@sonicjs-cms/core 2.8.1 → 2.8.3

package/dist/chunk-TQABQWOP.js

@@ -0,0 +1,39 @@
+// src/utils/sanitize.ts
+function escapeHtml(text) {
+  if (typeof text !== "string") {
+    return "";
+  }
+  const map = {
+    "&": "&",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': "&quot;",
+    "'": "&#039;"
+  };
+  return text.replace(/[&<>"']/g, (char) => map[char] || char);
+}
+function sanitizeInput(input) {
+  if (!input) {
+    return "";
+  }
+  return escapeHtml(String(input).trim());
+}
+function sanitizeRichText(html) {
+  if (typeof html !== "string") {
+    return "";
+  }
+  return html.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, "").replace(/\s+on\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "").replace(/(href|src|action)\s*=\s*"javascript:[^"]*"/gi, '$1=""').replace(/(href|src|action)\s*=\s*'javascript:[^']*'/gi, "$1=''");
+}
+function sanitizeObject(obj, fields) {
+  const sanitized = { ...obj };
+  for (const field of fields) {
+    if (typeof obj[field] === "string") {
+      sanitized[field] = sanitizeInput(obj[field]);
+    }
+  }
+  return sanitized;
+}
+
+export { escapeHtml, sanitizeInput, sanitizeObject, sanitizeRichText };
+//# sourceMappingURL=chunk-TQABQWOP.js.map
+//# sourceMappingURL=chunk-TQABQWOP.js.map

package/dist/chunk-TQABQWOP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/sanitize.ts"],"names":[],"mappings":";AASO,SAAS,WAAW,IAAA,EAAsB;AAC/C,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,OAAO,EAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAA8B;AAAA,IAClC,GAAA,EAAK,OAAA;AAAA,IACL,GAAA,EAAK,MAAA;AAAA,IACL,GAAA,EAAK,MAAA;AAAA,IACL,GAAA,EAAK,QAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACP;AAEA,EAAA,OAAO,IAAA,CAAK,QAAQ,UAAA,EAAY,CAAC,SAAS,GAAA,CAAI,IAAI,KAAK,IAAI,CAAA;AAC7D;AAQO,SAAS,cAAc,KAAA,EAA0C;AACtE,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,EAAA;AAAA,EACT;AACA,EAAA,OAAO,UAAA,CAAW,MAAA,CAAO,KAAK,CAAA,CAAE,MAAM,CAAA;AACxC;AAQO,SAAS,iBAAiB,IAAA,EAAsB;AACrD,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,OAAO,EAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA,CAEJ,OAAA,CAAQ,qDAAA,EAAuD,EAAE,EAEjE,OAAA,CAAQ,8CAAA,EAAgD,EAAE,CAAA,CAE1D,QAAQ,8CAAA,EAAgD,OAAO,CAAA,CAC/D,OAAA,CAAQ,gDAAgD,OAAO,CAAA;AACpE;AAQO,SAAS,cAAA,CACd,KACA,MAAA,EACG;AACH,EAAA,MAAM,SAAA,GAAY,EAAE,GAAG,GAAA,EAAI;AAE3B,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,IAAI,OAAO,GAAA,CAAI,KAAK,CAAA,KAAM,QAAA,EAAU;AAClC,MAAA,SAAA,CAAU,KAAK,CAAA,GAAI,aAAA,CAAc,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,IAC7C;AAAA,EACF;AAEA,EAAA,OAAO,SAAA;AACT","file":"chunk-TQABQWOP.js","sourcesContent":["/**\n * HTML sanitization utilities for preventing XSS attacks\n */\n\n/**\n * Escapes HTML special characters to prevent XSS attacks\n * @param text - The text to escape\n * @returns The escaped text safe for HTML output\n */\nexport function escapeHtml(text: string): string {\n  if (typeof text !