@crowi/api-contract 2.0.0-alpha.11 → 2.0.0-alpha.12

package/dist/index.mjs

@@ -649,6 +649,18 @@ var ClearRenderCacheResponseSchema = z6.object({
   /** Number of cache rows removed. */
   removedCount: z6.number().int().min(0)
 });
+var PluginReadinessFieldSchema = z6.object({
+  name: z6.string(),
+  configured: z6.literal(false)
+});
+var PluginReadinessIssueSchema = z6.object({
+  name: z6.string(),
+  adminPlacement: PluginAdminPlacementSchema,
+  fields: z6.array(PluginReadinessFieldSchema)
+});
+var PluginReadinessResponseSchema = z6.object({
+  issues: z6.array(PluginReadinessIssueSchema)
+});
 
 // src/contracts/admin/plugins.ts
 var PluginNameQuerySchema = z7.object({ name: z7.string() });
@@ -780,6 +792,27 @@ var clearRenderCacheAllRoute = createRoute4({
     }
   }
 });
+var getPluginReadinessRoute = createRoute4({
+  method: "get",
+  path: "/admin/plugins/readiness",
+  tags: ["admin.plugins"],
+  security: [{ bearerAuth: [] }],
+  summary: "List active plugins missing required readiness config fields",
+  responses: {
+    200: {
+      description: "Readiness issues for active plugins (empty when everything is configured)",
+      content: { "application/json": { schema: PluginReadinessResponseSchema } }
+    },
+    401: {
+      description: "Authentication required",
+      content: { "application/json": { schema: AuthenticationRequiredErrorSchema } }
+    },
+    403: {
+      description: "Admin permission required",
+      content: { "application/json": { schema: AdminRequiredErrorSchema } }
+    }
+  }
+});
 var clearRenderCachePluginRoute = createRoute4({
   method: "post",
   path: "/admin/plugins/render-cache/clear-plugin",
@@ -819,6 +852,7 @@ var adminPluginsRoutes = {
   listPluginsRoute,
   getPluginConfigRoute,
   updatePluginConfigRoute,
+  getPluginReadinessRoute,
   clearRenderCacheAllRoute,
   clearRenderCachePluginRoute
 };
@@ -3374,22 +3408,28 @@ var draftRoutes = {
 import { createRoute as createRoute16 } from "@hono/zod-openapi";
 
 // src/schemas/installer.ts
+import { z as z30 } from "@hono/zod-openapi";
+
+// src/schemas/username.ts
 import { z as z29 } from "@hono/zod-openapi";
-var InstallerStatusResponseSchema = z29.object({
-  status: z29.enum(["installer_required", "already_installed"])
-});
-var CreateAdminRequestSchema = z29.object({
-  registerForm: z29.object({
-    username: z29.string().min(1).regex(/^[\da-zA-Z\-_.]+$/, "username may only contain letters, digits, hyphens, underscores, and dots"),
-    name: z29.string().min(1),
-    email: z29.string().email(),
-    password: z29.string().min(6).regex(/^[\x20-\x7F]{6,}$/, "password must be 6+ printable ASCII characters")
+var UsernameSchema = z29.string().min(1).max(64).regex(/^[A-Za-z0-9_-]+$/, "username may only contain letters, digits, hyphens, and underscores");
+
+// src/schemas/installer.ts
+var InstallerStatusResponseSchema = z30.object({
+  status: z30.enum(["installer_required", "already_installed"])
+});
+var CreateAdminRequestSchema = z30.object({
+  registerForm: z30.object({
+    username: UsernameSchema,
+    name: z30.string().min(1),
+    email: z30.string().email(),
+    password: z30.string().min(6).regex(/^[\x20-\x7F]{6,}$/, "password must be 6+ printable ASCII characters")
   })
 });
-var CreateAdminResponseSchema = z29.object({
-  status: z29.enum(["ok", "error"]),
-  message: z29.string().optional(),
-  errors: z29.array(z29.string()).optional()
+var CreateAdminResponseSchema = z30.object({
+  status: z30.enum(["ok", "error"]),
+  message: z30.string().optional(),
+  errors: z30.array(z30.string()).optional()
 });
 
 // src/contracts/installer.ts
@@ -3461,84 +3501,84 @@ var createAdminRoute = createRoute16({
 var installerRoutes = { getInstallerStatusRoute, createAdminRoute };
 
 // src/contracts/me.ts
-import { createRoute as createRoute17, z as z31 } from "@hono/zod-openapi";
+import { createRoute as createRoute17, z as z32 } from "@hono/zod-openapi";
 
 // src/schemas/me.ts
-import { z as z30 } from "@hono/zod-openapi";
-var LanguageSchema = z30.enum(["en", "ja"]);
-var ThemeSchema = z30.enum(["system", "light", "dark"]);
-var UserProfileResponseSchema = z30.object({
-  id: z30.string(),
-  username: z30.string(),
-  name: z30.string(),
-  email: z30.string().email(),
+import { z as z31 } from "@hono/zod-openapi";
+var LanguageSchema = z31.enum(["en", "ja"]);
+var ThemeSchema = z31.enum(["system", "light", "dark"]);
+var UserProfileResponseSchema = z31.object({
+  id: z31.string(),
+  username: z31.string(),
+  name: z31.string(),
+  email: z31.string().email(),
   lang: LanguageSchema,
   theme: ThemeSchema,
-  image: z30.string().nullable(),
-  introduction: z30.string().optional(),
-  hasPassword: z30.boolean(),
-  createdAt: z30.string(),
+  image: z31.string().nullable(),
+  introduction: z31.string().optional(),
+  hasPassword: z31.boolean(),
+  createdAt: z31.string(),
   /**
    * True when the profile update requested a new email that is awaiting
    * confirmation: the stored `email` is unchanged and a confirmation
    * link was sent to the new address.
    */
-  emailChangePending: z30.boolean().optional()
+  emailChangePending: z31.boolean().optional()
 });
-var UpdateProfileRequestSchema = z30.object({
-  userForm: z30.object({
-    name: z30.string().min(1, "Name is required"),
-    email: z30.string().email("Invalid email format"),
+var UpdateProfileRequestSchema = z31.object({
+  userForm: z31.object({
+    name: z31.string().min(1, "Name is required"),
+    email: z31.string().email("Invalid email format"),
     lang: LanguageSchema
   })
 });
-var UpdateThemeRequestSchema = z30.object({
+var UpdateThemeRequestSchema = z31.object({
   theme: ThemeSchema
 });
-var ThemeUpdateResponseSchema = z30.object({
-  status: z30.literal("ok"),
+var ThemeUpdateResponseSchema = z31.object({
+  status: z31.literal("ok"),
   theme: ThemeSchema
 });
-var PictureUploadResponseSchema = z30.object({
-  status: z30.boolean(),
-  url: z30.string().optional(),
-  message: z30.string().optional()
+var PictureUploadResponseSchema = z31.object({
+  status: z31.boolean(),
+  url: z31.string().optional(),
+  message: z31.string().optional()
 });
-var SuccessResponseSchema = z30.object({
-  status: z30.literal("ok"),
-  message: z30.string().optional()
+var SuccessResponseSchema = z31.object({
+  status: z31.literal("ok"),
+  message: z31.string().optional()
 });
-var ProfileErrorResponseSchema = z30.object({
-  status: z30.literal("error"),
+var ProfileErrorResponseSchema = z31.object({
+  status: z31.literal("error"),
   /** Stable code so the web can localize the message (e.g. EMAIL_TAKEN). */
-  code: z30.string().optional(),
-  message: z30.string().optional(),
-  errors: z30.array(z30.string()).optional()
+  code: z31.string().optional(),
+  message: z31.string().optional(),
+  errors: z31.array(z31.string()).optional()
 });
 var PASSWORD_REGEX = /^(?=.*[a-zA-Z])(?=.*\d)(?=.*[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?`~])[a-zA-Z\d!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?`~]+$/;
-var UpdatePasswordRequestSchema = z30.object({
-  oldPassword: z30.string().optional(),
-  newPassword: z30.string().min(8, "Password must be at least 8 characters").max(100, "Password must be at most 100 characters").regex(PASSWORD_REGEX, "Password must contain at least one letter, one digit, and one special character"),
-  newPasswordConfirm: z30.string()
+var UpdatePasswordRequestSchema = z31.object({
+  oldPassword: z31.string().optional(),
+  newPassword: z31.string().min(8, "Password must be at least 8 characters").max(100, "Password must be at most 100 characters").regex(PASSWORD_REGEX, "Password must contain at least one letter, one digit, and one special character"),
+  newPasswordConfirm: z31.string()
 }).refine((data) => data.newPassword === data.newPasswordConfirm, {
   message: "Passwords do not match",
   path: ["newPasswordConfirm"]
 });
-var PasswordUpdateSuccessSchema = z30.object({
-  status: z30.literal("ok"),
-  message: z30.string(),
-  accessToken: z30.string(),
-  refreshToken: z30.string(),
+var PasswordUpdateSuccessSchema = z31.object({
+  status: z31.literal("ok"),
+  message: z31.string(),
+  accessToken: z31.string(),
+  refreshToken: z31.string(),
   /** Access-token lifetime in seconds. */
-  expiresIn: z30.number()
+  expiresIn: z31.number()
 });
-var PasswordErrorResponseSchema = z30.object({
-  status: z30.literal("error"),
-  message: z30.string(),
-  errors: z30.array(z30.string()).optional()
+var PasswordErrorResponseSchema = z31.object({
+  status: z31.literal("error"),
+  message: z31.string(),
+  errors: z31.array(z31.string()).optional()
 });
-var RecentlyViewedPagesResponseSchema = z30.object({
-  pages: z30.array(PageSchema)
+var RecentlyViewedPagesResponseSchema = z31.object({
+  pages: z31.array(PageSchema)
 });
 
