@actuate-media/cms-admin 0.76.4 → 0.76.6

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # @actuate-media/cms-admin
 
+## 0.76.6
+
+### Patch Changes
+
+- 0cc76fb: Declare `react`/`react-dom` as peerDependencies to prevent a dual-React crash.
+
+  `@actuate-media/cms-admin` shipped `react` and `react-dom` under
+  `dependencies`, so any consumer whose React version didn't dedupe with `^19.2.0`
+  — a React 18 app (a configuration `cms-core` advertises via `react >=18.0.0`),
+  or React 19.0/19.1 — got a second, nested React copy installed. Two React copies
+  trigger "Invalid hook call" and hard-crash the entire admin UI.
+
+  They're now `peerDependencies` (`^18.0.0 || ^19.0.0`) so the consumer's single
+  React instance is always used (with a devDependency for local build/test). A new
+  `pnpm check:react-peers` CI gate fails if any publishable package declares
+  `react`/`react-dom` under `dependencies` again.
+
+## 0.76.5
+
+### Patch Changes
+
+- cd8a061: Remove dead sidebar nav from bundled plugins and guard the whole class.
+
+  `plugin-ai`, `plugin-commerce`, and `plugin-blocks` each advertised
+  `adminNavItems` paths (`/ai/*`, `/commerce/*`, `/blocks`) that the admin router
+  has no view for — plugins cannot register views, and these plugins register no
+  collection backing those paths — so every one of those sidebar links landed on
+  the 404 page. The commerce items were also duplicates of the working collection
+  nav (its collections already appear under the "Commerce" group at their real
+  `/<slug>` routes).
+  - Dropped the dead `adminNavItems` from all three plugins. Commerce collections
+    remain reachable at `/products`, `/orders`, `/discounts`, …; plugin-ai and
+    plugin-blocks are backend/page-builder plugins with no standalone admin route.
+  - Added `cms-admin`'s `router/admin-routes` resolver (`adminPathResolves`) plus
+    a table-driven test asserting **every** bundled plugin's nav paths resolve to a
+    real view, and a drift test that keeps the known-route list in sync with
+    `AdminRoot`. This is the systemic guard for a bug class that has now shipped in
+    published packages three times.
+
 ## 0.76.4
 
 ### Patch Changes

package/dist/__tests__/layout/build-nav-items.test.js

@@ -56,5 +56,30 @@ describe('buildNavItems — duplicate / grouping regressions', () => {
         expect(items.find((i) => i.path === '/seo/sitemap')?.group).toBe('Content');
         expect(items.find((i) => i.path === '/seo/link-health')?.group).toBe('Content');
     });
+    it('excludes admin.hidden collections and does not resurrect removed nav paths', () => {
+        // Post-fix reality: plugin-forms/plugin-redirects no longer advertise
+        // Submissions/Redirects nav items, and their form-submissions/redirects
+        // collections are admin.hidden. Neither should surface a (404-ing) nav path.
+        const items = buildNavItems({
+            collections: {
+                pages: { slug: 'pages', type: 'page', labels: { plural: 'Pages' } },
+                forms: { slug: 'forms', labels: { plural: 'Forms' }, admin: { group: 'Forms' } },
+                'form-submissions': {
+                    slug: 'form-submissions',
+                    labels: { plural: 'Form Submissions' },
+                    admin: { hidden: true },
+                },
+                redirects: { slug: 'redirects', labels: { plural: 'Redirects' }, admin: { hidden: true } },
+            },
+            _pluginNavItems: [
+                { label: 'Forms', icon: 'FileText', path: '/forms' },
+                { label: 'SEO', icon: 'search', path: '/seo' },
+            ],
+        });
+        const paths = items.map((i) => i.path);
+        expect(paths).not.toContain('/form-submissions');
+        expect(paths).not.toContain('/redirects');
+        expect(items.filter((i) => i.path === '/forms')).toHaveLength(1);
+    });
 });
 //# sourceMappingURL=build-nav-items.test.js.map

