opacacms 0.1.21 → 0.2.0

package/dist/{chunk-xrfhhz85.js → chunk-kc4jfnv7.js}

@@ -1,27 +1,28 @@
 import {
   createAuth,
   sanitizeConfig
-} from "./chunk-mycmsjd9.js";
-import {
-  logger
-} from "./chunk-62ev8gnc.js";
+} from "./chunk-b3kr8w41.js";
 import {
   toSnakeCase
-} from "./chunk-2kyhqvhc.js";
+} from "./chunk-qxt9vge8.js";
 import {
   exports_system_schema,
   getSystemCollections,
   init_system_schema
-} from "./chunk-ybbbqj63.js";
+} from "./chunk-v9z61v3g.js";
+import {
+  OpacaLogger,
+  logger
+} from "./chunk-t0zg026p.js";
 import {
   __require,
   __toCommonJS
 } from "./chunk-8sqjbsgt.js";
 
 // src/server/admin.ts
-function createAdminHandlers(config, getAuth) {
+function createAdminHandlers(config, settings, getAuth) {
   const getMetadata = (c) => {
-    return c.json(sanitizeConfig(config));
+    return c.json(sanitizeConfig(config, settings));
   };
   const getCollections = (c) => {
     const collections = [...config.collections];
@@ -101,19 +102,27 @@ function createAdminHandlers(config, getAuth) {
       return c.json({ message, detail: err }, 400);
     }
   };
+  const getPluginSettings = async (c) => {
+    const name = c.req.param("name");
+    if (!name)
+      return c.json({ error: "Plugin name is required" }, 400);
+    const pluginSettings = settings[name] || {};
+    return c.json(pluginSettings);
+  };
   return {
     getMetadata,
     getCollections,
     getConfig,
     getSetupStatus,
-    createApiKey
+    createApiKey,
+    getPluginSettings
   };
 }
 
 // src/validator.ts
 import { z } from "zod";
-function generateSchemaForCollection(collection, isUpdate = false) {
-  const shape = mapFieldsToShape(collection.fields, isUpdate);
+function generateSchemaForCollection(collection, isUpdate = false, forDocs = false) {
+  const shape = mapFieldsToShape(collection.fields, isUpdate, forDocs);
   if (collection.versions) {
     shape._status = z.enum(["draft", "published"]).optional().nullable();
   }
@@ -122,46 +131,49 @@ function generateSchemaForCollection(collection, isUpdate = false) {
     const config = typeof ts === "object" ? ts : {};
     const createdField = config.createdAt || "createdAt";
     const updatedField = config.updatedAt || "updatedAt";
-    shape[createdField] = z.union([z.string(), z.date()]).optional().nullable();
-    shape[updatedField] = z.union([z.string(), z.date()]).optional().nullable();
+    const dateSchema = forDocs ? z.string() : z.union([z.string(), z.date()]);
+    shape[createdField] = dateSchema.optional().nullable();
+    shape[updatedField] = dateSchema.optional().nullable();
   }
   return z.object(shape);
 }
-function mapFieldsToShape(fields, isUpdate = false) {
+function mapFieldsToShape(fields, isUpdate = false, forDocs = false) {
   const shape = {};
   for (const field of fields) {
+    if (field.type === "virtual" || field.type === "ui")
+      continue;
     if (!field.name) {
       if (field.type === "tabs" && field.tabs) {
         for (const tab of field.tabs) {
-          Object.assign(shape, mapFieldsToShape(tab.fields, isUpdate));
+          Object.assign(shape, mapFieldsToShape(tab.fields, isUpdate, forDocs));
         }
       } else if (field.type === "group" && field.fields) {
-        Object.assign(shape, mapFieldsToShape(field.fields, isUpdate));
+        Object.assign(shape, mapFieldsToShape(field.fields, isUpdate, forDocs));
       } else if (field.type === "row" && field.fields) {
-        Object.assign(shape, mapFieldsToShape(field.fields, isUpdate));
+        Object.assign(shape, mapFieldsToShape(field.fields, isUpdate, forDocs));
       } else if (field.type === "collapsible" && field.fields) {
-        Object.assign(shape, mapFieldsToShape(field.fields, isUpdate));
+        Object.assign(shape, mapFieldsToShape(field.fields, isUpdate, forDocs));
       }
       continue;
     }
     const fieldName = field.name;
     let schema;
     if (field.type === "group" && field.fields) {
-      schema = z.object(mapFieldsToShape(field.fields, isUpdate));
+      schema = z.object(mapFieldsToShape(field.fields, isUpdate, forDocs));
     } else if (field.type === "blocks" && field.blocks) {
       const blockSchemas = field.blocks.map((block) => z.object({