 // src/contracts/me.ts
@@ -3621,8 +3661,8 @@ var uploadPictureRoute = createRoute17({
     body: {
       content: {
         "multipart/form-data": {
-          schema: z31.object({
-            file: z31.any().optional().describe("Profile picture file")
+          schema: z32.object({
+            file: z32.any().optional().describe("Profile picture file")
           })
         }
       }
@@ -3722,37 +3762,37 @@ var meRoutes = {
 };
 
 // src/contracts/access-token.ts
-import { createRoute as createRoute18, z as z33 } from "@hono/zod-openapi";
+import { createRoute as createRoute18, z as z34 } from "@hono/zod-openapi";
 
 // src/schemas/access-token.ts
-import { z as z32 } from "@hono/zod-openapi";
-var AccessTokenSchema = z32.object({
-  id: z32.string(),
-  name: z32.string(),
-  scopes: z32.array(z32.string()),
+import { z as z33 } from "@hono/zod-openapi";
+var AccessTokenSchema = z33.object({
+  id: z33.string(),
+  name: z33.string(),
+  scopes: z33.array(z33.string()),
   /** ISO-8601 expiry, or `null` for a non-expiring token. */
-  expiresAt: z32.string().nullable(),
+  expiresAt: z33.string().nullable(),
   /** ISO-8601 of last successful use, or `null` if never used. */
-  lastUsedAt: z32.string().nullable(),
-  createdAt: z32.string()
+  lastUsedAt: z33.string().nullable(),
+  createdAt: z33.string()
 });
-var ListAccessTokensResponseSchema = z32.object({
-  accessTokens: z32.array(AccessTokenSchema)
+var ListAccessTokensResponseSchema = z33.object({
+  accessTokens: z33.array(AccessTokenSchema)
 });
-var CreateAccessTokenRequestSchema = z32.object({
-  name: z32.string().min(1, "Name is required").max(200),
-  scopes: z32.array(z32.string()).min(1, "At least one scope is required"),
-  expiresAt: z32.string().datetime().nullable().optional()
+var CreateAccessTokenRequestSchema = z33.object({
+  name: z33.string().min(1, "Name is required").max(200),
+  scopes: z33.array(z33.string()).min(1, "At least one scope is required"),
+  expiresAt: z33.string().datetime().nullable().optional()
 });
 var CreateAccessTokenResponseSchema = AccessTokenSchema.extend({
-  token: z32.string()
-});
-var InvalidScopeErrorSchema = z32.object({
-  error: z32.object({
-    code: z32.literal("INVALID_SCOPE"),
-    message: z32.string(),
-    details: z32.object({
-      invalidScopes: z32.array(z32.string())
+  token: z33.string()
+});
+var InvalidScopeErrorSchema = z33.object({
+  error: z33.object({
+    code: z33.literal("INVALID_SCOPE"),
+    message: z33.string(),
+    details: z33.object({
+      invalidScopes: z33.array(z33.string())
     }).optional()
   })
 });
@@ -3824,7 +3864,7 @@ var deleteAccessTokenRoute = createRoute18({
   security: [{ bearerAuth: [] }],
   summary: "Revoke a personal access token",
   request: {
-    params: z33.object({ id: z33.string() })
+    params: z34.object({ id: z34.string() })
   },
   responses: {
     200: {
@@ -3856,13 +3896,13 @@ var accessTokenRoutes = {
 };
 
 // src/contracts/oauth.ts
-import { createRoute as createRoute19, z as z36 } from "@hono/zod-openapi";
+import { createRoute as createRoute19, z as z37 } from "@hono/zod-openapi";
 
 // src/schemas/oauth-endpoints.ts
-import { z as z35 } from "@hono/zod-openapi";
+import { z as z36 } from "@hono/zod-openapi";
 
