@sonicjs-cms/core 2.19.0 → 3.0.0-beta.2

package/dist/app-Do66yCcV.d.cts

@@ -0,0 +1,1268 @@
+import * as better_auth_client from 'better-auth/client';
+import * as better_auth_plugins_email_otp from 'better-auth/plugins/email-otp';
+import * as better_auth from 'better-auth';
+import * as better_auth_plugins_magic_link from 'better-auth/plugins/magic-link';
+import * as better_call from 'better-call';
+import * as zod_v4_core from 'zod/v4/core';
+import * as zod from 'zod';
+import { z } from 'zod';
+import { i as HookSystemLike, E as EmailProvider } from './types-Dea1eNxU.cjs';
+import { Hono, MiddlewareHandler, Context } from 'hono';
+import { D1Database, KVNamespace, R2Bucket } from '@cloudflare/workers-types';
+
+/**
+ * Build the default Better Auth options used by SonicJS (through the CF shim).
+ * Exported so apps can extend via config.auth.extendBetterAuth.
+ */
+declare function getDefaultAuthOptions(env: Bindings, requestBaseURL?: string): {
+    plugins: ({
+        id: "magic-link";
+        version: string;
+        endpoints: {
+            signInMagicLink: better_call.StrictEndpoint<"/sign-in/magic-link", {
+                method: "POST";
+                requireHeaders: true;
+                body: zod.ZodObject<{
+                    email: zod.ZodEmail;
+                    name: zod.ZodOptional<zod.ZodString>;
+                    callbackURL: zod.ZodOptional<zod.ZodString>;
+                    newUserCallbackURL: zod.ZodOptional<zod.ZodString>;
+                    errorCallbackURL: zod.ZodOptional<zod.ZodString>;
+                    metadata: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodAny>>;
+                }, zod_v4_core.$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                status: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                status: boolean;
+            }>;
+            magicLinkVerify: better_call.StrictEndpoint<"/magic-link/verify", {
+                method: "GET";
+                query: zod.ZodObject<{
+                    token: zod.ZodString;
+                    callbackURL: zod.ZodOptional<zod.ZodString>;
+                    errorCallbackURL: zod.ZodOptional<zod.ZodString>;
+                    newUserCallbackURL: zod.ZodOptional<zod.ZodString>;
+                }, zod_v4_core.$strip>;
+                use: ((inputContext: better_call.MiddlewareInputContext<better_call.MiddlewareOptions>) => Promise<void>)[];
+                requireHeaders: true;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                session: {
+                                                    $ref: string;
+                                                };
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                token: string;
+                user: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                };
+                session: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                };
+            }>;
+        };
+        rateLimit: {
+            pathMatcher(path: string): boolean;
+            window: number;
+            max: number;
+        }[];
+        options: better_auth_plugins_magic_link.MagicLinkOptions;
+    } | {
+        id: "email-otp";
+        version: string;
+        init(ctx: better_auth.AuthContext): {
+            options: {
+                emailVerification: {
+                    sendVerificationEmail(data: {
+                        user: better_auth.User;
+                        url: string;
+                        token: string;
+                    }, request: Request | undefined): Promise<void>;
+                };
+            };
+        } | undefined;
+        endpoints: {
+            sendVerificationOTP: better_call.StrictEndpoint<"/email-otp/send-verification-otp", {
+                method: "POST";
+                body: zod.ZodObject<{
+                    email: zod.ZodString;
+                    type: zod.ZodEnum<{
+                        "sign-in": "sign-in";
+                        "change-email": "change-email";
+                        "email-verification": "email-verification";
+                        "forget-password": "forget-password";
+                    }>;
+                }, zod_v4_core.$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                success: boolean;
+            }>;
+            createVerificationOTP: better_call.StrictEndpoint<string, {
+                method: "POST";
+                body: zod.ZodObject<{
+                    email: zod.ZodString;
+                    type: zod.ZodEnum<{
+                        "sign-in": "sign-in";
+                        "change-email": "change-email";
+                        "email-verification": "email-verification";
+                        "forget-password": "forget-password";
+                    }>;
+                }, zod_v4_core.$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "string";
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, string>;
