@sonicjs-cms/core 3.0.0-beta.24 → 3.0.0-beta.26

package/dist/{chunk-VC5XVPLM.js → chunk-OJFIQGZB.js}

@@ -1,18 +1,19 @@
+import { renderDocumentFormPage, renderAlert } from './chunk-E3TQG7AA.js';
+import { recordCatalogRequest, scheduleKvWrite } from './chunk-F6BTBE4S.js';
 import { isFirstUserRegistration, isRegistrationEnabled, authValidationService } from './chunk-VVYVFCML.js';
-import { renderDocumentFormPage, renderAlert } from './chunk-BHND5PEV.js';
-import { getCacheService, CACHE_CONFIGS, SettingsService, getLogger, getAppInstance, buildRouteList, CATEGORY_INFO } from './chunk-2XAQTPAE.js';
-import { DocumentTypeRegistry, requireAuth, requireRole, optionalAuth, isPluginActive, rateLimit, AuthManager, getJwtExpirySecondsFromDb, getJwtRefreshGraceSecondsFromDb, logActivity, generateCsrfToken } from './chunk-FHPEM77Y.js';
-import { DocumentsService, documentSecondsToMs, RbacService } from './chunk-3TMTYJAJ.js';
+import { getCacheService, CACHE_CONFIGS, SettingsService, getLogger, getAppInstance, buildRouteList, CATEGORY_INFO } from './chunk-6X22VFEV.js';
+import { DocumentTypeRegistry, requireAuth, requireRole, optionalAuth, rateLimit, AuthManager, getJwtExpirySecondsFromDb, getJwtRefreshGraceSecondsFromDb, logActivity, generateCsrfToken } from './chunk-EEA476CJ.js';
+import { DocumentsService, documentSecondsToMs, RbacService } from './chunk-RXLI3ADU.js';
 import { nanoid } from './chunk-UWUP2VMT.js';
-import { getCollectionRegistry, collectionRecordToRow, loadCollectionConfigs, getVisibleCollections, PluginService, PLUGIN_REGISTRY, findPluginByCodeName, isCodeCollectionInternal, isDbDocTypeInternal, invalidateTenantCache } from './chunk-RJ2O5IIE.js';
-import { MigrationService } from './chunk-UIHIXTIS.js';
-import { renderCheckboxPage, renderAlert as renderAlert$1, renderTable, renderPagination, renderConfirmationDialog, getConfirmationDialogScript, renderAdminLayout, adminLayoutV2, renderForm } from './chunk-BJROXF4N.js';
-import { init_admin_layout_catalyst_template, renderAdminLayoutCatalyst } from './chunk-THFZSDIU.js';
-import { createServiceSingleton, definePlugin, getPluginDefinition, applySchemaDefaults, renderSchemaFields, parseFormDataToSettings, getPluginMenu } from './chunk-VGEZNFWH.js';
+import { getCollectionRegistry, isPluginActive, collectionRecordToRow, loadCollectionConfigs, getVisibleCollections, PluginService, PLUGIN_REGISTRY, findPluginByCodeName, isCodeCollectionInternal, isDbDocTypeInternal, invalidateTenantCache } from './chunk-RVOX2WH2.js';
+import { MigrationService } from './chunk-5YSFQO7X.js';
+import { renderCheckboxPage, renderAlert as renderAlert$1, renderTable, renderPagination, renderConfirmationDialog, getConfirmationDialogScript, renderAdminLayout, adminLayoutV2, renderForm } from './chunk-HSDJDWLV.js';
+import { init_admin_layout_catalyst_template, renderAdminLayoutCatalyst } from './chunk-SXC4HPK6.js';
+import { createServiceSingleton, definePlugin, getPluginDefinition, applySchemaDefaults, renderSchemaFields, parseFormDataToSettings, getPluginMenu } from './chunk-JD7BZU3A.js';
 import { hasHookSystem, getTypedHooks } from './chunk-RNZFGN4R.js';
-import { QueryFilterBuilder, getBlocksFieldConfig, parseBlocksValue } from './chunk-QZGABF2M.js';
+import { QueryFilterBuilder, getBlocksFieldConfig, parseBlocksValue } from './chunk-AMP4BSJE.js';
 import { metricsTracker } from './chunk-FICTAGD4.js';
-import { getCoreVersion } from './chunk-LNI3FYSI.js';
+import { getCoreVersion } from './chunk-UB5QSRO7.js';
 import { escapeHtml, sanitizeRichText, sanitizeInput } from './chunk-TQABQWOP.js';
 import { Hono } from 'hono';
 import { z } from 'zod';
@@ -45,6 +46,7 @@ var DocumentPermissionsService = class {
         const publicGrants = baseGrants["public"] ?? [];
         if (publicGrants.includes(permission)) return true;
       } else if (principal.type === "role") {
+        if (principal.id === "public") continue;
         const roleGrants = baseGrants[principal.id] ?? [];
         if (roleGrants.includes(permission)) return true;
       }
@@ -842,6 +844,34 @@ async function dispatchHookEvent(c, event, payload, mode = "fire-and-forget") {
   return hooks.dispatch(event, payload);
 }
 
+// src/plugins/cache/services/swr.ts
+var STALE_TTL_MS = 3e4;
+var staleMap = /* @__PURE__ */ new Map();
+function markStale(cacheKey, data, collection) {
+  staleMap.set(cacheKey, {
+    data,
+    collection,
+    expiresAt: Date.now() + STALE_TTL_MS
+  });
+}
+function getAndConsumeStale(cacheKey) {
+  const entry = staleMap.get(cacheKey);
+  if (!entry) return null;
+  if (Date.now() > entry.expiresAt) {
+    staleMap.delete(cacheKey);
+    return null;
+  }
+  staleMap.delete(cacheKey);
+  return entry.data;
+}
+function swrStats() {
+  const now = Date.now();
+  for (const [key, entry] of staleMap.entries()) {
+    if (now > entry.expiresAt) staleMap.delete(key);
+  }
+  return { count: staleMap.size };
+}
+
 // src/plugins/core-plugins/global-variables-plugin/variable-resolver.ts
 var TOKEN_PATTERN = /\{([a-z0-9_]+)\}/g;
 function resolveVariables(text, variables) {
@@ -994,6 +1024,32 @@ apiContentCrudRoutes.get("/:id", optionalAuth(), async (c) => {
       { collection: docRow.type_id, id: docRow.root_id, data: transformedContent.data },
       "fire-and-forget"
     );
+    const fieldsParam = c.req.query("fields");
+    if (fieldsParam) {
+      const projFields = fieldsParam.split(",").map((s) => s.trim()).filter(Boolean);
+      if (projFields.length > 0) {
+        const result = {};
+        const dataSubFields = [];
+        for (const f of projFields) {
+          if (f === "data") {
+            result.data = transformedContent.data;
+          } else if (f.startsWith("data.")) {
+            dataSubFields.push(f.slice(5));
+          } else if (Object.prototype.hasOwnProperty.call(transformedContent, f)) {
+            result[f] = transformedContent[f];
+          }
+        }
+        if (dataSubFields.length > 0 && !result.data) {
+          result.data = {};
+          for (const sub of dataSubFields) {
+            if (transformedContent.data && Object.prototype.hasOwnProperty.call(transformedContent.data, sub)) {
+              result.data[sub] = transformedContent.data[sub];
+            }
+          }
+        }
+        return c.json({ data: result });
+      }
+    }
     return c.json({ data: transformedContent });
   } catch (error) {
     console.error("Error fetching content:", error);
@@ -1057,8 +1113,8 @@ apiContentCrudRoutes.post("/", requireAuth(), requireRole(["admin", "editor", "a
         user?.userId
       );
       const cache = getCacheService(CACHE_CONFIGS.api);
-      await cache.invalidate("content-filtered:*");
-      await cache.invalidate("collection-content-filtered:*");
+      await cache.invalidate("api:content-filtered:*");
+      await cache.invalidate(`api:collection-content-filtered:${backing.coll.name}:*`);
       dispatchHookEvent(
         c,
         "content:after:create",
@@ -1121,8 +1177,8 @@ apiContentCrudRoutes.put("/:id", requireAuth(), requireRole(["admin", "editor",
         await svc.unpublish(pub.id);
       }
       const cache = getCacheService(CACHE_CONFIGS.api);
-      await cache.invalidate("content-filtered:*");
-      await cache.invalidate("collection-content-filtered:*");
+      await cache.invalidate("api:content-filtered:*");
+      await cache.invalidate(`api:collection-content-filtered:${docRow.type_id}:*`);
       const coll = getCollectionRegistry().getByName(docRow.type_id);
       const saved = await db.prepare("SELECT * FROM documents WHERE id = ?").bind(newDraft.id).first();
       const savedData = saved?.data ? JSON.parse(saved.data) : {};
@@ -1161,8 +1217,8 @@ apiContentCrudRoutes.delete("/:id", requireAuth(), requireRole(["admin", "editor
       const now = Math.floor(Date.now() / 1e3);
       await db.prepare("UPDATE documents SET deleted_at = ?, updated_at = ? WHERE root_id = ? AND tenant_id = ?").bind(now, now, id, tenantId).run();
       const cache = getCacheService(CACHE_CONFIGS.api);
-      await cache.invalidate("content-filtered:*");
-      await cache.invalidate("collection-content-filtered:*");
+      await cache.invalidate("api:content-filtered:*");
+      await cache.invalidate(`api:collection-content-filtered:${docRow.type_id}:*`);
       dispatchHookEvent(c, "content:after:delete", { collection: docRow.type_id, id, data: {}, user: actor }, "fire-and-forget");
       return c.json({ success: true });
     }
@@ -1178,6 +1234,22 @@ apiContentCrudRoutes.delete("/:id", requireAuth(), requireRole(["admin", "editor
 var api_content_crud_default = apiContentCrudRoutes;
 