 // src/schemas/oauth.ts
-import { z as z34 } from "@hono/zod-openapi";
+import { z as z35 } from "@hono/zod-openapi";
 var SCOPES = [
   // umbrella
   "read",
@@ -3930,11 +3970,11 @@ function scopeSatisfies(required, granted) {
   return false;
 }
 var InsufficientScopeErrorSchema = ApiErrorSchema.extend({
-  error: z34.object({
-    code: z34.literal("INSUFFICIENT_SCOPE"),
-    message: z34.string(),
-    details: z34.object({
-      requiredScope: z34.string()
+  error: z35.object({
+    code: z35.literal("INSUFFICIENT_SCOPE"),
+    message: z35.string(),
+    details: z35.object({
+      requiredScope: z35.string()
     }).optional()
   })
 });
@@ -3953,97 +3993,97 @@ var OAUTH_ERROR_CODES = [
   "slow_down",
   "expired_token"
 ];
-var OAuthErrorSchema = z35.object({
-  error: z35.enum(OAUTH_ERROR_CODES),
-  error_description: z35.string().optional()
-});
-var AuthorizeRequestSchema = z35.object({
-  client_id: z35.string().min(1),
-  redirect_uri: z35.string().min(1),
-  scope: z35.string().min(1),
-  code_challenge: z35.string().min(1),
-  code_challenge_method: z35.literal("S256"),
-  state: z35.string().optional()
-});
-var AuthorizeResponseSchema = z35.object({
-  redirectUri: z35.string()
-});
-var TokenRequestSchema = z35.discriminatedUnion("grant_type", [
-  z35.object({
-    grant_type: z35.literal("authorization_code"),
-    code: z35.string().min(1),
-    code_verifier: z35.string().min(1),
-    redirect_uri: z35.string().min(1),
-    client_id: z35.string().min(1)
+var OAuthErrorSchema = z36.object({
+  error: z36.enum(OAUTH_ERROR_CODES),
+  error_description: z36.string().optional()
+});
+var AuthorizeRequestSchema = z36.object({
+  client_id: z36.string().min(1),
+  redirect_uri: z36.string().min(1),
+  scope: z36.string().min(1),
+  code_challenge: z36.string().min(1),
+  code_challenge_method: z36.literal("S256"),
+  state: z36.string().optional()
+});
+var AuthorizeResponseSchema = z36.object({
+  redirectUri: z36.string()
+});
+var TokenRequestSchema = z36.discriminatedUnion("grant_type", [
+  z36.object({
+    grant_type: z36.literal("authorization_code"),
+    code: z36.string().min(1),
+    code_verifier: z36.string().min(1),
+    redirect_uri: z36.string().min(1),
+    client_id: z36.string().min(1)
   }),
-  z35.object({
-    grant_type: z35.literal("refresh_token"),
-    refresh_token: z35.string().min(1),
-    client_id: z35.string().min(1),
-    scope: z35.string().optional()
+  z36.object({
+    grant_type: z36.literal("refresh_token"),
+    refresh_token: z36.string().min(1),
+    client_id: z36.string().min(1),
+    scope: z36.string().optional()
   }),
   // RFC 8628 §3.4 — device authorization grant. The client polls with the
   // opaque `device_code` returned by `/oauth/device/authorize`.
-  z35.object({
-    grant_type: z35.literal("urn:ietf:params:oauth:grant-type:device_code"),
-    device_code: z35.string().min(1),
-    client_id: z35.string().min(1)
+  z36.object({
+    grant_type: z36.literal("urn:ietf:params:oauth:grant-type:device_code"),
+    device_code: z36.string().min(1),
+    client_id: z36.string().min(1)
   })
 ]);
 var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-var TokenResponseSchema = z35.object({
-  access_token: z35.string(),
-  token_type: z35.literal("Bearer"),
-  expires_in: z35.number(),
-  refresh_token: z35.string(),
-  scope: z35.string()
-});
-var RevokeRequestSchema = z35.object({
-  token: z35.string().min(1),
-  token_type_hint: z35.string().optional()
-});
-var RevokeResponseSchema = z35.object({});
-var DeviceAuthorizeRequestSchema = z35.object({
-  client_id: z35.string().min(1),
-  scope: z35.string().min(1)
-});
-var DeviceAuthorizeResponseSchema = z35.object({
-  device_code: z35.string(),
-  user_code: z35.string(),
-  verification_uri: z35.string(),
-  verification_uri_complete: z35.string(),
-  expires_in: z35.number(),
-  interval: z35.number()
-});
-var DeviceVerifyRequestSchema = z35.object({
-  user_code: z35.string().min(1),
-  action: z35.enum(["approve", "deny"])
-});
-var DeviceVerifyResponseSchema = z35.object({
-  status: z35.enum(["approved", "denied"])
-});
-var DeviceInfoResponseSchema = z35.object({
-  client_id: z35.string(),
-  scopes: z35.array(z35.string())
-});
-var ClientInfoResponseSchema = z35.object({
-  clientId: z35.string(),
-  name: z35.string(),
-  firstParty: z35.boolean(),
-  trusted: z35.boolean()
+var TokenResponseSchema = z36.object({
+  access_token: z36.string(),
+  token_type: z36.literal("Bearer"),
+  expires_in: z36.number(),
+  refresh_token: z36.string(),
+  scope: z36.string()
+});
+var RevokeRequestSchema = z36.object({
+  token: z36.string().min(1),
+  token_type_hint: z36.string().optional()
+});
+var RevokeResponseSchema = z36.object({});
+var DeviceAuthorizeRequestSchema = z36.object({
+  client_id: z36.string().min(1),
+  scope: z36.string().min(1)
+});
+var DeviceAuthorizeResponseSchema = z36.object({
+  device_code: z36.string(),
+  user_code: z36.string(),
+  verification_uri: z36.string(),
+  verification_uri_complete: z36.string(),
+  expires_in: z36.number(),
+  interval: z36.number()
+});
+var DeviceVerifyRequestSchema = z36.object({
+  user_code: z36.string().min(1),
+  action: z36.enum(["approve", "deny"])
+});
+var DeviceVerifyResponseSchema = z36.object({
+  status: z36.enum(["approved", "denied"])
+});
+var DeviceInfoResponseSchema = z36.object({
+  client_id: z36.string(),
+  scopes: z36.array(z36.string())
+});
+var ClientInfoResponseSchema = z36.object({
+  clientId: z36.string(),
+  name: z36.string(),
+  firstParty: z36.boolean(),
+  trusted: z36.boolean()
 });
 var GRANT_TYPES_SUPPORTED = ["authorization_code", "refresh_token", DEVICE_CODE_GRANT_TYPE];
-var DiscoveryResponseSchema = z35.object({
-  issuer: z35.string(),
-  authorization_endpoint: z35.string(),
-  token_endpoint: z35.string(),
-  revocation_endpoint: z35.string(),
-  device_authorization_endpoint: z35.string().optional(),
-  scopes_supported: z35.array(z35.string()),
-  response_types_supported: z35.array(z35.string()),
-  grant_types_supported: z35.array(z35.string()),
-  code_challenge_methods_supported: z35.array(z35.string()),
-  token_endpoint_auth_methods_supported: z35.array(z35.string())
+var DiscoveryResponseSchema = z36.object({
+  issuer: z36.string(),
+  authorization_endpoint: z36.string(),
+  token_endpoint: z36.string(),
+  revocation_endpoint: z36.string(),
+  device_authorization_endpoint: z36.string().optional(),
+  scopes_supported: z36.array(z36.string()),
+  response_types_supported: z36.array(z36.string()),
+  grant_types_supported: z36.array(z36.string()),
+  code_challenge_methods_supported: z36.array(z36.string()),
+  token_endpoint_auth_methods_supported: z36.array(z36.string())
 });
 var DISCOVERY_SCOPES_SUPPORTED = ISSUABLE_SCOPES;
 
@@ -4179,7 +4219,7 @@ var deviceInfoRoute = createRoute19({
   // scopes so the web consent screen can show them before approval. Reveals
   // no secret. Unknown / expired / non-pending → 404 (PHASE4-Q9 option A).
   request: {
-    query: z36.object({ user_code: z36.string().min(1) })
+    query: z37.object({ user_code: z37.string().min(1) })
   },
   responses: {
     200: {
@@ -4233,7 +4273,7 @@ var clientInfoRoute = createRoute19({
   // no redirectUris/allowedScopes — mirroring deviceInfoRoute's own
   // non-secret-lookup shape. Unknown client_id → 404.
   request: {
-    query: z36.object({ client_id: z36.string().min(1) })
+    query: z37.object({ client_id: z37.string().min(1) })
   },
   responses: {
     200: {
@@ -4258,24 +4298,24 @@ var oauthRoutes = {
 };
 
 // src/contracts/notification.ts
-import { createRoute as createRoute20, z as z38 } from "@hono/zod-openapi";
+import { createRoute as createRoute20, z as z39 } from "@hono/zod-openapi";
 
