@sonicjs-cms/core 3.0.0-beta.24 → 3.0.0-beta.26

package/dist/index.js

@@ -1,37 +1,38 @@
-import { createAuth } from './chunk-SOZUG52O.js';
-import { getEmailService, hasEmailService, setEmailService, reconcileMenuFromPlugins, invalidateVariablesCache, resolveVariablesInObject, resolveDocScope, denyIfNotAllowed, DocumentRepository, dispatchHookEvent, getCustomData, createDocumentSchema, renderTable, getVariablesCached, setVariablesCache, TenantService, isValidMemberRole, renderConfirmationDialog, getConfirmationDialogScript, VALID_MEMBER_ROLES, userProfilesPlugin, lexicalEditorPlugin, api_media_default, api_system_default, apiDocumentsRoutes, api_default, adminDocumentsRoutes, admin_api_default, adminCollectionsRoutes, adminSettingsRoutes, router2, admin_content_default, adminMediaRoutes, router, adminPluginRoutes, adminLogsRoutes, userRoutes, auth_default, test_cleanup_default, getDocumentRequestContext, updateDocumentSchema, effectiveTenantForType } from './chunk-VC5XVPLM.js';
-export { DocumentRepository, ROUTES_INFO, admin_api_default as adminApiRoutes, adminCheckboxRoutes, adminCollectionsRoutes, admin_content_default as adminContentRoutes, router as adminDashboardRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, userRoutes as adminUsersRoutes, api_content_crud_default as apiContentCrudRoutes, api_media_default as apiMediaRoutes, api_default as apiRoutes, api_system_default as apiSystemRoutes, auth_default as authRoutes, createUserProfilesPlugin, defineUserProfile, getUserProfileConfig, userProfilesPlugin } from './chunk-VC5XVPLM.js';
+import { createAuth } from './chunk-JG5J434C.js';
+import { getEmailService, hasEmailService, setEmailService, reconcileMenuFromPlugins, invalidateVariablesCache, resolveVariablesInObject, resolveDocScope, denyIfNotAllowed, DocumentRepository, swrStats, setDemoModeActive, dispatchHookEvent, getCustomData, createDocumentSchema, renderTable, getVariablesCached, setVariablesCache, TenantService, isValidMemberRole, renderConfirmationDialog, getConfirmationDialogScript, VALID_MEMBER_ROLES, userProfilesPlugin, lexicalEditorPlugin, api_media_default, api_system_default, apiDocumentsRoutes, api_default, adminDocumentsRoutes, admin_api_default, adminCollectionsRoutes, adminSettingsRoutes, router2, admin_content_default, adminMediaRoutes, router, adminPluginRoutes, adminLogsRoutes, userRoutes, auth_default, test_cleanup_default, getDocumentRequestContext, updateDocumentSchema, effectiveTenantForType } from './chunk-OJFIQGZB.js';
+export { DocumentRepository, ROUTES_INFO, admin_api_default as adminApiRoutes, adminCheckboxRoutes, adminCollectionsRoutes, admin_content_default as adminContentRoutes, router as adminDashboardRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, userRoutes as adminUsersRoutes, api_content_crud_default as apiContentCrudRoutes, api_media_default as apiMediaRoutes, api_default as apiRoutes, api_system_default as apiSystemRoutes, auth_default as authRoutes, createUserProfilesPlugin, defineUserProfile, getUserProfileConfig, userProfilesPlugin } from './chunk-OJFIQGZB.js';
+import './chunk-E3TQG7AA.js';
+import { loadKvCatalog, getCatalog, getCatalogStats, clearCatalog, clearKvCatalog } from './chunk-F6BTBE4S.js';
 import './chunk-VVYVFCML.js';
-import './chunk-BHND5PEV.js';
-import { SettingsService, setAppInstance } from './chunk-2XAQTPAE.js';
-export { Logger, getLogger, initLogger } from './chunk-2XAQTPAE.js';
+import { SettingsService, setAppInstance } from './chunk-6X22VFEV.js';
+export { Logger, getLogger, initLogger } from './chunk-6X22VFEV.js';
 import { getAllCacheStats, CACHE_CONFIGS, getCacheService, clearAllCaches, parseCacheKey } from './chunk-K25XHMM3.js';
 import { schema_exports } from './chunk-AI663NBO.js';
