@sonicjs-cms/core 2.19.0 → 3.0.0-beta.2

package/dist/index.d.ts

@@ -1,521 +1,360 @@
-export { B as Bindings, a as SonicJSApp, S as SonicJSConfig, V as Variables, c as createSonicJSApp, s as setupCoreMiddleware, b as setupCoreRoutes } from './app-C9esKLmh.js';
-import { B as schema } from './plugin-bootstrap-P_ciLp_C.js';
-export { D as Collection, E as Content, C as CorePlugin, F as DbPlugin, G as DbPluginHook, L as LogCategory, H as LogConfig, a as LogEntry, b as LogFilter, c as LogLevel, d as Logger, I as Media, M as Migration, e as MigrationService, f as MigrationStatus, N as NewCollection, J as NewContent, K as NewLogConfig, O as NewMedia, Q as NewPlugin, R as NewPluginActivityLog, S as NewPluginAsset, T as NewPluginHook, U as NewPluginRoute, V as NewSystemLog, W as NewUser, X as NewWorkflowHistory, Y as PluginActivityLog, Z as PluginAsset, P as PluginBootstrapService, _ as PluginRoute, g as PluginServiceClass, $ as SystemLog, a0 as User, a1 as WorkflowHistory, a2 as apiTokens, h as backfillFormSubmissions, i as cleanupRemovedCollections, a3 as collections, a4 as content, a5 as contentVersions, j as createContentFromSubmission, k as deriveCollectionSchemaFromFormio, l as deriveSubmissionTitle, m as fullCollectionSync, n as getAvailableCollectionNames, o as getLogger, p as getManagedCollections, q as initLogger, a6 as insertCollectionSchema, a7 as insertContentSchema, a8 as insertLogConfigSchema, a9 as insertMediaSchema, aa as insertPluginActivityLogSchema, ab as insertPluginAssetSchema, ac as insertPluginHookSchema, ad as insertPluginRouteSchema, ae as insertPluginSchema, af as insertSystemLogSchema, ag as insertUserSchema, ah as insertWorkflowHistorySchema, r as isCollectionManaged, s as loadCollectionConfig, t as loadCollectionConfigs, ai as logConfig, u as mapFormStatusToContentStatus, aj as media, ak as pluginActivityLog, al as pluginAssets, am as pluginHooks, an as pluginRoutes, ao as plugins, v as registerCollections, ap as selectCollectionSchema, aq as selectContentSchema, ar as selectLogConfigSchema, as as selectMediaSchema, at as selectPluginActivityLogSchema, au as selectPluginAssetSchema, av as selectPluginHookSchema, aw as selectPluginRouteSchema, ax as selectPluginSchema, ay as selectSystemLogSchema, az as selectUserSchema, aA as selectWorkflowHistorySchema, w as syncAllFormCollections, x as syncCollection, y as syncCollections, z as syncFormCollection, aB as systemLogs, aC as users, A as validateCollectionConfig, aD as workflowHistory } from './plugin-bootstrap-P_ciLp_C.js';
+export { B as Bindings, a as BootIsolateFn, b as SonicJSApp, S as SonicJSConfig, V as Variables, c as createSonicJSApp, s as setupCoreMiddleware, d as setupCoreRoutes } from './app-Bo0X1OWX.js';
+import { o as DefinedPlugin } from './define-plugin-BzNHc1ZI.js';
+export { B as BooleanField, e as ConfigSchema, f as ConfigSchemaField, h as CronContext, i as CronDeclaration, j as CronDispatchResult, k as CronTickEvent, l as CronablePlugin, H as HookSystemImpl, r as HookUtils, N as NumberField, P as ParsedField, v as PluginManagerClass, an as PluginMenuEntry, x as PluginRegistryImpl, y as PluginValidatorClass, z as PluginsRegistry, A as RegisterPluginsError, G as RegisterPluginsErrorReason, I as RegisterPluginsHostContext, J as RegisterablePlugin, K as RegistryEntry, ao as ResolvedPluginMenuEntry, L as ScopedHookSystemClass, O as SelectField, Q as SettingsFor, U as StringField, Y as applySchemaDefaults, _ as collectCronSchedules, $ as collectCrons, a2 as createScheduledHandler, a3 as definePlugin, a4 as dispatchCronTick, a5 as getHookSystem, ap as getPluginMenu, a6 as getTypedHooks, a8 as hasHookSystem, a9 as isDefinedPlugin, ae as parseConfigSchema, af as parseFormDataToSettings, ah as registerPlugins, ai as renderSchemaFields, aj as resetHookSystem, aq as resetPluginMenu, ar as resolvePluginMenuItems, ak as setHookSystem, as as setPluginMenu } from './define-plugin-BzNHc1ZI.js';
+import { D1Database as D1Database$1 } from '@cloudflare/workers-types';
+import { E as EmailProvider, N as NormalizedEmailMessage, q as SendResult } from './types-Dea1eNxU.js';
+export { s as EmailLogRow } from './types-Dea1eNxU.js';
+import { s as schema } from './plugin-bootstrap-qu8hJgUt.js';
+export { m as Content, C as CorePlugin, n as DbPlugin, o as DbPluginHook, L as LogCategory, p as LogConfig, a as LogEntry, b as LogFilter, c as LogLevel, d as Logger, q as Media, M as Migration, e as MigrationService, f as MigrationStatus, N as NewContent, t as NewLogConfig, u as NewMedia, w as NewPlugin, x as NewPluginActivityLog, y as NewPluginAsset, z as NewPluginHook, A as NewPluginRoute, B as NewSystemLog, D as NewUser, E as NewWorkflowHistory, F as PluginActivityLog, G as PluginAsset, P as PluginBootstrapService, H as PluginRoute, g as PluginServiceClass, S as SystemLog, U as User, W as WorkflowHistory, I as apiTokens, J as content, K as contentVersions, h as getAvailableCollectionNames, i as getLogger, j as initLogger, O as insertContentSchema, Q as insertLogConfigSchema, R as