@sonicjs-cms/core 2.10.0 → 2.10.1

package/dist/{chunk-RCA6R6VE.cjs → chunk-HGKBMUYY.cjs}

@@ -1,12 +1,12 @@
 'use strict';
 
-var chunk64APW3DW_cjs = require('./chunk-64APW3DW.cjs');
-var chunkIT2TC4ZD_cjs = require('./chunk-IT2TC4ZD.cjs');
-var chunkIIBRG5S5_cjs = require('./chunk-IIBRG5S5.cjs');
-var chunkZMVWMJ3S_cjs = require('./chunk-ZMVWMJ3S.cjs');
+var chunkLFAQUR7P_cjs = require('./chunk-LFAQUR7P.cjs');
+var chunk5GO3AMON_cjs = require('./chunk-5GO3AMON.cjs');
+var chunkTWCQVJ6M_cjs = require('./chunk-TWCQVJ6M.cjs');
+var chunkEAJJHE5F_cjs = require('./chunk-EAJJHE5F.cjs');
 var chunkLTKV7AE5_cjs = require('./chunk-LTKV7AE5.cjs');
 var chunk6FHNRRJ3_cjs = require('./chunk-6FHNRRJ3.cjs');
-var chunkEKPLKUZT_cjs = require('./chunk-EKPLKUZT.cjs');
+var chunkE2GKK5HX_cjs = require('./chunk-E2GKK5HX.cjs');
 var chunkRCQ2HIQD_cjs = require('./chunk-RCQ2HIQD.cjs');
 var chunkMNWKYY5E_cjs = require('./chunk-MNWKYY5E.cjs');
 var hono = require('hono');
@@ -121,7 +121,7 @@ apiContentCrudRoutes.get("/:id", async (c) => {
     }, 500);
   }
 });
-apiContentCrudRoutes.post("/", chunkIT2TC4ZD_cjs.requireAuth(), chunkIT2TC4ZD_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
+apiContentCrudRoutes.post("/", chunk5GO3AMON_cjs.requireAuth(), chunk5GO3AMON_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
   try {
     const db = c.env.DB;
     const user = c.get("user");
@@ -162,7 +162,7 @@ apiContentCrudRoutes.post("/", chunkIT2TC4ZD_cjs.requireAuth(), chunkIT2TC4ZD_cj
       now,
       now
     ).run();
-    const cache = chunk64APW3DW_cjs.getCacheService(chunk64APW3DW_cjs.CACHE_CONFIGS.api);
+    const cache = chunkLFAQUR7P_cjs.getCacheService(chunkLFAQUR7P_cjs.CACHE_CONFIGS.api);
     await cache.invalidate(`content:list:${collectionId}:*`);
     await cache.invalidate("content-filtered:*");
     const getStmt = db.prepare("SELECT * FROM content WHERE id = ?");
@@ -187,7 +187,7 @@ apiContentCrudRoutes.post("/", chunkIT2TC4ZD_cjs.requireAuth(), chunkIT2TC4ZD_cj
     }, 500);
   }
 });
-apiContentCrudRoutes.put("/:id", chunkIT2TC4ZD_cjs.requireAuth(), chunkIT2TC4ZD_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
+apiContentCrudRoutes.put("/:id", chunk5GO3AMON_cjs.requireAuth(), chunk5GO3AMON_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
   try {
     const id = c.req.param("id");
     const db = c.env.DB;
@@ -225,7 +225,7 @@ apiContentCrudRoutes.put("/:id", chunkIT2TC4ZD_cjs.requireAuth(), chunkIT2TC4ZD_
       WHERE id = ?
     `);
     await updateStmt.bind(...params).run();
-    const cache = chunk64APW3DW_cjs.getCacheService(chunk64APW3DW_cjs.CACHE_CONFIGS.api);
+    const cache = chunkLFAQUR7P_cjs.getCacheService(chunkLFAQUR7P_cjs.CACHE_CONFIGS.api);
     await cache.delete(cache.generateKey("content", id));
     await cache.invalidate(`content:list:${existing.collection_id}:*`);
     await cache.invalidate("content-filtered:*");
@@ -251,7 +251,7 @@ apiContentCrudRoutes.put("/:id", chunkIT2TC4ZD_cjs.requireAuth(), chunkIT2TC4ZD_
     }, 500);
   }
 });
-apiContentCrudRoutes.delete("/:id", chunkIT2TC4ZD_cjs.requireAuth(), chunkIT2TC4ZD_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
+apiContentCrudRoutes.delete("/:id", chunk5GO3AMON_cjs.requireAuth(), chunk5GO3AMON_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
   try {
     const id = c.req.param("id");
     const db = c.env.DB;
@@ -262,7 +262,7 @@ apiContentCrudRoutes.delete("/:id", chunkIT2TC4ZD_cjs.requireAuth(), chunkIT2TC4
     }
     const deleteStmt = db.prepare("DELETE FROM content WHERE id = ?");
     await deleteStmt.bind(id).run();
-    const cache = chunk64APW3DW_cjs.getCacheService(chunk64APW3DW_cjs.CACHE_CONFIGS.api);
+    const cache = chunkLFAQUR7P_cjs.getCacheService(chunkLFAQUR7P_cjs.CACHE_CONFIGS.api);
     await cache.delete(cache.generateKey("content", id));
     await cache.invalidate(`content:list:${existing.collection_id}:*`);
     await cache.invalidate("content-filtered:*");
@@ -287,7 +287,7 @@ apiRoutes.use("*", async (c, next) => {
   c.header("X-Response-Time", `${totalTime}ms`);
 });
 apiRoutes.use("*", async (c, next) => {
-  const cacheEnabled = await chunkIT2TC4ZD_cjs.isPluginActive(c.env.DB, "core-cache");
+  const cacheEnabled = await chunk5GO3AMON_cjs.isPluginActive(c.env.DB, "core-cache");
   c.set("cacheEnabled", cacheEnabled);
   await next();
 });
@@ -724,7 +724,7 @@ apiRoutes.get("/collections", async (c) => {
   try {
     const db = c.env.DB;
     const cacheEnabled = c.get("cacheEnabled");
-    const cache = chunk64APW3DW_cjs.getCacheService(chunk64APW3DW_cjs.CACHE_CONFIGS.api);
+    const cache = chunkLFAQUR7P_cjs.getCacheService(chunkLFAQUR7P_cjs.CACHE_CONFIGS.api);
     const cacheKey = cache.generateKey("collections", "all");
     if (cacheEnabled) {
       const cacheResult = await cache.getWithSource(cacheKey);
@@ -750,7 +750,7 @@ apiRoutes.get("/collections", async (c) => {
     }
     c.header("X-Cache-Status", "MISS");
     c.header("X-Cache-Source", "database");
-    const stmt = db.prepare("SELECT * FROM collections WHERE is_active = 1");
+    const stmt = db.prepare("SELECT * FROM collections WHERE is_active = 1 AND (source_type IS NULL OR source_type = 'user')");
     const { results } = await stmt.all();
     const transformedResults = results.map((row) => ({
       ...row,
@@ -778,7 +778,7 @@ apiRoutes.get("/collections", async (c) => {
     return c.json({ error: "Failed to fetch collections" }, 500);
   }
 });
-apiRoutes.get("/content", chunkIT2TC4ZD_cjs.optionalAuth(), async (c) => {
+apiRoutes.get("/content", chunk5GO3AMON_cjs.optionalAuth(), async (c) => {
   const executionStart = Date.now();
   try {
     const db = c.env.DB;
@@ -801,13 +801,13 @@ apiRoutes.get("/content", chunkIT2TC4ZD_cjs.optionalAuth(), async (c) => {
         });
       }
     }
-    const filter = chunkEKPLKUZT_cjs.QueryFilterBuilder.parseFromQuery(queryParams);
+    const filter = chunkE2GKK5HX_cjs.QueryFilterBuilder.parseFromQuery(queryParams);
     const normalizedFilter = normalizePublicContentFilter(filter, c.get("user")?.role);
     if (!normalizedFilter.limit) {
       normalizedFilter.limit = 50;
     }
     normalizedFilter.limit = Math.min(normalizedFilter.limit, 1e3);
