@sonicjs-cms/core 3.0.0-beta.2 → 3.0.0-beta.20

package/dist/index.d.cts

@@ -1,16 +1,17 @@
-export { B as Bindings, a as BootIsolateFn, b as SonicJSApp, S as SonicJSConfig, V as Variables, c as createSonicJSApp, s as setupCoreMiddleware, d as setupCoreRoutes } from './app-Do66yCcV.cjs';
-import { o as DefinedPlugin } from './define-plugin-IWDKYaVm.cjs';
-export { B as BooleanField, e as ConfigSchema, f as ConfigSchemaField, h as CronContext, i as CronDeclaration, j as CronDispatchResult, k as CronTickEvent, l as CronablePlugin, H as HookSystemImpl, r as HookUtils, N as NumberField, P as ParsedField, v as PluginManagerClass, an as PluginMenuEntry, x as PluginRegistryImpl, y as PluginValidatorClass, z as PluginsRegistry, A as RegisterPluginsError, G as RegisterPluginsErrorReason, I as RegisterPluginsHostContext, J as RegisterablePlugin, K as RegistryEntry, ao as ResolvedPluginMenuEntry, L as ScopedHookSystemClass, O as SelectField, Q as SettingsFor, U as StringField, Y as applySchemaDefaults, _ as collectCronSchedules, $ as collectCrons, a2 as createScheduledHandler, a3 as definePlugin, a4 as dispatchCronTick, a5 as getHookSystem, ap as getPluginMenu, a6 as getTypedHooks, a8 as hasHookSystem, a9 as isDefinedPlugin, ae as parseConfigSchema, af as parseFormDataToSettings, ah as registerPlugins, ai as renderSchemaFields, aj as resetHookSystem, aq as resetPluginMenu, ar as resolvePluginMenuItems, ak as setHookSystem, as as setPluginMenu } from './define-plugin-IWDKYaVm.cjs';
+export { B as Bindings, a as BootIsolateFn, b as SonicJSApp, S as SonicJSConfig, V as Variables, c as createSonicJSApp, s as setupCoreMiddleware, d as setupCoreRoutes } from './app-aj39TGHB.cjs';
+import { o as DefinedPlugin } from './define-plugin-DsKiGu1q.cjs';
+export { B as BooleanField, e as ConfigSchema, f as ConfigSchemaField, h as CronContext, i as CronDeclaration, j as CronDispatchResult, k as CronTickEvent, l as CronablePlugin, H as HookSystemImpl, r as HookUtils, N as NumberField, P as ParsedField, v as PluginManagerClass, an as PluginMenuEntry, x as PluginRegistryImpl, y as PluginValidatorClass, z as PluginsRegistry, A as RegisterPluginsError, G as RegisterPluginsErrorReason, I as RegisterPluginsHostContext, J as RegisterablePlugin, K as RegistryEntry, ao as ResolvedPluginMenuEntry, L as ScopedHookSystemClass, O as SelectField, Q as SettingsFor, U as StringField, Y as applySchemaDefaults, _ as collectCronSchedules, $ as collectCrons, a2 as createScheduledHandler, a3 as definePlugin, a4 as dispatchCronTick, a5 as getHookSystem, ap as getPluginMenu, a6 as getTypedHooks, a8 as hasHookSystem, a9 as isDefinedPlugin, ae as parseConfigSchema, af as parseFormDataToSettings, ah as registerPlugins, ai as renderSchemaFields, aj as resetHookSystem, aq as resetPluginMenu, ar as resolvePluginMenuItems, ak as setHookSystem, as as setPluginMenu } from './define-plugin-DsKiGu1q.cjs';
 import { D1Database as D1Database$1 } from '@cloudflare/workers-types';
-import { E as EmailProvider, N as NormalizedEmailMessage, q as SendResult } from './types-Dea1eNxU.cjs';
-export { s as EmailLogRow } from './types-Dea1eNxU.cjs';
-import { s as schema } from './plugin-bootstrap-B8ThJU21.cjs';
-export { m as Content, C as CorePlugin, n as DbPlugin, o as DbPluginHook, L as LogCategory, p as LogConfig, a as LogEntry, b as LogFilter, c as LogLevel, d as Logger, q as Media, M as Migration, e as MigrationService, f as MigrationStatus, N as NewContent, t as NewLogConfig, u as NewMedia, w as NewPlugin, x as NewPluginActivityLog, y as NewPluginAsset, z as NewPluginHook, A as NewPluginRoute, B as NewSystemLog, D as NewUser, E as NewWorkflowHistory, F as PluginActivityLog, G as PluginAsset, P as PluginBootstrapService, H as PluginRoute, g as PluginServiceClass, S as SystemLog, U as User, W as WorkflowHistory, I as apiTokens, J as content, K as contentVersions, h as getAvailableCollectionNames, i as getLogger, j as initLogger, O as insertContentSchema, Q as insertLogConfigSchema, R as insertMediaSchema, T as insertPluginActivityLogSchema, V as insertPluginAssetSchema, X as insertPluginHookSchema, Y as insertPluginRouteSchema, Z as insertPluginSchema, _ as insertSystemLogSchema, $ as insertUserSchema, a0 as insertWorkflowHistorySchema, l as loadCollectionConfig, k as loadCollectionConfigs, a1 as logConfig, a2 as media, a3 as pluginActivityLog, a4 as pluginAssets, a5 as pluginHooks, a6 as pluginRoutes, a7 as plugins, r as registerCollections, a8 as selectContentSchema, a9 as selectLogConfigSchema, aa as selectMediaSchema, ab as selectPluginActivityLogSchema, ac as selectPluginAssetSchema, ad as selectPluginHookSchema, ae as selectPluginRouteSchema, af as selectPluginSchema, ag as selectSystemLogSchema, ah as selectUserSchema, ai as selectWorkflowHistorySchema, aj as systemLogs, ak as users, v as validateCollectionConfig, al as workflowHistory } from './plugin-bootstrap-B8ThJU21.cjs';
-import { e as FieldType } from './collection-config-JgHOpFCG.cjs';
-export { C as CollectionConfig, b as CollectionConfigModule, c as CollectionSchema, d as CollectionSyncResult, F as FieldConfig } from './collection-config-JgHOpFCG.cjs';
