@sonicjs-cms/core 3.0.0-beta.24 → 3.0.0-beta.26

package/dist/{chunk-I767LVN7.cjs → chunk-S2QN4LFD.cjs}

@@ -1,20 +1,21 @@
 'use strict';
 
+var chunkTT3TQSCZ_cjs = require('./chunk-TT3TQSCZ.cjs');
+var chunkFZGIU5AZ_cjs = require('./chunk-FZGIU5AZ.cjs');
 var chunkXWVDSM2L_cjs = require('./chunk-XWVDSM2L.cjs');
-var chunkJMJM7DMM_cjs = require('./chunk-JMJM7DMM.cjs');
-var chunk36Z3AKX3_cjs = require('./chunk-36Z3AKX3.cjs');
-var chunk37V3RET3_cjs = require('./chunk-37V3RET3.cjs');
-var chunkLTZ5WYOK_cjs = require('./chunk-LTZ5WYOK.cjs');
+var chunkC5LDQ3SH_cjs = require('./chunk-C5LDQ3SH.cjs');
+var chunkBRKXMRMB_cjs = require('./chunk-BRKXMRMB.cjs');
+var chunkOLEOKHDX_cjs = require('./chunk-OLEOKHDX.cjs');
 var chunkKIGVVO6N_cjs = require('./chunk-KIGVVO6N.cjs');
-var chunkQCJHCSOK_cjs = require('./chunk-QCJHCSOK.cjs');
-var chunkA2SN3RVL_cjs = require('./chunk-A2SN3RVL.cjs');
-var chunkE66UVONV_cjs = require('./chunk-E66UVONV.cjs');
-var chunkUYJQDDEE_cjs = require('./chunk-UYJQDDEE.cjs');
-var chunkBP52BFIV_cjs = require('./chunk-BP52BFIV.cjs');
+var chunk4DHPR7KR_cjs = require('./chunk-4DHPR7KR.cjs');
+var chunkPAS7GZBS_cjs = require('./chunk-PAS7GZBS.cjs');
+var chunkOUBUS74I_cjs = require('./chunk-OUBUS74I.cjs');
+var chunkMI2YXCK4_cjs = require('./chunk-MI2YXCK4.cjs');
+var chunkKWQNB6UM_cjs = require('./chunk-KWQNB6UM.cjs');
 var chunkJ6JTWD2A_cjs = require('./chunk-J6JTWD2A.cjs');
-var chunkIXUHXTHW_cjs = require('./chunk-IXUHXTHW.cjs');
+var chunkSFGYZUWU_cjs = require('./chunk-SFGYZUWU.cjs');
 var chunkRCQ2HIQD_cjs = require('./chunk-RCQ2HIQD.cjs');
-var chunkKKNEYIZJ_cjs = require('./chunk-KKNEYIZJ.cjs');
+var chunkXZUEGFXE_cjs = require('./chunk-XZUEGFXE.cjs');
 var chunkMNWKYY5E_cjs = require('./chunk-MNWKYY5E.cjs');
 var hono = require('hono');
 var zod = require('zod');
@@ -47,6 +48,7 @@ var DocumentPermissionsService = class {
         const publicGrants = baseGrants["public"] ?? [];
         if (publicGrants.includes(permission)) return true;
       } else if (principal.type === "role") {
+        if (principal.id === "public") continue;
         const roleGrants = baseGrants[principal.id] ?? [];
         if (roleGrants.includes(permission)) return true;
       }
@@ -271,7 +273,7 @@ function getDocumentRequestContext(c) {
 
 // src/routes/api-documents.ts
 async function aclAllowsRead(db, tenantId, principalSet, row, preloadedType) {
-  const docType = preloadedType ?? await new chunk37V3RET3_cjs.DocumentTypeRegistry(db).findById(row.type_id);
+  const docType = preloadedType ?? await new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db).findById(row.type_id);
   if (!docType) return false;
   return new DocumentRepository(db, tenantId).isAllowed(principalSet, row.root_id, "read", docType.settings);
 }
@@ -289,7 +291,7 @@ apiDocumentsRoutes.get("/", async (c) => {
     if (!typeId) {
       return c.json({ error: "type query parameter is required" }, 400);
     }
-    const registry = new chunk37V3RET3_cjs.DocumentTypeRegistry(db);
+    const registry = new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db);
     const docType = await registry.findById(typeId);
     if (!docType || !docType.isActive) {
       return c.json({ error: "Unknown document type" }, 400);
@@ -371,7 +373,7 @@ apiDocumentsRoutes.get("/root/:rootId", async (c) => {
          AND (expires_at IS NULL OR expires_at > ?) LIMIT 1`
     ).bind(rootId, now, now).first();
     if (!row) return c.json({ error: "Not found" }, 404);
-    const docType = await new chunk37V3RET3_cjs.DocumentTypeRegistry(db).findById(row.type_id);
+    const docType = await new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db).findById(row.type_id);
     const effTenant = effectiveTenantForType(tenantId, docType?.settings);
     if (row.tenant_id !== effTenant) return c.json({ error: "Not found" }, 404);
     if (!await aclAllowsRead(db, effTenant, principalSet, row, docType)) {
@@ -407,7 +409,7 @@ apiDocumentsRoutes.get("/:id", async (c) => {
          AND (expires_at IS NULL OR expires_at > ?) LIMIT 1`
     ).bind(id, now, now).first();
     if (!row) return c.json({ error: "Not found" }, 404);
-    const docType = await new chunk37V3RET3_cjs.DocumentTypeRegistry(db).findById(row.type_id);
+    const docType = await new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db).findById(row.type_id);
     const effTenant = effectiveTenantForType(tenantId, docType?.settings);
     if (row.tenant_id !== effTenant) return c.json({ error: "Not found" }, 404);
     if (!await aclAllowsRead(db, effTenant, principalSet, row, docType)) {
@@ -477,17 +479,17 @@ async function resolveDocScope(c, db, by, opts = {}) {
   const draft = opts.currentDraftOnly ? " AND is_current_draft = 1" : "";
   const row = await db.prepare(`SELECT type_id, root_id, tenant_id FROM documents WHERE ${col} = ?${draft} LIMIT 1`).bind(val).first();
   if (!row) return null;
-  const docType = await new chunk37V3RET3_cjs.DocumentTypeRegistry(db).findById(row.type_id);
+  const docType = await new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db).findById(row.type_id);
   const tenantId = effectiveTenantForType(getRequestTenant(c), docType?.settings);
   if (row.tenant_id !== tenantId) return null;
   return { typeId: row.type_id, rootId: row.root_id, tenantId, docType };
 }
 var adminDocumentsRoutes = new hono.Hono();
-adminDocumentsRoutes.use("*", chunk37V3RET3_cjs.requireAuth());
-adminDocumentsRoutes.use("*", chunk37V3RET3_cjs.requireRole(["admin", "editor"]));
+adminDocumentsRoutes.use("*", chunkBRKXMRMB_cjs.requireAuth());
+adminDocumentsRoutes.use("*", chunkBRKXMRMB_cjs.requireRole(["admin", "editor"]));
 adminDocumentsRoutes.get("/types", async (c) => {
   try {
-    const registry = new chunk37V3RET3_cjs.DocumentTypeRegistry(c.env.DB);
+    const registry = new chunkBRKXMRMB_cjs.DocumentTypeRegistry(c.env.DB);
     const types = await registry.findAll();
     return c.json({ data: types });
   } catch (error) {
@@ -515,7 +517,7 @@ adminDocumentsRoutes.get("/", async (c) => {
     if (!typeId) {
       return c.json({ error: "type query parameter is required" }, 400);
     }
-    const registry = new chunk37V3RET3_cjs.DocumentTypeRegistry(db);
+    const registry = new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db);
     const docType = await registry.findById(typeId);
     if (!docType || !docType.isActive) {
       return c.json({ error: "Unknown document type" }, 400);
@@ -626,7 +628,7 @@ adminDocumentsRoutes.post("/", async (c) => {
     const input = validation.data;
     const db = c.env.DB;
     const user = c.get("user");
-    const registry = new chunk37V3RET3_cjs.DocumentTypeRegistry(db);
+    const registry = new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db);
     const docType = await registry.findById(input.typeId);
     if (!docType || !docType.isActive) {
       return c.json({ error: "Unknown document type" }, 400);
@@ -634,7 +636,7 @@ adminDocumentsRoutes.post("/", async (c) => {
     const createDenied = await denyIfNotAllowed(c, db, "", "create", docType.settings);
     if (createDenied) return createDenied;
     const tenantId = effectiveTenantForType(getRequestTenant(c), docType.settings);
-    const svc = new chunkLTZ5WYOK_cjs.DocumentsService(db, {
+    const svc = new chunkOLEOKHDX_cjs.DocumentsService(db, {
       queryableFields: docType.queryableFields,
       typeSchemaVersion: docType.schemaVersion,
       maxVersionsPerRoot: docType.settings.maxVersionsPerRoot,
@@ -672,7 +674,7 @@ adminDocumentsRoutes.put("/:rootId", async (c) => {
     const docType = scope.docType;
     const updateDenied = await denyIfNotAllowed(c, db, rootId, "update", docType?.settings, scope.tenantId);
     if (updateDenied) return updateDenied;
-    const svc = new chunkLTZ5WYOK_cjs.DocumentsService(db, {
+    const svc = new chunkOLEOKHDX_cjs.DocumentsService(db, {
       queryableFields: docType?.queryableFields ?? [],
       typeSchemaVersion: docType?.schemaVersion,
       maxVersionsPerRoot: docType?.settings.maxVersionsPerRoot,
@@ -697,7 +699,7 @@ adminDocumentsRoutes.post("/:id/publish", async (c) => {
     const docType = scope.docType;
     const publishDenied = await denyIfNotAllowed(c, db, scope.rootId, "publish", docType?.settings, scope.tenantId);
     if (publishDenied) return publishDenied;
-    const svc = new chunkLTZ5WYOK_cjs.DocumentsService(db, {
+    const svc = new chunkOLEOKHDX_cjs.DocumentsService(db, {
       queryableFields: docType?.queryableFields ?? [],
       typeSchemaVersion: docType?.schemaVersion,
       tenantId: scope.tenantId,
@@ -720,7 +722,7 @@ adminDocumentsRoutes.post("/:id/unpublish", async (c) => {
     const docType = scope.docType;
     const unpublishDenied = await denyIfNotAllowed(c, db, scope.rootId, "publish", docType?.settings, scope.tenantId);
     if (unpublishDenied) return unpublishDenied;
-    const svc = new chunkLTZ5WYOK_cjs.DocumentsService(db, {
+    const svc = new chunkOLEOKHDX_cjs.DocumentsService(db, {
       queryableFields: docType?.queryableFields ?? [],
       tenantId: scope.tenantId
     });
@@ -742,7 +744,7 @@ adminDocumentsRoutes.delete("/:id", async (c) => {
     const docType = scope.docType;
     const deleteDenied = await denyIfNotAllowed(c, db, scope.rootId, "delete", docType?.settings, scope.tenantId);
     if (deleteDenied) return deleteDenied;
-    const svc = new chunkLTZ5WYOK_cjs.DocumentsService(db, { queryableFields: docType?.queryableFields ?? [], tenantId: scope.tenantId });
+    const svc = new chunkOLEOKHDX_cjs.DocumentsService(db, { queryableFields: docType?.queryableFields ?? [], tenantId: scope.tenantId });
     if (docType?.settings.pii) {
       if (scope.rootId) await svc.erase(scope.rootId, scope.tenantId);
     } else {
@@ -758,7 +760,7 @@ adminDocumentsRoutes.post("/types/:typeId/reindex", async (c) => {
   try {
     const { typeId } = c.req.param();
     const db = c.env.DB;
-    const registry = new chunk37V3RET3_cjs.DocumentTypeRegistry(db);
+    const registry = new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db);
     const docType = await registry.findById(typeId);
     if (!docType) return c.json({ error: "Unknown document type" }, 400);
     const reindexTenant = effectiveTenantForType(getRequestTenant(c), docType.settings);
@@ -844,6 +846,34 @@ async function dispatchHookEvent(c, event, payload, mode = "fire-and-forget") {
   return hooks.dispatch(event, payload);
 }
 
+// src/plugins/cache/services/swr.ts
+var STALE_TTL_MS = 3e4;
+var staleMap = /* @__PURE__ */ new Map();
+function markStale(cacheKey, data, collection) {
+  staleMap.set(cacheKey, {
+    data,
+    collection,
+    expiresAt: Date.now() + STALE_TTL_MS
+  });
+}
+function getAndConsumeStale(cacheKey) {
+  const entry = staleMap.get(cacheKey);
+  if (!entry) return null;
+  if (Date.now() > entry.expiresAt) {
+    staleMap.delete(cacheKey);
+    return null;
+  }
+  staleMap.delete(cacheKey);
+  return entry.data;
+}
+function swrStats() {
+  const now = Date.now();
+  for (const [key, entry] of staleMap.entries()) {
+    if (now > entry.expiresAt) staleMap.delete(key);
+  }
+  return { count: staleMap.size };
+}
+
 // src/plugins/core-plugins/global-variables-plugin/variable-resolver.ts
 var TOKEN_PATTERN = /\{([a-z0-9_]+)\}/g;
 function resolveVariables(text, variables) {
@@ -912,13 +942,13 @@ async function resolveContentVariables(contentData, db) {
 // src/routes/api-content-crud.ts
 var apiContentCrudRoutes = new hono.Hono();
 async function resolveDocBacking(db, collectionIdOrName) {
-  const registry = chunkQCJHCSOK_cjs.getCollectionRegistry();
+  const registry = chunk4DHPR7KR_cjs.getCollectionRegistry();
   const record = registry.getBySlugOrName(collectionIdOrName) ?? registry.getById(collectionIdOrName);
   if (record) {
-    const docType2 = await new chunk37V3RET3_cjs.DocumentTypeRegistry(db).findById(record.name);
+    const docType2 = await new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db).findById(record.name);
     return docType2 ? { coll: { id: record.id, name: record.name }, docType: docType2 } : null;
   }
-  const docType = await new chunk37V3RET3_cjs.DocumentTypeRegistry(db).findById(collectionIdOrName);
+  const docType = await new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db).findById(collectionIdOrName);
   if (docType) {
     return { coll: { id: collectionIdOrName, name: collectionIdOrName }, docType };
   }
@@ -961,7 +991,7 @@ apiContentCrudRoutes.get("/check-slug", async (c) => {
     }, 500);
   }
 });
-apiContentCrudRoutes.get("/:id", chunk37V3RET3_cjs.optionalAuth(), async (c) => {
+apiContentCrudRoutes.get("/:id", chunkBRKXMRMB_cjs.optionalAuth(), async (c) => {
   try {
     const id = c.req.param("id");
     const db = c.env.DB;
@@ -971,7 +1001,7 @@ apiContentCrudRoutes.get("/:id", chunk37V3RET3_cjs.optionalAuth(), async (c) =>
     ).bind(id, getRequestTenant(c)).first();
     let transformedContent;
     if (docRow) {
-      const coll = chunkQCJHCSOK_cjs.getCollectionRegistry().getByName(docRow.type_id);
+      const coll = chunk4DHPR7KR_cjs.getCollectionRegistry().getByName(docRow.type_id);
       transformedContent = {
         id: docRow.root_id,
         title: docRow.title,
@@ -980,8 +1010,8 @@ apiContentCrudRoutes.get("/:id", chunk37V3RET3_cjs.optionalAuth(), async (c) =>
         collectionId: coll?.id ?? docRow.type_id,
         data: docRow.data ? JSON.parse(docRow.data) : {},
         // D29: document timestamps are SECONDS; legacy `content` API contract is MILLISECONDS.
-        created_at: chunkLTZ5WYOK_cjs.documentSecondsToMs(docRow.created_at),
-        updated_at: chunkLTZ5WYOK_cjs.documentSecondsToMs(docRow.updated_at)
+        created_at: chunkOLEOKHDX_cjs.documentSecondsToMs(docRow.created_at),
+        updated_at: chunkOLEOKHDX_cjs.documentSecondsToMs(docRow.updated_at)
       };
     } else {
       return c.json({ error: "Content not found" }, 404);
@@ -996,6 +1026,32 @@ apiContentCrudRoutes.get("/:id", chunk37V3RET3_cjs.optionalAuth(), async (c) =>
       { collection: docRow.type_id, id: docRow.root_id, data: transformedContent.data },
       "fire-and-forget"
     );
+    const fieldsParam = c.req.query("fields");
+    if (fieldsParam) {
+      const projFields = fieldsParam.split(",").map((s) => s.trim()).filter(Boolean);
+      if (projFields.length > 0) {
+        const result = {};
+        const dataSubFields = [];
+        for (const f of projFields) {
+          if (f === "data") {
+            result.data = transformedContent.data;
+          } else if (f.startsWith("data.")) {
+            dataSubFields.push(f.slice(5));
+          } else if (Object.prototype.hasOwnProperty.call(transformedContent, f)) {
+            result[f] = transformedContent[f];
+          }
+        }
+        if (dataSubFields.length > 0 && !result.data) {
+          result.data = {};
+          for (const sub of dataSubFields) {
+            if (transformedContent.data && Object.prototype.hasOwnProperty.call(transformedContent.data, sub)) {
+              result.data[sub] = transformedContent.data[sub];
+            }
+          }
+        }
+        return c.json({ data: result });
+      }
+    }
     return c.json({ data: transformedContent });
   } catch (error) {
     console.error("Error fetching content:", error);
@@ -1005,7 +1061,7 @@ apiContentCrudRoutes.get("/:id", chunk37V3RET3_cjs.optionalAuth(), async (c) =>
     }, 500);
   }
 });
-apiContentCrudRoutes.post("/", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
+apiContentCrudRoutes.post("/", chunkBRKXMRMB_cjs.requireAuth(), chunkBRKXMRMB_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
   try {
     const db = c.env.DB;
     const user = c.get("user");
@@ -1039,7 +1095,7 @@ apiContentCrudRoutes.post("/", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3_cj
         return c.json({ error: "Write cancelled by plugin", details: String(err) }, 400);
       }
       const tenantId = getRequestTenant(c);
-      const svc = new chunkLTZ5WYOK_cjs.DocumentsService(db, {
+      const svc = new chunkOLEOKHDX_cjs.DocumentsService(db, {
         queryableFields: backing.docType.queryableFields ?? [],
         typeSchemaVersion: backing.docType.schemaVersion ?? 1,
         maxVersionsPerRoot: backing.docType.settings?.maxVersionsPerRoot ?? 50,
@@ -1058,9 +1114,9 @@ apiContentCrudRoutes.post("/", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3_cj
         }),
         user?.userId
       );
-      const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.api);
-      await cache.invalidate("content-filtered:*");
-      await cache.invalidate("collection-content-filtered:*");
+      const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.api);
+      await cache.invalidate("api:content-filtered:*");
+      await cache.invalidate(`api:collection-content-filtered:${backing.coll.name}:*`);
       dispatchHookEvent(
         c,
         "content:after:create",
@@ -1068,7 +1124,7 @@ apiContentCrudRoutes.post("/", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3_cj
         "fire-and-forget"
       );
       return c.json({
-        data: { id: doc.rootId, title: doc.title, slug: doc.slug, status: doc.status, collectionId: backing.coll.id, data: doc.data, created_at: chunkLTZ5WYOK_cjs.documentSecondsToMs(doc.createdAt), updated_at: chunkLTZ5WYOK_cjs.documentSecondsToMs(doc.updatedAt) }
+        data: { id: doc.rootId, title: doc.title, slug: doc.slug, status: doc.status, collectionId: backing.coll.id, data: doc.data, created_at: chunkOLEOKHDX_cjs.documentSecondsToMs(doc.createdAt), updated_at: chunkOLEOKHDX_cjs.documentSecondsToMs(doc.updatedAt) }
       }, 201);
     }
     return c.json({ error: "Collection is not document-backed" }, 400);
@@ -1080,7 +1136,7 @@ apiContentCrudRoutes.post("/", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3_cj
     }, 500);
   }
 });
-apiContentCrudRoutes.put("/:id", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
+apiContentCrudRoutes.put("/:id", chunkBRKXMRMB_cjs.requireAuth(), chunkBRKXMRMB_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
   try {
     const id = c.req.param("id");
     const db = c.env.DB;
@@ -1102,8 +1158,8 @@ apiContentCrudRoutes.put("/:id", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3_
       } catch (err) {
         return c.json({ error: "Write cancelled by plugin", details: String(err) }, 400);
       }
-      const docType = await new chunk37V3RET3_cjs.DocumentTypeRegistry(db).findById(docRow.type_id);
-      const svc = new chunkLTZ5WYOK_cjs.DocumentsService(db, {
+      const docType = await new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db).findById(docRow.type_id);
+      const svc = new chunkOLEOKHDX_cjs.DocumentsService(db, {
         queryableFields: docType?.queryableFields ?? [],
         typeSchemaVersion: docType?.schemaVersion ?? 1,
         maxVersionsPerRoot: docType?.settings?.maxVersionsPerRoot ?? 50,
@@ -1122,10 +1178,10 @@ apiContentCrudRoutes.put("/:id", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3_
       } else if (body.status === "draft" && pub) {
         await svc.unpublish(pub.id);
       }
-      const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.api);
-      await cache.invalidate("content-filtered:*");
-      await cache.invalidate("collection-content-filtered:*");
-      const coll = chunkQCJHCSOK_cjs.getCollectionRegistry().getByName(docRow.type_id);
+      const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.api);
+      await cache.invalidate("api:content-filtered:*");
+      await cache.invalidate(`api:collection-content-filtered:${docRow.type_id}:*`);
+      const coll = chunk4DHPR7KR_cjs.getCollectionRegistry().getByName(docRow.type_id);
       const saved = await db.prepare("SELECT * FROM documents WHERE id = ?").bind(newDraft.id).first();
       const savedData = saved?.data ? JSON.parse(saved.data) : {};
       dispatchHookEvent(c, "content:after:update", { collection: docRow.type_id, id, data: savedData, user: actor }, "fire-and-forget");
@@ -1134,7 +1190,7 @@ apiContentCrudRoutes.put("/:id", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3_
         dispatchHookEvent(c, "content:after:publish", { collection: docRow.type_id, id, data: savedData, user: actor }, "fire-and-forget");
       }
       return c.json({
-        data: { id: saved.root_id, title: saved.title, slug: saved.slug, status: saved.status, collectionId: coll?.id ?? docRow.type_id, data: savedData, created_at: chunkLTZ5WYOK_cjs.documentSecondsToMs(saved.created_at), updated_at: chunkLTZ5WYOK_cjs.documentSecondsToMs(saved.updated_at) }
+        data: { id: saved.root_id, title: saved.title, slug: saved.slug, status: saved.status, collectionId: coll?.id ?? docRow.type_id, data: savedData, created_at: chunkOLEOKHDX_cjs.documentSecondsToMs(saved.created_at), updated_at: chunkOLEOKHDX_cjs.documentSecondsToMs(saved.updated_at) }
       });
     }
     return c.json({ error: "Content not found" }, 404);
@@ -1146,7 +1202,7 @@ apiContentCrudRoutes.put("/:id", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3_
     }, 500);
   }
 });
-apiContentCrudRoutes.delete("/:id", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
+apiContentCrudRoutes.delete("/:id", chunkBRKXMRMB_cjs.requireAuth(), chunkBRKXMRMB_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
   try {
     const id = c.req.param("id");
     const db = c.env.DB;
@@ -1162,9 +1218,9 @@ apiContentCrudRoutes.delete("/:id", chunk37V3RET3_cjs.requireAuth(), chunk37V3RE
       }
       const now = Math.floor(Date.now() / 1e3);
       await db.prepare("UPDATE documents SET deleted_at = ?, updated_at = ? WHERE root_id = ? AND tenant_id = ?").bind(now, now, id, tenantId).run();
-      const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.api);
-      await cache.invalidate("content-filtered:*");
-      await cache.invalidate("collection-content-filtered:*");
+      const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.api);
+      await cache.invalidate("api:content-filtered:*");
+      await cache.invalidate(`api:collection-content-filtered:${docRow.type_id}:*`);
       dispatchHookEvent(c, "content:after:delete", { collection: docRow.type_id, id, data: {}, user: actor }, "fire-and-forget");
       return c.json({ success: true });
     }
@@ -1180,6 +1236,22 @@ apiContentCrudRoutes.delete("/:id", chunk37V3RET3_cjs.requireAuth(), chunk37V3RE
 var api_content_crud_default = apiContentCrudRoutes;
 