package/dist/__tests__/layout/build-nav-items.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-nav-items.test.js","sourceRoot":"","sources":["../../../src/__tests__/layout/build-nav-items.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAEvD;;;;;;GAMG;AACH,SAAS,kBAAkB;IACzB,OAAO;QACL,WAAW,EAAE;YACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;YACnE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChF,kBAAkB,EAAE;gBAClB,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACtC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;aAC1B;SACF;QACD,eAAe,EAAE;YACf,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpD,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE;YAClE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;YACvD,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE;YACvD,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE;YAChE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,EAAE;SACrE;KACF,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,KAAK,GAAG,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACpE,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,MAAM,KAAK,GAAG,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAA;QACjD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,KAAK,GAAG,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAA;QACjD,2EAA2E;QAC3E,uDAAuD;QACvD,IAAI,WAAW,GAAG,KAAK,CAAA;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACjC,CAAC;iBAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtB,WAAW,GAAG,IAAI,CAAA;YACpB,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,KAAK,GAAG,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAA;QACjD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC3E,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"build-nav-items.test.js","sourceRoot":"","sources":["../../../src/__tests__/layout/build-nav-items.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAEvD;;;;;;GAMG;AACH,SAAS,kBAAkB;IACzB,OAAO;QACL,WAAW,EAAE;YACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;YACnE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChF,kBAAkB,EAAE;gBAClB,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACtC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;aAC1B;SACF;QACD,eAAe,EAAE;YACf,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpD,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE;YAClE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;YACvD,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE;YACvD,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE;YAChE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,EAAE;SACrE;KACF,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,KAAK,GAAG,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACpE,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,MAAM,KAAK,GAAG,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAA;QACjD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,KAAK,GAAG,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAA;QACjD,2EAA2E;QAC3E,uDAAuD;QACvD,IAAI,WAAW,GAAG,KAAK,CAAA;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACjC,CAAC;iBAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtB,WAAW,GAAG,IAAI,CAAA;YACpB,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,KAAK,GAAG,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAA;QACjD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC3E,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,sEAAsE;QACtE,wEAAwE;QACxE,6EAA6E;QAC7E,MAAM,KAAK,GAAG,aAAa,CAAC;YAC1B,WAAW,EAAE;gBACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;gBACnE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAChF,kBAAkB,EAAE;oBAClB,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;oBACtC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB;gBACD,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;aAC3F;YACD,eAAe,EAAE;gBACf,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACpD,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;aAC/C;SACF,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAA;QAChD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QACzC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/router/admin-routes.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=admin-routes.test.d.ts.map

package/dist/__tests__/router/admin-routes.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-routes.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/router/admin-routes.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/router/admin-routes.test.js

@@ -0,0 +1,62 @@
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { ADMIN_STATIC_ROUTE_PATTERNS, adminPathResolves, matchesRoutePattern, collectionRoutePatterns, } from '../../router/admin-routes.js';
+describe('matchesRoutePattern', () => {
+    it('matches by equal segment count with :param wildcards', () => {
+        expect(matchesRoutePattern('/pages', '/pages')).toBe(true);
+        expect(matchesRoutePattern('/pages/abc123/edit', '/pages/:id/edit')).toBe(true);
+        expect(matchesRoutePattern('/', '/')).toBe(true);
+    });
+    it('rejects a mismatched segment count or literal', () => {
+        expect(matchesRoutePattern('/pages/abc', '/pages')).toBe(false);
+        expect(matchesRoutePattern('/ai/scores', '/pages/:id')).toBe(false);
+        expect(matchesRoutePattern('/', '/pages')).toBe(false);
+    });
+    it('ignores query string and hash', () => {
+        expect(matchesRoutePattern('/seo?tab=audit', '/seo')).toBe(true);
+    });
+});
+describe('adminPathResolves', () => {
+    it('resolves built-in routes and SEO deep paths', () => {
+        expect(adminPathResolves('/media')).toBe(true);
+        expect(adminPathResolves('/forms')).toBe(true);
+        expect(adminPathResolves('/seo')).toBe(true);
+        expect(adminPathResolves('/seo/link-health')).toBe(true);
+    });
+    it('does NOT resolve a path with no backing route (the plugin-nav bug)', () => {
+        expect(adminPathResolves('/ai/scores')).toBe(false);
+        expect(adminPathResolves('/commerce/products')).toBe(false);
+        expect(adminPathResolves('/blocks')).toBe(false);
+    });
+    it('resolves a non-reserved collection at /<slug> and /collections/<slug>', () => {
+        const config = { collections: { products: { slug: 'products' } } };
+        expect(adminPathResolves('/products', config)).toBe(true);
+        expect(adminPathResolves('/collections/products', config)).toBe(true);
+        // Without the collection, the top-level route does not exist.
+        expect(adminPathResolves('/products')).toBe(false);
+    });
+    it('does not give a reserved-slug collection a shadowing top-level route', () => {
+        const patterns = collectionRoutePatterns({ collections: { pages: { slug: 'pages' } } });
+        expect(patterns).toContain('/collections/pages');
+        expect(patterns).not.toContain('/pages');
+    });
+});
+/**
+ * Drift guard: every literal `matchRoute('…')` in AdminRoot must be represented
+ * in ADMIN_STATIC_ROUTE_PATTERNS, so `adminPathResolves` can't silently fall
+ * behind the real router (which would let a broken plugin nav path pass review).
+ * Dynamic `matchRoute(`/${slug}/…`)` template calls and iterated SEO paths are
+ * intentionally excluded — those are covered by collection/SEO patterns.
+ */
+describe('ADMIN_STATIC_ROUTE_PATTERNS stays in sync with AdminRoot', () => {
+    it('covers every literal matchRoute() call in AdminRoot', () => {
+        const src = readFileSync(fileURLToPath(new URL('../../AdminRoot.tsx', import.meta.url)), 'utf8');
+        const literals = [...src.matchAll(/matchRoute\(\s*'([^']+)'\s*\)/g)].map((m) => m[1]);
+        expect(literals.length).toBeGreaterThan(20);
+        const known = new Set(ADMIN_STATIC_ROUTE_PATTERNS);
+        const missing = [...new Set(literals)].filter((p) => !known.has(p));
+        expect(missing).toEqual([]);
+    });
+});
+//# sourceMappingURL=admin-routes.test.js.map