== 'string') {\n    return ''\n  }\n\n  const map: Record<string, string> = {\n    '&': '&amp;',\n    '<': '&lt;',\n    '>': '&gt;',\n    '\"': '&quot;',\n    \"'\": '&#039;'\n  }\n\n  return text.replace(/[&<>\"']/g, (char) => map[char] || char)\n}\n\n/**\n * Sanitizes user input by escaping HTML special characters\n * This should be used for all user-provided text fields to prevent XSS\n * @param input - The input string to sanitize\n * @returns The sanitized string\n */\nexport function sanitizeInput(input: string | null | undefined): string {\n  if (!input) {\n    return ''\n  }\n  return escapeHtml(String(input).trim())\n}\n\n/**\n * Sanitizes rich text HTML by stripping dangerous elements while preserving\n * legitimate formatting. Removes script tags, event handlers, and javascript: URLs.\n * @param html - The rich text HTML to sanitize\n * @returns Sanitized HTML safe for rendering\n */\nexport function sanitizeRichText(html: string): string {\n  if (typeof html !== 'string') {\n    return ''\n  }\n\n  return html\n    // Remove script tags and their contents\n    .replace(/<script\\b[^<]*(?:(?!<\\/script>)<[^<]*)*<\\/script>/gi, '')\n    // Remove event handler attributes (on*)\n    .replace(/\\s+on\\w+\\s*=\\s*(?:\"[^\"]*\"|'[^']*'|[^\\s>]+)/gi, '')\n    // Remove javascript: URLs in href/src/action attributes\n    .replace(/(href|src|action)\\s*=\\s*\"javascript:[^\"]*\"/gi, '$1=\"\"')\n    .replace(/(href|src|action)\\s*=\\s*'javascript:[^']*'/gi, \"$1=''\")\n}\n\n/**\n * Sanitizes an object's string properties\n * @param obj - Object with string properties to sanitize\n * @param fields - Array of field names to sanitize\n * @returns New object with sanitized fields\n */\nexport function sanitizeObject<T extends Record<string, any>>(\n  obj: T,\n  fields: (keyof T)[]\n): T {\n  const sanitized = { ...obj }\n\n  for (const field of fields) {\n    if (typeof obj[field] === 'string') {\n      sanitized[field] = sanitizeInput(obj[field]) as T[keyof T]\n    }\n  }\n\n  return sanitized\n}\n"]}

package/dist/chunk-Y3VMEGY2.js

@@ -0,0 +1,541 @@
+import { syncCollections, PluginBootstrapService } from './chunk-YFJJU26H.js';
+import { MigrationService } from './chunk-GTFMI24U.js';
+import { metricsTracker } from './chunk-FICTAGD4.js';
+import { sign, verify } from 'hono/jwt';
+import { setCookie, getCookie } from 'hono/cookie';
+
+// src/middleware/bootstrap.ts
+var bootstrapComplete = false;
+function verifySecurityConfig(env) {
+  const warnings = [];
+  if (!env.JWT_SECRET) {
+    warnings.push(
+      "JWT_SECRET is not set \u2014 using hardcoded fallback. Set via `wrangler secret put JWT_SECRET`"
+    );
+  } else if (env.JWT_SECRET.includes("change-in-production")) {
+    warnings.push(
+      "JWT_SECRET contains the default value \u2014 tokens are forgeable. Generate a strong random secret"
+    );
+  }
+  if (!env.CORS_ORIGINS) {
+    warnings.push(
+      "CORS_ORIGINS is not set \u2014 all cross-origin API requests will be rejected"
+    );
+  }
+  if (!env.ENVIRONMENT) {
+    warnings.push(
+      'ENVIRONMENT is not set \u2014 HSTS header will not be applied. Set to "production" or "development"'
+    );
+  }
+  if (warnings.length === 0) {
+    return;
+  }
+  const isProduction = env.ENVIRONMENT === "production";
+  for (const warning of warnings) {
+    console.warn(`[SonicJS Security] ${warning}`);
+  }
+  if (isProduction) {
+    const hasCritical = !env.JWT_SECRET || env.JWT_SECRET.includes("change-in-production");
+    if (hasCritical) {
+      throw new Error(
+        "[SonicJS Security] CRITICAL: Production deployment is missing a secure JWT_SECRET. Set it via `wrangler secret put JWT_SECRET` before deploying."