 // src/routes/api.ts
+function isAnonPrincipal(principalSet) {
+  return principalSet.length === 1 && principalSet[0]?.type === "public";
+}
+async function typeReadAllowed(db, principalSet, docType, typeName) {
+  const perms = new DocumentPermissionsService(db);
+  if (perms.isAllowedSync(principalSet, [], "read", docType?.settings ?? {})) return true;
+  const rbac = new chunkOLEOKHDX_cjs.RbacService(db);
+  let anyRbacRoleFound = false;
+  for (const p of principalSet) {
+    if (p.type !== "role") continue;
+    if (!await rbac.hasRbacRole(p.id)) continue;
+    anyRbacRoleFound = true;
+    if (await rbac.isGrantedForRole(p.id, `document_type:${typeName}`, "read")) return true;
+  }
+  return !anyRbacRoleFound;
+}
 var DOC_SORTABLE_COLUMNS = /* @__PURE__ */ new Set([
   "created_at",
   "updated_at",
@@ -1259,10 +1331,37 @@ function mapDocRowToContent(row, collectionId) {
     collectionId,
     data: row.data ? JSON.parse(row.data) : {},
     // D29: document timestamps are SECONDS; the legacy `content` API contract is MILLISECONDS.
-    created_at: chunkLTZ5WYOK_cjs.documentSecondsToMs(row.created_at),
-    updated_at: chunkLTZ5WYOK_cjs.documentSecondsToMs(row.updated_at)
+    created_at: chunkOLEOKHDX_cjs.documentSecondsToMs(row.created_at),
+    updated_at: chunkOLEOKHDX_cjs.documentSecondsToMs(row.updated_at)
   };
 }
+function projectFields(item, fields) {
+  if (fields.length === 0) return item;
+  const result = {};
+  const dataSubFields = [];
+  for (const f of fields) {
+    if (f === "data") {
+      result.data = item.data;
+    } else if (f.startsWith("data.")) {
+      dataSubFields.push(f.slice(5));
+    } else if (Object.prototype.hasOwnProperty.call(item, f)) {
+      result[f] = item[f];
+    }
+  }
+  if (dataSubFields.length > 0 && !result.data) {
+    result.data = {};
+    for (const sub of dataSubFields) {
+      if (item.data && Object.prototype.hasOwnProperty.call(item.data, sub)) {
+        result.data[sub] = item.data[sub];
+      }
+    }
+  }
+  return result;
+}
+function parseFieldsParam(raw2) {
+  if (!raw2) return [];
+  return raw2.split(",").map((s) => s.trim()).filter(Boolean);
+}
 var apiRoutes = new hono.Hono();
 apiRoutes.use("*", async (c, next) => {
   const startTime = Date.now();
@@ -1272,7 +1371,8 @@ apiRoutes.use("*", async (c, next) => {
   c.header("X-Response-Time", `${totalTime}ms`);
 });
 apiRoutes.use("*", async (c, next) => {
-  const cacheEnabled = await chunk37V3RET3_cjs.isPluginActive(c.env.DB, "core-cache");
+  const bypass = c.req.header("Cache-Control") === "no-cache";
+  const cacheEnabled = !bypass && await chunk4DHPR7KR_cjs.isPluginActive(c.env.DB, "core-cache");
   c.set("cacheEnabled", cacheEnabled);
   await next();
 });
@@ -1295,7 +1395,7 @@ apiRoutes.get("/", (c) => {
     openapi: "3.0.0",
     info: {
       title: "SonicJS AI API",
-      version: chunkKKNEYIZJ_cjs.getCoreVersion(),
+      version: chunkXZUEGFXE_cjs.getCoreVersion(),
       description: "RESTful API for SonicJS headless CMS - a modern, AI-powered content management system built on Cloudflare Workers",
       contact: {
         name: "SonicJS Support",
@@ -1699,7 +1799,7 @@ apiRoutes.get("/collections", async (c) => {
   try {
     const db = c.env.DB;
     const cacheEnabled = c.get("cacheEnabled");
-    const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.api);
+    const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.api);
     const cacheKey = cache.generateKey("collections", "all");
     if (cacheEnabled) {
       const cacheResult = await cache.getWithSource(cacheKey);
@@ -1725,8 +1825,8 @@ apiRoutes.get("/collections", async (c) => {
     }
     c.header("X-Cache-Status", "MISS");
     c.header("X-Cache-Source", "registry");
-    const records = chunkQCJHCSOK_cjs.getCollectionRegistry().listActive().filter((r) => !r.internal);
-    const transformedResults = records.map(chunkQCJHCSOK_cjs.collectionRecordToRow);
+    const records = chunk4DHPR7KR_cjs.getCollectionRegistry().listActive().filter((r) => !r.internal);
+    const transformedResults = records.map(chunk4DHPR7KR_cjs.collectionRecordToRow);
     const responseData = {
       data: transformedResults,
       meta: addTimingMeta(c, {
@@ -1747,16 +1847,21 @@ apiRoutes.get("/collections", async (c) => {
     return c.json({ error: "Failed to fetch collections" }, 500);
   }
 });
-apiRoutes.get("/content", chunk37V3RET3_cjs.optionalAuth(), async (c) => {
+apiRoutes.get("/content", chunkBRKXMRMB_cjs.optionalAuth(), async (c) => {
   const executionStart = Date.now();
   try {
     const db = c.env.DB;
     const queryParams = c.req.query();
+    const projFields = parseFieldsParam(queryParams.fields);
+    if (queryParams.fields) delete queryParams.fields;
     const role = c.get("user")?.role;
+    const { tenantId: cTenantId, principalSet: cPrincipalSet } = getDocumentRequestContext(c);
+    const cAnon = isAnonPrincipal(cPrincipalSet);
+    const cNeedsAcl = !cAnon && !canReadNonPublicContent(role);
     const collIdByName = /* @__PURE__ */ new Map();
     let typeId;
     let typeIds;
-    const registry = chunkQCJHCSOK_cjs.getCollectionRegistry();
+    const registry = chunk4DHPR7KR_cjs.getCollectionRegistry();
     if (queryParams.collection) {
       const collectionName = queryParams.collection;
       const record = registry.getByName(collectionName);
@@ -1786,11 +1891,11 @@ apiRoutes.get("/content", chunk37V3RET3_cjs.optionalAuth(), async (c) => {
         return r.name;
       });
     }
-    const filter = chunkIXUHXTHW_cjs.QueryFilterBuilder.parseFromQuery(queryParams);
+    const filter = chunkSFGYZUWU_cjs.QueryFilterBuilder.parseFromQuery(queryParams);
     const normalizedFilter = augmentFilterForDocuments(filter, { typeId, typeIds, role });
     if (!normalizedFilter.limit) normalizedFilter.limit = 50;
     normalizedFilter.limit = Math.min(normalizedFilter.limit, 1e3);
-    const builder = new chunkIXUHXTHW_cjs.QueryFilterBuilder();
+    const builder = new chunkSFGYZUWU_cjs.QueryFilterBuilder();
     const queryResult = builder.build("documents", normalizedFilter);
     if (queryResult.errors.length > 0) {
       return c.json({
@@ -1798,8 +1903,8 @@ apiRoutes.get("/content", chunk37V3RET3_cjs.optionalAuth(), async (c) => {
         details: queryResult.errors
       }, 400);
     }
-    const cacheEnabled = c.get("cacheEnabled");
-    const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.api);
+    const cacheEnabled = c.get("cacheEnabled") && !cNeedsAcl;
+    const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.api);
     const cacheKey = cache.generateKey("content-filtered", JSON.stringify({ filter: normalizedFilter, query: queryResult.sql }));
     if (cacheEnabled) {
       const cacheResult = await cache.getWithSource(cacheKey);
@@ -1820,19 +1925,61 @@ apiRoutes.get("/content", chunk37V3RET3_cjs.optionalAuth(), async (c) => {
             }
           }, executionStart)
         };
+        chunkFZGIU5AZ_cjs.recordCatalogRequest({ cacheKey, collection: typeId ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: cacheResult.source });
+        chunkFZGIU5AZ_cjs.scheduleKvWrite(cacheKey, c.executionCtx);
         return c.json(dataWithMeta);
       }
+      const swrData = getAndConsumeStale(cacheKey);
+      if (swrData) {
+        c.header("X-Cache-Status", "STALE");
+        c.header("X-Cache-Source", "swr");
+        chunkFZGIU5AZ_cjs.recordCatalogRequest({ cacheKey, collection: typeId ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: "swr" });
+        chunkFZGIU5AZ_cjs.scheduleKvWrite(cacheKey, c.executionCtx);
+        return c.json({ ...swrData, meta: addTimingMeta(c, { ...swrData.meta, cache: { hit: true, source: "swr", stale: true } }, executionStart) });
+      }
+      chunkFZGIU5AZ_cjs.recordCatalogRequest({ cacheKey, collection: typeId ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: "miss" });
+      chunkFZGIU5AZ_cjs.scheduleKvWrite(cacheKey, c.executionCtx);
     }
     c.header("X-Cache-Status", "MISS");
     c.header("X-Cache-Source", "database");
     const stmt = db.prepare(queryResult.sql);
     const boundStmt = queryResult.params.length > 0 ? stmt.bind(...queryResult.params) : stmt;
     const { results } = await boundStmt.all();
-    const transformedResults = results.map((row) => mapDocRowToContent(row, collIdByName.get(row.type_id) ?? null));
+    let aclResults = results;
+    if (cNeedsAcl) {
+      const typeReg = new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db);
+      const repo = new DocumentRepository(db, cTenantId);
+      const uniqueTypeIds = [...new Set(results.map((r) => r.type_id))];
+      const typeSettingsMap = /* @__PURE__ */ new Map();
+      const typeRbacOnlyMap = /* @__PURE__ */ new Map();
+      const typeDeniedMap = /* @__PURE__ */ new Map();
+      await Promise.all(uniqueTypeIds.map(async (tid) => {
+        const dt = await typeReg.findById(tid);
+        const settings = dt?.settings ?? {};
+        typeSettingsMap.set(tid, settings);
+        const allowed2 = await typeReadAllowed(db, cPrincipalSet, dt, tid);
+        if (!allowed2) {
+          typeDeniedMap.set(tid, true);
+          return;
+        }
+        const perms = new DocumentPermissionsService(db);
+        typeRbacOnlyMap.set(tid, !perms.isAllowedSync(cPrincipalSet, [], "read", settings));
+      }));
+      const allowed = await Promise.all(
+        results.map((row) => {
+          const tid = row.type_id;
+          if (typeDeniedMap.get(tid)) return Promise.resolve(false);
+          if (typeRbacOnlyMap.get(tid)) return Promise.resolve(true);
+          return repo.isAllowed(cPrincipalSet, row.root_id, "read", typeSettingsMap.get(tid) ?? {});
+        })
+      );
+      aclResults = results.filter((_, i) => allowed[i]);
+    }
+    const transformedResults = aclResults.map((row) => mapDocRowToContent(row, collIdByName.get(row.type_id) ?? null));
     const responseData = {
-      data: transformedResults,
+      data: projFields.length ? transformedResults.map((item) => projectFields(item, projFields)) : transformedResults,
       meta: addTimingMeta(c, {
-        count: results.length,
+        count: aclResults.length,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         // D44: echo the caller's filter with the access policy applied (status=published forced for
         // anonymous callers — the visible enforcement proof), NOT the internal doc-augmented where-tree.
@@ -1843,7 +1990,7 @@ apiRoutes.get("/content", chunk37V3RET3_cjs.optionalAuth(), async (c) => {
         }
       }, executionStart)
     };
-    if (cacheEnabled) {
+    if (cacheEnabled && projFields.length === 0) {
       await cache.set(cacheKey, responseData);
     }
     return c.json(responseData);
@@ -1855,26 +2002,36 @@ apiRoutes.get("/content", chunk37V3RET3_cjs.optionalAuth(), async (c) => {
     }, 500);
   }
 });
-apiRoutes.get("/collections/:collection/content", chunk37V3RET3_cjs.optionalAuth(), async (c) => {
+apiRoutes.get("/collections/:collection/content", chunkBRKXMRMB_cjs.optionalAuth(), async (c) => {
   const executionStart = Date.now();
   try {
     const collection = c.req.param("collection");
     const db = c.env.DB;
     const queryParams = c.req.query();
-    const record = chunkQCJHCSOK_cjs.getCollectionRegistry().getBySlugOrName(collection);
+    const record = chunk4DHPR7KR_cjs.getCollectionRegistry().getBySlugOrName(collection);
     if (!record || record.isActive === false) {
       return c.json({ error: "Collection not found" }, 404);
     }
     const collIdByName = /* @__PURE__ */ new Map();
     collIdByName.set(collection, record.id);
     const role = c.get("user")?.role;
-    const filter = chunkIXUHXTHW_cjs.QueryFilterBuilder.parseFromQuery(queryParams);
+    const { tenantId: ccTenantId, principalSet: ccPrincipalSet } = getDocumentRequestContext(c);
+    const ccAnon = isAnonPrincipal(ccPrincipalSet);
+    const ccNeedsAcl = !ccAnon && !canReadNonPublicContent(role);
+    let ccDocType;
+    if (ccNeedsAcl) {
+      ccDocType = await new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db).findById(record.name);
+      if (!await typeReadAllowed(db, ccPrincipalSet, ccDocType, record.name)) {
+        return c.json({ error: "Forbidden" }, 403);
+      }
+    }
+    const filter = chunkSFGYZUWU_cjs.QueryFilterBuilder.parseFromQuery(queryParams);
     const normalizedFilter = augmentFilterForDocuments(filter, { typeId: collection, role });
     if (!normalizedFilter.limit) {
       normalizedFilter.limit = 50;
     }
     normalizedFilter.limit = Math.min(normalizedFilter.limit, 1e3);
-    const builder = new chunkIXUHXTHW_cjs.QueryFilterBuilder();
+    const builder = new chunkSFGYZUWU_cjs.QueryFilterBuilder();
     const queryResult = builder.build("documents", normalizedFilter);
     if (queryResult.errors.length > 0) {
       return c.json({
@@ -1882,8 +2039,8 @@ apiRoutes.get("/collections/:collection/content", chunk37V3RET3_cjs.optionalAuth
         details: queryResult.errors
       }, 400);
     }
-    const cacheEnabled = c.get("cacheEnabled");
-    const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.api);
+    const cacheEnabled = c.get("cacheEnabled") && !ccNeedsAcl;
+    const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.api);
     const includeCollection = queryParams.include?.split(",").map((s) => s.trim()).includes("collection");
     const cacheKey = cache.generateKey("collection-content-filtered", `${collection}:${JSON.stringify({ filter: normalizedFilter, query: queryResult.sql, includeCollection })}`);
     if (cacheEnabled) {
@@ -1905,20 +2062,44 @@ apiRoutes.get("/collections/:collection/content", chunk37V3RET3_cjs.optionalAuth
             }
           }, executionStart)
         };
+        chunkFZGIU5AZ_cjs.recordCatalogRequest({ cacheKey, collection: collection ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: cacheResult.source });
+        chunkFZGIU5AZ_cjs.scheduleKvWrite(cacheKey, c.executionCtx);
         return c.json(dataWithMeta);
       }
+      const swrData = getAndConsumeStale(cacheKey);
+      if (swrData) {
+        c.header("X-Cache-Status", "STALE");
+        c.header("X-Cache-Source", "swr");
+        chunkFZGIU5AZ_cjs.recordCatalogRequest({ cacheKey, collection: collection ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: "swr" });
+        chunkFZGIU5AZ_cjs.scheduleKvWrite(cacheKey, c.executionCtx);
+        return c.json({ ...swrData, meta: addTimingMeta(c, { ...swrData.meta, cache: { hit: true, source: "swr", stale: true } }, executionStart) });
+      }
+      chunkFZGIU5AZ_cjs.recordCatalogRequest({ cacheKey, collection: collection ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: "miss" });
+      chunkFZGIU5AZ_cjs.scheduleKvWrite(cacheKey, c.executionCtx);
     }
     c.header("X-Cache-Status", "MISS");
     c.header("X-Cache-Source", "database");
     const stmt = db.prepare(queryResult.sql);
     const boundStmt = queryResult.params.length > 0 ? stmt.bind(...queryResult.params) : stmt;
     const { results } = await boundStmt.all();
-    const transformedResults = results.map((row) => mapDocRowToContent(row, collIdByName.get(row.type_id) ?? null));
+    let ccAclResults = results;
+    if (ccNeedsAcl) {
+      const ccPerms = new DocumentPermissionsService(db);
+      const ccBaseGrantsPass = ccPerms.isAllowedSync(ccPrincipalSet, [], "read", ccDocType?.settings ?? {});
+      if (ccBaseGrantsPass) {
+        const repo = new DocumentRepository(db, ccTenantId);
+        const allowed = await Promise.all(
+          results.map((row) => repo.isAllowed(ccPrincipalSet, row.root_id, "read", ccDocType?.settings ?? {}))
+        );
+        ccAclResults = results.filter((_, i) => allowed[i]);
+      }
+    }
+    const transformedResults = ccAclResults.map((row) => mapDocRowToContent(row, collIdByName.get(row.type_id) ?? null));
     const responseData = {
       data: transformedResults,
       meta: addTimingMeta(c, {
-        ...includeCollection ? { collection: chunkQCJHCSOK_cjs.collectionRecordToRow(record) } : {},
-        count: results.length,
+        ...includeCollection ? { collection: chunk4DHPR7KR_cjs.collectionRecordToRow(record) } : {},
+        count: ccAclResults.length,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         // D44: echo the caller's filter with the access policy applied (status=published forced for
         // anonymous callers — the visible enforcement proof), NOT the internal doc-augmented where-tree.
@@ -1942,32 +2123,44 @@ apiRoutes.get("/collections/:collection/content", chunk37V3RET3_cjs.optionalAuth
   }
 });
 apiRoutes.route("/content", api_content_crud_default);
-apiRoutes.get("/:collection", chunk37V3RET3_cjs.optionalAuth(), async (c) => {
+apiRoutes.get("/:collection", chunkBRKXMRMB_cjs.optionalAuth(), async (c) => {
   const executionStart = Date.now();
   try {
     const collection = c.req.param("collection");
     const db = c.env.DB;
     const queryParams = c.req.query();
-    const record = chunkQCJHCSOK_cjs.getCollectionRegistry().getBySlugOrName(collection);
+    const projFields = parseFieldsParam(queryParams.fields);
+    if (queryParams.fields) delete queryParams.fields;
+    const record = chunk4DHPR7KR_cjs.getCollectionRegistry().getBySlugOrName(collection);
     if (!record || record.isActive === false) {
       return c.json({ error: "Collection not found" }, 404);
     }
     const collIdByName = /* @__PURE__ */ new Map();
     collIdByName.set(record.name, record.id);
     const role = c.get("user")?.role;
-    const filter = chunkIXUHXTHW_cjs.QueryFilterBuilder.parseFromQuery(queryParams);
+    const { tenantId, principalSet } = getDocumentRequestContext(c);
+    const anon = isAnonPrincipal(principalSet);
+    const needsAcl = !anon && !canReadNonPublicContent(role);
+    let docTypeForCheck;
+    if (needsAcl) {
+      docTypeForCheck = await new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db).findById(record.name);
+      if (!await typeReadAllowed(db, principalSet, docTypeForCheck, record.name)) {
+        return c.json({ error: "Forbidden" }, 403);
+      }
+    }
+    const filter = chunkSFGYZUWU_cjs.QueryFilterBuilder.parseFromQuery(queryParams);
     const normalizedFilter = augmentFilterForDocuments(filter, { typeId: record.name, role });
     if (!normalizedFilter.limit) normalizedFilter.limit = 50;
     normalizedFilter.limit = Math.min(normalizedFilter.limit, 1e3);
-    const builder = new chunkIXUHXTHW_cjs.QueryFilterBuilder();
+    const builder = new chunkSFGYZUWU_cjs.QueryFilterBuilder();
     const queryResult = builder.build("documents", normalizedFilter);
     if (queryResult.errors.length > 0) {
       return c.json({ error: "Invalid filter parameters", details: queryResult.errors }, 400);
     }
     const collectionCache = record.cache;
     const collectionCacheDisabled = collectionCache?.enabled === false;
-    const cacheEnabled = c.get("cacheEnabled") && !collectionCacheDisabled;
-    const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.api);
+    const cacheEnabled = c.get("cacheEnabled") && !collectionCacheDisabled && projFields.length === 0 && !needsAcl;
+    const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.api);
     const includeCollection = queryParams.include?.split(",").map((s) => s.trim()).includes("collection");
     const cacheKey = cache.generateKey("collection-content-filtered", `${collection}:${JSON.stringify({ filter: normalizedFilter, query: queryResult.sql, includeCollection })}`);
     if (cacheEnabled) {
@@ -1976,20 +2169,45 @@ apiRoutes.get("/:collection", chunk37V3RET3_cjs.optionalAuth(), async (c) => {
         c.header("X-Cache-Status", "HIT");
         c.header("X-Cache-Source", cacheResult.source);
         if (cacheResult.ttl) c.header("X-Cache-TTL", Math.floor(cacheResult.ttl).toString());
+        chunkFZGIU5AZ_cjs.recordCatalogRequest({ cacheKey, collection: collection ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: cacheResult.source });
+        chunkFZGIU5AZ_cjs.scheduleKvWrite(cacheKey, c.executionCtx);
         return c.json({ ...cacheResult.data, meta: addTimingMeta(c, { ...cacheResult.data.meta, cache: { hit: true, source: cacheResult.source, ttl: cacheResult.ttl ? Math.floor(cacheResult.ttl) : void 0 } }, executionStart) });
       }
+      const swrData = getAndConsumeStale(cacheKey);
+      if (swrData) {
+        c.header("X-Cache-Status", "STALE");
+        c.header("X-Cache-Source", "swr");
+        chunkFZGIU5AZ_cjs.recordCatalogRequest({ cacheKey, collection: collection ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: "swr" });
+        chunkFZGIU5AZ_cjs.scheduleKvWrite(cacheKey, c.executionCtx);
+        return c.json({ ...swrData, meta: addTimingMeta(c, { ...swrData.meta, cache: { hit: true, source: "swr", stale: true } }, executionStart) });
+      }
+      chunkFZGIU5AZ_cjs.recordCatalogRequest({ cacheKey, collection: collection ?? null, path: c.req.path, queryString: c.req.raw.url.split("?")[1] ?? "", source: "miss" });
+      chunkFZGIU5AZ_cjs.scheduleKvWrite(cacheKey, c.executionCtx);
     }
     c.header("X-Cache-Status", "MISS");
     c.header("X-Cache-Source", "database");
     const stmt = db.prepare(queryResult.sql);
     const boundStmt = queryResult.params.length > 0 ? stmt.bind(...queryResult.params) : stmt;
     const { results } = await boundStmt.all();
-    const transformedResults = results.map((row) => mapDocRowToContent(row, collIdByName.get(row.type_id) ?? null));
+    let aclResults = results;
+    if (needsAcl) {
+      const perms = new DocumentPermissionsService(db);
+      const baseGrantsPass = perms.isAllowedSync(principalSet, [], "read", docTypeForCheck?.settings ?? {});
+      if (!baseGrantsPass) {
+      } else {
+        const repo = new DocumentRepository(db, tenantId);
+        const allowed = await Promise.all(
+          results.map((row) => repo.isAllowed(principalSet, row.root_id, "read", docTypeForCheck?.settings ?? {}))
+        );
+        aclResults = results.filter((_, i) => allowed[i]);
+      }
+    }
+    const transformedResults = aclResults.map((row) => mapDocRowToContent(row, collIdByName.get(row.type_id) ?? null));
     const responseData = {
-      data: transformedResults,
+      data: projFields.length ? transformedResults.map((item) => projectFields(item, projFields)) : transformedResults,
       meta: addTimingMeta(c, {
-        ...includeCollection ? { collection: chunkQCJHCSOK_cjs.collectionRecordToRow(record) } : {},
-        count: results.length,
+        ...includeCollection ? { collection: chunk4DHPR7KR_cjs.collectionRecordToRow(record) } : {},
+        count: aclResults.length,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         filter: normalizePublicContentFilter(filter, role),
         cache: { hit: false, source: "database" }
@@ -2006,12 +2224,12 @@ apiRoutes.get("/:collection", chunk37V3RET3_cjs.optionalAuth(), async (c) => {
     return c.json({ error: "Failed to fetch content", details: error instanceof Error ? error.message : String(error) }, 500);
   }
 });
-apiRoutes.get("/:collection/:id", chunk37V3RET3_cjs.optionalAuth(), async (c) => {
+apiRoutes.get("/:collection/:id", chunkBRKXMRMB_cjs.optionalAuth(), async (c) => {
   try {
     const collection = c.req.param("collection");
     const id = c.req.param("id");
     const db = c.env.DB;
-    const record = chunkQCJHCSOK_cjs.getCollectionRegistry().getBySlugOrName(collection);
+    const record = chunk4DHPR7KR_cjs.getCollectionRegistry().getBySlugOrName(collection);
     if (!record || record.isActive === false) {
       return c.json({ error: "Collection not found" }, 404);
     }
@@ -2020,7 +2238,24 @@ apiRoutes.get("/:collection/:id", chunk37V3RET3_cjs.optionalAuth(), async (c) =>
       privileged ? "SELECT * FROM documents WHERE root_id = ? AND type_id = ? AND tenant_id = 'default' AND is_current_draft = 1 AND deleted_at IS NULL" : "SELECT * FROM documents WHERE root_id = ? AND type_id = ? AND tenant_id = 'default' AND is_published = 1 AND deleted_at IS NULL"
     ).bind(id, record.name).first();
     if (!docRow) return c.json({ error: "Content not found" }, 404);
-    const coll = chunkQCJHCSOK_cjs.getCollectionRegistry().getByName(docRow.type_id);
+    const colRole = c.get("user")?.role;
+    const { tenantId: colTenantId, principalSet: colPrincipalSet } = getDocumentRequestContext(c);
+    const colNeedsAcl = !isAnonPrincipal(colPrincipalSet) && !canReadNonPublicContent(colRole);
+    if (colNeedsAcl) {
+      const docType = await new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db).findById(record.name);
+      if (!await typeReadAllowed(db, colPrincipalSet, docType, record.name)) {
+        return c.json({ error: "Content not found" }, 404);
+      }
+      const perms = new DocumentPermissionsService(db);
+      if (perms.isAllowedSync(colPrincipalSet, [], "read", docType?.settings ?? {})) {
+        const repo = new DocumentRepository(db, colTenantId);
+        if (!await repo.isAllowed(colPrincipalSet, docRow.root_id, "read", docType?.settings ?? {})) {
+          return c.json({ error: "Content not found" }, 404);
+        }
+      }
+    }
+    const projFields = parseFieldsParam(c.req.query("fields"));
+    const coll = chunk4DHPR7KR_cjs.getCollectionRegistry().getByName(docRow.type_id);
     const transformedContent = {
       id: docRow.root_id,
       title: docRow.title,
@@ -2028,17 +2263,17 @@ apiRoutes.get("/:collection/:id", chunk37V3RET3_cjs.optionalAuth(), async (c) =>
       status: docRow.status,
       collectionId: coll?.id ?? docRow.type_id,
       data: docRow.data ? JSON.parse(docRow.data) : {},
-      created_at: chunkLTZ5WYOK_cjs.documentSecondsToMs(docRow.created_at),
-      updated_at: chunkLTZ5WYOK_cjs.documentSecondsToMs(docRow.updated_at)
+      created_at: chunkOLEOKHDX_cjs.documentSecondsToMs(docRow.created_at),
+      updated_at: chunkOLEOKHDX_cjs.documentSecondsToMs(docRow.updated_at)
     };
     dispatchHookEvent(c, "content:read", { collection: docRow.type_id, id: docRow.root_id, data: transformedContent.data }, "fire-and-forget");
-    return c.json({ data: transformedContent });
+    return c.json({ data: projFields.length ? projectFields(transformedContent, projFields) : transformedContent });
   } catch (error) {
     console.error("Error fetching content:", error);
     return c.json({ error: "Failed to fetch content", details: error instanceof Error ? error.message : String(error) }, 500);
   }
 });
-apiRoutes.post("/:collection", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
+apiRoutes.post("/:collection", chunkBRKXMRMB_cjs.requireAuth(), chunkBRKXMRMB_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
   try {
     const collection = c.req.param("collection");
     const db = c.env.DB;
@@ -2059,26 +2294,29 @@ apiRoutes.post("/:collection", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3_cj
     } catch (err) {
       return c.json({ error: "Write cancelled by plugin", details: String(err) }, 400);
     }
-    const svc = new chunkLTZ5WYOK_cjs.DocumentsService(db, { queryableFields: backing.docType.queryableFields ?? [], typeSchemaVersion: backing.docType.schemaVersion ?? 1, maxVersionsPerRoot: backing.docType.settings?.maxVersionsPerRoot ?? 50, tenantId: "default", versioning: backing.docType.settings?.versioning ?? false });
+    const svc = new chunkOLEOKHDX_cjs.DocumentsService(db, { queryableFields: backing.docType.queryableFields ?? [], typeSchemaVersion: backing.docType.schemaVersion ?? 1, maxVersionsPerRoot: backing.docType.settings?.maxVersionsPerRoot ?? 50, tenantId: "default", versioning: backing.docType.settings?.versioning ?? false });
     const doc = await svc.create(createDocumentSchema.parse({ typeId: backing.coll.name, tenantId: "default", locale: "default", title, slug: finalSlug, data: hookData, publishOnCreate: (status || "draft") === "published" }), user?.userId);
-    const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.api);
-    await cache.invalidate("content-filtered:*");
-    await cache.invalidate("collection-content-filtered:*");
+    const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.api);
+    const createAffectedKeys = (await cache.listKeys()).map((k) => k.key).filter((k) => k.startsWith("api:content-filtered:") || k.startsWith(`api:collection-content-filtered:${backing.coll.name}:`));
+    const createStaleValues = await cache.getMany(createAffectedKeys);
+    for (const [key, val] of createStaleValues) markStale(key, val, backing.coll.name);
+    await cache.invalidate("api:content-filtered:*");
+    await cache.invalidate(`api:collection-content-filtered:${backing.coll.name}:*`);
     dispatchHookEvent(c, "content:after:create", { collection: backing.coll.name, id: doc.rootId, data: doc.data ?? {}, user: actor }, "fire-and-forget");
-    return c.json({ data: { id: doc.rootId, title: doc.title, slug: doc.slug, status: doc.status, collectionId: backing.coll.id, data: doc.data, created_at: chunkLTZ5WYOK_cjs.documentSecondsToMs(doc.createdAt), updated_at: chunkLTZ5WYOK_cjs.documentSecondsToMs(doc.updatedAt) } }, 201);
+    return c.json({ data: { id: doc.rootId, title: doc.title, slug: doc.slug, status: doc.status, collectionId: backing.coll.id, data: doc.data, created_at: chunkOLEOKHDX_cjs.documentSecondsToMs(doc.createdAt), updated_at: chunkOLEOKHDX_cjs.documentSecondsToMs(doc.updatedAt) } }, 201);
   } catch (error) {
     console.error("Error creating content:", error);
     return c.json({ error: "Failed to create content", details: error instanceof Error ? error.message : String(error) }, 500);
   }
 });
-apiRoutes.put("/:collection/:id", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
+apiRoutes.put("/:collection/:id", chunkBRKXMRMB_cjs.requireAuth(), chunkBRKXMRMB_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
   try {
     const collection = c.req.param("collection");
     const id = c.req.param("id");
     const db = c.env.DB;
     const user = c.get("user");
     const body = await c.req.json();
-    const collRecord = chunkQCJHCSOK_cjs.getCollectionRegistry().getBySlugOrName(collection);
+    const collRecord = chunk4DHPR7KR_cjs.getCollectionRegistry().getBySlugOrName(collection);
     const typeName = collRecord?.name ?? collection;
     const docRow = await db.prepare("SELECT root_id, type_id FROM documents WHERE root_id = ? AND type_id = ? AND tenant_id = 'default' AND is_current_draft = 1 AND deleted_at IS NULL").bind(id, typeName).first();
     if (!docRow) return c.json({ error: "Content not found" }, 404);
@@ -2090,8 +2328,8 @@ apiRoutes.put("/:collection/:id", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3
     } catch (err) {
       return c.json({ error: "Write cancelled by plugin", details: String(err) }, 400);
     }
-    const docType = await new chunk37V3RET3_cjs.DocumentTypeRegistry(db).findById(docRow.type_id);
-    const svc = new chunkLTZ5WYOK_cjs.DocumentsService(db, { queryableFields: docType?.queryableFields ?? [], typeSchemaVersion: docType?.schemaVersion ?? 1, maxVersionsPerRoot: docType?.settings?.maxVersionsPerRoot ?? 50, tenantId: "default", versioning: docType?.settings?.versioning ?? false });
+    const docType = await new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db).findById(docRow.type_id);
+    const svc = new chunkOLEOKHDX_cjs.DocumentsService(db, { queryableFields: docType?.queryableFields ?? [], typeSchemaVersion: docType?.schemaVersion ?? 1, maxVersionsPerRoot: docType?.settings?.maxVersionsPerRoot ?? 50, tenantId: "default", versioning: docType?.settings?.versioning ?? false });
     const input = {};
     if (body.title !== void 0) input.title = body.title;
     if (body.slug !== void 0) input.slug = slugify(body.slug);
@@ -2104,28 +2342,31 @@ apiRoutes.put("/:collection/:id", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3
     } else if (body.status === "draft" && pub) {
       await svc.unpublish(pub.id);
     }
-    const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.api);
-    await cache.invalidate("content-filtered:*");
-    await cache.invalidate("collection-content-filtered:*");
-    const coll = chunkQCJHCSOK_cjs.getCollectionRegistry().getByName(docRow.type_id);
+    const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.api);
+    const updateAffectedKeys = (await cache.listKeys()).map((k) => k.key).filter((k) => k.startsWith("api:content-filtered:") || k.startsWith(`api:collection-content-filtered:${docRow.type_id}:`));
+    const updateStaleValues = await cache.getMany(updateAffectedKeys);
+    for (const [key, val] of updateStaleValues) markStale(key, val, docRow.type_id);
+    await cache.invalidate("api:content-filtered:*");
+    await cache.invalidate(`api:collection-content-filtered:${docRow.type_id}:*`);
+    const coll = chunk4DHPR7KR_cjs.getCollectionRegistry().getByName(docRow.type_id);
     const saved = await db.prepare("SELECT * FROM documents WHERE id = ?").bind(newDraft.id).first();
     const savedData = saved?.data ? JSON.parse(saved.data) : {};
     dispatchHookEvent(c, "content:after:update", { collection: docRow.type_id, id, data: savedData, user: actor }, "fire-and-forget");
     const nowPublished = body.status === "published" || body.status === void 0 && wasPublished;
     if (nowPublished && !wasPublished) dispatchHookEvent(c, "content:after:publish", { collection: docRow.type_id, id, data: savedData, user: actor }, "fire-and-forget");
-    return c.json({ data: { id: saved.root_id, title: saved.title, slug: saved.slug, status: saved.status, collectionId: coll?.id ?? docRow.type_id, data: savedData, created_at: chunkLTZ5WYOK_cjs.documentSecondsToMs(saved.created_at), updated_at: chunkLTZ5WYOK_cjs.documentSecondsToMs(saved.updated_at) } });
+    return c.json({ data: { id: saved.root_id, title: saved.title, slug: saved.slug, status: saved.status, collectionId: coll?.id ?? docRow.type_id, data: savedData, created_at: chunkOLEOKHDX_cjs.documentSecondsToMs(saved.created_at), updated_at: chunkOLEOKHDX_cjs.documentSecondsToMs(saved.updated_at) } });
   } catch (error) {
     console.error("Error updating content:", error);
     return c.json({ error: "Failed to update content", details: error instanceof Error ? error.message : String(error) }, 500);
   }
 });
-apiRoutes.delete("/:collection/:id", chunk37V3RET3_cjs.requireAuth(), chunk37V3RET3_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
+apiRoutes.delete("/:collection/:id", chunkBRKXMRMB_cjs.requireAuth(), chunkBRKXMRMB_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
   try {
     const collection = c.req.param("collection");
     const id = c.req.param("id");
     const db = c.env.DB;
     const user = c.get("user");
-    const collRecord = chunkQCJHCSOK_cjs.getCollectionRegistry().getBySlugOrName(collection);
+    const collRecord = chunk4DHPR7KR_cjs.getCollectionRegistry().getBySlugOrName(collection);
     const typeName = collRecord?.name ?? collection;
     const docRow = await db.prepare("SELECT type_id FROM documents WHERE root_id = ? AND type_id = ? AND tenant_id = 'default' AND deleted_at IS NULL LIMIT 1").bind(id, typeName).first();
     if (!docRow) return c.json({ error: "Content not found" }, 404);
@@ -2137,9 +2378,12 @@ apiRoutes.delete("/:collection/:id", chunk37V3RET3_cjs.requireAuth(), chunk37V3R
     }
     const now = Math.floor(Date.now() / 1e3);
     await db.prepare("UPDATE documents SET deleted_at = ?, updated_at = ? WHERE root_id = ? AND tenant_id = 'default'").bind(now, now, id).run();
-    const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.api);
-    await cache.invalidate("content-filtered:*");
-    await cache.invalidate("collection-content-filtered:*");
+    const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.api);
+    const deleteAffectedKeys = (await cache.listKeys()).map((k) => k.key).filter((k) => k.startsWith("api:content-filtered:") || k.startsWith(`api:collection-content-filtered:${docRow.type_id}:`));
+    const deleteStaleValues = await cache.getMany(deleteAffectedKeys);
+    for (const [key, val] of deleteStaleValues) markStale(key, val, docRow.type_id);
+    await cache.invalidate("api:content-filtered:*");
+    await cache.invalidate(`api:collection-content-filtered:${docRow.type_id}:*`);
     dispatchHookEvent(c, "content:after:delete", { collection: docRow.type_id, id, data: {}, user: actor }, "fire-and-forget");
     return c.json({ success: true });
   } catch (error) {
@@ -2212,7 +2456,7 @@ var MediaDocumentService = class {
   tenantId;
   /** Create a media_asset document from R2 upload metadata. Published-on-create (immediately usable). */
   async createFromUpload(meta, createdBy) {
-    const svc = new chunkLTZ5WYOK_cjs.DocumentsService(this.db, { queryableFields: MEDIA_QUERYABLE, tenantId: this.tenantId, maxVersionsPerRoot: 5 });
+    const svc = new chunkOLEOKHDX_cjs.DocumentsService(this.db, { queryableFields: MEDIA_QUERYABLE, tenantId: this.tenantId, maxVersionsPerRoot: 5 });
     return svc.create(
       createDocumentSchema.parse({
         typeId: "media_asset",
@@ -2290,7 +2534,7 @@ var MediaDocumentService = class {
   }
   /** Update alt/caption/tags on a media_asset document (saveDraft + publish atomically). */
   async updateMetadata(rootId, meta, updatedBy) {
-    const svc = new chunkLTZ5WYOK_cjs.DocumentsService(this.db, { queryableFields: MEDIA_QUERYABLE, tenantId: this.tenantId, maxVersionsPerRoot: 5 });
+    const svc = new chunkOLEOKHDX_cjs.DocumentsService(this.db, { queryableFields: MEDIA_QUERYABLE, tenantId: this.tenantId, maxVersionsPerRoot: 5 });
     const newDraft = await svc.saveDraft(rootId, { data: meta }, updatedBy);
     return svc.publish(newDraft.id, updatedBy);
   }
@@ -2347,7 +2591,7 @@ var fileValidationSchema = zod.z.object({
   // 50MB max
 });
 var apiMediaRoutes = new hono.Hono();
-apiMediaRoutes.use("*", chunk37V3RET3_cjs.requireAuth());
+apiMediaRoutes.use("*", chunkBRKXMRMB_cjs.requireAuth());
 apiMediaRoutes.post("/upload", async (c) => {
   try {
     const user = c.get("user");
@@ -2701,9 +2945,13 @@ apiMediaRoutes.post("/create-folder", async (c) => {
         error: "Folder name can only contain lowercase letters, numbers, hyphens, and underscores"
       }, 400);
     }
-    const checkStmt = c.env.DB.prepare("SELECT COUNT(*) as count FROM media WHERE folder = ? AND deleted_at IS NULL");
-    const existingFolder = await checkStmt.bind(folderName).first();
-    if (existingFolder && existingFolder.count > 0) {
+    let folderExists = false;
+    try {
+      const existing = await c.env.DB.prepare("SELECT COUNT(*) as count FROM documents WHERE type_id = 'media_asset' AND tenant_id = 'default' AND json_extract(data, '$.folder') = ? AND deleted_at IS NULL AND is_current_draft = 1").bind(folderName).first();
+      folderExists = (existing?.count ?? 0) > 0;
+    } catch {
+    }
+    if (folderExists) {
       return c.json({
         success: false,
         error: `Folder "${folderName}" already exists`
@@ -3045,7 +3293,7 @@ apiSystemRoutes.get("/info", (c) => {
 apiSystemRoutes.get("/stats", async (c) => {
   try {
     const db = c.env.DB;
-    const typeIds = chunkQCJHCSOK_cjs.getCollectionRegistry().listActive().filter((r) => !r.internal).map((r) => r.name);
+    const typeIds = chunk4DHPR7KR_cjs.getCollectionRegistry().listActive().filter((r) => !r.internal).map((r) => r.name);
     let contentStats = null;
     if (typeIds.length > 0) {
       const placeholders = typeIds.map(() => "?").join(",");
@@ -3120,12 +3368,12 @@ apiSystemRoutes.get("/env", (c) => {
 });
 var api_system_default = apiSystemRoutes;
 var adminApiRoutes = new hono.Hono();
-adminApiRoutes.use("*", chunk37V3RET3_cjs.requireAuth());
-adminApiRoutes.use("*", chunk37V3RET3_cjs.requireRole(["admin", "editor"]));
+adminApiRoutes.use("*", chunkBRKXMRMB_cjs.requireAuth());
+adminApiRoutes.use("*", chunkBRKXMRMB_cjs.requireRole(["admin", "editor"]));
 adminApiRoutes.get("/stats", async (c) => {
   try {
     const db = c.env.DB;
-    const userCollections = chunkQCJHCSOK_cjs.getCollectionRegistry().listActive().filter((r) => !r.internal);
+    const userCollections = chunk4DHPR7KR_cjs.getCollectionRegistry().listActive().filter((r) => !r.internal);
     const collectionsCount = userCollections.length;
     let contentCount = 0;
     if (userCollections.length > 0) {
@@ -3216,7 +3464,7 @@ adminApiRoutes.get("/collections", async (c) => {
   try {
     const search = c.req.query("search") || "";
     const includeInactive = c.req.query("includeInactive") === "true";
-    let records = chunkQCJHCSOK_cjs.getCollectionRegistry().list().filter((r) => !r.internal);
+    let records = chunk4DHPR7KR_cjs.getCollectionRegistry().list().filter((r) => !r.internal);
     if (!includeInactive) records = records.filter((r) => r.isActive !== false);
     if (search) {
       const needle = search.toLowerCase();
@@ -3248,7 +3496,7 @@ adminApiRoutes.get("/collections", async (c) => {
 adminApiRoutes.get("/collections/:id", async (c) => {
   try {
     const id = c.req.param("id");
-    const registry = chunkQCJHCSOK_cjs.getCollectionRegistry();
+    const registry = chunk4DHPR7KR_cjs.getCollectionRegistry();
     const record = registry.getById(id) ?? registry.getByName(id);
     if (!record) {
       return c.json({ error: "Collection not found" }, 404);
@@ -3298,7 +3546,7 @@ adminApiRoutes.get("/references", async (c) => {
     if (collectionParams.length === 0) {
       return c.json({ error: "Collection is required" }, 400);
     }
-    const registry = chunkQCJHCSOK_cjs.getCollectionRegistry();
+    const registry = chunk4DHPR7KR_cjs.getCollectionRegistry();
     const matched = collectionParams.map((param) => registry.getById(param) ?? registry.getByName(param)).filter((r) => !!r);
     const seen = /* @__PURE__ */ new Set();
     const collections = matched.filter((r) => {
@@ -3413,7 +3661,7 @@ adminApiRoutes.patch("/collections/:id", collectionsReadOnly);
 adminApiRoutes.delete("/collections/:id", collectionsReadOnly);
 adminApiRoutes.get("/migrations/status", async (c) => {
   try {
-    const { MigrationService: MigrationService2 } = await import('./migrations-FGXZPKDC.cjs');
+    const { MigrationService: MigrationService2 } = await import('./migrations-6M6772UC.cjs');
     const db = c.env.DB;
     const migrationService = new MigrationService2(db);
     const status = await migrationService.getMigrationStatus();
@@ -3456,7 +3704,7 @@ adminApiRoutes.post("/migrations/run", async (c) => {
 });
 adminApiRoutes.get("/migrations/validate", async (c) => {
   try {
-    const { MigrationService: MigrationService2 } = await import('./migrations-FGXZPKDC.cjs');
+    const { MigrationService: MigrationService2 } = await import('./migrations-6M6772UC.cjs');
     const db = c.env.DB;
     const migrationService = new MigrationService2(db);
     const validation = await migrationService.validateSchema();
@@ -3606,8 +3854,8 @@ function renderLoginPage(data, demoLoginActive = false) {
         <div class="mt-8 sm:mx-auto sm:w-full sm:max-w-md">
           <div class="bg-zinc-900 shadow-sm ring-1 ring-white/10 rounded-xl px-6 py-8 sm:px-10">
             <!-- Alerts -->
-            ${data.error ? `<div class="mb-6">${chunkE66UVONV_cjs.renderAlert({ type: "error", message: data.error })}</div>` : ""}
-            ${data.message ? `<div class="mb-6">${chunkE66UVONV_cjs.renderAlert({ type: "success", message: data.message })}</div>` : ""}
+            ${data.error ? `<div class="mb-6">${chunkOUBUS74I_cjs.renderAlert({ type: "error", message: data.error })}</div>` : ""}
+            ${data.message ? `<div class="mb-6">${chunkOUBUS74I_cjs.renderAlert({ type: "success", message: data.message })}</div>` : ""}
 