package/dist/__tests__/router/admin-routes.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-routes.test.js","sourceRoot":"","sources":["../../../src/__tests__/router/admin-routes.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,8BAA8B,CAAA;AAErC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1D,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/E,MAAM,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,mBAAmB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/D,MAAM,CAAC,mBAAmB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnE,MAAM,CAAC,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9C,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9C,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5C,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnD,MAAM,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3D,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;QAClE,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzD,MAAM,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrE,8DAA8D;QAC9D,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,QAAQ,GAAG,uBAAuB,CAAC,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAA;QACvF,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,QAAQ,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACxE,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QAChG,MAAM,QAAQ,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;QACtF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAA;QAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAA;QAClD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACnE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/router/plugin-nav-resolves.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=plugin-nav-resolves.test.d.ts.map

package/dist/__tests__/router/plugin-nav-resolves.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-nav-resolves.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/router/plugin-nav-resolves.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/router/plugin-nav-resolves.test.js

@@ -0,0 +1,46 @@
+import { describe, it, expect } from 'vitest';
+import { aiPlugin } from '@actuate-media/plugin-ai';
+import { blocksPlugin } from '@actuate-media/plugin-blocks';
+import { commercePlugin } from '@actuate-media/plugin-commerce';
+import { formsPlugin } from '@actuate-media/plugin-forms';
+import { mediaPlugin } from '@actuate-media/plugin-media';
+import { navigationPlugin } from '@actuate-media/plugin-navigation';
+import { seoPlugin } from '@actuate-media/plugin-seo';
+import { adminPathResolves } from '../../router/admin-routes.js';
+/**
+ * Systemic guard for the recurring plugin-nav-404 class: a plugin advertises an
+ * `adminNavItems` path the admin router has no route for, so the sidebar link
+ * lands on the 404 page. It has shipped in published packages more than once
+ * (plugin-ai / plugin-commerce / plugin-blocks). Plugins cannot register views,
+ * so every nav path MUST resolve to a built-in route or one of the plugin's own
+ * collection routes — asserted here for every bundled plugin.
+ *
+ * When this fails: either point the nav item at a real route (a built-in, or a
+ * `/<slug>` for a collection the plugin registers) or remove it until a plugin
+ * view API exists. Do NOT add the path to ADMIN_STATIC_ROUTE_PATTERNS unless
+ * AdminRoot actually renders a view for it.
+ */
+const BUNDLED_PLUGINS = [
+    { name: 'plugin-ai', plugin: aiPlugin() },
+    { name: 'plugin-blocks', plugin: blocksPlugin() },
+    { name: 'plugin-commerce', plugin: commercePlugin() },
+    { name: 'plugin-forms', plugin: formsPlugin() },
+    { name: 'plugin-media', plugin: mediaPlugin() },
+    { name: 'plugin-navigation', plugin: navigationPlugin() },
+    { name: 'plugin-seo', plugin: seoPlugin() },
+];
+describe('every bundled plugin adminNavItems path resolves to a real admin view', () => {
+    for (const { name, plugin } of BUNDLED_PLUGINS) {
+        const navItems = plugin.adminNavItems ?? [];
+        // A config exposing exactly this plugin's collections — the only extra
+        // destinations a plugin can legitimately point its nav at.
+        const config = { collections: plugin.collections ?? {} };
+        it(`${name} (${navItems.length} nav item${navItems.length === 1 ? '' : 's'})`, () => {
+            const dead = navItems
+                .map((item) => item.path)
+                .filter((path) => !adminPathResolves(path, config));
+            expect(dead, `${name} advertises sidebar paths with no admin route: ${dead.join(', ')}`).toEqual([]);
+        });
+    }
+});
+//# sourceMappingURL=plugin-nav-resolves.test.js.map

package/dist/__tests__/router/plugin-nav-resolves.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-nav-resolves.test.js","sourceRoot":"","sources":["../../../src/__tests__/router/plugin-nav-resolves.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAEhE;;;;;;;;;;;;GAYG;AACH,MAAM,eAAe,GAAG;IACtB,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;IACzC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IACjD,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE;IACrD,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE;IAC/C,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE;IAC/C,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE;IACzD,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;CAC5C,CAAA;AAED,QAAQ,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACrF,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAA;QAC3C,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAA;QAExD,EAAE,CAAC,GAAG,IAAI,KAAK,QAAQ,CAAC,MAAM,YAAY,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE;YAClF,MAAM,IAAI,GAAG,QAAQ;iBAClB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;iBACxB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;YACrD,MAAM,CACJ,IAAI,EACJ,GAAG,IAAI,kDAAkD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3E,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA"}