+import { z } from 'zod';
+import { E as EmailProvider, N as NormalizedEmailMessage, t as SendResult } from './types-DT7XN5TX.cjs';
+export { q as EmailLogRow } from './types-DT7XN5TX.cjs';
+import { s as schema } from './plugin-bootstrap-BHWQ2df8.cjs';
+export { m as Content, C as CorePlugin, n as DbPlugin, o as DbPluginHook, L as LogCategory, p as LogConfig, a as LogEntry, b as LogFilter, c as LogLevel, d as Logger, q as Media, M as Migration, e as MigrationService, f as MigrationStatus, N as NewContent, t as NewLogConfig, u as NewMedia, w as NewPlugin, x as NewPluginActivityLog, y as NewPluginAsset, z as NewPluginHook, A as NewPluginRoute, B as NewSystemLog, D as NewUser, E as NewWorkflowHistory, F as PluginActivityLog, G as PluginAsset, P as PluginBootstrapService, H as PluginRoute, g as PluginServiceClass, S as SystemLog, U as User, W as WorkflowHistory, I as apiTokens, J as content, K as contentVersions, h as getAvailableCollectionNames, i as getLogger, j as initLogger, O as insertContentSchema, Q as insertLogConfigSchema, R as insertMediaSchema, T as insertPluginActivityLogSchema, V as insertPluginAssetSchema, X as insertPluginHookSchema, Y as insertPluginRouteSchema, Z as insertPluginSchema, _ as insertSystemLogSchema, $ as insertUserSchema, a0 as insertWorkflowHistorySchema, l as loadCollectionConfig, k as loadCollectionConfigs, a1 as logConfig, a2 as media, a3 as pluginActivityLog, a4 as pluginAssets, a5 as pluginHooks, a6 as pluginRoutes, a7 as plugins, r as registerCollections, a8 as selectContentSchema, a9 as selectLogConfigSchema, aa as selectMediaSchema, ab as selectPluginActivityLogSchema, ac as selectPluginAssetSchema, ad as selectPluginHookSchema, ae as selectPluginRouteSchema, af as selectPluginSchema, ag as selectSystemLogSchema, ah as selectUserSchema, ai as selectWorkflowHistorySchema, aj as systemLogs, ak as users, v as validateCollectionConfig, al as workflowHistory } from './plugin-bootstrap-BHWQ2df8.cjs';
+import { e as FieldType } from './collection-config-BTzAvKt2.cjs';
+export { C as CollectionConfig, b as CollectionConfigModule, c as CollectionSchema, d as CollectionSyncResult, F as FieldConfig } from './collection-config-BTzAvKt2.cjs';
 export { AuthManager, Permission, PermissionManager, UserPermissions, bootstrapMiddleware, cacheHeaders, compressionMiddleware, detailedLoggingMiddleware, getActivePlugins, isPluginActive, logActivity, loggingMiddleware, optionalAuth, performanceLoggingMiddleware, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeaders, securityLoggingMiddleware } from './middleware.cjs';
 export { ROUTES_INFO, adminApiRoutes, adminCheckboxRoutes, adminCollectionsRoutes, adminContentRoutes, adminDashboardRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, adminUsersRoutes, apiContentCrudRoutes, apiMediaRoutes, apiRoutes, apiSystemRoutes, authRoutes } from './routes.cjs';
-export { A as AlertData, C as ConfirmationDialogOptions, F as Filter, a as FilterBarData, b as FilterOption, c as FormData, d as FormField, P as PaginationData, T as TableColumn, e as TableData, g as getConfirmationDialogScript, r as renderAlert, f as renderConfirmationDialog, h as renderFilterBar, i as renderForm, j as renderFormField, k as renderPagination, l as renderTable } from './filter-bar.template-DlVYMk-T.cjs';
+export { A as AdminLayoutCatalystData, a as AlertData, C as ConfirmationDialogOptions, F as Filter, b as FilterBarData, c as FilterOption, d as FormData, e as FormField, P as PaginationData, T as TableColumn, f as TableData, g as getConfirmationDialogScript, r as renderAdminLayoutCatalyst, h as renderAlert, i as renderConfirmationDialog, j as renderFilterBar, k as renderForm, l as renderFormField, m as renderPagination, n as renderTable } from './admin-layout-catalyst.template-DrwDUfsE.cjs';
 export { A as AuthService, C as ContentService, H as HOOKS, a as HookContext, b as HookHandler, c as HookName, d as HookSystem, M as MediaService, P as Plugin, f as PluginAdminPage, g as PluginBuilderOptions, h as PluginComponent, i as PluginConfig, j as PluginContext, k as PluginHook, l as PluginLogger, m as PluginManager, n as PluginMenuItem, o as PluginMiddleware, p as PluginModel, q as PluginRegistry, r as PluginRoutes, s as PluginService, t as PluginStatus, u as PluginValidationResult, v as PluginValidator, S as ScopedHookSystem } from './plugin-DDYetMF-.cjs';
 export { P as PluginManifest } from './plugin-manifest-Dpy8wxIB.cjs';
 export { F as FilterCondition, a as FilterGroup, b as FilterOperator, Q as QueryFilter, c as QueryFilterBuilder, d as QueryResult, S as SONICJS_VERSION, T as TemplateRenderer, e as buildQuery, f as escapeHtml, g as getCoreVersion, m as metricsTracker, r as renderTemplate, s as sanitizeInput, h as sanitizeObject, t as templateRenderer } from './version-DFTyGfIH.cjs';
@@ -21,11 +22,11 @@ import 'better-auth';
 import 'better-auth/plugins/magic-link';
 import 'better-call';
 import 'zod/v4/core';
-import 'zod';
 import 'hono';
 import 'drizzle-zod';
 import 'drizzle-orm/sqlite-core';
 import 'hono/types';
+import 'hono/utils/html';
 