+            getVerificationOTP: better_call.StrictEndpoint<string, {
+                method: "GET";
+                query: zod.ZodObject<{
+                    email: zod.ZodString;
+                    type: zod.ZodEnum<{
+                        "sign-in": "sign-in";
+                        "change-email": "change-email";
+                        "email-verification": "email-verification";
+                        "forget-password": "forget-password";
+                    }>;
+                }, zod_v4_core.$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            "200": {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                otp: {
+                                                    type: string;
+                                                    nullable: boolean;
+                                                    description: string;
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                otp: null;
+            } | {
+                otp: string;
+            }>;
+            checkVerificationOTP: better_call.StrictEndpoint<"/email-otp/check-verification-otp", {
+                method: "POST";
+                body: zod.ZodObject<{
+                    email: zod.ZodString;
+                    type: zod.ZodEnum<{
+                        "sign-in": "sign-in";
+                        "change-email": "change-email";
+                        "email-verification": "email-verification";
+                        "forget-password": "forget-password";
+                    }>;
+                    otp: zod.ZodString;
+                }, zod_v4_core.$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                success: boolean;
+            }>;
+            verifyEmailOTP: better_call.StrictEndpoint<"/email-otp/verify-email", {
+                method: "POST";
+                body: zod.ZodObject<{
+                    email: zod.ZodString;
+                    otp: zod.ZodString;
+                }, zod_v4_core.$strip>;
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                status: {
+                                                    type: string;
+                                                    description: string;
+                                                    enum: boolean[];
+                                                };
+                                                token: {
+                                                    type: string;
+                                                    nullable: boolean;
+                                                    description: string;
+                                                };
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                status: boolean;
+                token: string;
+                user: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                } & Record<string, any>;
+            } | {
+                status: boolean;
+                token: null;
+                user: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                } & Record<string, any>;
+            }>;
+            signInEmailOTP: better_call.StrictEndpoint<"/sign-in/email-otp", {
+                method: "POST";
+                body: zod.ZodIntersection<zod.ZodObject<{
+                    email: zod.ZodString;
+                    otp: zod.ZodString;
+                    name: zod.ZodOptional<zod.ZodString>;
+                    image: zod.ZodOptional<zod.ZodString>;
+                }, zod_v4_core.$strip>, zod.ZodRecord<zod.ZodString, zod.ZodAny>>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                token: {
+                                                    type: string;
+                                                    description: string;
+                                                };
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                token: string;
+                user: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                };
+            }>;
+            requestPasswordResetEmailOTP: better_call.StrictEndpoint<"/email-otp/request-password-reset", {
+                method: "POST";
+                body: zod.ZodObject<{
+                    email: zod.ZodString;
+                }, zod_v4_core.$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                    description: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                success: boolean;
+            }>;
+            forgetPasswordEmailOTP: better_call.StrictEndpoint<"/forget-password/email-otp", {
+                method: "POST";
+                body: zod.ZodObject<{
+                    email: zod.ZodString;
+                }, zod_v4_core.$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                    description: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                success: boolean;
+            }>;
+            resetPasswordEmailOTP: better_call.StrictEndpoint<"/email-otp/reset-password", {
