@sonicjs-cms/core 2.19.0 → 3.0.0-beta.2

package/dist/{chunk-JZV22DEV.js → chunk-ZGGXCFR6.js}

@@ -1,4 +1,123 @@
+import { escapeHtml } from './chunk-TQABQWOP.js';
+import { getCookie } from 'hono/cookie';
+
+// src/services/collection-registry.ts
+var CollectionRegistry = class {
+  byName = /* @__PURE__ */ new Map();
+  bySlug = /* @__PURE__ */ new Map();
+  /**
+   * Replace the registry contents with the given configs. Idempotent —
+   * calling with the same configs twice yields the same state.
+   */
+  register(configs) {
+    this.byName.clear();
+    this.bySlug.clear();
+    for (const config of configs) {
+      if (!config.name) continue;
+      const record = {
+        ...config,
+        id: config.name,
+        slug: config.slug ?? config.name.replace(/_/g, "-"),
+        managed: config.managed !== void 0 ? config.managed : true,
+        isActive: config.isActive !== void 0 ? config.isActive : true
+      };
+      this.byName.set(record.name, record);
+      this.bySlug.set(record.slug, record);
+    }
+  }
+  /** All registered collections (including inactive). */
+  list() {
+    return Array.from(this.byName.values());
+  }
+  /** Active collections only. */
+  listActive() {
+    return this.list().filter((c) => c.isActive !== false);
+  }
+  getByName(name) {
+    return this.byName.get(name);
+  }
+  /** For code-defined collections, id === name. */
+  getById(id) {
+    return this.byName.get(id);
+  }
+  /** Look up by the URL slug (set in CollectionConfig.slug). Falls back to getByName if needed. */
+  getBySlug(slug) {
+    return this.bySlug.get(slug);
+  }
+  /** Resolve a path segment to a record — tries slug first, then name. */
+  getBySlugOrName(slugOrName) {
+    return this.bySlug.get(slugOrName) ?? this.byName.get(slugOrName);
+  }
+  isActive(name) {
+    const record = this.byName.get(name);
+    return record?.isActive !== false && record !== void 0;
+  }
+  size() {
+    return this.byName.size;
+  }
+  /** Test helper — wipe state. */
+  clear() {
+    this.byName.clear();
+    this.bySlug.clear();
+  }
+};
+function collectionRecordToRow(record) {
+  return {
+    id: record.id,
+    name: record.name,
+    display_name: record.displayName,
+    description: record.description ?? null,
+    schema: record.schema,
+    is_active: record.isActive === false ? 0 : 1,
+    managed: record.managed === false ? 0 : 1,
+    source_type: "code",
+    source_id: null,
+    created_at: 0,
+    updated_at: 0
+  };
+}
+var instance = null;
+function getCollectionRegistry() {
+  if (!instance) {
+    instance = new CollectionRegistry();
+  }
+  return instance;
+}
+function resetCollectionRegistry() {
+  instance = null;
+}
+
 // src/services/collection-loader.ts
+function isCodeCollectionInternal(cfg) {
+  return cfg.internal === true;
+}
+function isDbDocTypeInternal(source) {
+  return source === "system" || source === "plugin";
+}
+async function getVisibleCollections(db) {
+  const codeRegistry = getCollectionRegistry().list();
+  const codeMap = /* @__PURE__ */ new Map();
+  for (const cfg of codeRegistry) {
+    if (!isCodeCollectionInternal(cfg)) {
+      codeMap.set(cfg.name, { name: cfg.name, displayName: cfg.displayName });
+    }
+  }
+  let dbRows = [];
+  try {
+    const { results } = await db.prepare(
+      "SELECT name, display_name, source FROM document_types WHERE is_active = 1 ORDER BY display_name"
+    ).all();
+    dbRows = results ?? [];
+  } catch {
+  }
+  const merged = new Map(codeMap);
+  for (const row of dbRows) {
+    if (!isDbDocTypeInternal(row.source) && !merged.has(row.name)) {
+      merged.set(row.name, { name: String(row.name), displayName: String(row.display_name) });
+    }
+  }
+  return Array.from(merged.values());
+}
 var registeredCollections = [];
 function registerCollections(collections) {
   for (const config of collections) {
@@ -127,621 +246,295 @@ function validateCollectionConfig(config) {
     errors
   };
 }
-
-// src/services/collection-sync.ts
-async function syncCollections(db) {
-  console.log("\u{1F504} Starting collection sync...");
-  const results = [];
-  const configs = await loadCollectionConfigs();
-  if (configs.length === 0) {
-    console.log("\u26A0\uFE0F  No collection configurations found");
-    return results;
-  }
-  for (const config of configs) {
-    const result = await syncCollection(db, config);
-    results.push(result);
-  }
-  const created = results.filter((r) => r.status === "created").length;
-  const updated = results.filter((r) => r.status === "updated").length;
-  const unchanged = results.filter((r) => r.status === "unchanged").length;
-  const errors = results.filter((r) => r.status === "error").length;
-  console.log(`\u2705 Collection sync complete: ${created} created, ${updated} updated, ${unchanged} unchanged, ${errors} errors`);
-  return results;
+var TENANT_COOKIE = "sonicjs-tenant";
+var TENANT_SWITCHER_MARKER = "<!-- TENANT_SWITCHER -->";
+var MULTI_TENANT_PLUGIN_ID = "multi-tenant";
+var CACHE_TTL_MS = 3e4;
+var DEFAULT_SETTINGS = {
+  headerName: "X-Tenant-Id",
+  subdomainResolution: false,
+  rootDomain: ""
+};
+var cache = null;
+function invalidateTenantCache() {
+  cache = null;
 }
-async function syncCollection(db, config) {
+async function loadTenantState(db) {
+  const now = Date.now();
+  if (cache && now - cache.fetchedAt < CACHE_TTL_MS) return cache;
+  let pluginActive = false;
+  let settings = DEFAULT_SETTINGS;
+  const tenants = /* @__PURE__ */ new Map();
+  const domains = /* @__PURE__ */ new Map();
   try {
-    const validation = validateCollectionConfig(config);
-    if (!validation.valid) {
-      return {
-        name: config.name,
-        status: "error",
-        error: `Validation failed: ${validation.errors.join(", ")}`
-      };
-    }
-    const existingStmt = db.prepare("SELECT * FROM collections WHERE name = ?");
-    const existing = await existingStmt.bind(config.name).first();
-    const now = Date.now();
-    const collectionId = existing?.id || `col-${config.name}-${crypto.randomUUID().slice(0, 8)}`;
-    const schemaJson = JSON.stringify(config.schema);
-    const isActive = config.isActive !== false ? 1 : 0;
-    const managed = config.managed !== false ? 1 : 0;
-    if (!existing) {
-      const insertStmt = db.prepare(`
-        INSERT INTO collections (id, name, display_name, description, schema, is_active, managed, created_at, updated_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-      `);
-      await insertStmt.bind(
-        collectionId,
-        config.name,
-        config.displayName,
-        config.description || null,
-        schemaJson,
-        isActive,
-        managed,
-        now,
-        now
-      ).run();
-      console.log(`  \u2713 Created collection: ${config.name}`);
-      return {
-        name: config.name,
-        status: "created",
-        message: `Created collection "${config.displayName}"`
-      };
-    } else {
-      const existingSchema = existing.schema ? JSON.stringify(existing.schema) : "{}";
-      const existingDisplayName = existing.display_name;
-      const existingDescription = existing.description;
-      const existingIsActive = existing.is_active;
-      const existingManaged = existing.managed;
-      const needsUpdate = schemaJson !== existingSchema || config.displayName !== existingDisplayName || (config.description || null) !== existingDescription || isActive !== existingIsActive || managed !== existingManaged;
-      if (!needsUpdate) {
-        return {
-          name: config.name,
-          status: "unchanged",
-          message: `Collection "${config.displayName}" is up to date`
+    const pluginRow = await db.prepare(
+      `SELECT data FROM documents
+       WHERE type_id = 'plugin' AND tenant_id = 'default' AND slug = ?
