@crowi/api-contract 2.0.0-alpha.11 → 2.0.0-alpha.13

package/dist/index.js

@@ -78,6 +78,8 @@ __export(index_exports, {
   CommentInvalidRequestErrorSchema: () => CommentInvalidRequestErrorSchema,
   CommentNotFoundErrorSchema: () => CommentNotFoundErrorSchema,
   CommentSchema: () => CommentSchema,
+  ConfigReadinessIssueSchema: () => ConfigReadinessIssueSchema,
+  ConfigReadinessResponseSchema: () => ConfigReadinessResponseSchema,
   ConfirmEmailChangeRequestSchema: () => ConfirmEmailChangeRequestSchema,
   ConfirmEmailChangeResponseSchema: () => ConfirmEmailChangeResponseSchema,
   ConflictErrorSchema: () => ConflictErrorSchema,
@@ -88,6 +90,8 @@ __export(index_exports, {
   CreateAdminResponseSchema: () => CreateAdminResponseSchema,
   CreateDraftRequestSchema: () => CreateDraftRequestSchema,
   CreateDraftResponseSchema: () => CreateDraftResponseSchema,
+  CreateLinkGrantRequestSchema: () => CreateLinkGrantRequestSchema,
+  CreateLinkGrantResponseSchema: () => CreateLinkGrantResponseSchema,
   CreatePageRequestSchema: () => CreatePageRequestSchema,
   CrowiCodeSidecarSchema: () => CrowiCodeSidecarSchema,
   CrowiDiagramNodeSchema: () => CrowiDiagramNodeSchema,
@@ -123,6 +127,14 @@ __export(index_exports, {
   EditAdminUserRequestSchema: () => EditAdminUserRequestSchema,
   EncryptionNotConfiguredErrorSchema: () => EncryptionNotConfiguredErrorSchema,
   ErrorCodeSchema: () => ErrorCodeSchema,
+  FederatedHandoffRequestSchema: () => FederatedHandoffRequestSchema,
+  FederatedHandoffResponseSchema: () => FederatedHandoffResponseSchema,
+  FederatedProviderSchema: () => FederatedProviderSchema,
+  FederatedRegistrationActiveResultSchema: () => FederatedRegistrationActiveResultSchema,
+  FederatedRegistrationApprovalResultSchema: () => FederatedRegistrationApprovalResultSchema,
+  FederatedRegistrationResultSchema: () => FederatedRegistrationResultSchema,
+  FederatedRegistrationSnapshotSchema: () => FederatedRegistrationSnapshotSchema,
+  FederatedRegistrationSubmitRequestSchema: () => FederatedRegistrationSubmitRequestSchema,
   ForbiddenErrorSchema: () => ForbiddenErrorSchema,
   ForgotPasswordRequestSchema: () => ForgotPasswordRequestSchema,
   ForgotPasswordResponseSchema: () => ForgotPasswordResponseSchema,
@@ -164,6 +176,7 @@ __export(index_exports, {
   LanguageSchema: () => LanguageSchema,
   LikerSchema: () => LikerSchema,
   LikersResponseSchema: () => LikersResponseSchema,
+  LinkedAuthProviderListResponseSchema: () => LinkedAuthProviderListResponseSchema,
   ListAccessTokensResponseSchema: () => ListAccessTokensResponseSchema,
   ListAdminUsersRequestSchema: () => ListAdminUsersRequestSchema,
   ListAdminUsersResponseSchema: () => ListAdminUsersResponseSchema,
@@ -235,6 +248,7 @@ __export(index_exports, {
   PluginFieldSchema: () => PluginFieldSchema,
   PluginInfoSchema: () => PluginInfoSchema,
   PluginNotFoundErrorSchema: () => PluginNotFoundErrorSchema,
+  PluginReadinessFieldSchema: () => PluginReadinessFieldSchema,
   PresenceClientMessageSchema: () => PresenceClientMessageSchema,
   PresenceCommentChangedMessageSchema: () => PresenceCommentChangedMessageSchema,
   PresenceHeartbeatMessageSchema: () => PresenceHeartbeatMessageSchema,
@@ -247,6 +261,7 @@ __export(index_exports, {
   PreviewPageRequestSchema: () => PreviewPageRequestSchema,
   PreviewPageResponseSchema: () => PreviewPageResponseSchema,
   ProfileErrorResponseSchema: () => ProfileErrorResponseSchema,
+  ProviderListResponseSchema: () => ProviderListResponseSchema,
   RENDERED_AST_NODE_DEFS: () => RENDERED_AST_NODE_DEFS,
   RecentlyViewedPagesResponseSchema: () => RecentlyViewedPagesResponseSchema,
   ReencryptResponseSchema: () => ReencryptResponseSchema,
@@ -295,6 +310,8 @@ __export(index_exports, {
   SendTestMailErrorSchema: () => SendTestMailErrorSchema,
   SendTestMailRequestSchema: () => SendTestMailRequestSchema,
   SendTestMailResponseSchema: () => SendTestMailResponseSchema,
+  SenderProofSchema: () => SenderProofSchema,
+  SenderPublicJwkSchema: () => SenderPublicJwkSchema,
   SensitiveConfigEntrySchema: () => SensitiveConfigEntrySchema,
   ServiceUnavailableErrorSchema: () => ServiceUnavailableErrorSchema,
   SetPageGrantRequestSchema: () => SetPageGrantRequestSchema,
@@ -315,6 +332,7 @@ __export(index_exports, {
   TokenRequestSchema: () => TokenRequestSchema,
   TokenResponseSchema: () => TokenResponseSchema,
   UPLOAD_ALLOWED_MIME: () => UPLOAD_ALLOWED_MIME,
+  UnlinkAuthProviderErrorSchema: () => UnlinkAuthProviderErrorSchema,
   UpdateAdminUserEmailRequestSchema: () => UpdateAdminUserEmailRequestSchema,
   UpdateAppSettingsRequestSchema: () => UpdateAppSettingsRequestSchema,
   UpdateAppSettingsResponseSchema: () => UpdateAppSettingsResponseSchema,
@@ -346,6 +364,7 @@ __export(index_exports, {
   UserStatusErrorSchema: () => UserStatusErrorSchema,
   UserStatusSchema: () => UserStatusSchema,
   UserSubpagesRequestSchema: () => UserSubpagesRequestSchema,
+  UsernameSchema: () => UsernameSchema,
   ValidationErrorSchema: () => ValidationErrorSchema,
   WS_CLOSE_CODES: () => WS_CLOSE_CODES,
   WatchStatusResponseSchema: () => WatchStatusResponseSchema,
@@ -377,6 +396,7 @@ __export(index_exports, {
   autocompleteUsersRoute: () => autocompleteUsersRoute,
   backlinkRoutes: () => backlinkRoutes,
   bookmarkRoutes: () => bookmarkRoutes,
+  callbackFederatedProviderRoute: () => callbackFederatedProviderRoute,
   cancelDraftRoute: () => cancelDraftRoute,
   claimPageLinkAccessRoute: () => claimPageLinkAccessRoute,
   clearRenderCacheAllRoute: () => clearRenderCacheAllRoute,
@@ -386,6 +406,7 @@ __export(index_exports, {
   confirmEmailChangeRoute: () => confirmEmailChangeRoute,
   createAccessTokenRoute: () => createAccessTokenRoute,
   createAdminRoute: () => createAdminRoute,
+  createAuthProviderLinkGrantRoute: () => createAuthProviderLinkGrantRoute,
   createClient: () => createClient,
   createDraftRoute: () => createDraftRoute,
   createPageRoute: () => createPageRoute,
@@ -401,6 +422,9 @@ __export(index_exports, {
   draftRoutes: () => draftRoutes,
   editUserRoute: () => editUserRoute,
   emailChangeRoutes: () => emailChangeRoutes,
+  federatedAuthRoutes: () => federatedAuthRoutes,
+  federatedHandoffRoute: () => federatedHandoffRoute,
+  federatedRegistrationRoutes: () => federatedRegistrationRoutes,
   forgotPasswordRoute: () => forgotPasswordRoute,
   getAppInfoRoute: () => getAppInfoRoute,
   getAppSettingsRoute: () => getAppSettingsRoute,
@@ -410,12 +434,14 @@ __export(index_exports, {
   getBacklinksRoute: () => getBacklinksRoute,
   getBookmarkRoute: () => getBookmarkRoute,
   getCryptoStatusRoute: () => getCryptoStatusRoute,
+  getFederatedRegistrationRoute: () => getFederatedRegistrationRoute,
   getInstallerStatusRoute: () => getInstallerStatusRoute,
   getLikersRoute: () => getLikersRoute,
   getMailSettingsRoute: () => getMailSettingsRoute,
   getNotificationsTokenRoute: () => getNotificationsTokenRoute,
   getPageRoute: () => getPageRoute,
   getPluginConfigRoute: () => getPluginConfigRoute,
+  getPluginReadinessRoute: () => getPluginReadinessRoute,
   getPresenceTokenRoute: () => getPresenceTokenRoute,
   getProfileRoute: () => getProfileRoute,
   getRevisionRoute: () => getRevisionRoute,
@@ -442,6 +468,8 @@ __export(index_exports, {
   listAttachmentsRoute: () => listAttachmentsRoute,
   listCommentsRoute: () => listCommentsRoute,
   listDraftsRoute: () => listDraftsRoute,
+  listFederatedProvidersRoute: () => listFederatedProvidersRoute,
+  listLinkedAuthProvidersRoute: () => listLinkedAuthProvidersRoute,
   listMembersRoute: () => listMembersRoute,
   listMyBookmarksRoute: () => listMyBookmarksRoute,
   listNotificationsRoute: () => listNotificationsRoute,
@@ -450,6 +478,7 @@ __export(index_exports, {
   listPluginsRoute: () => listPluginsRoute,
   listRevisionsRoute: () => listRevisionsRoute,
   listUsersRoute: () => listUsersRoute,
+  logoutFederatedRegistrationRoute: () => logoutFederatedRegistrationRoute,
   makeAdminRoute: () => makeAdminRoute,
   markAllAsReadRoute: () => markAllAsReadRoute,
   meRoutes: () => meRoutes,
@@ -486,7 +515,9 @@ __export(index_exports, {
   sendTestMailRoute: () => sendTestMailRoute,
   setPageGrantRoute: () => setPageGrantRoute,
   setWatchStatusRoute: () => setWatchStatusRoute,
+  startFederatedProviderRoute: () => startFederatedProviderRoute,
   stripKnownHtmlTags: () => stripKnownHtmlTags,
+  submitFederatedRegistrationRoute: () => submitFederatedRegistrationRoute,
   suspendUserRoute: () => suspendUserRoute,
   tokenAuthRoutes: () => tokenAuthRoutes,
   tokenLoginRoute: () => tokenLoginRoute,
@@ -496,6 +527,7 @@ __export(index_exports, {
   tokenRegisterRoute: () => tokenRegisterRoute,
   tokenRoute: () => tokenRoute,
   unlikePageRoute: () => unlikePageRoute,
+  unlinkAuthProviderRoute: () => unlinkAuthProviderRoute,
   unwrapRenderedAst: () => unwrapRenderedAst,
   updateAppSettingsRoute: () => updateAppSettingsRoute,
   updateAuthSettingsRoute: () => updateAuthSettingsRoute,
@@ -517,7 +549,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/client.ts
-var import_zod_openapi74 = require("@hono/zod-openapi");
+var import_zod_openapi79 = require("@hono/zod-openapi");
 var import_client = require("hono/client");
 