 // src/schemas/notification.ts
-import { z as z37 } from "@hono/zod-openapi";
-var NotificationStatusSchema = z37.enum(["UNREAD", "UNOPENED", "OPENED"]);
+import { z as z38 } from "@hono/zod-openapi";
+var NotificationStatusSchema = z38.enum(["UNREAD", "UNOPENED", "OPENED"]);
 var NotificationStatusEnum = {
   UNREAD: "UNREAD",
   UNOPENED: "UNOPENED",
   OPENED: "OPENED"
 };
-var NotificationActionSchema = z37.enum(["COMMENT", "LIKE", "MENTION", "UPDATE"]);
+var NotificationActionSchema = z38.enum(["COMMENT", "LIKE", "MENTION", "UPDATE"]);
 var NotificationActionEnum = {
   COMMENT: "COMMENT",
   LIKE: "LIKE",
   MENTION: "MENTION",
   UPDATE: "UPDATE"
 };
-var NotificationTargetModelSchema = z37.enum(["Page"]);
+var NotificationTargetModelSchema = z38.enum(["Page"]);
 var NotificationTargetModelEnum = {
   PAGE: "Page"
 };
@@ -4284,68 +4324,68 @@ var PageRefSchema = PageSchema.pick({
   path: true,
   status: true
 });
-var NotificationSchema = z37.object({
-  _id: z37.string(),
-  user: z37.string(),
+var NotificationSchema = z38.object({
+  _id: z38.string(),
+  user: z38.string(),
   targetModel: NotificationTargetModelSchema,
   target: PageRefSchema,
   action: NotificationActionSchema,
   status: NotificationStatusSchema,
-  actionUsers: z37.array(UserPublicSchema),
-  createdAt: z37.string()
+  actionUsers: z38.array(UserPublicSchema),
+  createdAt: z38.string()
 });
-var ListNotificationsRequestSchema = z37.object({
-  limit: z37.coerce.number().optional().default(10),
-  offset: z37.coerce.number().optional().default(0)
+var ListNotificationsRequestSchema = z38.object({
+  limit: z38.coerce.number().optional().default(10),
+  offset: z38.coerce.number().optional().default(0)
 });
-var ListNotificationsResponseSchema = z37.object({
-  notifications: z37.array(NotificationSchema),
+var ListNotificationsResponseSchema = z38.object({
+  notifications: z38.array(NotificationSchema),
   pager: PagerSchema
 });
-var MarkAllAsReadResponseSchema = z37.object({
-  ok: z37.literal(true)
+var MarkAllAsReadResponseSchema = z38.object({
+  ok: z38.literal(true)
 });
-var OpenNotificationParamSchema = z37.object({
-  id: z37.string()
+var OpenNotificationParamSchema = z38.object({
+  id: z38.string()
 });
-var OpenNotificationResponseSchema = z37.object({
+var OpenNotificationResponseSchema = z38.object({
   notification: NotificationSchema
 });
-var NotificationStatusResponseSchema = z37.object({
-  count: z37.number()
+var NotificationStatusResponseSchema = z38.object({
+  count: z38.number()
 });
-var NotificationNotFoundErrorSchema = z37.object({
-  error: z37.object({
-    code: z37.literal("NOTIFICATION_NOT_FOUND"),
-    message: z37.literal("Notification not found")
+var NotificationNotFoundErrorSchema = z38.object({
+  error: z38.object({
+    code: z38.literal("NOTIFICATION_NOT_FOUND"),
+    message: z38.literal("Notification not found")
   })
 });
-var NotificationsTokenResponseSchema = z37.object({
-  token: z37.string(),
-  selfUserId: z37.string(),
-  expiresAt: z37.string()
+var NotificationsTokenResponseSchema = z38.object({
+  token: z38.string(),
+  selfUserId: z38.string(),
+  expiresAt: z38.string()
 });
-var NotificationsTokenPayloadSchema = z37.object({
-  selfUserId: z37.string(),
+var NotificationsTokenPayloadSchema = z38.object({
+  selfUserId: z38.string(),
   // Random UUID mixed into every signed token so two tokens minted
   // within the same second still produce byte-different JWT strings.
   // The browser uses the token as a React effect dependency to drive
   // the WebSocket reconnect — without `jti`, the iat/exp pair is
   // identical at second granularity and the dep stays stable.
-  jti: z37.string().uuid(),
-  iat: z37.number().int(),
-  exp: z37.number().int()
+  jti: z38.string().uuid(),
+  iat: z38.number().int(),
+  exp: z38.number().int()
 });
-var NotificationsChangedMessageSchema = z37.object({
-  type: z37.literal("changed")
+var NotificationsChangedMessageSchema = z38.object({
+  type: z38.literal("changed")
 });
 var NotificationsServerMessageSchema = NotificationsChangedMessageSchema;
 
 // src/contracts/notification.ts
-var NotificationInvalidRequestErrorSchema = z38.object({
-  error: z38.object({
-    code: z38.literal("INVALID_REQUEST"),
-    message: z38.string()
+var NotificationInvalidRequestErrorSchema = z39.object({
+  error: z39.object({
+    code: z39.literal("INVALID_REQUEST"),
+    message: z39.string()
   })
 });
 var listNotificationsRoute = createRoute20({
@@ -4481,9 +4521,9 @@ var notificationRoutes = {
 };
 
 // src/contracts/page-collab.ts
-import { createRoute as createRoute21, z as z39 } from "@hono/zod-openapi";
-var PageIdPathParamsSchema2 = z39.object({
-  id: z39.string().openapi({ description: "Page id (24-char hex ObjectId)", example: "507f1f77bcf86cd799439011" })
+import { createRoute as createRoute21, z as z40 } from "@hono/zod-openapi";
+var PageIdPathParamsSchema2 = z40.object({
+  id: z40.string().openapi({ description: "Page id (24-char hex ObjectId)", example: "507f1f77bcf86cd799439011" })
 });
 var getYjsTokenRoute = createRoute21({
   method: "get",
@@ -4522,25 +4562,25 @@ var pageCollabRoutes = {
 };
 
 // src/contracts/page.ts
-import { createRoute as createRoute22, z as z40 } from "@hono/zod-openapi";
-var PageBadRequestErrorSchema = z40.object({
-  error: z40.object({
-    code: z40.string(),
-    message: z40.string()
+import { createRoute as createRoute22, z as z41 } from "@hono/zod-openapi";
+var PageBadRequestErrorSchema = z41.object({
+  error: z41.object({
+    code: z41.string(),
+    message: z41.string()
   })
 });
-var DeletePageRequestSchema = z40.object({
-  page_id: z40.string(),
-  revision_id: z40.string().optional(),
-  completely: z40.boolean().optional()
+var DeletePageRequestSchema = z41.object({
+  page_id: z41.string(),
+  revision_id: z41.string().optional(),
+  completely: z41.boolean().optional()
 });
-var RevertDeletedPageRequestSchema = z40.object({
-  page_id: z40.string()
+var RevertDeletedPageRequestSchema = z41.object({
+  page_id: z41.string()
 });
-var PageIdBodySchema = z40.object({
-  page_id: z40.string()
+var PageIdBodySchema = z41.object({
+  page_id: z41.string()
 });
-var PageResponseSchema = z40.object({ page: PageSchema });
+var PageResponseSchema = z41.object({ page: PageSchema });
 var getPageRoute = createRoute22({
   method: "get",
   path: "/pages",
@@ -4854,7 +4894,7 @@ var claimPageLinkAccessRoute = createRoute22({
       description: "The caller has no access to the page (isGrantedFor is false) or lacks scope / is a non-web session \u2014 403 is about the caller lacking access, never about the page grant type per se",
       content: {
         "application/json": {
-          schema: z40.union([PageNotGrantedErrorSchema, InsufficientScopeErrorSchema])
+          schema: z41.union([PageNotGrantedErrorSchema, InsufficientScopeErrorSchema])
         }
       }
     },
@@ -5044,7 +5084,7 @@ var renamePageRoute = createRoute22({
       description: "PAGE_INVALID_NAME / PAGE_EXISTS / PAGE_RENAME_FAILED / PAGE_RENAME_TREE_FAILED",
       content: {
         "application/json": {
-          schema: z40.union([PageBadRequestErrorSchema, RenameTreeErrorSchema])
+          schema: z41.union([PageBadRequestErrorSchema, RenameTreeErrorSchema])
         }
       }
     },
@@ -5082,7 +5122,7 @@ var renameSubtreeRoute = createRoute22({
       description: "PAGE_INVALID_NAME / PAGE_RENAME_TREE_FAILED (collisions, nothing to move, or partial failure)",
       content: {
         "application/json": {
-          schema: z40.union([PageBadRequestErrorSchema, RenameTreeErrorSchema])
+          schema: z41.union([PageBadRequestErrorSchema, RenameTreeErrorSchema])
         }
       }
     },
@@ -5135,11 +5175,11 @@ var pageRoutes = {
 import { createRoute as createRoute23 } from "@hono/zod-openapi";
 
 // src/schemas/page-preview.ts
-import { z as z41 } from "@hono/zod-openapi";
-var PreviewPageRequestSchema = z41.object({
-  body: z41.string()
+import { z as z42 } from "@hono/zod-openapi";
+var PreviewPageRequestSchema = z42.object({
+  body: z42.string()
 });
-var PreviewPageResponseSchema = z41.object({
+var PreviewPageResponseSchema = z42.object({
   renderedAst: RenderedAstValueSchema.optional(),
   renderedAstArtifactKey: RenderedAstArtifactKeySchema.optional()
 });
@@ -5183,78 +5223,78 @@ var pagePreviewRoutes = {
 };
 
 // src/contracts/presence.ts
-import { createRoute as createRoute24, z as z43 } from "@hono/zod-openapi";
+import { createRoute as createRoute24, z as z44 } from "@hono/zod-openapi";
 
