@sonicjs-cms/core 3.0.0-beta.24 → 3.0.0-beta.25

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 export { B as Bindings, a as BootIsolateFn, b as SonicJSApp, S as SonicJSConfig, V as Variables, c as createSonicJSApp, s as setupCoreMiddleware, d as setupCoreRoutes } from './app-aj39TGHB.cjs';
-import { o as DefinedPlugin } from './define-plugin-DMcvEy_C.cjs';
-export { B as BooleanField, e as ConfigSchema, f as ConfigSchemaField, h as CronContext, i as CronDeclaration, j as CronDispatchResult, k as CronTickEvent, l as CronablePlugin, H as HookSystemImpl, r as HookUtils, N as NumberField, P as ParsedField, v as PluginManagerClass, an as PluginMenuEntry, x as PluginRegistryImpl, y as PluginValidatorClass, z as PluginsRegistry, A as RegisterPluginsError, G as RegisterPluginsErrorReason, I as RegisterPluginsHostContext, J as RegisterablePlugin, K as RegistryEntry, ao as ResolvedPluginMenuEntry, L as ScopedHookSystemClass, O as SelectField, Q as SettingsFor, U as StringField, Y as applySchemaDefaults, _ as collectCronSchedules, $ as collectCrons, a2 as createScheduledHandler, a3 as definePlugin, a4 as dispatchCronTick, a5 as getHookSystem, ap as getPluginMenu, a6 as getTypedHooks, a8 as hasHookSystem, a9 as isDefinedPlugin, ae as parseConfigSchema, af as parseFormDataToSettings, ah as registerPlugins, ai as renderSchemaFields, aj as resetHookSystem, aq as resetPluginMenu, ar as resolvePluginMenuItems, ak as setHookSystem, as as setPluginMenu } from './define-plugin-DMcvEy_C.cjs';
+import { o as DefinedPlugin } from './define-plugin-rjXmGOgu.cjs';
+export { B as BooleanField, e as ConfigSchema, f as ConfigSchemaField, h as CronContext, i as CronDeclaration, j as CronDispatchResult, k as CronTickEvent, l as CronablePlugin, H as HookSystemImpl, r as HookUtils, N as NumberField, P as ParsedField, v as PluginManagerClass, an as PluginMenuEntry, x as PluginRegistryImpl, y as PluginValidatorClass, z as PluginsRegistry, A as RegisterPluginsError, G as RegisterPluginsErrorReason, I as RegisterPluginsHostContext, J as RegisterablePlugin, K as RegistryEntry, ao as ResolvedPluginMenuEntry, L as ScopedHookSystemClass, O as SelectField, Q as SettingsFor, U as StringField, Y as applySchemaDefaults, _ as collectCronSchedules, $ as collectCrons, a2 as createScheduledHandler, a3 as definePlugin, a4 as dispatchCronTick, a5 as getHookSystem, ap as getPluginMenu, a6 as getTypedHooks, a8 as hasHookSystem, a9 as isDefinedPlugin, ae as parseConfigSchema, af as parseFormDataToSettings, ah as registerPlugins, ai as renderSchemaFields, aj as resetHookSystem, aq as resetPluginMenu, ar as resolvePluginMenuItems, ak as setHookSystem, as as setPluginMenu } from './define-plugin-rjXmGOgu.cjs';
 import { D1Database as D1Database$1 } from '@cloudflare/workers-types';
 import { z } from 'zod';
 import { E as EmailProvider, N as NormalizedEmailMessage, t as SendResult } from './types-DT7XN5TX.cjs';
@@ -159,6 +159,14 @@ declare class RbacService {
     getRolesForUser(userId: string): Promise<RbacRole[]>;
     /** Grants attached to a set of role ids (from the embedded role grants). */
     private grantsForRoleIds;
+    /**
+     * Does the role (matched by document slug OR data.name) have a grant for resource+verb?
+     * Matches the role principal id from the request context, which can be either the RBAC slug
+     * (e.g. 'role-public') or the legacy role name (e.g. 'public').
