@sonicjs-cms/core 3.0.0-beta.2 → 3.0.0-beta.21

package/dist/index.cjs

@@ -1,31 +1,32 @@
 'use strict';
 
-var chunkNUKJ54GA_cjs = require('./chunk-NUKJ54GA.cjs');
-var chunkVXE42MYF_cjs = require('./chunk-VXE42MYF.cjs');
-require('./chunk-HIKBY7MS.cjs');
-require('./chunk-DNQCEKUK.cjs');
-var chunkBDDABDAB_cjs = require('./chunk-BDDABDAB.cjs');
+var chunkGMMCCIQO_cjs = require('./chunk-GMMCCIQO.cjs');
+var chunk7RUW244J_cjs = require('./chunk-7RUW244J.cjs');
+require('./chunk-XWVDSM2L.cjs');
+require('./chunk-N32OWET6.cjs');
+var chunk36Z3AKX3_cjs = require('./chunk-36Z3AKX3.cjs');
 var chunkYA3TJ65D_cjs = require('./chunk-YA3TJ65D.cjs');
 var chunkYP7GW2G5_cjs = require('./chunk-YP7GW2G5.cjs');
-var chunkAAWNRBRB_cjs = require('./chunk-AAWNRBRB.cjs');
-var chunk2CB4KY7I_cjs = require('./chunk-2CB4KY7I.cjs');
-var chunkJEQ7FLOD_cjs = require('./chunk-JEQ7FLOD.cjs');
-var chunkQAYFOER6_cjs = require('./chunk-QAYFOER6.cjs');
-var chunkDSA4UX5B_cjs = require('./chunk-DSA4UX5B.cjs');
-var chunkWULONYGB_cjs = require('./chunk-WULONYGB.cjs');
-var chunkMVIZJOO5_cjs = require('./chunk-MVIZJOO5.cjs');
-var chunkNAVPFIG5_cjs = require('./chunk-NAVPFIG5.cjs');
-var chunkH2AXVCLS_cjs = require('./chunk-H2AXVCLS.cjs');
-var chunkXW56B23A_cjs = require('./chunk-XW56B23A.cjs');
+var chunkFCLKX2OS_cjs = require('./chunk-FCLKX2OS.cjs');
+var chunkLTZ5WYOK_cjs = require('./chunk-LTZ5WYOK.cjs');
+var chunkKIGVVO6N_cjs = require('./chunk-KIGVVO6N.cjs');
+var chunkKVBHB7QP_cjs = require('./chunk-KVBHB7QP.cjs');
+var chunkOJC4G5JE_cjs = require('./chunk-OJC4G5JE.cjs');
+var chunkCRGUD4KC_cjs = require('./chunk-CRGUD4KC.cjs');
+var chunkPXNTCCPE_cjs = require('./chunk-PXNTCCPE.cjs');
+var chunkK623Q6WD_cjs = require('./chunk-K623Q6WD.cjs');
+var chunk5UXU3LP4_cjs = require('./chunk-5UXU3LP4.cjs');
+var chunkA4KUJ3LD_cjs = require('./chunk-A4KUJ3LD.cjs');
 var chunkJ6JTWD2A_cjs = require('./chunk-J6JTWD2A.cjs');
 var chunkIXUHXTHW_cjs = require('./chunk-IXUHXTHW.cjs');
-require('./chunk-P3XDZL6Q.cjs');
 var chunkRCQ2HIQD_cjs = require('./chunk-RCQ2HIQD.cjs');
-var chunkLRZIAW7U_cjs = require('./chunk-LRZIAW7U.cjs');
+require('./chunk-P3XDZL6Q.cjs');
+var chunkAOUVUF32_cjs = require('./chunk-AOUVUF32.cjs');
 var chunkMNWKYY5E_cjs = require('./chunk-MNWKYY5E.cjs');
 var chunkQTFKZBLC_cjs = require('./chunk-QTFKZBLC.cjs');
 require('./chunk-IGJUBJBW.cjs');
 var hono = require('hono');
+var cors = require('hono/cors');
 var zod = require('zod');
 var cookie = require('hono/cookie');
 var html = require('hono/html');
@@ -39,6 +40,7 @@ var DatabaseToolsService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   /**
    * Get database statistics
    */
@@ -180,9 +182,9 @@ var DatabaseToolsService = class {
     }
   }
   /**
-   * Get table data with optional pagination and sorting
+   * Get table data with optional pagination, sorting, and search
    */
-  async getTableData(tableName, limit = 100, offset = 0, sortColumn, sortDirection = "asc") {
+  async getTableData(tableName, limit = 100, offset = 0, sortColumn, sortDirection = "asc", search) {
     try {
       const tables = await this.getTables();
       if (!tables.includes(tableName)) {
@@ -193,14 +195,26 @@ var DatabaseToolsService = class {
       if (sortColumn && !columns.includes(sortColumn)) {
         sortColumn = void 0;
       }
-      const countResult = await this.db.prepare(`SELECT COUNT(*) as count FROM ${tableName}`).first();
+      const searchTerm = search?.trim();
+      let whereClause = "";
+      let bindings = [];
+      if (searchTerm) {
+        const conditions = columns.map(() => `CAST(? AS TEXT) IS NOT NULL AND CAST(? AS TEXT) LIKE ?`).join(" OR ");
+        const colConditions = columns.map((col) => `CAST("${col}" AS TEXT) LIKE ?`).join(" OR ");
+        whereClause = ` WHERE (${colConditions})`;
+        bindings = columns.map(() => `%${searchTerm}%`);
+      }
+      const countQuery = `SELECT COUNT(*) as count FROM "${tableName}"${whereClause}`;
+      const countStmt = this.db.prepare(countQuery);
+      const countResult = bindings.length > 0 ? await countStmt.bind(...bindings).first() : await countStmt.first();
       const totalRows = countResult?.count || 0;
-      let query = `SELECT * FROM ${tableName}`;
+      let query = `SELECT * FROM "${tableName}"${whereClause}`;
       if (sortColumn) {
-        query += ` ORDER BY ${sortColumn} ${sortDirection.toUpperCase()}`;
+        query += ` ORDER BY "${sortColumn}" ${sortDirection.toUpperCase()}`;
       }
       query += ` LIMIT ${limit} OFFSET ${offset}`;
-      const dataResult = await this.db.prepare(query).all();
+      const dataStmt = this.db.prepare(query);
+      const dataResult = bindings.length > 0 ? await dataStmt.bind(...bindings).all() : await dataStmt.all();
       return {
         tableName,
         columns,
@@ -249,7 +263,7 @@ var DatabaseToolsService = class {
 };
 
 // src/templates/pages/admin-database-table.template.ts
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 function renderDatabaseTablePage(data) {
   const totalPages = Math.ceil(data.totalRows / data.pageSize);
   const startRow = (data.currentPage - 1) * data.pageSize + 1;
@@ -304,6 +318,43 @@ function renderDatabaseTablePage(data) {
         </div>
       </div>
 
+      <!-- Search bar -->
+      <div class="flex items-center gap-3">
+        <div class="relative flex-1 max-w-xl">
+          <div class="pointer-events-none absolute inset-y-0 left-0 flex items-center pl-3">
+            <svg class="h-4 w-4 text-zinc-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0"/>
+            </svg>
+          </div>
+          <input
+            id="searchInput"
+            type="text"
+            placeholder="Search all columns including JSON data..."
+            value="${escapeHtml2(data.search || "")}"
+            class="block w-full rounded-lg border-0 py-2.5 pl-10 pr-10 text-sm text-zinc-900 dark:text-white bg-white dark:bg-zinc-800 ring-1 ring-inset ring-zinc-300 dark:ring-zinc-700 placeholder:text-zinc-400 focus:ring-2 focus:ring-inset focus:ring-indigo-600"
+            onkeydown="if(event.key==='Enter') doSearch()"
+          />
+          ${data.search ? `
+          <button
+            onclick="clearSearch()"
+            class="absolute inset-y-0 right-0 flex items-center pr-3 text-zinc-400 hover:text-zinc-600 dark:hover:text-zinc-200"
+            title="Clear search"
+          >
+            <svg class="h-4 w-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"/>
+            </svg>
+          </button>
+          ` : ""}
+        </div>
+        <button
+          onclick="doSearch()"
+          class="inline-flex items-center justify-center rounded-lg bg-indigo-600 px-4 py-2.5 text-sm font-semibold text-white hover:bg-indigo-500 transition-colors shadow-sm"
+        >
+          Search
+        </button>
+        ${data.search ? `<span class="text-sm text-zinc-500 dark:text-zinc-400">Filtered: <strong class="text-zinc-900 dark:text-white">${escapeHtml2(data.search)}</strong></span>` : ""}
+      </div>
+
       <!-- Table Card -->
       <div class="rounded-xl bg-white dark:bg-zinc-900 shadow-sm ring-1 ring-zinc-950/5 dark:ring-white/10 overflow-hidden">
         <!-- Table -->
@@ -338,7 +389,7 @@ function renderDatabaseTablePage(data) {
                   <tr class="${idx % 2 === 0 ? "bg-white dark:bg-zinc-900" : "bg-zinc-50 dark:bg-zinc-900/50"}">
                     ${data.columns.map((col) => `
                       <td class="px-4 py-3 text-sm text-zinc-700 dark:text-zinc-300 whitespace-nowrap max-w-xs overflow-hidden text-ellipsis" title="${escapeHtml2(String(row[col] ?? ""))}">
-                        ${formatCellValue(row[col])}
+                        ${formatCellValue(row[col], col)}
                       </td>
                     `).join("")}
                   </tr>
@@ -414,79 +465,143 @@ function renderDatabaseTablePage(data) {
       </div>
     </div>
 
+    <!-- JSON Viewer Modal -->
+    <div id="jsonModal" class="fixed inset-0 z-50 hidden" role="dialog" aria-modal="true">
+      <div class="fixed inset-0 bg-black/60 backdrop-blur-sm" onclick="closeJsonModal()"></div>
+      <div class="fixed inset-0 flex items-center justify-center p-4 pointer-events-none">
+        <div class="pointer-events-auto relative w-full max-w-4xl max-h-[85vh] flex flex-col rounded-xl bg-white dark:bg-zinc-900 shadow-2xl ring-1 ring-zinc-950/10 dark:ring-white/10">
+          <div class="flex items-center justify-between px-6 py-4 border-b border-zinc-200 dark:border-zinc-700">
+            <div>
+              <h3 id="jsonModalTitle" class="text-base font-semibold text-zinc-900 dark:text-white">Field Value</h3>
+              <p id="jsonModalSubtitle" class="text-xs text-zinc-500 dark:text-zinc-400 mt-0.5"></p>
+            </div>
+            <div class="flex items-center gap-2">
+              <button onclick="copyJsonValue()" class="inline-flex items-center gap-1.5 rounded-lg bg-zinc-100 dark:bg-zinc-800 px-3 py-1.5 text-xs font-medium text-zinc-700 dark:text-zinc-300 hover:bg-zinc-200 dark:hover:bg-zinc-700 transition-colors">
+                <svg class="h-3.5 w-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z"/>
+                </svg>
+                Copy
+              </button>
+              <button onclick="closeJsonModal()" class="rounded-lg p-1.5 text-zinc-400 hover:text-zinc-600 dark:hover:text-zinc-200 hover:bg-zinc-100 dark:hover:bg-zinc-800 transition-colors">
+                <svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"/>
+                </svg>
+              </button>
+            </div>
+          </div>
+          <div class="flex-1 overflow-auto p-6">
+            <pre id="jsonModalContent" class="text-sm font-mono text-zinc-800 dark:text-zinc-200 whitespace-pre-wrap break-words leading-relaxed"></pre>
+          </div>
+        </div>
+      </div>
+    </div>
+
     <script>
       const currentTableName = '${data.tableName}';
       let currentPage = ${data.currentPage};
       let currentPageSize = ${data.pageSize};
       let currentSort = '${data.sortColumn || ""}';
       let currentSortDir = '${data.sortDirection || "asc"}';
+      let currentSearch = ${JSON.stringify(data.search || "")};
+
+      function buildParams(overrides = {}) {
+        const params = new URLSearchParams();
+        const p = { page: currentPage, pageSize: currentPageSize, sort: currentSort, dir: currentSortDir, search: currentSearch, ...overrides };
+        if (p.page) params.set('page', p.page);
+        if (p.pageSize) params.set('pageSize', p.pageSize);
+        if (p.sort) { params.set('sort', p.sort); params.set('dir', p.dir || 'asc'); }
+        if (p.search) params.set('search', p.search);
+        return params;
+      }
 
       function goToPage(page) {
         if (page < 1 || page > ${totalPages}) return;
-        const params = new URLSearchParams();
-        params.set('page', page);
-        params.set('pageSize', currentPageSize);
-        if (currentSort) {
-          params.set('sort', currentSort);
-          params.set('dir', currentSortDir);
-        }
-        window.location.href = \`/admin/database-tools/tables/\${currentTableName}?\${params}\`;
+        window.location.href = \`/admin/database-tools/tables/\${currentTableName}?\${buildParams({ page })}\`;
       }
 
       function sortTable(column) {
-        let newDir = 'asc';
-        if (currentSort === column && currentSortDir === 'asc') {
-          newDir = 'desc';
-        }
-
-        const params = new URLSearchParams();
-        params.set('page', '1');
-        params.set('pageSize', currentPageSize);
-        params.set('sort', column);
-        params.set('dir', newDir);
-        window.location.href = \`/admin/database-tools/tables/\${currentTableName}?\${params}\`;
+        const newDir = (currentSort === column && currentSortDir === 'asc') ? 'desc' : 'asc';
+        window.location.href = \`/admin/database-tools/tables/\${currentTableName}?\${buildParams({ page: 1, sort: column, dir: newDir })}\`;
       }
 
       function changePageSize(newSize) {
-        const params = new URLSearchParams();
-        params.set('page', '1');
-        params.set('pageSize', newSize);
-        if (currentSort) {
-          params.set('sort', currentSort);
-          params.set('dir', currentSortDir);
-        }
-        window.location.href = \`/admin/database-tools/tables/\${currentTableName}?\${params}\`;
+        window.location.href = \`/admin/database-tools/tables/\${currentTableName}?\${buildParams({ page: 1, pageSize: newSize })}\`;
       }
 
       function refreshTableData() {
         window.location.reload();
       }
 
-      function formatCellValue(value) {
-        if (value === null || value === undefined) {
-          return '<span class="text-zinc-400 dark:text-zinc-500 italic">null</span>';
-        }
-        if (typeof value === 'boolean') {
-          return \`<span class="px-2 py-0.5 rounded text-xs font-medium \${value ? 'bg-green-100 text-green-800 dark:bg-green-900/30 dark:text-green-400' : 'bg-zinc-100 text-zinc-800 dark:bg-zinc-800 dark:text-zinc-400'}">\${value}</span>\`;
-        }
-        if (typeof value === 'object') {
-          return '<span class="text-xs font-mono text-zinc-600 dark:text-zinc-400">' + JSON.stringify(value).substring(0, 50) + (JSON.stringify(value).length > 50 ? '...' : '') + '</span>';
-        }
-        const str = String(value);
-        if (str.length > 100) {
-          return escapeHtml(str.substring(0, 100)) + '...';
+      function doSearch() {
+        const val = document.getElementById('searchInput').value.trim();
+        window.location.href = \`/admin/database-tools/tables/\${currentTableName}?\${buildParams({ page: 1, search: val })}\`;
+      }
+
+      function clearSearch() {
+        window.location.href = \`/admin/database-tools/tables/\${currentTableName}?\${buildParams({ page: 1, search: '' })}\`;
+      }
+
+      // JSON viewer modal
+      let _jsonModalValue = '';
+
+      function openJsonModal(rawValue, colName) {
+        // rawValue comes from dataset \u2014 browser already decoded HTML entities, so it's the original string
+        _jsonModalValue = rawValue;
+        document.getElementById('jsonModalTitle').textContent = colName;
+        const el = document.getElementById('jsonModalContent');
+        const subtitle = document.getElementById('jsonModalSubtitle');
+        try {
+          const parsed = JSON.parse(rawValue);
+          const pretty = JSON.stringify(parsed, null, 2);
+          subtitle.textContent = 'JSON \u2022 ' + rawValue.length + ' chars';
+          el.innerHTML = syntaxHighlight(pretty);
+        } catch {
+          el.textContent = rawValue;
+          subtitle.textContent = rawValue.length + ' chars';
         }
-        return escapeHtml(str);
+        document.getElementById('jsonModal').classList.remove('hidden');
+        document.body.style.overflow = 'hidden';
       }
 
+      function closeJsonModal() {
+        document.getElementById('jsonModal').classList.add('hidden');
+        document.body.style.overflow = '';
+      }
+
+      function copyJsonValue() {
+        navigator.clipboard.writeText(_jsonModalValue).then(() => {
+          const btn = event.currentTarget;
+          const orig = btn.innerHTML;
+          btn.textContent = 'Copied!';
+          setTimeout(() => { btn.innerHTML = orig; }, 1500);
+        });
+      }
+
+      function syntaxHighlight(json) {
+        json = json.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+        return json.replace(/("(\\\\u[a-zA-Z0-9]{4}|\\\\[^u]|[^\\\\"])*"(\\s*:)?|\\b(true|false|null)\\b|-?\\d+(?:\\.\\d*)?(?:[eE][+\\-]?\\d+)?)/g, function(match) {
+          let cls = 'text-purple-600 dark:text-purple-400'; // number
+          if (/^"/.test(match)) {
+            if (/:$/.test(match)) {
+              cls = 'text-blue-600 dark:text-blue-400 font-medium'; // key
+            } else {
+              cls = 'text-green-700 dark:text-green-400'; // string value
+            }
+          } else if (/true|false/.test(match)) {
+            cls = 'text-orange-600 dark:text-orange-400';
+          } else if (/null/.test(match)) {
+            cls = 'text-zinc-400 italic';
+          }
+          return \`<span class="\${cls}">\${match}</span>\`;
+        });
+      }
+
+      document.addEventListener('keydown', (e) => {
+        if (e.key === 'Escape') closeJsonModal();
+      });
+
       function escapeHtml(text) {
-        const map = {
-          '&': '&amp;',
-          '<': '&lt;',
-          '>': '&gt;',
-          '"': '&quot;',
-          "'": '&#039;'
-        };
+        const map = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#039;' };
         return String(text).replace(/[&<>"']/g, m => map[m]);
       }
     </script>
@@ -498,7 +613,7 @@ function renderDatabaseTablePage(data) {
     user: data.user,
     content: pageContent
   };
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 function generatePageNumbers(currentPage, totalPages) {
   const pages = [];
@@ -553,7 +668,16 @@ function escapeHtml2(text) {
   };
   return String(text).replace(/[&<>"']/g, (m) => map[m] || m);
 }
-function formatCellValue(value) {
+function isJsonString(str2) {
+  const s = str2.trim();
+  return (s.startsWith("{") || s.startsWith("[")) && (s.endsWith("}") || s.endsWith("]"));
+}
+function jsonButton(raw, colName) {
+  const preview = raw.length > 60 ? escapeHtml2(raw.substring(0, 60)) + "\u2026" : escapeHtml2(raw);
+  return `<button data-json-val="${escapeHtml2(raw)}" data-col-name="${escapeHtml2(colName)}" onclick="openJsonModal(this.dataset.jsonVal, this.dataset.colName)" class="text-left text-xs font-mono text-indigo-600 dark:text-indigo-400 hover:underline">${preview}</button>`;
+}
+function formatCellValue(value, colName) {
+  const col = colName || "value";
   if (value === null || value === void 0) {
     return '<span class="text-zinc-400 dark:text-zinc-500 italic">null</span>';
   }
@@ -561,11 +685,15 @@ function formatCellValue(value) {
     return `<span class="px-2 py-0.5 rounded text-xs font-medium ${value ? "bg-green-100 text-green-800 dark:bg-green-900/30 dark:text-green-400" : "bg-zinc-100 text-zinc-800 dark:bg-zinc-800 dark:text-zinc-400"}">${value}</span>`;
   }
   if (typeof value === "object") {
-    return '<span class="text-xs font-mono text-zinc-600 dark:text-zinc-400">' + JSON.stringify(value).substring(0, 50) + (JSON.stringify(value).length > 50 ? "..." : "") + "</span>";
+    return jsonButton(JSON.stringify(value), col);
   }
   const str2 = String(value);
-  if (str2.length > 100) {
-    return escapeHtml2(str2.substring(0, 100)) + "...";
+  if (isJsonString(str2)) {
+    return jsonButton(str2, col);
+  }
+  if (str2.length > 120) {
+    const preview = escapeHtml2(str2.substring(0, 120)) + "\u2026";
+    return `<button data-json-val="${escapeHtml2(str2)}" data-col-name="${escapeHtml2(col)}" onclick="openJsonModal(this.dataset.jsonVal, this.dataset.colName)" class="text-left text-sm text-zinc-700 dark:text-zinc-300 hover:underline">${preview}</button>`;
   }
   return escapeHtml2(str2);
 }
@@ -573,7 +701,7 @@ function formatCellValue(value) {
 // src/plugins/core-plugins/database-tools-plugin/admin-routes.ts
 function createDatabaseToolsAdminRoutes() {
   const router3 = new hono.Hono();
-  router3.use("*", chunkAAWNRBRB_cjs.requireAuth());
+  router3.use("*", chunkFCLKX2OS_cjs.requireAuth());
   router3.get("/api/stats", async (c) => {
     try {
       const user = c.get("user");
@@ -700,9 +828,10 @@ function createDatabaseToolsAdminRoutes() {
       const offset = parseInt(c.req.query("offset") || "0");
       const sortColumn = c.req.query("sort");
       const sortDirection = c.req.query("dir") || "asc";
+      const search = c.req.query("search");
       const db = c.env.DB;
       const service = new DatabaseToolsService(db);
-      const tableData = await service.getTableData(tableName, limit, offset, sortColumn, sortDirection);
+      const tableData = await service.getTableData(tableName, limit, offset, sortColumn, sortDirection, search);
       return c.json({
         success: true,
         data: tableData
@@ -726,10 +855,11 @@ function createDatabaseToolsAdminRoutes() {
       const pageSize = parseInt(c.req.query("pageSize") || "20");
       const sortColumn = c.req.query("sort");
       const sortDirection = c.req.query("dir") || "asc";
+      const search = c.req.query("search");
       const offset = (page - 1) * pageSize;
       const db = c.env.DB;
       const service = new DatabaseToolsService(db);
-      const tableData = await service.getTableData(tableName, pageSize, offset, sortColumn, sortDirection);
+      const tableData = await service.getTableData(tableName, pageSize, offset, sortColumn, sortDirection, search);
       const pageData = {
         user: {
           name: user.email.split("@")[0] || "Unknown",
@@ -743,7 +873,8 @@ function createDatabaseToolsAdminRoutes() {
         currentPage: page,
         pageSize,
         sortColumn,
-        sortDirection
+        sortDirection,
+        search
       };
       return c.html(renderDatabaseTablePage(pageData));
     } catch (error) {
@@ -897,6 +1028,7 @@ var EmailSettingsService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   async load() {
     let row = null;
     try {
@@ -925,8 +1057,10 @@ var SiteConfigService = class {
     this.db = db;
     this.env = env;
   }
+  db;
+  env;
   async load() {
-    const settings = new chunkBDDABDAB_cjs.SettingsService(this.db);
+    const settings = new chunk36Z3AKX3_cjs.SettingsService(this.db);
     const general = await settings.getGeneralSettings();
     const siteUrl = this.env.PUBLIC_URL || "http://localhost:8787";
     return {
@@ -976,7 +1110,7 @@ var SiteConfigService = class {
 