insertMediaSchema, T as insertPluginActivityLogSchema, V as insertPluginAssetSchema, X as insertPluginHookSchema, Y as insertPluginRouteSchema, Z as insertPluginSchema, _ as insertSystemLogSchema, $ as insertUserSchema, a0 as insertWorkflowHistorySchema, l as loadCollectionConfig, k as loadCollectionConfigs, a1 as logConfig, a2 as media, a3 as pluginActivityLog, a4 as pluginAssets, a5 as pluginHooks, a6 as pluginRoutes, a7 as plugins, r as registerCollections, a8 as selectContentSchema, a9 as selectLogConfigSchema, aa as selectMediaSchema, ab as selectPluginActivityLogSchema, ac as selectPluginAssetSchema, ad as selectPluginHookSchema, ae as selectPluginRouteSchema, af as selectPluginSchema, ag as selectSystemLogSchema, ah as selectUserSchema, ai as selectWorkflowHistorySchema, aj as systemLogs, ak as users, v as validateCollectionConfig, al as workflowHistory } from './plugin-bootstrap-qu8hJgUt.js';
+import { e as FieldType } from './collection-config-JgHOpFCG.js';
+export { C as CollectionConfig, b as CollectionConfigModule, c as CollectionSchema, d as CollectionSyncResult, F as FieldConfig } from './collection-config-JgHOpFCG.js';
 export { AuthManager, Permission, PermissionManager, UserPermissions, bootstrapMiddleware, cacheHeaders, compressionMiddleware, detailedLoggingMiddleware, getActivePlugins, isPluginActive, logActivity, loggingMiddleware, optionalAuth, performanceLoggingMiddleware, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeaders, securityLoggingMiddleware } from './middleware.js';
-export { H as HookSystemImpl, a as HookUtils, P as PluginManagerClass, b as PluginRegistryImpl, c as PluginValidatorClass, S as ScopedHookSystemClass } from './plugin-manager-Efx9RyDX.js';
-export { ROUTES_INFO, adminApiRoutes, adminCheckboxRoutes, adminCodeExamplesRoutes, adminCollectionsRoutes, adminContentRoutes, adminDashboardRoutes, adminDesignRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, adminTestimonialsRoutes, adminUsersRoutes, apiContentCrudRoutes, apiMediaRoutes, apiRoutes, apiSystemRoutes, authRoutes } from './routes.js';
+export { ROUTES_INFO, adminApiRoutes, adminCheckboxRoutes, adminCollectionsRoutes, adminContentRoutes, adminDashboardRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, adminUsersRoutes, apiContentCrudRoutes, apiMediaRoutes, apiRoutes, apiSystemRoutes, authRoutes } from './routes.js';
 export { A as AlertData, C as ConfirmationDialogOptions, F as Filter, a as FilterBarData, b as FilterOption, c as FormData, d as FormField, P as PaginationData, T as TableColumn, e as TableData, g as getConfirmationDialogScript, r as renderAlert, f as renderConfirmationDialog, h as renderFilterBar, i as renderForm, j as renderFormField, k as renderPagination, l as renderTable } from './filter-bar.template-DlVYMk-T.js';
-import { e as FieldType } from './collection-config-B4PG-AaF.js';
-export { C as CollectionConfig, b as CollectionConfigModule, c as CollectionSchema, d as CollectionSyncResult, F as FieldConfig } from './collection-config-B4PG-AaF.js';
 export { A as AuthService, C as ContentService, H as HOOKS, a as HookContext, b as HookHandler, c as HookName, d as HookSystem, M as MediaService, P as Plugin, f as PluginAdminPage, g as PluginBuilderOptions, h as PluginComponent, i as PluginConfig, j as PluginContext, k as PluginHook, l as PluginLogger, m as PluginManager, n as PluginMenuItem, o as PluginMiddleware, p as PluginModel, q as PluginRegistry, r as PluginRoutes, s as PluginService, t as PluginStatus, u as PluginValidationResult, v as PluginValidator, S as ScopedHookSystem } from './plugin-DDYetMF-.js';
 export { P as PluginManifest } from './plugin-manifest-Dpy8wxIB.js';
 export { F as FilterCondition, a as FilterGroup, b as FilterOperator, Q as QueryFilter, c as QueryFilterBuilder, d as QueryResult, S as SONICJS_VERSION, T as TemplateRenderer, e as buildQuery, f as escapeHtml, g as getCoreVersion, m as metricsTracker, r as renderTemplate, s as sanitizeInput, h as sanitizeObject, t as templateRenderer } from './version-DFTyGfIH.js';
 import * as drizzle_orm_d1 from 'drizzle-orm/d1';
-import { Hono, MiddlewareHandler, Context } from 'hono';
-import { z } from 'zod';
-import { D1Database as D1Database$1, KVNamespace, R2Bucket } from '@cloudflare/workers-types';
+import 'better-auth/client';
+import 'better-auth/plugins/email-otp';
+import 'better-auth';
+import 'better-auth/plugins/magic-link';
+import 'better-call';
+import 'zod/v4/core';
+import 'zod';
+import 'hono';
 import 'drizzle-zod';
 import 'drizzle-orm/sqlite-core';
 import 'hono/types';
 
 /**
- * SonicJS Plugin System Types
+ * Wrangler.toml [triggers] cron codegen
  *
- * Defines the core interfaces and types for the plugin system
+ * Cloudflare Workers cron triggers are deploy-time static — they must be listed
+ * in `wrangler.toml` at deploy time and cannot be changed at runtime. This module
+ * provides utilities to generate and validate the `[triggers]` section from the
+ * plugin list, so the file stays in sync with declared plugin crons.