+         AND q_plugin_status = 'active' AND is_current_draft = 1 AND deleted_at IS NULL`
+    ).bind(MULTI_TENANT_PLUGIN_ID).first();
+    if (pluginRow) {
+      pluginActive = true;
+      try {
+        const data = typeof pluginRow.data === "string" ? JSON.parse(pluginRow.data) : pluginRow.data ?? {};
+        const s = data.settings ?? {};
+        settings = {
+          headerName: typeof s.headerName === "string" && s.headerName.trim() !== "" ? s.headerName.trim() : DEFAULT_SETTINGS.headerName,
+          subdomainResolution: s.subdomainResolution === true,
+          rootDomain: typeof s.rootDomain === "string" ? s.rootDomain.trim().toLowerCase() : ""
         };
+      } catch {
+        settings = DEFAULT_SETTINGS;
       }
-      const updateStmt = db.prepare(`
-        UPDATE collections
-        SET display_name = ?, description = ?, schema = ?, is_active = ?, managed = ?, updated_at = ?
-        WHERE name = ?
-      `);
-      await updateStmt.bind(
-        config.displayName,
-        config.description || null,
-        schemaJson,
-        isActive,
-        managed,
-        now,
-        config.name
-      ).run();
-      console.log(`  \u2713 Updated collection: ${config.name}`);
-      return {
-        name: config.name,
-        status: "updated",
-        message: `Updated collection "${config.displayName}"`
-      };
-    }
-  } catch (error) {
-    console.error(`  \u2717 Error syncing collection ${config.name}:`, error);
-    return {
-      name: config.name,
-      status: "error",
-      error: error instanceof Error ? error.message : "Unknown error"
-    };
-  }
-}
-async function isCollectionManaged(db, collectionName) {
-  try {
-    const stmt = db.prepare("SELECT managed FROM collections WHERE name = ?");
-    const result = await stmt.bind(collectionName).first();
-    return result?.managed === 1;
-  } catch (error) {
-    console.error(`Error checking if collection is managed:`, error);
-    return false;
-  }
-}
-async function getManagedCollections(db) {
-  try {
-    const stmt = db.prepare("SELECT name FROM collections WHERE managed = 1");
-    const { results } = await stmt.all();
-    return (results || []).map((row) => row.name);
-  } catch (error) {
-    console.error("Error getting managed collections:", error);
-    return [];
-  }
-}
-async function cleanupRemovedCollections(db) {
-  try {
-    const configs = await loadCollectionConfigs();
-    const configNames = new Set(configs.map((c) => c.name));
-    const managedCollections = await getManagedCollections(db);
-    const removed = [];
-    for (const managedName of managedCollections) {
-      if (!configNames.has(managedName)) {
-        const updateStmt = db.prepare(`
-          UPDATE collections
-          SET is_active = 0, updated_at = ?
-          WHERE name = ? AND managed = 1
-        `);
-        await updateStmt.bind(Date.now(), managedName).run();
-        removed.push(managedName);
-        console.log(`  \u26A0\uFE0F  Deactivated removed collection: ${managedName}`);
-      }
-    }
-    return removed;
-  } catch (error) {
-    console.error("Error cleaning up removed collections:", error);
-    return [];
-  }
-}
-async function fullCollectionSync(db) {
-  const results = await syncCollections(db);
-  const removed = await cleanupRemovedCollections(db);
-  return { results, removed };
-}
-
-// src/services/form-collection-sync.ts
-var SYSTEM_FORM_USER_ID = "system-form-submission";
-function mapFormioTypeToSchemaType(component) {
-  switch (component.type) {
-    case "textfield":
-    case "textarea":
-    case "password":
-    case "phoneNumber":
-    case "url":
-      return { type: "string", title: component.label || component.key };
-    case "email":
-      return { type: "string", format: "email", title: component.label || component.key };
-    case "number":
-    case "currency":
-      return { type: "number", title: component.label || component.key };
-    case "checkbox":
-      return { type: "boolean", title: component.label || component.key };
-    case "select":
-    case "radio": {
-      const enumValues = (component.data?.values || component.values || []).map((v) => v.value);
-      const enumLabels = (component.data?.values || component.values || []).map((v) => v.label);
-      return {
-        type: "select",
-        title: component.label || component.key,
-        enum: enumValues,
-        enumLabels
-      };
-    }
-    case "selectboxes":
-      return { type: "object", title: component.label || component.key };
-    case "datetime":
-    case "day":
-    case "time":
-      return { type: "string", format: "date-time", title: component.label || component.key };
-    case "file":
-    case "signature":
-      return { type: "string", title: component.label || component.key };
-    case "address":
-      return { type: "object", title: component.label || component.key };
-    case "hidden":
-      return { type: "string", title: component.label || component.key };
-    default:
-      return { type: "string", title: component.label || component.key };
-  }
-}
-function extractFieldComponents(components) {
-  const fields = [];
-  if (!components) return fields;
-  for (const comp of components) {
-    if (comp.type === "panel" || comp.type === "fieldset" || comp.type === "well" || comp.type === "tabs") {
-      if (comp.components) {
-        fields.push(...extractFieldComponents(comp.components));
-      }
-      continue;
-    }
-    if (comp.type === "columns" && comp.columns) {
-      for (const col of comp.columns) {
-        if (col.components) {
-          fields.push(...extractFieldComponents(col.components));
+      const { results } = await db.prepare(
+        `SELECT slug, name, status, domain FROM auth_tenant`
+      ).all();
+      for (const row of results ?? []) {
+        const status = row.status === "inactive" ? "inactive" : "active";
+        tenants.set(row.slug, { name: row.name || row.slug, status });
+        if (row.domain && status === "active") {
+          domains.set(String(row.domain).toLowerCase(), row.slug);
         }
       }
-      continue;
-    }
-    if (comp.type === "table" && comp.rows) {
-      for (const row of comp.rows) {
-        if (Array.isArray(row)) {
-          for (const cell of row) {
-            if (cell.components) {
-              fields.push(...extractFieldComponents(cell.components));
-            }
-          }
-        }
-      }
-      continue;
-    }
-    if (comp.type === "button" || comp.type === "htmlelement" || comp.type === "content") {
-      continue;
-    }
-    if (comp.type === "turnstile") {
-      continue;
-    }
-    if (comp.key) {
-      fields.push(comp);
-    }
-    if (comp.components) {
-      fields.push(...extractFieldComponents(comp.components));
+      if (!tenants.has("default")) tenants.set("default", { name: "Default", status: "active" });
     }
+  } catch {
+    pluginActive = false;
   }
-  return fields;
+  cache = { pluginActive, settings, tenants, domains, fetchedAt: now };
+  return cache;
 }
-function deriveCollectionSchemaFromFormio(formioSchema) {
-  const components = formioSchema?.components || [];
-  const fieldComponents = extractFieldComponents(components);
-  const properties = {
-    // Always include a title field for the content item
-    title: { type: "string", title: "Title", required: true }
-  };
-  const required = ["title"];
-  for (const comp of fieldComponents) {
-    const key = comp.key;
-    if (!key || key === "submit" || key === "title") continue;
-    const fieldDef = mapFormioTypeToSchemaType(comp);
-    if (comp.validate?.required) {
-      fieldDef.required = true;
-      required.push(key);
-    }
-    properties[key] = fieldDef;
-  }
-  return { type: "object", properties, required };
+function isActiveTenant(state, slug) {
+  if (!slug) return false;
+  const entry = state.tenants.get(slug);
+  return !!entry && entry.status === "active";
 }
-function deriveSubmissionTitle(data, formDisplayName) {
-  const candidates = ["name", "fullName", "full_name", "firstName", "first_name"];
-  for (const key of candidates) {
-    if (data[key] && typeof data[key] === "string" && data[key].trim()) {
-      if (key === "firstName" || key === "first_name") {
-        const last = data["lastName"] || data["last_name"] || data["lastname"] || "";
-        if (last) return `${data[key].trim()} ${last.trim()}`;
-      }
-      return data[key].trim();
+function resolveTenantSlug(state, req, opts) {
+  if (!state.pluginActive) return "default";
+  const full = state;
+  const enforce = opts?.enforceMembership === true;
+  const member = (slug) => !enforce || slug === "default" || (opts?.memberSlugs?.has(slug) ?? false);
+  const accept = (slug) => isActiveTenant(full, slug) && member(slug);
+  const header = req.header?.trim().toLowerCase();
+  if (accept(header)) return header;
+  const cookie = req.cookie?.trim().toLowerCase();
+  if (accept(cookie)) return cookie;
+  const host = req.host?.split(":")[0]?.toLowerCase() ?? "";
+  if (host) {
+    const bySlug = state.domains.get(host);
+    if (accept(bySlug)) return bySlug;
+    const { subdomainResolution, rootDomain } = state.settings;
+    if (subdomainResolution && rootDomain && host.endsWith(`.${rootDomain}`)) {
+      const sub = host.slice(0, -(rootDomain.length + 1));
+      if (sub && !sub.includes(".") && accept(sub)) return sub;
     }
   }
-  if (data.email && typeof data.email === "string" && data.email.trim()) {
-    return data.email.trim();
-  }
-  if (data.subject && typeof data.subject === "string" && data.subject.trim()) {
-    return data.subject.trim();
-  }
-  const dateStr = (/* @__PURE__ */ new Date()).toLocaleDateString("en-US", {
-    year: "numeric",
-    month: "short",
-    day: "numeric",
-    hour: "2-digit",
-    minute: "2-digit"
-  });
-  return `${formDisplayName} - ${dateStr}`;
-}
-function mapFormStatusToContentStatus(formStatus) {
-  switch (formStatus) {
-    case "pending":
-      return "published";
-    case "reviewed":
-      return "published";
-    case "approved":
-      return "published";
-    case "rejected":
-      return "archived";
-    case "spam":
-      return "deleted";
-    default:
-      return "published";
-  }
-}
-async function syncFormCollection(db, form) {
-  const collectionName = `form_${form.name}`;
-  const displayName = `${form.display_name} (Form)`;
-  const formioSchema = typeof form.formio_schema === "string" ? JSON.parse(form.formio_schema) : form.formio_schema;
-  const schema = deriveCollectionSchemaFromFormio(formioSchema);
-  const schemaJson = JSON.stringify(schema);
-  const now = Date.now();
-  const isActive = form.is_active ? 1 : 0;
-  const existing = await db.prepare(
-    "SELECT id, schema, display_name, description, is_active FROM collections WHERE source_type = ? AND source_id = ?"