+     */
+    isGrantedForRole(roleNameOrSlug: string, resource: string, verb: string): Promise<boolean>;
+    /** True if a role document exists for this id or name. Use to distinguish "no RBAC role → default allow" from "role exists but no grant → deny". */
+    hasRbacRole(idOrName: string): Promise<boolean>;
     /** Does a single grant row satisfy the requested (resource, verb)? */
     private grantMatches;
     private strongestScope;

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { B as Bindings, a as BootIsolateFn, b as SonicJSApp, S as SonicJSConfig, V as Variables, c as createSonicJSApp, s as setupCoreMiddleware, d as setupCoreRoutes } from './app-01M0dIwt.js';
-import { o as DefinedPlugin } from './define-plugin-D_6D9vVZ.js';
-export { B as BooleanField, e as ConfigSchema, f as ConfigSchemaField, h as CronContext, i as CronDeclaration, j as CronDispatchResult, k as CronTickEvent, l as CronablePlugin, H as HookSystemImpl, r as HookUtils, N as NumberField, P as ParsedField, v as PluginManagerClass, an as PluginMenuEntry, x as PluginRegistryImpl, y as PluginValidatorClass, z as PluginsRegistry, A as RegisterPluginsError, G as RegisterPluginsErrorReason, I as RegisterPluginsHostContext, J as RegisterablePlugin, K as RegistryEntry, ao as ResolvedPluginMenuEntry, L as ScopedHookSystemClass, O as SelectField, Q as SettingsFor, U as StringField, Y as applySchemaDefaults, _ as collectCronSchedules, $ as collectCrons, a2 as createScheduledHandler, a3 as definePlugin, a4 as dispatchCronTick, a5 as getHookSystem, ap as getPluginMenu, a6 as getTypedHooks, a8 as hasHookSystem, a9 as isDefinedPlugin, ae as parseConfigSchema, af as parseFormDataToSettings, ah as registerPlugins, ai as renderSchemaFields, aj as resetHookSystem, aq as resetPluginMenu, ar as resolvePluginMenuItems, ak as setHookSystem, as as setPluginMenu } from './define-plugin-D_6D9vVZ.js';
+import { o as DefinedPlugin } from './define-plugin-DDe8a_bh.js';
+export { B as BooleanField, e as ConfigSchema, f as ConfigSchemaField, h as CronContext, i as CronDeclaration, j as CronDispatchResult, k as CronTickEvent, l as CronablePlugin, H as HookSystemImpl, r as HookUtils, N as NumberField, P as ParsedField, v as PluginManagerClass, an as PluginMenuEntry, x as PluginRegistryImpl, y as PluginValidatorClass, z as PluginsRegistry, A as RegisterPluginsError, G as RegisterPluginsErrorReason, I as RegisterPluginsHostContext, J as RegisterablePlugin, K as RegistryEntry, ao as ResolvedPluginMenuEntry, L as ScopedHookSystemClass, O as SelectField, Q as SettingsFor, U as StringField, Y as applySchemaDefaults, _ as collectCronSchedules, $ as collectCrons, a2 as createScheduledHandler, a3 as definePlugin, a4 as dispatchCronTick, a5 as getHookSystem, ap as getPluginMenu, a6 as getTypedHooks, a8 as hasHookSystem, a9 as isDefinedPlugin, ae as parseConfigSchema, af as parseFormDataToSettings, ah as registerPlugins, ai as renderSchemaFields, aj as resetHookSystem, aq as resetPluginMenu, ar as resolvePluginMenuItems, ak as setHookSystem, as as setPluginMenu } from './define-plugin-DDe8a_bh.js';
 import { D1Database as D1Database$1 } from '@cloudflare/workers-types';
 import { z } from 'zod';
 import { E as EmailProvider, N as NormalizedEmailMessage, t as SendResult } from './types-DT7XN5TX.js';
@@ -159,6 +159,14 @@ declare class RbacService {
     getRolesForUser(userId: string): Promise<RbacRole[]>;
     /** Grants attached to a set of role ids (from the embedded role grants). */
     private grantsForRoleIds;
+    /**
+     * Does the role (matched by document slug OR data.name) have a grant for resource+verb?
+     * Matches the role principal id from the request context, which can be either the RBAC slug
+     * (e.g. 'role-public') or the legacy role name (e.g. 'public').
