@sonicjs-cms/core 3.0.0-beta.22 → 3.0.0-beta.24

package/dist/index.js

@@ -1,37 +1,37 @@
 import { createAuth } from './chunk-SOZUG52O.js';
-import { getEmailService, hasEmailService, setEmailService, invalidateVariablesCache, resolveVariablesInObject, resolveDocScope, denyIfNotAllowed, DocumentRepository, dispatchHookEvent, getCustomData, createDocumentSchema, renderTable, getVariablesCached, setVariablesCache, TenantService, isValidMemberRole, renderConfirmationDialog, getConfirmationDialogScript, VALID_MEMBER_ROLES, userProfilesPlugin, lexicalEditorPlugin, api_media_default, api_system_default, apiDocumentsRoutes, api_default, adminDocumentsRoutes, admin_api_default, adminCollectionsRoutes, adminSettingsRoutes, router2, admin_content_default, adminMediaRoutes, router, adminPluginRoutes, adminLogsRoutes, userRoutes, auth_default, test_cleanup_default } from './chunk-6KNTZ67K.js';
-export { DocumentRepository, ROUTES_INFO, admin_api_default as adminApiRoutes, adminCheckboxRoutes, adminCollectionsRoutes, admin_content_default as adminContentRoutes, router as adminDashboardRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, userRoutes as adminUsersRoutes, api_content_crud_default as apiContentCrudRoutes, api_media_default as apiMediaRoutes, api_default as apiRoutes, api_system_default as apiSystemRoutes, auth_default as authRoutes, createUserProfilesPlugin, defineUserProfile, getUserProfileConfig, userProfilesPlugin } from './chunk-6KNTZ67K.js';
+import { getEmailService, hasEmailService, setEmailService, reconcileMenuFromPlugins, invalidateVariablesCache, resolveVariablesInObject, resolveDocScope, denyIfNotAllowed, DocumentRepository, dispatchHookEvent, getCustomData, createDocumentSchema, renderTable, getVariablesCached, setVariablesCache, TenantService, isValidMemberRole, renderConfirmationDialog, getConfirmationDialogScript, VALID_MEMBER_ROLES, userProfilesPlugin, lexicalEditorPlugin, api_media_default, api_system_default, apiDocumentsRoutes, api_default, adminDocumentsRoutes, admin_api_default, adminCollectionsRoutes, adminSettingsRoutes, router2, admin_content_default, adminMediaRoutes, router, adminPluginRoutes, adminLogsRoutes, userRoutes, auth_default, test_cleanup_default, getDocumentRequestContext, updateDocumentSchema, effectiveTenantForType } from './chunk-VC5XVPLM.js';
+export { DocumentRepository, ROUTES_INFO, admin_api_default as adminApiRoutes, adminCheckboxRoutes, adminCollectionsRoutes, admin_content_default as adminContentRoutes, router as adminDashboardRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, userRoutes as adminUsersRoutes, api_content_crud_default as apiContentCrudRoutes, api_media_default as apiMediaRoutes, api_default as apiRoutes, api_system_default as apiSystemRoutes, auth_default as authRoutes, createUserProfilesPlugin, defineUserProfile, getUserProfileConfig, userProfilesPlugin } from './chunk-VC5XVPLM.js';
 import './chunk-VVYVFCML.js';
-import './chunk-RMRJGMDE.js';
+import './chunk-BHND5PEV.js';
 import { SettingsService, setAppInstance } from './chunk-2XAQTPAE.js';
 export { Logger, getLogger, initLogger } from './chunk-2XAQTPAE.js';
 import { getAllCacheStats, CACHE_CONFIGS, getCacheService, clearAllCaches, parseCacheKey } from './chunk-K25XHMM3.js';
 import { schema_exports } from './chunk-AI663NBO.js';
 export { apiTokens, content, contentVersions, insertContentSchema, insertLogConfigSchema, insertMediaSchema, insertPluginActivityLogSchema, insertPluginAssetSchema, insertPluginHookSchema, insertPluginRouteSchema, insertPluginSchema, insertSystemLogSchema, insertUserSchema, insertWorkflowHistorySchema, logConfig, media, pluginActivityLog, pluginAssets, pluginHooks, pluginRoutes, plugins, selectContentSchema, selectLogConfigSchema, selectMediaSchema, selectPluginActivityLogSchema, selectPluginAssetSchema, selectPluginHookSchema, selectPluginRouteSchema, selectPluginSchema, selectSystemLogSchema, selectUserSchema, selectWorkflowHistorySchema, systemLogs, users, workflowHistory } from './chunk-AI663NBO.js';
-import { requireAuth, DocumentTypeRegistry, requireRbac, requireRole, getJwtExpirySecondsFromDb, AuthManager, metricsMiddleware, bootstrapMiddleware, securityHeadersMiddleware, csrfProtection } from './chunk-CHWT5KBK.js';
-export { AuthManager, PermissionManager, bootstrapDocumentTypes, bootstrapMiddleware, cacheHeaders, compressionMiddleware, detailedLoggingMiddleware, getActivePlugins, isPluginActive, logActivity, loggingMiddleware, optionalAuth, performanceLoggingMiddleware, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeadersMiddleware as securityHeaders, securityLoggingMiddleware } from './chunk-CHWT5KBK.js';
+import { requireAuth, DocumentTypeRegistry, requireRbac, requireRole, getJwtExpirySecondsFromDb, AuthManager, metricsMiddleware, bootstrapMiddleware, securityHeadersMiddleware, csrfProtection } from './chunk-FHPEM77Y.js';
+export { AuthManager, PermissionManager, bootstrapDocumentTypes, bootstrapMiddleware, cacheHeaders, compressionMiddleware, detailedLoggingMiddleware, getActivePlugins, isPluginActive, logActivity, loggingMiddleware, optionalAuth, performanceLoggingMiddleware, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeadersMiddleware as securityHeaders, securityLoggingMiddleware } from './chunk-FHPEM77Y.js';
 import { RbacService, DocumentsService } from './chunk-3TMTYJAJ.js';
 export { DocumentsService, RbacService } from './chunk-3TMTYJAJ.js';
 import { nanoid } from './chunk-UWUP2VMT.js';
-import { PluginService, PLUGIN_REGISTRY, invalidateTenantCache, getCollectionRegistry, TENANT_COOKIE, MULTI_TENANT_PLUGIN_ID, collectionRecordToRow, tenantMiddleware } from './chunk-DOMXI5PM.js';
-export { PluginBootstrapService, PluginService as PluginServiceClass, getAvailableCollectionNames, loadCollectionConfig, loadCollectionConfigs, registerCollections, validateCollectionConfig } from './chunk-DOMXI5PM.js';
-export { MigrationService } from './chunk-2FCKKOA5.js';
-export { renderFilterBar } from './chunk-JQISFW6U.js';
-import { renderAdminLayout } from './chunk-OBA2RYZN.js';
-export { getConfirmationDialogScript, renderAlert, renderConfirmationDialog, renderForm, renderFormField, renderPagination, renderTable } from './chunk-OBA2RYZN.js';
-import { init_admin_layout_catalyst_template, renderAdminLayoutCatalyst } from './chunk-5V62WT6M.js';
-export { renderAdminLayoutCatalyst } from './chunk-5V62WT6M.js';
-import { TurnstileService, HookSystemImpl, createPluginWirer, registerPluginRoutes, setPluginMenu, resolvePluginMenuItems } from './chunk-GB2Q2DNK.js';
-export { HookSystemImpl, HookUtils, PluginDependencyCycleError, PluginManager as PluginManagerClass, PluginRegistryImpl, PluginValidator as PluginValidatorClass, RegisterPluginsError, ScopedHookSystem as ScopedHookSystemClass, collectCronSchedules, collectCrons, createScheduledHandler, dispatchCronTick, getPluginMenu, registerPlugins, resetPluginMenu, resolvePluginMenuItems, setPluginMenu, topoSort } from './chunk-GB2Q2DNK.js';
-import { definePlugin, setPluginDefinitions } from './chunk-I2DM27HP.js';
-export { applySchemaDefaults, definePlugin, isDefinedPlugin, parseConfigSchema, parseFormDataToSettings, renderSchemaFields } from './chunk-I2DM27HP.js';
+import { PluginService, PLUGIN_REGISTRY, invalidateTenantCache, getCollectionRegistry, TENANT_COOKIE, MULTI_TENANT_PLUGIN_ID, collectionRecordToRow, tenantMiddleware } from './chunk-RJ2O5IIE.js';
+export { PluginBootstrapService, PluginService as PluginServiceClass, getAvailableCollectionNames, loadCollectionConfig, loadCollectionConfigs, registerCollections, validateCollectionConfig } from './chunk-RJ2O5IIE.js';
+export { MigrationService } from './chunk-UIHIXTIS.js';
+export { renderFilterBar } from './chunk-URIBTX27.js';
+import { renderAdminLayout } from './chunk-BJROXF4N.js';
+export { getConfirmationDialogScript, renderAlert, renderConfirmationDialog, renderForm, renderFormField, renderPagination, renderTable } from './chunk-BJROXF4N.js';
+import { init_admin_layout_catalyst_template, renderAdminLayoutCatalyst } from './chunk-THFZSDIU.js';
+export { renderAdminLayoutCatalyst } from './chunk-THFZSDIU.js';
+import { TurnstileService, HookSystemImpl, createPluginWirer, registerPluginRoutes } from './chunk-VYQVDL2M.js';
+export { HookSystemImpl, HookUtils, PluginDependencyCycleError, PluginManager as PluginManagerClass, PluginRegistryImpl, PluginValidator as PluginValidatorClass, RegisterPluginsError, ScopedHookSystem as ScopedHookSystemClass, collectCronSchedules, collectCrons, createScheduledHandler, dispatchCronTick, registerPlugins, topoSort } from './chunk-VYQVDL2M.js';
+import { definePlugin, setPluginMenu, setPluginDefinitions, resolvePluginMenuItems } from './chunk-VGEZNFWH.js';
+export { applySchemaDefaults, definePlugin, getPluginMenu, isDefinedPlugin, parseConfigSchema, parseFormDataToSettings, renderSchemaFields, resetPluginMenu, resolvePluginMenuItems, setPluginMenu } from './chunk-VGEZNFWH.js';
 import { setHookSystem } from './chunk-RNZFGN4R.js';
 export { getHookSystem, getTypedHooks, hasHookSystem, resetHookSystem, setHookSystem } from './chunk-RNZFGN4R.js';
 export { QueryFilterBuilder, TemplateRenderer, buildQuery, renderTemplate, templateRenderer } from './chunk-QZGABF2M.js';
 export { metricsTracker } from './chunk-FICTAGD4.js';
 import './chunk-X7ZAEI5S.js';
-import { getCoreVersion, package_default } from './chunk-73O4GPJ6.js';
-export { SONICJS_VERSION, getCoreVersion } from './chunk-73O4GPJ6.js';
+import { getCoreVersion, package_default } from './chunk-LNI3FYSI.js';
+export { SONICJS_VERSION, getCoreVersion } from './chunk-LNI3FYSI.js';
 import { escapeHtml, sanitizeInput } from './chunk-TQABQWOP.js';
 export { escapeHtml, sanitizeInput, sanitizeObject } from './chunk-TQABQWOP.js';
 export { HOOKS } from './chunk-QXOZI5Q2.js';
@@ -8112,7 +8112,7 @@ adminRoutes5.get("/settings", async (c) => {
   const db = c.env.DB;
   const user = c.get("user");
   const settings = await getSettings4(db);
-  const { renderAdminLayoutCatalyst: renderAdminLayoutCatalyst2 } = await import('./admin-layout-catalyst.template-YQ4EMF2J.js');
+  const { renderAdminLayoutCatalyst: renderAdminLayoutCatalyst2 } = await import('./admin-layout-catalyst.template-6UQGLCKI.js');
   const content2 = `
     <div>
       <div class="mb-6">
@@ -11777,6 +11777,1436 @@ function pluginMenuMiddleware() {
     }
   };
 }
+
+// src/plugins/core-plugins/menu-plugin/services/menu-repository.ts
+async function listMenuItems(db, opts) {
+  try {
+    let sql = `
+      SELECT id, slug, sort_order, data
+      FROM documents
+      WHERE type_id = 'menu_item'
+        AND tenant_id = 'default'
+        AND is_current_draft = 1
+        AND deleted_at IS NULL
+    `;
+    const binds = [];
+    if (opts?.source) ;
+    sql += ` ORDER BY sort_order ASC`;
+    const stmt = db.prepare(sql);
+    const result = await (binds.length ? stmt.bind(...binds) : stmt).all();
+    return (result.results ?? []).map((row) => {
+      const data = JSON.parse(row.data);
+      return {
+        ...data,
+        id: row.id,
+        slug: row.slug,
+        sortOrder: row.sort_order,
+        tenantId: "default"
+      };
+    });
+  } catch {
+    return [];
+  }
+}
+async function fetchPluginStatuses(db, pluginIds) {
+  if (pluginIds.length === 0) return {};
+  try {
+    const rows = await db.prepare(
+      `SELECT slug, json_extract(data, '$.status') AS status
+         FROM documents
+         WHERE type_id = 'plugin' AND tenant_id = 'default'
+           AND is_current_draft = 1 AND deleted_at IS NULL`
+    ).all();
+    const statusMap = /* @__PURE__ */ new Map();
+    for (const row of rows.results ?? []) {
+      statusMap.set(row.slug, row.status ?? "inactive");
+    }
+    const result = {};
+    for (const id of pluginIds) {
+      const s = statusMap.get(id);
+      result[id] = s === "active" ? "active" : "inactive";
+    }
+    return result;
+  } catch {
+    return {};
+  }
+}
+function buildSidebarTree(items) {
+  const visible = items.filter((i) => i.visible);
+  visible.sort((a, b) => a.sortOrder - b.sortOrder);
+  const byId = /* @__PURE__ */ new Map();
+  const roots = [];
+  for (const item of visible) {
+    byId.set(item.id, {
+      id: item.id,
+      label: item.label,
+      url: item.url,
+      icon: item.icon,
+      target: item.target,
+      isExternal: item.isExternal,
+      visible: item.visible,
+      source: item.source,
+      sortOrder: item.sortOrder,
+      children: []
+    });
+  }
+  for (const item of visible) {
+    const node = byId.get(item.id);
+    if (item.parent && byId.has(item.parent)) {
+      byId.get(item.parent).children.push(node);
+    } else {
+      roots.push(node);
+    }
+  }
+  for (const node of byId.values()) {
+    node.children.sort((a, b) => a.sortOrder - b.sortOrder);
+  }
+  return roots;
+}
+async function upsertSystemItem(db, slug, data, sortOrder) {
+  const now = Math.floor(Date.now() / 1e3);
+  const existing = await db.prepare(
+    `SELECT id FROM documents WHERE slug = ? AND type_id = 'menu_item' AND tenant_id = 'default' AND is_current_draft = 1 AND deleted_at IS NULL`
+  ).bind(slug).first();
+  if (existing) {
+    return;
+  }
+  const id = nanoid();
+  await db.prepare(
+    `INSERT INTO documents (
+        id, root_id, type_id, type_version, version_of_id, version_number,
+        is_current_draft, is_published, status, parent_root_id,
+        slug, path, title, zone, sort_order, visible,
+        published_at, scheduled_at, expires_at, deleted_at,
+        tenant_id, locale, translation_group_id,
+        data, metadata, owner_id, created_by, updated_by, created_at, updated_at
+      ) VALUES (
+        ?, ?, ?, ?, ?, ?,
+        ?, ?, ?, ?,
+        ?, ?, ?, ?, ?, ?,
+        ?, ?, ?, ?,
+        ?, ?, ?,
+        ?, ?, ?, ?, ?, ?, ?
+      )`
+  ).bind(
+    id,
+    // id
+    id,
+    // root_id
+    "menu_item",
+    // type_id
+    1,
+    // type_version
+    null,
+    // version_of_id
+    1,
+    // version_number
+    1,
+    // is_current_draft
+    1,
+    // is_published
+    "published",
+    // status
+    "",
+    // parent_root_id
+    slug,
+    // slug
+    null,
+    // path
+    data.label,
+    // title
+    null,
+    // zone
+    sortOrder,
+    // sort_order
+    data.visible ? 1 : 0,
+    // visible
+    now,
+    // published_at
+    null,
+    // scheduled_at
+    null,
+    // expires_at
+    null,
+    // deleted_at
+    "default",
+    // tenant_id
+    "default",
+    // locale
+    "",
+    // translation_group_id
+    JSON.stringify(data),
+    // data
+    "{}",
+    // metadata
+    null,
+    // owner_id
+    "system",
+    // created_by
+    "system",
+    // updated_by
+    now,
+    // created_at
+    now
+    // updated_at
+  ).run();
+}
+async function reorderItems(db, items) {
+  if (items.length === 0) return;
+  const now = Math.floor(Date.now() / 1e3);
+  const stmts = items.map(
+    (item) => db.prepare(
+      `UPDATE documents SET
+          sort_order = ?,
+          data = json_set(data, '$.parent', ?),
+          updated_at = ?