+ *
+ * Usage in a codegen script:
+ *
+ *   const schedules = collectCronSchedules(allPlugins)
+ *   const updated = updateWranglerTriggers(tomlContent, schedules)
+ *   writeFileSync('wrangler.toml', updated, 'utf8')
+ *
+ * Usage in a CI guard test:
+ *
+ *   const actual = parseCronTriggers(tomlContent)
+ *   const expected = collectCronSchedules(allPlugins)
+ *   expect(actual).toEqual(expected.sort())
  */
 
-interface Plugin {
-    /** Unique plugin identifier */
-    name: string;
-    /** Plugin version (semantic versioning) */
-    version: string;
-    /** Human-readable description */
-    description?: string;
-    /** Plugin author information */
-    author?: {
-        name: string;
-        email?: string;
-        url?: string;
-    };
-    /** Plugin dependencies (other plugins required) */
-    dependencies?: string[];
-    /** SonicJS version compatibility */
-    compatibility?: string;
-    /** Plugin license */
-    license?: string;
-    routes?: PluginRoutes[];
-    middleware?: PluginMiddleware[];
-    models?: PluginModel[];
-    services?: PluginService[];
-    adminPages?: PluginAdminPage[];
-    adminComponents?: PluginComponent[];
-    menuItems?: PluginMenuItem[];
-    hooks?: PluginHook[];
-    install?: (context: PluginContext) => Promise<void>;
-    uninstall?: (context: PluginContext) => Promise<void>;
-    activate?: (context: PluginContext) => Promise<void>;
-    deactivate?: (context: PluginContext) => Promise<void>;
-    configure?: (config: PluginConfig) => Promise<void>;
-}
-interface PluginContext {
-    /** Database instance */
-    db: D1Database$1;
-    /** Key-value storage */
-    kv: KVNamespace;
-    /** R2 storage bucket */
-    r2?: R2Bucket;
-    /** Plugin configuration */
-    config: PluginConfig;
-    /** Core SonicJS services */
-    services: {
-        auth: AuthService;
-        content: ContentService;
-        media: MediaService;
-    };
-    /** Hook system for inter-plugin communication */
-    hooks: HookSystem | ScopedHookSystem;
-    /** Logging utilities */
-    logger: PluginLogger;
-}
-interface PluginConfig {
-    /** Plugin-specific configuration */
-    [key: string]: any;
-    /** Whether plugin is enabled */
-    enabled: boolean;
-    /** Plugin installation timestamp */
-    installedAt?: number;
-    /** Plugin last update timestamp */
-    updatedAt?: number;
-}
-interface PluginRoutes {
-    /** Route path prefix */
-    path: string;
-    /** Hono route handler */
-    handler: Hono;
-    /** Route description */
-    description?: string;
-    /** Whether route requires authentication */
-    requiresAuth?: boolean;
-    /** Required roles for access */
-    roles?: string[];
-    /** Route priority (for ordering) */
-    priority?: number;
-}
-interface PluginMiddleware {
-    /** Middleware name */
-    name: string;
-    /** Middleware handler function */
-    handler: MiddlewareHandler;
-    /** Middleware description */
-    description?: string;
-    /** Middleware priority (lower = earlier) */
-    priority?: number;
-    /** Routes to apply middleware to */
-    routes?: string[];
-    /** Whether to apply globally */
-    global?: boolean;
-}
-interface PluginModel {
-    /** Model name */
-    name: string;
-    /** Database table name */
-    tableName: string;
-    /** Zod schema for validation */
-    schema: z.ZodSchema;
-    /** Database migrations */
-    migrations: string[];
-    /** Model relationships */
-    relationships?: ModelRelationship[];
-    /** Whether model extends core content */
-    extendsContent?: boolean;
-}
-interface ModelRelationship {
-    type: 'oneToOne' | 'oneToMany' | 'manyToMany';
-    target: string;
-    foreignKey?: string;
-    joinTable?: string;
+/**
+ * Parse the cron trigger expressions from a `wrangler.toml` file.