         blockType: z.literal(block.slug),
-        ...mapFieldsToShape(block.fields, isUpdate)
+        ...mapFieldsToShape(block.fields, isUpdate, forDocs)
       }));
       schema = z.array(z.union(blockSchemas));
     } else if (field.type === "row" || field.type === "collapsible") {
       if (field.fields) {
-        schema = z.object(mapFieldsToShape(field.fields, isUpdate));
+        schema = z.object(mapFieldsToShape(field.fields, isUpdate, forDocs));
       } else {
         schema = z.any();
       }
     } else {
-      schema = mapFieldToZod(field);
+      schema = mapFieldToZod(field, forDocs);
     }
     if (field.localized) {
       schema = z.union([z.record(z.string(), schema), schema]);
@@ -177,23 +189,36 @@ function mapFieldsToShape(fields, isUpdate = false) {
       schema = schema.default(field.defaultValue);
     }
     if (field.validate) {
-      schema = schema.superRefine((val, ctx) => {
-        if (val === undefined || val === null)
-          return;
-        const result = field.validate(val);
-        if (result !== true) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: typeof result === "string" ? result : "Invalid field"
-          });
-        }
-      });
+      if (typeof field.validate === "function") {
+        schema = schema.superRefine((val, ctx) => {
+          if (val === undefined || val === null)
+            return;
+          const result = field.validate(val);
+          if (result !== true) {
+            ctx.addIssue({
+              code: z.ZodIssueCode.custom,
+              message: typeof result === "string" ? result : "Invalid field"
+            });
+          }
+        });
+      } else if (typeof field.validate === "object" && field.validate !== null && "safeParse" in field.validate) {
+        schema = schema.superRefine((val, ctx) => {
+          if (val === undefined || val === null)
+            return;
+          const result = field.validate.safeParse(val);
+          if (!result.success) {
+            for (const issue of result.error.issues) {
+              ctx.addIssue(issue);
+            }
+          }
+        });
+      }
     }
     shape[fieldName] = schema;
   }
   return shape;
 }
-function mapFieldToZod(field) {
+function mapFieldToZod(field, forDocs = false) {
   switch (field.type) {
     case "text":
     case "slug":
@@ -202,7 +227,7 @@ function mapFieldToZod(field) {
       return z.string();
     case "relationship": {
       const isHasMany = "hasMany" in field && field.hasMany;
-      const base = z.union([z.string(), z.number(), z.undefined(), z.null()]);
+      const base = forDocs ? z.union([z.string(), z.number(), z.null()]) : z.union([z.string(), z.number(), z.undefined(), z.null()]);
       const schema = isHasMany ? z.array(base.optional().nullable()) : base;
       if (isHasMany) {
         return z.preprocess((val) => {
@@ -215,6 +240,18 @@ function mapFieldToZod(field) {
       }
       return schema;
     }
+    case "file":
+      return z.object({
+        id: z.string(),
+        url: z.string(),
+        filename: z.string(),
+        mime_type: z.string(),
+        filesize: z.number(),
+        width: z.number().optional().nullable(),
+        height: z.number().optional().nullable(),
+        focal_x: z.number().optional().nullable(),
+        focal_y: z.number().optional().nullable()
+      });
     case "number":
       return z.preprocess((val) => {
         if (val === "" || val === undefined || val === null)
@@ -224,14 +261,16 @@ function mapFieldToZod(field) {
           return Number.isNaN(num) ? undefined : num;
         }
         return val;
-      }, z.union([z.number(), z.undefined(), z.null()]));
+      }, z.number().optional().nullable());
     case "boolean":
       return z.preprocess((val) => {
         if (typeof val === "string")
           return val === "true";
         return val;
       }, z.boolean());
-    case "date":
+    case "date": {
+      if (forDocs)
+        return z.string().describe("ISO 8601 Date");
       return z.preprocess((val) => {
         if (val === "" || val === undefined || val === null)
           return;
@@ -242,8 +281,20 @@ function mapFieldToZod(field) {
         z.undefined(),
         z.null()
       ]));
+    }
     case "select":