 // src/contracts/admin/app.ts
@@ -623,8 +655,12 @@ var ERROR_CODES = [
   "INVALID_CREDENTIALS",
   "REFRESH_TOKEN_REQUIRED",
   "REGISTRATION_CLOSED",
+  // --- federated sign-in (RFC-0014) ---
+  "FEDERATED_HANDOFF_INVALID",
+  "FEDERATED_HANDOFF_CONSUMED",
   // --- admin subsystems ---
   "ENCRYPTION_NOT_CONFIGURED",
+  "MAIL_FROM_NOT_CONFIGURED",
   "MAIL_TEST_FAILED",
   "PLUGIN_NOT_FOUND",
   "PLUGIN_CONFIG_VALIDATION_FAILED"
@@ -905,10 +941,16 @@ var SendTestMailResponseSchema = import_zod_openapi7.z.object({
   to: import_zod_openapi7.z.string()
 });
 var SendTestMailErrorSchema = import_zod_openapi7.z.object({
-  error: import_zod_openapi7.z.object({
-    code: import_zod_openapi7.z.literal("MAIL_TEST_FAILED"),
-    message: import_zod_openapi7.z.string()
-  })
+  error: import_zod_openapi7.z.discriminatedUnion("code", [
+    import_zod_openapi7.z.object({
+      code: import_zod_openapi7.z.literal("MAIL_FROM_NOT_CONFIGURED"),
+      message: import_zod_openapi7.z.literal("The mail sender address is not configured.")
+    }),
+    import_zod_openapi7.z.object({
+      code: import_zod_openapi7.z.literal("MAIL_TEST_FAILED"),
+      message: import_zod_openapi7.z.enum(["Failed to send the test email. Check the active mail sender configuration.", "No email address on the calling user"])
+    })
+  ])
 });
 var MailSettingsValidationErrorSchema = import_zod_openapi7.z.object({
   bodyResult: import_zod_openapi7.z.object({
@@ -1021,7 +1063,7 @@ var sendTestMailRoute = (0, import_zod_openapi8.createRoute)({
       content: { "application/json": { schema: AdminRequiredErrorSchema } }
     },
     502: {
-      description: "Test mail dispatch failed (SMTP error)",
+      description: "Test mail dispatch failed (mail dispatch failure \u2014 e.g. sender/transport error, or the mail sender address is not configured)",
       content: { "application/json": { schema: SendTestMailErrorSchema } }
     }
   }
@@ -1167,6 +1209,21 @@ var ClearRenderCacheResponseSchema = import_zod_openapi9.z.object({
   /** Number of cache rows removed. */
   removedCount: import_zod_openapi9.z.number().int().min(0)
 });
+var PluginReadinessFieldSchema = import_zod_openapi9.z.object({
+  name: import_zod_openapi9.z.string(),
+  configured: import_zod_openapi9.z.literal(false)
+});
+var ConfigReadinessIssueSchema = import_zod_openapi9.z.object({
+  /** Stable id — `plugin:<name>` or a core declaration id (e.g. `core:mail`). */
+  id: import_zod_openapi9.z.string(),
+  source: import_zod_openapi9.z.enum(["plugin", "core"]),
+  label: import_zod_openapi9.z.string(),
+  href: import_zod_openapi9.z.string(),
+  fields: import_zod_openapi9.z.array(PluginReadinessFieldSchema)
+});
+var ConfigReadinessResponseSchema = import_zod_openapi9.z.object({
+  issues: import_zod_openapi9.z.array(ConfigReadinessIssueSchema)
+});
 
 // src/contracts/admin/plugins.ts
 var PluginNameQuerySchema = import_zod_openapi10.z.object({ name: import_zod_openapi10.z.string() });
@@ -1298,6 +1355,27 @@ var clearRenderCacheAllRoute = (0, import_zod_openapi10.createRoute)({
     }
   }
 });
+var getPluginReadinessRoute = (0, import_zod_openapi10.createRoute)({
+  method: "get",
+  path: "/admin/plugins/readiness",
+  tags: ["admin.plugins"],
+  security: [{ bearerAuth: [] }],
+  summary: "List active plugins and core config missing required readiness fields",
+  responses: {
+    200: {
+      description: "Readiness issues for active plugins and core config (empty when everything is configured)",
+      content: { "application/json": { schema: ConfigReadinessResponseSchema } }
+    },
+    401: {
+      description: "Authentication required",
+      content: { "application/json": { schema: AuthenticationRequiredErrorSchema } }
+    },
+    403: {
+      description: "Admin permission required",
+      content: { "application/json": { schema: AdminRequiredErrorSchema } }
+    }
+  }
+});
 var clearRenderCachePluginRoute = (0, import_zod_openapi10.createRoute)({
   method: "post",
   path: "/admin/plugins/render-cache/clear-plugin",
@@ -1337,6 +1415,7 @@ var adminPluginsRoutes = {
   listPluginsRoute,
   getPluginConfigRoute,
   updatePluginConfigRoute,
+  getPluginReadinessRoute,
   clearRenderCacheAllRoute,
   clearRenderCachePluginRoute
 };
@@ -3889,29 +3968,35 @@ var draftRoutes = {
 };
 
 // src/contracts/installer.ts
-var import_zod_openapi41 = require("@hono/zod-openapi");
+var import_zod_openapi42 = require("@hono/zod-openapi");
 
 // src/schemas/installer.ts
+var import_zod_openapi41 = require("@hono/zod-openapi");
+
+// src/schemas/username.ts
 var import_zod_openapi40 = require("@hono/zod-openapi");
-var InstallerStatusResponseSchema = import_zod_openapi40.z.object({
-  status: import_zod_openapi40.z.enum(["installer_required", "already_installed"])
-});
-var CreateAdminRequestSchema = import_zod_openapi40.z.object({
-  registerForm: import_zod_openapi40.z.object({
-    username: import_zod_openapi40.z.string().min(1).regex(/^[\da-zA-Z\-_.]+$/, "username may only contain letters, digits, hyphens, underscores, and dots"),
-    name: import_zod_openapi40.z.string().min(1),
-    email: import_zod_openapi40.z.string().email(),
-    password: import_zod_openapi40.z.string().min(6).regex(/^[\x20-\x7F]{6,}$/, "password must be 6+ printable ASCII characters")
+var UsernameSchema = import_zod_openapi40.z.string().min(1).max(64).regex(/^[A-Za-z0-9_-]+$/, "username may only contain letters, digits, hyphens, and underscores");
+
+// src/schemas/installer.ts
+var InstallerStatusResponseSchema = import_zod_openapi41.z.object({
+  status: import_zod_openapi41.z.enum(["installer_required", "already_installed"])
+});
+var CreateAdminRequestSchema = import_zod_openapi41.z.object({
+  registerForm: import_zod_openapi41.z.object({
+    username: UsernameSchema,
+    name: import_zod_openapi41.z.string().min(1),
+    email: import_zod_openapi41.z.string().email(),
+    password: import_zod_openapi41.z.string().min(6).regex(/^[\x20-\x7F]{6,}$/, "password must be 6+ printable ASCII characters")
   })
 });
-var CreateAdminResponseSchema = import_zod_openapi40.z.object({
-  status: import_zod_openapi40.z.enum(["ok", "error"]),
-  message: import_zod_openapi40.z.string().optional(),
-  errors: import_zod_openapi40.z.array(import_zod_openapi40.z.string()).optional()
+var CreateAdminResponseSchema = import_zod_openapi41.z.object({
+  status: import_zod_openapi41.z.enum(["ok", "error"]),
+  message: import_zod_openapi41.z.string().optional(),
+  errors: import_zod_openapi41.z.array(import_zod_openapi41.z.string()).optional()
 });
 
 // src/contracts/installer.ts
-var getInstallerStatusRoute = (0, import_zod_openapi41.createRoute)({
+var getInstallerStatusRoute = (0, import_zod_openapi42.createRoute)({
   method: "get",
   path: "/installer",
   tags: ["installer"],
@@ -3935,7 +4020,7 @@ var getInstallerStatusRoute = (0, import_zod_openapi41.createRoute)({
     }
   }
 });
-var createAdminRoute = (0, import_zod_openapi41.createRoute)({
+var createAdminRoute = (0, import_zod_openapi42.createRoute)({
   method: "post",
   path: "/installer/createAdmin",
   tags: ["installer"],
@@ -3979,88 +4064,101 @@ var createAdminRoute = (0, import_zod_openapi41.createRoute)({
 var installerRoutes = { getInstallerStatusRoute, createAdminRoute };
 
 // src/contracts/me.ts
-var import_zod_openapi43 = require("@hono/zod-openapi");
+var import_zod_openapi44 = require("@hono/zod-openapi");
 