+     */
+    isGrantedForRole(roleNameOrSlug: string, resource: string, verb: string): Promise<boolean>;
+    /** True if a role document exists for this id or name. Use to distinguish "no RBAC role → default allow" from "role exists but no grant → deny". */
+    hasRbacRole(idOrName: string): Promise<boolean>;
     /** Does a single grant row satisfy the requested (resource, verb)? */
     private grantMatches;
     private strongestScope;

package/dist/index.js

@@ -1,37 +1,37 @@
-import { createAuth } from './chunk-SOZUG52O.js';
-import { getEmailService, hasEmailService, setEmailService, reconcileMenuFromPlugins, invalidateVariablesCache, resolveVariablesInObject, resolveDocScope, denyIfNotAllowed, DocumentRepository, dispatchHookEvent, getCustomData, createDocumentSchema, renderTable, getVariablesCached, setVariablesCache, TenantService, isValidMemberRole, renderConfirmationDialog, getConfirmationDialogScript, VALID_MEMBER_ROLES, userProfilesPlugin, lexicalEditorPlugin, api_media_default, api_system_default, apiDocumentsRoutes, api_default, adminDocumentsRoutes, admin_api_default, adminCollectionsRoutes, adminSettingsRoutes, router2, admin_content_default, adminMediaRoutes, router, adminPluginRoutes, adminLogsRoutes, userRoutes, auth_default, test_cleanup_default, getDocumentRequestContext, updateDocumentSchema, effectiveTenantForType } from './chunk-VC5XVPLM.js';
-export { DocumentRepository, ROUTES_INFO, admin_api_default as adminApiRoutes, adminCheckboxRoutes, adminCollectionsRoutes, admin_content_default as adminContentRoutes, router as adminDashboardRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, userRoutes as adminUsersRoutes, api_content_crud_default as apiContentCrudRoutes, api_media_default as apiMediaRoutes, api_default as apiRoutes, api_system_default as apiSystemRoutes, auth_default as authRoutes, createUserProfilesPlugin, defineUserProfile, getUserProfileConfig, userProfilesPlugin } from './chunk-VC5XVPLM.js';
+import { createAuth } from './chunk-3KGY4IBW.js';
+import { getEmailService, hasEmailService, setEmailService, reconcileMenuFromPlugins, invalidateVariablesCache, resolveVariablesInObject, resolveDocScope, denyIfNotAllowed, DocumentRepository, dispatchHookEvent, getCustomData, createDocumentSchema, renderTable, getVariablesCached, setVariablesCache, TenantService, isValidMemberRole, renderConfirmationDialog, getConfirmationDialogScript, VALID_MEMBER_ROLES, userProfilesPlugin, lexicalEditorPlugin, api_media_default, api_system_default, apiDocumentsRoutes, api_default, adminDocumentsRoutes, admin_api_default, adminCollectionsRoutes, adminSettingsRoutes, router2, admin_content_default, adminMediaRoutes, router, adminPluginRoutes, adminLogsRoutes, userRoutes, auth_default, test_cleanup_default, getDocumentRequestContext, updateDocumentSchema, effectiveTenantForType } from './chunk-7P5OCUPS.js';
+export { DocumentRepository, ROUTES_INFO, admin_api_default as adminApiRoutes, adminCheckboxRoutes, adminCollectionsRoutes, admin_content_default as adminContentRoutes, router as adminDashboardRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, userRoutes as adminUsersRoutes, api_content_crud_default as apiContentCrudRoutes, api_media_default as apiMediaRoutes, api_default as apiRoutes, api_system_default as apiSystemRoutes, auth_default as authRoutes, createUserProfilesPlugin, defineUserProfile, getUserProfileConfig, userProfilesPlugin } from './chunk-7P5OCUPS.js';
 import './chunk-VVYVFCML.js';
-import './chunk-BHND5PEV.js';
+import './chunk-E3TQG7AA.js';
 import { SettingsService, setAppInstance } from './chunk-2XAQTPAE.js';
 export { Logger, getLogger, initLogger } from './chunk-2XAQTPAE.js';
 import { getAllCacheStats, CACHE_CONFIGS, getCacheService, clearAllCaches, parseCacheKey } from './chunk-K25XHMM3.js';