+    case "radio": {
+      const choices = field.options?.choices;
+      if (choices && Array.isArray(choices)) {
+        const values = choices.map((c) => typeof c === "string" ? c : c.value);
+        if (values.length > 0) {
+          return z.enum(values);
+        }
+      }
       return z.string();
+    }
+    case "json":
+      return z.any();
     case "array":
       return z.preprocess((val) => {
         if (val === undefined || val === null || val === "")
@@ -258,6 +309,7 @@ function mapFieldToZod(field) {
 }
 
 // src/server/handlers.ts
+init_system_schema();
 var hydrateDoc = async (doc, fields, c, config) => {
   if (!doc)
     return doc;
@@ -317,24 +369,119 @@ var hydrateDoc = async (doc, fields, c, config) => {
   await Promise.all(hydratePromises);
   return doc;
 };
-var populateDoc = async (db, fields, doc, populateKeys) => {
-  if (!doc)
-    return doc;
-  const populatePromises = fields.filter((f) => {
-    const field = f;
-    return field.type === "relationship" && field.relationTo && populateKeys.includes(field.name) && doc[field.name];
-  }).map(async (f) => {
-    const field = f;
+function parsePopulate(populate) {
+  if (!populate)
+    return {};
+  if (typeof populate === "object" && !Array.isArray(populate)) {
+    return populate;
+  }
+  if (typeof populate === "string" && (populate.startsWith("{") || populate.startsWith("["))) {
     try {
-      const relatedDoc = await db.findOne(field.relationTo, { id: doc[field.name] });
-      if (relatedDoc) {
-        doc[field.name] = relatedDoc;
+      const parsed = JSON.parse(populate);
+      if (Array.isArray(parsed)) {
+        const result2 = {};
+        for (const item of parsed) {
+          if (typeof item === "string") {
+            Object.assign(result2, parsePopulate(item));
+          }
+        }
+        return result2;
+      }
+      return parsed;
+    } catch {}
+  }
+  const result = {};
+  const keys = typeof populate === "string" ? populate.split(",") : [];
+  for (const key of keys) {
+    const parts = key.trim().split(".");
+    let current = result;
+    for (let i = 0;i < parts.length; i++) {
+      const part = parts[i];
+      if (!part)
+        continue;
+      if (i === parts.length - 1) {
+        current[part] = current[part] || true;
+      } else {
+        if (typeof current[part] !== "object") {
+          current[part] = { populate: {} };
+        } else if (!current[part].populate) {
+          current[part].populate = { ...current[part].populate };
+        }
+        current = current[part].populate;
+      }
+    }
+  }
+  return result;
+}
+var populateDoc = async (db, fields, doc, populate, config) => {
+  if (!doc || !populate || Object.keys(populate).length === 0)
+    return doc;
+  const populatePromises = fields.map(async (field) => {
+    const pValue = populate[field.name];
+    if (field.type === "relationship" && field.relationTo && pValue) {
+      const relationTo = field.relationTo;
+      const nestedPopulate = typeof pValue === "object" ? pValue.populate : undefined;
+      const fetchAndPopulate = async (id) => {
+        if (!id)
+          return id;
+        try {
+          const systemCollections = getSystemCollections();
+          const allCollections = [...config.collections, ...systemCollections];
+          const relatedCollection = allCollections.find((c) => c.slug === relationTo || c.apiPath === relationTo);
+          const targetSlug = relatedCollection ? relatedCollection.slug : relationTo;
+          let relatedDoc = await db.findOne(targetSlug, { id });
+          if (relatedDoc && nestedPopulate && relatedCollection) {
+            relatedDoc = await populateDoc(db, relatedCollection.fields, relatedDoc, nestedPopulate, config);
+          }
+          return relatedDoc || id;
+        } catch (err) {
+          console.error(`[OpacaCMS] Failed to populate relationship ${field.name}`, err);
+          return id;
+        }
+      };
+      if (field.hasMany && Array.isArray(doc[field.name])) {
+        doc[field.name] = await Promise.all(doc[field.name].map(fetchAndPopulate));
+      } else if (doc[field.name]) {
+        doc[field.name] = await fetchAndPopulate(doc[field.name]);
+      }
+    }