 // src/schemas/me.ts
-var import_zod_openapi42 = require("@hono/zod-openapi");
-var LanguageSchema = import_zod_openapi42.z.enum(["en", "ja"]);
-var ThemeSchema = import_zod_openapi42.z.enum(["system", "light", "dark"]);
-var UserProfileResponseSchema = import_zod_openapi42.z.object({
-  id: import_zod_openapi42.z.string(),
-  username: import_zod_openapi42.z.string(),
-  name: import_zod_openapi42.z.string(),
-  email: import_zod_openapi42.z.string().email(),
+var import_zod_openapi43 = require("@hono/zod-openapi");
+var LanguageSchema = import_zod_openapi43.z.enum(["en", "ja"]);
+var ThemeSchema = import_zod_openapi43.z.enum(["system", "light", "dark"]);
+var UserProfileResponseSchema = import_zod_openapi43.z.object({
+  id: import_zod_openapi43.z.string(),
+  username: import_zod_openapi43.z.string(),
+  name: import_zod_openapi43.z.string(),
+  email: import_zod_openapi43.z.string().email(),
   lang: LanguageSchema,
   theme: ThemeSchema,
-  image: import_zod_openapi42.z.string().nullable(),
-  introduction: import_zod_openapi42.z.string().optional(),
-  hasPassword: import_zod_openapi42.z.boolean(),
-  createdAt: import_zod_openapi42.z.string(),
+  image: import_zod_openapi43.z.string().nullable(),
+  introduction: import_zod_openapi43.z.string().optional(),
+  hasPassword: import_zod_openapi43.z.boolean(),
+  createdAt: import_zod_openapi43.z.string(),
+  /**
+   * True when the account has at least one linked federated identity
+   * (`UserIdentity` row). The email address on a federated account is
+   * fixed to the value the identity provider verified — `PUT /me`
+   * refuses a change and returns `EMAIL_LOCKED_BY_FEDERATED_IDENTITY`
+   * when this is true and a different email is submitted. The web uses
+   * this to disable the email field and point to the Security tab.
+   *
+   * Always reflects the account's current state — on `GET /me` and on
+   * every 200 from `PUT /me`, including a `PUT` that changed only name /
+   * lang.
+   */
+  federated: import_zod_openapi43.z.boolean(),
   /**
    * True when the profile update requested a new email that is awaiting
    * confirmation: the stored `email` is unchanged and a confirmation
    * link was sent to the new address.
    */
-  emailChangePending: import_zod_openapi42.z.boolean().optional()
+  emailChangePending: import_zod_openapi43.z.boolean().optional()
 });
-var UpdateProfileRequestSchema = import_zod_openapi42.z.object({
-  userForm: import_zod_openapi42.z.object({
-    name: import_zod_openapi42.z.string().min(1, "Name is required"),
-    email: import_zod_openapi42.z.string().email("Invalid email format"),
+var UpdateProfileRequestSchema = import_zod_openapi43.z.object({
+  userForm: import_zod_openapi43.z.object({
+    name: import_zod_openapi43.z.string().min(1, "Name is required"),
+    email: import_zod_openapi43.z.string().email("Invalid email format"),
     lang: LanguageSchema
   })
 });
-var UpdateThemeRequestSchema = import_zod_openapi42.z.object({
+var UpdateThemeRequestSchema = import_zod_openapi43.z.object({
   theme: ThemeSchema
 });
-var ThemeUpdateResponseSchema = import_zod_openapi42.z.object({
-  status: import_zod_openapi42.z.literal("ok"),
+var ThemeUpdateResponseSchema = import_zod_openapi43.z.object({
+  status: import_zod_openapi43.z.literal("ok"),
   theme: ThemeSchema
 });
-var PictureUploadResponseSchema = import_zod_openapi42.z.object({
-  status: import_zod_openapi42.z.boolean(),
-  url: import_zod_openapi42.z.string().optional(),
-  message: import_zod_openapi42.z.string().optional()
+var PictureUploadResponseSchema = import_zod_openapi43.z.object({
+  status: import_zod_openapi43.z.boolean(),
+  url: import_zod_openapi43.z.string().optional(),
+  message: import_zod_openapi43.z.string().optional()
 });
-var SuccessResponseSchema = import_zod_openapi42.z.object({
-  status: import_zod_openapi42.z.literal("ok"),
-  message: import_zod_openapi42.z.string().optional()
+var SuccessResponseSchema = import_zod_openapi43.z.object({
+  status: import_zod_openapi43.z.literal("ok"),
+  message: import_zod_openapi43.z.string().optional()
 });
-var ProfileErrorResponseSchema = import_zod_openapi42.z.object({
-  status: import_zod_openapi42.z.literal("error"),
+var ProfileErrorResponseSchema = import_zod_openapi43.z.object({
+  status: import_zod_openapi43.z.literal("error"),
   /** Stable code so the web can localize the message (e.g. EMAIL_TAKEN). */
-  code: import_zod_openapi42.z.string().optional(),
-  message: import_zod_openapi42.z.string().optional(),
-  errors: import_zod_openapi42.z.array(import_zod_openapi42.z.string()).optional()
+  code: import_zod_openapi43.z.string().optional(),
+  message: import_zod_openapi43.z.string().optional(),
+  errors: import_zod_openapi43.z.array(import_zod_openapi43.z.string()).optional()
 });
 var PASSWORD_REGEX = /^(?=.*[a-zA-Z])(?=.*\d)(?=.*[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?`~])[a-zA-Z\d!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?`~]+$/;
-var UpdatePasswordRequestSchema = import_zod_openapi42.z.object({
-  oldPassword: import_zod_openapi42.z.string().optional(),
-  newPassword: import_zod_openapi42.z.string().min(8, "Password must be at least 8 characters").max(100, "Password must be at most 100 characters").regex(PASSWORD_REGEX, "Password must contain at least one letter, one digit, and one special character"),
-  newPasswordConfirm: import_zod_openapi42.z.string()
+var UpdatePasswordRequestSchema = import_zod_openapi43.z.object({
+  oldPassword: import_zod_openapi43.z.string().optional(),
+  newPassword: import_zod_openapi43.z.string().min(8, "Password must be at least 8 characters").max(100, "Password must be at most 100 characters").regex(PASSWORD_REGEX, "Password must contain at least one letter, one digit, and one special character"),
+  newPasswordConfirm: import_zod_openapi43.z.string()
 }).refine((data) => data.newPassword === data.newPasswordConfirm, {
   message: "Passwords do not match",
   path: ["newPasswordConfirm"]
 });
-var PasswordUpdateSuccessSchema = import_zod_openapi42.z.object({
-  status: import_zod_openapi42.z.literal("ok"),
-  message: import_zod_openapi42.z.string(),
-  accessToken: import_zod_openapi42.z.string(),
-  refreshToken: import_zod_openapi42.z.string(),
+var PasswordUpdateSuccessSchema = import_zod_openapi43.z.object({
+  status: import_zod_openapi43.z.literal("ok"),
+  message: import_zod_openapi43.z.string(),
+  accessToken: import_zod_openapi43.z.string(),
+  refreshToken: import_zod_openapi43.z.string(),
   /** Access-token lifetime in seconds. */
-  expiresIn: import_zod_openapi42.z.number()
+  expiresIn: import_zod_openapi43.z.number()
 });
-var PasswordErrorResponseSchema = import_zod_openapi42.z.object({
-  status: import_zod_openapi42.z.literal("error"),
-  message: import_zod_openapi42.z.string(),
-  errors: import_zod_openapi42.z.array(import_zod_openapi42.z.string()).optional()
+var PasswordErrorResponseSchema = import_zod_openapi43.z.object({
+  status: import_zod_openapi43.z.literal("error"),
+  message: import_zod_openapi43.z.string(),
+  errors: import_zod_openapi43.z.array(import_zod_openapi43.z.string()).optional()
 });
-var RecentlyViewedPagesResponseSchema = import_zod_openapi42.z.object({
-  pages: import_zod_openapi42.z.array(PageSchema)
+var RecentlyViewedPagesResponseSchema = import_zod_openapi43.z.object({
+  pages: import_zod_openapi43.z.array(PageSchema)
 });
 
 // src/contracts/me.ts
-var getProfileRoute = (0, import_zod_openapi43.createRoute)({
+var getProfileRoute = (0, import_zod_openapi44.createRoute)({
   method: "get",
   path: "/me",
   tags: ["me"],
@@ -4077,7 +4175,7 @@ var getProfileRoute = (0, import_zod_openapi43.createRoute)({
     }
   }
 });
-var updateProfileRoute = (0, import_zod_openapi43.createRoute)({
+var updateProfileRoute = (0, import_zod_openapi44.createRoute)({
   method: "put",
   path: "/me",
   tags: ["me"],
@@ -4103,7 +4201,7 @@ var updateProfileRoute = (0, import_zod_openapi43.createRoute)({
     }
   }
 });
-var updateThemeRoute = (0, import_zod_openapi43.createRoute)({
+var updateThemeRoute = (0, import_zod_openapi44.createRoute)({
   method: "patch",
   path: "/me/theme",
   tags: ["me"],
@@ -4129,7 +4227,7 @@ var updateThemeRoute = (0, import_zod_openapi43.createRoute)({
     }
   }
 });
-var uploadPictureRoute = (0, import_zod_openapi43.createRoute)({
+var uploadPictureRoute = (0, import_zod_openapi44.createRoute)({
   method: "post",
   path: "/me/picture",
   tags: ["me"],
@@ -4139,8 +4237,8 @@ var uploadPictureRoute = (0, import_zod_openapi43.createRoute)({
     body: {
       content: {
         "multipart/form-data": {
-          schema: import_zod_openapi43.z.object({
-            file: import_zod_openapi43.z.any().optional().describe("Profile picture file")
+          schema: import_zod_openapi44.z.object({
+            file: import_zod_openapi44.z.any().optional().describe("Profile picture file")
           })
         }
       }
@@ -4161,7 +4259,7 @@ var uploadPictureRoute = (0, import_zod_openapi43.createRoute)({
     }
   }
 });
-var deletePictureRoute = (0, import_zod_openapi43.createRoute)({
+var deletePictureRoute = (0, import_zod_openapi44.createRoute)({
   method: "delete",
   path: "/me/picture",
   tags: ["me"],
@@ -4182,7 +4280,7 @@ var deletePictureRoute = (0, import_zod_openapi43.createRoute)({
     }
   }
 });
-var updatePasswordRoute = (0, import_zod_openapi43.createRoute)({
+var updatePasswordRoute = (0, import_zod_openapi44.createRoute)({
   method: "put",
   path: "/me/password",
   tags: ["me"],
@@ -4208,7 +4306,7 @@ var updatePasswordRoute = (0, import_zod_openapi43.createRoute)({
     }
   }
 });
-var recentlyViewedPagesRoute = (0, import_zod_openapi43.createRoute)({
+var recentlyViewedPagesRoute = (0, import_zod_openapi44.createRoute)({
   method: "get",
   path: "/me/recently-viewed-pages",
   tags: ["me"],
@@ -4240,43 +4338,43 @@ var meRoutes = {
 };
 
 // src/contracts/access-token.ts
-var import_zod_openapi45 = require("@hono/zod-openapi");
+var import_zod_openapi46 = require("@hono/zod-openapi");
 