 // src/plugins/core-plugins/email-plugin/routes/admin.ts
 var adminRoutes = new hono.Hono();
-adminRoutes.use("*", chunkAAWNRBRB_cjs.requireAuth());
+adminRoutes.use("*", chunkFCLKX2OS_cjs.requireAuth());
 adminRoutes.post("/settings", async (c) => {
   if (c.get("user")?.role !== "admin") {
     return c.json({ error: "admin role required" }, 403);
@@ -1014,7 +1148,7 @@ adminRoutes.post("/test", async (c) => {
   const { subject, html: html4, text } = renderTestEmail({ siteName });
   try {
     const settingsLoaded = await settings.load();
-    const result = await chunkVXE42MYF_cjs.getEmailService().send({
+    const result = await chunk7RUW244J_cjs.getEmailService().send({
       to,
       subject,
       html: html4,
@@ -1096,7 +1230,7 @@ function makeOnRegistrationCompleted(env) {
       siteName,
       loginUrl: siteConfig.buildLoginUrl(siteUrl)
     });
-    const result = await chunkVXE42MYF_cjs.getEmailService().send({
+    const result = await chunk7RUW244J_cjs.getEmailService().send({
       to: user.email,
       subject,
       html: html4,
@@ -1170,7 +1304,7 @@ function makeOnPasswordResetRequested(env) {
       expiresAt: Date.now() + DEFAULT_EXPIRY_MS,
       siteName
     });
-    const result = await chunkVXE42MYF_cjs.getEmailService().send({
+    const result = await chunk7RUW244J_cjs.getEmailService().send({
       to: user.email,
       subject,
       html: html4,
@@ -1238,7 +1372,7 @@ function makeOnPasswordResetCompleted(env) {
       supportEmail,
       when: Date.now()
     });
-    const result = await chunkVXE42MYF_cjs.getEmailService().send({
+    const result = await chunk7RUW244J_cjs.getEmailService().send({
       to: user.email,
       subject,
       html: html4,
@@ -1262,6 +1396,8 @@ var EmailValidationError = class extends Error {
     this.reason = reason;
     this.name = "EmailValidationError";
   }
+  field;
+  reason;
   code = "EMAIL_VALIDATION_FAILED";
 };
 
@@ -1297,6 +1433,9 @@ var CfGraphqlClient = class {
       throw new EmailValidationError("apiToken", "EMAIL_API_TOKEN is required for GraphQL queries");
     }
   }
+  zoneId;
+  apiToken;
+  fetchImpl;
   async queryEmailSends(input) {
     const startIso = new Date(input.startSeconds * 1e3).toISOString();
     const endIso = new Date(input.endSeconds * 1e3).toISOString();
@@ -1359,6 +1498,7 @@ var EmailLogService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   /**
    * Records a successful submission to CF Email Service. `status` =
    * `'submitted'`, `delivery_state` remains NULL until reconciliation runs.
@@ -1532,6 +1672,8 @@ var ReconciliationService = class {
     this.graphql = graphql;
     this.emailLog = emailLog;
   }
+  graphql;
+  emailLog;
   async run(input = {}) {
     const windowHours = input.windowHours ?? 24;
     const nowMs = input.now ?? Date.now();
@@ -1940,6 +2082,7 @@ var CloudflareEmailProvider = class {
   constructor(binding) {
     this.binding = binding;
   }
+  binding;
   name = "cloudflare";
   isConfigured() {
     return !!this.binding;
@@ -1970,7 +2113,7 @@ var CloudflareEmailProvider = class {
     }
   }
 };
-var emailPluginV3 = chunkXW56B23A_cjs.definePlugin({
+var emailPluginV3 = chunkA4KUJ3LD_cjs.definePlugin({
   id: "email",
   version: "1.0.0",
   name: "Email",
@@ -1984,7 +2127,7 @@ var emailPluginV3 = chunkXW56B23A_cjs.definePlugin({
     const db = env.DB;
     if (db) {
       try {
-        const typeRegistry = new chunkAAWNRBRB_cjs.DocumentTypeRegistry(db);
+        const typeRegistry = new chunkFCLKX2OS_cjs.DocumentTypeRegistry(db);
         await typeRegistry.register({
           id: "email_log",
           name: "email_log",
@@ -1999,7 +2142,7 @@ var emailPluginV3 = chunkXW56B23A_cjs.definePlugin({
       } catch {
       }
     }
-    if (!chunkVXE42MYF_cjs.hasEmailService()) {
+    if (!chunk7RUW244J_cjs.hasEmailService()) {
       const settings = db ? await new EmailSettingsService(db).load() : {};
       const envResendKey = typeof env.RESEND_API_KEY === "string" && env.RESEND_API_KEY ? env.RESEND_API_KEY : void 0;
       const cfEmailBinding = env.EMAIL;
@@ -2017,7 +2160,7 @@ var emailPluginV3 = chunkXW56B23A_cjs.definePlugin({
       } else {
         provider = resolveEmailProvider({ env });
       }
-      chunkVXE42MYF_cjs.setEmailService(new EmailService({ ...serviceOpts, provider }));
+      chunk7RUW244J_cjs.setEmailService(new EmailService({ ...serviceOpts, provider }));
     }
     ctx.hooks.on("auth:registration:completed", makeOnRegistrationCompleted(env));
     ctx.hooks.on("auth:password-reset:requested", makeOnPasswordResetRequested(env));
@@ -2028,7 +2171,7 @@ var emailPluginV3 = chunkXW56B23A_cjs.definePlugin({
 var BATCH_SIZE = 100;
 ({
   schema: zod.z.record(zod.z.string(), zod.z.unknown())});
-var emailReconciliationPlugin = chunkXW56B23A_cjs.definePlugin({
+var emailReconciliationPlugin = chunkA4KUJ3LD_cjs.definePlugin({
   id: "email-reconciliation",
   version: "1.0.0",
   description: "Hourly cron that backfills email delivery state from provider status APIs. Only active for providers that implement EmailProvider.reconcile().",
@@ -2049,11 +2192,11 @@ var emailReconciliationPlugin = chunkXW56B23A_cjs.definePlugin({
       console.warn("[email-reconciliation] No DB binding in cron env \u2014 skipping.");
       return;
     }
-    if (!chunkVXE42MYF_cjs.hasEmailService()) {
+    if (!chunk7RUW244J_cjs.hasEmailService()) {
       console.warn("[email-reconciliation] EmailService not initialized \u2014 skipping.");
       return;
     }
-    const emailService = chunkVXE42MYF_cjs.getEmailService();
+    const emailService = chunk7RUW244J_cjs.getEmailService();
     let rows = [];
     try {
       const result = await db.prepare(
@@ -2122,6 +2265,7 @@ var OTPService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   /**
    * Generate a secure random OTP code
    */
@@ -2485,7 +2629,7 @@ function buildOtpApi() {
           console.warn("Failed to parse OTP plugin settings, using defaults");
         }
       }
-      const settingsService = new chunkBDDABDAB_cjs.SettingsService(db);
+      const settingsService = new chunk36Z3AKX3_cjs.SettingsService(db);
       const generalSettings = await settingsService.getGeneralSettings();
       const siteName = generalSettings.siteName;
       const canRequest = await otpService.checkRateLimit(normalizedEmail, settings);
@@ -2539,8 +2683,8 @@ function buildOtpApi() {
           loginUrl: settings.loginUrl || "",
           loginButtonText: settings.loginButtonText || ""
         });
-        if (chunkVXE42MYF_cjs.hasEmailService()) {
-          const sent = await chunkVXE42MYF_cjs.getEmailService().send({
+        if (chunk7RUW244J_cjs.hasEmailService()) {
+          const sent = await chunk7RUW244J_cjs.getEmailService().send({
             to: normalizedEmail,
             subject: `Your login code for ${siteName}`,
             flow: "otp",
@@ -2642,21 +2786,21 @@ function buildOtpApi() {
           error: "Account is deactivated"
         }, 403);
       }
-      const tokenTtl = await chunkAAWNRBRB_cjs.getJwtExpirySecondsFromDb(db, c.env);
-      const token = await chunkAAWNRBRB_cjs.AuthManager.generateToken(user.id, user.email, user.role, c.env.JWT_SECRET, tokenTtl);
+      const tokenTtl = await chunkFCLKX2OS_cjs.getJwtExpirySecondsFromDb(db, c.env);
+      const token = await chunkFCLKX2OS_cjs.AuthManager.generateToken(user.id, user.email, user.role, c.env.JWT_SECRET, tokenTtl);
       cookie.setCookie(c, "auth_token", token, {
         httpOnly: true,
         secure: true,
         sameSite: "Strict",
         maxAge: tokenTtl
       });
-      chunkVXE42MYF_cjs.dispatchHookEvent(
+      chunk7RUW244J_cjs.dispatchHookEvent(
         c,
         "auth:otp:verified",
         { user: { id: user.id, email: user.email, role: user.role } },
         "fire-and-forget"
       );
-      const customData = await chunkVXE42MYF_cjs.getCustomData(db, user.id);
+      const customData = await chunk7RUW244J_cjs.getCustomData(db, user.id);
       const { is_active: _isActive, ...publicUser } = user;
       return c.json({
         success: true,
@@ -2701,7 +2845,7 @@ function buildOtpApi() {
   });
   return otpAPI;
 }
-var otpLoginPlugin = chunkXW56B23A_cjs.definePlugin({
+var otpLoginPlugin = chunkA4KUJ3LD_cjs.definePlugin({
   id: "otp-login",
   version: "1.0.0",
   name: "OTP Login",
@@ -2756,6 +2900,7 @@ var OAuthService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   /**
    * Build the authorization redirect URL for a provider.
    */
@@ -3098,15 +3243,15 @@ function buildOauthApi() {
         if (!user || !user.is_active) {
           return c.redirect("/auth/login?error=Account is deactivated");
         }
-        const tokenTtl2 = await chunkAAWNRBRB_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
-        const jwt2 = await chunkAAWNRBRB_cjs.AuthManager.generateToken(
+        const tokenTtl2 = await chunkFCLKX2OS_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
+        const jwt2 = await chunkFCLKX2OS_cjs.AuthManager.generateToken(
           user.id,
           user.email,
           user.role,
           c.env.JWT_SECRET,
           tokenTtl2
         );
-        chunkAAWNRBRB_cjs.AuthManager.setAuthCookie(c, jwt2, { sameSite: "Lax", maxAge: tokenTtl2 });
+        chunkFCLKX2OS_cjs.AuthManager.setAuthCookie(c, jwt2, { sameSite: "Lax", maxAge: tokenTtl2 });
         return c.redirect("/admin");
       }
       const existingUser = await oauthService.findUserByEmail(profile.email);
@@ -3123,15 +3268,15 @@ function buildOauthApi() {
           tokenExpiresAt: tokenExpiresAt ?? void 0,
           profileData: JSON.stringify(profile)
         });
-        const tokenTtl2 = await chunkAAWNRBRB_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
-        const jwt2 = await chunkAAWNRBRB_cjs.AuthManager.generateToken(
+        const tokenTtl2 = await chunkFCLKX2OS_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
+        const jwt2 = await chunkFCLKX2OS_cjs.AuthManager.generateToken(
           existingUser.id,
           existingUser.email,
           existingUser.role,
           c.env.JWT_SECRET,
           tokenTtl2
         );
-        chunkAAWNRBRB_cjs.AuthManager.setAuthCookie(c, jwt2, { sameSite: "Lax", maxAge: tokenTtl2 });
+        chunkFCLKX2OS_cjs.AuthManager.setAuthCookie(c, jwt2, { sameSite: "Lax", maxAge: tokenTtl2 });
         return c.redirect("/admin");
       }
       const newUserId = await oauthService.createUserFromOAuth(profile);
@@ -3144,15 +3289,15 @@ function buildOauthApi() {
         tokenExpiresAt: tokenExpiresAt ?? void 0,
         profileData: JSON.stringify(profile)
       });
-      const tokenTtl = await chunkAAWNRBRB_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
-      const jwt = await chunkAAWNRBRB_cjs.AuthManager.generateToken(
+      const tokenTtl = await chunkFCLKX2OS_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
+      const jwt = await chunkFCLKX2OS_cjs.AuthManager.generateToken(
         newUserId,
         profile.email.toLowerCase(),
         "viewer",
         c.env.JWT_SECRET,
         tokenTtl
       );
-      chunkAAWNRBRB_cjs.AuthManager.setAuthCookie(c, jwt, { sameSite: "Lax", maxAge: tokenTtl });
+      chunkFCLKX2OS_cjs.AuthManager.setAuthCookie(c, jwt, { sameSite: "Lax", maxAge: tokenTtl });
       return c.redirect("/admin");
     } catch (error) {
       console.error("OAuth callback error:", error);
@@ -3247,7 +3392,7 @@ function buildOauthApi() {
   });
   return oauthAPI;
 }
-var oauthProvidersPlugin = chunkXW56B23A_cjs.definePlugin({
+var oauthProvidersPlugin = chunkA4KUJ3LD_cjs.definePlugin({
   id: "oauth-providers",
   version: "1.0.0",
   name: "OAuth Providers",
@@ -3272,6 +3417,7 @@ var EmbeddingService = class {
   constructor(ai) {
     this.ai = ai;
   }
+  ai;
   /**
    * Generate embedding for a single text
    */
@@ -3476,6 +3622,9 @@ var CustomRAGService = class {
     this.embeddingService = new EmbeddingService(ai);
     this.chunkingService = new ChunkingService();
   }
+  db;
+  ai;
+  vectorize;
   embeddingService;
   chunkingService;
   /**
@@ -3766,6 +3915,9 @@ var AISearchService = class {
       console.log("[AISearchService] Custom RAG not available, using keyword search only");
     }
   }
+  db;
+  ai;
+  vectorize;
   customRAG;
   /**
    * Get plugin settings
@@ -3824,7 +3976,7 @@ var AISearchService = class {
    */
   async detectNewCollections() {
     try {
-      const allCollections = chunkQAYFOER6_cjs.getCollectionRegistry().listActive().filter((r) => !r.internal).map((r) => ({
+      const allCollections = chunkKVBHB7QP_cjs.getCollectionRegistry().listActive().filter((r) => !r.internal).map((r) => ({
         id: r.id,
         name: r.name,
         display_name: r.displayName,
@@ -3876,7 +4028,7 @@ var AISearchService = class {
    */
   async getAllCollections() {
     try {
-      const allCollections = chunkQAYFOER6_cjs.getCollectionRegistry().listActive().filter((r) => !r.internal).sort((a, b) => a.displayName.localeCompare(b.displayName)).map((r) => ({
+      const allCollections = chunkKVBHB7QP_cjs.getCollectionRegistry().listActive().filter((r) => !r.internal).sort((a, b) => a.displayName.localeCompare(b.displayName)).map((r) => ({
         id: r.id,
         name: r.name,
         display_name: r.displayName,
@@ -4206,13 +4358,16 @@ var IndexManager = class {
       console.log("[IndexManager] Custom RAG initialized");
     }
   }
+  db;
+  ai;
+  vectorize;
   customRAG;
   /**
    * Index all content items within a collection using Custom RAG
    */
   async indexCollection(collectionId) {
     try {
-      const registry = chunkQAYFOER6_cjs.getCollectionRegistry();
+      const registry = chunkKVBHB7QP_cjs.getCollectionRegistry();
       const record = registry.getById(collectionId) ?? registry.getByName(collectionId);
       if (!record) {
         throw new Error(`Collection ${collectionId} not found`);
@@ -4828,7 +4983,7 @@ function renderSettingsPage(data) {
       }, 30000);
     </script>
   `;
-  return chunkMVIZJOO5_cjs.renderAdminLayout({
+  return chunkPXNTCCPE_cjs.renderAdminLayout({
     title: "AI Search Settings",
     pageTitle: "AI Search Settings",
     currentPath: "/admin/plugins/ai-search/settings",
@@ -4839,7 +4994,7 @@ function renderSettingsPage(data) {
 
 // src/plugins/core-plugins/ai-search-plugin/routes/admin.ts
 var adminRoutes2 = new hono.Hono();
-adminRoutes2.use("*", chunkAAWNRBRB_cjs.requireAuth());
+adminRoutes2.use("*", chunkFCLKX2OS_cjs.requireAuth());
 adminRoutes2.get("/", async (c) => {
   try {
     const user = c.get("user");
@@ -5080,7 +5235,7 @@ var manifest_default = {
   author: "SonicJS"};
 
 // src/plugins/core-plugins/ai-search-plugin/index.ts
-var aiSearchPlugin = chunkXW56B23A_cjs.definePlugin({
+var aiSearchPlugin = chunkA4KUJ3LD_cjs.definePlugin({
   id: manifest_default.id,
   version: manifest_default.version,
   name: manifest_default.name,
@@ -5133,12 +5288,14 @@ var SecurityAuditService = class {
   constructor(db, settings = DEFAULT_SETTINGS2) {
     this.db = db;
     this.settings = settings;
-    this.docsService = new chunk2CB4KY7I_cjs.DocumentsService(db, {
+    this.docsService = new chunkLTZ5WYOK_cjs.DocumentsService(db, {
       queryableFields: QUERYABLE_FIELDS,
       maxVersionsPerRoot: 1,
       tenantId: TENANT
     });
   }
+  db;
+  settings;
   docsService;
   async logEvent(event) {
     const doc = await this.docsService.create({
@@ -5379,7 +5536,7 @@ function rowToEvent(row) {
 }
 
 // src/plugins/core-plugins/security-audit-plugin/components/dashboard-page.ts
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 function formatTimestamp(ts) {
   const date = new Date(ts);
   const now = Date.now();
@@ -5578,11 +5735,11 @@ function renderSecurityDashboard(data) {
     version,
     dynamicMenuItems
   };
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/plugins/core-plugins/security-audit-plugin/components/event-log-page.ts
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 function formatTimestamp2(ts) {
   const date = new Date(ts);
   return date.toLocaleDateString("en-US", {
@@ -5789,11 +5946,11 @@ function renderEventLogPage(data) {
     version,
     dynamicMenuItems
   };
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/plugins/core-plugins/security-audit-plugin/components/settings-page.ts
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 function renderSecuritySettingsPage(data) {
   const { settings, user, version, message, dynamicMenuItems } = data;
   const content2 = `
@@ -5946,12 +6103,12 @@ function renderSecuritySettingsPage(data) {
     version,
     dynamicMenuItems
   };
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/plugins/core-plugins/security-audit-plugin/routes/admin.ts
 var adminRoutes3 = new hono.Hono();
-adminRoutes3.use("*", chunkAAWNRBRB_cjs.requireAuth());
+adminRoutes3.use("*", chunkFCLKX2OS_cjs.requireAuth());
 adminRoutes3.use("*", async (c, next) => {
   const user = c.get("user");
   if (user?.role !== "admin") {
@@ -5961,7 +6118,7 @@ adminRoutes3.use("*", async (c, next) => {
 });
 async function getSettings(db) {
   try {
-    const pluginService = new chunkQAYFOER6_cjs.PluginService(db);
+    const pluginService = new chunkKVBHB7QP_cjs.PluginService(db);
     const plugin2 = await pluginService.getPlugin("security-audit");
     if (plugin2?.settings) {
       const settings = typeof plugin2.settings === "string" ? JSON.parse(plugin2.settings) : plugin2.settings;
@@ -6066,7 +6223,7 @@ adminRoutes3.post("/settings", async (c) => {
       autoPurge: body["retention.autoPurge"] === "true"
     }
   };
-  const pluginService = new chunkQAYFOER6_cjs.PluginService(db);
+  const pluginService = new chunkKVBHB7QP_cjs.PluginService(db);
   await pluginService.updatePluginSettings("security-audit", settings);
   if (c.req.header("HX-Request")) {
     return c.json({ success: true });
@@ -6082,6 +6239,7 @@ var BruteForceDetector = class {
     this.kv = kv;
     this.settings = settings || DEFAULT_SETTINGS2.bruteForce;
   }
+  kv;
   settings;
   async recordFailedAttempt(ip, email) {
     if (!this.settings.enabled || !this.kv) {
@@ -6227,7 +6385,7 @@ var BruteForceDetector = class {
 
 // src/plugins/core-plugins/security-audit-plugin/routes/api.ts
 var apiRoutes2 = new hono.Hono();
-apiRoutes2.use("*", chunkAAWNRBRB_cjs.requireAuth());
+apiRoutes2.use("*", chunkFCLKX2OS_cjs.requireAuth());
 apiRoutes2.use("*", async (c, next) => {
   const user = c.get("user");
   if (user?.role !== "admin") {
@@ -6237,7 +6395,7 @@ apiRoutes2.use("*", async (c, next) => {
 });
 async function getSettings2(db) {
   try {
-    const pluginService = new chunkQAYFOER6_cjs.PluginService(db);
+    const pluginService = new chunkKVBHB7QP_cjs.PluginService(db);
     const plugin2 = await pluginService.getPlugin("security-audit");
     if (plugin2?.settings) {
       const settings = typeof plugin2.settings === "string" ? JSON.parse(plugin2.settings) : plugin2.settings;
@@ -6385,7 +6543,7 @@ function generateFingerprint(ip, userAgent) {
 }
 async function getPluginSettings(db) {
   try {
-    const pluginService = new chunkQAYFOER6_cjs.PluginService(db);
+    const pluginService = new chunkKVBHB7QP_cjs.PluginService(db);
     const plugin2 = await pluginService.getPlugin("security-audit");
     if (plugin2?.settings) {
       const settings = typeof plugin2.settings === "string" ? JSON.parse(plugin2.settings) : plugin2.settings;
@@ -6616,7 +6774,7 @@ async function logAuthEvent(c, db, settings, ip, userAgent, countryCode, fingerp
 
