@sonicjs-cms/core 3.0.0-beta.14 → 3.0.0-beta.15

package/dist/index.js

@@ -1,37 +1,37 @@
-import { createAuth } from './chunk-75JKPNUZ.js';
-import { getEmailService, hasEmailService, setEmailService, invalidateVariablesCache, resolveVariablesInObject, resolveDocScope, denyIfNotAllowed, DocumentRepository, dispatchHookEvent, getCustomData, renderTable, getVariablesCached, setVariablesCache, TenantService, isValidMemberRole, renderConfirmationDialog, getConfirmationDialogScript, VALID_MEMBER_ROLES, userProfilesPlugin, lexicalEditorPlugin, api_media_default, api_system_default, apiDocumentsRoutes, api_default, adminDocumentsRoutes, admin_api_default, adminCollectionsRoutes, adminSettingsRoutes, router2, admin_content_default, adminMediaRoutes, router, adminPluginRoutes, adminLogsRoutes, userRoutes, auth_default, test_cleanup_default } from './chunk-HNUGMALL.js';
-export { ROUTES_INFO, admin_api_default as adminApiRoutes, adminCheckboxRoutes, adminCollectionsRoutes, admin_content_default as adminContentRoutes, router as adminDashboardRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, userRoutes as adminUsersRoutes, api_content_crud_default as apiContentCrudRoutes, api_media_default as apiMediaRoutes, api_default as apiRoutes, api_system_default as apiSystemRoutes, auth_default as authRoutes, createUserProfilesPlugin, defineUserProfile, getUserProfileConfig, userProfilesPlugin } from './chunk-HNUGMALL.js';
-import './chunk-IESEVHXL.js';
+import { createAuth } from './chunk-IQZA2OY5.js';
+import { getEmailService, hasEmailService, setEmailService, invalidateVariablesCache, resolveVariablesInObject, resolveDocScope, denyIfNotAllowed, DocumentRepository, dispatchHookEvent, getCustomData, createDocumentSchema, renderTable, getVariablesCached, setVariablesCache, TenantService, isValidMemberRole, renderConfirmationDialog, getConfirmationDialogScript, VALID_MEMBER_ROLES, userProfilesPlugin, lexicalEditorPlugin, api_media_default, api_system_default, apiDocumentsRoutes, api_default, adminDocumentsRoutes, admin_api_default, adminCollectionsRoutes, adminSettingsRoutes, router2, admin_content_default, adminMediaRoutes, router, adminPluginRoutes, adminLogsRoutes, userRoutes, auth_default, test_cleanup_default } from './chunk-L3VIH6U4.js';
+export { ROUTES_INFO, admin_api_default as adminApiRoutes, adminCheckboxRoutes, adminCollectionsRoutes, admin_content_default as adminContentRoutes, router as adminDashboardRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, userRoutes as adminUsersRoutes, api_content_crud_default as apiContentCrudRoutes, api_media_default as apiMediaRoutes, api_default as apiRoutes, api_system_default as apiSystemRoutes, auth_default as authRoutes, createUserProfilesPlugin, defineUserProfile, getUserProfileConfig, userProfilesPlugin } from './chunk-L3VIH6U4.js';
+import './chunk-VVYVFCML.js';
 import './chunk-RMRJGMDE.js';
 import { SettingsService, setAppInstance } from './chunk-RQ6N3FTV.js';
 export { Logger, getLogger, initLogger } from './chunk-RQ6N3FTV.js';
 import { getAllCacheStats, CACHE_CONFIGS, getCacheService, clearAllCaches, parseCacheKey } from './chunk-K25XHMM3.js';
 import { schema_exports } from './chunk-AI663NBO.js';
 export { apiTokens, content, contentVersions, insertContentSchema, insertLogConfigSchema, insertMediaSchema, insertPluginActivityLogSchema, insertPluginAssetSchema, insertPluginHookSchema, insertPluginRouteSchema, insertPluginSchema, insertSystemLogSchema, insertUserSchema, insertWorkflowHistorySchema, logConfig, media, pluginActivityLog, pluginAssets, pluginHooks, pluginRoutes, plugins, selectContentSchema, selectLogConfigSchema, selectMediaSchema, selectPluginActivityLogSchema, selectPluginAssetSchema, selectPluginHookSchema, selectPluginRouteSchema, selectPluginSchema, selectSystemLogSchema, selectUserSchema, selectWorkflowHistorySchema, systemLogs, users, workflowHistory } from './chunk-AI663NBO.js';
-import { requireAuth, DocumentTypeRegistry, requireRbac, requireRole, getJwtExpirySecondsFromDb, AuthManager, metricsMiddleware, bootstrapMiddleware, securityHeadersMiddleware, csrfProtection } from './chunk-O32IZ6JS.js';
-export { AuthManager, PermissionManager, bootstrapDocumentTypes, bootstrapMiddleware, cacheHeaders, compressionMiddleware, detailedLoggingMiddleware, getActivePlugins, isPluginActive, logActivity, loggingMiddleware, optionalAuth, performanceLoggingMiddleware, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeadersMiddleware as securityHeaders, securityLoggingMiddleware } from './chunk-O32IZ6JS.js';
+import { requireAuth, DocumentTypeRegistry, requireRbac, requireRole, getJwtExpirySecondsFromDb, AuthManager, metricsMiddleware, bootstrapMiddleware, securityHeadersMiddleware, csrfProtection } from './chunk-GQXVDFIG.js';
+export { AuthManager, PermissionManager, bootstrapDocumentTypes, bootstrapMiddleware, cacheHeaders, compressionMiddleware, detailedLoggingMiddleware, getActivePlugins, isPluginActive, logActivity, loggingMiddleware, optionalAuth, performanceLoggingMiddleware, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeadersMiddleware as securityHeaders, securityLoggingMiddleware } from './chunk-GQXVDFIG.js';
 import { RbacService, DocumentsService } from './chunk-PDC7DLOV.js';
 export { RbacService } from './chunk-PDC7DLOV.js';
 import { nanoid } from './chunk-GCDZZNIN.js';
-import { PluginService, PLUGIN_REGISTRY, invalidateTenantCache, getCollectionRegistry, TENANT_COOKIE, MULTI_TENANT_PLUGIN_ID, collectionRecordToRow, tenantMiddleware } from './chunk-INE5E3SL.js';
