@sonicjs-cms/core 3.0.0-beta.2 → 3.0.0-beta.21

package/dist/{chunk-VD2EA3WT.js → chunk-ZP77LTN4.js}

@@ -1,22 +1,21 @@
-import { isFirstUserRegistration, isRegistrationEnabled, authValidationService } from './chunk-IESEVHXL.js';
-import { renderDocumentFormPage, renderAlert } from './chunk-EF2NQUIQ.js';
-import { getCacheService, CACHE_CONFIGS, SettingsService, getLogger, getAppInstance, buildRouteList, CATEGORY_INFO } from './chunk-ZEZ245PW.js';
-import { DocumentTypeRegistry, requireAuth, requireRole, optionalAuth, isPluginActive, rateLimit, AuthManager, getJwtExpirySecondsFromDb, getJwtRefreshGraceSecondsFromDb, logActivity, generateCsrfToken } from './chunk-RZ6H7OZK.js';
-import { DocumentsService, documentSecondsToMs, RbacService } from './chunk-BLMTL57B.js';
-import { nanoid } from './chunk-GCDZZNIN.js';
-import { getCollectionRegistry, collectionRecordToRow, loadCollectionConfigs, getVisibleCollections, PluginService, PLUGIN_REGISTRY, findPluginByCodeName, isCodeCollectionInternal, isDbDocTypeInternal, invalidateTenantCache } from './chunk-ZGGXCFR6.js';
-import { MigrationService } from './chunk-NLJVSER2.js';
-import { renderCheckboxPage, renderAlert as renderAlert$1, renderTable, renderPagination, renderConfirmationDialog, getConfirmationDialogScript, renderAdminLayout, adminLayoutV2, renderForm } from './chunk-HDWE5FRJ.js';
-import { init_admin_layout_catalyst_template, renderAdminLayoutCatalyst } from './chunk-3TB6AT6X.js';
-import { createServiceSingleton, definePlugin, getPluginDefinition, applySchemaDefaults, renderSchemaFields, parseFormDataToSettings } from './chunk-6OUHGKFD.js';
+import { isFirstUserRegistration, isRegistrationEnabled, authValidationService } from './chunk-VVYVFCML.js';
+import { renderDocumentFormPage, renderAlert } from './chunk-RMRJGMDE.js';
+import { getCacheService, CACHE_CONFIGS, SettingsService, getLogger, getAppInstance, buildRouteList, CATEGORY_INFO } from './chunk-2XAQTPAE.js';
+import { DocumentTypeRegistry, requireAuth, requireRole, optionalAuth, isPluginActive, rateLimit, AuthManager, getJwtExpirySecondsFromDb, getJwtRefreshGraceSecondsFromDb, logActivity, generateCsrfToken } from './chunk-4UYJPHSV.js';
+import { DocumentsService, documentSecondsToMs, RbacService } from './chunk-3TMTYJAJ.js';
+import { nanoid } from './chunk-UWUP2VMT.js';
+import { getCollectionRegistry, collectionRecordToRow, loadCollectionConfigs, getVisibleCollections, PluginService, PLUGIN_REGISTRY, findPluginByCodeName, isCodeCollectionInternal, isDbDocTypeInternal, invalidateTenantCache } from './chunk-4LVVMVQI.js';
+import { MigrationService } from './chunk-5U75XP74.js';
+import { renderCheckboxPage, renderAlert as renderAlert$1, renderTable, renderPagination, renderConfirmationDialog, getConfirmationDialogScript, renderAdminLayout, adminLayoutV2, renderForm } from './chunk-OBA2RYZN.js';
+import { init_admin_layout_catalyst_template, renderAdminLayoutCatalyst } from './chunk-5V62WT6M.js';
+import { createServiceSingleton, definePlugin, getPluginDefinition, applySchemaDefaults, renderSchemaFields, parseFormDataToSettings } from './chunk-7OTOXWEB.js';
 import { hasHookSystem, getTypedHooks } from './chunk-RNZFGN4R.js';
 import { QueryFilterBuilder, getBlocksFieldConfig, parseBlocksValue } from './chunk-QZGABF2M.js';
 import { metricsTracker } from './chunk-FICTAGD4.js';
-import { getCoreVersion } from './chunk-NMPEMSU4.js';
+import { getCoreVersion } from './chunk-JEX3UPZL.js';
 import { escapeHtml, sanitizeRichText, sanitizeInput } from './chunk-TQABQWOP.js';
 import { Hono } from 'hono';
 import { z } from 'zod';
-import { cors } from 'hono/cors';
 import { setCookie, getCookie } from 'hono/cookie';
 import { html, raw } from 'hono/html';
 
@@ -25,6 +24,7 @@ var DocumentPermissionsService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   // Deny wins. Overrides beat base grants. Empty ACL falls back to base grants.
