@sonicjs-cms/core 3.0.0-beta.2 → 3.0.0-beta.20

package/dist/index.js

@@ -1,41 +1,43 @@
-import { createAuth } from './chunk-IVPRUGTY.js';
-import { getEmailService, hasEmailService, setEmailService, invalidateVariablesCache, resolveVariablesInObject, resolveDocScope, denyIfNotAllowed, DocumentRepository, dispatchHookEvent, getCustomData, renderTable, getVariablesCached, setVariablesCache, TenantService, isValidMemberRole, renderConfirmationDialog, getConfirmationDialogScript, VALID_MEMBER_ROLES, userProfilesPlugin, lexicalEditorPlugin, api_media_default, api_system_default, apiDocumentsRoutes, api_default, adminDocumentsRoutes, admin_api_default, adminCollectionsRoutes, adminSettingsRoutes, router2, admin_content_default, adminMediaRoutes, router, adminPluginRoutes, adminLogsRoutes, userRoutes, auth_default, test_cleanup_default } from './chunk-VD2EA3WT.js';
-export { ROUTES_INFO, admin_api_default as adminApiRoutes, adminCheckboxRoutes, adminCollectionsRoutes, admin_content_default as adminContentRoutes, router as adminDashboardRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, userRoutes as adminUsersRoutes, api_content_crud_default as apiContentCrudRoutes, api_media_default as apiMediaRoutes, api_default as apiRoutes, api_system_default as apiSystemRoutes, auth_default as authRoutes, createUserProfilesPlugin, defineUserProfile, getUserProfileConfig, userProfilesPlugin } from './chunk-VD2EA3WT.js';
-import './chunk-IESEVHXL.js';
-import './chunk-EF2NQUIQ.js';
-import { SettingsService, setAppInstance } from './chunk-ZEZ245PW.js';
-export { Logger, getLogger, initLogger } from './chunk-ZEZ245PW.js';
+import { createAuth } from './chunk-SOZUG52O.js';
+import { getEmailService, hasEmailService, setEmailService, invalidateVariablesCache, resolveVariablesInObject, resolveDocScope, denyIfNotAllowed, DocumentRepository, dispatchHookEvent, getCustomData, createDocumentSchema, renderTable, getVariablesCached, setVariablesCache, TenantService, isValidMemberRole, renderConfirmationDialog, getConfirmationDialogScript, VALID_MEMBER_ROLES, userProfilesPlugin, lexicalEditorPlugin, api_media_default, api_system_default, apiDocumentsRoutes, api_default, adminDocumentsRoutes, admin_api_default, adminCollectionsRoutes, adminSettingsRoutes, router2, admin_content_default, adminMediaRoutes, router, adminPluginRoutes, adminLogsRoutes, userRoutes, auth_default, test_cleanup_default } from './chunk-5UCMLBRQ.js';
+export { DocumentRepository, ROUTES_INFO, admin_api_default as adminApiRoutes, adminCheckboxRoutes, adminCollectionsRoutes, admin_content_default as adminContentRoutes, router as adminDashboardRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, userRoutes as adminUsersRoutes, api_content_crud_default as apiContentCrudRoutes, api_media_default as apiMediaRoutes, api_default as apiRoutes, api_system_default as apiSystemRoutes, auth_default as authRoutes, createUserProfilesPlugin, defineUserProfile, getUserProfileConfig, userProfilesPlugin } from './chunk-5UCMLBRQ.js';
+import './chunk-VVYVFCML.js';
+import './chunk-RMRJGMDE.js';
+import { SettingsService, setAppInstance } from './chunk-2XAQTPAE.js';
+export { Logger, getLogger, initLogger } from './chunk-2XAQTPAE.js';
 import { getAllCacheStats, CACHE_CONFIGS, getCacheService, clearAllCaches, parseCacheKey } from './chunk-K25XHMM3.js';
 import { schema_exports } from './chunk-AI663NBO.js';
 export { apiTokens, content, contentVersions, insertContentSchema, insertLogConfigSchema, insertMediaSchema, insertPluginActivityLogSchema, insertPluginAssetSchema, insertPluginHookSchema, insertPluginRouteSchema, insertPluginSchema, insertSystemLogSchema, insertUserSchema, insertWorkflowHistorySchema, logConfig, media, pluginActivityLog, pluginAssets, pluginHooks, pluginRoutes, plugins, selectContentSchema, selectLogConfigSchema, selectMediaSchema, selectPluginActivityLogSchema, selectPluginAssetSchema, selectPluginHookSchema, selectPluginRouteSchema, selectPluginSchema, selectSystemLogSchema, selectUserSchema, selectWorkflowHistorySchema, systemLogs, users, workflowHistory } from './chunk-AI663NBO.js';
-import { requireAuth, DocumentTypeRegistry, requireRbac, requireRole, getJwtExpirySecondsFromDb, AuthManager, metricsMiddleware, bootstrapMiddleware, securityHeadersMiddleware, csrfProtection } from './chunk-RZ6H7OZK.js';
-export { AuthManager, PermissionManager, bootstrapDocumentTypes, bootstrapMiddleware, cacheHeaders, compressionMiddleware, detailedLoggingMiddleware, getActivePlugins, isPluginActive, logActivity, loggingMiddleware, optionalAuth, performanceLoggingMiddleware, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeadersMiddleware as securityHeaders, securityLoggingMiddleware } from './chunk-RZ6H7OZK.js';
-import { RbacService, DocumentsService } from './chunk-BLMTL57B.js';
-export { RbacService } from './chunk-BLMTL57B.js';
-import { nanoid } from './chunk-GCDZZNIN.js';
-import { PluginService, PLUGIN_REGISTRY, invalidateTenantCache, getCollectionRegistry, TENANT_COOKIE, MULTI_TENANT_PLUGIN_ID, collectionRecordToRow, tenantMiddleware } from './chunk-ZGGXCFR6.js';
-export { PluginBootstrapService, PluginService as PluginServiceClass, getAvailableCollectionNames, loadCollectionConfig, loadCollectionConfigs, registerCollections, validateCollectionConfig } from './chunk-ZGGXCFR6.js';
-export { MigrationService } from './chunk-NLJVSER2.js';
-export { renderFilterBar } from './chunk-6JQOUUOB.js';
-import { renderAdminLayout } from './chunk-HDWE5FRJ.js';
-export { getConfirmationDialogScript, renderAlert, renderConfirmationDialog, renderForm, renderFormField, renderPagination, renderTable } from './chunk-HDWE5FRJ.js';
-import { init_admin_layout_catalyst_template, renderAdminLayoutCatalyst } from './chunk-3TB6AT6X.js';
-import { TurnstileService, HookSystemImpl, createPluginWirer, registerPluginRoutes, setPluginMenu } from './chunk-YHSQVQXX.js';
-export { HookSystemImpl, HookUtils, PluginDependencyCycleError, PluginManager as PluginManagerClass, PluginRegistryImpl, PluginValidator as PluginValidatorClass, RegisterPluginsError, ScopedHookSystem as ScopedHookSystemClass, collectCronSchedules, collectCrons, createScheduledHandler, dispatchCronTick, getPluginMenu, registerPlugins, resetPluginMenu, resolvePluginMenuItems, setPluginMenu, topoSort } from './chunk-YHSQVQXX.js';
-import { definePlugin, setPluginDefinitions } from './chunk-6OUHGKFD.js';
-export { applySchemaDefaults, definePlugin, isDefinedPlugin, parseConfigSchema, parseFormDataToSettings, renderSchemaFields } from './chunk-6OUHGKFD.js';
+import { requireAuth, DocumentTypeRegistry, requireRbac, requireRole, getJwtExpirySecondsFromDb, AuthManager, metricsMiddleware, bootstrapMiddleware, securityHeadersMiddleware, csrfProtection } from './chunk-WCA4VENG.js';
+export { AuthManager, PermissionManager, bootstrapDocumentTypes, bootstrapMiddleware, cacheHeaders, compressionMiddleware, detailedLoggingMiddleware, getActivePlugins, isPluginActive, logActivity, loggingMiddleware, optionalAuth, performanceLoggingMiddleware, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeadersMiddleware as securityHeaders, securityLoggingMiddleware } from './chunk-WCA4VENG.js';
+import { RbacService, DocumentsService } from './chunk-3TMTYJAJ.js';
+export { DocumentsService, RbacService } from './chunk-3TMTYJAJ.js';
+import { nanoid } from './chunk-UWUP2VMT.js';
+import { PluginService, PLUGIN_REGISTRY, invalidateTenantCache, getCollectionRegistry, TENANT_COOKIE, MULTI_TENANT_PLUGIN_ID, collectionRecordToRow, tenantMiddleware } from './chunk-RDH6PUOP.js';
+export { PluginBootstrapService, PluginService as PluginServiceClass, getAvailableCollectionNames, loadCollectionConfig, loadCollectionConfigs, registerCollections, validateCollectionConfig } from './chunk-RDH6PUOP.js';
+export { MigrationService } from './chunk-DSXEVMOM.js';