package/dist/router/admin-routes.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Every static route pattern `AdminRoot.renderView()` resolves via a literal
+ * `matchRoute('…')` call. Dynamic collection routes are derived per-config in
+ * {@link collectionRoutePatterns}; the SEO deep paths are added from the view's
+ * own {@link SEO_DEEP_PATHS} so the two can't drift.
+ */
+export declare const ADMIN_STATIC_ROUTE_PATTERNS: readonly string[];
+/**
+ * Slugs AdminRoot reserves so a consumer- or plugin-defined collection can't
+ * own the top-level `/<slug>` route (they stay reachable at `/collections/<slug>`).
+ * Mirrors `RESERVED_SLUGS` in AdminRoot.
+ */
+export declare const RESERVED_COLLECTION_SLUGS: ReadonlySet<string>;
+interface CollectionLike {
+    slug?: string;
+    type?: string;
+}
+interface ConfigLike {
+    collections?: Record<string, CollectionLike | undefined>;
+}
+/**
+ * Match a concrete path against a route pattern using AdminRoot's `matchRoute`
+ * rules: equal segment count, and a `:param` segment matches any single
+ * non-empty segment. Query string and hash are ignored.
+ */
+export declare function matchesRoutePattern(path: string, pattern: string): boolean;
+/**
+ * The collection routes AdminRoot derives for a config: the always-available
+ * generic `/collections/<slug>`, plus the top-level `/<slug>` list route for
+ * each non-reserved collection. Mirrors AdminRoot's `collectionMap` (keyed by
+ * `def.slug`, slug-less collections skipped).
+ */
+export declare function collectionRoutePatterns(config: ConfigLike | undefined): string[];
+/** Every route pattern AdminRoot can resolve under `config`. */
+export declare function adminRoutePatterns(config?: ConfigLike): string[];
+/**
+ * True when `path` resolves to a real admin view (i.e. is NOT the 404 fallback)
+ * under `config`. This is the contract every plugin `adminNavItems` path must
+ * satisfy — see the `plugin-nav-resolves` test.
+ */
+export declare function adminPathResolves(path: string, config?: ConfigLike): boolean;
+export {};
+//# sourceMappingURL=admin-routes.d.ts.map

package/dist/router/admin-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-routes.d.ts","sourceRoot":"","sources":["../../src/router/admin-routes.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EA0CxD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAexD,CAAA;AAEF,UAAU,cAAc;IACtB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AACD,UAAU,UAAU;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,CAAC,CAAA;CACzD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAW1E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,EAAE,CAShF;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,EAAE,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAE5E"}

package/dist/router/admin-routes.js

@@ -0,0 +1,137 @@
+/**
+ * The set of admin routes `AdminRoot.renderView()` can resolve, expressed as
+ * data so callers other than the render tree can ask "does this path lead to a
+ * real view, or to the 404 fallback?".
+ *
+ * This exists to guard a recurring class of bug: a plugin advertises an
+ * `adminNavItems` path (e.g. `/ai/scores`) that the router has no route for, so
+ * the sidebar link lands on the 404 page. Plugins cannot register views — the
+ * only destinations that exist are the built-in routes below and the per-config
+ * collection routes — so a plugin path is valid only if it resolves here. The
+ * `plugin-nav-resolves` test asserts exactly that for every bundled plugin, and
+ * the `admin-routes` drift test keeps `ADMIN_STATIC_ROUTE_PATTERNS` in sync with
+ * the literal `matchRoute('…')` calls in AdminRoot.
+ */
+import { SEO_DEEP_PATHS } from '../views/SEO.js';
+/**
+ * Every static route pattern `AdminRoot.renderView()` resolves via a literal
+ * `matchRoute('…')` call. Dynamic collection routes are derived per-config in
+ * {@link collectionRoutePatterns}; the SEO deep paths are added from the view's
+ * own {@link SEO_DEEP_PATHS} so the two can't drift.
+ */
+export const ADMIN_STATIC_ROUTE_PATTERNS = [
+    '/',
+    '/api-keys',
+    '/collections/:slug',
+    '/collections/:slug/:id',
+    '/collections/:slug/new',
+    '/forgot-password',
+    '/forms',
+    '/forms/:id/edit',
+    '/forms/:id/submissions',
+    '/forms/entries',
+    '/forms/new',
+    '/media',
+    '/page-builder/:id',
+    '/page-builder/new',
+    '/page-templates',
+    '/pages',
+    '/pages/:id',
+    '/pages/:id/edit',
+    '/pages/:id/preview',
+    '/pages/new',
+    '/pages/tags',
+    '/pages/tags/:id/edit',
+    '/pages/tags/new',
+    '/posts',
+    '/posts/:type/:id/edit',
+    '/posts/:type/:id/preview',
+    '/posts/:type/new',
+    '/posts/new',
+    '/posts/types',
+    '/posts/types/:slug/edit',
+    '/posts/types/:slug/template',
+    '/posts/types/new',
+    '/profile',
+    '/reset-password',
+    '/saved-sections',
+    '/script-tags',
+    '/script-tags/:id',
+    '/script-tags/new',
+    '/settings',
+    '/users',
+    '/widgets',
+];
+/**
+ * Slugs AdminRoot reserves so a consumer- or plugin-defined collection can't
+ * own the top-level `/<slug>` route (they stay reachable at `/collections/<slug>`).
+ * Mirrors `RESERVED_SLUGS` in AdminRoot.
+ */
+export const RESERVED_COLLECTION_SLUGS = new Set([
+    'media',
+    'forms',
+    'seo',
+    'script-tags',
+    'saved-sections',
+    'page-templates',
+    'widgets',
+    'users',
+    'settings',
+    'profile',
+    'page-builder',
+    'collections',
+    'pages',
+    'posts',
+]);
+/**
+ * Match a concrete path against a route pattern using AdminRoot's `matchRoute`
+ * rules: equal segment count, and a `:param` segment matches any single
+ * non-empty segment. Query string and hash are ignored.
+ */
+export function matchesRoutePattern(path, pattern) {
+    const pathParts = path.split('?')[0].split('#')[0].split('/').filter(Boolean);
+    const patternParts = pattern.split('/').filter(Boolean);
+    if (pattern === '/')
+        return pathParts.length === 0;
+    if (patternParts.length !== pathParts.length)
+        return false;
+    for (let i = 0; i < patternParts.length; i++) {
+        const pp = patternParts[i];
+        if (pp.startsWith(':'))
+            continue;
+        if (pp !== pathParts[i])
+            return false;
+    }
+    return true;
+}
+/**
+ * The collection routes AdminRoot derives for a config: the always-available
+ * generic `/collections/<slug>`, plus the top-level `/<slug>` list route for
+ * each non-reserved collection. Mirrors AdminRoot's `collectionMap` (keyed by
+ * `def.slug`, slug-less collections skipped).
+ */
+export function collectionRoutePatterns(config) {
+    const out = [];
+    for (const def of Object.values(config?.collections ?? {})) {
+        const slug = def?.slug;
+        if (!slug)
+            continue;
+        out.push(`/collections/${slug}`);
+        if (!RESERVED_COLLECTION_SLUGS.has(slug))
+            out.push(`/${slug}`);
+    }
+    return out;
+}
+/** Every route pattern AdminRoot can resolve under `config`. */
+export function adminRoutePatterns(config) {
+    return [...ADMIN_STATIC_ROUTE_PATTERNS, ...SEO_DEEP_PATHS, ...collectionRoutePatterns(config)];
+}
+/**
+ * True when `path` resolves to a real admin view (i.e. is NOT the 404 fallback)
+ * under `config`. This is the contract every plugin `adminNavItems` path must
+ * satisfy — see the `plugin-nav-resolves` test.
+ */
+export function adminPathResolves(path, config) {
+    return adminRoutePatterns(config).some((pattern) => matchesRoutePattern(path, pattern));
+}
+//# sourceMappingURL=admin-routes.js.map