   async isAllowed(principalSet, rootId, permission, typeSettings, tenantId) {
     const overrides = await this.getDocumentPermissions(rootId, principalSet, permission, tenantId);
@@ -133,6 +133,8 @@ var DocumentRepository = class {
     this.tenantId = tenantId;
     this.permissions = new DocumentPermissionsService(db);
   }
+  db;
+  tenantId;
   permissions;
   // ─── Reads ───────────────────────────────────────────────────────────────
   async getById(id) {
@@ -748,7 +750,7 @@ adminDocumentsRoutes.post("/types/:typeId/reindex", async (c) => {
     const reindexTenant = effectiveTenantForType(getRequestTenant(c), docType.settings);
     const reindexDenied = await denyIfNotAllowed(c, db, "", "manage", docType.settings, reindexTenant);
     if (reindexDenied) return reindexDenied;
-    const { DocumentProjection } = await import('./document-projection-YYMC6I4U.js');
+    const { DocumentProjection } = await import('./document-projection-4HG75S5S.js');
     const projection = new DocumentProjection(db);
     const rebuilt = await projection.reindexType(typeId, reindexTenant, docType.queryableFields);
     return c.json({ rebuilt });
@@ -1260,16 +1262,6 @@ apiRoutes.use("*", async (c, next) => {
   c.set("cacheEnabled", cacheEnabled);
   await next();
 });
-apiRoutes.use("*", cors({
-  origin: (origin, c) => {
-    const allowed = c.env?.CORS_ORIGINS;
-    if (!allowed) return null;
-    const list = allowed.split(",").map((s) => s.trim());
-    return list.includes(origin) ? origin : null;
-  },
-  allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
-  allowHeaders: ["Content-Type", "Authorization", "X-API-Key"]
-}));
 function addTimingMeta(c, meta = {}, executionStartTime) {
   const totalTime = Date.now() - c.get("startTime");
   const executionTime = executionStartTime ? Date.now() - executionStartTime : void 0;
@@ -2202,6 +2194,8 @@ var MediaDocumentService = class {
     this.db = db;
     this.tenantId = tenantId;
   }
+  db;
+  tenantId;
   /** Create a media_asset document from R2 upload metadata. Published-on-create (immediately usable). */
   async createFromUpload(meta, createdBy) {
     const svc = new DocumentsService(this.db, { queryableFields: MEDIA_QUERYABLE, tenantId: this.tenantId, maxVersionsPerRoot: 5 });
@@ -2255,12 +2249,17 @@ var MediaDocumentService = class {
       where.push("(json_extract(data, '$.filename') LIKE ? OR json_extract(data, '$.originalName') LIKE ? OR json_extract(data, '$.alt') LIKE ?)");
       params.push(term, term, term);
     }
-    const listed = await this.db.prepare(`SELECT * FROM documents WHERE ${where.join(" AND ")} ORDER BY updated_at DESC LIMIT ? OFFSET ?`).bind(...params, limit, offset).all();
+    const [listed, countResult] = await Promise.all([
+      this.db.prepare(`SELECT * FROM documents WHERE ${where.join(" AND ")} ORDER BY updated_at DESC LIMIT ? OFFSET ?`).bind(...params, limit, offset).all(),
+      this.db.prepare(`SELECT COUNT(*) AS total FROM documents WHERE ${where.join(" AND ")}`).bind(...params).first()
+    ]);
     const files = (listed.results ?? []).map(rowToMinimalDoc);
+    const total = countResult?.total ?? 0;
     const folderAgg = await this.db.prepare(`SELECT q_media_folder AS folder, COUNT(*) AS count, SUM(q_media_size) AS totalSize FROM documents WHERE ${base} GROUP BY q_media_folder ORDER BY q_media_folder`).bind(this.tenantId).all();
     const typeAgg = await this.db.prepare(`SELECT CASE WHEN q_media_mime LIKE 'image/%' THEN 'images' WHEN q_media_mime LIKE 'video/%' THEN 'videos' WHEN q_media_mime IN ('application/pdf', 'text/plain') THEN 'documents' ELSE 'other' END AS type, COUNT(*) AS count FROM documents WHERE ${base} GROUP BY type`).bind(this.tenantId).all();
     return {
       files,
+      total,
       folders: (folderAgg.results ?? []).map((f) => ({ folder: f.folder, count: f.count, totalSize: f.totalSize ?? 0 })),
       types: (typeAgg.results ?? []).map((t) => ({ type: t.type, count: t.count }))
     };
@@ -3400,7 +3399,7 @@ adminApiRoutes.patch("/collections/:id", collectionsReadOnly);
 adminApiRoutes.delete("/collections/:id", collectionsReadOnly);
 adminApiRoutes.get("/migrations/status", async (c) => {
   try {
-    const { MigrationService: MigrationService2 } = await import('./migrations-WCAVBD7C.js');
+    const { MigrationService: MigrationService2 } = await import('./migrations-HMX5SPN2.js');
     const db = c.env.DB;
     const migrationService = new MigrationService2(db);
     const status = await migrationService.getMigrationStatus();
@@ -3443,7 +3442,7 @@ adminApiRoutes.post("/migrations/run", async (c) => {
 });
 adminApiRoutes.get("/migrations/validate", async (c) => {
   try {
-    const { MigrationService: MigrationService2 } = await import('./migrations-WCAVBD7C.js');
+    const { MigrationService: MigrationService2 } = await import('./migrations-HMX5SPN2.js');
     const db = c.env.DB;