 export { apiTokens, content, contentVersions, insertContentSchema, insertLogConfigSchema, insertMediaSchema, insertPluginActivityLogSchema, insertPluginAssetSchema, insertPluginHookSchema, insertPluginRouteSchema, insertPluginSchema, insertSystemLogSchema, insertUserSchema, insertWorkflowHistorySchema, logConfig, media, pluginActivityLog, pluginAssets, pluginHooks, pluginRoutes, plugins, selectContentSchema, selectLogConfigSchema, selectMediaSchema, selectPluginActivityLogSchema, selectPluginAssetSchema, selectPluginHookSchema, selectPluginRouteSchema, selectPluginSchema, selectSystemLogSchema, selectUserSchema, selectWorkflowHistorySchema, systemLogs, users, workflowHistory } from './chunk-AI663NBO.js';
-import { requireAuth, DocumentTypeRegistry, requireRbac, requireRole, getJwtExpirySecondsFromDb, AuthManager, metricsMiddleware, bootstrapMiddleware, securityHeadersMiddleware, csrfProtection } from './chunk-FHPEM77Y.js';
-export { AuthManager, PermissionManager, bootstrapDocumentTypes, bootstrapMiddleware, cacheHeaders, compressionMiddleware, detailedLoggingMiddleware, getActivePlugins, isPluginActive, logActivity, loggingMiddleware, optionalAuth, performanceLoggingMiddleware, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeadersMiddleware as securityHeaders, securityLoggingMiddleware } from './chunk-FHPEM77Y.js';
-import { RbacService, DocumentsService } from './chunk-3TMTYJAJ.js';
-export { DocumentsService, RbacService } from './chunk-3TMTYJAJ.js';
+import { requireAuth, DocumentTypeRegistry, requireRbac, requireRole, getJwtExpirySecondsFromDb, AuthManager, metricsMiddleware, bootstrapMiddleware, securityHeadersMiddleware, csrfProtection } from './chunk-EEA476CJ.js';
+export { AuthManager, PermissionManager, bootstrapDocumentTypes, bootstrapMiddleware, cacheHeaders, compressionMiddleware, detailedLoggingMiddleware, logActivity, loggingMiddleware, optionalAuth, performanceLoggingMiddleware, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeadersMiddleware as securityHeaders, securityLoggingMiddleware } from './chunk-EEA476CJ.js';
+import { RbacService, DocumentsService } from './chunk-RXLI3ADU.js';
+export { DocumentsService, RbacService } from './chunk-RXLI3ADU.js';
 import { nanoid } from './chunk-UWUP2VMT.js';
-import { PluginService, PLUGIN_REGISTRY, invalidateTenantCache, getCollectionRegistry, TENANT_COOKIE, MULTI_TENANT_PLUGIN_ID, collectionRecordToRow, tenantMiddleware } from './chunk-RJ2O5IIE.js';
-export { PluginBootstrapService, PluginService as PluginServiceClass, getAvailableCollectionNames, loadCollectionConfig, loadCollectionConfigs, registerCollections, validateCollectionConfig } from './chunk-RJ2O5IIE.js';
-export { MigrationService } from './chunk-UIHIXTIS.js';
-export { renderFilterBar } from './chunk-URIBTX27.js';
-import { renderAdminLayout } from './chunk-BJROXF4N.js';
-export { getConfirmationDialogScript, renderAlert, renderConfirmationDialog, renderForm, renderFormField, renderPagination, renderTable } from './chunk-BJROXF4N.js';
-import { init_admin_layout_catalyst_template, renderAdminLayoutCatalyst } from './chunk-THFZSDIU.js';
-export { renderAdminLayoutCatalyst } from './chunk-THFZSDIU.js';
-import { TurnstileService, HookSystemImpl, createPluginWirer, registerPluginRoutes } from './chunk-VYQVDL2M.js';
-export { HookSystemImpl, HookUtils, PluginDependencyCycleError, PluginManager as PluginManagerClass, PluginRegistryImpl, PluginValidator as PluginValidatorClass, RegisterPluginsError, ScopedHookSystem as ScopedHookSystemClass, collectCronSchedules, collectCrons, createScheduledHandler, dispatchCronTick, registerPlugins, topoSort } from './chunk-VYQVDL2M.js';
-import { definePlugin, setPluginMenu, setPluginDefinitions, resolvePluginMenuItems } from './chunk-VGEZNFWH.js';
-export { applySchemaDefaults, definePlugin, getPluginMenu, isDefinedPlugin, parseConfigSchema, parseFormDataToSettings, renderSchemaFields, resetPluginMenu, resolvePluginMenuItems, setPluginMenu } from './chunk-VGEZNFWH.js';
+import { PluginService, PLUGIN_REGISTRY, invalidateTenantCache, getCollectionRegistry, TENANT_COOKIE, MULTI_TENANT_PLUGIN_ID, collectionRecordToRow, tenantMiddleware } from './chunk-RVOX2WH2.js';
