAAA;AAC/C,QAAA,IAAI,YAAA,CAAa,QAAA,CAAS,WAAW,CAAA,EAAG;AACtC,UAAA,OAAO,CAAA,CAAE,SAAS,gEAAgE,CAAA;AAAA,QACpF;AACA,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,0BAAA,IAA8B,GAAG,CAAA;AAAA,MAC1D;AAGA,MAAA,CAAA,CAAE,GAAA,CAAI,QAAQ,OAAO,CAAA;AAErB,MAAA,OAAO,MAAM,IAAA,EAAK;AAAA,IACpB,SAAS,KAAA,EAAO;AACd,MAAA,OAAA,CAAQ,KAAA,CAAM,0BAA0B,KAAK,CAAA;AAE7C,MAAA,MAAM,YAAA,GAAe,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,IAAK,EAAA;AAC/C,MAAA,IAAI,YAAA,CAAa,QAAA,CAAS,WAAW,CAAA,EAAG;AACtC,QAAA,OAAO,CAAA,CAAE,SAAS,6DAA6D,CAAA;AAAA,MACjF;AACA,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,uBAAA,IAA2B,GAAG,CAAA;AAAA,IACvD;AAAA,EACF,CAAA;AACF;AAGO,IAAM,WAAA,GAAc,CAAC,YAAA,KAAoC;AAC9D,EAAA,OAAO,OAAO,GAAY,IAAA,KAAe;AACvC,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,GAAA,CAAI,MAAM,CAAA;AAEzB,IAAA,IAAI,CAAC,IAAA,EAAM;AAET,MAAA,MAAM,YAAA,GAAe,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,IAAK,EAAA;AAC/C,MAAA,IAAI,YAAA,CAAa,QAAA,CAAS,WAAW,CAAA,EAAG;AACtC,QAAA,OAAO,CAAA,CAAE,SAAS,yDAAyD,CAAA;AAAA,MAC7E;AACA,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,yBAAA,IAA6B,GAAG,CAAA;AAAA,IACzD;AAEA,IAAA,MAAM,QAAQ,KAAA,CAAM,OAAA,CAAQ,YAAY,CAAA,GAAI,YAAA,GAAe,CAAC,YAAY,CAAA;AAExE,IAAA,IAAI,CAAC,KAAA,CAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,EAAG;AAE9B,MAAA,MAAM,YAAA,GAAe,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,IAAK,EAAA;AAC/C,MAAA,IAAI,YAAA,CAAa,QAAA,CAAS,WAAW,CAAA,EAAG;AACtC,QAAA,OAAO,CAAA,CAAE,SAAS,kEAAkE,CAAA;AAAA,MACtF;AACA,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,0BAAA,IAA8B,GAAG,CAAA;AAAA,IAC1D;AAEA,IAAA,OAAO,MAAM,IAAA,EAAK;AAAA,EACpB,CAAA;AACF;AAGO,IAAM,eAAe,MAAM;AAChC,EAAA,OAAO,OAAO,GAAY,IAAA,KAAe;AACvC,IAAA,IAAI;AACF,MAAA,IAAI,KAAA,GAAQ,EAAE,GAAA,CAAI,MAAA,CAAO,eAAe,CAAA,EAAG,OAAA,CAAQ,WAAW,EAAE,CAAA;AAEhE,MAAA,IAAI,CAAC,KAAA,EAAO;AACV,QAAA,KAAA,GAAQA,gBAAA,CAAU,GAAG,YAAY,CAAA;AAAA,MACnC;AAEA,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,MAAM,OAAA,GAAU,MAAM,WAAA,CAAY,WAAA,CAAY,KAAK,CAAA;AACnD,QAAA,IAAI,OAAA,EAAS;AACX,UAAA,CAAA,CAAE,GAAA,CAAI,QAAQ,OAAO,CAAA;AAAA,QACvB;AAAA,MACF;AAEA,MAAA,OAAO,MAAM,IAAA,EAAK;AAAA,IACpB,SAAS,KAAA,EAAO;AAEd,MAAA,OAAA,CAAQ,KAAA,CAAM,wBAAwB,KAAK,CAAA;AAC3C,MAAA,OAAO,MAAM,IAAA,EAAK;AAAA,IACpB;AAAA,EACF,CAAA;AACF;;;AClMO,IAAM,oBAAoB,MAAyB;AACxD,EAAA,OAAO,OAAO,GAAG,IAAA,KAAS;AACxB,IAAA,MAAM,OAAO,IAAI,GAAA,CAAI,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA;AAGhC,IAAA,IAAI,SAAS,8BAAA,EAAgC;AAC3C,MAAAC,gCAAA,CAAe,aAAA,EAAc;AAAA,IAC/B;AAGA,IAAA,MAAM,IAAA,EAAK;AAAA,EACb,CAAA;AACF;;;ACQO,IAAM,oBAAyB,MAAM,OAAO,EAAA,EAAS,IAAA,KAAc,MAAM,IAAA;AACzE,IAAM,4BAAiC,MAAM,OAAO,EAAA,EAAS,IAAA,KAAc,MAAM,IAAA;AACjF,IAAM,4BAAiC,MAAM,OAAO,EAAA,EAAS,IAAA,KAAc,MAAM,IAAA;AACjF,IAAM,+BAAoC,MAAM,OAAO,EAAA,EAAS,IAAA,KAAc,MAAM,IAAA;AACpF,IAAM,eAAoB,MAAM,OAAO,EAAA,EAAS,IAAA,KAAc,MAAM,IAAA;AACpE,IAAM,qBAAA,GAA6B,OAAO,EAAA,EAAS,IAAA,KAAc,MAAM,IAAA;AACvE,IAAM,kBAAuB,MAAM,OAAO,EAAA,EAAS,IAAA,KAAc,MAAM,IAAA;AAGvE,IAAM,oBAAyB;AAC/B,IAAM,oBAAyB,MAAM,OAAO,EAAA,EAAS,IAAA,KAAc,MAAM,IAAA;AACzE,IAAM,uBAA4B,MAAM,OAAO,EAAA,EAAS,IAAA,KAAc,MAAM,IAAA;AAC5E,IAAM,cAAmB,MAAM;AAAC;AAChC,IAAM,sBAA2B,MAAM,OAAO,EAAA,EAAS,IAAA,KAAc,MAAM,IAAA;AAC3E,IAAM,uBAA4B,MAAM,OAAO,EAAA,EAAS,IAAA,KAAc,MAAM,IAAA;AAC5E,IAAM,gBAAA,GAAwB,MAAM;AACpC,IAAM,iBAAsB,MAAM","file":"chunk-T3YIKW2A.cjs","sourcesContent":["import { Context, Next } from \"hono\";\nimport { syncCollections } from \"../services/collection-sync\";\nimport { MigrationService } from \"../services/migrations\";\nimport { PluginBootstrapService } from \"../services/plugin-bootstrap\";\nimport type { SonicJSConfig } from \"../app\";\n\ntype Bindings = {\n  DB: D1Database;\n  KV: KVNamespace;\n};\n\n// Track if bootstrap has been run in this worker instance\nlet bootstrapComplete = false;\n\n/**\n * Bootstrap middleware