 // src/plugins/core-plugins/security-audit-plugin/index.ts
 var SECURITY_ICON = `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/></svg>`;
-var securityAuditPlugin = chunkXW56B23A_cjs.definePlugin({
+var securityAuditPlugin = chunkA4KUJ3LD_cjs.definePlugin({
   id: "security-audit",
   version: "1.0.0",
   name: "Security Audit",
@@ -6634,11 +6792,465 @@ var securityAuditPlugin = chunkXW56B23A_cjs.definePlugin({
   deactivate: async () => console.log("[SecurityAudit] Plugin deactivated")
 });
 
+// src/plugins/core-plugins/api-keys-plugin/services/api-key-service.ts
+var API_KEY_QUERYABLE = [
+  { name: "keyHash", kind: "scalar", type: "text", column: "q_apikey_hash" },
+  { name: "userId", kind: "scalar", type: "text", column: "q_apikey_user_id" },
+  { name: "revoked", kind: "scalar", type: "integer", column: "q_apikey_revoked" }
+];
+var KEY_PREFIX = "sk_";
+var KEY_BYTES = 24;
+var DISPLAY_PREFIX_LEN = KEY_PREFIX.length + 8;
+function generateApiKeySecret() {
+  const bytes = new Uint8Array(KEY_BYTES);
+  crypto.getRandomValues(bytes);
+  let hex = "";
+  for (const b of bytes) hex += b.toString(16).padStart(2, "0");
+  return KEY_PREFIX + hex;
+}
+async function hashApiKey(secret) {
+  const data = new TextEncoder().encode(secret);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  const view = new Uint8Array(digest);
+  let hex = "";
+  for (const b of view) hex += b.toString(16).padStart(2, "0");
+  return hex;
+}
+var ApiKeyService = class {
+  constructor(db, tenantId = "default") {
+    this.db = db;
+    this.tenantId = tenantId;
+  }
+  db;
+  tenantId;
+  docService() {
+    return new chunkLTZ5WYOK_cjs.DocumentsService(this.db, {
+      queryableFields: API_KEY_QUERYABLE,
+      tenantId: this.tenantId,
+      maxVersionsPerRoot: 1
+    });
+  }
+  /** Count a user's active (non-revoked) keys — used to enforce the per-user cap. */
+  async countForUser(userId) {
+    const row = await this.db.prepare(
+      `SELECT COUNT(*) AS c FROM documents
+         WHERE type_id = 'api_key' AND tenant_id = ? AND is_current_draft = 1
+           AND deleted_at IS NULL AND q_apikey_user_id = ? AND q_apikey_revoked = 0`
+    ).bind(this.tenantId, userId).first();
+    return row?.c ?? 0;
+  }
+  /**
+   * Mint a new key for a user. The returned `key` is the only time the plaintext
+   * exists outside the caller — it is hashed before storage.
+   */
+  async create(input) {
+    const name = input.name.trim() || "API Key";
+    const secret = generateApiKeySecret();
+    const keyHash = await hashApiKey(secret);
+    const prefix = secret.slice(0, DISPLAY_PREFIX_LEN);
+    const expiresAt = input.expiresAt ?? null;
+    const doc = await this.docService().create(
+      chunk7RUW244J_cjs.createDocumentSchema.parse({
+        typeId: "api_key",
+        tenantId: this.tenantId,
+        title: name,
+        ownerId: input.userId,
+        publishOnCreate: true,
+        data: {
+          name,
+          userId: input.userId,
+          keyHash,
+          keyPrefix: prefix,
+          revoked: 0,
+          lastUsedAt: null,
+          expiresAt
+        }
+      }),
+      input.userId
+    );
+    return { id: doc.rootId, key: secret, name, prefix, expiresAt };
+  }
+  /** List a user's non-revoked keys (metadata only — never the secret or hash). */
+  async list(userId) {
+    const res = await this.db.prepare(
+      `SELECT root_id, data, created_at FROM documents
+         WHERE type_id = 'api_key' AND tenant_id = ? AND is_current_draft = 1
+           AND deleted_at IS NULL AND q_apikey_user_id = ? AND q_apikey_revoked = 0
+         ORDER BY created_at DESC`
+    ).bind(this.tenantId, userId).all();
+    return (res.results ?? []).map((row) => {
+      const d = JSON.parse(row.data);
+      return {
+        id: row.root_id,
+        name: d.name ?? "API Key",
+        prefix: d.keyPrefix ?? "",
+        createdAt: row.created_at,
+        lastUsedAt: d.lastUsedAt ?? null,
+        expiresAt: d.expiresAt ?? null
+      };
+    });
+  }
+  /**
+   * Revoke (hard-delete) a key owned by `userId`. Credentials are erased, not
+   * soft-flagged. Returns false if the key does not exist or is not owned by
+   * the caller (no information leak about other users' keys).
+   */
+  async revoke(rootId, userId) {
+    const row = await this.db.prepare(
+      `SELECT q_apikey_user_id AS owner FROM documents
+         WHERE root_id = ? AND tenant_id = ? AND type_id = 'api_key' AND is_current_draft = 1 AND deleted_at IS NULL`
+    ).bind(rootId, this.tenantId).first();
+    if (!row || row.owner !== userId) return false;
+    await this.docService().erase(rootId, this.tenantId);
+    return true;
+  }
+  /**
+   * Resolve a presented secret to its owning user, or null. Rejects unknown,
+   * revoked, expired keys and inactive users. Best-effort updates lastUsedAt.
+   */
+  async resolve(secret) {
+    if (!secret || !secret.startsWith(KEY_PREFIX)) return null;
+    const keyHash = await hashApiKey(secret);
+    const keyRow2 = await this.db.prepare(
+      `SELECT root_id, data FROM documents
+         WHERE type_id = 'api_key' AND tenant_id = ? AND is_current_draft = 1 AND deleted_at IS NULL
+           AND q_apikey_hash = ? AND q_apikey_revoked = 0
+         LIMIT 1`
+    ).bind(this.tenantId, keyHash).first();
+    if (!keyRow2) return null;
+    const d = JSON.parse(keyRow2.data);
+    if (d.expiresAt != null && Date.now() > Number(d.expiresAt)) return null;
+    const user = await this.db.prepare(`SELECT id, email, role, is_active, is_super_admin FROM auth_user WHERE id = ?`).bind(d.userId).first();
+    if (!user || user.is_active !== 1) return null;
+    try {
+      await this.touchLastUsed(keyRow2.root_id, d);
+    } catch {
+    }
+    return {
+      userId: user.id,
+      email: user.email,
+      role: user.role ?? "viewer",
+      isSuperAdmin: user.is_super_admin === 1
+    };
+  }
+  /** Update lastUsedAt in-place (single-version type, no history churn). */
+  async touchLastUsed(rootId, data) {
+    const next = JSON.stringify({ ...data, lastUsedAt: Date.now() });
+    await this.db.prepare(
+      `UPDATE documents SET data = ? WHERE root_id = ? AND tenant_id = ? AND type_id = 'api_key' AND is_current_draft = 1`
+    ).bind(next, rootId, this.tenantId).run();
+  }
+};
+
+// src/plugins/core-plugins/api-keys-plugin/components/keys-page.ts
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
+function fmtDate(ms) {
+  if (!ms) return "\u2014";
+  try {
+    return new Date(ms).toISOString().slice(0, 10);
+  } catch {
+    return "\u2014";
+  }
+}
+function keyRow(k) {
+  const name = chunkMNWKYY5E_cjs.escapeHtml(k.name);
+  const prefix = chunkMNWKYY5E_cjs.escapeHtml(k.prefix);
+  const id = chunkMNWKYY5E_cjs.escapeHtml(k.id);
+  return `
+    <tr class="border-t border-zinc-950/5 dark:border-white/10" data-key-id="${id}">
+      <td class="py-3 pr-4 text-sm font-medium text-zinc-950 dark:text-white">${name}</td>
+      <td class="py-3 pr-4 text-sm font-mono text-zinc-500 dark:text-zinc-400">${prefix}\u2026</td>
+      <td class="py-3 pr-4 text-sm text-zinc-500 dark:text-zinc-400">${fmtDate(k.createdAt ? k.createdAt * 1e3 : null)}</td>
+      <td class="py-3 pr-4 text-sm text-zinc-500 dark:text-zinc-400">${k.lastUsedAt ? fmtDate(k.lastUsedAt) : "Never"}</td>
+      <td class="py-3 pr-4 text-sm text-zinc-500 dark:text-zinc-400">${k.expiresAt ? fmtDate(k.expiresAt) : "Never"}</td>
+      <td class="py-3 text-right">
+        <button type="button" onclick="revokeApiKey('${id}', '${name.replace(/'/g, "\\'")}')"
+          class="rounded-lg bg-red-50 dark:bg-red-900/20 px-3 py-1.5 text-sm font-medium text-red-700 dark:text-red-400 hover:bg-red-100 dark:hover:bg-red-900/40 ring-1 ring-red-200 dark:ring-red-800 transition-colors">
+          Revoke
+        </button>
+      </td>
+    </tr>`;
+}
+function renderApiKeysPage(data) {
+  const { keys, user, version, dynamicMenuItems } = data;
+  const rows = keys.length ? keys.map(keyRow).join("") : `<tr><td colspan="6" class="py-8 text-center text-sm text-zinc-500 dark:text-zinc-400">No API keys yet. Create one to enable programmatic access.</td></tr>`;
+  const content2 = `
+    <div>
+      <div class="sm:flex sm:items-center sm:justify-between mb-6">
+        <div class="sm:flex-auto">
+          <h1 class="text-2xl/8 font-semibold text-zinc-950 dark:text-white sm:text-xl/8">API Keys</h1>
+          <p class="mt-2 text-sm/6 text-zinc-500 dark:text-zinc-400">
+            Long-lived secrets for headless / server-to-server REST access. Send a key as the
+            <code class="font-mono">x-api-key</code> header or <code class="font-mono">Authorization: Bearer &lt;key&gt;</code>.
+            The secret is shown once at creation \u2014 store it now.
+          </p>
+        </div>
+        <div class="mt-4 sm:mt-0 sm:ml-16">
+          <button type="button" onclick="document.getElementById('create-key-modal').classList.remove('hidden')"
+            class="inline-flex items-center justify-center rounded-lg bg-cyan-600 px-4 py-2.5 text-sm font-semibold text-white hover:bg-cyan-500 transition-colors shadow-sm">
+            Create API key
+          </button>
+        </div>
+      </div>
+
+      <!-- Newly-created secret banner (populated by JS, shown once) -->
+      <div id="new-key-banner" class="hidden mb-6 rounded-xl bg-emerald-50 dark:bg-emerald-900/20 p-4 ring-1 ring-emerald-200 dark:ring-emerald-800">
+        <p class="text-sm font-medium text-emerald-800 dark:text-emerald-300 mb-2">
+          Copy your new key now \u2014 it will not be shown again.
+        </p>
+        <div class="flex items-center gap-2">
+          <code id="new-key-value" class="flex-1 rounded-lg bg-white dark:bg-zinc-900 px-3 py-2 text-sm font-mono text-zinc-950 dark:text-white ring-1 ring-zinc-950/10 dark:ring-white/10 break-all"></code>
+          <button type="button" onclick="copyNewKey()"
+            class="rounded-lg bg-emerald-600 px-3 py-2 text-sm font-semibold text-white hover:bg-emerald-500 transition-colors">
+            Copy
+          </button>
+        </div>
+      </div>
+
+      <div class="rounded-xl bg-white/80 dark:bg-zinc-900/80 backdrop-blur-xl p-6 ring-1 ring-zinc-950/5 dark:ring-white/10 shadow-sm overflow-x-auto">
+        <table class="w-full text-left">
+          <thead>
+            <tr class="text-xs font-semibold uppercase tracking-wide text-zinc-500 dark:text-zinc-400">
+              <th class="pb-2 pr-4">Name</th>
+              <th class="pb-2 pr-4">Prefix</th>
+              <th class="pb-2 pr-4">Created</th>
+              <th class="pb-2 pr-4">Last used</th>
+              <th class="pb-2 pr-4">Expires</th>
+              <th class="pb-2 text-right">Actions</th>
+            </tr>
+          </thead>
+          <tbody id="keys-tbody">${rows}</tbody>
+        </table>
+      </div>
+    </div>
+
+    <!-- Create modal -->
+    <div id="create-key-modal" class="hidden fixed inset-0 z-50 flex items-center justify-center bg-black/40 p-4">
+      <div class="w-full max-w-md rounded-xl bg-white dark:bg-zinc-900 p-6 ring-1 ring-zinc-950/10 dark:ring-white/10 shadow-xl">
+        <h2 class="text-base font-semibold text-zinc-950 dark:text-white mb-4">Create API key</h2>
+        <label class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1">Name</label>
+        <input id="new-key-name" type="text" placeholder="e.g. CI deploy token"
+          class="w-full rounded-lg border-zinc-300 dark:border-zinc-700 bg-white dark:bg-zinc-800 px-3 py-2 text-sm text-zinc-950 dark:text-white mb-4 ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10">
+        <label class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1">Expires in (days, optional)</label>
+        <input id="new-key-expiry" type="number" min="1" max="3650" placeholder="Never"
+          class="w-full rounded-lg border-zinc-300 dark:border-zinc-700 bg-white dark:bg-zinc-800 px-3 py-2 text-sm text-zinc-950 dark:text-white mb-4 ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10">
+        <div class="flex justify-end gap-2">
+          <button type="button" onclick="document.getElementById('create-key-modal').classList.add('hidden')"
+            class="rounded-lg bg-white dark:bg-zinc-800 px-4 py-2 text-sm font-semibold text-zinc-950 dark:text-white ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10">
+            Cancel
+          </button>
+          <button type="button" onclick="createApiKey()"
+            class="rounded-lg bg-cyan-600 px-4 py-2 text-sm font-semibold text-white hover:bg-cyan-500 transition-colors">
+            Create
+          </button>
+        </div>
+      </div>
+    </div>
+
+    <script>
+      // CSRF: the csrf_token cookie is JS-readable (httpOnly:false); echo it back
+      // as X-CSRF-Token on state-changing requests (signed double-submit).
+      function csrfHeader() {
+        const m = document.cookie.match(/(?:^|; )csrf_token=([^;]+)/)
+        return m ? { 'X-CSRF-Token': decodeURIComponent(m[1]) } : {}
+      }
+      async function createApiKey() {
+        const name = document.getElementById('new-key-name').value.trim()
+        if (!name) { window.showNotification && window.showNotification('Name is required', 'error'); return }
+        const expiry = parseInt(document.getElementById('new-key-expiry').value, 10)
+        const body = { name }
+        if (Number.isFinite(expiry) && expiry > 0) body.expiresInDays = expiry
+        const res = await fetch('/admin/plugins/api-keys/api/keys', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', ...csrfHeader() },
+          body: JSON.stringify(body),
+        })
+        if (!res.ok) {
+          const e = await res.json().catch(() => ({}))
+          window.showNotification && window.showNotification(e.error || 'Failed to create key', 'error')
+          return
+        }
+        const { apiKey } = await res.json()
+        document.getElementById('create-key-modal').classList.add('hidden')
+        document.getElementById('new-key-value').textContent = apiKey.key
+        document.getElementById('new-key-banner').classList.remove('hidden')
+        setTimeout(() => location.reload(), 1500)
+      }
+      function copyNewKey() {
+        const v = document.getElementById('new-key-value').textContent
+        navigator.clipboard.writeText(v).then(() => window.showNotification && window.showNotification('Copied', 'success'))
+      }
+      async function revokeApiKey(id, name) {
+        if (!confirm('Revoke "' + name + '"? This cannot be undone and will break any client using it.')) return
+        const res = await fetch('/admin/plugins/api-keys/api/keys/' + id, { method: 'DELETE', headers: { ...csrfHeader() } })
+        if (res.ok) {
+          const row = document.querySelector('[data-key-id="' + id + '"]')
+          if (row) row.remove()
+          window.showNotification && window.showNotification('Key revoked', 'success')
+        } else {
+          window.showNotification && window.showNotification('Failed to revoke', 'error')
+        }
+      }
+    </script>`;
+  const layoutData = {
+    title: "API Keys",
+    pageTitle: "API Keys",
+    currentPath: "/admin/plugins/api-keys",
+    user,
+    content: content2,
+    version,
+    dynamicMenuItems
+  };
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst(layoutData);
+}
+
+// src/plugins/core-plugins/api-keys-plugin/types.ts
+var DEFAULT_SETTINGS3 = {
+  maxKeysPerUser: 50,
+  defaultExpiryDays: 0
+};
+
+// src/plugins/core-plugins/api-keys-plugin/routes/admin.ts
+var adminRoutes4 = new hono.Hono();
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var createSchema = zod.z.object({
+  name: zod.z.string().min(1).max(100),
+  // Optional lifetime in days; omitted/null → plugin default (which may be "never").
+  expiresInDays: zod.z.number().int().positive().max(3650).nullish()
+});
+async function getSettings3(db) {
+  try {
+    const plugin2 = await new chunkKVBHB7QP_cjs.PluginService(db).getPlugin("api-keys");
+    if (plugin2?.settings) {
+      const s = typeof plugin2.settings === "string" ? JSON.parse(plugin2.settings) : plugin2.settings;
+      return { ...DEFAULT_SETTINGS3, ...s };
+    }
+  } catch {
+  }
+  return DEFAULT_SETTINGS3;
+}
+adminRoutes4.use("*", chunkFCLKX2OS_cjs.requireAuth());
+adminRoutes4.use("*", async (c, next) => {
+  const user = c.get("user");
+  if (user?.role !== "admin") {
+    return c.json({ error: "Access denied" }, 403);
+  }
+  return next();
+});
+adminRoutes4.get("/", async (c) => {
+  const user = c.get("user");
+  const tenantId = c.get("tenantId") || "default";
+  const keys = await new ApiKeyService(c.env.DB, tenantId).list(user.userId);
+  return c.html(
+    renderApiKeysPage({
+      keys,
+      user: { name: user.email, email: user.email, role: user.role },
+      version: c.get("appVersion"),
+      dynamicMenuItems: c.get("pluginMenuItems")
+    })
+  );
+});
+adminRoutes4.get("/api/keys", async (c) => {
+  const user = c.get("user");
+  const tenantId = c.get("tenantId") || "default";
+  const keys = await new ApiKeyService(c.env.DB, tenantId).list(user.userId);
+  return c.json({ keys });
+});
+adminRoutes4.post("/api/keys", async (c) => {
+  const user = c.get("user");
+  const tenantId = c.get("tenantId") || "default";
+  const body = await c.req.json().catch(() => ({}));
+  const parsed = createSchema.safeParse(body);
+  if (!parsed.success) {
+    return c.json({ error: "Invalid request", details: parsed.error.flatten() }, 400);
+  }
+  const settings = await getSettings3(c.env.DB);
+  const svc = new ApiKeyService(c.env.DB, tenantId);
+  if (await svc.countForUser(user.userId) >= settings.maxKeysPerUser) {
+    return c.json({ error: `API key limit reached (max ${settings.maxKeysPerUser})` }, 409);
+  }
+  const days = parsed.data.expiresInDays ?? (settings.defaultExpiryDays > 0 ? settings.defaultExpiryDays : null);
+  const expiresAt = days ? Date.now() + days * DAY_MS : null;
+  const created = await svc.create({ userId: user.userId, name: parsed.data.name, expiresAt });
+  return c.json({ apiKey: created }, 201);
+});
+adminRoutes4.delete("/api/keys/:id", async (c) => {
+  const user = c.get("user");
+  const tenantId = c.get("tenantId") || "default";
+  const ok = await new ApiKeyService(c.env.DB, tenantId).revoke(c.req.param("id") ?? "", user.userId);
+  if (!ok) return c.json({ error: "API key not found" }, 404);
+  return c.json({ success: true });
+});
+
+// src/plugins/core-plugins/api-keys-plugin/middleware/api-key-auth.ts
+function apiKeyAuthMiddleware() {
+  return async (c, next) => {
+    if (!c.get("user")) {
+      const authz = c.req.header("authorization") || "";
+      const bearer = authz.toLowerCase().startsWith("bearer ") ? authz.slice(7).trim() : "";
+      const presented = c.req.header("x-api-key") || (bearer.startsWith("sk_") ? bearer : "");
+      if (presented) {
+        try {
+          const tenantId = c.get("tenantId") || "default";
+          const resolved = await new ApiKeyService(c.env.DB, tenantId).resolve(presented);
+          if (resolved) {
+            c.set("user", {
+              userId: resolved.userId,
+              email: resolved.email,
+              role: resolved.role,
+              isSuperAdmin: resolved.isSuperAdmin,
+              // API keys are stateless bearer creds — no session window.
+              exp: 0,
+              iat: 0
+            });
+          }
+        } catch {
+        }
+      }
+    }
+    await next();
+  };
+}
+
+// src/plugins/core-plugins/api-keys-plugin/index.ts
+var KEY_ICON = `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z"/></svg>`;
+var apiKeysPlugin = chunkA4KUJ3LD_cjs.definePlugin({
+  id: "api-keys",
+  version: "1.0.0-beta.1",
+  name: "API Keys",
+  description: "Programmatic API access keys for headless / server-to-server REST access.",
+  sonicjsVersionRange: "^3.0.0",
+  author: { name: "SonicJS Team" },
+  register(app2) {
+    app2.route("/admin/plugins/api-keys", adminRoutes4);
+  },
+  menu: [
+    { label: "API Keys", path: "/admin/plugins/api-keys", icon: KEY_ICON, order: 86 }
+  ],
+  configSchema: {
+    maxKeysPerUser: {
+      type: "number",
+      label: "Max keys per user",
+      description: "Hard cap on active keys a single user may hold.",
+      default: 50
+    },
+    defaultExpiryDays: {
+      type: "number",
+      label: "Default expiry (days)",
+      description: "Lifetime applied to new keys when no explicit expiry is given. 0 = never expires.",
+      default: 0
+    }
+  },
+  activate: async () => console.log("[ApiKeys] Plugin activated"),
+  deactivate: async () => console.log("[ApiKeys] Plugin deactivated")
+});
+
 // src/plugins/core-plugins/stripe-plugin/services/subscription-service.ts
 var SubscriptionService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   /**
    * Ensure the subscriptions table exists
    */
@@ -6877,6 +7489,7 @@ var StripeEventService = class {
   constructor(db) {
     this.db = db;
   }
+  db;
   async ensureTable() {
     await this.db.prepare(`
       CREATE TABLE IF NOT EXISTS stripe_events (
@@ -6987,7 +7600,7 @@ var StripeEventService = class {
 };
 