-  ).bind("form", form.id).first();
-  if (!existing) {
-    const collectionId = `col-form-${form.name}-${crypto.randomUUID().slice(0, 8)}`;
-    await db.prepare(`
-      INSERT INTO collections (id, name, display_name, description, schema, is_active, managed, source_type, source_id, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, 1, 'form', ?, ?, ?)
-    `).bind(
-      collectionId,
-      collectionName,
-      displayName,
-      form.description || null,
-      schemaJson,
-      isActive,
-      form.id,
-      now,
-      now
-    ).run();
-    console.log(`[FormSync] Created shadow collection: ${collectionName}`);
-    return { collectionId, status: "created" };
-  }
-  const existingSchema = existing.schema ? JSON.stringify(typeof existing.schema === "string" ? JSON.parse(existing.schema) : existing.schema) : "{}";
-  const needsUpdate = schemaJson !== existingSchema || displayName !== existing.display_name || (form.description || null) !== existing.description || isActive !== existing.is_active;
-  if (!needsUpdate) {
-    return { collectionId: existing.id, status: "unchanged" };
-  }
-  await db.prepare(`
-    UPDATE collections SET display_name = ?, description = ?, schema = ?, is_active = ?, updated_at = ?
-    WHERE id = ?
-  `).bind(
-    displayName,
-    form.description || null,
-    schemaJson,
-    isActive,
-    now,
-    existing.id
-  ).run();
-  console.log(`[FormSync] Updated shadow collection: ${collectionName}`);
-  return { collectionId: existing.id, status: "updated" };
+  return "default";
 }
-async function syncAllFormCollections(db) {
+async function loadMemberRoles(db, userId) {
   try {
-    const tableCheck = await db.prepare(
-      "SELECT name FROM sqlite_master WHERE type='table' AND name='forms'"
-    ).first();
-    if (!tableCheck) {
-      console.log("[FormSync] Forms table does not exist, skipping form sync");
-      return;
-    }
-    const { results: forms } = await db.prepare(
-      "SELECT id, name, display_name, description, formio_schema, is_active FROM forms"
-    ).all();
-    if (!forms || forms.length === 0) {
-      console.log("[FormSync] No forms found, skipping");
-      return;
-    }
-    let created = 0;
-    let updated = 0;
-    for (const form of forms) {
-      try {
-        const result = await syncFormCollection(db, form);
-        if (result.status === "created") created++;
-        if (result.status === "updated") updated++;
-        await backfillFormSubmissions(db, form.id, result.collectionId);
-      } catch (error) {
-        console.error(`[FormSync] Error syncing form ${form.name}:`, error);
-      }
-    }
-    console.log(`[FormSync] Sync complete: ${created} created, ${updated} updated out of ${forms.length} forms`);
-  } catch (error) {
-    console.error("[FormSync] Error syncing form collections:", error);
+    const { results } = await db.prepare(`
+      SELECT t.slug, m.role FROM auth_tenant_member m
+      JOIN auth_tenant t ON t.id = m.tenant_id
+      WHERE m.user_id = ?
+    `).bind(userId).all();
+    return new Map((results ?? []).map((r) => [r.slug, r.role || "viewer"]));
+  } catch {
+    return /* @__PURE__ */ new Map();
   }
 }
-async function createContentFromSubmission(db, submissionData, form, submissionId, metadata = {}) {
-  try {
-    let collection = await db.prepare(
-      "SELECT id FROM collections WHERE source_type = ? AND source_id = ?"
-    ).bind("form", form.id).first();
-    if (!collection) {
-      console.warn(`[FormSync] No shadow collection found for form ${form.name}, attempting to create...`);
-      try {
-        const fullForm = await db.prepare(
-          "SELECT id, name, display_name, description, formio_schema, is_active FROM forms WHERE id = ?"
-        ).bind(form.id).first();
-        if (fullForm) {
-          const schema = typeof fullForm.formio_schema === "string" ? JSON.parse(fullForm.formio_schema) : fullForm.formio_schema;
-          const result = await syncFormCollection(db, {
-            id: fullForm.id,
-            name: fullForm.name,
-            display_name: fullForm.display_name,
-            description: fullForm.description,
-            formio_schema: schema,
-            is_active: fullForm.is_active ?? 1
-          });
-          collection = await db.prepare(
-            "SELECT id FROM collections WHERE source_type = ? AND source_id = ?"
-          ).bind("form", form.id).first();
-          console.log(`[FormSync] On-the-fly sync result: ${result.status}, collectionId: ${result.collectionId}`);
-        }
-      } catch (syncErr) {
-        console.error("[FormSync] On-the-fly shadow collection creation failed:", syncErr);
-      }
-      if (!collection) {
-        console.error(`[FormSync] Still no shadow collection for form ${form.name} after recovery attempt`);
-        return null;
-      }
-    }
-    const contentId = crypto.randomUUID();
-    const now = Date.now();
-    const title = deriveSubmissionTitle(submissionData, form.display_name);
-    const slug = `submission-${submissionId.slice(0, 8)}`;
-    const contentData = {
-      title,
-      ...submissionData,
-      _submission_metadata: {
-        submissionId,
-        formId: form.id,
-        formName: form.name,
-        email: metadata.userEmail || submissionData.email || null,
-        ipAddress: metadata.ipAddress || null,
-        userAgent: metadata.userAgent || null,
-        submittedAt: now
-      }
-    };
-    const authorId = metadata.userId || SYSTEM_FORM_USER_ID;
-    if (authorId === SYSTEM_FORM_USER_ID) {
-      const systemUser = await db.prepare("SELECT id FROM users WHERE id = ?").bind(SYSTEM_FORM_USER_ID).first();
-      if (!systemUser) {
-        console.log("[FormSync] System form user missing, creating...");
-        const sysNow = Date.now();
-        await db.prepare(`
-          INSERT OR IGNORE INTO users (id, email, username, first_name, last_name, password_hash, role, is_active, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, NULL, 'viewer', 0, ?, ?)