+        WHERE id = ? AND tenant_id = 'default'`
+    ).bind(item.sortOrder, item.parent ?? null, now, item.id)
+  );
+  await db.batch(stmts);
+}
+async function toggleVisibility(db, id, visible) {
+  const now = Math.floor(Date.now() / 1e3);
+  const visInt = visible ? 1 : 0;
+  await db.prepare(
+    `UPDATE documents SET
+        data = json_set(data, '$.visible', ?),
+        visible = ?,
+        updated_at = ?
+      WHERE id = ? AND tenant_id = 'default' AND type_id = 'menu_item'`
+  ).bind(visInt, visInt, now, id).run();
+}
+async function updateItem(db, id, changes, lockedFields) {
+  const lockedKeys = new Set(lockedFields.filter((f) => f !== "parent"));
+  for (const key of Object.keys(changes)) {
+    if (lockedKeys.has(key)) {
+      return false;
+    }
+  }
+  const now = Math.floor(Date.now() / 1e3);
+  const jsonSetParts = [];
+  const binds = [];
+  const dataFields = ["label", "icon", "target", "permissions", "url", "parent", "visible"];
+  for (const field of dataFields) {
+    if (field in changes) {
+      jsonSetParts.push(`'$.${field}'`, "?");
+      binds.push(
+        field === "permissions" ? JSON.stringify(changes[field]) : changes[field] ?? null
+      );
+    }
+  }
+  const setParts = [];
+  if (jsonSetParts.length > 0) {
+    setParts.push(`data = json_set(data, ${jsonSetParts.join(", ")})`);
+  }
+  if ("sortOrder" in changes && changes.sortOrder !== void 0) {
+    setParts.push(`sort_order = ?`);
+    binds.push(changes.sortOrder);
+  }
+  if ("visible" in changes && changes.visible !== void 0) {
+    setParts.push(`visible = ?`);
+    binds.push(changes.visible ? 1 : 0);
+  }
+  if (setParts.length === 0) {
+    return true;
+  }
+  setParts.push(`updated_at = ?`);
+  binds.push(now);
+  binds.push(id);
+  const sql = `UPDATE documents SET ${setParts.join(", ")} WHERE id = ? AND tenant_id = 'default' AND type_id = 'menu_item'`;
+  await db.prepare(sql).bind(...binds).run();
+  return true;
+}
+async function deleteItem(db, id) {
+  try {
+    const row = await db.prepare(
+      `SELECT data FROM documents WHERE id = ? AND tenant_id = 'default' AND is_current_draft = 1 AND deleted_at IS NULL`
+    ).bind(id).first();
+    if (!row) {
+      return { ok: false, reason: "Item not found" };
+    }
+    const data = JSON.parse(row.data);
+    if (data.source === "system" || data.source === "plugin") {
+      return { ok: false, reason: "Cannot delete system or plugin items" };
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    await db.prepare(
+      `UPDATE documents SET deleted_at = ? WHERE id = ? AND tenant_id = 'default'`
+    ).bind(now, id).run();
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, reason: err instanceof Error ? err.message : "Unknown error" };
+  }
+}
+
+// src/services/menu-icons.ts
+var MENU_ICON_MAP = {
+  "puzzle-piece": `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path d="M14.5 2A1.5 1.5 0 0013 3.5V4H8.5A1.5 1.5 0 007 5.5V10h-.5a1.5 1.5 0 100 3H7v4.5A1.5 1.5 0 008.5 19H13v-.5a1.5 1.5 0 113 0V19h.5a1.5 1.5 0 001.5-1.5V13h-.5a1.5 1.5 0 110-3h.5V5.5A1.5 1.5 0 0017 4h-.5v-.5A1.5 1.5 0 0014.5 2z"/></svg>`,
+  envelope: `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path d="M2.003 5.884L10 9.882l7.997-3.998A2 2 0 0016 4H4a2 2 0 00-1.997 1.884z"/><path d="M18 8.118l-8 4-8-4V14a2 2 0 002 2h12a2 2 0 002-2V8.118z"/></svg>`,
+  cog: `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path fill-rule="evenodd" d="M11.49 3.17c-.38-1.56-2.6-1.56-2.98 0a1.532 1.532 0 01-2.286.948c-1.372-.836-2.942.734-2.106 2.106.54.886.061 2.042-.947 2.287-1.561.379-1.561 2.6 0 2.978a1.532 1.532 0 01.947 2.287c-.836 1.372.734 2.942 2.106 2.106a1.532 1.532 0 012.287.947c.379 1.561 2.6 1.561 2.978 0a1.533 1.533 0 012.287-.947c1.372.836 2.942-.734 2.106-2.106a1.533 1.533 0 01.947-2.287c1.561-.379 1.561-2.6 0-2.978a1.532 1.532 0 01-.947-2.287c.836-1.372-.734-2.942-2.106-2.106a1.532 1.532 0 01-2.287-.947zM10 13a3 3 0 100-6 3 3 0 000 6z" clip-rule="evenodd"/></svg>`,
+  chart: `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path d="M2 11a1 1 0 011-1h2a1 1 0 011 1v5a1 1 0 01-1 1H3a1 1 0 01-1-1v-5zM8 7a1 1 0 011-1h2a1 1 0 011 1v9a1 1 0 01-1 1H9a1 1 0 01-1-1V7zM14 4a1 1 0 011-1h2a1 1 0 011 1v12a1 1 0 01-1 1h-2a1 1 0 01-1-1V4z"/></svg>`,
+  sparkles: `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path d="M9 4.804A7.968 7.968 0 005.5 4c-1.255 0-2.443.29-3.5.804v10A7.969 7.969 0 015.5 14c1.669 0 3.218.51 4.5 1.385A7.962 7.962 0 0114.5 14c1.255 0 2.443.29 3.5.804v-10A7.968 7.968 0 0014.5 4c-1.255 0-2.443.29-3.5.804V12a1 1 0 11-2 0V4.804z"/></svg>`,
+  bolt: `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path fill-rule="evenodd" d="M11.3 1.046A1 1 0 0112 2v5h4a1 1 0 01.82 1.573l-7 10A1 1 0 018 18v-5H4a1 1 0 01-.82-1.573l7-10a1 1 0 011.12-.38z" clip-rule="evenodd"/></svg>`,
+  document: `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path fill-rule="evenodd" d="M4 4a2 2 0 012-2h8a2 2 0 012 2v12a2 2 0 01-2 2H6a2 2 0 01-2-2V4zm3 1h6v2H7V5zm0 4h6v2H7V9zm0 4h4v2H7v-2z" clip-rule="evenodd"/></svg>`,
+  lock: `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path fill-rule="evenodd" d="M5 9V7a5 5 0 0110 0v2a2 2 0 012 2v5a2 2 0 01-2 2H5a2 2 0 01-2-2v-5a2 2 0 012-2zm8-2v2H7V7a3 3 0 016 0z" clip-rule="evenodd"/></svg>`,
+  photo: `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path fill-rule="evenodd" d="M4 3a2 2 0 00-2 2v10a2 2 0 002 2h12a2 2 0 002-2V5a2 2 0 00-2-2H4zm12 12H4l4-8 3 6 2-4 3 6z" clip-rule="evenodd"/></svg>`,
+  "magnifying-glass": `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="m21 21-5.197-5.197m0 0A7.5 7.5 0 1 0 5.196 5.196a7.5 7.5 0 0 0 10.607 10.607Z"/></svg>`,
+  "chart-bar": `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 13.125C3 12.504 3.504 12 4.125 12h2.25c.621 0 1.125.504 1.125 1.125v6.75C7.5 20.496 6.996 21 6.375 21h-2.25A1.125 1.125 0 0 1 3 19.875v-6.75ZM9.75 8.625c0-.621.504-1.125 1.125-1.125h2.25c.621 0 1.125.504 1.125 1.125v11.25c0 .621-.504 1.125-1.125 1.125h-2.25a1.125 1.125 0 0 1-1.125-1.125V8.625ZM16.5 4.125c0-.621.504-1.125 1.125-1.125h2.25C20.496 3 21 3.504 21 4.125v15.75c0 .621-.504 1.125-1.125 1.125h-2.25a1.125 1.125 0 0 1-1.125-1.125V4.125Z"/></svg>`,
+  image: `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="m2.25 15.75 5.159-5.159a2.25 2.25 0 0 1 3.182 0l5.159 5.159m-1.5-1.5 1.409-1.409a2.25 2.25 0 0 1 3.182 0l2.909 2.909m-18 3.75h16.5a1.5 1.5 0 0 0 1.5-1.5V6a1.5 1.5 0 0 0-1.5-1.5H3.75A1.5 1.5 0 0 0 2.25 6v12a1.5 1.5 0 0 0 1.5 1.5Zm10.5-11.25h.008v.008h-.008V8.25Zm.375 0a.375.375 0 1 1-.75 0 .375.375 0 0 1 .75 0Z"/></svg>`,
+  palette: `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4.098 19.902a3.75 3.75 0 0 0 5.304 0l6.401-6.402M6.75 21A3.75 3.75 0 0 1 3 17.25V4.125C3 3.504 3.504 3 4.125 3h5.25c.621 0 1.125.504 1.125 1.125v4.072M6.75 21a3.75 3.75 0 0 0 3.75-3.75V8.197M6.75 21h13.125c.621 0 1.125-.504 1.125-1.125v-5.25c0-.621-.504-1.125-1.125-1.125h-4.072M10.5 8.197l2.88-2.88c.438-.439 1.15-.439 1.59 0l3.712 3.713c.44.44.44 1.152 0 1.59l-2.879 2.88M6.75 17.25h.008v.008H6.75v-.008Z"/></svg>`,
+  "hand-raised": `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10.05 4.575a1.575 1.575 0 1 0-3.15 0v3m3.15-3v-1.5a1.575 1.575 0 0 1 3.15 0v1.5m-3.15 0 .075 5.925m3.075-5.925v2.925m0-2.925a1.575 1.575 0 0 1 3.15 0V9.9m-3.15-2.4v5.325M16.5 9.9a1.575 1.575 0 0 1 3.15 0V15a6.15 6.15 0 0 1-6.15 6.15H12A6.15 6.15 0 0 1 5.85 15V9.525"/></svg>`,
+  key: `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15.75 5.25a3 3 0 0 1 3 3m3 0a6 6 0 0 1-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1 1 21.75 8.25Z"/></svg>`,
+  "arrow-right": `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13.5 4.5 21 12m0 0-7.5 7.5M21 12H3"/></svg>`,
+  "shield-check": `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/></svg>`,
+  "credit-card": `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M2.25 8.25h19.5M2.25 9h19.5m-16.5 5.25h6m-6 2.25h3m-3.75 3h15a2.25 2.25 0 0 0 2.25-2.25V6.75A2.25 2.25 0 0 0 19.5 4.5h-15a2.25 2.25 0 0 0-2.25 2.25v10.5A2.25 2.25 0 0 0 4.5 19.5Z"/></svg>`,
+  "document-text": `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12h6m-6 4h6m2 5H7a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5.586a1 1 0 0 1 .707.293l5.414 5.414a1 1 0 0 1 .293.707V19a2 2 0 0 1-2 2z"/></svg>`,
+  "pencil-square": `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="m16.862 4.487 1.687-1.688a1.875 1.875 0 1 1 2.652 2.652L10.582 16.07a4.5 4.5 0 0 1-1.897 1.13L6 18l.8-2.685a4.5 4.5 0 0 1 1.13-1.897l8.932-8.931Zm0 0L19.5 7.125M18 14v4.75A2.25 2.25 0 0 1 15.75 21H5.25A2.25 2.25 0 0 1 3 18.75V8.25A2.25 2.25 0 0 1 5.25 6H10"/></svg>`,
+  server: `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path fill-rule="evenodd" d="M2 5a2 2 0 012-2h12a2 2 0 012 2v2a2 2 0 01-2 2H4a2 2 0 01-2-2V5zm14 1a1 1 0 11-2 0 1 1 0 012 0zM2 13a2 2 0 012-2h12a2 2 0 012 2v2a2 2 0 01-2 2H4a2 2 0 01-2-2v-2zm14 1a1 1 0 11-2 0 1 1 0 012 0z" clip-rule="evenodd"/></svg>`,
+  "building-office": `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3.75 21h16.5M4.5 3h15M5.25 3v18m13.5-18v18M9 6.75h1.5m-1.5 3h1.5m-1.5 3h1.5m3-6H15m-1.5 3H15m-1.5 3H15M9 21v-3.375c0-.621.504-1.125 1.125-1.125h3.75c.621 0 1.125.504 1.125 1.125V21"/></svg>`,
+  home: `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path d="M10.707 2.293a1 1 0 00-1.414 0l-7 7a1 1 0 001.414 1.414L4 10.414V17a1 1 0 001 1h2a1 1 0 001-1v-2a1 1 0 011-1h2a1 1 0 011 1v2a1 1 0 001 1h2a1 1 0 001-1v-6.586l.293.293a1 1 0 001.414-1.414l-7-7z"/></svg>`,
+  users: `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path d="M9 6a3 3 0 11-6 0 3 3 0 016 0zM17 6a3 3 0 11-6 0 3 3 0 016 0zM12.93 17c.046-.327.07-.66.07-1a6.97 6.97 0 00-1.5-4.33A5 5 0 0119 16v1h-6.07zM6 11a5 5 0 015 5v1H1v-1a5 5 0 015-5z"/></svg>`,
+  collection: `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path d="M7 3a1 1 0 000 2h6a1 1 0 100-2H7zM4 7a1 1 0 011-1h10a1 1 0 110 2H5a1 1 0 01-1-1zM2 11a2 2 0 012-2h12a2 2 0 012 2v4a2 2 0 01-2 2H4a2 2 0 01-2-2v-4z"/></svg>`,
+  "bars-3": `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3.75 6.75h16.5M3.75 12h16.5m-16.5 5.25h16.5"/></svg>`,
+  "cog-6-tooth": `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9.594 3.94c.09-.542.56-.94 1.11-.94h2.593c.55 0 1.02.398 1.11.94l.213 1.281c.063.374.313.686.645.87.074.04.147.083.22.127.325.196.72.257 1.075.124l1.217-.456a1.125 1.125 0 0 1 1.37.49l1.296 2.247a1.125 1.125 0 0 1-.26 1.431l-1.003.827c-.293.241-.438.613-.43.992a7.723 7.723 0 0 1 0 .255c-.008.378.137.75.43.991l1.004.827c.424.35.534.955.26 1.43l-1.298 2.247a1.125 1.125 0 0 1-1.369.491l-1.217-.456c-.355-.133-.75-.072-1.076.124a6.47 6.47 0 0 1-.22.128c-.331.183-.581.495-.644.869l-.213 1.281c-.09.543-.56.94-1.11.94h-2.594c-.55 0-1.019-.398-1.11-.94l-.213-1.281c-.062-.374-.312-.686-.644-.87a6.52 6.52 0 0 1-.22-.127c-.325-.196-.72-.257-1.076-.124l-1.217.456a1.125 1.125 0 0 1-1.369-.49l-1.297-2.247a1.125 1.125 0 0 1 .26-1.431l1.004-.827c.292-.24.437-.613.43-.991a6.932 6.932 0 0 1 0-.255c.007-.38-.138-.751-.43-.992l-1.004-.827a1.125 1.125 0 0 1-.26-1.43l1.297-2.247a1.125 1.125 0 0 1 1.37-.491l1.216.456c.356.133.751.072 1.076-.124.072-.044.146-.086.22-.128.332-.183.582-.495.644-.869l.214-1.28Z"/><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 1 1-6 0 3 3 0 0 1 6 0Z"/></svg>`,
+  star: `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path d="M9.049 2.927c.3-.921 1.603-.921 1.902 0l1.07 3.292a1 1 0 00.95.69h3.462c.969 0 1.371 1.24.588 1.81l-2.8 2.034a1 1 0 00-.364 1.118l1.07 3.292c.3.921-.755 1.688-1.54 1.118l-2.8-2.034a1 1 0 00-1.175 0l-2.8 2.034c-.784.57-1.838-.197-1.539-1.118l1.07-3.292a1 1 0 00-.364-1.118L2.98 8.72c-.783-.57-.38-1.81.588-1.81h3.461a1 1 0 00.951-.69l1.07-3.292z"/></svg>`,
+  tag: `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path fill-rule="evenodd" d="M17.707 9.293a1 1 0 010 1.414l-7 7a1 1 0 01-1.414 0l-7-7A.997.997 0 012 10V5a3 3 0 013-3h5c.256 0 .512.098.707.293l7 7zM5 6a1 1 0 100-2 1 1 0 000 2z" clip-rule="evenodd"/></svg>`,
+  link: `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13.828 10.172a4 4 0 00-5.656 0l-4 4a4 4 0 105.656 5.656l1.102-1.101m-.758-4.899a4 4 0 005.656 0l4-4a4 4 0 00-5.656-5.656l-1.1 1.1"/></svg>`,
+  "external-link": `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"/></svg>`,
+  eye: `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path d="M10 12a2 2 0 100-4 2 2 0 000 4z"/><path fill-rule="evenodd" d="M.458 10C1.732 5.943 5.522 3 10 3s8.268 2.943 9.542 7c-1.274 4.057-5.064 7-9.542 7S1.732 14.057.458 10zM14 10a4 4 0 11-8 0 4 4 0 018 0z" clip-rule="evenodd"/></svg>`,
+  "eye-slash": `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path fill-rule="evenodd" d="M3.707 2.293a1 1 0 00-1.414 1.414l14 14a1 1 0 001.414-1.414l-1.473-1.473A10.014 10.014 0 0019.542 10C18.268 5.943 14.478 3 10 3a9.958 9.958 0 00-4.512 1.074l-1.78-1.781zm4.261 4.26l1.514 1.515a2.003 2.003 0 012.45 2.45l1.514 1.514a4 4 0 00-5.478-5.478z" clip-rule="evenodd"/><path d="M12.454 16.697L9.75 13.992a4 4 0 01-3.742-3.741L2.335 6.578A9.98 9.98 0 00.458 10c1.274 4.057 5.065 7 9.542 7 .847 0 1.669-.105 2.454-.303z"/></svg>`
+};
+var FALLBACK = `<svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20"><path d="M14.5 2A1.5 1.5 0 0013 3.5V4H8.5A1.5 1.5 0 007 5.5V10h-.5a1.5 1.5 0 100 3H7v4.5A1.5 1.5 0 008.5 19H13v-.5a1.5 1.5 0 113 0V19h.5a1.5 1.5 0 001.5-1.5V13h-.5a1.5 1.5 0 110-3h.5V5.5A1.5 1.5 0 0017 4h-.5v-.5A1.5 1.5 0 0014.5 2z"/></svg>`;
+function resolveIcon2(nameOrSvg) {
+  if (!nameOrSvg) return FALLBACK;
+  if (nameOrSvg.startsWith("<svg")) return nameOrSvg;
+  return MENU_ICON_MAP[nameOrSvg] ?? FALLBACK;
+}
+
+// src/middleware/menu.ts
+var EXTERNAL_ICON = `<svg class="h-3 w-3 ml-1 shrink-0 opacity-60" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"/></svg>`;
+var CHEVRON = `<svg data-menu-chevron class="h-4 w-4 rotate-180 transition-transform duration-200" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7"/></svg>`;
+function renderTopLevelItem(item, currentPath) {
+  const isActive = currentPath === item.url || item.url !== "/admin" && currentPath.startsWith(item.url);
+  const icon = resolveIcon2(item.icon);
+  const label = escapeHtml(item.label);
+  const targetAttr = item.target === "_blank" ? ' target="_blank" rel="noopener noreferrer"' : "";
+  const externalAffordance = item.isExternal ? EXTERNAL_ICON : "";
+  if (item.children.length > 0) {
+    const accordionId = `acc-${item.id.replace(/[^a-z0-9]/gi, "-")}`;
+    const isChildActive = item.children.some(
+      (c) => currentPath === c.url || currentPath.startsWith(c.url)
+    );
+    const accordionActive = isActive || isChildActive;
+    return `