 // src/schemas/access-token.ts
-var import_zod_openapi44 = require("@hono/zod-openapi");
-var AccessTokenSchema = import_zod_openapi44.z.object({
-  id: import_zod_openapi44.z.string(),
-  name: import_zod_openapi44.z.string(),
-  scopes: import_zod_openapi44.z.array(import_zod_openapi44.z.string()),
+var import_zod_openapi45 = require("@hono/zod-openapi");
+var AccessTokenSchema = import_zod_openapi45.z.object({
+  id: import_zod_openapi45.z.string(),
+  name: import_zod_openapi45.z.string(),
+  scopes: import_zod_openapi45.z.array(import_zod_openapi45.z.string()),
   /** ISO-8601 expiry, or `null` for a non-expiring token. */
-  expiresAt: import_zod_openapi44.z.string().nullable(),
+  expiresAt: import_zod_openapi45.z.string().nullable(),
   /** ISO-8601 of last successful use, or `null` if never used. */
-  lastUsedAt: import_zod_openapi44.z.string().nullable(),
-  createdAt: import_zod_openapi44.z.string()
+  lastUsedAt: import_zod_openapi45.z.string().nullable(),
+  createdAt: import_zod_openapi45.z.string()
 });
-var ListAccessTokensResponseSchema = import_zod_openapi44.z.object({
-  accessTokens: import_zod_openapi44.z.array(AccessTokenSchema)
+var ListAccessTokensResponseSchema = import_zod_openapi45.z.object({
+  accessTokens: import_zod_openapi45.z.array(AccessTokenSchema)
 });
-var CreateAccessTokenRequestSchema = import_zod_openapi44.z.object({
-  name: import_zod_openapi44.z.string().min(1, "Name is required").max(200),
-  scopes: import_zod_openapi44.z.array(import_zod_openapi44.z.string()).min(1, "At least one scope is required"),
-  expiresAt: import_zod_openapi44.z.string().datetime().nullable().optional()
+var CreateAccessTokenRequestSchema = import_zod_openapi45.z.object({
+  name: import_zod_openapi45.z.string().min(1, "Name is required").max(200),
+  scopes: import_zod_openapi45.z.array(import_zod_openapi45.z.string()).min(1, "At least one scope is required"),
+  expiresAt: import_zod_openapi45.z.string().datetime().nullable().optional()
 });
 var CreateAccessTokenResponseSchema = AccessTokenSchema.extend({
-  token: import_zod_openapi44.z.string()
-});
-var InvalidScopeErrorSchema = import_zod_openapi44.z.object({
-  error: import_zod_openapi44.z.object({
-    code: import_zod_openapi44.z.literal("INVALID_SCOPE"),
-    message: import_zod_openapi44.z.string(),
-    details: import_zod_openapi44.z.object({
-      invalidScopes: import_zod_openapi44.z.array(import_zod_openapi44.z.string())
+  token: import_zod_openapi45.z.string()
+});
+var InvalidScopeErrorSchema = import_zod_openapi45.z.object({
+  error: import_zod_openapi45.z.object({
+    code: import_zod_openapi45.z.literal("INVALID_SCOPE"),
+    message: import_zod_openapi45.z.string(),
+    details: import_zod_openapi45.z.object({
+      invalidScopes: import_zod_openapi45.z.array(import_zod_openapi45.z.string())
     }).optional()
   })
 });
 
 // src/contracts/access-token.ts
-var listAccessTokensRoute = (0, import_zod_openapi45.createRoute)({
+var listAccessTokensRoute = (0, import_zod_openapi46.createRoute)({
   method: "get",
   path: "/me/access-tokens",
   tags: ["me"],
@@ -4301,7 +4399,7 @@ var listAccessTokensRoute = (0, import_zod_openapi45.createRoute)({
     }
   }
 });
-var createAccessTokenRoute = (0, import_zod_openapi45.createRoute)({
+var createAccessTokenRoute = (0, import_zod_openapi46.createRoute)({
   method: "post",
   path: "/me/access-tokens",
   tags: ["me"],
@@ -4335,14 +4433,14 @@ var createAccessTokenRoute = (0, import_zod_openapi45.createRoute)({
     }
   }
 });
-var deleteAccessTokenRoute = (0, import_zod_openapi45.createRoute)({
+var deleteAccessTokenRoute = (0, import_zod_openapi46.createRoute)({
   method: "delete",
   path: "/me/access-tokens/{id}",
   tags: ["me"],
   security: [{ bearerAuth: [] }],
   summary: "Revoke a personal access token",
   request: {
-    params: import_zod_openapi45.z.object({ id: import_zod_openapi45.z.string() })
+    params: import_zod_openapi46.z.object({ id: import_zod_openapi46.z.string() })
   },
   responses: {
     200: {
@@ -4374,13 +4472,13 @@ var accessTokenRoutes = {
 };
 
 // src/contracts/oauth.ts
-var import_zod_openapi48 = require("@hono/zod-openapi");
+var import_zod_openapi49 = require("@hono/zod-openapi");
 
 // src/schemas/oauth-endpoints.ts
-var import_zod_openapi47 = require("@hono/zod-openapi");
+var import_zod_openapi48 = require("@hono/zod-openapi");
 