 /**
  * Wrangler.toml [triggers] cron codegen
@@ -212,6 +213,182 @@ declare class RbacService {
 
 declare function bootstrapDocumentTypes(db: D1Database$1): Promise<void>;
 
+type Permission = 'read' | 'create' | 'update' | 'delete' | 'publish' | 'manage';
+type PrincipalType = 'user' | 'role' | 'group' | 'public' | 'token';
+type RefStrength = 'strong' | 'weak';
+type QueryableFieldKind = 'scalar' | 'facet' | 'reference';
+type DocumentStatus = 'draft' | 'published' | 'archived';
+interface QueryableField {
+    name: string;
+    path?: string;
+    kind: QueryableFieldKind;
+    type?: 'text' | 'number' | 'integer' | 'boolean' | 'date';
+    column?: string;
+    refStrength?: RefStrength;
+}
+interface DocumentTypeSettings {
+    baseGrants?: Record<string, Permission[]>;
+    maxVersionsPerRoot?: number;
+    pii?: boolean;
+    /** Hide this type from the admin content list and all-view (e.g. internal system types like 'plugin'). */
+    internal?: boolean;
+    /**
+     * Shared/global type: its documents are NOT tenant-scoped — they live in one shared pool and are
+     * visible from every tenant. Opt-in (default false). When false, the type is tenant-isolated like
+     * everything else. See `effectiveTenantForType` (services/document-request-context.ts).
+     */
+    global?: boolean;
+    /**
+     * Retain historical version rows for this type. Default false.
+     * When false: saveDraft updates the working draft row in place and publish deletes the
+     * superseded published row (at most ~2 rows per root, no history accumulation).
+     * When true: new row per saveDraft + prune to maxVersionsPerRoot (the versioning-plugin opts types in).
+     */
+    versioning?: boolean;
+}
+interface Document {
+    id: string;
+    rootId: string;
+    typeId: string;
+    typeVersion: number;
+    versionOfId: string | null;
+    versionNumber: number;
+    isCurrentDraft: boolean;
+    isPublished: boolean;
+    status: DocumentStatus;
+    parentRootId: string;
+    slug: string | null;
+    path: string | null;
+    title: string | null;
+    zone: string | null;
+    sortOrder: number;
+    visible: boolean;
+    publishedAt: number | null;
+    scheduledAt: number | null;
+    expiresAt: number | null;
+    deletedAt: number | null;
+    tenantId: string;
+    locale: string;
+    translationGroupId: string;
+    data: Record<string, unknown>;
+    metadata: Record<string, unknown>;
+    ownerId: string | null;
+    createdBy: string | null;
+    updatedBy: string | null;
+    createdAt: number;
+    updatedAt: number;
+}
+interface PrincipalRef {
+    type: PrincipalType;
+    id: string;
+}
+declare const createDocumentSchema: z.ZodObject<{
+    typeId: z.ZodString;
+    tenantId: z.ZodDefault<z.ZodString>;
+    locale: z.ZodDefault<z.ZodString>;
+    parentRootId: z.ZodDefault<z.ZodString>;
+    slug: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    title: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    zone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    sortOrder: z.ZodDefault<z.ZodNumber>;
+    visible: z.ZodDefault<z.ZodBoolean>;
+    scheduledAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    data: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    ownerId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    publishOnCreate: z.ZodDefault<z.ZodBoolean>;
+    createdAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    updatedAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.core.$strip>;
+declare const updateDocumentSchema: z.ZodObject<{
+    title: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    slug: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    zone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    sortOrder: z.ZodOptional<z.ZodNumber>;
+    visible: z.ZodOptional<z.ZodBoolean>;
+    scheduledAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    updatedBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+type CreateDocumentInput = z.infer<typeof createDocumentSchema>;
+type UpdateDocumentInput = z.infer<typeof updateDocumentSchema>;
+
+type ListStatus = 'published' | 'draft' | 'all';
+interface ListDocumentsOptions {
+    typeId?: string;
+    /** Which lifecycle axis to list: published row, current-draft row, or either. */
+    status?: ListStatus;
+    locale?: string;
+    parentRootId?: string;
+    limit?: number;
+    cursorUpdatedAt?: number;
+    cursorId?: string;
+    now?: number;
+    /** Resolved generated-column filters, e.g. { column: 'q_tst_rating', value: 4 }. Caller maps
+     *  field→column via the type's queryableFields; column names are format-guarded here too. */
+    scalarFilters?: Array<{
+        column: string;
+        value: string | number;
+    }>;
+    /** Multi-valued facet filter, e.g. { field: 'tags', value: 'homepage' }. Bound as params. */
+    facetFilter?: {
+        field: string;
+        value: string;
+    };
+    /** Generated-column to sort by (else keyset on updated_at). Format-guarded. */
+    sortColumn?: string | null;
+    sortDir?: 'ASC' | 'DESC';
+    /** Apply the schedule window (scheduled_at/expires_at) — public reads only. */
+    timeWindow?: boolean;
+}
+declare class DocumentRepository {
+    private db;
+    private tenantId;
+    private permissions;
+    constructor(db: D1Database$1, tenantId: string);
+    getById(id: string): Promise<Document | null>;
+    getCurrentDraft(rootId: string): Promise<Document | null>;
+    getPublished(rootId: string): Promise<Document | null>;
+    list(opts?: ListDocumentsOptions): Promise<Document[]>;
+    listPublished(opts?: ListDocumentsOptions): Promise<Document[]>;
+    listDrafts(opts?: ListDocumentsOptions): Promise<Document[]>;
+    getVersionHistory(rootId: string): Promise<Document[]>;
+    getInboundReferences(toRootId: string): Promise<Array<{
+        fromDocumentId: string;
+        fieldName: string;
+        refStrength: string;
+    }>>;
+    isAllowed(principalSet: PrincipalRef[], rootId: string, permission: Permission, typeSettings: DocumentTypeSettings): Promise<boolean>;
+}
+
+interface DocumentsServiceOptions {
+    queryableFields?: QueryableField[];
+    typeSchemaVersion?: number;
+    maxVersionsPerRoot?: number;
+    /** Tenant this service operates within. Every root-keyed lookup is scoped to it (R3). POC default: 'default'. */
+    tenantId?: string;
+    /** Retain version history (new row per saveDraft, supersede-as-history). Default false (in-place). */
+    versioning?: boolean;
+}
+declare class DocumentsService {
+    private db;
+    private opts;
+    private projection;
+    private tenantId;
+    private versioning;
+    constructor(db: D1Database$1, opts?: DocumentsServiceOptions);
+    create(input: CreateDocumentInput, createdBy?: string): Promise<Document>;
+    saveDraft(rootId: string, input: UpdateDocumentInput, updatedBy?: string): Promise<Document>;
+    private updateInPlace;
+    publish(documentId: string, publishedBy?: string): Promise<Document>;
+    unpublish(documentId: string): Promise<Document>;
+    softDelete(documentId: string): Promise<void>;
+    erase(rootId: string, tenantId: string): Promise<void>;
+}
+
 /**
  * Cloudflare Email binding provider (MailChannels / send_email binding)
  *
@@ -262,6 +439,17 @@ declare const emailReconciliationPlugin: DefinedPlugin;
 declare const redirectPlugin: DefinedPlugin;
 declare function createRedirectPlugin(): DefinedPlugin;
 