-    const builder3 = new chunkEKPLKUZT_cjs.QueryFilterBuilder();
+    const builder3 = new chunkE2GKK5HX_cjs.QueryFilterBuilder();
     const queryResult = builder3.build("content", normalizedFilter);
     if (queryResult.errors.length > 0) {
       return c.json({
@@ -816,7 +816,7 @@ apiRoutes.get("/content", chunkIT2TC4ZD_cjs.optionalAuth(), async (c) => {
       }, 400);
     }
     const cacheEnabled = c.get("cacheEnabled");
-    const cache = chunk64APW3DW_cjs.getCacheService(chunk64APW3DW_cjs.CACHE_CONFIGS.api);
+    const cache = chunkLFAQUR7P_cjs.getCacheService(chunkLFAQUR7P_cjs.CACHE_CONFIGS.api);
     const cacheKey = cache.generateKey("content-filtered", JSON.stringify({ filter: normalizedFilter, query: queryResult.sql }));
     if (cacheEnabled) {
       const cacheResult = await cache.getWithSource(cacheKey);
@@ -879,7 +879,7 @@ apiRoutes.get("/content", chunkIT2TC4ZD_cjs.optionalAuth(), async (c) => {
     }, 500);
   }
 });
-apiRoutes.get("/collections/:collection/content", chunkIT2TC4ZD_cjs.optionalAuth(), async (c) => {
+apiRoutes.get("/collections/:collection/content", chunk5GO3AMON_cjs.optionalAuth(), async (c) => {
   const executionStart = Date.now();
   try {
     const collection = c.req.param("collection");
@@ -890,7 +890,7 @@ apiRoutes.get("/collections/:collection/content", chunkIT2TC4ZD_cjs.optionalAuth
     if (!collectionResult) {
       return c.json({ error: "Collection not found" }, 404);
     }
-    const filter = chunkEKPLKUZT_cjs.QueryFilterBuilder.parseFromQuery(queryParams);
+    const filter = chunkE2GKK5HX_cjs.QueryFilterBuilder.parseFromQuery(queryParams);
     const normalizedFilter = normalizePublicContentFilter(filter, c.get("user")?.role);
     if (!normalizedFilter.where) {
       normalizedFilter.where = { and: [] };
@@ -907,7 +907,7 @@ apiRoutes.get("/collections/:collection/content", chunkIT2TC4ZD_cjs.optionalAuth
       normalizedFilter.limit = 50;
     }
     normalizedFilter.limit = Math.min(normalizedFilter.limit, 1e3);
-    const builder3 = new chunkEKPLKUZT_cjs.QueryFilterBuilder();
+    const builder3 = new chunkE2GKK5HX_cjs.QueryFilterBuilder();
     const queryResult = builder3.build("content", normalizedFilter);
     if (queryResult.errors.length > 0) {
       return c.json({
@@ -916,7 +916,7 @@ apiRoutes.get("/collections/:collection/content", chunkIT2TC4ZD_cjs.optionalAuth
       }, 400);
     }
     const cacheEnabled = c.get("cacheEnabled");
-    const cache = chunk64APW3DW_cjs.getCacheService(chunk64APW3DW_cjs.CACHE_CONFIGS.api);
+    const cache = chunkLFAQUR7P_cjs.getCacheService(chunkLFAQUR7P_cjs.CACHE_CONFIGS.api);
     const cacheKey = cache.generateKey("collection-content-filtered", `${collection}:${JSON.stringify({ filter: normalizedFilter, query: queryResult.sql })}`);
     if (cacheEnabled) {
       const cacheResult = await cache.getWithSource(cacheKey);
@@ -1028,7 +1028,7 @@ var fileValidationSchema = zod.z.object({
   // 50MB max
 });
 var apiMediaRoutes = new hono.Hono();
-apiMediaRoutes.use("*", chunkIT2TC4ZD_cjs.requireAuth());
+apiMediaRoutes.use("*", chunk5GO3AMON_cjs.requireAuth());
 apiMediaRoutes.post("/upload", async (c) => {
   try {
     const user = c.get("user");
@@ -1772,14 +1772,14 @@ apiSystemRoutes.get("/env", (c) => {
 });
 var api_system_default = apiSystemRoutes;
 var adminApiRoutes = new hono.Hono();
-adminApiRoutes.use("*", chunkIT2TC4ZD_cjs.requireAuth());
-adminApiRoutes.use("*", chunkIT2TC4ZD_cjs.requireRole(["admin", "editor"]));
+adminApiRoutes.use("*", chunk5GO3AMON_cjs.requireAuth());
+adminApiRoutes.use("*", chunk5GO3AMON_cjs.requireRole(["admin", "editor"]));
 adminApiRoutes.get("/stats", async (c) => {
   try {
     const db = c.env.DB;
     let collectionsCount = 0;
     try {
-      const collectionsStmt = db.prepare("SELECT COUNT(*) as count FROM collections WHERE is_active = 1");
+      const collectionsStmt = db.prepare("SELECT COUNT(*) as count FROM collections WHERE is_active = 1 AND (source_type IS NULL OR source_type = 'user')");
       const collectionsResult = await collectionsStmt.first();
       collectionsCount = collectionsResult?.count || 0;
     } catch (error) {
@@ -1787,7 +1787,7 @@ adminApiRoutes.get("/stats", async (c) => {
     }
     let contentCount = 0;
     try {
-      const contentStmt = db.prepare("SELECT COUNT(*) as count FROM content WHERE deleted_at IS NULL");
+      const contentStmt = db.prepare("SELECT COUNT(*) as count FROM content c JOIN collections col ON c.collection_id = col.id WHERE c.deleted_at IS NULL AND (col.source_type IS NULL OR col.source_type = 'user')");
       const contentResult = await contentStmt.first();
       contentCount = contentResult?.count || 0;
     } catch (error) {
@@ -1929,6 +1929,7 @@ adminApiRoutes.get("/collections", async (c) => {
         SELECT id, name, display_name, description, created_at, updated_at, is_active, managed
         FROM collections
         WHERE ${includeInactive ? "1=1" : "is_active = 1"}
+        AND (source_type IS NULL OR source_type = 'user')
         AND (name LIKE ? OR display_name LIKE ? OR description LIKE ?)
         ORDER BY created_at DESC
       `);
@@ -1939,7 +1940,8 @@ adminApiRoutes.get("/collections", async (c) => {
       stmt = db.prepare(`
         SELECT id, name, display_name, description, created_at, updated_at, is_active, managed
         FROM collections
-        ${includeInactive ? "" : "WHERE is_active = 1"}
+        WHERE (source_type IS NULL OR source_type = 'user')
+        ${includeInactive ? "" : "AND is_active = 1"}
         ORDER BY created_at DESC
       `);
       const queryResults = await stmt.all();
@@ -2283,7 +2285,7 @@ adminApiRoutes.delete("/collections/:id", async (c) => {
 });
 adminApiRoutes.get("/migrations/status", async (c) => {
   try {
-    const { MigrationService: MigrationService2 } = await import('./migrations-ONIAY6GK.cjs');
+    const { MigrationService: MigrationService2 } = await import('./migrations-EM2D6EG2.cjs');
     const db = c.env.DB;
     const migrationService = new MigrationService2(db);
     const status = await migrationService.getMigrationStatus();
@@ -2308,7 +2310,7 @@ adminApiRoutes.post("/migrations/run", async (c) => {
         error: "Unauthorized. Admin access required."