+export { renderFilterBar } from './chunk-JQISFW6U.js';
+import { renderAdminLayout } from './chunk-OBA2RYZN.js';
+export { getConfirmationDialogScript, renderAlert, renderConfirmationDialog, renderForm, renderFormField, renderPagination, renderTable } from './chunk-OBA2RYZN.js';
+import { init_admin_layout_catalyst_template, renderAdminLayoutCatalyst } from './chunk-5V62WT6M.js';
+export { renderAdminLayoutCatalyst } from './chunk-5V62WT6M.js';
+import { TurnstileService, HookSystemImpl, createPluginWirer, registerPluginRoutes, setPluginMenu, resolvePluginMenuItems } from './chunk-MYQ7KZUQ.js';
+export { HookSystemImpl, HookUtils, PluginDependencyCycleError, PluginManager as PluginManagerClass, PluginRegistryImpl, PluginValidator as PluginValidatorClass, RegisterPluginsError, ScopedHookSystem as ScopedHookSystemClass, collectCronSchedules, collectCrons, createScheduledHandler, dispatchCronTick, getPluginMenu, registerPlugins, resetPluginMenu, resolvePluginMenuItems, setPluginMenu, topoSort } from './chunk-MYQ7KZUQ.js';
+import { definePlugin, setPluginDefinitions } from './chunk-GMZ5TGYP.js';
+export { applySchemaDefaults, definePlugin, isDefinedPlugin, parseConfigSchema, parseFormDataToSettings, renderSchemaFields } from './chunk-GMZ5TGYP.js';
 import { setHookSystem } from './chunk-RNZFGN4R.js';
 export { getHookSystem, getTypedHooks, hasHookSystem, resetHookSystem, setHookSystem } from './chunk-RNZFGN4R.js';
 export { QueryFilterBuilder, TemplateRenderer, buildQuery, renderTemplate, templateRenderer } from './chunk-QZGABF2M.js';
-import './chunk-X7ZAEI5S.js';
 export { metricsTracker } from './chunk-FICTAGD4.js';
-import { getCoreVersion, package_default } from './chunk-NMPEMSU4.js';
-export { SONICJS_VERSION, getCoreVersion } from './chunk-NMPEMSU4.js';
+import './chunk-X7ZAEI5S.js';
+import { getCoreVersion, package_default } from './chunk-W53J3BJ2.js';
+export { SONICJS_VERSION, getCoreVersion } from './chunk-W53J3BJ2.js';
 import { escapeHtml, sanitizeInput } from './chunk-TQABQWOP.js';
 export { escapeHtml, sanitizeInput, sanitizeObject } from './chunk-TQABQWOP.js';
 export { HOOKS } from './chunk-QXOZI5Q2.js';
 import './chunk-V4OQ3NZ2.js';
 import { Hono } from 'hono';
+import { cors } from 'hono/cors';
 import { z } from 'zod';
 import { setCookie, getCookie } from 'hono/cookie';
 import { html } from 'hono/html';
@@ -49,6 +51,7 @@ var DatabaseToolsService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   /**
    * Get database statistics
    */
@@ -907,6 +910,7 @@ var EmailSettingsService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   async load() {
     let row = null;
     try {
@@ -935,6 +939,8 @@ var SiteConfigService = class {
     this.db = db;
     this.env = env;
   }
+  db;
+  env;
   async load() {
     const settings = new SettingsService(this.db);
     const general = await settings.getGeneralSettings();
@@ -1272,6 +1278,8 @@ var EmailValidationError = class extends Error {
     this.reason = reason;
     this.name = "EmailValidationError";
   }
+  field;
+  reason;
   code = "EMAIL_VALIDATION_FAILED";
 };
 
@@ -1307,6 +1315,9 @@ var CfGraphqlClient = class {
       throw new EmailValidationError("apiToken", "EMAIL_API_TOKEN is required for GraphQL queries");
     }
   }
+  zoneId;
+  apiToken;
+  fetchImpl;
   async queryEmailSends(input) {
     const startIso = new Date(input.startSeconds * 1e3).toISOString();
     const endIso = new Date(input.endSeconds * 1e3).toISOString();
@@ -1369,6 +1380,7 @@ var EmailLogService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   /**
    * Records a successful submission to CF Email Service. `status` =
    * `'submitted'`, `delivery_state` remains NULL until reconciliation runs.
@@ -1542,6 +1554,8 @@ var ReconciliationService = class {
     this.graphql = graphql;
     this.emailLog = emailLog;
   }
+  graphql;
+  emailLog;
   async run(input = {}) {
     const windowHours = input.windowHours ?? 24;
     const nowMs = input.now ?? Date.now();
@@ -1950,6 +1964,7 @@ var CloudflareEmailProvider = class {
   constructor(binding) {
     this.binding = binding;
   }
+  binding;
   name = "cloudflare";
   isConfigured() {
     return !!this.binding;
@@ -2132,6 +2147,7 @@ var OTPService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   /**
    * Generate a secure random OTP code
    */
@@ -2766,6 +2782,7 @@ var OAuthService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   /**
    * Build the authorization redirect URL for a provider.
    */
@@ -3282,6 +3299,7 @@ var EmbeddingService = class {
   constructor(ai) {
     this.ai = ai;
   }
+  ai;
   /**
    * Generate embedding for a single text
    */
@@ -3486,6 +3504,9 @@ var CustomRAGService = class {
     this.embeddingService = new EmbeddingService(ai);
     this.chunkingService = new ChunkingService();
   }
+  db;
+  ai;
+  vectorize;
   embeddingService;
   chunkingService;
   /**
@@ -3776,6 +3797,9 @@ var AISearchService = class {
       console.log("[AISearchService] Custom RAG not available, using keyword search only");
     }
   }
+  db;
+  ai;
+  vectorize;
   customRAG;
   /**
    * Get plugin settings
@@ -4216,6 +4240,9 @@ var IndexManager = class {
       console.log("[IndexManager] Custom RAG initialized");
     }
   }
+  db;
+  ai;
+  vectorize;
   customRAG;
   /**
    * Index all content items within a collection using Custom RAG
@@ -5149,6 +5176,8 @@ var SecurityAuditService = class {
       tenantId: TENANT
     });
   }
+  db;
+  settings;
   docsService;
   async logEvent(event) {
     const doc = await this.docsService.create({
@@ -6092,6 +6121,7 @@ var BruteForceDetector = class {
     this.kv = kv;
     this.settings = settings || DEFAULT_SETTINGS2.bruteForce;
   }
+  kv;
   settings;
   async recordFailedAttempt(ip, email) {
     if (!this.settings.enabled || !this.kv) {
@@ -6644,11 +6674,465 @@ var securityAuditPlugin = definePlugin({
   deactivate: async () => console.log("[SecurityAudit] Plugin deactivated")
 });
 
+// src/plugins/core-plugins/api-keys-plugin/services/api-key-service.ts
+var API_KEY_QUERYABLE = [
+  { name: "keyHash", kind: "scalar", type: "text", column: "q_apikey_hash" },
+  { name: "userId", kind: "scalar", type: "text", column: "q_apikey_user_id" },
+  { name: "revoked", kind: "scalar", type: "integer", column: "q_apikey_revoked" }
+];
+var KEY_PREFIX = "sk_";
+var KEY_BYTES = 24;
+var DISPLAY_PREFIX_LEN = KEY_PREFIX.length + 8;
+function generateApiKeySecret() {
+  const bytes = new Uint8Array(KEY_BYTES);
+  crypto.getRandomValues(bytes);
+  let hex = "";
+  for (const b of bytes) hex += b.toString(16).padStart(2, "0");
+  return KEY_PREFIX + hex;
+}
+async function hashApiKey(secret) {
+  const data = new TextEncoder().encode(secret);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  const view = new Uint8Array(digest);
+  let hex = "";
+  for (const b of view) hex += b.toString(16).padStart(2, "0");
+  return hex;
+}
+var ApiKeyService = class {
+  constructor(db, tenantId = "default") {
+    this.db = db;
+    this.tenantId = tenantId;
+  }
+  db;
+  tenantId;
+  docService() {
+    return new DocumentsService(this.db, {
+      queryableFields: API_KEY_QUERYABLE,
+      tenantId: this.tenantId,
+      maxVersionsPerRoot: 1
+    });
+  }
+  /** Count a user's active (non-revoked) keys — used to enforce the per-user cap. */
+  async countForUser(userId) {
+    const row = await this.db.prepare(
+      `SELECT COUNT(*) AS c FROM documents
+         WHERE type_id = 'api_key' AND tenant_id = ? AND is_current_draft = 1
+           AND deleted_at IS NULL AND q_apikey_user_id = ? AND q_apikey_revoked = 0`
+    ).bind(this.tenantId, userId).first();
+    return row?.c ?? 0;
+  }
+  /**
+   * Mint a new key for a user. The returned `key` is the only time the plaintext
+   * exists outside the caller — it is hashed before storage.