-        `).bind(SYSTEM_FORM_USER_ID, "system-forms@sonicjs.internal", "system-forms", "Form", "Submission", sysNow, sysNow).run();
-      }
+function tenantMiddleware() {
+  return async (c, next) => {
+    const db = c.env?.DB;
+    if (!db) {
+      c.set("tenantId", "default");
+      return next();
     }
-    console.log(`[FormSync] Inserting content: id=${contentId}, collection=${collection.id}, slug=${slug}, title=${title}, author=${authorId}`);
-    await db.prepare(`
-      INSERT INTO content (id, collection_id, slug, title, data, status, author_id, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, 'published', ?, ?, ?)
-    `).bind(
-      contentId,
-      collection.id,
-      slug,
-      title,
-      JSON.stringify(contentData),
-      authorId,
-      now,
-      now
-    ).run();
-    await db.prepare(
-      "UPDATE form_submissions SET content_id = ? WHERE id = ?"
-    ).bind(contentId, submissionId).run();
-    console.log(`[FormSync] Content created successfully: ${contentId}`);
-    return contentId;
-  } catch (error) {
-    console.error("[FormSync] Error creating content from submission:", error);
-    return null;
-  }
-}
-async function backfillFormSubmissions(db, formId, collectionId) {
-  try {
-    const { results: submissions } = await db.prepare(
-      "SELECT id, submission_data, user_email, ip_address, user_agent, user_id, submitted_at FROM form_submissions WHERE form_id = ? AND content_id IS NULL"
-    ).bind(formId).all();
-    if (!submissions || submissions.length === 0) {
-      return 0;
+    const state = await loadTenantState(db);
+    const user = c.get("user");
+    let memberSlugs;
+    let memberRoles;
+    const enforceMembership = !!(user?.userId && state.pluginActive && !user.isSuperAdmin);
+    if (user?.userId && state.pluginActive && !user.isSuperAdmin) {
+      memberRoles = await loadMemberRoles(db, user.userId);
+      memberSlugs = new Set(memberRoles.keys());
     }
-    const form = await db.prepare(
-      "SELECT id, name, display_name FROM forms WHERE id = ?"
-    ).bind(formId).first();
-    if (!form) return 0;
-    let count = 0;
-    for (const sub of submissions) {
-      try {
-        const submissionData = typeof sub.submission_data === "string" ? JSON.parse(sub.submission_data) : sub.submission_data;
-        const contentId = await createContentFromSubmission(
-          db,
-          submissionData,
-          { id: form.id, name: form.name, display_name: form.display_name },
-          sub.id,
-          {
-            ipAddress: sub.ip_address,
-            userAgent: sub.user_agent,
-            userEmail: sub.user_email,
-            userId: sub.user_id
-          }
-        );
-        if (contentId) count++;
-      } catch (error) {
-        console.error(`[FormSync] Error backfilling submission ${sub.id}:`, error);
-      }
+    const tenantId = resolveTenantSlug(
+      state,
+      {
+        header: c.req.header(state.settings.headerName),
+        cookie: getCookie(c, TENANT_COOKIE),
+        host: c.req.header("host")
+      },
+      { memberSlugs, enforceMembership }
+    );
+    c.set("tenantId", tenantId);
+    if (user?.userId) {
+      const role = tenantId === "default" || user.isSuperAdmin ? user.role : memberRoles?.get(tenantId) ?? user.role;
+      c.set("tenantRole", role);
     }
-    if (count > 0) {
-      console.log(`[FormSync] Backfilled ${count} submissions for form ${formId}`);
+    await next();
+    const path = new URL(c.req.url).pathname;
+    if (!path.startsWith("/admin")) return;
+    if (!c.res.headers.get("content-type")?.includes("text/html")) return;
+    const status = c.res.status;
+    const headers = new Headers(c.res.headers);
+    const html = await c.res.text();
+    if (html.includes(TENANT_SWITCHER_MARKER)) {
+      const replacement = state.pluginActive ? renderTenantSwitcher(state, tenantId, enforceMembership ? memberSlugs : void 0) : "";
+      c.res = new Response(html.split(TENANT_SWITCHER_MARKER).join(replacement), { status, headers });
+    } else {
+      c.res = new Response(html, { status, headers });
     }
-    return count;
-  } catch (error) {
-    console.error("[FormSync] Error backfilling submissions:", error);
-    return 0;
-  }
+  };
+}
+function renderTenantSwitcher(state, currentTenantId, memberSlugs) {
+  const active = [...state.tenants.entries()].filter(([slug, t]) => t.status === "active" && (!memberSlugs || slug === "default" || memberSlugs.has(slug))).sort(([a], [b]) => a === "default" ? -1 : b === "default" ? 1 : a.localeCompare(b));
+  const options = active.map(
+    ([slug, t]) => `<option value="${escapeHtml(slug)}" ${slug === currentTenantId ? "selected" : ""}>${escapeHtml(t.name)}</option>`
+  ).join("");
+  return `
+    <div class="border-b border-zinc-950/5 px-4 py-3 dark:border-white/5" data-tenant-switcher>
+      <label for="tenant-switcher-select" class="mb-1 flex items-center gap-1.5 text-xs/5 font-medium text-zinc-500 dark:text-zinc-400">
+        <svg class="h-3.5 w-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3.75 21h16.5M4.5 3h15M5.25 3v18m13.5-18v18M9 6.75h1.5m-1.5 3h1.5m-1.5 3h1.5m3-6H15m-1.5 3H15m-1.5 3H15M9 21v-3.375c0-.621.504-1.125 1.125-1.125h3.75c.621 0 1.125.504 1.125 1.125V21"/></svg>
+        Tenant
+      </label>
+      <form method="POST" action="/admin/tenants/switch" data-tenant-switcher-form>
+        <select
+          id="tenant-switcher-select"
+          name="tenant"
+          onchange="this.form.requestSubmit ? this.form.requestSubmit() : this.form.submit()"
+          class="w-full rounded-lg border border-zinc-950/10 bg-white px-2 py-1.5 text-sm/5 text-zinc-950 dark:border-white/10 dark:bg-zinc-800 dark:text-white"
+        >${options}</select>
+        <input type="hidden" name="redirect" value="" data-tenant-switcher-redirect>
+      </form>
+      <script>
+        (function () {
+          var r = document.querySelector('[data-tenant-switcher-redirect]');
+          if (r) r.value = window.location.pathname + window.location.search;
+        })();
+      </script>
+    </div>`;
 }
 
 // src/services/plugin-service.ts
+var TENANT = "default";
+var TYPE_ID = "plugin";
 var PluginService = class {
   constructor(db) {
     this.db = db;
   }
   async getAllPlugins() {
-    await this.ensureAllPluginsExist();
-    const stmt = this.db.prepare(`
-      SELECT * FROM plugins
-      ORDER BY is_core DESC, display_name ASC
-    `);
-    const { results } = await stmt.all();
-    return (results || []).map(this.mapPluginFromDb);
-  }
-  /**
-   * Ensure all plugins from the registry exist in the database
-   * Auto-installs any newly detected plugins with inactive status
-   *
-   * Note: This method should be overridden or configured with a plugin registry
-   * in the consuming application
-   */
-  async ensureAllPluginsExist() {
-    console.log("[PluginService] ensureAllPluginsExist - requires PLUGIN_REGISTRY configuration");
+    const { results } = await this.db.prepare(`
+      SELECT * FROM documents
+      WHERE type_id = ? AND tenant_id = ? AND is_current_draft = 1 AND deleted_at IS NULL
+      ORDER BY json_extract(data, '$.isCore') DESC, title ASC
+    `).bind(TYPE_ID, TENANT).all();
+    return (results || []).map(mapDocumentToPlugin);
   }
   async getPlugin(pluginId) {
-    const stmt = this.db.prepare("SELECT * FROM plugins WHERE id = ?");
-    const plugin = await stmt.bind(pluginId).first();
-    if (!plugin) return null;
-    return this.mapPluginFromDb(plugin);
+    const row = await this.db.prepare(`
+      SELECT * FROM documents
+      WHERE slug = ? AND type_id = ? AND tenant_id = ? AND is_current_draft = 1 AND deleted_at IS NULL
+    `).bind(pluginId, TYPE_ID, TENANT).first();
+    if (!row) return null;
+    return mapDocumentToPlugin(row);
   }
   async getPluginByName(name) {