package/dist/router/admin-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-routes.js","sourceRoot":"","sources":["../../src/router/admin-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,GAAG;IACH,WAAW;IACX,oBAAoB;IACpB,wBAAwB;IACxB,wBAAwB;IACxB,kBAAkB;IAClB,QAAQ;IACR,iBAAiB;IACjB,wBAAwB;IACxB,gBAAgB;IAChB,YAAY;IACZ,QAAQ;IACR,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,QAAQ;IACR,YAAY;IACZ,iBAAiB;IACjB,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,sBAAsB;IACtB,iBAAiB;IACjB,QAAQ;IACR,uBAAuB;IACvB,0BAA0B;IAC1B,kBAAkB;IAClB,YAAY;IACZ,cAAc;IACd,yBAAyB;IACzB,6BAA6B;IAC7B,kBAAkB;IAClB,UAAU;IACV,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,kBAAkB;IAClB,kBAAkB;IAClB,WAAW;IACX,QAAQ;IACR,UAAU;CACX,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IACpE,OAAO;IACP,OAAO;IACP,KAAK;IACL,aAAa;IACb,gBAAgB;IAChB,gBAAgB;IAChB,SAAS;IACT,OAAO;IACP,UAAU;IACV,SAAS;IACT,cAAc;IACd,aAAa;IACb,OAAO;IACP,OAAO;CACR,CAAC,CAAA;AAUF;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,OAAe;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC/E,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAA;IAClD,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAE,CAAA;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAChC,IAAI,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IACvC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAA8B;IACpE,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,CAAA;QACtB,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAA;QAChC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,kBAAkB,CAAC,MAAmB;IACpD,OAAO,CAAC,GAAG,2BAA2B,EAAE,GAAG,cAAc,EAAE,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAA;AAChG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAmB;IACjE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;AACzF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuate-media/cms-admin",
-  "version": "0.76.4",
+  "version": "0.76.6",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -67,8 +67,6 @@
     "lowlight": "^3.0.0",
     "lucide-react": "^1.7.0",
     "qrcode.react": "^4.2.0",
-    "react": "^19.2.0",
-    "react-dom": "^19.2.0",
     "recharts": "^3.8.1",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.5.0",
@@ -79,7 +77,9 @@
   },
   "peerDependencies": {
     "@actuate-media/cms-core": ">=0.1.0",
-    "@actuate-media/component-blocks": ">=0.1.0"
+    "@actuate-media/component-blocks": ">=0.1.0",
+    "react": "^18.0.0 || ^19.0.0",
+    "react-dom": "^18.0.0 || ^19.0.0"
   },
   "peerDependenciesMeta": {
     "@actuate-media/component-blocks": {
@@ -93,11 +93,20 @@
     "@types/react-dom": "^19.0.0",
     "concurrently": "^9.2.1",
     "happy-dom": "^20.9.0",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
     "tailwindcss": "^4.0.0",
     "typescript": "^5.7.0",
     "vitest": "^4.1.0",
     "@actuate-media/component-blocks": "0.2.2",
-    "@actuate-media/cms-core": "0.93.1"
+    "@actuate-media/cms-core": "0.93.4",
+    "@actuate-media/plugin-ai": "0.5.4",
+    "@actuate-media/plugin-blocks": "0.0.15",
+    "@actuate-media/plugin-commerce": "0.1.1",
+    "@actuate-media/plugin-media": "0.0.14",
+    "@actuate-media/plugin-forms": "0.0.15",
+    "@actuate-media/plugin-seo": "0.0.17",
+    "@actuate-media/plugin-navigation": "0.0.14"
   },
   "scripts": {
     "build": "tsc --project tsconfig.json && npx @tailwindcss/cli -i src/styles/build-input.css -o dist/actuate-admin.css --minify",