that ensures system initialization\n * Runs once per worker instance\n */\nexport function bootstrapMiddleware(config: SonicJSConfig = {}) {\n  return async (c: Context<{ Bindings: Bindings }>, next: Next) => {\n    // Skip if already bootstrapped in this worker instance\n    if (bootstrapComplete) {\n      return next();\n    }\n\n    // Skip bootstrap for static assets and health checks\n    const path = c.req.path;\n    if (\n      path.startsWith(\"/images/\") ||\n      path.startsWith(\"/assets/\") ||\n      path === \"/health\" ||\n      path.endsWith(\".js\") ||\n      path.endsWith(\".css\") ||\n      path.endsWith(\".png\") ||\n      path.endsWith(\".jpg\") ||\n      path.endsWith(\".ico\")\n    ) {\n      return next();\n    }\n\n    try {\n      console.log(\"[Bootstrap] Starting system initialization...\");\n\n      // 1. Run database migrations first\n      console.log(\"[Bootstrap] Running database migrations...\");\n      const migrationService = new MigrationService(c.env.DB);\n      await migrationService.runPendingMigrations();\n\n      // 2. Sync collection configurations\n      console.log(\"[Bootstrap] Syncing collection configurations...\");\n      try {\n        await syncCollections(c.env.DB);\n      } catch (error) {\n        console.error(\"[Bootstrap] Error syncing collections:\", error);\n        // Continue bootstrap even if collection sync fails\n      }\n\n      // 3. Bootstrap core plugins (unless disableAll is set)\n      if (!config.plugins?.disableAll) {\n        console.log(\"[Bootstrap] Bootstrapping core plugins...\");\n        const bootstrapService = new PluginBootstrapService(c.env.DB);\n\n        // Check if bootstrap is needed\n        const needsBootstrap = await bootstrapService.isBootstrapNeeded();\n        if (needsBootstrap) {\n          await bootstrapService.bootstrapCorePlugins();\n        }\n      } else {\n        console.log(\"[Bootstrap] Plugin bootstrap skipped (disableAll is true)\");\n      }\n\n      // Mark bootstrap as complete for this worker instance\n      bootstrapComplete = true;\n      console.log(\"[Bootstrap] System initialization completed\");\n    } catch (error) {\n      console.error(\"[Bootstrap] Error during system initialization:\", error);\n      // Don't prevent the app from starting, but log the error\n    }\n\n    return next();\n  };\n}\n\n/**\n * Reset bootstrap flag (useful for testing)\n */\nexport function resetBootstrap() {\n  bootstrapComplete = false;\n}\n","import { sign, verify } from 'hono/jwt'\nimport { Context, Next } from 'hono'\nimport { getCookie, setCookie } from 'hono/cookie'\n\ntype JWTPayload = {\n  userId: string\n  email: string\n  role: string\n  exp: number\n  iat: number\n}\n\n// JWT secret - in production this should come from environment variables\nconst JWT_SECRET = 'your-super-secret-jwt-key-change-in-production'\n\nexport class AuthManager {\n  static async generateToken(userId: string, email: string, role: string): Promise<string> {\n    const payload: JWTPayload = {\n      userId,\n      email,\n      role,\n      exp: Math.floor(Date.now() / 1000) + (60 * 60 * 24), // 24 hours\n      iat: Math.floor(Date.now() / 1000)\n    }\n    \n    return await sign(payload, JWT_SECRET, 'HS256')\n  }\n\n  static async verifyToken(token: string): Promise<JWTPayload | null> {\n    try {\n      const payload = await verify(token, JWT_SECRET, 'HS256') as JWTPayload\n      \n      // Check if token is expired\n      if (payload.exp < Math.floor(Date.now() / 1000)) {\n        return null\n      }\n      \n      return payload\n    } catch (error) {\n      console.error('Token verification failed:', error)\n      return null\n    }\n  }\n\n  static async hashPassword(password: string): Promise<string> {\n    // In Cloudflare