@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.64

package/dist/swagger.json

@@ -267,7 +267,7 @@
                         ],
                         "description": "Comma-separated allow-list of post-logout redirect patterns (OIDC\nRP-Initiated Logout `post_logout_redirect_uri`). Matched with the same\nwildcard semantics as `redirectUri`."
                     },
-                    "grantTypes": {
+                    "backchannelLogoutUri": {
                         "anyOf": [
                             {
                                 "type": "string"
@@ -275,9 +275,10 @@
                             {
                                 "type": "null"
                             }
-                        ]
+                        ],
+                        "description": "OIDC Back-Channel Logout 1.0 endpoint: one absolute http(s) URL, no\npatterns. Null means no logout token is pushed to this client."
                     },
-                    "scope": {
+                    "grantTypes": {
                         "anyOf": [
                             {
                                 "type": "string"
@@ -296,18 +297,7 @@
                                 "type": "null"
                             }
                         ],
-                        "description": "Default redirect URL."
-                    },
-                    "rootUrl": {
-                        "anyOf": [
-                            {
-                                "type": "string"
-                            },
-                            {
-                                "type": "null"
-                            }
-                        ],
-                        "description": "URL prepended to relative URLs."
+                        "description": "The application's home URL, rendered as a link on the account\nconsole's Applications page. http(s)-only is enforced at render time."
                     },
                     "createdAt": {
                         "type": "string"
@@ -356,10 +346,9 @@
                     "secretEncrypted",
                     "redirectUri",
                     "postLogoutRedirectUri",
+                    "backchannelLogoutUri",
                     "grantTypes",
-                    "scope",
                     "baseUrl",
-                    "rootUrl",
                     "createdAt",
                     "updatedAt",
                     "realmId",
@@ -663,6 +652,10 @@
                 "properties": {},
                 "type": "object"
             },
+            "URLAlias": {
+                "type": "string",
+                "description": "The **`URL`** interface is used to parse, construct, normalize, and encode URLs. It works by providing properties which allow you to easily read and modify the components of a URL.\n\n[MDN Reference](https://developer.mozilla.org/docs/Web/API/URL)"
+            },
             "SocketReadyState": {
                 "type": "string",
                 "enum": [
@@ -806,7 +799,7 @@
                 "description": "Server instance returned by `Bun.serve()` (`Bun.Server`).",
                 "properties": {
                     "url": {
-                        "additionalProperties": true
+                        "$ref": "#/components/schemas/URLAlias"
                     },
                     "port": {
                         "type": "number",
@@ -1373,7 +1366,7 @@
                         "description": "The underlying web-standard `Request` backing this request.\n\nSee https://srvx.h3.dev/guide/node#noderequest"
                     },
                     "_url": {
-                        "additionalProperties": true,
+                        "$ref": "#/components/schemas/URLAlias",
                         "description": "Access to the parsed URL of this request."
                     },
                     "runtime": {
@@ -1638,16 +1631,6 @@
                             "realmId": {
                                 "type": "string"
                             },
-                            "scope": {
-                                "anyOf": [
-                                    {
-                                        "type": "string"
-                                    },
-                                    {
-                                        "type": "null"
-                                    }
-                                ]
-                            },
                             "grantTypes": {
                                 "anyOf": [
                                     {
@@ -1658,7 +1641,7 @@
                                     }
                                 ]
                             },
-                            "rootUrl": {
+                            "baseUrl": {
                                 "anyOf": [
                                     {
                                         "type": "string"
@@ -1668,7 +1651,7 @@
                                     }
                                 ]
                             },
-                            "baseUrl": {
+                            "backchannelLogoutUri": {
                                 "anyOf": [
                                     {
                                         "type": "string"
@@ -1772,16 +1755,6 @@
                     "realmId": {
                         "type": "string"
                     },
-                    "scope": {
-                        "anyOf": [
-                            {
-                                "type": "string"
-                            },
-                            {
-                                "type": "null"
-                            }
-                        ]
-                    },
                     "grantTypes": {
                         "anyOf": [
                             {
@@ -1792,7 +1765,7 @@
                             }
                         ]
                     },
-                    "rootUrl": {
+                    "baseUrl": {
                         "anyOf": [
                             {
                                 "type": "string"
@@ -1802,7 +1775,7 @@
                             }
                         ]
                     },
-                    "baseUrl": {
+                    "backchannelLogoutUri": {
                         "anyOf": [
                             {
                                 "type": "string"
@@ -2754,6 +2727,10 @@
                     "email": {
                         "type": "string"
                     },
+                    "emailVerified": {
+                        "type": "boolean",
+                        "description": "Whether control of `email` was proven, by following the code mailed\nto it. Deliberately NOT derived from `active`, which is the account's\nenable flag and says nothing about the address (#3519)."