     const migrationService = new MigrationService2(db);
     const validation = await migrationService.validateSchema();
@@ -3602,7 +3601,7 @@ function renderLoginPage(data, demoLoginActive = false) {
             <!-- Form -->
             <form
               id="login-form"
-              hx-post="/auth/login/form"
+              hx-post="/auth/login/form${data.redirect ? `?redirect=${encodeURIComponent(data.redirect)}` : ""}"
               hx-target="#form-response"
               hx-swap="innerHTML"
               class="space-y-6"
@@ -5590,6 +5589,79 @@ function renderDynamicField(field, options = {}) {
       `;
       break;
     }
+    case "json": {
+      const jsonParsedValue = value !== null && value !== void 0 && typeof value !== "string" ? value : typeof value === "string" && value !== "" ? (() => {
+        try {
+          return JSON.parse(value);
+        } catch {
+          return value;
+        }
+      })() : null;
+      const jsonDisplayValue = jsonParsedValue !== null && typeof jsonParsedValue !== "string" ? JSON.stringify(jsonParsedValue, null, 2) : typeof jsonParsedValue === "string" ? jsonParsedValue : "";
+      const viewerId = `${fieldId}-viewer`;
+      const textareaId = `${fieldId}-textarea`;
+      const jsonDataAttr = escapeHtml2(JSON.stringify(jsonParsedValue ?? null));
+      const isEmpty = jsonParsedValue === null || jsonDisplayValue === "";
+      if (disabled) {
+        fieldHTML = `
+          <div
+            id="${viewerId}"
+            class="json-viewer-host rounded-lg px-3 py-2 text-xs bg-white dark:bg-zinc-800 shadow-sm ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10 min-h-[2.5rem] overflow-auto"
+            data-json-viewer
+            data-json="${jsonDataAttr}"
+            data-open="${opts.open ?? 2}"
+          >${isEmpty ? '<span class="text-zinc-400 dark:text-zinc-500 italic">empty</span>' : ""}</div>
+          ${getJsonViewerScript()}
+        `;
+      } else {
+        fieldHTML = `
+          <div class="json-field-wrapper space-y-2">
+            <div class="flex items-center justify-end">
+              <button
+                type="button"
+                id="${fieldId}-toggle"
+                class="text-xs text-zinc-500 dark:text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-200 underline transition-colors"
+                data-json-toggle
+                data-viewer="${viewerId}"
+                data-textarea="${textareaId}"
+                data-hidden-input="${fieldId}"
+              >Edit JSON</button>
+            </div>
+
+            <div
+              id="${viewerId}"
+              class="json-viewer-host rounded-lg px-3 py-2 text-xs bg-white dark:bg-zinc-800 shadow-sm ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10 min-h-[2.5rem] overflow-auto"
+              data-json-viewer
+              data-json="${jsonDataAttr}"
+              data-open="${opts.open ?? 2}"
+            >${isEmpty ? '<span class="text-zinc-400 dark:text-zinc-500 italic">empty \u2014 click &quot;Edit JSON&quot; to add data</span>' : ""}</div>
+
+            <textarea
+              id="${textareaId}"
+              rows="${opts.rows || 8}"
+              placeholder="${opts.placeholder || "{}"}"
+              class="${baseClasses} ${errorClasses} resize-y font-mono text-xs hidden"
+              aria-label="${escapeHtml2(field.field_label)}"
+              data-json-edit-area
+              data-viewer="${viewerId}"
+              data-hidden-input="${fieldId}"
+            >${escapeHtml2(jsonDisplayValue)}</textarea>
+
+            <input
+              type="hidden"
+              id="${fieldId}"
+              name="${fieldName}"
+              value="${escapeHtml2(jsonDisplayValue)}"
+              ${required}
+            >
+
+            <div id="${fieldId}-json-error" class="text-xs text-pink-500 dark:text-pink-400 hidden"></div>
+          </div>
+          ${getJsonViewerScript()}
+        `;
+      }
+      break;
+    }
     default:
       fieldHTML = `
         <input
@@ -6086,6 +6158,120 @@ function normalizeBlockField(fieldConfig, fieldName) {
     options
   };
 }
+function getJsonViewerScript() {
+  return `
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/json-formatter-js@2.5.23/dist/json-formatter.min.css" id="json-formatter-css" onload="this.removeAttribute('onload')" onerror="">
+    <script>
+      (function() {
+        var JS_URL = 'https://cdn.jsdelivr.net/npm/json-formatter-js@2.5.23/dist/json-formatter.umd.min.js';
+
+        function isDark() {
+          return document.documentElement.classList.contains('dark') ||
+                 document.documentElement.dataset.theme === 'dark' ||
+                 window.matchMedia('(prefers-color-scheme: dark)').matches;
+        }
+
+        function initViewer(el) {
+          var raw = el.dataset.json;
+          var open = parseInt(el.dataset.open || '2', 10);