+   */
+  async create(input) {
+    const name = input.name.trim() || "API Key";
+    const secret = generateApiKeySecret();
+    const keyHash = await hashApiKey(secret);
+    const prefix = secret.slice(0, DISPLAY_PREFIX_LEN);
+    const expiresAt = input.expiresAt ?? null;
+    const doc = await this.docService().create(
+      createDocumentSchema.parse({
+        typeId: "api_key",
+        tenantId: this.tenantId,
+        title: name,
+        ownerId: input.userId,
+        publishOnCreate: true,
+        data: {
+          name,
+          userId: input.userId,
+          keyHash,
+          keyPrefix: prefix,
+          revoked: 0,
+          lastUsedAt: null,
+          expiresAt
+        }
+      }),
+      input.userId
+    );
+    return { id: doc.rootId, key: secret, name, prefix, expiresAt };
+  }
+  /** List a user's non-revoked keys (metadata only — never the secret or hash). */
+  async list(userId) {
+    const res = await this.db.prepare(
+      `SELECT root_id, data, created_at FROM documents
+         WHERE type_id = 'api_key' AND tenant_id = ? AND is_current_draft = 1
+           AND deleted_at IS NULL AND q_apikey_user_id = ? AND q_apikey_revoked = 0
+         ORDER BY created_at DESC`
+    ).bind(this.tenantId, userId).all();
+    return (res.results ?? []).map((row) => {
+      const d = JSON.parse(row.data);
+      return {
+        id: row.root_id,
+        name: d.name ?? "API Key",
+        prefix: d.keyPrefix ?? "",
+        createdAt: row.created_at,
+        lastUsedAt: d.lastUsedAt ?? null,
+        expiresAt: d.expiresAt ?? null
+      };
+    });
+  }
+  /**
+   * Revoke (hard-delete) a key owned by `userId`. Credentials are erased, not
+   * soft-flagged. Returns false if the key does not exist or is not owned by
+   * the caller (no information leak about other users' keys).
+   */
+  async revoke(rootId, userId) {
+    const row = await this.db.prepare(
+      `SELECT q_apikey_user_id AS owner FROM documents
+         WHERE root_id = ? AND tenant_id = ? AND type_id = 'api_key' AND is_current_draft = 1 AND deleted_at IS NULL`
+    ).bind(rootId, this.tenantId).first();
+    if (!row || row.owner !== userId) return false;
+    await this.docService().erase(rootId, this.tenantId);
+    return true;
+  }
+  /**
+   * Resolve a presented secret to its owning user, or null. Rejects unknown,
+   * revoked, expired keys and inactive users. Best-effort updates lastUsedAt.
+   */
+  async resolve(secret) {
+    if (!secret || !secret.startsWith(KEY_PREFIX)) return null;
+    const keyHash = await hashApiKey(secret);
+    const keyRow2 = await this.db.prepare(
+      `SELECT root_id, data FROM documents
+         WHERE type_id = 'api_key' AND tenant_id = ? AND is_current_draft = 1 AND deleted_at IS NULL
+           AND q_apikey_hash = ? AND q_apikey_revoked = 0
+         LIMIT 1`
+    ).bind(this.tenantId, keyHash).first();
+    if (!keyRow2) return null;
+    const d = JSON.parse(keyRow2.data);
+    if (d.expiresAt != null && Date.now() > Number(d.expiresAt)) return null;
+    const user = await this.db.prepare(`SELECT id, email, role, is_active, is_super_admin FROM auth_user WHERE id = ?`).bind(d.userId).first();
+    if (!user || user.is_active !== 1) return null;
+    try {
+      await this.touchLastUsed(keyRow2.root_id, d);
+    } catch {
+    }
+    return {
+      userId: user.id,
+      email: user.email,
+      role: user.role ?? "viewer",
+      isSuperAdmin: user.is_super_admin === 1
+    };
+  }
+  /** Update lastUsedAt in-place (single-version type, no history churn). */
+  async touchLastUsed(rootId, data) {
+    const next = JSON.stringify({ ...data, lastUsedAt: Date.now() });
+    await this.db.prepare(
+      `UPDATE documents SET data = ? WHERE root_id = ? AND tenant_id = ? AND type_id = 'api_key' AND is_current_draft = 1`
+    ).bind(next, rootId, this.tenantId).run();
+  }
+};
+
+// src/plugins/core-plugins/api-keys-plugin/components/keys-page.ts
+init_admin_layout_catalyst_template();
+function fmtDate(ms) {
+  if (!ms) return "\u2014";
+  try {
+    return new Date(ms).toISOString().slice(0, 10);
+  } catch {
+    return "\u2014";
+  }
+}
+function keyRow(k) {
+  const name = escapeHtml(k.name);
+  const prefix = escapeHtml(k.prefix);
+  const id = escapeHtml(k.id);
+  return `
+    <tr class="border-t border-zinc-950/5 dark:border-white/10" data-key-id="${id}">
+      <td class="py-3 pr-4 text-sm font-medium text-zinc-950 dark:text-white">${name}</td>
+      <td class="py-3 pr-4 text-sm font-mono text-zinc-500 dark:text-zinc-400">${prefix}\u2026</td>
+      <td class="py-3 pr-4 text-sm text-zinc-500 dark:text-zinc-400">${fmtDate(k.createdAt ? k.createdAt * 1e3 : null)}</td>
+      <td class="py-3 pr-4 text-sm text-zinc-500 dark:text-zinc-400">${k.lastUsedAt ? fmtDate(k.lastUsedAt) : "Never"}</td>
+      <td class="py-3 pr-4 text-sm text-zinc-500 dark:text-zinc-400">${k.expiresAt ? fmtDate(k.expiresAt) : "Never"}</td>
+      <td class="py-3 text-right">
+        <button type="button" onclick="revokeApiKey('${id}', '${name.replace(/'/g, "\\'")}')"
+          class="rounded-lg bg-red-50 dark:bg-red-900/20 px-3 py-1.5 text-sm font-medium text-red-700 dark:text-red-400 hover:bg-red-100 dark:hover:bg-red-900/40 ring-1 ring-red-200 dark:ring-red-800 transition-colors">
+          Revoke
+        </button>
+      </td>
+    </tr>`;
+}
+function renderApiKeysPage(data) {
+  const { keys, user, version, dynamicMenuItems } = data;
+  const rows = keys.length ? keys.map(keyRow).join("") : `<tr><td colspan="6" class="py-8 text-center text-sm text-zinc-500 dark:text-zinc-400">No API keys yet. Create one to enable programmatic access.</td></tr>`;
+  const content2 = `
+    <div>
+      <div class="sm:flex sm:items-center sm:justify-between mb-6">
+        <div class="sm:flex-auto">
+          <h1 class="text-2xl/8 font-semibold text-zinc-950 dark:text-white sm:text-xl/8">API Keys</h1>
+          <p class="mt-2 text-sm/6 text-zinc-500 dark:text-zinc-400">
+            Long-lived secrets for headless / server-to-server REST access. Send a key as the
+            <code class="font-mono">x-api-key</code> header or <code class="font-mono">Authorization: Bearer &lt;key&gt;</code>.