+                    },
                     "password": {
                         "anyOf": [
                             {
@@ -2868,6 +2845,7 @@
                     "lastName",
                     "displayName",
                     "email",
+                    "emailVerified",
                     "password",
                     "avatar",
                     "cover",
@@ -3619,6 +3597,45 @@
                 "type": "object",
                 "description": "Response of `POST /identity-providers/:id/link-request` (plan 091):\nthe external provider's authorize URL the browser navigates to."
             },
+            "OAuth2TokenGrantResponse": {
+                "properties": {
+                    "scope": {
+                        "type": "string"
+                    },
+                    "mac_algorithm": {
+                        "type": "string"
+                    },
+                    "mac_key": {
+                        "type": "string"
+                    },
+                    "id_token": {
+                        "type": "string"
+                    },
+                    "token_type": {
+                        "type": "string"
+                    },
+                    "expires_in": {
+                        "type": "number",
+                        "format": "double"
+                    },
+                    "refresh_token_expires_in": {
+                        "type": "number",
+                        "format": "double"
+                    },
+                    "refresh_token": {
+                        "type": "string"
+                    },
+                    "access_token": {
+                        "type": "string"
+                    }
+                },
+                "required": [
+                    "token_type",
+                    "expires_in",
+                    "access_token"
+                ],
+                "type": "object"
+            },
             "IdentityProviderAccount": {
                 "properties": {
                     "id": {
@@ -4773,81 +4790,260 @@
                 ],
                 "type": "object"
             },
-            "OAuth2TokenGrantResponse": {
+            "UserAuthenticatorChallengeVerifyResponse": {
                 "properties": {
-                    "scope": {
+                    "token": {
+                        "$ref": "#/components/schemas/OAuth2TokenGrantResponse",
+                        "description": "Present when the challenge was authenticated with an \"MFA-pending\"\nlogin ticket (mfa_token): the full token grant for the completed\nlogin (issue #3242)."
+                    },
+                    "verified": {
+                        "type": "boolean"
+                    }
+                },
+                "required": [
+                    "verified"
+                ],
+                "type": "object"
+            },
+            "UserAuthenticatorChallengeVerifyPayload": {
+                "properties": {
+                    "response": {
                         "type": "string"
                     },
-                    "mac_algorithm": {
+                    "kind": {
+                        "type": "string",
+                        "enum": [
+                            "totp",
+                            "recovery",
+                            "email",
+                            "webauthn"
+                        ]
+                    }
+                },
+                "required": [
+                    "response",
+                    "kind"
+                ],
+                "type": "object"
+            },
+            "OAuth2AuthorizationCodeRequest": {
+                "properties": {
+                    "acr_values": {
+                        "type": "string",
+                        "description": "OIDC Core §3.1.2.1: space-delimited requested acr values. Voluntary\nper §5.5.1.1 — unknown tokens are ignored; `urn:authup:mfa` acts as\na step-up trigger."
+                    },
+                    "login_hint": {
+                        "type": "string",
+                        "description": "OIDC Core §3.1.2.1: login hint pre-filling the sign-in identifier."
+                    },
+                    "max_age": {
+                        "anyOf": [
+                            {
+                                "type": "number",
+                                "format": "double"
+                            },
+                            {
+                                "type": "string"
+                            }
+                        ],
+                        "description": "OIDC Core §3.1.2.1: max acceptable age (seconds) of the authentication."
+                    },
+                    "prompt": {
+                        "type": "string",
+                        "description": "OIDC Core §3.1.2.1: space-delimited list of `none|login|consent|select_account`."