+/**
+ * Hello World Plugin — Payload-shaped pilot port.
+ *
+ * Demonstrates the v4 plugin shape: definePlugin(...) with declarative menu
+ * + configSchema + sync register. Replaces the legacy PluginBuilder fluent
+ * API. Keeps the same id/version/routes so existing tests and the manifest
+ * registry continue to resolve it.
+ */
+declare const helloWorldPlugin: DefinedPlugin;
+declare function createHelloWorldPlugin(): DefinedPlugin;
+
 /**
  * Site Settings Collection
  *
@@ -541,4 +729,4 @@ declare function createUserProfilesPlugin(): DefinedPlugin;
 
 declare const VERSION: string;
 
-export { BUILT_IN_PROVIDERS, type CFSendEmailBinding, CloudflareEmailProvider, type CloudflareEmailProviderOptions, FieldType, OAuthService, PluginDependencyCycleError, type ProfileFieldDefinition, RbacService, type SortablePlugin, type TopoSortOptions, type UserProfileConfig, VERSION, bootstrapDocumentTypes, createDb, createOAuthProvidersPlugin, createRedirectPlugin, createUserProfilesPlugin, defineUserProfile, emailReconciliationPlugin, generateTriggersComment, getUserProfileConfig, oauthProvidersPlugin, parseCronTriggers, redirectPlugin, _default as siteSettingsCollection, topoSort, updateWranglerTriggers, userProfilesPlugin };
+export { BUILT_IN_PROVIDERS, type CFSendEmailBinding, CloudflareEmailProvider, type CloudflareEmailProviderOptions, DocumentRepository, DocumentsService, FieldType, OAuthService, PluginDependencyCycleError, type ProfileFieldDefinition, RbacService, type SortablePlugin, type TopoSortOptions, type UserProfileConfig, VERSION, bootstrapDocumentTypes, createDb, createHelloWorldPlugin, createOAuthProvidersPlugin, createRedirectPlugin, createUserProfilesPlugin, defineUserProfile, emailReconciliationPlugin, generateTriggersComment, getUserProfileConfig, helloWorldPlugin, oauthProvidersPlugin, parseCronTriggers, redirectPlugin, _default as siteSettingsCollection, topoSort, updateWranglerTriggers, userProfilesPlugin };