Workers, we'll use Web Crypto API\n    const encoder = new TextEncoder()\n    const data = encoder.encode(password + 'salt-change-in-production')\n    const hashBuffer = await crypto.subtle.digest('SHA-256', data)\n    const hashArray = Array.from(new Uint8Array(hashBuffer))\n    return hashArray.map(b => b.toString(16).padStart(2, '0')).join('')\n  }\n\n  static async verifyPassword(password: string, hash: string): Promise<boolean> {\n    const passwordHash = await this.hashPassword(password)\n    return passwordHash === hash\n  }\n\n  /**\n   * Set authentication cookie - useful for plugins implementing alternative auth methods\n   * @param c - Hono context\n   * @param token - JWT token to set in cookie\n   * @param options - Optional cookie configuration\n   */\n  static setAuthCookie(c: Context, token: string, options?: {\n    maxAge?: number\n    secure?: boolean\n    httpOnly?: boolean\n    sameSite?: 'Strict' | 'Lax' | 'None'\n  }): void {\n    setCookie(c, 'auth_token', token, {\n      httpOnly: options?.httpOnly ?? true,\n      secure: options?.secure ?? true,\n      sameSite: options?.sameSite ?? 'Strict',\n      maxAge: options?.maxAge ?? (60 * 60 * 24) // 24 hours default\n    })\n  }\n}\n\n// Middleware to require authentication\nexport const requireAuth = () => {\n  return async (c: Context, next: Next) => {\n    try {\n      // Try to get token from Authorization header\n      let token = c.req.header('Authorization')?.replace('Bearer ', '')\n\n      // If no header token, try cookie\n      if (!token) {\n        token = getCookie(c, 'auth_token')\n      }\n\n      if (!token) {\n        // Check if this is a browser request (HTML accept header)\n        const acceptHeader = c.req.header('Accept') || ''\n        if (acceptHeader.includes('text/html')) {\n          return c.redirect('/auth/login?error=Please login to access the admin area')\n        }\n        return c.json({ error: 'Authentication required' }, 401)\n      }\n\n      // Try to get cached token verification from KV\n      const kv = c.env?.KV\n      let payload: JWTPayload | null = null\n\n      if (kv) {\n        const cacheKey = `auth:${token.substring(0, 20)}` // Use token prefix as key\n        const cached = await kv.get(cacheKey, 'json')\n        if (cached) {\n          payload = cached as JWTPayload\n        }\n      }\n\n      // If not cached, verify token\n      if (!payload) {\n        payload = await AuthManager.verifyToken(token)\n\n        // Cache the verified payload for 5 minutes\n        if (payload && kv) {\n          const cacheKey = `auth:${token.substring(0, 20)}`\n          await kv.put(cacheKey, JSON.stringify(payload), { expirationTtl: 300 })\n        }\n      }\n\n      if (!payload) {\n        // Check if this is a browser request (HTML accept header)\n        const acceptHeader = c.req.header('Accept') || ''\n        if (acceptHeader.includes('text/html')) {\n          return c.redirect('/auth/login?error=Your session has expired, please login again')\n        }\n        return c.json({ error: 'Invalid or expired token' }, 401)\n      }\n\n      // Add user info to context\n      c.set('user', payload)\n\n      return await next()\n    } catch (error) {\n      console.error('Auth middleware error:', error)\n      // Check if this is a browser request (HTML accept header)\n      const acceptHeader = c.req.header('Accept') || ''\n      if (acceptHeader.includes('text/html')) {\n        return c.redirect('/auth/login?error=Authentication failed, please login again')\n      }\n      return c.json({ error: 'Authentication failed' }, 401)\n    }\n  }\n}\n\n// Middleware to require specific role\nexport const requireRole = (requiredRole: string | string[]) => {\n  return async (c: Context, next: Next) => {\n    