 // src/plugins/core-plugins/stripe-plugin/components/subscriptions-page.ts
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 
 // src/plugins/core-plugins/stripe-plugin/components/tab-bar.ts
 var TABS = [
@@ -7120,7 +7733,7 @@ function renderSubscriptionsPage(data) {
     version,
     dynamicMenuItems
   };
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 function statsCard(label, value, colorClass) {
   return `
@@ -7200,7 +7813,7 @@ function renderPagination2(page, totalPages, status) {
 }
 
 // src/plugins/core-plugins/stripe-plugin/components/events-page.ts
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 function renderEventsPage(data) {
   const { events, stats, types, filters, user, version, dynamicMenuItems } = data;
   const content2 = `
@@ -7273,7 +7886,7 @@ function renderEventsPage(data) {
     version,
     dynamicMenuItems
   };
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 function eventStatsCard(label, value, colorClass) {
   return `
@@ -7361,7 +7974,7 @@ function renderEventPagination(page, totalPages, type, status) {
 }
 
 // src/plugins/core-plugins/stripe-plugin/types.ts
-var DEFAULT_SETTINGS3 = {
+var DEFAULT_SETTINGS4 = {
   stripePublishableKey: "",
   stripeSecretKey: "",
   stripeWebhookSecret: "",
@@ -7371,28 +7984,28 @@ var DEFAULT_SETTINGS3 = {
 };
 
 // src/plugins/core-plugins/stripe-plugin/routes/admin.ts
-var adminRoutes4 = new hono.Hono();
-adminRoutes4.use("*", chunkAAWNRBRB_cjs.requireAuth());
-adminRoutes4.use("*", async (c, next) => {
+var adminRoutes5 = new hono.Hono();
+adminRoutes5.use("*", chunkFCLKX2OS_cjs.requireAuth());
+adminRoutes5.use("*", async (c, next) => {
   const user = c.get("user");
   if (user?.role !== "admin") {
     return c.text("Access denied", 403);
   }
   return next();
 });
-async function getSettings3(db) {
+async function getSettings4(db) {
   try {
-    const pluginService = new chunkQAYFOER6_cjs.PluginService(db);
+    const pluginService = new chunkKVBHB7QP_cjs.PluginService(db);
     const plugin2 = await pluginService.getPlugin("stripe");
     if (plugin2?.settings) {
       const settings = typeof plugin2.settings === "string" ? JSON.parse(plugin2.settings) : plugin2.settings;
-      return { ...DEFAULT_SETTINGS3, ...settings };
+      return { ...DEFAULT_SETTINGS4, ...settings };
     }
   } catch {
   }
-  return DEFAULT_SETTINGS3;
+  return DEFAULT_SETTINGS4;
 }
-adminRoutes4.get("/", async (c) => {
+adminRoutes5.get("/", async (c) => {
   const db = c.env.DB;
   const user = c.get("user");
   const subscriptionService = new SubscriptionService(db);
@@ -7415,7 +8028,7 @@ adminRoutes4.get("/", async (c) => {
   });
   return c.html(html4);
 });
-adminRoutes4.get("/events", async (c) => {
+adminRoutes5.get("/events", async (c) => {
   const db = c.env.DB;
   const user = c.get("user");
   const eventService = new StripeEventService(db);
@@ -7441,11 +8054,11 @@ adminRoutes4.get("/events", async (c) => {
   });
   return c.html(html4);
 });
-adminRoutes4.get("/settings", async (c) => {
+adminRoutes5.get("/settings", async (c) => {
   const db = c.env.DB;
   const user = c.get("user");
-  const settings = await getSettings3(db);
-  const { renderAdminLayoutCatalyst: renderAdminLayoutCatalyst2 } = await import('./admin-layout-catalyst.template-ZK5HD545.cjs');
+  const settings = await getSettings4(db);
+  const { renderAdminLayoutCatalyst: renderAdminLayoutCatalyst2 } = await import('./admin-layout-catalyst.template-KDHKVLXR.cjs');
   const content2 = `
     <div>
       <div class="mb-6">
@@ -7551,7 +8164,7 @@ adminRoutes4.get("/settings", async (c) => {
     dynamicMenuItems: c.get("pluginMenuItems")
   }));
 });
-adminRoutes4.post("/settings", async (c) => {
+adminRoutes5.post("/settings", async (c) => {
   try {
     const body = await c.req.json();
     const db = c.env.DB;
@@ -7573,6 +8186,7 @@ var StripeAPI = class {
   constructor(secretKey) {
     this.secretKey = secretKey;
   }
+  secretKey;
   baseUrl = "https://api.stripe.com/v1";
   /**
    * Verify a webhook signature
@@ -7702,17 +8316,17 @@ function timingSafeEqual(a, b) {
 
 // src/plugins/core-plugins/stripe-plugin/routes/api.ts
 var apiRoutes3 = new hono.Hono();
-async function getSettings4(db) {
+async function getSettings5(db) {
   try {
-    const pluginService = new chunkQAYFOER6_cjs.PluginService(db);
+    const pluginService = new chunkKVBHB7QP_cjs.PluginService(db);
     const plugin2 = await pluginService.getPlugin("stripe");
     if (plugin2?.settings) {
       const settings = typeof plugin2.settings === "string" ? JSON.parse(plugin2.settings) : plugin2.settings;
-      return { ...DEFAULT_SETTINGS3, ...settings };
+      return { ...DEFAULT_SETTINGS4, ...settings };
     }
   } catch {
   }
-  return DEFAULT_SETTINGS3;
+  return DEFAULT_SETTINGS4;
 }
 function mapStripeStatus(status) {
   const map = {
@@ -7729,7 +8343,7 @@ function mapStripeStatus(status) {
 }
 apiRoutes3.post("/webhook", async (c) => {
   const db = c.env.DB;
-  const settings = await getSettings4(db);
+  const settings = await getSettings5(db);
   if (!settings.stripeWebhookSecret) {
     return c.json({ error: "Webhook secret not configured" }, 500);
   }
@@ -7855,11 +8469,11 @@ apiRoutes3.post("/webhook", async (c) => {
   }
   return c.json({ received: true });
 });
-apiRoutes3.post("/create-checkout-session", chunkAAWNRBRB_cjs.requireAuth(), async (c) => {
+apiRoutes3.post("/create-checkout-session", chunkFCLKX2OS_cjs.requireAuth(), async (c) => {
   const db = c.env.DB;
   const user = c.get("user");
   if (!user) return c.json({ error: "Unauthorized" }, 401);
-  const settings = await getSettings4(db);
+  const settings = await getSettings5(db);
   if (!settings.stripeSecretKey) {
     return c.json({ error: "Stripe not configured" }, 500);
   }
@@ -7895,7 +8509,7 @@ apiRoutes3.post("/create-checkout-session", chunkAAWNRBRB_cjs.requireAuth(), asy
   });
   return c.json({ sessionId: session.id, url: session.url });
 });
-apiRoutes3.get("/subscription", chunkAAWNRBRB_cjs.requireAuth(), async (c) => {
+apiRoutes3.get("/subscription", chunkFCLKX2OS_cjs.requireAuth(), async (c) => {
   const user = c.get("user");
   if (!user) return c.json({ error: "Unauthorized" }, 401);
   const db = c.env.DB;
@@ -7907,7 +8521,7 @@ apiRoutes3.get("/subscription", chunkAAWNRBRB_cjs.requireAuth(), async (c) => {
   }
   return c.json({ subscription });
 });
-apiRoutes3.get("/subscriptions", chunkAAWNRBRB_cjs.requireAuth(), async (c) => {
+apiRoutes3.get("/subscriptions", chunkFCLKX2OS_cjs.requireAuth(), async (c) => {
   const user = c.get("user");
   if (user?.role !== "admin") return c.json({ error: "Access denied" }, 403);
   const db = c.env.DB;
@@ -7923,7 +8537,7 @@ apiRoutes3.get("/subscriptions", chunkAAWNRBRB_cjs.requireAuth(), async (c) => {
   const result = await subscriptionService.list(filters);
   return c.json(result);
 });
-apiRoutes3.get("/stats", chunkAAWNRBRB_cjs.requireAuth(), async (c) => {
+apiRoutes3.get("/stats", chunkFCLKX2OS_cjs.requireAuth(), async (c) => {
   const user = c.get("user");
   if (user?.role !== "admin") return c.json({ error: "Access denied" }, 403);
   const db = c.env.DB;
@@ -7932,11 +8546,11 @@ apiRoutes3.get("/stats", chunkAAWNRBRB_cjs.requireAuth(), async (c) => {
   const stats = await subscriptionService.getStats();
   return c.json(stats);
 });
-apiRoutes3.post("/sync-subscriptions", chunkAAWNRBRB_cjs.requireAuth(), async (c) => {
+apiRoutes3.post("/sync-subscriptions", chunkFCLKX2OS_cjs.requireAuth(), async (c) => {
   const user = c.get("user");
   if (user?.role !== "admin") return c.json({ error: "Access denied" }, 403);
   const db = c.env.DB;
-  const settings = await getSettings4(db);
+  const settings = await getSettings5(db);
   if (!settings.stripeSecretKey) {
     return c.json({ error: "Stripe secret key not configured" }, 400);
   }
@@ -7980,7 +8594,7 @@ apiRoutes3.post("/sync-subscriptions", chunkAAWNRBRB_cjs.requireAuth(), async (c
     }, 500);
   }
 });
-apiRoutes3.get("/events", chunkAAWNRBRB_cjs.requireAuth(), async (c) => {
+apiRoutes3.get("/events", chunkFCLKX2OS_cjs.requireAuth(), async (c) => {
   const user = c.get("user");
   if (user?.role !== "admin") return c.json({ error: "Access denied" }, 403);
   const db = c.env.DB;
@@ -8003,7 +8617,7 @@ apiRoutes3.get("/events", chunkAAWNRBRB_cjs.requireAuth(), async (c) => {
 
 // src/plugins/core-plugins/stripe-plugin/index.ts
 var STRIPE_ICON = `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 10h18M7 15h1m4 0h1m-7 4h12a3 3 0 003-3V8a3 3 0 00-3-3H6a3 3 0 00-3 3v8a3 3 0 003 3z"/></svg>`;
-var stripePlugin = chunkXW56B23A_cjs.definePlugin({
+var stripePlugin = chunkA4KUJ3LD_cjs.definePlugin({
   id: "stripe",
   version: "1.0.0",
   name: "Stripe",
@@ -8011,7 +8625,7 @@ var stripePlugin = chunkXW56B23A_cjs.definePlugin({
   sonicjsVersionRange: "^3.0.0",
   author: { name: "SonicJS Team" },
   register(app2) {
-    app2.route("/admin/plugins/stripe", adminRoutes4);
+    app2.route("/admin/plugins/stripe", adminRoutes5);
     app2.route("/api/stripe", apiRoutes3);
   },
   menu: [
@@ -8024,7 +8638,7 @@ var stripePlugin = chunkXW56B23A_cjs.definePlugin({
 });
 
 // src/templates/pages/admin-forms-list.template.ts
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 function renderFormsListPage(data) {
   const tableData = {
     tableId: "forms-table",
@@ -8276,7 +8890,7 @@ function renderFormsListPage(data) {
 
       <!-- Forms Table -->
       <div class="bg-white dark:bg-zinc-900 rounded-lg border border-zinc-950/5 dark:border-white/10 overflow-hidden">
-        ${chunkVXE42MYF_cjs.renderTable(tableData)}
+        ${chunk7RUW244J_cjs.renderTable(tableData)}
       </div>
     </div>
   `;
@@ -8286,11 +8900,11 @@ function renderFormsListPage(data) {
     user: data.user,
     version: data.version
   };
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/templates/pages/admin-forms-builder.template.ts
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 function getTurnstileComponentScript() {
   return `
     (function() {
@@ -9503,11 +10117,11 @@ ${getTurnstileComponentScript()}
     user: data.user,
     version: data.version
   };
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/templates/pages/admin-forms-create.template.ts
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 function renderFormCreatePage(data) {
   const pageContent = `
     <div class="max-w-3xl mx-auto">
@@ -9700,12 +10314,13 @@ function renderFormCreatePage(data) {
     user: data.user,
     version: data.version
   };
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/routes/admin-forms.ts
+var isTableMissing = (err) => String(err?.message ?? err?.cause?.message ?? "").includes("no such table: forms");
 var adminFormsRoutes = new hono.Hono();
-adminFormsRoutes.use("*", chunkAAWNRBRB_cjs.requireAuth());
+adminFormsRoutes.use("*", chunkFCLKX2OS_cjs.requireAuth());
 adminFormsRoutes.get("/", async (c) => {
   try {
     const user = c.get("user");
@@ -9745,6 +10360,14 @@ adminFormsRoutes.get("/", async (c) => {
     };
     return c.html(renderFormsListPage(pageData));
   } catch (error) {
+    if (isTableMissing(error)) {
+      const user = c.get("user");
+      return c.html(renderFormsListPage({
+        forms: [],
+        user: user ? { name: user.email, email: user.email, role: user.role } : void 0,
+        version: c.get("appVersion")
+      }));
+    }
     console.error("Error listing forms:", error);
     return c.html("<p>Error loading forms</p>", 500);
   }
@@ -9855,6 +10478,7 @@ adminFormsRoutes.post("/", async (c) => {
     ).run();
     return c.redirect(`/admin/forms/${formId}/builder`);
   } catch (error) {
+    if (isTableMissing(error)) return c.json({ error: "Forms storage not configured \u2014 run database migrations" }, 503);
     console.error("Error creating form:", error);
     return c.json({ error: "Failed to create form" }, 500);
   }
@@ -9869,7 +10493,7 @@ adminFormsRoutes.get("/:id/builder", async (c) => {
     if (!form) {
       return c.html("<p>Form not found</p>", 404);
     }
-    const turnstileService = new chunkH2AXVCLS_cjs.TurnstileService(db);
+    const turnstileService = new chunk5UXU3LP4_cjs.TurnstileService(db);
     const turnstileSettings = await turnstileService.getSettings();
     const pageData = {
       id: form.id,
@@ -9892,6 +10516,7 @@ adminFormsRoutes.get("/:id/builder", async (c) => {
     };
     return c.html(renderFormBuilderPage(pageData));
   } catch (error) {
+    if (isTableMissing(error)) return c.html("<p>Forms storage not configured \u2014 run database migrations</p>", 503);
     console.error("Error showing form builder:", error);
     return c.html("<p>Error loading form builder</p>", 500);
   }
@@ -9921,6 +10546,7 @@ adminFormsRoutes.put("/:id", async (c) => {
     ).run();
     return c.json({ success: true, message: "Form saved successfully" });
   } catch (error) {
+    if (isTableMissing(error)) return c.json({ error: "Forms storage not configured \u2014 run database migrations" }, 503);
     console.error("Error updating form:", error);
     return c.json({ error: "Failed to save form" }, 500);
   }
@@ -9942,6 +10568,7 @@ adminFormsRoutes.delete("/:id", async (c) => {
     await db.prepare("DELETE FROM forms WHERE id = ?").bind(formId).run();
     return c.json({ success: true, message: "Form deleted successfully" });
   } catch (error) {
+    if (isTableMissing(error)) return c.json({ error: "Forms storage not configured \u2014 run database migrations" }, 503);
     console.error("Error deleting form:", error);
     return c.json({ error: "Failed to delete form" }, 500);
   }
@@ -10002,6 +10629,7 @@ adminFormsRoutes.get("/:id/submissions", async (c) => {
     `;
     return c.html(html4);
   } catch (error) {
+    if (isTableMissing(error)) return c.html("<p>Forms storage not configured \u2014 run database migrations</p>", 503);
     console.error("Error loading submissions:", error);
     return c.html("<p>Error loading submissions</p>", 500);
   }
@@ -10022,6 +10650,7 @@ function sanitizeDeep(value) {
   }
   return value;
 }
+var isTableMissing2 = (err) => String(err?.message ?? err?.cause?.message ?? "").includes("no such table: form");
 var publicFormsRoutes = new hono.Hono();
 publicFormsRoutes.get("/:identifier/turnstile-config", async (c) => {
   try {
@@ -10033,7 +10662,7 @@ publicFormsRoutes.get("/:identifier/turnstile-config", async (c) => {
     if (!form) {
       return c.json({ error: "Form not found" }, 404);
     }
-    const turnstileService = new chunkH2AXVCLS_cjs.TurnstileService(db);
+    const turnstileService = new chunk5UXU3LP4_cjs.TurnstileService(db);
     const globalSettings = await turnstileService.getSettings();
     const formSettings = form.turnstile_settings ? JSON.parse(form.turnstile_settings) : { inherit: true };
     const enabled = form.turnstile_enabled === 1 || formSettings.inherit && globalSettings?.enabled;
@@ -10049,6 +10678,7 @@ publicFormsRoutes.get("/:identifier/turnstile-config", async (c) => {
       appearance: formSettings.appearance || globalSettings.appearance || "always"
     });
   } catch (error) {
+    if (isTableMissing2(error)) return c.json({ enabled: false });
     console.error("Error fetching Turnstile config:", error);
     return c.json({ error: "Failed to fetch config" }, 500);
   }
@@ -10076,6 +10706,7 @@ publicFormsRoutes.get("/:identifier/schema", async (c) => {
       submitUrl: `/api/forms/${form.id}/submit`
     });
   } catch (error) {
+    if (isTableMissing2(error)) return c.json({ error: "Form not found" }, 404);
     console.error("Error fetching form schema:", error);
     return c.json({ error: "Failed to fetch form schema" }, 500);
   }
@@ -10442,6 +11073,7 @@ publicFormsRoutes.get("/:name", async (c) => {
     `;
     return c.html(html4);
   } catch (error) {
+    if (isTableMissing2(error)) return c.html("<h1>Form not found</h1><p>This form does not exist or is not publicly available.</p>", 404);
     console.error("Error rendering form:", error);
     return c.html("<p>Error loading form</p>", 500);
   }
@@ -10460,7 +11092,7 @@ publicFormsRoutes.post("/:identifier/submit", async (c) => {
     const turnstileEnabled = form.turnstile_enabled === 1;
     const turnstileSettings = form.turnstile_settings ? JSON.parse(form.turnstile_settings) : { inherit: true };
     if (turnstileEnabled || turnstileSettings.inherit) {
-      const turnstileService = new chunkH2AXVCLS_cjs.TurnstileService(db);
+      const turnstileService = new chunk5UXU3LP4_cjs.TurnstileService(db);
       const globalEnabled = await turnstileService.isEnabled();
       if (globalEnabled || turnstileEnabled) {
         const turnstileToken = body.data?.turnstile || body.turnstile;
@@ -10515,13 +11147,14 @@ publicFormsRoutes.post("/:identifier/submit", async (c) => {
       message: "Form submitted successfully"
     });
   } catch (error) {
+    if (isTableMissing2(error)) return c.json({ error: "Form not found" }, 404);
     console.error("Error submitting form:", error);
     return c.json({ error: "Failed to submit form" }, 500);
   }
 });
 