-export { PluginBootstrapService, PluginService as PluginServiceClass, getAvailableCollectionNames, loadCollectionConfig, loadCollectionConfigs, registerCollections, validateCollectionConfig } from './chunk-INE5E3SL.js';
-export { MigrationService } from './chunk-32SDMKZ7.js';
+import { PluginService, PLUGIN_REGISTRY, invalidateTenantCache, getCollectionRegistry, TENANT_COOKIE, MULTI_TENANT_PLUGIN_ID, collectionRecordToRow, tenantMiddleware } from './chunk-4ENXIP4M.js';
+export { PluginBootstrapService, PluginService as PluginServiceClass, getAvailableCollectionNames, loadCollectionConfig, loadCollectionConfigs, registerCollections, validateCollectionConfig } from './chunk-4ENXIP4M.js';
+export { MigrationService } from './chunk-VOAP3KFU.js';
 export { renderFilterBar } from './chunk-JQISFW6U.js';
 import { renderAdminLayout } from './chunk-OBA2RYZN.js';
 export { getConfirmationDialogScript, renderAlert, renderConfirmationDialog, renderForm, renderFormField, renderPagination, renderTable } from './chunk-OBA2RYZN.js';
 import { init_admin_layout_catalyst_template, renderAdminLayoutCatalyst } from './chunk-5V62WT6M.js';
 export { renderAdminLayoutCatalyst } from './chunk-5V62WT6M.js';
-import { TurnstileService, HookSystemImpl, createPluginWirer, registerPluginRoutes, setPluginMenu } from './chunk-5L6EMI7A.js';
-export { HookSystemImpl, HookUtils, PluginDependencyCycleError, PluginManager as PluginManagerClass, PluginRegistryImpl, PluginValidator as PluginValidatorClass, RegisterPluginsError, ScopedHookSystem as ScopedHookSystemClass, collectCronSchedules, collectCrons, createScheduledHandler, dispatchCronTick, getPluginMenu, registerPlugins, resetPluginMenu, resolvePluginMenuItems, setPluginMenu, topoSort } from './chunk-5L6EMI7A.js';
-import { definePlugin, setPluginDefinitions } from './chunk-QNPT6BQP.js';
-export { applySchemaDefaults, definePlugin, isDefinedPlugin, parseConfigSchema, parseFormDataToSettings, renderSchemaFields } from './chunk-QNPT6BQP.js';
+import { TurnstileService, HookSystemImpl, createPluginWirer, registerPluginRoutes, setPluginMenu } from './chunk-75WXXLAU.js';
+export { HookSystemImpl, HookUtils, PluginDependencyCycleError, PluginManager as PluginManagerClass, PluginRegistryImpl, PluginValidator as PluginValidatorClass, RegisterPluginsError, ScopedHookSystem as ScopedHookSystemClass, collectCronSchedules, collectCrons, createScheduledHandler, dispatchCronTick, getPluginMenu, registerPlugins, resetPluginMenu, resolvePluginMenuItems, setPluginMenu, topoSort } from './chunk-75WXXLAU.js';
+import { definePlugin, setPluginDefinitions } from './chunk-JRLADH5B.js';
+export { applySchemaDefaults, definePlugin, isDefinedPlugin, parseConfigSchema, parseFormDataToSettings, renderSchemaFields } from './chunk-JRLADH5B.js';
 import { setHookSystem } from './chunk-RNZFGN4R.js';
 export { getHookSystem, getTypedHooks, hasHookSystem, resetHookSystem, setHookSystem } from './chunk-RNZFGN4R.js';
 export { QueryFilterBuilder, TemplateRenderer, buildQuery, renderTemplate, templateRenderer } from './chunk-QZGABF2M.js';
 export { metricsTracker } from './chunk-FICTAGD4.js';
 import './chunk-X7ZAEI5S.js';
-import { getCoreVersion, package_default } from './chunk-U7T5EOHJ.js';
-export { SONICJS_VERSION, getCoreVersion } from './chunk-U7T5EOHJ.js';
+import { getCoreVersion, package_default } from './chunk-CE6POA7A.js';
+export { SONICJS_VERSION, getCoreVersion } from './chunk-CE6POA7A.js';
 import { escapeHtml, sanitizeInput } from './chunk-TQABQWOP.js';
 export { escapeHtml, sanitizeInput, sanitizeObject } from './chunk-TQABQWOP.js';
 export { HOOKS } from './chunk-QXOZI5Q2.js';
@@ -6646,6 +6646,457 @@ var securityAuditPlugin = definePlugin({
   deactivate: async () => console.log("[SecurityAudit] Plugin deactivated")
 });
 
+// src/plugins/core-plugins/api-keys-plugin/services/api-key-service.ts
+var API_KEY_QUERYABLE = [
+  { name: "keyHash", kind: "scalar", type: "text", column: "q_apikey_hash" },
+  { name: "userId", kind: "scalar", type: "text", column: "q_apikey_user_id" },
+  { name: "revoked", kind: "scalar", type: "integer", column: "q_apikey_revoked" }
+];
+var KEY_PREFIX = "sk_";
+var KEY_BYTES = 24;
+var DISPLAY_PREFIX_LEN = KEY_PREFIX.length + 8;
+function generateApiKeySecret() {
+  const bytes = new Uint8Array(KEY_BYTES);
+  crypto.getRandomValues(bytes);
+  let hex = "";
+  for (const b of bytes) hex += b.toString(16).padStart(2, "0");
+  return KEY_PREFIX + hex;
+}
+async function hashApiKey(secret) {
+  const data = new TextEncoder().encode(secret);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  const view = new Uint8Array(digest);
+  let hex = "";
+  for (const b of view) hex += b.toString(16).padStart(2, "0");
+  return hex;
+}
+var ApiKeyService = class {
+  constructor(db, tenantId = "default") {
+    this.db = db;
+    this.tenantId = tenantId;
+  }
+  docService() {
+    return new DocumentsService(this.db, {
+      queryableFields: API_KEY_QUERYABLE,
+      tenantId: this.tenantId,
+      maxVersionsPerRoot: 1
+    });
+  }
+  /** Count a user's active (non-revoked) keys — used to enforce the per-user cap. */
+  async countForUser(userId) {
+    const row = await this.db.prepare(
+      `SELECT COUNT(*) AS c FROM documents
+         WHERE type_id = 'api_key' AND tenant_id = ? AND is_current_draft = 1
+           AND deleted_at IS NULL AND q_apikey_user_id = ? AND q_apikey_revoked = 0`
+    ).bind(this.tenantId, userId).first();
+    return row?.c ?? 0;
+  }
+  /**
+   * Mint a new key for a user. The returned `key` is the only time the plaintext
+   * exists outside the caller — it is hashed before storage.