package/src/__tests__/layout/build-nav-items.test.ts

@@ -61,4 +61,30 @@ describe('buildNavItems — duplicate / grouping regressions', () => {
     expect(items.find((i) => i.path === '/seo/sitemap')?.group).toBe('Content')
     expect(items.find((i) => i.path === '/seo/link-health')?.group).toBe('Content')
   })
+
+  it('excludes admin.hidden collections and does not resurrect removed nav paths', () => {
+    // Post-fix reality: plugin-forms/plugin-redirects no longer advertise
+    // Submissions/Redirects nav items, and their form-submissions/redirects
+    // collections are admin.hidden. Neither should surface a (404-ing) nav path.
+    const items = buildNavItems({
+      collections: {
+        pages: { slug: 'pages', type: 'page', labels: { plural: 'Pages' } },
+        forms: { slug: 'forms', labels: { plural: 'Forms' }, admin: { group: 'Forms' } },
+        'form-submissions': {
+          slug: 'form-submissions',
+          labels: { plural: 'Form Submissions' },
+          admin: { hidden: true },
+        },
+        redirects: { slug: 'redirects', labels: { plural: 'Redirects' }, admin: { hidden: true } },
+      },
+      _pluginNavItems: [
+        { label: 'Forms', icon: 'FileText', path: '/forms' },
+        { label: 'SEO', icon: 'search', path: '/seo' },
+      ],
+    })
+    const paths = items.map((i) => i.path)
+    expect(paths).not.toContain('/form-submissions')
+    expect(paths).not.toContain('/redirects')
+    expect(items.filter((i) => i.path === '/forms')).toHaveLength(1)
+  })
 })

package/src/__tests__/router/admin-routes.test.ts

@@ -0,0 +1,74 @@
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import {
+  ADMIN_STATIC_ROUTE_PATTERNS,
+  adminPathResolves,
+  matchesRoutePattern,
+  collectionRoutePatterns,
+} from '../../router/admin-routes.js'
+
+describe('matchesRoutePattern', () => {
+  it('matches by equal segment count with :param wildcards', () => {
+    expect(matchesRoutePattern('/pages', '/pages')).toBe(true)
+    expect(matchesRoutePattern('/pages/abc123/edit', '/pages/:id/edit')).toBe(true)
+    expect(matchesRoutePattern('/', '/')).toBe(true)
+  })
+
+  it('rejects a mismatched segment count or literal', () => {
+    expect(matchesRoutePattern('/pages/abc', '/pages')).toBe(false)
+    expect(matchesRoutePattern('/ai/scores', '/pages/:id')).toBe(false)
+    expect(matchesRoutePattern('/', '/pages')).toBe(false)
+  })
+
+  it('ignores query string and hash', () => {
+    expect(matchesRoutePattern('/seo?tab=audit', '/seo')).toBe(true)
+  })
+})
+
+describe('adminPathResolves', () => {
+  it('resolves built-in routes and SEO deep paths', () => {
+    expect(adminPathResolves('/media')).toBe(true)
+    expect(adminPathResolves('/forms')).toBe(true)
+    expect(adminPathResolves('/seo')).toBe(true)
+    expect(adminPathResolves('/seo/link-health')).toBe(true)
+  })
+
+  it('does NOT resolve a path with no backing route (the plugin-nav bug)', () => {
+    expect(adminPathResolves('/ai/scores')).toBe(false)
+    expect(adminPathResolves('/commerce/products')).toBe(false)
+    expect(adminPathResolves('/blocks')).toBe(false)
+  })
+
+  it('resolves a non-reserved collection at /<slug> and /collections/<slug>', () => {
+    const config = { collections: { products: { slug: 'products' } } }
+    expect(adminPathResolves('/products', config)).toBe(true)
+    expect(adminPathResolves('/collections/products', config)).toBe(true)
+    // Without the collection, the top-level route does not exist.
+    expect(adminPathResolves('/products')).toBe(false)
+  })
+
+  it('does not give a reserved-slug collection a shadowing top-level route', () => {
+    const patterns = collectionRoutePatterns({ collections: { pages: { slug: 'pages' } } })
+    expect(patterns).toContain('/collections/pages')
+    expect(patterns).not.toContain('/pages')
+  })
+})
+
+/**
+ * Drift guard: every literal `matchRoute('…')` in AdminRoot must be represented
+ * in ADMIN_STATIC_ROUTE_PATTERNS, so `adminPathResolves` can't silently fall
+ * behind the real router (which would let a broken plugin nav path pass review).
+ * Dynamic `matchRoute(`/${slug}/…`)` template calls and iterated SEO paths are
+ * intentionally excluded — those are covered by collection/SEO patterns.
+ */
+describe('ADMIN_STATIC_ROUTE_PATTERNS stays in sync with AdminRoot', () => {
+  it('covers every literal matchRoute() call in AdminRoot', () => {
+    const src = readFileSync(fileURLToPath(new URL('../../AdminRoot.tsx', import.meta.url)), 'utf8')
+    const literals = [...src.matchAll(/matchRoute\(\s*'([^']+)'\s*\)/g)].map((m) => m[1]!)
+    expect(literals.length).toBeGreaterThan(20)
+    const known = new Set(ADMIN_STATIC_ROUTE_PATTERNS)
+    const missing = [...new Set(literals)].filter((p) => !known.has(p))
+    expect(missing).toEqual([])
+  })
+})