package/dist/index.d.ts

@@ -1,16 +1,17 @@
-export { B as Bindings, a as BootIsolateFn, b as SonicJSApp, S as SonicJSConfig, V as Variables, c as createSonicJSApp, s as setupCoreMiddleware, d as setupCoreRoutes } from './app-Bo0X1OWX.js';
-import { o as DefinedPlugin } from './define-plugin-BzNHc1ZI.js';
-export { B as BooleanField, e as ConfigSchema, f as ConfigSchemaField, h as CronContext, i as CronDeclaration, j as CronDispatchResult, k as CronTickEvent, l as CronablePlugin, H as HookSystemImpl, r as HookUtils, N as NumberField, P as ParsedField, v as PluginManagerClass, an as PluginMenuEntry, x as PluginRegistryImpl, y as PluginValidatorClass, z as PluginsRegistry, A as RegisterPluginsError, G as RegisterPluginsErrorReason, I as RegisterPluginsHostContext, J as RegisterablePlugin, K as RegistryEntry, ao as ResolvedPluginMenuEntry, L as ScopedHookSystemClass, O as SelectField, Q as SettingsFor, U as StringField, Y as applySchemaDefaults, _ as collectCronSchedules, $ as collectCrons, a2 as createScheduledHandler, a3 as definePlugin, a4 as dispatchCronTick, a5 as getHookSystem, ap as getPluginMenu, a6 as getTypedHooks, a8 as hasHookSystem, a9 as isDefinedPlugin, ae as parseConfigSchema, af as parseFormDataToSettings, ah as registerPlugins, ai as renderSchemaFields, aj as resetHookSystem, aq as resetPluginMenu, ar as resolvePluginMenuItems, ak as setHookSystem, as as setPluginMenu } from './define-plugin-BzNHc1ZI.js';
+export { B as Bindings, a as BootIsolateFn, b as SonicJSApp, S as SonicJSConfig, V as Variables, c as createSonicJSApp, s as setupCoreMiddleware, d as setupCoreRoutes } from './app-01M0dIwt.js';
+import { o as DefinedPlugin } from './define-plugin-BYIey6sp.js';
+export { B as BooleanField, e as ConfigSchema, f as ConfigSchemaField, h as CronContext, i as CronDeclaration, j as CronDispatchResult, k as CronTickEvent, l as CronablePlugin, H as HookSystemImpl, r as HookUtils, N as NumberField, P as ParsedField, v as PluginManagerClass, an as PluginMenuEntry, x as PluginRegistryImpl, y as PluginValidatorClass, z as PluginsRegistry, A as RegisterPluginsError, G as RegisterPluginsErrorReason, I as RegisterPluginsHostContext, J as RegisterablePlugin, K as RegistryEntry, ao as ResolvedPluginMenuEntry, L as ScopedHookSystemClass, O as SelectField, Q as SettingsFor, U as StringField, Y as applySchemaDefaults, _ as collectCronSchedules, $ as collectCrons, a2 as createScheduledHandler, a3 as definePlugin, a4 as dispatchCronTick, a5 as getHookSystem, ap as getPluginMenu, a6 as getTypedHooks, a8 as hasHookSystem, a9 as isDefinedPlugin, ae as parseConfigSchema, af as parseFormDataToSettings, ah as registerPlugins, ai as renderSchemaFields, aj as resetHookSystem, aq as resetPluginMenu, ar as resolvePluginMenuItems, ak as setHookSystem, as as setPluginMenu } from './define-plugin-BYIey6sp.js';
 import { D1Database as D1Database$1 } from '@cloudflare/workers-types';
-import { E as EmailProvider, N as NormalizedEmailMessage, q as SendResult } from './types-Dea1eNxU.js';
-export { s as EmailLogRow } from './types-Dea1eNxU.js';
-import { s as schema } from './plugin-bootstrap-qu8hJgUt.js';
-export { m as Content, C as CorePlugin, n as DbPlugin, o as DbPluginHook, L as LogCategory, p as LogConfig, a as LogEntry, b as LogFilter, c as LogLevel, d as Logger, q as Media, M as Migration, e as MigrationService, f as MigrationStatus, N as NewContent, t as NewLogConfig, u as NewMedia, w as NewPlugin, x as NewPluginActivityLog, y as NewPluginAsset, z as NewPluginHook, A as NewPluginRoute, B as NewSystemLog, D as NewUser, E as NewWorkflowHistory, F as PluginActivityLog, G as PluginAsset, P as PluginBootstrapService, H as PluginRoute, g as PluginServiceClass, S as SystemLog, U as User, W as WorkflowHistory, I as apiTokens, J as content, K as contentVersions, h as getAvailableCollectionNames, i as getLogger, j as initLogger, O as insertContentSchema, Q as insertLogConfigSchema, R as insertMediaSchema, T as insertPluginActivityLogSchema, V as insertPluginAssetSchema, X as insertPluginHookSchema, Y as insertPluginRouteSchema, Z as insertPluginSchema, _ as insertSystemLogSchema, $ as insertUserSchema, a0 as insertWorkflowHistorySchema, l as loadCollectionConfig, k as loadCollectionConfigs, a1 as logConfig, a2 as media, a3 as pluginActivityLog, a4 as pluginAssets, a5 as pluginHooks, a6 as pluginRoutes, a7 as plugins, r as registerCollections, a8 as selectContentSchema, a9 as selectLogConfigSchema, aa as selectMediaSchema, ab as selectPluginActivityLogSchema, ac as selectPluginAssetSchema, ad as selectPluginHookSchema, ae as selectPluginRouteSchema, af as selectPluginSchema, ag as selectSystemLogSchema, ah as selectUserSchema, ai as selectWorkflowHistorySchema, aj as systemLogs, ak as users, v as validateCollectionConfig, al as workflowHistory } from './plugin-bootstrap-qu8hJgUt.js';
-import { e as FieldType } from './collection-config-JgHOpFCG.js';
-export { C as CollectionConfig, b as CollectionConfigModule, c as CollectionSchema, d as CollectionSyncResult, F as FieldConfig } from './collection-config-JgHOpFCG.js';