-    const stmt = this.db.prepare("SELECT * FROM plugins WHERE name = ?");
-    const plugin = await stmt.bind(name).first();
-    if (!plugin) return null;
-    return this.mapPluginFromDb(plugin);
+    return this.getPlugin(name);
   }
   async getPluginStats() {
-    const stmt = this.db.prepare(`
-      SELECT 
+    const stats = await this.db.prepare(`
+      SELECT
         COUNT(*) as total,
-        COUNT(CASE WHEN status = 'active' THEN 1 END) as active,
-        COUNT(CASE WHEN status = 'inactive' THEN 1 END) as inactive,
-        COUNT(CASE WHEN status = 'error' THEN 1 END) as errors
-      FROM plugins
-    `);
-    const stats = await stmt.first();
+        COUNT(CASE WHEN q_plugin_status = 'active' THEN 1 END) as active,
+        COUNT(CASE WHEN q_plugin_status = 'inactive' THEN 1 END) as inactive,
+        COUNT(CASE WHEN q_plugin_status = 'error' THEN 1 END) as errors
+      FROM documents
+      WHERE type_id = ? AND tenant_id = ? AND is_current_draft = 1 AND deleted_at IS NULL
+    `).bind(TYPE_ID, TENANT).first();
     return {
-      total: stats.total || 0,
-      active: stats.active || 0,
-      inactive: stats.inactive || 0,
-      errors: stats.errors || 0,
+      total: stats?.total || 0,
+      active: stats?.active || 0,
+      inactive: stats?.inactive || 0,
+      errors: stats?.errors || 0,
       uninstalled: 0
     };
   }
   async installPlugin(pluginData) {
-    const id = pluginData.id || `plugin-${Date.now()}`;
+    const slug = pluginData.id || pluginData.name || `plugin-${Date.now()}`;
+    const docId = crypto.randomUUID();
     const now = Math.floor(Date.now() / 1e3);
-    const stmt = this.db.prepare(`
-      INSERT INTO plugins (
-        id, name, display_name, description, version, author, category, icon,
-        status, is_core, settings, permissions, dependencies, download_count, 
-        rating, installed_at, last_updated
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `);
-    await stmt.bind(
-      id,
-      pluginData.name || id,
+    const data = JSON.stringify({
+      name: slug,
+      displayName: pluginData.display_name || "Unnamed Plugin",
+      description: pluginData.description || "",
+      version: pluginData.version || "1.0.0",
+      author: pluginData.author || "Unknown",
+      category: pluginData.category || "utilities",
+      icon: pluginData.icon || "\u{1F50C}",
+      status: "active",
+      isCore: pluginData.is_core || false,
+      settings: pluginData.settings || {},
+      permissions: pluginData.permissions || [],
+      dependencies: pluginData.dependencies || [],
+      downloadCount: pluginData.download_count || 0,
+      rating: pluginData.rating || 0
+    });
+    await this.db.prepare(`
+      INSERT INTO documents (
+        id, root_id, type_id, version_number, is_current_draft, is_published, status,
+        parent_root_id, slug, title, tenant_id, locale, translation_group_id,
+        data, metadata, created_at, updated_at
+      ) VALUES (
+        ?, ?, ?, 1, 1, 1, 'published',
+        '', ?, ?, ?, 'default', '',
+        ?, '{}', ?, ?
+      )
+    `).bind(
+      docId,
+      docId,
+      TYPE_ID,
+      slug,
       pluginData.display_name || "Unnamed Plugin",
-      pluginData.description || "",
-      pluginData.version || "1.0.0",
-      pluginData.author || "Unknown",
-      pluginData.category || "utilities",
-      pluginData.icon || "\u{1F50C}",
-      "inactive",
-      pluginData.is_core || false,
-      JSON.stringify(pluginData.settings || {}),
-      JSON.stringify(pluginData.permissions || []),
-      JSON.stringify(pluginData.dependencies || []),
-      pluginData.download_count || 0,
-      pluginData.rating || 0,
+      TENANT,
+      data,
       now,
       now
     ).run();
-    await this.logActivity(id, "installed", null, { version: pluginData.version });
-    const installed = await this.getPlugin(id);
+    await this.logActivity(slug, "installed", null, { version: pluginData.version });
+    await this.logActivity(slug, "activated", null);
+    const installed = await this.getPlugin(slug);
     if (!installed) throw new Error("Failed to install plugin");
     return installed;
   }
+  /**
+   * Ensure a definePlugin-registered plugin exists in the DB with active status.
+   * No-op if already present. Used by admin routes to auto-register SDK plugins
+   * that have never been explicitly installed.
+   */
+  async ensurePlugin(id, data) {
+    const existing = await this.getPlugin(id);
+    if (existing) return existing;
+    return this.installPlugin({
+      id,
+      name: id,
+      display_name: data.displayName || id,
+      description: data.description || "",
+      author: data.author || "",
+      version: data.version || "1.0.0"
+    });
+  }
   async uninstallPlugin(pluginId) {
     const plugin = await this.getPlugin(pluginId);
     if (!plugin) throw new Error("Plugin not found");
     if (plugin.is_core) throw new Error("Cannot uninstall core plugins");
-    if (plugin.status === "active") {
-      await this.deactivatePlugin(pluginId);
-    }
-    const stmt = this.db.prepare("DELETE FROM plugins WHERE id = ?");
-    await stmt.bind(pluginId).run();
+    if (plugin.status === "active") await this.deactivatePlugin(pluginId);
+    const now = Math.floor(Date.now() / 1e3);
+    await this.db.prepare(`
+      UPDATE documents
+      SET deleted_at = ?, updated_at = ?, is_current_draft = 0, is_published = 0
+      WHERE slug = ? AND type_id = ? AND tenant_id = ? AND is_current_draft = 1
+    `).bind(now, now, pluginId, TYPE_ID, TENANT).run();
     await this.logActivity(pluginId, "uninstalled", null, { name: plugin.name });
   }
   async activatePlugin(pluginId) {
@@ -751,100 +544,128 @@ var PluginService = class {
       await this.checkDependencies(plugin.dependencies);
     }
     const now = Math.floor(Date.now() / 1e3);
-    const stmt = this.db.prepare(`
-      UPDATE plugins 
-      SET status = 'active', activated_at = ?, error_message = NULL 
-      WHERE id = ?
-    `);
-    await stmt.bind(now, pluginId).run();
+    await this.db.prepare(`
+      UPDATE documents
+      SET data = json_set(data, '$.status', 'active', '$.activatedAt', ?, '$.errorMessage', null),
+          updated_at = ?
+      WHERE slug = ? AND type_id = ? AND tenant_id = ? AND is_current_draft = 1 AND deleted_at IS NULL
+    `).bind(now, now, pluginId, TYPE_ID, TENANT).run();
+    await this.db.prepare(`UPDATE plugins SET status = 'active' WHERE id = ?`).bind(pluginId).run().catch(() => {
+    });
+    invalidateTenantCache();
     await this.logActivity(pluginId, "activated", null);
   }
   async deactivatePlugin(pluginId) {
     const plugin = await this.getPlugin(pluginId);
     if (!plugin) throw new Error("Plugin not found");
     await this.checkDependents(plugin.name);
-    const stmt = this.db.prepare(`
-      UPDATE plugins 
-      SET status = 'inactive', activated_at = NULL 
-      WHERE id = ?
-    `);
-    await stmt.bind(pluginId).run();
+    const now = Math.floor(Date.now() / 1e3);
+    await this.db.prepare(`
+      UPDATE documents
+      SET data = json_set(data, '$.status', 'inactive', '$.activatedAt', null),
+          updated_at = ?
+      WHERE slug = ? AND type_id = ? AND tenant_id = ? AND is_current_draft = 1 AND deleted_at IS NULL
+    `).bind(now, pluginId, TYPE_ID, TENANT).run();
+    await this.db.prepare(`UPDATE plugins SET status = 'inactive' WHERE id = ?`).bind(pluginId).run().catch(() => {
+    });
+    invalidateTenantCache();
     await this.logActivity(pluginId, "deactivated", null);
   }
   async updatePluginSettings(pluginId, settings) {
     const plugin = await this.getPlugin(pluginId);
     if (!plugin) throw new Error("Plugin not found");
-    const stmt = this.db.prepare(`
-      UPDATE plugins 
-      SET settings = ?, updated_at = unixepoch() 
-      WHERE id = ?