+          if (!raw || raw === 'null') return;
+          var data;
+          try { data = JSON.parse(raw); } catch(e) { el.textContent = raw; return; }
+          var fmt = new JSONFormatter(data, open, {
+            hoverPreviewEnabled: true,
+            hoverPreviewArrayCount: 5,
+            hoverPreviewFieldCount: 5,
+            theme: isDark() ? 'dark' : '',
+            animateOpen: true,
+            animateClose: true,
+          });
+          el.innerHTML = '';
+          el.appendChild(fmt.render());
+        }
+
+        function initAllViewers() {
+          document.querySelectorAll('[data-json-viewer]').forEach(function(el) { initViewer(el); });
+        }
+
+        function ensureLoaded(cb) {
+          if (window.JSONFormatter) { cb(); return; }
+          if (window.__jsonFormatterCallbacks) { window.__jsonFormatterCallbacks.push(cb); return; }
+          window.__jsonFormatterCallbacks = [cb];
+          var s = document.createElement('script');
+          s.src = JS_URL;
+          s.onload = function() {
+            (window.__jsonFormatterCallbacks || []).forEach(function(fn) { fn(); });
+            window.__jsonFormatterCallbacks = null;
+          };
+          document.head.appendChild(s);
+        }
+
+        if (!window.__sonicJsonViewerInit) {
+          window.__sonicJsonViewerInit = true;
+
+          // Toggle between viewer and edit textarea
+          document.addEventListener('click', function(e) {
+            var btn = e.target.closest('[data-json-toggle]');
+            if (!btn) return;
+            var viewerId = btn.dataset.viewer;
+            var textareaId = btn.dataset.textarea;
+            var hiddenId = btn.dataset.hiddenInput;
+            var viewer = document.getElementById(viewerId);
+            var textarea = document.getElementById(textareaId);
+            var hidden = document.getElementById(hiddenId);
+            var errorEl = hidden ? document.getElementById(hiddenId + '-json-error') : null;
+            if (!viewer || !textarea) return;
+            var isEditing = !textarea.classList.contains('hidden');
+            if (isEditing) {
+              // Switching back to viewer \u2014 validate + refresh
+              var raw = textarea.value.trim();
+              if (raw) {
+                try {
+                  var parsed = JSON.parse(raw);
+                  if (hidden) hidden.value = raw;
+                  viewer.dataset.json = JSON.stringify(parsed);
+                  ensureLoaded(function() { initViewer(viewer); });
+                  if (errorEl) { errorEl.textContent = ''; errorEl.classList.add('hidden'); }
+                } catch(ex) {
+                  if (errorEl) { errorEl.textContent = 'Invalid JSON: ' + ex.message; errorEl.classList.remove('hidden'); }
+                  return;
+                }
+              } else {
+                if (hidden) hidden.value = '';
+                viewer.innerHTML = '<span class="text-zinc-400 dark:text-zinc-500 italic">empty</span>';
+              }
+              textarea.classList.add('hidden');
+              viewer.classList.remove('hidden');
+              btn.textContent = 'Edit JSON';
+            } else {
+              // Switching to edit \u2014 populate textarea from hidden input
+              if (hidden && hidden.value) {
+                try {
+                  textarea.value = JSON.stringify(JSON.parse(hidden.value), null, 2);
+                } catch(e) {
+                  textarea.value = hidden.value;
+                }
+              }
+              viewer.classList.add('hidden');
+              textarea.classList.remove('hidden');
+              btn.textContent = 'Preview';
+            }
+          });
+        }
+
+        function run() {
+          ensureLoaded(initAllViewers);
+        }
+
+        if (document.readyState === 'loading') {
+          document.addEventListener('DOMContentLoaded', run);
+        } else {
+          run();
+        }
+      })();
+    </script>
+  `;
+}
 function getStructuredFieldScript() {
   return `
     ${getReadFieldValueScript()}
@@ -6946,10 +7132,12 @@ var authRoutes = new Hono();
 authRoutes.get("/login", async (c) => {
   const error = c.req.query("error");
   const message = c.req.query("message");
+  const redirect = c.req.query("redirect");
   const pageData = {
     error: error || void 0,
     message: message || void 0,
-    version: c.get("appVersion")
+    version: c.get("appVersion"),
+    redirect: redirect && redirect.startsWith("/") ? redirect : void 0
   };
   const db = c.env.DB;
   let demoLoginActive = false;
@@ -7093,7 +7281,7 @@ authRoutes.post(
       }
       const { email, password } = validation.data;
       const normalizedEmail = email.toLowerCase();
-      const { createAuth } = await import('./config-HFXANXCC.js');
+      const { createAuth } = await import('./config-6FB2BXMP.js');