const user = c.get('user') as JWTPayload\n    \n    if (!user) {\n      // Check if this is a browser request (HTML accept header)\n      const acceptHeader = c.req.header('Accept') || ''\n      if (acceptHeader.includes('text/html')) {\n        return c.redirect('/auth/login?error=Please login to access the admin area')\n      }\n      return c.json({ error: 'Authentication required' }, 401)\n    }\n    \n    const roles = Array.isArray(requiredRole) ? requiredRole : [requiredRole]\n    \n    if (!roles.includes(user.role)) {\n      // Check if this is a browser request (HTML accept header)\n      const acceptHeader = c.req.header('Accept') || ''\n      if (acceptHeader.includes('text/html')) {\n        return c.redirect('/auth/login?error=You do not have permission to access this area')\n      }\n      return c.json({ error: 'Insufficient permissions' }, 403)\n    }\n    \n    return await next()\n  }\n}\n\n// Optional auth middleware (doesn't block if no token)\nexport const optionalAuth = () => {\n  return async (c: Context, next: Next) => {\n    try {\n      let token = c.req.header('Authorization')?.replace('Bearer ', '')\n      \n      if (!token) {\n        token = getCookie(c, 'auth_token')\n      }\n      \n      if (token) {\n        const payload = await AuthManager.verifyToken(token)\n        if (payload) {\n          c.set('user', payload)\n        }\n      }\n      \n      return await next()\n    } catch (error) {\n      // Don't block on auth errors in optional auth\n      console.error('Optional auth error:', error)\n      return await next()\n    }\n  }\n}\n","import { MiddlewareHandler } from 'hono'\nimport { metricsTracker } from '../utils/metrics'\n\n/**\n * Middleware to track all HTTP requests for real-time analytics\n * Excludes the metrics endpoint itself to avoid inflating the count\n */\nexport const metricsMiddleware = (): MiddlewareHandler => {\n  return async (c, next) => {\n    const path = new URL(c.req.url).pathname\n\n    // Don't track the metrics endpoint itself to avoid self-inflating counts\n    if (path !== '/admin/dashboard/api/metrics') {\n      metricsTracker.recordRequest()\n    }\n\n    // Continue with the request\n    await next()\n  }\n}\n","/**\n * Middleware Module Exports\n *\n * Request processing middleware for SonicJS\n *\n * Note: Most middleware is currently in the monolith and will be migrated later.\n * For now, we only export the bootstrap middleware which is used for system initialization.\n */\n\n// Bootstrap middleware\nexport { bootstrapMiddleware } from './bootstrap'\n\n// Auth middleware\nexport { AuthManager, requireAuth, requireRole, optionalAuth } from './auth'\n\n// Metrics middleware\nexport { metricsMiddleware } from './metrics'\n\n// Re-export types and functions that are referenced but implemented in monolith\n// These are placeholder exports to maintain API compatibility\nexport type Permission = string\nexport type UserPermissions = {\n  userId: string\n  permissions: Permission[]\n}\n\n// Middleware stubs - these return pass-through middleware that call next()\nexport const loggingMiddleware: any = () => async (_c: any, next: any) => await next()\nexport const detailedLoggingMiddleware: any = () => async (_c: any, next: any) => await next()\nexport const securityLoggingMiddleware: any = () => async (_c: any, next: any) => await next()\nexport const performanceLoggingMiddleware: any = () => async (_c: any, next: any) => await next()\nexport const cacheHeaders: any = () => async (_c: any, next: any) => await next()\nexport const compressionMiddleware: any = async (_c: any, next: any) => await next()\nexport const securityHeaders: any = () => async (_c: any, next: any) => await next()\n\n// Other stubs\nexport const PermissionManager: any = {}\nexport const requirePermission: any = () => async (_c: any, next: any) => await next()\nexport const requireAnyPermission: any = () => async (_c: any, next: any) => await next()\nexport const logActivity: any = () => {}\nexport const requireActivePlugin: any = () => async (_c: any, next: any) => await next()\nexport const requireActivePlugins: any = () => async (_c: any, next: any) => await next()\nexport const getActivePlugins: any = () => []\nexport const isPluginActive: any = () => false\n"]}