+                method: "POST";
+                body: zod.ZodObject<{
+                    email: zod.ZodString;
+                    otp: zod.ZodString;
+                    password: zod.ZodString;
+                }, zod_v4_core.$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                success: boolean;
+            }>;
+            requestEmailChangeEmailOTP: better_call.StrictEndpoint<"/email-otp/request-email-change", {
+                method: "POST";
+                body: zod.ZodObject<{
+                    newEmail: zod.ZodString;
+                    otp: zod.ZodOptional<zod.ZodString>;
+                }, zod_v4_core.$strip>;
+                use: ((inputContext: better_call.MiddlewareInputContext<better_call.MiddlewareOptions>) => Promise<{
+                    session: {
+                        session: Record<string, any> & {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                        user: Record<string, any> & {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            email: string;
+                            emailVerified: boolean;
+                            name: string;
+                            image?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                success: boolean;
+            }>;
+            changeEmailEmailOTP: better_call.StrictEndpoint<"/email-otp/change-email", {
+                method: "POST";
+                body: zod.ZodObject<{
+                    newEmail: zod.ZodString;
+                    otp: zod.ZodString;
+                }, zod_v4_core.$strip>;
+                use: ((inputContext: better_call.MiddlewareInputContext<better_call.MiddlewareOptions>) => Promise<{
+                    session: {
+                        session: Record<string, any> & {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                        user: Record<string, any> & {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            email: string;
+                            emailVerified: boolean;
+                            name: string;
+                            image?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                success: boolean;
+            }>;
+        };
+        hooks: {
+            after: {
+                matcher(context: better_auth.HookEndpointContext): boolean;
+                handler: (inputContext: better_call.MiddlewareInputContext<better_call.MiddlewareOptions>) => Promise<void>;
+            }[];
+        };
+        rateLimit: ({
+            pathMatcher(path: string): path is "/email-otp/send-verification-otp";
+            window: number;
+            max: number;
+        } | {
+            pathMatcher(path: string): path is "/email-otp/check-verification-otp";
+            window: number;
+            max: number;
+        } | {
+            pathMatcher(path: string): path is "/email-otp/verify-email";
+            window: number;
+            max: number;
+        } | {
+            pathMatcher(path: string): path is "/sign-in/email-otp";
+            window: number;
+            max: number;
+        } | {
+            pathMatcher(path: string): path is "/email-otp/request-password-reset";
+            window: number;
+            max: number;
+        } | {
+            pathMatcher(path: string): path is "/email-otp/reset-password";
+            window: number;
+            max: number;
+        } | {
+            pathMatcher(path: string): path is "/forget-password/email-otp";
+            window: number;
+            max: number;
+        } | {
+            pathMatcher(path: string): path is "/email-otp/request-email-change";
+            window: number;
+            max: number;
+        } | {
+            pathMatcher(path: string): path is "/email-otp/change-email";
+            window: number;
+            max: number;
+        })[];
+        options: better_auth_plugins_email_otp.EmailOTPOptions;
+        $ERROR_CODES: {
+            OTP_EXPIRED: better_auth.RawError<"OTP_EXPIRED">;
+            INVALID_OTP: better_auth.RawError<"INVALID_OTP">;
+            TOO_MANY_ATTEMPTS: better_auth.RawError<"TOO_MANY_ATTEMPTS">;
+        };
+    } | better_auth_client.DefaultOrganizationPlugin<{
+        schema: {
+            organization: {
+                modelName: string;
+                additionalFields: {
+                    status: {
+                        type: "string";
+                        required: false;
+                        defaultValue: string;
+                        input: true;
+                    };
+                    domain: {
+                        type: "string";
+                        required: false;
+                        input: true;
+                    };
+                    notes: {
+                        type: "string";
+                        required: false;
+                        defaultValue: string;
+                        input: true;
+                    };
+                };