       }, 403);
     }
-    const { MigrationService: MigrationService2 } = await import('./migrations-ONIAY6GK.cjs');
+    const { MigrationService: MigrationService2 } = await import('./migrations-EM2D6EG2.cjs');
     const db = c.env.DB;
     const migrationService = new MigrationService2(db);
     const result = await migrationService.runPendingMigrations();
@@ -2327,7 +2329,7 @@ adminApiRoutes.post("/migrations/run", async (c) => {
 });
 adminApiRoutes.get("/migrations/validate", async (c) => {
   try {
-    const { MigrationService: MigrationService2 } = await import('./migrations-ONIAY6GK.cjs');
+    const { MigrationService: MigrationService2 } = await import('./migrations-EM2D6EG2.cjs');
     const db = c.env.DB;
     const migrationService = new MigrationService2(db);
     const validation = await migrationService.validateSchema();
@@ -2738,7 +2740,7 @@ var JWT_SECRET_FALLBACK = "your-super-secret-jwt-key-change-in-production";
 async function setCsrfCookie(c) {
   const secret = c.env?.JWT_SECRET || JWT_SECRET_FALLBACK;
   const isDev = c.env?.ENVIRONMENT === "development" || !c.env?.ENVIRONMENT;
-  const csrfToken = await chunkIT2TC4ZD_cjs.generateCsrfToken(secret);
+  const csrfToken = await chunk5GO3AMON_cjs.generateCsrfToken(secret);
   cookie.setCookie(c, "csrf_token", csrfToken, {
     httpOnly: false,
     secure: !isDev,
@@ -2795,7 +2797,7 @@ var loginSchema = zod.z.object({
 });
 authRoutes.post(
   "/register",
-  chunkIT2TC4ZD_cjs.rateLimit({ max: 3, windowMs: 60 * 1e3, keyPrefix: "register" }),
+  chunk5GO3AMON_cjs.rateLimit({ max: 3, windowMs: 60 * 1e3, keyPrefix: "register" }),
   async (c) => {
     try {
       const db = c.env.DB;
@@ -2832,7 +2834,7 @@ authRoutes.post(
       if (existingUser) {
         return c.json({ error: "User with this email or username already exists" }, 400);
       }
-      const passwordHash = await chunkIT2TC4ZD_cjs.AuthManager.hashPassword(password);
+      const passwordHash = await chunk5GO3AMON_cjs.AuthManager.hashPassword(password);
       const userId = crypto.randomUUID();
       const now = /* @__PURE__ */ new Date();
       await db.prepare(`
@@ -2852,7 +2854,7 @@ authRoutes.post(
         now.getTime(),
         now.getTime()
       ).run();
-      const token = await chunkIT2TC4ZD_cjs.AuthManager.generateToken(userId, normalizedEmail, "viewer", c.env.JWT_SECRET);
+      const token = await chunk5GO3AMON_cjs.AuthManager.generateToken(userId, normalizedEmail, "viewer", c.env.JWT_SECRET);
       cookie.setCookie(c, "auth_token", token, {
         httpOnly: true,
         secure: true,
@@ -2886,7 +2888,7 @@ authRoutes.post(
 );
 authRoutes.post(
   "/login",
-  chunkIT2TC4ZD_cjs.rateLimit({ max: 5, windowMs: 60 * 1e3, keyPrefix: "login" }),
+  chunk5GO3AMON_cjs.rateLimit({ max: 5, windowMs: 60 * 1e3, keyPrefix: "login" }),
   async (c) => {
     try {
       const body = await c.req.json();
@@ -2897,7 +2899,7 @@ authRoutes.post(
       const { email, password } = validation.data;
       const db = c.env.DB;
       const normalizedEmail = email.toLowerCase();
-      const cache = chunk64APW3DW_cjs.getCacheService(chunk64APW3DW_cjs.CACHE_CONFIGS.user);
+      const cache = chunkLFAQUR7P_cjs.getCacheService(chunkLFAQUR7P_cjs.CACHE_CONFIGS.user);
       let user = await cache.get(cache.generateKey("user", `email:${normalizedEmail}`));
       if (!user) {
         user = await db.prepare("SELECT * FROM users WHERE email = ? AND is_active = 1").bind(normalizedEmail).first();
@@ -2909,19 +2911,19 @@ authRoutes.post(
       if (!user) {
         return c.json({ error: "Invalid email or password" }, 401);
       }
-      const isValidPassword = await chunkIT2TC4ZD_cjs.AuthManager.verifyPassword(password, user.password_hash);
+      const isValidPassword = await chunk5GO3AMON_cjs.AuthManager.verifyPassword(password, user.password_hash);
       if (!isValidPassword) {
         return c.json({ error: "Invalid email or password" }, 401);
       }
-      if (chunkIT2TC4ZD_cjs.AuthManager.isLegacyHash(user.password_hash)) {
+      if (chunk5GO3AMON_cjs.AuthManager.isLegacyHash(user.password_hash)) {
         try {
-          const newHash = await chunkIT2TC4ZD_cjs.AuthManager.hashPassword(password);
+          const newHash = await chunk5GO3AMON_cjs.AuthManager.hashPassword(password);
           await db.prepare("UPDATE users SET password_hash = ?, updated_at = ? WHERE id = ?").bind(newHash, Date.now(), user.id).run();
         } catch (rehashError) {
           console.error("Password rehash failed (non-fatal):", rehashError);
         }
       }
-      const token = await chunkIT2TC4ZD_cjs.AuthManager.generateToken(user.id, user.email, user.role, c.env.JWT_SECRET);
+      const token = await chunk5GO3AMON_cjs.AuthManager.generateToken(user.id, user.email, user.role, c.env.JWT_SECRET);
       cookie.setCookie(c, "auth_token", token, {
         httpOnly: true,
         secure: true,
@@ -2974,7 +2976,7 @@ authRoutes.get("/logout", (c) => {
   clearCsrfCookie(c);
   return c.redirect("/auth/login?message=You have been logged out successfully");
 });
-authRoutes.get("/me", chunkIT2TC4ZD_cjs.requireAuth(), async (c) => {
+authRoutes.get("/me", chunk5GO3AMON_cjs.requireAuth(), async (c) => {
   try {
     const user = c.get("user");
     if (!user) {
@@ -2991,13 +2993,13 @@ authRoutes.get("/me", chunkIT2TC4ZD_cjs.requireAuth(), async (c) => {
     return c.json({ error: "Failed to get user" }, 500);
   }
 });
-authRoutes.post("/refresh", chunkIT2TC4ZD_cjs.requireAuth(), async (c) => {
+authRoutes.post("/refresh", chunk5GO3AMON_cjs.requireAuth(), async (c) => {
   try {
     const user = c.get("user");
     if (!user) {
       return c.json({ error: "Not authenticated" }, 401);
     }
-    const token = await chunkIT2TC4ZD_cjs.AuthManager.generateToken(user.userId, user.email, user.role, c.env.JWT_SECRET);
+    const token = await chunk5GO3AMON_cjs.AuthManager.generateToken(user.userId, user.email, user.role, c.env.JWT_SECRET);
     cookie.setCookie(c, "auth_token", token, {
       httpOnly: true,
       secure: true,
@@ -3014,7 +3016,7 @@ authRoutes.post("/refresh", chunkIT2TC4ZD_cjs.requireAuth(), async (c) => {
 });
 authRoutes.post(
   "/register/form",
-  chunkIT2TC4ZD_cjs.rateLimit({ max: 3, windowMs: 60 * 1e3, keyPrefix: "register" }),
+  chunk5GO3AMON_cjs.rateLimit({ max: 3, windowMs: 60 * 1e3, keyPrefix: "register" }),
   async (c) => {
     try {
       const db = c.env.DB;
@@ -3061,7 +3063,7 @@ authRoutes.post(
         </div>
       `);
       }
-      const passwordHash = await chunkIT2TC4ZD_cjs.AuthManager.hashPassword(password);
+      const passwordHash = await chunk5GO3AMON_cjs.AuthManager.hashPassword(password);
       const role = isFirstUser ? "admin" : "viewer";
       const userId = crypto.randomUUID();
       const now = /* @__PURE__ */ new Date();
@@ -3081,7 +3083,7 @@ authRoutes.post(
         now.getTime(),
         now.getTime()
       ).run();
-      const token = await chunkIT2TC4ZD_cjs.AuthManager.generateToken(userId, normalizedEmail, role, c.env.JWT_SECRET);
+      const token = await chunk5GO3AMON_cjs.AuthManager.generateToken(userId, normalizedEmail, role, c.env.JWT_SECRET);
       cookie.setCookie(c, "auth_token", token, {
         httpOnly: true,
         secure: false,
@@ -3114,7 +3116,7 @@ authRoutes.post(
 );
 authRoutes.post(
   "/login/form",
-  chunkIT2TC4ZD_cjs.rateLimit({ max: 5, windowMs: 60 * 1e3, keyPrefix: "login" }),
+  chunk5GO3AMON_cjs.rateLimit({ max: 5, windowMs: 60 * 1e3, keyPrefix: "login" }),
   async (c) => {
     try {
       const formData = await c.req.formData();
@@ -3138,7 +3140,7 @@ authRoutes.post(
         </div>
       `);
       }
-      const isValidPassword = await chunkIT2TC4ZD_cjs.AuthManager.verifyPassword(password, user.password_hash);