package/dist/{chunk-DTLB6UIH.cjs → chunk-Y72M3MVX.cjs}

@@ -1,5 +1,6 @@
 'use strict';
 
+var chunkYHW27CBV_cjs = require('./chunk-YHW27CBV.cjs');
 var chunkKYGRJCZM_cjs = require('./chunk-KYGRJCZM.cjs');
 var chunkIGJUBJBW_cjs = require('./chunk-IGJUBJBW.cjs');
 var zod = require('zod');
@@ -3083,11 +3084,288 @@ var PluginManager = class {
   }
 };
 
+// src/plugins/core-plugins/turnstile-plugin/manifest.json
+var manifest_default = {
+  id: "turnstile",
+  name: "Cloudflare Turnstile",
+  description: "CAPTCHA-free bot protection using Cloudflare Turnstile. Provides reusable verification for any form.",
+  version: "1.0.0",
+  author: "SonicJS",
+  category: "security",
+  icon: "shield-check",
+  homepage: "https://developers.cloudflare.com/turnstile/",
+  repository: "https://github.com/sonicjs/sonicjs",
+  license: "MIT",
+  permissions: ["settings:write", "admin:access"],
+  dependencies: [],
+  configSchema: {
+    siteKey: {
+      type: "string",
+      label: "Site Key",
+      description: "Your Cloudflare Turnstile site key (public)",
+      required: true
+    },
+    secretKey: {
+      type: "string",
+      label: "Secret Key",
+      description: "Your Cloudflare Turnstile secret key (private)",
+      required: true,
+      sensitive: true
+    },
+    theme: {
+      type: "select",
+      label: "Widget Theme",
+      description: "Visual theme for the Turnstile widget",
+      default: "auto",
+      options: [
+        { value: "light", label: "Light" },
+        { value: "dark", label: "Dark" },
+        { value: "auto", label: "Auto" }
+      ]
+    },
+    size: {
+      type: "select",
+      label: "Widget Size",
+      description: "Size of the Turnstile widget",
+      default: "normal",
+      options: [
+        { value: "normal", label: "Normal" },
+        { value: "compact", label: "Compact" }
+      ]
+    },
+    mode: {
+      type: "select",
+      label: "Widget Mode",
+      description: "Managed: Adaptive challenge. Non-Interactive: Always visible, minimal friction. Invisible: No visible widget",
+      default: "managed",
+      options: [
+        { value: "managed", label: "Managed (Recommended)" },
+        { value: "non-interactive", label: "Non-Interactive" },
+        { value: "invisible", label: "Invisible" }
+      ]
+    },
+    appearance: {
+      type: "select",
+      label: "Appearance",
+      description: "When the Turnstile challenge is executed. Always: Verifies immediately. Execute: Challenge on form submit. Interaction Only: Only after user interaction",
+      default: "always",
+      options: [
+        { value: "always", label: "Always" },
+        { value: "execute", label: "Execute" },
+        { value: "interaction-only", label: "Interaction Only" }
+      ]
+    },
+    preClearance: {
+      type: "boolean",
+      label: "Enable Pre-clearance",
+      description: "Issue a clearance cookie that bypasses Cloudflare Firewall Rules (as if the user passed a challenge on your proxied site)",
+      default: false
+    },
+    preClearanceLevel: {
+      type: "select",
+      label: "Pre-clearance Level",
+      description: "Controls which Cloudflare Firewall Rules the clearance cookie bypasses. Only applies if Pre-clearance is enabled",