+    if (field.type === "group" && field.fields && doc[field.name]) {
+      if (typeof pValue === "object" && pValue.populate) {
+        await populateDoc(db, field.fields, doc[field.name], pValue.populate, config);
+      }
+    }
+    if (field.type === "array" && field.fields && Array.isArray(doc[field.name])) {
+      if (typeof pValue === "object" && pValue.populate) {
+        await Promise.all(doc[field.name].map((item) => populateDoc(db, field.fields, item, pValue.populate, config)));
+      }
+    }
+    if (field.type === "blocks" && field.blocks && Array.isArray(doc[field.name])) {
+      if (typeof pValue === "object" && pValue.populate) {
+        await Promise.all(doc[field.name].map((item) => {
+          const block = field.blocks.find((b) => b.slug === item.block_type);
+          if (block && block.fields) {
+            return populateDoc(db, block.fields, item, pValue.populate, config);
+          }
+          return Promise.resolve();
+        }));
       }
-    } catch (err) {
-      console.error(`[OpacaCMS] Failed to populate relationship ${field.name} `, err);
     }
   });
   await Promise.all(populatePromises);
+  const pKeys = Object.keys(populate);
+  const hasSelection = pKeys.some((k) => {
+    const field = fields.find((f) => f.name === k);
+    return field && !["relationship", "group", "array", "blocks"].includes(field.type);
+  });
+  if (hasSelection) {
+    const filtered = {};
+    for (const key of pKeys) {
+      if (populate[key]) {
+        filtered[key] = doc[key];
+      }
+    }
+    return filtered;
+  }
   return doc;
 };
 function createHandlers(config, collection, getAuth) {
@@ -415,7 +562,7 @@ function createHandlers(config, collection, getAuth) {
   const saveVersion = async (doc, status) => {
     if (!collection.versions)
       return;
-    const versionsTable = `${collection.slug}_versions`.toLowerCase();
+    const versionsTable = `${toSnakeCase(collection.slug)}_versions`;
     const versionDoc = {
       id: crypto.randomUUID(),
       _parent_id: doc.id,
@@ -447,7 +594,7 @@ function createHandlers(config, collection, getAuth) {
       if (limit > maxLimit)
         limit = maxLimit;
       const sort = queries.sort;
-      const populate = queries.populate ? queries.populate.split(",") : [];
+      const populate = parsePopulate(queries.populate);
       const filter = {};
       for (const [key, value] of Object.entries(queries)) {
         if (["page", "limit", "sort", "populate", "locale", "draft"].includes(key))
@@ -464,8 +611,8 @@ function createHandlers(config, collection, getAuth) {
         }
       }
       const results = await db.find(collection.slug, filter, { page, limit, sort });
-      if (populate.length > 0) {
-        results.docs = await Promise.all(results.docs.map((doc) => populateDoc(db, collection.fields, doc, populate)));
+      if (Object.keys(populate).length > 0) {
+        results.docs = await Promise.all(results.docs.map((doc) => populateDoc(db, collection.fields, doc, populate, config)));
       }
       results.docs = await Promise.all(results.docs.map((doc) => hydrateDoc(doc, collection.fields, c, config)));
       return c.json(results);
@@ -475,13 +622,13 @@ function createHandlers(config, collection, getAuth) {
         return c.json({ message: "Forbidden" }, 403);
       }
       const queries = c.req.query();
-      const populate = queries.populate ? queries.populate.split(",") : [];
+      const populate = parsePopulate(queries.populate);
       const id = c.req.param("id");
       let doc = await db.findOne(collection.slug, { id });
       if (!doc)
         return c.json({ message: "Not found" }, 404);
-      if (populate.length > 0) {
-        doc = await populateDoc(db, collection.fields, doc, populate);
+      if (Object.keys(populate).length > 0) {
+        doc = await populateDoc(db, collection.fields, doc, populate, config);
       }
       doc = await hydrateDoc(doc, collection.fields, c, config);
       const permissions = await getFieldAccessPermissions(c, "read", collection.fields, doc);
@@ -645,7 +792,7 @@ function createHandlers(config, collection, getAuth) {
         return c.json({ message: "Forbidden" }, 403);
       }
       const parentId = c.req.query("parentId");