package/src/__tests__/router/plugin-nav-resolves.test.ts

@@ -0,0 +1,51 @@
+import { describe, it, expect } from 'vitest'
+import { aiPlugin } from '@actuate-media/plugin-ai'
+import { blocksPlugin } from '@actuate-media/plugin-blocks'
+import { commercePlugin } from '@actuate-media/plugin-commerce'
+import { formsPlugin } from '@actuate-media/plugin-forms'
+import { mediaPlugin } from '@actuate-media/plugin-media'
+import { navigationPlugin } from '@actuate-media/plugin-navigation'
+import { seoPlugin } from '@actuate-media/plugin-seo'
+import { adminPathResolves } from '../../router/admin-routes.js'
+
+/**
+ * Systemic guard for the recurring plugin-nav-404 class: a plugin advertises an
+ * `adminNavItems` path the admin router has no route for, so the sidebar link
+ * lands on the 404 page. It has shipped in published packages more than once
+ * (plugin-ai / plugin-commerce / plugin-blocks). Plugins cannot register views,
+ * so every nav path MUST resolve to a built-in route or one of the plugin's own
+ * collection routes — asserted here for every bundled plugin.
+ *
+ * When this fails: either point the nav item at a real route (a built-in, or a
+ * `/<slug>` for a collection the plugin registers) or remove it until a plugin
+ * view API exists. Do NOT add the path to ADMIN_STATIC_ROUTE_PATTERNS unless
+ * AdminRoot actually renders a view for it.
+ */
+const BUNDLED_PLUGINS = [
+  { name: 'plugin-ai', plugin: aiPlugin() },
+  { name: 'plugin-blocks', plugin: blocksPlugin() },
+  { name: 'plugin-commerce', plugin: commercePlugin() },
+  { name: 'plugin-forms', plugin: formsPlugin() },
+  { name: 'plugin-media', plugin: mediaPlugin() },
+  { name: 'plugin-navigation', plugin: navigationPlugin() },
+  { name: 'plugin-seo', plugin: seoPlugin() },
+]
+
+describe('every bundled plugin adminNavItems path resolves to a real admin view', () => {
+  for (const { name, plugin } of BUNDLED_PLUGINS) {
+    const navItems = plugin.adminNavItems ?? []
+    // A config exposing exactly this plugin's collections — the only extra
+    // destinations a plugin can legitimately point its nav at.
+    const config = { collections: plugin.collections ?? {} }
+
+    it(`${name} (${navItems.length} nav item${navItems.length === 1 ? '' : 's'})`, () => {
+      const dead = navItems
+        .map((item) => item.path)
+        .filter((path) => !adminPathResolves(path, config))
+      expect(
+        dead,
+        `${name} advertises sidebar paths with no admin route: ${dead.join(', ')}`,
+      ).toEqual([])
+    })
+  }
+})