+            The secret is shown once at creation \u2014 store it now.
+          </p>
+        </div>
+        <div class="mt-4 sm:mt-0 sm:ml-16">
+          <button type="button" onclick="document.getElementById('create-key-modal').classList.remove('hidden')"
+            class="inline-flex items-center justify-center rounded-lg bg-cyan-600 px-4 py-2.5 text-sm font-semibold text-white hover:bg-cyan-500 transition-colors shadow-sm">
+            Create API key
+          </button>
+        </div>
+      </div>
+
+      <!-- Newly-created secret banner (populated by JS, shown once) -->
+      <div id="new-key-banner" class="hidden mb-6 rounded-xl bg-emerald-50 dark:bg-emerald-900/20 p-4 ring-1 ring-emerald-200 dark:ring-emerald-800">
+        <p class="text-sm font-medium text-emerald-800 dark:text-emerald-300 mb-2">
+          Copy your new key now \u2014 it will not be shown again.
+        </p>
+        <div class="flex items-center gap-2">
+          <code id="new-key-value" class="flex-1 rounded-lg bg-white dark:bg-zinc-900 px-3 py-2 text-sm font-mono text-zinc-950 dark:text-white ring-1 ring-zinc-950/10 dark:ring-white/10 break-all"></code>
+          <button type="button" onclick="copyNewKey()"
+            class="rounded-lg bg-emerald-600 px-3 py-2 text-sm font-semibold text-white hover:bg-emerald-500 transition-colors">
+            Copy
+          </button>
+        </div>
+      </div>
+
+      <div class="rounded-xl bg-white/80 dark:bg-zinc-900/80 backdrop-blur-xl p-6 ring-1 ring-zinc-950/5 dark:ring-white/10 shadow-sm overflow-x-auto">
+        <table class="w-full text-left">
+          <thead>
+            <tr class="text-xs font-semibold uppercase tracking-wide text-zinc-500 dark:text-zinc-400">
+              <th class="pb-2 pr-4">Name</th>
+              <th class="pb-2 pr-4">Prefix</th>
+              <th class="pb-2 pr-4">Created</th>
+              <th class="pb-2 pr-4">Last used</th>
+              <th class="pb-2 pr-4">Expires</th>
+              <th class="pb-2 text-right">Actions</th>
+            </tr>
+          </thead>
+          <tbody id="keys-tbody">${rows}</tbody>
+        </table>
+      </div>
+    </div>
+
+    <!-- Create modal -->
+    <div id="create-key-modal" class="hidden fixed inset-0 z-50 flex items-center justify-center bg-black/40 p-4">
+      <div class="w-full max-w-md rounded-xl bg-white dark:bg-zinc-900 p-6 ring-1 ring-zinc-950/10 dark:ring-white/10 shadow-xl">
+        <h2 class="text-base font-semibold text-zinc-950 dark:text-white mb-4">Create API key</h2>
+        <label class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1">Name</label>
+        <input id="new-key-name" type="text" placeholder="e.g. CI deploy token"
+          class="w-full rounded-lg border-zinc-300 dark:border-zinc-700 bg-white dark:bg-zinc-800 px-3 py-2 text-sm text-zinc-950 dark:text-white mb-4 ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10">
+        <label class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1">Expires in (days, optional)</label>
+        <input id="new-key-expiry" type="number" min="1" max="3650" placeholder="Never"
+          class="w-full rounded-lg border-zinc-300 dark:border-zinc-700 bg-white dark:bg-zinc-800 px-3 py-2 text-sm text-zinc-950 dark:text-white mb-4 ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10">
+        <div class="flex justify-end gap-2">
+          <button type="button" onclick="document.getElementById('create-key-modal').classList.add('hidden')"
+            class="rounded-lg bg-white dark:bg-zinc-800 px-4 py-2 text-sm font-semibold text-zinc-950 dark:text-white ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10">
+            Cancel
+          </button>
+          <button type="button" onclick="createApiKey()"
+            class="rounded-lg bg-cyan-600 px-4 py-2 text-sm font-semibold text-white hover:bg-cyan-500 transition-colors">
+            Create
+          </button>
+        </div>
+      </div>
+    </div>
+
+    <script>
+      // CSRF: the csrf_token cookie is JS-readable (httpOnly:false); echo it back
+      // as X-CSRF-Token on state-changing requests (signed double-submit).
+      function csrfHeader() {
+        const m = document.cookie.match(/(?:^|; )csrf_token=([^;]+)/)
+        return m ? { 'X-CSRF-Token': decodeURIComponent(m[1]) } : {}
+      }
+      async function createApiKey() {
+        const name = document.getElementById('new-key-name').value.trim()
+        if (!name) { window.showNotification && window.showNotification('Name is required', 'error'); return }
+        const expiry = parseInt(document.getElementById('new-key-expiry').value, 10)
+        const body = { name }
+        if (Number.isFinite(expiry) && expiry > 0) body.expiresInDays = expiry
+        const res = await fetch('/admin/plugins/api-keys/api/keys', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', ...csrfHeader() },
+          body: JSON.stringify(body),
+        })
+        if (!res.ok) {
+          const e = await res.json().catch(() => ({}))
+          window.showNotification && window.showNotification(e.error || 'Failed to create key', 'error')
+          return
+        }
+        const { apiKey } = await res.json()
+        document.getElementById('create-key-modal').classList.add('hidden')
+        document.getElementById('new-key-value').textContent = apiKey.key
+        document.getElementById('new-key-banner').classList.remove('hidden')
+        setTimeout(() => location.reload(), 1500)
+      }
+      function copyNewKey() {
+        const v = document.getElementById('new-key-value').textContent
+        navigator.clipboard.writeText(v).then(() => window.showNotification && window.showNotification('Copied', 'success'))
+      }
+      async function revokeApiKey(id, name) {
+        if (!confirm('Revoke "' + name + '"? This cannot be undone and will break any client using it.')) return
+        const res = await fetch('/admin/plugins/api-keys/api/keys/' + id, { method: 'DELETE', headers: { ...csrfHeader() } })
+        if (res.ok) {
+          const row = document.querySelector('[data-key-id="' + id + '"]')
+          if (row) row.remove()
+          window.showNotification && window.showNotification('Key revoked', 'success')
+        } else {
+          window.showNotification && window.showNotification('Failed to revoke', 'error')
+        }
+      }
+    </script>`;
+  const layoutData = {
+    title: "API Keys",
+    pageTitle: "API Keys",
+    currentPath: "/admin/plugins/api-keys",
+    user,
+    content: content2,
+    version,
+    dynamicMenuItems
+  };
+  return renderAdminLayoutCatalyst(layoutData);
+}
+
+// src/plugins/core-plugins/api-keys-plugin/types.ts
+var DEFAULT_SETTINGS3 = {
+  maxKeysPerUser: 50,
+  defaultExpiryDays: 0
+};
+
+// src/plugins/core-plugins/api-keys-plugin/routes/admin.ts
+var adminRoutes4 = new Hono();
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var createSchema = z.object({
+  name: z.string().min(1).max(100),
+  // Optional lifetime in days; omitted/null → plugin default (which may be "never").