+      <div data-menu-accordion class="relative">
+        ${accordionActive ? '<span class="absolute inset-y-2 -left-4 w-0.5 rounded-full bg-cyan-500 dark:bg-cyan-400"></span>' : ""}
+        <div class="flex w-full items-center">
+          <a href="${item.url}"${targetAttr}
+            class="flex flex-1 items-center gap-3 rounded-lg px-2 py-2.5 text-left text-sm/5 font-medium ${accordionActive ? "text-zinc-950 dark:text-white" : "text-zinc-950 hover:bg-zinc-950/5 dark:text-white dark:hover:bg-white/5"}"
+            ${accordionActive ? 'data-current="true"' : ""}
+          >
+            <span class="shrink-0 ${accordionActive ? "fill-zinc-950 dark:fill-white" : "fill-zinc-500 dark:fill-zinc-400"}">${icon}</span>
+            <span class="truncate">${label}</span>${externalAffordance}
+          </a>
+          <button
+            onclick="toggleMenuAccordion('${accordionId}')"
+            class="flex items-center justify-center rounded-lg p-2 text-zinc-500 hover:bg-zinc-950/5 dark:text-zinc-400 dark:hover:bg-white/5 flex-shrink-0"
+            aria-label="Toggle ${label} submenu"
+          >
+            ${CHEVRON}
+          </button>
+        </div>
+        <div id="${accordionId}" class="pl-6 mt-0.5 flex flex-col gap-0.5">
+          ${item.children.map((child) => renderChildItem(child, currentPath)).join("")}
+        </div>
+      </div>`;
+  }
+  return `
+    <span class="relative">
+      ${isActive ? '<span class="absolute inset-y-2 -left-4 w-0.5 rounded-full bg-cyan-500 dark:bg-cyan-400"></span>' : ""}
+      <a href="${item.url}"${targetAttr}
+        class="flex w-full items-center gap-3 rounded-lg px-2 py-2.5 text-left text-sm/5 font-medium ${isActive ? "text-zinc-950 dark:text-white" : "text-zinc-950 hover:bg-zinc-950/5 dark:text-white dark:hover:bg-white/5"}"
+        ${isActive ? 'data-current="true"' : ""}
+      >
+        <span class="shrink-0 ${isActive ? "fill-zinc-950 dark:fill-white" : "fill-zinc-500 dark:fill-zinc-400"}">${icon}</span>
+        <span class="truncate">${label}</span>${externalAffordance}
+      </a>
+    </span>`;
+}
+function renderChildItem(item, currentPath) {
+  const isActive = currentPath === item.url || item.url !== "/admin" && currentPath.startsWith(item.url);
+  const icon = resolveIcon2(item.icon);
+  const label = escapeHtml(item.label);
+  const targetAttr = item.target === "_blank" ? ' target="_blank" rel="noopener noreferrer"' : "";
+  const externalAffordance = item.isExternal ? EXTERNAL_ICON : "";
+  return `
+    <span class="relative">
+      ${isActive ? '<span class="absolute inset-y-2 -left-4 w-0.5 rounded-full bg-cyan-500 dark:bg-cyan-400"></span>' : ""}
+      <a href="${item.url}"${targetAttr}
+        class="flex w-full items-center gap-3 rounded-lg px-2 py-2 text-left text-sm/5 font-medium ${isActive ? "text-zinc-950 dark:text-white" : "text-zinc-600 hover:bg-zinc-950/5 dark:text-zinc-400 dark:hover:bg-white/5"}"
+        ${isActive ? 'data-current="true"' : ""}
+      >
+        <span class="shrink-0 ${isActive ? "fill-zinc-950 dark:fill-white" : "fill-zinc-500 dark:fill-zinc-400"}">${icon}</span>
+        <span class="truncate">${label}</span>${externalAffordance}
+      </a>
+    </span>`;
+}
+var ACCORDION_SCRIPT = `
+<script>
+  function toggleMenuAccordion(id) {
+    var el = document.getElementById(id)
+    if (!el) return
+    var chevrons = el.parentElement ? el.parentElement.querySelectorAll('[data-menu-chevron]') : []
+    if (el.style.display === 'none' || el.style.display === '') {
+      el.style.display = 'flex'
+      el.style.flexDirection = 'column'
+      chevrons.forEach(function(c) { c.style.transform = 'rotate(180deg)' })
+    } else {
+      el.style.display = 'none'
+      chevrons.forEach(function(c) { c.style.transform = 'rotate(0deg)' })
+    }
+  }
+  // Open active accordions on load
+  document.addEventListener('DOMContentLoaded', function() {
+    document.querySelectorAll('[data-menu-accordion]').forEach(function(acc) {
+      if (acc.querySelector('[data-current]')) {
+        var sub = acc.querySelector('[id^="acc-"]')
+        if (sub) { sub.style.display = 'flex'; sub.style.flexDirection = 'column' }
+      }
+    })
+  })
+</script>`;
+async function isMenuPluginActive(db) {
+  try {
+    const row = await db.prepare(
+      `SELECT json_extract(data, '$.status') AS status
+         FROM documents
+         WHERE slug = 'menu' AND type_id = 'plugin' AND tenant_id = 'default'
+           AND is_current_draft = 1 AND deleted_at IS NULL
+         LIMIT 1`
+    ).first();
+    if (!row) return false;
+    return row.status === "active";
+  } catch {
+    return false;
+  }
+}
+function menuMiddleware() {
+  return async (c, next) => {
+    const path = new URL(c.req.url).pathname;
+    if (!path.startsWith("/admin")) {
+      return next();
+    }
+    await next();
+    if (!c.res.headers.get("content-type")?.includes("text/html")) return;
+    if (!await isMenuPluginActive(c.env.DB)) return;
+    let items = [];
+    try {
+      items = await listMenuItems(c.env.DB);
+    } catch {
+      return;
+    }
+    if (items.length === 0) return;
+    const tree = buildSidebarTree(items);
+    const renderedItems = tree.map((item) => renderTopLevelItem(item, path)).join("");
+    const navItemsHtml = renderedItems + ACCORDION_SCRIPT;
+    const status = c.res.status;
+    const headers = new Headers(c.res.headers);
+    const html4 = await c.res.text();
+    const markerRegex = /<!-- ADMIN_SIDEBAR_NAV_ITEMS -->[\s\S]*?<!-- \/ADMIN_SIDEBAR_NAV_ITEMS -->/g;
+    if (markerRegex.test(html4)) {
+      const newHtml = html4.replace(
+        /<!-- ADMIN_SIDEBAR_NAV_ITEMS -->[\s\S]*?<!-- \/ADMIN_SIDEBAR_NAV_ITEMS -->/g,
+        navItemsHtml
+      );
+      c.res = new Response(newHtml, { status, headers });
+    } else {
+      c.res = new Response(html4, { status, headers });
+    }
+  };
+}
+
+// src/plugins/core-plugins/menu-plugin/services/menu-defaults.ts
+var SYSTEM_MENU_ITEMS = [
+  {
+    id: "menu:system:content",
+    label: "Content",
+    url: "/admin/content",
+    icon: "document",
+    target: "_self",
+    isExternal: false,
+    visible: true,
+    parent: null,
+    source: "system",
+    pluginId: null,
+    permissions: [],
+    lockedFields: ["url"],
+    sortOrder: 10
+  },
+  {
+    id: "menu:system:collections",
+    label: "Collections",
+    url: "/admin/collections",
+    icon: "collection",
+    target: "_self",
+    isExternal: false,
+    visible: true,
+    parent: null,
+    source: "system",
+    pluginId: null,
+    permissions: [],
+    lockedFields: ["url"],
+    sortOrder: 20
+  },
+  {
+    id: "menu:system:users",
+    label: "Users",
+    url: "/admin/users",
+    icon: "users",
+    target: "_self",
+    isExternal: false,
+    visible: true,
+    parent: null,
+    source: "system",
+    pluginId: null,
+    permissions: [],
+    lockedFields: ["url"],
+    sortOrder: 30
+  },
+  {
+    id: "menu:system:settings",
+    label: "Settings",
+    url: "/admin/settings",
+    icon: "cog",
+    target: "_self",
+    isExternal: false,
+    visible: true,
+    parent: null,
+    source: "system",
+    pluginId: null,
+    permissions: [],
+    lockedFields: ["url"],
+    sortOrder: 40
+  },
+  {
+    id: "menu:system:plugins",
+    label: "Plugins",
+    url: "/admin/plugins",
+    icon: "collection",
+    target: "_self",
+    isExternal: false,
+    visible: true,
+    parent: null,
+    source: "system",
+    pluginId: null,
+    permissions: [],
+    lockedFields: ["url"],
+    sortOrder: 50
+  },
+  {
+    id: "menu:system:menu",
+    label: "Menu",
+    url: "/admin/menu",
+    icon: "bars-3",
+    target: "_self",
+    isExternal: false,
+    visible: true,
+    parent: null,
+    source: "system",
+    pluginId: null,
+    permissions: [],
+    lockedFields: ["url"],
+    sortOrder: 60
+  }
+];
+
+// src/plugins/core-plugins/menu-plugin/templates/admin-menu-list.template.ts
+init_admin_layout_catalyst_template();
+function pluginStatusBadge(status) {
+  if (status === "inactive") {
+    return `<span class="inline-flex items-center rounded-md px-2 py-0.5 text-xs font-medium bg-red-50 dark:bg-red-500/10 text-red-700 dark:text-red-400 ring-1 ring-inset ring-red-600/20 dark:ring-red-500/20 ml-1">disabled</span>`;
+  }
+  return `<span class="inline-flex items-center rounded-md px-2 py-0.5 text-xs font-medium bg-green-50 dark:bg-green-500/10 text-green-700 dark:text-green-400 ring-1 ring-inset ring-green-600/20 dark:ring-green-500/20 ml-1">enabled</span>`;
+}
+function sourceBadge(source) {
+  switch (source) {
+    case "system":
+      return `<span class="inline-flex items-center rounded-md px-2 py-0.5 text-xs font-medium bg-zinc-100 dark:bg-zinc-700/50 text-zinc-600 dark:text-zinc-300 ring-1 ring-inset ring-zinc-300/50 dark:ring-zinc-600/50">system</span>`;
+    case "plugin":
+      return `<span class="inline-flex items-center rounded-md px-2 py-0.5 text-xs font-medium bg-blue-50 dark:bg-blue-500/10 text-blue-700 dark:text-blue-300 ring-1 ring-inset ring-blue-700/10 dark:ring-blue-400/20">plugin</span>`;
+    default:
+      return `<span class="inline-flex items-center rounded-md px-2 py-0.5 text-xs font-medium bg-green-50 dark:bg-green-500/10 text-green-700 dark:text-green-300 ring-1 ring-inset ring-green-700/10 dark:ring-green-400/20">user</span>`;
+  }
+}
+function iconPreview(icon) {
+  if (!icon) return '<span class="text-zinc-400 dark:text-zinc-500">\u2014</span>';
+  if (icon.trim().startsWith("<")) {
+    return `<span class="w-5 h-5 inline-flex items-center justify-center">${icon}</span>`;
+  }
+  return `<span class="text-xs font-mono text-zinc-500 dark:text-zinc-400 truncate max-w-[80px]">${escapeHtml(icon)}</span>`;
+}
+function renderMenuListPage(data) {
+  const messageBanner = data.message ? `<div class="mb-6 rounded-lg bg-cyan-50 dark:bg-cyan-900/20 border border-cyan-200 dark:border-cyan-700 px-4 py-3 text-sm text-cyan-800 dark:text-cyan-200">
+        ${escapeHtml(data.message)}
+      </div>` : "";
+  const pluginStatuses = data.pluginStatuses ?? {};
+  const rows = data.items.map((item, index) => {
+    const isFirst = index === 0;
+    const isLast = index === data.items.length - 1;
+    const moveUpForm = !isFirst ? `<form method="POST" action="/admin/menu/${escapeHtml(item.id)}/move-up" class="inline">
+          <button type="submit" class="p-1 rounded hover:bg-zinc-100 dark:hover:bg-zinc-700 text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-200 transition-colors" title="Move up">
+            <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 15l7-7 7 7"/>
+            </svg>
+          </button>
+        </form>` : `<span class="w-6 inline-block"></span>`;
+    const moveDownForm = !isLast ? `<form method="POST" action="/admin/menu/${escapeHtml(item.id)}/move-down" class="inline">
+          <button type="submit" class="p-1 rounded hover:bg-zinc-100 dark:hover:bg-zinc-700 text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-200 transition-colors" title="Move down">
+            <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7"/>
+            </svg>
+          </button>
+        </form>` : `<span class="w-6 inline-block"></span>`;
+    const deleteButton = item.source === "user" ? `<form method="POST" action="/admin/menu/${escapeHtml(item.id)}/delete" onsubmit="return confirm('Delete this item?')" class="inline">
+          <button type="submit" class="inline-flex items-center px-2.5 py-1.5 text-xs font-medium rounded-md text-red-700 dark:text-red-400 bg-red-50 dark:bg-red-500/10 hover:bg-red-100 dark:hover:bg-red-500/20 ring-1 ring-inset ring-red-600/20 dark:ring-red-500/20 transition-colors">
+            Delete
+          </button>
+        </form>` : "";
+    return `
+      <tr class="border-b border-zinc-100 dark:border-zinc-800 hover:bg-zinc-50/50 dark:hover:bg-zinc-800/30 transition-colors cursor-pointer" onclick="if(!event.target.closest('a,button,input,form')){window.location='/admin/menu/${escapeHtml(item.id)}'}">
+        <td class="px-4 py-3 w-16">
+          <div class="flex items-center gap-0.5">
+            ${moveUpForm}
+            ${moveDownForm}
+          </div>
+        </td>
+        <td class="px-4 py-3 w-16">
+          ${iconPreview(item.icon)}
+        </td>
+        <td class="px-4 py-3">
+          <span class="text-sm font-medium text-zinc-900 dark:text-zinc-100">${escapeHtml(item.label)}</span>
+          ${item.parent ? `<span class="ml-2 text-xs text-zinc-400 dark:text-zinc-500">child</span>` : ""}
+        </td>
+        <td class="px-4 py-3 max-w-[200px]">
+          <span class="text-sm text-zinc-500 dark:text-zinc-400 truncate block">${escapeHtml(item.url)}</span>
+        </td>
+        <td class="px-4 py-3">
+          ${sourceBadge(item.source)}
+          ${item.source === "plugin" && item.pluginId ? pluginStatusBadge(pluginStatuses[item.pluginId] ?? "active") : ""}
+        </td>
+        <td class="px-4 py-3">
+          <form method="POST" action="/admin/menu/${escapeHtml(item.id)}/visibility" class="inline">
+            <label class="relative inline-flex items-center cursor-pointer">
+              <input
+                type="checkbox"
+                name="visible"
+                value="true"
+                ${item.visible ? "checked" : ""}
+                onchange="this.form.requestSubmit()"
+                class="sr-only peer"
+              >
+              <div class="w-9 h-5 bg-zinc-200 dark:bg-zinc-700 peer-focus:outline-none peer-focus:ring-2 peer-focus:ring-cyan-500 rounded-full peer peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-zinc-300 after:border after:rounded-full after:h-4 after:w-4 after:transition-all peer-checked:bg-cyan-600"></div>
+            </label>
+          </form>
+        </td>
+        <td class="px-4 py-3">
+          <div class="flex items-center gap-2">
+            <a href="/admin/menu/${escapeHtml(item.id)}" class="inline-flex items-center px-2.5 py-1.5 text-xs font-medium rounded-md text-zinc-700 dark:text-zinc-300 bg-zinc-100 dark:bg-zinc-700 hover:bg-zinc-200 dark:hover:bg-zinc-600 ring-1 ring-inset ring-zinc-300/50 dark:ring-zinc-600/50 transition-colors">
+              Edit
+            </a>
+            ${deleteButton}
+          </div>
+        </td>
+      </tr>`;
+  }).join("\n");
+  const emptyState = data.items.length === 0 ? `<tr>
+        <td colspan="7" class="px-4 py-12 text-center text-sm text-zinc-400 dark:text-zinc-500">
+          No menu items yet. <a href="/admin/menu/new" class="text-cyan-600 dark:text-cyan-400 underline hover:no-underline">Add a link</a> to get started.