+ * Returns an array of cron strings found under `[triggers]`, sorted.
+ */
+declare function parseCronTriggers(tomlContent: string): string[];
+/**
+ * Update the `[triggers] crons` section in a wrangler.toml string.
+ *
+ * If the `[triggers]` section exists, replaces its `crons` line.
+ * If it does not exist and schedules is non-empty, appends it.
+ * If schedules is empty, removes the section entirely.
+ *
+ * Returns the updated toml content.
+ */
+declare function updateWranglerTriggers(tomlContent: string, schedules: string[]): string;
+/**
+ * Generate a wrangler.toml cron trigger comment block for documentation.
+ */
+declare function generateTriggersComment(schedules: string[]): string;
+
+/**
+ * Dependency-aware plugin ordering (topo-sort + cycle detection).
+ *
+ * Plugins declare `dependencies: ['other-plugin-id']`. This module produces a
+ * dependency-first order — so a plugin that depends on another is mounted and
+ * wired AFTER the dependency, not before. Today the `dependencies` field is
+ * inert (plugins are mounted/wired in declaration order). This makes it real.
+ *
+ * Reference: Infowall `register-plugins.ts` `topoSort`. The algorithm is the
+ * same iterative DFS with a `visiting` stack that Infowall uses, adapted to
+ * the structural plugin shape used here.
+ */
+/** Thrown when `topoSort` detects a dependency cycle. */
+declare class PluginDependencyCycleError extends Error {
+    readonly cycle: string[];
+    constructor(pluginId: string, visitStack: string[]);
 }
-interface PluginService {
-    /** Service name */
-    name: string;
-    /** Service implementation */
-    implementation: any;
-    /** Service description */
-    description?: string;
-    /** Service dependencies */
+/** Minimal structural shape this module needs from a plugin. */
+interface SortablePlugin {
+    /** Stable unique identifier. Falls back to `name` when `id` is absent. */
+    id?: string;
+    name?: string;
+    /** IDs of plugins that must be mounted/wired before this one. */
     dependencies?: string[];
-    /** Whether service is singleton */
-    singleton?: boolean;
 }
-interface PluginAdminPage {
-    /** Page path (relative to /admin) */
-    path: string;
-    /** Page title */
-    title: string;
-    /** Page component/template */
-    component: string;
-    /** Page description */
-    description?: string;
-    /** Required permissions */
-    permissions?: string[];
-    /** Menu item configuration */
-    menuItem?: PluginMenuItem;
-    /** Page icon */
-    icon?: string;
+interface TopoSortOptions {
+    /**
+     * When true, an unknown dependency id → throw. When false (default), emit a
+     * console.warn and skip the dependency (graceful degradation).
+     */
+    strict?: boolean;
 }
-interface PluginComponent {
-    /** Component name */
+/**
+ * Sort `plugins` into dependency-first order.
+ *
+ * Plugins with no `dependencies` field (old-style PluginBuilder plugins) sort
+ * at the front in their original declaration order, before any v3 plugins that
+ * might depend on them — this preserves backwards compatibility.
+ *
+ * @throws {PluginDependencyCycleError} if a dependency cycle is detected.
+ */
+declare function topoSort<T extends SortablePlugin>(plugins: ReadonlyArray<T>, options?: TopoSortOptions): T[];
+
+interface RbacRole {
+    id: string;
     name: string;
-    /** Component template function */
-    template: (props: any) => string;
-    /** Component description */
-    description?: string;
-    /** Component props schema */
-    propsSchema?: z.ZodSchema;
+    display_name: string;
+    description: string | null;
+    is_system: number;
 }
-interface PluginMenuItem {
-    /** Menu item label */
-    label: string;
-    /** Menu item path */
-    path: string;
-    /** Menu item icon */
-    icon?: string;
-    /** Menu item order */
-    order?: number;
-    /** Parent menu item */
-    parent?: string;
-    /** Required permissions */
-    permissions?: string[];
-    /** Whether item is active */
-    active?: boolean;
-}
-interface PluginHook {
-    /** Hook name */
+interface RbacVerb {
+    id: string;
     name: string;
-    /** Hook handler function */
-    handler: HookHandler;
-    /** Hook priority */
-    priority?: number;
-    /** Hook description */
-    description?: string;
-}
-type HookHandler = (data: any, context: HookContext) => Promise<any>;
-interface HookContext {
-    /** Plugin that registered the hook */
-    plugin: string;
-    /** Hook execution context */
-    context: PluginContext;
-    /** Cancel hook execution */
-    cancel?: () => void;
-}
-interface HookSystem {
-    /** Register a hook handler */
-    register(hookName: string, handler: HookHandler, priority?: number): void;
-    /** Execute all handlers for a hook */
-    execute(hookName: string, data: any, context?: any): Promise<any>;
-    /** Remove a hook handler */