 // src/routes/api.ts
+function isAnonPrincipal(principalSet) {
+  return principalSet.length === 1 && principalSet[0]?.type === "public";
+}
+async function typeReadAllowed(db, principalSet, docType, typeName) {
+  const perms = new DocumentPermissionsService(db);
+  if (perms.isAllowedSync(principalSet, [], "read", docType?.settings ?? {})) return true;
+  const rbac = new RbacService(db);
+  let anyRbacRoleFound = false;
+  for (const p of principalSet) {
+    if (p.type !== "role") continue;
+    if (!await rbac.hasRbacRole(p.id)) continue;
+    anyRbacRoleFound = true;
+    if (await rbac.isGrantedForRole(p.id, `document_type:${typeName}`, "read")) return true;
+  }
+  return !anyRbacRoleFound;
+}
 var DOC_SORTABLE_COLUMNS = /* @__PURE__ */ new Set([
   "created_at",
   "updated_at",
@@ -1261,6 +1333,33 @@ function mapDocRowToContent(row, collectionId) {
     updated_at: documentSecondsToMs(row.updated_at)
   };
 }
+function projectFields(item, fields) {
+  if (fields.length === 0) return item;
+  const result = {};
+  const dataSubFields = [];
+  for (const f of fields) {
+    if (f === "data") {
+      result.data = item.data;
+    } else if (f.startsWith("data.")) {
+      dataSubFields.push(f.slice(5));
+    } else if (Object.prototype.hasOwnProperty.call(item, f)) {
+      result[f] = item[f];
+    }
+  }
+  if (dataSubFields.length > 0 && !result.data) {
+    result.data = {};
+    for (const sub of dataSubFields) {
+      if (item.data && Object.prototype.hasOwnProperty.call(item.data, sub)) {
+        result.data[sub] = item.data[sub];
+      }
+    }
+  }
+  return result;
+}
+function parseFieldsParam(raw2) {
+  if (!raw2) return [];
+  return raw2.split(",").map((s) => s.trim()).filter(Boolean);
+}
 var apiRoutes = new Hono();
 apiRoutes.use("*", async (c, next) => {
   const startTime = Date.now();
@@ -1270,7 +1369,8 @@ apiRoutes.use("*", async (c, next) => {
   c.header("X-Response-Time", `${totalTime}ms`);
 });
 apiRoutes.use("*", async (c, next) => {
-  const cacheEnabled = await isPluginActive(c.env.DB, "core-cache");
+  const bypass = c.req.header("Cache-Control") === "no-cache";
+  const cacheEnabled = !bypass && await isPluginActive(c.env.DB, "core-cache");
   c.set("cacheEnabled", cacheEnabled);
   await next();
 });
@@ -1750,7 +1850,12 @@ apiRoutes.get("/content", optionalAuth(), async (c) => {
   try {
     const db = c.env.DB;
     const queryParams = c.req.query();
+    const projFields = parseFieldsParam(queryParams.fields);
+    if (queryParams.fields) delete queryParams.fields;
     const role = c.get("user")?.role;
+    const { tenantId: cTenantId, principalSet: cPrincipalSet } = getDocumentRequestContext(c);
+    const cAnon = isAnonPrincipal(cPrincipalSet);
+    const cNeedsAcl = !cAnon && !canReadNonPublicContent(role);
     const collIdByName = /* @__PURE__ */ new Map();
     let typeId;
     let typeIds;
@@ -1796,7 +1901,7 @@ apiRoutes.get("/content", optionalAuth(), async (c) => {
         details: queryResult.errors
       }, 400);
     }
-    const cacheEnabled = c.get("cacheEnabled");
+    const cacheEnabled = c.get("cacheEnabled") && !cNeedsAcl;
     const cache = getCacheService(CACHE_CONFIGS.api);
     const cacheKey = cache.generateKey("content-filtered", JSON.stringify({ filter: normalizedFilter, query: queryResult.sql }));
     if (cacheEnabled) {
@@ -1818,19 +1923,61 @@ apiRoutes.get("/content", optionalAuth(), async (c) => {
             }
           }, executionStart)
         };
+        recordCatalogRequest({ cacheKey, collection: typeId ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: cacheResult.source });
+        scheduleKvWrite(cacheKey, c.executionCtx);
         return c.json(dataWithMeta);
       }
+      const swrData = getAndConsumeStale(cacheKey);
+      if (swrData) {
+        c.header("X-Cache-Status", "STALE");
+        c.header("X-Cache-Source", "swr");
+        recordCatalogRequest({ cacheKey, collection: typeId ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: "swr" });
+        scheduleKvWrite(cacheKey, c.executionCtx);
+        return c.json({ ...swrData, meta: addTimingMeta(c, { ...swrData.meta, cache: { hit: true, source: "swr", stale: true } }, executionStart) });
+      }
+      recordCatalogRequest({ cacheKey, collection: typeId ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: "miss" });
+      scheduleKvWrite(cacheKey, c.executionCtx);
     }
     c.header("X-Cache-Status", "MISS");
     c.header("X-Cache-Source", "database");
     const stmt = db.prepare(queryResult.sql);
     const boundStmt = queryResult.params.length > 0 ? stmt.bind(...queryResult.params) : stmt;
     const { results } = await boundStmt.all();
-    const transformedResults = results.map((row) => mapDocRowToContent(row, collIdByName.get(row.type_id) ?? null));
+    let aclResults = results;
+    if (cNeedsAcl) {
+      const typeReg = new DocumentTypeRegistry(db);
+      const repo = new DocumentRepository(db, cTenantId);
+      const uniqueTypeIds = [...new Set(results.map((r) => r.type_id))];
+      const typeSettingsMap = /* @__PURE__ */ new Map();
+      const typeRbacOnlyMap = /* @__PURE__ */ new Map();
+      const typeDeniedMap = /* @__PURE__ */ new Map();
+      await Promise.all(uniqueTypeIds.map(async (tid) => {
+        const dt = await typeReg.findById(tid);
+        const settings = dt?.settings ?? {};
+        typeSettingsMap.set(tid, settings);
+        const allowed2 = await typeReadAllowed(db, cPrincipalSet, dt, tid);
+        if (!allowed2) {
+          typeDeniedMap.set(tid, true);
+          return;
+        }
+        const perms = new DocumentPermissionsService(db);
+        typeRbacOnlyMap.set(tid, !perms.isAllowedSync(cPrincipalSet, [], "read", settings));
+      }));
+      const allowed = await Promise.all(
+        results.map((row) => {
+          const tid = row.type_id;
+          if (typeDeniedMap.get(tid)) return Promise.resolve(false);
+          if (typeRbacOnlyMap.get(tid)) return Promise.resolve(true);
+          return repo.isAllowed(cPrincipalSet, row.root_id, "read", typeSettingsMap.get(tid) ?? {});
+        })
+      );
+      aclResults = results.filter((_, i) => allowed[i]);
+    }
+    const transformedResults = aclResults.map((row) => mapDocRowToContent(row, collIdByName.get(row.type_id) ?? null));
     const responseData = {
-      data: transformedResults,
+      data: projFields.length ? transformedResults.map((item) => projectFields(item, projFields)) : transformedResults,
       meta: addTimingMeta(c, {
-        count: results.length,
+        count: aclResults.length,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         // D44: echo the caller's filter with the access policy applied (status=published forced for
         // anonymous callers — the visible enforcement proof), NOT the internal doc-augmented where-tree.
@@ -1841,7 +1988,7 @@ apiRoutes.get("/content", optionalAuth(), async (c) => {
         }
       }, executionStart)
     };
-    if (cacheEnabled) {
+    if (cacheEnabled && projFields.length === 0) {
       await cache.set(cacheKey, responseData);
     }
     return c.json(responseData);
@@ -1866,6 +2013,16 @@ apiRoutes.get("/collections/:collection/content", optionalAuth(), async (c) => {
     const collIdByName = /* @__PURE__ */ new Map();
     collIdByName.set(collection, record.id);
     const role = c.get("user")?.role;
+    const { tenantId: ccTenantId, principalSet: ccPrincipalSet } = getDocumentRequestContext(c);
+    const ccAnon = isAnonPrincipal(ccPrincipalSet);
+    const ccNeedsAcl = !ccAnon && !canReadNonPublicContent(role);
+    let ccDocType;
+    if (ccNeedsAcl) {
+      ccDocType = await new DocumentTypeRegistry(db).findById(record.name);
+      if (!await typeReadAllowed(db, ccPrincipalSet, ccDocType, record.name)) {
+        return c.json({ error: "Forbidden" }, 403);
+      }
+    }
     const filter = QueryFilterBuilder.parseFromQuery(queryParams);
     const normalizedFilter = augmentFilterForDocuments(filter, { typeId: collection, role });
     if (!normalizedFilter.limit) {
@@ -1880,7 +2037,7 @@ apiRoutes.get("/collections/:collection/content", optionalAuth(), async (c) => {
         details: queryResult.errors
       }, 400);
     }
-    const cacheEnabled = c.get("cacheEnabled");
+    const cacheEnabled = c.get("cacheEnabled") && !ccNeedsAcl;
     const cache = getCacheService(CACHE_CONFIGS.api);
     const includeCollection = queryParams.include?.split(",").map((s) => s.trim()).includes("collection");
     const cacheKey = cache.generateKey("collection-content-filtered", `${collection}:${JSON.stringify({ filter: normalizedFilter, query: queryResult.sql, includeCollection })}`);
@@ -1903,20 +2060,44 @@ apiRoutes.get("/collections/:collection/content", optionalAuth(), async (c) => {
             }
           }, executionStart)
         };
+        recordCatalogRequest({ cacheKey, collection: collection ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: cacheResult.source });
+        scheduleKvWrite(cacheKey, c.executionCtx);
         return c.json(dataWithMeta);
       }
+      const swrData = getAndConsumeStale(cacheKey);
+      if (swrData) {
+        c.header("X-Cache-Status", "STALE");
+        c.header("X-Cache-Source", "swr");
+        recordCatalogRequest({ cacheKey, collection: collection ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: "swr" });
+        scheduleKvWrite(cacheKey, c.executionCtx);
+        return c.json({ ...swrData, meta: addTimingMeta(c, { ...swrData.meta, cache: { hit: true, source: "swr", stale: true } }, executionStart) });
+      }
+      recordCatalogRequest({ cacheKey, collection: collection ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: "miss" });
+      scheduleKvWrite(cacheKey, c.executionCtx);
     }
     c.header("X-Cache-Status", "MISS");
     c.header("X-Cache-Source", "database");
     const stmt = db.prepare(queryResult.sql);
     const boundStmt = queryResult.params.length > 0 ? stmt.bind(...queryResult.params) : stmt;
     const { results } = await boundStmt.all();
-    const transformedResults = results.map((row) => mapDocRowToContent(row, collIdByName.get(row.type_id) ?? null));
+    let ccAclResults = results;
+    if (ccNeedsAcl) {
+      const ccPerms = new DocumentPermissionsService(db);
+      const ccBaseGrantsPass = ccPerms.isAllowedSync(ccPrincipalSet, [], "read", ccDocType?.settings ?? {});
+      if (ccBaseGrantsPass) {
+        const repo = new DocumentRepository(db, ccTenantId);
+        const allowed = await Promise.all(
+          results.map((row) => repo.isAllowed(ccPrincipalSet, row.root_id, "read", ccDocType?.settings ?? {}))
+        );
+        ccAclResults = results.filter((_, i) => allowed[i]);
+      }
+    }
+    const transformedResults = ccAclResults.map((row) => mapDocRowToContent(row, collIdByName.get(row.type_id) ?? null));
     const responseData = {
       data: transformedResults,
       meta: addTimingMeta(c, {
         ...includeCollection ? { collection: collectionRecordToRow(record) } : {},
-        count: results.length,
+        count: ccAclResults.length,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         // D44: echo the caller's filter with the access policy applied (status=published forced for
         // anonymous callers — the visible enforcement proof), NOT the internal doc-augmented where-tree.
@@ -1946,6 +2127,8 @@ apiRoutes.get("/:collection", optionalAuth(), async (c) => {
     const collection = c.req.param("collection");
     const db = c.env.DB;
     const queryParams = c.req.query();
+    const projFields = parseFieldsParam(queryParams.fields);
+    if (queryParams.fields) delete queryParams.fields;
     const record = getCollectionRegistry().getBySlugOrName(collection);
     if (!record || record.isActive === false) {
       return c.json({ error: "Collection not found" }, 404);
@@ -1953,6 +2136,16 @@ apiRoutes.get("/:collection", optionalAuth(), async (c) => {
     const collIdByName = /* @__PURE__ */ new Map();
     collIdByName.set(record.name, record.id);
     const role = c.get("user")?.role;
+    const { tenantId, principalSet } = getDocumentRequestContext(c);
+    const anon = isAnonPrincipal(principalSet);
+    const needsAcl = !anon && !canReadNonPublicContent(role);
+    let docTypeForCheck;
+    if (needsAcl) {
+      docTypeForCheck = await new DocumentTypeRegistry(db).findById(record.name);
+      if (!await typeReadAllowed(db, principalSet, docTypeForCheck, record.name)) {
+        return c.json({ error: "Forbidden" }, 403);
+      }
+    }
     const filter = QueryFilterBuilder.parseFromQuery(queryParams);
     const normalizedFilter = augmentFilterForDocuments(filter, { typeId: record.name, role });
     if (!normalizedFilter.limit) normalizedFilter.limit = 50;
@@ -1964,7 +2157,7 @@ apiRoutes.get("/:collection", optionalAuth(), async (c) => {
     }
     const collectionCache = record.cache;
     const collectionCacheDisabled = collectionCache?.enabled === false;
-    const cacheEnabled = c.get("cacheEnabled") && !collectionCacheDisabled;
+    const cacheEnabled = c.get("cacheEnabled") && !collectionCacheDisabled && projFields.length === 0 && !needsAcl;
     const cache = getCacheService(CACHE_CONFIGS.api);
     const includeCollection = queryParams.include?.split(",").map((s) => s.trim()).includes("collection");
     const cacheKey = cache.generateKey("collection-content-filtered", `${collection}:${JSON.stringify({ filter: normalizedFilter, query: queryResult.sql, includeCollection })}`);
@@ -1974,20 +2167,45 @@ apiRoutes.get("/:collection", optionalAuth(), async (c) => {
         c.header("X-Cache-Status", "HIT");
         c.header("X-Cache-Source", cacheResult.source);
         if (cacheResult.ttl) c.header("X-Cache-TTL", Math.floor(cacheResult.ttl).toString());
+        recordCatalogRequest({ cacheKey, collection: collection ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: cacheResult.source });
+        scheduleKvWrite(cacheKey, c.executionCtx);
         return c.json({ ...cacheResult.data, meta: addTimingMeta(c, { ...cacheResult.data.meta, cache: { hit: true, source: cacheResult.source, ttl: cacheResult.ttl ? Math.floor(cacheResult.ttl) : void 0 } }, executionStart) });
       }
+      const swrData = getAndConsumeStale(cacheKey);
+      if (swrData) {
+        c.header("X-Cache-Status", "STALE");
+        c.header("X-Cache-Source", "swr");
+        recordCatalogRequest({ cacheKey, collection: collection ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: "swr" });
+        scheduleKvWrite(cacheKey, c.executionCtx);
+        return c.json({ ...swrData, meta: addTimingMeta(c, { ...swrData.meta, cache: { hit: true, source: "swr", stale: true } }, executionStart) });
+      }
+      recordCatalogRequest({ cacheKey, collection: collection ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: "miss" });
+      scheduleKvWrite(cacheKey, c.executionCtx);
     }
     c.header("X-Cache-Status", "MISS");
     c.header("X-Cache-Source", "database");
     const stmt = db.prepare(queryResult.sql);
     const boundStmt = queryResult.params.length > 0 ? stmt.bind(...queryResult.params) : stmt;
     const { results } = await boundStmt.all();
-    const transformedResults = results.map((row) => mapDocRowToContent(row, collIdByName.get(row.type_id) ?? null));
+    let aclResults = results;
+    if (needsAcl) {
+      const perms = new DocumentPermissionsService(db);
+      const baseGrantsPass = perms.isAllowedSync(principalSet, [], "read", docTypeForCheck?.settings ?? {});
+      if (!baseGrantsPass) {
+      } else {
+        const repo = new DocumentRepository(db, tenantId);
+        const allowed = await Promise.all(
+          results.map((row) => repo.isAllowed(principalSet, row.root_id, "read", docTypeForCheck?.settings ?? {}))
+        );
+        aclResults = results.filter((_, i) => allowed[i]);
+      }
+    }
+    const transformedResults = aclResults.map((row) => mapDocRowToContent(row, collIdByName.get(row.type_id) ?? null));
     const responseData = {
-      data: transformedResults,
+      data: projFields.length ? transformedResults.map((item) => projectFields(item, projFields)) : transformedResults,
       meta: addTimingMeta(c, {
         ...includeCollection ? { collection: collectionRecordToRow(record) } : {},
-        count: results.length,
+        count: aclResults.length,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         filter: normalizePublicContentFilter(filter, role),
         cache: { hit: false, source: "database" }
@@ -2018,6 +2236,23 @@ apiRoutes.get("/:collection/:id", optionalAuth(), async (c) => {
       privileged ? "SELECT * FROM documents WHERE root_id = ? AND type_id = ? AND tenant_id = 'default' AND is_current_draft = 1 AND deleted_at IS NULL" : "SELECT * FROM documents WHERE root_id = ? AND type_id = ? AND tenant_id = 'default' AND is_published = 1 AND deleted_at IS NULL"
     ).bind(id, record.name).first();
     if (!docRow) return c.json({ error: "Content not found" }, 404);
+    const colRole = c.get("user")?.role;
+    const { tenantId: colTenantId, principalSet: colPrincipalSet } = getDocumentRequestContext(c);
+    const colNeedsAcl = !isAnonPrincipal(colPrincipalSet) && !canReadNonPublicContent(colRole);
+    if (colNeedsAcl) {
+      const docType = await new DocumentTypeRegistry(db).findById(record.name);
+      if (!await typeReadAllowed(db, colPrincipalSet, docType, record.name)) {
+        return c.json({ error: "Content not found" }, 404);
+      }
+      const perms = new DocumentPermissionsService(db);
+      if (perms.isAllowedSync(colPrincipalSet, [], "read", docType?.settings ?? {})) {
+        const repo = new DocumentRepository(db, colTenantId);
+        if (!await repo.isAllowed(colPrincipalSet, docRow.root_id, "read", docType?.settings ?? {})) {
+          return c.json({ error: "Content not found" }, 404);
+        }
+      }
+    }
+    const projFields = parseFieldsParam(c.req.query("fields"));
     const coll = getCollectionRegistry().getByName(docRow.type_id);
     const transformedContent = {
       id: docRow.root_id,
@@ -2030,7 +2265,7 @@ apiRoutes.get("/:collection/:id", optionalAuth(), async (c) => {
       updated_at: documentSecondsToMs(docRow.updated_at)
     };
     dispatchHookEvent(c, "content:read", { collection: docRow.type_id, id: docRow.root_id, data: transformedContent.data }, "fire-and-forget");
-    return c.json({ data: transformedContent });
+    return c.json({ data: projFields.length ? projectFields(transformedContent, projFields) : transformedContent });
   } catch (error) {
     console.error("Error fetching content:", error);
     return c.json({ error: "Failed to fetch content", details: error instanceof Error ? error.message : String(error) }, 500);
@@ -2060,8 +2295,11 @@ apiRoutes.post("/:collection", requireAuth(), requireRole(["admin", "editor", "a
     const svc = new DocumentsService(db, { queryableFields: backing.docType.queryableFields ?? [], typeSchemaVersion: backing.docType.schemaVersion ?? 1, maxVersionsPerRoot: backing.docType.settings?.maxVersionsPerRoot ?? 50, tenantId: "default", versioning: backing.docType.settings?.versioning ?? false });
     const doc = await svc.create(createDocumentSchema.parse({ typeId: backing.coll.name, tenantId: "default", locale: "default", title, slug: finalSlug, data: hookData, publishOnCreate: (status || "draft") === "published" }), user?.userId);
     const cache = getCacheService(CACHE_CONFIGS.api);
-    await cache.invalidate("content-filtered:*");
-    await cache.invalidate("collection-content-filtered:*");
+    const createAffectedKeys = (await cache.listKeys()).map((k) => k.key).filter((k) => k.startsWith("api:content-filtered:") || k.startsWith(`api:collection-content-filtered:${backing.coll.name}:`));
+    const createStaleValues = await cache.getMany(createAffectedKeys);
+    for (const [key, val] of createStaleValues) markStale(key, val, backing.coll.name);
+    await cache.invalidate("api:content-filtered:*");
+    await cache.invalidate(`api:collection-content-filtered:${backing.coll.name}:*`);
     dispatchHookEvent(c, "content:after:create", { collection: backing.coll.name, id: doc.rootId, data: doc.data ?? {}, user: actor }, "fire-and-forget");
     return c.json({ data: { id: doc.rootId, title: doc.title, slug: doc.slug, status: doc.status, collectionId: backing.coll.id, data: doc.data, created_at: documentSecondsToMs(doc.createdAt), updated_at: documentSecondsToMs(doc.updatedAt) } }, 201);
   } catch (error) {
@@ -2103,8 +2341,11 @@ apiRoutes.put("/:collection/:id", requireAuth(), requireRole(["admin", "editor",
       await svc.unpublish(pub.id);
     }
     const cache = getCacheService(CACHE_CONFIGS.api);
-    await cache.invalidate("content-filtered:*");
-    await cache.invalidate("collection-content-filtered:*");
+    const updateAffectedKeys = (await cache.listKeys()).map((k) => k.key).filter((k) => k.startsWith("api:content-filtered:") || k.startsWith(`api:collection-content-filtered:${docRow.type_id}:`));
+    const updateStaleValues = await cache.getMany(updateAffectedKeys);
+    for (const [key, val] of updateStaleValues) markStale(key, val, docRow.type_id);
+    await cache.invalidate("api:content-filtered:*");
+    await cache.invalidate(`api:collection-content-filtered:${docRow.type_id}:*`);
     const coll = getCollectionRegistry().getByName(docRow.type_id);
     const saved = await db.prepare("SELECT * FROM documents WHERE id = ?").bind(newDraft.id).first();
     const savedData = saved?.data ? JSON.parse(saved.data) : {};
@@ -2136,8 +2377,11 @@ apiRoutes.delete("/:collection/:id", requireAuth(), requireRole(["admin", "edito
     const now = Math.floor(Date.now() / 1e3);
     await db.prepare("UPDATE documents SET deleted_at = ?, updated_at = ? WHERE root_id = ? AND tenant_id = 'default'").bind(now, now, id).run();
     const cache = getCacheService(CACHE_CONFIGS.api);
-    await cache.invalidate("content-filtered:*");
-    await cache.invalidate("collection-content-filtered:*");
+    const deleteAffectedKeys = (await cache.listKeys()).map((k) => k.key).filter((k) => k.startsWith("api:content-filtered:") || k.startsWith(`api:collection-content-filtered:${docRow.type_id}:`));
+    const deleteStaleValues = await cache.getMany(deleteAffectedKeys);
+    for (const [key, val] of deleteStaleValues) markStale(key, val, docRow.type_id);
+    await cache.invalidate("api:content-filtered:*");
+    await cache.invalidate(`api:collection-content-filtered:${docRow.type_id}:*`);
     dispatchHookEvent(c, "content:after:delete", { collection: docRow.type_id, id, data: {}, user: actor }, "fire-and-forget");
     return c.json({ success: true });
   } catch (error) {
@@ -2699,9 +2943,13 @@ apiMediaRoutes.post("/create-folder", async (c) => {
         error: "Folder name can only contain lowercase letters, numbers, hyphens, and underscores"
       }, 400);
     }
-    const checkStmt = c.env.DB.prepare("SELECT COUNT(*) as count FROM media WHERE folder = ? AND deleted_at IS NULL");
-    const existingFolder = await checkStmt.bind(folderName).first();
-    if (existingFolder && existingFolder.count > 0) {
+    let folderExists = false;
+    try {
+      const existing = await c.env.DB.prepare("SELECT COUNT(*) as count FROM documents WHERE type_id = 'media_asset' AND tenant_id = 'default' AND json_extract(data, '$.folder') = ? AND deleted_at IS NULL AND is_current_draft = 1").bind(folderName).first();
+      folderExists = (existing?.count ?? 0) > 0;
+    } catch {
+    }
+    if (folderExists) {
       return c.json({
         success: false,
         error: `Folder "${folderName}" already exists`
@@ -3411,7 +3659,7 @@ adminApiRoutes.patch("/collections/:id", collectionsReadOnly);
 adminApiRoutes.delete("/collections/:id", collectionsReadOnly);
 adminApiRoutes.get("/migrations/status", async (c) => {
   try {
-    const { MigrationService: MigrationService2 } = await import('./migrations-Z6D27NAW.js');
+    const { MigrationService: MigrationService2 } = await import('./migrations-GZ2HIB4I.js');
     const db = c.env.DB;
     const migrationService = new MigrationService2(db);
     const status = await migrationService.getMigrationStatus();
@@ -3454,7 +3702,7 @@ adminApiRoutes.post("/migrations/run", async (c) => {
 });
 adminApiRoutes.get("/migrations/validate", async (c) => {
   try {
-    const { MigrationService: MigrationService2 } = await import('./migrations-Z6D27NAW.js');
+    const { MigrationService: MigrationService2 } = await import('./migrations-GZ2HIB4I.js');
     const db = c.env.DB;
     const migrationService = new MigrationService2(db);
     const validation = await migrationService.validateSchema();
@@ -3613,6 +3861,8 @@ function renderLoginPage(data, demoLoginActive = false) {
             <!-- Form -->
             <form
               id="login-form"
+              action="/auth/login/form${data.redirect ? `?redirect=${encodeURIComponent(data.redirect)}` : ""}"
+              method="post"
               hx-post="/auth/login/form${data.redirect ? `?redirect=${encodeURIComponent(data.redirect)}` : ""}"
               hx-target="#form-response"
               hx-swap="innerHTML"
@@ -5128,9 +5378,11 @@ function renderDynamicField(field, options = {}) {
           min="${opts.min || ""}"
           max="${opts.max || ""}"
           class="${baseClasses} ${errorClasses} !w-auto dark:[color-scheme:dark]"
+          placeholder="YYYY-MM-DD"
           ${required}
           ${disabled ? "disabled" : ""}
         >
+        <p class="mt-1 text-xs text-zinc-500 dark:text-zinc-400">Format: YYYY-MM-DD</p>
       `;
       break;
     case "datetime":
@@ -5146,6 +5398,7 @@ function renderDynamicField(field, options = {}) {
           ${required}
           ${disabled ? "disabled" : ""}
         >
+        <p class="mt-1 text-xs text-zinc-500 dark:text-zinc-400">Format: YYYY-MM-DD HH:MM</p>
       `;
       break;
     case "slug":
@@ -7100,8 +7353,32 @@ function createUserProfilesPlugin() {
   return userProfilesPlugin;
 }
 