+      const isValidPassword = await chunk5GO3AMON_cjs.AuthManager.verifyPassword(password, user.password_hash);
       if (!isValidPassword) {
         return c.html(html.html`
         <div class="bg-red-100 border border-red-400 text-red-700 px-4 py-3 rounded">
@@ -3146,15 +3148,15 @@ authRoutes.post(
         </div>
       `);
       }
-      if (chunkIT2TC4ZD_cjs.AuthManager.isLegacyHash(user.password_hash)) {
+      if (chunk5GO3AMON_cjs.AuthManager.isLegacyHash(user.password_hash)) {
         try {
-          const newHash = await chunkIT2TC4ZD_cjs.AuthManager.hashPassword(password);
+          const newHash = await chunk5GO3AMON_cjs.AuthManager.hashPassword(password);
           await db.prepare("UPDATE users SET password_hash = ?, updated_at = ? WHERE id = ?").bind(newHash, Date.now(), user.id).run();
         } catch (rehashError) {
           console.error("Password rehash failed (non-fatal):", rehashError);
         }
       }
-      const token = await chunkIT2TC4ZD_cjs.AuthManager.generateToken(user.id, user.email, user.role, c.env.JWT_SECRET);
+      const token = await chunk5GO3AMON_cjs.AuthManager.generateToken(user.id, user.email, user.role, c.env.JWT_SECRET);
       cookie.setCookie(c, "auth_token", token, {
         httpOnly: true,
         secure: false,
@@ -3196,7 +3198,7 @@ authRoutes.post(
 );
 authRoutes.post(
   "/seed-admin",
-  chunkIT2TC4ZD_cjs.rateLimit({ max: 2, windowMs: 60 * 1e3, keyPrefix: "seed-admin" }),
+  chunk5GO3AMON_cjs.rateLimit({ max: 2, windowMs: 60 * 1e3, keyPrefix: "seed-admin" }),
   async (c) => {
     try {
       const db = c.env.DB;
@@ -3218,7 +3220,7 @@ authRoutes.post(
     `).run();
       const existingAdmin = await db.prepare("SELECT id FROM users WHERE email = ? OR username = ?").bind("admin@sonicjs.com", "admin").first();
       if (existingAdmin) {
-        const passwordHash2 = await chunkIT2TC4ZD_cjs.AuthManager.hashPassword("sonicjs!");
+        const passwordHash2 = await chunk5GO3AMON_cjs.AuthManager.hashPassword("sonicjs!");
         await db.prepare("UPDATE users SET password_hash = ?, updated_at = ? WHERE id = ?").bind(passwordHash2, Date.now(), existingAdmin.id).run();
         return c.json({
           message: "Admin user already exists (password updated)",
@@ -3230,7 +3232,7 @@ authRoutes.post(
           }
         });
       }
-      const passwordHash = await chunkIT2TC4ZD_cjs.AuthManager.hashPassword("sonicjs!");
+      const passwordHash = await chunk5GO3AMON_cjs.AuthManager.hashPassword("sonicjs!");
       const userId = "admin-user-id";
       const now = Date.now();
       const adminEmail = "admin@sonicjs.com".toLowerCase();
@@ -3451,7 +3453,7 @@ authRoutes.post("/accept-invitation", async (c) => {
     if (existingUsername) {
       return c.json({ error: "Username is already taken" }, 400);
     }
-    const passwordHash = await chunkIT2TC4ZD_cjs.AuthManager.hashPassword(password);
+    const passwordHash = await chunk5GO3AMON_cjs.AuthManager.hashPassword(password);
     const updateStmt = db.prepare(`
       UPDATE users SET 
         username = ?,
@@ -3470,7 +3472,7 @@ authRoutes.post("/accept-invitation", async (c) => {
       Date.now(),
       invitedUser.id
     ).run();
-    const authToken = await chunkIT2TC4ZD_cjs.AuthManager.generateToken(invitedUser.id, invitedUser.email, invitedUser.role, c.env.JWT_SECRET);
+    const authToken = await chunk5GO3AMON_cjs.AuthManager.generateToken(invitedUser.id, invitedUser.email, invitedUser.role, c.env.JWT_SECRET);
     cookie.setCookie(c, "auth_token", authToken, {
       httpOnly: true,
       secure: true,
@@ -3487,7 +3489,7 @@ authRoutes.post("/accept-invitation", async (c) => {
 });
 authRoutes.post(
   "/request-password-reset",
-  chunkIT2TC4ZD_cjs.rateLimit({ max: 3, windowMs: 15 * 60 * 1e3, keyPrefix: "password-reset" }),
+  chunk5GO3AMON_cjs.rateLimit({ max: 3, windowMs: 15 * 60 * 1e3, keyPrefix: "password-reset" }),
   async (c) => {
     try {
       const formData = await c.req.formData();
@@ -3705,7 +3707,7 @@ authRoutes.post("/reset-password", async (c) => {
     if (Date.now() > user.password_reset_expires) {
       return c.json({ error: "Reset token has expired" }, 400);
     }
-    const newPasswordHash = await chunkIT2TC4ZD_cjs.AuthManager.hashPassword(password);
+    const newPasswordHash = await chunk5GO3AMON_cjs.AuthManager.hashPassword(password);
     try {
       const historyStmt = db.prepare(`
         INSERT INTO password_history (id, user_id, password_hash, created_at)
@@ -9168,9 +9170,9 @@ function parseFieldValue(field, formData, options = {}) {
   const { skipValidation = false } = options;
   const value = formData.get(field.field_name);
   const errors = [];
-  const blocksConfig = chunkEKPLKUZT_cjs.getBlocksFieldConfig(field.field_options);
+  const blocksConfig = chunkE2GKK5HX_cjs.getBlocksFieldConfig(field.field_options);
   if (blocksConfig) {
-    const parsed = chunkEKPLKUZT_cjs.parseBlocksValue(value, blocksConfig);
+    const parsed = chunkE2GKK5HX_cjs.parseBlocksValue(value, blocksConfig);
     if (!skipValidation && field.is_required && parsed.value.length === 0) {
       parsed.errors.push(`${field.field_label} is required`);
     }
@@ -9280,9 +9282,9 @@ function extractFieldData(fields, formData, options = {}) {
   }
   return { data, errors };
 }
-adminContentRoutes.use("*", chunkIT2TC4ZD_cjs.requireAuth());
+adminContentRoutes.use("*", chunk5GO3AMON_cjs.requireAuth());
 async function getCollectionFields(db, collectionId) {
-  const cache = chunk64APW3DW_cjs.getCacheService(chunk64APW3DW_cjs.CACHE_CONFIGS.collection);
+  const cache = chunkLFAQUR7P_cjs.getCacheService(chunkLFAQUR7P_cjs.CACHE_CONFIGS.collection);
   return cache.getOrSet(
     cache.generateKey("fields", collectionId),
     async () => {
@@ -9331,7 +9333,7 @@ async function getCollectionFields(db, collectionId) {
   );
 }
 async function getCollection(db, collectionId) {
-  const cache = chunk64APW3DW_cjs.getCacheService(chunk64APW3DW_cjs.CACHE_CONFIGS.collection);
+  const cache = chunkLFAQUR7P_cjs.getCacheService(chunkLFAQUR7P_cjs.CACHE_CONFIGS.collection);
   return cache.getOrSet(
     cache.generateKey("collection", collectionId),
     async () => {
@@ -9359,7 +9361,7 @@ adminContentRoutes.get("/", async (c) => {
     const status = url.searchParams.get("status") || "all";
     const search = url.searchParams.get("search") || "";
     const offset = (page - 1) * limit;
-    const collectionsStmt = db.prepare("SELECT id, name, display_name FROM collections WHERE is_active = 1 ORDER BY display_name");
+    const collectionsStmt = db.prepare("SELECT id, name, display_name FROM collections WHERE is_active = 1 AND (source_type IS NULL OR source_type = 'user') ORDER BY display_name");
     const { results: collectionsResults } = await collectionsStmt.all();
     const models = (collectionsResults || []).map((row) => ({
       name: row.name,
@@ -9367,6 +9369,7 @@ adminContentRoutes.get("/", async (c) => {
     }));
     const conditions = [];
     const params = [];
+    conditions.push("(col.source_type IS NULL OR col.source_type = 'user')");
     if (status !== "deleted") {
       conditions.push("c.status != 'deleted'");
     }
@@ -9495,7 +9498,7 @@ adminContentRoutes.get("/new", async (c) => {
     const collectionId = url.searchParams.get("collection");
     if (!collectionId) {
       const db2 = c.env.DB;
-      const collectionsStmt = db2.prepare("SELECT id, name, display_name, description FROM collections WHERE is_active = 1 ORDER BY display_name");
+      const collectionsStmt = db2.prepare("SELECT id, name, display_name, description FROM collections WHERE is_active = 1 AND (source_type IS NULL OR source_type = 'user') ORDER BY display_name");