-    unregister(hookName: string, handler: HookHandler): void;
-    /** Get all registered hooks */
-    getHooks(hookName: string): PluginHook[];
-    /** Create a scoped hook system (optional) */
-    createScope?(pluginName: string): ScopedHookSystem;
-}
-interface ScopedHookSystem {
-    /** Register a hook handler */
-    register(hookName: string, handler: HookHandler, priority?: number): void;
-    /** Execute all handlers for a hook */
-    execute(hookName: string, data: any, context?: any): Promise<any>;
-    /** Remove a hook handler */
-    unregister(hookName: string, handler: HookHandler): void;
-    /** Remove all hooks for this scope */
-    unregisterAll(): void;
-}
-interface AuthService {
-    /** Generate JWT token for a user */
-    generateToken(userId: string, email: string, role: string): Promise<string>;
-    /** Verify and decode JWT token */
-    verifyToken(token: string): Promise<any>;
-    /** Set authentication cookie (useful for alternative auth methods) */
-    setAuthCookie(context: Context, token: string, options?: {
-        maxAge?: number;
-        secure?: boolean;
-        httpOnly?: boolean;
-        sameSite?: 'Strict' | 'Lax' | 'None';
-    }): void;
-    /** Hash password */
-    hashPassword(password: string): Promise<string>;
-    /** Verify password against hash */
-    verifyPassword(password: string, hash: string): Promise<boolean>;
-}
-interface AuthService {
-    /** Verify user permissions */
-    hasPermission(userId: string, permission: string): Promise<boolean>;
-    /** Get current user */
-    getCurrentUser(context: Context): Promise<any>;
-    /** Create authentication middleware */
-    createMiddleware(options?: any): MiddlewareHandler;
+    description: string | null;
+    is_system: number;
+    sort_order: number;
 }
-interface ContentService {
-    /** Get content by ID */
-    getById(id: string): Promise<any>;
-    /** Create new content */
-    create(data: any): Promise<any>;
-    /** Update content */
-    update(id: string, data: any): Promise<any>;
-    /** Delete content */
-    delete(id: string): Promise<void>;
-    /** Search content */
-    search(query: string, options?: any): Promise<any[]>;
-}
-interface MediaService {
-    /** Upload file */
-    upload(file: File, options?: any): Promise<any>;
-    /** Get media by ID */
-    getById(id: string): Promise<any>;
-    /** Delete media */
-    delete(id: string): Promise<void>;
-    /** Transform image */
-    transform(id: string, options: any): Promise<string>;
+interface RbacResource {
+    key: string;
+    label: string;
+    group: 'system' | 'document_type';
 }
-interface PluginLogger {
-    debug(message: string, data?: any): void;
-    info(message: string, data?: any): void;
-    warn(message: string, data?: any): void;
-    error(message: string, error?: Error, data?: any): void;
+type PermissionScope = 'none' | 'own' | 'any';
+interface Grant {
+    role_id: string;
+    resource: string;
+    verb: string;
+    scope: Exclude<PermissionScope, 'none'>;
 }
-interface PluginBuilderOptions {
-    name: string;
-    version: string;
-    description?: string;
-    author?: Plugin['author'];
-    dependencies?: string[];
+declare class RbacService {
+    private db;
+    private kv?;
+    private static readonly LEGACY_ROLE_PRECEDENCE;
+    private _docs?;
+    constructor(db: D1Database, kv?: KVNamespace | undefined);
+    private docs;
+    private parse;
+    private listDocs;
+    private getDoc;
+    private upsertDoc;
+    private deleteDoc;
+    private roleToRow;
+    getRoles(): Promise<RbacRole[]>;
+    getVerbs(): Promise<RbacVerb[]>;
+    /** System resources + one `document_type:<name>` per active document type. */
+    getResources(): Promise<RbacResource[]>;
+    getGrants(): Promise<Grant[]>;
+    getRolesForUser(userId: string): Promise<RbacRole[]>;
+    /** Grants attached to a set of role ids (from the embedded role grants). */
+    private grantsForRoleIds;
+    /** Does a single grant row satisfy the requested (resource, verb)? */
+    private grantMatches;
+    private strongestScope;
+    /** Can the user perform `verb` on `resource`? Reads the live grant matrix. */
+    can(userId: string, resource: string, verb: string): Promise<boolean>;
+    /** Highest scope granted to the user for `resource:verb`. */
+    getPermissionScope(userId: string, resource: string, verb: string): Promise<PermissionScope>;
+    /** Flattened, human-readable permission list for a user. Cached in KV for 60 s. */
+    permissionsForUser(userId: string): Promise<string[]>;
+    createRole(name: string, displayName: string, description?: string): Promise<void>;
+    deleteRole(roleId: string): Promise<void>;
+    /**
+     * Update a role's display name and description. The `name` (slug) can only be
+     * changed for custom roles — system role names are referenced by the legacy
+     * mapping, so they stay fixed.