+   */
+  async create(input) {
+    const name = input.name.trim() || "API Key";
+    const secret = generateApiKeySecret();
+    const keyHash = await hashApiKey(secret);
+    const prefix = secret.slice(0, DISPLAY_PREFIX_LEN);
+    const expiresAt = input.expiresAt ?? null;
+    const doc = await this.docService().create(
+      createDocumentSchema.parse({
+        typeId: "api_key",
+        tenantId: this.tenantId,
+        title: name,
+        ownerId: input.userId,
+        publishOnCreate: true,
+        data: {
+          name,
+          userId: input.userId,
+          keyHash,
+          keyPrefix: prefix,
+          revoked: 0,
+          lastUsedAt: null,
+          expiresAt
+        }
+      }),
+      input.userId
+    );
+    return { id: doc.rootId, key: secret, name, prefix, expiresAt };
+  }
+  /** List a user's non-revoked keys (metadata only — never the secret or hash). */
+  async list(userId) {
+    const res = await this.db.prepare(
+      `SELECT root_id, data, created_at FROM documents
+         WHERE type_id = 'api_key' AND tenant_id = ? AND is_current_draft = 1
+           AND deleted_at IS NULL AND q_apikey_user_id = ? AND q_apikey_revoked = 0
+         ORDER BY created_at DESC`
+    ).bind(this.tenantId, userId).all();
+    return (res.results ?? []).map((row) => {
+      const d = JSON.parse(row.data);
+      return {
+        id: row.root_id,
+        name: d.name ?? "API Key",
+        prefix: d.keyPrefix ?? "",
+        createdAt: row.created_at,
+        lastUsedAt: d.lastUsedAt ?? null,
+        expiresAt: d.expiresAt ?? null
+      };
+    });
+  }
+  /**
+   * Revoke (hard-delete) a key owned by `userId`. Credentials are erased, not
+   * soft-flagged. Returns false if the key does not exist or is not owned by
+   * the caller (no information leak about other users' keys).
+   */
+  async revoke(rootId, userId) {
+    const row = await this.db.prepare(
+      `SELECT q_apikey_user_id AS owner FROM documents
+         WHERE root_id = ? AND tenant_id = ? AND type_id = 'api_key' AND is_current_draft = 1 AND deleted_at IS NULL`
+    ).bind(rootId, this.tenantId).first();
+    if (!row || row.owner !== userId) return false;
+    await this.docService().erase(rootId, this.tenantId);
+    return true;
+  }
+  /**
+   * Resolve a presented secret to its owning user, or null. Rejects unknown,
+   * revoked, expired keys and inactive users. Best-effort updates lastUsedAt.
+   */
+  async resolve(secret) {
+    if (!secret || !secret.startsWith(KEY_PREFIX)) return null;
+    const keyHash = await hashApiKey(secret);
+    const keyRow2 = await this.db.prepare(
+      `SELECT root_id, data FROM documents
+         WHERE type_id = 'api_key' AND tenant_id = ? AND is_current_draft = 1 AND deleted_at IS NULL
+           AND q_apikey_hash = ? AND q_apikey_revoked = 0
+         LIMIT 1`
+    ).bind(this.tenantId, keyHash).first();
+    if (!keyRow2) return null;
+    const d = JSON.parse(keyRow2.data);
+    if (d.expiresAt != null && Date.now() > Number(d.expiresAt)) return null;
+    const user = await this.db.prepare(`SELECT id, email, role, is_active, is_super_admin FROM auth_user WHERE id = ?`).bind(d.userId).first();
+    if (!user || user.is_active !== 1) return null;
+    try {
+      await this.touchLastUsed(keyRow2.root_id, d);
+    } catch {
+    }
+    return {
+      userId: user.id,
+      email: user.email,
+      role: user.role ?? "viewer",
+      isSuperAdmin: user.is_super_admin === 1
+    };
+  }
+  /** Update lastUsedAt in-place (single-version type, no history churn). */
+  async touchLastUsed(rootId, data) {
+    const next = JSON.stringify({ ...data, lastUsedAt: Date.now() });
+    await this.db.prepare(
+      `UPDATE documents SET data = ? WHERE root_id = ? AND tenant_id = ? AND type_id = 'api_key' AND is_current_draft = 1`
+    ).bind(next, rootId, this.tenantId).run();
+  }
+};
+
+// src/plugins/core-plugins/api-keys-plugin/components/keys-page.ts
+init_admin_layout_catalyst_template();
+function fmtDate(ms) {
+  if (!ms) return "\u2014";
+  try {
+    return new Date(ms).toISOString().slice(0, 10);
+  } catch {
+    return "\u2014";
+  }
+}
+function keyRow(k) {
+  const name = escapeHtml(k.name);
+  const prefix = escapeHtml(k.prefix);
+  const id = escapeHtml(k.id);
+  return `
+    <tr class="border-t border-zinc-950/5 dark:border-white/10" data-key-id="${id}">
+      <td class="py-3 pr-4 text-sm font-medium text-zinc-950 dark:text-white">${name}</td>
+      <td class="py-3 pr-4 text-sm font-mono text-zinc-500 dark:text-zinc-400">${prefix}\u2026</td>
+      <td class="py-3 pr-4 text-sm text-zinc-500 dark:text-zinc-400">${fmtDate(k.createdAt ? k.createdAt * 1e3 : null)}</td>
+      <td class="py-3 pr-4 text-sm text-zinc-500 dark:text-zinc-400">${k.lastUsedAt ? fmtDate(k.lastUsedAt) : "Never"}</td>
+      <td class="py-3 pr-4 text-sm text-zinc-500 dark:text-zinc-400">${k.expiresAt ? fmtDate(k.expiresAt) : "Never"}</td>
+      <td class="py-3 text-right">
+        <button type="button" onclick="revokeApiKey('${id}', '${name.replace(/'/g, "\\'")}')"