 // src/schemas/presence.ts
-import { z as z42 } from "@hono/zod-openapi";
-var PresenceTokenResponseSchema = z42.object({
-  token: z42.string(),
-  pageId: z42.string(),
-  selfUserId: z42.string(),
-  expiresAt: z42.string()
-});
-var PresenceTokenPayloadSchema = z42.object({
-  userId: z42.string(),
-  pageId: z42.string(),
-  iat: z42.number().int(),
-  exp: z42.number().int()
-});
-var PresenceViewerSchema = z42.object({
-  userId: z42.string(),
-  username: z42.string(),
-  displayName: z42.string(),
-  avatarUrl: z42.string().nullable(),
-  isEditing: z42.boolean(),
-  joinedAt: z42.number().int()
-});
-var PresenceHeartbeatMessageSchema = z42.object({
-  type: z42.literal("heartbeat")
+import { z as z43 } from "@hono/zod-openapi";
+var PresenceTokenResponseSchema = z43.object({
+  token: z43.string(),
+  pageId: z43.string(),
+  selfUserId: z43.string(),
+  expiresAt: z43.string()
+});
+var PresenceTokenPayloadSchema = z43.object({
+  userId: z43.string(),
+  pageId: z43.string(),
+  iat: z43.number().int(),
+  exp: z43.number().int()
+});
+var PresenceViewerSchema = z43.object({
+  userId: z43.string(),
+  username: z43.string(),
+  displayName: z43.string(),
+  avatarUrl: z43.string().nullable(),
+  isEditing: z43.boolean(),
+  joinedAt: z43.number().int()
+});
+var PresenceHeartbeatMessageSchema = z43.object({
+  type: z43.literal("heartbeat")
 });
 var PresenceClientMessageSchema = PresenceHeartbeatMessageSchema;
-var PresenceViewersMessageSchema = z42.object({
-  type: z42.literal("viewers"),
-  viewers: z42.array(PresenceViewerSchema),
-  generation: z42.number().int()
-});
-var PresencePageUpdatedMessageSchema = z42.object({
-  type: z42.literal("page-updated"),
-  pageId: z42.string(),
-  revisionId: z42.string(),
-  editorUserId: z42.string(),
-  editorDisplayName: z42.string()
-});
-var PresenceCommentChangedMessageSchema = z42.object({
-  type: z42.literal("comment-changed"),
-  pageId: z42.string(),
-  changeType: z42.enum(["added", "removed"]),
-  commentId: z42.string(),
-  actorUserId: z42.string().optional()
-});
-var PresenceServerMessageSchema = z42.discriminatedUnion("type", [
+var PresenceViewersMessageSchema = z43.object({
+  type: z43.literal("viewers"),
+  viewers: z43.array(PresenceViewerSchema),
+  generation: z43.number().int()
+});
+var PresencePageUpdatedMessageSchema = z43.object({
+  type: z43.literal("page-updated"),
+  pageId: z43.string(),
+  revisionId: z43.string(),
+  editorUserId: z43.string(),
+  editorDisplayName: z43.string()
+});
+var PresenceCommentChangedMessageSchema = z43.object({
+  type: z43.literal("comment-changed"),
+  pageId: z43.string(),
+  changeType: z43.enum(["added", "removed"]),
+  commentId: z43.string(),
+  actorUserId: z43.string().optional()
+});
+var PresenceServerMessageSchema = z43.discriminatedUnion("type", [
   PresenceViewersMessageSchema,
   PresencePageUpdatedMessageSchema,
   PresenceCommentChangedMessageSchema
 ]);
-var LikerSchema = z42.object({
-  id: z42.string(),
-  username: z42.string(),
-  displayName: z42.string(),
-  avatarUrl: z42.string().nullable(),
-  likedAt: z42.string().nullable()
-});
-var LikersResponseSchema = z42.object({
-  users: z42.array(LikerSchema),
-  totalCount: z42.number().int().nonnegative()
-});
-var GetLikersRequestSchema = z42.object({
+var LikerSchema = z43.object({
+  id: z43.string(),
+  username: z43.string(),
+  displayName: z43.string(),
+  avatarUrl: z43.string().nullable(),
+  likedAt: z43.string().nullable()
+});
+var LikersResponseSchema = z43.object({
+  users: z43.array(LikerSchema),
+  totalCount: z43.number().int().nonnegative()
+});
+var GetLikersRequestSchema = z43.object({
   // Optional cap on returned `users`. `totalCount` always reflects the
   // full count regardless of `limit`. Omit for the full list.
-  limit: z42.coerce.number().int().positive().optional()
+  limit: z43.coerce.number().int().positive().optional()
 });
 
 // src/contracts/presence.ts
-var PageIdPathParamsSchema3 = z43.object({
-  id: z43.string().openapi({ description: "Page id (24-char hex ObjectId)", example: "507f1f77bcf86cd799439011" })
+var PageIdPathParamsSchema3 = z44.object({
+  id: z44.string().openapi({ description: "Page id (24-char hex ObjectId)", example: "507f1f77bcf86cd799439011" })
 });
 var getPresenceTokenRoute = createRoute24({
   method: "get",
@@ -5327,49 +5367,49 @@ var presenceRoutes = {
 };
 
 // src/contracts/revision.ts
-import { createRoute as createRoute25, z as z45 } from "@hono/zod-openapi";
+import { createRoute as createRoute25, z as z46 } from "@hono/zod-openapi";
 
 // src/schemas/revision.ts
-import { z as z44 } from "@hono/zod-openapi";
-var RevisionMetaSchema = z44.object({
-  _id: z44.string(),
-  path: z44.string(),
+import { z as z45 } from "@hono/zod-openapi";
+var RevisionMetaSchema = z45.object({
+  _id: z45.string(),
+  path: z45.string(),
   author: PageUserSchema.nullable().optional(),
   savedBy: PageUserSchema.nullable().optional(),
-  contributors: z44.array(PageUserSchema).optional(),
+  contributors: z45.array(PageUserSchema).optional(),
   // RFC-0010 — edit channel. `web` (browser / collab editor) vs the API
   // token paths (`oauth` / `pat`). Absent on pre-RFC-0010 revisions. The
   // history UI shows an "app" chip for the token paths.
-  editVia: z44.enum(["web", "oauth", "pat"]).optional(),
-  createdAt: z44.string()
+  editVia: z45.enum(["web", "oauth", "pat"]).optional(),
+  createdAt: z45.string()
 });
-var ListRevisionsRequestSchema = z44.object({
-  limit: z44.coerce.number().int().positive().max(200).optional().default(50),
-  offset: z44.coerce.number().int().min(0).optional().default(0)
+var ListRevisionsRequestSchema = z45.object({
+  limit: z45.coerce.number().int().positive().max(200).optional().default(50),
+  offset: z45.coerce.number().int().min(0).optional().default(0)
 });
-var ListRevisionsResponseSchema = z44.object({
-  revisions: z44.array(RevisionMetaSchema),
+var ListRevisionsResponseSchema = z45.object({
+  revisions: z45.array(RevisionMetaSchema),
   pager: PagerSchema
 });
-var GetRevisionResponseSchema = z44.object({
+var GetRevisionResponseSchema = z45.object({
   revision: RevisionSchema
 });
-var GetRevisionsRequestSchema = z44.object({
-  ids: z44.string().min(1, "ids is required")
+var GetRevisionsRequestSchema = z45.object({
+  ids: z45.string().min(1, "ids is required")
 });
-var GetRevisionsResponseSchema = z44.object({
-  revisions: z44.array(RevisionSchema)
+var GetRevisionsResponseSchema = z45.object({
+  revisions: z45.array(RevisionSchema)
 });
-var RevisionInvalidRequestErrorSchema = z44.object({
-  error: z44.object({
-    code: z44.literal("INVALID_REQUEST"),
-    message: z44.string()
+var RevisionInvalidRequestErrorSchema = z45.object({
+  error: z45.object({
+    code: z45.literal("INVALID_REQUEST"),
+    message: z45.string()
   })
 });
 
 // src/contracts/revision.ts
-var PageIdParamSchema = z45.object({ page_id: z45.string() });
-var RevisionIdParamSchema = z45.object({ id: z45.string() });
+var PageIdParamSchema = z46.object({ page_id: z46.string() });
+var RevisionIdParamSchema = z46.object({ id: z46.string() });
 var listRevisionsRoute = createRoute25({
   method: "get",
   path: "/pages/{page_id}/revisions",
@@ -5468,31 +5508,31 @@ var revisionRoutes = {
 import { createRoute as createRoute26 } from "@hono/zod-openapi";
 