 // src/schemas/oauth.ts
-var import_zod_openapi46 = require("@hono/zod-openapi");
+var import_zod_openapi47 = require("@hono/zod-openapi");
 var SCOPES = [
   // umbrella
   "read",
@@ -4448,11 +4546,11 @@ function scopeSatisfies(required, granted) {
   return false;
 }
 var InsufficientScopeErrorSchema = ApiErrorSchema.extend({
-  error: import_zod_openapi46.z.object({
-    code: import_zod_openapi46.z.literal("INSUFFICIENT_SCOPE"),
-    message: import_zod_openapi46.z.string(),
-    details: import_zod_openapi46.z.object({
-      requiredScope: import_zod_openapi46.z.string()
+  error: import_zod_openapi47.z.object({
+    code: import_zod_openapi47.z.literal("INSUFFICIENT_SCOPE"),
+    message: import_zod_openapi47.z.string(),
+    details: import_zod_openapi47.z.object({
+      requiredScope: import_zod_openapi47.z.string()
     }).optional()
   })
 });
@@ -4471,102 +4569,102 @@ var OAUTH_ERROR_CODES = [
   "slow_down",
   "expired_token"
 ];
-var OAuthErrorSchema = import_zod_openapi47.z.object({
-  error: import_zod_openapi47.z.enum(OAUTH_ERROR_CODES),
-  error_description: import_zod_openapi47.z.string().optional()
-});
-var AuthorizeRequestSchema = import_zod_openapi47.z.object({
-  client_id: import_zod_openapi47.z.string().min(1),
-  redirect_uri: import_zod_openapi47.z.string().min(1),
-  scope: import_zod_openapi47.z.string().min(1),
-  code_challenge: import_zod_openapi47.z.string().min(1),
-  code_challenge_method: import_zod_openapi47.z.literal("S256"),
-  state: import_zod_openapi47.z.string().optional()
-});
-var AuthorizeResponseSchema = import_zod_openapi47.z.object({
-  redirectUri: import_zod_openapi47.z.string()
-});
-var TokenRequestSchema = import_zod_openapi47.z.discriminatedUnion("grant_type", [
-  import_zod_openapi47.z.object({
-    grant_type: import_zod_openapi47.z.literal("authorization_code"),
-    code: import_zod_openapi47.z.string().min(1),
-    code_verifier: import_zod_openapi47.z.string().min(1),
-    redirect_uri: import_zod_openapi47.z.string().min(1),
-    client_id: import_zod_openapi47.z.string().min(1)
+var OAuthErrorSchema = import_zod_openapi48.z.object({
+  error: import_zod_openapi48.z.enum(OAUTH_ERROR_CODES),
+  error_description: import_zod_openapi48.z.string().optional()
+});
+var AuthorizeRequestSchema = import_zod_openapi48.z.object({
+  client_id: import_zod_openapi48.z.string().min(1),
+  redirect_uri: import_zod_openapi48.z.string().min(1),
+  scope: import_zod_openapi48.z.string().min(1),
+  code_challenge: import_zod_openapi48.z.string().min(1),
+  code_challenge_method: import_zod_openapi48.z.literal("S256"),
+  state: import_zod_openapi48.z.string().optional()
+});
+var AuthorizeResponseSchema = import_zod_openapi48.z.object({
+  redirectUri: import_zod_openapi48.z.string()
+});
+var TokenRequestSchema = import_zod_openapi48.z.discriminatedUnion("grant_type", [
+  import_zod_openapi48.z.object({
+    grant_type: import_zod_openapi48.z.literal("authorization_code"),
+    code: import_zod_openapi48.z.string().min(1),
+    code_verifier: import_zod_openapi48.z.string().min(1),
+    redirect_uri: import_zod_openapi48.z.string().min(1),
+    client_id: import_zod_openapi48.z.string().min(1)
   }),
-  import_zod_openapi47.z.object({
-    grant_type: import_zod_openapi47.z.literal("refresh_token"),
-    refresh_token: import_zod_openapi47.z.string().min(1),
-    client_id: import_zod_openapi47.z.string().min(1),
-    scope: import_zod_openapi47.z.string().optional()
+  import_zod_openapi48.z.object({
+    grant_type: import_zod_openapi48.z.literal("refresh_token"),
+    refresh_token: import_zod_openapi48.z.string().min(1),
+    client_id: import_zod_openapi48.z.string().min(1),
+    scope: import_zod_openapi48.z.string().optional()
   }),
   // RFC 8628 §3.4 — device authorization grant. The client polls with the
   // opaque `device_code` returned by `/oauth/device/authorize`.
-  import_zod_openapi47.z.object({
-    grant_type: import_zod_openapi47.z.literal("urn:ietf:params:oauth:grant-type:device_code"),
-    device_code: import_zod_openapi47.z.string().min(1),
-    client_id: import_zod_openapi47.z.string().min(1)
+  import_zod_openapi48.z.object({
+    grant_type: import_zod_openapi48.z.literal("urn:ietf:params:oauth:grant-type:device_code"),
+    device_code: import_zod_openapi48.z.string().min(1),
+    client_id: import_zod_openapi48.z.string().min(1)
   })
 ]);
 var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-var TokenResponseSchema = import_zod_openapi47.z.object({
-  access_token: import_zod_openapi47.z.string(),
-  token_type: import_zod_openapi47.z.literal("Bearer"),
-  expires_in: import_zod_openapi47.z.number(),
-  refresh_token: import_zod_openapi47.z.string(),
-  scope: import_zod_openapi47.z.string()
-});
-var RevokeRequestSchema = import_zod_openapi47.z.object({
-  token: import_zod_openapi47.z.string().min(1),
-  token_type_hint: import_zod_openapi47.z.string().optional()
-});
-var RevokeResponseSchema = import_zod_openapi47.z.object({});
-var DeviceAuthorizeRequestSchema = import_zod_openapi47.z.object({
-  client_id: import_zod_openapi47.z.string().min(1),
-  scope: import_zod_openapi47.z.string().min(1)
-});
-var DeviceAuthorizeResponseSchema = import_zod_openapi47.z.object({
-  device_code: import_zod_openapi47.z.string(),
-  user_code: import_zod_openapi47.z.string(),
-  verification_uri: import_zod_openapi47.z.string(),
-  verification_uri_complete: import_zod_openapi47.z.string(),
-  expires_in: import_zod_openapi47.z.number(),
-  interval: import_zod_openapi47.z.number()
-});
-var DeviceVerifyRequestSchema = import_zod_openapi47.z.object({
-  user_code: import_zod_openapi47.z.string().min(1),
-  action: import_zod_openapi47.z.enum(["approve", "deny"])
-});
-var DeviceVerifyResponseSchema = import_zod_openapi47.z.object({
-  status: import_zod_openapi47.z.enum(["approved", "denied"])
-});
-var DeviceInfoResponseSchema = import_zod_openapi47.z.object({
-  client_id: import_zod_openapi47.z.string(),
-  scopes: import_zod_openapi47.z.array(import_zod_openapi47.z.string())
-});
-var ClientInfoResponseSchema = import_zod_openapi47.z.object({
-  clientId: import_zod_openapi47.z.string(),
-  name: import_zod_openapi47.z.string(),
-  firstParty: import_zod_openapi47.z.boolean(),
-  trusted: import_zod_openapi47.z.boolean()
+var TokenResponseSchema = import_zod_openapi48.z.object({
+  access_token: import_zod_openapi48.z.string(),
+  token_type: import_zod_openapi48.z.literal("Bearer"),
+  expires_in: import_zod_openapi48.z.number(),
+  refresh_token: import_zod_openapi48.z.string(),
+  scope: import_zod_openapi48.z.string()
+});
+var RevokeRequestSchema = import_zod_openapi48.z.object({
+  token: import_zod_openapi48.z.string().min(1),
+  token_type_hint: import_zod_openapi48.z.string().optional()
+});
+var RevokeResponseSchema = import_zod_openapi48.z.object({});
+var DeviceAuthorizeRequestSchema = import_zod_openapi48.z.object({
+  client_id: import_zod_openapi48.z.string().min(1),
+  scope: import_zod_openapi48.z.string().min(1)
+});
+var DeviceAuthorizeResponseSchema = import_zod_openapi48.z.object({
+  device_code: import_zod_openapi48.z.string(),
+  user_code: import_zod_openapi48.z.string(),
+  verification_uri: import_zod_openapi48.z.string(),
+  verification_uri_complete: import_zod_openapi48.z.string(),
+  expires_in: import_zod_openapi48.z.number(),
+  interval: import_zod_openapi48.z.number()
+});
+var DeviceVerifyRequestSchema = import_zod_openapi48.z.object({
+  user_code: import_zod_openapi48.z.string().min(1),
+  action: import_zod_openapi48.z.enum(["approve", "deny"])
+});
+var DeviceVerifyResponseSchema = import_zod_openapi48.z.object({
+  status: import_zod_openapi48.z.enum(["approved", "denied"])
+});
+var DeviceInfoResponseSchema = import_zod_openapi48.z.object({
+  client_id: import_zod_openapi48.z.string(),
+  scopes: import_zod_openapi48.z.array(import_zod_openapi48.z.string())
+});
+var ClientInfoResponseSchema = import_zod_openapi48.z.object({
+  clientId: import_zod_openapi48.z.string(),
+  name: import_zod_openapi48.z.string(),
+  firstParty: import_zod_openapi48.z.boolean(),
+  trusted: import_zod_openapi48.z.boolean()
 });
 var GRANT_TYPES_SUPPORTED = ["authorization_code", "refresh_token", DEVICE_CODE_GRANT_TYPE];
-var DiscoveryResponseSchema = import_zod_openapi47.z.object({
-  issuer: import_zod_openapi47.z.string(),
-  authorization_endpoint: import_zod_openapi47.z.string(),
-  token_endpoint: import_zod_openapi47.z.string(),
-  revocation_endpoint: import_zod_openapi47.z.string(),
-  device_authorization_endpoint: import_zod_openapi47.z.string().optional(),
-  scopes_supported: import_zod_openapi47.z.array(import_zod_openapi47.z.string()),
-  response_types_supported: import_zod_openapi47.z.array(import_zod_openapi47.z.string()),
-  grant_types_supported: import_zod_openapi47.z.array(import_zod_openapi47.z.string()),
-  code_challenge_methods_supported: import_zod_openapi47.z.array(import_zod_openapi47.z.string()),
-  token_endpoint_auth_methods_supported: import_zod_openapi47.z.array(import_zod_openapi47.z.string())
+var DiscoveryResponseSchema = import_zod_openapi48.z.object({
+  issuer: import_zod_openapi48.z.string(),
+  authorization_endpoint: import_zod_openapi48.z.string(),
+  token_endpoint: import_zod_openapi48.z.string(),
+  revocation_endpoint: import_zod_openapi48.z.string(),
+  device_authorization_endpoint: import_zod_openapi48.z.string().optional(),
+  scopes_supported: import_zod_openapi48.z.array(import_zod_openapi48.z.string()),
+  response_types_supported: import_zod_openapi48.z.array(import_zod_openapi48.z.string()),
+  grant_types_supported: import_zod_openapi48.z.array(import_zod_openapi48.z.string()),
+  code_challenge_methods_supported: import_zod_openapi48.z.array(import_zod_openapi48.z.string()),
+  token_endpoint_auth_methods_supported: import_zod_openapi48.z.array(import_zod_openapi48.z.string())
 });
 var DISCOVERY_SCOPES_SUPPORTED = ISSUABLE_SCOPES;
 
 // src/contracts/oauth.ts
-var authorizeRoute = (0, import_zod_openapi48.createRoute)({
+var authorizeRoute = (0, import_zod_openapi49.createRoute)({
   method: "post",
   path: "/oauth/authorize",
   tags: ["oauth"],
@@ -4596,7 +4694,7 @@ var authorizeRoute = (0, import_zod_openapi48.createRoute)({
     }
   }
 });
-var tokenRoute = (0, import_zod_openapi48.createRoute)({
+var tokenRoute = (0, import_zod_openapi49.createRoute)({
   method: "post",
   path: "/oauth/token",
   tags: ["oauth"],
@@ -4628,7 +4726,7 @@ var tokenRoute = (0, import_zod_openapi48.createRoute)({
     }
   }
 });
-var revokeRoute = (0, import_zod_openapi48.createRoute)({
+var revokeRoute = (0, import_zod_openapi49.createRoute)({
   method: "post",
   path: "/oauth/revoke",
   tags: ["oauth"],
@@ -4648,7 +4746,7 @@ var revokeRoute = (0, import_zod_openapi48.createRoute)({
     }
   }
 });
-var discoveryRoute = (0, import_zod_openapi48.createRoute)({
+var discoveryRoute = (0, import_zod_openapi49.createRoute)({
   method: "get",
   path: "/.well-known/oauth-authorization-server",
   tags: ["oauth"],
@@ -4660,7 +4758,7 @@ var discoveryRoute = (0, import_zod_openapi48.createRoute)({
     }
   }
 });
-var deviceAuthorizeRoute = (0, import_zod_openapi48.createRoute)({
+var deviceAuthorizeRoute = (0, import_zod_openapi49.createRoute)({
   method: "post",
   path: "/oauth/device/authorize",
   tags: ["oauth"],
@@ -4688,7 +4786,7 @@ var deviceAuthorizeRoute = (0, import_zod_openapi48.createRoute)({
     }
   }
 });
-var deviceInfoRoute = (0, import_zod_openapi48.createRoute)({
+var deviceInfoRoute = (0, import_zod_openapi49.createRoute)({
   method: "get",
   path: "/oauth/device",
   tags: ["oauth"],
@@ -4697,7 +4795,7 @@ var deviceInfoRoute = (0, import_zod_openapi48.createRoute)({
   // scopes so the web consent screen can show them before approval. Reveals
   // no secret. Unknown / expired / non-pending → 404 (PHASE4-Q9 option A).
   request: {
-    query: import_zod_openapi48.z.object({ user_code: import_zod_openapi48.z.string().min(1) })
+    query: import_zod_openapi49.z.object({ user_code: import_zod_openapi49.z.string().min(1) })
   },
   responses: {
     200: {
@@ -4710,7 +4808,7 @@ var deviceInfoRoute = (0, import_zod_openapi48.createRoute)({
     }
   }
 });
-var deviceVerifyRoute = (0, import_zod_openapi48.createRoute)({
+var deviceVerifyRoute = (0, import_zod_openapi49.createRoute)({
   method: "post",
   path: "/oauth/device/verify",
   tags: ["oauth"],
@@ -4740,7 +4838,7 @@ var deviceVerifyRoute = (0, import_zod_openapi48.createRoute)({
     }
   }
 });
-var clientInfoRoute = (0, import_zod_openapi48.createRoute)({
+var clientInfoRoute = (0, import_zod_openapi49.createRoute)({
   method: "get",
   path: "/oauth/client-info",
   tags: ["oauth"],
@@ -4751,7 +4849,7 @@ var clientInfoRoute = (0, import_zod_openapi48.createRoute)({
   // no redirectUris/allowedScopes — mirroring deviceInfoRoute's own
   // non-secret-lookup shape. Unknown client_id → 404.
   request: {
-    query: import_zod_openapi48.z.object({ client_id: import_zod_openapi48.z.string().min(1) })
+    query: import_zod_openapi49.z.object({ client_id: import_zod_openapi49.z.string().min(1) })
   },
   responses: {
     200: {
@@ -4776,24 +4874,24 @@ var oauthRoutes = {
 };
 
 // src/contracts/notification.ts
-var import_zod_openapi50 = require("@hono/zod-openapi");
+var import_zod_openapi51 = require("@hono/zod-openapi");
 