       const auth = createAuth(c.env);
       const baReq = new Request(new URL("/auth/sign-in/email", c.req.url).href, {
         method: "POST",
@@ -7115,6 +7303,20 @@ authRoutes.post(
       await setCsrfCookie(c);
       const baBody = await baRes.json();
       const user = baBody.user ?? {};
+      const tokenTtl = await getJwtExpirySecondsFromDb(c.env.DB, c.env);
+      const token = await AuthManager.generateToken(
+        user.id,
+        user.email,
+        user.role ?? "viewer",
+        c.env.JWT_SECRET,
+        tokenTtl
+      );
+      setCookie(c, "auth_token", token, {
+        httpOnly: true,
+        secure: true,
+        sameSite: "Strict",
+        maxAge: tokenTtl
+      });
       return c.json({
         user: {
           id: user.id,
@@ -7122,7 +7324,8 @@ authRoutes.post(
           firstName: user.name?.split(" ")[0] ?? "",
           lastName: user.name?.split(" ").slice(1).join(" ") ?? "",
           role: user.role ?? "viewer"
-        }
+        },
+        token
       });
     } catch (error) {
       console.error("Login error:", error);
@@ -7132,7 +7335,7 @@ authRoutes.post(
 );
 authRoutes.post("/logout", async (c) => {
   try {
-    const { createAuth } = await import('./config-HFXANXCC.js');
+    const { createAuth } = await import('./config-6FB2BXMP.js');
     const auth = createAuth(c.env);
     const baReq = new Request(new URL("/auth/sign-out", c.req.url).href, {
       method: "POST",
@@ -7148,7 +7351,7 @@ authRoutes.post("/logout", async (c) => {
 });
 authRoutes.get("/logout", async (c) => {
   try {
-    const { createAuth } = await import('./config-HFXANXCC.js');
+    const { createAuth } = await import('./config-6FB2BXMP.js');
     const auth = createAuth(c.env);
     const baReq = new Request(new URL("/auth/sign-out", c.req.url).href, {
       method: "POST",
@@ -7355,7 +7558,7 @@ authRoutes.post(
         </div>
       `);
       }
-      const { createAuth } = await import('./config-HFXANXCC.js');
+      const { createAuth } = await import('./config-6FB2BXMP.js');
       const auth = createAuth(c.env);
       const baReq = new Request(new URL("/auth/sign-in/email", c.req.url).href, {
         method: "POST",
@@ -7379,6 +7582,8 @@ authRoutes.post(
         }
       }
       await setCsrfCookie(c);
+      const rawRedirect = c.req.query("redirect");
+      const redirectUrl = rawRedirect && rawRedirect.startsWith("/") ? rawRedirect : "/admin/content";
       return c.html(html`
       <div id="form-response">
         <div class="rounded-lg bg-green-100 dark:bg-lime-500/10 p-4 ring-1 ring-green-400 dark:ring-lime-500/20">
@@ -7391,7 +7596,7 @@ authRoutes.post(
             </div>
           </div>
           <script>
-            setTimeout(() => { window.location.href = '/admin/content'; }, 500);
+            setTimeout(() => { window.location.href = '${redirectUrl}'; }, 500);
           </script>
         </div>
       </div>
@@ -12866,7 +13071,7 @@ adminContentRoutes.post("/documents/:typeId/:documentId/delete", async (c) => {
 adminContentRoutes.get("/documents/:typeId/:rootId/versions", async (c) => {
   const { typeId, rootId } = c.req.param();
   const db = c.env.DB;
-  const { renderVersionHistoryFragment } = await import('./admin-documents-form.template-NLSI6Z42.js');
+  const { renderVersionHistoryFragment } = await import('./admin-documents-form.template-DDSH6ROU.js');
   const registry = new DocumentTypeRegistry(db);
   const docType = await registry.findById(typeId);
   if (!docType) return c.html("<div>Unknown type.</div>", 404);
@@ -14739,6 +14944,7 @@ var TenantService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   async listTenants() {
     const { results } = await this.db.prepare(`
       SELECT * FROM auth_tenant
@@ -17614,7 +17820,7 @@ adminMediaRoutes.get("/", async (c) => {
     const limit = 24;
     const offset = (page - 1) * limit;
     const mediaSvc = new MediaDocumentService(c.env.DB, getRequestTenant(c));
-    const { files, folders: folderAgg, types: typeAgg } = await mediaSvc.list({ folder, type, limit, offset });
+    const { files, total, folders: folderAgg, types: typeAgg } = await mediaSvc.list({ folder, type, limit, offset });
     const mediaFiles = files.map((doc) => mediaDocToFile(doc));
     const pageData = {
       files: mediaFiles,
@@ -17624,8 +17830,8 @@ adminMediaRoutes.get("/", async (c) => {
       currentType: type,
       currentView: view,
       currentPage: page,
-      totalFiles: mediaFiles.length,
-      hasNextPage: mediaFiles.length === limit,
+      totalFiles: total,
+      hasNextPage: offset + mediaFiles.length < total,
       user: {
         name: user.email,
         email: user.email,
@@ -17665,12 +17871,14 @@ adminMediaRoutes.get("/selector", async (c) => {
         <input
           type="search"
           id="media-selector-search"
+          name="search"
           placeholder="Search files..."