             <!-- Form Response (HTMX target) -->
             <div id="form-response" class="mb-6"></div>
@@ -3615,6 +3863,8 @@ function renderLoginPage(data, demoLoginActive = false) {
             <!-- Form -->
             <form
               id="login-form"
+              action="/auth/login/form${data.redirect ? `?redirect=${encodeURIComponent(data.redirect)}` : ""}"
+              method="post"
               hx-post="/auth/login/form${data.redirect ? `?redirect=${encodeURIComponent(data.redirect)}` : ""}"
               hx-target="#form-response"
               hx-swap="innerHTML"
@@ -3771,7 +4021,7 @@ function renderRegisterPage(data) {
         <div class="mt-8 sm:mx-auto sm:w-full sm:max-w-md">
           <div class="bg-zinc-900 shadow-sm ring-1 ring-white/10 rounded-xl px-6 py-8 sm:px-10">
             <!-- Alerts -->
-            ${data.error ? `<div class="mb-6">${chunkE66UVONV_cjs.renderAlert({ type: "error", message: data.error })}</div>` : ""}
+            ${data.error ? `<div class="mb-6">${chunkOUBUS74I_cjs.renderAlert({ type: "error", message: data.error })}</div>` : ""}
 
             <!-- Form -->
             <form
@@ -3871,7 +4121,7 @@ function renderRegisterPage(data) {
 }
 
 // src/services/email/email-service-singleton.ts
-var singleton = chunkBP52BFIV_cjs.createServiceSingleton("EmailService");
+var singleton = chunkKWQNB6UM_cjs.createServiceSingleton("EmailService");
 function setEmailService(service2) {
   singleton.set(service2);
 }
@@ -3915,7 +4165,7 @@ function emptyProfile() {
   return { custom: {} };
 }
 function service(db) {
-  return new chunkLTZ5WYOK_cjs.DocumentsService(db, { tenantId: "default", maxVersionsPerRoot: 1, queryableFields: [] });
+  return new chunkOLEOKHDX_cjs.DocumentsService(db, { tenantId: "default", maxVersionsPerRoot: 1, queryableFields: [] });
 }
 async function readProfileData(db, userId) {
   const row = await db.prepare(
@@ -4679,7 +4929,7 @@ function getLexicalInitScript(settings = {}) {
     </script>
   `;
 }
-var lexicalEditorPlugin = chunkBP52BFIV_cjs.definePlugin({
+var lexicalEditorPlugin = chunkKWQNB6UM_cjs.definePlugin({
   id: "lexical-editor",
   version: "1.0.0",
   name: "Lexical Editor",
@@ -5130,9 +5380,11 @@ function renderDynamicField(field, options = {}) {
           min="${opts.min || ""}"
           max="${opts.max || ""}"
           class="${baseClasses} ${errorClasses} !w-auto dark:[color-scheme:dark]"
+          placeholder="YYYY-MM-DD"
           ${required}
           ${disabled ? "disabled" : ""}
         >
+        <p class="mt-1 text-xs text-zinc-500 dark:text-zinc-400">Format: YYYY-MM-DD</p>
       `;
       break;
     case "datetime":
@@ -5148,6 +5400,7 @@ function renderDynamicField(field, options = {}) {
           ${required}
           ${disabled ? "disabled" : ""}
         >
+        <p class="mt-1 text-xs text-zinc-500 dark:text-zinc-400">Format: YYYY-MM-DD HH:MM</p>
       `;
       break;
     case "slug":
@@ -7085,7 +7338,7 @@ api.put("/:userId", async (c) => {
   await saveCustomData(db, userId, sanitized);
   return c.json({ success: true });
 });
-var userProfilesPlugin = chunkBP52BFIV_cjs.definePlugin({
+var userProfilesPlugin = chunkKWQNB6UM_cjs.definePlugin({
   id: "user-profiles",
   version: "1.0.0",
   name: "User Profiles",
@@ -7102,8 +7355,32 @@ function createUserProfilesPlugin() {
   return userProfilesPlugin;
 }
 