 // src/schemas/notification.ts
-var import_zod_openapi49 = require("@hono/zod-openapi");
-var NotificationStatusSchema = import_zod_openapi49.z.enum(["UNREAD", "UNOPENED", "OPENED"]);
+var import_zod_openapi50 = require("@hono/zod-openapi");
+var NotificationStatusSchema = import_zod_openapi50.z.enum(["UNREAD", "UNOPENED", "OPENED"]);
 var NotificationStatusEnum = {
   UNREAD: "UNREAD",
   UNOPENED: "UNOPENED",
   OPENED: "OPENED"
 };
-var NotificationActionSchema = import_zod_openapi49.z.enum(["COMMENT", "LIKE", "MENTION", "UPDATE"]);
+var NotificationActionSchema = import_zod_openapi50.z.enum(["COMMENT", "LIKE", "MENTION", "UPDATE"]);
 var NotificationActionEnum = {
   COMMENT: "COMMENT",
   LIKE: "LIKE",
   MENTION: "MENTION",
   UPDATE: "UPDATE"
 };
-var NotificationTargetModelSchema = import_zod_openapi49.z.enum(["Page"]);
+var NotificationTargetModelSchema = import_zod_openapi50.z.enum(["Page"]);
 var NotificationTargetModelEnum = {
   PAGE: "Page"
 };
@@ -4802,71 +4900,71 @@ var PageRefSchema = PageSchema.pick({
   path: true,
   status: true
 });
-var NotificationSchema = import_zod_openapi49.z.object({
-  _id: import_zod_openapi49.z.string(),
-  user: import_zod_openapi49.z.string(),
+var NotificationSchema = import_zod_openapi50.z.object({
+  _id: import_zod_openapi50.z.string(),
+  user: import_zod_openapi50.z.string(),
   targetModel: NotificationTargetModelSchema,
   target: PageRefSchema,
   action: NotificationActionSchema,
   status: NotificationStatusSchema,
-  actionUsers: import_zod_openapi49.z.array(UserPublicSchema),
-  createdAt: import_zod_openapi49.z.string()
+  actionUsers: import_zod_openapi50.z.array(UserPublicSchema),
+  createdAt: import_zod_openapi50.z.string()
 });
-var ListNotificationsRequestSchema = import_zod_openapi49.z.object({
-  limit: import_zod_openapi49.z.coerce.number().optional().default(10),
-  offset: import_zod_openapi49.z.coerce.number().optional().default(0)
+var ListNotificationsRequestSchema = import_zod_openapi50.z.object({
+  limit: import_zod_openapi50.z.coerce.number().optional().default(10),
+  offset: import_zod_openapi50.z.coerce.number().optional().default(0)
 });
-var ListNotificationsResponseSchema = import_zod_openapi49.z.object({
-  notifications: import_zod_openapi49.z.array(NotificationSchema),
+var ListNotificationsResponseSchema = import_zod_openapi50.z.object({
+  notifications: import_zod_openapi50.z.array(NotificationSchema),
   pager: PagerSchema
 });
-var MarkAllAsReadResponseSchema = import_zod_openapi49.z.object({
-  ok: import_zod_openapi49.z.literal(true)
+var MarkAllAsReadResponseSchema = import_zod_openapi50.z.object({
+  ok: import_zod_openapi50.z.literal(true)
 });
-var OpenNotificationParamSchema = import_zod_openapi49.z.object({
-  id: import_zod_openapi49.z.string()
+var OpenNotificationParamSchema = import_zod_openapi50.z.object({
+  id: import_zod_openapi50.z.string()
 });
-var OpenNotificationResponseSchema = import_zod_openapi49.z.object({
+var OpenNotificationResponseSchema = import_zod_openapi50.z.object({
   notification: NotificationSchema
 });
-var NotificationStatusResponseSchema = import_zod_openapi49.z.object({
-  count: import_zod_openapi49.z.number()
+var NotificationStatusResponseSchema = import_zod_openapi50.z.object({
+  count: import_zod_openapi50.z.number()
 });
-var NotificationNotFoundErrorSchema = import_zod_openapi49.z.object({
-  error: import_zod_openapi49.z.object({
-    code: import_zod_openapi49.z.literal("NOTIFICATION_NOT_FOUND"),
-    message: import_zod_openapi49.z.literal("Notification not found")
+var NotificationNotFoundErrorSchema = import_zod_openapi50.z.object({
+  error: import_zod_openapi50.z.object({
+    code: import_zod_openapi50.z.literal("NOTIFICATION_NOT_FOUND"),
+    message: import_zod_openapi50.z.literal("Notification not found")
   })
 });
-var NotificationsTokenResponseSchema = import_zod_openapi49.z.object({
-  token: import_zod_openapi49.z.string(),
-  selfUserId: import_zod_openapi49.z.string(),
-  expiresAt: import_zod_openapi49.z.string()
+var NotificationsTokenResponseSchema = import_zod_openapi50.z.object({
+  token: import_zod_openapi50.z.string(),
+  selfUserId: import_zod_openapi50.z.string(),
+  expiresAt: import_zod_openapi50.z.string()
 });
-var NotificationsTokenPayloadSchema = import_zod_openapi49.z.object({
-  selfUserId: import_zod_openapi49.z.string(),
+var NotificationsTokenPayloadSchema = import_zod_openapi50.z.object({
+  selfUserId: import_zod_openapi50.z.string(),
   // Random UUID mixed into every signed token so two tokens minted
   // within the same second still produce byte-different JWT strings.
   // The browser uses the token as a React effect dependency to drive
   // the WebSocket reconnect — without `jti`, the iat/exp pair is
   // identical at second granularity and the dep stays stable.
-  jti: import_zod_openapi49.z.string().uuid(),
-  iat: import_zod_openapi49.z.number().int(),
-  exp: import_zod_openapi49.z.number().int()
+  jti: import_zod_openapi50.z.string().uuid(),
+  iat: import_zod_openapi50.z.number().int(),
+  exp: import_zod_openapi50.z.number().int()
 });
-var NotificationsChangedMessageSchema = import_zod_openapi49.z.object({
-  type: import_zod_openapi49.z.literal("changed")
+var NotificationsChangedMessageSchema = import_zod_openapi50.z.object({
+  type: import_zod_openapi50.z.literal("changed")
 });
 var NotificationsServerMessageSchema = NotificationsChangedMessageSchema;
 
 // src/contracts/notification.ts
-var NotificationInvalidRequestErrorSchema = import_zod_openapi50.z.object({
-  error: import_zod_openapi50.z.object({
-    code: import_zod_openapi50.z.literal("INVALID_REQUEST"),
-    message: import_zod_openapi50.z.string()
+var NotificationInvalidRequestErrorSchema = import_zod_openapi51.z.object({
+  error: import_zod_openapi51.z.object({
+    code: import_zod_openapi51.z.literal("INVALID_REQUEST"),
+    message: import_zod_openapi51.z.string()
   })
 });
-var listNotificationsRoute = (0, import_zod_openapi50.createRoute)({
+var listNotificationsRoute = (0, import_zod_openapi51.createRoute)({
   method: "get",
   path: "/notifications",
   tags: ["notification"],
@@ -4890,7 +4988,7 @@ var listNotificationsRoute = (0, import_zod_openapi50.createRoute)({
     }
   }
 });
-var markAllAsReadRoute = (0, import_zod_openapi50.createRoute)({
+var markAllAsReadRoute = (0, import_zod_openapi51.createRoute)({
   method: "post",
   path: "/notifications/read",
   tags: ["notification"],
@@ -4911,7 +5009,7 @@ var markAllAsReadRoute = (0, import_zod_openapi50.createRoute)({
     }
   }
 });
-var getUnreadCountRoute = (0, import_zod_openapi50.createRoute)({
+var getUnreadCountRoute = (0, import_zod_openapi51.createRoute)({
   method: "get",
   path: "/notifications/status",
   tags: ["notification"],
@@ -4932,7 +5030,7 @@ var getUnreadCountRoute = (0, import_zod_openapi50.createRoute)({
     }
   }
 });
-var openNotificationRoute = (0, import_zod_openapi50.createRoute)({
+var openNotificationRoute = (0, import_zod_openapi51.createRoute)({
   method: "post",
   path: "/notifications/{id}/open",
   tags: ["notification"],
@@ -4964,7 +5062,7 @@ var openNotificationRoute = (0, import_zod_openapi50.createRoute)({
     }
   }
 });
-var getNotificationsTokenRoute = (0, import_zod_openapi50.createRoute)({
+var getNotificationsTokenRoute = (0, import_zod_openapi51.createRoute)({
   method: "get",
   path: "/notifications/token",
   tags: ["notification"],
@@ -4999,11 +5097,11 @@ var notificationRoutes = {
 };
 
 // src/contracts/page-collab.ts
-var import_zod_openapi51 = require("@hono/zod-openapi");
-var PageIdPathParamsSchema2 = import_zod_openapi51.z.object({
-  id: import_zod_openapi51.z.string().openapi({ description: "Page id (24-char hex ObjectId)", example: "507f1f77bcf86cd799439011" })
+var import_zod_openapi52 = require("@hono/zod-openapi");
+var PageIdPathParamsSchema2 = import_zod_openapi52.z.object({
+  id: import_zod_openapi52.z.string().openapi({ description: "Page id (24-char hex ObjectId)", example: "507f1f77bcf86cd799439011" })
 });
-var getYjsTokenRoute = (0, import_zod_openapi51.createRoute)({
+var getYjsTokenRoute = (0, import_zod_openapi52.createRoute)({
   method: "get",
   path: "/pages/{id}/yjs-token",
   tags: ["page-collab"],
@@ -5040,26 +5138,26 @@ var pageCollabRoutes = {
 };
 