+// src/services/demo-mode.ts
+var _demoModeActive = false;
+function setDemoModeActive() {
+  _demoModeActive = true;
+}
+function isDemoModeActive() {
+  return _demoModeActive;
+}
+
 // src/routes/auth.ts
 var JWT_SECRET_FALLBACK = "your-super-secret-jwt-key-change-in-production";
+var DEMO_EMAIL = "admin@sonicjs.com";
+var STATS_EVENTS_ENDPOINT = "https://stats.sonicjs.com/v1/events";
+async function trackDemoLogin(kv) {
+  try {
+    const installationId = await kv?.get("_sonicjs_installation_id") ?? "demo-unknown";
+    await fetch(STATS_EVENTS_ENDPOINT, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        data: { installation_id: installationId, event_type: "demo_login", properties: {}, timestamp: (/* @__PURE__ */ new Date()).toISOString() }
+      })
+    });
+  } catch {
+  }
+}
 function renderPasswordResetEmail(resetLink, firstName) {
   const greeting = firstName ? `Hi ${firstName},` : "Hello,";
   return `<!DOCTYPE html>
@@ -7151,13 +7428,7 @@ authRoutes.get("/login", async (c) => {
     version: c.get("appVersion"),
     redirect: redirect && redirect.startsWith("/") ? redirect : void 0
   };
-  const db = c.env.DB;
-  let demoLoginActive = false;
-  try {
-    const plugin = await db.prepare("SELECT * FROM plugins WHERE id = ? AND status = ?").bind("demo-login-prefill", "active").first();
-    demoLoginActive = !!plugin;
-  } catch (error2) {
-  }
+  const demoLoginActive = isDemoModeActive();
   return c.html(renderLoginPage(pageData, demoLoginActive));
 });
 authRoutes.get("/register", async (c) => {
@@ -7293,8 +7564,8 @@ authRoutes.post(
       }
       const { email, password } = validation.data;
       const normalizedEmail = email.toLowerCase();
-      const { createAuth } = await import('./config-6FB2BXMP.js');
-      const auth = createAuth(c.env);
+      const { createAuth } = await import('./config-DOAWXZBG.js');
+      const auth = createAuth(c.env, void 0, new URL(c.req.url).origin);
       const baReq = new Request(new URL("/auth/sign-in/email", c.req.url).href, {
         method: "POST",
         headers: { "Content-Type": "application/json", "Origin": new URL(c.req.url).origin },
@@ -7304,12 +7575,14 @@ authRoutes.post(
       if (!baRes.ok) {
         return c.json({ error: "Invalid email or password" }, 401);
       }
-      const rawSetCookie = baRes.headers.get("set-cookie");
-      if (rawSetCookie) {
-        c.res.headers.append("Set-Cookie", rawSetCookie);
-      } else if (baRes.headers.getSetCookie) {
+      if (baRes.headers.getSetCookie) {
         for (const sc of baRes.headers.getSetCookie()) {
-          c.res.headers.append("Set-Cookie", sc);
+          c.header("Set-Cookie", sc, { append: true });
+        }
+      } else {
+        const rawSetCookie = baRes.headers.get("set-cookie");
+        if (rawSetCookie) {
+          c.header("Set-Cookie", rawSetCookie, { append: true });
         }
       }
       await setCsrfCookie(c);
@@ -7329,6 +7602,9 @@ authRoutes.post(
         sameSite: "Strict",
         maxAge: tokenTtl
       });
+      if (normalizedEmail === DEMO_EMAIL) {
+        c.executionCtx?.waitUntil(trackDemoLogin(c.env.CACHE_KV));
+      }
       return c.json({
         user: {
           id: user.id,
@@ -7347,8 +7623,8 @@ authRoutes.post(
 );
 authRoutes.post("/logout", async (c) => {
   try {
-    const { createAuth } = await import('./config-6FB2BXMP.js');
-    const auth = createAuth(c.env);
+    const { createAuth } = await import('./config-DOAWXZBG.js');
+    const auth = createAuth(c.env, void 0, new URL(c.req.url).origin);
     const baReq = new Request(new URL("/auth/sign-out", c.req.url).href, {
       method: "POST",
       headers: { "Content-Type": "application/json", "Origin": new URL(c.req.url).origin, "Cookie": c.req.header("Cookie") || "" },
@@ -7357,14 +7633,15 @@ authRoutes.post("/logout", async (c) => {
     await auth.handler(baReq);
   } catch {
   }
-  setCookie(c, "better-auth.session_token", "", { httpOnly: true, sameSite: "Lax", path: "/", maxAge: 0 });
+  const isSecure = new URL(c.req.url).protocol === "https:";
+  setCookie(c, "better-auth.session_token", "", { httpOnly: true, sameSite: "Lax", path: "/", maxAge: 0, secure: isSecure });
   clearCsrfCookie(c);
   return c.json({ message: "Logged out successfully" });
 });
 authRoutes.get("/logout", async (c) => {
   try {
-    const { createAuth } = await import('./config-6FB2BXMP.js');
-    const auth = createAuth(c.env);
+    const { createAuth } = await import('./config-DOAWXZBG.js');
+    const auth = createAuth(c.env, void 0, new URL(c.req.url).origin);
     const baReq = new Request(new URL("/auth/sign-out", c.req.url).href, {
       method: "POST",
       headers: { "Content-Type": "application/json", "Origin": new URL(c.req.url).origin, "Cookie": c.req.header("Cookie") || "" },
@@ -7373,7 +7650,8 @@ authRoutes.get("/logout", async (c) => {
     await auth.handler(baReq);
   } catch {
   }
-  setCookie(c, "better-auth.session_token", "", { httpOnly: true, sameSite: "Lax", path: "/", maxAge: 0 });
+  const isSecure = new URL(c.req.url).protocol === "https:";
+  setCookie(c, "better-auth.session_token", "", { httpOnly: true, sameSite: "Lax", path: "/", maxAge: 0, secure: isSecure });
   clearCsrfCookie(c);
   return c.redirect("/auth/login?message=You have been logged out successfully");
 });
@@ -7570,8 +7848,8 @@ authRoutes.post(
         </div>
       `);
       }
-      const { createAuth } = await import('./config-6FB2BXMP.js');
-      const auth = createAuth(c.env);
+      const { createAuth } = await import('./config-DOAWXZBG.js');
+      const auth = createAuth(c.env, void 0, new URL(c.req.url).origin);
       const baReq = new Request(new URL("/auth/sign-in/email", c.req.url).href, {
         method: "POST",
         headers: { "Content-Type": "application/json", "Origin": new URL(c.req.url).origin },
@@ -7585,17 +7863,27 @@ authRoutes.post(
         </div>
       `);
       }
-      const rawSetCookie = baRes.headers.get("set-cookie");
-      if (rawSetCookie) {
-        c.res.headers.append("Set-Cookie", rawSetCookie);
-      } else if (baRes.headers.getSetCookie) {
+      if (baRes.headers.getSetCookie) {
         for (const sc of baRes.headers.getSetCookie()) {
-          c.res.headers.append("Set-Cookie", sc);
+          c.header("Set-Cookie", sc, { append: true });
+        }
+      } else {
+        const rawSetCookie = baRes.headers.get("set-cookie");
+        if (rawSetCookie) {
+          c.header("Set-Cookie", rawSetCookie, { append: true });
         }
       }
       await setCsrfCookie(c);
+      if (email === DEMO_EMAIL) {
+        c.executionCtx?.waitUntil(trackDemoLogin(c.env.CACHE_KV));
+      }
       const rawRedirect = c.req.query("redirect");
       const redirectUrl = rawRedirect && rawRedirect.startsWith("/") ? rawRedirect : "/admin/content";
+      const isHtmx = c.req.header("HX-Request") === "true";
+      if (isHtmx) {
+        c.header("HX-Redirect", redirectUrl);
+        return c.html(html`<div id="form-response"><p class="text-sm text-green-600">Login successful! Redirecting...</p></div>`);
+      }
       return c.html(html`
       <div id="form-response">
         <div class="rounded-lg bg-green-100 dark:bg-lime-500/10 p-4 ring-1 ring-green-400 dark:ring-lime-500/20">
@@ -9107,33 +9395,44 @@ function renderContentFormPage(data, opts) {
           </a>
 