+export { PluginBootstrapService, PluginService as PluginServiceClass, getActivePlugins, getAvailableCollectionNames, isPluginActive, loadCollectionConfig, loadCollectionConfigs, registerCollections, requireActivePlugin, requireActivePlugins, validateCollectionConfig } from './chunk-RVOX2WH2.js';
+export { MigrationService } from './chunk-5YSFQO7X.js';
+export { renderFilterBar } from './chunk-73RTFFMX.js';
+import { renderAdminLayout } from './chunk-HSDJDWLV.js';
+export { getConfirmationDialogScript, renderAlert, renderConfirmationDialog, renderForm, renderFormField, renderPagination, renderTable } from './chunk-HSDJDWLV.js';
+import { init_admin_layout_catalyst_template, renderAdminLayoutCatalyst } from './chunk-SXC4HPK6.js';
+export { renderAdminLayoutCatalyst } from './chunk-SXC4HPK6.js';
+import { TurnstileService, HookSystemImpl, createPluginWirer, registerPluginRoutes } from './chunk-UKIDWRA3.js';
+export { HookSystemImpl, HookUtils, PluginDependencyCycleError, PluginManager as PluginManagerClass, PluginRegistryImpl, PluginValidator as PluginValidatorClass, RegisterPluginsError, ScopedHookSystem as ScopedHookSystemClass, collectCronSchedules, collectCrons, createScheduledHandler, dispatchCronTick, registerPlugins, topoSort } from './chunk-UKIDWRA3.js';
+import { definePlugin, setPluginMenu, setPluginDefinitions, resolvePluginMenuItems } from './chunk-JD7BZU3A.js';
+export { applySchemaDefaults, definePlugin, getPluginMenu, isDefinedPlugin, parseConfigSchema, parseFormDataToSettings, renderSchemaFields, resetPluginMenu, resolvePluginMenuItems, setPluginMenu } from './chunk-JD7BZU3A.js';
 import { setHookSystem } from './chunk-RNZFGN4R.js';
 export { getHookSystem, getTypedHooks, hasHookSystem, resetHookSystem, setHookSystem } from './chunk-RNZFGN4R.js';
-export { QueryFilterBuilder, TemplateRenderer, buildQuery, renderTemplate, templateRenderer } from './chunk-QZGABF2M.js';
+export { QueryFilterBuilder, TemplateRenderer, buildQuery, renderTemplate, templateRenderer } from './chunk-AMP4BSJE.js';
 export { metricsTracker } from './chunk-FICTAGD4.js';
 import './chunk-X7ZAEI5S.js';
-import { getCoreVersion, package_default } from './chunk-LNI3FYSI.js';
-export { SONICJS_VERSION, getCoreVersion } from './chunk-LNI3FYSI.js';
+import { getCoreVersion, package_default } from './chunk-UB5QSRO7.js';
+export { SONICJS_VERSION, getCoreVersion } from './chunk-UB5QSRO7.js';
 import { escapeHtml, sanitizeInput } from './chunk-TQABQWOP.js';
 export { escapeHtml, sanitizeInput, sanitizeObject } from './chunk-TQABQWOP.js';
 export { HOOKS } from './chunk-QXOZI5Q2.js';
@@ -8112,7 +8113,7 @@ adminRoutes5.get("/settings", async (c) => {
   const db = c.env.DB;
   const user = c.get("user");
   const settings = await getSettings4(db);
-  const { renderAdminLayoutCatalyst: renderAdminLayoutCatalyst2 } = await import('./admin-layout-catalyst.template-6UQGLCKI.js');
+  const { renderAdminLayoutCatalyst: renderAdminLayoutCatalyst2 } = await import('./admin-layout-catalyst.template-WCYMQVTZ.js');
   const content2 = `
     <div>
       <div class="mb-6">
@@ -11727,9 +11728,9 @@ function pluginMenuMiddleware() {
     if (!path.startsWith("/admin")) {
       return next();
     }
+    const db = c.env.DB;
     let activeMenuItems = [];
     try {
-      const db = c.env.DB;
       const pluginIds = REGISTRY_MENU_PLUGINS.map((p) => p.id);
       if (pluginIds.length > 0) {
         const placeholders = pluginIds.map(() => "?").join(",");
@@ -11753,9 +11754,24 @@ function pluginMenuMiddleware() {
     }
     const user = c.get("user");
     const singletonItems = resolvePluginMenuItems(user ? { role: user.role } : void 0);
+    const singletonPluginIds = [...new Set(
+      singletonItems.map((i) => i.pluginId).filter((id) => !!id)
+    )];
+    let activeSingletonIds = /* @__PURE__ */ new Set();
+    try {
+      if (singletonPluginIds.length > 0) {
+        const ph = singletonPluginIds.map(() => "?").join(",");
+        const result = await db.prepare(
+          `SELECT slug FROM documents WHERE type_id = 'plugin' AND tenant_id = 'default' AND slug IN (${ph}) AND q_plugin_status = 'active' AND is_current_draft = 1 AND deleted_at IS NULL`