-      const versionsTable = `${collection.slug} _versions`.toLowerCase();
+      const versionsTable = `${toSnakeCase(collection.slug)}_versions`;
       const query = parentId ? `SELECT * FROM ${versionsTable} WHERE _parent_id = ? ORDER BY created_at DESC` : `SELECT * FROM ${versionsTable} ORDER BY created_at DESC`;
       const params = parentId ? [parentId] : [];
       try {
@@ -660,7 +807,7 @@ function createHandlers(config, collection, getAuth) {
         return c.json({ message: "Forbidden" }, 403);
       }
       const versionId = c.req.param("versionId");
-      const versionsTable = `${collection.slug} _versions`.toLowerCase();
+      const versionsTable = `${toSnakeCase(collection.slug)}_versions`;
       try {
         const versionRows = await db.unsafe(`SELECT * FROM ${versionsTable} WHERE id = ? `, [versionId]);
         if (versionRows.length === 0)
@@ -744,29 +891,43 @@ import { Hono } from "hono";
 // src/server/middlewares/admin.ts
 var adminMiddleware = async (c, next) => {
   const user = c.get("user");
-  const isPublicAdmin = c.req.path.endsWith("/__admin/metadata") || c.req.path.endsWith("/__admin/setup");
-  if (!user && !isPublicAdmin) {
-    return c.json({ message: "Unauthorized" }, 401);
-  }
-  if (isPublicAdmin) {
+  const config = c.get("config");
+  const isDevelopment = true;
+  const path = c.req.path;
+  const isMetadata = path.endsWith("/__admin/metadata");
+  const isSetup = path.endsWith("/__admin/setup");
+  const secretHeader = c.req.header("X-Opaca-Secret");
+  const isSecretValid = config?.secret && secretHeader && secretHeader === config.secret;
+  if (isSetup) {
     await next();
     return;
   }
-  if (user.role === "admin" || user.role?.includes("admin")) {
-    await next();
-    return;
+  if (isMetadata) {
+    if (isDevelopment || isSecretValid) {
+      await next();
+      return;
+    }
+  }
+  if (user) {
+    const isAdmin = user.role === "admin" || user.role?.includes("admin");
+    if (isAdmin) {
+      await next();
+      return;
+    }
+    return c.json({ message: "Forbidden" }, 403);
   }
-  return c.json({ message: "Forbidden" }, 403);
+  return c.json({ message: "Unauthorized" }, 401);
 };
 
 // src/server/routers/admin.ts
-function createAdminRouter(config, state) {
+function createAdminRouter(config, settings, state) {
   const adminRouter = new Hono;
-  const adminHandlers = createAdminHandlers(config, () => state.auth);
+  const adminHandlers = createAdminHandlers(config, settings, () => state.auth);
   adminRouter.get("/collections", adminMiddleware, adminHandlers.getCollections);
-  adminRouter.get("/metadata", adminHandlers.getMetadata);
+  adminRouter.get("/metadata", adminMiddleware, adminHandlers.getMetadata);
   adminRouter.get("/config", adminMiddleware, adminHandlers.getConfig);
   adminRouter.get("/setup", adminHandlers.getSetupStatus);
+  adminRouter.get("/plugin-settings/:name", adminMiddleware, adminHandlers.getPluginSettings);
   adminRouter.post("/api-key/create", adminMiddleware, adminHandlers.createApiKey);
   return adminRouter;
 }
@@ -917,14 +1078,11 @@ function createAssetsHandlers(config) {
         const rows = result.docs;
         const total = result.totalDocs;
         let folderRows = [];
-        const bucketFilter = bucket !== "all" ? `AND bucket = ?` : "";
-        const bucketParam = bucket !== "all" ? [bucket] : [];
         if (config.db.name === "postgres") {
-          const pgBucketFilter = bucketFilter.replace("?", "$1");
           if (folder === null || folder === "") {
-            folderRows = await config.db.unsafe(`SELECT DISTINCT split_part(folder, '/', 1) as subfolder, bucket FROM _opaca_assets WHERE folder IS NOT NULL AND folder != '' ${pgBucketFilter}`, bucketParam);
+            folderRows = await config.db.unsafe("SELECT DISTINCT split_part(folder, '/', 1) as subfolder, bucket FROM _opaca_assets WHERE folder IS NOT NULL AND folder != '' AND (bucket = $1 OR $1 = 'all')", [bucket]);
           } else {
-            folderRows = await config.db.unsafe(`SELECT DISTINCT split_part(substring(folder from length($1) + 2), '/', 1) as subfolder, bucket FROM _opaca_assets WHERE folder LIKE $2 ${bucket !== "all" ? "AND bucket = $3" : ""}`, [folder, `${folder}/%`, ...bucketParam]);