 // src/plugins/core-plugins/forms-plugin/index.ts
-var formsPlugin = chunkXW56B23A_cjs.definePlugin({
+var formsPlugin = chunkA4KUJ3LD_cjs.definePlugin({
   id: "forms",
   version: "1.0.0",
   name: "Forms",
@@ -10539,9 +11172,9 @@ var formsPlugin = chunkXW56B23A_cjs.definePlugin({
   activate: async () => console.info("\u2705 Forms plugin activated"),
   deactivate: async () => console.info("\u274C Forms plugin deactivated")
 });
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 var adminRbacRoutes = new hono.Hono();
-adminRbacRoutes.use("*", chunkAAWNRBRB_cjs.requireRbac("rbac", "manage"));
+adminRbacRoutes.use("*", chunkFCLKX2OS_cjs.requireRbac("rbac", "manage"));
 var esc = (s) => String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 var TABS2 = `
   <div class="border-b border-zinc-950/10 dark:border-white/10 mb-6">
@@ -10551,7 +11184,7 @@ var TABS2 = `
     </nav>
   </div>`;
 adminRbacRoutes.get("/", async (c) => {
-  const rbac = new chunk2CB4KY7I_cjs.RbacService(c.env.DB);
+  const rbac = new chunkLTZ5WYOK_cjs.RbacService(c.env.DB);
   const [roles, verbs, resources, grants] = await Promise.all([
     rbac.getRoles(),
     rbac.getVerbs(),
@@ -10662,7 +11295,7 @@ adminRbacRoutes.get("/", async (c) => {
           ${r.is_system ? `<code class="text-xs text-zinc-500 dark:text-zinc-400">${esc(r.name)}</code><span class="rounded-full bg-zinc-100 dark:bg-white/10 px-2 py-0.5 text-[11px] text-zinc-500 dark:text-zinc-400">system</span>` : `<input form="roles-bulk-form" class="${inpSm} w-28" name="name_${esc(r.id)}" value="${esc(r.name)}" required>`}
           <label class="ml-auto inline-flex items-center gap-2 rounded-md bg-white/5 px-2.5 py-1 text-xs font-medium text-zinc-700 dark:text-zinc-300 ring-1 ring-inset ring-zinc-500/20">
             <input form="roles-bulk-form" type="checkbox" name="portal_${esc(r.id)}" value="1" ${portalChecked ? "checked" : ""} ${portalDisabled ? "disabled" : ""} class="h-3.5 w-3.5 rounded border-zinc-400 text-cyan-600 focus:ring-cyan-500">
-            Access portal
+            Admin Panel
           </label>
           <a href="/admin/tenants/roles/${esc(r.name)}" data-role-tenants="${esc(r.name)}" class="text-xs text-cyan-600 dark:text-cyan-400 hover:underline" title="Per-tenant assignments of this role">tenants</a>
           ${r.is_system ? "" : `<button form="delete-role-${esc(r.id)}" type="submit" onclick="return confirm('Delete role ${esc(r.name)}?')" class="text-xs text-red-600 dark:text-red-400 hover:underline">delete</button>`}
@@ -10766,7 +11399,7 @@ adminRbacRoutes.get("/", async (c) => {
     <div class="grid grid-cols-1 md:grid-cols-2 gap-6 mb-6">
       <div class="${card}">
         <h3 class="text-base font-semibold text-zinc-950 dark:text-white mb-3">Roles</h3>
-        <p class="mb-3 text-xs text-zinc-500 dark:text-zinc-400">Use <strong>Access portal</strong> to allow a role into the admin backend. Resource permissions are configured in the <strong>Matrix</strong> tab.</p>
+        <p class="mb-3 text-xs text-zinc-500 dark:text-zinc-400">Use <strong>Admin Panel</strong> to allow a role into the admin backend. Resource permissions are configured in the <strong>Matrix</strong> tab.</p>
         ${roleList}
       </div>
       <div class="${card}">
@@ -10845,11 +11478,11 @@ adminRbacRoutes.get("/", async (c) => {
   </script>`;
   const u = c.get("user");
   return c.html(
-    chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst({
+    chunkK623Q6WD_cjs.renderAdminLayoutCatalyst({
       title: "Roles & Permissions",
       pageTitle: "Roles & Permissions",
       currentPath: "/admin/users",
-      version: chunkLRZIAW7U_cjs.getCoreVersion(),
+      version: chunkAOUVUF32_cjs.getCoreVersion(),
       user: u ? { name: u.email || "Admin", email: u.email || "", role: u.role || "admin" } : void 0,
       content: content2
     })
@@ -10873,7 +11506,7 @@ adminRbacRoutes.post("/grants", async (c) => {
       pairsByRole.get(roleId).push({ resource, verb, scope });
     }
   }
-  const rbac = new chunk2CB4KY7I_cjs.RbacService(c.env.DB);
+  const rbac = new chunkLTZ5WYOK_cjs.RbacService(c.env.DB);
   for (const id of saveRoleIds) {
     await rbac.setRoleGrants(id, pairsByRole.get(id) || []);
   }
@@ -10894,7 +11527,7 @@ adminRbacRoutes.post("/grants", async (c) => {
 adminRbacRoutes.post("/roles/bulk", async (c) => {
   const form = await c.req.formData();
   const roleIds = String(form.get("role_ids") || "").split(",").filter(Boolean);
-  const rbac = new chunk2CB4KY7I_cjs.RbacService(c.env.DB);
+  const rbac = new chunkLTZ5WYOK_cjs.RbacService(c.env.DB);
   for (const roleId of roleIds) {
     const displayName = String(form.get(`display_name_${roleId}`) || "").trim();
     const nameVal = form.get(`name_${roleId}`) ? String(form.get(`name_${roleId}`)).trim() : void 0;
@@ -10919,7 +11552,7 @@ adminRbacRoutes.post("/roles", async (c) => {
   const displayName = String(form.get("display_name") || "").trim();
   if (name && displayName) {
     try {
-      await new chunk2CB4KY7I_cjs.RbacService(c.env.DB).createRole(name, displayName);
+      await new chunkLTZ5WYOK_cjs.RbacService(c.env.DB).createRole(name, displayName);
     } catch {
     }
   }
@@ -10934,7 +11567,7 @@ adminRbacRoutes.post("/roles/:id", async (c) => {
   const portalAccess = form.get("portal_access") === "1";
   if (displayName) {
     try {
-      const rbac = new chunk2CB4KY7I_cjs.RbacService(c.env.DB);
+      const rbac = new chunkLTZ5WYOK_cjs.RbacService(c.env.DB);
       if (roleId !== "role-admin") {
         await rbac.updateRoleAndPortalAccess(roleId, displayName, name, portalAccess, description);
       } else {
@@ -10946,7 +11579,7 @@ adminRbacRoutes.post("/roles/:id", async (c) => {
   return c.redirect(`/admin/rbac#roles-verbs`);
 });
 adminRbacRoutes.post("/roles/:id/delete", async (c) => {
-  await new chunk2CB4KY7I_cjs.RbacService(c.env.DB).deleteRole(c.req.param("id"));
+  await new chunkLTZ5WYOK_cjs.RbacService(c.env.DB).deleteRole(c.req.param("id"));
   return c.redirect("/admin/rbac#roles-verbs");
 });
 adminRbacRoutes.post("/verbs", async (c) => {
@@ -10954,18 +11587,18 @@ adminRbacRoutes.post("/verbs", async (c) => {
   const name = String(form.get("name") || "").trim();
   if (name) {
     try {
-      await new chunk2CB4KY7I_cjs.RbacService(c.env.DB).createVerb(name);
+      await new chunkLTZ5WYOK_cjs.RbacService(c.env.DB).createVerb(name);
     } catch {
     }
   }
   return c.redirect("/admin/rbac#roles-verbs");
 });
 adminRbacRoutes.post("/verbs/:id/delete", async (c) => {
-  await new chunk2CB4KY7I_cjs.RbacService(c.env.DB).deleteVerb(c.req.param("id"));
+  await new chunkLTZ5WYOK_cjs.RbacService(c.env.DB).deleteVerb(c.req.param("id"));
   return c.redirect("/admin/rbac#roles-verbs");
 });
 adminRbacRoutes.get("/check", async (c) => {
-  const rbac = new chunk2CB4KY7I_cjs.RbacService(c.env.DB);
+  const rbac = new chunkLTZ5WYOK_cjs.RbacService(c.env.DB);
   const resource = c.req.query("resource") || "";
   const verb = c.req.query("verb") || "";
   const roleId = c.req.query("role");
@@ -10986,7 +11619,7 @@ adminRbacRoutes.get("/check", async (c) => {
 });
 
 // src/middleware/plugin-menu.ts
-var REGISTRY_MENU_PLUGINS = Object.values(chunkQAYFOER6_cjs.PLUGIN_REGISTRY).filter((p) => p.adminMenu !== null).map((p) => ({
+var REGISTRY_MENU_PLUGINS = Object.values(chunkKVBHB7QP_cjs.PLUGIN_REGISTRY).filter((p) => p.adminMenu !== null).map((p) => ({
   id: p.id,
   label: p.adminMenu.label,
   path: p.adminMenu.path,
@@ -11064,14 +11697,24 @@ function pluginMenuMiddleware() {
       }
     } catch {
     }
-    c.set("pluginMenuItems", activeMenuItems.map((m) => ({ label: m.label, path: m.path, icon: resolveIcon(m.icon) || "" })));
+    const user = c.get("user");
+    const singletonItems = chunk5UXU3LP4_cjs.resolvePluginMenuItems(user ? { role: user.role } : void 0);
+    const existingPaths = new Set(activeMenuItems.map((i) => i.path));
+    for (const item of singletonItems) {
+      if (!existingPaths.has(item.path)) {
+        activeMenuItems.push({ label: item.label, path: item.path, icon: item.icon, order: item.order });
+      }
+    }
+    activeMenuItems.sort((a, b) => a.order - b.order);
+    c.set("pluginMenuItems", activeMenuItems.map((m) => ({ label: m.label, path: m.path, icon: resolveIcon(m.icon) || m.icon || "" })));
     await next();
-    if (activeMenuItems.length > 0 && c.res.headers.get("content-type")?.includes("text/html")) {
+    const finalItems = c.get("pluginMenuItems") ?? [];
+    if (finalItems.length > 0 && c.res.headers.get("content-type")?.includes("text/html")) {
       const status = c.res.status;
       const headers = new Headers(c.res.headers);
       const html4 = await c.res.text();
       if (html4.includes(MARKER)) {
-        const renderedItems = activeMenuItems.map((item) => renderMenuItem(item, path)).join("");
+        const renderedItems = finalItems.map((item) => renderMenuItem(item, path)).join("");
         const newHtml = html4.split(MARKER).join(renderedItems);
         c.res = new Response(newHtml, { status, headers });
       } else {
@@ -11080,17 +11723,17 @@ function pluginMenuMiddleware() {
     }
   };
 }
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
-var adminRoutes5 = new hono.Hono();
-adminRoutes5.use("*", chunkAAWNRBRB_cjs.requireAuth());
-adminRoutes5.use("*", async (c, next) => {
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
+var adminRoutes6 = new hono.Hono();
+adminRoutes6.use("*", chunkFCLKX2OS_cjs.requireAuth());
+adminRoutes6.use("*", async (c, next) => {
   const user = c.get("user");
   if (user?.role !== "admin") {
     return c.text("Access denied", 403);
   }
   return next();
 });
-adminRoutes5.get("/", async (c) => {
+adminRoutes6.get("/", async (c) => {
   const user = c.get("user");
   const db = c.env.DB;
   let totalRequests = 0;
@@ -11198,7 +11841,7 @@ adminRoutes5.get("/", async (c) => {
       </div>
     </div>
   `;
-  return c.html(chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst({
+  return c.html(chunkK623Q6WD_cjs.renderAdminLayoutCatalyst({
     title: "Analytics",
     pageTitle: "Analytics Dashboard",
     currentPath: "/admin/analytics",
@@ -11229,12 +11872,13 @@ var QUERYABLE_FIELDS2 = [
 var EventTrackingService = class {
   constructor(db) {
     this.db = db;
-    this.docsService = new chunk2CB4KY7I_cjs.DocumentsService(db, {
+    this.docsService = new chunkLTZ5WYOK_cjs.DocumentsService(db, {
       queryableFields: QUERYABLE_FIELDS2,
       maxVersionsPerRoot: 1,
       tenantId: TENANT2
     });
   }
+  db;
   docsService;
   async trackEvent(input) {
     const doc = await this.docsService.create({
@@ -11437,7 +12081,7 @@ apiRoutes4.get("/stats", async (c) => {
 });
 
 // src/plugins/core-plugins/analytics/index.ts
-var analyticsPlugin = chunkXW56B23A_cjs.definePlugin({
+var analyticsPlugin = chunkA4KUJ3LD_cjs.definePlugin({
   id: "core-analytics",
   version: "1.0.0",
   name: "Analytics",
@@ -11446,7 +12090,7 @@ var analyticsPlugin = chunkXW56B23A_cjs.definePlugin({
   author: { name: "SonicJS Team", email: "team@sonicjs.com" },
   register(app2) {
     app2.route("/api/events", apiRoutes4);
-    app2.route("/admin/analytics", adminRoutes5);
+    app2.route("/admin/analytics", adminRoutes6);
   },
   menu: [
     {
@@ -11584,7 +12228,7 @@ function esc2(s) {
   return (s || "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 async function getVariablesMap(db) {
-  let variables = chunkVXE42MYF_cjs.getVariablesCached();
+  let variables = chunk7RUW244J_cjs.getVariablesCached();
   if (variables) return variables;
   try {
     const { results } = await db.prepare(
@@ -11594,7 +12238,7 @@ async function getVariablesMap(db) {
     for (const row of results || []) {
       variables.set(row.key, row.value);
     }
-    chunkVXE42MYF_cjs.setVariablesCache(variables);
+    chunk7RUW244J_cjs.setVariablesCache(variables);
     return variables;
   } catch {
     return /* @__PURE__ */ new Map();
@@ -11663,7 +12307,7 @@ apiRoutes5.post("/", async (c) => {
     await db.prepare(
       "INSERT INTO global_variables (key, value, description, category, is_active) VALUES (?, ?, ?, ?, ?)"
     ).bind(key, value || "", description || "", category || "general", isActive !== false ? 1 : 0).run();
-    chunkVXE42MYF_cjs.invalidateVariablesCache();
+    chunk7RUW244J_cjs.invalidateVariablesCache();
     const created = await db.prepare("SELECT * FROM global_variables WHERE key = ?").bind(key).first();
     return c.json({ success: true, data: formatVariable(created) }, 201);
   } catch {
@@ -11708,7 +12352,7 @@ apiRoutes5.put("/:id", async (c) => {
     updates.push("updated_at = strftime('%s', 'now')");
     params.push(id);
     await db.prepare(`UPDATE global_variables SET ${updates.join(", ")} WHERE id = ?`).bind(...params).run();
-    chunkVXE42MYF_cjs.invalidateVariablesCache();
+    chunk7RUW244J_cjs.invalidateVariablesCache();
     const updated = await db.prepare("SELECT * FROM global_variables WHERE id = ?").bind(id).first();
     return c.json({ success: true, data: formatVariable(updated) });
   } catch {
@@ -11722,14 +12366,14 @@ apiRoutes5.delete("/:id", async (c) => {
     const existing = await db.prepare("SELECT id FROM global_variables WHERE id = ?").bind(id).first();
     if (!existing) return c.json({ error: "Variable not found" }, 404);
     await db.prepare("DELETE FROM global_variables WHERE id = ?").bind(id).run();
-    chunkVXE42MYF_cjs.invalidateVariablesCache();
+    chunk7RUW244J_cjs.invalidateVariablesCache();
     return c.json({ success: true });
   } catch {
     return c.json({ success: false, error: "Failed to delete variable" }, 500);
   }
 });
-var adminRoutes6 = new hono.Hono();
-adminRoutes6.use("*", async (c, next) => {
+var adminRoutes7 = new hono.Hono();
+adminRoutes7.use("*", async (c, next) => {
   try {
     const db = c.env?.DB;
     if (db) {
@@ -11740,7 +12384,7 @@ adminRoutes6.use("*", async (c, next) => {
   }
   await next();
 });
-adminRoutes6.get("/", async (c) => {
+adminRoutes7.get("/", async (c) => {
   const db = c.env.DB;
   let variables = [];
   try {
@@ -11770,7 +12414,7 @@ adminRoutes6.get("/", async (c) => {
   }
   return c.html(renderAdminPage(variables, { editorActive, activeEditorName, enableEditorIntegration }));
 });
-adminRoutes6.put("/:id", async (c) => {
+adminRoutes7.put("/:id", async (c) => {
   const db = c.env.DB;
   const id = c.req.param("id");
   let body;
@@ -11782,19 +12426,19 @@ adminRoutes6.put("/:id", async (c) => {
   const value = body.value;
   if (value !== void 0) {
     await db.prepare("UPDATE global_variables SET value = ?, updated_at = strftime('%s', 'now') WHERE id = ?").bind(value, id).run();
-    chunkVXE42MYF_cjs.invalidateVariablesCache();
+    chunk7RUW244J_cjs.invalidateVariablesCache();
   }
   return c.html('<span class="text-green-400 text-xs">Saved</span>');
 });
-adminRoutes6.post("/:id/toggle", async (c) => {
+adminRoutes7.post("/:id/toggle", async (c) => {
   const db = c.env.DB;
   const id = c.req.param("id");
   await db.prepare("UPDATE global_variables SET is_active = CASE WHEN is_active = 1 THEN 0 ELSE 1 END, updated_at = strftime('%s', 'now') WHERE id = ?").bind(id).run();
-  chunkVXE42MYF_cjs.invalidateVariablesCache();
+  chunk7RUW244J_cjs.invalidateVariablesCache();
   c.header("HX-Redirect", "/admin/global-variables");
   return c.body(null, 204);
 });
-adminRoutes6.post("/", async (c) => {
+adminRoutes7.post("/", async (c) => {
   const db = c.env.DB;
   const form = await c.req.parseBody();
   const key = (form.key || "").trim();
@@ -11811,11 +12455,11 @@ adminRoutes6.post("/", async (c) => {
   await db.prepare(
     "INSERT INTO global_variables (key, value, description, category) VALUES (?, ?, ?, ?)"
   ).bind(key, value, description, category).run();
-  chunkVXE42MYF_cjs.invalidateVariablesCache();
+  chunk7RUW244J_cjs.invalidateVariablesCache();
   c.header("HX-Redirect", "/admin/global-variables");
   return c.body(null, 204);
 });
-adminRoutes6.post("/settings/editor-integration", async (c) => {
+adminRoutes7.post("/settings/editor-integration", async (c) => {
   const db = c.env.DB;
   try {
     const row = await db.prepare("SELECT settings FROM plugins WHERE id = 'global-variables'").first();
@@ -11827,10 +12471,10 @@ adminRoutes6.post("/settings/editor-integration", async (c) => {
     return c.json({ success: false, error: "Failed to update setting" }, 500);
   }
 });
-adminRoutes6.delete("/:id", async (c) => {
+adminRoutes7.delete("/:id", async (c) => {
   const db = c.env.DB;
   await db.prepare("DELETE FROM global_variables WHERE id = ?").bind(c.req.param("id")).run();
-  chunkVXE42MYF_cjs.invalidateVariablesCache();
+  chunk7RUW244J_cjs.invalidateVariablesCache();
   return c.html("");
 });
 function renderAdminPage(variables, editorStatus = { editorActive: false, activeEditorName: "", enableEditorIntegration: true }) {
@@ -12148,7 +12792,7 @@ function renderAdminPage(variables, editorStatus = { editorActive: false, active
   </div>
   ` });
 }
-var globalVariablesPlugin = chunkXW56B23A_cjs.definePlugin({
+var globalVariablesPlugin = chunkA4KUJ3LD_cjs.definePlugin({
   id: "global-variables",
   version: "1.1.0",
   name: "Global Variables",
@@ -12158,7 +12802,7 @@ var globalVariablesPlugin = chunkXW56B23A_cjs.definePlugin({
   capabilities: ["hooks.content:subscribe"],
   register(app2) {
     app2.route("/api/global-variables", apiRoutes5);
-    app2.route("/admin/global-variables", adminRoutes6);
+    app2.route("/admin/global-variables", adminRoutes7);
   },
   menu: [
     { label: "Global Variables", path: "/admin/global-variables", icon: "bolt", order: 45, permissions: ["global-variables:view"] }
@@ -12171,7 +12815,7 @@ var globalVariablesPlugin = chunkXW56B23A_cjs.definePlugin({
         if (!db || !data) return data;
         const variables = await getVariablesMap(db);
         if (variables.size === 0) return data;
-        return chunkVXE42MYF_cjs.resolveVariablesInObject(data, variables);
+        return chunk7RUW244J_cjs.resolveVariablesInObject(data, variables);
       } catch {
         return data;
       }
@@ -12189,7 +12833,7 @@ var globalVariablesPlugin = chunkXW56B23A_cjs.definePlugin({
   },
   activate: async () => console.info("[GlobalVariables] Plugin activated"),
   deactivate: async () => {
-    chunkVXE42MYF_cjs.invalidateVariablesCache();
+    chunk7RUW244J_cjs.invalidateVariablesCache();
     console.info("[GlobalVariables] Plugin deactivated, cache cleared");
   },
   uninstall: async (ctx) => {
@@ -12479,8 +13123,8 @@ apiRoutes6.delete("/:id", async (c) => {
     return c.json({ success: false, error: "Failed to delete shortcode" }, 500);
   }
 });
-var adminRoutes7 = new hono.Hono();
-adminRoutes7.use("*", async (c, next) => {
+var adminRoutes8 = new hono.Hono();
+adminRoutes8.use("*", async (c, next) => {
   try {
     const db = c.env?.DB;
     if (db) {
@@ -12491,7 +13135,7 @@ adminRoutes7.use("*", async (c, next) => {
   }
   await next();
 });
-adminRoutes7.get("/", async (c) => {
+adminRoutes8.get("/", async (c) => {
   const db = c.env.DB;
   let shortcodes = [];
   try {
@@ -12521,7 +13165,7 @@ adminRoutes7.get("/", async (c) => {
   }
   return c.html(renderAdminPage2(shortcodes, { editorActive, activeEditorName, enableEditorIntegration }));
 });
-adminRoutes7.post("/", async (c) => {
+adminRoutes8.post("/", async (c) => {
   const db = c.env.DB;
   const form = await c.req.parseBody();
   const name = (form.name || "").trim();
@@ -12542,7 +13186,7 @@ adminRoutes7.post("/", async (c) => {
   c.header("HX-Redirect", "/admin/shortcodes");
   return c.body(null, 204);
 });
-adminRoutes7.post("/settings/editor-integration", async (c) => {
+adminRoutes8.post("/settings/editor-integration", async (c) => {
   const db = c.env.DB;
   try {
     const row = await db.prepare("SELECT settings FROM plugins WHERE id = 'shortcodes'").first();
@@ -12554,7 +13198,7 @@ adminRoutes7.post("/settings/editor-integration", async (c) => {
     return c.json({ success: false, error: "Failed to update setting" }, 500);
   }
 });
-adminRoutes7.delete("/:id", async (c) => {
+adminRoutes8.delete("/:id", async (c) => {
   await c.env.DB.prepare("DELETE FROM shortcodes WHERE id = ?").bind(c.req.param("id")).run();
   return c.html("");
 });
@@ -12755,7 +13399,7 @@ function renderAdminPage2(shortcodes, editorStatus = { editorActive: false, acti
   </div>
   ` });
 }
-var shortcodesPlugin = chunkXW56B23A_cjs.definePlugin({
+var shortcodesPlugin = chunkA4KUJ3LD_cjs.definePlugin({
   id: "shortcodes",
   version: "1.0.0",
   name: "Shortcodes",
@@ -12765,7 +13409,7 @@ var shortcodesPlugin = chunkXW56B23A_cjs.definePlugin({
   capabilities: ["hooks.content:subscribe"],
   register(app2) {
     app2.route("/api/shortcodes", apiRoutes6);
-    app2.route("/admin/shortcodes", adminRoutes7);
+    app2.route("/admin/shortcodes", adminRoutes8);
   },
   menu: [
     { label: "Shortcodes", path: "/admin/shortcodes", icon: "bolt", order: 46, permissions: ["shortcodes:view"] }
@@ -12839,7 +13483,7 @@ helloWorldRoutes.get("/", async (c) => {
     </html>
   `);
 });
-var helloWorldPlugin = chunkXW56B23A_cjs.definePlugin({
+var helloWorldPlugin = chunkA4KUJ3LD_cjs.definePlugin({
   id: "hello-world",
   version: "1.0.0",
   name: "Hello World",
@@ -12874,6 +13518,9 @@ var helloWorldPlugin = chunkXW56B23A_cjs.definePlugin({
     console.info("\u274C Hello World plugin deactivated");
   }
 });
+function createHelloWorldPlugin() {
+  return helloWorldPlugin;
+}
 
 // src/plugins/core-plugins/multi-tenant-plugin/manifest.json
 var manifest_default2 = {
@@ -12883,7 +13530,7 @@ var manifest_default2 = {
   author: "SonicJS Team"};
 