+        ).bind(...singletonPluginIds).all();
+        activeSingletonIds = new Set((result.results || []).map((r) => r.slug));
+      }
+    } catch {
+    }
     const existingPaths = new Set(activeMenuItems.map((i) => i.path));
     for (const item of singletonItems) {
-      if (!existingPaths.has(item.path)) {
+      const isActive = !item.pluginId || activeSingletonIds.has(item.pluginId);
+      if (isActive && !existingPaths.has(item.path)) {
         activeMenuItems.push({ label: item.label, path: item.path, icon: item.icon, order: item.order });
       }
     }
@@ -17193,6 +17209,14 @@ function renderCacheDashboard(data) {
           >
             Collection Settings
           </button>
+          <button
+            onclick="switchTab('url-catalog')"
+            id="tab-url-catalog"
+            class="cache-tab border-b-2 border-transparent py-3 px-1 text-sm font-medium text-zinc-500 dark:text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-300 hover:border-zinc-300 dark:hover:border-zinc-600 whitespace-nowrap"
+          >
+            URL Catalog
+            ${data.catalog.stats.totalEntries > 0 ? `<span class="ml-1.5 inline-flex items-center rounded-full px-1.5 py-0.5 text-xs font-medium bg-sky-100 dark:bg-sky-500/20 text-sky-700 dark:text-sky-300">${data.catalog.stats.totalEntries}</span>` : ""}
+          </button>
         </nav>
       </div>
 
@@ -17273,10 +17297,18 @@ function renderCacheDashboard(data) {
       <div id="tab-panel-collection-settings" class="hidden space-y-6">
         ${renderCollectionSettingsTab(data.collections)}
       </div>
+
+      <!-- Tab: URL Catalog -->
+      <div id="tab-panel-url-catalog" class="hidden space-y-6">
+        ${renderUrlCatalogTab(data.catalog)}
+      </div>
     </div>
 
     <script>
-      function switchTab(tab) {
+      const VALID_TABS = ['overview', 'collection-settings', 'url-catalog']
+
+      function switchTab(tab, pushHash) {
+        if (!VALID_TABS.includes(tab)) tab = 'overview'
         // Update tab button styles
         document.querySelectorAll('.cache-tab').forEach(btn => {
           btn.classList.remove('border-zinc-950', 'dark:border-white', 'text-zinc-950', 'dark:text-white')
@@ -17294,8 +17326,21 @@ function renderCacheDashboard(data) {
         })
         const activePanel = document.getElementById('tab-panel-' + tab)
         if (activePanel) activePanel.classList.remove('hidden')
+
+        // Sync URL hash (pushHash=false when called from hashchange to avoid loop)
+        if (pushHash !== false) location.hash = tab
       }
 
+      document.addEventListener('DOMContentLoaded', function () {
+        const hash = location.hash.slice(1)
+        switchTab(VALID_TABS.includes(hash) ? hash : 'overview', false)
+      })
+
+      window.addEventListener('hashchange', function () {
+        const hash = location.hash.slice(1)
+        switchTab(VALID_TABS.includes(hash) ? hash : 'overview', false)
+      })
+
       async function refreshStats() {
         window.location.reload()
       }
@@ -17319,6 +17364,21 @@ function renderCacheDashboard(data) {
         }
       }
 
+      async function clearUrlCatalog() {
+        try {
+          const response = await fetch('/admin/cache/catalog/clear', { method: 'POST' })
+          const result = await response.json()
+          if (result.success) {
+            alert('URL catalog cleared')
+            window.location.reload()
+          } else {
+            alert('Error: ' + result.error)
+          }
+        } catch (error) {
+          alert('Error: ' + error.message)
+        }
+      }
+
       let namespaceToDelete = null
 
       async function clearNamespaceCache(namespace) {
@@ -17380,6 +17440,130 @@ function renderCacheDashboard(data) {
   };
   return renderAdminLayoutCatalyst(layoutData);
 }
+function renderUrlCatalogTab(catalog) {
+  const { entries, stats, swrPending } = catalog;
+  const statCards = `
+    <div class="grid grid-cols-2 gap-4 sm:grid-cols-4">