+        </td>
+      </tr>` : "";
+  const pageContent = `
+    <div>
+      <div class="flex flex-col sm:flex-row sm:items-center sm:justify-between mb-6">
+        <div>
+          <h1 class="text-2xl/8 font-semibold text-zinc-950 dark:text-white sm:text-xl/8">Menu Manager</h1>
+          <p class="mt-1 text-sm/6 text-zinc-500 dark:text-zinc-400">Manage navigation links and their order</p>
+        </div>
+        <div class="mt-4 sm:mt-0">
+          <a href="/admin/menu/new" class="inline-flex items-center justify-center rounded-lg bg-zinc-950 dark:bg-white px-3.5 py-2.5 text-sm font-semibold text-white dark:text-zinc-950 hover:bg-zinc-800 dark:hover:bg-zinc-100 transition-colors shadow-sm">
+            <svg class="-ml-0.5 mr-1.5 h-5 w-5" viewBox="0 0 20 20" fill="currentColor">
+              <path d="M10.75 4.75a.75.75 0 00-1.5 0v4.5h-4.5a.75.75 0 000 1.5h4.5v4.5a.75.75 0 001.5 0v-4.5h4.5a.75.75 0 000-1.5h-4.5v-4.5z"/>
+            </svg>
+            Add Link
+          </a>
+        </div>
+      </div>
+
+      ${messageBanner}
+
+      <div class="rounded-xl overflow-hidden bg-white dark:bg-zinc-900 shadow-sm ring-1 ring-zinc-950/5 dark:ring-white/10">
+        <table class="min-w-full divide-y divide-zinc-200 dark:divide-zinc-800">
+          <thead>
+            <tr class="bg-zinc-50 dark:bg-zinc-800/50">
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider w-16">Order</th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider w-16">Icon</th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">Label</th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">URL</th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">Source</th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">Visible</th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">Actions</th>
+            </tr>
+          </thead>
+          <tbody class="divide-y divide-zinc-100 dark:divide-zinc-800">
+            ${rows}
+            ${emptyState}
+          </tbody>
+        </table>
+      </div>
+    </div>
+  `;
+  const layoutData = {
+    title: "Menu Manager",
+    pageTitle: "Menu Manager",
+    currentPath: data.currentPath ?? "/admin/menu",
+    user: data.user,
+    version: data.version,
+    dynamicMenuItems: data.dynamicMenuItems,
+    content: pageContent
+  };
+  return renderAdminLayoutCatalyst(layoutData);
+}
+function renderMenuSettingsContent(items, pluginStatuses = {}, message) {
+  const messageBanner = "";
+  const rows = items.map((item, index) => {
+    const isFirst = index === 0;
+    const isLast = index === items.length - 1;
+    const moveUpForm = !isFirst ? `<form method="POST" action="/admin/menu/${escapeHtml(item.id)}/move-up" class="inline">
+          <button type="submit" class="p-1 rounded hover:bg-zinc-100 dark:hover:bg-zinc-700 text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-200 transition-colors" title="Move up">
+            <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 15l7-7 7 7"/></svg>
+          </button>
+        </form>` : `<span class="w-6 inline-block"></span>`;
+    const moveDownForm = !isLast ? `<form method="POST" action="/admin/menu/${escapeHtml(item.id)}/move-down" class="inline">
+          <button type="submit" class="p-1 rounded hover:bg-zinc-100 dark:hover:bg-zinc-700 text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-200 transition-colors" title="Move down">
+            <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7"/></svg>
+          </button>
+        </form>` : `<span class="w-6 inline-block"></span>`;
+    const deleteButton = item.source === "user" ? `<form method="POST" action="/admin/menu/${escapeHtml(item.id)}/delete" onsubmit="return confirm('Delete this item?')" class="inline">
+          <button type="submit" class="inline-flex items-center px-2.5 py-1.5 text-xs font-medium rounded-md text-red-700 dark:text-red-400 bg-red-50 dark:bg-red-500/10 hover:bg-red-100 dark:hover:bg-red-500/20 ring-1 ring-inset ring-red-600/20 dark:ring-red-500/20 transition-colors">Delete</button>
+        </form>` : "";
+    return `
+      <tr class="border-b border-zinc-100 dark:border-zinc-800 hover:bg-zinc-50/50 dark:hover:bg-zinc-800/30 transition-colors cursor-pointer" onclick="if(!event.target.closest('a,button,input,form')){window.location='/admin/menu/${escapeHtml(item.id)}'}">
+        <td class="px-4 py-3 w-16">
+          <div class="flex items-center gap-0.5">${moveUpForm}${moveDownForm}</div>
+        </td>
+        <td class="px-4 py-3 w-16">${iconPreview(item.icon)}</td>
+        <td class="px-4 py-3">
+          <span class="text-sm font-medium text-zinc-900 dark:text-zinc-100">${escapeHtml(item.label)}</span>
+          ${item.parent ? `<span class="ml-2 text-xs text-zinc-400 dark:text-zinc-500">child</span>` : ""}
+        </td>
+        <td class="px-4 py-3 max-w-[200px]">
+          <span class="text-sm text-zinc-500 dark:text-zinc-400 truncate block">${escapeHtml(item.url)}</span>
+        </td>
+        <td class="px-4 py-3">${sourceBadge(item.source)}${item.source === "plugin" && item.pluginId ? pluginStatusBadge(pluginStatuses[item.pluginId] ?? "active") : ""}</td>
+        <td class="px-4 py-3">
+          <form method="POST" action="/admin/menu/${escapeHtml(item.id)}/visibility" class="inline">
+            <label class="relative inline-flex items-center cursor-pointer">
+              <input type="checkbox" name="visible" value="true" ${item.visible ? "checked" : ""} onchange="this.form.requestSubmit()" class="sr-only peer">
+              <div class="w-9 h-5 bg-zinc-200 dark:bg-zinc-700 peer-focus:outline-none peer-focus:ring-2 peer-focus:ring-cyan-500 rounded-full peer peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-zinc-300 after:border after:rounded-full after:h-4 after:w-4 after:transition-all peer-checked:bg-cyan-600"></div>
+            </label>
+          </form>
+        </td>
+        <td class="px-4 py-3">
+          <div class="flex items-center gap-2">
+            <a href="/admin/menu/${escapeHtml(item.id)}" class="inline-flex items-center px-2.5 py-1.5 text-xs font-medium rounded-md text-zinc-700 dark:text-zinc-300 bg-zinc-100 dark:bg-zinc-700 hover:bg-zinc-200 dark:hover:bg-zinc-600 ring-1 ring-inset ring-zinc-300/50 dark:ring-zinc-600/50 transition-colors">Edit</a>
+            ${deleteButton}
+          </div>
+        </td>
+      </tr>`;
+  }).join("\n");
+  const emptyState = items.length === 0 ? `<tr><td colspan="7" class="px-4 py-12 text-center text-sm text-zinc-400 dark:text-zinc-500">No menu items yet. <a href="/admin/menu/new" class="text-cyan-600 dark:text-cyan-400 underline hover:no-underline">Add a link</a> to get started.</td></tr>` : "";
+  return `
+    <script>
+      (function() {
+        function getCsrfToken() {
+          var c = document.cookie.split('; ').find(function(r) { return r.startsWith('csrf_token='); });
+          return c ? c.substring(c.indexOf('=') + 1) : '';
+        }
+        document.addEventListener('submit', function(e) {
+          var form = e.target;
+          if (!form || form.tagName !== 'FORM') return;
+          if ((form.method || 'GET').toUpperCase() === 'GET') return;
+          if (!form.querySelector('input[name="_csrf"]')) {
+            var input = document.createElement('input');
+            input.type = 'hidden';
+            input.name = '_csrf';
+            input.value = getCsrfToken();
+            form.appendChild(input);
+          }
+        });
+      })();
+    </script>
+    <div>
+      <div class="flex items-center justify-between mb-4">
+        <p class="text-sm text-zinc-500 dark:text-zinc-400">Manage navigation links and their order in the sidebar.</p>
+        <a href="/admin/menu/new" class="inline-flex items-center justify-center rounded-lg bg-zinc-950 dark:bg-white px-3 py-2 text-sm font-semibold text-white dark:text-zinc-950 hover:bg-zinc-800 dark:hover:bg-zinc-100 transition-colors shadow-sm">
+          <svg class="-ml-0.5 mr-1.5 h-4 w-4" viewBox="0 0 20 20" fill="currentColor"><path d="M10.75 4.75a.75.75 0 00-1.5 0v4.5h-4.5a.75.75 0 000 1.5h4.5v4.5a.75.75 0 001.5 0v-4.5h4.5a.75.75 0 000-1.5h-4.5v-4.5z"/></svg>
+          Add Link
+        </a>
+      </div>
+      ${messageBanner}
+      <div class="rounded-xl overflow-hidden bg-white dark:bg-zinc-900 shadow-sm ring-1 ring-zinc-950/5 dark:ring-white/10">
+        <table class="min-w-full divide-y divide-zinc-200 dark:divide-zinc-800">
+          <thead>
+            <tr class="bg-zinc-50 dark:bg-zinc-800/50">
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider w-16">Order</th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider w-16">Icon</th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">Label</th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">URL</th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">Source</th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">Visible</th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">Actions</th>
+            </tr>
+          </thead>
+          <tbody class="divide-y divide-zinc-100 dark:divide-zinc-800">
+            ${rows}
+            ${emptyState}
+          </tbody>
+        </table>
+      </div>
+    </div>
+  `;
+}
+
+// src/plugins/core-plugins/menu-plugin/templates/admin-menu-form.template.ts
+init_admin_layout_catalyst_template();
+
+// src/plugins/core-plugins/menu-plugin/templates/icon-picker.template.ts
+var ICONS = [
+  {
+    name: "puzzle-piece",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11 4a2 2 0 114 0v1a1 1 0 001 1h3a1 1 0 011 1v3a1 1 0 01-1 1h-1a2 2 0 100 4h1a1 1 0 011 1v3a1 1 0 01-1 1h-3a1 1 0 01-1-1v-1a2 2 0 10-4 0v1a1 1 0 01-1 1H7a1 1 0 01-1-1v-3a1 1 0 00-1-1H4a2 2 0 110-4h1a1 1 0 001-1V7a1 1 0 011-1h3a1 1 0 001-1V4z"/>'
+  },
+  {
+    name: "document",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M7 21h10a2 2 0 002-2V9.414a1 1 0 00-.293-.707l-5.414-5.414A1 1 0 0012.586 3H7a2 2 0 00-2 2v14a2 2 0 002 2z"/>'
+  },
+  {
+    name: "collection",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 11H5m14 0a2 2 0 012 2v6a2 2 0 01-2 2H5a2 2 0 01-2-2v-6a2 2 0 012-2m14 0V9a2 2 0 00-2-2M5 11V9a2 2 0 012-2m0 0V5a2 2 0 012-2h6a2 2 0 012 2v2M7 7h10"/>'
+  },
+  {
+    name: "users",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4.354a4 4 0 110 5.292M15 21H3v-1a6 6 0 0112 0v1zm0 0h6v-1a6 6 0 00-9-5.197M13 7a4 4 0 11-8 0 4 4 0 018 0z"/>'
+  },
+  {
+    name: "cog",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10.325 4.317c.426-1.756 2.924-1.756 3.35 0a1.724 1.724 0 002.573 1.066c1.543-.94 3.31.826 2.37 2.37a1.724 1.724 0 001.065 2.572c1.756.426 1.756 2.924 0 3.35a1.724 1.724 0 00-1.066 2.573c.94 1.543-.826 3.31-2.37 2.37a1.724 1.724 0 00-2.572 1.065c-.426 1.756-2.924 1.756-3.35 0a1.724 1.724 0 00-2.573-1.066c-1.543.94-3.31-.826-2.37-2.37a1.724 1.724 0 00-1.065-2.572c-1.756-.426-1.756-2.924 0-3.35a1.724 1.724 0 001.066-2.573c-.94-1.543.826-3.31 2.37-2.37.996.608 2.296.07 2.572-1.065z"/><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z"/>'
+  },
+  {
+    name: "envelope",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z"/>'
+  },
+  {
+    name: "chart",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 19v-6a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2a2 2 0 002-2zm0 0V9a2 2 0 012-2h2a2 2 0 012 2v10m-6 0a2 2 0 002 2h2a2 2 0 002-2m0 0V5a2 2 0 012-2h2a2 2 0 012 2v14a2 2 0 01-2 2h-2a2 2 0 01-2-2z"/>'
+  },
+  {
+    name: "bolt",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z"/>'
+  },
+  {
+    name: "sparkles",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 3v4M3 5h4M6 17v4m-2-2h4m5-16l2.286 6.857L21 12l-5.714 2.143L13 21l-2.286-6.857L5 12l5.714-2.143L13 3z"/>'
+  },
+  {
+    name: "photo",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 16l4.586-4.586a2 2 0 012.828 0L16 16m-2-2l1.586-1.586a2 2 0 012.828 0L20 14m-6-6h.01M6 20h12a2 2 0 002-2V6a2 2 0 00-2-2H6a2 2 0 00-2 2v12a2 2 0 002 2z"/>'
+  },
+  {
+    name: "lock",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z"/>'
+  },
+  {
+    name: "magnifying-glass",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z"/>'
+  },
+  {
+    name: "chart-bar",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 19v-6a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2a2 2 0 002-2zm0 0V9a2 2 0 012-2h2a2 2 0 012 2v10m-6 0a2 2 0 002 2h2a2 2 0 002-2m0 0V5a2 2 0 012-2h2a2 2 0 012 2v14a2 2 0 01-2 2h-2a2 2 0 01-2-2z"/>'
+  },
+  {
+    name: "image",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 16l4.586-4.586a2 2 0 012.828 0L16 16m-2-2l1.586-1.586a2 2 0 012.828 0L20 14m-6-6h.01M6 20h12a2 2 0 002-2V6a2 2 0 00-2-2H6a2 2 0 00-2 2v12a2 2 0 002 2z"/>'
+  },
+  {
+    name: "key",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z"/>'
+  },
+  {
+    name: "shield-check",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/>'
+  },
+  {
+    name: "credit-card",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 10h18M7 15h1m4 0h1m-7 4h12a3 3 0 003-3V8a3 3 0 00-3-3H6a3 3 0 00-3 3v8a3 3 0 003 3z"/>'
+  },
+  {
+    name: "document-text",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12h6m-6 4h6m2 5H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z"/>'
+  },
+  {
+    name: "pencil-square",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11 5H6a2 2 0 00-2 2v11a2 2 0 002 2h11a2 2 0 002-2v-5m-1.414-9.414a2 2 0 112.828 2.828L11.828 15H9v-2.828l8.586-8.586z"/>'
+  },
+  {
+    name: "server",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 12h14M5 12a2 2 0 01-2-2V6a2 2 0 012-2h14a2 2 0 012 2v4a2 2 0 01-2 2M5 12a2 2 0 00-2 2v4a2 2 0 002 2h14a2 2 0 002-2v-4a2 2 0 00-2-2m-2-4h.01M17 16h.01"/>'
+  },
+  {
+    name: "building-office",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 21V5a2 2 0 00-2-2H7a2 2 0 00-2 2v16m14 0h2m-2 0h-5m-9 0H3m2 0h5M9 7h1m-1 4h1m4-4h1m-1 4h1m-5 10v-5a1 1 0 011-1h2a1 1 0 011 1v5m-4 0h4"/>'
+  },
+  {
+    name: "home",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 12l2-2m0 0l7-7 7 7M5 10v10a1 1 0 001 1h3m10-11l2 2m-2-2v10a1 1 0 01-1 1h-3m-6 0a1 1 0 001-1v-4a1 1 0 011-1h2a1 1 0 011 1v4a1 1 0 001 1m-6 0h6"/>'
+  },
+  {
+    name: "star",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11.049 2.927c.3-.921 1.603-.921 1.902 0l1.519 4.674a1 1 0 00.95.69h4.915c.969 0 1.371 1.24.588 1.81l-3.976 2.888a1 1 0 00-.363 1.118l1.518 4.674c.3.922-.755 1.688-1.538 1.118l-3.976-2.888a1 1 0 00-1.176 0l-3.976 2.888c-.783.57-1.838-.197-1.538-1.118l1.518-4.674a1 1 0 00-.363-1.118l-3.976-2.888c-.784-.57-.38-1.81.588-1.81h4.914a1 1 0 00.951-.69l1.519-4.674z"/>'
+  },
+  {