+     */
+    updateRole(roleId: string, displayName: string, description?: string, name?: string): Promise<void>;
+    /** Update displayName + portal access in a single write to avoid double-saveDraft FK issues. */
+    updateRoleAndPortalAccess(roleId: string, displayName: string, name: string | undefined, portalEnabled: boolean, description?: string): Promise<void>;
+    createVerb(name: string, description?: string): Promise<void>;
+    deleteVerb(verbId: string): Promise<void>;
+    /** Replace all grants for one role with the supplied (resource, verb, scope) rows. */
+    setRoleGrants(roleId: string, pairs: Array<{
+        resource: string;
+        verb: string;
+        scope?: Exclude<PermissionScope, 'none'>;
+    }>): Promise<void>;
+    /**
+     * Count active users (optionally excluding one) who hold BOTH an effective
+     * portal:access grant and an effective rbac:manage grant — the users who could
+     * recover from a permission lockout. Powers the self-lockout guard.
+     */
+    countPortalAdmins(excludeUserId?: string): Promise<number>;
+    /**
+     * Replace a user's RBAC role assignments. The `rbac_user_roles` document is the
+     * single source of truth for authorization; the legacy `auth_user.role` column
+     * is kept as a derived projection (highest-precedence system role, else
+     * 'viewer') so the two never diverge.
+     */
+    setUserRoles(userId: string, roleIds: string[]): Promise<void>;
+    setRolePortalAccess(roleId: string, enabled: boolean): Promise<void>;
+    /**
+     * Seed the system roles, verbs, and their grants as documents. Idempotent —
+     * existing roles/verbs (by slug) are left untouched. Replaces the INSERT OR
+     * IGNORE seeds that lived in migration 0001. Call at bootstrap, after the rbac
+     * document types are registered.
+     */
+    ensureSystemRbacSeed(): Promise<void>;
+    /** Assign a role to a user by role name (e.g. 'admin'), preserving existing roles. */
+    addUserRoleByName(userId: string, roleName: string): Promise<void>;
 }
 
-declare function createDb(d1: D1Database): drizzle_orm_d1.DrizzleD1Database<typeof schema> & {
-    $client: D1Database;
-};
+declare function bootstrapDocumentTypes(db: D1Database$1): Promise<void>;
 
 /**
- * Plugin Builder SDK
+ * Cloudflare Email binding provider (MailChannels / send_email binding)
  *
- * Provides a fluent API for building SonicJS plugins
+ * Sends email through a Cloudflare `send_email` Workers binding.
+ * Configure via `wrangler.toml`:
  *
- * @packageDocumentation
- */
-
-/**
- * Fluent builder for creating SonicJS plugins.
- *
- * @beta This API is in beta and may change in future releases.
+ *   [[send_email]]
+ *   name = "SEND_EMAIL"
+ *   destination_address = "you@yourdomain.com"  # optional allowlist
  *
- * @example
- * ```typescript
- * import { PluginBuilder } from '@sonicjs-cms/core'
+ * Then pass `SEND_EMAIL` as the `binding` when constructing:
+ *   new CloudflareEmailProvider({ binding: env.SEND_EMAIL, defaultFrom: 'no-reply@example.com' })
  *
- * const plugin = PluginBuilder.create({
- *   name: 'my-plugin',
- *   version: '1.0.0',
- *   description: 'My custom plugin'
- * })
- *   .addRoute('/api/my-plugin', routes)
- *   .addHook('content:save', handler)
- *   .lifecycle({ activate: async () => console.log('Activated!') })
- *   .build()
- * ```
+ * Note: delivery state tracking is not available through the MailChannels API;
+ * the `reconcile()` method is a no-op for this provider. Production delivery
+ * monitoring should use Cloudflare Email Event Notifications (separate webhook).
  */
-declare class PluginBuilder {
-    private plugin;
-    constructor(options: PluginBuilderOptions);
-    /**
-     * Create a new plugin builder
-     */
-    static create(options: PluginBuilderOptions): PluginBuilder;
-    /**
-     * Add metadata to the plugin
-     */
-    metadata(metadata: {
-        description?: string;
-        author?: Plugin['author'];
-        license?: string;
-        compatibility?: string;
-        dependencies?: string[];
-    }): PluginBuilder;
-    /**
-     * Add routes to plugin
-     */
-    addRoutes(routes: PluginRoutes[]): PluginBuilder;
-    /**
-     * Add a single route to plugin
-     */
-    addRoute(path: string, handler: Hono, options?: {
-        description?: string;
-        requiresAuth?: boolean;
-        roles?: string[];
-        priority?: number;
-    }): PluginBuilder;
-    /**
-     * Add middleware to plugin
-     */
-    addMiddleware(middleware: PluginMiddleware[]): PluginBuilder;
-    /**
-     * Add a single middleware to plugin
-     */
-    addSingleMiddleware(name: string, handler: any, options?: {
-        description?: string;
-        priority?: number;
-        routes?: string[];
-        global?: boolean;
-    }): PluginBuilder;
-    /**
-     * Add models to plugin
-     */
-    addModels(models: PluginModel[]): PluginBuilder;
-    /**
-     * Add a single model to plugin
-     */
-    addModel(name: string, options: {
-        tableName: string;
-        schema: z.ZodSchema;
-        migrations: string[];
-        relationships?: PluginModel['relationships'];
-        extendsContent?: boolean;
-    }): PluginBuilder;
-    /**
-     * Add services to plugin
-     */
-    addServices(services: PluginService[]): PluginBuilder;
-    /**
-     * Add a single service to plugin
-     */
-    addService(name: string, implementation: any, options?: {
-        description?: string;
-        dependencies?: string[];
-        singleton?: boolean;
-    }): PluginBuilder;
-    /**
-     * Add admin pages to plugin
-     */
-    addAdminPages(pages: PluginAdminPage[]): PluginBuilder;
-    /**