+      ${renderMiniStatCard("Tracked URLs", stats.totalEntries.toLocaleString(), "sky")}
+      ${renderMiniStatCard("Cache Hits", stats.totalHits.toLocaleString(), "lime")}
+      ${renderMiniStatCard("Cache Misses", stats.totalMisses.toLocaleString(), "amber")}
+      ${renderMiniStatCard("Stale Serves", stats.totalStale.toLocaleString(), "purple")}
+    </div>
+  `;
+  const swrBadge = swrPending > 0 ? `<span class="ml-2 inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium bg-amber-100 dark:bg-amber-500/20 text-amber-700 dark:text-amber-300">${swrPending} stale pending</span>` : "";
+  if (entries.length === 0) {
+    return `
+      ${statCards}
+      <div class="overflow-hidden rounded-xl bg-white dark:bg-zinc-900 ring-1 ring-zinc-950/5 dark:ring-white/10">
+        <div class="p-12 text-center">
+          <svg class="mx-auto h-8 w-8 text-zinc-400 dark:text-zinc-500 mb-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2"/>
+          </svg>
+          <p class="text-sm font-medium text-zinc-900 dark:text-zinc-100">No entries yet</p>
+          <p class="mt-1 text-sm text-zinc-500 dark:text-zinc-400">Cache-eligible API requests will appear here after the first page load.</p>
+        </div>
+      </div>
+    `;
+  }
+  const rows = entries.map((entry) => {
+    const totalReqs = entry.hits + entry.misses + entry.staleServes;
+    const hitRate = totalReqs > 0 ? Math.round(entry.hits / totalReqs * 100) : 0;
+    const hitRateColor = hitRate > 70 ? "text-lime-600 dark:text-lime-400" : hitRate > 40 ? "text-amber-600 dark:text-amber-400" : "text-red-600 dark:text-red-400";
+    const pathDisplay = entry.queryString ? `${entry.path}?${entry.queryString}` : entry.path;
+    const truncatedPath = pathDisplay.length > 80 ? pathDisplay.slice(0, 77) + "\u2026" : pathDisplay;
+    const collBadge = entry.collection ? `<span class="inline-flex items-center rounded-md px-1.5 py-0.5 text-xs font-medium bg-sky-50 dark:bg-sky-500/10 text-sky-700 dark:text-sky-400 ring-1 ring-inset ring-sky-600/20">${entry.collection}</span>` : `<span class="text-xs text-zinc-400 dark:text-zinc-600">\u2014</span>`;
+    const timeAgo = formatTimeAgo(entry.lastSeen);
+    return `
+      <tr class="hover:bg-zinc-50 dark:hover:bg-zinc-800/50">
+        <td class="px-4 py-3 max-w-xs">
+          <code class="text-xs text-zinc-700 dark:text-zinc-300 break-all" title="${pathDisplay}">${truncatedPath}</code>
+        </td>
+        <td class="px-4 py-3 whitespace-nowrap">${collBadge}</td>
+        <td class="px-4 py-3 whitespace-nowrap text-sm text-zinc-900 dark:text-zinc-100 text-right">${totalReqs.toLocaleString()}</td>
+        <td class="px-4 py-3 whitespace-nowrap text-right">
+          <span class="text-sm font-medium ${hitRateColor}">${hitRate}%</span>
+        </td>
+        <td class="px-4 py-3 whitespace-nowrap text-sm text-zinc-600 dark:text-zinc-400 text-right">${entry.hits.toLocaleString()}</td>
+        <td class="px-4 py-3 whitespace-nowrap text-sm text-zinc-600 dark:text-zinc-400 text-right">${entry.misses.toLocaleString()}</td>
+        <td class="px-4 py-3 whitespace-nowrap text-sm text-zinc-500 dark:text-zinc-500 text-right">${entry.staleServes > 0 ? entry.staleServes.toLocaleString() : "\u2014"}</td>
+        <td class="px-4 py-3 whitespace-nowrap text-xs text-zinc-400 dark:text-zinc-500 text-right">${timeAgo}</td>
+      </tr>
+    `;
+  }).join("");
+  return `
+    ${statCards}
+
+    <div class="overflow-hidden rounded-xl bg-white dark:bg-zinc-900 ring-1 ring-zinc-950/5 dark:ring-white/10">
+      <div class="px-6 py-4 border-b border-zinc-950/5 dark:border-white/10 flex items-center justify-between">
+        <div>
+          <h2 class="text-lg font-semibold text-zinc-950 dark:text-white">
+            Cache-Eligible API URLs${swrBadge}
+          </h2>
+          <p class="mt-1 text-sm text-zinc-500 dark:text-zinc-400">
+            Ranked by total requests. Resets on isolate eviction. Scoped to public/privileged (non-ACL) requests only.