+            };
+            member: {
+                modelName: string;
+                fields: {
+                    organizationId: string;
+                };
+            };
+            invitation: {
+                modelName: string;
+                fields: {
+                    organizationId: string;
+                };
+            };
+            team: {
+                modelName: string;
+                fields: {
+                    organizationId: string;
+                };
+            };
+        };
+    }>)[];
+    socialProviders: {
+        google?: {
+            clientId: string;
+            clientSecret: string;
+        } | undefined;
+        github?: {
+            clientId: string;
+            clientSecret: string;
+        } | undefined;
+    };
+    user: {
+        modelName: "auth_user";
+        fields: {
+            image: string;
+        };
+        additionalFields: {
+            role: {
+                type: "string";
+                required: false;
+                defaultValue: string;
+                input: false;
+            };
+            firstName: {
+                type: "string";
+                required: false;
+                defaultValue: string;
+                input: true;
+            };
+            lastName: {
+                type: "string";
+                required: false;
+                defaultValue: string;
+                input: true;
+            };
+            isSuperAdmin: {
+                type: "boolean";
+                required: false;
+                defaultValue: false;
+                input: false;
+            };
+        };
+    };
+    session: {
+        modelName: "auth_session";
+        expiresIn: number;
+        updateAge: number;
+    };
+    account: {
+        modelName: "auth_account";
+    };
+    verification: {
+        modelName: "auth_verification";
+    };
+    basePath: string;
+    emailAndPassword: {
+        enabled: true;
+        autoSignIn: true;
+        password: {
+            verify: ({ hash, password }: {
+                hash: string;
+                password: string;
+            }) => Promise<boolean>;
+        };
+    };
+    databaseHooks: {
+        user: {
+            create: {
+                before: (userData: Record<string, unknown>) => Promise<{
+                    data: {
+                        name: string;
+                        firstName: string;
+                        lastName: string;
+                        role: string;
+                    };
+                }>;
+                after: (user: {
+                    id: string;
+                }) => Promise<void>;
+            };
+        };
+    };
+    secret: string | undefined;
+    baseURL: string | undefined;
+    appName: string;
+};
+type BetterAuthDefaultOptions = ReturnType<typeof getDefaultAuthOptions>;
+type ExtendBetterAuth = (opts: BetterAuthDefaultOptions) => BetterAuthDefaultOptions;
+
+/**
+ * SonicJS Plugin System Types
+ *
+ * Defines the core interfaces and types for the plugin system
+ */
+
+interface Plugin {
+    /** Unique plugin identifier */
+    name: string;
+    /** Plugin version (semantic versioning) */
+    version: string;
+    /** Human-readable description */
+    description?: string;
+    /** Plugin author information */
+    author?: {
+        name: string;
+        email?: string;
+        url?: string;
+    };
+    /** Plugin dependencies (other plugins required) */
+    dependencies?: string[];
+    /** SonicJS version compatibility */
+    compatibility?: string;
+    /** Plugin license */
+    license?: string;
+    routes?: PluginRoutes[];
+    /**
+     * Optional imperative route registration, called synchronously at app
+     * construction time. Use this for routes that can't be expressed as a static
+     * `routes[]` entry (e.g. conditional mounting).
+     *
+     * MUST be synchronous: Hono's router locks after the first request, so all
+     * `app.route()` calls have to happen before any request is served. Returning
+     * a Promise throws `PluginRegisterMustBeSyncError`. Async, env-dependent work
+     * belongs in lifecycle hooks (`install`/`activate`), not here.
+     */
+    register?: (app: Hono) => void;
+    middleware?: PluginMiddleware[];
+    models?: PluginModel[];
+    services?: PluginService[];
+    adminPages?: PluginAdminPage[];
+    adminComponents?: PluginComponent[];
+    menuItems?: PluginMenuItem[];
+    hooks?: PluginHook[];
+    install?: (context: PluginContext) => Promise<void>;
+    uninstall?: (context: PluginContext) => Promise<void>;
+    activate?: (context: PluginContext) => Promise<void>;
+    deactivate?: (context: PluginContext) => Promise<void>;
+    configure?: (config: PluginConfig) => Promise<void>;
+}
+interface PluginContext {
+    /** Database instance */
+    db: D1Database;
+    /** Key-value storage */
+    kv: KVNamespace;
+    /** R2 storage bucket */
+    r2?: R2Bucket;
+    /** Plugin configuration */