           <div class="flex items-center gap-x-3">
-            ${data.versioningEnabled ? `
-              <button
-                type="submit"
-                form="content-form"
-                name="action"
-                value="save"
-                class="inline-flex items-center justify-center gap-x-1.5 rounded-lg bg-zinc-950 dark:bg-white px-3.5 py-2.5 text-sm font-semibold text-white dark:text-zinc-950 hover:bg-zinc-800 dark:hover:bg-zinc-100 transition-colors shadow-sm"
-              >
-                <svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="1.5">
-                  <path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7"/>
-                </svg>
-                ${isEdit ? "Update" : "Save"}
-              </button>
-            ` : ""}
+            <button
+              type="submit"
+              form="content-form"
+              name="action"
+              value="save"
+              class="inline-flex items-center justify-center gap-x-1.5 rounded-lg bg-zinc-950 dark:bg-white px-3.5 py-2.5 text-sm font-semibold text-white dark:text-zinc-950 hover:bg-zinc-800 dark:hover:bg-zinc-100 transition-colors shadow-sm"
+            >
+              <svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="1.5">
+                <path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7"/>
+              </svg>
+              Save
+            </button>
+
+            <button
+              type="submit"
+              form="content-form"
+              name="action"
+              value="save_and_close"
+              class="inline-flex items-center justify-center gap-x-1.5 rounded-lg bg-white dark:bg-zinc-800 px-3.5 py-2.5 text-sm font-semibold text-zinc-950 dark:text-white ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10 hover:bg-zinc-50 dark:hover:bg-zinc-700 transition-colors shadow-sm"
+            >
+              <svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="1.5">
+                <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12"/>
+              </svg>
+              Save & close
+            </button>
 