+          </p>
+        </div>
+        <button
+          onclick="clearUrlCatalog()"
+          class="inline-flex items-center gap-2 rounded-lg bg-white dark:bg-zinc-900 px-3 py-1.5 text-sm font-medium text-zinc-700 dark:text-zinc-300 ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10 hover:bg-zinc-50 dark:hover:bg-zinc-800"
+        >
+          Clear
+        </button>
+      </div>
+      <div class="overflow-x-auto">
+        <table class="min-w-full divide-y divide-zinc-950/5 dark:divide-white/10">
+          <thead class="bg-zinc-50 dark:bg-zinc-800/50">
+            <tr>
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">URL</th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">Collection</th>
+              <th class="px-4 py-3 text-right text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">Requests</th>
+              <th class="px-4 py-3 text-right text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">Hit Rate</th>
+              <th class="px-4 py-3 text-right text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">Hits</th>
+              <th class="px-4 py-3 text-right text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">Misses</th>
+              <th class="px-4 py-3 text-right text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">Stale</th>
+              <th class="px-4 py-3 text-right text-xs font-medium text-zinc-500 dark:text-zinc-400 uppercase tracking-wider">Last Seen</th>
+            </tr>
+          </thead>
+          <tbody class="divide-y divide-zinc-950/5 dark:divide-white/10">
+            ${rows}
+          </tbody>
+        </table>
+      </div>
+    </div>
+
+    <div class="overflow-hidden rounded-xl bg-white dark:bg-zinc-900 ring-1 ring-zinc-950/5 dark:ring-white/10">
+      <div class="px-6 py-5">
+        <h3 class="text-sm font-semibold text-zinc-950 dark:text-white mb-2">About this catalog</h3>
+        <ul class="text-sm text-zinc-600 dark:text-zinc-400 space-y-1 list-disc list-inside">
+          <li><strong>Phase 1 (done):</strong> Collection-scoped cache invalidation \u2014 content changes only purge the affected collection's keys.</li>
+          <li><strong>Phase 2 (this view):</strong> URL catalog tracks every cache-eligible API request. Use to identify hot URLs for targeted pre-warming.</li>
+          <li><strong>Phase 3 (SWR):</strong> Stale-While-Revalidate \u2014 on invalidation, the previous response is kept for 30 s so the first post-edit request is served from cache instantly. Stale serves are counted above.</li>
+          <li>Catalog is per-isolate and resets on cold start. For persistent tracking, sink data to Analytics Engine.</li>
+        </ul>
+      </div>
+    </div>
+  `;
+}
+function renderMiniStatCard(label, value, color) {
+  const colorClasses = {
+    sky: "bg-sky-50 dark:bg-sky-500/10 text-sky-600 dark:text-sky-400",
+    lime: "bg-lime-50 dark:bg-lime-500/10 text-lime-600 dark:text-lime-400",
+    amber: "bg-amber-50 dark:bg-amber-500/10 text-amber-600 dark:text-amber-400",
+    purple: "bg-purple-50 dark:bg-purple-500/10 text-purple-600 dark:text-purple-400"
+  };
+  return `
+    <div class="overflow-hidden rounded-xl bg-white dark:bg-zinc-900 ring-1 ring-zinc-950/5 dark:ring-white/10 p-4">
+      <p class="text-xs text-zinc-500 dark:text-zinc-400">${label}</p>
+      <p class="mt-1 text-xl font-semibold ${colorClasses[color] ?? colorClasses.sky}">${value}</p>
+    </div>
+  `;
+}
+function formatTimeAgo(ts) {
+  const secs = Math.floor((Date.now() - ts) / 1e3);
+  if (secs < 60) return `${secs}s ago`;
+  if (secs < 3600) return `${Math.floor(secs / 60)}m ago`;
+  return `${Math.floor(secs / 3600)}h ago`;
+}
 function renderCollectionSettingsTab(collections) {
   if (collections.length === 0) {
     return `
@@ -17647,6 +17831,9 @@ app.get("/", async (c) => {
       ttlSource: hasCustomTtl ? "collection" : "default"
     };
   });
+  await loadKvCatalog();
+  const catalogEntries = getCatalog({ limit: 100 });