+                    },
+                    "code_challenge_method": {
                         "type": "string"
                     },
-                    "mac_key": {
+                    "code_challenge": {
                         "type": "string"
                     },
-                    "id_token": {
+                    "nonce": {
                         "type": "string"
                     },
-                    "token_type": {
+                    "state": {
                         "type": "string"
                     },
-                    "expires_in": {
-                        "type": "number",
-                        "format": "double"
+                    "scope": {
+                        "type": "string"
                     },
-                    "refresh_token_expires_in": {
-                        "type": "number",
-                        "format": "double"
+                    "redirect_uri": {
+                        "type": "string"
                     },
-                    "refresh_token": {
+                    "realm_id": {
                         "type": "string"
                     },
-                    "access_token": {
+                    "client_id": {
+                        "type": "string"
+                    },
+                    "response_type": {
                         "type": "string"
                     }
                 },
                 "required": [
-                    "token_type",
-                    "expires_in",
-                    "access_token"
+                    "response_type"
                 ],
                 "type": "object"
             },
-            "UserAuthenticatorChallengeVerifyResponse": {
+            "AuthorizeInfoError": {
                 "properties": {
-                    "token": {
-                        "$ref": "#/components/schemas/OAuth2TokenGrantResponse",
-                        "description": "Present when the challenge was authenticated with an \"MFA-pending\"\nlogin ticket (mfa_token): the full token grant for the completed\nlogin (issue #3242)."
+                    "code": {
+                        "type": "string"
                     },
-                    "verified": {
+                    "message": {
+                        "type": "string"
+                    }
+                },
+                "additionalProperties": {
+                    "additionalProperties": true
+                },
+                "required": [
+                    "message"
+                ],
+                "type": "object",
+                "description": "A refusal as it travels: the sanitized error's own enumerable\nattributes plus its `message`, which an Error does not carry as one.\n\nIt is NOT an `Error`. Nothing survives the JSON trip but data, so an\n`instanceof Error` check against it is always false, and `name` and\n`stack` are absent. `code` is the discriminator to branch on; the\nremaining attributes are whatever the error class carries (`issues`\non a validation failure, `data` on an OAuth2 one)."
+            },
+            "ClientSummary": {
+                "properties": {
+                    "createdAt": {
+                        "type": "string"
+                    },
+                    "builtIn": {
                         "type": "boolean"
+                    },
+                    "id": {
+                        "type": "string"
+                    },
+                    "displayName": {
+                        "anyOf": [
+                            {
+                                "type": "string"
+                            },
+                            {
+                                "type": "null"
+                            }
+                        ]
+                    },
+                    "name": {
+                        "type": "string"
                     }
                 },
                 "required": [
-                    "verified"
+                    "createdAt",
+                    "builtIn",
+                    "id",
+                    "displayName",
+                    "name"
                 ],
-                "type": "object"
+                "type": "object",
+                "description": "The client as an anonymous visitor may see it. `GET /authorize` and\n`GET /authorize/info` are both unauthenticated, so the row is trimmed\nto these five fields before it leaves the server: never the\nredirect_uri patterns (the trusted-origin set), the grant types, the\nhome URL, the back-channel logout endpoint, the authentication method\nor the secret storage flags."
             },
-            "UserAuthenticatorChallengeVerifyPayload": {
+            "RealmSummary": {
                 "properties": {
-                    "response": {
+                    "id": {
                         "type": "string"
                     },
-                    "kind": {
-                        "type": "string",
-                        "enum": [
-                            "totp",
-                            "recovery",
-                            "email",
-                            "webauthn"
+                    "displayName": {
+                        "anyOf": [
+                            {
+                                "type": "string"
+                            },
+                            {
+                                "type": "null"
+                            }
                         ]
+                    },
+                    "name": {
+                        "type": "string"
                     }
                 },
                 "required": [
-                    "response",
-                    "kind"
+                    "id",
+                    "displayName",
+                    "name"
+                ],
+                "type": "object",
+                "description": "The client's realm, named so a page can render the realm-mismatch\nnotice (`codeRequest.realm_id` carries only the id)."
+            },
+            "StatusResponseFeatures": {
+                "properties": {
+                    "adminConsole": {
+                        "type": "boolean"
+                    },
+                    "accountConsole": {
+                        "type": "boolean"
+                    },
+                    "emailVerification": {
+                        "type": "boolean"
+                    },
+                    "passwordRecovery": {
+                        "type": "boolean"
+                    },
+                    "registration": {
+                        "type": "boolean"
+                    }
+                },
+                "required": [
+                    "adminConsole",
+                    "accountConsole",
+                    "emailVerification",
+                    "passwordRecovery",
+                    "registration"
                 ],
                 "type": "object"
             },
+            "AuthorizeInfo": {
+                "properties": {
+                    "requestPath": {
+                        "type": "string",
+                        "description": "Path and query of the authorize request, `provider` stripped. A\npage carries it as the same-origin `redirect` parameter on the\nregister / password links, so those lead back into this request."