+          class="rounded-lg bg-red-50 dark:bg-red-900/20 px-3 py-1.5 text-sm font-medium text-red-700 dark:text-red-400 hover:bg-red-100 dark:hover:bg-red-900/40 ring-1 ring-red-200 dark:ring-red-800 transition-colors">
+          Revoke
+        </button>
+      </td>
+    </tr>`;
+}
+function renderApiKeysPage(data) {
+  const { keys, user, version, dynamicMenuItems } = data;
+  const rows = keys.length ? keys.map(keyRow).join("") : `<tr><td colspan="6" class="py-8 text-center text-sm text-zinc-500 dark:text-zinc-400">No API keys yet. Create one to enable programmatic access.</td></tr>`;
+  const content2 = `
+    <div>
+      <div class="sm:flex sm:items-center sm:justify-between mb-6">
+        <div class="sm:flex-auto">
+          <h1 class="text-2xl/8 font-semibold text-zinc-950 dark:text-white sm:text-xl/8">API Keys</h1>
+          <p class="mt-2 text-sm/6 text-zinc-500 dark:text-zinc-400">
+            Long-lived secrets for headless / server-to-server REST access. Send a key as the
+            <code class="font-mono">x-api-key</code> header or <code class="font-mono">Authorization: Bearer &lt;key&gt;</code>.
+            The secret is shown once at creation \u2014 store it now.
+          </p>
+        </div>
+        <div class="mt-4 sm:mt-0 sm:ml-16">
+          <button type="button" onclick="document.getElementById('create-key-modal').classList.remove('hidden')"
+            class="inline-flex items-center justify-center rounded-lg bg-cyan-600 px-4 py-2.5 text-sm font-semibold text-white hover:bg-cyan-500 transition-colors shadow-sm">
+            Create API key
+          </button>
+        </div>
+      </div>
+
+      <!-- Newly-created secret banner (populated by JS, shown once) -->
+      <div id="new-key-banner" class="hidden mb-6 rounded-xl bg-emerald-50 dark:bg-emerald-900/20 p-4 ring-1 ring-emerald-200 dark:ring-emerald-800">
+        <p class="text-sm font-medium text-emerald-800 dark:text-emerald-300 mb-2">
+          Copy your new key now \u2014 it will not be shown again.
+        </p>
+        <div class="flex items-center gap-2">
+          <code id="new-key-value" class="flex-1 rounded-lg bg-white dark:bg-zinc-900 px-3 py-2 text-sm font-mono text-zinc-950 dark:text-white ring-1 ring-zinc-950/10 dark:ring-white/10 break-all"></code>
+          <button type="button" onclick="copyNewKey()"
+            class="rounded-lg bg-emerald-600 px-3 py-2 text-sm font-semibold text-white hover:bg-emerald-500 transition-colors">
+            Copy
+          </button>
+        </div>
+      </div>
+
+      <div class="rounded-xl bg-white/80 dark:bg-zinc-900/80 backdrop-blur-xl p-6 ring-1 ring-zinc-950/5 dark:ring-white/10 shadow-sm overflow-x-auto">
+        <table class="w-full text-left">
+          <thead>
+            <tr class="text-xs font-semibold uppercase tracking-wide text-zinc-500 dark:text-zinc-400">
+              <th class="pb-2 pr-4">Name</th>
+              <th class="pb-2 pr-4">Prefix</th>
+              <th class="pb-2 pr-4">Created</th>
+              <th class="pb-2 pr-4">Last used</th>
+              <th class="pb-2 pr-4">Expires</th>
+              <th class="pb-2 text-right">Actions</th>
+            </tr>
+          </thead>
+          <tbody id="keys-tbody">${rows}</tbody>
+        </table>
+      </div>
+    </div>
+
+    <!-- Create modal -->
+    <div id="create-key-modal" class="hidden fixed inset-0 z-50 flex items-center justify-center bg-black/40 p-4">
+      <div class="w-full max-w-md rounded-xl bg-white dark:bg-zinc-900 p-6 ring-1 ring-zinc-950/10 dark:ring-white/10 shadow-xl">
+        <h2 class="text-base font-semibold text-zinc-950 dark:text-white mb-4">Create API key</h2>
+        <label class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1">Name</label>
+        <input id="new-key-name" type="text" placeholder="e.g. CI deploy token"
+          class="w-full rounded-lg border-zinc-300 dark:border-zinc-700 bg-white dark:bg-zinc-800 px-3 py-2 text-sm text-zinc-950 dark:text-white mb-4 ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10">
+        <label class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1">Expires in (days, optional)</label>
+        <input id="new-key-expiry" type="number" min="1" max="3650" placeholder="Never"
+          class="w-full rounded-lg border-zinc-300 dark:border-zinc-700 bg-white dark:bg-zinc-800 px-3 py-2 text-sm text-zinc-950 dark:text-white mb-4 ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10">
+        <div class="flex justify-end gap-2">
+          <button type="button" onclick="document.getElementById('create-key-modal').classList.add('hidden')"
+            class="rounded-lg bg-white dark:bg-zinc-800 px-4 py-2 text-sm font-semibold text-zinc-950 dark:text-white ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10">
+            Cancel
+          </button>
+          <button type="button" onclick="createApiKey()"
+            class="rounded-lg bg-cyan-600 px-4 py-2 text-sm font-semibold text-white hover:bg-cyan-500 transition-colors">
+            Create
+          </button>
+        </div>
+      </div>
+    </div>
+
+    <script>
+      // CSRF: the csrf_token cookie is JS-readable (httpOnly:false); echo it back
+      // as X-CSRF-Token on state-changing requests (signed double-submit).