+  expiresInDays: z.number().int().positive().max(3650).nullish()
+});
+async function getSettings3(db) {
+  try {
+    const plugin2 = await new PluginService(db).getPlugin("api-keys");
+    if (plugin2?.settings) {
+      const s = typeof plugin2.settings === "string" ? JSON.parse(plugin2.settings) : plugin2.settings;
+      return { ...DEFAULT_SETTINGS3, ...s };
+    }
+  } catch {
+  }
+  return DEFAULT_SETTINGS3;
+}
+adminRoutes4.use("*", requireAuth());
+adminRoutes4.use("*", async (c, next) => {
+  const user = c.get("user");
+  if (user?.role !== "admin") {
+    return c.json({ error: "Access denied" }, 403);
+  }
+  return next();
+});
+adminRoutes4.get("/", async (c) => {
+  const user = c.get("user");
+  const tenantId = c.get("tenantId") || "default";
+  const keys = await new ApiKeyService(c.env.DB, tenantId).list(user.userId);
+  return c.html(
+    renderApiKeysPage({
+      keys,
+      user: { name: user.email, email: user.email, role: user.role },
+      version: c.get("appVersion"),
+      dynamicMenuItems: c.get("pluginMenuItems")
+    })
+  );
+});
+adminRoutes4.get("/api/keys", async (c) => {
+  const user = c.get("user");
+  const tenantId = c.get("tenantId") || "default";
+  const keys = await new ApiKeyService(c.env.DB, tenantId).list(user.userId);
+  return c.json({ keys });
+});
+adminRoutes4.post("/api/keys", async (c) => {
+  const user = c.get("user");
+  const tenantId = c.get("tenantId") || "default";
+  const body = await c.req.json().catch(() => ({}));
+  const parsed = createSchema.safeParse(body);
+  if (!parsed.success) {
+    return c.json({ error: "Invalid request", details: parsed.error.flatten() }, 400);
+  }
+  const settings = await getSettings3(c.env.DB);
+  const svc = new ApiKeyService(c.env.DB, tenantId);
+  if (await svc.countForUser(user.userId) >= settings.maxKeysPerUser) {
+    return c.json({ error: `API key limit reached (max ${settings.maxKeysPerUser})` }, 409);
+  }
+  const days = parsed.data.expiresInDays ?? (settings.defaultExpiryDays > 0 ? settings.defaultExpiryDays : null);
+  const expiresAt = days ? Date.now() + days * DAY_MS : null;
+  const created = await svc.create({ userId: user.userId, name: parsed.data.name, expiresAt });
+  return c.json({ apiKey: created }, 201);
+});
+adminRoutes4.delete("/api/keys/:id", async (c) => {
+  const user = c.get("user");
+  const tenantId = c.get("tenantId") || "default";
+  const ok = await new ApiKeyService(c.env.DB, tenantId).revoke(c.req.param("id") ?? "", user.userId);
+  if (!ok) return c.json({ error: "API key not found" }, 404);
+  return c.json({ success: true });
+});
+
+// src/plugins/core-plugins/api-keys-plugin/middleware/api-key-auth.ts
+function apiKeyAuthMiddleware() {
+  return async (c, next) => {
+    if (!c.get("user")) {
+      const authz = c.req.header("authorization") || "";
+      const bearer = authz.toLowerCase().startsWith("bearer ") ? authz.slice(7).trim() : "";
+      const presented = c.req.header("x-api-key") || (bearer.startsWith("sk_") ? bearer : "");
+      if (presented) {
+        try {
+          const tenantId = c.get("tenantId") || "default";
+          const resolved = await new ApiKeyService(c.env.DB, tenantId).resolve(presented);
+          if (resolved) {
+            c.set("user", {
+              userId: resolved.userId,
+              email: resolved.email,
+              role: resolved.role,
+              isSuperAdmin: resolved.isSuperAdmin,
+              // API keys are stateless bearer creds — no session window.
+              exp: 0,
+              iat: 0
+            });
+          }
+        } catch {
+        }
+      }
+    }
+    await next();
+  };
+}
+
+// src/plugins/core-plugins/api-keys-plugin/index.ts
+var KEY_ICON = `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z"/></svg>`;
+var apiKeysPlugin = definePlugin({
+  id: "api-keys",
+  version: "1.0.0-beta.1",
+  name: "API Keys",
+  description: "Programmatic API access keys for headless / server-to-server REST access.",
+  sonicjsVersionRange: "^3.0.0",
+  author: { name: "SonicJS Team" },
+  register(app2) {
+    app2.route("/admin/plugins/api-keys", adminRoutes4);
+  },
+  menu: [
+    { label: "API Keys", path: "/admin/plugins/api-keys", icon: KEY_ICON, order: 86 }
+  ],
+  configSchema: {
+    maxKeysPerUser: {
+      type: "number",
+      label: "Max keys per user",
+      description: "Hard cap on active keys a single user may hold.",
+      default: 50
+    },
+    defaultExpiryDays: {
+      type: "number",
+      label: "Default expiry (days)",
+      description: "Lifetime applied to new keys when no explicit expiry is given. 0 = never expires.",
+      default: 0
+    }
+  },
+  activate: async () => console.log("[ApiKeys] Plugin activated"),
+  deactivate: async () => console.log("[ApiKeys] Plugin deactivated")
+});
+
 // src/plugins/core-plugins/stripe-plugin/services/subscription-service.ts
 var SubscriptionService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   /**
    * Ensure the subscriptions table exists
    */
@@ -6887,6 +7371,7 @@ var StripeEventService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   async ensureTable() {
     await this.db.prepare(`
       CREATE TABLE IF NOT EXISTS stripe_events (
@@ -7371,7 +7856,7 @@ function renderEventPagination(page, totalPages, type, status) {
 }
 
 // src/plugins/core-plugins/stripe-plugin/types.ts
-var DEFAULT_SETTINGS3 = {
+var DEFAULT_SETTINGS4 = {
   stripePublishableKey: "",
   stripeSecretKey: "",
   stripeWebhookSecret: "",
@@ -7381,28 +7866,28 @@ var DEFAULT_SETTINGS3 = {
 };
 
 // src/plugins/core-plugins/stripe-plugin/routes/admin.ts
-var adminRoutes4 = new Hono();
-adminRoutes4.use("*", requireAuth());
-adminRoutes4.use("*", async (c, next) => {
+var adminRoutes5 = new Hono();
+adminRoutes5.use("*", requireAuth());
+adminRoutes5.use("*", async (c, next) => {
   const user = c.get("user");
   if (user?.role !== "admin") {
     return c.text("Access denied", 403);
   }
   return next();
 });
-async function getSettings3(db) {
+async function getSettings4(db) {
   try {
     const pluginService = new PluginService(db);
     const plugin2 = await pluginService.getPlugin("stripe");
     if (plugin2?.settings) {
       const settings = typeof plugin2.settings === "string" ? JSON.parse(plugin2.settings) : plugin2.settings;
-      return { ...DEFAULT_SETTINGS3, ...settings };
+      return { ...DEFAULT_SETTINGS4, ...settings };
     }
   } catch {
   }
-  return DEFAULT_SETTINGS3;
+  return DEFAULT_SETTINGS4;
 }
-adminRoutes4.get("/", async (c) => {
+adminRoutes5.get("/", async (c) => {
   const db = c.env.DB;
   const user = c.get("user");
   const subscriptionService = new SubscriptionService(db);
@@ -7425,7 +7910,7 @@ adminRoutes4.get("/", async (c) => {
   });
   return c.html(html4);
 });
-adminRoutes4.get("/events", async (c) => {
+adminRoutes5.get("/events", async (c) => {
   const db = c.env.DB;
   const user = c.get("user");
   const eventService = new StripeEventService(db);
@@ -7451,11 +7936,11 @@ adminRoutes4.get("/events", async (c) => {
   });
   return c.html(html4);
 });
-adminRoutes4.get("/settings", async (c) => {
+adminRoutes5.get("/settings", async (c) => {