+// src/services/demo-mode.ts
+var _demoModeActive = false;
+function setDemoModeActive() {
+  _demoModeActive = true;
+}
+function isDemoModeActive() {
+  return _demoModeActive;
+}
+
 // src/routes/auth.ts
 var JWT_SECRET_FALLBACK = "your-super-secret-jwt-key-change-in-production";
+var DEMO_EMAIL = "admin@sonicjs.com";
+var STATS_EVENTS_ENDPOINT = "https://stats.sonicjs.com/v1/events";
+async function trackDemoLogin(kv) {
+  try {
+    const installationId = await kv?.get("_sonicjs_installation_id") ?? "demo-unknown";
+    await fetch(STATS_EVENTS_ENDPOINT, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        data: { installation_id: installationId, event_type: "demo_login", properties: {}, timestamp: (/* @__PURE__ */ new Date()).toISOString() }
+      })
+    });
+  } catch {
+  }
+}
 function renderPasswordResetEmail(resetLink, firstName) {
   const greeting = firstName ? `Hi ${firstName},` : "Hello,";
   return `<!DOCTYPE html>
@@ -7123,8 +7400,8 @@ function renderPasswordResetEmail(resetLink, firstName) {
 async function setCsrfCookie(c, maxAge) {
   const secret = c.env?.JWT_SECRET || JWT_SECRET_FALLBACK;
   const isDev = c.env?.ENVIRONMENT === "development" || !c.env?.ENVIRONMENT;
-  const csrfToken = await chunk37V3RET3_cjs.generateCsrfToken(secret);
-  const cookieMaxAge = await chunk37V3RET3_cjs.getJwtExpirySecondsFromDb(c.env?.DB, c.env);
+  const csrfToken = await chunkBRKXMRMB_cjs.generateCsrfToken(secret);
+  const cookieMaxAge = await chunkBRKXMRMB_cjs.getJwtExpirySecondsFromDb(c.env?.DB, c.env);
   cookie.setCookie(c, "csrf_token", csrfToken, {
     httpOnly: false,
     secure: !isDev,
@@ -7153,13 +7430,7 @@ authRoutes.get("/login", async (c) => {
     version: c.get("appVersion"),
     redirect: redirect && redirect.startsWith("/") ? redirect : void 0
   };
-  const db = c.env.DB;
-  let demoLoginActive = false;
-  try {
-    const plugin = await db.prepare("SELECT * FROM plugins WHERE id = ? AND status = ?").bind("demo-login-prefill", "active").first();
-    demoLoginActive = !!plugin;
-  } catch (error2) {
-  }
+  const demoLoginActive = isDemoModeActive();
   return c.html(renderLoginPage(pageData, demoLoginActive));
 });
 authRoutes.get("/register", async (c) => {
@@ -7183,7 +7454,7 @@ var loginSchema = zod.z.object({
 });
 authRoutes.post(
   "/register",
-  chunk37V3RET3_cjs.rateLimit({ max: 30, windowMs: 60 * 1e3, keyPrefix: "register" }),
+  chunkBRKXMRMB_cjs.rateLimit({ max: 30, windowMs: 60 * 1e3, keyPrefix: "register" }),
   async (c) => {
     try {
       const db = c.env.DB;
@@ -7219,7 +7490,7 @@ authRoutes.post(
       if (existingUser) {
         return c.json({ error: "User with this email already exists" }, 400);
       }
-      const passwordHash = await chunk37V3RET3_cjs.AuthManager.hashPassword(password);
+      const passwordHash = await chunkBRKXMRMB_cjs.AuthManager.hashPassword(password);
       const userId = crypto.randomUUID();
       const now = /* @__PURE__ */ new Date();
       const nowSec = Math.floor(now.getTime() / 1e3);
@@ -7252,8 +7523,8 @@ authRoutes.post(
         { user: { id: userId, email: normalizedEmail, role: "viewer" } },
         "fire-and-forget"
       );
-      const tokenTtl = await chunk37V3RET3_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
-      const token = await chunk37V3RET3_cjs.AuthManager.generateToken(userId, normalizedEmail, "viewer", c.env.JWT_SECRET, tokenTtl);
+      const tokenTtl = await chunkBRKXMRMB_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
+      const token = await chunkBRKXMRMB_cjs.AuthManager.generateToken(userId, normalizedEmail, "viewer", c.env.JWT_SECRET, tokenTtl);
       cookie.setCookie(c, "auth_token", token, {
         httpOnly: true,
         secure: true,
@@ -7285,7 +7556,7 @@ authRoutes.post(
 );
 authRoutes.post(
   "/login",
-  chunk37V3RET3_cjs.rateLimit({ max: 30, windowMs: 60 * 1e3, keyPrefix: "login" }),
+  chunkBRKXMRMB_cjs.rateLimit({ max: 30, windowMs: 60 * 1e3, keyPrefix: "login" }),
   async (c) => {
     try {
       const body = await c.req.json();
@@ -7295,8 +7566,8 @@ authRoutes.post(
       }
       const { email, password } = validation.data;
       const normalizedEmail = email.toLowerCase();
-      const { createAuth } = await import('./config-OCH7S4WK.cjs');
-      const auth = createAuth(c.env);
+      const { createAuth } = await import('./config-VLU73ZW7.cjs');
+      const auth = createAuth(c.env, void 0, new URL(c.req.url).origin);
       const baReq = new Request(new URL("/auth/sign-in/email", c.req.url).href, {
         method: "POST",
         headers: { "Content-Type": "application/json", "Origin": new URL(c.req.url).origin },
@@ -7306,19 +7577,21 @@ authRoutes.post(
       if (!baRes.ok) {
         return c.json({ error: "Invalid email or password" }, 401);
       }
-      const rawSetCookie = baRes.headers.get("set-cookie");
-      if (rawSetCookie) {
-        c.res.headers.append("Set-Cookie", rawSetCookie);
-      } else if (baRes.headers.getSetCookie) {
+      if (baRes.headers.getSetCookie) {
         for (const sc of baRes.headers.getSetCookie()) {
-          c.res.headers.append("Set-Cookie", sc);
+          c.header("Set-Cookie", sc, { append: true });
+        }
+      } else {
+        const rawSetCookie = baRes.headers.get("set-cookie");
+        if (rawSetCookie) {
+          c.header("Set-Cookie", rawSetCookie, { append: true });
         }
       }
       await setCsrfCookie(c);
       const baBody = await baRes.json();
       const user = baBody.user ?? {};
-      const tokenTtl = await chunk37V3RET3_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
-      const token = await chunk37V3RET3_cjs.AuthManager.generateToken(
+      const tokenTtl = await chunkBRKXMRMB_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
+      const token = await chunkBRKXMRMB_cjs.AuthManager.generateToken(
         user.id,
         user.email,
         user.role ?? "viewer",
@@ -7331,6 +7604,9 @@ authRoutes.post(
         sameSite: "Strict",
         maxAge: tokenTtl
       });
+      if (normalizedEmail === DEMO_EMAIL) {
+        c.executionCtx?.waitUntil(trackDemoLogin(c.env.CACHE_KV));
+      }
       return c.json({
         user: {
           id: user.id,
@@ -7349,8 +7625,8 @@ authRoutes.post(
 );
 authRoutes.post("/logout", async (c) => {
   try {
-    const { createAuth } = await import('./config-OCH7S4WK.cjs');
-    const auth = createAuth(c.env);
+    const { createAuth } = await import('./config-VLU73ZW7.cjs');
+    const auth = createAuth(c.env, void 0, new URL(c.req.url).origin);
     const baReq = new Request(new URL("/auth/sign-out", c.req.url).href, {
       method: "POST",
       headers: { "Content-Type": "application/json", "Origin": new URL(c.req.url).origin, "Cookie": c.req.header("Cookie") || "" },
@@ -7359,14 +7635,15 @@ authRoutes.post("/logout", async (c) => {
     await auth.handler(baReq);
   } catch {
   }
-  cookie.setCookie(c, "better-auth.session_token", "", { httpOnly: true, sameSite: "Lax", path: "/", maxAge: 0 });
+  const isSecure = new URL(c.req.url).protocol === "https:";
+  cookie.setCookie(c, "better-auth.session_token", "", { httpOnly: true, sameSite: "Lax", path: "/", maxAge: 0, secure: isSecure });
   clearCsrfCookie(c);
   return c.json({ message: "Logged out successfully" });
 });
 authRoutes.get("/logout", async (c) => {
   try {
-    const { createAuth } = await import('./config-OCH7S4WK.cjs');
-    const auth = createAuth(c.env);
+    const { createAuth } = await import('./config-VLU73ZW7.cjs');
+    const auth = createAuth(c.env, void 0, new URL(c.req.url).origin);
     const baReq = new Request(new URL("/auth/sign-out", c.req.url).href, {
       method: "POST",
       headers: { "Content-Type": "application/json", "Origin": new URL(c.req.url).origin, "Cookie": c.req.header("Cookie") || "" },
@@ -7375,11 +7652,12 @@ authRoutes.get("/logout", async (c) => {
     await auth.handler(baReq);
   } catch {
   }
-  cookie.setCookie(c, "better-auth.session_token", "", { httpOnly: true, sameSite: "Lax", path: "/", maxAge: 0 });
+  const isSecure = new URL(c.req.url).protocol === "https:";
+  cookie.setCookie(c, "better-auth.session_token", "", { httpOnly: true, sameSite: "Lax", path: "/", maxAge: 0, secure: isSecure });
   clearCsrfCookie(c);
   return c.redirect("/auth/login?message=You have been logged out successfully");
 });
-authRoutes.get("/me", chunk37V3RET3_cjs.requireAuth(), async (c) => {
+authRoutes.get("/me", chunkBRKXMRMB_cjs.requireAuth(), async (c) => {
   try {
     const user = c.get("user");
     if (!user) {
@@ -7399,7 +7677,7 @@ authRoutes.get("/me", chunk37V3RET3_cjs.requireAuth(), async (c) => {
 });
 authRoutes.post(
   "/refresh",
-  chunk37V3RET3_cjs.rateLimit({ max: 60, windowMs: 60 * 1e3, keyPrefix: "refresh" }),
+  chunkBRKXMRMB_cjs.rateLimit({ max: 60, windowMs: 60 * 1e3, keyPrefix: "refresh" }),
   async (c) => {
     try {
       let token = c.req.header("Authorization")?.replace("Bearer ", "");
@@ -7408,8 +7686,8 @@ authRoutes.post(
         return c.json({ error: "Authentication required" }, 401);
       }
       const db = c.env.DB;
-      const grace = await chunk37V3RET3_cjs.getJwtRefreshGraceSecondsFromDb(db, c.env);
-      const payload = await chunk37V3RET3_cjs.AuthManager.verifyToken(token, c.env.JWT_SECRET, grace);
+      const grace = await chunkBRKXMRMB_cjs.getJwtRefreshGraceSecondsFromDb(db, c.env);
+      const payload = await chunkBRKXMRMB_cjs.AuthManager.verifyToken(token, c.env.JWT_SECRET, grace);
       if (!payload) {
         return c.json({ error: "Invalid or expired token" }, 401);
       }
@@ -7417,8 +7695,8 @@ authRoutes.post(
       if (!row || !row.is_active) {
         return c.json({ error: "User is not active" }, 401);
       }
-      const tokenTtl = await chunk37V3RET3_cjs.getJwtExpirySecondsFromDb(db, c.env);
-      const newToken = await chunk37V3RET3_cjs.AuthManager.generateToken(row.id, row.email, row.role, c.env.JWT_SECRET, tokenTtl);
+      const tokenTtl = await chunkBRKXMRMB_cjs.getJwtExpirySecondsFromDb(db, c.env);
+      const newToken = await chunkBRKXMRMB_cjs.AuthManager.generateToken(row.id, row.email, row.role, c.env.JWT_SECRET, tokenTtl);
       cookie.setCookie(c, "auth_token", newToken, {
         httpOnly: true,
         secure: true,
@@ -7438,7 +7716,7 @@ authRoutes.post(
 );
 authRoutes.post(
   "/register/form",
-  chunk37V3RET3_cjs.rateLimit({ max: 30, windowMs: 60 * 1e3, keyPrefix: "register" }),
+  chunkBRKXMRMB_cjs.rateLimit({ max: 30, windowMs: 60 * 1e3, keyPrefix: "register" }),
   async (c) => {
     try {
       const db = c.env.DB;
@@ -7483,7 +7761,7 @@ authRoutes.post(
         </div>
       `);
       }
-      const passwordHash = await chunk37V3RET3_cjs.AuthManager.hashPassword(password);
+      const passwordHash = await chunkBRKXMRMB_cjs.AuthManager.hashPassword(password);
       const role = isFirstUser ? "admin" : "viewer";
       const userId = crypto.randomUUID();
       const now = /* @__PURE__ */ new Date();
@@ -7517,7 +7795,7 @@ authRoutes.post(
           await saveCustomData(db, userId, sanitized);
         }
       }
-      const rbacService = new chunkLTZ5WYOK_cjs.RbacService(db);
+      const rbacService = new chunkOLEOKHDX_cjs.RbacService(db);
       await rbacService.addUserRoleByName(userId, role);
       dispatchHookEvent(
         c,
@@ -7525,8 +7803,8 @@ authRoutes.post(
         { user: { id: userId, email: normalizedEmail, role } },
         "fire-and-forget"
       );
-      const tokenTtl = await chunk37V3RET3_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
-      const token = await chunk37V3RET3_cjs.AuthManager.generateToken(userId, normalizedEmail, role, c.env.JWT_SECRET, tokenTtl);
+      const tokenTtl = await chunkBRKXMRMB_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
+      const token = await chunkBRKXMRMB_cjs.AuthManager.generateToken(userId, normalizedEmail, role, c.env.JWT_SECRET, tokenTtl);
       cookie.setCookie(c, "auth_token", token, {
         httpOnly: true,
         secure: false,
@@ -7558,7 +7836,7 @@ authRoutes.post(
 );
 authRoutes.post(
   "/login/form",
-  chunk37V3RET3_cjs.rateLimit({ max: 30, windowMs: 60 * 1e3, keyPrefix: "login" }),
+  chunkBRKXMRMB_cjs.rateLimit({ max: 30, windowMs: 60 * 1e3, keyPrefix: "login" }),
   async (c) => {
     try {
       const formData = await c.req.formData();
@@ -7572,8 +7850,8 @@ authRoutes.post(
         </div>
       `);
       }
-      const { createAuth } = await import('./config-OCH7S4WK.cjs');
-      const auth = createAuth(c.env);
+      const { createAuth } = await import('./config-VLU73ZW7.cjs');
+      const auth = createAuth(c.env, void 0, new URL(c.req.url).origin);
       const baReq = new Request(new URL("/auth/sign-in/email", c.req.url).href, {
         method: "POST",
         headers: { "Content-Type": "application/json", "Origin": new URL(c.req.url).origin },
@@ -7587,17 +7865,27 @@ authRoutes.post(
         </div>
       `);
       }
-      const rawSetCookie = baRes.headers.get("set-cookie");
-      if (rawSetCookie) {
-        c.res.headers.append("Set-Cookie", rawSetCookie);
-      } else if (baRes.headers.getSetCookie) {
+      if (baRes.headers.getSetCookie) {
         for (const sc of baRes.headers.getSetCookie()) {
-          c.res.headers.append("Set-Cookie", sc);
+          c.header("Set-Cookie", sc, { append: true });
+        }
+      } else {
+        const rawSetCookie = baRes.headers.get("set-cookie");
+        if (rawSetCookie) {
+          c.header("Set-Cookie", rawSetCookie, { append: true });
         }
       }
       await setCsrfCookie(c);
+      if (email === DEMO_EMAIL) {
+        c.executionCtx?.waitUntil(trackDemoLogin(c.env.CACHE_KV));
+      }
       const rawRedirect = c.req.query("redirect");
       const redirectUrl = rawRedirect && rawRedirect.startsWith("/") ? rawRedirect : "/admin/content";
+      const isHtmx = c.req.header("HX-Request") === "true";
+      if (isHtmx) {
+        c.header("HX-Redirect", redirectUrl);
+        return c.html(html.html`<div id="form-response"><p class="text-sm text-green-600">Login successful! Redirecting...</p></div>`);
+      }
       return c.html(html.html`
       <div id="form-response">
         <div class="rounded-lg bg-green-100 dark:bg-lime-500/10 p-4 ring-1 ring-green-400 dark:ring-lime-500/20">
@@ -7627,14 +7915,14 @@ authRoutes.post(
 );
 authRoutes.post(
   "/seed-admin",
-  chunk37V3RET3_cjs.rateLimit({ max: 10, windowMs: 60 * 1e3, keyPrefix: "seed-admin" }),
+  chunkBRKXMRMB_cjs.rateLimit({ max: 10, windowMs: 60 * 1e3, keyPrefix: "seed-admin" }),
   async (c) => {
     try {
       const db = c.env.DB;
-      const rbac = new chunkLTZ5WYOK_cjs.RbacService(db);
+      const rbac = new chunkOLEOKHDX_cjs.RbacService(db);
       const results = [];
       const upsertSeedUser = async (opts) => {
-        const passwordHash = await chunk37V3RET3_cjs.AuthManager.hashPassword(opts.password);
+        const passwordHash = await chunkBRKXMRMB_cjs.AuthManager.hashPassword(opts.password);
         const nowMs = Date.now();
         const nowSec = Math.floor(nowMs / 1e3);
         const existing = await db.prepare("SELECT id FROM auth_user WHERE email = ?").bind(opts.email).first();
@@ -7859,7 +8147,7 @@ authRoutes.post("/accept-invitation", async (c) => {
     if (invitationAge > maxAge) {
       return c.json({ error: "Invitation has expired" }, 400);
     }
-    const passwordHash = await chunk37V3RET3_cjs.AuthManager.hashPassword(password);
+    const passwordHash = await chunkBRKXMRMB_cjs.AuthManager.hashPassword(password);
     const updateStmt = db.prepare(`
       UPDATE auth_user SET
         password_hash = ?,
@@ -7876,8 +8164,8 @@ authRoutes.post("/accept-invitation", async (c) => {
       Date.now(),
       invitedUser.id
     ).run();
-    const tokenTtl = await chunk37V3RET3_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
-    const authToken = await chunk37V3RET3_cjs.AuthManager.generateToken(invitedUser.id, invitedUser.email, invitedUser.role, c.env.JWT_SECRET, tokenTtl);
+    const tokenTtl = await chunkBRKXMRMB_cjs.getJwtExpirySecondsFromDb(c.env.DB, c.env);
+    const authToken = await chunkBRKXMRMB_cjs.AuthManager.generateToken(invitedUser.id, invitedUser.email, invitedUser.role, c.env.JWT_SECRET, tokenTtl);
     cookie.setCookie(c, "auth_token", authToken, {
       httpOnly: true,
       secure: true,
@@ -7893,7 +8181,7 @@ authRoutes.post("/accept-invitation", async (c) => {
 });
 authRoutes.post(
   "/request-password-reset",
-  chunk37V3RET3_cjs.rateLimit({ max: 3, windowMs: 15 * 60 * 1e3, keyPrefix: "password-reset" }),
+  chunkBRKXMRMB_cjs.rateLimit({ max: 3, windowMs: 15 * 60 * 1e3, keyPrefix: "password-reset" }),
   async (c) => {
     try {
       const formData = await c.req.formData();
@@ -8130,7 +8418,7 @@ authRoutes.post("/reset-password", async (c) => {
     if (Date.now() > user.password_reset_expires) {
       return c.json({ error: "Reset token has expired" }, 400);
     }
-    const newPasswordHash = await chunk37V3RET3_cjs.AuthManager.hashPassword(password);
+    const newPasswordHash = await chunkBRKXMRMB_cjs.AuthManager.hashPassword(password);
     try {
       const historyStmt = db.prepare(`
         INSERT INTO auth_password_history (id, user_id, password_hash, created_at)
@@ -8344,7 +8632,7 @@ app.post("/test-seed-defaults", async (c) => {
 var test_cleanup_default = app;
 
 // src/plugins/available/easy-mdx/index.ts
-chunkBP52BFIV_cjs.definePlugin({
+chunkKWQNB6UM_cjs.definePlugin({
   id: "easy-mdx",
   version: "1.0.0",
   name: "EasyMDE Markdown Editor",
@@ -8544,7 +8832,7 @@ function getMDXEditorInitScript(config) {
 }
 
 // src/plugins/available/tinymce-plugin/index.ts
-chunkBP52BFIV_cjs.definePlugin({
+chunkKWQNB6UM_cjs.definePlugin({
   id: "tinymce-plugin",
   version: "1.0.0",
   name: "TinyMCE",
@@ -8814,7 +9102,7 @@ function getQuillCDN(version = "2.0.2") {
     </style>
   `;
 }
-chunkBP52BFIV_cjs.definePlugin({
+chunkKWQNB6UM_cjs.definePlugin({
   id: "quill-editor",
   version: "1.0.0",
   name: "Quill Editor",
@@ -8826,7 +9114,7 @@ chunkBP52BFIV_cjs.definePlugin({
 });
 
 // src/templates/pages/admin-content-form.template.ts
-chunkUYJQDDEE_cjs.init_admin_layout_catalyst_template();
+chunkMI2YXCK4_cjs.init_admin_layout_catalyst_template();
 function renderContentFormPage(data, opts) {
   const isEdit = data.isEdit || !!data.id;
   const title = isEdit ? `Edit: ${data.title || "Content"}` : `New ${data.collection.display_name}`;
@@ -8908,8 +9196,8 @@ function renderContentFormPage(data, opts) {
         <!-- Form Content -->
         <div class="px-6 py-6">
           <div id="form-messages">
-            ${data.error ? chunkE66UVONV_cjs.renderAlert({ type: "error", message: data.error, dismissible: true }) : ""}
-            ${data.success ? chunkE66UVONV_cjs.renderAlert({ type: "success", message: data.success, dismissible: true }) : ""}
+            ${data.error ? chunkOUBUS74I_cjs.renderAlert({ type: "error", message: data.error, dismissible: true }) : ""}
+            ${data.success ? chunkOUBUS74I_cjs.renderAlert({ type: "success", message: data.success, dismissible: true }) : ""}
           </div>
 
           <div class="grid grid-cols-1 lg:grid-cols-3 gap-6">
@@ -9109,33 +9397,44 @@ function renderContentFormPage(data, opts) {
           </a>
 
           <div class="flex items-center gap-x-3">
-            ${data.versioningEnabled ? `
-              <button
-                type="submit"
-                form="content-form"
-                name="action"
-                value="save"
-                class="inline-flex items-center justify-center gap-x-1.5 rounded-lg bg-zinc-950 dark:bg-white px-3.5 py-2.5 text-sm font-semibold text-white dark:text-zinc-950 hover:bg-zinc-800 dark:hover:bg-zinc-100 transition-colors shadow-sm"
-              >
-                <svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="1.5">
-                  <path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7"/>
-                </svg>
-                ${isEdit ? "Update" : "Save"}
-              </button>
-            ` : ""}
+            <button
+              type="submit"
+              form="content-form"
+              name="action"
+              value="save"
+              class="inline-flex items-center justify-center gap-x-1.5 rounded-lg bg-zinc-950 dark:bg-white px-3.5 py-2.5 text-sm font-semibold text-white dark:text-zinc-950 hover:bg-zinc-800 dark:hover:bg-zinc-100 transition-colors shadow-sm"
+            >
+              <svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="1.5">
+                <path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7"/>
+              </svg>
+              Save
+            </button>
+
+            <button
+              type="submit"
+              form="content-form"
+              name="action"
+              value="save_and_close"
+              class="inline-flex items-center justify-center gap-x-1.5 rounded-lg bg-white dark:bg-zinc-800 px-3.5 py-2.5 text-sm font-semibold text-zinc-950 dark:text-white ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10 hover:bg-zinc-50 dark:hover:bg-zinc-700 transition-colors shadow-sm"
+            >
+              <svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="1.5">
+                <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12"/>
+              </svg>
+              Save & close
+            </button>
 
-            ${data.user?.role !== "viewer" ? `
+            ${data.user?.role !== "viewer" && data.versioningEnabled ? `
               <button
                 type="submit"
                 form="content-form"
                 name="action"
                 value="save_and_publish"
-                class="inline-flex items-center justify-center gap-x-1.5 rounded-lg ${data.versioningEnabled ? "bg-lime-600 dark:bg-lime-500 hover:bg-lime-700 dark:hover:bg-lime-600" : "bg-zinc-950 dark:bg-white hover:bg-zinc-800 dark:hover:bg-zinc-100 text-white dark:text-zinc-950"} px-3.5 py-2.5 text-sm font-semibold text-white transition-colors shadow-sm"
+                class="inline-flex items-center justify-center gap-x-1.5 rounded-lg bg-lime-600 dark:bg-lime-500 hover:bg-lime-700 dark:hover:bg-lime-600 px-3.5 py-2.5 text-sm font-semibold text-white transition-colors shadow-sm"
               >
                 <svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="1.5">
                   <path stroke-linecap="round" stroke-linejoin="round" d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z"/>
                 </svg>
-                ${data.versioningEnabled ? `${isEdit ? "Update" : "Save"} & Publish` : isEdit ? "Update" : "Save"}
+                Publish
               </button>
             ` : ""}
           </div>
@@ -9145,7 +9444,7 @@ function renderContentFormPage(data, opts) {
     </div>
 
     <!-- Confirmation Dialogs -->
-    ${chunkE66UVONV_cjs.renderConfirmationDialog({
+    ${chunkOUBUS74I_cjs.renderConfirmationDialog({
     id: "duplicate-content-confirm",
     title: "Duplicate Content",
     message: "Create a copy of this content?",
@@ -9156,7 +9455,7 @@ function renderContentFormPage(data, opts) {
     onConfirm: "performDuplicateContent()"
   })}
 
-    ${chunkE66UVONV_cjs.renderConfirmationDialog({
+    ${chunkOUBUS74I_cjs.renderConfirmationDialog({
     id: "delete-content-confirm",
     title: "Delete Content",
     message: "Are you sure you want to delete this content? This action cannot be undone.",
@@ -9167,7 +9466,7 @@ function renderContentFormPage(data, opts) {
     onConfirm: `performDeleteContent('${data.id}')`
   })}
 
-    ${chunkE66UVONV_cjs.renderConfirmationDialog({
+    ${chunkOUBUS74I_cjs.renderConfirmationDialog({
     id: "delete-repeater-item-confirm",
     title: "Delete Item",
     message: "Are you sure you want to delete this item? This action cannot be undone.",
@@ -9178,7 +9477,7 @@ function renderContentFormPage(data, opts) {
     onConfirm: "performRepeaterDelete()"
   })}
 
-    ${chunkE66UVONV_cjs.renderConfirmationDialog({
+    ${chunkOUBUS74I_cjs.renderConfirmationDialog({
     id: "delete-block-confirm",
     title: "Delete Block",
     message: "Are you sure you want to delete this block? This action cannot be undone.",
@@ -9189,7 +9488,7 @@ function renderContentFormPage(data, opts) {
     onConfirm: "performRepeaterDelete()"
   })}
 
-    ${chunkE66UVONV_cjs.getConfirmationDialogScript()}
+    ${chunkOUBUS74I_cjs.getConfirmationDialogScript()}
 