 // src/schemas/admin-crypto.ts
-import { z as z46 } from "@hono/zod-openapi";
-var SensitiveConfigEntrySchema = z46.object({
-  ns: z46.string(),
-  key: z46.string(),
-  present: z46.boolean(),
-  encrypted: z46.boolean()
-});
-var CryptoStatusResponseSchema = z46.object({
+import { z as z47 } from "@hono/zod-openapi";
+var SensitiveConfigEntrySchema = z47.object({
+  ns: z47.string(),
+  key: z47.string(),
+  present: z47.boolean(),
+  encrypted: z47.boolean()
+});
+var CryptoStatusResponseSchema = z47.object({
   /** False when CROWI_ENCRYPTION_KEY is not configured — UI shows a setup hint. */
-  encryptionConfigured: z46.boolean(),
-  unencryptedCount: z46.number().int().min(0),
-  encryptedCount: z46.number().int().min(0),
-  entries: z46.array(SensitiveConfigEntrySchema)
+  encryptionConfigured: z47.boolean(),
+  unencryptedCount: z47.number().int().min(0),
+  encryptedCount: z47.number().int().min(0),
+  entries: z47.array(SensitiveConfigEntrySchema)
 });
-var ReencryptResponseSchema = z46.object({
-  rewritten: z46.number().int().min(0),
+var ReencryptResponseSchema = z47.object({
+  rewritten: z47.number().int().min(0),
   /** Already encrypted, skipped on this run. */
-  alreadyEncrypted: z46.number().int().min(0),
+  alreadyEncrypted: z47.number().int().min(0),
   /** Sensitive registry entries that had no row in the DB at all. */
-  missing: z46.number().int().min(0)
+  missing: z47.number().int().min(0)
 });
-var EncryptionNotConfiguredErrorSchema = z46.object({
-  error: z46.object({
-    code: z46.literal("ENCRYPTION_NOT_CONFIGURED"),
-    message: z46.string()
+var EncryptionNotConfiguredErrorSchema = z47.object({
+  error: z47.object({
+    code: z47.literal("ENCRYPTION_NOT_CONFIGURED"),
+    message: z47.string()
   })
 });
 
@@ -5560,30 +5600,30 @@ var adminCryptoRoutes = {
 import { createRoute as createRoute27 } from "@hono/zod-openapi";
 
 // src/schemas/search.ts
-import { z as z48 } from "@hono/zod-openapi";
-var SearchPageTypeSchema = z48.enum(["portal", "public", "user"]);
-var SearchPagesRequestSchema = z48.object({
-  q: z48.string().min(1),
-  tree: z48.string().optional(),
+import { z as z49 } from "@hono/zod-openapi";
+var SearchPageTypeSchema = z49.enum(["portal", "public", "user"]);
+var SearchPagesRequestSchema = z49.object({
+  q: z49.string().min(1),
+  tree: z49.string().optional(),
   type: SearchPageTypeSchema.optional(),
-  page: z48.coerce.number().int().min(1).default(1),
-  limit: z48.coerce.number().int().min(1).max(100).default(50)
-});
-var SearchHitSchema = z48.object({
-  pageId: z48.string(),
-  path: z48.string(),
-  score: z48.number().optional(),
-  snippet: z48.string().optional(),
-  bookmarkCount: z48.number(),
+  page: z49.coerce.number().int().min(1).default(1),
+  limit: z49.coerce.number().int().min(1).max(100).default(50)
+});
+var SearchHitSchema = z49.object({
+  pageId: z49.string(),
+  path: z49.string(),
+  score: z49.number().optional(),
+  snippet: z49.string().optional(),
+  bookmarkCount: z49.number(),
   page: PageSchema
 });
-var SearchPagesResponseSchema = z48.object({
-  meta: z48.object({
-    took: z48.number().optional(),
-    total: z48.number(),
-    results: z48.number()
+var SearchPagesResponseSchema = z49.object({
+  meta: z49.object({
+    took: z49.number().optional(),
+    total: z49.number(),
+    results: z49.number()
   }),
-  data: z48.array(SearchHitSchema)
+  data: z49.array(SearchHitSchema)
 });
 
 // src/contracts/search.ts
@@ -5624,53 +5664,53 @@ var searchRoutes = {
 };
 
 // src/contracts/token-auth.ts
-import { createRoute as createRoute28, z as z50 } from "@hono/zod-openapi";
+import { createRoute as createRoute28, z as z51 } from "@hono/zod-openapi";
 
 // src/schemas/auth.ts
-import { z as z49 } from "@hono/zod-openapi";
-var TokenAuthLoginRequestSchema = z49.object({
-  email: z49.string().email(),
-  password: z49.string().min(6)
-});
-var TokenAuthResponseSchema = z49.object({
-  accessToken: z49.string(),
-  refreshToken: z49.string(),
-  expiresIn: z49.number(),
+import { z as z50 } from "@hono/zod-openapi";
+var TokenAuthLoginRequestSchema = z50.object({
+  email: z50.string().email(),
+  password: z50.string().min(6)
+});
+var TokenAuthResponseSchema = z50.object({
+  accessToken: z50.string(),
+  refreshToken: z50.string(),
+  expiresIn: z50.number(),
   // seconds until expiration
-  user: z49.object({
-    id: z49.string(),
-    username: z49.string(),
-    email: z49.string().email(),
-    name: z49.string(),
-    image: z49.string().optional(),
-    admin: z49.boolean().optional()
+  user: z50.object({
+    id: z50.string(),
+    username: z50.string(),
+    email: z50.string().email(),
+    name: z50.string(),
+    image: z50.string().optional(),
+    admin: z50.boolean().optional()
   })
 });
-var RefreshTokenRequestSchema = z49.object({
-  refreshToken: z49.string()
+var RefreshTokenRequestSchema = z50.object({
+  refreshToken: z50.string()
 });
-var TokenAuthRegisterRequestSchema = z49.object({
-  username: z49.string(),
-  name: z49.string(),
-  email: z49.string().email(),
-  password: z49.string().min(6)
+var TokenAuthRegisterRequestSchema = z50.object({
+  username: UsernameSchema,
+  name: z50.string(),
+  email: z50.string().email(),
+  password: z50.string().min(6)
 });
-var RegisterPendingResponseSchema = z49.object({
-  status: z49.enum(["confirmation_required", "approval_required"])
+var RegisterPendingResponseSchema = z50.object({
+  status: z50.enum(["confirmation_required", "approval_required"])
 });
 
 // src/contracts/token-auth.ts
-var TokenLogoutResponseSchema = z50.object({ message: z50.string() });
-var TokenMeResponseSchema = z50.object({
-  user: z50.object({
-    id: z50.string(),
-    username: z50.string(),
-    email: z50.string().email(),
-    name: z50.string(),
-    image: z50.string().optional(),
-    status: z50.number(),
-    admin: z50.boolean().optional(),
-    createdAt: z50.string()
+var TokenLogoutResponseSchema = z51.object({ message: z51.string() });
+var TokenMeResponseSchema = z51.object({
+  user: z51.object({
+    id: z51.string(),
+    username: z51.string(),
+    email: z51.string().email(),
+    name: z51.string(),
+    image: z51.string().optional(),
+    status: z51.number(),
+    admin: z51.boolean().optional(),
+    createdAt: z51.string()
   })
 });
 var tokenLoginRoute = createRoute28({
@@ -5798,7 +5838,7 @@ var tokenLogoutRoute = createRoute28({
     body: {
       content: {
         "application/json": {
-          schema: z50.object({ refreshToken: z50.string().optional() })
+          schema: z51.object({ refreshToken: z51.string().optional() })
         }
       }
     }
@@ -5851,15 +5891,15 @@ var tokenAuthRoutes = {
 import { createRoute as createRoute29 } from "@hono/zod-openapi";
 
 // src/schemas/invite-accept.ts
-import { z as z51 } from "@hono/zod-openapi";
-var InviteAcceptRequestSchema = z51.object({
-  token: z51.string(),
-  username: z51.string().min(1),
-  name: z51.string().min(1),
-  password: z51.string().min(6)
+import { z as z52 } from "@hono/zod-openapi";
+var InviteAcceptRequestSchema = z52.object({
+  token: z52.string(),
+  username: UsernameSchema,
+  name: z52.string().min(1),
+  password: z52.string().min(6)
 });
-var InvitePreviewResponseSchema = z51.object({
-  email: z51.string().email()
+var InvitePreviewResponseSchema = z52.object({
+  email: z52.string().email()
 });
 
 // src/contracts/invite-accept.ts
@@ -5936,16 +5976,16 @@ var inviteAcceptRoutes = {
 import { createRoute as createRoute30 } from "@hono/zod-openapi";
 