+      );
+    }
+  }
+}
+function bootstrapMiddleware(config = {}) {
+  return async (c, next) => {
+    if (bootstrapComplete) {
+      return next();
+    }
+    const path = c.req.path;
+    if (path.startsWith("/images/") || path.startsWith("/assets/") || path === "/health" || path.endsWith(".js") || path.endsWith(".css") || path.endsWith(".png") || path.endsWith(".jpg") || path.endsWith(".ico")) {
+      return next();
+    }
+    try {
+      console.log("[Bootstrap] Starting system initialization...");
+      console.log("[Bootstrap] Running database migrations...");
+      const migrationService = new MigrationService(c.env.DB);
+      await migrationService.runPendingMigrations();
+      console.log("[Bootstrap] Syncing collection configurations...");
+      try {
+        await syncCollections(c.env.DB);
+      } catch (error) {
+        console.error("[Bootstrap] Error syncing collections:", error);
+      }
+      if (!config.plugins?.disableAll) {
+        console.log("[Bootstrap] Bootstrapping core plugins...");
+        const bootstrapService = new PluginBootstrapService(c.env.DB);
+        const needsBootstrap = await bootstrapService.isBootstrapNeeded();
+        if (needsBootstrap) {
+          await bootstrapService.bootstrapCorePlugins();
+        }
+      } else {
+        console.log("[Bootstrap] Plugin bootstrap skipped (disableAll is true)");
+      }
+      bootstrapComplete = true;
+      console.log("[Bootstrap] System initialization completed");
+    } catch (error) {
+      console.error("[Bootstrap] Error during system initialization:", error);
+    }
+    verifySecurityConfig(c.env);
+    return next();
+  };
+}
+var JWT_SECRET_FALLBACK = "your-super-secret-jwt-key-change-in-production";
+var AuthManager = class {
+  static async generateToken(userId, email, role, secret) {
+    const payload = {
+      userId,
+      email,
+      role,
+      exp: Math.floor(Date.now() / 1e3) + 60 * 60 * 24,
+      // 24 hours
+      iat: Math.floor(Date.now() / 1e3)
+    };
+    return await sign(payload, secret || JWT_SECRET_FALLBACK, "HS256");
+  }
+  static async verifyToken(token, secret) {
+    try {
+      const payload = await verify(token, secret || JWT_SECRET_FALLBACK, "HS256");
+      if (payload.exp < Math.floor(Date.now() / 1e3)) {
+        return null;
+      }
+      return payload;
+    } catch (error) {
+      console.error("Token verification failed:", error);
+      return null;
+    }
+  }
+  static async hashPassword(password) {
+    const iterations = 1e5;
+    const salt = new Uint8Array(16);
+    crypto.getRandomValues(salt);
+    const encoder = new TextEncoder();
+    const keyMaterial = await crypto.subtle.importKey(
+      "raw",
+      encoder.encode(password),
+      "PBKDF2",
+      false,
+      ["deriveBits"]
+    );
+    const hashBuffer = await crypto.subtle.deriveBits(
+      {
+        name: "PBKDF2",
+        salt,
+        iterations,
+        hash: "SHA-256"
+      },
+      keyMaterial,
+      256
+    );
+    const saltHex = Array.from(salt).map((b) => b.toString(16).padStart(2, "0")).join("");
+    const hashHex = Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+    return `pbkdf2:${iterations}:${saltHex}:${hashHex}`;
+  }
+  static async hashPasswordLegacy(password) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(password + "salt-change-in-production");
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+  static async verifyPassword(password, storedHash) {
+    if (storedHash.startsWith("pbkdf2:")) {
+      const parts = storedHash.split(":");
+      if (parts.length !== 4) return false;
+      const iterationsStr = parts[1];
+      const saltHex = parts[2];
+      const expectedHashHex = parts[3];
+      const iterations = parseInt(iterationsStr, 10);
+      const saltBytes = saltHex.match(/.{2}/g);
+      if (!saltBytes) return false;
+      const salt = new Uint8Array(saltBytes.map((byte) => parseInt(byte, 16)));
+      const encoder = new TextEncoder();
+      const keyMaterial = await crypto.subtle.importKey(
+        "raw",
+        encoder.encode(password),
+        "PBKDF2",
+        false,
+        ["deriveBits"]
+      );
+      const hashBuffer = await crypto.subtle.deriveBits(
+        {
+          name: "PBKDF2",
+          salt,
+          iterations,
+          hash: "SHA-256"
+        },
+        keyMaterial,
+        256
+      );