     ${data.lexicalEnabled ? getLexicalStyles() : "<!-- Lexical plugin not active -->"}
 
@@ -10275,11 +10574,11 @@ function renderContentFormPage(data, opts) {
     content: pageContent,
     version: data.version
   };
-  return chunkUYJQDDEE_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkMI2YXCK4_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/templates/pages/admin-content-list.template.ts
-chunkUYJQDDEE_cjs.init_admin_layout_catalyst_template();
+chunkMI2YXCK4_cjs.init_admin_layout_catalyst_template();
 function renderContentListPage(data) {
   const urlParams = new URLSearchParams();
   if (data.modelName && data.modelName !== "all") urlParams.set("model", data.modelName);
@@ -10713,8 +11012,8 @@ function renderContentListPage(data) {
       
       <!-- Content List -->
       <div id="content-list">
-        ${chunkE66UVONV_cjs.renderTable(tableData)}
-        ${chunkE66UVONV_cjs.renderPagination(paginationData)}
+        ${chunkOUBUS74I_cjs.renderTable(tableData)}
+        ${chunkOUBUS74I_cjs.renderPagination(paginationData)}
       </div>
       
     </div>
@@ -10924,7 +11223,7 @@ function renderContentListPage(data) {
     </script>
 
     <!-- Confirmation Dialog for Bulk Actions -->
-    ${chunkE66UVONV_cjs.renderConfirmationDialog({
+    ${chunkOUBUS74I_cjs.renderConfirmationDialog({
     id: "bulk-action-confirm",
     title: "Confirm Bulk Action",
     message: "Are you sure you want to perform this action? This operation will affect multiple items.",
@@ -10936,7 +11235,7 @@ function renderContentListPage(data) {
   })}
 
     <!-- Confirmation Dialog Script -->
-    ${chunkE66UVONV_cjs.getConfirmationDialogScript()}
+    ${chunkOUBUS74I_cjs.getConfirmationDialogScript()}
 
     <!-- Advanced Search Modal -->
     <div id="advancedSearchModal" class="hidden fixed inset-0 z-50 overflow-y-auto" aria-labelledby="modal-title" role="dialog" aria-modal="true">
@@ -11233,7 +11532,7 @@ function renderContentListPage(data) {
     version: data.version,
     content: pageContent
   };
-  return chunkUYJQDDEE_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkMI2YXCK4_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/routes/admin-content-field-types.ts
@@ -11276,9 +11575,9 @@ function parseFieldValue(field, formData, options = {}) {
   const { skipValidation = false } = options;
   const value = formData.get(field.field_name);
   const errors = [];
-  const blocksConfig = chunkIXUHXTHW_cjs.getBlocksFieldConfig(field.field_options);
+  const blocksConfig = chunkSFGYZUWU_cjs.getBlocksFieldConfig(field.field_options);
   if (blocksConfig) {
-    const parsed = chunkIXUHXTHW_cjs.parseBlocksValue(value, blocksConfig);
+    const parsed = chunkSFGYZUWU_cjs.parseBlocksValue(value, blocksConfig);
     if (!skipValidation && field.is_required && parsed.value.length === 0) {
       parsed.errors.push(`${field.field_label} is required`);
     }
@@ -11388,7 +11687,7 @@ function extractFieldData(fields, formData, options = {}) {
   }
   return { data, errors };
 }
-adminContentRoutes.use("*", chunk37V3RET3_cjs.requireAuth());
+adminContentRoutes.use("*", chunkBRKXMRMB_cjs.requireAuth());
 async function getCollectionFields(db, collectionId) {
   console.log(`[getCollectionFields] Loading fields for collection: ${collectionId}`);
   const collectionStmt = db.prepare("SELECT schema, queryable_fields FROM document_types WHERE id = ?");
@@ -11415,7 +11714,7 @@ async function getCollectionFields(db, collectionId) {
           };
         });
       }
-      const codeCollections2 = await chunkQCJHCSOK_cjs.loadCollectionConfigs();
+      const codeCollections2 = await chunk4DHPR7KR_cjs.loadCollectionConfigs();
       const codeMatch = codeCollections2.find((c) => c.name === collectionId);
       if (codeMatch && codeMatch.schema?.properties) {
         console.log(`[getCollectionFields] DB doc type has no properties \u2014 using code collection schema`);
@@ -11447,7 +11746,7 @@ async function getCollectionFields(db, collectionId) {
     }
   }
   console.log(`[getCollectionFields] Not in database, checking code collections`);
-  const codeCollections = await chunkQCJHCSOK_cjs.loadCollectionConfigs();
+  const codeCollections = await chunk4DHPR7KR_cjs.loadCollectionConfigs();
   console.log(`[getCollectionFields] Found ${codeCollections.length} code collections`);
   const codeCollection = codeCollections.find((c) => c.name === collectionId);
   if (codeCollection && codeCollection.schema) {
@@ -11483,7 +11782,7 @@ async function getCollectionFields(db, collectionId) {
 }
 async function getCollection(db, collectionId) {
   console.log(`[getCollection] Loading collection by ID: ${collectionId}`);
-  const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.collection);
+  const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.collection);
   return cache.getOrSet(
     cache.generateKey("collection", collectionId),
     async () => {
@@ -11501,7 +11800,7 @@ async function getCollection(db, collectionId) {
         };
       }
       console.log(`[getCollection] Not in database, checking code collections`);
-      const codeCollections = await chunkQCJHCSOK_cjs.loadCollectionConfigs();
+      const codeCollections = await chunk4DHPR7KR_cjs.loadCollectionConfigs();
       const codeCollection = codeCollections.find((c) => c.name === collectionId);
       if (codeCollection) {
         console.log(`[getCollection] Found code collection: ${collectionId}`);
@@ -11520,7 +11819,7 @@ async function getCollection(db, collectionId) {
 }
 async function getDocBackingType(db, collectionName) {
   if (!collectionName) return null;
-  const dt = await new chunk37V3RET3_cjs.DocumentTypeRegistry(db).findById(collectionName);
+  const dt = await new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db).findById(collectionName);
   return dt && dt.isActive ? dt : null;
 }
 async function getCollectionByName(db, name) {
@@ -11537,7 +11836,7 @@ async function getCollectionByName(db, name) {
     };
   }
   console.log(`[getCollectionByName] Not in database, checking code collections`);
-  const codeCollections = await chunkQCJHCSOK_cjs.loadCollectionConfigs();
+  const codeCollections = await chunk4DHPR7KR_cjs.loadCollectionConfigs();
   const codeCollection = codeCollections.find((c) => c.name === name);
   if (codeCollection) {
     console.log(`[getCollectionByName] Found code collection: ${name}`);
@@ -11553,7 +11852,7 @@ async function getCollectionByName(db, name) {
   return null;
 }
 async function loadContentEditorFlags(db) {
-  const flags = { workflowEnabled: await chunk37V3RET3_cjs.isPluginActive(db, "workflow") };
+  const flags = { workflowEnabled: await chunk4DHPR7KR_cjs.isPluginActive(db, "workflow") };
   const editors = [
     ["tinymce-plugin", "tinymce"],
     ["quill-editor", "quill"],
@@ -11561,10 +11860,10 @@ async function loadContentEditorFlags(db) {
     ["lexical-editor", "lexical"]
   ];
   for (const [plugin, key] of editors) {
-    const enabled = await chunk37V3RET3_cjs.isPluginActive(db, plugin);
+    const enabled = await chunk4DHPR7KR_cjs.isPluginActive(db, plugin);
     flags[`${key}Enabled`] = enabled;
     if (enabled) {
-      const ps = new chunkQCJHCSOK_cjs.PluginService(db);
+      const ps = new chunk4DHPR7KR_cjs.PluginService(db);
       const p = await ps.getPlugin(plugin);
       flags[`${key}Settings`] = p?.settings;
     }
@@ -11572,7 +11871,7 @@ async function loadContentEditorFlags(db) {
   return flags;
 }
 function makeDocService(db, docType, tenantId) {
-  return new chunkLTZ5WYOK_cjs.DocumentsService(db, {
+  return new chunkOLEOKHDX_cjs.DocumentsService(db, {
     queryableFields: docType.queryableFields ?? [],
     typeSchemaVersion: docType.schemaVersion ?? 1,
     maxVersionsPerRoot: docType.settings?.maxVersionsPerRoot ?? 50,
@@ -11600,9 +11899,9 @@ adminContentRoutes.get("/", async (c) => {
     const offset = (page - 1) * limit;
     const collectionsStmt = db.prepare("SELECT id, name, display_name FROM document_types WHERE is_active = 1 ORDER BY display_name");
     const { results: collectionsResults } = await collectionsStmt.all();
-    const codeCollections = await chunkQCJHCSOK_cjs.loadCollectionConfigs();
+    const codeCollections = await chunk4DHPR7KR_cjs.loadCollectionConfigs();
     const codeCollectionMap = new Map(codeCollections.map((c2) => [c2.name, c2]));
-    const docTypeRegistry = new chunk37V3RET3_cjs.DocumentTypeRegistry(db);
+    const docTypeRegistry = new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db);
     const docTypes = (await docTypeRegistry.findAll()).filter((dt) => !dt.settings?.internal && !dt.isAuth);
     const visibleTypeIds = new Set(docTypes.map((dt) => dt.id));
     const allCollections = [
@@ -11614,7 +11913,7 @@ adminContentRoutes.get("/", async (c) => {
       ...allCollections.map((c2) => ({ name: c2.name, displayName: c2.displayName })),
       ...docTypes.filter((dt) => !collectionNames.has(dt.id)).map((dt) => ({ name: `doc:${dt.id}`, displayName: dt.displayName }))
     ];
-    const newContentCollections = await chunkQCJHCSOK_cjs.getVisibleCollections(db);
+    const newContentCollections = await chunk4DHPR7KR_cjs.getVisibleCollections(db);
     const docBackedCollection = !modelName.startsWith("doc:") && modelName !== "all" ? docTypes.find((dt) => dt.id === modelName) : void 0;
     const isDocModel = modelName.startsWith("doc:") || !!docBackedCollection;
     if (isDocModel) {
@@ -11899,9 +12198,9 @@ adminContentRoutes.get("/new", async (c) => {
       const collectionsStmt = db2.prepare("SELECT id, name, display_name, description FROM document_types WHERE is_active = 1 ORDER BY display_name");
       const { results } = await collectionsStmt.all();
       const visibleTypeIds = new Set(
-        (await new chunk37V3RET3_cjs.DocumentTypeRegistry(db2).findAll()).filter((dt) => !dt.settings?.internal && !dt.isAuth).map((dt) => dt.id)
+        (await new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db2).findAll()).filter((dt) => !dt.settings?.internal && !dt.isAuth).map((dt) => dt.id)
       );
-      const codeCollections = await chunkQCJHCSOK_cjs.loadCollectionConfigs();
+      const codeCollections = await chunk4DHPR7KR_cjs.loadCollectionConfigs();
       const dbCollectionNames = new Set((results || []).map((r) => r.name));
       const allCollections = [
         ...codeCollections.filter((c2) => !dbCollectionNames.has(c2.name)).map((c2) => ({
@@ -11967,32 +12266,32 @@ adminContentRoutes.get("/new", async (c) => {
       return c.html(renderContentFormPage(formData2));
     }
     const fields = await getCollectionFields(db, collection.id);
-    const workflowEnabled = await chunk37V3RET3_cjs.isPluginActive(db, "workflow");
-    const tinymceEnabled = await chunk37V3RET3_cjs.isPluginActive(db, "tinymce-plugin");
+    const workflowEnabled = await chunk4DHPR7KR_cjs.isPluginActive(db, "workflow");
+    const tinymceEnabled = await chunk4DHPR7KR_cjs.isPluginActive(db, "tinymce-plugin");
     let tinymceSettings;
     if (tinymceEnabled) {
-      const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+      const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
       const tinymcePlugin2 = await pluginService.getPlugin("tinymce-plugin");
       tinymceSettings = tinymcePlugin2?.settings;
     }
-    const quillEnabled = await chunk37V3RET3_cjs.isPluginActive(db, "quill-editor");
+    const quillEnabled = await chunk4DHPR7KR_cjs.isPluginActive(db, "quill-editor");
     let quillSettings;
     if (quillEnabled) {
-      const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+      const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
       const quillPlugin = await pluginService.getPlugin("quill-editor");
       quillSettings = quillPlugin?.settings;
     }
-    const mdxeditorEnabled = await chunk37V3RET3_cjs.isPluginActive(db, "easy-mdx");
+    const mdxeditorEnabled = await chunk4DHPR7KR_cjs.isPluginActive(db, "easy-mdx");
     let mdxeditorSettings;
     if (mdxeditorEnabled) {
-      const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+      const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
       const mdxeditorPlugin = await pluginService.getPlugin("easy-mdx");
       mdxeditorSettings = mdxeditorPlugin?.settings;
     }
-    const lexicalEnabled = await chunk37V3RET3_cjs.isPluginActive(db, "lexical-editor");
+    const lexicalEnabled = await chunk4DHPR7KR_cjs.isPluginActive(db, "lexical-editor");
     let lexicalSettings;
     if (lexicalEnabled) {
-      const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+      const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
       const lexicalPlugin = await pluginService.getPlugin("lexical-editor");
       lexicalSettings = lexicalPlugin?.settings;
     }
@@ -12091,7 +12390,7 @@ adminContentRoutes.get("/:id/edit", async (c) => {
       } : void 0
     };
     return c.html(renderContentFormPage(notFoundData));
-    const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.content);
+    const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.content);
     const content = await cache.getOrSet(
       cache.generateKey("content", id),
       async () => {
@@ -12128,32 +12427,32 @@ adminContentRoutes.get("/:id/edit", async (c) => {
     };
     const fields = await getCollectionFields(db, content.collection_id);
     const contentData = content.data ? JSON.parse(content.data) : {};
-    const workflowEnabled = await chunk37V3RET3_cjs.isPluginActive(db, "workflow");
-    const tinymceEnabled = await chunk37V3RET3_cjs.isPluginActive(db, "tinymce-plugin");
+    const workflowEnabled = await chunk4DHPR7KR_cjs.isPluginActive(db, "workflow");
+    const tinymceEnabled = await chunk4DHPR7KR_cjs.isPluginActive(db, "tinymce-plugin");
     let tinymceSettings;
     if (tinymceEnabled) {
-      const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+      const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
       const tinymcePlugin2 = await pluginService.getPlugin("tinymce-plugin");
       tinymceSettings = tinymcePlugin2?.settings;
     }
-    const quillEnabled = await chunk37V3RET3_cjs.isPluginActive(db, "quill-editor");
+    const quillEnabled = await chunk4DHPR7KR_cjs.isPluginActive(db, "quill-editor");
     let quillSettings;
     if (quillEnabled) {
-      const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+      const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
       const quillPlugin = await pluginService.getPlugin("quill-editor");
       quillSettings = quillPlugin?.settings;
     }
-    const mdxeditorEnabled = await chunk37V3RET3_cjs.isPluginActive(db, "easy-mdx");
+    const mdxeditorEnabled = await chunk4DHPR7KR_cjs.isPluginActive(db, "easy-mdx");
     let mdxeditorSettings;
     if (mdxeditorEnabled) {
-      const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+      const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
       const mdxeditorPlugin = await pluginService.getPlugin("easy-mdx");
       mdxeditorSettings = mdxeditorPlugin?.settings;
     }
-    const lexicalEnabled = await chunk37V3RET3_cjs.isPluginActive(db, "lexical-editor");
+    const lexicalEnabled = await chunk4DHPR7KR_cjs.isPluginActive(db, "lexical-editor");
     let lexicalSettings;
     if (lexicalEnabled) {
-      const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+      const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
       const lexicalPlugin = await pluginService.getPlugin("lexical-editor");
       lexicalSettings = lexicalPlugin?.settings;
     }
@@ -12276,8 +12575,11 @@ adminContentRoutes.post("/", async (c) => {
         data,
         publishOnCreate: status === "published"
       }), user?.userId);
-      const cache2 = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.content);
+      const cache2 = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.content);
       await cache2.invalidate(`content:list:${collectionId}:*`);
+      const apiCacheCreate = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.api);
+      await apiCacheCreate.invalidate("api:content-filtered:*");
+      await apiCacheCreate.invalidate(`api:collection-content-filtered:${createDocType.id}:*`);
       const redirectUrl2 = `/admin/content/${doc.rootId}/edit?success=Content created successfully!`;
       return c.req.header("HX-Request") === "true" ? c.text("", 200, { "HX-Redirect": redirectUrl2 }) : c.redirect(redirectUrl2);
     }
@@ -12306,7 +12608,7 @@ adminContentRoutes.post("/", async (c) => {
       now,
       now
     ).run();
-    const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.content);
+    const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.content);
     await cache.invalidate(`content:list:${collectionId}:*`);
     const versionStmt = db.prepare(`
       INSERT INTO content_versions (id, content_id, version, data, author_id, created_at)
@@ -12395,9 +12697,29 @@ adminContentRoutes.put("/:id", async (c) => {
         const pub = await db.prepare("SELECT id FROM documents WHERE root_id = ? AND is_published = 1 AND tenant_id = ?").bind(id, tenantId).first();
         if (status2 === "published") await svc.publish(newDraft.id, user?.userId);
         else if (pub) await svc.unpublish(pub.id);
-        await chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.content).invalidate(`content:list:*`);
+        await chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.content).invalidate(`content:list:*`);
+        const apiCacheEdit = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.api);
+        await apiCacheEdit.invalidate("api:content-filtered:*");
+        await apiCacheEdit.invalidate(`api:collection-content-filtered:${docRowU.type_id}:*`);
+        const isHTMX2 = c.req.header("HX-Request") === "true";
+        const referrerParams = formData.get("referrer_params");
+        const listUrl = referrerParams ? `/admin/content?${referrerParams}` : `/admin/content?collection=${dcoll.id}`;
+        if (action === "save_and_close") {
+          return isHTMX2 ? c.text("", 200, { "HX-Redirect": listUrl }) : c.redirect(listUrl);
+        }
+        if (isHTMX2) {
+          const label = status2 === "published" ? "Content published successfully!" : "Content saved successfully!";
+          return c.html(html.html`<div id="form-messages">
+            <div class="rounded-lg bg-green-50 dark:bg-green-900/20 p-4 mb-4 flex items-center gap-3 border border-green-200 dark:border-green-800">
+              <svg class="h-5 w-5 text-green-500 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="1.5">
+                <path stroke-linecap="round" stroke-linejoin="round" d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z"/>
+              </svg>
+              <span class="text-sm font-medium text-green-800 dark:text-green-200">${label}</span>
+            </div>
+          </div>`);
+        }
         const redirectUrl2 = `/admin/content/${id}/edit?success=Content updated successfully!`;
-        return c.req.header("HX-Request") === "true" ? c.text("", 200, { "HX-Redirect": redirectUrl2 }) : c.redirect(redirectUrl2);
+        return c.redirect(redirectUrl2);
       }
     }
     return c.html(html.html`
@@ -12478,7 +12800,7 @@ adminContentRoutes.put("/:id", async (c) => {
       now,
       id
     ).run();
-    const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.content);
+    const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.content);
     await cache.delete(cache.generateKey("content", id));
     await cache.invalidate(`content:list:${existingContent.collection_id}:*`);
     const existingData = JSON.parse(existingContent.data || "{}");
@@ -12530,7 +12852,7 @@ adminContentRoutes.put("/:id", async (c) => {
     `);
   }
 });
-adminContentRoutes.post("/preview", chunk37V3RET3_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
+adminContentRoutes.post("/preview", chunkBRKXMRMB_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
   try {
     const formData = await c.req.formData();
     const collectionId = formData.get("collection_id");
@@ -12785,14 +13107,14 @@ adminContentRoutes.post("/bulk-action", async (c) => {
         }
       }
     }
-    const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.content);
+    const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.content);
     for (const contentId of ids) {
       await cache.delete(cache.generateKey("content", contentId));
     }
     await cache.invalidate("content:list:*");
-    const apiCache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.api);
-    await apiCache.invalidate("content-filtered:*");
-    await apiCache.invalidate("collection-content-filtered:*");
+    const apiCache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.api);
+    await apiCache.invalidate("api:content-filtered:*");
+    await apiCache.invalidate("api:collection-content-filtered:*");
     return c.json({ success: true, count: ids.length });
   } catch (error) {
     console.error("Bulk action error:", error);
@@ -12809,7 +13131,10 @@ adminContentRoutes.delete("/:id", async (c) => {
     if (docDel && await getDocBackingType(db, docDel.type_id)) {
       const now2 = Math.floor(Date.now() / 1e3);
       await db.prepare("UPDATE documents SET deleted_at = ?, updated_at = ? WHERE root_id = ? AND tenant_id = ?").bind(now2, now2, id, tenantId).run();
-      await chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.content).invalidate("content:list:*");
+      await chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.content).invalidate("content:list:*");
+      const apiCacheDel = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.api);
+      await apiCacheDel.invalidate("api:content-filtered:*");
+      await apiCacheDel.invalidate(`api:collection-content-filtered:${docDel.type_id}:*`);
       return c.html(`
         <div id="content-list" hx-get="/admin/content?model=${docDel.type_id}" hx-trigger="load" hx-swap="outerHTML">
           <div class="flex items-center justify-center p-8"><span class="text-zinc-500">Deleting\u2026</span></div>
@@ -12829,7 +13154,7 @@ adminContentRoutes.delete("/:id", async (c) => {
       WHERE id = ?
     `);
     await deleteStmt.bind(now, id).run();
-    const cache = chunk36Z3AKX3_cjs.getCacheService(chunk36Z3AKX3_cjs.CACHE_CONFIGS.content);
+    const cache = chunkC5LDQ3SH_cjs.getCacheService(chunkC5LDQ3SH_cjs.CACHE_CONFIGS.content);
     await cache.delete(cache.generateKey("content", id));
     await cache.invalidate("content:list:*");
     return c.html(`
@@ -12849,7 +13174,7 @@ adminContentRoutes.delete("/:id", async (c) => {
     return c.json({ success: false, error: "Failed to delete content" }, 500);
   }
 });
-adminContentRoutes.get("/:id/version/:version/preview", chunk37V3RET3_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
+adminContentRoutes.get("/:id/version/:version/preview", chunkBRKXMRMB_cjs.requireRole(["admin", "editor", "author"]), async (c) => {
   try {
     const id = c.req.param("id");
     const version = parseInt(c.req.param("version") || "0");
@@ -12945,9 +13270,9 @@ function parseDocFormData(formData, queryableFields = []) {
   return { title, slug, data };
 }
 async function getDocService(db, typeId, tenantId) {
-  const registry = new chunk37V3RET3_cjs.DocumentTypeRegistry(db);
+  const registry = new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db);
   const docType = await registry.findById(typeId);
-  const svc = new chunkLTZ5WYOK_cjs.DocumentsService(db, {
+  const svc = new chunkOLEOKHDX_cjs.DocumentsService(db, {
     queryableFields: docType?.queryableFields ?? [],
     typeSchemaVersion: docType?.schemaVersion ?? 1,
     maxVersionsPerRoot: docType?.settings?.maxVersionsPerRoot ?? 50,
@@ -12958,10 +13283,10 @@ async function getDocService(db, typeId, tenantId) {
 }
 adminContentRoutes.get("/documents/:typeId/new", async (c) => {
   const { typeId } = c.req.param();
-  const registry = new chunk37V3RET3_cjs.DocumentTypeRegistry(c.env.DB);
+  const registry = new chunkBRKXMRMB_cjs.DocumentTypeRegistry(c.env.DB);
   const docType = await registry.findById(typeId);
   if (!docType) return c.html("<p>Unknown document type.</p>", 404);
-  return c.html(chunkJMJM7DMM_cjs.renderDocumentFormPage({ docType, isEdit: false, user: userCtx(c) }));
+  return c.html(chunkTT3TQSCZ_cjs.renderDocumentFormPage({ docType, isEdit: false, user: userCtx(c) }));
 });
 adminContentRoutes.post("/documents/:typeId/new", async (c) => {
   const { typeId } = c.req.param();
@@ -12983,17 +13308,17 @@ adminContentRoutes.post("/documents/:typeId/new", async (c) => {
     }), user?.userId);
     return c.redirect(`/admin/content/documents/${typeId}/${doc.rootId}/edit?message=Created+successfully`);
   } catch (err) {
-    const registry = new chunk37V3RET3_cjs.DocumentTypeRegistry(c.env.DB);
+    const registry = new chunkBRKXMRMB_cjs.DocumentTypeRegistry(c.env.DB);
     const docType = await registry.findById(typeId);
     if (!docType) return c.html("<p>Unknown document type.</p>", 404);
-    return c.html(chunkJMJM7DMM_cjs.renderDocumentFormPage({ docType, isEdit: false, user: userCtx(c), message: err?.message ?? "Failed to create", messageType: "error" }));
+    return c.html(chunkTT3TQSCZ_cjs.renderDocumentFormPage({ docType, isEdit: false, user: userCtx(c), message: err?.message ?? "Failed to create", messageType: "error" }));
   }
 });
 adminContentRoutes.get("/documents/:typeId/:rootId/edit", async (c) => {
   const { typeId, rootId } = c.req.param();
   const db = c.env.DB;
   const message = c.req.query("message");
-  const registry = new chunk37V3RET3_cjs.DocumentTypeRegistry(db);
+  const registry = new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db);
   const docType = await registry.findById(typeId);
   if (!docType) return c.html("<p>Unknown document type.</p>", 404);
   const tenantId = reqTenant(c);
@@ -13040,7 +13365,7 @@ adminContentRoutes.get("/documents/:typeId/:rootId/edit", async (c) => {
     createdAt: draftRow.created_at,
     updatedAt: draftRow.updated_at
   };
-  return c.html(chunkJMJM7DMM_cjs.renderDocumentFormPage({ docType, doc, publishedDoc, isEdit: true, message, user: userCtx(c), versioningEnabled: docType?.settings?.versioning === true }));
+  return c.html(chunkTT3TQSCZ_cjs.renderDocumentFormPage({ docType, doc, publishedDoc, isEdit: true, message, user: userCtx(c), versioningEnabled: docType?.settings?.versioning === true }));
 });
 adminContentRoutes.post("/documents/:typeId/:rootId", async (c) => {
   const { typeId, rootId } = c.req.param();
@@ -13105,8 +13430,8 @@ adminContentRoutes.post("/documents/:typeId/:documentId/delete", async (c) => {
 adminContentRoutes.get("/documents/:typeId/:rootId/versions", async (c) => {
   const { typeId, rootId } = c.req.param();
   const db = c.env.DB;
-  const { renderVersionHistoryFragment } = await import('./admin-documents-form.template-YNAVMJCV.cjs');
-  const registry = new chunk37V3RET3_cjs.DocumentTypeRegistry(db);
+  const { renderVersionHistoryFragment } = await import('./admin-documents-form.template-UWKGVAMW.cjs');
+  const registry = new chunkBRKXMRMB_cjs.DocumentTypeRegistry(db);
   const docType = await registry.findById(typeId);
   if (!docType) return c.html("<div>Unknown type.</div>", 404);
   const result = await db.prepare(
@@ -13126,7 +13451,7 @@ adminContentRoutes.get("/documents/:typeId/:rootId/versions", async (c) => {
 var admin_content_default = adminContentRoutes;
 