 // src/schemas/password-reset.ts
-import { z as z52 } from "@hono/zod-openapi";
-var ForgotPasswordRequestSchema = z52.object({
-  email: z52.string().email()
+import { z as z53 } from "@hono/zod-openapi";
+var ForgotPasswordRequestSchema = z53.object({
+  email: z53.string().email()
 });
-var ForgotPasswordResponseSchema = z52.object({
-  ok: z52.literal(true)
+var ForgotPasswordResponseSchema = z53.object({
+  ok: z53.literal(true)
 });
-var ResetPasswordRequestSchema = z52.object({
-  token: z52.string(),
-  password: z52.string().min(6)
+var ResetPasswordRequestSchema = z53.object({
+  token: z53.string(),
+  password: z53.string().min(6)
 });
 
 // src/contracts/password-reset.ts
@@ -6040,12 +6080,12 @@ var passwordResetRoutes = {
 import { createRoute as createRoute31 } from "@hono/zod-openapi";
 
 // src/schemas/activation.ts
-import { z as z53 } from "@hono/zod-openapi";
-var ActivateRequestSchema = z53.object({
-  token: z53.string()
+import { z as z54 } from "@hono/zod-openapi";
+var ActivateRequestSchema = z54.object({
+  token: z54.string()
 });
-var ActivateValidationResponseSchema = z53.object({
-  ok: z53.literal(true)
+var ActivateValidationResponseSchema = z54.object({
+  ok: z54.literal(true)
 });
 
 // src/contracts/activation.ts
@@ -6110,14 +6150,14 @@ var activationRoutes = {
 import { createRoute as createRoute32 } from "@hono/zod-openapi";
 
 // src/schemas/email-change.ts
-import { z as z54 } from "@hono/zod-openapi";
-var ConfirmEmailChangeRequestSchema = z54.object({
-  token: z54.string()
+import { z as z55 } from "@hono/zod-openapi";
+var ConfirmEmailChangeRequestSchema = z55.object({
+  token: z55.string()
 });
-var ConfirmEmailChangeResponseSchema = z54.object({
-  ok: z54.literal(true),
+var ConfirmEmailChangeResponseSchema = z55.object({
+  ok: z55.literal(true),
   /** The newly-confirmed email address. */
-  email: z54.string().email()
+  email: z55.string().email()
 });
 
 // src/contracts/email-change.ts
@@ -6183,8 +6223,8 @@ var emailChangeRoutes = {
 };
 
 // src/contracts/user.ts
-import { createRoute as createRoute33, z as z55 } from "@hono/zod-openapi";
-var UsernameParamSchema = z55.object({ username: z55.string() });
+import { createRoute as createRoute33, z as z56 } from "@hono/zod-openapi";
+var UsernameParamSchema = z56.object({ username: z56.string() });
 var getUserPageRoute = createRoute33({
   method: "get",
   path: "/user/{username}",
@@ -6602,6 +6642,7 @@ var stubPendingUsersCount = { count: 0 };
 var stubListPlugins = { plugins: [] };
 var stubPluginConfig = { name: "", fields: [], values: {} };
 var stubUpdatePluginConfig = { ok: true, hotReloaded: false, reconfigureFailed: false };
+var stubPluginReadiness = { issues: [] };
 var stubClearRenderCache = { ok: true, clearedAt: "", removedCount: 0 };
 var appAuthMeUserChain = new OpenAPIHono().openapi(
   appRoutes.getAppInfoRoute,
@@ -6641,7 +6682,7 @@ var bookmarkBacklinkCommentRevisionChain = new OpenAPIHono().openapi(bookmarkRou
 var pageChain = new OpenAPIHono().openapi(pageRoutes.getPageRoute, (c) => c.json(stubPageWithRevision, 200)).openapi(pageRoutes.listPagesRoute, (c) => c.json(stubListPages, 200)).openapi(pageRoutes.listPageChildrenRoute, (c) => c.json(stubListPageChildren, 200)).openapi(pageRoutes.createPageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.updatePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.setPageGrantRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.seenPageRoute, (c) => c.json(stubSeenUsers, 200)).openapi(pageRoutes.getSeenUsersRoute, (c) => c.json(stubSeenUsers, 200)).openapi(pageRoutes.likePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.unlikePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.claimPageLinkAccessRoute, (c) => c.json({ ...stubPageWithRevision, granted: false }, 200)).openapi(pageRoutes.getWatchStatusRoute, (c) => c.json(stubWatchStatus, 200)).openapi(pageRoutes.setWatchStatusRoute, (c) => c.json(stubWatchStatus, 200)).openapi(pageRoutes.deletePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.revertDeletedPageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.revertToRevisionRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.renamePageRoute, (c) => c.json({ ...stubPageResponse, renamed_count: 1 }, 200)).openapi(pageRoutes.renameSubtreeRoute, (c) => c.json({ renamed_count: 0 }, 200)).openapi(pagePreviewRoutes.previewPageRoute, (c) => c.json(stubPreview, 200)).openapi(pageCollabRoutes.getYjsTokenRoute, (c) => c.json(stubWsToken, 200)).openapi(presenceRoutes.getPresenceTokenRoute, (c) => c.json(stubPresenceToken, 200)).openapi(presenceRoutes.getLikersRoute, (c) => c.json(stubLikers, 200));
 var lateContractApp = new OpenAPIHono().openapi(draftRoutes.createDraftRoute, (c) => c.json(stubCreateDraft, 201)).openapi(draftRoutes.listDraftsRoute, (c) => c.json(stubListDrafts, 200)).openapi(draftRoutes.cancelDraftRoute, (c) => c.json(stubCreateDraft, 200)).openapi(autocompleteRoutes.autocompleteUsersRoute, (c) => c.json(stubAutocomplete, 200)).openapi(autocompleteRoutes.autocompletePagesRoute, (c) => c.json(stubAutocomplete, 200)).openapi(attachmentRoutes.getAttachmentUsageRoute, (c) => c.json(stubAttachmentUsage, 200)).openapi(attachmentRoutes.listAttachmentsRoute, (c) => c.json(stubListAttachments, 200)).openapi(attachmentRoutes.addAttachmentRoute, (c) => c.json(stubAddAttachment, 200)).openapi(attachmentRoutes.uploadAttachmentRoute, (c) => c.json(stubUploadAttachment, 200)).openapi(attachmentRoutes.getAttachmentMetaRoute, (c) => c.json(stubAttachmentMeta, 200)).openapi(attachmentRoutes.removeAttachmentRoute, (c) => c.json(stubRemoveAttachment, 200)).openapi(searchRoutes.searchPagesRoute, (c) => c.json(stubSearchPages, 200)).openapi(adminCryptoRoutes.getCryptoStatusRoute, (c) => c.json(stubCryptoStatus, 200)).openapi(adminCryptoRoutes.reencryptAllRoute, (c) => c.json(stubReencrypt, 200)).openapi(notificationRoutes.listNotificationsRoute, (c) => c.json(stubListNotifications, 200)).openapi(notificationRoutes.markAllAsReadRoute, (c) => c.json(stubMarkAllAsRead, 200)).openapi(notificationRoutes.getNotificationsTokenRoute, (c) => c.json(stubNotificationsToken, 200)).openapi(notificationRoutes.getUnreadCountRoute, (c) => c.json(stubNotificationStatus, 200)).openapi(notificationRoutes.openNotificationRoute, (c) => c.json(stubOpenNotification, 200));
 var adminSettingsContractApp = new OpenAPIHono().openapi(adminAppRoutes.getAppSettingsRoute, (c) => c.json(stubGetAppSettings, 200)).openapi(adminAppRoutes.updateAppSettingsRoute, (c) => c.json(stubUpdateAppSettings, 200)).openapi(adminAuthRoutes.getAuthSettingsRoute, (c) => c.json(stubAuthSettings, 200)).openapi(adminAuthRoutes.updateAuthSettingsRoute, (c) => c.json(stubAuthSettings, 200)).openapi(adminSecurityRoutes.getSecuritySettingsRoute, (c) => c.json(stubSecuritySettings, 200)).openapi(adminSecurityRoutes.updateSecuritySettingsRoute, (c) => c.json(stubSecuritySettings, 200)).openapi(adminMailRoutes.getMailSettingsRoute, (c) => c.json(stubMailSettings, 200)).openapi(adminMailRoutes.updateMailSettingsRoute, (c) => c.json(stubUpdateMailSettings, 200)).openapi(adminMailRoutes.sendTestMailRoute, (c) => c.json(stubSendTestMail, 200)).openapi(adminStorageRoutes.getStorageStatusRoute, (c) => c.json(stubStorageStatus, 200)).openapi(adminSearchRoutes.getSearchStatusRoute, (c) => c.json(stubSearchStatus, 200));
-var adminUsersPluginsContractApp = new OpenAPIHono().openapi(adminUsersRoutes.listUsersRoute, (c) => c.json(stubListAdminUsers, 200)).openapi(adminUsersRoutes.searchUsersByEmailRoute, (c) => c.json(stubSearchAdminUsersByEmail, 200)).openapi(adminUsersRoutes.pendingUsersCountRoute, (c) => c.json(stubPendingUsersCount, 200)).openapi(adminUsersRoutes.inviteUsersRoute, (c) => c.json(stubInviteUsers, 200)).openapi(adminUsersRoutes.editUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.makeAdminRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.removeFromAdminRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.activateUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.suspendUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.resetPasswordRoute, (c) => c.json(stubResetPassword, 200)).openapi(adminUsersRoutes.resendInviteRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.updateUserEmailRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.deleteUserRoute, (c) => c.json(stubDeleteAdminUser, 200)).openapi(adminPluginsRoutes.listPluginsRoute, (c) => c.json(stubListPlugins, 200)).openapi(adminPluginsRoutes.getPluginConfigRoute, (c) => c.json(stubPluginConfig, 200)).openapi(adminPluginsRoutes.updatePluginConfigRoute, (c) => c.json(stubUpdatePluginConfig, 200)).openapi(adminPluginsRoutes.clearRenderCacheAllRoute, (c) => c.json(stubClearRenderCache, 200)).openapi(adminPluginsRoutes.clearRenderCachePluginRoute, (c) => c.json(stubClearRenderCache, 200));
+var adminUsersPluginsContractApp = new OpenAPIHono().openapi(adminUsersRoutes.listUsersRoute, (c) => c.json(stubListAdminUsers, 200)).openapi(adminUsersRoutes.searchUsersByEmailRoute, (c) => c.json(stubSearchAdminUsersByEmail, 200)).openapi(adminUsersRoutes.pendingUsersCountRoute, (c) => c.json(stubPendingUsersCount, 200)).openapi(adminUsersRoutes.inviteUsersRoute, (c) => c.json(stubInviteUsers, 200)).openapi(adminUsersRoutes.editUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.makeAdminRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.removeFromAdminRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.activateUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.suspendUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.resetPasswordRoute, (c) => c.json(stubResetPassword, 200)).openapi(adminUsersRoutes.resendInviteRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.updateUserEmailRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.deleteUserRoute, (c) => c.json(stubDeleteAdminUser, 200)).openapi(adminPluginsRoutes.listPluginsRoute, (c) => c.json(stubListPlugins, 200)).openapi(adminPluginsRoutes.getPluginConfigRoute, (c) => c.json(stubPluginConfig, 200)).openapi(adminPluginsRoutes.updatePluginConfigRoute, (c) => c.json(stubUpdatePluginConfig, 200)).openapi(adminPluginsRoutes.getPluginReadinessRoute, (c) => c.json(stubPluginReadiness, 200)).openapi(adminPluginsRoutes.clearRenderCacheAllRoute, (c) => c.json(stubClearRenderCache, 200)).openapi(adminPluginsRoutes.clearRenderCachePluginRoute, (c) => c.json(stubClearRenderCache, 200));
 var oauthContractApp = new OpenAPIHono().openapi(oauthRoutes.authorizeRoute, (c) => c.json(stubAuthorize, 200)).openapi(oauthRoutes.tokenRoute, (c) => c.json(stubToken, 200)).openapi(oauthRoutes.revokeRoute, (c) => c.json(stubRevoke, 200)).openapi(oauthRoutes.discoveryRoute, (c) => c.json(stubDiscovery, 200)).openapi(oauthRoutes.deviceAuthorizeRoute, (c) => c.json(stubDeviceAuthorize, 200)).openapi(oauthRoutes.deviceInfoRoute, (c) => c.json(stubDeviceInfo, 200)).openapi(oauthRoutes.deviceVerifyRoute, (c) => c.json(stubDeviceVerify, 200)).openapi(oauthRoutes.clientInfoRoute, (c) => c.json(stubClientInfo, 200));
 var createClient = (baseUrl, options = {}) => hc(baseUrl, {
   headers: options.headers,
@@ -6649,19 +6690,19 @@ var createClient = (baseUrl, options = {}) => hc(baseUrl, {
 });
 