+import { z } from 'zod';
+import { E as EmailProvider, N as NormalizedEmailMessage, t as SendResult } from './types-DT7XN5TX.js';
+export { q as EmailLogRow } from './types-DT7XN5TX.js';
+import { s as schema } from './plugin-bootstrap-Bj4fxX1q.js';
+export { m as Content, C as CorePlugin, n as DbPlugin, o as DbPluginHook, L as LogCategory, p as LogConfig, a as LogEntry, b as LogFilter, c as LogLevel, d as Logger, q as Media, M as Migration, e as MigrationService, f as MigrationStatus, N as NewContent, t as NewLogConfig, u as NewMedia, w as NewPlugin, x as NewPluginActivityLog, y as NewPluginAsset, z as NewPluginHook, A as NewPluginRoute, B as NewSystemLog, D as NewUser, E as NewWorkflowHistory, F as PluginActivityLog, G as PluginAsset, P as PluginBootstrapService, H as PluginRoute, g as PluginServiceClass, S as SystemLog, U as User, W as WorkflowHistory, I as apiTokens, J as content, K as contentVersions, h as getAvailableCollectionNames, i as getLogger, j as initLogger, O as insertContentSchema, Q as insertLogConfigSchema, R as insertMediaSchema, T as insertPluginActivityLogSchema, V as insertPluginAssetSchema, X as insertPluginHookSchema, Y as insertPluginRouteSchema, Z as insertPluginSchema, _ as insertSystemLogSchema, $ as insertUserSchema, a0 as insertWorkflowHistorySchema, l as loadCollectionConfig, k as loadCollectionConfigs, a1 as logConfig, a2 as media, a3 as pluginActivityLog, a4 as pluginAssets, a5 as pluginHooks, a6 as pluginRoutes, a7 as plugins, r as registerCollections, a8 as selectContentSchema, a9 as selectLogConfigSchema, aa as selectMediaSchema, ab as selectPluginActivityLogSchema, ac as selectPluginAssetSchema, ad as selectPluginHookSchema, ae as selectPluginRouteSchema, af as selectPluginSchema, ag as selectSystemLogSchema, ah as selectUserSchema, ai as selectWorkflowHistorySchema, aj as systemLogs, ak as users, v as validateCollectionConfig, al as workflowHistory } from './plugin-bootstrap-Bj4fxX1q.js';
+import { e as FieldType } from './collection-config-BTzAvKt2.js';
+export { C as CollectionConfig, b as CollectionConfigModule, c as CollectionSchema, d as CollectionSyncResult, F as FieldConfig } from './collection-config-BTzAvKt2.js';
 export { AuthManager, Permission, PermissionManager, UserPermissions, bootstrapMiddleware, cacheHeaders, compressionMiddleware, detailedLoggingMiddleware, getActivePlugins, isPluginActive, logActivity, loggingMiddleware, optionalAuth, performanceLoggingMiddleware, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeaders, securityLoggingMiddleware } from './middleware.js';
 export { ROUTES_INFO, adminApiRoutes, adminCheckboxRoutes, adminCollectionsRoutes, adminContentRoutes, adminDashboardRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, adminUsersRoutes, apiContentCrudRoutes, apiMediaRoutes, apiRoutes, apiSystemRoutes, authRoutes } from './routes.js';
-export { A as AlertData, C as ConfirmationDialogOptions, F as Filter, a as FilterBarData, b as FilterOption, c as FormData, d as FormField, P as PaginationData, T as TableColumn, e as TableData, g as getConfirmationDialogScript, r as renderAlert, f as renderConfirmationDialog, h as renderFilterBar, i as renderForm, j as renderFormField, k as renderPagination, l as renderTable } from './filter-bar.template-DlVYMk-T.js';
+export { A as AdminLayoutCatalystData, a as AlertData, C as ConfirmationDialogOptions, F as Filter, b as FilterBarData, c as FilterOption, d as FormData, e as FormField, P as PaginationData, T as TableColumn, f as TableData, g as getConfirmationDialogScript, r as renderAdminLayoutCatalyst, h as renderAlert, i as renderConfirmationDialog, j as renderFilterBar, k as renderForm, l as renderFormField, m as renderPagination, n as renderTable } from './admin-layout-catalyst.template-DrwDUfsE.js';
 export { A as AuthService, C as ContentService, H as HOOKS, a as HookContext, b as HookHandler, c as HookName, d as HookSystem, M as MediaService, P as Plugin, f as PluginAdminPage, g as PluginBuilderOptions, h as PluginComponent, i as PluginConfig, j as PluginContext, k as PluginHook, l as PluginLogger, m as PluginManager, n as PluginMenuItem, o as PluginMiddleware, p as PluginModel, q as PluginRegistry, r as PluginRoutes, s as PluginService, t as PluginStatus, u as PluginValidationResult, v as PluginValidator, S as ScopedHookSystem } from './plugin-DDYetMF-.js';
 export { P as PluginManifest } from './plugin-manifest-Dpy8wxIB.js';
 export { F as FilterCondition, a as FilterGroup, b as FilterOperator, Q as QueryFilter, c as QueryFilterBuilder, d as QueryResult, S as SONICJS_VERSION, T as TemplateRenderer, e as buildQuery, f as escapeHtml, g as getCoreVersion, m as metricsTracker, r as renderTemplate, s as sanitizeInput, h as sanitizeObject, t as templateRenderer } from './version-DFTyGfIH.js';
@@ -21,11 +22,11 @@ import 'better-auth';
 import 'better-auth/plugins/magic-link';
 import 'better-call';
 import 'zod/v4/core';
-import 'zod';
 import 'hono';
 import 'drizzle-zod';
 import 'drizzle-orm/sqlite-core';
 import 'hono/types';
+import 'hono/utils/html';
 