+      function csrfHeader() {
+        const m = document.cookie.match(/(?:^|; )csrf_token=([^;]+)/)
+        return m ? { 'X-CSRF-Token': decodeURIComponent(m[1]) } : {}
+      }
+      async function createApiKey() {
+        const name = document.getElementById('new-key-name').value.trim()
+        if (!name) { window.showNotification && window.showNotification('Name is required', 'error'); return }
+        const expiry = parseInt(document.getElementById('new-key-expiry').value, 10)
+        const body = { name }
+        if (Number.isFinite(expiry) && expiry > 0) body.expiresInDays = expiry
+        const res = await fetch('/admin/plugins/api-keys/api/keys', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', ...csrfHeader() },
+          body: JSON.stringify(body),
+        })
+        if (!res.ok) {
+          const e = await res.json().catch(() => ({}))
+          window.showNotification && window.showNotification(e.error || 'Failed to create key', 'error')
+          return
+        }
+        const { apiKey } = await res.json()
+        document.getElementById('create-key-modal').classList.add('hidden')
+        document.getElementById('new-key-value').textContent = apiKey.key
+        document.getElementById('new-key-banner').classList.remove('hidden')
+        setTimeout(() => location.reload(), 1500)
+      }
+      function copyNewKey() {
+        const v = document.getElementById('new-key-value').textContent
+        navigator.clipboard.writeText(v).then(() => window.showNotification && window.showNotification('Copied', 'success'))
+      }
+      async function revokeApiKey(id, name) {
+        if (!confirm('Revoke "' + name + '"? This cannot be undone and will break any client using it.')) return
+        const res = await fetch('/admin/plugins/api-keys/api/keys/' + id, { method: 'DELETE', headers: { ...csrfHeader() } })
+        if (res.ok) {
+          const row = document.querySelector('[data-key-id="' + id + '"]')
+          if (row) row.remove()
+          window.showNotification && window.showNotification('Key revoked', 'success')
+        } else {
+          window.showNotification && window.showNotification('Failed to revoke', 'error')
+        }
+      }
+    </script>`;
+  const layoutData = {
+    title: "API Keys",
+    pageTitle: "API Keys",
+    currentPath: "/admin/plugins/api-keys",
+    user,
+    content: content2,
+    version,
+    dynamicMenuItems
+  };
+  return renderAdminLayoutCatalyst(layoutData);
+}
+
+// src/plugins/core-plugins/api-keys-plugin/types.ts
+var DEFAULT_SETTINGS3 = {
+  maxKeysPerUser: 50,
+  defaultExpiryDays: 0
+};
+
+// src/plugins/core-plugins/api-keys-plugin/routes/admin.ts
+var adminRoutes4 = new Hono();
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var createSchema = z.object({
+  name: z.string().min(1).max(100),
+  // Optional lifetime in days; omitted/null → plugin default (which may be "never").
+  expiresInDays: z.number().int().positive().max(3650).nullish()
+});
+async function getSettings3(db) {
+  try {
+    const plugin2 = await new PluginService(db).getPlugin("api-keys");
+    if (plugin2?.settings) {
+      const s = typeof plugin2.settings === "string" ? JSON.parse(plugin2.settings) : plugin2.settings;
+      return { ...DEFAULT_SETTINGS3, ...s };
+    }
+  } catch {
+  }
+  return DEFAULT_SETTINGS3;
+}
+adminRoutes4.use("*", requireAuth());
+adminRoutes4.use("*", async (c, next) => {
+  const user = c.get("user");
+  if (user?.role !== "admin") {
+    return c.json({ error: "Access denied" }, 403);
+  }
+  return next();
+});
+adminRoutes4.get("/", async (c) => {
+  const user = c.get("user");
+  const tenantId = c.get("tenantId") || "default";
+  const keys = await new ApiKeyService(c.env.DB, tenantId).list(user.userId);
+  return c.html(
+    renderApiKeysPage({
+      keys,
+      user: { name: user.email, email: user.email, role: user.role },
+      version: c.get("appVersion"),
+      dynamicMenuItems: c.get("pluginMenuItems")
+    })
+  );
+});
+adminRoutes4.get("/api/keys", async (c) => {
+  const user = c.get("user");
+  const tenantId = c.get("tenantId") || "default";
+  const keys = await new ApiKeyService(c.env.DB, tenantId).list(user.userId);
+  return c.json({ keys });
+});
+adminRoutes4.post("/api/keys", async (c) => {
+  const user = c.get("user");
+  const tenantId = c.get("tenantId") || "default";
+  const body = await c.req.json().catch(() => ({}));
+  const parsed = createSchema.safeParse(body);
+  if (!parsed.success) {
+    return c.json({ error: "Invalid request", details: parsed.error.flatten() }, 400);
+  }
+  const settings = await getSettings3(c.env.DB);
+  const svc = new ApiKeyService(c.env.DB, tenantId);
+  if (await svc.countForUser(user.userId) >= settings.maxKeysPerUser) {
+    return c.json({ error: `API key limit reached (max ${settings.maxKeysPerUser})` }, 409);
+  }
+  const days = parsed.data.expiresInDays ?? (settings.defaultExpiryDays > 0 ? settings.defaultExpiryDays : null);
+  const expiresAt = days ? Date.now() + days * DAY_MS : null;
+  const created = await svc.create({ userId: user.userId, name: parsed.data.name, expiresAt });
+  return c.json({ apiKey: created }, 201);
+});
+adminRoutes4.delete("/api/keys/:id", async (c) => {
+  const user = c.get("user");
+  const tenantId = c.get("tenantId") || "default";
+  const ok = await new ApiKeyService(c.env.DB, tenantId).revoke(c.req.param("id") ?? "", user.userId);
+  if (!ok) return c.json({ error: "API key not found" }, 404);
+  return c.json({ success: true });
+});
+
+// src/plugins/core-plugins/api-keys-plugin/middleware/api-key-auth.ts
+function apiKeyAuthMiddleware() {
+  return async (c, next) => {
+    if (!c.get("user")) {
+      const authz = c.req.header("authorization") || "";
+      const bearer = authz.toLowerCase().startsWith("bearer ") ? authz.slice(7).trim() : "";
+      const presented = c.req.header("x-api-key") || (bearer.startsWith("sk_") ? bearer : "");
+      if (presented) {
+        try {
+          const tenantId = c.get("tenantId") || "default";
+          const resolved = await new ApiKeyService(c.env.DB, tenantId).resolve(presented);
+          if (resolved) {
+            c.set("user", {
+              userId: resolved.userId,
+              email: resolved.email,
+              role: resolved.role,
+              isSuperAdmin: resolved.isSuperAdmin,
+              // API keys are stateless bearer creds — no session window.