+                    },
+                    "features": {
+                        "$ref": "#/components/schemas/StatusResponseFeatures"
+                    },
+                    "federatedLogin": {
+                        "properties": {
+                            "providerId": {
+                                "type": "string"
+                            }
+                        },
+                        "required": [
+                            "providerId"
+                        ],
+                        "type": "object",
+                        "description": "A federated login waiting to be completed (plan 094). Only the\nprovider is named; the pending login itself rides a cookie."
+                    },
+                    "redirectUriVerified": {
+                        "type": "boolean",
+                        "description": "Whether the request `redirect_uri` matched a registered client\npattern. False means the page must not offer a redirect back to\nthe application."
+                    },
+                    "realm": {
+                        "$ref": "#/components/schemas/RealmSummary"
+                    },
+                    "scopes": {
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/components/schemas/Scope"
+                        }
+                    },
+                    "client": {
+                        "$ref": "#/components/schemas/ClientSummary"
+                    },
+                    "error": {
+                        "$ref": "#/components/schemas/AuthorizeInfoError"
+                    },
+                    "codeRequest": {
+                        "$ref": "#/components/schemas/OAuth2AuthorizationCodeRequest"
+                    }
+                },
+                "required": [
+                    "requestPath",
+                    "features",
+                    "redirectUriVerified"
+                ],
+                "type": "object",
+                "description": "The complete render input of the hosted `/authorize` page: what the\ncode-request verifier resolved, plus the feature flags and the request\npath the page hands to its register / password-forgot links.\n\nA refused request is not an error response. It answers with `error`\nfilled and the resolved fields absent, exactly as the page renders it,\nso a caller renders the refusal instead of failing."
+            },
             "OAuth2JsonWebKey": {
                 "properties": {
                     "y": {
@@ -4914,6 +5110,37 @@
                 ],
                 "type": "object"
             },
+            "EndSessionResponse": {
+                "properties": {
+                    "redirect": {
+                        "type": "string",
+                        "description": "The validated `post_logout_redirect_uri`, `state` already applied.\nThe page navigates it only after its own sign-out has run."
+                    },
+                    "serverRevoked": {
+                        "type": "boolean",
+                        "description": "Whether a session was actually revoked here."
+                    },
+                    "hintSubKind": {
+                        "type": "string"
+                    },
+                    "hintSub": {
+                        "type": "string"
+                    },
+                    "hintVerified": {
+                        "type": "boolean",
+                        "description": "Whether the `id_token_hint` verified. Claims are reflected only when\nit did."
+                    },
+                    "clientName": {
+                        "type": "string",
+                        "description": "The client the hint or the request identified, for the page to name."
+                    }
+                },
+                "required": [
+                    "serverRevoked"
+                ],
+                "type": "object",
+                "description": "What `POST /logout` answers a JSON caller with (plan 101 D2).\n\nThe end_session_endpoint keeps its two OIDC browser bindings, which\nredirect to wherever the auth console is served; this is the shape the\nrendered page gets when it asks for the session to be ended.\n\nThe three hint fields are the operands of the page's auto-clear gate:\nit may tear the browser's own session down only when the server really\nrevoked a session AND that session's subject is this browser's user.\nThey are answered to the page's own request rather than carried in a\nURL for exactly that reason, since a URL-borne `hintSub` would be\nattacker-suppliable and the gate would decide nothing."