   const db = c.env.DB;
   const user = c.get("user");
-  const settings = await getSettings3(db);
-  const { renderAdminLayoutCatalyst: renderAdminLayoutCatalyst2 } = await import('./admin-layout-catalyst.template-WHJGSWWD.js');
+  const settings = await getSettings4(db);
+  const { renderAdminLayoutCatalyst: renderAdminLayoutCatalyst2 } = await import('./admin-layout-catalyst.template-YQ4EMF2J.js');
   const content2 = `
     <div>
       <div class="mb-6">
@@ -7561,7 +8046,7 @@ adminRoutes4.get("/settings", async (c) => {
     dynamicMenuItems: c.get("pluginMenuItems")
   }));
 });
-adminRoutes4.post("/settings", async (c) => {
+adminRoutes5.post("/settings", async (c) => {
   try {
     const body = await c.req.json();
     const db = c.env.DB;
@@ -7583,6 +8068,7 @@ var StripeAPI = class {
   constructor(secretKey) {
     this.secretKey = secretKey;
   }
+  secretKey;
   baseUrl = "https://api.stripe.com/v1";
   /**
    * Verify a webhook signature
@@ -7712,17 +8198,17 @@ function timingSafeEqual(a, b) {
 
 // src/plugins/core-plugins/stripe-plugin/routes/api.ts
 var apiRoutes3 = new Hono();
-async function getSettings4(db) {
+async function getSettings5(db) {
   try {
     const pluginService = new PluginService(db);
     const plugin2 = await pluginService.getPlugin("stripe");
     if (plugin2?.settings) {
       const settings = typeof plugin2.settings === "string" ? JSON.parse(plugin2.settings) : plugin2.settings;
-      return { ...DEFAULT_SETTINGS3, ...settings };
+      return { ...DEFAULT_SETTINGS4, ...settings };
     }
   } catch {
   }
-  return DEFAULT_SETTINGS3;
+  return DEFAULT_SETTINGS4;
 }
 function mapStripeStatus(status) {
   const map = {
@@ -7739,7 +8225,7 @@ function mapStripeStatus(status) {
 }
 apiRoutes3.post("/webhook", async (c) => {
   const db = c.env.DB;
-  const settings = await getSettings4(db);
+  const settings = await getSettings5(db);
   if (!settings.stripeWebhookSecret) {
     return c.json({ error: "Webhook secret not configured" }, 500);
   }
@@ -7869,7 +8355,7 @@ apiRoutes3.post("/create-checkout-session", requireAuth(), async (c) => {
   const db = c.env.DB;
   const user = c.get("user");
   if (!user) return c.json({ error: "Unauthorized" }, 401);
-  const settings = await getSettings4(db);
+  const settings = await getSettings5(db);
   if (!settings.stripeSecretKey) {
     return c.json({ error: "Stripe not configured" }, 500);
   }
@@ -7946,7 +8432,7 @@ apiRoutes3.post("/sync-subscriptions", requireAuth(), async (c) => {
   const user = c.get("user");
   if (user?.role !== "admin") return c.json({ error: "Access denied" }, 403);
   const db = c.env.DB;
-  const settings = await getSettings4(db);
+  const settings = await getSettings5(db);
   if (!settings.stripeSecretKey) {
     return c.json({ error: "Stripe secret key not configured" }, 400);
   }
@@ -8021,7 +8507,7 @@ var stripePlugin = definePlugin({
   sonicjsVersionRange: "^3.0.0",
   author: { name: "SonicJS Team" },
   register(app2) {
-    app2.route("/admin/plugins/stripe", adminRoutes4);
+    app2.route("/admin/plugins/stripe", adminRoutes5);
     app2.route("/api/stripe", apiRoutes3);
   },
   menu: [
@@ -9714,6 +10200,7 @@ function renderFormCreatePage(data) {
 }
 
 // src/routes/admin-forms.ts
+var isTableMissing = (err) => String(err?.message ?? err?.cause?.message ?? "").includes("no such table: forms");
 var adminFormsRoutes = new Hono();
 adminFormsRoutes.use("*", requireAuth());
 adminFormsRoutes.get("/", async (c) => {
@@ -9755,6 +10242,14 @@ adminFormsRoutes.get("/", async (c) => {
     };
     return c.html(renderFormsListPage(pageData));
   } catch (error) {
+    if (isTableMissing(error)) {
+      const user = c.get("user");
+      return c.html(renderFormsListPage({
+        forms: [],
+        user: user ? { name: user.email, email: user.email, role: user.role } : void 0,
+        version: c.get("appVersion")
+      }));
+    }
     console.error("Error listing forms:", error);
     return c.html("<p>Error loading forms</p>", 500);
   }
@@ -9865,6 +10360,7 @@ adminFormsRoutes.post("/", async (c) => {
     ).run();
     return c.redirect(`/admin/forms/${formId}/builder`);
   } catch (error) {
+    if (isTableMissing(error)) return c.json({ error: "Forms storage not configured \u2014 run database migrations" }, 503);
     console.error("Error creating form:", error);
     return c.json({ error: "Failed to create form" }, 500);
   }
@@ -9902,6 +10398,7 @@ adminFormsRoutes.get("/:id/builder", async (c) => {
     };
     return c.html(renderFormBuilderPage(pageData));
   } catch (error) {
+    if (isTableMissing(error)) return c.html("<p>Forms storage not configured \u2014 run database migrations</p>", 503);
     console.error("Error showing form builder:", error);
     return c.html("<p>Error loading form builder</p>", 500);
   }
@@ -9931,6 +10428,7 @@ adminFormsRoutes.put("/:id", async (c) => {
     ).run();
     return c.json({ success: true, message: "Form saved successfully" });
   } catch (error) {
+    if (isTableMissing(error)) return c.json({ error: "Forms storage not configured \u2014 run database migrations" }, 503);
     console.error("Error updating form:", error);
     return c.json({ error: "Failed to save form" }, 500);
   }
@@ -9952,6 +10450,7 @@ adminFormsRoutes.delete("/:id", async (c) => {
     await db.prepare("DELETE FROM forms WHERE id = ?").bind(formId).run();
     return c.json({ success: true, message: "Form deleted successfully" });
   } catch (error) {
+    if (isTableMissing(error)) return c.json({ error: "Forms storage not configured \u2014 run database migrations" }, 503);
     console.error("Error deleting form:", error);
     return c.json({ error: "Failed to delete form" }, 500);
   }
@@ -10012,6 +10511,7 @@ adminFormsRoutes.get("/:id/submissions", async (c) => {
     `;
     return c.html(html4);
   } catch (error) {
+    if (isTableMissing(error)) return c.html("<p>Forms storage not configured \u2014 run database migrations</p>", 503);
     console.error("Error loading submissions:", error);
     return c.html("<p>Error loading submissions</p>", 500);
   }
@@ -10032,6 +10532,7 @@ function sanitizeDeep(value) {
   }
   return value;
 }
+var isTableMissing2 = (err) => String(err?.message ?? err?.cause?.message ?? "").includes("no such table: form");
 var publicFormsRoutes = new Hono();
 publicFormsRoutes.get("/:identifier/turnstile-config", async (c) => {
   try {
@@ -10059,6 +10560,7 @@ publicFormsRoutes.get("/:identifier/turnstile-config", async (c) => {
       appearance: formSettings.appearance || globalSettings.appearance || "always"
     });
   } catch (error) {
+    if (isTableMissing2(error)) return c.json({ enabled: false });
     console.error("Error fetching Turnstile config:", error);
     return c.json({ error: "Failed to fetch config" }, 500);
   }
@@ -10086,6 +10588,7 @@ publicFormsRoutes.get("/:identifier/schema", async (c) => {
       submitUrl: `/api/forms/${form.id}/submit`
     });
   } catch (error) {
+    if (isTableMissing2(error)) return c.json({ error: "Form not found" }, 404);
     console.error("Error fetching form schema:", error);
     return c.json({ error: "Failed to fetch form schema" }, 500);
   }