+      const actualHashHex = Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+      if (actualHashHex.length !== expectedHashHex.length) return false;
+      let result2 = 0;
+      for (let i = 0; i < actualHashHex.length; i++) {
+        result2 |= actualHashHex.charCodeAt(i) ^ expectedHashHex.charCodeAt(i);
+      }
+      return result2 === 0;
+    }
+    const legacyHash = await this.hashPasswordLegacy(password);
+    if (legacyHash.length !== storedHash.length) return false;
+    let result = 0;
+    for (let i = 0; i < legacyHash.length; i++) {
+      result |= legacyHash.charCodeAt(i) ^ storedHash.charCodeAt(i);
+    }
+    return result === 0;
+  }
+  static isLegacyHash(storedHash) {
+    return !storedHash.startsWith("pbkdf2:");
+  }
+  /**
+   * Set authentication cookie - useful for plugins implementing alternative auth methods
+   * @param c - Hono context
+   * @param token - JWT token to set in cookie
+   * @param options - Optional cookie configuration
+   */
+  static setAuthCookie(c, token, options) {
+    setCookie(c, "auth_token", token, {
+      httpOnly: options?.httpOnly ?? true,
+      secure: options?.secure ?? true,
+      sameSite: options?.sameSite ?? "Strict",
+      maxAge: options?.maxAge ?? 60 * 60 * 24
+      // 24 hours default
+    });
+  }
+};
+var requireAuth = () => {
+  return async (c, next) => {
+    try {
+      let token = c.req.header("Authorization")?.replace("Bearer ", "");
+      if (!token) {
+        token = getCookie(c, "auth_token");
+      }
+      if (!token) {
+        const acceptHeader = c.req.header("Accept") || "";
+        if (acceptHeader.includes("text/html")) {
+          return c.redirect("/auth/login?error=Please login to access the admin area");
+        }
+        return c.json({ error: "Authentication required" }, 401);
+      }
+      const kv = c.env?.KV;
+      let payload = null;
+      if (kv) {
+        const cacheKey = `auth:${token.substring(0, 20)}`;
+        const cached = await kv.get(cacheKey, "json");
+        if (cached) {
+          payload = cached;
+        }
+      }
+      if (!payload) {
+        const jwtSecret = c.env?.JWT_SECRET;
+        payload = await AuthManager.verifyToken(token, jwtSecret);
+        if (payload && kv) {
+          const cacheKey = `auth:${token.substring(0, 20)}`;
+          await kv.put(cacheKey, JSON.stringify(payload), { expirationTtl: 300 });
+        }
+      }
+      if (!payload) {
+        const acceptHeader = c.req.header("Accept") || "";
+        if (acceptHeader.includes("text/html")) {
+          return c.redirect("/auth/login?error=Your session has expired, please login again");
+        }
+        return c.json({ error: "Invalid or expired token" }, 401);
+      }
+      c.set("user", payload);
+      return await next();
+    } catch (error) {
+      console.error("Auth middleware error:", error);
+      const acceptHeader = c.req.header("Accept") || "";
+      if (acceptHeader.includes("text/html")) {
+        return c.redirect("/auth/login?error=Authentication failed, please login again");
+      }
+      return c.json({ error: "Authentication failed" }, 401);
+    }
+  };
+};
+var requireRole = (requiredRole) => {
+  return async (c, next) => {
+    const user = c.get("user");
+    if (!user) {
+      const acceptHeader = c.req.header("Accept") || "";
+      if (acceptHeader.includes("text/html")) {
+        return c.redirect("/auth/login?error=Please login to access the admin area");
+      }
+      return c.json({ error: "Authentication required" }, 401);
+    }
+    const roles = Array.isArray(requiredRole) ? requiredRole : [requiredRole];
+    if (!roles.includes(user.role)) {
+      const acceptHeader = c.req.header("Accept") || "";
+      if (acceptHeader.includes("text/html")) {
+        return c.redirect("/auth/login?error=You do not have permission to access this area");
+      }
+      return c.json({ error: "Insufficient permissions" }, 403);
+    }
+    return await next();
+  };
+};
+var optionalAuth = () => {
+  return async (c, next) => {
+    try {
+      let token = c.req.header("Authorization")?.replace("Bearer ", "");
+      if (!token) {
+        token = getCookie(c, "auth_token");
+      }
+      if (token) {
+        const jwtSecret = c.env?.JWT_SECRET;
+        const payload = await AuthManager.verifyToken(token, jwtSecret);
+        if (payload) {
+          c.set("user", payload);
+        }
+      }
+      return await next();