+            },
             "PasswordForgotResponse": {
                 "properties": {
                     "resetExpires": {
@@ -5012,33 +5239,10 @@
                     "realmId": {
                         "type": "string"
                     },
-                    "name": {
-                        "type": "string"
-                    }
-                },
-                "type": "object"
-            },
-            "StatusResponseFeatures": {
-                "properties": {
-                    "accountConsole": {
-                        "type": "boolean"
-                    },
-                    "emailVerification": {
-                        "type": "boolean"
-                    },
-                    "passwordRecovery": {
-                        "type": "boolean"
-                    },
-                    "registration": {
-                        "type": "boolean"
-                    }
-                },
-                "required": [
-                    "accountConsole",
-                    "emailVerification",
-                    "passwordRecovery",
-                    "registration"
-                ],
+                    "name": {
+                        "type": "string"
+                    }
+                },
                 "type": "object"
             },
             "StatusResponse": {
@@ -5181,10 +5385,6 @@
                                 "type": "string",
                                 "description": "Scopes (e.g. \"scope1 scope2\")"
                             },
-                            "sub_name": {
-                                "type": "string",
-                                "description": "Subject name"
-                            },
                             "sub_kind": {
                                 "type": "string",
                                 "enum": [
@@ -5199,7 +5399,8 @@
                                     "access_token",
                                     "id_token",
                                     "refresh_token",
-                                    "mfa_token"
+                                    "mfa_token",
+                                    "logout_token"
                                 ],
                                 "description": "Token type"
                             },
@@ -5236,6 +5437,81 @@
                     }
                 ]
             },
+            "OpenIDClaims": {
+                "properties": {
+                    "updated_at": {
+                        "type": "number",
+                        "format": "double",
+                        "description": "UTC Date in seconds"
+                    },
+                    "locale": {
+                        "type": "string"
+                    },
+                    "zoneinfo": {
+                        "type": "string"
+                    },
+                    "roles": {
+                        "type": "array",
+                        "items": {
+                            "type": "string"
+                        }
+                    },
+                    "birthdate": {
+                        "type": "string"
+                    },
+                    "gender": {
+                        "type": "string"
+                    },
+                    "website": {
+                        "type": "string"
+                    },
+                    "picture": {
+                        "type": "string"
+                    },
+                    "profile": {
+                        "type": "string"
+                    },
+                    "preferred_username": {
+                        "type": "string"
+                    },
+                    "nickname": {
+                        "type": "string"
+                    },
+                    "middle_name": {
+                        "type": "string"
+                    },
+                    "given_name": {
+                        "type": "string"
+                    },
+                    "family_name": {
+                        "type": "string"
+                    },
+                    "name": {
+                        "type": "string"
+                    },
+                    "address": {
+                        "properties": {},
+                        "additionalProperties": {
+                            "additionalProperties": true
+                        },
+                        "type": "object"
+                    },
+                    "phone_number_verified": {
+                        "type": "boolean"
+                    },
+                    "phone_number": {
+                        "type": "string"
+                    },
+                    "email_verified": {
+                        "type": "boolean"
+                    },
+                    "email": {
+                        "type": "string"
+                    }
+                },
+                "type": "object",
+                "description": "The OpenID Connect Core §5.1 standard claims about a subject.\n\nDeclared in a module of its own, importing nothing, so both the id_token\npayload (`OpenIDTokenPayload`) and the RFC 7662 introspection response\n(`OAuth2TokenIntrospectionResponse`) can intersect it. The latter lives in\n`../oauth2`, which `./type` already imports, so declaring the claims there\nwould put the two modules in a cycle.\n\nEvery claim is optional, and an absent one is an OMITTED key rather than a\nnull: OIDC models an unavailable claim as one that is not returned, so a\nproducer mapping a nullable column onto a claim must skip it rather than\nemit `null`."
+            },
             "OAuth2TokenPermission": {
                 "properties": {
                     "realm_id": {
@@ -5279,6 +5555,9 @@
                     {
                         "$ref": "#/components/schemas/OAuth2TokenPayload"
                     },
+                    {
+                        "$ref": "#/components/schemas/OpenIDClaims"
+                    },
                     {
                         "properties": {
                             "permissions": {
@@ -5296,7 +5575,8 @@
                         ],
                         "type": "object"
                     }
-                ]
+                ],
+                "description": "The endpoint answers with the token's own payload plus the subject's OpenID\nclaims, so both are declared. Without the claim set they were reachable only\nthrough `JWTClaims`' index signature, which types every one of them `any`:\na renamed or mistyped claim compiled and failed at runtime (#3518).\n\n`OpenIDClaims` rather than `OpenIDTokenPayload`, because that type lives in a\nmodule importing this one."
             },
             "EntityCollectionResponseRealm": {
                 "properties": {
@@ -5406,6 +5686,14 @@
                         "type": "string",
                         "description": "The OAuth 2.0 / OpenID Connect URL of the OP's Dynamic Client Registration Endpoint OpenID.Registration."
                     },
+                    "backchannel_logout_session_supported": {
+                        "type": "boolean",
+                        "description": "OIDC Back-Channel Logout 1.0: the pushed logout token carries `sid`."
+                    },
+                    "backchannel_logout_supported": {
+                        "type": "boolean",
+                        "description": "OIDC Back-Channel Logout 1.0: the OP pushes a logout token to a\nclient's registered back-channel logout URI when a session ends."
+                    },
                     "end_session_endpoint": {
                         "type": "string",
                         "description": "OIDC RP-Initiated Logout 1.0 — the OP's end-session (logout) endpoint."