 // src/templates/pages/admin-profile.template.ts
-chunkUYJQDDEE_cjs.init_admin_layout_catalyst_template();
+chunkMI2YXCK4_cjs.init_admin_layout_catalyst_template();
 function renderAvatarImage(avatarUrl, firstName, lastName) {
   return `<div id="avatar-image-container" class="w-24 h-24 rounded-full mx-auto mb-4 overflow-hidden bg-gradient-to-br from-cyan-400 to-purple-400 flex items-center justify-center ring-4 ring-zinc-950/5 dark:ring-white/10">
     ${avatarUrl ? `<img src="${avatarUrl}" alt="Profile picture" class="w-full h-full object-cover">` : `<span class="text-2xl font-bold text-white">${firstName.charAt(0)}${lastName.charAt(0)}</span>`}
@@ -13146,8 +13471,8 @@ function renderProfilePage(data) {
       </div>
 
       <!-- Alert Messages -->
-      ${data.error ? chunkE66UVONV_cjs.renderAlert({ type: "error", message: data.error, dismissible: true }) : ""}
-      ${data.success ? chunkE66UVONV_cjs.renderAlert({ type: "success", message: data.success, dismissible: true }) : ""}
+      ${data.error ? chunkOUBUS74I_cjs.renderAlert({ type: "error", message: data.error, dismissible: true }) : ""}
+      ${data.success ? chunkOUBUS74I_cjs.renderAlert({ type: "success", message: data.success, dismissible: true }) : ""}
 
       <!-- Profile Form -->
       <div class="grid grid-cols-1 lg:grid-cols-3 gap-8">
@@ -13524,7 +13849,7 @@ function renderProfilePage(data) {
     version: data.version,
     content: pageContent
   };
-  return chunkUYJQDDEE_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkMI2YXCK4_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/templates/pages/admin-activity-logs.template.ts
@@ -13734,7 +14059,7 @@ function renderActivityLogsPage(data) {
     user: data.user,
     content: pageContent
   };
-  return chunkE66UVONV_cjs.renderAdminLayout(layoutData);
+  return chunkOUBUS74I_cjs.renderAdminLayout(layoutData);
 }
 function getActionBadgeClass(action) {
   if (action.includes("login") || action.includes("logout")) {
@@ -13754,7 +14079,7 @@ function formatAction(action) {
 }
 
 // src/templates/pages/admin-user-edit.template.ts
-chunkUYJQDDEE_cjs.init_admin_layout_catalyst_template();
+chunkMI2YXCK4_cjs.init_admin_layout_catalyst_template();
 
 // src/templates/components/confirmation-dialog.template.ts
 function renderConfirmationDialog2(options) {
@@ -13950,8 +14275,8 @@ function renderUserEditPage(data) {
 
       <!-- Alert Messages -->
       <div id="form-messages" class="mb-6 empty:mb-0">
-        ${data.error ? chunkE66UVONV_cjs.renderAlert({ type: "error", message: data.error, dismissible: true }) : ""}
-        ${data.success ? chunkE66UVONV_cjs.renderAlert({ type: "success", message: data.success, dismissible: true }) : ""}
+        ${data.error ? chunkOUBUS74I_cjs.renderAlert({ type: "error", message: data.error, dismissible: true }) : ""}
+        ${data.success ? chunkOUBUS74I_cjs.renderAlert({ type: "success", message: data.success, dismissible: true }) : ""}
       </div>
 
       <!-- User Edit Form -->
@@ -14273,11 +14598,11 @@ function renderUserEditPage(data) {
     user: data.user,
     content: pageContent
   };
-  return chunkUYJQDDEE_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkMI2YXCK4_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/templates/pages/admin-user-new.template.ts
-chunkUYJQDDEE_cjs.init_admin_layout_catalyst_template();
+chunkMI2YXCK4_cjs.init_admin_layout_catalyst_template();
 function renderUserNewPage(data) {
   const pageContent = `
     <div>
@@ -14316,8 +14641,8 @@ function renderUserNewPage(data) {
 
       <!-- Alert Messages -->
       <div id="form-messages">
-        ${data.error ? chunkE66UVONV_cjs.renderAlert({ type: "error", message: data.error, dismissible: true }) : ""}
-        ${data.success ? chunkE66UVONV_cjs.renderAlert({ type: "success", message: data.success, dismissible: true }) : ""}
+        ${data.error ? chunkOUBUS74I_cjs.renderAlert({ type: "error", message: data.error, dismissible: true }) : ""}
+        ${data.success ? chunkOUBUS74I_cjs.renderAlert({ type: "success", message: data.success, dismissible: true }) : ""}
       </div>
 
       <!-- User New Form -->
@@ -14547,11 +14872,11 @@ function renderUserNewPage(data) {
     user: data.user,
     content: pageContent
   };
-  return chunkUYJQDDEE_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkMI2YXCK4_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/templates/pages/admin-users-list.template.ts
-chunkUYJQDDEE_cjs.init_admin_layout_catalyst_template();
+chunkMI2YXCK4_cjs.init_admin_layout_catalyst_template();
 function renderUsersListPage(data) {
   const columns = [
     {
@@ -14707,8 +15032,8 @@ function renderUsersListPage(data) {
       </div>
 
       <!-- Alert Messages -->
-      ${data.error ? chunkE66UVONV_cjs.renderAlert({ type: "error", message: data.error, dismissible: true }) : ""}
-      ${data.success ? chunkE66UVONV_cjs.renderAlert({ type: "success", message: data.success, dismissible: true }) : ""}
+      ${data.error ? chunkOUBUS74I_cjs.renderAlert({ type: "error", message: data.error, dismissible: true }) : ""}
+      ${data.success ? chunkOUBUS74I_cjs.renderAlert({ type: "success", message: data.success, dismissible: true }) : ""}
 
       <!-- Stats -->
       <div class="mb-6">
@@ -14885,10 +15210,10 @@ function renderUsersListPage(data) {
       </div>
 
       <!-- Users Table -->
-      ${chunkE66UVONV_cjs.renderTable(tableData)}
+      ${chunkOUBUS74I_cjs.renderTable(tableData)}
 
       <!-- Pagination -->
-      ${data.pagination ? chunkE66UVONV_cjs.renderPagination(data.pagination) : ""}
+      ${data.pagination ? chunkOUBUS74I_cjs.renderPagination(data.pagination) : ""}
     </div>
 
     <script>
@@ -14959,7 +15284,7 @@ function renderUsersListPage(data) {
     version: data.version,
     content: pageContent
   };
-  return chunkUYJQDDEE_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkMI2YXCK4_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/plugins/core-plugins/multi-tenant-plugin/services/tenant-service.ts
@@ -15039,7 +15364,7 @@ var TenantService = class {
       SET name = ?, domain = ?, status = ?, notes = ?, updated_at = ?
       WHERE slug = ?
     `).bind(name, domain, status, notes, now, slug).run();
-    chunkQCJHCSOK_cjs.invalidateTenantCache();
+    chunk4DHPR7KR_cjs.invalidateTenantCache();
     const updated = await this.getTenantBySlug(slug);
     if (!updated) throw new Error("Tenant not found");
     return updated;
@@ -15057,7 +15382,7 @@ var TenantService = class {
       throw new Error(`Tenant '${slug}' still owns ${docCount} document(s). Delete or migrate its content first.`);
     }
     await this.db.prepare(`DELETE FROM auth_tenant WHERE slug = ?`).bind(slug).run();
-    chunkQCJHCSOK_cjs.invalidateTenantCache();
+    chunk4DHPR7KR_cjs.invalidateTenantCache();
   }
   // ─── Membership (auth_tenant_member) ───────────────────────────────────────
   // Tenant resolution and the admin switcher are gated on membership: an authed user may only
@@ -15301,7 +15626,7 @@ var TenantService = class {
       INSERT INTO auth_tenant (id, name, slug, status, domain, notes, metadata, created_at, updated_at)
       VALUES (?, ?, ?, 'active', ?, ?, '{}', ?, ?)
     `).bind(id, input.name, input.slug, input.domain, input.notes, now, now).run();
-    chunkQCJHCSOK_cjs.invalidateTenantCache();
+    chunk4DHPR7KR_cjs.invalidateTenantCache();
     const created = await this.getTenantBySlug(input.slug);
     if (!created) throw new Error("Failed to create tenant");
     return created;
@@ -15325,14 +15650,14 @@ function mapRowToTenant(row) {
 
 // src/routes/admin-users.ts
 var userRoutes = new hono.Hono();
-userRoutes.use("*", chunk37V3RET3_cjs.requireAuth());
-userRoutes.use("/users/*", chunk37V3RET3_cjs.requireRole(["admin"]));
-userRoutes.use("/users", chunk37V3RET3_cjs.requireRole(["admin"]));
-userRoutes.use("/invite-user", chunk37V3RET3_cjs.requireRole(["admin"]));
-userRoutes.use("/resend-invitation/*", chunk37V3RET3_cjs.requireRole(["admin"]));
-userRoutes.use("/cancel-invitation/*", chunk37V3RET3_cjs.requireRole(["admin"]));
-userRoutes.use("/activity-logs", chunk37V3RET3_cjs.requireRole(["admin"]));
-userRoutes.use("/activity-logs/*", chunk37V3RET3_cjs.requireRole(["admin"]));
+userRoutes.use("*", chunkBRKXMRMB_cjs.requireAuth());
+userRoutes.use("/users/*", chunkBRKXMRMB_cjs.requireRole(["admin"]));
+userRoutes.use("/users", chunkBRKXMRMB_cjs.requireRole(["admin"]));
+userRoutes.use("/invite-user", chunkBRKXMRMB_cjs.requireRole(["admin"]));
+userRoutes.use("/resend-invitation/*", chunkBRKXMRMB_cjs.requireRole(["admin"]));
+userRoutes.use("/cancel-invitation/*", chunkBRKXMRMB_cjs.requireRole(["admin"]));
+userRoutes.use("/activity-logs", chunkBRKXMRMB_cjs.requireRole(["admin"]));
+userRoutes.use("/activity-logs/*", chunkBRKXMRMB_cjs.requireRole(["admin"]));
 userRoutes.get("/", (c) => {
   return c.redirect("/admin/dashboard");
 });
@@ -15360,12 +15685,10 @@ var LANGUAGES = [
   { value: "ko", label: "Korean" },
   { value: "zh", label: "Chinese" }
 ];
-var ROLES = [
-  { value: "admin", label: "Administrator" },
-  { value: "editor", label: "Editor" },
-  { value: "author", label: "Author" },
-  { value: "viewer", label: "Viewer" }
-];
+async function fetchRoleOptions(db) {
+  const roles = await new chunkOLEOKHDX_cjs.RbacService(db).getRoles();
+  return roles.map((r) => ({ value: r.id, label: r.display_name }));
+}
 userRoutes.get("/profile", async (c) => {
   const user = c.get("user");
   const db = c.env.DB;
@@ -15443,7 +15766,7 @@ userRoutes.put("/profile", async (c) => {
     const language = formData.get("language")?.toString() || "en";
     const emailNotifications = formData.get("email_notifications") === "1";
     if (!firstName || !lastName || !email) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "First name, last name, and email are required.",
         dismissible: true
@@ -15451,7 +15774,7 @@ userRoutes.put("/profile", async (c) => {
     }
     const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
     if (!emailRegex.test(email)) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "Please enter a valid email address.",
         dismissible: true
@@ -15463,7 +15786,7 @@ userRoutes.put("/profile", async (c) => {
     `);
     const existingUser = await checkStmt.bind(email, user.userId).first();
     if (existingUser) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "Email is already taken by another user.",
         dismissible: true
@@ -15495,11 +15818,11 @@ userRoutes.put("/profile", async (c) => {
       const validation = validateCustomData(sanitized, profileConfig);
       if (!validation.valid) {
         const errorMessages = Object.values(validation.errors).join(", ");
-        return c.html(chunkJMJM7DMM_cjs.renderAlert({ type: "error", message: errorMessages, dismissible: true }), 400);
+        return c.html(chunkTT3TQSCZ_cjs.renderAlert({ type: "error", message: errorMessages, dismissible: true }), 400);
       }
       await saveCustomData(db, user.userId, sanitized);
     }
-    await chunk37V3RET3_cjs.logActivity(
+    await chunkBRKXMRMB_cjs.logActivity(
       db,
       user.userId,
       "profile.update",
@@ -15509,14 +15832,14 @@ userRoutes.put("/profile", async (c) => {
       c.req.header("x-forwarded-for") || c.req.header("cf-connecting-ip"),
       c.req.header("user-agent")
     );
-    return c.html(chunkJMJM7DMM_cjs.renderAlert({
+    return c.html(chunkTT3TQSCZ_cjs.renderAlert({
       type: "success",
       message: "Profile updated successfully!",
       dismissible: true
     }));
   } catch (error) {
     console.error("Profile update error:", error);
-    return c.html(chunkJMJM7DMM_cjs.renderAlert({
+    return c.html(chunkTT3TQSCZ_cjs.renderAlert({
       type: "error",
       message: "Failed to update profile. Please try again.",
       dismissible: true
@@ -15530,7 +15853,7 @@ userRoutes.post("/profile/avatar", async (c) => {
     const formData = await c.req.formData();
     const avatarFile = formData.get("avatar");
     if (!avatarFile || typeof avatarFile === "string" || !avatarFile.name) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "Please select an image file.",
         dismissible: true
@@ -15538,7 +15861,7 @@ userRoutes.post("/profile/avatar", async (c) => {
     }
     const allowedTypes = ["image/jpeg", "image/png", "image/gif", "image/webp"];
     if (!allowedTypes.includes(avatarFile.type)) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "Please upload a valid image file (JPEG, PNG, GIF, or WebP).",
         dismissible: true
@@ -15546,7 +15869,7 @@ userRoutes.post("/profile/avatar", async (c) => {
     }
     const maxSize = 5 * 1024 * 1024;
     if (avatarFile.size > maxSize) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "Image file must be smaller than 5MB.",
         dismissible: true
@@ -15562,7 +15885,7 @@ userRoutes.post("/profile/avatar", async (c) => {
       SELECT first_name, last_name FROM auth_user WHERE id = ?
     `);
     const userData = await userStmt.bind(user.userId).first();
-    await chunk37V3RET3_cjs.logActivity(
+    await chunkBRKXMRMB_cjs.logActivity(
       db,
       user.userId,
       "profile.avatar_update",
@@ -15572,7 +15895,7 @@ userRoutes.post("/profile/avatar", async (c) => {
       c.req.header("x-forwarded-for") || c.req.header("cf-connecting-ip"),
       c.req.header("user-agent")
     );
-    const alertHtml = chunkJMJM7DMM_cjs.renderAlert({
+    const alertHtml = chunkTT3TQSCZ_cjs.renderAlert({
       type: "success",
       message: "Profile picture updated successfully!",
       dismissible: true
@@ -15586,7 +15909,7 @@ userRoutes.post("/profile/avatar", async (c) => {
     return c.html(alertHtml + avatarImageWithOob);
   } catch (error) {
     console.error("Avatar upload error:", error);
-    return c.html(chunkJMJM7DMM_cjs.renderAlert({
+    return c.html(chunkTT3TQSCZ_cjs.renderAlert({
       type: "error",
       message: "Failed to upload profile picture. Please try again.",
       dismissible: true
@@ -15602,21 +15925,21 @@ userRoutes.post("/profile/password", async (c) => {
     const newPassword = formData.get("new_password")?.toString() || "";
     const confirmPassword = formData.get("confirm_password")?.toString() || "";
     if (!currentPassword || !newPassword || !confirmPassword) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "All password fields are required.",
         dismissible: true
       }));
     }
     if (newPassword !== confirmPassword) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "New passwords do not match.",
         dismissible: true
       }));
     }
     if (newPassword.length < 8) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "New password must be at least 8 characters long.",
         dismissible: true
@@ -15627,21 +15950,21 @@ userRoutes.post("/profile/password", async (c) => {
     `);
     const userData = await userStmt.bind(user.userId).first();
     if (!userData) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "User not found.",
         dismissible: true
       }));
     }
-    const validPassword = await chunk37V3RET3_cjs.AuthManager.verifyPassword(currentPassword, userData.password_hash);
+    const validPassword = await chunkBRKXMRMB_cjs.AuthManager.verifyPassword(currentPassword, userData.password_hash);
     if (!validPassword) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "Current password is incorrect.",
         dismissible: true
       }));
     }
-    const newPasswordHash = await chunk37V3RET3_cjs.AuthManager.hashPassword(newPassword);
+    const newPasswordHash = await chunkBRKXMRMB_cjs.AuthManager.hashPassword(newPassword);
     const historyStmt = db.prepare(`
       INSERT INTO auth_password_history (id, user_id, password_hash, created_at)
       VALUES (?, ?, ?, ?)
@@ -15657,7 +15980,7 @@ userRoutes.post("/profile/password", async (c) => {
       WHERE id = ?
     `);
     await updateStmt.bind(newPasswordHash, Date.now(), user.userId).run();
-    await chunk37V3RET3_cjs.logActivity(
+    await chunkBRKXMRMB_cjs.logActivity(
       db,
       user.userId,
       "profile.password_change",
@@ -15667,14 +15990,14 @@ userRoutes.post("/profile/password", async (c) => {
       c.req.header("x-forwarded-for") || c.req.header("cf-connecting-ip"),
       c.req.header("user-agent")
     );
-    return c.html(chunkJMJM7DMM_cjs.renderAlert({
+    return c.html(chunkTT3TQSCZ_cjs.renderAlert({
       type: "success",
       message: "Password updated successfully!",
       dismissible: true
     }));
   } catch (error) {
     console.error("Password change error:", error);
-    return c.html(chunkJMJM7DMM_cjs.renderAlert({
+    return c.html(chunkTT3TQSCZ_cjs.renderAlert({
       type: "error",
       message: "Failed to update password. Please try again.",
       dismissible: true
@@ -15724,7 +16047,7 @@ userRoutes.get("/users", async (c) => {
     `);
     const countResult = await countStmt.bind(...params).first();
     const totalUsers = countResult?.total || 0;
-    await chunk37V3RET3_cjs.logActivity(
+    await chunkBRKXMRMB_cjs.logActivity(
       db,
       user.userId,
       "users.list_view",
@@ -15795,7 +16118,7 @@ userRoutes.get("/users", async (c) => {
     if (isApiRequest) {
       return c.json({ error: "Failed to load users" }, 500);
     }
-    return c.html(chunkJMJM7DMM_cjs.renderAlert({
+    return c.html(chunkTT3TQSCZ_cjs.renderAlert({
       type: "error",
       message: "Failed to load users. Please try again.",
       dismissible: true
@@ -15814,8 +16137,9 @@ userRoutes.get("/users/new", async (c) => {
     const regFieldNames = profileConfig?.registrationFields ?? [];
     const regFields = profileConfig && upRow ? regFieldNames.length > 0 ? profileConfig.fields.filter((f) => regFieldNames.includes(f.name)) : profileConfig.fields : [];
     const registrationFieldsHtml = regFields.length > 0 ? renderCustomProfileSection({ fields: regFields }, {}) : void 0;
+    const roles = await fetchRoleOptions(db);
     const pageData = {
-      roles: ROLES,
+      roles,
       registrationFieldsHtml,
       user: {
         name: user.email.split("@")[0] || user.email,
@@ -15826,7 +16150,7 @@ userRoutes.get("/users/new", async (c) => {
     return c.html(renderUserNewPage(pageData));
   } catch (error) {
     console.error("User new page error:", error);
-    return c.html(chunkJMJM7DMM_cjs.renderAlert({
+    return c.html(chunkTT3TQSCZ_cjs.renderAlert({
       type: "error",
       message: "Failed to load user creation page. Please try again.",
       dismissible: true
@@ -15843,9 +16167,9 @@ userRoutes.post("/users/new", async (c) => {
     const email = formData.get("email")?.toString()?.trim().toLowerCase() || "";
     const phone = chunkMNWKYY5E_cjs.sanitizeInput(formData.get("phone")?.toString()) || null;
     const bio = chunkMNWKYY5E_cjs.sanitizeInput(formData.get("bio")?.toString()) || null;
-    const roleInput = formData.get("role")?.toString() || "viewer";
-    const validRoles = ["admin", "editor", "author", "viewer"];
-    const role = validRoles.includes(roleInput) ? roleInput : "viewer";
+    const roleInput = formData.get("role")?.toString() || "";
+    const validRoles = (await new chunkOLEOKHDX_cjs.RbacService(db).getRoles()).map((r) => r.id);
+    const role = validRoles.includes(roleInput) ? roleInput : validRoles[0] ?? "admin";
     const password = formData.get("password")?.toString() || "";
     const confirmPassword = formData.get("confirm_password")?.toString() || "";
     const isActive = formData.get("is_active") === "1";
@@ -15860,12 +16184,12 @@ userRoutes.post("/users/new", async (c) => {
       const validation = validateCustomData(sanitized, profileConfig);
       if (!validation.valid) {
         const errorMessages = Object.values(validation.errors).join(", ");
-        return c.html(chunkJMJM7DMM_cjs.renderAlert({ type: "error", message: errorMessages, dismissible: true }), 400);
+        return c.html(chunkTT3TQSCZ_cjs.renderAlert({ type: "error", message: errorMessages, dismissible: true }), 400);
       }
       sanitizedRegistrationCustom = sanitized;
     }
     if (!firstName || !lastName || !email || !password) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "First name, last name, email, and password are required.",
         dismissible: true
@@ -15873,21 +16197,21 @@ userRoutes.post("/users/new", async (c) => {
     }
     const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
     if (!emailRegex.test(email)) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "Please enter a valid email address.",
         dismissible: true
       }));
     }
     if (password.length < 8) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "Password must be at least 8 characters long.",
         dismissible: true
       }));
     }
     if (password !== confirmPassword) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "Passwords do not match.",
         dismissible: true
@@ -15899,13 +16223,13 @@ userRoutes.post("/users/new", async (c) => {
     `);
     const existingUser = await checkStmt.bind(email).first();
     if (existingUser) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "Email is already taken.",
         dismissible: true
       }));
     }
-    const passwordHash = await chunk37V3RET3_cjs.AuthManager.hashPassword(password);
+    const passwordHash = await chunkBRKXMRMB_cjs.AuthManager.hashPassword(password);
     const userId = crypto.randomUUID();
     const createStmt = db.prepare(`
       INSERT INTO auth_user (
@@ -15930,7 +16254,7 @@ userRoutes.post("/users/new", async (c) => {
     if (sanitizedRegistrationCustom !== null && Object.keys(sanitizedRegistrationCustom).length > 0) {
       await writeProfileData(db, userId, { custom: sanitizedRegistrationCustom }, user.userId);
     }
-    await chunk37V3RET3_cjs.logActivity(
+    await chunkBRKXMRMB_cjs.logActivity(
       db,
       user.userId,
       "user!.create",
@@ -15944,7 +16268,7 @@ userRoutes.post("/users/new", async (c) => {
     return c.body(null, 200);
   } catch (error) {
     console.error("User creation error:", error);
-    return c.html(chunkJMJM7DMM_cjs.renderAlert({
+    return c.html(chunkTT3TQSCZ_cjs.renderAlert({
       type: "error",
       message: "Failed to create user!. Please try again.",
       dismissible: true
@@ -15969,7 +16293,7 @@ userRoutes.get("/users/:id", async (c) => {
     if (!userRecord) {
       return c.json({ error: "User not found" }, 404);
     }
-    await chunk37V3RET3_cjs.logActivity(
+    await chunkBRKXMRMB_cjs.logActivity(
       db,
       user.userId,
       "user!.view",
@@ -16014,7 +16338,7 @@ userRoutes.get("/users/:id/edit", async (c) => {
     `);
     const userToEdit = await userStmt.bind(userId).first();
     if (!userToEdit) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "User not found",
         dismissible: true
@@ -16067,9 +16391,10 @@ userRoutes.get("/users/:id/edit", async (c) => {
     }
     const queryMessage = c.req.query("message");
     const queryType = c.req.query("type") === "error" ? "error" : "success";
+    const roles = await fetchRoleOptions(db);
     const pageData = {
       userToEdit: editData,
-      roles: ROLES,
+      roles,
       hasProfilePlugin: profileConfig !== null && upRow !== null,
       customProfileFieldsHtml,
       tenantMemberships,
@@ -16084,7 +16409,7 @@ userRoutes.get("/users/:id/edit", async (c) => {
     return c.html(renderUserEditPage(pageData));
   } catch (error) {
     console.error("User edit page error:", error);
-    return c.html(chunkJMJM7DMM_cjs.renderAlert({
+    return c.html(chunkTT3TQSCZ_cjs.renderAlert({
       type: "error",
       message: "Failed to load user. Please try again.",
       dismissible: true
@@ -16101,9 +16426,9 @@ userRoutes.put("/users/:id", async (c) => {
     const lastName = chunkMNWKYY5E_cjs.sanitizeInput(formData.get("last_name")?.toString());
     const email = formData.get("email")?.toString()?.trim().toLowerCase() || "";
     const phone = chunkMNWKYY5E_cjs.sanitizeInput(formData.get("phone")?.toString()) || null;
-    const roleInput = formData.get("role")?.toString() || "viewer";
-    const validRoles = ["admin", "editor", "author", "viewer"];
-    const role = validRoles.includes(roleInput) ? roleInput : "viewer";
+    const roleInput = formData.get("role")?.toString() || "";
+    const validRoles = (await new chunkOLEOKHDX_cjs.RbacService(db).getRoles()).map((r) => r.id);
+    const role = validRoles.includes(roleInput) ? roleInput : validRoles[0] ?? "admin";
     const isActive = formData.get("is_active") === "1";
     const emailVerified = formData.get("email_verified") === "1";
     const newPassword = formData.get("new_password")?.toString() || "";
@@ -16117,12 +16442,12 @@ userRoutes.put("/users/:id", async (c) => {
       const validation = validateCustomData(sanitized, profileConfig);
       if (!validation.valid) {
         const errorMessages = Object.values(validation.errors).join(", ");
-        return c.html(chunkJMJM7DMM_cjs.renderAlert({ type: "error", message: errorMessages, dismissible: true }), 400);
+        return c.html(chunkTT3TQSCZ_cjs.renderAlert({ type: "error", message: errorMessages, dismissible: true }), 400);
       }
       sanitizedCustom = sanitized;
     }
     if (!email) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "Email is required.",
         dismissible: true
@@ -16130,7 +16455,7 @@ userRoutes.put("/users/:id", async (c) => {
     }
     const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
     if (!emailRegex.test(email)) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "Please enter a valid email address.",
         dismissible: true
@@ -16138,14 +16463,14 @@ userRoutes.put("/users/:id", async (c) => {
     }
     if (newPassword) {
       if (newPassword.length < 8) {
-        return c.html(chunkJMJM7DMM_cjs.renderAlert({
+        return c.html(chunkTT3TQSCZ_cjs.renderAlert({
           type: "error",
           message: "Password must be at least 8 characters long.",
           dismissible: true
         }));
       }
       if (newPassword !== confirmPassword) {
-        return c.html(chunkJMJM7DMM_cjs.renderAlert({
+        return c.html(chunkTT3TQSCZ_cjs.renderAlert({
           type: "error",
           message: "Passwords do not match.",
           dismissible: true
@@ -16158,7 +16483,7 @@ userRoutes.put("/users/:id", async (c) => {
     `);
     const existingUser = await checkStmt.bind(email, userId).first();
     if (existingUser) {
-      return c.html(chunkJMJM7DMM_cjs.renderAlert({
+      return c.html(chunkTT3TQSCZ_cjs.renderAlert({
         type: "error",
         message: "Email is already taken by another user.",
         dismissible: true
@@ -16183,7 +16508,7 @@ userRoutes.put("/users/:id", async (c) => {
       userId
     ).run();
     if (newPassword) {
-      const passwordHash = await chunk37V3RET3_cjs.AuthManager.hashPassword(newPassword);
+      const passwordHash = await chunkBRKXMRMB_cjs.AuthManager.hashPassword(newPassword);
       const updatePasswordStmt = db.prepare(`
         UPDATE auth_user SET password_hash = ?, updated_at = ? WHERE id = ?
       `);
@@ -16196,7 +16521,7 @@ userRoutes.put("/users/:id", async (c) => {
         ...sanitizedCustom !== null ? { custom: sanitizedCustom } : {}
       }, user.userId);
     }
-    await chunk37V3RET3_cjs.logActivity(
+    await chunkBRKXMRMB_cjs.logActivity(
       db,
       user.userId,
       "user.update",
@@ -16206,7 +16531,7 @@ userRoutes.put("/users/:id", async (c) => {
       c.req.header("x-forwarded-for") || c.req.header("cf-connecting-ip"),
       c.req.header("user-agent")
     );
-    return c.html(chunkJMJM7DMM_cjs.renderAlert({
+    return c.html(chunkTT3TQSCZ_cjs.renderAlert({
       type: "success",
       message: "User updated successfully!",
       dismissible: true,
@@ -16214,7 +16539,7 @@ userRoutes.put("/users/:id", async (c) => {
     }));
   } catch (error) {
     console.error("User update error:", error);
-    return c.html(chunkJMJM7DMM_cjs.renderAlert({
+    return c.html(chunkTT3TQSCZ_cjs.renderAlert({
       type: "error",
       message: "Failed to update user. Please try again.",
       dismissible: true
@@ -16242,7 +16567,7 @@ userRoutes.post("/users/:id/toggle", async (c) => {
       UPDATE auth_user SET is_active = ?, updated_at = ? WHERE id = ?
     `);
     await toggleStmt.bind(active ? 1 : 0, Date.now(), userId).run();
-    await chunk37V3RET3_cjs.logActivity(
+    await chunkBRKXMRMB_cjs.logActivity(
       db,
       user.userId,
       active ? "user.activate" : "user.deactivate",
@@ -16283,7 +16608,7 @@ userRoutes.delete("/users/:id", async (c) => {
         DELETE FROM auth_user WHERE id = ?
       `);
       await deleteStmt.bind(userId).run();
-      await chunk37V3RET3_cjs.logActivity(
+      await chunkBRKXMRMB_cjs.logActivity(
         db,
         user.userId,
         "user!.hard_delete",
@@ -16302,7 +16627,7 @@ userRoutes.delete("/users/:id", async (c) => {
         UPDATE auth_user SET is_active = 0, updated_at = ? WHERE id = ?
       `);
       await deleteStmt.bind(Date.now(), userId).run();
-      await chunk37V3RET3_cjs.logActivity(
+      await chunkBRKXMRMB_cjs.logActivity(
         db,
         user.userId,
         "user!.soft_delete",
@@ -16368,7 +16693,7 @@ userRoutes.post("/invite-user", async (c) => {
       Date.now(),
       Date.now()
     ).run();
-    await chunk37V3RET3_cjs.logActivity(
+    await chunkBRKXMRMB_cjs.logActivity(
       db,
       user.userId,
       "user!.invite_sent",
@@ -16425,7 +16750,7 @@ userRoutes.post("/resend-invitation/:id", async (c) => {
       Date.now(),
       userId
     ).run();
-    await chunk37V3RET3_cjs.logActivity(
+    await chunkBRKXMRMB_cjs.logActivity(
       db,
       user.userId,
       "user!.invitation_resent",
@@ -16461,7 +16786,7 @@ userRoutes.delete("/cancel-invitation/:id", async (c) => {
     }
     const deleteStmt = db.prepare(`DELETE FROM auth_user WHERE id = ?`);
     await deleteStmt.bind(userId).run();
-    await chunk37V3RET3_cjs.logActivity(
+    await chunkBRKXMRMB_cjs.logActivity(
       db,
       user.userId,
       "user!.invitation_cancelled",
@@ -16710,7 +17035,7 @@ function getFileIcon(mimeType) {
 }
 