 // src/plugins/core-plugins/multi-tenant-plugin/templates/tenants-list.template.ts
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 function statusBadge2(status) {
   return status === "active" ? '<span class="inline-flex items-center rounded-md bg-emerald-500/10 px-2 py-1 text-xs font-medium text-emerald-600 dark:text-emerald-400">Active</span>' : '<span class="inline-flex items-center rounded-md bg-zinc-500/10 px-2 py-1 text-xs font-medium text-zinc-600 dark:text-zinc-400">Inactive</span>';
 }
@@ -12956,7 +13603,7 @@ function renderTenantsList(data) {
         </table>
       </div>
     </div>`;
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst({
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst({
     title: "Tenants - SonicJS",
     pageTitle: "Tenants",
     currentPath: "/admin/tenants",
@@ -12975,7 +13622,7 @@ function renderTenantsInactive(data) {
         <a href="/admin/plugins" class="mt-6 inline-flex items-center rounded-lg bg-zinc-950 px-3.5 py-2 text-sm font-semibold text-white hover:bg-zinc-800 dark:bg-white dark:text-zinc-950 dark:hover:bg-zinc-200">Go to Plugins</a>
       </div>
     </div>`;
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst({
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst({
     title: "Tenants - SonicJS",
     pageTitle: "Tenants",
     currentPath: "/admin/tenants",
@@ -12986,7 +13633,7 @@ function renderTenantsInactive(data) {
 }
 
 // src/plugins/core-plugins/multi-tenant-plugin/templates/tenant-form.template.ts
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 function fieldErrors(errors, field) {
   const list = errors?.[field];
   if (!list || list.length === 0) return "";
@@ -13054,7 +13701,7 @@ function renderTenantForm(data) {
         </form>
       </div>
     </div>`;
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst({
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst({
     title: `${data.isEdit ? "Edit Tenant" : "New Tenant"} - SonicJS`,
     pageTitle: data.isEdit ? "Edit Tenant" : "New Tenant",
     currentPath: "/admin/tenants",
@@ -13065,9 +13712,9 @@ function renderTenantForm(data) {
 }
 
 // src/plugins/core-plugins/multi-tenant-plugin/templates/tenant-members.template.ts
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 function roleOptions(selected) {
-  return chunkVXE42MYF_cjs.VALID_MEMBER_ROLES.map(
+  return chunk7RUW244J_cjs.VALID_MEMBER_ROLES.map(
     (r) => `<option value="${r}" ${r === selected ? "selected" : ""}>${r}</option>`
   ).join("");
 }
@@ -13129,7 +13776,7 @@ function renderInvitations(slug, invitations) {
           <div>
             <label for="invite-role" class="mb-1 block text-xs font-medium text-zinc-500 dark:text-zinc-400">Role</label>
             <select id="invite-role" name="role" class="rounded-lg border border-zinc-950/10 bg-white px-2 py-2 text-sm text-zinc-950 dark:border-white/10 dark:bg-zinc-800 dark:text-white">
-              ${chunkVXE42MYF_cjs.VALID_MEMBER_ROLES.map((r) => `<option value="${r}" ${r === "viewer" ? "selected" : ""}>${r}</option>`).join("")}
+              ${chunk7RUW244J_cjs.VALID_MEMBER_ROLES.map((r) => `<option value="${r}" ${r === "viewer" ? "selected" : ""}>${r}</option>`).join("")}
             </select>
           </div>
           <button type="submit" data-send-invite class="rounded-lg bg-zinc-950 px-3.5 py-2 text-sm font-semibold text-white hover:bg-zinc-800 dark:bg-white dark:text-zinc-950 dark:hover:bg-zinc-200">Invite</button>
@@ -13212,7 +13859,7 @@ function renderTenantMembers(data) {
 
       ${renderInvitations(data.slug, data.invitations)}
     </div>`;
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst({
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst({
     title: `Members - ${data.tenantName} - SonicJS`,
     pageTitle: "Tenant Members",
     currentPath: "/admin/tenants",
@@ -13223,9 +13870,9 @@ function renderTenantMembers(data) {
 }
 
 // src/plugins/core-plugins/multi-tenant-plugin/templates/user-memberships.template.ts
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 function roleOptions2(selected) {
-  return chunkVXE42MYF_cjs.VALID_MEMBER_ROLES.map(
+  return chunk7RUW244J_cjs.VALID_MEMBER_ROLES.map(
     (r) => `<option value="${r}" ${r === selected ? "selected" : ""}>${r}</option>`
   ).join("");
 }
@@ -13298,7 +13945,7 @@ function renderUserMemberships(data) {
         </table>
       </div>
     </div>`;
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst({
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst({
     title: `Tenant memberships - ${data.userEmail} - SonicJS`,
     pageTitle: "Tenant memberships",
     currentPath: "/admin/users",
@@ -13309,7 +13956,7 @@ function renderUserMemberships(data) {
 }
 
 // src/plugins/core-plugins/multi-tenant-plugin/templates/role-usage.template.ts
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 function renderRoleUsage(data) {
   const role = chunkMNWKYY5E_cjs.escapeHtml(data.roleName);
   const rows = data.assignments.length ? data.assignments.map((a) => `
@@ -13344,7 +13991,7 @@ function renderRoleUsage(data) {
         </table>
       </div>
     </div>`;
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst({
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst({
     title: `Role usage - ${data.roleName} - SonicJS`,
     pageTitle: "Role usage",
     currentPath: "/admin/tenants",
@@ -13387,7 +14034,7 @@ function zodToFieldErrors(error) {
 }
 async function isMultiTenantActive(db) {
   try {
-    const plugin2 = await new chunkQAYFOER6_cjs.PluginService(db).getPlugin(chunkQAYFOER6_cjs.MULTI_TENANT_PLUGIN_ID);
+    const plugin2 = await new chunkKVBHB7QP_cjs.PluginService(db).getPlugin(chunkKVBHB7QP_cjs.MULTI_TENANT_PLUGIN_ID);
     return plugin2?.status === "active";
   } catch {
     return false;
@@ -13395,7 +14042,7 @@ async function isMultiTenantActive(db) {
 }
 function createTenantAdminRoutes() {
   const routes2 = new hono.Hono();
-  routes2.use("*", chunkAAWNRBRB_cjs.requireAuth());
+  routes2.use("*", chunkFCLKX2OS_cjs.requireAuth());
   routes2.use("*", async (c, next) => {
     const user = c.get("user");
     if (user?.role !== "admin") {
@@ -13409,7 +14056,7 @@ function createTenantAdminRoutes() {
     const form = await c.req.formData();
     const slug = String(form.get("tenant") ?? "").trim().toLowerCase();
     const redirect = String(form.get("redirect") ?? "");
-    const svc = new chunkVXE42MYF_cjs.TenantService(db);
+    const svc = new chunk7RUW244J_cjs.TenantService(db);
     const tenant = await svc.getTenantBySlug(slug);
     if (!tenant || tenant.status !== "active") {
       return c.json({ error: "Unknown or inactive tenant" }, 400);
@@ -13419,7 +14066,7 @@ function createTenantAdminRoutes() {
     if (!user.isSuperAdmin && !await svc.isMember(user.userId, slug)) {
       return c.json({ error: "You are not a member of this tenant" }, 403);
     }
-    cookie.setCookie(c, chunkQAYFOER6_cjs.TENANT_COOKIE, slug, {
+    cookie.setCookie(c, chunkKVBHB7QP_cjs.TENANT_COOKIE, slug, {
       path: "/",
       httpOnly: true,
       sameSite: "Lax",
@@ -13436,7 +14083,7 @@ function createTenantAdminRoutes() {
     if (!user) return c.redirect("/auth/login");
     const token = c.req.query("token") ?? "";
     try {
-      const { slug } = await new chunkVXE42MYF_cjs.TenantService(db).acceptInvitation(token, user.userId, user.email);
+      const { slug } = await new chunk7RUW244J_cjs.TenantService(db).acceptInvitation(token, user.userId, user.email);
       return c.redirect(`/admin/tenants/${slug}/members?message=Invitation accepted`);
     } catch (error) {
       const message = error instanceof Error ? error.message : "Failed to accept invitation";
@@ -13464,7 +14111,7 @@ function createTenantAdminRoutes() {
     const userId = c.req.param("userId");
     const target = await db.prepare("SELECT id, email FROM auth_user WHERE id = ?").bind(userId).first();
     if (!target?.id) return c.redirect("/admin/users?message=User not found&type=error");
-    const svc = new chunkVXE42MYF_cjs.TenantService(db);
+    const svc = new chunk7RUW244J_cjs.TenantService(db);
     const [memberships, allTenants] = await Promise.all([svc.listUserMemberships(userId), svc.listTenants()]);
     const memberSlugs = new Set(memberships.map((m) => m.slug));
     const availableTenants = allTenants.filter((t) => t.status === "active" && !memberSlugs.has(t.slug)).map((t) => ({ slug: t.slug, name: t.name }));
@@ -13489,10 +14136,10 @@ function createTenantAdminRoutes() {
       const slug = String(form.get("slug") ?? "").trim().toLowerCase();
       const role = String(form.get("role") ?? "viewer");
       const redirectTo = String(form.get("_redirect") ?? "") || `/admin/tenants/users/${userId}`;
-      if (!chunkVXE42MYF_cjs.isValidMemberRole(role)) throw new Error(`Invalid role '${role}'`);
+      if (!chunk7RUW244J_cjs.isValidMemberRole(role)) throw new Error(`Invalid role '${role}'`);
       const target = await db.prepare("SELECT email FROM auth_user WHERE id = ?").bind(userId).first();
       if (!target) throw new Error("User not found");
-      const svc = new chunkVXE42MYF_cjs.TenantService(db);
+      const svc = new chunk7RUW244J_cjs.TenantService(db);
       if (!await svc.getTenantBySlug(slug)) throw new Error("Tenant not found");
       if (await svc.isMember(userId, slug)) throw new Error(`Already a member of '${slug}'`);
       await svc.addMember(slug, userId, role, target.email ?? null);
@@ -13511,7 +14158,7 @@ function createTenantAdminRoutes() {
       const form = await c.req.formData();
       const role = String(form.get("role") ?? "");
       const redirectTo = String(form.get("_redirect") ?? "") || `/admin/tenants/users/${userId}`;
-      await new chunkVXE42MYF_cjs.TenantService(db).setMemberRole(slug, userId, role);
+      await new chunk7RUW244J_cjs.TenantService(db).setMemberRole(slug, userId, role);
       return c.redirect(`${redirectTo}?message=Role updated`);
     } catch (error) {
       const message = error instanceof Error ? error.message : "Failed to update role";
@@ -13526,7 +14173,7 @@ function createTenantAdminRoutes() {
     try {
       const form = await c.req.formData();
       const redirectTo = String(form.get("_redirect") ?? "") || `/admin/tenants/users/${userId}`;
-      await new chunkVXE42MYF_cjs.TenantService(db).removeMember(slug, userId);
+      await new chunk7RUW244J_cjs.TenantService(db).removeMember(slug, userId);
       return c.redirect(`${redirectTo}?message=Removed from ${encodeURIComponent(slug)}`);
     } catch (error) {
       const message = error instanceof Error ? error.message : "Failed to remove membership";
@@ -13541,7 +14188,7 @@ function createTenantAdminRoutes() {
       return c.html(renderTenantsInactive({ user: userShape(cur), version }));
     }
     const roleName = c.req.param("roleName");
-    const assignments = await new chunkVXE42MYF_cjs.TenantService(db).listAssignmentsByRole(roleName);
+    const assignments = await new chunk7RUW244J_cjs.TenantService(db).listAssignmentsByRole(roleName);
     return c.html(renderRoleUsage({ roleName, assignments, user: userShape(cur), version }));
   });
   routes2.get("/", async (c) => {
@@ -13551,7 +14198,7 @@ function createTenantAdminRoutes() {
     if (!await isMultiTenantActive(db)) {
       return c.html(renderTenantsInactive({ user: userShape(user), version }));
     }
-    const svc = new chunkVXE42MYF_cjs.TenantService(db);
+    const svc = new chunk7RUW244J_cjs.TenantService(db);
     await svc.ensureDefaultTenant();
     const tenants = await svc.listTenants();
     const [docRes, memberRes] = await db.batch([
@@ -13590,7 +14237,7 @@ function createTenantAdminRoutes() {
       formEntries = Object.fromEntries(form.entries());
       const validated = tenantFormSchema.parse(formEntries);
       if (!validated.slug) throw new zod.z.ZodError([{ code: "custom", message: "Slug is required", path: ["slug"] }]);
-      const svc = new chunkVXE42MYF_cjs.TenantService(db);
+      const svc = new chunk7RUW244J_cjs.TenantService(db);
       await svc.createTenant({
         name: validated.name,
         slug: validated.slug,
@@ -13615,7 +14262,7 @@ function createTenantAdminRoutes() {
     if (!await isMultiTenantActive(db)) {
       return c.html(renderTenantsInactive({ user: userShape(user), version }));
     }
-    const tenant = await new chunkVXE42MYF_cjs.TenantService(db).getTenantBySlug(c.req.param("slug"));
+    const tenant = await new chunk7RUW244J_cjs.TenantService(db).getTenantBySlug(c.req.param("slug"));
     if (!tenant) return c.redirect("/admin/tenants?message=Tenant not found&type=error");
     return c.html(renderTenantForm({ tenant, isEdit: true, user: userShape(user), version }));
   });
@@ -13625,7 +14272,7 @@ function createTenantAdminRoutes() {
     const version = c.get("appVersion");
     const slug = c.req.param("slug");
     if (!await isMultiTenantActive(db)) return c.json({ error: "Multi-tenant plugin is not active" }, 403);
-    const svc = new chunkVXE42MYF_cjs.TenantService(db);
+    const svc = new chunk7RUW244J_cjs.TenantService(db);
     try {
       const form = await c.req.formData();
       const validated = tenantFormSchema.parse(Object.fromEntries(form.entries()));
@@ -13650,7 +14297,7 @@ function createTenantAdminRoutes() {
     const slug = c.req.param("slug");
     if (!await isMultiTenantActive(db)) return c.json({ error: "Multi-tenant plugin is not active" }, 403);
     try {
-      await new chunkVXE42MYF_cjs.TenantService(db).deleteTenant(slug);
+      await new chunk7RUW244J_cjs.TenantService(db).deleteTenant(slug);
       return c.redirect("/admin/tenants?message=Tenant deleted successfully");
     } catch (error) {
       const message = error instanceof Error ? error.message : "Failed to delete tenant";
@@ -13665,7 +14312,7 @@ function createTenantAdminRoutes() {
       return c.html(renderTenantsInactive({ user: userShape(user), version }));
     }
     const slug = c.req.param("slug");
-    const svc = new chunkVXE42MYF_cjs.TenantService(db);
+    const svc = new chunk7RUW244J_cjs.TenantService(db);
     const tenant = await svc.getTenantBySlug(slug);
     if (!tenant) return c.redirect("/admin/tenants?message=Tenant not found&type=error");
     const [members, invitations] = await Promise.all([svc.listMembers(slug), svc.listInvitations(slug)]);
@@ -13691,7 +14338,7 @@ function createTenantAdminRoutes() {
       const form = await c.req.formData();
       const email = String(form.get("email") ?? "");
       const role = String(form.get("role") ?? "viewer");
-      await new chunkVXE42MYF_cjs.TenantService(db).addMemberByEmail(slug, email, role);
+      await new chunk7RUW244J_cjs.TenantService(db).addMemberByEmail(slug, email, role);
       return c.redirect(`/admin/tenants/${slug}/members?message=Member added`);
     } catch (error) {
       const message = error instanceof Error ? error.message : "Failed to add member";
@@ -13706,7 +14353,7 @@ function createTenantAdminRoutes() {
     try {
       const form = await c.req.formData();
       const role = String(form.get("role") ?? "");
-      await new chunkVXE42MYF_cjs.TenantService(db).setMemberRole(slug, userId, role);
+      await new chunk7RUW244J_cjs.TenantService(db).setMemberRole(slug, userId, role);
       return c.redirect(`/admin/tenants/${slug}/members?message=Role updated`);
     } catch (error) {
       const message = error instanceof Error ? error.message : "Failed to update role";
@@ -13719,7 +14366,7 @@ function createTenantAdminRoutes() {
     const userId = c.req.param("userId");
     if (!await isMultiTenantActive(db)) return c.json({ error: "Multi-tenant plugin is not active" }, 403);
     try {
-      await new chunkVXE42MYF_cjs.TenantService(db).removeMember(slug, userId);
+      await new chunk7RUW244J_cjs.TenantService(db).removeMember(slug, userId);
       return c.redirect(`/admin/tenants/${slug}/members?message=Member removed`);
     } catch (error) {
       const message = error instanceof Error ? error.message : "Failed to remove member";
@@ -13735,12 +14382,12 @@ function createTenantAdminRoutes() {
       const form = await c.req.formData();
       const email = String(form.get("email") ?? "");
       const role = String(form.get("role") ?? "viewer");
-      const token = await new chunkVXE42MYF_cjs.TenantService(db).createInvitation(slug, email, role, user?.userId ?? null);
+      const token = await new chunk7RUW244J_cjs.TenantService(db).createInvitation(slug, email, role, user?.userId ?? null);
       const origin = c.req.header("origin") || new URL(c.req.url).origin;
       const acceptUrl = `${origin}/join/invite?token=${encodeURIComponent(token)}`;
       let note;
       let noteType = "";
-      const svc2 = chunkVXE42MYF_cjs.hasEmailService() ? chunkVXE42MYF_cjs.getEmailService() : null;
+      const svc2 = chunk7RUW244J_cjs.hasEmailService() ? chunk7RUW244J_cjs.getEmailService() : null;
       const hasRealProvider = !!svc2 && svc2.getProviderName() !== "console";
       if (hasRealProvider) {
         const result = await svc2.send({
@@ -13781,7 +14428,7 @@ function createTenantAdminRoutes() {
          WHERE i.id = ? AND t.slug = ? AND i.status = 'pending'`
       ).bind(id, slug).first();
       if (!inv) throw new Error("Invitation not found or already used");
-      const svc2 = chunkVXE42MYF_cjs.hasEmailService() ? chunkVXE42MYF_cjs.getEmailService() : null;
+      const svc2 = chunk7RUW244J_cjs.hasEmailService() ? chunk7RUW244J_cjs.getEmailService() : null;
       const hasRealProvider = !!svc2 && svc2.getProviderName() !== "console";
       if (!hasRealProvider) throw new Error("No email plugin active");
       const origin = c.req.header("origin") || new URL(c.req.url).origin;
@@ -13806,7 +14453,7 @@ function createTenantAdminRoutes() {
     const id = c.req.param("id");
     if (!await isMultiTenantActive(db)) return c.json({ error: "Multi-tenant plugin is not active" }, 403);
     try {
-      await new chunkVXE42MYF_cjs.TenantService(db).revokeInvitation(slug, id);
+      await new chunk7RUW244J_cjs.TenantService(db).revokeInvitation(slug, id);
       return c.redirect(`/admin/tenants/${slug}/members?message=Invitation revoked`);
     } catch (error) {
       const message = error instanceof Error ? error.message : "Failed to revoke invitation";
@@ -14036,7 +14683,7 @@ function createJoinRoutes() {
     if (existing) return rerender("An account with this email already exists. Please sign in instead.");
     try {
       const userId = crypto.randomUUID();
-      const passwordHash = await chunkAAWNRBRB_cjs.AuthManager.hashPassword(password);
+      const passwordHash = await chunkFCLKX2OS_cjs.AuthManager.hashPassword(password);
       const now = Date.now();
       const nowSec = Math.floor(now / 1e3);
       await db.batch([
@@ -14049,8 +14696,8 @@ function createJoinRoutes() {
            VALUES (?, ?, ?, 'credential', ?, ?, ?)`
         ).bind(`cred-${userId}`, userId, userId, passwordHash, nowSec, nowSec)
       ]);
-      await new chunkVXE42MYF_cjs.TenantService(db).acceptInvitation(token, userId, inv.email);
-      const auth = chunkNUKJ54GA_cjs.createAuth(c.env);
+      await new chunk7RUW244J_cjs.TenantService(db).acceptInvitation(token, userId, inv.email);
+      const auth = chunkGMMCCIQO_cjs.createAuth(c.env);
       const origin = new URL(c.req.url).origin;
       const baReq = new Request(`${origin}/auth/sign-in/email`, {
         method: "POST",
@@ -14105,7 +14752,7 @@ function createJoinRoutes() {
       version
     }), 400);
     try {
-      const auth = chunkNUKJ54GA_cjs.createAuth(c.env);
+      const auth = chunkGMMCCIQO_cjs.createAuth(c.env);
       const origin = new URL(c.req.url).origin;
       const baReq = new Request(`${origin}/auth/sign-in/email`, {
         method: "POST",
@@ -14117,7 +14764,7 @@ function createJoinRoutes() {
       const baBody = await baRes.json();
       const userId = baBody?.user?.id;
       if (!userId) return rerender("Sign-in succeeded but could not read user ID.");
-      await new chunkVXE42MYF_cjs.TenantService(db).acceptInvitation(token, userId, inv.email);
+      await new chunk7RUW244J_cjs.TenantService(db).acceptInvitation(token, userId, inv.email);
       const headers = new Headers({ Location: "/admin?message=Welcome! You have joined " + encodeURIComponent(inv.tenantName) });
       copyBaCookies(baRes, headers);
       return new Response(null, { status: 302, headers });
@@ -14131,7 +14778,7 @@ function createJoinRoutes() {
 