+  const catalogSummary = getCatalogStats();
   const dashboardData = {
     stats,
     totals: {
@@ -17659,6 +17846,11 @@ app.get("/", async (c) => {
     },
     namespaces: Object.keys(stats),
     collections,
+    catalog: {
+      entries: catalogEntries,
+      stats: catalogSummary,
+      swrPending: swrStats().count
+    },
     user: user ? {
       name: user.email,
       email: user.email,
@@ -18005,6 +18197,24 @@ app.post("/warm/:namespace", async (c) => {
     }, 500);
   }
 });
+app.get("/catalog", async (c) => {
+  const collection = c.req.query("collection") || void 0;
+  const sortBy = c.req.query("sort") || "requests";
+  const limit = parseInt(c.req.query("limit") || "100");
+  await loadKvCatalog();
+  const entries = getCatalog({ collection, sortBy, limit });
+  const stats = getCatalogStats();
+  return c.json({
+    success: true,
+    data: { entries, stats, swrPending: swrStats().count },
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  });
+});
+app.post("/catalog/clear", async (_c) => {
+  clearCatalog();
+  await clearKvCatalog();
+  return _c.json({ success: true, message: "URL catalog cleared", timestamp: (/* @__PURE__ */ new Date()).toISOString() });
+});
 var routes_default2 = app;
 
 // src/plugins/cache/index.ts
@@ -18250,7 +18460,7 @@ function createSonicJSApp(config = {}) {
     await next();
   });
   app2.use("*", metricsMiddleware());
-  app2.use("*", bootstrapMiddleware(config));
+  app2.use("*", bootstrapMiddleware(config, [...corePluginsBeforeCatchAll, ...corePluginsAfterCatchAll, ...config.plugins?.register ?? []]));
   const boot = async (env) => {
     if (config.plugins?.disableAll) return;
     firstRequestEnv = env;
@@ -18282,10 +18492,19 @@ function createSonicJSApp(config = {}) {
       const allowed = c.env?.CORS_ORIGINS;
       if (!allowed) return null;
       const list = allowed.split(",").map((s) => s.trim());
-      return list.includes(origin) ? origin : null;
+      const match = list.some((pattern) => {
+        if (pattern === origin) return true;
+        if (pattern.startsWith("*.")) {
+          const suffix = pattern.slice(1);
+          return origin.endsWith(suffix);
+        }
+        return false;
+      });
+      return match ? origin : null;
     },
     allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
-    allowHeaders: ["Content-Type", "Authorization", "X-API-Key"],
+    allowHeaders: ["Content-Type", "Authorization", "X-API-Key", "Cache-Control"],
+    exposeHeaders: ["X-Cache-Status", "X-Cache-Source", "X-Cache-TTL", "X-Response-Time"],
     credentials: true
   }));
   app2.use("*", securityHeadersMiddleware());
@@ -18322,6 +18541,29 @@ function createSonicJSApp(config = {}) {
     await next();
   });
   app2.use("*", apiKeyAuthMiddleware());
+  app2.use("*", async (c, next) => {
+    if (!c.get("user")) {
+      const authHeader = c.req.header("Authorization");
+      if (authHeader?.startsWith("Bearer ") && !authHeader.startsWith("Bearer sk_")) {
+        const token = authHeader.slice(7);
+        try {
+          const secret = c.env?.JWT_SECRET;
+          const payload = await AuthManager.verifyToken(token, secret);
+          if (payload) {
+            c.set("user", {
+              userId: payload.userId,
+              email: payload.email,
+              role: payload.role,
+              exp: payload.exp,
+              iat: payload.iat
+            });
+          }
+        } catch {
+        }
+      }
+    }
+    await next();
+  });
   if (config.middleware?.afterAuth) {
     for (const middleware of config.middleware.afterAuth) {
       app2.use("*", middleware);
@@ -18347,7 +18589,7 @@ function createSonicJSApp(config = {}) {
     if (!user?.userId) return next();
     let perms = [];
     try {
-      const { RbacService: RbacService2 } = await import('./rbac-Y43IEQOP.js');
+      const { RbacService: RbacService2 } = await import('./rbac-XSNP76CV.js');
       perms = await new RbacService2(c.env.DB, c.env.CACHE_KV).permissionsForUser(user.userId);