@@ -6486,6 +6774,17 @@
                         "type": "string",
                         "description": "Subject kind (e.g. user, client)"
                     },
+                    "secret": {
+                        "anyOf": [
+                            {
+                                "type": "string"
+                            },
+                            {
+                                "type": "null"
+                            }
+                        ],
+                        "description": "The opaque credential a console browser presents in place of a bearer\ntoken (plan 088). The secret half of the row: `id` is the public\nidentifier (published as `sid` in every id_token and on every\n`/sessions` row), this is what a holder must prove.\n\nNull on every bearer-mode session. The column is `select: false`, so it\nis ABSENT from every ordinary read and present only on the dedicated\nlookup. That is why it is optional here rather than always a value."
+                    },
                     "ipAddress": {
                         "type": "string",
                         "description": "Last used ip address."
@@ -7117,6 +7416,9 @@
                                     }
                                 ]
                             },
+                            "emailVerified": {
+                                "type": "boolean"
+                            },
                             "nameLocked": {
                                 "type": "boolean"
                             },
@@ -7195,6 +7497,9 @@
                                     }
                                 ]
                             },
+                            "emailVerified": {
+                                "type": "boolean"
+                            },
                             "nameLocked": {
                                 "type": "boolean"
                             },
@@ -9681,14 +9986,7 @@
                         "content": {
                             "application/json": {
                                 "schema": {
-                                    "anyOf": [
-                                        {
-                                            "type": "string"
-                                        },
-                                        {
-                                            "$ref": "#/components/schemas/Response"
-                                        }
-                                    ]
+                                    "$ref": "#/components/schemas/Response"
                                 }
                             }
                         }
@@ -9721,14 +10019,73 @@
                         "content": {
                             "application/json": {
                                 "schema": {
-                                    "anyOf": [
-                                        {
-                                            "type": "string"
-                                        },
-                                        {
-                                            "$ref": "#/components/schemas/Response"
-                                        }
-                                    ]
+                                    "$ref": "#/components/schemas/Response"
+                                }
+                            }
+                        }
+                    }
+                },
+                "description": "",
+                "tags": [],
+                "parameters": [
+                    {
+                        "allowEmptyValue": false,
+                        "deprecated": false,
+                        "description": "",
+                        "in": "path",
+                        "name": "id",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "examples": {}
+                    }
+                ]
+            }
+        },
+        "/identity-providers/{id}/login-complete": {
+            "post": {
+                "operationId": "CompleteLogin",
+                "responses": {
+                    "200": {
+                        "description": "Ok",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "$ref": "#/components/schemas/OAuth2TokenGrantResponse"
+                                }
+                            }
+                        }
+                    }
+                },
+                "description": "",
+                "tags": [],
+                "parameters": [
+                    {
+                        "allowEmptyValue": false,
+                        "deprecated": false,
+                        "description": "",
+                        "in": "path",
+                        "name": "id",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "examples": {}
+                    }
+                ]
+            }
+        },
+        "/realms/{realmId}/identity-providers/{id}/login-complete": {
+            "post": {
+                "operationId": "CompleteLogin_2",
+                "responses": {
+                    "200": {
+                        "description": "Ok",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "$ref": "#/components/schemas/OAuth2TokenGrantResponse"
                                 }
                             }
                         }
@@ -11068,36 +11425,36 @@
                 ]
             }
         },
-        "/account": {
+        "/login/start": {
             "get": {
-                "operationId": "Serve",
+                "operationId": "Login_2",
                 "responses": {
                     "200": {
                         "description": "Ok",
                         "content": {
                             "application/json": {
                                 "schema": {
-                                    "type": "string"
+                                    "$ref": "#/components/schemas/Response"
                                 }
                             }
                         }
                     }
                 },
-                "description": "",
+                "description": "A path of its own rather than a `realmId`-carrying `/login` (098 C1).\nOne URL used to mean two things: with a realm the server-side kick,\nwithout one the console's own login PAGE. The page is served by the\nconsole service now, so the kick can no longer fall back to it and the\nsplit became required rather than optional.",
                 "tags": [],
                 "parameters": []
             }
         },
-        "/account/{page}": {
+        "/callback": {
             "get": {
-                "operationId": "ServePage",