 import { schema_exports } from './chunk-AI663NBO.js';
 export { apiTokens, content, contentVersions, insertContentSchema, insertLogConfigSchema, insertMediaSchema, insertPluginActivityLogSchema, insertPluginAssetSchema, insertPluginHookSchema, insertPluginRouteSchema, insertPluginSchema, insertSystemLogSchema, insertUserSchema, insertWorkflowHistorySchema, logConfig, media, pluginActivityLog, pluginAssets, pluginHooks, pluginRoutes, plugins, selectContentSchema, selectLogConfigSchema, selectMediaSchema, selectPluginActivityLogSchema, selectPluginAssetSchema, selectPluginHookSchema, selectPluginRouteSchema, selectPluginSchema, selectSystemLogSchema, selectUserSchema, selectWorkflowHistorySchema, systemLogs, users, workflowHistory } from './chunk-AI663NBO.js';
-import { requireAuth, DocumentTypeRegistry, requireRbac, requireRole, getJwtExpirySecondsFromDb, AuthManager, metricsMiddleware, bootstrapMiddleware, securityHeadersMiddleware, csrfProtection } from './chunk-FHPEM77Y.js';
-export { AuthManager, PermissionManager, bootstrapDocumentTypes, bootstrapMiddleware, cacheHeaders, compressionMiddleware, detailedLoggingMiddleware, getActivePlugins, isPluginActive, logActivity, loggingMiddleware, optionalAuth, performanceLoggingMiddleware, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeadersMiddleware as securityHeaders, securityLoggingMiddleware } from './chunk-FHPEM77Y.js';
-import { RbacService, DocumentsService } from './chunk-3TMTYJAJ.js';
-export { DocumentsService, RbacService } from './chunk-3TMTYJAJ.js';
+import { requireAuth, DocumentTypeRegistry, requireRbac, requireRole, getJwtExpirySecondsFromDb, AuthManager, metricsMiddleware, bootstrapMiddleware, securityHeadersMiddleware, csrfProtection } from './chunk-2OXFMMA3.js';
+export { AuthManager, PermissionManager, bootstrapDocumentTypes, bootstrapMiddleware, cacheHeaders, compressionMiddleware, detailedLoggingMiddleware, getActivePlugins, isPluginActive, logActivity, loggingMiddleware, optionalAuth, performanceLoggingMiddleware, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeadersMiddleware as securityHeaders, securityLoggingMiddleware } from './chunk-2OXFMMA3.js';
+import { RbacService, DocumentsService } from './chunk-BDQ55MWV.js';
+export { DocumentsService, RbacService } from './chunk-BDQ55MWV.js';
 import { nanoid } from './chunk-UWUP2VMT.js';
-import { PluginService, PLUGIN_REGISTRY, invalidateTenantCache, getCollectionRegistry, TENANT_COOKIE, MULTI_TENANT_PLUGIN_ID, collectionRecordToRow, tenantMiddleware } from './chunk-RJ2O5IIE.js';
-export { PluginBootstrapService, PluginService as PluginServiceClass, getAvailableCollectionNames, loadCollectionConfig, loadCollectionConfigs, registerCollections, validateCollectionConfig } from './chunk-RJ2O5IIE.js';
-export { MigrationService } from './chunk-UIHIXTIS.js';
-export { renderFilterBar } from './chunk-URIBTX27.js';
-import { renderAdminLayout } from './chunk-BJROXF4N.js';
-export { getConfirmationDialogScript, renderAlert, renderConfirmationDialog, renderForm, renderFormField, renderPagination, renderTable } from './chunk-BJROXF4N.js';
-import { init_admin_layout_catalyst_template, renderAdminLayoutCatalyst } from './chunk-THFZSDIU.js';
-export { renderAdminLayoutCatalyst } from './chunk-THFZSDIU.js';
-import { TurnstileService, HookSystemImpl, createPluginWirer, registerPluginRoutes } from './chunk-VYQVDL2M.js';
-export { HookSystemImpl, HookUtils, PluginDependencyCycleError, PluginManager as PluginManagerClass, PluginRegistryImpl, PluginValidator as PluginValidatorClass, RegisterPluginsError, ScopedHookSystem as ScopedHookSystemClass, collectCronSchedules, collectCrons, createScheduledHandler, dispatchCronTick, registerPlugins, topoSort } from './chunk-VYQVDL2M.js';