+            folderRows = await config.db.unsafe("SELECT DISTINCT split_part(substring(folder from length($1) + 2), '/', 1) as subfolder, bucket FROM _opaca_assets WHERE folder LIKE $2 AND (bucket = $3 OR $3 = 'all')", [folder, `${folder}/%`, bucket]);
           }
         } else {
           if (folder === null || folder === "") {
@@ -935,8 +1093,8 @@ function createAssetsHandlers(config) {
                   ELSE folder 
                 END as subfolder,
                 bucket
-              FROM _opaca_assets WHERE folder IS NOT NULL AND folder != '' ${bucketFilter}
-            `, bucketParam);
+              FROM _opaca_assets WHERE folder IS NOT NULL AND folder != '' AND (bucket = ? OR ? = 'all')
+            `, [bucket, bucket]);
           } else {
             const skipLen = folder.length + 2;
             folderRows = await config.db.unsafe(`
@@ -946,8 +1104,8 @@ function createAssetsHandlers(config) {
                   ELSE SUBSTR(folder, ?)
                 END as subfolder,
                 bucket
-              FROM _opaca_assets WHERE folder LIKE ? ${bucketFilter}
-            `, [skipLen, skipLen, skipLen, skipLen, `${folder}/%`, ...bucketParam]);
+              FROM _opaca_assets WHERE folder LIKE ? AND (bucket = ? OR ? = 'all')
+            `, [skipLen, skipLen, skipLen, skipLen, `${folder}/%`, bucket, bucket]);
           }
         }
         const folderMap = {};
@@ -1057,6 +1215,28 @@ function mountGlobalRoutes(router, config, state) {
 }
 function createSystemRouter(config) {
   const systemRouter = new Hono3;
+  systemRouter.get("/plugins/assets", adminMiddleware, (c) => {
+    const response = {
+      scripts: [],
+      styles: []
+    };
+    if (config.plugins && Array.isArray(config.plugins)) {
+      for (const plugin of config.plugins) {
+        if (plugin.adminAssets) {
+          try {
+            const assets = plugin.adminAssets();
+            if (assets.scripts)
+              response.scripts.push(...assets.scripts);
+            if (assets.styles)
+              response.styles.push(...assets.styles);
+          } catch (e) {
+            console.error(`[Plugin] ${plugin.name} failed to expose adminAssets: `, e);
+          }
+        }
+      }
+    }
+    return c.json(response);
+  });
   if (config.storages) {
     const assetsHandlers = createAssetsHandlers(config);
     systemRouter.post("/assets/upload", adminMiddleware, assetsHandlers.upload);
@@ -1115,7 +1295,7 @@ function createAuthMiddleware(getAuth) {
               const ownerResult = await auth.options.database?.findOne?.("_users", {
                 id: result.key.referenceId
               });
-              c.set("user", ownerResult || null);
+              c.set("user", ownerResult);
             } catch (e) {
               logger.warn("Failed to fetch API key owner from database:", e);
               c.set("user", null);
@@ -1138,9 +1318,11 @@ function createAuthMiddleware(getAuth) {
 
 // src/server/middlewares/context.ts
 function createContextMiddleware(config) {
+  const logger2 = new OpacaLogger(config.logger);
   return async (c, next) => {
     c.set("config", config);
     c.set("db", config.db);
+    c.set("logger", logger2);
     await next();
   };
 }
@@ -1329,7 +1511,8 @@ function setupMiddlewares(router, config, state) {
   router.use("*", createCorsMiddleware(config));
   router.use("*", createDatabaseInitMiddleware(config, state));
   router.onError((err, c) => {
-    logger.error(`API Error: ${err.message}`, err);
+    const ctxLogger = c.get("logger");
+    ctxLogger.error(`API Error: ${err.message}`, err);
     return c.json({ message: "Internal Server Error", error: err.message }, 500);
   });
 }
@@ -1337,8 +1520,196 @@ function setupAuthMiddlewares(router, config, state) {
   router.use("*", createAuthMiddleware(() => state.auth));
 }
 
+// src/server/openapi.ts
+import { z as z2 } from "zod";
+import { zodToJsonSchema } from "zod-to-json-schema";
+function generateOpenAPISchema(config) {
+  const openapi = {
+    openapi: "3.1.0",
+    info: {
+      title: config.appName || "OpacaCMS API",
+      version: "1.0.0",
+      description: "Automatically generated OpenAPI schema for OpacaCMS Collections and Globals."