     } catch {
       return next();
@@ -18424,7 +18666,7 @@ function createSonicJSApp(config = {}) {
     const userPlugins = (config.plugins?.register ?? []).filter(
       (p) => !PLUGIN_REGISTRY[p.id]
     );
-    setPluginMenu(userPlugins.flatMap((p) => p.menu ?? []));
+    setPluginMenu(userPlugins.flatMap((p) => (p.menu ?? []).map((m) => ({ ...m, pluginId: p.id }))));
     setPluginDefinitions(allMountedPlugins);
   }
   app2.get("/favicon.svg", (c) => {
@@ -21961,6 +22203,69 @@ function createRedirectPlugin() {
   return redirectPlugin;
 }
 
+// src/plugins/core-plugins/demo-login/index.ts
+var demoLoginJs = `
+  // Demo Login Prefill Script
+  (function() {
+    'use strict';
+
+    function prefillLoginForm() {
+      const emailInput = document.getElementById('email');
+      const passwordInput = document.getElementById('password');
+
+      if (emailInput && passwordInput) {
+        emailInput.value = 'admin@sonicjs.com';
+        passwordInput.value = 'sonicjs!';
+
+        const form = emailInput.closest('form');
+        if (form) {
+          const notice = document.createElement('div');
+          notice.className = 'mb-4 p-3 bg-blue-50 border border-blue-200 rounded-lg text-blue-800 text-sm';
+          notice.innerHTML = '\u{1F3AF} <strong>Demo Mode:</strong> Login form prefilled with demo credentials';
+          form.insertBefore(notice, form.firstChild);
+        }
+      }
+    }
+
+    if (document.readyState === 'loading') {
+      document.addEventListener('DOMContentLoaded', prefillLoginForm);
+    } else {
+      prefillLoginForm();
+    }
+
+    document.addEventListener('htmx:afterSwap', function(event) {
+      if (event.detail.target.id === 'main-content' ||
+          document.getElementById('email')) {
+        setTimeout(prefillLoginForm, 100);
+      }
+    });
+  })();
+`;
+var loginPrefillHandler = async (data) => {
+  if (data.pageType === "auth-login" || data.template?.includes("login")) {
+    data.scripts = data.scripts ?? [];
+    data.inlineScripts = data.inlineScripts ?? [];
+    data.inlineScripts.push(demoLoginJs);
+  }
+  return data;
+};
+var demoLoginPlugin = definePlugin({
+  id: "demo-login-plugin",
+  version: "1.0.0",
+  name: "Demo Login",
+  description: "Prefills login form with demo credentials (admin@sonicjs.com/sonicjs!) for easy site demonstration.",
+  sonicjsVersionRange: "^3.0.0",
+  author: { name: "SonicJS" },
+  async onBoot(ctx) {
+    setDemoModeActive();
+    const hooks = ctx.raw?.hooks;
+    if (hooks?.register) {
+      hooks.register("template:render", loginPrefillHandler);
+      hooks.register("page:before-render", loginPrefillHandler);
+    }
+  }
+});
+
 // src/collections/site-settings.collection.ts
 var site_settings_collection_default = {
   name: "site_settings",
@@ -22882,6 +23187,6 @@ function createMcpPlugin(options) {
 // src/index.ts
 var VERSION = package_default.version;
 
-export { BUILT_IN_PROVIDERS, CloudflareEmailProvider2 as CloudflareEmailProvider, OAuthService, VERSION, createDb, createHelloWorldPlugin, createMcpPlugin, createOAuthProvidersPlugin, createRedirectPlugin, createSonicJSApp, emailReconciliationPlugin, generateTriggersComment, helloWorldPlugin, mcpPlugin, oauthProvidersPlugin, parseCronTriggers, redirectPlugin, setupCoreMiddleware, setupCoreRoutes, site_settings_collection_default as siteSettingsCollection, updateWranglerTriggers };
+export { BUILT_IN_PROVIDERS, CloudflareEmailProvider2 as CloudflareEmailProvider, OAuthService, VERSION, createDb, createHelloWorldPlugin, createMcpPlugin, createOAuthProvidersPlugin, createRedirectPlugin, createSonicJSApp, demoLoginPlugin, emailReconciliationPlugin, generateTriggersComment, helloWorldPlugin, mcpPlugin, oauthProvidersPlugin, parseCronTriggers, redirectPlugin, setupCoreMiddleware, setupCoreRoutes, site_settings_collection_default as siteSettingsCollection, updateWranglerTriggers };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map