-    `);
-    await stmt.bind(JSON.stringify(settings), pluginId).run();
+    const now = Math.floor(Date.now() / 1e3);
+    await this.db.prepare(`
+      UPDATE documents
+      SET data = json_set(data, '$.settings', json(?)), updated_at = ?
+      WHERE slug = ? AND type_id = ? AND tenant_id = ? AND is_current_draft = 1 AND deleted_at IS NULL
+    `).bind(JSON.stringify(settings), now, pluginId, TYPE_ID, TENANT).run();
+    invalidateTenantCache();
     await this.logActivity(pluginId, "settings_updated", null);
   }
+  async updatePluginVersion(pluginId, patch) {
+    const now = Math.floor(Date.now() / 1e3);
+    await this.db.prepare(`
+      UPDATE documents
+      SET data = json_set(data,
+            '$.version', ?,
+            '$.description', ?,
+            '$.permissions', json(?),
+            '$.settings', json(?)
+          ),
+          updated_at = ?
+      WHERE slug = ? AND type_id = ? AND tenant_id = ? AND is_current_draft = 1 AND deleted_at IS NULL
+    `).bind(
+      patch.version,
+      patch.description,
+      JSON.stringify(patch.permissions),
+      JSON.stringify(patch.settings || {}),
+      now,
+      pluginId,
+      TYPE_ID,
+      TENANT
+    ).run();
+  }
   async setPluginError(pluginId, error) {
-    const stmt = this.db.prepare(`
-      UPDATE plugins 
-      SET status = 'error', error_message = ? 
-      WHERE id = ?
-    `);
-    await stmt.bind(error, pluginId).run();
+    const now = Math.floor(Date.now() / 1e3);
+    await this.db.prepare(`
+      UPDATE documents
+      SET data = json_set(data, '$.status', 'error', '$.errorMessage', ?),
+          updated_at = ?
+      WHERE slug = ? AND type_id = ? AND tenant_id = ? AND is_current_draft = 1 AND deleted_at IS NULL
+    `).bind(error, now, pluginId, TYPE_ID, TENANT).run();
     await this.logActivity(pluginId, "error", null, { error });
   }
   async getPluginActivity(pluginId, limit = 10) {
-    const stmt = this.db.prepare(`
-      SELECT * FROM plugin_activity_log 
-      WHERE plugin_id = ? 
-      ORDER BY timestamp DESC 
-      LIMIT ?
-    `);
-    const { results } = await stmt.bind(pluginId, limit).all();
-    return (results || []).map((row) => ({
-      id: row.id,
-      action: row.action,
-      userId: row.user_id,
-      details: row.details ? JSON.parse(row.details) : null,
-      timestamp: row.timestamp
-    }));
+    try {
+      const { results } = await this.db.prepare(`
+        SELECT id, data, created_at FROM documents
+        WHERE type_id = 'plugin_activity'
+          AND tenant_id = ?
+          AND is_current_draft = 1
+          AND deleted_at IS NULL
+          AND json_extract(data, '$.pluginId') = ?
+        ORDER BY created_at DESC
+        LIMIT ?
+      `).bind(TENANT, pluginId, limit).all();
+      return (results || []).map((row) => {
+        const d = typeof row.data === "string" ? JSON.parse(row.data) : row.data || {};
+        return {
+          id: row.id,
+          action: d.action,
+          userId: d.userId || null,
+          details: d.details || null,
+          timestamp: row.created_at
+        };
+      });
+    } catch {
+      return [];
+    }
   }
   async registerHook(pluginId, hookName, handlerName, priority = 10) {
     const id = `hook-${Date.now()}`;
-    const stmt = this.db.prepare(`
+    await this.db.prepare(`
       INSERT INTO plugin_hooks (id, plugin_id, hook_name, handler_name, priority)
       VALUES (?, ?, ?, ?, ?)
-    `);
-    await stmt.bind(id, pluginId, hookName, handlerName, priority).run();
+    `).bind(id, pluginId, hookName, handlerName, priority).run();
   }
   async registerRoute(pluginId, path, method, handlerName, middleware) {
     const id = `route-${Date.now()}`;
-    const stmt = this.db.prepare(`
+    await this.db.prepare(`
       INSERT INTO plugin_routes (id, plugin_id, path, method, handler_name, middleware)
       VALUES (?, ?, ?, ?, ?, ?)
-    `);
-    await stmt.bind(
-      id,
-      pluginId,
-      path,
-      method,
-      handlerName,
-      JSON.stringify(middleware || [])
-    ).run();
+    `).bind(id, pluginId, path, method, handlerName, JSON.stringify(middleware || [])).run();
   }
   async getPluginHooks(pluginId) {
-    const stmt = this.db.prepare(`
-      SELECT * FROM plugin_hooks 
-      WHERE plugin_id = ? AND is_active = TRUE
-      ORDER BY priority ASC
-    `);
-    const { results } = await stmt.bind(pluginId).all();
+    const { results } = await this.db.prepare(`
+      SELECT * FROM plugin_hooks WHERE plugin_id = ? AND is_active = TRUE ORDER BY priority ASC
+    `).bind(pluginId).all();
     return results || [];
   }
   async getPluginRoutes(pluginId) {
-    const stmt = this.db.prepare(`
-      SELECT * FROM plugin_routes 
-      WHERE plugin_id = ? AND is_active = TRUE
-    `);
-    const { results } = await stmt.bind(pluginId).all();
+    const { results } = await this.db.prepare(`
+      SELECT * FROM plugin_routes WHERE plugin_id = ? AND is_active = TRUE
+    `).bind(pluginId).all();
     return results || [];
   }
   async checkDependencies(dependencies) {
@@ -856,55 +677,61 @@ var PluginService = class {
     }
   }
   async checkDependents(pluginName) {
-    const stmt = this.db.prepare(`
-      SELECT id, display_name FROM plugins 
-      WHERE status = 'active' 
-      AND dependencies LIKE ?
-    `);
-    const { results } = await stmt.bind(`%"${pluginName}"%`).all();
+    const { results } = await this.db.prepare(`
+      SELECT slug, title FROM documents
+      WHERE type_id = ? AND tenant_id = ? AND is_current_draft = 1 AND deleted_at IS NULL
+        AND q_plugin_status = 'active'
+        AND json_extract(data, '$.dependencies') LIKE ?
+    `).bind(TYPE_ID, TENANT, `%"${pluginName}"%`).all();
     if (results && results.length > 0) {
-      const names = results.map((p) => p.display_name).join(", ");
+      const names = results.map((p) => p.title || p.slug).join(", ");
       throw new Error(`Cannot deactivate. The following plugins depend on this one: ${names}`);
     }
   }
   async logActivity(pluginId, action, userId, details) {
-    const id = `activity-${Date.now()}`;
-    const stmt = this.db.prepare(`
-      INSERT INTO plugin_activity_log (id, plugin_id, action, user_id, details)
-      VALUES (?, ?, ?, ?, ?)
-    `);
-    await stmt.bind(
-      id,
-      pluginId,
-      action,
-      userId,
-      details ? JSON.stringify(details) : null
-    ).run();
-  }
-  mapPluginFromDb(row) {
-    return {
-      id: row.id,
-      name: row.name,
-      display_name: row.display_name,
-      description: row.description,
-      version: row.version,
-      author: row.author,
-      category: row.category,
-      icon: row.icon,
-      status: row.status,
-      is_core: row.is_core === 1,
-      settings: row.settings ? JSON.parse(row.settings) : void 0,
-      permissions: row.permissions ? JSON.parse(row.permissions) : void 0,
-      dependencies: row.dependencies ? JSON.parse(row.dependencies) : void 0,
-      download_count: row.download_count || 0,
-      rating: row.rating || 0,
-      installed_at: row.installed_at,
-      activated_at: row.activated_at,
-      last_updated: row.last_updated,
-      error_message: row.error_message
-    };
+    try {
+      const docId = crypto.randomUUID();
+      const now = Math.floor(Date.now() / 1e3);
+      const data = JSON.stringify({ pluginId, action, userId, details: details || null });
+      await this.db.prepare(`
+        INSERT INTO documents (
+          id, root_id, type_id, version_number, is_current_draft, is_published, status,
+          parent_root_id, slug, title, tenant_id, locale, translation_group_id,
+          data, metadata, created_at, updated_at
+        ) VALUES (
+          ?, ?, 'plugin_activity', 1, 1, 1, 'published',
+          '', ?, ?, 'default', 'default', '',
+          ?, '{}', ?, ?