+    },
+    paths: {},
+    components: {
+      schemas: {},
+      securitySchemes: {
+        bearerAuth: {
+          type: "http",
+          scheme: "bearer"
+        }
+      }
+    }
+  };
+  for (const collection of config.collections || []) {
+    const isHidden = collection.hidden === true;
+    if (isHidden)
+      continue;
+    const pathBase = `/api/${collection.apiPath || collection.slug}`;
+    const tag = collection.label || collection.slug;
+    const zodSchema = generateSchemaForCollection(collection, false, true);
+    const schemaName = collection.slug.charAt(0).toUpperCase() + collection.slug.slice(1);
+    const jsonSchema = typeof z2.toJSONSchema === "function" ? z2.toJSONSchema(zodSchema, { target: "openapi-3.0" }) : zodToJsonSchema(zodSchema, { target: "openApi3" });
+    openapi.components.schemas[schemaName] = jsonSchema;
+    const ref = `#/components/schemas/${schemaName}`;
+    openapi.paths[pathBase] = {
+      get: {
+        tags: [tag],
+        summary: `Find ${tag}`,
+        parameters: [
+          { name: "limit", in: "query", schema: { type: "integer" } },
+          { name: "page", in: "query", schema: { type: "integer" } }
+        ],
+        responses: {
+          "200": {
+            description: "Successful response",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    docs: { type: "array", items: { $ref: ref } },
+                    totalDocs: { type: "integer" }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      post: {
+        tags: [tag],
+        summary: `Create ${tag}`,
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": { schema: { $ref: ref } }
+          }
+        },
+        responses: {
+          "201": {
+            description: "Created successfully",
+            content: { "application/json": { schema: { $ref: ref } } }
+          }
+        }
+      }
+    };
+    openapi.paths[`${pathBase}/{id}`] = {
+      get: {
+        tags: [tag],
+        summary: `Find ${tag} by ID`,
+        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+        responses: {
+          "200": {
+            description: "Successful response",
+            content: { "application/json": { schema: { $ref: ref } } }
+          },
+          "404": { description: "Not found" }
+        }
+      },
+      patch: {
+        tags: [tag],
+        summary: `Update ${tag}`,
+        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+        requestBody: {
+          content: { "application/json": { schema: { $ref: ref } } }
+        },
+        responses: {
+          "200": {
+            description: "Updated successfully",
+            content: { "application/json": { schema: { $ref: ref } } }
+          }
+        }
+      },
+      delete: {
+        tags: [tag],
+        summary: `Delete ${tag}`,
+        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+        responses: {
+          "200": { description: "Deleted successfully" }
+        }
+      }
+    };
+  }
+  for (const global of config.globals || []) {
+    const pathBase = `/api/globals/${global.slug}`;
+    const tag = global.label || global.slug;
+    const zodSchema = generateSchemaForCollection(global, false, true);
+    const schemaName = global.slug.charAt(0).toUpperCase() + global.slug.slice(1);
+    const jsonSchema = typeof z2.toJSONSchema === "function" ? z2.toJSONSchema(zodSchema, { target: "openapi-3.0" }) : zodToJsonSchema(zodSchema, { target: "openApi3" });
+    openapi.components.schemas[schemaName] = jsonSchema;
+    const ref = `#/components/schemas/${schemaName}`;
+    openapi.paths[pathBase] = {
+      get: {
+        tags: [tag],
+        summary: `Find ${tag}`,
+        responses: {
+          "200": {
+            description: "Successful response",
+            content: { "application/json": { schema: { $ref: ref } } }
+          }
+        }
+      },