+              exp: 0,
+              iat: 0
+            });
+          }
+        } catch {
+        }
+      }
+    }
+    await next();
+  };
+}
+
+// src/plugins/core-plugins/api-keys-plugin/index.ts
+var KEY_ICON = `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z"/></svg>`;
+var apiKeysPlugin = definePlugin({
+  id: "api-keys",
+  version: "1.0.0-beta.1",
+  name: "API Keys",
+  description: "Programmatic API access keys for headless / server-to-server REST access.",
+  sonicjsVersionRange: "^3.0.0",
+  author: { name: "SonicJS Team" },
+  register(app2) {
+    app2.route("/admin/plugins/api-keys", adminRoutes4);
+  },
+  menu: [
+    { label: "API Keys", path: "/admin/plugins/api-keys", icon: KEY_ICON, order: 86 }
+  ],
+  configSchema: {
+    maxKeysPerUser: {
+      type: "number",
+      label: "Max keys per user",
+      description: "Hard cap on active keys a single user may hold.",
+      default: 50
+    },
+    defaultExpiryDays: {
+      type: "number",
+      label: "Default expiry (days)",
+      description: "Lifetime applied to new keys when no explicit expiry is given. 0 = never expires.",
+      default: 0
+    }
+  },
+  activate: async () => console.log("[ApiKeys] Plugin activated"),
+  deactivate: async () => console.log("[ApiKeys] Plugin deactivated")
+});
+
 // src/plugins/core-plugins/stripe-plugin/services/subscription-service.ts
 var SubscriptionService = class {
   constructor(db) {
@@ -7373,7 +7824,7 @@ function renderEventPagination(page, totalPages, type, status) {
 }
 
 // src/plugins/core-plugins/stripe-plugin/types.ts
-var DEFAULT_SETTINGS3 = {
+var DEFAULT_SETTINGS4 = {
   stripePublishableKey: "",
   stripeSecretKey: "",
   stripeWebhookSecret: "",
@@ -7383,28 +7834,28 @@ var DEFAULT_SETTINGS3 = {
 };
 
 // src/plugins/core-plugins/stripe-plugin/routes/admin.ts
-var adminRoutes4 = new Hono();
-adminRoutes4.use("*", requireAuth());
-adminRoutes4.use("*", async (c, next) => {
+var adminRoutes5 = new Hono();
+adminRoutes5.use("*", requireAuth());
+adminRoutes5.use("*", async (c, next) => {
   const user = c.get("user");
   if (user?.role !== "admin") {
     return c.text("Access denied", 403);
   }
   return next();
 });
-async function getSettings3(db) {
+async function getSettings4(db) {
   try {
     const pluginService = new PluginService(db);
     const plugin2 = await pluginService.getPlugin("stripe");
     if (plugin2?.settings) {
       const settings = typeof plugin2.settings === "string" ? JSON.parse(plugin2.settings) : plugin2.settings;
-      return { ...DEFAULT_SETTINGS3, ...settings };
+      return { ...DEFAULT_SETTINGS4, ...settings };
     }
   } catch {
   }
-  return DEFAULT_SETTINGS3;
+  return DEFAULT_SETTINGS4;
 }
-adminRoutes4.get("/", async (c) => {
+adminRoutes5.get("/", async (c) => {
   const db = c.env.DB;
   const user = c.get("user");
   const subscriptionService = new SubscriptionService(db);
@@ -7427,7 +7878,7 @@ adminRoutes4.get("/", async (c) => {
   });
   return c.html(html4);
 });
-adminRoutes4.get("/events", async (c) => {
+adminRoutes5.get("/events", async (c) => {
   const db = c.env.DB;
   const user = c.get("user");
   const eventService = new StripeEventService(db);
@@ -7453,10 +7904,10 @@ adminRoutes4.get("/events", async (c) => {
   });
   return c.html(html4);
 });
-adminRoutes4.get("/settings", async (c) => {
+adminRoutes5.get("/settings", async (c) => {
   const db = c.env.DB;
   const user = c.get("user");
-  const settings = await getSettings3(db);
+  const settings = await getSettings4(db);
   const { renderAdminLayoutCatalyst: renderAdminLayoutCatalyst2 } = await import('./admin-layout-catalyst.template-YQ4EMF2J.js');
   const content2 = `
     <div>
@@ -7563,7 +8014,7 @@ adminRoutes4.get("/settings", async (c) => {
     dynamicMenuItems: c.get("pluginMenuItems")
   }));
 });
-adminRoutes4.post("/settings", async (c) => {
+adminRoutes5.post("/settings", async (c) => {
   try {
     const body = await c.req.json();
     const db = c.env.DB;
@@ -7714,17 +8165,17 @@ function timingSafeEqual(a, b) {
 
 // src/plugins/core-plugins/stripe-plugin/routes/api.ts
 var apiRoutes3 = new Hono();
-async function getSettings4(db) {
+async function getSettings5(db) {
   try {
     const pluginService = new PluginService(db);
     const plugin2 = await pluginService.getPlugin("stripe");
     if (plugin2?.settings) {
       const settings = typeof plugin2.settings === "string" ? JSON.parse(plugin2.settings) : plugin2.settings;
-      return { ...DEFAULT_SETTINGS3, ...settings };
+      return { ...DEFAULT_SETTINGS4, ...settings };
     }
   } catch {
   }
-  return DEFAULT_SETTINGS3;
+  return DEFAULT_SETTINGS4;
 }
 function mapStripeStatus(status) {
   const map = {