-            ${data.user?.role !== "viewer" ? `
+            ${data.user?.role !== "viewer" && data.versioningEnabled ? `
               <button
                 type="submit"
                 form="content-form"
                 name="action"
                 value="save_and_publish"
-                class="inline-flex items-center justify-center gap-x-1.5 rounded-lg ${data.versioningEnabled ? "bg-lime-600 dark:bg-lime-500 hover:bg-lime-700 dark:hover:bg-lime-600" : "bg-zinc-950 dark:bg-white hover:bg-zinc-800 dark:hover:bg-zinc-100 text-white dark:text-zinc-950"} px-3.5 py-2.5 text-sm font-semibold text-white transition-colors shadow-sm"
+                class="inline-flex items-center justify-center gap-x-1.5 rounded-lg bg-lime-600 dark:bg-lime-500 hover:bg-lime-700 dark:hover:bg-lime-600 px-3.5 py-2.5 text-sm font-semibold text-white transition-colors shadow-sm"
               >
                 <svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="1.5">
                   <path stroke-linecap="round" stroke-linejoin="round" d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z"/>
                 </svg>
-                ${data.versioningEnabled ? `${isEdit ? "Update" : "Save"} & Publish` : isEdit ? "Update" : "Save"}
+                Publish
               </button>
             ` : ""}
           </div>
@@ -12276,6 +12575,9 @@ adminContentRoutes.post("/", async (c) => {
       }), user?.userId);
       const cache2 = getCacheService(CACHE_CONFIGS.content);
       await cache2.invalidate(`content:list:${collectionId}:*`);
+      const apiCacheCreate = getCacheService(CACHE_CONFIGS.api);
+      await apiCacheCreate.invalidate("api:content-filtered:*");
+      await apiCacheCreate.invalidate(`api:collection-content-filtered:${createDocType.id}:*`);
       const redirectUrl2 = `/admin/content/${doc.rootId}/edit?success=Content created successfully!`;
       return c.req.header("HX-Request") === "true" ? c.text("", 200, { "HX-Redirect": redirectUrl2 }) : c.redirect(redirectUrl2);
     }
@@ -12394,8 +12696,28 @@ adminContentRoutes.put("/:id", async (c) => {
         if (status2 === "published") await svc.publish(newDraft.id, user?.userId);
         else if (pub) await svc.unpublish(pub.id);
         await getCacheService(CACHE_CONFIGS.content).invalidate(`content:list:*`);
+        const apiCacheEdit = getCacheService(CACHE_CONFIGS.api);
+        await apiCacheEdit.invalidate("api:content-filtered:*");
+        await apiCacheEdit.invalidate(`api:collection-content-filtered:${docRowU.type_id}:*`);
+        const isHTMX2 = c.req.header("HX-Request") === "true";
+        const referrerParams = formData.get("referrer_params");
+        const listUrl = referrerParams ? `/admin/content?${referrerParams}` : `/admin/content?collection=${dcoll.id}`;
+        if (action === "save_and_close") {
+          return isHTMX2 ? c.text("", 200, { "HX-Redirect": listUrl }) : c.redirect(listUrl);
+        }
+        if (isHTMX2) {
+          const label = status2 === "published" ? "Content published successfully!" : "Content saved successfully!";
+          return c.html(html`<div id="form-messages">
+            <div class="rounded-lg bg-green-50 dark:bg-green-900/20 p-4 mb-4 flex items-center gap-3 border border-green-200 dark:border-green-800">
+              <svg class="h-5 w-5 text-green-500 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="1.5">
+                <path stroke-linecap="round" stroke-linejoin="round" d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z"/>
+              </svg>
+              <span class="text-sm font-medium text-green-800 dark:text-green-200">${label}</span>
+            </div>
+          </div>`);
+        }
         const redirectUrl2 = `/admin/content/${id}/edit?success=Content updated successfully!`;
-        return c.req.header("HX-Request") === "true" ? c.text("", 200, { "HX-Redirect": redirectUrl2 }) : c.redirect(redirectUrl2);
+        return c.redirect(redirectUrl2);
       }
     }
     return c.html(html`
@@ -12789,8 +13111,8 @@ adminContentRoutes.post("/bulk-action", async (c) => {
     }
     await cache.invalidate("content:list:*");
     const apiCache = getCacheService(CACHE_CONFIGS.api);
-    await apiCache.invalidate("content-filtered:*");
-    await apiCache.invalidate("collection-content-filtered:*");
+    await apiCache.invalidate("api:content-filtered:*");
+    await apiCache.invalidate("api:collection-content-filtered:*");
     return c.json({ success: true, count: ids.length });
   } catch (error) {
     console.error("Bulk action error:", error);
@@ -12808,6 +13130,9 @@ adminContentRoutes.delete("/:id", async (c) => {
       const now2 = Math.floor(Date.now() / 1e3);
       await db.prepare("UPDATE documents SET deleted_at = ?, updated_at = ? WHERE root_id = ? AND tenant_id = ?").bind(now2, now2, id, tenantId).run();
       await getCacheService(CACHE_CONFIGS.content).invalidate("content:list:*");
+      const apiCacheDel = getCacheService(CACHE_CONFIGS.api);
+      await apiCacheDel.invalidate("api:content-filtered:*");
+      await apiCacheDel.invalidate(`api:collection-content-filtered:${docDel.type_id}:*`);
       return c.html(`
         <div id="content-list" hx-get="/admin/content?model=${docDel.type_id}" hx-trigger="load" hx-swap="outerHTML">
           <div class="flex items-center justify-center p-8"><span class="text-zinc-500">Deleting\u2026</span></div>
@@ -13103,7 +13428,7 @@ adminContentRoutes.post("/documents/:typeId/:documentId/delete", async (c) => {
 adminContentRoutes.get("/documents/:typeId/:rootId/versions", async (c) => {
   const { typeId, rootId } = c.req.param();
   const db = c.env.DB;
-  const { renderVersionHistoryFragment } = await import('./admin-documents-form.template-55V2ZGWT.js');
+  const { renderVersionHistoryFragment } = await import('./admin-documents-form.template-JWV5GITD.js');
   const registry = new DocumentTypeRegistry(db);
   const docType = await registry.findById(typeId);
   if (!docType) return c.html("<div>Unknown type.</div>", 404);
@@ -15358,12 +15683,10 @@ var LANGUAGES = [
   { value: "ko", label: "Korean" },
   { value: "zh", label: "Chinese" }
 ];
-var ROLES = [
-  { value: "admin", label: "Administrator" },
-  { value: "editor", label: "Editor" },
-  { value: "author", label: "Author" },
-  { value: "viewer", label: "Viewer" }
-];
+async function fetchRoleOptions(db) {
+  const roles = await new RbacService(db).getRoles();
+  return roles.map((r) => ({ value: r.id, label: r.display_name }));
+}
 userRoutes.get("/profile", async (c) => {
   const user = c.get("user");
   const db = c.env.DB;
@@ -15812,8 +16135,9 @@ userRoutes.get("/users/new", async (c) => {
     const regFieldNames = profileConfig?.registrationFields ?? [];
     const regFields = profileConfig && upRow ? regFieldNames.length > 0 ? profileConfig.fields.filter((f) => regFieldNames.includes(f.name)) : profileConfig.fields : [];
     const registrationFieldsHtml = regFields.length > 0 ? renderCustomProfileSection({ fields: regFields }, {}) : void 0;
+    const roles = await fetchRoleOptions(db);
     const pageData = {
-      roles: ROLES,
+      roles,
       registrationFieldsHtml,
       user: {
         name: user.email.split("@")[0] || user.email,
@@ -15841,9 +16165,9 @@ userRoutes.post("/users/new", async (c) => {
     const email = formData.get("email")?.toString()?.trim().toLowerCase() || "";
     const phone = sanitizeInput(formData.get("phone")?.toString()) || null;
     const bio = sanitizeInput(formData.get("bio")?.toString()) || null;
-    const roleInput = formData.get("role")?.toString() || "viewer";
-    const validRoles = ["admin", "editor", "author", "viewer"];
-    const role = validRoles.includes(roleInput) ? roleInput : "viewer";
+    const roleInput = formData.get("role")?.toString() || "";
+    const validRoles = (await new RbacService(db).getRoles()).map((r) => r.id);
+    const role = validRoles.includes(roleInput) ? roleInput : validRoles[0] ?? "admin";
     const password = formData.get("password")?.toString() || "";
     const confirmPassword = formData.get("confirm_password")?.toString() || "";
     const isActive = formData.get("is_active") === "1";
@@ -16065,9 +16389,10 @@ userRoutes.get("/users/:id/edit", async (c) => {
     }
     const queryMessage = c.req.query("message");
     const queryType = c.req.query("type") === "error" ? "error" : "success";
+    const roles = await fetchRoleOptions(db);
     const pageData = {
       userToEdit: editData,
-      roles: ROLES,
+      roles,
       hasProfilePlugin: profileConfig !== null && upRow !== null,
       customProfileFieldsHtml,
       tenantMemberships,
@@ -16099,9 +16424,9 @@ userRoutes.put("/users/:id", async (c) => {
     const lastName = sanitizeInput(formData.get("last_name")?.toString());
     const email = formData.get("email")?.toString()?.trim().toLowerCase() || "";
     const phone = sanitizeInput(formData.get("phone")?.toString()) || null;
-    const roleInput = formData.get("role")?.toString() || "viewer";
-    const validRoles = ["admin", "editor", "author", "viewer"];
-    const role = validRoles.includes(roleInput) ? roleInput : "viewer";
+    const roleInput = formData.get("role")?.toString() || "";
+    const validRoles = (await new RbacService(db).getRoles()).map((r) => r.id);
+    const role = validRoles.includes(roleInput) ? roleInput : validRoles[0] ?? "admin";
     const isActive = formData.get("is_active") === "1";
     const emailVerified = formData.get("email_verified") === "1";
     const newPassword = formData.get("new_password")?.toString() || "";
@@ -18688,15 +19013,6 @@ function renderPluginsListPage(data) {
             </div>
 