           class="w-full rounded-lg bg-white dark:bg-zinc-800 px-4 py-2 text-sm text-zinc-950 dark:text-white shadow-sm ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10 placeholder:text-zinc-400 dark:placeholder:text-zinc-500 focus:outline-none focus:ring-2 focus:ring-zinc-950 dark:focus:ring-white transition-shadow"
           hx-get="/admin/media/selector"
           hx-trigger="keyup changed delay:300ms"
           hx-target="#media-selector-grid"
-          hx-include="[name='search']"
+          hx-swap="outerHTML"
+          hx-select="#media-selector-grid"
         >
       </div>
 
@@ -19137,6 +19345,8 @@ function escapeHtmlAttr(value) {
 }
 function renderPluginSettingsPage(data) {
   const { plugin, activity = [], user } = data;
+  const hasUserSettings = Object.keys(plugin.settings || {}).some((k) => !k.startsWith("_"));
+  const defaultTab = hasUserSettings ? "settings" : "info";
   const pageContent = `
     <div class="w-full px-4 sm:px-6 lg:px-8 py-6">
       <!-- Header with Back Button -->
@@ -19147,13 +19357,24 @@ function renderPluginSettingsPage(data) {
             ${plugin.description}
           </p>
         </div>
-        <div class="mt-4 sm:mt-0 sm:ml-16 sm:flex-none">
+        <div class="mt-4 sm:mt-0 sm:ml-16 flex items-center gap-3">
           <a href="/admin/plugins" class="inline-flex items-center justify-center rounded-lg bg-white dark:bg-zinc-800 px-3.5 py-2.5 text-sm font-semibold text-zinc-950 dark:text-white ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10 hover:bg-zinc-50 dark:hover:bg-zinc-700 transition-colors shadow-sm">
             <svg class="-ml-0.5 mr-1.5 h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
               <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 19l-7-7m0 0l7-7m-7 7h18"/>
             </svg>
             Back to Plugins
           </a>
+          ${plugin.settings?._adminPath ? `
+          <a
+            href="${plugin.settings._adminPath}"
+            class="inline-flex items-center justify-center gap-1.5 rounded-lg bg-gradient-to-r from-cyan-500 to-purple-600 hover:from-cyan-400 hover:to-purple-500 px-3.5 py-2.5 text-sm font-semibold text-white shadow-sm transition-all duration-200"
+          >
+            <svg class="-ml-0.5 h-4 w-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"/>
+            </svg>
+            View Page
+          </a>
+          ` : ""}
         </div>
       </div>
 
@@ -19186,23 +19407,25 @@ function renderPluginSettingsPage(data) {
       <!-- Tabs -->
       <div class="mb-6">
         <nav class="flex space-x-8" aria-label="Tabs">
-          <button onclick="showTab('settings')" id="settings-tab" class="tab-button active border-b-2 border-blue-400 py-2 px-1 text-sm font-medium text-blue-400">
+          ${hasUserSettings ? `
+          <a href="#settings" onclick="showTab('settings')" id="settings-tab" class="tab-button border-b-2 border-transparent py-2 px-1 text-sm font-medium text-gray-400 hover:text-gray-300">
             Settings
-          </button>
-          <button onclick="showTab('activity')" id="activity-tab" class="tab-button border-b-2 border-transparent py-2 px-1 text-sm font-medium text-gray-400 hover:text-gray-300">
-            Activity Log
-          </button>
-          <button onclick="showTab('info')" id="info-tab" class="tab-button border-b-2 border-transparent py-2 px-1 text-sm font-medium text-gray-400 hover:text-gray-300">
+          </a>
+          ` : ""}
+          <a href="#info" onclick="showTab('info')" id="info-tab" class="tab-button border-b-2 border-transparent py-2 px-1 text-sm font-medium text-gray-400 hover:text-gray-300">
             Information
-          </button>
+          </a>
+          <a href="#activity" onclick="showTab('activity')" id="activity-tab" class="tab-button border-b-2 border-transparent py-2 px-1 text-sm font-medium text-gray-400 hover:text-gray-300">
+            Activity Log
+          </a>
         </nav>
       </div>
 
       <!-- Tab Content -->
       <div id="tab-content">
         <!-- Settings Tab -->
-        <div id="settings-content" class="tab-content">
-          ${renderSettingsTab(plugin)}
+        <div id="settings-content" class="tab-content hidden">
+          ${hasUserSettings ? renderSettingsTab(plugin) : ""}
         </div>
 
         <!-- Activity Tab -->
@@ -19218,27 +19441,42 @@ function renderPluginSettingsPage(data) {
     </div>
 
     <script>
+      const VALID_TABS = [${hasUserSettings ? "'settings', " : ""}'activity', 'info'];