+    config: PluginConfig;
+    /** Core SonicJS services */
+    services: {
+        auth: AuthService;
+        content: ContentService;
+        media: MediaService;
+    };
+    /** Hook system for inter-plugin communication */
+    hooks: HookSystem | ScopedHookSystem;
+    /** Logging utilities */
+    logger: PluginLogger;
+}
+interface PluginConfig {
+    /** Plugin-specific configuration */
+    [key: string]: any;
+    /** Whether plugin is enabled */
+    enabled: boolean;
+    /** Plugin installation timestamp */
+    installedAt?: number;
+    /** Plugin last update timestamp */
+    updatedAt?: number;
+}
+interface PluginRoutes {
+    /** Route path prefix */
+    path: string;
+    /** Hono route handler */
+    handler: Hono;
+    /** Route description */
+    description?: string;
+    /** Whether route requires authentication */
+    requiresAuth?: boolean;
+    /** Required roles for access */
+    roles?: string[];
+    /** Route priority (for ordering) */
+    priority?: number;
+}
+interface PluginMiddleware {
+    /** Middleware name */
+    name: string;
+    /** Middleware handler function */
+    handler: MiddlewareHandler;
+    /** Middleware description */
+    description?: string;
+    /** Middleware priority (lower = earlier) */
+    priority?: number;
+    /** Routes to apply middleware to */
+    routes?: string[];
+    /** Whether to apply globally */
+    global?: boolean;
+}
+interface PluginModel {
+    /** Model name */
+    name: string;
+    /** Database table name */
+    tableName: string;
+    /** Zod schema for validation */
+    schema: z.ZodSchema;
+    /** Database migrations */
+    migrations: string[];
+    /** Model relationships */
+    relationships?: ModelRelationship[];
+    /** Whether model extends core content */
+    extendsContent?: boolean;
+}
+interface ModelRelationship {
+    type: 'oneToOne' | 'oneToMany' | 'manyToMany';
+    target: string;
+    foreignKey?: string;
+    joinTable?: string;
+}
+interface PluginService {
+    /** Service name */
+    name: string;
+    /** Service implementation */
+    implementation: any;
+    /** Service description */
+    description?: string;
+    /** Service dependencies */
+    dependencies?: string[];
+    /** Whether service is singleton */
+    singleton?: boolean;
+}
+interface PluginAdminPage {
+    /** Page path (relative to /admin) */
+    path: string;
+    /** Page title */
+    title: string;
+    /** Page component/template */
+    component: string;
+    /** Page description */
+    description?: string;
+    /** Required permissions */
+    permissions?: string[];
+    /** Menu item configuration */
+    menuItem?: PluginMenuItem;
+    /** Page icon */
+    icon?: string;
+}
+interface PluginComponent {
+    /** Component name */
+    name: string;
+    /** Component template function */
+    template: (props: any) => string;
+    /** Component description */
+    description?: string;
+    /** Component props schema */
+    propsSchema?: z.ZodSchema;
+}
+interface PluginMenuItem {
+    /** Menu item label */
+    label: string;
+    /** Menu item path */
+    path: string;
+    /** Menu item icon */
+    icon?: string;
+    /** Menu item order */
+    order?: number;
+    /** Parent menu item */
+    parent?: string;
+    /** Required permissions */
+    permissions?: string[];
+    /** Whether item is active */
+    active?: boolean;
+}
+interface PluginHook {
+    /** Hook name */
+    name: string;
+    /** Hook handler function */
+    handler: HookHandler;
+    /** Hook priority */
+    priority?: number;
+    /** Hook description */
+    description?: string;
+}
+type HookHandler = (data: any, context: HookContext) => Promise<any>;
+interface HookContext {
+    /** Plugin that registered the hook */
+    plugin: string;
+    /** Hook execution context */
+    context: PluginContext;
+    /** Cancel hook execution */
+    cancel?: () => void;
+}
+interface HookSystem {
+    /** Register a hook handler */
+    register(hookName: string, handler: HookHandler, priority?: number): void;
+    /** Execute all handlers for a hook */
+    execute(hookName: string, data: any, context?: any): Promise<any>;
+    /** Remove a hook handler */
+    unregister(hookName: string, handler: HookHandler): void;
+    /** Get all registered hooks */
+    getHooks(hookName: string): PluginHook[];
+    /** Create a scoped hook system (optional) */
+    createScope?(pluginName: string): ScopedHookSystem;
+}
+interface ScopedHookSystem {
+    /** Register a hook handler */
+    register(hookName: string, handler: HookHandler, priority?: number): void;
+    /** Execute all handlers for a hook */
+    execute(hookName: string, data: any, context?: any): Promise<any>;
+    /** Remove a hook handler */
+    unregister(hookName: string, handler: HookHandler): void;
+    /** Remove all hooks for this scope */
+    unregisterAll(): void;
+}
+interface AuthService {
+    /** Generate JWT token for a user */