             <div class="flex items-center gap-3 w-full sm:w-auto">
-              <select id="sort-filter" onchange="filterAndSortPlugins()" class="block w-full sm:w-auto h-9 rounded-md border-0 py-1.5 pl-3 pr-8 text-zinc-900 ring-1 ring-inset ring-zinc-300 focus:ring-2 focus:ring-inset focus:ring-zinc-600 dark:bg-zinc-900 dark:text-white dark:ring-zinc-700 dark:focus:ring-zinc-500 sm:text-sm sm:leading-6">
-                <option value="name-asc">Name (A-Z)</option>
-                <option value="name-desc">Name (Z-A)</option>
-                <option value="newest">Newest Installed</option>
-                <option value="updated">Recently Updated</option>
-                <option value="popular">Popularity</option>
-                <option value="rating">Highest Rated</option>
-              </select>
-
               <button
                 onclick="location.reload()"
                 class="inline-flex items-center gap-x-1.5 rounded-md bg-white dark:bg-zinc-900 px-3 py-1.5 h-9 text-sm font-semibold text-zinc-900 dark:text-white shadow-sm ring-1 ring-inset ring-zinc-300 dark:ring-zinc-700 hover:bg-zinc-50 dark:hover:bg-zinc-800"
@@ -18860,8 +19176,6 @@ function renderPluginsListPage(data) {
           .forEach(cb => params.append('status', cb.value));
         const search = document.getElementById('search-input').value;
         if (search) params.set('search', search);
-        const sort = document.getElementById('sort-filter').value;
-        if (sort && sort !== 'name-asc') params.set('sort', sort);
         const url = new URL(window.location.href);
         url.search = params.toString();
         history.replaceState(null, '', url.toString());
@@ -18879,8 +19193,6 @@ function renderPluginsListPage(data) {
         });
         const search = params.get('search');
         if (search) document.getElementById('search-input').value = search;
-        const sort = params.get('sort');
-        if (sort) document.getElementById('sort-filter').value = sort;
         if (params.toString()) filterAndSortPlugins();
       }
 