package/src/router/admin-routes.ts

@@ -0,0 +1,144 @@
+/**
+ * The set of admin routes `AdminRoot.renderView()` can resolve, expressed as
+ * data so callers other than the render tree can ask "does this path lead to a
+ * real view, or to the 404 fallback?".
+ *
+ * This exists to guard a recurring class of bug: a plugin advertises an
+ * `adminNavItems` path (e.g. `/ai/scores`) that the router has no route for, so
+ * the sidebar link lands on the 404 page. Plugins cannot register views — the
+ * only destinations that exist are the built-in routes below and the per-config
+ * collection routes — so a plugin path is valid only if it resolves here. The
+ * `plugin-nav-resolves` test asserts exactly that for every bundled plugin, and
+ * the `admin-routes` drift test keeps `ADMIN_STATIC_ROUTE_PATTERNS` in sync with
+ * the literal `matchRoute('…')` calls in AdminRoot.
+ */
+import { SEO_DEEP_PATHS } from '../views/SEO.js'
+
+/**
+ * Every static route pattern `AdminRoot.renderView()` resolves via a literal
+ * `matchRoute('…')` call. Dynamic collection routes are derived per-config in
+ * {@link collectionRoutePatterns}; the SEO deep paths are added from the view's
+ * own {@link SEO_DEEP_PATHS} so the two can't drift.
+ */
+export const ADMIN_STATIC_ROUTE_PATTERNS: readonly string[] = [
+  '/',
+  '/api-keys',
+  '/collections/:slug',
+  '/collections/:slug/:id',
+  '/collections/:slug/new',
+  '/forgot-password',
+  '/forms',
+  '/forms/:id/edit',
+  '/forms/:id/submissions',
+  '/forms/entries',
+  '/forms/new',
+  '/media',
+  '/page-builder/:id',
+  '/page-builder/new',
+  '/page-templates',
+  '/pages',
+  '/pages/:id',
+  '/pages/:id/edit',
+  '/pages/:id/preview',
+  '/pages/new',
+  '/pages/tags',
+  '/pages/tags/:id/edit',
+  '/pages/tags/new',
+  '/posts',
+  '/posts/:type/:id/edit',
+  '/posts/:type/:id/preview',
+  '/posts/:type/new',
+  '/posts/new',
+  '/posts/types',
+  '/posts/types/:slug/edit',
+  '/posts/types/:slug/template',
+  '/posts/types/new',
+  '/profile',
+  '/reset-password',
+  '/saved-sections',
+  '/script-tags',
+  '/script-tags/:id',
+  '/script-tags/new',
+  '/settings',
+  '/users',
+  '/widgets',
+]
+
+/**
+ * Slugs AdminRoot reserves so a consumer- or plugin-defined collection can't
+ * own the top-level `/<slug>` route (they stay reachable at `/collections/<slug>`).
+ * Mirrors `RESERVED_SLUGS` in AdminRoot.
+ */
+export const RESERVED_COLLECTION_SLUGS: ReadonlySet<string> = new Set([
+  'media',
+  'forms',
+  'seo',
+  'script-tags',
+  'saved-sections',
+  'page-templates',
+  'widgets',
+  'users',
+  'settings',
+  'profile',
+  'page-builder',
+  'collections',
+  'pages',
+  'posts',
+])
+
+interface CollectionLike {
+  slug?: string
+  type?: string
+}
+interface ConfigLike {
+  collections?: Record<string, CollectionLike | undefined>
+}
+
+/**
+ * Match a concrete path against a route pattern using AdminRoot's `matchRoute`
+ * rules: equal segment count, and a `:param` segment matches any single
+ * non-empty segment. Query string and hash are ignored.
+ */
+export function matchesRoutePattern(path: string, pattern: string): boolean {
+  const pathParts = path.split('?')[0]!.split('#')[0]!.split('/').filter(Boolean)
+  const patternParts = pattern.split('/').filter(Boolean)
+  if (pattern === '/') return pathParts.length === 0
+  if (patternParts.length !== pathParts.length) return false
+  for (let i = 0; i < patternParts.length; i++) {
+    const pp = patternParts[i]!
+    if (pp.startsWith(':')) continue
+    if (pp !== pathParts[i]) return false
+  }
+  return true
+}
+
+/**
+ * The collection routes AdminRoot derives for a config: the always-available
+ * generic `/collections/<slug>`, plus the top-level `/<slug>` list route for
+ * each non-reserved collection. Mirrors AdminRoot's `collectionMap` (keyed by
+ * `def.slug`, slug-less collections skipped).
+ */
+export function collectionRoutePatterns(config: ConfigLike | undefined): string[] {
+  const out: string[] = []
+  for (const def of Object.values(config?.collections ?? {})) {
+    const slug = def?.slug
+    if (!slug) continue
+    out.push(`/collections/${slug}`)
+    if (!RESERVED_COLLECTION_SLUGS.has(slug)) out.push(`/${slug}`)
+  }
+  return out
+}
+
+/** Every route pattern AdminRoot can resolve under `config`. */
+export function adminRoutePatterns(config?: ConfigLike): string[] {
+  return [...ADMIN_STATIC_ROUTE_PATTERNS, ...SEO_DEEP_PATHS, ...collectionRoutePatterns(config)]
+}
+
+/**
+ * True when `path` resolves to a real admin view (i.e. is NOT the 404 fallback)
+ * under `config`. This is the contract every plugin `adminNavItems` path must
+ * satisfy — see the `plugin-nav-resolves` test.
+ */
+export function adminPathResolves(path: string, config?: ConfigLike): boolean {
+  return adminRoutePatterns(config).some((pattern) => matchesRoutePattern(path, pattern))
+}