 // src/schemas/mail-token.ts
-import { z as z56 } from "@hono/zod-openapi";
-var MailTokenPurposeSchema = z56.enum(["invite", "activate", "reset", "email-change"]);
-var MailTokenPayloadSchema = z56.object({
+import { z as z57 } from "@hono/zod-openapi";
+var MailTokenPurposeSchema = z57.enum(["invite", "activate", "reset", "email-change"]);
+var MailTokenPayloadSchema = z57.object({
   purpose: MailTokenPurposeSchema,
-  userId: z56.string(),
+  userId: z57.string(),
   /** Target address. For `email-change` this is the NEW address. */
-  email: z56.string().email(),
+  email: z57.string().email(),
   /**
    * For `email-change`: the account's email at issue time. The confirm
    * endpoint rejects the token unless it still matches, making the token
    * single-use (a stale token cannot revert a later change).
    */
-  fromEmail: z56.string().email().optional(),
+  fromEmail: z57.string().email().optional(),
   /**
    * For `reset`: the account's `passwordResetGeneration` at issue time.
    * Consuming the link increments that counter, so the token only matches
@@ -6670,7 +6711,7 @@ var MailTokenPayloadSchema = z56.object({
    * schema because the other purposes don't carry it (and links minted
    * before the claim existed simply no longer match).
    */
-  resetGeneration: z56.number().int().nonnegative().optional(),
+  resetGeneration: z57.number().int().nonnegative().optional(),
   /**
    * For `email-change`: the account's `authVersion` at issue time. The
    * confirm endpoint requires it to still match, so a pending address change
@@ -6682,10 +6723,22 @@ var MailTokenPayloadSchema = z56.object({
    * semantics wanted are exactly "the session that asked for this is gone",
    * and that is what every bump of it already means.
    */
-  authVersion: z56.number().int().nonnegative().optional(),
+  authVersion: z57.number().int().nonnegative().optional(),
+  /**
+   * For `email-change`: the account's `emailChangeGeneration` at issue time.
+   * Requesting a change increments it, so asking for a different address
+   * supersedes any link still pending — which is what lets a user call off a
+   * change they did not want (one an attacker started with a stolen session,
+   * or one sent to a mistyped address). `authVersion` cannot serve this: it
+   * means "the session that asked is gone", and bumping it on a mere request
+   * would log the user out of their own account for editing their profile.
+   * Optional in the schema for the same reason as the others — links minted
+   * before the claim existed simply no longer match.
+   */
+  emailChangeGeneration: z57.number().int().nonnegative().optional(),
   // iat / exp are injected and verified by the JWT layer.
-  iat: z56.number().optional(),
-  exp: z56.number().optional()
+  iat: z57.number().optional(),
+  exp: z57.number().optional()
 });
 
 // src/util/html-elements.ts
@@ -7057,6 +7110,9 @@ export {
   PluginFieldSchema,
   PluginInfoSchema,
   PluginNotFoundErrorSchema,
+  PluginReadinessFieldSchema,
+  PluginReadinessIssueSchema,
+  PluginReadinessResponseSchema,
   PresenceClientMessageSchema,
   PresenceCommentChangedMessageSchema,
   PresenceHeartbeatMessageSchema,
@@ -7168,6 +7224,7 @@ export {
   UserStatusErrorSchema,
   UserStatusSchema,
   UserSubpagesRequestSchema,
+  UsernameSchema,
   ValidationErrorSchema,
   WS_CLOSE_CODES,
   WatchStatusResponseSchema,
@@ -7238,6 +7295,7 @@ export {
   getNotificationsTokenRoute,
   getPageRoute,
   getPluginConfigRoute,
+  getPluginReadinessRoute,
   getPresenceTokenRoute,
   getProfileRoute,
   getRevisionRoute,