-     * Add a single admin page to plugin
-     */
-    addAdminPage(path: string, title: string, component: string, options?: {
-        description?: string;
-        permissions?: string[];
-        icon?: string;
-        menuItem?: PluginMenuItem;
-    }): PluginBuilder;
-    /**
-     * Add admin components to plugin
-     */
-    addComponents(components: PluginComponent[]): PluginBuilder;
-    /**
-     * Add a single admin component to plugin
-     */
-    addComponent(name: string, template: (props: any) => string, options?: {
-        description?: string;
-        propsSchema?: z.ZodSchema;
-    }): PluginBuilder;
-    /**
-     * Add menu items to plugin
-     */
-    addMenuItems(items: PluginMenuItem[]): PluginBuilder;
-    /**
-     * Add a single menu item to plugin
-     */
-    addMenuItem(label: string, path: string, options?: {
-        icon?: string;
-        order?: number;
-        parent?: string;
-        permissions?: string[];
-    }): PluginBuilder;
-    /**
-     * Add hooks to plugin
-     */
-    addHooks(hooks: PluginHook[]): PluginBuilder;
-    /**
-     * Add a single hook to plugin
-     */
-    addHook(name: string, handler: any, options?: {
-        priority?: number;
-        description?: string;
-    }): PluginBuilder;
-    /**
-     * Add lifecycle hooks
-     */
-    lifecycle(hooks: {
-        install?: Plugin['install'];
-        uninstall?: Plugin['uninstall'];
-        activate?: Plugin['activate'];
-        deactivate?: Plugin['deactivate'];
-        configure?: Plugin['configure'];
-    }): PluginBuilder;
-    /**
-     * Build the plugin
-     */
-    build(): Plugin;
+
+/** Minimal shape of the Cloudflare `send_email` binding object. */
+interface CFSendEmailBinding {
+    /** Send an RFC-2822 formatted email. */
+    send(message: {
+        from: string;
+        to: string[];
+        subject: string;
+        html?: string;
+        text?: string;
+        reply_to?: string;
+    }): Promise<void>;
+}
+interface CloudflareEmailProviderOptions {
+    /** The `send_email` binding from `env`. */
+    binding: CFSendEmailBinding;
+    /** Default from-address (must be verified on your Cloudflare account). */
+    defaultFrom?: string;
 }
+declare class CloudflareEmailProvider implements EmailProvider {
+    readonly name = "cloudflare-email";
+    private readonly binding;
+    private readonly defaultFrom;
+    constructor(options: CloudflareEmailProviderOptions);
+    isConfigured(): boolean;
+    send(message: NormalizedEmailMessage): Promise<SendResult>;
+}
+
+declare const emailReconciliationPlugin: DefinedPlugin;
+
+declare const redirectPlugin: DefinedPlugin;
+declare function createRedirectPlugin(): DefinedPlugin;
+
 /**
- * Helper functions for common plugin patterns.
+ * Site Settings Collection
  *
- * @beta This API is in beta and may change in future releases.
+ * Stores site-wide configuration settings (general, security, etc.) as singleton documents.
+ * Each settings group is stored as a separate document with a fixed slug.
  */
-declare class PluginHelpers {
-    /**
-     * Create a REST API route for a model.
-     *
-     * @experimental This method returns placeholder routes. Full implementation coming soon.
-     */
-    static createModelAPI(modelName: string, options?: {
-        basePath?: string;
-        permissions?: {
-            read?: string[];
-            write?: string[];
-            delete?: string[];
+declare const _default: {
+    name: string;
+    displayName: string;
+    description: string;
+    icon: string;
+    color: string;
+    internal: true;
+    schema: {
+        type: "object";
+        properties: {
+            siteName: {
+                type: "string";
+                title: string;
+                description: string;
+                required: true;
+                maxLength: number;
+                placeholder: string;
+            };
+            siteDescription: {
+                type: "string";
+                title: string;
+                description: string;
+                required: true;
+                maxLength: number;
+                placeholder: string;
+            };
+            adminEmail: {
+                type: "email";
+                title: string;
+                description: string;
+                required: true;
+                placeholder: string;
+            };
+            timezone: {
+                type: "select";
+                title: string;
+                description: string;
+                enum: string[];
+                default: string;
+                required: true;
+            };
+            language: {
+                type: "select";
+                title: string;
+                description: string;
+                enum: string[];
+                enumLabels: string[];
+                default: string;
+                required: true;
+            };
+            maintenanceMode: {
+                type: "checkbox";
+                title: string;
+                description: string;
+                default: boolean;
+            };
+            jwtExpiresIn: {
+                type: "string";
+                title: string;
+                description: string;
+                required: false;
+                maxLength: number;
+                placeholder: string;
+            };
+            jwtRefreshGraceSeconds: {
+                type: "number";
+                title: string;
+                description: string;
+                required: false;
+                min: number;
+                max: number;
+            };
         };
-    }): Hono;
-    /**
-     * Create an admin CRUD interface for a model.