+      post: {
+        tags: [tag],
+        summary: `Update ${tag}`,
+        requestBody: {
+          content: { "application/json": { schema: { $ref: ref } } }
+        },
+        responses: {
+          "200": {
+            description: "Updated successfully",
+            content: { "application/json": { schema: { $ref: ref } } }
+          }
+        }
+      }
+    };
+  }
+  return openapi;
+}
+
 // src/server/router.ts
-function createAPIRouter(config) {
+import { Scalar } from "@scalar/hono-api-reference";
+
+// src/server/routers/plugins.ts
+function mountPluginRoutes(config, settings, logger2, router) {
+  if (config.plugins && Array.isArray(config.plugins)) {
+    for (const plugin of config.plugins) {
+      const pluginSettings = settings[plugin.name] || {};
+      const pluginContext = { config, logger: logger2, settings: pluginSettings };
+      if (plugin.onRequest) {
+        router.use("*", async (c, next) => {
+          const result = await plugin.onRequest(c);
+          if (result === false) {
+            return c.json({ error: "Blocked by plugin: " + plugin.name }, 403);
+          }
+          await next();
+        });
+      }
+      if (plugin.onRouterInit) {
+        try {
+          plugin.onRouterInit(router, pluginContext);
+        } catch (e) {
+          logger2.error(`[Plugin] ${plugin.name} failed during onRouterInit: `, e);
+        }
+      }
+    }
+  }
+}
+function firePluginInitComplete(config, settings, logger2) {
+  if (config.plugins && Array.isArray(config.plugins)) {
+    for (const plugin of config.plugins) {
+      if (plugin.onInitComplete) {
+        const pluginSettings = settings[plugin.name] || {};
+        plugin.onInitComplete({ config, logger: logger2, settings: pluginSettings });
+      }
+    }
+  }
+}
+
+// src/server/router.ts
+function createAPIRouter(config, settings = {}) {
   const state = { auth: undefined, migrated: false };
   const router = new Hono4().basePath("/api");
   setupMiddlewares(router, config, state);
@@ -1347,12 +1718,36 @@ function createAPIRouter(config) {
     return c.json({ status: "ok", version: "1.0.0", appName: config.appName });
   });
   router.route("/auth", createAuthRouter(config, state));
-  router.route("/__admin", createAdminRouter(config, state));
+  router.route("/__admin", createAdminRouter(config, settings, state));
   router.route("/__system", createSystemRouter(config));
   router.route("/", createAssetsServingRouter(config));
+  mountPluginRoutes(config, settings, logger, router);
   mountCollectionRoutes(router, config, state);
   mountGlobalRoutes(router, config, state);
+  if (config.api?.openAPI?.enabled) {
+    router.get("/open-api.json", (c) => {
+      const schema = generateOpenAPISchema(config);
+      return c.json(schema);
+    });
+    const referencePath = config.api.openAPI.path || "/reference";
+    const safeRefPath = referencePath.startsWith("/") ? referencePath : `/${referencePath}`;
+    router.get(safeRefPath, Scalar({
+      pageTitle: `${config.appName || "OpacaCMS"} API Documentation`,
+      theme: config.api.openAPI.theme || "default",
+      layout: config.api.openAPI.layout === "classic" ? "classic" : "modern",
+      hideModels: config.api.openAPI.hideModels,
+      hideDownloadButton: config.api.openAPI.hideDownloadButton,
+      customCss: config.api.openAPI.customCss,
+      ...{
+        sources: [
+          { url: "/api/open-api.json", title: "CMS Collections" },
+          { url: "/api/auth/open-api/generate-schema", title: "Auth APIs" }
+        ]
+      }
+    }));
+  }
+  firePluginInitComplete(config, settings, logger);
   return router;
 }
 
-export { createAdminHandlers, hydrateDoc, createHandlers, createGlobalHandlers, createAPIRouter };
+export { createAdminHandlers, hydrateDoc, parsePopulate, populateDoc, createHandlers, createGlobalHandlers, createAPIRouter };