 // src/templates/pages/admin-media-library.template.ts
-chunkUYJQDDEE_cjs.init_admin_layout_catalyst_template();
+chunkMI2YXCK4_cjs.init_admin_layout_catalyst_template();
 function renderMediaLibraryPage(data) {
   const pageContent = `
     <div>
@@ -17645,7 +17970,7 @@ function renderMediaLibraryPage(data) {
     version: data.version,
     content: pageContent
   };
-  return chunkUYJQDDEE_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkMI2YXCK4_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/templates/components/media-file-details.template.ts
@@ -17842,7 +18167,7 @@ var fileValidationSchema2 = zod.z.object({
   // 50MB max
 });
 var adminMediaRoutes = new hono.Hono();
-adminMediaRoutes.use("*", chunk37V3RET3_cjs.requireAuth());
+adminMediaRoutes.use("*", chunkBRKXMRMB_cjs.requireAuth());
 adminMediaRoutes.get("/", async (c) => {
   try {
     const user = c.get("user");
@@ -17884,7 +18209,7 @@ adminMediaRoutes.get("/selector", async (c) => {
     const { searchParams } = new URL(c.req.url);
     const search = searchParams.get("search") || "";
     const db = c.env.DB;
-    const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+    const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
     const mediaPlugin = await pluginService.getPlugin("core-media");
     if (!mediaPlugin || mediaPlugin.status !== "active") {
       return c.html(html.html`
@@ -18260,7 +18585,7 @@ adminMediaRoutes.put("/:id", async (c) => {
     `);
   }
 });
-adminMediaRoutes.delete("/cleanup", chunk37V3RET3_cjs.requireRole("admin"), async (c) => {
+adminMediaRoutes.delete("/cleanup", chunkBRKXMRMB_cjs.requireRole("admin"), async (c) => {
   try {
     const db = c.env.DB;
     const allMediaStmt = db.prepare("SELECT id, r2_key, filename FROM media WHERE deleted_at IS NULL");
@@ -18518,7 +18843,7 @@ function generateMediaItemHTML(file) {
 }
 
 // src/templates/pages/admin-plugins-list.template.ts
-chunkUYJQDDEE_cjs.init_admin_layout_catalyst_template();
+chunkMI2YXCK4_cjs.init_admin_layout_catalyst_template();
 function renderPluginsListPage(data) {
   const categories = [
     { value: "content", label: "Content Management" },
@@ -18690,15 +19015,6 @@ function renderPluginsListPage(data) {
             </div>
 
             <div class="flex items-center gap-3 w-full sm:w-auto">
-              <select id="sort-filter" onchange="filterAndSortPlugins()" class="block w-full sm:w-auto h-9 rounded-md border-0 py-1.5 pl-3 pr-8 text-zinc-900 ring-1 ring-inset ring-zinc-300 focus:ring-2 focus:ring-inset focus:ring-zinc-600 dark:bg-zinc-900 dark:text-white dark:ring-zinc-700 dark:focus:ring-zinc-500 sm:text-sm sm:leading-6">
-                <option value="name-asc">Name (A-Z)</option>
-                <option value="name-desc">Name (Z-A)</option>
-                <option value="newest">Newest Installed</option>
-                <option value="updated">Recently Updated</option>
-                <option value="popular">Popularity</option>
-                <option value="rating">Highest Rated</option>
-              </select>
-
               <button
                 onclick="location.reload()"
                 class="inline-flex items-center gap-x-1.5 rounded-md bg-white dark:bg-zinc-900 px-3 py-1.5 h-9 text-sm font-semibold text-zinc-900 dark:text-white shadow-sm ring-1 ring-inset ring-zinc-300 dark:ring-zinc-700 hover:bg-zinc-50 dark:hover:bg-zinc-800"
@@ -18862,8 +19178,6 @@ function renderPluginsListPage(data) {
           .forEach(cb => params.append('status', cb.value));
         const search = document.getElementById('search-input').value;
         if (search) params.set('search', search);
-        const sort = document.getElementById('sort-filter').value;
-        if (sort && sort !== 'name-asc') params.set('sort', sort);
         const url = new URL(window.location.href);
         url.search = params.toString();
         history.replaceState(null, '', url.toString());
@@ -18881,8 +19195,6 @@ function renderPluginsListPage(data) {
         });
         const search = params.get('search');
         if (search) document.getElementById('search-input').value = search;
-        const sort = params.get('sort');
-        if (sort) document.getElementById('sort-filter').value = sort;
         if (params.toString()) filterAndSortPlugins();
       }
 
@@ -18898,7 +19210,6 @@ function renderPluginsListPage(data) {
           .map(cb => cb.value.toLowerCase());
 
         const searchInput = document.getElementById('search-input').value.toLowerCase();
-        const sortValue = document.getElementById('sort-filter').value;
 
         const pluginsGrid = document.getElementById('plugins-grid');
         const pluginCards = Array.from(pluginsGrid.querySelectorAll('.plugin-card'));
@@ -18922,30 +19233,6 @@ function renderPluginsListPage(data) {
           return true;
         });
 
-        // Sort
-        visibleCards.sort((a, b) => {
-          const aName = a.getAttribute('data-name') || '';
-          const bName = b.getAttribute('data-name') || '';
-          const aInstalled = parseInt(a.getAttribute('data-installed') || '0');
-          const bInstalled = parseInt(b.getAttribute('data-installed') || '0');
-          const aUpdated = parseInt(a.getAttribute('data-updated') || '0');
-          const bUpdated = parseInt(b.getAttribute('data-updated') || '0');
-          const aDownloads = parseInt(a.getAttribute('data-downloads') || '0');
-          const bDownloads = parseInt(b.getAttribute('data-downloads') || '0');
-          const aRating = parseFloat(a.getAttribute('data-rating') || '0');
-          const bRating = parseFloat(b.getAttribute('data-rating') || '0');
-
-          switch (sortValue) {
-            case 'name-desc': return bName.localeCompare(aName);
-            case 'newest': return bInstalled - aInstalled;
-            case 'updated': return bUpdated - aUpdated;
-            case 'popular': return bDownloads - aDownloads;
-            case 'rating': return bRating - aRating;
-            case 'name-asc':
-            default: return aName.localeCompare(bName);
-          }
-        });
-
         // Re-append
         pluginCards.forEach(card => card.style.display = 'none'); // Hide all first
         
@@ -19001,7 +19288,7 @@ function renderPluginsListPage(data) {
     version: data.version,
     content: pageContent
   };
-  return chunkUYJQDDEE_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkMI2YXCK4_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 function renderPluginCard(plugin) {
   const statusColors = {
@@ -19379,8 +19666,9 @@ function escapeHtmlAttr(value) {
 }
 function renderPluginSettingsPage(data) {
   const { plugin, activity = [], user, settingsTabData } = data;
-  const pluginDef = chunkBP52BFIV_cjs.getPluginDefinition(plugin.id || plugin.name);
-  const hasUserSettings = pluginDef?.settingsTabContent != null || Object.keys(plugin.settings || {}).some((k) => !k.startsWith("_"));
+  const pluginDef = chunkKWQNB6UM_cjs.getPluginDefinition(plugin.id || plugin.name);
+  const pluginId = plugin.id || plugin.name;
+  const hasUserSettings = pluginDef?.settingsTabContent != null || Object.keys(plugin.settings || {}).some((k) => !k.startsWith("_")) || hasCustomSettingsComponent(pluginId);
   const defaultTab = hasUserSettings ? "settings" : "info";
   const pageContent = `
     <div class="w-full px-4 sm:px-6 lg:px-8 py-6">
@@ -19545,9 +19833,28 @@ function renderPluginSettingsPage(data) {
         const form = document.getElementById('settings-form');
         const formData = new FormData(form);
         const isAuthPlugin = '${plugin.id}' === 'core-auth';
+        const isOAuthPlugin = '${plugin.id}' === 'oauth-providers';
         let settings = {};
 
-        if (isAuthPlugin) {
+        if (isOAuthPlugin) {
+          // Build nested provider settings structure
+          const getVal = id => (document.getElementById(id) || {}).value || '';
+          const getChecked = id => !!(document.getElementById(id) || {}).checked;
+          settings = {
+            providers: {
+              github: {
+                clientId: getVal('oauth_github_clientId'),
+                clientSecret: getVal('oauth_github_clientSecret'),
+                enabled: getChecked('oauth_github_enabled'),
+              },
+              google: {
+                clientId: getVal('oauth_google_clientId'),
+                clientSecret: getVal('oauth_google_clientSecret'),
+                enabled: getChecked('oauth_google_enabled'),
+              },
+            }
+          };
+        } else if (isAuthPlugin) {
           // Handle nested auth settings structure
           settings = {
             requiredFields: {},
@@ -19656,7 +19963,7 @@ function renderPluginSettingsPage(data) {
     user,
     content: pageContent
   };
-  return chunkE66UVONV_cjs.renderAdminLayout(layoutData);
+  return chunkOUBUS74I_cjs.renderAdminLayout(layoutData);
 }
 function renderStatusBadge(status) {
   const statusColors = {
@@ -19685,7 +19992,7 @@ function renderSettingsTab(plugin, settingsTabData) {
   const settings = plugin.settings || {};
   const pluginId = plugin.id || plugin.name;
   const hasUserKeys = Object.keys(settings).some((k) => !k.startsWith("_"));
-  const pluginDef = chunkBP52BFIV_cjs.getPluginDefinition(pluginId);
+  const pluginDef = chunkKWQNB6UM_cjs.getPluginDefinition(pluginId);
   if (pluginDef?.settingsTabContent) {
     return pluginDef.settingsTabContent.render({ plugin, settings, data: settingsTabData });
   }
@@ -20035,7 +20342,8 @@ function formatTimestamp(timestamp) {
 }
 var pluginSettingsComponents = {
   "otp-login": renderOTPLoginSettingsContent,
-  "email": renderEmailSettingsContent
+  "email": renderEmailSettingsContent,
+  "oauth-providers": renderOAuthProvidersSettingsContent
 };
 function renderOTPLoginSettingsContent(plugin, settings) {
   const siteName = settings.siteName || "SonicJS";
@@ -20758,6 +21066,62 @@ defineUserProfile({
     </div>
   `;
 }
+function renderOAuthProvidersSettingsContent(plugin, settings) {
+  const providers = settings.providers || {};
+  const gh = providers.github || {};
+  const gg = providers.google || {};
+  const inputClass = "backdrop-blur-sm bg-white/10 border border-white/20 rounded-lg px-3 py-2 text-white placeholder-gray-300 focus:border-blue-400 focus:outline-none transition-colors w-full";
+  return `
+    <div class="space-y-6">
+      <form id="settings-form">
+        <div class="backdrop-blur-md bg-white/5 rounded-xl border border-white/10 p-6 space-y-6">
+          <h3 class="text-lg font-semibold text-white">GitHub OAuth</h3>
+          <div>
+            <label for="oauth_github_clientId" class="block text-sm font-medium text-gray-300 mb-2">Client ID</label>
+            <input type="text" id="oauth_github_clientId" name="oauth_github_clientId"
+              value="${escapeHtmlAttr(gh.clientId || "")}"
+              placeholder="GitHub OAuth App Client ID" class="${inputClass}" />
+          </div>
+          <div>
+            <label for="oauth_github_clientSecret" class="block text-sm font-medium text-gray-300 mb-2">Client Secret</label>
+            <input type="password" id="oauth_github_clientSecret" name="oauth_github_clientSecret"
+              value="${escapeHtmlAttr(gh.clientSecret || "")}"
+              placeholder="GitHub OAuth App Client Secret" class="${inputClass}" />
+          </div>
+          <div class="flex items-center gap-3">
+            <input type="checkbox" id="oauth_github_enabled" name="oauth_github_enabled"
+              ${gh.enabled ? "checked" : ""} class="w-4 h-4 rounded border-white/10" />
+            <label for="oauth_github_enabled" class="text-sm text-gray-300">Enable GitHub login</label>
+          </div>
+        </div>
+
+        <div class="backdrop-blur-md bg-white/5 rounded-xl border border-white/10 p-6 space-y-6 mt-6">
+          <h3 class="text-lg font-semibold text-white">Google OAuth</h3>
+          <div>
+            <label for="oauth_google_clientId" class="block text-sm font-medium text-gray-300 mb-2">Client ID</label>
+            <input type="text" id="oauth_google_clientId" name="oauth_google_clientId"
+              value="${escapeHtmlAttr(gg.clientId || "")}"
+              placeholder="Google OAuth Client ID" class="${inputClass}" />
+          </div>
+          <div>
+            <label for="oauth_google_clientSecret" class="block text-sm font-medium text-gray-300 mb-2">Client Secret</label>
+            <input type="password" id="oauth_google_clientSecret" name="oauth_google_clientSecret"
+              value="${escapeHtmlAttr(gg.clientSecret || "")}"
+              placeholder="Google OAuth Client Secret" class="${inputClass}" />
+          </div>
+          <div class="flex items-center gap-3">
+            <input type="checkbox" id="oauth_google_enabled" name="oauth_google_enabled"
+              ${gg.enabled ? "checked" : ""} class="w-4 h-4 rounded border-white/10" />
+            <label for="oauth_google_enabled" class="text-sm text-gray-300">Enable Google login</label>
+          </div>
+        </div>
+      </form>
+    </div>
+  `;
+}
+function hasCustomSettingsComponent(pluginId) {
+  return pluginId in pluginSettingsComponents;
+}
 
 // src/plugins/core-plugins/menu-plugin/services/menu-reconcile.ts
 async function upsertPluginRow(db, slug, entry, visible) {
@@ -20875,8 +21239,8 @@ async function fetchActivePluginIds(db) {
 }
 async function reconcileMenuFromPlugins(db) {
   try {
-    const singletonEntries = chunkBP52BFIV_cjs.getPluginMenu();
-    const manifestEntries = Object.values(chunkQCJHCSOK_cjs.PLUGIN_REGISTRY).filter(
+    const singletonEntries = chunkKWQNB6UM_cjs.getPluginMenu();
+    const manifestEntries = Object.values(chunk4DHPR7KR_cjs.PLUGIN_REGISTRY).filter(
       (p) => p.adminMenu !== null
     );
     const byPluginId = /* @__PURE__ */ new Map();
@@ -20913,8 +21277,8 @@ async function reconcileMenuFromPlugins(db) {
 