+    name: "tag",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M7 7h.01M7 3h5c.512 0 1.024.195 1.414.586l7 7a2 2 0 010 2.828l-7 7a2 2 0 01-2.828 0l-7-7A1.994 1.994 0 013 12V7a4 4 0 014-4z"/>'
+  },
+  {
+    name: "link",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13.828 10.172a4 4 0 00-5.656 0l-4 4a4 4 0 105.656 5.656l1.102-1.101m-.758-4.899a4 4 0 005.656 0l4-4a4 4 0 00-5.656-5.656l-1.1 1.1"/>'
+  },
+  {
+    name: "external-link",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"/>'
+  },
+  {
+    name: "eye",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z"/><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M2.458 12C3.732 7.943 7.523 5 12 5c4.478 0 8.268 2.943 9.542 7-1.274 4.057-5.064 7-9.542 7-4.477 0-8.268-2.943-9.542-7z"/>'
+  },
+  {
+    name: "bars-3",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 6h16M4 12h16M4 18h16"/>'
+  },
+  {
+    name: "arrow-right",
+    svg: '<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M14 5l7 7m0 0l-7 7m7-7H3"/>'
+  }
+];
+function renderIconPicker(selectedIcon) {
+  const safeSelected = escapeHtml(selectedIcon);
+  const iconButtons = ICONS.map(({ name, svg }) => {
+    const isSelected = name === selectedIcon;
+    const selectedClasses = isSelected ? "ring-2 ring-cyan-500 bg-cyan-50 dark:bg-cyan-900/30" : "ring-1 ring-zinc-200 dark:ring-zinc-700 hover:ring-cyan-300 dark:hover:ring-cyan-600 hover:bg-zinc-50 dark:hover:bg-zinc-800";
+    return `
+      <button
+        type="button"
+        data-icon-name="${name}"
+        onclick="selectIcon('${name}')"
+        class="icon-btn flex flex-col items-center gap-1 p-2 rounded-lg transition-all duration-150 ${selectedClasses}"
+        title="${name}"
+      >
+        <svg class="w-6 h-6 text-zinc-700 dark:text-zinc-300" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          ${svg}
+        </svg>
+        <span class="text-[10px] text-zinc-500 dark:text-zinc-400 truncate max-w-[56px] text-center leading-tight">${name}</span>
+      </button>`;
+  }).join("\n");
+  return `
+    <div class="space-y-4">
+      <input type="hidden" name="icon" id="icon-input" value="${safeSelected}">
+
+      <div>
+        <p class="text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-2">Choose an icon</p>
+        <div class="grid grid-cols-6 sm:grid-cols-8 md:grid-cols-10 gap-2 max-h-64 overflow-y-auto p-1 rounded-lg border border-zinc-200 dark:border-zinc-700 bg-white dark:bg-zinc-900">
+          ${iconButtons}
+        </div>
+      </div>
+
+      <div>
+        <label class="text-sm font-medium text-zinc-700 dark:text-zinc-300 block mb-1">Custom SVG (overrides selection above)</label>
+        <textarea
+          id="custom-svg-input"
+          rows="3"
+          placeholder='<svg xmlns="http://www.w3.org/2000/svg" ...>...</svg>'
+          oninput="handleCustomSvg(this.value)"
+          class="w-full rounded-lg border border-zinc-300 dark:border-zinc-600 bg-white dark:bg-zinc-800 px-3 py-2 text-sm text-zinc-900 dark:text-zinc-100 placeholder:text-zinc-400 dark:placeholder:text-zinc-500 focus:outline-none focus:ring-2 focus:ring-cyan-500 font-mono"
+        ></textarea>
+        <p class="mt-1 text-xs text-zinc-400 dark:text-zinc-500">Paste raw SVG markup to use a custom icon.</p>
+      </div>
+    </div>
+
+    <script>
+      (function () {
+        function selectIcon(name) {
+          document.getElementById('icon-input').value = name;
+          document.getElementById('custom-svg-input').value = '';
+          document.querySelectorAll('.icon-btn').forEach(function (btn) {
+            var isSelected = btn.getAttribute('data-icon-name') === name;
+            btn.className = btn.className
+              .replace(/ring-2 ring-cyan-500 bg-cyan-50 dark:bg-cyan-900\\/30/g, '')
+              .replace(/ring-1 ring-zinc-200 dark:ring-zinc-700 hover:ring-cyan-300 dark:hover:ring-cyan-600 hover:bg-zinc-50 dark:hover:bg-zinc-800/g, '')
+              .trim();
+            if (isSelected) {
+              btn.className += ' ring-2 ring-cyan-500 bg-cyan-50 dark:bg-cyan-900/30';
+            } else {
+              btn.className += ' ring-1 ring-zinc-200 dark:ring-zinc-700 hover:ring-cyan-300 dark:hover:ring-cyan-600 hover:bg-zinc-50 dark:hover:bg-zinc-800';
+            }
+          });
+        }
+
+        function handleCustomSvg(value) {
+          var trimmed = value.trim();
+          if (trimmed) {
+            document.getElementById('icon-input').value = trimmed;
+            document.querySelectorAll('.icon-btn').forEach(function (btn) {
+              btn.className = btn.className
+                .replace(/ring-2 ring-cyan-500 bg-cyan-50 dark:bg-cyan-900\\/30/g, '')
+                .replace(/ring-1 ring-zinc-200 dark:ring-zinc-700 hover:ring-cyan-300 dark:hover:ring-cyan-600 hover:bg-zinc-50 dark:hover:bg-zinc-800/g, '')
+                .trim();
+              btn.className += ' ring-1 ring-zinc-200 dark:ring-zinc-700 hover:ring-cyan-300 dark:hover:ring-cyan-600 hover:bg-zinc-50 dark:hover:bg-zinc-800';
+            });
+          }
+        }
+
+        window.selectIcon = selectIcon;
+        window.handleCustomSvg = handleCustomSvg;
+      })();
+    </script>
+  `;
+}
+
+// src/plugins/core-plugins/menu-plugin/templates/admin-menu-form.template.ts
+function renderMenuFormPage(data) {
+  const { item, topLevelItems } = data;
+  const isEdit = item !== null;
+  const errorBanner = data.error ? `<div class="mb-6 rounded-lg bg-red-50 dark:bg-red-900/20 border border-red-200 dark:border-red-700 px-4 py-3 text-sm text-red-800 dark:text-red-300">
+        ${escapeHtml(data.error)}
+      </div>` : "";
+  const parentOptions = topLevelItems.filter((t) => !isEdit || t.id !== item?.id).sort((a, b) => a.label.localeCompare(b.label)).map((t) => {
+    const selected = item?.parent === t.id ? "selected" : "";
+    return `<option value="${escapeHtml(t.id)}" ${selected}>${escapeHtml(t.label)}</option>`;
+  }).join("\n");
+  const targetSelfSelected = !item || item.target === "_self" ? "selected" : "";
+  const targetBlankSelected = item?.target === "_blank" ? "selected" : "";
+  const visibleChecked = item ? item.visible ? "checked" : "" : "checked";
+  const formAttrs = isEdit ? `method="POST" action="/admin/menu/${escapeHtml(item.id)}/update"` : `method="POST" action="/admin/menu"`;
+  const submitLabel = isEdit ? "Save Changes" : "Add Item";
+  const pageTitle = isEdit ? `Edit: ${escapeHtml(item.label)}` : "Add Menu Item";
+  const pageContent = `
+    <div class="max-w-2xl">
+      <div class="mb-6">
+        <a href="/admin/menu" class="inline-flex items-center gap-1.5 text-sm text-zinc-500 dark:text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-200 transition-colors">
+          <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 19l-7-7 7-7"/>
+          </svg>
+          Back to Menu Manager
+        </a>
+        <h1 class="mt-3 text-2xl/8 font-semibold text-zinc-950 dark:text-white sm:text-xl/8">${pageTitle}</h1>
+      </div>
+
+      ${errorBanner}
+
+      <div class="rounded-xl bg-white dark:bg-zinc-900 shadow-sm ring-1 ring-zinc-950/5 dark:ring-white/10 p-6">
+        <form ${formAttrs} class="space-y-6">
+
+          <div>
+            <label for="menu-label" class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1">
+              Label <span class="text-red-500">*</span>
+            </label>
+            <input
+              id="menu-label"
+              type="text"
+              name="label"
+              required
+              value="${isEdit ? escapeHtml(item.label) : ""}"
+              placeholder="e.g. Documentation"
+              class="w-full rounded-lg border border-zinc-300 dark:border-zinc-600 bg-white dark:bg-zinc-800 px-3 py-2 text-sm text-zinc-900 dark:text-zinc-100 placeholder:text-zinc-400 dark:placeholder:text-zinc-500 focus:outline-none focus:ring-2 focus:ring-cyan-500 transition-shadow"
+            >
+          </div>
+
+          <div>
+            <label for="menu-url" class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1">URL</label>
+            <input
+              id="menu-url"
+              type="text"
+              name="url"
+              value="${isEdit ? escapeHtml(item.url) : ""}"
+              placeholder="/path/to/page or https://example.com"
+              class="w-full rounded-lg border border-zinc-300 dark:border-zinc-600 bg-white dark:bg-zinc-800 px-3 py-2 text-sm text-zinc-900 dark:text-zinc-100 placeholder:text-zinc-400 dark:placeholder:text-zinc-500 focus:outline-none focus:ring-2 focus:ring-cyan-500 transition-shadow"
+            >
+          </div>
+
+          <div class="grid grid-cols-2 gap-4">
+            <div>
+              <label for="menu-target" class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1">Open in</label>
+              <select
+                id="menu-target"
+                name="target"
+                class="w-full rounded-lg border border-zinc-300 dark:border-zinc-600 bg-white dark:bg-zinc-800 px-3 py-2 text-sm text-zinc-900 dark:text-zinc-100 focus:outline-none focus:ring-2 focus:ring-cyan-500 transition-shadow"
+              >
+                <option value="_self" ${targetSelfSelected}>Same tab</option>
+                <option value="_blank" ${targetBlankSelected}>New tab</option>
+              </select>
+            </div>
+
+            <div>
+              <label for="menu-parent" class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-1">Parent</label>
+              <select
+                id="menu-parent"
+                name="parent"
+                class="w-full rounded-lg border border-zinc-300 dark:border-zinc-600 bg-white dark:bg-zinc-800 px-3 py-2 text-sm text-zinc-900 dark:text-zinc-100 focus:outline-none focus:ring-2 focus:ring-cyan-500 transition-shadow"
+              >
+                <option value="">Top level (none)</option>
+                ${parentOptions}
+              </select>
+            </div>
+          </div>
+
+          <div class="flex items-center gap-3">
+            <label class="relative inline-flex items-center cursor-pointer">
+              <input
+                id="menu-visible"
+                type="checkbox"
+                name="visible"
+                value="1"
+                ${visibleChecked}
+                class="sr-only peer"
+              >
+              <div class="w-9 h-5 bg-zinc-200 dark:bg-zinc-700 peer-focus:outline-none peer-focus:ring-2 peer-focus:ring-cyan-500 rounded-full peer peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-zinc-300 after:border after:rounded-full after:h-4 after:w-4 after:transition-all peer-checked:bg-cyan-600"></div>
+            </label>
+            <label for="menu-visible" class="text-sm font-medium text-zinc-700 dark:text-zinc-300 cursor-pointer">Visible in navigation</label>
+          </div>
+
+          <div>
+            <p class="block text-sm font-medium text-zinc-700 dark:text-zinc-300 mb-2">Icon</p>
+            ${renderIconPicker(item?.icon ?? "link")}
+          </div>
+
+          <div class="flex items-center justify-end gap-3 pt-2 border-t border-zinc-100 dark:border-zinc-800">
+            <a href="/admin/menu" class="inline-flex items-center px-3.5 py-2 text-sm font-medium rounded-lg text-zinc-700 dark:text-zinc-300 bg-zinc-100 dark:bg-zinc-700 hover:bg-zinc-200 dark:hover:bg-zinc-600 transition-colors">
+              Cancel
+            </a>
+            <button
+              type="submit"
+              class="inline-flex items-center px-3.5 py-2 text-sm font-semibold rounded-lg bg-zinc-950 dark:bg-white text-white dark:text-zinc-950 hover:bg-zinc-800 dark:hover:bg-zinc-100 transition-colors shadow-sm"
+            >
+              ${submitLabel}
+            </button>
+          </div>
+
+        </form>
+      </div>
+    </div>
+  `;
+  const layoutData = {
+    title: isEdit ? "Edit Menu Item" : "Add Menu Item",
+    pageTitle: isEdit ? "Edit Menu Item" : "Add Menu Item",
+    currentPath: data.currentPath ?? "/admin/menu",
+    user: data.user,
+    version: data.version,
+    dynamicMenuItems: data.dynamicMenuItems,
+    content: pageContent
+  };
+  return renderAdminLayoutCatalyst(layoutData);
+}
+
+// src/plugins/core-plugins/menu-plugin/routes/admin-menu.ts
+function sanitizeUrl(url) {
+  const trimmed = url.trim();
+  if (/^javascript:/i.test(trimmed) || /^data:/i.test(trimmed)) return "";
+  return trimmed;
+}
+var adminMenuRoutes = new Hono();
+adminMenuRoutes.use("*", requireAuth());
+adminMenuRoutes.use("*", requireRole(["admin"]));
+adminMenuRoutes.get("/", async (c) => {
+  const db = c.env.DB;
+  const user = c.get("user");
+  const items = await listMenuItems(db);
+  buildSidebarTree(items);
+  const pluginIds = [...new Set(items.filter((i) => i.pluginId).map((i) => i.pluginId))];
+  const pluginStatuses = await fetchPluginStatuses(db, pluginIds);
+  return c.html(renderMenuListPage({
+    items,
+    pluginStatuses,
+    user,
+    currentPath: "/admin/menu",
+    version: c.get("appVersion"),
+    dynamicMenuItems: c.get("pluginMenuItems"),
+    message: c.req.query("message")
+  }));
+});
+adminMenuRoutes.get("/new", async (c) => {
+  const db = c.env.DB;
+  const topLevelItems = await listMenuItems(db);
+  return c.html(renderMenuFormPage({
+    item: null,
+    topLevelItems: topLevelItems.filter((i) => !i.parent),
+    user: c.get("user"),
+    currentPath: "/admin/menu",
+    version: c.get("appVersion"),
+    dynamicMenuItems: c.get("pluginMenuItems")
+  }));
+});
+adminMenuRoutes.get("/:id", async (c) => {
+  const db = c.env.DB;
+  const id = c.req.param("id");
+  const items = await listMenuItems(db);
+  const item = items.find((i) => i.id === id);
+  if (!item) return c.notFound();
+  const topLevelItems = items.filter((i) => !i.parent && i.id !== id);
+  return c.html(renderMenuFormPage({
+    item,
+    topLevelItems,
+    user: c.get("user"),
+    currentPath: "/admin/menu",
+    version: c.get("appVersion"),
+    dynamicMenuItems: c.get("pluginMenuItems")
+  }));
+});
+adminMenuRoutes.post("/", async (c) => {
+  const db = c.env.DB;
+  const form = await c.req.formData();
+  const label = String(form.get("label") ?? "").trim();
+  const url = String(form.get("url") ?? "").trim();
+  const icon = String(form.get("icon") ?? "link").trim();
+  const target = form.get("target") === "_blank" ? "_blank" : "_self";
+  const parent = String(form.get("parent") ?? "").trim() || null;
+  const visible = form.has("visible");
+  if (!label) {