+
       function showTab(tabName) {
-        // Hide all tab contents
+        if (!VALID_TABS.includes(tabName)) tabName = '${defaultTab}';
+
         document.querySelectorAll('.tab-content').forEach(content => {
           content.classList.add('hidden');
         });
-        
-        // Remove active class from all tabs
+
         document.querySelectorAll('.tab-button').forEach(tab => {
           tab.classList.remove('active', 'border-blue-400', 'text-blue-400');
           tab.classList.add('border-transparent', 'text-gray-400');
         });
-        
-        // Show selected tab content
-        document.getElementById(tabName + '-content').classList.remove('hidden');
-        
-        // Add active class to selected tab
+
+        const contentEl = document.getElementById(tabName + '-content');
+        if (contentEl) contentEl.classList.remove('hidden');
+
         const activeTab = document.getElementById(tabName + '-tab');
-        activeTab.classList.add('active', 'border-blue-400', 'text-blue-400');
-        activeTab.classList.remove('border-transparent', 'text-gray-400');
+        if (activeTab) {
+          activeTab.classList.add('active', 'border-blue-400', 'text-blue-400');
+          activeTab.classList.remove('border-transparent', 'text-gray-400');
+        }
+
+        if (window.location.hash !== '#' + tabName) {
+          history.replaceState(null, '', '#' + tabName);
+        }
+      }
+
+      function initTabFromHash() {
+        const hash = window.location.hash.replace('#', '');
+        showTab(VALID_TABS.includes(hash) ? hash : '${defaultTab}');
       }
 
+      window.addEventListener('hashchange', initTabFromHash);
+      initTabFromHash();
+
       async function togglePlugin(pluginId, action) {
         const button = event.target;
         const originalText = button.textContent;
@@ -19411,6 +19649,7 @@ function renderToggleButton(plugin) {
 function renderSettingsTab(plugin) {
   const settings = plugin.settings || {};
   const pluginId = plugin.id || plugin.name;
+  const hasUserKeys = Object.keys(settings).some((k) => !k.startsWith("_"));
   const customRenderer = pluginSettingsComponents[pluginId];
   if (customRenderer) {
     return `
@@ -19446,9 +19685,9 @@ function renderSettingsTab(plugin) {
       `}
 
       <form id="settings-form" class="space-y-6">
-        ${isAuthPlugin && Object.keys(settings).length > 0 ? renderAuthSettingsForm(settings) : isTurnstilePlugin && Object.keys(settings).length > 0 ? renderTurnstileSettingsForm(settings) : Object.keys(settings).length > 0 ? renderSettingsFields(settings) : renderNoSettings(plugin)}
+        ${isAuthPlugin && hasUserKeys ? renderAuthSettingsForm(settings) : isTurnstilePlugin && hasUserKeys ? renderTurnstileSettingsForm(settings) : hasUserKeys ? renderSettingsFields(settings) : renderNoSettings(plugin)}
 
-        ${Object.keys(settings).length > 0 ? `
+        ${hasUserKeys ? `
         <div class="flex items-center justify-end pt-6 border-t border-white/10">
           <button
             type="button"
@@ -19465,7 +19704,7 @@ function renderSettingsTab(plugin) {
   `;
 }
 function renderSettingsFields(settings) {
-  return Object.entries(settings).map(([key, value]) => {
+  return Object.entries(settings).filter(([key]) => !key.startsWith("_")).map(([key, value]) => {
     const fieldId = `setting_${key}`;
     const displayName = key.replace(/([A-Z])/g, " $1").replace(/^./, (str) => str.toUpperCase());
     if (typeof value === "boolean") {
@@ -19654,6 +19893,38 @@ function renderActivityTab(activity) {
 }
 function renderInformationTab(plugin) {
   return `
+    ${plugin.description ? `
+    <!-- About -->
+    <div class="backdrop-blur-md bg-black/20 rounded-xl border border-white/10 shadow-xl p-6 mb-6">
+      <h2 class="text-xl font-semibold text-white mb-3">About</h2>
+      <p class="text-gray-300 leading-relaxed">${plugin.description}</p>
+    </div>
+    ` : ""}
+
+    ${(plugin.settings?._routes?.length ?? 0) > 0 ? `
+    <!-- Routes -->
+    <div class="backdrop-blur-md bg-black/20 rounded-xl border border-white/10 shadow-xl p-6 mb-6">
+      <h2 class="text-xl font-semibold text-white mb-4">Routes</h2>
+      <div class="space-y-2">
+        ${plugin.settings._routes.map((r) => {
+    const badge = r.method === "GET" ? "bg-emerald-500/20 text-emerald-300 border border-emerald-500/30" : r.method === "POST" ? "bg-blue-500/20 text-blue-300 border border-blue-500/30" : r.method === "DELETE" ? "bg-red-500/20 text-red-300 border border-red-500/30" : "bg-white/10 text-gray-300 border border-white/20";