 // src/contracts/page.ts
-var import_zod_openapi52 = require("@hono/zod-openapi");
-var PageBadRequestErrorSchema = import_zod_openapi52.z.object({
-  error: import_zod_openapi52.z.object({
-    code: import_zod_openapi52.z.string(),
-    message: import_zod_openapi52.z.string()
+var import_zod_openapi53 = require("@hono/zod-openapi");
+var PageBadRequestErrorSchema = import_zod_openapi53.z.object({
+  error: import_zod_openapi53.z.object({
+    code: import_zod_openapi53.z.string(),
+    message: import_zod_openapi53.z.string()
   })
 });
-var DeletePageRequestSchema = import_zod_openapi52.z.object({
-  page_id: import_zod_openapi52.z.string(),
-  revision_id: import_zod_openapi52.z.string().optional(),
-  completely: import_zod_openapi52.z.boolean().optional()
+var DeletePageRequestSchema = import_zod_openapi53.z.object({
+  page_id: import_zod_openapi53.z.string(),
+  revision_id: import_zod_openapi53.z.string().optional(),
+  completely: import_zod_openapi53.z.boolean().optional()
 });
-var RevertDeletedPageRequestSchema = import_zod_openapi52.z.object({
-  page_id: import_zod_openapi52.z.string()
+var RevertDeletedPageRequestSchema = import_zod_openapi53.z.object({
+  page_id: import_zod_openapi53.z.string()
 });
-var PageIdBodySchema = import_zod_openapi52.z.object({
-  page_id: import_zod_openapi52.z.string()
+var PageIdBodySchema = import_zod_openapi53.z.object({
+  page_id: import_zod_openapi53.z.string()
 });
-var PageResponseSchema = import_zod_openapi52.z.object({ page: PageSchema });
-var getPageRoute = (0, import_zod_openapi52.createRoute)({
+var PageResponseSchema = import_zod_openapi53.z.object({ page: PageSchema });
+var getPageRoute = (0, import_zod_openapi53.createRoute)({
   method: "get",
   path: "/pages",
   tags: ["page"],
@@ -5096,7 +5194,7 @@ var getPageRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var listPagesRoute = (0, import_zod_openapi52.createRoute)({
+var listPagesRoute = (0, import_zod_openapi53.createRoute)({
   method: "get",
   path: "/pages/list",
   tags: ["page"],
@@ -5116,7 +5214,7 @@ var listPagesRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var listPageChildrenRoute = (0, import_zod_openapi52.createRoute)({
+var listPageChildrenRoute = (0, import_zod_openapi53.createRoute)({
   method: "get",
   path: "/pages/children",
   tags: ["page"],
@@ -5136,7 +5234,7 @@ var listPageChildrenRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var createPageRoute = (0, import_zod_openapi52.createRoute)({
+var createPageRoute = (0, import_zod_openapi53.createRoute)({
   method: "post",
   path: "/pages",
   tags: ["page"],
@@ -5162,7 +5260,7 @@ var createPageRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var updatePageRoute = (0, import_zod_openapi52.createRoute)({
+var updatePageRoute = (0, import_zod_openapi53.createRoute)({
   method: "put",
   path: "/pages",
   tags: ["page"],
@@ -5196,7 +5294,7 @@ var updatePageRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var setPageGrantRoute = (0, import_zod_openapi52.createRoute)({
+var setPageGrantRoute = (0, import_zod_openapi53.createRoute)({
   method: "put",
   path: "/pages/grant",
   tags: ["page"],
@@ -5226,7 +5324,7 @@ var setPageGrantRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var seenPageRoute = (0, import_zod_openapi52.createRoute)({
+var seenPageRoute = (0, import_zod_openapi53.createRoute)({
   method: "post",
   path: "/pages/seen",
   tags: ["page"],
@@ -5256,7 +5354,7 @@ var seenPageRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var getSeenUsersRoute = (0, import_zod_openapi52.createRoute)({
+var getSeenUsersRoute = (0, import_zod_openapi53.createRoute)({
   method: "get",
   path: "/pages/seen-users",
   tags: ["page"],
@@ -5284,7 +5382,7 @@ var getSeenUsersRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var likePageRoute = (0, import_zod_openapi52.createRoute)({
+var likePageRoute = (0, import_zod_openapi53.createRoute)({
   method: "post",
   path: "/pages/like",
   tags: ["page"],
@@ -5314,7 +5412,7 @@ var likePageRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var unlikePageRoute = (0, import_zod_openapi52.createRoute)({
+var unlikePageRoute = (0, import_zod_openapi53.createRoute)({
   method: "post",
   path: "/pages/unlike",
   tags: ["page"],
@@ -5344,7 +5442,7 @@ var unlikePageRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var claimPageLinkAccessRoute = (0, import_zod_openapi52.createRoute)({
+var claimPageLinkAccessRoute = (0, import_zod_openapi53.createRoute)({
   method: "post",
   path: "/pages/link-access",
   tags: ["page"],
@@ -5372,7 +5470,7 @@ var claimPageLinkAccessRoute = (0, import_zod_openapi52.createRoute)({
       description: "The caller has no access to the page (isGrantedFor is false) or lacks scope / is a non-web session \u2014 403 is about the caller lacking access, never about the page grant type per se",
       content: {
         "application/json": {
-          schema: import_zod_openapi52.z.union([PageNotGrantedErrorSchema, InsufficientScopeErrorSchema])
+          schema: import_zod_openapi53.z.union([PageNotGrantedErrorSchema, InsufficientScopeErrorSchema])
         }
       }
     },
@@ -5390,7 +5488,7 @@ var claimPageLinkAccessRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var getWatchStatusRoute = (0, import_zod_openapi52.createRoute)({
+var getWatchStatusRoute = (0, import_zod_openapi53.createRoute)({
   method: "get",
   path: "/pages/watch",
   tags: ["page"],
@@ -5418,7 +5516,7 @@ var getWatchStatusRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var setWatchStatusRoute = (0, import_zod_openapi52.createRoute)({
+var setWatchStatusRoute = (0, import_zod_openapi53.createRoute)({
   method: "put",
   path: "/pages/watch",
   tags: ["page"],
@@ -5448,7 +5546,7 @@ var setWatchStatusRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var deletePageRoute = (0, import_zod_openapi52.createRoute)({
+var deletePageRoute = (0, import_zod_openapi53.createRoute)({
   method: "delete",
   path: "/pages",
   tags: ["page"],
@@ -5482,7 +5580,7 @@ var deletePageRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var revertDeletedPageRoute = (0, import_zod_openapi52.createRoute)({
+var revertDeletedPageRoute = (0, import_zod_openapi53.createRoute)({
   method: "post",
   path: "/pages/revert",
   tags: ["page"],
@@ -5512,7 +5610,7 @@ var revertDeletedPageRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var revertToRevisionRoute = (0, import_zod_openapi52.createRoute)({
+var revertToRevisionRoute = (0, import_zod_openapi53.createRoute)({
   method: "post",
   path: "/pages/revert-to-revision",
   tags: ["page"],
@@ -5542,7 +5640,7 @@ var revertToRevisionRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var renamePageRoute = (0, import_zod_openapi52.createRoute)({
+var renamePageRoute = (0, import_zod_openapi53.createRoute)({
   method: "post",
   path: "/pages/rename",
   tags: ["page"],
@@ -5562,7 +5660,7 @@ var renamePageRoute = (0, import_zod_openapi52.createRoute)({
       description: "PAGE_INVALID_NAME / PAGE_EXISTS / PAGE_RENAME_FAILED / PAGE_RENAME_TREE_FAILED",
       content: {
         "application/json": {
-          schema: import_zod_openapi52.z.union([PageBadRequestErrorSchema, RenameTreeErrorSchema])
+          schema: import_zod_openapi53.z.union([PageBadRequestErrorSchema, RenameTreeErrorSchema])
         }
       }
     },
@@ -5580,7 +5678,7 @@ var renamePageRoute = (0, import_zod_openapi52.createRoute)({
     }
   }
 });
-var renameSubtreeRoute = (0, import_zod_openapi52.createRoute)({
+var renameSubtreeRoute = (0, import_zod_openapi53.createRoute)({
   method: "post",
   path: "/pages/rename-subtree",
   tags: ["page"],
@@ -5600,7 +5698,7 @@ var renameSubtreeRoute = (0, import_zod_openapi52.createRoute)({
       description: "PAGE_INVALID_NAME / PAGE_RENAME_TREE_FAILED (collisions, nothing to move, or partial failure)",
       content: {
         "application/json": {
-          schema: import_zod_openapi52.z.union([PageBadRequestErrorSchema, RenameTreeErrorSchema])
+          schema: import_zod_openapi53.z.union([PageBadRequestErrorSchema, RenameTreeErrorSchema])
         }
       }
     },
@@ -5650,20 +5748,20 @@ var pageRoutes = {
 };
 
 // src/contracts/page-preview.ts
-var import_zod_openapi54 = require("@hono/zod-openapi");
+var import_zod_openapi55 = require("@hono/zod-openapi");
 
 // src/schemas/page-preview.ts
-var import_zod_openapi53 = require("@hono/zod-openapi");
-var PreviewPageRequestSchema = import_zod_openapi53.z.object({
-  body: import_zod_openapi53.z.string()
+var import_zod_openapi54 = require("@hono/zod-openapi");
+var PreviewPageRequestSchema = import_zod_openapi54.z.object({
+  body: import_zod_openapi54.z.string()
 });
-var PreviewPageResponseSchema = import_zod_openapi53.z.object({
+var PreviewPageResponseSchema = import_zod_openapi54.z.object({
   renderedAst: RenderedAstValueSchema.optional(),
   renderedAstArtifactKey: RenderedAstArtifactKeySchema.optional()
 });
 
 // src/contracts/page-preview.ts
-var previewPageRoute = (0, import_zod_openapi54.createRoute)({
+var previewPageRoute = (0, import_zod_openapi55.createRoute)({
   method: "post",
   path: "/pages/preview",
   tags: ["page-preview"],
@@ -5701,80 +5799,80 @@ var pagePreviewRoutes = {
 };
 
 // src/contracts/presence.ts
-var import_zod_openapi56 = require("@hono/zod-openapi");
+var import_zod_openapi57 = require("@hono/zod-openapi");
 