+    generateToken(userId: string, email: string, role: string): Promise<string>;
+    /** Verify and decode JWT token */
+    verifyToken(token: string): Promise<any>;
+    /** Set authentication cookie (useful for alternative auth methods) */
+    setAuthCookie(context: Context, token: string, options?: {
+        maxAge?: number;
+        secure?: boolean;
+        httpOnly?: boolean;
+        sameSite?: 'Strict' | 'Lax' | 'None';
+    }): void;
+    /** Hash password */
+    hashPassword(password: string): Promise<string>;
+    /** Verify password against hash */
+    verifyPassword(password: string, hash: string): Promise<boolean>;
+}
+interface AuthService {
+    /** Verify user permissions */
+    hasPermission(userId: string, permission: string): Promise<boolean>;
+    /** Get current user */
+    getCurrentUser(context: Context): Promise<any>;
+    /** Create authentication middleware */
+    createMiddleware(options?: any): MiddlewareHandler;
+}
+interface ContentService {
+    /** Get content by ID */
+    getById(id: string): Promise<any>;
+    /** Create new content */
+    create(data: any): Promise<any>;
+    /** Update content */
+    update(id: string, data: any): Promise<any>;
+    /** Delete content */
+    delete(id: string): Promise<void>;
+    /** Search content */
+    search(query: string, options?: any): Promise<any[]>;
+}
+interface MediaService {
+    /** Upload file */
+    upload(file: File, options?: any): Promise<any>;
+    /** Get media by ID */
+    getById(id: string): Promise<any>;
+    /** Delete media */
+    delete(id: string): Promise<void>;
+    /** Transform image */
+    transform(id: string, options: any): Promise<string>;
+}
+interface PluginLogger {
+    debug(message: string, data?: any): void;
+    info(message: string, data?: any): void;
+    warn(message: string, data?: any): void;
+    error(message: string, error?: Error, data?: any): void;
+}
+
+/**
+ * Email provider resolution
+ *
+ * Decides which transport an app uses, in precedence order:
+ *
+ *   1. an explicit `provider` instance  (dev brought their own — wins outright)
+ *   2. an explicit `providerName` built-in, credentialed from env
+ *   3. env auto-detect: RESEND_API_KEY → Resend, else SENDGRID_API_KEY → SendGrid
+ *   4. the Console provider (zero-config dev/CI fallback)
+ *
+ * If a chosen provider turns out to be unconfigured (e.g. `providerName: 'resend'`
+ * with no key), it falls back to Console with a warning rather than failing sends
+ * silently — so a missing key degrades to "logged, not delivered", never to a
+ * security leak (a reset flow returning its own token because mail didn't send).
+ */
+
+type BuiltInProviderName = 'resend' | 'sendgrid' | 'console';
+
+interface Bindings {
+    DB: D1Database;
+    CACHE_KV: KVNamespace;
+    MEDIA_BUCKET: R2Bucket;
+    ASSETS: Fetcher;
+    EMAIL_QUEUE?: Queue;
+    SENDGRID_API_KEY?: string;
+    DEFAULT_FROM_EMAIL?: string;
+    IMAGES_ACCOUNT_ID?: string;
+    IMAGES_API_TOKEN?: string;
+    ENVIRONMENT?: string;
+    CORS_ORIGINS?: string;
+    JWT_SECRET?: string;
+    JWT_EXPIRES_IN?: string;
+    JWT_REFRESH_GRACE_SECONDS?: string;
+    BUCKET_NAME?: string;
+    GOOGLE_MAPS_API_KEY?: string;
+    BETTER_AUTH_SECRET?: string;
+    BETTER_AUTH_URL?: string;
+    GITHUB_CLIENT_ID?: string;
+    GITHUB_CLIENT_SECRET?: string;
+    GOOGLE_CLIENT_ID?: string;
+    GOOGLE_CLIENT_SECRET?: string;
+}
+interface Variables {
+    user?: {
+        userId: string;
+        email: string;
+        role: string;
+        isSuperAdmin?: boolean;
+        exp: number;
+        iat: number;
+    };
+    session?: {
+        id: string;
+        userId: string;
+        token: string;
+        expiresAt: number;
+        createdAt: number;
+        updatedAt: number;
+    };
+    rbacPerms?: string[];
+    requestId?: string;
+    startTime?: number;
+    appVersion?: string;
+    csrfToken?: string;
+    pluginMenuItems?: Array<{
+        label: string;
+        path: string;
+        icon: string;
+    }>;
+    /**
+     * The plugin hook system attached to the request. Set by bootstrapMiddleware
+     * BEFORE any heavy bootstrap work runs, so anything that emits a hook during
+     * bootstrap (cron cold starts, RBAC seed, document-type registration) sees a
+     * live bus instead of a no-op.
+     */
+    hookSystem?: HookSystemLike;
+    /** Tenant slug resolved per request by tenantMiddleware ('default' when single-tenant). */
+    tenantId?: string;
+    /** The authed user's role IN the resolved tenant (per-tenant RBAC); global role for 'default'. */
+    tenantRole?: string;
+}
+interface SonicJSConfig {
+    collections?: {
+        directory?: string;
+        autoSync?: boolean;
+    };
+    plugins?: {
+        /**
+         * @deprecated No-op. Cloudflare Workers has no runtime filesystem, so a
+         * plugin directory cannot be scanned at runtime. Pass plugins explicitly via
+         * `register` instead.