+    return c.html(renderMenuFormPage({
+      item: null,
+      topLevelItems: [],
+      user: c.get("user"),
+      currentPath: "/admin/menu",
+      version: c.get("appVersion"),
+      dynamicMenuItems: c.get("pluginMenuItems"),
+      error: "Label is required"
+    }), 400);
+  }
+  const now = Math.floor(Date.now() / 1e3);
+  const id = nanoid();
+  const slug = `menu:user:${id}`;
+  const safeUrl = sanitizeUrl(url);
+  const isExternal = /^https?:\/\//.test(safeUrl);
+  const data = JSON.stringify({
+    label,
+    url: safeUrl,
+    icon,
+    target,
+    isExternal,
+    visible,
+    parent,
+    source: "user",
+    pluginId: null,
+    permissions: [],
+    lockedFields: []
+  });
+  const items = await listMenuItems(db);
+  const maxSort = items.reduce((m, i) => Math.max(m, i.sortOrder), 0);
+  const sortOrder = maxSort + 10;
+  await db.prepare(
+    `INSERT INTO documents (id, root_id, type_id, type_version, version_of_id, version_number,
+       is_current_draft, is_published, status, parent_root_id, slug, path, title, zone,
+       sort_order, visible, published_at, scheduled_at, expires_at, deleted_at,
+       tenant_id, locale, translation_group_id, data, metadata,
+       owner_id, created_by, updated_by, created_at, updated_at)
+     VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`
+  ).bind(
+    id,
+    id,
+    "menu_item",
+    1,
+    null,
+    1,
+    1,
+    1,
+    "published",
+    "",
+    slug,
+    null,
+    label,
+    null,
+    sortOrder,
+    visible ? 1 : 0,
+    now,
+    null,
+    null,
+    null,
+    "default",
+    "default",
+    "",
+    data,
+    "{}",
+    null,
+    c.get("user")?.userId ?? "system",
+    c.get("user")?.userId ?? "system",
+    now,
+    now
+  ).run();
+  return c.redirect("/admin/menu?message=Item+created");
+});
+adminMenuRoutes.put("/reorder", async (c) => {
+  const db = c.env.DB;
+  const body = await c.req.json();
+  if (!Array.isArray(body)) return c.json({ error: "Invalid body" }, 400);
+  await reorderItems(db, body);
+  return c.json({ ok: true });
+});
+adminMenuRoutes.post("/:id/visibility", async (c) => {
+  const db = c.env.DB;
+  const id = c.req.param("id");
+  const form = await c.req.formData();
+  const visible = form.get("visible") === "true";
+  await toggleVisibility(db, id, visible);
+  return c.redirect("/admin/menu?message=Visibility+updated");
+});
+async function handleMenuItemUpdate(c) {
+  const db = c.env.DB;
+  const id = c.req.param("id");
+  const form = await c.req.formData();
+  const items = await listMenuItems(db);
+  const item = items.find((i) => i.id === id);
+  if (!item) return c.json({ error: "Not found" }, 404);
+  const locked = new Set(item.lockedFields);
+  const changes = {};
+  if (form.has("label") && !locked.has("label")) changes.label = String(form.get("label")).trim();
+  if (form.has("icon") && !locked.has("icon")) changes.icon = String(form.get("icon")).trim();
+  if (form.has("target") && !locked.has("target")) changes.target = form.get("target") === "_blank" ? "_blank" : "_self";
+  if (form.has("url") && !locked.has("url")) changes.url = sanitizeUrl(String(form.get("url")));
+  if (form.has("parent")) changes.parent = String(form.get("parent")).trim() || null;
+  changes.visible = form.has("visible");
+  const ok = await updateItem(db, id, changes, item.lockedFields);
+  if (!ok) return c.json({ error: "Cannot modify locked fields" }, 403);
+  return c.redirect("/admin/menu?message=Item+updated");
+}
+adminMenuRoutes.put("/:id", handleMenuItemUpdate);
+adminMenuRoutes.post("/:id/update", handleMenuItemUpdate);
+adminMenuRoutes.delete("/:id", async (c) => {
+  const db = c.env.DB;
+  const id = c.req.param("id");
+  const result = await deleteItem(db, id);
+  if (!result.ok) return c.json({ error: result.reason }, 403);
+  return c.redirect("/admin/menu?message=Item+deleted");
+});
+adminMenuRoutes.post("/:id/delete", async (c) => {
+  const db = c.env.DB;
+  const id = c.req.param("id");
+  const result = await deleteItem(db, id);
+  if (!result.ok) return c.json({ error: result.reason }, 403);
+  return c.redirect("/admin/menu?message=Item+deleted");
+});
+adminMenuRoutes.post("/:id/move-up", async (c) => {
+  const db = c.env.DB;
+  const id = c.req.param("id");
+  const allItems = await listMenuItems(db);
+  const cur = allItems.find((i) => i.id === id);
+  if (!cur) return c.redirect("/admin/menu");
+  const siblings = allItems.filter((i) => i.parent === cur.parent);
+  const idx = siblings.findIndex((i) => i.id === id);
+  const prev = siblings[idx - 1];
+  if (idx > 0 && prev) {
+    await reorderItems(db, [
+      { id: cur.id, sortOrder: prev.sortOrder, parent: cur.parent },
+      { id: prev.id, sortOrder: cur.sortOrder, parent: prev.parent }
+    ]);
+    return c.redirect("/admin/menu?message=Reordered");
+  }
+  return c.redirect("/admin/menu");
+});
+adminMenuRoutes.post("/:id/move-down", async (c) => {
+  const db = c.env.DB;
+  const id = c.req.param("id");
+  const allItems = await listMenuItems(db);
+  const cur = allItems.find((i) => i.id === id);
+  if (!cur) return c.redirect("/admin/menu");
+  const siblings = allItems.filter((i) => i.parent === cur.parent);
+  const idx = siblings.findIndex((i) => i.id === id);
+  const next = siblings[idx + 1];
+  if (idx !== -1 && idx < siblings.length - 1 && next) {
+    await reorderItems(db, [
+      { id: cur.id, sortOrder: next.sortOrder, parent: cur.parent },
+      { id: next.id, sortOrder: cur.sortOrder, parent: next.parent }
+    ]);
+    return c.redirect("/admin/menu?message=Reordered");
+  }
+  return c.redirect("/admin/menu");
+});
+var menuPlugin = definePlugin({
+  id: "menu",
+  version: "1.0.0",
+  name: "Menu Manager",
+  description: "Admin sidebar navigation manager.",
+  sonicjsVersionRange: "^3.0.0",
+  author: { name: "SonicJS Team", email: "team@sonicjs.com" },
+  register(app2) {
+    app2.route("/admin/menu", adminMenuRoutes);
+  },
+  async onBoot(ctx) {
+    const env = ctx.env ?? {};
+    const db = env.DB;
+    if (!db) return;
+    try {
+      const typeRegistry = new DocumentTypeRegistry(db);
+      await typeRegistry.register({
+        id: "menu_item",
+        name: "menu_item",
+        displayName: "Menu Item",
+        description: "Admin sidebar navigation item",
+        schema: z.object({}),
+        pluginId: "menu",
+        source: "plugin",
+        queryableFields: [
+          { name: "parent", path: "$.parent", kind: "scalar", type: "text", column: "q_menu_parent" },
+          { name: "visible", path: "$.visible", kind: "scalar", type: "boolean", column: "q_menu_visible" },
+          { name: "source", path: "$.source", kind: "scalar", type: "text", column: "q_menu_source" },
+          { name: "pluginId", path: "$.pluginId", kind: "scalar", type: "text", column: "q_menu_plugin_id" }
+        ],
+        settings: {
+          baseGrants: { admin: ["read", "create", "update", "delete", "manage"] },
+          internal: true
+        }
+      });
+      for (const item of SYSTEM_MENU_ITEMS) {
+        await upsertSystemItem(db, item.id, {
+          label: item.label,
+          url: item.url,
+          icon: item.icon,
+          target: item.target,
+          isExternal: item.isExternal,
+          visible: item.visible,
+          parent: item.parent,
+          source: item.source,
+          pluginId: item.pluginId,
+          permissions: [...item.permissions],
+          lockedFields: [...item.lockedFields]
+        }, item.sortOrder);
+      }
+      await reconcileMenuFromPlugins(db);
+    } catch {
+    }
+  },
+  settingsTabContent: {
+    async loadData(db) {
+      const items = await listMenuItems(db);
+      const pluginIds = [...new Set(items.filter((i) => i.pluginId).map((i) => i.pluginId))];
+      const pluginStatuses = await fetchPluginStatuses(db, pluginIds);
+      return { items, pluginStatuses };
+    },
+    render({ data }) {
+      const items = data?.items ?? [];
+      const pluginStatuses = data?.pluginStatuses ?? {};
+      return renderMenuSettingsContent(items, pluginStatuses);
+    }
+  }
+});
 init_admin_layout_catalyst_template();
 var adminRoutes6 = new Hono();
 adminRoutes6.use("*", requireAuth());
@@ -16762,7 +18192,8 @@ function createSonicJSApp(config = {}) {
     helloWorldPlugin,
     multiTenantPlugin,
     lexicalEditorPlugin,
-    versioningPlugin
+    versioningPlugin,
+    menuPlugin
   ];
   const corePluginsAfterCatchAll = [emailPluginV3, magicLinkPlugin, emailReconciliationPlugin];
   const wirePlugins = createPluginWirer(
@@ -16900,6 +18331,7 @@ function createSonicJSApp(config = {}) {
   app2.use("/admin/*", requireAuth());
   app2.use("/admin/*", requireRbac("portal", "access"));
   app2.use("/admin/*", pluginMenuMiddleware());
+  app2.use("/admin/*", menuMiddleware());
   const NAV_LANDING = [
     { path: "/admin/content", perm: "content:read" },
     { path: "/admin/media", perm: "media:read" },
@@ -20619,10 +22051,837 @@ var site_settings_collection_default = {
 function createDb(d1) {
   return drizzle(d1, { schema: schema_exports });
 }
+var mcpTypeConfigSchema = z.object({
+  read: z.boolean().default(true),
+  write: z.boolean().default(true)
+});
+var mcpConfigSchema = z.object({
+  /** Collections exposed over MCP. Omitted → every active collection. */
+  expose: z.array(z.string()).optional(),
+  /** Per-collection read/write overrides, keyed by collection name. */
+  types: z.record(z.string(), mcpTypeConfigSchema).default({}),
+  /** Field names stripped from every tool response + write schema. */
+  redactFields: z.array(z.string()).default([]),
+  /** Max documents returned by list_* tools and document resources. */
+  listLimit: z.number().int().positive().max(200).default(50)
+});
+function resolveMcpConfig(raw, collections) {
+  const cfg = mcpConfigSchema.parse(raw ?? {});
+  const exposeSet = cfg.expose ? new Set(cfg.expose) : null;
+  const types = collections.filter((c) => exposeSet ? exposeSet.has(c.name) : true).map((c) => {
+    const override = cfg.types[c.name];
+    return {
+      typeId: c.name,
+      displayName: c.displayName ?? c.name,
+      read: override?.read ?? true,
+      write: override?.write ?? true
+    };
+  });
+  return { types, redactFields: cfg.redactFields, listLimit: cfg.listLimit };
+}
+
+// src/plugins/core-plugins/mcp-plugin/schema/field-to-jsonschema.ts
+var SYSTEM_FIELDS = /* @__PURE__ */ new Set([
+  "id",
+  "root_id",
+  "rootId",
+  "created_at",
+  "createdAt",
+  "updated_at",
+  "updatedAt",
+  "version_number",
+  "versionNumber"
+]);
+function fieldToJsonSchema(field) {
+  const base = {};
+  if (field.title) base.title = field.title;
+  if (field.description) base.description = field.description;
+  switch (field.type) {
+    case "number":
+      return {
+        ...base,
+        type: "number",
+        ...field.min != null ? { minimum: field.min } : {},
+        ...field.max != null ? { maximum: field.max } : {}
+      };
+    case "boolean":
+    case "checkbox":
+      return { ...base, type: "boolean" };
+    case "date":
+    case "datetime":
+      return { ...base, type: "string", format: "date-time" };
+    case "select":
+    case "radio":
+      return { ...base, type: "string", ...field.enum ? { enum: field.enum } : {} };
+    case "multiselect":
+      return {
+        ...base,
+        type: "array",
+        items: { type: "string", ...field.enum ? { enum: field.enum } : {} }
+      };
+    case "array":
+      return {
+        ...base,
+        type: "array",
+        items: field.items ? fieldToJsonSchema(field.items) : {}
+      };
+    case "object":
+      return {
+        ...base,
+        type: "object",
+        ...field.properties ? { properties: mapProperties(field.properties) } : {}
+      };
+    case "json":
+      return { ...base };
+    // string-like: string, slug, email, url, richtext, markdown, textarea, editors,
+    // reference, media, color, file, user
+    default: {
+      const node = { ...base, type: "string" };
+      if (field.minLength != null) node.minLength = field.minLength;
+      if (field.maxLength != null) node.maxLength = field.maxLength;
+      if (field.pattern) node.pattern = field.pattern;
+      if (field.format) node.format = field.format;
+      return node;
+    }
+  }
+}
+function mapProperties(props) {
+  const out = {};
+  for (const [name, field] of Object.entries(props)) {
+    out[name] = fieldToJsonSchema(field);
+  }
+  return out;
+}
+function collectionToJsonSchema(schema, opts = {}) {
+  const properties = {};
+  const required = [];
+  const redact2 = new Set(opts.redactFields ?? []);
+  const schemaRequired = new Set(schema.required ?? []);
+  for (const [name, field] of Object.entries(schema.properties ?? {})) {
+    if (redact2.has(name)) continue;
+    if (opts.forWrite && SYSTEM_FIELDS.has(name)) continue;
+    properties[name] = fieldToJsonSchema(field);
+    if (field.required || schemaRequired.has(name)) required.push(name);
+  }
+  return { type: "object", properties, ...required.length ? { required } : {} };
+}
+
+// src/plugins/core-plugins/mcp-plugin/tools/registry.ts
+var PHASE_FLAGS = { includeWrite: true, includeSearch: false };
+var EMPTY_OBJECT_SCHEMA = { type: "object", properties: {} };
+function buildToolRegistry(cfg, collections, opts = {}) {
+  const tools = [];
+  tools.push({
+    name: "list_collections",
+    description: "List every content collection exposed over MCP, with its read/write access.",
+    inputSchema: EMPTY_OBJECT_SCHEMA,
+    op: "list_collections"
+  });
+  if (opts.includeSearch) {
+    tools.push({
+      name: "search_content",
+      description: "Search content across exposed collections by title or slug.",
+      inputSchema: {
+        type: "object",
+        properties: { query: { type: "string", description: "Text matched against document title and slug." } },
+        required: ["query"]
+      },
+      op: "search_content"
+    });
+  }
+  for (const t of cfg.types) {
+    const col = collections.get(t.typeId);
+    const writeSchema = col ? collectionToJsonSchema(col.schema, { forWrite: true, redactFields: cfg.redactFields }) : EMPTY_OBJECT_SCHEMA;
+    if (t.read) {
+      tools.push({
+        name: `list_${t.typeId}`,
+        description: `List ${t.displayName} documents.`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            status: {
+              type: "string",
+              enum: ["published", "draft"],
+              description: "Lifecycle to list. Defaults to published."