+    const pathHtml = r.method === "GET" ? `<a href="${r.path}" class="font-mono text-sm text-blue-400 hover:text-blue-300 hover:underline">${r.path}</a>` : `<span class="font-mono text-sm text-gray-200">${r.path}</span>`;
+    const authBadge = r.requiresAuth ? `<span class="ml-2 text-xs text-amber-400/80">\u{1F512} auth</span>` : "";
+    return `
+          <div class="flex items-start gap-3 py-2 border-b border-white/5 last:border-0">
+            <span class="shrink-0 inline-block px-2 py-0.5 rounded text-xs font-bold ${badge}">${r.method}</span>
+            <div class="min-w-0">
+              <div class="flex items-center gap-1 flex-wrap">
+                ${pathHtml}${authBadge}
+              </div>
+              ${r.description ? `<p class="text-xs text-gray-400 mt-0.5">${r.description}</p>` : ""}
+            </div>
+          </div>`;
+  }).join("")}
+      </div>
+    </div>
+    ` : ""}
+
     <div class="grid grid-cols-1 lg:grid-cols-2 gap-6">
       <!-- Plugin Details -->
       <div class="backdrop-blur-md bg-black/20 rounded-xl border border-white/10 shadow-xl p-6">
@@ -20684,7 +20955,9 @@ adminPluginRoutes.post("/:id/configure", async (c) => {
       description: def.description,
       author: typeof def.author === "object" ? def.author?.name : def.author
     });
-    await pluginService.updatePluginSettings(pluginId, parsed);
+    const existingPlugin = await pluginService.getPlugin(pluginId);
+    const existingSettings = existingPlugin?.settings ?? {};
+    await pluginService.updatePluginSettings(pluginId, { ...existingSettings, ...parsed });
     return c.redirect(`/admin/plugins/${encodeURIComponent(pluginId)}/configure`);
   } catch (error) {
     console.error("Error saving schema settings:", error);
@@ -20786,7 +21059,9 @@ adminPluginRoutes.post("/:id/settings", async (c) => {
     }
     const settings = await c.req.json();
     const pluginService = new PluginService(db);
-    await pluginService.updatePluginSettings(pluginId, settings);
+    const existingPlugin = await pluginService.getPlugin(pluginId);
+    const existingSettings = existingPlugin?.settings ?? {};
+    await pluginService.updatePluginSettings(pluginId, { ...existingSettings, ...settings });
     if (pluginId === "core-auth") {
       try {
         const cacheKv = c.env.CACHE_KV;
@@ -26638,6 +26913,6 @@ var ROUTES_INFO = {
   reference: "https://github.com/sonicjs/sonicjs"
 };
 
-export { DocumentRepository, ROUTES_INFO, TenantService, VALID_MEMBER_ROLES, adminCheckboxRoutes, adminCollectionsRoutes, adminDocumentsRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, admin_api_default, admin_content_default, apiDocumentsRoutes, api_content_crud_default, api_default, api_media_default, api_system_default, auth_default, createUserProfilesPlugin, defineUserProfile, denyIfNotAllowed, dispatchHookEvent, getConfirmationDialogScript2 as getConfirmationDialogScript, getCustomData, getEmailService, getUserProfileConfig, getVariablesCached, hasEmailService, invalidateVariablesCache, isValidMemberRole, lexicalEditorPlugin, renderConfirmationDialog2 as renderConfirmationDialog, renderTable2 as renderTable, resolveDocScope, resolveVariablesInObject, router, router2, setEmailService, setVariablesCache, test_cleanup_default, userProfilesPlugin, userRoutes };
-//# sourceMappingURL=chunk-VD2EA3WT.js.map
-//# sourceMappingURL=chunk-VD2EA3WT.js.map
+export { DocumentRepository, ROUTES_INFO, TenantService, VALID_MEMBER_ROLES, adminCheckboxRoutes, adminCollectionsRoutes, adminDocumentsRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, admin_api_default, admin_content_default, apiDocumentsRoutes, api_content_crud_default, api_default, api_media_default, api_system_default, auth_default, createDocumentSchema, createUserProfilesPlugin, defineUserProfile, denyIfNotAllowed, dispatchHookEvent, getConfirmationDialogScript2 as getConfirmationDialogScript, getCustomData, getEmailService, getUserProfileConfig, getVariablesCached, hasEmailService, invalidateVariablesCache, isValidMemberRole, lexicalEditorPlugin, renderConfirmationDialog2 as renderConfirmationDialog, renderTable2 as renderTable, resolveDocScope, resolveVariablesInObject, router, router2, setEmailService, setVariablesCache, test_cleanup_default, userProfilesPlugin, userRoutes };
+//# sourceMappingURL=chunk-ZP77LTN4.js.map
+//# sourceMappingURL=chunk-ZP77LTN4.js.map