+         */
+        directory?: string;
+        /**
+         * @deprecated No-op. Filesystem autoload is not supported on Workers. Pass
+         * plugins explicitly via `register` instead.
+         */
+        autoLoad?: boolean;
+        /**
+         * User-supplied plugins to mount. Each plugin's declarative `routes[]` and/or
+         * synchronous `register(app)` hook is mounted into the app, before the
+         * `/admin` catch-all so plugin admin pages are not shadowed.
+         *
+         * @example
+         * createSonicJSApp({ plugins: { register: [contactFormPlugin] } })
+         */
+        register?: Plugin[];
+        /**
+         * Disable ALL plugins — core AND user. When true, no plugin routes are
+         * mounted and plugin bootstrap (DB seeding) is skipped. Use this to run a
+         * bare core app.
+         */
+        disableAll?: boolean;
+    };
+    /**
+     * Email configuration. Controls the app-wide EmailService that backs password
+     * reset, magic-link, OTP, and any plugin that declares `email:send`.
+     *
+     * Bring your own provider, name a built-in, or let env auto-detect:
+     * - `provider`: a custom `EmailProvider` instance (highest precedence).
+     * - `providerName`: `'resend' | 'sendgrid' | 'console'`, credentialed from env.
+     * - neither: auto-detect from env (RESEND_API_KEY, then SENDGRID_API_KEY),
+     *   falling back to the console provider (logs instead of delivering).
+     */
+    email?: {
+        provider?: EmailProvider;
+        providerName?: BuiltInProviderName;
+        /** Default from-address. Falls back to env DEFAULT_FROM_EMAIL, then a placeholder. */
+        from?: string;
+    };
+    routes?: Array<{
+        path: string;
+        handler: Hono;
+    }>;
+    middleware?: {
+        beforeAuth?: Array<(c: Context, next: () => Promise<void>) => Promise<void>>;
+        afterAuth?: Array<(c: Context, next: () => Promise<void>) => Promise<void>>;
+    };
+    auth?: {
+        extendBetterAuth?: ExtendBetterAuth;
+    };
+    version?: string;
+    name?: string;
+}
+/**
+ * A function that boots the plugin infrastructure from env bindings.
+ *
+ * Runs email init + plugin wiring, both promise-memoized so calling it multiple
+ * times per isolate is a no-op. Pass it to `createScheduledHandler` as the
+ * `boot` option so cron-first cold isolates wire up before dispatching.
+ */
+type BootIsolateFn = (env: Record<string, unknown>) => Promise<void>;
+/**
+ * The app returned by {@link createSonicJSApp}. Extends the Hono app with a
+ * `boot` function that wires plugins from env bindings, suitable for use in a
+ * Worker `scheduled()` handler.
+ */
+type SonicJSApp = Hono<{
+    Bindings: Bindings;
+    Variables: Variables;
+}> & {
+    /** Boot the plugin infrastructure from Cloudflare env bindings (once-guarded). */
+    readonly boot: BootIsolateFn;
+};
+/**
+ * Create a SonicJS application with core functionality
+ *
+ * @param config - Application configuration
+ * @returns Configured Hono application
+ *
+ * @example
+ * ```typescript
+ * import { createSonicJSApp } from '@sonicjs-cms/core'
+ *
+ * const app = createSonicJSApp({
+ *   collections: {
+ *     directory: './src/collections',
+ *     autoSync: true
+ *   },
+ *   plugins: {
+ *     directory: './src/plugins',
+ *     autoLoad: true
+ *   }
+ * })
+ *
+ * export default app
+ * ```
+ */
+declare function createSonicJSApp(config?: SonicJSConfig): SonicJSApp;
+/**
+ * Setup core middleware (backward compatibility)
+ *
+ * @param _app - Hono application
+ * @deprecated Use createSonicJSApp() instead
+ */
+declare function setupCoreMiddleware(_app: SonicJSApp): void;
+/**
+ * Setup core routes (backward compatibility)
+ *
+ * @param _app - Hono application
+ * @deprecated Use createSonicJSApp() instead
+ */
+declare function setupCoreRoutes(_app: SonicJSApp): void;
+
+export { type Bindings as B, type SonicJSConfig as S, type Variables as V, type BootIsolateFn as a, type SonicJSApp as b, createSonicJSApp as c, setupCoreRoutes as d, setupCoreMiddleware as s };