+            },
+            limit: { type: "number", description: `Max documents to return (capped at ${cfg.listLimit}).` }
+          }
+        },
+        op: "list",
+        typeId: t.typeId
+      });
+      tools.push({
+        name: `get_${t.typeId}`,
+        description: `Get one ${t.displayName} document by id or slug.`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            id: { type: "string", description: "Document id or root id." },
+            slug: { type: "string", description: "Document slug (alternative to id)." }
+          }
+        },
+        op: "get",
+        typeId: t.typeId
+      });
+    }
+    if (opts.includeWrite && t.write) {
+      tools.push({
+        name: `create_${t.typeId}`,
+        description: `Create a ${t.displayName} document.`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            title: { type: "string" },
+            slug: { type: "string" },
+            data: writeSchema,
+            publish: { type: "boolean", description: "Publish immediately. Defaults to false (draft)." }
+          }
+        },
+        op: "create",
+        typeId: t.typeId
+      });
+      tools.push({
+        name: `update_${t.typeId}`,
+        description: `Update a ${t.displayName} document (saves a new draft).`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            id: { type: "string", description: "Root id of the document to update." },
+            title: { type: "string" },
+            slug: { type: "string" },
+            data: writeSchema
+          },
+          required: ["id"]
+        },
+        op: "update",
+        typeId: t.typeId
+      });
+      tools.push({
+        name: `publish_${t.typeId}`,
+        description: `Publish a ${t.displayName} document.`,
+        inputSchema: {
+          type: "object",
+          properties: { id: { type: "string", description: "Root id of the document to publish." } },
+          required: ["id"]
+        },
+        op: "publish",
+        typeId: t.typeId
+      });
+      tools.push({
+        name: `delete_${t.typeId}`,
+        description: `Delete a ${t.displayName} document.`,
+        inputSchema: {
+          type: "object",
+          properties: { id: { type: "string", description: "Root id of the document to delete." } },
+          required: ["id"]
+        },
+        op: "delete",
+        typeId: t.typeId
+      });
+    }
+  }
+  return tools;
+}
+
+// src/plugins/core-plugins/mcp-plugin/jsonrpc.ts
+var JSON_RPC = {
+  PARSE_ERROR: -32700,
+  INVALID_REQUEST: -32600,
+  METHOD_NOT_FOUND: -32601,
+  INVALID_PARAMS: -32602,
+  INTERNAL_ERROR: -32603,
+  /** Custom: no valid API key on the request. */
+  UNAUTHORIZED: -32001
+};
+var McpToolError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "McpToolError";
+  }
+};
+function rpcResult(id, result) {
+  return { jsonrpc: "2.0", id: id ?? null, result };
+}
+function rpcError(id, code, message, data) {
+  return { jsonrpc: "2.0", id: id ?? null, error: { code, message, ...{} } };
+}
+function parseJsonRpc(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return { error: { code: JSON_RPC.INVALID_REQUEST, message: "Request must be a JSON object" } };
+  }
+  const b = body;
+  if (b.jsonrpc !== "2.0") {
+    return { error: { code: JSON_RPC.INVALID_REQUEST, message: 'jsonrpc must be "2.0"' } };
+  }
+  if (typeof b.method !== "string" || b.method.length === 0) {
+    return { error: { code: JSON_RPC.INVALID_REQUEST, message: "method must be a non-empty string" } };
+  }
+  const id = b.id === void 0 ? null : b.id;
+  const params = b.params && typeof b.params === "object" && !Array.isArray(b.params) ? b.params : {};
+  return { jsonrpc: "2.0", id, method: b.method, params };
+}
+
+// src/plugins/core-plugins/mcp-plugin/tools/documents.ts
+function redact(data, fields) {
+  if (!fields.length) return data;
+  const out = { ...data };
+  for (const f of fields) delete out[f];
+  return out;
+}
+function shapeDocument(doc, redactFields) {
+  return {
+    id: doc.id,
+    rootId: doc.rootId,
+    typeId: doc.typeId,
+    title: doc.title,
+    slug: doc.slug,
+    status: doc.status,
+    isPublished: doc.isPublished,
+    publishedAt: doc.publishedAt,
+    updatedAt: doc.updatedAt,
+    data: redact(doc.data, redactFields)
+  };
+}
+async function resolveType(ctx, typeId) {
+  const docType = await new DocumentTypeRegistry(ctx.db).findById(typeId);
+  if (!docType || !docType.isActive) throw new McpToolError(`Unknown document type: ${typeId}`);
+  const effTenant = effectiveTenantForType(ctx.tenantId, docType.settings);
+  const repo = new DocumentRepository(ctx.db, effTenant);
+  return { docType, repo };
+}
+async function execList(ctx, typeId, args) {
+  const { docType, repo } = await resolveType(ctx, typeId);
+  const status = args.status === "draft" ? "draft" : "published";
+  const limit = Math.min(Math.max(1, args.limit ?? ctx.listLimit), ctx.listLimit);
+  const now = Math.floor(Date.now() / 1e3);
+  const docs = await repo.list({
+    typeId,
+    status,
+    timeWindow: status === "published",
+    now,
+    limit
+  });
+  const allowed = await Promise.all(
+    docs.map((d) => repo.isAllowed(ctx.principalSet, d.rootId, "read", docType.settings))
+  );
+  return docs.filter((_, i) => allowed[i]).map((d) => shapeDocument(d, ctx.redactFields));
+}
+async function execGet(ctx, typeId, args) {
+  const { docType, repo } = await resolveType(ctx, typeId);
+  let doc = null;
+  if (args.id) {
+    doc = await repo.getById(args.id) ?? await repo.getPublished(args.id) ?? await repo.getCurrentDraft(args.id);
+  } else if (args.slug) {
+    doc = await repo.getBySlug(typeId, args.slug);
+  } else {
+    throw new McpToolError('get requires an "id" or "slug" argument');
+  }
+  if (!doc || doc.typeId !== typeId) throw new McpToolError("Document not found");
+  const ok = await repo.isAllowed(ctx.principalSet, doc.rootId, "read", docType.settings);
+  if (!ok) throw new McpToolError("Document not found");
+  return shapeDocument(doc, ctx.redactFields);
+}
+
+// src/plugins/core-plugins/mcp-plugin/tools/mutations.ts
+async function resolveWriteScope(ctx, typeId) {
+  const docType = await new DocumentTypeRegistry(ctx.db).findById(typeId);
+  if (!docType || !docType.isActive) throw new McpToolError(`Unknown document type: ${typeId}`);
+  const effTenant = effectiveTenantForType(ctx.tenantId, docType.settings);
+  const repo = new DocumentRepository(ctx.db, effTenant);
+  const svc = new DocumentsService(ctx.db, {
+    queryableFields: docType.queryableFields ?? [],
+    typeSchemaVersion: docType.schemaVersion,
+    maxVersionsPerRoot: docType.settings?.maxVersionsPerRoot,
+    tenantId: effTenant,
+    versioning: docType.settings?.versioning ?? false
+  });
+  return { docType, effTenant, repo, svc };
+}
+async function assertAllowed(scope, ctx, rootId, permission) {
+  const ok = await scope.repo.isAllowed(ctx.principalSet, rootId, permission, scope.docType.settings ?? {});
+  if (!ok) throw new McpToolError(`Permission denied: cannot ${permission} ${scope.docType.id}`);
+}
+function applyUserFieldDefaults(data, typeId, userId) {
+  const col = getCollectionRegistry().getByName(typeId);
+  if (!col?.schema?.properties) return data;
+  const props = col.schema.properties;
+  const patched = { ...data };
+  for (const [name, field] of Object.entries(props)) {
+    if (field.type === "user" && !patched[name]) patched[name] = userId;
+  }
+  return patched;
+}
+async function execCreate(ctx, typeId, args) {
+  const scope = await resolveWriteScope(ctx, typeId);
+  await assertAllowed(scope, ctx, "", "create");
+  const data = redact(applyUserFieldDefaults(args.data ?? {}, typeId, ctx.userId), ctx.redactFields);
+  const input = createDocumentSchema.parse({
+    typeId,
+    tenantId: scope.effTenant,
+    title: args.title ?? null,
+    slug: args.slug ?? null,
+    data,
+    ownerId: ctx.userId,
+    publishOnCreate: Boolean(args.publish)
+  });
+  const doc = await scope.svc.create(input, ctx.userId);
+  return shapeDocument(doc, ctx.redactFields);
+}
+async function execUpdate(ctx, typeId, args) {
+  if (!args.id) throw new McpToolError('update requires an "id" (root id)');
+  const scope = await resolveWriteScope(ctx, typeId);
+  const current = await scope.repo.getCurrentDraft(args.id);
+  if (!current || current.typeId !== typeId) throw new McpToolError("Document not found");
+  await assertAllowed(scope, ctx, args.id, "update");
+  const patch = updateDocumentSchema.parse({
+    ...args.title !== void 0 ? { title: args.title } : {},
+    ...args.slug !== void 0 ? { slug: args.slug } : {},
+    ...args.data !== void 0 ? { data: redact(args.data, ctx.redactFields) } : {}
+  });
+  const doc = await scope.svc.saveDraft(args.id, patch, ctx.userId);
+  return shapeDocument(doc, ctx.redactFields);
+}
+async function execPublish(ctx, typeId, args) {
+  if (!args.id) throw new McpToolError('publish requires an "id" (root id)');
+  const scope = await resolveWriteScope(ctx, typeId);
+  const current = await scope.repo.getCurrentDraft(args.id);
+  if (!current || current.typeId !== typeId) throw new McpToolError("Document not found");
+  await assertAllowed(scope, ctx, args.id, "publish");
+  const doc = await scope.svc.publish(current.id, ctx.userId);
+  return shapeDocument(doc, ctx.redactFields);
+}
+async function execDelete(ctx, typeId, args) {
+  if (!args.id) throw new McpToolError('delete requires an "id" (root id)');
+  const scope = await resolveWriteScope(ctx, typeId);
+  const current = await scope.repo.getCurrentDraft(args.id) ?? await scope.repo.getPublished(args.id);
+  if (!current || current.typeId !== typeId) throw new McpToolError("Document not found");
+  await assertAllowed(scope, ctx, args.id, "delete");
+  if (scope.docType.settings?.pii) {
+    await scope.svc.erase(args.id, scope.effTenant);
+    return { rootId: args.id, deleted: true, erased: true };
+  }
+  const ids = /* @__PURE__ */ new Set();
+  ids.add(current.id);
+  if (current.isCurrentDraft) {
+    const published = await scope.repo.getPublished(args.id);
+    if (published) ids.add(published.id);
+  } else {
+    const draft = await scope.repo.getCurrentDraft(args.id);
+    if (draft) ids.add(draft.id);
+  }
+  for (const id of ids) await scope.svc.softDelete(id);
+  return { rootId: args.id, deleted: true, erased: false };
+}
+
+// src/plugins/core-plugins/mcp-plugin/tools/static.ts
+function execListCollections(types) {
+  return types.map((t) => ({ typeId: t.typeId, displayName: t.displayName, read: t.read, write: t.write }));
+}
+
+// src/plugins/core-plugins/mcp-plugin/resources/schemas.ts
+function buildResourceList(cfg) {
+  const out = [
+    { uri: "sonicjs://collections", name: "All collections", mimeType: "application/json" }
+  ];
+  for (const t of cfg.types) {
+    out.push({
+      uri: `sonicjs://collections/${t.typeId}/schema`,
+      name: `${t.displayName} schema`,
+      mimeType: "application/json"
+    });
+  }
+  return out;
+}
+var SCHEMA_URI = /^sonicjs:\/\/collections\/([^/]+)\/schema$/;
+function readResource(uri, cfg, collections) {
+  if (uri === "sonicjs://collections") {
+    const list = cfg.types.map((t) => ({
+      typeId: t.typeId,
+      displayName: t.displayName,
+      read: t.read,
+      write: t.write
+    }));
+    return { uri, mimeType: "application/json", text: JSON.stringify(list, null, 2) };
+  }
+  const m = uri.match(SCHEMA_URI);
+  if (m) {
+    const typeId = m[1];
+    const exposed = cfg.types.find((t) => t.typeId === typeId);
+    const col = collections.get(typeId);
+    if (!exposed || !col) throw new McpToolError(`Unknown collection: ${typeId}`);
+    const schema = collectionToJsonSchema(col.schema, { redactFields: cfg.redactFields });
+    return { uri, mimeType: "application/json", text: JSON.stringify(schema, null, 2) };
+  }
+  throw new McpToolError(`Unknown resource URI: ${uri}`);
+}
+
+// src/plugins/core-plugins/mcp-plugin/routes/mcp.ts
+var SERVER_INFO = { name: "sonicjs-mcp", version: "1.0.0" };
+var PROTOCOL_VERSION = "2024-11-05";
+function createMcpRoutes(options = {}) {
+  const app2 = new Hono();
+  app2.post("/", async (c) => {
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json(rpcError(null, JSON_RPC.PARSE_ERROR, "Invalid JSON"));
+    }
+    const parsed = parseJsonRpc(body);
+    if ("error" in parsed) {
+      const id2 = body && typeof body === "object" ? body.id ?? null : null;
+      return c.json(rpcError(id2, parsed.error.code, parsed.error.message));
+    }
+    const { id, method, params } = parsed;
+    const user = c.get("user");
+    if (!user) {
+      return c.json(
+        rpcError(id, JSON_RPC.UNAUTHORIZED, "Unauthorized: provide a valid API key via Authorization: Bearer sk_...")