@@ -10452,6 +10955,7 @@ publicFormsRoutes.get("/:name", async (c) => {
     `;
     return c.html(html4);
   } catch (error) {
+    if (isTableMissing2(error)) return c.html("<h1>Form not found</h1><p>This form does not exist or is not publicly available.</p>", 404);
     console.error("Error rendering form:", error);
     return c.html("<p>Error loading form</p>", 500);
   }
@@ -10525,6 +11029,7 @@ publicFormsRoutes.post("/:identifier/submit", async (c) => {
       message: "Form submitted successfully"
     });
   } catch (error) {
+    if (isTableMissing2(error)) return c.json({ error: "Form not found" }, 404);
     console.error("Error submitting form:", error);
     return c.json({ error: "Failed to submit form" }, 500);
   }
@@ -10672,7 +11177,7 @@ adminRbacRoutes.get("/", async (c) => {
           ${r.is_system ? `<code class="text-xs text-zinc-500 dark:text-zinc-400">${esc(r.name)}</code><span class="rounded-full bg-zinc-100 dark:bg-white/10 px-2 py-0.5 text-[11px] text-zinc-500 dark:text-zinc-400">system</span>` : `<input form="roles-bulk-form" class="${inpSm} w-28" name="name_${esc(r.id)}" value="${esc(r.name)}" required>`}
           <label class="ml-auto inline-flex items-center gap-2 rounded-md bg-white/5 px-2.5 py-1 text-xs font-medium text-zinc-700 dark:text-zinc-300 ring-1 ring-inset ring-zinc-500/20">
             <input form="roles-bulk-form" type="checkbox" name="portal_${esc(r.id)}" value="1" ${portalChecked ? "checked" : ""} ${portalDisabled ? "disabled" : ""} class="h-3.5 w-3.5 rounded border-zinc-400 text-cyan-600 focus:ring-cyan-500">
-            Access portal
+            Admin Panel
           </label>
           <a href="/admin/tenants/roles/${esc(r.name)}" data-role-tenants="${esc(r.name)}" class="text-xs text-cyan-600 dark:text-cyan-400 hover:underline" title="Per-tenant assignments of this role">tenants</a>
           ${r.is_system ? "" : `<button form="delete-role-${esc(r.id)}" type="submit" onclick="return confirm('Delete role ${esc(r.name)}?')" class="text-xs text-red-600 dark:text-red-400 hover:underline">delete</button>`}
@@ -10776,7 +11281,7 @@ adminRbacRoutes.get("/", async (c) => {
     <div class="grid grid-cols-1 md:grid-cols-2 gap-6 mb-6">
       <div class="${card}">
         <h3 class="text-base font-semibold text-zinc-950 dark:text-white mb-3">Roles</h3>
-        <p class="mb-3 text-xs text-zinc-500 dark:text-zinc-400">Use <strong>Access portal</strong> to allow a role into the admin backend. Resource permissions are configured in the <strong>Matrix</strong> tab.</p>
+        <p class="mb-3 text-xs text-zinc-500 dark:text-zinc-400">Use <strong>Admin Panel</strong> to allow a role into the admin backend. Resource permissions are configured in the <strong>Matrix</strong> tab.</p>
         ${roleList}
       </div>
       <div class="${card}">
@@ -11074,14 +11579,24 @@ function pluginMenuMiddleware() {
       }
     } catch {
     }
-    c.set("pluginMenuItems", activeMenuItems.map((m) => ({ label: m.label, path: m.path, icon: resolveIcon(m.icon) || "" })));
+    const user = c.get("user");
+    const singletonItems = resolvePluginMenuItems(user ? { role: user.role } : void 0);
+    const existingPaths = new Set(activeMenuItems.map((i) => i.path));
+    for (const item of singletonItems) {
+      if (!existingPaths.has(item.path)) {
+        activeMenuItems.push({ label: item.label, path: item.path, icon: item.icon, order: item.order });
+      }
+    }
+    activeMenuItems.sort((a, b) => a.order - b.order);
+    c.set("pluginMenuItems", activeMenuItems.map((m) => ({ label: m.label, path: m.path, icon: resolveIcon(m.icon) || m.icon || "" })));
     await next();
-    if (activeMenuItems.length > 0 && c.res.headers.get("content-type")?.includes("text/html")) {
+    const finalItems = c.get("pluginMenuItems") ?? [];
+    if (finalItems.length > 0 && c.res.headers.get("content-type")?.includes("text/html")) {
       const status = c.res.status;
       const headers = new Headers(c.res.headers);
       const html4 = await c.res.text();
       if (html4.includes(MARKER)) {
-        const renderedItems = activeMenuItems.map((item) => renderMenuItem(item, path)).join("");
+        const renderedItems = finalItems.map((item) => renderMenuItem(item, path)).join("");
         const newHtml = html4.split(MARKER).join(renderedItems);
         c.res = new Response(newHtml, { status, headers });
       } else {
@@ -11091,16 +11606,16 @@ function pluginMenuMiddleware() {
   };
 }
 init_admin_layout_catalyst_template();
-var adminRoutes5 = new Hono();
-adminRoutes5.use("*", requireAuth());
-adminRoutes5.use("*", async (c, next) => {
+var adminRoutes6 = new Hono();
+adminRoutes6.use("*", requireAuth());
+adminRoutes6.use("*", async (c, next) => {
   const user = c.get("user");
   if (user?.role !== "admin") {
     return c.text("Access denied", 403);
   }
   return next();
 });
-adminRoutes5.get("/", async (c) => {
+adminRoutes6.get("/", async (c) => {
   const user = c.get("user");
   const db = c.env.DB;
   let totalRequests = 0;
@@ -11245,6 +11760,7 @@ var EventTrackingService = class {
       tenantId: TENANT2
     });
   }
+  db;
   docsService;
   async trackEvent(input) {
     const doc = await this.docsService.create({
@@ -11456,7 +11972,7 @@ var analyticsPlugin = definePlugin({
   author: { name: "SonicJS Team", email: "team@sonicjs.com" },
   register(app2) {
     app2.route("/api/events", apiRoutes4);
-    app2.route("/admin/analytics", adminRoutes5);
+    app2.route("/admin/analytics", adminRoutes6);
   },
   menu: [
     {
@@ -11738,8 +12254,8 @@ apiRoutes5.delete("/:id", async (c) => {
     return c.json({ success: false, error: "Failed to delete variable" }, 500);
   }
 });
-var adminRoutes6 = new Hono();
-adminRoutes6.use("*", async (c, next) => {
+var adminRoutes7 = new Hono();
+adminRoutes7.use("*", async (c, next) => {
   try {
     const db = c.env?.DB;
     if (db) {
@@ -11750,7 +12266,7 @@ adminRoutes6.use("*", async (c, next) => {
   }
   await next();
 });
-adminRoutes6.get("/", async (c) => {
+adminRoutes7.get("/", async (c) => {
   const db = c.env.DB;
   let variables = [];
   try {
@@ -11780,7 +12296,7 @@ adminRoutes6.get("/", async (c) => {
   }
   return c.html(renderAdminPage(variables, { editorActive, activeEditorName, enableEditorIntegration }));
 });
-adminRoutes6.put("/:id", async (c) => {
+adminRoutes7.put("/:id", async (c) => {
   const db = c.env.DB;
   const id = c.req.param("id");
   let body;
@@ -11796,7 +12312,7 @@ adminRoutes6.put("/:id", async (c) => {
   }
   return c.html('<span class="text-green-400 text-xs">Saved</span>');
 });
-adminRoutes6.post("/:id/toggle", async (c) => {
+adminRoutes7.post("/:id/toggle", async (c) => {
   const db = c.env.DB;
   const id = c.req.param("id");
   await db.prepare("UPDATE global_variables SET is_active = CASE WHEN is_active = 1 THEN 0 ELSE 1 END, updated_at = strftime('%s', 'now') WHERE id = ?").bind(id).run();
@@ -11804,7 +12320,7 @@ adminRoutes6.post("/:id/toggle", async (c) => {
   c.header("HX-Redirect", "/admin/global-variables");
   return c.body(null, 204);
 });
-adminRoutes6.post("/", async (c) => {
+adminRoutes7.post("/", async (c) => {
   const db = c.env.DB;