@@ -7741,7 +8192,7 @@ function mapStripeStatus(status) {
 }
 apiRoutes3.post("/webhook", async (c) => {
   const db = c.env.DB;
-  const settings = await getSettings4(db);
+  const settings = await getSettings5(db);
   if (!settings.stripeWebhookSecret) {
     return c.json({ error: "Webhook secret not configured" }, 500);
   }
@@ -7871,7 +8322,7 @@ apiRoutes3.post("/create-checkout-session", requireAuth(), async (c) => {
   const db = c.env.DB;
   const user = c.get("user");
   if (!user) return c.json({ error: "Unauthorized" }, 401);
-  const settings = await getSettings4(db);
+  const settings = await getSettings5(db);
   if (!settings.stripeSecretKey) {
     return c.json({ error: "Stripe not configured" }, 500);
   }
@@ -7948,7 +8399,7 @@ apiRoutes3.post("/sync-subscriptions", requireAuth(), async (c) => {
   const user = c.get("user");
   if (user?.role !== "admin") return c.json({ error: "Access denied" }, 403);
   const db = c.env.DB;
-  const settings = await getSettings4(db);
+  const settings = await getSettings5(db);
   if (!settings.stripeSecretKey) {
     return c.json({ error: "Stripe secret key not configured" }, 400);
   }
@@ -8023,7 +8474,7 @@ var stripePlugin = definePlugin({
   sonicjsVersionRange: "^3.0.0",
   author: { name: "SonicJS Team" },
   register(app2) {
-    app2.route("/admin/plugins/stripe", adminRoutes4);
+    app2.route("/admin/plugins/stripe", adminRoutes5);
     app2.route("/api/stripe", apiRoutes3);
   },
   menu: [
@@ -11113,16 +11564,16 @@ function pluginMenuMiddleware() {
   };
 }
 init_admin_layout_catalyst_template();
-var adminRoutes5 = new Hono();
-adminRoutes5.use("*", requireAuth());
-adminRoutes5.use("*", async (c, next) => {
+var adminRoutes6 = new Hono();
+adminRoutes6.use("*", requireAuth());
+adminRoutes6.use("*", async (c, next) => {
   const user = c.get("user");
   if (user?.role !== "admin") {
     return c.text("Access denied", 403);
   }
   return next();
 });
-adminRoutes5.get("/", async (c) => {
+adminRoutes6.get("/", async (c) => {
   const user = c.get("user");
   const db = c.env.DB;
   let totalRequests = 0;
@@ -11478,7 +11929,7 @@ var analyticsPlugin = definePlugin({
   author: { name: "SonicJS Team", email: "team@sonicjs.com" },
   register(app2) {
     app2.route("/api/events", apiRoutes4);
-    app2.route("/admin/analytics", adminRoutes5);
+    app2.route("/admin/analytics", adminRoutes6);
   },
   menu: [
     {
@@ -11760,8 +12211,8 @@ apiRoutes5.delete("/:id", async (c) => {
     return c.json({ success: false, error: "Failed to delete variable" }, 500);
   }
 });
-var adminRoutes6 = new Hono();
-adminRoutes6.use("*", async (c, next) => {
+var adminRoutes7 = new Hono();
+adminRoutes7.use("*", async (c, next) => {
   try {
     const db = c.env?.DB;
     if (db) {
@@ -11772,7 +12223,7 @@ adminRoutes6.use("*", async (c, next) => {
   }
   await next();
 });
-adminRoutes6.get("/", async (c) => {
+adminRoutes7.get("/", async (c) => {
   const db = c.env.DB;
   let variables = [];
   try {
@@ -11802,7 +12253,7 @@ adminRoutes6.get("/", async (c) => {
   }
   return c.html(renderAdminPage(variables, { editorActive, activeEditorName, enableEditorIntegration }));
 });
-adminRoutes6.put("/:id", async (c) => {
+adminRoutes7.put("/:id", async (c) => {
   const db = c.env.DB;
   const id = c.req.param("id");
   let body;
@@ -11818,7 +12269,7 @@ adminRoutes6.put("/:id", async (c) => {
   }
   return c.html('<span class="text-green-400 text-xs">Saved</span>');
 });
-adminRoutes6.post("/:id/toggle", async (c) => {
+adminRoutes7.post("/:id/toggle", async (c) => {
   const db = c.env.DB;
   const id = c.req.param("id");
   await db.prepare("UPDATE global_variables SET is_active = CASE WHEN is_active = 1 THEN 0 ELSE 1 END, updated_at = strftime('%s', 'now') WHERE id = ?").bind(id).run();
@@ -11826,7 +12277,7 @@ adminRoutes6.post("/:id/toggle", async (c) => {
   c.header("HX-Redirect", "/admin/global-variables");
   return c.body(null, 204);
 });
-adminRoutes6.post("/", async (c) => {
+adminRoutes7.post("/", async (c) => {
   const db = c.env.DB;
   const form = await c.req.parseBody();
   const key = (form.key || "").trim();
@@ -11847,7 +12298,7 @@ adminRoutes6.post("/", async (c) => {
   c.header("HX-Redirect", "/admin/global-variables");
   return c.body(null, 204);
 });
-adminRoutes6.post("/settings/editor-integration", async (c) => {
+adminRoutes7.post("/settings/editor-integration", async (c) => {
   const db = c.env.DB;
   try {
     const row = await db.prepare("SELECT settings FROM plugins WHERE id = 'global-variables'").first();
@@ -11859,7 +12310,7 @@ adminRoutes6.post("/settings/editor-integration", async (c) => {
     return c.json({ success: false, error: "Failed to update setting" }, 500);
   }
 });