+    } catch (error) {
+      console.error("Optional auth error:", error);
+      return await next();
+    }
+  };
+};
+
+// src/middleware/metrics.ts
+var metricsMiddleware = () => {
+  return async (c, next) => {
+    const path = new URL(c.req.url).pathname;
+    if (path !== "/admin/dashboard/api/metrics") {
+      metricsTracker.recordRequest();
+    }
+    await next();
+  };
+};
+var JWT_SECRET_FALLBACK2 = "your-super-secret-jwt-key-change-in-production";
+function arrayBufferToBase64Url(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function getHmacKey(secret) {
+  const encoder = new TextEncoder();
+  return crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"]
+  );
+}
+async function generateCsrfToken(secret) {
+  const nonceBytes = new Uint8Array(32);
+  crypto.getRandomValues(nonceBytes);
+  const nonce = arrayBufferToBase64Url(nonceBytes.buffer);
+  const key = await getHmacKey(secret);
+  const encoder = new TextEncoder();
+  const signatureBuffer = await crypto.subtle.sign("HMAC", key, encoder.encode(nonce));
+  const signature = arrayBufferToBase64Url(signatureBuffer);
+  return `${nonce}.${signature}`;
+}
+async function validateCsrfToken(token, secret) {
+  if (!token || typeof token !== "string") return false;
+  const dotIndex = token.indexOf(".");
+  if (dotIndex === -1) return false;
+  const nonce = token.substring(0, dotIndex);
+  const signature = token.substring(dotIndex + 1);
+  if (!nonce || !signature) return false;
+  try {
+    const key = await getHmacKey(secret);
+    const encoder = new TextEncoder();
+    const sigPadded = signature.replace(/-/g, "+").replace(/_/g, "/");
+    const sigBinary = atob(sigPadded);
+    const sigBytes = new Uint8Array(sigBinary.length);
+    for (let i = 0; i < sigBinary.length; i++) {
+      sigBytes[i] = sigBinary.charCodeAt(i);
+    }
+    return await crypto.subtle.verify("HMAC", key, sigBytes.buffer, encoder.encode(nonce));
+  } catch {
+    return false;
+  }
+}
+var DEFAULT_EXEMPT_PATHS = [
+  "/auth/login",
+  "/auth/register",
+  "/auth/seed-admin",
+  "/auth/accept-invitation",
+  "/auth/reset-password",
+  "/auth/request-password-reset"
+];
+function isExemptPath(path, extraExemptPaths = []) {
+  if (path.startsWith("/forms/") || path.startsWith("/api/forms/") || path === "/forms" || path === "/api/forms") {
+    return true;
+  }
+  if (path.startsWith("/api/search")) {
+    return true;
+  }
+  const allExempt = [...DEFAULT_EXEMPT_PATHS, ...extraExemptPaths];
+  for (const exempt of allExempt) {
+    if (path === exempt || path.startsWith(exempt + "/")) {
+      return true;
+    }
+  }
+  return false;
+}
+function csrfProtection(options = {}) {
+  return async (c, next) => {
+    const method = c.req.method.toUpperCase();
+    const path = new URL(c.req.url).pathname;
+    const secret = c.env?.JWT_SECRET || JWT_SECRET_FALLBACK2;
+    if (c.env?.ENVIRONMENT === "production" && !c.env?.JWT_SECRET) {
+      console.warn(
+        "[CSRF] WARNING: JWT_SECRET is not set in production. CSRF tokens are signed with the fallback key, which is insecure."
+      );
+    }
+    if (method === "GET" || method === "HEAD" || method === "OPTIONS") {
+      await ensureCsrfCookie(c, secret);
+      await next();
+      return;
+    }
+    if (isExemptPath(path, options.exemptPaths)) {
+      await next();
+      return;
+    }
+    const authCookie = getCookie(c, "auth_token");
+    if (!authCookie) {
+      await next();
+      return;
+    }
+    const cookieToken = getCookie(c, "csrf_token");
+    let headerToken = c.req.header("X-CSRF-Token");
+    if (!headerToken) {
+      const contentType = c.req.header("Content-Type") || "";
+      if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+        try {
+          const body = await c.req.parseBody();
+          headerToken = body["_csrf"];
+        } catch {
+        }
+      }
+    }
+    if (!cookieToken || !headerToken) {
+      return csrfError(c, "CSRF token missing");
+    }
+    if (cookieToken !== headerToken) {
+      return csrfError(c, "CSRF token mismatch");
+    }
+    const isValid = await validateCsrfToken(cookieToken, secret);
+    if (!isValid) {
+      return csrfError(c, "CSRF token invalid");
+    }
+    await next();
+  };
+}
+async function ensureCsrfCookie(c, secret) {
+  const existing = getCookie(c, "csrf_token");
+  if (existing) {
+    const isValid = await validateCsrfToken(existing, secret);