   const form = await c.req.parseBody();
   const key = (form.key || "").trim();
@@ -11825,7 +12341,7 @@ adminRoutes6.post("/", async (c) => {
   c.header("HX-Redirect", "/admin/global-variables");
   return c.body(null, 204);
 });
-adminRoutes6.post("/settings/editor-integration", async (c) => {
+adminRoutes7.post("/settings/editor-integration", async (c) => {
   const db = c.env.DB;
   try {
     const row = await db.prepare("SELECT settings FROM plugins WHERE id = 'global-variables'").first();
@@ -11837,7 +12353,7 @@ adminRoutes6.post("/settings/editor-integration", async (c) => {
     return c.json({ success: false, error: "Failed to update setting" }, 500);
   }
 });
-adminRoutes6.delete("/:id", async (c) => {
+adminRoutes7.delete("/:id", async (c) => {
   const db = c.env.DB;
   await db.prepare("DELETE FROM global_variables WHERE id = ?").bind(c.req.param("id")).run();
   invalidateVariablesCache();
@@ -12168,7 +12684,7 @@ var globalVariablesPlugin = definePlugin({
   capabilities: ["hooks.content:subscribe"],
   register(app2) {
     app2.route("/api/global-variables", apiRoutes5);
-    app2.route("/admin/global-variables", adminRoutes6);
+    app2.route("/admin/global-variables", adminRoutes7);
   },
   menu: [
     { label: "Global Variables", path: "/admin/global-variables", icon: "bolt", order: 45, permissions: ["global-variables:view"] }
@@ -12489,8 +13005,8 @@ apiRoutes6.delete("/:id", async (c) => {
     return c.json({ success: false, error: "Failed to delete shortcode" }, 500);
   }
 });
-var adminRoutes7 = new Hono();
-adminRoutes7.use("*", async (c, next) => {
+var adminRoutes8 = new Hono();
+adminRoutes8.use("*", async (c, next) => {
   try {
     const db = c.env?.DB;
     if (db) {
@@ -12501,7 +13017,7 @@ adminRoutes7.use("*", async (c, next) => {
   }
   await next();
 });
-adminRoutes7.get("/", async (c) => {
+adminRoutes8.get("/", async (c) => {
   const db = c.env.DB;
   let shortcodes = [];
   try {
@@ -12531,7 +13047,7 @@ adminRoutes7.get("/", async (c) => {
   }
   return c.html(renderAdminPage2(shortcodes, { editorActive, activeEditorName, enableEditorIntegration }));
 });
-adminRoutes7.post("/", async (c) => {
+adminRoutes8.post("/", async (c) => {
   const db = c.env.DB;
   const form = await c.req.parseBody();
   const name = (form.name || "").trim();
@@ -12552,7 +13068,7 @@ adminRoutes7.post("/", async (c) => {
   c.header("HX-Redirect", "/admin/shortcodes");
   return c.body(null, 204);
 });
-adminRoutes7.post("/settings/editor-integration", async (c) => {
+adminRoutes8.post("/settings/editor-integration", async (c) => {
   const db = c.env.DB;
   try {
     const row = await db.prepare("SELECT settings FROM plugins WHERE id = 'shortcodes'").first();
@@ -12564,7 +13080,7 @@ adminRoutes7.post("/settings/editor-integration", async (c) => {
     return c.json({ success: false, error: "Failed to update setting" }, 500);
   }
 });
-adminRoutes7.delete("/:id", async (c) => {
+adminRoutes8.delete("/:id", async (c) => {
   await c.env.DB.prepare("DELETE FROM shortcodes WHERE id = ?").bind(c.req.param("id")).run();
   return c.html("");
 });
@@ -12775,7 +13291,7 @@ var shortcodesPlugin = definePlugin({
   capabilities: ["hooks.content:subscribe"],
   register(app2) {
     app2.route("/api/shortcodes", apiRoutes6);
-    app2.route("/admin/shortcodes", adminRoutes7);
+    app2.route("/admin/shortcodes", adminRoutes8);
   },
   menu: [
     { label: "Shortcodes", path: "/admin/shortcodes", icon: "bolt", order: 46, permissions: ["shortcodes:view"] }
@@ -12884,6 +13400,9 @@ var helloWorldPlugin = definePlugin({
     console.info("\u274C Hello World plugin deactivated");
   }
 });
+function createHelloWorldPlugin() {
+  return helloWorldPlugin;
+}
 
 // src/plugins/core-plugins/multi-tenant-plugin/manifest.json
 var manifest_default2 = {
@@ -16057,6 +16576,7 @@ function createSonicJSApp(config = {}) {
   const magicLinkPlugin = createMagicLinkAuthPlugin();
   const corePluginsBeforeCatchAll = [
     securityAuditPlugin,
+    apiKeysPlugin,
     aiSearchPlugin,
     oauthProvidersPlugin,
     userProfilesPlugin,
@@ -16154,6 +16674,17 @@ function createSonicJSApp(config = {}) {
   app2.use("*", async (_c, next) => {
     await next();
   });
+  app2.use("*", cors({
+    origin: (origin, c) => {
+      const allowed = c.env?.CORS_ORIGINS;
+      if (!allowed) return null;
+      const list = allowed.split(",").map((s) => s.trim());
+      return list.includes(origin) ? origin : null;
+    },
+    allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
+    allowHeaders: ["Content-Type", "Authorization", "X-API-Key"],
+    credentials: true
+  }));
   app2.use("*", securityHeadersMiddleware());
   app2.use("*", csrfProtection());
   app2.use("*", async (c, next) => {
@@ -16187,6 +16718,7 @@ function createSonicJSApp(config = {}) {
     }
     await next();
   });
+  app2.use("*", apiKeyAuthMiddleware());
   if (config.middleware?.afterAuth) {
     for (const middleware of config.middleware.afterAuth) {
       app2.use("*", middleware);
@@ -16211,7 +16743,7 @@ function createSonicJSApp(config = {}) {
     if (!user?.userId) return next();
     let perms = [];
     try {
-      const { RbacService: RbacService2 } = await import('./rbac-O73MFKDA.js');
+      const { RbacService: RbacService2 } = await import('./rbac-Y43IEQOP.js');
       perms = await new RbacService2(c.env.DB, c.env.CACHE_KV).permissionsForUser(user.userId);
     } catch {
       return next();
@@ -16285,7 +16817,10 @@ function createSonicJSApp(config = {}) {
       ...corePluginsAfterCatchAll,
       ...config.plugins?.register ?? []
     ];
-    setPluginMenu(allMountedPlugins.flatMap((p) => p.menu ?? []));
+    const userPlugins = (config.plugins?.register ?? []).filter(
+      (p) => !PLUGIN_REGISTRY[p.id]
+    );
+    setPluginMenu(userPlugins.flatMap((p) => p.menu ?? []));
     setPluginDefinitions(allMountedPlugins);
   }
   app2.get("/favicon.svg", (c) => {
@@ -17150,6 +17685,8 @@ var RedirectService = class {
       this.cloudflareService = new CloudflareBulkService(env);
     }
   }
+  db;
+  env;
   cloudflareService = null;
   getDocService() {
     return new DocumentsService(this.db, {
@@ -19914,6 +20451,6 @@ function createDb(d1) {
 // src/index.ts
 var VERSION = package_default.version;
 
-export { BUILT_IN_PROVIDERS, CloudflareEmailProvider2 as CloudflareEmailProvider, OAuthService, VERSION, createDb, createOAuthProvidersPlugin, createRedirectPlugin, createSonicJSApp, emailReconciliationPlugin, generateTriggersComment, oauthProvidersPlugin, parseCronTriggers, redirectPlugin, setupCoreMiddleware, setupCoreRoutes, site_settings_collection_default as siteSettingsCollection, updateWranglerTriggers };
+export { BUILT_IN_PROVIDERS, CloudflareEmailProvider2 as CloudflareEmailProvider, OAuthService, VERSION, createDb, createHelloWorldPlugin, createOAuthProvidersPlugin, createRedirectPlugin, createSonicJSApp, emailReconciliationPlugin, generateTriggersComment, helloWorldPlugin, oauthProvidersPlugin, parseCronTriggers, redirectPlugin, setupCoreMiddleware, setupCoreRoutes, site_settings_collection_default as siteSettingsCollection, updateWranglerTriggers };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map