+        )
+      `).bind(docId, docId, docId, action, data, now, now).run();
+    } catch {
+    }
   }
 };
+function mapDocumentToPlugin(row) {
+  const data = typeof row.data === "string" ? JSON.parse(row.data) : row.data || {};
+  return {
+    id: row.slug || data.name || row.root_id,
+    name: data.name || row.slug || "",
+    display_name: data.displayName || row.title || "",
+    description: data.description || "",
+    version: data.version || "1.0.0",
+    author: data.author || "Unknown",
+    category: data.category || "utilities",
+    icon: data.icon || "\u{1F50C}",
+    status: data.status || "inactive",
+    is_core: data.isCore === true || data.isCore === 1,
+    settings: data.settings,
+    permissions: data.permissions,
+    dependencies: data.dependencies,
+    download_count: data.downloadCount || 0,
+    rating: data.rating || 0,
+    installed_at: row.created_at,
+    activated_at: data.activatedAt || void 0,
+    last_updated: row.updated_at,
+    error_message: data.errorMessage || void 0
+  };
+}
 
 // src/plugins/manifest-registry.ts
 var PLUGIN_REGISTRY = {
@@ -941,23 +768,6 @@ var PLUGIN_REGISTRY = {
       "order": 50
     }
   },
-  "code-examples-plugin": {
-    "id": "code-examples-plugin",
-    "codeName": "code-examples-plugin",
-    "displayName": "Code Examples",
-    "description": "Code snippets and examples library with syntax highlighting and categorization",
-    "version": "1.0.0-beta.1",
-    "author": "SonicJS Team",
-    "category": "content",
-    "iconEmoji": "\u{1F4BB}",
-    "is_core": false,
-    "permissions": [
-      "code-examples:manage"
-    ],
-    "dependencies": [],
-    "defaultSettings": {},
-    "adminMenu": null
-  },
   "core-analytics": {
     "id": "core-analytics",
     "codeName": "core-analytics",
@@ -1011,12 +821,6 @@ var PLUGIN_REGISTRY = {
           "label": "Password",
           "type": "password"
         },
-        "username": {
-          "required": true,
-          "minLength": 3,
-          "label": "Username",
-          "type": "text"
-        },
         "firstName": {
           "required": true,
           "minLength": 1,
@@ -1032,7 +836,6 @@ var PLUGIN_REGISTRY = {
       },
       "validation": {
         "emailFormat": true,
-        "allowDuplicateUsernames": false,
         "passwordRequirements": {
           "requireUppercase": false,
           "requireLowercase": false,
@@ -1058,6 +861,7 @@ var PLUGIN_REGISTRY = {
     "category": "system",
     "iconEmoji": "\u26A1",
     "is_core": true,
+    "defaultActive": true,
     "permissions": [
       "cache.view",
       "cache.clear",
@@ -1070,7 +874,12 @@ var PLUGIN_REGISTRY = {
       "enableDatabaseCache": true,
       "defaultTTL": 3600
     },
-    "adminMenu": null
+    "adminMenu": {
+      "label": "Cache",
+      "icon": "server",
+      "path": "/admin/cache",
+      "order": 60
+    }
   },
   "core-media": {
     "id": "core-media",
@@ -1104,7 +913,7 @@ var PLUGIN_REGISTRY = {
     "author": "SonicJS Team",
     "category": "development",
     "iconEmoji": "\u{1F5C4}\uFE0F",
-    "is_core": false,
+    "is_core": true,
     "permissions": [
       "database:admin"
     ],
@@ -1138,32 +947,6 @@ var PLUGIN_REGISTRY = {
     },
     "adminMenu": null
   },
-  "design": {
-    "id": "design",
-    "codeName": "design",
-    "displayName": "Design System",
-    "description": "Design system management including themes, components, and UI customization. Provides a visual interface for managing design tokens, typography, colors, and component library.",
-    "version": "1.0.0-beta.1",
-    "author": "SonicJS",
-    "category": "utilities",
-    "iconEmoji": "\u{1F3A8}",
-    "is_core": false,
-    "permissions": [
-      "design.view",
-      "design.edit"
-    ],
-    "dependencies": [],
-    "defaultSettings": {
-      "defaultTheme": "light",
-      "customCSS": ""
-    },
-    "adminMenu": {
-      "label": "Design",
-      "icon": "palette",
-      "path": "/admin/design",
-      "order": 80
-    }
-  },
   "easy-mdx": {
     "id": "easy-mdx",
     "codeName": "easy-mdx",
@@ -1188,12 +971,12 @@ var PLUGIN_REGISTRY = {
     "id": "email",
     "codeName": "email",
     "displayName": "Email",
-    "description": "Send transactional emails using Resend",
-    "version": "1.0.0-beta.1",
+    "description": "Send transactional emails via Cloudflare Email Service. Subscribes to auth lifecycle events (welcome, password reset, password changed) and runs a 5-minute reconciliation cron against the CF GraphQL Activity Log.",
+    "version": "1.0.0",
     "author": "SonicJS Team",
     "category": "utilities",
     "iconEmoji": "\u{1F4E7}",
-    "is_core": false,
+    "is_core": true,
     "permissions": [
       "email:manage",
       "email:send",
@@ -1201,19 +984,45 @@ var PLUGIN_REGISTRY = {
     ],
     "dependencies": [],
     "defaultSettings": {
-      "apiKey": "",
+      "provider": "cloudflare",
+      "resendApiKey": "",
       "fromEmail": "",
       "fromName": "",
       "replyTo": "",
-      "logoUrl": ""
+      "logoUrl": "",
+      "cfAccountId": "",
+      "cfEmailApiToken": ""
     },
     "adminMenu": {
       "label": "Email",
       "icon": "envelope",
-      "path": "/admin/plugins/email/settings",
+      "path": "/admin/plugins/email",
       "order": 80
     }
   },
+  "forms": {
+    "id": "forms",
+    "codeName": "forms",
+    "displayName": "Forms",
+    "description": "Form builder with Form.io integration, Turnstile CAPTCHA support, and submission management",
+    "version": "1.0.0",
+    "author": "SonicJS Team",
+    "category": "content",
+    "iconEmoji": "\u{1F4CB}",
+    "is_core": true,
+    "permissions": [
+      "forms:manage",
+      "forms:view"
+    ],
+    "dependencies": [],
+    "defaultSettings": {},
+    "adminMenu": {
+      "label": "Forms",
+      "icon": "document-text",
+      "path": "/admin/forms",
+      "order": 30
+    }
+  },
   "global-variables": {
     "id": "global-variables",
     "codeName": "global-variables",
@@ -1263,6 +1072,31 @@ var PLUGIN_REGISTRY = {
       "order": 90
     }
   },
+  "lexical-editor": {
+    "id": "lexical-editor",
+    "codeName": "lexical-editor",
+    "displayName": "Lexical Rich Text Editor",
+    "description": "Lexical editor integration for rich text editing. Default rich text editor for SonicJS \u2014 on by default for greenfield installs.",
+    "version": "1.0.0",
+    "author": "SonicJS Team",
+    "category": "editor",
+    "iconEmoji": "\u{1F4DD}",
+    "is_core": true,
+    "defaultActive": true,
+    "permissions": [],
+    "dependencies": [],
+    "defaultSettings": {
+      "defaultHeight": 300,
+      "defaultToolbar": "standard",
+      "placeholder": "Enter content..."