+    if (isValid) {
+      c.set("csrfToken", existing);
+      return;
+    }
+  }
+  const token = await generateCsrfToken(secret);
+  c.set("csrfToken", token);
+  const isDev = c.env?.ENVIRONMENT === "development" || !c.env?.ENVIRONMENT;
+  setCookie(c, "csrf_token", token, {
+    httpOnly: false,
+    // JS must read this cookie
+    secure: !isDev,
+    sameSite: "Strict",
+    path: "/",
+    maxAge: 86400
+    // 24 hours — browser-side expiry
+  });
+}
+function csrfError(c, message) {
+  const accept = c.req.header("Accept") || "";
+  if (accept.includes("text/html")) {
+    return c.html(
+      `<!DOCTYPE html><html><head><title>403 Forbidden</title></head><body><h1>403 Forbidden</h1><p>${message}</p></body></html>`,
+      403
+    );
+  }
+  return c.json({ error: message, status: 403 }, 403);
+}
+
+// src/middleware/rate-limit.ts
+function rateLimit(options) {
+  const { max, windowMs, keyPrefix } = options;
+  return async (c, next) => {
+    const kv = c.env?.CACHE_KV;
+    if (!kv) {
+      return await next();
+    }
+    const ip = c.req.header("cf-connecting-ip") || c.req.header("x-forwarded-for") || "unknown";
+    const key = `ratelimit:${keyPrefix}:${ip}`;
+    try {
+      const now = Date.now();
+      const stored = await kv.get(key, "json");
+      let entry;
+      if (stored && stored.resetAt > now) {
+        entry = stored;
+      } else {
+        entry = { count: 0, resetAt: now + windowMs };
+      }
+      entry.count++;
+      const ttlSeconds = Math.ceil((entry.resetAt - now) / 1e3);
+      if (entry.count > max) {
+        await kv.put(key, JSON.stringify(entry), { expirationTtl: Math.max(ttlSeconds, 1) });
+        const retryAfter = Math.ceil((entry.resetAt - now) / 1e3);
+        c.header("Retry-After", String(retryAfter));
+        c.header("X-RateLimit-Limit", String(max));
+        c.header("X-RateLimit-Remaining", "0");
+        c.header("X-RateLimit-Reset", String(Math.ceil(entry.resetAt / 1e3)));
+        return c.json({ error: "Too many requests. Please try again later." }, 429);
+      }
+      await kv.put(key, JSON.stringify(entry), { expirationTtl: Math.max(ttlSeconds, 1) });
+      c.header("X-RateLimit-Limit", String(max));
+      c.header("X-RateLimit-Remaining", String(max - entry.count));
+      c.header("X-RateLimit-Reset", String(Math.ceil(entry.resetAt / 1e3)));
+      return await next();
+    } catch (error) {
+      console.error("Rate limiter error (non-fatal):", error);
+      return await next();
+    }
+  };
+}
+
+// src/middleware/security-headers.ts
+var securityHeadersMiddleware = () => {
+  return async (c, next) => {
+    await next();
+    c.header("X-Content-Type-Options", "nosniff");
+    c.header("X-Frame-Options", "SAMEORIGIN");
+    c.header("Referrer-Policy", "strict-origin-when-cross-origin");
+    c.header("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
+    const environment = c.env?.ENVIRONMENT;
+    if (environment !== "development") {
+      c.header("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+    }
+  };
+};
+
+// src/middleware/index.ts
+var loggingMiddleware = () => async (_c, next) => await next();
+var detailedLoggingMiddleware = () => async (_c, next) => await next();
+var securityLoggingMiddleware = () => async (_c, next) => await next();
+var performanceLoggingMiddleware = () => async (_c, next) => await next();
+var cacheHeaders = () => async (_c, next) => await next();
+var compressionMiddleware = async (_c, next) => await next();
+var PermissionManager = {};
+var requirePermission = () => async (_c, next) => await next();
+var requireAnyPermission = () => async (_c, next) => await next();
+var logActivity = () => {
+};
+var requireActivePlugin = () => async (_c, next) => await next();
+var requireActivePlugins = () => async (_c, next) => await next();
+var getActivePlugins = () => [];
+var isPluginActive = () => false;
+
+export { AuthManager, PermissionManager, bootstrapMiddleware, cacheHeaders, compressionMiddleware, csrfProtection, detailedLoggingMiddleware, generateCsrfToken, getActivePlugins, isPluginActive, logActivity, loggingMiddleware, metricsMiddleware, optionalAuth, performanceLoggingMiddleware, rateLimit, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeadersMiddleware, securityLoggingMiddleware, validateCsrfToken, verifySecurityConfig };
+//# sourceMappingURL=chunk-Y3VMEGY2.js.map
+//# sourceMappingURL=chunk-Y3VMEGY2.js.map