+      );
+    }
+    const { tenantId, principalSet, userId } = getDocumentRequestContext(c);
+    const registry = getCollectionRegistry();
+    const active = registry.listActive();
+    const collections = new Map(active.map((col) => [col.name, col]));
+    const cfg = resolveMcpConfig(options, active);
+    const tools = buildToolRegistry(cfg, collections, PHASE_FLAGS);
+    try {
+      switch (method) {
+        case "initialize":
+          return c.json(
+            rpcResult(id, {
+              protocolVersion: PROTOCOL_VERSION,
+              serverInfo: SERVER_INFO,
+              capabilities: { tools: {}, resources: {} }
+            })
+          );
+        case "tools/list":
+          return c.json(
+            rpcResult(id, {
+              tools: tools.map((t) => ({ name: t.name, description: t.description, inputSchema: t.inputSchema }))
+            })
+          );
+        case "tools/call": {
+          const name = typeof params.name === "string" ? params.name : "";
+          const args = params.arguments && typeof params.arguments === "object" ? params.arguments : {};
+          const tool = tools.find((t) => t.name === name);
+          if (!tool) return c.json(rpcError(id, JSON_RPC.METHOD_NOT_FOUND, `Unknown tool: ${name}`));
+          const readCtx = {
+            db: c.env.DB,
+            tenantId,
+            principalSet,
+            listLimit: cfg.listLimit,
+            redactFields: cfg.redactFields
+          };
+          const writeCtx = {
+            db: c.env.DB,
+            tenantId,
+            principalSet,
+            userId: userId ?? "",
+            redactFields: cfg.redactFields
+          };
+          try {
+            let result;
+            switch (tool.op) {
+              case "list_collections":
+                result = execListCollections(cfg.types);
+                break;
+              case "list":
+                result = await execList(readCtx, tool.typeId, args);
+                break;
+              case "get":
+                result = await execGet(readCtx, tool.typeId, args);
+                break;
+              case "create":
+                result = await execCreate(writeCtx, tool.typeId, args);
+                break;
+              case "update":
+                result = await execUpdate(writeCtx, tool.typeId, args);
+                break;
+              case "publish":
+                result = await execPublish(writeCtx, tool.typeId, args);
+                break;
+              case "delete":
+                result = await execDelete(writeCtx, tool.typeId, args);
+                break;
+              default:
+                return c.json(rpcError(id, JSON_RPC.METHOD_NOT_FOUND, `Tool not available: ${name}`));
+            }
+            return c.json(rpcResult(id, { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] }));
+          } catch (e) {
+            if (e instanceof McpToolError) {
+              return c.json(rpcResult(id, { content: [{ type: "text", text: e.message }], isError: true }));
+            }
+            throw e;
+          }
+        }
+        case "resources/list":
+          return c.json(rpcResult(id, { resources: buildResourceList(cfg) }));
+        case "resources/read": {
+          const uri = typeof params.uri === "string" ? params.uri : "";
+          if (!uri) return c.json(rpcError(id, JSON_RPC.INVALID_PARAMS, 'resources/read requires a "uri" param'));
+          try {
+            const contents = readResource(uri, cfg, collections);
+            return c.json(rpcResult(id, { contents: [contents] }));
+          } catch (e) {
+            if (e instanceof McpToolError) return c.json(rpcError(id, JSON_RPC.INVALID_PARAMS, e.message));
+            throw e;
+          }
+        }
+        default:
+          return c.json(rpcError(id, JSON_RPC.METHOD_NOT_FOUND, `Method not found: ${method}`));
+      }
+    } catch (e) {
+      console.error("[mcp] handler error:", e);
+      return c.json(rpcError(id, JSON_RPC.INTERNAL_ERROR, "Internal error"));
+    }
+  });
+  return app2;
+}
+
+// src/plugins/core-plugins/mcp-plugin/admin/templates.ts
+init_admin_layout_catalyst_template();
+function accessBadge(ok) {
+  return ok ? `<span class="inline-flex items-center rounded-full bg-emerald-50 dark:bg-emerald-900/20 px-2 py-0.5 text-xs font-medium text-emerald-700 dark:text-emerald-400 ring-1 ring-emerald-600/20 dark:ring-emerald-400/20">Yes</span>` : `<span class="inline-flex items-center rounded-full bg-zinc-100 dark:bg-zinc-800 px-2 py-0.5 text-xs font-medium text-zinc-500 dark:text-zinc-400 ring-1 ring-zinc-200 dark:ring-zinc-700">No</span>`;
+}
+function toolNamesForType(typeId, tools) {
+  const names = tools.filter((t) => t.typeId === typeId).map((t) => `<code class="text-xs font-mono text-zinc-500 dark:text-zinc-400">${escapeHtml(t.name)}</code>`);
+  return names.length ? names.join('<span class="text-zinc-300 dark:text-zinc-600 mx-1">,</span>') : "\u2014";
+}
+function buildClaudeJson(endpointUrl) {
+  return JSON.stringify(
+    {
+      mcpServers: {
+        sonicjs: {
+          type: "http",
+          url: endpointUrl,
+          headers: { Authorization: "Bearer sk_YOUR_API_KEY" }
+        }
+      }
+    },
+    null,
+    2
+  );
+}
+function buildCursorJson(endpointUrl) {
+  return JSON.stringify(
+    {
+      mcpServers: {
+        sonicjs: {
+          url: endpointUrl,
+          headers: { Authorization: "Bearer sk_YOUR_API_KEY" }
+        }
+      }
+    },
+    null,
+    2
+  );
+}
+function renderMcpDashboardPage(data) {
+  const { endpointUrl, types, tools, user, version, dynamicMenuItems } = data;
+  const safeEndpoint = escapeHtml(endpointUrl);
+  const typeCount = types.length;
+  const toolCount = tools.length;
+  const typeRows = types.length ? types.map(
+    (t) => `
+      <tr class="border-t border-zinc-950/5 dark:border-white/10">
+        <td class="py-3 pr-4 text-sm font-mono text-zinc-950 dark:text-white">${escapeHtml(t.typeId)}</td>
+        <td class="py-3 pr-4 text-sm text-zinc-500 dark:text-zinc-400">${escapeHtml(t.displayName)}</td>
+        <td class="py-3 pr-4">${accessBadge(t.read)}</td>
+        <td class="py-3 pr-4">${accessBadge(t.write)}</td>
+        <td class="py-3 text-sm">${toolNamesForType(t.typeId, tools)}</td>
+      </tr>`
+  ).join("") : `<tr><td colspan="5" class="py-8 text-center text-sm text-zinc-500 dark:text-zinc-400">No collections exposed. Register collections via <code class="font-mono">registerCollections()</code> in your app entry point.</td></tr>`;
+  const claudeJson = escapeHtml(buildClaudeJson(endpointUrl));
+  const cursorJson = escapeHtml(buildCursorJson(endpointUrl));
+  const content2 = `
+    <div class="space-y-8">
+
+      <!-- Header -->
+      <div class="sm:flex sm:items-center sm:justify-between">
+        <div class="sm:flex-auto">
+          <h1 class="text-2xl/8 font-semibold text-zinc-950 dark:text-white sm:text-xl/8">MCP Server</h1>
+          <p class="mt-2 text-sm/6 text-zinc-500 dark:text-zinc-400">
+            Model Context Protocol endpoint for AI agents (Claude Code, Cursor, VS Code). Requests are authenticated with API keys.
+          </p>
+        </div>
+        <div class="mt-4 sm:mt-0 sm:ml-16">
+          <a href="/admin/plugins/api-keys"
+            class="inline-flex items-center justify-center rounded-lg bg-cyan-600 px-4 py-2.5 text-sm font-semibold text-white hover:bg-cyan-500 transition-colors shadow-sm">
+            Mint API Key
+          </a>
+        </div>
+      </div>
+
+      <!-- Status -->
+      <div class="rounded-xl bg-white/80 dark:bg-zinc-900/80 backdrop-blur-xl p-6 ring-1 ring-zinc-950/5 dark:ring-white/10 shadow-sm">
+        <h2 class="text-sm font-semibold text-zinc-950 dark:text-white mb-4">Endpoint</h2>
+        <div class="flex items-center gap-3">
+          <code id="endpoint-url" class="flex-1 rounded-lg bg-zinc-50 dark:bg-zinc-800 px-3 py-2 text-sm font-mono text-zinc-950 dark:text-white ring-1 ring-zinc-950/5 dark:ring-white/5 break-all">${safeEndpoint}</code>
+          <button type="button" onclick="copyEndpoint()"
+            class="shrink-0 rounded-lg bg-zinc-100 dark:bg-zinc-800 px-3 py-2 text-sm font-medium text-zinc-700 dark:text-zinc-300 hover:bg-zinc-200 dark:hover:bg-zinc-700 ring-1 ring-zinc-950/5 dark:ring-white/10 transition-colors">
+            Copy
+          </button>
+        </div>
+        <div class="mt-4 flex flex-wrap gap-4 text-sm text-zinc-500 dark:text-zinc-400">
+          <span>
+            <span class="font-semibold text-zinc-950 dark:text-white">${typeCount}</span>
+            collection${typeCount === 1 ? "" : "s"} exposed
+          </span>
+          <span class="text-zinc-300 dark:text-zinc-600">&middot;</span>
+          <span>
+            <span class="font-semibold text-zinc-950 dark:text-white">${toolCount}</span>
+            tool${toolCount === 1 ? "" : "s"} available
+          </span>
+          <span class="text-zinc-300 dark:text-zinc-600">&middot;</span>
+          <span>Auth via <a href="/admin/plugins/api-keys" class="text-cyan-600 dark:text-cyan-400 hover:underline">API Keys</a></span>
+        </div>
+      </div>
+
+      <!-- Exposed collections table -->
+      <div class="rounded-xl bg-white/80 dark:bg-zinc-900/80 backdrop-blur-xl p-6 ring-1 ring-zinc-950/5 dark:ring-white/10 shadow-sm overflow-x-auto">
+        <h2 class="text-sm font-semibold text-zinc-950 dark:text-white mb-4">Exposed collections</h2>
+        <table class="w-full text-left">
+          <thead>
+            <tr class="text-xs font-semibold uppercase tracking-wide text-zinc-500 dark:text-zinc-400">
+              <th class="pb-2 pr-4">ID</th>
+              <th class="pb-2 pr-4">Display name</th>
+              <th class="pb-2 pr-4">Read</th>
+              <th class="pb-2 pr-4">Write</th>
+              <th class="pb-2">Tools</th>
+            </tr>
+          </thead>
+          <tbody>${typeRows}</tbody>
+        </table>
+      </div>
+
+      <!-- Integration guide -->
+      <div class="rounded-xl bg-white/80 dark:bg-zinc-900/80 backdrop-blur-xl p-6 ring-1 ring-zinc-950/5 dark:ring-white/10 shadow-sm space-y-6">
+        <div>
+          <h2 class="text-sm font-semibold text-zinc-950 dark:text-white mb-1">Integration guide</h2>
+          <p class="text-sm text-zinc-500 dark:text-zinc-400">
+            <a href="/admin/plugins/api-keys" class="text-cyan-600 dark:text-cyan-400 hover:underline">Mint an API key</a>,
+            then paste one of the configs below into your MCP client.
+            Replace <code class="font-mono text-xs">sk_YOUR_API_KEY</code> with the key.
+          </p>
+        </div>
+
+        <!-- Claude Code -->
+        <div>
+          <div class="flex items-center justify-between mb-2">
+            <h3 class="text-sm font-medium text-zinc-700 dark:text-zinc-300">
+              Claude Code &mdash; <code class="font-mono text-xs">~/.claude/mcp.json</code>
+            </h3>
+            <button type="button" onclick="copyConfig('claude-config')"
+              class="text-xs text-zinc-500 dark:text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-200 transition-colors">
+              Copy
+            </button>
+          </div>
+          <pre id="claude-config" class="rounded-lg bg-zinc-950 dark:bg-zinc-800 px-4 py-3 text-sm font-mono text-zinc-100 overflow-x-auto ring-1 ring-zinc-700 dark:ring-zinc-600 whitespace-pre">${claudeJson}</pre>
+        </div>
+
+        <!-- Cursor -->
+        <div>
+          <div class="flex items-center justify-between mb-2">
+            <h3 class="text-sm font-medium text-zinc-700 dark:text-zinc-300">
+              Cursor &mdash; <code class="font-mono text-xs">~/.cursor/mcp.json</code>
+            </h3>
+            <button type="button" onclick="copyConfig('cursor-config')"
+              class="text-xs text-zinc-500 dark:text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-200 transition-colors">
+              Copy
+            </button>
+          </div>
+          <pre id="cursor-config" class="rounded-lg bg-zinc-950 dark:bg-zinc-800 px-4 py-3 text-sm font-mono text-zinc-100 overflow-x-auto ring-1 ring-zinc-700 dark:ring-zinc-600 whitespace-pre">${cursorJson}</pre>
+        </div>
+
+        <p class="text-xs text-zinc-400 dark:text-zinc-500">
+          MCP v1 = HTTP POST only (no SSE stream). Clients that require stdio transport can use
+          <code class="font-mono">npx mcp-remote ${safeEndpoint}</code> as a local bridge.
+        </p>
+      </div>
+
+    </div>
+
+    <script>
+      function copyEndpoint() {
+        navigator.clipboard.writeText(document.getElementById('endpoint-url').textContent.trim()).then(() => {
+          window.showNotification && window.showNotification('Endpoint URL copied', 'success')
+        })
+      }
+      function copyConfig(id) {
+        navigator.clipboard.writeText(document.getElementById(id).textContent).then(() => {
+          window.showNotification && window.showNotification('Config copied', 'success')
+        })
+      }
+    </script>`;
+  const layoutData = {
+    title: "MCP Server",
+    pageTitle: "MCP Server",
+    currentPath: "/admin/mcp",
+    user,
+    content: content2,
+    version,
+    dynamicMenuItems
+  };
+  return renderAdminLayoutCatalyst(layoutData);
+}
+
+// src/plugins/core-plugins/mcp-plugin/admin/routes.ts
+function createMcpAdminRoutes(options = {}) {
+  const routes2 = new Hono();
+  routes2.use("*", requireAuth());
+  routes2.use("*", async (c, next) => {
+    const user = c.get("user");
+    if (user?.role !== "admin") return c.json({ error: "Access denied" }, 403);
+    return next();
+  });
+  routes2.get("/", async (c) => {
+    const url = new URL(c.req.url);
+    const endpointUrl = `${url.protocol}//${url.host}/mcp`;
+    const registry = getCollectionRegistry();
+    const active = registry.listActive();
+    const collections = new Map(active.map((col) => [col.name, col]));
+    const cfg = resolveMcpConfig(options, active);
+    const tools = buildToolRegistry(cfg, collections, PHASE_FLAGS);
+    const user = c.get("user");
+    return c.html(
+      renderMcpDashboardPage({
+        endpointUrl,
+        types: cfg.types,
+        tools,
+        user: { name: user.email, email: user.email, role: user.role },
+        version: c.get("appVersion"),
+        dynamicMenuItems: c.get("pluginMenuItems")
+      })
+    );
+  });
+  return routes2;
+}
+
+// src/plugins/core-plugins/mcp-plugin/index.ts
+var MCP_ICON = `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8 9l3 3-3 3m5 0h3M5 20h14a2 2 0 002-2V6a2 2 0 00-2-2H5a2 2 0 00-2 2v12a2 2 0 002 2z"/></svg>`;
+function mcpPlugin(options = {}) {
+  return definePlugin({
+    id: "mcp",
+    version: "1.0.0",
+    name: "MCP Server",
+    description: "Exposes SonicJS content as Model Context Protocol tools for AI agents (Claude Code, Cursor, \u2026).",
+    sonicjsVersionRange: "^3.0.0",
+    author: { name: "SonicJS Team" },
+    register(app2) {
+      app2.route("/mcp", createMcpRoutes(options));
+      app2.route("/admin/mcp", createMcpAdminRoutes(options));
+    },
+    menu: [{ label: "MCP Server", path: "/admin/mcp", icon: MCP_ICON, order: 87 }]
+  });
+}
+function createMcpPlugin(options) {
+  return mcpPlugin(options);
+}
 
 // src/index.ts
 var VERSION = package_default.version;
 
-export { BUILT_IN_PROVIDERS, CloudflareEmailProvider2 as CloudflareEmailProvider, OAuthService, VERSION, createDb, createHelloWorldPlugin, createOAuthProvidersPlugin, createRedirectPlugin, createSonicJSApp, emailReconciliationPlugin, generateTriggersComment, helloWorldPlugin, oauthProvidersPlugin, parseCronTriggers, redirectPlugin, setupCoreMiddleware, setupCoreRoutes, site_settings_collection_default as siteSettingsCollection, updateWranglerTriggers };
+export { BUILT_IN_PROVIDERS, CloudflareEmailProvider2 as CloudflareEmailProvider, OAuthService, VERSION, createDb, createHelloWorldPlugin, createMcpPlugin, createOAuthProvidersPlugin, createRedirectPlugin, createSonicJSApp, emailReconciliationPlugin, generateTriggersComment, helloWorldPlugin, mcpPlugin, oauthProvidersPlugin, parseCronTriggers, redirectPlugin, setupCoreMiddleware, setupCoreRoutes, site_settings_collection_default as siteSettingsCollection, updateWranglerTriggers };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map