@@ -18896,7 +19208,6 @@ function renderPluginsListPage(data) {
           .map(cb => cb.value.toLowerCase());
 
         const searchInput = document.getElementById('search-input').value.toLowerCase();
-        const sortValue = document.getElementById('sort-filter').value;
 
         const pluginsGrid = document.getElementById('plugins-grid');
         const pluginCards = Array.from(pluginsGrid.querySelectorAll('.plugin-card'));
@@ -18920,30 +19231,6 @@ function renderPluginsListPage(data) {
           return true;
         });
 
-        // Sort
-        visibleCards.sort((a, b) => {
-          const aName = a.getAttribute('data-name') || '';
-          const bName = b.getAttribute('data-name') || '';
-          const aInstalled = parseInt(a.getAttribute('data-installed') || '0');
-          const bInstalled = parseInt(b.getAttribute('data-installed') || '0');
-          const aUpdated = parseInt(a.getAttribute('data-updated') || '0');
-          const bUpdated = parseInt(b.getAttribute('data-updated') || '0');
-          const aDownloads = parseInt(a.getAttribute('data-downloads') || '0');
-          const bDownloads = parseInt(b.getAttribute('data-downloads') || '0');
-          const aRating = parseFloat(a.getAttribute('data-rating') || '0');
-          const bRating = parseFloat(b.getAttribute('data-rating') || '0');
-
-          switch (sortValue) {
-            case 'name-desc': return bName.localeCompare(aName);
-            case 'newest': return bInstalled - aInstalled;
-            case 'updated': return bUpdated - aUpdated;
-            case 'popular': return bDownloads - aDownloads;
-            case 'rating': return bRating - aRating;
-            case 'name-asc':
-            default: return aName.localeCompare(bName);
-          }
-        });
-
         // Re-append
         pluginCards.forEach(card => card.style.display = 'none'); // Hide all first
         