       const { results } = await collectionsStmt.all();
       const collections = (results || []).map((row) => ({
         id: row.id,
@@ -9556,21 +9559,21 @@ adminContentRoutes.get("/new", async (c) => {
     const tinymceEnabled = await isPluginActive2(db, "tinymce-plugin");
     let tinymceSettings;
     if (tinymceEnabled) {
-      const pluginService = new chunkIIBRG5S5_cjs.PluginService(db);
+      const pluginService = new chunkTWCQVJ6M_cjs.PluginService(db);
       const tinymcePlugin2 = await pluginService.getPlugin("tinymce-plugin");
       tinymceSettings = tinymcePlugin2?.settings;
     }
     const quillEnabled = await isPluginActive2(db, "quill-editor");
     let quillSettings;
     if (quillEnabled) {
-      const pluginService = new chunkIIBRG5S5_cjs.PluginService(db);
+      const pluginService = new chunkTWCQVJ6M_cjs.PluginService(db);
       const quillPlugin = await pluginService.getPlugin("quill-editor");
       quillSettings = quillPlugin?.settings;
     }
     const mdxeditorEnabled = await isPluginActive2(db, "easy-mdx");
     let mdxeditorSettings;
     if (mdxeditorEnabled) {
-      const pluginService = new chunkIIBRG5S5_cjs.PluginService(db);
+      const pluginService = new chunkTWCQVJ6M_cjs.PluginService(db);
       const mdxeditorPlugin = await pluginService.getPlugin("easy-mdx");
       mdxeditorSettings = mdxeditorPlugin?.settings;
     }
@@ -9620,7 +9623,7 @@ adminContentRoutes.get("/:id/edit", async (c) => {
     const db = c.env.DB;
     const url = new URL(c.req.url);
     const referrerParams = url.searchParams.get("ref") || "";
-    const cache = chunk64APW3DW_cjs.getCacheService(chunk64APW3DW_cjs.CACHE_CONFIGS.content);
+    const cache = chunkLFAQUR7P_cjs.getCacheService(chunkLFAQUR7P_cjs.CACHE_CONFIGS.content);
     const content = await cache.getOrSet(
       cache.generateKey("content", id),
       async () => {
@@ -9661,21 +9664,21 @@ adminContentRoutes.get("/:id/edit", async (c) => {
     const tinymceEnabled = await isPluginActive2(db, "tinymce-plugin");
     let tinymceSettings;
     if (tinymceEnabled) {
-      const pluginService = new chunkIIBRG5S5_cjs.PluginService(db);
+      const pluginService = new chunkTWCQVJ6M_cjs.PluginService(db);
       const tinymcePlugin2 = await pluginService.getPlugin("tinymce-plugin");
       tinymceSettings = tinymcePlugin2?.settings;
     }
     const quillEnabled = await isPluginActive2(db, "quill-editor");
     let quillSettings;
     if (quillEnabled) {
-      const pluginService = new chunkIIBRG5S5_cjs.PluginService(db);
+      const pluginService = new chunkTWCQVJ6M_cjs.PluginService(db);
       const quillPlugin = await pluginService.getPlugin("quill-editor");
       quillSettings = quillPlugin?.settings;
     }
     const mdxeditorEnabled = await isPluginActive2(db, "easy-mdx");
     let mdxeditorSettings;
     if (mdxeditorEnabled) {
-      const pluginService = new chunkIIBRG5S5_cjs.PluginService(db);
+      const pluginService = new chunkTWCQVJ6M_cjs.PluginService(db);
       const mdxeditorPlugin = await pluginService.getPlugin("easy-mdx");
       mdxeditorSettings = mdxeditorPlugin?.settings;
     }
@@ -9796,7 +9799,7 @@ adminContentRoutes.post("/", async (c) => {
       now,
       now
     ).run();
-    const cache = chunk64APW3DW_cjs.getCacheService(chunk64APW3DW_cjs.CACHE_CONFIGS.content);
+    const cache = chunkLFAQUR7P_cjs.getCacheService(chunkLFAQUR7P_cjs.CACHE_CONFIGS.content);
     await cache.invalidate(`content:list:${collectionId}:*`);
     const versionStmt = db.prepare(`
       INSERT INTO content_versions (id, content_id, version, data, author_id, created_at)
@@ -9915,7 +9918,7 @@ adminContentRoutes.put("/:id", async (c) => {
       now,
       id
     ).run();
-    const cache = chunk64APW3DW_cjs.getCacheService(chunk64APW3DW_cjs.CACHE_CONFIGS.content);
+    const cache = chunkLFAQUR7P_cjs.getCacheService(chunkLFAQUR7P_cjs.CACHE_CONFIGS.content);
     await cache.delete(cache.generateKey("content", id));
     await cache.invalidate(`content:list:${existingContent.collection_id}:*`);
     const existingData = JSON.parse(existingContent.data || "{}");
@@ -9970,7 +9973,7 @@ adminContentRoutes.put("/:id", async (c) => {
     `);
   }
 });
-adminContentRoutes.post("/preview", chunkIT2TC4ZD_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
+adminContentRoutes.post("/preview", chunk5GO3AMON_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
   try {
     const formData = await c.req.formData();
     const collectionId = formData.get("collection_id");
@@ -10192,7 +10195,7 @@ adminContentRoutes.post("/bulk-action", async (c) => {
     } else {
       return c.json({ success: false, error: "Invalid action" });
     }
-    const cache = chunk64APW3DW_cjs.getCacheService(chunk64APW3DW_cjs.CACHE_CONFIGS.content);
+    const cache = chunkLFAQUR7P_cjs.getCacheService(chunkLFAQUR7P_cjs.CACHE_CONFIGS.content);
     for (const contentId of ids) {
       await cache.delete(cache.generateKey("content", contentId));
     }
@@ -10220,7 +10223,7 @@ adminContentRoutes.delete("/:id", async (c) => {
       WHERE id = ?
     `);
     await deleteStmt.bind(now, id).run();
-    const cache = chunk64APW3DW_cjs.getCacheService(chunk64APW3DW_cjs.CACHE_CONFIGS.content);
+    const cache = chunkLFAQUR7P_cjs.getCacheService(chunkLFAQUR7P_cjs.CACHE_CONFIGS.content);
     await cache.delete(cache.generateKey("content", id));
     await cache.invalidate("content:list:*");
     return c.html(`
@@ -10348,7 +10351,7 @@ adminContentRoutes.post("/:id/restore/:version", async (c) => {
     return c.json({ success: false, error: "Failed to restore version" });
   }
 });
-adminContentRoutes.get("/:id/version/:version/preview", chunkIT2TC4ZD_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
+adminContentRoutes.get("/:id/version/:version/preview", chunk5GO3AMON_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
   try {
     const id = c.req.param("id");
     const version = parseInt(c.req.param("version") || "0");
@@ -12315,14 +12318,14 @@ function renderUsersListPage(data) {
 
 // src/routes/admin-users.ts
 var userRoutes = new hono.Hono();
-userRoutes.use("*", chunkIT2TC4ZD_cjs.requireAuth());
-userRoutes.use("/users/*", chunkIT2TC4ZD_cjs.requireRole(["admin"]));
-userRoutes.use("/users", chunkIT2TC4ZD_cjs.requireRole(["admin"]));
-userRoutes.use("/invite-user", chunkIT2TC4ZD_cjs.requireRole(["admin"]));
-userRoutes.use("/resend-invitation/*", chunkIT2TC4ZD_cjs.requireRole(["admin"]));
-userRoutes.use("/cancel-invitation/*", chunkIT2TC4ZD_cjs.requireRole(["admin"]));
-userRoutes.use("/activity-logs", chunkIT2TC4ZD_cjs.requireRole(["admin"]));
-userRoutes.use("/activity-logs/*", chunkIT2TC4ZD_cjs.requireRole(["admin"]));
+userRoutes.use("*", chunk5GO3AMON_cjs.requireAuth());
+userRoutes.use("/users/*", chunk5GO3AMON_cjs.requireRole(["admin"]));
+userRoutes.use("/users", chunk5GO3AMON_cjs.requireRole(["admin"]));
+userRoutes.use("/invite-user", chunk5GO3AMON_cjs.requireRole(["admin"]));
+userRoutes.use("/resend-invitation/*", chunk5GO3AMON_cjs.requireRole(["admin"]));
+userRoutes.use("/cancel-invitation/*", chunk5GO3AMON_cjs.requireRole(["admin"]));
+userRoutes.use("/activity-logs", chunk5GO3AMON_cjs.requireRole(["admin"]));
+userRoutes.use("/activity-logs/*", chunk5GO3AMON_cjs.requireRole(["admin"]));
 userRoutes.get("/", (c) => {
   return c.redirect("/admin/dashboard");
 });
@@ -12477,7 +12480,7 @@ userRoutes.put("/profile", async (c) => {
       Date.now(),
       user.userId
     ).run();
-    await chunkIT2TC4ZD_cjs.logActivity(
+    await chunk5GO3AMON_cjs.logActivity(
       db,
       user.userId,
       "profile.update",
@@ -12540,7 +12543,7 @@ userRoutes.post("/profile/avatar", async (c) => {
       SELECT first_name, last_name FROM users WHERE id = ?