+                "operationId": "Callback_2",
                 "responses": {
                     "200": {
                         "description": "Ok",
                         "content": {
                             "application/json": {
                                 "schema": {
-                                    "type": "string"
+                                    "$ref": "#/components/schemas/Response"
                                 }
                             }
                         }
@@ -11110,20 +11467,20 @@
         },
         "/activate": {
             "get": {
-                "operationId": "Serve_2",
+                "operationId": "Serve",
                 "responses": {
                     "200": {
                         "description": "Ok",
                         "content": {
                             "application/json": {
                                 "schema": {
-                                    "type": "string"
+                                    "$ref": "#/components/schemas/Response"
                                 }
                             }
                         }
                     }
                 },
-                "description": "",
+                "description": "The page renders in the auth console service; this hop carries the\nrequest's own parameters over to it. The POST below stays here:\nserver-core keeps the protocol, the service keeps the render.",
                 "tags": [],
                 "parameters": []
             },
@@ -11282,20 +11639,40 @@
                 "parameters": []
             },
             "get": {
-                "operationId": "Serve_3",
+                "operationId": "Serve_2",
                 "responses": {
                     "200": {
                         "description": "Ok",
                         "content": {
                             "application/json": {
                                 "schema": {
-                                    "type": "string"
+                                    "$ref": "#/components/schemas/Response"
                                 }
                             }
                         }
                     }
                 },
-                "description": "",
+                "description": "The page renders in the auth console service, which reads its\nwhole input back from `/info` above. server-core keeps the\nprotocol: this GET is a stateless hop, and the POST that issues\nthe code stays here.",
+                "tags": [],
+                "parameters": []
+            }
+        },
+        "/authorize/info": {
+            "get": {
+                "operationId": "Info",
+                "responses": {
+                    "200": {
+                        "description": "Ok",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "$ref": "#/components/schemas/AuthorizeInfo"
+                                }
+                            }
+                        }
+                    }
+                },
+                "description": "The page's render input as JSON, for a renderer that is not this\nprocess (plan 101 D2). Anonymous like the page GET, and answering\nthe same query: a refused request is a 200 carrying the refusal,\nnever an error status, so the caller renders what the page renders.",
                 "tags": [],
                 "parameters": []
             }
@@ -11366,27 +11743,20 @@
         },
         "/logout": {
             "get": {
-                "operationId": "Serve_4",
+                "operationId": "Serve_3",
                 "responses": {
                     "200": {
                         "description": "Ok",
                         "content": {
                             "application/json": {
                                 "schema": {
-                                    "anyOf": [
-                                        {
-                                            "type": "string"
-                                        },
-                                        {
-                                            "$ref": "#/components/schemas/Response"
-                                        }
-                                    ]
+                                    "$ref": "#/components/schemas/Response"
                                 }
                             }
                         }
                     }
                 },
-                "description": "",
+                "description": "`end_session_endpoint` keeps both of its OIDC bindings, and both are\nBROWSER NAVIGATIONS: the RP either redirects the user here (GET) or\nauto-submits a form at it (form_post). Neither can consume a JSON\nanswer, so both hand over to the console service, carrying the\nrequest's own parameters.\n\nThe revoke moved to the JSON call the rendered page makes (plan 101\nD2). It could not stay here: the page needs `serverRevoked`,\n`hintSub` and `hintSubKind` to decide whether to tear its own local\nsession down, and those must reach it as the answer to its OWN\nrequest. Putting them in the redirect URL would let anyone craft\nthem, which is exactly the forced-logout CSRF the client-side gate\nexists to refuse.\n\nThe consequence to know: a browser with JavaScript disabled no\nlonger revokes. It also never returns to the RP, so both sides stay\nconsistent rather than the RP believing a logout it did not get.",
                 "tags": [],
                 "parameters": []
             },
@@ -11398,12 +11768,12 @@
                         "content": {
                             "application/json": {
                                 "schema": {
-                                    "anyOf": [
+                                    "oneOf": [
                                         {
-                                            "type": "string"
+                                            "$ref": "#/components/schemas/Response"
                                         },
                                         {
-                                            "$ref": "#/components/schemas/Response"
+                                            "$ref": "#/components/schemas/EndSessionResponse"
                                         }
                                     ]
                                 }
@@ -11438,20 +11808,20 @@
         },
         "/password-forgot": {
             "get": {
-                "operationId": "Serve_5",
+                "operationId": "Serve_4",
                 "responses": {
                     "200": {
                         "description": "Ok",
                         "content": {
                             "application/json": {