-import { definePlugin, setPluginMenu, setPluginDefinitions, resolvePluginMenuItems } from './chunk-VGEZNFWH.js';
-export { applySchemaDefaults, definePlugin, getPluginMenu, isDefinedPlugin, parseConfigSchema, parseFormDataToSettings, renderSchemaFields, resetPluginMenu, resolvePluginMenuItems, setPluginMenu } from './chunk-VGEZNFWH.js';
+import { PluginService, PLUGIN_REGISTRY, invalidateTenantCache, getCollectionRegistry, TENANT_COOKIE, MULTI_TENANT_PLUGIN_ID, collectionRecordToRow, tenantMiddleware } from './chunk-2D3A4X52.js';
+export { PluginBootstrapService, PluginService as PluginServiceClass, getAvailableCollectionNames, loadCollectionConfig, loadCollectionConfigs, registerCollections, validateCollectionConfig } from './chunk-2D3A4X52.js';
+export { MigrationService } from './chunk-D7RLBBHE.js';
+export { renderFilterBar } from './chunk-73RTFFMX.js';
+import { renderAdminLayout } from './chunk-HSDJDWLV.js';
+export { getConfirmationDialogScript, renderAlert, renderConfirmationDialog, renderForm, renderFormField, renderPagination, renderTable } from './chunk-HSDJDWLV.js';
+import { init_admin_layout_catalyst_template, renderAdminLayoutCatalyst } from './chunk-SXC4HPK6.js';
+export { renderAdminLayoutCatalyst } from './chunk-SXC4HPK6.js';
+import { TurnstileService, HookSystemImpl, createPluginWirer, registerPluginRoutes } from './chunk-F26HP3B6.js';
+export { HookSystemImpl, HookUtils, PluginDependencyCycleError, PluginManager as PluginManagerClass, PluginRegistryImpl, PluginValidator as PluginValidatorClass, RegisterPluginsError, ScopedHookSystem as ScopedHookSystemClass, collectCronSchedules, collectCrons, createScheduledHandler, dispatchCronTick, registerPlugins, topoSort } from './chunk-F26HP3B6.js';
+import { definePlugin, setPluginMenu, setPluginDefinitions, resolvePluginMenuItems } from './chunk-C54MH5UI.js';
+export { applySchemaDefaults, definePlugin, getPluginMenu, isDefinedPlugin, parseConfigSchema, parseFormDataToSettings, renderSchemaFields, resetPluginMenu, resolvePluginMenuItems, setPluginMenu } from './chunk-C54MH5UI.js';
 import { setHookSystem } from './chunk-RNZFGN4R.js';
 export { getHookSystem, getTypedHooks, hasHookSystem, resetHookSystem, setHookSystem } from './chunk-RNZFGN4R.js';
-export { QueryFilterBuilder, TemplateRenderer, buildQuery, renderTemplate, templateRenderer } from './chunk-QZGABF2M.js';
+export { QueryFilterBuilder, TemplateRenderer, buildQuery, renderTemplate, templateRenderer } from './chunk-FVAK4C6L.js';
 export { metricsTracker } from './chunk-FICTAGD4.js';
 import './chunk-X7ZAEI5S.js';
-import { getCoreVersion, package_default } from './chunk-LNI3FYSI.js';
-export { SONICJS_VERSION, getCoreVersion } from './chunk-LNI3FYSI.js';
+import { getCoreVersion, package_default } from './chunk-CWIGQYRR.js';
+export { SONICJS_VERSION, getCoreVersion } from './chunk-CWIGQYRR.js';
 import { escapeHtml, sanitizeInput } from './chunk-TQABQWOP.js';
 export { escapeHtml, sanitizeInput, sanitizeObject } from './chunk-TQABQWOP.js';
 export { HOOKS } from './chunk-QXOZI5Q2.js';
@@ -8112,7 +8112,7 @@ adminRoutes5.get("/settings", async (c) => {
   const db = c.env.DB;
   const user = c.get("user");
   const settings = await getSettings4(db);
-  const { renderAdminLayoutCatalyst: renderAdminLayoutCatalyst2 } = await import('./admin-layout-catalyst.template-6UQGLCKI.js');
+  const { renderAdminLayoutCatalyst: renderAdminLayoutCatalyst2 } = await import('./admin-layout-catalyst.template-WCYMQVTZ.js');
   const content2 = `
     <div>
       <div class="mb-6">
@@ -11727,9 +11727,9 @@ function pluginMenuMiddleware() {
     if (!path.startsWith("/admin")) {
       return next();
     }
+    const db = c.env.DB;
     let activeMenuItems = [];