@@ -19378,7 +19665,8 @@ function escapeHtmlAttr(value) {
 function renderPluginSettingsPage(data) {
   const { plugin, activity = [], user, settingsTabData } = data;
   const pluginDef = getPluginDefinition(plugin.id || plugin.name);
-  const hasUserSettings = pluginDef?.settingsTabContent != null || Object.keys(plugin.settings || {}).some((k) => !k.startsWith("_"));
+  const pluginId = plugin.id || plugin.name;
+  const hasUserSettings = pluginDef?.settingsTabContent != null || Object.keys(plugin.settings || {}).some((k) => !k.startsWith("_")) || hasCustomSettingsComponent(pluginId);
   const defaultTab = hasUserSettings ? "settings" : "info";
   const pageContent = `
     <div class="w-full px-4 sm:px-6 lg:px-8 py-6">
@@ -19543,9 +19831,28 @@ function renderPluginSettingsPage(data) {
         const form = document.getElementById('settings-form');
         const formData = new FormData(form);
         const isAuthPlugin = '${plugin.id}' === 'core-auth';
+        const isOAuthPlugin = '${plugin.id}' === 'oauth-providers';
         let settings = {};
 
-        if (isAuthPlugin) {
+        if (isOAuthPlugin) {
+          // Build nested provider settings structure
+          const getVal = id => (document.getElementById(id) || {}).value || '';
+          const getChecked = id => !!(document.getElementById(id) || {}).checked;
+          settings = {
+            providers: {
+              github: {
+                clientId: getVal('oauth_github_clientId'),
+                clientSecret: getVal('oauth_github_clientSecret'),
+                enabled: getChecked('oauth_github_enabled'),
+              },
+              google: {
+                clientId: getVal('oauth_google_clientId'),
+                clientSecret: getVal('oauth_google_clientSecret'),
+                enabled: getChecked('oauth_google_enabled'),
+              },
+            }
+          };
+        } else if (isAuthPlugin) {
           // Handle nested auth settings structure
           settings = {
             requiredFields: {},
@@ -20033,7 +20340,8 @@ function formatTimestamp(timestamp) {
 }
 var pluginSettingsComponents = {
   "otp-login": renderOTPLoginSettingsContent,
-  "email": renderEmailSettingsContent
+  "email": renderEmailSettingsContent,
+  "oauth-providers": renderOAuthProvidersSettingsContent
 };
 function renderOTPLoginSettingsContent(plugin, settings) {
   const siteName = settings.siteName || "SonicJS";
@@ -20756,6 +21064,62 @@ defineUserProfile({
     </div>
   `;
 }
+function renderOAuthProvidersSettingsContent(plugin, settings) {
+  const providers = settings.providers || {};
+  const gh = providers.github || {};
+  const gg = providers.google || {};
+  const inputClass = "backdrop-blur-sm bg-white/10 border border-white/20 rounded-lg px-3 py-2 text-white placeholder-gray-300 focus:border-blue-400 focus:outline-none transition-colors w-full";
+  return `
+    <div class="space-y-6">
+      <form id="settings-form">
+        <div class="backdrop-blur-md bg-white/5 rounded-xl border border-white/10 p-6 space-y-6">
+          <h3 class="text-lg font-semibold text-white">GitHub OAuth</h3>
+          <div>
+            <label for="oauth_github_clientId" class="block text-sm font-medium text-gray-300 mb-2">Client ID</label>
+            <input type="text" id="oauth_github_clientId" name="oauth_github_clientId"
+              value="${escapeHtmlAttr(gh.clientId || "")}"
+              placeholder="GitHub OAuth App Client ID" class="${inputClass}" />
+          </div>
+          <div>
+            <label for="oauth_github_clientSecret" class="block text-sm font-medium text-gray-300 mb-2">Client Secret</label>
+            <input type="password" id="oauth_github_clientSecret" name="oauth_github_clientSecret"
+              value="${escapeHtmlAttr(gh.clientSecret || "")}"
+              placeholder="GitHub OAuth App Client Secret" class="${inputClass}" />
+          </div>
+          <div class="flex items-center gap-3">
+            <input type="checkbox" id="oauth_github_enabled" name="oauth_github_enabled"
+              ${gh.enabled ? "checked" : ""} class="w-4 h-4 rounded border-white/10" />
+            <label for="oauth_github_enabled" class="text-sm text-gray-300">Enable GitHub login</label>
+          </div>
+        </div>
+
+        <div class="backdrop-blur-md bg-white/5 rounded-xl border border-white/10 p-6 space-y-6 mt-6">
+          <h3 class="text-lg font-semibold text-white">Google OAuth</h3>
+          <div>
+            <label for="oauth_google_clientId" class="block text-sm font-medium text-gray-300 mb-2">Client ID</label>
+            <input type="text" id="oauth_google_clientId" name="oauth_google_clientId"
+              value="${escapeHtmlAttr(gg.clientId || "")}"
+              placeholder="Google OAuth Client ID" class="${inputClass}" />
+          </div>
+          <div>
+            <label for="oauth_google_clientSecret" class="block text-sm font-medium text-gray-300 mb-2">Client Secret</label>
+            <input type="password" id="oauth_google_clientSecret" name="oauth_google_clientSecret"
+              value="${escapeHtmlAttr(gg.clientSecret || "")}"
+              placeholder="Google OAuth Client Secret" class="${inputClass}" />
+          </div>
+          <div class="flex items-center gap-3">
+            <input type="checkbox" id="oauth_google_enabled" name="oauth_google_enabled"
+              ${gg.enabled ? "checked" : ""} class="w-4 h-4 rounded border-white/10" />
+            <label for="oauth_google_enabled" class="text-sm text-gray-300">Enable Google login</label>
+          </div>
+        </div>
+      </form>
+    </div>
+  `;
+}
+function hasCustomSettingsComponent(pluginId) {
+  return pluginId in pluginSettingsComponents;
+}
 
 // src/plugins/core-plugins/menu-plugin/services/menu-reconcile.ts
 async function upsertPluginRow(db, slug, entry, visible) {
@@ -27116,6 +27480,6 @@ var ROUTES_INFO = {
   reference: "https://github.com/sonicjs/sonicjs"
 };
 
-export { DocumentRepository, ROUTES_INFO, TenantService, VALID_MEMBER_ROLES, adminCheckboxRoutes, adminCollectionsRoutes, adminDocumentsRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, admin_api_default, admin_content_default, apiDocumentsRoutes, api_content_crud_default, api_default, api_media_default, api_system_default, auth_default, createDocumentSchema, createUserProfilesPlugin, defineUserProfile, denyIfNotAllowed, dispatchHookEvent, effectiveTenantForType, getConfirmationDialogScript2 as getConfirmationDialogScript, getCustomData, getDocumentRequestContext, getEmailService, getUserProfileConfig, getVariablesCached, hasEmailService, invalidateVariablesCache, isValidMemberRole, lexicalEditorPlugin, reconcileMenuFromPlugins, renderConfirmationDialog2 as renderConfirmationDialog, renderTable2 as renderTable, resolveDocScope, resolveVariablesInObject, router, router2, setEmailService, setVariablesCache, test_cleanup_default, updateDocumentSchema, userProfilesPlugin, userRoutes };
-//# sourceMappingURL=chunk-VC5XVPLM.js.map
-//# sourceMappingURL=chunk-VC5XVPLM.js.map
+export { DocumentRepository, ROUTES_INFO, TenantService, VALID_MEMBER_ROLES, adminCheckboxRoutes, adminCollectionsRoutes, adminDocumentsRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, admin_api_default, admin_content_default, apiDocumentsRoutes, api_content_crud_default, api_default, api_media_default, api_system_default, auth_default, createDocumentSchema, createUserProfilesPlugin, defineUserProfile, denyIfNotAllowed, dispatchHookEvent, effectiveTenantForType, getConfirmationDialogScript2 as getConfirmationDialogScript, getCustomData, getDocumentRequestContext, getEmailService, getUserProfileConfig, getVariablesCached, hasEmailService, invalidateVariablesCache, isValidMemberRole, lexicalEditorPlugin, reconcileMenuFromPlugins, renderConfirmationDialog2 as renderConfirmationDialog, renderTable2 as renderTable, resolveDocScope, resolveVariablesInObject, router, router2, setDemoModeActive, setEmailService, setVariablesCache, swrStats, test_cleanup_default, updateDocumentSchema, userProfilesPlugin, userRoutes };
+//# sourceMappingURL=chunk-OJFIQGZB.js.map
+//# sourceMappingURL=chunk-OJFIQGZB.js.map