 /**
  * Wrangler.toml [triggers] cron codegen
@@ -212,6 +213,182 @@ declare class RbacService {
 
 declare function bootstrapDocumentTypes(db: D1Database$1): Promise<void>;
 
+type Permission = 'read' | 'create' | 'update' | 'delete' | 'publish' | 'manage';
+type PrincipalType = 'user' | 'role' | 'group' | 'public' | 'token';
+type RefStrength = 'strong' | 'weak';
+type QueryableFieldKind = 'scalar' | 'facet' | 'reference';
+type DocumentStatus = 'draft' | 'published' | 'archived';
+interface QueryableField {
+    name: string;
+    path?: string;
+    kind: QueryableFieldKind;
+    type?: 'text' | 'number' | 'integer' | 'boolean' | 'date';
+    column?: string;
+    refStrength?: RefStrength;
+}
+interface DocumentTypeSettings {
+    baseGrants?: Record<string, Permission[]>;
+    maxVersionsPerRoot?: number;
+    pii?: boolean;
+    /** Hide this type from the admin content list and all-view (e.g. internal system types like 'plugin'). */
+    internal?: boolean;
+    /**
+     * Shared/global type: its documents are NOT tenant-scoped — they live in one shared pool and are
+     * visible from every tenant. Opt-in (default false). When false, the type is tenant-isolated like
+     * everything else. See `effectiveTenantForType` (services/document-request-context.ts).
+     */
+    global?: boolean;
+    /**
+     * Retain historical version rows for this type. Default false.
+     * When false: saveDraft updates the working draft row in place and publish deletes the
+     * superseded published row (at most ~2 rows per root, no history accumulation).
+     * When true: new row per saveDraft + prune to maxVersionsPerRoot (the versioning-plugin opts types in).
+     */
+    versioning?: boolean;
+}
+interface Document {
+    id: string;
+    rootId: string;
+    typeId: string;
+    typeVersion: number;
+    versionOfId: string | null;
+    versionNumber: number;
+    isCurrentDraft: boolean;
+    isPublished: boolean;
+    status: DocumentStatus;
+    parentRootId: string;
+    slug: string | null;
+    path: string | null;
+    title: string | null;
+    zone: string | null;
+    sortOrder: number;
+    visible: boolean;
+    publishedAt: number | null;
+    scheduledAt: number | null;
+    expiresAt: number | null;
+    deletedAt: number | null;
+    tenantId: string;
+    locale: string;
+    translationGroupId: string;
+    data: Record<string, unknown>;
+    metadata: Record<string, unknown>;
+    ownerId: string | null;
+    createdBy: string | null;
+    updatedBy: string | null;
+    createdAt: number;
+    updatedAt: number;
+}
+interface PrincipalRef {
+    type: PrincipalType;
+    id: string;
+}
+declare const createDocumentSchema: z.ZodObject<{
+    typeId: z.ZodString;
+    tenantId: z.ZodDefault<z.ZodString>;
+    locale: z.ZodDefault<z.ZodString>;
+    parentRootId: z.ZodDefault<z.ZodString>;
+    slug: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    title: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    zone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    sortOrder: z.ZodDefault<z.ZodNumber>;
+    visible: z.ZodDefault<z.ZodBoolean>;
+    scheduledAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    data: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    ownerId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    publishOnCreate: z.ZodDefault<z.ZodBoolean>;
+    createdAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    updatedAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.core.$strip>;
+declare const updateDocumentSchema: z.ZodObject<{
+    title: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    slug: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    zone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    sortOrder: z.ZodOptional<z.ZodNumber>;
+    visible: z.ZodOptional<z.ZodBoolean>;
+    scheduledAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    updatedBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+type CreateDocumentInput = z.infer<typeof createDocumentSchema>;
+type UpdateDocumentInput = z.infer<typeof updateDocumentSchema>;
+
+type ListStatus = 'published' | 'draft' | 'all';
+interface ListDocumentsOptions {
+    typeId?: string;
+    /** Which lifecycle axis to list: published row, current-draft row, or either. */
+    status?: ListStatus;
+    locale?: string;
+    parentRootId?: string;
+    limit?: number;
+    cursorUpdatedAt?: number;
+    cursorId?: string;
+    now?: number;
+    /** Resolved generated-column filters, e.g. { column: 'q_tst_rating', value: 4 }. Caller maps
+     *  field→column via the type's queryableFields; column names are format-guarded here too. */
+    scalarFilters?: Array<{
+        column: string;
+        value: string | number;
+    }>;
+    /** Multi-valued facet filter, e.g. { field: 'tags', value: 'homepage' }. Bound as params. */
+    facetFilter?: {
+        field: string;
+        value: string;
+    };
+    /** Generated-column to sort by (else keyset on updated_at). Format-guarded. */
+    sortColumn?: string | null;
+    sortDir?: 'ASC' | 'DESC';
+    /** Apply the schedule window (scheduled_at/expires_at) — public reads only. */
+    timeWindow?: boolean;
+}
+declare class DocumentRepository {
+    private db;
+    private tenantId;
+    private permissions;
+    constructor(db: D1Database$1, tenantId: string);
+    getById(id: string): Promise<Document | null>;
+    getCurrentDraft(rootId: string): Promise<Document | null>;
+    getPublished(rootId: string): Promise<Document | null>;
+    list(opts?: ListDocumentsOptions): Promise<Document[]>;
+    listPublished(opts?: ListDocumentsOptions): Promise<Document[]>;
+    listDrafts(opts?: ListDocumentsOptions): Promise<Document[]>;
+    getVersionHistory(rootId: string): Promise<Document[]>;
+    getInboundReferences(toRootId: string): Promise<Array<{
+        fromDocumentId: string;
+        fieldName: string;
+        refStrength: string;
+    }>>;
+    isAllowed(principalSet: PrincipalRef[], rootId: string, permission: Permission, typeSettings: DocumentTypeSettings): Promise<boolean>;
+}
+
+interface DocumentsServiceOptions {
+    queryableFields?: QueryableField[];
+    typeSchemaVersion?: number;
+    maxVersionsPerRoot?: number;
+    /** Tenant this service operates within. Every root-keyed lookup is scoped to it (R3). POC default: 'default'. */
+    tenantId?: string;
+    /** Retain version history (new row per saveDraft, supersede-as-history). Default false (in-place). */
+    versioning?: boolean;
+}
+declare class DocumentsService {
+    private db;
+    private opts;
+    private projection;
+    private tenantId;
+    private versioning;
+    constructor(db: D1Database$1, opts?: DocumentsServiceOptions);
+    create(input: CreateDocumentInput, createdBy?: string): Promise<Document>;
+    saveDraft(rootId: string, input: UpdateDocumentInput, updatedBy?: string): Promise<Document>;
+    private updateInPlace;
+    publish(documentId: string, publishedBy?: string): Promise<Document>;
+    unpublish(documentId: string): Promise<Document>;
+    softDelete(documentId: string): Promise<void>;
+    erase(rootId: string, tenantId: string): Promise<void>;
+}
+
 /**
  * Cloudflare Email binding provider (MailChannels / send_email binding)
  *
@@ -262,6 +439,17 @@ declare const emailReconciliationPlugin: DefinedPlugin;
 declare const redirectPlugin: DefinedPlugin;
 declare function createRedirectPlugin(): DefinedPlugin;
 