+      default: "managed",
+      options: [
+        { value: "interactive", label: "Interactive - Bypasses Interactive, Managed & JS Challenge Rules" },
+        { value: "managed", label: "Managed - Bypasses Managed & JS Challenge Rules" },
+        { value: "non-interactive", label: "Non-interactive - Bypasses JS Challenge Rules only" }
+      ]
+    },
+    enabled: {
+      type: "boolean",
+      label: "Enable Turnstile",
+      description: "Enable or disable Turnstile verification globally",
+      default: true
+    }
+  },
+  adminMenu: {
+    label: "Turnstile",
+    icon: "shield-check",
+    href: "/admin/plugins/turnstile/settings",
+    parentId: "plugins",
+    order: 100
+  }
+};
+
+// src/plugins/core-plugins/turnstile-plugin/services/turnstile.ts
+var TurnstileService = class {
+  db;
+  VERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+  constructor(db) {
+    this.db = db;
+  }
+  /**
+   * Get Turnstile settings from database
+   */
+  async getSettings() {
+    try {
+      const plugin = await this.db.prepare(`SELECT settings FROM plugins WHERE id = ? LIMIT 1`).bind(manifest_default.id).first();
+      if (!plugin || !plugin.settings) {
+        return null;
+      }
+      return JSON.parse(plugin.settings);
+    } catch (error) {
+      console.error("Error getting Turnstile settings:", error);
+      return null;
+    }
+  }
+  /**
+   * Verify a Turnstile token with Cloudflare
+   */
+  async verifyToken(token, remoteIp) {
+    try {
+      const settings = await this.getSettings();
+      if (!settings) {
+        return { success: false, error: "Turnstile not configured" };
+      }
+      if (!settings.enabled) {
+        return { success: true };
+      }
+      if (!settings.secretKey) {
+        return { success: false, error: "Turnstile secret key not configured" };
+      }
+      const formData = new FormData();
+      formData.append("secret", settings.secretKey);
+      formData.append("response", token);
+      if (remoteIp) {
+        formData.append("remoteip", remoteIp);
+      }
+      const response = await fetch(this.VERIFY_URL, {
+        method: "POST",
+        body: formData
+      });
+      if (!response.ok) {
+        return { success: false, error: "Turnstile verification request failed" };
+      }
+      const result = await response.json();
+      if (!result.success) {
+        const errorCode = result["error-codes"]?.[0] || "unknown-error";
+        return { success: false, error: `Turnstile verification failed: ${errorCode}` };
+      }
+      return { success: true };
+    } catch (error) {
+      console.error("Error verifying Turnstile token:", error);
+      return { success: false, error: "Turnstile verification error" };
+    }
+  }
+  /**
+   * Save Turnstile settings to database
+   */
+  async saveSettings(settings) {
+    try {
+      await this.db.prepare(`UPDATE plugins SET settings = ?, updated_at = ? WHERE id = ?`).bind(JSON.stringify(settings), Date.now(), manifest_default.id).run();
+      console.log("Turnstile settings saved successfully");
+    } catch (error) {
+      console.error("Error saving Turnstile settings:", error);
+      throw new Error("Failed to save Turnstile settings");
+    }
+  }
+  /**
+   * Check if Turnstile is enabled
+   */
+  async isEnabled() {
+    const settings = await this.getSettings();
+    return settings?.enabled === true && !!settings.siteKey && !!settings.secretKey;
+  }
+};
+
+// src/plugins/core-plugins/turnstile-plugin/middleware/verify.ts
+async function verifyTurnstile(c, next) {
+  const db = c.get("db") || c.env?.DB;
+  if (!db) {
+    console.error("Turnstile middleware: Database not available");
+    return c.json({ error: "Database not available" }, 500);
+  }
+  const turnstileService = new TurnstileService(db);