     try {
-      const db = c.env.DB;
       const pluginIds = REGISTRY_MENU_PLUGINS.map((p) => p.id);
       if (pluginIds.length > 0) {
         const placeholders = pluginIds.map(() => "?").join(",");
@@ -11753,9 +11753,24 @@ function pluginMenuMiddleware() {
     }
     const user = c.get("user");
     const singletonItems = resolvePluginMenuItems(user ? { role: user.role } : void 0);
+    const singletonPluginIds = [...new Set(
+      singletonItems.map((i) => i.pluginId).filter((id) => !!id)
+    )];
+    let activeSingletonIds = /* @__PURE__ */ new Set();
+    try {
+      if (singletonPluginIds.length > 0) {
+        const ph = singletonPluginIds.map(() => "?").join(",");
+        const result = await db.prepare(
+          `SELECT slug FROM documents WHERE type_id = 'plugin' AND tenant_id = 'default' AND slug IN (${ph}) AND q_plugin_status = 'active' AND is_current_draft = 1 AND deleted_at IS NULL`
+        ).bind(...singletonPluginIds).all();
+        activeSingletonIds = new Set((result.results || []).map((r) => r.slug));
+      }
+    } catch {
+    }
     const existingPaths = new Set(activeMenuItems.map((i) => i.path));
     for (const item of singletonItems) {
-      if (!existingPaths.has(item.path)) {
+      const isActive = !item.pluginId || activeSingletonIds.has(item.pluginId);
+      if (isActive && !existingPaths.has(item.path)) {
         activeMenuItems.push({ label: item.label, path: item.path, icon: item.icon, order: item.order });
       }
     }
@@ -18250,7 +18265,7 @@ function createSonicJSApp(config = {}) {
     await next();
   });
   app2.use("*", metricsMiddleware());
-  app2.use("*", bootstrapMiddleware(config));
+  app2.use("*", bootstrapMiddleware(config, [...corePluginsBeforeCatchAll, ...corePluginsAfterCatchAll, ...config.plugins?.register ?? []]));
   const boot = async (env) => {
     if (config.plugins?.disableAll) return;
     firstRequestEnv = env;
@@ -18322,6 +18337,29 @@ function createSonicJSApp(config = {}) {
     await next();
   });
   app2.use("*", apiKeyAuthMiddleware());
+  app2.use("*", async (c, next) => {
+    if (!c.get("user")) {
+      const authHeader = c.req.header("Authorization");
+      if (authHeader?.startsWith("Bearer ") && !authHeader.startsWith("Bearer sk_")) {
+        const token = authHeader.slice(7);
+        try {
+          const secret = c.env?.JWT_SECRET;
+          const payload = await AuthManager.verifyToken(token, secret);
+          if (payload) {
+            c.set("user", {
+              userId: payload.userId,
+              email: payload.email,
+              role: payload.role,
+              exp: payload.exp,
+              iat: payload.iat
+            });
+          }
+        } catch {
+        }
+      }
+    }
+    await next();
+  });
   if (config.middleware?.afterAuth) {
     for (const middleware of config.middleware.afterAuth) {
       app2.use("*", middleware);
@@ -18347,7 +18385,7 @@ function createSonicJSApp(config = {}) {
     if (!user?.userId) return next();
     let perms = [];
     try {
-      const { RbacService: RbacService2 } = await import('./rbac-Y43IEQOP.js');
+      const { RbacService: RbacService2 } = await import('./rbac-P44772FP.js');
       perms = await new RbacService2(c.env.DB, c.env.CACHE_KV).permissionsForUser(user.userId);
     } catch {
       return next();
@@ -18424,7 +18462,7 @@ function createSonicJSApp(config = {}) {
     const userPlugins = (config.plugins?.register ?? []).filter(
       (p) => !PLUGIN_REGISTRY[p.id]
     );
-    setPluginMenu(userPlugins.flatMap((p) => p.menu ?? []));
+    setPluginMenu(userPlugins.flatMap((p) => (p.menu ?? []).map((m) => ({ ...m, pluginId: p.id }))));
     setPluginDefinitions(allMountedPlugins);
   }
   app2.get("/favicon.svg", (c) => {