     `);
     const userData = await userStmt.bind(user.userId).first();
-    await chunkIT2TC4ZD_cjs.logActivity(
+    await chunk5GO3AMON_cjs.logActivity(
       db,
       user.userId,
       "profile.avatar_update",
@@ -12611,7 +12614,7 @@ userRoutes.post("/profile/password", async (c) => {
         dismissible: true
       }));
     }
-    const validPassword = await chunkIT2TC4ZD_cjs.AuthManager.verifyPassword(currentPassword, userData.password_hash);
+    const validPassword = await chunk5GO3AMON_cjs.AuthManager.verifyPassword(currentPassword, userData.password_hash);
     if (!validPassword) {
       return c.html(renderAlert2({
         type: "error",
@@ -12619,7 +12622,7 @@ userRoutes.post("/profile/password", async (c) => {
         dismissible: true
       }));
     }
-    const newPasswordHash = await chunkIT2TC4ZD_cjs.AuthManager.hashPassword(newPassword);
+    const newPasswordHash = await chunk5GO3AMON_cjs.AuthManager.hashPassword(newPassword);
     const historyStmt = db.prepare(`
       INSERT INTO password_history (id, user_id, password_hash, created_at)
       VALUES (?, ?, ?, ?)
@@ -12635,7 +12638,7 @@ userRoutes.post("/profile/password", async (c) => {
       WHERE id = ?
     `);
     await updateStmt.bind(newPasswordHash, Date.now(), user.userId).run();
-    await chunkIT2TC4ZD_cjs.logActivity(
+    await chunk5GO3AMON_cjs.logActivity(
       db,
       user.userId,
       "profile.password_change",
@@ -12702,7 +12705,7 @@ userRoutes.get("/users", async (c) => {
     `);
     const countResult = await countStmt.bind(...params).first();
     const totalUsers = countResult?.total || 0;
-    await chunkIT2TC4ZD_cjs.logActivity(
+    await chunk5GO3AMON_cjs.logActivity(
       db,
       user.userId,
       "users.list_view",
@@ -12858,7 +12861,7 @@ userRoutes.post("/users/new", async (c) => {
         dismissible: true
       }));
     }
-    const passwordHash = await chunkIT2TC4ZD_cjs.AuthManager.hashPassword(password);
+    const passwordHash = await chunk5GO3AMON_cjs.AuthManager.hashPassword(password);
     const userId = crypto.randomUUID();
     const createStmt = db.prepare(`
       INSERT INTO users (
@@ -12881,7 +12884,7 @@ userRoutes.post("/users/new", async (c) => {
       Date.now(),
       Date.now()
     ).run();
-    await chunkIT2TC4ZD_cjs.logActivity(
+    await chunk5GO3AMON_cjs.logActivity(
       db,
       user.userId,
       "user!.create",
@@ -12919,7 +12922,7 @@ userRoutes.get("/users/:id", async (c) => {
     if (!userRecord) {
       return c.json({ error: "User not found" }, 404);
     }
-    await chunkIT2TC4ZD_cjs.logActivity(
+    await chunk5GO3AMON_cjs.logActivity(
       db,
       user.userId,
       "user!.view",
@@ -13146,7 +13149,7 @@ userRoutes.put("/users/:id", async (c) => {
         ).run();
       }
     }
-    await chunkIT2TC4ZD_cjs.logActivity(
+    await chunk5GO3AMON_cjs.logActivity(
       db,
       user.userId,
       "user.update",
@@ -13191,7 +13194,7 @@ userRoutes.post("/users/:id/toggle", async (c) => {
       UPDATE users SET is_active = ?, updated_at = ? WHERE id = ?
     `);
     await toggleStmt.bind(active ? 1 : 0, Date.now(), userId).run();
-    await chunkIT2TC4ZD_cjs.logActivity(
+    await chunk5GO3AMON_cjs.logActivity(
       db,
       user.userId,
       active ? "user.activate" : "user.deactivate",
@@ -13232,7 +13235,7 @@ userRoutes.delete("/users/:id", async (c) => {
         DELETE FROM users WHERE id = ?
       `);
       await deleteStmt.bind(userId).run();
-      await chunkIT2TC4ZD_cjs.logActivity(
+      await chunk5GO3AMON_cjs.logActivity(
         db,
         user.userId,
         "user!.hard_delete",
@@ -13251,7 +13254,7 @@ userRoutes.delete("/users/:id", async (c) => {
         UPDATE users SET is_active = 0, updated_at = ? WHERE id = ?
       `);
       await deleteStmt.bind(Date.now(), userId).run();
-      await chunkIT2TC4ZD_cjs.logActivity(
+      await chunk5GO3AMON_cjs.logActivity(
         db,
         user.userId,
         "user!.soft_delete",
@@ -13317,7 +13320,7 @@ userRoutes.post("/invite-user", async (c) => {
       Date.now(),
       Date.now()
     ).run();
-    await chunkIT2TC4ZD_cjs.logActivity(
+    await chunk5GO3AMON_cjs.logActivity(
       db,
       user.userId,
       "user!.invite_sent",
@@ -13374,7 +13377,7 @@ userRoutes.post("/resend-invitation/:id", async (c) => {
       Date.now(),
       userId
     ).run();
-    await chunkIT2TC4ZD_cjs.logActivity(
+    await chunk5GO3AMON_cjs.logActivity(
       db,
       user.userId,
       "user!.invitation_resent",
@@ -13410,7 +13413,7 @@ userRoutes.delete("/cancel-invitation/:id", async (c) => {
     }
     const deleteStmt = db.prepare(`DELETE FROM users WHERE id = ?`);
     await deleteStmt.bind(userId).run();
-    await chunkIT2TC4ZD_cjs.logActivity(
+    await chunk5GO3AMON_cjs.logActivity(
       db,
       user.userId,
       "user!.invitation_cancelled",
@@ -13493,7 +13496,7 @@ userRoutes.get("/activity-logs", async (c) => {
       ...log,
       details: log.details ? JSON.parse(log.details) : null
     }));
-    await chunkIT2TC4ZD_cjs.logActivity(
+    await chunk5GO3AMON_cjs.logActivity(
       db,
       user.userId,
       "activity.logs_viewed",
@@ -13600,7 +13603,7 @@ userRoutes.get("/activity-logs/export", async (c) => {
       csvRows.push(row.join(","));
     }
     const csvContent = csvRows.join("\n");
-    await chunkIT2TC4ZD_cjs.logActivity(
+    await chunk5GO3AMON_cjs.logActivity(
       db,
       user.userId,
       "activity.logs_exported",
@@ -14939,7 +14942,7 @@ var fileValidationSchema2 = zod.z.object({
   // 50MB max
 });
 var adminMediaRoutes = new hono.Hono();
-adminMediaRoutes.use("*", chunkIT2TC4ZD_cjs.requireAuth());
+adminMediaRoutes.use("*", chunk5GO3AMON_cjs.requireAuth());
 adminMediaRoutes.get("/", async (c) => {
   try {
     const user = c.get("user");
@@ -15525,7 +15528,7 @@ adminMediaRoutes.put("/:id", async (c) => {
     `);
   }
 });
-adminMediaRoutes.delete("/cleanup", chunkIT2TC4ZD_cjs.requireRole("admin"), async (c) => {
+adminMediaRoutes.delete("/cleanup", chunk5GO3AMON_cjs.requireRole("admin"), async (c) => {
   try {
     const db = c.env.DB;
     const allMediaStmt = db.prepare("SELECT id, r2_key, filename FROM media WHERE deleted_at IS NULL");
@@ -17748,7 +17751,7 @@ function renderEmailSettingsContent(plugin, settings) {
 
 // src/routes/admin-plugins.ts
 var adminPluginRoutes = new hono.Hono();
-adminPluginRoutes.use("*", chunkIT2TC4ZD_cjs.requireAuth());
+adminPluginRoutes.use("*", chunk5GO3AMON_cjs.requireAuth());
 var AVAILABLE_PLUGINS = [
   {
     id: "third-party-faq",
@@ -17875,7 +17878,7 @@ adminPluginRoutes.get("/", async (c) => {
     if (user?.role !== "admin") {
       return c.text("Access denied", 403);
     }
-    const pluginService = new chunkIIBRG5S5_cjs.PluginService(db);
+    const pluginService = new chunkTWCQVJ6M_cjs.PluginService(db);
     let installedPlugins = [];
     let stats = { total: 0, active: 0, inactive: 0, errors: 0, uninstalled: 0 };
     try {
@@ -17951,7 +17954,7 @@ adminPluginRoutes.get("/:id", async (c) => {
     if (user?.role !== "admin") {
       return c.redirect("/admin/plugins");
     }
-    const pluginService = new chunkIIBRG5S5_cjs.PluginService(db);
+    const pluginService = new chunkTWCQVJ6M_cjs.PluginService(db);
     const plugin = await pluginService.getPlugin(pluginId);
     if (!plugin) {
       return c.text("Plugin not found", 404);
@@ -18035,7 +18038,7 @@ adminPluginRoutes.post("/:id/activate", async (c) => {
     if (user?.role !== "admin") {