 // src/plugins/core-plugins/multi-tenant-plugin/index.ts
 var TENANT_ICON = `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3.75 21h16.5M4.5 3h15M5.25 3v18m13.5-18v18M9 6.75h1.5m-1.5 3h1.5m-1.5 3h1.5m3-6H15m-1.5 3H15m-1.5 3H15M9 21v-3.375c0-.621.504-1.125 1.125-1.125h3.75c.621 0 1.125.504 1.125 1.125V21"/></svg>`;
-var multiTenantPlugin = chunkXW56B23A_cjs.definePlugin({
+var multiTenantPlugin = chunkA4KUJ3LD_cjs.definePlugin({
   id: manifest_default2.id,
   version: "1.0.0",
   name: manifest_default2.name,
@@ -14146,30 +14793,30 @@ var multiTenantPlugin = chunkXW56B23A_cjs.definePlugin({
     { label: "Tenants", path: "/admin/tenants", icon: TENANT_ICON, order: 80 }
   ],
   activate: async () => {
-    chunkQAYFOER6_cjs.invalidateTenantCache();
+    chunkKVBHB7QP_cjs.invalidateTenantCache();
     console.info("\u2705 Multi-Tenant plugin activated");
   },
   deactivate: async () => {
-    chunkQAYFOER6_cjs.invalidateTenantCache();
+    chunkKVBHB7QP_cjs.invalidateTenantCache();
     console.info("\u274C Multi-Tenant plugin deactivated");
   }
 });
 var routes = new hono.Hono();
-routes.use("*", chunkAAWNRBRB_cjs.requireAuth());
-routes.use("*", chunkAAWNRBRB_cjs.requireRole(["admin", "editor"]));
+routes.use("*", chunkFCLKX2OS_cjs.requireAuth());
+routes.use("*", chunkFCLKX2OS_cjs.requireRole(["admin", "editor"]));
 routes.get("/:rootId", async (c) => {
   const { rootId } = c.req.param();
   const db = c.env.DB;
-  const scope = await chunkVXE42MYF_cjs.resolveDocScope(c, db, { rootId });
+  const scope = await chunk7RUW244J_cjs.resolveDocScope(c, db, { rootId });
   if (!scope) {
     return c.html('<p class="text-zinc-500 dark:text-zinc-400 p-4">Document not found.</p>', 404);
   }
   if (!scope.docType?.settings?.versioning) {
     return c.html('<p class="text-zinc-500 dark:text-zinc-400 p-4">Versioning not enabled for this type.</p>', 404);
   }
-  const denied = await chunkVXE42MYF_cjs.denyIfNotAllowed(c, db, rootId, "read", scope.docType?.settings, scope.tenantId);
+  const denied = await chunk7RUW244J_cjs.denyIfNotAllowed(c, db, rootId, "read", scope.docType?.settings, scope.tenantId);
   if (denied) return denied;
-  const repo = new chunkVXE42MYF_cjs.DocumentRepository(db, scope.tenantId);
+  const repo = new chunk7RUW244J_cjs.DocumentRepository(db, scope.tenantId);
   const versions = await repo.getVersionHistory(rootId);
   const safeRootIdAttr = chunkMNWKYY5E_cjs.escapeHtml(rootId);
   const rows = versions.map((v) => {
@@ -14262,14 +14909,14 @@ routes.post("/:rootId/restore/:versionNumber", async (c) => {
   const { rootId, versionNumber } = c.req.param();
   const db = c.env.DB;
   const user = c.get("user");
-  const scope = await chunkVXE42MYF_cjs.resolveDocScope(c, db, { rootId });
+  const scope = await chunk7RUW244J_cjs.resolveDocScope(c, db, { rootId });
   if (!scope) {
     return c.json({ error: "Document not found" }, 404);
   }
   if (!scope.docType?.settings?.versioning) {
     return c.json({ error: "Versioning not enabled for this type" }, 404);
   }
-  const denied = await chunkVXE42MYF_cjs.denyIfNotAllowed(c, db, rootId, "update", scope.docType?.settings, scope.tenantId);
+  const denied = await chunk7RUW244J_cjs.denyIfNotAllowed(c, db, rootId, "update", scope.docType?.settings, scope.tenantId);
   if (denied) return denied;
   const row = await db.prepare("SELECT * FROM documents WHERE root_id = ? AND tenant_id = ? AND version_number = ? LIMIT 1").bind(rootId, scope.tenantId, Number(versionNumber)).first();
   if (!row) {
@@ -14279,7 +14926,7 @@ routes.post("/:rootId/restore/:versionNumber", async (c) => {
   const title = row.title ?? null;
   const slug = row.slug ?? null;
   const docType = scope.docType;
-  const svc = new chunk2CB4KY7I_cjs.DocumentsService(db, {
+  const svc = new chunkLTZ5WYOK_cjs.DocumentsService(db, {
     queryableFields: docType?.queryableFields ?? [],
     typeSchemaVersion: docType?.schemaVersion ?? 1,
     maxVersionsPerRoot: docType?.settings?.maxVersionsPerRoot ?? 50,
@@ -14292,7 +14939,7 @@ routes.post("/:rootId/restore/:versionNumber", async (c) => {
 var routes_default = routes;
 
 // src/plugins/core-plugins/versioning-plugin/index.ts
-var versioningPlugin = chunkXW56B23A_cjs.definePlugin({
+var versioningPlugin = chunkA4KUJ3LD_cjs.definePlugin({
   id: "versioning",
   version: "1.0.0",
   name: "Versioning",
@@ -14369,8 +15016,8 @@ function createMagicLinkAuthPlugin() {
       const baseUrl = new URL(c.req.url).origin;
       const magicLink = `${baseUrl}/auth/magic-link/verify?token=${token}`;
       try {
-        if (chunkVXE42MYF_cjs.hasEmailService()) {
-          await chunkVXE42MYF_cjs.getEmailService().send({
+        if (chunk7RUW244J_cjs.hasEmailService()) {
+          await chunk7RUW244J_cjs.getEmailService().send({
             to: normalizedEmail,
             subject: "Your Magic Link to Sign In",
             flow: "magic-link",
@@ -14447,19 +15094,19 @@ function createMagicLinkAuthPlugin() {
         SET used = 1, used_at = ?
         WHERE id = ?
       `).bind(Date.now(), magicLink.id).run();
-      const tokenTtl = await chunkAAWNRBRB_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
-      const jwtToken = await chunkAAWNRBRB_cjs.AuthManager.generateToken(
+      const tokenTtl = await chunkFCLKX2OS_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
+      const jwtToken = await chunkFCLKX2OS_cjs.AuthManager.generateToken(
         user.id,
         user.email,
         user.role,
         c.env.JWT_SECRET,
         tokenTtl
       );
-      chunkAAWNRBRB_cjs.AuthManager.setAuthCookie(c, jwtToken, { maxAge: tokenTtl });
+      chunkFCLKX2OS_cjs.AuthManager.setAuthCookie(c, jwtToken, { maxAge: tokenTtl });
       await db.prepare(`
         UPDATE auth_user SET last_login_at = ? WHERE id = ?
       `).bind(Date.now(), user.id).run();
-      chunkVXE42MYF_cjs.dispatchHookEvent(
+      chunk7RUW244J_cjs.dispatchHookEvent(
         c,
         "auth:magic-link:consumed",
         { user: { id: user.id, email: user.email, role: user.role } },
@@ -14944,7 +15591,7 @@ async function warmCollections(db) {
   const collectionCache = chunkYA3TJ65D_cjs.getCacheService(config);
   let count = 0;
   try {
-    const results = chunkQAYFOER6_cjs.getCollectionRegistry().listActive().map(chunkQAYFOER6_cjs.collectionRecordToRow);
+    const results = chunkKVBHB7QP_cjs.getCollectionRegistry().listActive().map(chunkKVBHB7QP_cjs.collectionRecordToRow);
     for (const collection of results) {
       const key = collectionCache.generateKey("item", collection.id);
       await collectionCache.set(key, collection);
@@ -15011,7 +15658,7 @@ async function warmNamespace(namespace, entries) {
 }
 
 // src/templates/pages/admin-cache.template.ts
-chunkNAVPFIG5_cjs.init_admin_layout_catalyst_template();
+chunkK623Q6WD_cjs.init_admin_layout_catalyst_template();
 function renderCacheDashboard(data) {
   const pageContent = `
     <div class="space-y-6">
@@ -15215,7 +15862,7 @@ function renderCacheDashboard(data) {
     </script>
 
     <!-- Confirmation Dialogs -->
-    ${chunkVXE42MYF_cjs.renderConfirmationDialog({
+    ${chunk7RUW244J_cjs.renderConfirmationDialog({
     id: "clear-all-cache-confirm",
     title: "Clear All Cache",
     message: "Are you sure you want to clear all cache entries? This cannot be undone.",
@@ -15226,7 +15873,7 @@ function renderCacheDashboard(data) {
     onConfirm: "performClearAllCaches()"
   })}
 
-    ${chunkVXE42MYF_cjs.renderConfirmationDialog({
+    ${chunk7RUW244J_cjs.renderConfirmationDialog({
     id: "clear-namespace-cache-confirm",
     title: "Clear Namespace Cache",
     message: "Clear cache for this namespace?",
@@ -15237,7 +15884,7 @@ function renderCacheDashboard(data) {
     onConfirm: "performClearNamespaceCache()"
   })}
 
-    ${chunkVXE42MYF_cjs.getConfirmationDialogScript()}
+    ${chunk7RUW244J_cjs.getConfirmationDialogScript()}
   `;
   const layoutData = {
     title: "Cache System",
@@ -15247,7 +15894,7 @@ function renderCacheDashboard(data) {
     version: data.version,
     content: pageContent
   };
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 function renderCollectionSettingsTab(collections) {
   if (collections.length === 0) {
@@ -15503,7 +16150,7 @@ app.get("/", async (c) => {
   const totalRequests = totalHits + totalMisses;
   const overallHitRate = totalRequests > 0 ? totalHits / totalRequests * 100 : 0;
   const DEFAULT_TTL = chunkYA3TJ65D_cjs.CACHE_CONFIGS.api?.ttl ?? 300;
-  const collections = chunkQAYFOER6_cjs.getCollectionRegistry().listActive().filter((r) => !r.internal).map((r) => {
+  const collections = chunkKVBHB7QP_cjs.getCollectionRegistry().listActive().filter((r) => !r.internal).map((r) => {
     const cacheOverride = r.cache;
     const cacheEnabled = cacheOverride?.enabled !== false;
     const hasCustomTtl = typeof cacheOverride?.ttl === "number";
@@ -16040,16 +16687,17 @@ var faviconSvg = `<?xml version="1.0" encoding="UTF-8" standalone="no"?>
 // src/app.ts
 function createSonicJSApp(config = {}) {
   const app2 = new hono.Hono();
-  const appVersion = config.version || chunkLRZIAW7U_cjs.getCoreVersion();
+  const appVersion = config.version || chunkAOUVUF32_cjs.getCoreVersion();
   const appName = config.name || "SonicJS AI";
-  const hookSystem = new chunkH2AXVCLS_cjs.HookSystemImpl();
+  const hookSystem = new chunk5UXU3LP4_cjs.HookSystemImpl();
   chunkJ6JTWD2A_cjs.setHookSystem(hookSystem);
   const magicLinkPlugin = createMagicLinkAuthPlugin();
   const corePluginsBeforeCatchAll = [
     securityAuditPlugin,
+    apiKeysPlugin,
     aiSearchPlugin,
     oauthProvidersPlugin,
-    chunkVXE42MYF_cjs.userProfilesPlugin,
+    chunk7RUW244J_cjs.userProfilesPlugin,
     otpLoginPlugin,
     analyticsPlugin,
     stripePlugin,
@@ -16059,23 +16707,23 @@ function createSonicJSApp(config = {}) {
     shortcodesPlugin,
     helloWorldPlugin,
     multiTenantPlugin,
-    chunkVXE42MYF_cjs.lexicalEditorPlugin,
+    chunk7RUW244J_cjs.lexicalEditorPlugin,
     versioningPlugin
   ];
   const corePluginsAfterCatchAll = [emailPluginV3, magicLinkPlugin, emailReconciliationPlugin];
-  const wirePlugins = chunkH2AXVCLS_cjs.createPluginWirer(
+  const wirePlugins = chunk5UXU3LP4_cjs.createPluginWirer(
     () => [...corePluginsBeforeCatchAll, ...corePluginsAfterCatchAll, ...config.plugins?.register ?? []],
     // The capability-gated `ctx.cap.email` resolves to the app EmailService, which
     // is initialized (below) just before wiring on the first request.
     () => ({
       hooks: hookSystem,
       env: firstRequestEnv,
-      providers: { email: () => chunkVXE42MYF_cjs.getEmailService() }
+      providers: { email: () => chunk7RUW244J_cjs.getEmailService() }
     })
   );
   let firstRequestEnv;
   const initEmailService = async (env = {}) => {
-    if (chunkVXE42MYF_cjs.hasEmailService()) return;
+    if (chunk7RUW244J_cjs.hasEmailService()) return;
     let provider;
     let defaultFrom = config.email?.from;
     let defaultReplyTo;
@@ -16110,14 +16758,14 @@ function createSonicJSApp(config = {}) {
       }
     }
     defaultFrom = defaultFrom || env.DEFAULT_FROM_EMAIL || "noreply@sonicjs.local";
-    chunkVXE42MYF_cjs.setEmailService(new EmailService({ provider, defaultFrom, defaultReplyTo, db: env.DB }));
+    chunk7RUW244J_cjs.setEmailService(new EmailService({ provider, defaultFrom, defaultReplyTo, db: env.DB }));
   };
   app2.use("*", async (c, next) => {
     c.set("appVersion", appVersion);
     await next();
   });
-  app2.use("*", chunkAAWNRBRB_cjs.metricsMiddleware());
-  app2.use("*", chunkAAWNRBRB_cjs.bootstrapMiddleware(config));
+  app2.use("*", chunkFCLKX2OS_cjs.metricsMiddleware());
+  app2.use("*", chunkFCLKX2OS_cjs.bootstrapMiddleware(config));
   const boot = async (env) => {
     if (config.plugins?.disableAll) return;
     firstRequestEnv = env;
@@ -16144,13 +16792,24 @@ function createSonicJSApp(config = {}) {
   app2.use("*", async (_c, next) => {
     await next();
   });
-  app2.use("*", chunkAAWNRBRB_cjs.securityHeadersMiddleware());
-  app2.use("*", chunkAAWNRBRB_cjs.csrfProtection());
+  app2.use("*", cors.cors({
+    origin: (origin, c) => {
+      const allowed = c.env?.CORS_ORIGINS;
+      if (!allowed) return null;
+      const list = allowed.split(",").map((s) => s.trim());
+      return list.includes(origin) ? origin : null;
+    },
+    allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
+    allowHeaders: ["Content-Type", "Authorization", "X-API-Key"],
+    credentials: true
+  }));
+  app2.use("*", chunkFCLKX2OS_cjs.securityHeadersMiddleware());
+  app2.use("*", chunkFCLKX2OS_cjs.csrfProtection());
   app2.use("*", async (c, next) => {
     try {
       const reqUrl = new URL(c.req.url);
       const requestBaseURL = `${reqUrl.protocol}//${reqUrl.host}`;
-      const auth = chunkNUKJ54GA_cjs.createAuth(c.env, config.auth?.extendBetterAuth, requestBaseURL);
+      const auth = chunkGMMCCIQO_cjs.createAuth(c.env, config.auth?.extendBetterAuth, requestBaseURL);
       const session = await auth.api.getSession({ headers: c.req.raw.headers });
       if (session?.user) {
         const u = session.user;
@@ -16177,14 +16836,15 @@ function createSonicJSApp(config = {}) {
     }
     await next();
   });
+  app2.use("*", apiKeyAuthMiddleware());
   if (config.middleware?.afterAuth) {
     for (const middleware of config.middleware.afterAuth) {
       app2.use("*", middleware);
     }
   }
-  app2.use("*", chunkQAYFOER6_cjs.tenantMiddleware());
-  app2.use("/admin/*", chunkAAWNRBRB_cjs.requireAuth());
-  app2.use("/admin/*", chunkAAWNRBRB_cjs.requireRbac("portal", "access"));
+  app2.use("*", chunkKVBHB7QP_cjs.tenantMiddleware());
+  app2.use("/admin/*", chunkFCLKX2OS_cjs.requireAuth());
+  app2.use("/admin/*", chunkFCLKX2OS_cjs.requireRbac("portal", "access"));
   app2.use("/admin/*", pluginMenuMiddleware());
   const NAV_LANDING = [
     { path: "/admin/content", perm: "content:read" },
@@ -16201,7 +16861,7 @@ function createSonicJSApp(config = {}) {
     if (!user?.userId) return next();
     let perms = [];
     try {
-      const { RbacService: RbacService2 } = await import('./rbac-VONLJJKB.cjs');
+      const { RbacService: RbacService2 } = await import('./rbac-7QZ4JZ2E.cjs');
       perms = await new RbacService2(c.env.DB, c.env.CACHE_KV).permissionsForUser(user.userId);
     } catch {
       return next();
@@ -16230,43 +16890,43 @@ function createSonicJSApp(config = {}) {
   });
   app2.route("/api/security-audit", apiRoutes2);
   app2.route("/admin/plugins/security-audit", adminRoutes3);
-  app2.route("/api/media", chunkVXE42MYF_cjs.api_media_default);
-  app2.route("/api/system", chunkVXE42MYF_cjs.api_system_default);
-  app2.route("/api/documents", chunkVXE42MYF_cjs.apiDocumentsRoutes);
-  app2.route("/api", chunkVXE42MYF_cjs.api_default);
-  app2.route("/admin/documents", chunkVXE42MYF_cjs.adminDocumentsRoutes);
-  chunkH2AXVCLS_cjs.registerPluginRoutes(app2, [formsPlugin], { source: "core" });
-  app2.route("/admin/api", chunkVXE42MYF_cjs.admin_api_default);
-  app2.route("/admin/collections", chunkVXE42MYF_cjs.adminCollectionsRoutes);
-  app2.route("/admin/settings", chunkVXE42MYF_cjs.adminSettingsRoutes);
-  app2.route("/admin/api-reference", chunkVXE42MYF_cjs.router2);
+  app2.route("/api/media", chunk7RUW244J_cjs.api_media_default);
+  app2.route("/api/system", chunk7RUW244J_cjs.api_system_default);
+  app2.route("/api/documents", chunk7RUW244J_cjs.apiDocumentsRoutes);
+  app2.route("/api", chunk7RUW244J_cjs.api_default);
+  app2.route("/admin/documents", chunk7RUW244J_cjs.adminDocumentsRoutes);
+  chunk5UXU3LP4_cjs.registerPluginRoutes(app2, [formsPlugin], { source: "core" });
+  app2.route("/admin/api", chunk7RUW244J_cjs.admin_api_default);
+  app2.route("/admin/collections", chunk7RUW244J_cjs.adminCollectionsRoutes);
+  app2.route("/admin/settings", chunk7RUW244J_cjs.adminSettingsRoutes);
+  app2.route("/admin/api-reference", chunk7RUW244J_cjs.router2);
   app2.route("/admin/database-tools", createDatabaseToolsAdminRoutes());
-  app2.route("/admin/content", chunkVXE42MYF_cjs.admin_content_default);
-  app2.route("/admin/media", chunkVXE42MYF_cjs.adminMediaRoutes);
+  app2.route("/admin/content", chunk7RUW244J_cjs.admin_content_default);
+  app2.route("/admin/media", chunk7RUW244J_cjs.adminMediaRoutes);
   app2.use("/auth/*", securityAuditMiddleware());
   if (!config.plugins?.disableAll) {
-    chunkH2AXVCLS_cjs.registerPluginRoutes(app2, corePluginsBeforeCatchAll, { source: "core" });
+    chunk5UXU3LP4_cjs.registerPluginRoutes(app2, corePluginsBeforeCatchAll, { source: "core" });
     app2.route("/admin/cache", cache_default.getRoutes());
     if (config.plugins?.register && config.plugins.register.length > 0) {
-      chunkH2AXVCLS_cjs.registerPluginRoutes(app2, config.plugins.register, { source: "user" });
+      chunk5UXU3LP4_cjs.registerPluginRoutes(app2, config.plugins.register, { source: "user" });
     }
   }
   app2.route("/api/events", apiRoutes4);
-  app2.route("/admin/dashboard", chunkVXE42MYF_cjs.router);
-  app2.route("/admin/plugins", chunkVXE42MYF_cjs.adminPluginRoutes);
-  app2.route("/admin/logs", chunkVXE42MYF_cjs.adminLogsRoutes);
+  app2.route("/admin/dashboard", chunk7RUW244J_cjs.router);
+  app2.route("/admin/plugins", chunk7RUW244J_cjs.adminPluginRoutes);
+  app2.route("/admin/logs", chunk7RUW244J_cjs.adminLogsRoutes);
   app2.route("/admin/rbac", adminRbacRoutes);
-  app2.route("/admin", chunkVXE42MYF_cjs.userRoutes);
-  app2.route("/auth", chunkVXE42MYF_cjs.auth_default);
+  app2.route("/admin", chunk7RUW244J_cjs.userRoutes);
+  app2.route("/auth", chunk7RUW244J_cjs.auth_default);
   app2.on(["GET", "POST"], "/auth/*", (c) => {
     const reqUrl = new URL(c.req.url);
     const requestBaseURL = `${reqUrl.protocol}//${reqUrl.host}`;
-    const auth = chunkNUKJ54GA_cjs.createAuth(c.env, config.auth?.extendBetterAuth, requestBaseURL);
+    const auth = chunkGMMCCIQO_cjs.createAuth(c.env, config.auth?.extendBetterAuth, requestBaseURL);
     return auth.handler(c.req.raw);
   });
-  app2.route("/", chunkVXE42MYF_cjs.test_cleanup_default);
+  app2.route("/", chunk7RUW244J_cjs.test_cleanup_default);
   if (!config.plugins?.disableAll) {
-    chunkH2AXVCLS_cjs.registerPluginRoutes(app2, corePluginsAfterCatchAll, { source: "core" });
+    chunk5UXU3LP4_cjs.registerPluginRoutes(app2, corePluginsAfterCatchAll, { source: "core" });
   }
   if (!config.plugins?.disableAll) {
     const allMountedPlugins = [
@@ -16275,8 +16935,11 @@ function createSonicJSApp(config = {}) {
       ...corePluginsAfterCatchAll,
       ...config.plugins?.register ?? []
     ];
-    chunkH2AXVCLS_cjs.setPluginMenu(allMountedPlugins.flatMap((p) => p.menu ?? []));
-    chunkXW56B23A_cjs.setPluginDefinitions(allMountedPlugins);
+    const userPlugins = (config.plugins?.register ?? []).filter(
+      (p) => !chunkKVBHB7QP_cjs.PLUGIN_REGISTRY[p.id]
+    );
+    chunk5UXU3LP4_cjs.setPluginMenu(userPlugins.flatMap((p) => p.menu ?? []));
+    chunkA4KUJ3LD_cjs.setPluginDefinitions(allMountedPlugins);
   }
   app2.get("/favicon.svg", (c) => {
     return new Response(faviconSvg, {
@@ -16329,7 +16992,7 @@ function createSonicJSApp(config = {}) {
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     });
   });
-  chunkBDDABDAB_cjs.setAppInstance(app2);
+  chunk36Z3AKX3_cjs.setAppInstance(app2);
   app2.notFound((c) => {
     return c.json({ error: "Not Found", status: 404 }, 404);
   });
@@ -17140,9 +17803,11 @@ var RedirectService = class {
       this.cloudflareService = new CloudflareBulkService(env);
     }
   }
+  db;
+  env;
   cloudflareService = null;
   getDocService() {
-    return new chunk2CB4KY7I_cjs.DocumentsService(this.db, {
+    return new chunkLTZ5WYOK_cjs.DocumentsService(this.db, {
       queryableFields: REDIRECT_QUERYABLE_FIELDS,
       maxVersionsPerRoot: 1,
       tenantId: TENANT3
@@ -17258,7 +17923,7 @@ var RedirectService = class {
   async batchCreate(rows, userId) {
     const now = Math.floor(Date.now() / 1e3);
     const statements = rows.map((r) => {
-      const id = chunkJEQ7FLOD_cjs.nanoid();
+      const id = chunkKIGVVO6N_cjs.nanoid();
       const data = JSON.stringify({
         source: r.source,
         destination: r.destination,
@@ -18445,7 +19110,7 @@ function renderLayout(title, content2) {
       }
     </style>
   `;
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst({
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst({
     title,
     currentPath: "/admin/redirects",
     content: customStyles + content2.toString()
@@ -18810,7 +19475,7 @@ function getFormScripts() {
   `;
 }
 function renderLayout2(title, content2) {
-  return chunkNAVPFIG5_cjs.renderAdminLayoutCatalyst({
+  return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst({
     title,
     currentPath: "/admin/redirects",
     content: content2.toString()
@@ -19768,7 +20433,7 @@ function createRedirectApiRoutes() {
   });
   return api;
 }
-var redirectPlugin = chunkXW56B23A_cjs.definePlugin({
+var redirectPlugin = chunkA4KUJ3LD_cjs.definePlugin({
   id: manifest_default3.id,
   version: manifest_default3.version,
   name: manifest_default3.name,
@@ -19786,7 +20451,7 @@ var redirectPlugin = chunkXW56B23A_cjs.definePlugin({
   async onBoot(ctx) {
     const db = ctx.env?.DB;
     if (!db) return;
-    const registry = new chunkAAWNRBRB_cjs.DocumentTypeRegistry(db);
+    const registry = new chunkFCLKX2OS_cjs.DocumentTypeRegistry(db);
     await registry.register({
       id: "redirect",
       name: "redirect",
@@ -19902,99 +20567,103 @@ function createDb(d1$1) {
 }
 