 // src/routes/admin-plugins.ts
 var adminPluginRoutes = new hono.Hono();
-adminPluginRoutes.use("*", chunk37V3RET3_cjs.requireAuth());
-var AVAILABLE_PLUGINS = Object.values(chunkQCJHCSOK_cjs.PLUGIN_REGISTRY).map((p) => ({
+adminPluginRoutes.use("*", chunkBRKXMRMB_cjs.requireAuth());
+var AVAILABLE_PLUGINS = Object.values(chunk4DHPR7KR_cjs.PLUGIN_REGISTRY).map((p) => ({
   id: p.id,
   name: p.codeName,
   display_name: p.displayName,
@@ -20934,7 +21298,7 @@ adminPluginRoutes.get("/", async (c) => {
     if (user?.role !== "admin") {
       return c.text("Access denied", 403);
     }
-    const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+    const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
     let installedPlugins = [];
     let stats = { total: 0, active: 0, inactive: 0, errors: 0, uninstalled: 0 };
     try {
@@ -21008,10 +21372,10 @@ adminPluginRoutes.get("/:id", async (c) => {
     if (user?.role !== "admin") {
       return c.redirect("/admin/plugins");
     }
-    const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+    const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
     let plugin = await pluginService.getPlugin(pluginId);
     if (!plugin) {
-      const def = chunkBP52BFIV_cjs.getPluginDefinition(pluginId);
+      const def = chunkKWQNB6UM_cjs.getPluginDefinition(pluginId);
       if (!def) return c.text("Plugin not found", 404);
       plugin = await pluginService.ensurePlugin(pluginId, {
         displayName: def.displayName ?? pluginId,
@@ -21023,7 +21387,7 @@ adminPluginRoutes.get("/:id", async (c) => {
     const activity = await pluginService.getPluginActivity(pluginId, 20);
     let enrichedSettings = plugin.settings || {};
     if (pluginId === "otp-login") {
-      const settingsService = new chunk36Z3AKX3_cjs.SettingsService(db);
+      const settingsService = new chunkC5LDQ3SH_cjs.SettingsService(db);
       const generalSettings = await settingsService.getGeneralSettings();
       const siteName = generalSettings.siteName || "SonicJS";
       const emailPlugin = await db.prepare(`
@@ -21082,7 +21446,7 @@ adminPluginRoutes.get("/:id", async (c) => {
       timestamp: item.timestamp,
       user: item.userId || null
     }));
-    const pluginDef = chunkBP52BFIV_cjs.getPluginDefinition(pluginId);
+    const pluginDef = chunkKWQNB6UM_cjs.getPluginDefinition(pluginId);
     let settingsTabData = void 0;
     if (pluginDef?.settingsTabContent?.loadData) {
       try {
@@ -21112,14 +21476,14 @@ adminPluginRoutes.get("/:id/configure", async (c) => {
     const user = c.get("user");
     const pluginId = c.req.param("id");
     if (user?.role !== "admin") return c.redirect("/admin/plugins");
-    const def = chunkBP52BFIV_cjs.getPluginDefinition(pluginId);
+    const def = chunkKWQNB6UM_cjs.getPluginDefinition(pluginId);
     if (!def?.configSchema) return c.text("No schema-driven settings for this plugin", 404);
     const db = c.env.DB;
-    const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+    const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
     const plugin = await pluginService.getPlugin(pluginId);
     const stored = plugin?.settings ?? {};
-    const values = chunkBP52BFIV_cjs.applySchemaDefaults(def.configSchema, stored);
-    const fieldsHtml = chunkBP52BFIV_cjs.renderSchemaFields(def.configSchema, values);
+    const values = chunkKWQNB6UM_cjs.applySchemaDefaults(def.configSchema, stored);
+    const fieldsHtml = chunkKWQNB6UM_cjs.renderSchemaFields(def.configSchema, values);
     const displayName = plugin?.display_name ?? def.displayName ?? def.id;
     return c.html(`<!DOCTYPE html>
 <html lang="en"><head>
@@ -21146,12 +21510,12 @@ adminPluginRoutes.post("/:id/configure", async (c) => {
     const user = c.get("user");
     const pluginId = c.req.param("id");
     if (user?.role !== "admin") return c.json({ error: "Access denied" }, 403);
-    const def = chunkBP52BFIV_cjs.getPluginDefinition(pluginId);
+    const def = chunkKWQNB6UM_cjs.getPluginDefinition(pluginId);
     if (!def?.configSchema) return c.text("No schema-driven settings for this plugin", 404);
     const form = await c.req.formData();
-    const parsed = chunkBP52BFIV_cjs.parseFormDataToSettings(def.configSchema, form);
+    const parsed = chunkKWQNB6UM_cjs.parseFormDataToSettings(def.configSchema, form);
     const db = c.env.DB;
-    const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+    const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
     await pluginService.ensurePlugin(pluginId, {
       displayName: def.displayName ?? pluginId,
       version: def.version,
@@ -21175,7 +21539,7 @@ adminPluginRoutes.post("/:id/activate", async (c) => {
     if (user?.role !== "admin") {
       return c.json({ error: "Access denied" }, 403);
     }
-    const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+    const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
     await pluginService.activatePlugin(pluginId);
     await reconcileMenuFromPlugins(db);
     return c.json({ success: true });
@@ -21193,7 +21557,7 @@ adminPluginRoutes.post("/:id/deactivate", async (c) => {
     if (user?.role !== "admin") {
       return c.json({ error: "Access denied" }, 403);
     }
-    const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+    const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
     await pluginService.deactivatePlugin(pluginId);
     await reconcileMenuFromPlugins(db);
     return c.json({ success: true });
@@ -21211,8 +21575,8 @@ adminPluginRoutes.post("/install", async (c) => {
       return c.json({ error: "Access denied" }, 403);
     }
     const body = await c.req.json();
-    const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
-    const registryEntry = chunkQCJHCSOK_cjs.findPluginByCodeName(body.name) || chunkQCJHCSOK_cjs.PLUGIN_REGISTRY[body.name] || chunkQCJHCSOK_cjs.PLUGIN_REGISTRY[body.id];
+    const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
+    const registryEntry = chunk4DHPR7KR_cjs.findPluginByCodeName(body.name) || chunk4DHPR7KR_cjs.PLUGIN_REGISTRY[body.name] || chunk4DHPR7KR_cjs.PLUGIN_REGISTRY[body.id];
     if (!registryEntry) {
       return c.json({ error: "Plugin not found in registry" }, 404);
     }
@@ -21245,7 +21609,7 @@ adminPluginRoutes.post("/:id/uninstall", async (c) => {
     if (user?.role !== "admin") {
       return c.json({ error: "Access denied" }, 403);
     }
-    const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+    const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
     await pluginService.uninstallPlugin(pluginId);
     return c.json({ success: true });
   } catch (error) {
@@ -21263,7 +21627,7 @@ adminPluginRoutes.post("/:id/settings", async (c) => {
       return c.json({ error: "Access denied" }, 403);
     }
     const settings = await c.req.json();
-    const pluginService = new chunkQCJHCSOK_cjs.PluginService(db);
+    const pluginService = new chunk4DHPR7KR_cjs.PluginService(db);
     const existingPlugin = await pluginService.getPlugin(pluginId);
     const existingSettings = existingPlugin?.settings ?? {};
     await pluginService.updatePluginSettings(pluginId, { ...existingSettings, ...settings });
@@ -21298,7 +21662,7 @@ function formatLastUpdated(timestamp) {
 }
 
 // src/templates/pages/admin-logs-list.template.ts
-chunkUYJQDDEE_cjs.init_admin_layout_catalyst_template();
+chunkMI2YXCK4_cjs.init_admin_layout_catalyst_template();
 function renderLogsListPage(data) {
   const { logs, pagination, filters, user } = data;
   const content = `
@@ -21609,7 +21973,7 @@ function renderLogsListPage(data) {
     user,
     content
   };
-  return chunkUYJQDDEE_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkMI2YXCK4_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 function renderLogDetailsPage(data) {
   const { log, user } = data;
@@ -21821,7 +22185,7 @@ function renderLogDetailsPage(data) {
       </div>
     </div>
   `;
-  return chunkE66UVONV_cjs.adminLayoutV2({
+  return chunkOUBUS74I_cjs.adminLayoutV2({
     title: `Log Details - ${log.id}`,
     user,
     content
@@ -22064,7 +22428,7 @@ function renderLogConfigPage(data) {
 
     <script src="https://unpkg.com/htmx.org@1.9.6"></script>
   `;
-  return chunkE66UVONV_cjs.adminLayoutV2({
+  return chunkOUBUS74I_cjs.adminLayoutV2({
     title: "Log Configuration",
     user,
     content
@@ -22073,11 +22437,11 @@ function renderLogConfigPage(data) {
 
 // src/routes/admin-logs.ts
 var adminLogsRoutes = new hono.Hono();
-adminLogsRoutes.use("*", chunk37V3RET3_cjs.requireAuth());
+adminLogsRoutes.use("*", chunkBRKXMRMB_cjs.requireAuth());
 adminLogsRoutes.get("/", async (c) => {
   try {
     const user = c.get("user");
-    const logger = chunk36Z3AKX3_cjs.getLogger(c.env.DB);
+    const logger = chunkC5LDQ3SH_cjs.getLogger(c.env.DB);
     const query = c.req.query();
     const page = parseInt(query.page || "1");
     const limit = parseInt(query.limit || "50");
@@ -22157,7 +22521,7 @@ adminLogsRoutes.get("/:id", async (c) => {
   try {
     const id = c.req.param("id");
     const user = c.get("user");
-    const logger = chunk36Z3AKX3_cjs.getLogger(c.env.DB);
+    const logger = chunkC5LDQ3SH_cjs.getLogger(c.env.DB);
     const { logs } = await logger.getLogs({
       limit: 1,
       offset: 0,
@@ -22194,7 +22558,7 @@ adminLogsRoutes.get("/:id", async (c) => {
 adminLogsRoutes.get("/config", async (c) => {
   try {
     const user = c.get("user");
-    const logger = chunk36Z3AKX3_cjs.getLogger(c.env.DB);
+    const logger = chunkC5LDQ3SH_cjs.getLogger(c.env.DB);
     const configs = await logger.getAllConfigs();
     const pageData = {
       configs,
@@ -22218,7 +22582,7 @@ adminLogsRoutes.post("/config/:category", async (c) => {
     const level = formData.get("level");
     const retention = parseInt(formData.get("retention"));
     const maxSize = parseInt(formData.get("max_size"));
-    const logger = chunk36Z3AKX3_cjs.getLogger(c.env.DB);
+    const logger = chunkC5LDQ3SH_cjs.getLogger(c.env.DB);
     await logger.updateConfig(category, {
       enabled,
       level,
@@ -22247,7 +22611,7 @@ adminLogsRoutes.get("/export", async (c) => {
     const category = query.category;
     const startDate = query.start_date;
     const endDate = query.end_date;
-    const logger = chunk36Z3AKX3_cjs.getLogger(c.env.DB);
+    const logger = chunkC5LDQ3SH_cjs.getLogger(c.env.DB);
     const filter = {
       limit: 1e4,
       // Export up to 10k logs
@@ -22328,7 +22692,7 @@ adminLogsRoutes.post("/cleanup", async (c) => {
         error: "Unauthorized. Admin access required."
       }, 403);
     }
-    const logger = chunk36Z3AKX3_cjs.getLogger(c.env.DB);
+    const logger = chunkC5LDQ3SH_cjs.getLogger(c.env.DB);
     await logger.cleanupByRetention();
     return c.html(html.html`
       <div class="bg-green-100 border border-green-400 text-green-700 px-4 py-3 rounded">
@@ -22350,7 +22714,7 @@ adminLogsRoutes.post("/search", async (c) => {
     const search = formData.get("search");
     const level = formData.get("level");
     const category = formData.get("category");
-    const logger = chunk36Z3AKX3_cjs.getLogger(c.env.DB);
+    const logger = chunkC5LDQ3SH_cjs.getLogger(c.env.DB);
     const filter = {
       limit: 20,
       offset: 0,
@@ -22445,7 +22809,7 @@ adminCheckboxRoutes.get("/", (c) => {
       role: user.role
     } : void 0
   };
-  return c.html(chunkE66UVONV_cjs.renderCheckboxPage(pageData));
+  return c.html(chunkOUBUS74I_cjs.renderCheckboxPage(pageData));
 });
 
 // src/templates/pages/admin-dashboard.template.ts
@@ -22517,7 +22881,7 @@ function renderDashboardPage(data) {
     version: data.version,
     content: pageContent
   };
-  return chunkE66UVONV_cjs.renderAdminLayout(layoutData);
+  return chunkOUBUS74I_cjs.renderAdminLayout(layoutData);
 }
 function renderStatsCards(stats) {
   const cards = [
@@ -23065,9 +23429,9 @@ function renderStorageUsage(databaseSizeBytes, mediaSizeBytes) {
 }
 
 // src/routes/admin-dashboard.ts
-var VERSION = chunkKKNEYIZJ_cjs.getCoreVersion();
+var VERSION = chunkXZUEGFXE_cjs.getCoreVersion();
 var router = new hono.Hono();
-router.use("*", chunk37V3RET3_cjs.requireAuth());
+router.use("*", chunkBRKXMRMB_cjs.requireAuth());
 router.get("/", async (c) => {
   const user = c.get("user");
   try {
@@ -23257,7 +23621,7 @@ router.get("/system-status", async (c) => {
 });
 
 // src/templates/pages/admin-collections-list.template.ts
-chunkUYJQDDEE_cjs.init_admin_layout_catalyst_template();
+chunkMI2YXCK4_cjs.init_admin_layout_catalyst_template();
 
 // src/templates/components/table.template.ts
 function renderTable2(data) {
@@ -23739,11 +24103,11 @@ function renderCollectionsListPage(data) {
     version: data.version,
     content: pageContent
   };
-  return chunkUYJQDDEE_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkMI2YXCK4_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/templates/pages/admin-collections-form.template.ts
-chunkUYJQDDEE_cjs.init_admin_layout_catalyst_template();
+chunkMI2YXCK4_cjs.init_admin_layout_catalyst_template();
 function getFieldTypeBadge(fieldType) {
   const typeLabels = {
     "text": "Text",
@@ -23916,8 +24280,8 @@ function renderCollectionFormPage(data) {
         <!-- Form Content -->
         <div class="px-6 py-6">
           <div id="form-messages"></div>
-          ${data.error ? chunkJMJM7DMM_cjs.renderAlert({ type: "error", message: data.error, dismissible: true }) : ""}
-          ${data.success ? chunkJMJM7DMM_cjs.renderAlert({ type: "success", message: data.success, dismissible: true }) : ""}
+          ${data.error ? chunkTT3TQSCZ_cjs.renderAlert({ type: "error", message: data.error, dismissible: true }) : ""}
+          ${data.success ? chunkTT3TQSCZ_cjs.renderAlert({ type: "success", message: data.success, dismissible: true }) : ""}
 
           <!-- Form Styling -->
           <style>
@@ -24028,7 +24392,7 @@ function renderCollectionFormPage(data) {
             }
           </style>
           
-          ${chunkE66UVONV_cjs.renderForm(formData)}
+          ${chunkOUBUS74I_cjs.renderForm(formData)}
 
           ${isEdit && data.managed ? `
             <!-- Read-Only Fields Display for Managed Collections -->
@@ -25026,13 +25390,13 @@ function renderCollectionFormPage(data) {
     version: data.version,
     content: pageContent
   };
-  return chunkUYJQDDEE_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkMI2YXCK4_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/routes/admin-collections.ts
-chunkUYJQDDEE_cjs.init_admin_layout_catalyst_template();
+chunkMI2YXCK4_cjs.init_admin_layout_catalyst_template();
 var adminCollectionsRoutes = new hono.Hono();
-adminCollectionsRoutes.use("*", chunk37V3RET3_cjs.requireAuth());
+adminCollectionsRoutes.use("*", chunkBRKXMRMB_cjs.requireAuth());
 adminCollectionsRoutes.get("/", async (c) => {
   try {
     const user = c.get("user");
@@ -25049,7 +25413,7 @@ adminCollectionsRoutes.get("/", async (c) => {
       results = queryResults.results ?? [];
     } catch (e) {
     }
-    const codeCollections = chunkQCJHCSOK_cjs.getCollectionRegistry().list();
+    const codeCollections = chunk4DHPR7KR_cjs.getCollectionRegistry().list();
     const codeCollectionsMap = new Map(
       codeCollections.map((cfg) => {
         const fieldCount = cfg.schema?.properties ? Object.keys(cfg.schema.properties).length : 0;
@@ -25063,7 +25427,7 @@ adminCollectionsRoutes.get("/", async (c) => {
           field_count: fieldCount,
           managed: cfg.managed !== false,
           source_type: "code",
-          internal: chunkQCJHCSOK_cjs.isCodeCollectionInternal(cfg),
+          internal: chunk4DHPR7KR_cjs.isCodeCollectionInternal(cfg),
           versioning: cfg.versioning === true
         }];
       })
@@ -25102,7 +25466,7 @@ adminCollectionsRoutes.get("/", async (c) => {
         field_count: fieldCount,
         managed: false,
         source_type: row.source === "code" || row.source === "system" || row.source === "plugin" ? "code" : "user",
-        internal: chunkQCJHCSOK_cjs.isDbDocTypeInternal(row.source),
+        internal: chunk4DHPR7KR_cjs.isDbDocTypeInternal(row.source),
         versioning: dbVersioning
       };
     });
@@ -25259,11 +25623,11 @@ export const myPlugin = definePlugin({
   `;
   const u = user;
   return c.html(
-    chunkUYJQDDEE_cjs.renderAdminLayoutCatalyst({
+    chunkMI2YXCK4_cjs.renderAdminLayoutCatalyst({
       title: "Add a Collection",
       pageTitle: "Add a Collection",
       currentPath: "/admin/collections",
-      version: chunkKKNEYIZJ_cjs.getCoreVersion(),
+      version: chunkXZUEGFXE_cjs.getCoreVersion(),
       user: u ? { name: u.email ?? "Admin", email: u.email ?? "", role: u.role ?? "admin" } : void 0,
       content
     })
@@ -25280,7 +25644,7 @@ adminCollectionsRoutes.get("/:id", async (c) => {
       collection = await stmt.bind(id).first();
     } catch {
     }
-    const registryRecord = chunkQCJHCSOK_cjs.getCollectionRegistry().getById(id) ?? chunkQCJHCSOK_cjs.getCollectionRegistry().getByName(id);
+    const registryRecord = chunk4DHPR7KR_cjs.getCollectionRegistry().getById(id) ?? chunk4DHPR7KR_cjs.getCollectionRegistry().getByName(id);
     if (!collection && !registryRecord) {
       const formData2 = {
         isEdit: true,
@@ -25327,9 +25691,9 @@ adminCollectionsRoutes.get("/:id", async (c) => {
       isCodeDriven = true;
     }
     const [tinymceActive, quillActive, mdxeditorActive] = await Promise.all([
-      chunk37V3RET3_cjs.isPluginActive(db, "tinymce-plugin"),
-      chunk37V3RET3_cjs.isPluginActive(db, "quill-editor"),
-      chunk37V3RET3_cjs.isPluginActive(db, "easy-mdx")
+      chunk4DHPR7KR_cjs.isPluginActive(db, "tinymce-plugin"),
+      chunk4DHPR7KR_cjs.isPluginActive(db, "quill-editor"),
+      chunk4DHPR7KR_cjs.isPluginActive(db, "easy-mdx")
     ]);
     const displayName = collection?.display_name ?? registryRecord?.displayName ?? id;
     const formData = {
@@ -25349,9 +25713,9 @@ adminCollectionsRoutes.get("/:id", async (c) => {
     console.error("Error fetching collection:", error);
     const user = c.get("user");
     const [tinymceActive, quillActive, mdxeditorActive] = await Promise.all([
-      chunk37V3RET3_cjs.isPluginActive(db, "tinymce-plugin"),
-      chunk37V3RET3_cjs.isPluginActive(db, "quill-editor"),
-      chunk37V3RET3_cjs.isPluginActive(db, "easy-mdx")
+      chunk4DHPR7KR_cjs.isPluginActive(db, "tinymce-plugin"),
+      chunk4DHPR7KR_cjs.isPluginActive(db, "quill-editor"),
+      chunk4DHPR7KR_cjs.isPluginActive(db, "easy-mdx")
     ]);
     const formData = {
       isEdit: true,
@@ -25365,7 +25729,7 @@ adminCollectionsRoutes.get("/:id", async (c) => {
 });
 
 // src/templates/pages/admin-settings.template.ts
-chunkUYJQDDEE_cjs.init_admin_layout_catalyst_template();
+chunkMI2YXCK4_cjs.init_admin_layout_catalyst_template();
 function renderSettingsPage(data) {
   const activeTab = data.activeTab || "general";
   const pageContent = `
@@ -25755,7 +26119,7 @@ function renderSettingsPage(data) {
     version: data.version,
     content: pageContent
   };
-  return chunkUYJQDDEE_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkMI2YXCK4_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 function renderTabButton(tabId, label, iconPath, activeTab) {
   const isActive = activeTab === tabId;
@@ -26300,7 +26664,7 @@ function renderDatabaseToolsSettings(settings) {
 
 // src/routes/admin-settings.ts
 var adminSettingsRoutes = new hono.Hono();
-adminSettingsRoutes.use("*", chunk37V3RET3_cjs.requireAuth());
+adminSettingsRoutes.use("*", chunkBRKXMRMB_cjs.requireAuth());
 function getMockSettings(user) {
   return {
     general: {
@@ -26334,7 +26698,7 @@ adminSettingsRoutes.get("/", (c) => {
 adminSettingsRoutes.get("/general", async (c) => {
   const user = c.get("user");
   const db = c.env.DB;
-  const settingsService = new chunk36Z3AKX3_cjs.SettingsService(db);
+  const settingsService = new chunkC5LDQ3SH_cjs.SettingsService(db);
   const generalSettings = await settingsService.getGeneralSettings(user?.email);
   const mockSettings = getMockSettings(user);
   mockSettings.general = generalSettings;
@@ -26353,7 +26717,7 @@ adminSettingsRoutes.get("/general", async (c) => {
 adminSettingsRoutes.get("/security", async (c) => {
   const user = c.get("user");
   const db = c.env.DB;
-  const settingsService = new chunk36Z3AKX3_cjs.SettingsService(db);
+  const settingsService = new chunkC5LDQ3SH_cjs.SettingsService(db);
   const persisted = await settingsService.getSecuritySettings();
   const mockSettings = getMockSettings(user);
   mockSettings.security = {
@@ -26403,7 +26767,7 @@ adminSettingsRoutes.get("/database-tools", (c) => {
 adminSettingsRoutes.get("/api/migrations/status", async (c) => {
   try {
     const db = c.env.DB;
-    const migrationService = new chunkA2SN3RVL_cjs.MigrationService(db);
+    const migrationService = new chunkPAS7GZBS_cjs.MigrationService(db);
     const status = await migrationService.getMigrationStatus();
     return c.json({
       success: true,
@@ -26443,7 +26807,7 @@ adminSettingsRoutes.post("/api/migrations/run", async (c) => {
 adminSettingsRoutes.get("/api/migrations/validate", async (c) => {
   try {
     const db = c.env.DB;
-    const migrationService = new chunkA2SN3RVL_cjs.MigrationService(db);
+    const migrationService = new chunkPAS7GZBS_cjs.MigrationService(db);
     const validation = await migrationService.validateSchema();
     return c.json({
       success: true,
@@ -26612,7 +26976,7 @@ adminSettingsRoutes.post("/general", async (c) => {
     }
     const formData = await c.req.formData();
     const db = c.env.DB;
-    const settingsService = new chunk36Z3AKX3_cjs.SettingsService(db);
+    const settingsService = new chunkC5LDQ3SH_cjs.SettingsService(db);
     const settings = {
       siteName: formData.get("siteName"),
       siteDescription: formData.get("siteDescription"),
@@ -26658,7 +27022,7 @@ adminSettingsRoutes.post("/security", async (c) => {
     }
     const formData = await c.req.formData();
     const db = c.env.DB;
-    const settingsService = new chunk36Z3AKX3_cjs.SettingsService(db);
+    const settingsService = new chunkC5LDQ3SH_cjs.SettingsService(db);
     const jwtExpiresInRaw = formData.get("jwtExpiresIn")?.trim() || "";
     const graceRaw = formData.get("jwtRefreshGraceSeconds")?.trim() || "";
     if (!/^\d+(?:s|m|h|d)?$/i.test(jwtExpiresInRaw)) {
@@ -26701,7 +27065,7 @@ adminSettingsRoutes.post("/", async (c) => {
 });
 
 // src/templates/pages/admin-api-reference.template.ts
-chunkUYJQDDEE_cjs.init_admin_layout_catalyst_template();
+chunkMI2YXCK4_cjs.init_admin_layout_catalyst_template();
 function renderAuthBadge(auth) {
   if (auth === true) {
     return `
@@ -26842,7 +27206,7 @@ function renderAPIReferencePage(data) {
                 >
                   <option value="">All Categories</option>
                   ${categories.map((category) => {
-    const info = chunk36Z3AKX3_cjs.CATEGORY_INFO[category];
+    const info = chunkC5LDQ3SH_cjs.CATEGORY_INFO[category];
     const title = info ? info.title : category;
     return `<option value="${category}">${title}</option>`;
   }).join("\n                  ")}
@@ -26859,7 +27223,7 @@ function renderAPIReferencePage(data) {
       <!-- API Categories -->
       <div class="space-y-6">
         ${Object.entries(endpointsByCategory).map(([category, endpoints]) => {
-    const info = chunk36Z3AKX3_cjs.CATEGORY_INFO[category] || { title: category, description: "", icon: "&#x1f4cb;" };
+    const info = chunkC5LDQ3SH_cjs.CATEGORY_INFO[category] || { title: category, description: "", icon: "&#x1f4cb;" };
     return `
             <div class="api-category" data-category="${category}">
               <div class="rounded-lg bg-white dark:bg-zinc-900 shadow-sm ring-1 ring-zinc-950/5 dark:ring-white/10 overflow-hidden">
@@ -27032,20 +27396,20 @@ function renderAPIReferencePage(data) {
     version: data.version,
     content: pageContent
   };
-  return chunkUYJQDDEE_cjs.renderAdminLayoutCatalyst(layoutData);
+  return chunkMI2YXCK4_cjs.renderAdminLayoutCatalyst(layoutData);
 }
 
 // src/routes/admin-api-reference.ts
-var VERSION2 = chunkKKNEYIZJ_cjs.getCoreVersion();
+var VERSION2 = chunkXZUEGFXE_cjs.getCoreVersion();
 var router2 = new hono.Hono();
-router2.use("*", chunk37V3RET3_cjs.requireAuth());
+router2.use("*", chunkBRKXMRMB_cjs.requireAuth());
 router2.get("/", async (c) => {
   const user = c.get("user");
   try {
-    const app2 = chunk36Z3AKX3_cjs.getAppInstance();
-    const baseEndpoints = chunk36Z3AKX3_cjs.buildRouteList(app2);
+    const app2 = chunkC5LDQ3SH_cjs.getAppInstance();
+    const baseEndpoints = chunkC5LDQ3SH_cjs.buildRouteList(app2);
     const collectionRoutes = [];
-    const collections = chunkQCJHCSOK_cjs.getCollectionRegistry().listActive().filter((r) => !r.internal);
+    const collections = chunk4DHPR7KR_cjs.getCollectionRegistry().listActive().filter((r) => !r.internal);
     const methodOrder = { GET: 0, POST: 1, PUT: 2, PATCH: 3, DELETE: 4 };
     for (const col of collections) {
       const displayName = col.displayName || col.name;
@@ -27160,11 +27524,13 @@ exports.resolveDocScope = resolveDocScope;
 exports.resolveVariablesInObject = resolveVariablesInObject;
 exports.router = router;
 exports.router2 = router2;
+exports.setDemoModeActive = setDemoModeActive;
 exports.setEmailService = setEmailService;
 exports.setVariablesCache = setVariablesCache;
+exports.swrStats = swrStats;
 exports.test_cleanup_default = test_cleanup_default;
 exports.updateDocumentSchema = updateDocumentSchema;
 exports.userProfilesPlugin = userProfilesPlugin;
 exports.userRoutes = userRoutes;
-//# sourceMappingURL=chunk-I767LVN7.cjs.map
-//# sourceMappingURL=chunk-I767LVN7.cjs.map
+//# sourceMappingURL=chunk-S2QN4LFD.cjs.map
+//# sourceMappingURL=chunk-S2QN4LFD.cjs.map