       return c.json({ error: "Access denied" }, 403);
     }
-    const pluginService = new chunkIIBRG5S5_cjs.PluginService(db);
+    const pluginService = new chunkTWCQVJ6M_cjs.PluginService(db);
     await pluginService.activatePlugin(pluginId);
     return c.json({ success: true });
   } catch (error) {
@@ -18052,7 +18055,7 @@ adminPluginRoutes.post("/:id/deactivate", async (c) => {
     if (user?.role !== "admin") {
       return c.json({ error: "Access denied" }, 403);
     }
-    const pluginService = new chunkIIBRG5S5_cjs.PluginService(db);
+    const pluginService = new chunkTWCQVJ6M_cjs.PluginService(db);
     await pluginService.deactivatePlugin(pluginId);
     return c.json({ success: true });
   } catch (error) {
@@ -18069,7 +18072,7 @@ adminPluginRoutes.post("/install", async (c) => {
       return c.json({ error: "Access denied" }, 403);
     }
     const body = await c.req.json();
-    const pluginService = new chunkIIBRG5S5_cjs.PluginService(db);
+    const pluginService = new chunkTWCQVJ6M_cjs.PluginService(db);
     if (body.name === "faq-plugin") {
       const faqPlugin = await pluginService.installPlugin({
         id: "third-party-faq",
@@ -18339,7 +18342,7 @@ adminPluginRoutes.post("/:id/uninstall", async (c) => {
     if (user?.role !== "admin") {
       return c.json({ error: "Access denied" }, 403);
     }
-    const pluginService = new chunkIIBRG5S5_cjs.PluginService(db);
+    const pluginService = new chunkTWCQVJ6M_cjs.PluginService(db);
     await pluginService.uninstallPlugin(pluginId);
     return c.json({ success: true });
   } catch (error) {
@@ -18357,7 +18360,7 @@ adminPluginRoutes.post("/:id/settings", async (c) => {
       return c.json({ error: "Access denied" }, 403);
     }
     const settings = await c.req.json();
-    const pluginService = new chunkIIBRG5S5_cjs.PluginService(db);
+    const pluginService = new chunkTWCQVJ6M_cjs.PluginService(db);
     await pluginService.updatePluginSettings(pluginId, settings);
     if (pluginId === "core-auth") {
       try {
@@ -19165,11 +19168,11 @@ function renderLogConfigPage(data) {
 
 // src/routes/admin-logs.ts
 var adminLogsRoutes = new hono.Hono();
-adminLogsRoutes.use("*", chunkIT2TC4ZD_cjs.requireAuth());
+adminLogsRoutes.use("*", chunk5GO3AMON_cjs.requireAuth());
 adminLogsRoutes.get("/", async (c) => {
   try {
     const user = c.get("user");
-    const logger = chunk64APW3DW_cjs.getLogger(c.env.DB);
+    const logger = chunkLFAQUR7P_cjs.getLogger(c.env.DB);
     const query = c.req.query();
     const page = parseInt(query.page || "1");
     const limit = parseInt(query.limit || "50");
@@ -19249,7 +19252,7 @@ adminLogsRoutes.get("/:id", async (c) => {
   try {
     const id = c.req.param("id");
     const user = c.get("user");
-    const logger = chunk64APW3DW_cjs.getLogger(c.env.DB);
+    const logger = chunkLFAQUR7P_cjs.getLogger(c.env.DB);
     const { logs } = await logger.getLogs({
       limit: 1,
       offset: 0,
@@ -19286,7 +19289,7 @@ adminLogsRoutes.get("/:id", async (c) => {
 adminLogsRoutes.get("/config", async (c) => {
   try {
     const user = c.get("user");
-    const logger = chunk64APW3DW_cjs.getLogger(c.env.DB);
+    const logger = chunkLFAQUR7P_cjs.getLogger(c.env.DB);
     const configs = await logger.getAllConfigs();
     const pageData = {
       configs,
@@ -19310,7 +19313,7 @@ adminLogsRoutes.post("/config/:category", async (c) => {
     const level = formData.get("level");
     const retention = parseInt(formData.get("retention"));
     const maxSize = parseInt(formData.get("max_size"));
-    const logger = chunk64APW3DW_cjs.getLogger(c.env.DB);
+    const logger = chunkLFAQUR7P_cjs.getLogger(c.env.DB);
     await logger.updateConfig(category, {
       enabled,
       level,
@@ -19339,7 +19342,7 @@ adminLogsRoutes.get("/export", async (c) => {
     const category = query.category;
     const startDate = query.start_date;
     const endDate = query.end_date;
-    const logger = chunk64APW3DW_cjs.getLogger(c.env.DB);
+    const logger = chunkLFAQUR7P_cjs.getLogger(c.env.DB);
     const filter = {
       limit: 1e4,
       // Export up to 10k logs
@@ -19420,7 +19423,7 @@ adminLogsRoutes.post("/cleanup", async (c) => {
         error: "Unauthorized. Admin access required."
       }, 403);
     }
-    const logger = chunk64APW3DW_cjs.getLogger(c.env.DB);
+    const logger = chunkLFAQUR7P_cjs.getLogger(c.env.DB);
     await logger.cleanupByRetention();
     return c.html(html.html`
       <div class="bg-green-100 border border-green-400 text-green-700 px-4 py-3 rounded">
@@ -19442,7 +19445,7 @@ adminLogsRoutes.post("/search", async (c) => {
     const search = formData.get("search");
     const level = formData.get("level");
     const category = formData.get("category");
-    const logger = chunk64APW3DW_cjs.getLogger(c.env.DB);
+    const logger = chunkLFAQUR7P_cjs.getLogger(c.env.DB);
     const filter = {
       limit: 20,
       offset: 0,
@@ -21493,9 +21496,9 @@ function renderStorageUsage(databaseSizeBytes, mediaSizeBytes) {
 }
 
 // src/routes/admin-dashboard.ts
-var VERSION = chunkEKPLKUZT_cjs.getCoreVersion();
+var VERSION = chunkE2GKK5HX_cjs.getCoreVersion();
 var router = new hono.Hono();
-router.use("*", chunkIT2TC4ZD_cjs.requireAuth());
+router.use("*", chunk5GO3AMON_cjs.requireAuth());
 router.get("/", async (c) => {
   const user = c.get("user");
   try {
@@ -21526,7 +21529,7 @@ router.get("/stats", async (c) => {
     const db = c.env.DB;
     let collectionsCount = 0;
     try {
-      const collectionsStmt = db.prepare("SELECT COUNT(*) as count FROM collections WHERE is_active = 1");
+      const collectionsStmt = db.prepare("SELECT COUNT(*) as count FROM collections WHERE is_active = 1 AND (source_type IS NULL OR source_type = 'user')");
       const collectionsResult = await collectionsStmt.first();
       collectionsCount = collectionsResult?.count || 0;
     } catch (error) {
@@ -21534,7 +21537,7 @@ router.get("/stats", async (c) => {
     }
     let contentCount = 0;
     try {
-      const contentStmt = db.prepare("SELECT COUNT(*) as count FROM content");
+      const contentStmt = db.prepare("SELECT COUNT(*) as count FROM content c JOIN collections col ON c.collection_id = col.id WHERE (col.source_type IS NULL OR col.source_type = 'user')");
       const contentResult = await contentStmt.first();
       contentCount = contentResult?.count || 0;
     } catch (error) {
@@ -23314,10 +23317,10 @@ function renderCollectionFormPage(data) {
 
 // src/routes/admin-collections.ts
 var adminCollectionsRoutes = new hono.Hono();
-adminCollectionsRoutes.use("*", chunkIT2TC4ZD_cjs.requireAuth());
-adminCollectionsRoutes.post("*", chunkIT2TC4ZD_cjs.requireRole(["admin"]));
-adminCollectionsRoutes.put("*", chunkIT2TC4ZD_cjs.requireRole(["admin"]));
-adminCollectionsRoutes.delete("*", chunkIT2TC4ZD_cjs.requireRole(["admin"]));
+adminCollectionsRoutes.use("*", chunk5GO3AMON_cjs.requireAuth());
+adminCollectionsRoutes.post("*", chunk5GO3AMON_cjs.requireRole(["admin"]));
+adminCollectionsRoutes.put("*", chunk5GO3AMON_cjs.requireRole(["admin"]));
+adminCollectionsRoutes.delete("*", chunk5GO3AMON_cjs.requireRole(["admin"]));
 adminCollectionsRoutes.get("/", async (c) => {
   try {
     const user = c.get("user");
@@ -23331,6 +23334,7 @@ adminCollectionsRoutes.get("/", async (c) => {
         SELECT id, name, display_name, description, created_at, managed, schema
         FROM collections
         WHERE is_active = 1
+        AND (source_type IS NULL OR source_type = 'user')
         AND (name LIKE ? OR display_name LIKE ? OR description LIKE ?)