+/**
+ * Hello World Plugin — Payload-shaped pilot port.
+ *
+ * Demonstrates the v4 plugin shape: definePlugin(...) with declarative menu
+ * + configSchema + sync register. Replaces the legacy PluginBuilder fluent
+ * API. Keeps the same id/version/routes so existing tests and the manifest
+ * registry continue to resolve it.
+ */
+declare const helloWorldPlugin: DefinedPlugin;
+declare function createHelloWorldPlugin(): DefinedPlugin;
+
 /**
  * Site Settings Collection
  *
@@ -541,4 +729,4 @@ declare function createUserProfilesPlugin(): DefinedPlugin;
 
 declare const VERSION: string;
 
-export { BUILT_IN_PROVIDERS, type CFSendEmailBinding, CloudflareEmailProvider, type CloudflareEmailProviderOptions, FieldType, OAuthService, PluginDependencyCycleError, type ProfileFieldDefinition, RbacService, type SortablePlugin, type TopoSortOptions, type UserProfileConfig, VERSION, bootstrapDocumentTypes, createDb, createOAuthProvidersPlugin, createRedirectPlugin, createUserProfilesPlugin, defineUserProfile, emailReconciliationPlugin, generateTriggersComment, getUserProfileConfig, oauthProvidersPlugin, parseCronTriggers, redirectPlugin, _default as siteSettingsCollection, topoSort, updateWranglerTriggers, userProfilesPlugin };
+export { BUILT_IN_PROVIDERS, type CFSendEmailBinding, CloudflareEmailProvider, type CloudflareEmailProviderOptions, DocumentRepository, DocumentsService, FieldType, OAuthService, PluginDependencyCycleError, type ProfileFieldDefinition, RbacService, type SortablePlugin, type TopoSortOptions, type UserProfileConfig, VERSION, bootstrapDocumentTypes, createDb, createHelloWorldPlugin, createOAuthProvidersPlugin, createRedirectPlugin, createUserProfilesPlugin, defineUserProfile, emailReconciliationPlugin, generateTriggersComment, getUserProfileConfig, helloWorldPlugin, oauthProvidersPlugin, parseCronTriggers, redirectPlugin, _default as siteSettingsCollection, topoSort, updateWranglerTriggers, userProfilesPlugin };