-     *
-     * @experimental This method generates basic admin page structures. Full implementation coming soon.
-     */
-    static createAdminInterface(modelName: string, options?: {
-        icon?: string;
-        permissions?: string[];
-        fields?: Array<{
-            name: string;
-            type: string;
-            label: string;
-            required?: boolean;
-        }>;
-    }): {
-        pages: PluginAdminPage[];
-        menuItems: PluginMenuItem[];
+        required: string[];
     };
-    /**
-     * Create a database migration for a model
-     */
-    static createMigration(tableName: string, fields: Array<{
-        name: string;
-        type: 'TEXT' | 'INTEGER' | 'REAL' | 'BLOB';
-        nullable?: boolean;
-        primaryKey?: boolean;
-        unique?: boolean;
-        defaultValue?: string;
-    }>): string;
-    /**
-     * Create a Zod schema for a model
-     */
-    static createSchema(fields: Array<{
-        name: string;
-        type: 'string' | 'number' | 'boolean' | 'date' | 'array' | 'object';
-        optional?: boolean;
-        required?: boolean;
-        validation?: any;
-        items?: any;
-        properties?: Record<string, any>;
-    }>): z.ZodSchema;
-}
+    managed: true;
+    isActive: true;
+    metadata: {
+        purpose: string;
+        version: string;
+        singletonGroups: string[];
+    };
+};
+
+declare function createDb(d1: D1Database): drizzle_orm_d1.DrizzleD1Database<typeof schema> & {
+    $client: D1Database;
+};
 
 /**
  * OAuth Providers Plugin
@@ -530,9 +369,8 @@ declare class PluginHelpers {
  *   POST /auth/oauth/unlink             → Unlink OAuth provider from account
  *   GET  /auth/oauth/accounts           → List linked OAuth accounts for current user
  */
-
-declare function createOAuthProvidersPlugin(): Plugin;
-declare const oauthProvidersPlugin: Plugin;
+declare const oauthProvidersPlugin: DefinedPlugin;
+declare function createOAuthProvidersPlugin(): DefinedPlugin;
 
 /**
  * OAuth Service
@@ -669,20 +507,19 @@ declare function defineUserProfile(config: UserProfileConfig): void;
 declare function getUserProfileConfig(): UserProfileConfig | null;
 
 /**
- * User Profiles Plugin
+ * User Profiles Plugin — Payload-shaped port.
  *
- * Configurable custom profile fields for users.
- * Developers call defineUserProfile() at app boot to declare custom fields
- * that are stored as JSON in user_profiles.data and rendered in the admin UI.
+ * Configurable custom profile fields for users. defineUserProfile() at app
+ * boot declares custom fields stored as JSON in auth_user_profiles.data and
+ * rendered in the admin UI.
  *
  * API Routes:
  *   GET  /api/user-profiles/schema     → Public field definitions
- *   GET  /api/user-profiles/:userId    → Get custom data for a user (auth required)
- *   PUT  /api/user-profiles/:userId    → Update custom data for a user (auth required)
+ *   GET  /api/user-profiles/:userId    → Get custom data for a user
+ *   PUT  /api/user-profiles/:userId    → Update custom data for a user
  */
-
-declare function createUserProfilesPlugin(): Plugin;
-declare const userProfilesPlugin: Plugin;
+declare const userProfilesPlugin: DefinedPlugin;
+declare function createUserProfilesPlugin(): DefinedPlugin;
 
 /**
  * @sonicjs/core - Main Entry Point
@@ -704,4 +541,4 @@ declare const userProfilesPlugin: Plugin;
 
 declare const VERSION: string;
 
-export { BUILT_IN_PROVIDERS, FieldType, OAuthService, PluginBuilder, PluginHelpers, type ProfileFieldDefinition, type UserProfileConfig, VERSION, createDb, createOAuthProvidersPlugin, createUserProfilesPlugin, defineUserProfile, getUserProfileConfig, oauthProvidersPlugin, userProfilesPlugin };
+export { BUILT_IN_PROVIDERS, type CFSendEmailBinding, CloudflareEmailProvider, type CloudflareEmailProviderOptions, FieldType, OAuthService, PluginDependencyCycleError, type ProfileFieldDefinition, RbacService, type SortablePlugin, type TopoSortOptions, type UserProfileConfig, VERSION, bootstrapDocumentTypes, createDb, createOAuthProvidersPlugin, createRedirectPlugin, createUserProfilesPlugin, defineUserProfile, emailReconciliationPlugin, generateTriggersComment, getUserProfileConfig, oauthProvidersPlugin, parseCronTriggers, redirectPlugin, _default as siteSettingsCollection, topoSort, updateWranglerTriggers, userProfilesPlugin };