         ORDER BY created_at DESC
       `);
@@ -23338,7 +23342,7 @@ adminCollectionsRoutes.get("/", async (c) => {
       const queryResults = await stmt.bind(searchParam, searchParam, searchParam).all();
       results = queryResults.results;
     } else {
-      stmt = db.prepare("SELECT id, name, display_name, description, created_at, managed, schema FROM collections WHERE is_active = 1 ORDER BY created_at DESC");
+      stmt = db.prepare("SELECT id, name, display_name, description, created_at, managed, schema FROM collections WHERE is_active = 1 AND (source_type IS NULL OR source_type = 'user') ORDER BY created_at DESC");
       const queryResults = await stmt.all();
       results = queryResults.results;
     }
@@ -25512,7 +25516,7 @@ function renderDatabaseToolsSettings(settings) {
 
 // src/routes/admin-settings.ts
 var adminSettingsRoutes = new hono.Hono();
-adminSettingsRoutes.use("*", chunkIT2TC4ZD_cjs.requireAuth());
+adminSettingsRoutes.use("*", chunk5GO3AMON_cjs.requireAuth());
 function getMockSettings(user) {
   return {
     general: {
@@ -25577,7 +25581,7 @@ adminSettingsRoutes.get("/", (c) => {
 adminSettingsRoutes.get("/general", async (c) => {
   const user = c.get("user");
   const db = c.env.DB;
-  const settingsService = new chunk64APW3DW_cjs.SettingsService(db);
+  const settingsService = new chunkLFAQUR7P_cjs.SettingsService(db);
   const generalSettings = await settingsService.getGeneralSettings(user?.email);
   const mockSettings = getMockSettings(user);
   mockSettings.general = generalSettings;
@@ -25680,7 +25684,7 @@ adminSettingsRoutes.get("/database-tools", (c) => {
 adminSettingsRoutes.get("/api/migrations/status", async (c) => {
   try {
     const db = c.env.DB;
-    const migrationService = new chunkZMVWMJ3S_cjs.MigrationService(db);
+    const migrationService = new chunkEAJJHE5F_cjs.MigrationService(db);
     const status = await migrationService.getMigrationStatus();
     return c.json({
       success: true,
@@ -25704,7 +25708,7 @@ adminSettingsRoutes.post("/api/migrations/run", async (c) => {
       }, 403);
     }
     const db = c.env.DB;
-    const migrationService = new chunkZMVWMJ3S_cjs.MigrationService(db);
+    const migrationService = new chunkEAJJHE5F_cjs.MigrationService(db);
     const result = await migrationService.runPendingMigrations();
     return c.json({
       success: result.success,
@@ -25722,7 +25726,7 @@ adminSettingsRoutes.post("/api/migrations/run", async (c) => {
 adminSettingsRoutes.get("/api/migrations/validate", async (c) => {
   try {
     const db = c.env.DB;
-    const migrationService = new chunkZMVWMJ3S_cjs.MigrationService(db);
+    const migrationService = new chunkEAJJHE5F_cjs.MigrationService(db);
     const validation = await migrationService.validateSchema();
     return c.json({
       success: true,
@@ -25891,7 +25895,7 @@ adminSettingsRoutes.post("/general", async (c) => {
     }
     const formData = await c.req.formData();
     const db = c.env.DB;
-    const settingsService = new chunk64APW3DW_cjs.SettingsService(db);
+    const settingsService = new chunkLFAQUR7P_cjs.SettingsService(db);
     const settings = {
       siteName: formData.get("siteName"),
       siteDescription: formData.get("siteDescription"),
@@ -27612,7 +27616,7 @@ function renderFormCreatePage(data) {
 
 // src/routes/admin-forms.ts
 var adminFormsRoutes = new hono.Hono();
-adminFormsRoutes.use("*", chunkIT2TC4ZD_cjs.requireAuth());
+adminFormsRoutes.use("*", chunk5GO3AMON_cjs.requireAuth());
 adminFormsRoutes.get("/", async (c) => {
   try {
     const user = c.get("user");
@@ -28410,14 +28414,36 @@ publicFormsRoutes.post("/:identifier/submit", async (c) => {
       now
     ).run();
     await db.prepare(`
-      UPDATE forms 
+      UPDATE forms
       SET submission_count = submission_count + 1,
           updated_at = ?
       WHERE id = ?
     `).bind(now, form.id).run();
+    let contentId = null;
+    try {
+      contentId = await chunkTWCQVJ6M_cjs.createContentFromSubmission(
+        db,
+        sanitizedData,
+        { id: form.id, name: form.name, display_name: form.display_name },
+        submissionId,
+        {
+          ipAddress: c.req.header("cf-connecting-ip") || null,
+          userAgent: c.req.header("user-agent") || null,
+          userEmail: sanitizedData?.email || null,
+          userId: null
+          // anonymous submission
+        }
+      );
+      if (!contentId) {
+        console.warn("[FormSubmit] Content creation returned null for submission:", submissionId);
+      }
+    } catch (contentError) {
+      console.error("[FormSubmit] Error creating content from submission:", contentError);
+    }
     return c.json({
       success: true,
       submissionId,
+      contentId,
       message: "Form submitted successfully"
     });
   } catch (error) {
@@ -28569,7 +28595,7 @@ function renderAPIReferencePage(data) {
                 >
                   <option value="">All Categories</option>
                   ${categories.map((category) => {
-    const info = chunk64APW3DW_cjs.CATEGORY_INFO[category];
+    const info = chunkLFAQUR7P_cjs.CATEGORY_INFO[category];
     const title = info ? info.title : category;
     return `<option value="${category}">${title}</option>`;
   }).join("\n                  ")}
@@ -28586,7 +28612,7 @@ function renderAPIReferencePage(data) {
       <!-- API Categories -->
       <div class="space-y-6">
         ${Object.entries(endpointsByCategory).map(([category, endpoints]) => {
-    const info = chunk64APW3DW_cjs.CATEGORY_INFO[category] || { title: category, description: "", icon: "&#x1f4cb;" };
+    const info = chunkLFAQUR7P_cjs.CATEGORY_INFO[category] || { title: category, description: "", icon: "&#x1f4cb;" };
     return `
             <div class="api-category" data-category="${category}">
               <div class="rounded-lg bg-white dark:bg-zinc-900 shadow-sm ring-1 ring-zinc-950/5 dark:ring-white/10 overflow-hidden">
@@ -28763,14 +28789,14 @@ function renderAPIReferencePage(data) {
 }
 
 // src/routes/admin-api-reference.ts
-var VERSION2 = chunkEKPLKUZT_cjs.getCoreVersion();
+var VERSION2 = chunkE2GKK5HX_cjs.getCoreVersion();
 var router2 = new hono.Hono();
-router2.use("*", chunkIT2TC4ZD_cjs.requireAuth());
+router2.use("*", chunk5GO3AMON_cjs.requireAuth());
 router2.get("/", async (c) => {
   const user = c.get("user");
   try {
-    const app2 = chunk64APW3DW_cjs.getAppInstance();
-    const endpoints = chunk64APW3DW_cjs.buildRouteList(app2);
+    const app2 = chunkLFAQUR7P_cjs.getAppInstance();
+    const endpoints = chunkLFAQUR7P_cjs.buildRouteList(app2);
     const pageData = {
       endpoints,
       user: user ? {
@@ -28852,5 +28878,5 @@ exports.router = router;
 exports.router2 = router2;
 exports.test_cleanup_default = test_cleanup_default;
 exports.userRoutes = userRoutes;
-//# sourceMappingURL=chunk-RCA6R6VE.cjs.map
-//# sourceMappingURL=chunk-RCA6R6VE.cjs.map
+//# sourceMappingURL=chunk-HGKBMUYY.cjs.map
+//# sourceMappingURL=chunk-HGKBMUYY.cjs.map