+    },
+    "adminMenu": {
+      "label": "Lexical Editor",
+      "icon": "pencil-square",
+      "path": "/admin/plugins/lexical-editor",
+      "order": 80
+    }
+  },
   "magic-link-auth": {
     "id": "magic-link-auth",
     "codeName": "magic-link-auth",
@@ -1284,6 +1118,33 @@ var PLUGIN_REGISTRY = {
     },
     "adminMenu": null
   },
+  "multi-tenant": {
+    "id": "multi-tenant",
+    "codeName": "multi-tenant",
+    "displayName": "Multi-Tenant",
+    "description": "Multi-tenancy for the document model: tenant registry, per-request tenant resolution (header, admin switcher cookie, or domain), and tenant-scoped content isolation. Off by default.",
+    "version": "1.0.0",
+    "author": "SonicJS Team",
+    "category": "utilities",
+    "iconEmoji": "\u{1F3E2}",
+    "is_core": false,
+    "permissions": [
+      "tenants.manage",
+      "tenants.view"
+    ],
+    "dependencies": [],
+    "defaultSettings": {
+      "headerName": "X-Tenant-Id",
+      "subdomainResolution": false,
+      "rootDomain": ""
+    },
+    "adminMenu": {
+      "label": "Tenants",
+      "icon": "building-office",
+      "path": "/admin/tenants",
+      "order": 80
+    }
+  },
   "oauth-providers": {
     "id": "oauth-providers",
     "codeName": "oauth-providers",
@@ -1440,27 +1301,6 @@ var PLUGIN_REGISTRY = {
       "order": 85
     }
   },
-  "seed-data": {
-    "id": "seed-data",
-    "codeName": "seed-data",
-    "displayName": "Seed Data Generator",
-    "description": "Development tool for generating sample data and testing content. Useful for demos and development environments",
-    "version": "1.0.0-beta.1",
-    "author": "SonicJS Team",
-    "category": "development",
-    "iconEmoji": "\u{1F331}",
-    "is_core": false,
-    "permissions": [
-      "seed-data:generate"
-    ],
-    "dependencies": [],
-    "defaultSettings": {
-      "userCount": 20,
-      "contentCount": 200,
-      "defaultPassword": "password123"
-    },
-    "adminMenu": null
-  },
   "shortcodes": {
     "id": "shortcodes",
     "codeName": "shortcodes",
@@ -1513,23 +1353,6 @@ var PLUGIN_REGISTRY = {
       "order": 90
     }
   },
-  "testimonials-plugin": {
-    "id": "testimonials-plugin",
-    "codeName": "testimonials-plugin",
-    "displayName": "Testimonials",
-    "description": "Customer testimonials and reviews management with display widgets and ratings",
-    "version": "1.0.0-beta.1",
-    "author": "SonicJS Team",
-    "category": "content",
-    "iconEmoji": "\u{1F4AC}",
-    "is_core": false,
-    "permissions": [
-      "testimonials:manage"
-    ],
-    "dependencies": [],
-    "defaultSettings": {},
-    "adminMenu": null
-  },
   "tinymce-plugin": {
     "id": "tinymce-plugin",
     "codeName": "tinymce-plugin",
@@ -1598,27 +1421,19 @@ var PLUGIN_REGISTRY = {
     "defaultSettings": {},
     "adminMenu": null
   },
-  "workflow-plugin": {
-    "id": "workflow-plugin",
-    "codeName": "workflow-plugin",
-    "displayName": "Workflow Engine",
-    "description": "Content workflow and approval system with customizable states, transitions, and review processes",
-    "version": "1.0.0-beta.1",
+  "versioning": {
+    "id": "versioning",
+    "codeName": "versioning",
+    "displayName": "Versioning",
+    "description": "View and restore content version history for types with versioning enabled.",
+    "version": "1.0.0",
     "author": "SonicJS Team",
     "category": "content",
-    "iconEmoji": "\u{1F504}",
-    "is_core": false,
-    "permissions": [
-      "workflow:manage",
-      "workflow:approve"
-    ],
+    "iconEmoji": "\u{1F551}",
+    "is_core": true,
+    "permissions": [],
     "dependencies": [],
-    "defaultSettings": {
-      "enableApprovalChains": true,
-      "enableScheduling": true,
-      "enableAutomation": true,
-      "enableNotifications": true
-    },
+    "defaultSettings": {},
     "adminMenu": null
   }
 };
@@ -1633,17 +1448,8 @@ function findPluginByCodeName(codeName) {
 // src/services/plugin-bootstrap.ts
 var BOOTSTRAP_PLUGIN_IDS = [
   "core-auth",
-  "core-media",
-  "database-tools",
-  "seed-data",
-  "core-cache",
-  "workflow-plugin",
-  "easy-mdx",
-  "ai-search",
-  "oauth-providers",
-  "global-variables",
-  "user-profiles",
-  "stripe"
+  // Collect any registry entries marked defaultActive (e.g. lexical-editor)
+  ...Object.values(PLUGIN_REGISTRY).filter((e) => e.defaultActive === true && e.id !== "core-auth").map((e) => e.id)
 ];
 function registryToCorePlugin(entry) {
   return {
@@ -1668,9 +1474,10 @@ var PluginBootstrapService = class {
   pluginService;
   /**
    * Core plugins derived from the auto-generated plugin registry.
-   * Only plugins listed in BOOTSTRAP_PLUGIN_IDS are included.
+   * Only plugins listed in BOOTSTRAP_PLUGIN_IDS AND marked is_core=true are auto-installed.
+   * Non-core plugins are available in the registry but not bootstrapped.
    */
-  CORE_PLUGINS = BOOTSTRAP_PLUGIN_IDS.filter((id) => PLUGIN_REGISTRY[id] !== void 0).map((id) => registryToCorePlugin(PLUGIN_REGISTRY[id]));
+  CORE_PLUGINS = BOOTSTRAP_PLUGIN_IDS.filter((id) => PLUGIN_REGISTRY[id] !== void 0 && PLUGIN_REGISTRY[id].is_core === true).map((id) => registryToCorePlugin(PLUGIN_REGISTRY[id]));
   /**
    * Bootstrap all core plugins - install them if they don't exist
    */
@@ -1731,28 +1538,15 @@ var PluginBootstrapService = class {
     }
   }
   /**
-   * Update an existing plugin
+   * Update an existing plugin's version/description/permissions/settings
    */
   async updatePlugin(plugin) {
-    const now = Math.floor(Date.now() / 1e3);
-    const stmt = this.db.prepare(`
-      UPDATE plugins
-      SET
-        version = ?,
-        description = ?,
-        permissions = ?,
-        settings = ?,
-        last_updated = ?
-      WHERE id = ?
-    `);
-    await stmt.bind(
-      plugin.version,
-      plugin.description,
-      JSON.stringify(plugin.permissions),
-      JSON.stringify(plugin.settings || {}),
-      now,
-      plugin.id
-    ).run();
+    await this.pluginService.updatePluginVersion(plugin.id, {
+      version: plugin.version,
+      description: plugin.description,
+      permissions: plugin.permissions,
+      settings: plugin.settings || {}
+    });
   }
   /**
    * Check if bootstrap is needed (first run detection)
@@ -1778,6 +1572,6 @@ var PluginBootstrapService = class {
   }
 };
 
-export { PLUGIN_REGISTRY, PluginBootstrapService, PluginService, backfillFormSubmissions, cleanupRemovedCollections, createContentFromSubmission, deriveCollectionSchemaFromFormio, deriveSubmissionTitle, findPluginByCodeName, fullCollectionSync, getAvailableCollectionNames, getManagedCollections, isCollectionManaged, loadCollectionConfig, loadCollectionConfigs, mapFormStatusToContentStatus, registerCollections, syncAllFormCollections, syncCollection, syncCollections, syncFormCollection, validateCollectionConfig };
-//# sourceMappingURL=chunk-JZV22DEV.js.map
-//# sourceMappingURL=chunk-JZV22DEV.js.map
+export { CollectionRegistry, MULTI_TENANT_PLUGIN_ID, PLUGIN_REGISTRY, PluginBootstrapService, PluginService, TENANT_COOKIE, collectionRecordToRow, findPluginByCodeName, getAvailableCollectionNames, getCollectionRegistry, getVisibleCollections, invalidateTenantCache, isCodeCollectionInternal, isDbDocTypeInternal, loadCollectionConfig, loadCollectionConfigs, registerCollections, resetCollectionRegistry, tenantMiddleware, validateCollectionConfig };
+//# sourceMappingURL=chunk-ZGGXCFR6.js.map
+//# sourceMappingURL=chunk-ZGGXCFR6.js.map