                                 "schema": {
-                                    "type": "string"
+                                    "$ref": "#/components/schemas/Response"
                                 }
                             }
                         }
                     }
                 },
-                "description": "",
+                "description": "The page renders in the auth console service; this hop carries the\nrequest's own parameters over to it. The POST below stays here:\nserver-core keeps the protocol, the service keeps the render.",
                 "tags": [],
                 "parameters": []
             },
@@ -11487,20 +11857,20 @@
         },
         "/password-reset": {
             "get": {
-                "operationId": "Serve_6",
+                "operationId": "Serve_5",
                 "responses": {
                     "200": {
                         "description": "Ok",
                         "content": {
                             "application/json": {
                                 "schema": {
-                                    "type": "string"
+                                    "$ref": "#/components/schemas/Response"
                                 }
                             }
                         }
                     }
                 },
-                "description": "",
+                "description": "The page renders in the auth console service; this hop carries the\nrequest's own parameters over to it. The POST below stays here:\nserver-core keeps the protocol, the service keeps the render.",
                 "tags": [],
                 "parameters": []
             },
@@ -11536,20 +11906,20 @@
         },
         "/register": {
             "get": {
-                "operationId": "Serve_7",
+                "operationId": "Serve_6",
                 "responses": {
                     "200": {
                         "description": "Ok",
                         "content": {
                             "application/json": {
                                 "schema": {
-                                    "type": "string"
+                                    "$ref": "#/components/schemas/Response"
                                 }
                             }
                         }
                     }
                 },
-                "description": "",
+                "description": "The page renders in the auth console service; this hop carries the\nrequest's own parameters over to it. The POST below stays here:\nserver-core keeps the protocol, the service keeps the render.",
                 "tags": [],
                 "parameters": []
             },
@@ -11662,7 +12032,7 @@
                         }
                     }
                 },
-                "description": "",
+                "description": "Deliberately ungated, unlike introspection (#3489). RFC 7009 §2.1 asks\nthe client to send its credentials (a bare `client_id` for a public\nclient) and the server to verify the token was issued to that client;\nauthup knowingly skips both. A public `client_id` identifies and\nproves nothing, so an ownership check built on it would be advisory,\nthe consoles are public clients whose kit revokes anonymously on\nlogout teardown, revoking a token one possesses is the benign action,\nand the uniform 200 below leaves a scanner nothing to learn.",
                 "tags": [],
                 "parameters": []
             }
@@ -13310,6 +13680,46 @@
                 ]
             }
         },
+        "/sessions/@me/introspect": {
+            "get": {
+                "operationId": "GetOwnIntrospection",
+                "responses": {
+                    "200": {
+                        "description": "Ok",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "$ref": "#/components/schemas/OAuth2TokenIntrospectionResponse"
+                                }
+                            }
+                        }
+                    }
+                },
+                "description": "The caller's own session as a CONTEXT rather than a row: the identity\nclaims and permission projection a console hydrates its store from, which\nis what `POST /token/introspect` answers minus everything token-shaped.\n\nA sibling of `@me` rather than a replacement for it: `GET /sessions/@me`\nreturns the `auth_sessions` ROW, and a console needs the subject's claims\nand permissions, which are not on it. Named `introspect` because it is\nliterally the introspection projection, keyed off the request's own\ncredential instead of a token in the body.\n\nNo client scope on the permission read, deliberately.\n`reduceBindingsByIdentityClient` keeps only permissions whose own\n`clientId` matches the one passed, so naming a console's client would\ndrop every global permission — nearly all of them. The bearer path passes\nthe token's `client_id` because a token IS issued to one client; a\nsession is not.",
+                "tags": [],
+                "parameters": []
+            }
+        },
+        "/realms/{realmId}/sessions/@me/introspect": {
+            "get": {
+                "operationId": "GetOwnIntrospection_2",
+                "responses": {
+                    "200": {
+                        "description": "Ok",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "$ref": "#/components/schemas/OAuth2TokenIntrospectionResponse"
+                                }
+                            }
+                        }
+                    }
+                },
+                "description": "The caller's own session as a CONTEXT rather than a row: the identity\nclaims and permission projection a console hydrates its store from, which\nis what `POST /token/introspect` answers minus everything token-shaped.\n\nA sibling of `@me` rather than a replacement for it: `GET /sessions/@me`\nreturns the `auth_sessions` ROW, and a console needs the subject's claims\nand permissions, which are not on it. Named `introspect` because it is\nliterally the introspection projection, keyed off the request's own\ncredential instead of a token in the body.\n\nNo client scope on the permission read, deliberately.\n`reduceBindingsByIdentityClient` keeps only permissions whose own\n`clientId` matches the one passed, so naming a console's client would\ndrop every global permission — nearly all of them. The bearer path passes\nthe token's `client_id` because a token IS issued to one client; a\nsession is not.",
+                "tags": [],
+                "parameters": []
+            }
+        },
         "/sessions": {
             "get": {
                 "operationId": "GetMany_25",