 // src/index.ts
-var VERSION = chunkLRZIAW7U_cjs.package_default.version;
+var VERSION = chunkAOUVUF32_cjs.package_default.version;
 
+Object.defineProperty(exports, "DocumentRepository", {
+  enumerable: true,
+  get: function () { return chunk7RUW244J_cjs.DocumentRepository; }
+});
 Object.defineProperty(exports, "ROUTES_INFO", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.ROUTES_INFO; }
+  get: function () { return chunk7RUW244J_cjs.ROUTES_INFO; }
 });
 Object.defineProperty(exports, "adminApiRoutes", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.admin_api_default; }
+  get: function () { return chunk7RUW244J_cjs.admin_api_default; }
 });
 Object.defineProperty(exports, "adminCheckboxRoutes", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.adminCheckboxRoutes; }
+  get: function () { return chunk7RUW244J_cjs.adminCheckboxRoutes; }
 });
 Object.defineProperty(exports, "adminCollectionsRoutes", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.adminCollectionsRoutes; }
+  get: function () { return chunk7RUW244J_cjs.adminCollectionsRoutes; }
 });
 Object.defineProperty(exports, "adminContentRoutes", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.admin_content_default; }
+  get: function () { return chunk7RUW244J_cjs.admin_content_default; }
 });
 Object.defineProperty(exports, "adminDashboardRoutes", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.router; }
+  get: function () { return chunk7RUW244J_cjs.router; }
 });
 Object.defineProperty(exports, "adminLogsRoutes", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.adminLogsRoutes; }
+  get: function () { return chunk7RUW244J_cjs.adminLogsRoutes; }
 });
 Object.defineProperty(exports, "adminMediaRoutes", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.adminMediaRoutes; }
+  get: function () { return chunk7RUW244J_cjs.adminMediaRoutes; }
 });
 Object.defineProperty(exports, "adminPluginRoutes", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.adminPluginRoutes; }
+  get: function () { return chunk7RUW244J_cjs.adminPluginRoutes; }
 });
 Object.defineProperty(exports, "adminSettingsRoutes", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.adminSettingsRoutes; }
+  get: function () { return chunk7RUW244J_cjs.adminSettingsRoutes; }
 });
 Object.defineProperty(exports, "adminUsersRoutes", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.userRoutes; }
+  get: function () { return chunk7RUW244J_cjs.userRoutes; }
 });
 Object.defineProperty(exports, "apiContentCrudRoutes", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.api_content_crud_default; }
+  get: function () { return chunk7RUW244J_cjs.api_content_crud_default; }
 });
 Object.defineProperty(exports, "apiMediaRoutes", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.api_media_default; }
+  get: function () { return chunk7RUW244J_cjs.api_media_default; }
 });
 Object.defineProperty(exports, "apiRoutes", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.api_default; }
+  get: function () { return chunk7RUW244J_cjs.api_default; }
 });
 Object.defineProperty(exports, "apiSystemRoutes", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.api_system_default; }
+  get: function () { return chunk7RUW244J_cjs.api_system_default; }
 });
 Object.defineProperty(exports, "authRoutes", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.auth_default; }
+  get: function () { return chunk7RUW244J_cjs.auth_default; }
 });
 Object.defineProperty(exports, "createUserProfilesPlugin", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.createUserProfilesPlugin; }
+  get: function () { return chunk7RUW244J_cjs.createUserProfilesPlugin; }
 });
 Object.defineProperty(exports, "defineUserProfile", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.defineUserProfile; }
+  get: function () { return chunk7RUW244J_cjs.defineUserProfile; }
 });
 Object.defineProperty(exports, "getUserProfileConfig", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.getUserProfileConfig; }
+  get: function () { return chunk7RUW244J_cjs.getUserProfileConfig; }
 });
 Object.defineProperty(exports, "userProfilesPlugin", {
   enumerable: true,
-  get: function () { return chunkVXE42MYF_cjs.userProfilesPlugin; }
+  get: function () { return chunk7RUW244J_cjs.userProfilesPlugin; }
 });
 Object.defineProperty(exports, "Logger", {
   enumerable: true,
-  get: function () { return chunkBDDABDAB_cjs.Logger; }
+  get: function () { return chunk36Z3AKX3_cjs.Logger; }
 });
 Object.defineProperty(exports, "getLogger", {
   enumerable: true,
-  get: function () { return chunkBDDABDAB_cjs.getLogger; }
+  get: function () { return chunk36Z3AKX3_cjs.getLogger; }
 });
 Object.defineProperty(exports, "initLogger", {
   enumerable: true,
-  get: function () { return chunkBDDABDAB_cjs.initLogger; }
+  get: function () { return chunk36Z3AKX3_cjs.initLogger; }
 });
 Object.defineProperty(exports, "apiTokens", {
   enumerable: true,
@@ -20138,251 +20807,259 @@ Object.defineProperty(exports, "workflowHistory", {
 });
 Object.defineProperty(exports, "AuthManager", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.AuthManager; }
+  get: function () { return chunkFCLKX2OS_cjs.AuthManager; }
 });
 Object.defineProperty(exports, "PermissionManager", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.PermissionManager; }
+  get: function () { return chunkFCLKX2OS_cjs.PermissionManager; }
 });
 Object.defineProperty(exports, "bootstrapDocumentTypes", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.bootstrapDocumentTypes; }
+  get: function () { return chunkFCLKX2OS_cjs.bootstrapDocumentTypes; }
 });
 Object.defineProperty(exports, "bootstrapMiddleware", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.bootstrapMiddleware; }
+  get: function () { return chunkFCLKX2OS_cjs.bootstrapMiddleware; }
 });
 Object.defineProperty(exports, "cacheHeaders", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.cacheHeaders; }
+  get: function () { return chunkFCLKX2OS_cjs.cacheHeaders; }
 });
 Object.defineProperty(exports, "compressionMiddleware", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.compressionMiddleware; }
+  get: function () { return chunkFCLKX2OS_cjs.compressionMiddleware; }
 });
 Object.defineProperty(exports, "detailedLoggingMiddleware", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.detailedLoggingMiddleware; }
+  get: function () { return chunkFCLKX2OS_cjs.detailedLoggingMiddleware; }
 });
 Object.defineProperty(exports, "getActivePlugins", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.getActivePlugins; }
+  get: function () { return chunkFCLKX2OS_cjs.getActivePlugins; }
 });
 Object.defineProperty(exports, "isPluginActive", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.isPluginActive; }
+  get: function () { return chunkFCLKX2OS_cjs.isPluginActive; }
 });
 Object.defineProperty(exports, "logActivity", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.logActivity; }
+  get: function () { return chunkFCLKX2OS_cjs.logActivity; }
 });
 Object.defineProperty(exports, "loggingMiddleware", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.loggingMiddleware; }
+  get: function () { return chunkFCLKX2OS_cjs.loggingMiddleware; }
 });
 Object.defineProperty(exports, "optionalAuth", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.optionalAuth; }
+  get: function () { return chunkFCLKX2OS_cjs.optionalAuth; }
 });
 Object.defineProperty(exports, "performanceLoggingMiddleware", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.performanceLoggingMiddleware; }
+  get: function () { return chunkFCLKX2OS_cjs.performanceLoggingMiddleware; }
 });
 Object.defineProperty(exports, "requireActivePlugin", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.requireActivePlugin; }
+  get: function () { return chunkFCLKX2OS_cjs.requireActivePlugin; }
 });
 Object.defineProperty(exports, "requireActivePlugins", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.requireActivePlugins; }
+  get: function () { return chunkFCLKX2OS_cjs.requireActivePlugins; }
 });
 Object.defineProperty(exports, "requireAnyPermission", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.requireAnyPermission; }
+  get: function () { return chunkFCLKX2OS_cjs.requireAnyPermission; }
 });
 Object.defineProperty(exports, "requireAuth", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.requireAuth; }
+  get: function () { return chunkFCLKX2OS_cjs.requireAuth; }
 });
 Object.defineProperty(exports, "requirePermission", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.requirePermission; }
+  get: function () { return chunkFCLKX2OS_cjs.requirePermission; }
 });
 Object.defineProperty(exports, "requireRole", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.requireRole; }
+  get: function () { return chunkFCLKX2OS_cjs.requireRole; }
 });
 Object.defineProperty(exports, "securityHeaders", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.securityHeadersMiddleware; }
+  get: function () { return chunkFCLKX2OS_cjs.securityHeadersMiddleware; }
 });
 Object.defineProperty(exports, "securityLoggingMiddleware", {
   enumerable: true,
-  get: function () { return chunkAAWNRBRB_cjs.securityLoggingMiddleware; }
+  get: function () { return chunkFCLKX2OS_cjs.securityLoggingMiddleware; }
+});
+Object.defineProperty(exports, "DocumentsService", {
+  enumerable: true,
+  get: function () { return chunkLTZ5WYOK_cjs.DocumentsService; }
 });
 Object.defineProperty(exports, "RbacService", {
   enumerable: true,
-  get: function () { return chunk2CB4KY7I_cjs.RbacService; }
+  get: function () { return chunkLTZ5WYOK_cjs.RbacService; }
 });
 Object.defineProperty(exports, "PluginBootstrapService", {
   enumerable: true,
-  get: function () { return chunkQAYFOER6_cjs.PluginBootstrapService; }
+  get: function () { return chunkKVBHB7QP_cjs.PluginBootstrapService; }
 });
 Object.defineProperty(exports, "PluginServiceClass", {
   enumerable: true,
-  get: function () { return chunkQAYFOER6_cjs.PluginService; }
+  get: function () { return chunkKVBHB7QP_cjs.PluginService; }
 });
 Object.defineProperty(exports, "getAvailableCollectionNames", {
   enumerable: true,
-  get: function () { return chunkQAYFOER6_cjs.getAvailableCollectionNames; }
+  get: function () { return chunkKVBHB7QP_cjs.getAvailableCollectionNames; }
 });
 Object.defineProperty(exports, "loadCollectionConfig", {
   enumerable: true,
-  get: function () { return chunkQAYFOER6_cjs.loadCollectionConfig; }
+  get: function () { return chunkKVBHB7QP_cjs.loadCollectionConfig; }
 });
 Object.defineProperty(exports, "loadCollectionConfigs", {
   enumerable: true,
-  get: function () { return chunkQAYFOER6_cjs.loadCollectionConfigs; }
+  get: function () { return chunkKVBHB7QP_cjs.loadCollectionConfigs; }
 });
 Object.defineProperty(exports, "registerCollections", {
   enumerable: true,
-  get: function () { return chunkQAYFOER6_cjs.registerCollections; }
+  get: function () { return chunkKVBHB7QP_cjs.registerCollections; }
 });
 Object.defineProperty(exports, "validateCollectionConfig", {
   enumerable: true,
-  get: function () { return chunkQAYFOER6_cjs.validateCollectionConfig; }
+  get: function () { return chunkKVBHB7QP_cjs.validateCollectionConfig; }
 });
 Object.defineProperty(exports, "MigrationService", {
   enumerable: true,
-  get: function () { return chunkDSA4UX5B_cjs.MigrationService; }
+  get: function () { return chunkOJC4G5JE_cjs.MigrationService; }
 });
 Object.defineProperty(exports, "renderFilterBar", {
   enumerable: true,
-  get: function () { return chunkWULONYGB_cjs.renderFilterBar; }
+  get: function () { return chunkCRGUD4KC_cjs.renderFilterBar; }
 });
 Object.defineProperty(exports, "getConfirmationDialogScript", {
   enumerable: true,
-  get: function () { return chunkMVIZJOO5_cjs.getConfirmationDialogScript; }
+  get: function () { return chunkPXNTCCPE_cjs.getConfirmationDialogScript; }
 });
 Object.defineProperty(exports, "renderAlert", {
   enumerable: true,
-  get: function () { return chunkMVIZJOO5_cjs.renderAlert; }
+  get: function () { return chunkPXNTCCPE_cjs.renderAlert; }
 });
 Object.defineProperty(exports, "renderConfirmationDialog", {
   enumerable: true,
-  get: function () { return chunkMVIZJOO5_cjs.renderConfirmationDialog; }
+  get: function () { return chunkPXNTCCPE_cjs.renderConfirmationDialog; }
 });
 Object.defineProperty(exports, "renderForm", {
   enumerable: true,
-  get: function () { return chunkMVIZJOO5_cjs.renderForm; }
+  get: function () { return chunkPXNTCCPE_cjs.renderForm; }
 });
 Object.defineProperty(exports, "renderFormField", {
   enumerable: true,
-  get: function () { return chunkMVIZJOO5_cjs.renderFormField; }
+  get: function () { return chunkPXNTCCPE_cjs.renderFormField; }
 });
 Object.defineProperty(exports, "renderPagination", {
   enumerable: true,
-  get: function () { return chunkMVIZJOO5_cjs.renderPagination; }
+  get: function () { return chunkPXNTCCPE_cjs.renderPagination; }
 });
 Object.defineProperty(exports, "renderTable", {
   enumerable: true,
-  get: function () { return chunkMVIZJOO5_cjs.renderTable; }
+  get: function () { return chunkPXNTCCPE_cjs.renderTable; }
+});
+Object.defineProperty(exports, "renderAdminLayoutCatalyst", {
+  enumerable: true,
+  get: function () { return chunkK623Q6WD_cjs.renderAdminLayoutCatalyst; }
 });
 Object.defineProperty(exports, "HookSystemImpl", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.HookSystemImpl; }
+  get: function () { return chunk5UXU3LP4_cjs.HookSystemImpl; }
 });
 Object.defineProperty(exports, "HookUtils", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.HookUtils; }
+  get: function () { return chunk5UXU3LP4_cjs.HookUtils; }
 });
 Object.defineProperty(exports, "PluginDependencyCycleError", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.PluginDependencyCycleError; }
+  get: function () { return chunk5UXU3LP4_cjs.PluginDependencyCycleError; }
 });
 Object.defineProperty(exports, "PluginManagerClass", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.PluginManager; }
+  get: function () { return chunk5UXU3LP4_cjs.PluginManager; }
 });
 Object.defineProperty(exports, "PluginRegistryImpl", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.PluginRegistryImpl; }
+  get: function () { return chunk5UXU3LP4_cjs.PluginRegistryImpl; }
 });
 Object.defineProperty(exports, "PluginValidatorClass", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.PluginValidator; }
+  get: function () { return chunk5UXU3LP4_cjs.PluginValidator; }
 });
 Object.defineProperty(exports, "RegisterPluginsError", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.RegisterPluginsError; }
+  get: function () { return chunk5UXU3LP4_cjs.RegisterPluginsError; }
 });
 Object.defineProperty(exports, "ScopedHookSystemClass", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.ScopedHookSystem; }
+  get: function () { return chunk5UXU3LP4_cjs.ScopedHookSystem; }
 });
 Object.defineProperty(exports, "collectCronSchedules", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.collectCronSchedules; }
+  get: function () { return chunk5UXU3LP4_cjs.collectCronSchedules; }
 });
 Object.defineProperty(exports, "collectCrons", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.collectCrons; }
+  get: function () { return chunk5UXU3LP4_cjs.collectCrons; }
 });
 Object.defineProperty(exports, "createScheduledHandler", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.createScheduledHandler; }
+  get: function () { return chunk5UXU3LP4_cjs.createScheduledHandler; }
 });
 Object.defineProperty(exports, "dispatchCronTick", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.dispatchCronTick; }
+  get: function () { return chunk5UXU3LP4_cjs.dispatchCronTick; }
 });
 Object.defineProperty(exports, "getPluginMenu", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.getPluginMenu; }
+  get: function () { return chunk5UXU3LP4_cjs.getPluginMenu; }
 });
 Object.defineProperty(exports, "registerPlugins", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.registerPlugins; }
+  get: function () { return chunk5UXU3LP4_cjs.registerPlugins; }
 });
 Object.defineProperty(exports, "resetPluginMenu", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.resetPluginMenu; }
+  get: function () { return chunk5UXU3LP4_cjs.resetPluginMenu; }
 });
 Object.defineProperty(exports, "resolvePluginMenuItems", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.resolvePluginMenuItems; }
+  get: function () { return chunk5UXU3LP4_cjs.resolvePluginMenuItems; }
 });
 Object.defineProperty(exports, "setPluginMenu", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.setPluginMenu; }
+  get: function () { return chunk5UXU3LP4_cjs.setPluginMenu; }
 });
 Object.defineProperty(exports, "topoSort", {
   enumerable: true,
-  get: function () { return chunkH2AXVCLS_cjs.topoSort; }
+  get: function () { return chunk5UXU3LP4_cjs.topoSort; }
 });
 Object.defineProperty(exports, "applySchemaDefaults", {
   enumerable: true,
-  get: function () { return chunkXW56B23A_cjs.applySchemaDefaults; }
+  get: function () { return chunkA4KUJ3LD_cjs.applySchemaDefaults; }
 });
 Object.defineProperty(exports, "definePlugin", {
   enumerable: true,
-  get: function () { return chunkXW56B23A_cjs.definePlugin; }
+  get: function () { return chunkA4KUJ3LD_cjs.definePlugin; }
 });
 Object.defineProperty(exports, "isDefinedPlugin", {
   enumerable: true,
-  get: function () { return chunkXW56B23A_cjs.isDefinedPlugin; }
+  get: function () { return chunkA4KUJ3LD_cjs.isDefinedPlugin; }
 });
 Object.defineProperty(exports, "parseConfigSchema", {
   enumerable: true,
-  get: function () { return chunkXW56B23A_cjs.parseConfigSchema; }
+  get: function () { return chunkA4KUJ3LD_cjs.parseConfigSchema; }
 });
 Object.defineProperty(exports, "parseFormDataToSettings", {
   enumerable: true,
-  get: function () { return chunkXW56B23A_cjs.parseFormDataToSettings; }
+  get: function () { return chunkA4KUJ3LD_cjs.parseFormDataToSettings; }
 });
 Object.defineProperty(exports, "renderSchemaFields", {
   enumerable: true,
-  get: function () { return chunkXW56B23A_cjs.renderSchemaFields; }
+  get: function () { return chunkA4KUJ3LD_cjs.renderSchemaFields; }
 });
 Object.defineProperty(exports, "getHookSystem", {
   enumerable: true,
@@ -20430,11 +21107,11 @@ Object.defineProperty(exports, "metricsTracker", {
 });
 Object.defineProperty(exports, "SONICJS_VERSION", {
   enumerable: true,
-  get: function () { return chunkLRZIAW7U_cjs.SONICJS_VERSION; }
+  get: function () { return chunkAOUVUF32_cjs.SONICJS_VERSION; }
 });
 Object.defineProperty(exports, "getCoreVersion", {
   enumerable: true,
-  get: function () { return chunkLRZIAW7U_cjs.getCoreVersion; }
+  get: function () { return chunkAOUVUF32_cjs.getCoreVersion; }
 });
 Object.defineProperty(exports, "escapeHtml", {
   enumerable: true,
@@ -20457,11 +21134,13 @@ exports.CloudflareEmailProvider = CloudflareEmailProvider2;
 exports.OAuthService = OAuthService;
 exports.VERSION = VERSION;
 exports.createDb = createDb;
+exports.createHelloWorldPlugin = createHelloWorldPlugin;
 exports.createOAuthProvidersPlugin = createOAuthProvidersPlugin;
 exports.createRedirectPlugin = createRedirectPlugin;
 exports.createSonicJSApp = createSonicJSApp;
 exports.emailReconciliationPlugin = emailReconciliationPlugin;
 exports.generateTriggersComment = generateTriggersComment;
+exports.helloWorldPlugin = helloWorldPlugin;
 exports.oauthProvidersPlugin = oauthProvidersPlugin;
 exports.parseCronTriggers = parseCronTriggers;
 exports.redirectPlugin = redirectPlugin;