-adminRoutes6.delete("/:id", async (c) => {
+adminRoutes7.delete("/:id", async (c) => {
   const db = c.env.DB;
   await db.prepare("DELETE FROM global_variables WHERE id = ?").bind(c.req.param("id")).run();
   invalidateVariablesCache();
@@ -12190,7 +12641,7 @@ var globalVariablesPlugin = definePlugin({
   capabilities: ["hooks.content:subscribe"],
   register(app2) {
     app2.route("/api/global-variables", apiRoutes5);
-    app2.route("/admin/global-variables", adminRoutes6);
+    app2.route("/admin/global-variables", adminRoutes7);
   },
   menu: [
     { label: "Global Variables", path: "/admin/global-variables", icon: "bolt", order: 45, permissions: ["global-variables:view"] }
@@ -12511,8 +12962,8 @@ apiRoutes6.delete("/:id", async (c) => {
     return c.json({ success: false, error: "Failed to delete shortcode" }, 500);
   }
 });
-var adminRoutes7 = new Hono();
-adminRoutes7.use("*", async (c, next) => {
+var adminRoutes8 = new Hono();
+adminRoutes8.use("*", async (c, next) => {
   try {
     const db = c.env?.DB;
     if (db) {
@@ -12523,7 +12974,7 @@ adminRoutes7.use("*", async (c, next) => {
   }
   await next();
 });
-adminRoutes7.get("/", async (c) => {
+adminRoutes8.get("/", async (c) => {
   const db = c.env.DB;
   let shortcodes = [];
   try {
@@ -12553,7 +13004,7 @@ adminRoutes7.get("/", async (c) => {
   }
   return c.html(renderAdminPage2(shortcodes, { editorActive, activeEditorName, enableEditorIntegration }));
 });
-adminRoutes7.post("/", async (c) => {
+adminRoutes8.post("/", async (c) => {
   const db = c.env.DB;
   const form = await c.req.parseBody();
   const name = (form.name || "").trim();
@@ -12574,7 +13025,7 @@ adminRoutes7.post("/", async (c) => {
   c.header("HX-Redirect", "/admin/shortcodes");
   return c.body(null, 204);
 });
-adminRoutes7.post("/settings/editor-integration", async (c) => {
+adminRoutes8.post("/settings/editor-integration", async (c) => {
   const db = c.env.DB;
   try {
     const row = await db.prepare("SELECT settings FROM plugins WHERE id = 'shortcodes'").first();
@@ -12586,7 +13037,7 @@ adminRoutes7.post("/settings/editor-integration", async (c) => {
     return c.json({ success: false, error: "Failed to update setting" }, 500);
   }
 });
-adminRoutes7.delete("/:id", async (c) => {
+adminRoutes8.delete("/:id", async (c) => {
   await c.env.DB.prepare("DELETE FROM shortcodes WHERE id = ?").bind(c.req.param("id")).run();
   return c.html("");
 });
@@ -12797,7 +13248,7 @@ var shortcodesPlugin = definePlugin({
   capabilities: ["hooks.content:subscribe"],
   register(app2) {
     app2.route("/api/shortcodes", apiRoutes6);
-    app2.route("/admin/shortcodes", adminRoutes7);
+    app2.route("/admin/shortcodes", adminRoutes8);
   },
   menu: [
     { label: "Shortcodes", path: "/admin/shortcodes", icon: "bolt", order: 46, permissions: ["shortcodes:view"] }
@@ -12906,6 +13357,9 @@ var helloWorldPlugin = definePlugin({
     console.info("\u274C Hello World plugin deactivated");
   }
 });
+function createHelloWorldPlugin() {
+  return helloWorldPlugin;
+}
 
 // src/plugins/core-plugins/multi-tenant-plugin/manifest.json
 var manifest_default2 = {
@@ -16079,6 +16533,7 @@ function createSonicJSApp(config = {}) {
   const magicLinkPlugin = createMagicLinkAuthPlugin();
   const corePluginsBeforeCatchAll = [
     securityAuditPlugin,
+    apiKeysPlugin,
     aiSearchPlugin,
     oauthProvidersPlugin,
     userProfilesPlugin,
@@ -16220,6 +16675,7 @@ function createSonicJSApp(config = {}) {
     }
     await next();
   });
+  app2.use("*", apiKeyAuthMiddleware());
   if (config.middleware?.afterAuth) {
     for (const middleware of config.middleware.afterAuth) {
       app2.use("*", middleware);
@@ -19947,6 +20403,6 @@ function createDb(d1) {
 // src/index.ts
 var VERSION = package_default.version;
 
-export { BUILT_IN_PROVIDERS, CloudflareEmailProvider2 as CloudflareEmailProvider, OAuthService, VERSION, createDb, createOAuthProvidersPlugin, createRedirectPlugin, createSonicJSApp, emailReconciliationPlugin, generateTriggersComment, oauthProvidersPlugin, parseCronTriggers, redirectPlugin, setupCoreMiddleware, setupCoreRoutes, site_settings_collection_default as siteSettingsCollection, updateWranglerTriggers };
+export { BUILT_IN_PROVIDERS, CloudflareEmailProvider2 as CloudflareEmailProvider, OAuthService, VERSION, createDb, createHelloWorldPlugin, createOAuthProvidersPlugin, createRedirectPlugin, createSonicJSApp, emailReconciliationPlugin, generateTriggersComment, helloWorldPlugin, oauthProvidersPlugin, parseCronTriggers, redirectPlugin, setupCoreMiddleware, setupCoreRoutes, site_settings_collection_default as siteSettingsCollection, updateWranglerTriggers };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map