+  const isEnabled = await turnstileService.isEnabled();
+  if (!isEnabled) {
+    return next();
+  }
+  let token;
+  let body;
+  if (c.req.method === "POST") {
+    const contentType = c.req.header("content-type") || "";
+    if (contentType.includes("application/json")) {
+      body = await c.req.json();
+      token = body["cf-turnstile-response"] || body["turnstile-token"];
+      c.set("requestBody", body);
+    } else if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+      const formData = await c.req.formData();
+      token = formData.get("cf-turnstile-response")?.toString() || formData.get("turnstile-token")?.toString();
+    }
+  }
+  if (!token) {
+    return c.json({
+      error: "Turnstile token missing",
+      message: "Please complete the verification challenge"
+    }, 400);
+  }
+  const remoteIp = c.req.header("cf-connecting-ip") || c.req.header("x-forwarded-for");
+  const result = await turnstileService.verifyToken(token, remoteIp);
+  if (!result.success) {
+    return c.json({
+      error: "Turnstile verification failed",
+      message: result.error || "Verification failed. Please try again."
+    }, 403);
+  }
+  return next();
+}
+function createTurnstileMiddleware(options) {
+  return async (c, next) => {
+    const db = c.get("db") || c.env?.DB;
+    if (!db) {
+      return options?.onError?.(c, "Database not available") || c.json({ error: "Database not available" }, 500);
+    }
+    const turnstileService = new TurnstileService(db);
+    const isEnabled = await turnstileService.isEnabled();
+    if (!isEnabled) {
+      return next();
+    }
+    let token;
+    const contentType = c.req.header("content-type") || "";
+    if (contentType.includes("application/json")) {
+      const body = await c.req.json();
+      token = body["cf-turnstile-response"] || body["turnstile-token"];
+      c.set("requestBody", body);
+    } else if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+      const formData = await c.req.formData();
+      token = formData.get("cf-turnstile-response")?.toString() || formData.get("turnstile-token")?.toString();
+    }
+    if (!token) {
+      return options?.onMissing?.(c) || c.json({ error: "Turnstile token missing" }, 400);
+    }
+    const remoteIp = c.req.header("cf-connecting-ip") || c.req.header("x-forwarded-for");
+    const result = await turnstileService.verifyToken(token, remoteIp);
+    if (!result.success) {
+      return options?.onError?.(c, result.error || "Verification failed") || c.json({ error: "Turnstile verification failed", message: result.error }, 403);
+    }
+    return next();
+  };
+}
+
+// src/plugins/core-plugins/turnstile-plugin/index.ts
+new chunkYHW27CBV_cjs.PluginBuilder({
+  name: manifest_default.name,
+  version: manifest_default.version,
+  description: manifest_default.description,
+  author: { name: manifest_default.author }
+}).metadata({
+  description: manifest_default.description,
+  author: { name: manifest_default.author }
+}).addService("turnstile", TurnstileService).addSingleMiddleware("verifyTurnstile", verifyTurnstile, {
+  description: "Verify Cloudflare Turnstile token",
+  global: false
+}).build();
+
 exports.HookSystemImpl = HookSystemImpl;
 exports.HookUtils = HookUtils;
 exports.PluginManager = PluginManager;
 exports.PluginRegistryImpl = PluginRegistryImpl;
 exports.PluginValidator = PluginValidator;
 exports.ScopedHookSystem = ScopedHookSystem;
-//# sourceMappingURL=chunk-DTLB6UIH.cjs.map
-//# sourceMappingURL=chunk-DTLB6UIH.cjs.map
+exports.TurnstileService = TurnstileService;
+exports.createTurnstileMiddleware = createTurnstileMiddleware;
+exports.verifyTurnstile = verifyTurnstile;
+//# sourceMappingURL=chunk-Y72M3MVX.cjs.map
+//# sourceMappingURL=chunk-Y72M3MVX.cjs.map