 // src/schemas/presence.ts
-var import_zod_openapi55 = require("@hono/zod-openapi");
-var PresenceTokenResponseSchema = import_zod_openapi55.z.object({
-  token: import_zod_openapi55.z.string(),
-  pageId: import_zod_openapi55.z.string(),
-  selfUserId: import_zod_openapi55.z.string(),
-  expiresAt: import_zod_openapi55.z.string()
-});
-var PresenceTokenPayloadSchema = import_zod_openapi55.z.object({
-  userId: import_zod_openapi55.z.string(),
-  pageId: import_zod_openapi55.z.string(),
-  iat: import_zod_openapi55.z.number().int(),
-  exp: import_zod_openapi55.z.number().int()
-});
-var PresenceViewerSchema = import_zod_openapi55.z.object({
-  userId: import_zod_openapi55.z.string(),
-  username: import_zod_openapi55.z.string(),
-  displayName: import_zod_openapi55.z.string(),
-  avatarUrl: import_zod_openapi55.z.string().nullable(),
-  isEditing: import_zod_openapi55.z.boolean(),
-  joinedAt: import_zod_openapi55.z.number().int()
-});
-var PresenceHeartbeatMessageSchema = import_zod_openapi55.z.object({
-  type: import_zod_openapi55.z.literal("heartbeat")
+var import_zod_openapi56 = require("@hono/zod-openapi");
+var PresenceTokenResponseSchema = import_zod_openapi56.z.object({
+  token: import_zod_openapi56.z.string(),
+  pageId: import_zod_openapi56.z.string(),
+  selfUserId: import_zod_openapi56.z.string(),
+  expiresAt: import_zod_openapi56.z.string()
+});
+var PresenceTokenPayloadSchema = import_zod_openapi56.z.object({
+  userId: import_zod_openapi56.z.string(),
+  pageId: import_zod_openapi56.z.string(),
+  iat: import_zod_openapi56.z.number().int(),
+  exp: import_zod_openapi56.z.number().int()
+});
+var PresenceViewerSchema = import_zod_openapi56.z.object({
+  userId: import_zod_openapi56.z.string(),
+  username: import_zod_openapi56.z.string(),
+  displayName: import_zod_openapi56.z.string(),
+  avatarUrl: import_zod_openapi56.z.string().nullable(),
+  isEditing: import_zod_openapi56.z.boolean(),
+  joinedAt: import_zod_openapi56.z.number().int()
+});
+var PresenceHeartbeatMessageSchema = import_zod_openapi56.z.object({
+  type: import_zod_openapi56.z.literal("heartbeat")
 });
 var PresenceClientMessageSchema = PresenceHeartbeatMessageSchema;
-var PresenceViewersMessageSchema = import_zod_openapi55.z.object({
-  type: import_zod_openapi55.z.literal("viewers"),
-  viewers: import_zod_openapi55.z.array(PresenceViewerSchema),
-  generation: import_zod_openapi55.z.number().int()
-});
-var PresencePageUpdatedMessageSchema = import_zod_openapi55.z.object({
-  type: import_zod_openapi55.z.literal("page-updated"),
-  pageId: import_zod_openapi55.z.string(),
-  revisionId: import_zod_openapi55.z.string(),
-  editorUserId: import_zod_openapi55.z.string(),
-  editorDisplayName: import_zod_openapi55.z.string()
-});
-var PresenceCommentChangedMessageSchema = import_zod_openapi55.z.object({
-  type: import_zod_openapi55.z.literal("comment-changed"),
-  pageId: import_zod_openapi55.z.string(),
-  changeType: import_zod_openapi55.z.enum(["added", "removed"]),
-  commentId: import_zod_openapi55.z.string(),
-  actorUserId: import_zod_openapi55.z.string().optional()
-});
-var PresenceServerMessageSchema = import_zod_openapi55.z.discriminatedUnion("type", [
+var PresenceViewersMessageSchema = import_zod_openapi56.z.object({
+  type: import_zod_openapi56.z.literal("viewers"),
+  viewers: import_zod_openapi56.z.array(PresenceViewerSchema),
+  generation: import_zod_openapi56.z.number().int()
+});
+var PresencePageUpdatedMessageSchema = import_zod_openapi56.z.object({
+  type: import_zod_openapi56.z.literal("page-updated"),
+  pageId: import_zod_openapi56.z.string(),
+  revisionId: import_zod_openapi56.z.string(),
+  editorUserId: import_zod_openapi56.z.string(),
+  editorDisplayName: import_zod_openapi56.z.string()
+});
+var PresenceCommentChangedMessageSchema = import_zod_openapi56.z.object({
+  type: import_zod_openapi56.z.literal("comment-changed"),
+  pageId: import_zod_openapi56.z.string(),
+  changeType: import_zod_openapi56.z.enum(["added", "removed"]),
+  commentId: import_zod_openapi56.z.string(),
+  actorUserId: import_zod_openapi56.z.string().optional()
+});
+var PresenceServerMessageSchema = import_zod_openapi56.z.discriminatedUnion("type", [
   PresenceViewersMessageSchema,
   PresencePageUpdatedMessageSchema,
   PresenceCommentChangedMessageSchema
 ]);
-var LikerSchema = import_zod_openapi55.z.object({
-  id: import_zod_openapi55.z.string(),
-  username: import_zod_openapi55.z.string(),
-  displayName: import_zod_openapi55.z.string(),
-  avatarUrl: import_zod_openapi55.z.string().nullable(),
-  likedAt: import_zod_openapi55.z.string().nullable()
-});
-var LikersResponseSchema = import_zod_openapi55.z.object({
-  users: import_zod_openapi55.z.array(LikerSchema),
-  totalCount: import_zod_openapi55.z.number().int().nonnegative()
-});
-var GetLikersRequestSchema = import_zod_openapi55.z.object({
+var LikerSchema = import_zod_openapi56.z.object({
+  id: import_zod_openapi56.z.string(),
+  username: import_zod_openapi56.z.string(),
+  displayName: import_zod_openapi56.z.string(),
+  avatarUrl: import_zod_openapi56.z.string().nullable(),
+  likedAt: import_zod_openapi56.z.string().nullable()
+});
+var LikersResponseSchema = import_zod_openapi56.z.object({
+  users: import_zod_openapi56.z.array(LikerSchema),
+  totalCount: import_zod_openapi56.z.number().int().nonnegative()
+});
+var GetLikersRequestSchema = import_zod_openapi56.z.object({
   // Optional cap on returned `users`. `totalCount` always reflects the
   // full count regardless of `limit`. Omit for the full list.
-  limit: import_zod_openapi55.z.coerce.number().int().positive().optional()
+  limit: import_zod_openapi56.z.coerce.number().int().positive().optional()
 });
 
 // src/contracts/presence.ts
-var PageIdPathParamsSchema3 = import_zod_openapi56.z.object({
-  id: import_zod_openapi56.z.string().openapi({ description: "Page id (24-char hex ObjectId)", example: "507f1f77bcf86cd799439011" })
+var PageIdPathParamsSchema3 = import_zod_openapi57.z.object({
+  id: import_zod_openapi57.z.string().openapi({ description: "Page id (24-char hex ObjectId)", example: "507f1f77bcf86cd799439011" })
 });
-var getPresenceTokenRoute = (0, import_zod_openapi56.createRoute)({
+var getPresenceTokenRoute = (0, import_zod_openapi57.createRoute)({
   method: "get",
   path: "/pages/{id}/presence-token",
   tags: ["presence"],
@@ -5806,7 +5904,7 @@ var getPresenceTokenRoute = (0, import_zod_openapi56.createRoute)({
     }
   }
 });
-var getLikersRoute = (0, import_zod_openapi56.createRoute)({
+var getLikersRoute = (0, import_zod_openapi57.createRoute)({
   method: "get",
   path: "/pages/{id}/likers",
   tags: ["presence"],
@@ -5845,50 +5943,50 @@ var presenceRoutes = {
 };
 
 // src/contracts/revision.ts
-var import_zod_openapi58 = require("@hono/zod-openapi");
+var import_zod_openapi59 = require("@hono/zod-openapi");
 
 // src/schemas/revision.ts
-var import_zod_openapi57 = require("@hono/zod-openapi");
-var RevisionMetaSchema = import_zod_openapi57.z.object({
-  _id: import_zod_openapi57.z.string(),
-  path: import_zod_openapi57.z.string(),
+var import_zod_openapi58 = require("@hono/zod-openapi");
+var RevisionMetaSchema = import_zod_openapi58.z.object({
+  _id: import_zod_openapi58.z.string(),
+  path: import_zod_openapi58.z.string(),
   author: PageUserSchema.nullable().optional(),
   savedBy: PageUserSchema.nullable().optional(),
-  contributors: import_zod_openapi57.z.array(PageUserSchema).optional(),
+  contributors: import_zod_openapi58.z.array(PageUserSchema).optional(),
   // RFC-0010 — edit channel. `web` (browser / collab editor) vs the API
   // token paths (`oauth` / `pat`). Absent on pre-RFC-0010 revisions. The
   // history UI shows an "app" chip for the token paths.
-  editVia: import_zod_openapi57.z.enum(["web", "oauth", "pat"]).optional(),
-  createdAt: import_zod_openapi57.z.string()
+  editVia: import_zod_openapi58.z.enum(["web", "oauth", "pat"]).optional(),
+  createdAt: import_zod_openapi58.z.string()
 });
-var ListRevisionsRequestSchema = import_zod_openapi57.z.object({
-  limit: import_zod_openapi57.z.coerce.number().int().positive().max(200).optional().default(50),
-  offset: import_zod_openapi57.z.coerce.number().int().min(0).optional().default(0)
+var ListRevisionsRequestSchema = import_zod_openapi58.z.object({
+  limit: import_zod_openapi58.z.coerce.number().int().positive().max(200).optional().default(50),
+  offset: import_zod_openapi58.z.coerce.number().int().min(0).optional().default(0)
 });
-var ListRevisionsResponseSchema = import_zod_openapi57.z.object({
-  revisions: import_zod_openapi57.z.array(RevisionMetaSchema),
+var ListRevisionsResponseSchema = import_zod_openapi58.z.object({
+  revisions: import_zod_openapi58.z.array(RevisionMetaSchema),
   pager: PagerSchema
 });
-var GetRevisionResponseSchema = import_zod_openapi57.z.object({
+var GetRevisionResponseSchema = import_zod_openapi58.z.object({
   revision: RevisionSchema
 });
-var GetRevisionsRequestSchema = import_zod_openapi57.z.object({
-  ids: import_zod_openapi57.z.string().min(1, "ids is required")
+var GetRevisionsRequestSchema = import_zod_openapi58.z.object({
+  ids: import_zod_openapi58.z.string().min(1, "ids is required")
 });
-var GetRevisionsResponseSchema = import_zod_openapi57.z.object({
-  revisions: import_zod_openapi57.z.array(RevisionSchema)
+var GetRevisionsResponseSchema = import_zod_openapi58.z.object({
+  revisions: import_zod_openapi58.z.array(RevisionSchema)
 });
-var RevisionInvalidRequestErrorSchema = import_zod_openapi57.z.object({
-  error: import_zod_openapi57.z.object({
-    code: import_zod_openapi57.z.literal("INVALID_REQUEST"),
-    message: import_zod_openapi57.z.string()
+var RevisionInvalidRequestErrorSchema = import_zod_openapi58.z.object({
+  error: import_zod_openapi58.z.object({
+    code: import_zod_openapi58.z.literal("INVALID_REQUEST"),
+    message: import_zod_openapi58.z.string()
   })
 });
 
 // src/contracts/revision.ts
-var PageIdParamSchema = import_zod_openapi58.z.object({ page_id: import_zod_openapi58.z.string() });
-var RevisionIdParamSchema = import_zod_openapi58.z.object({ id: import_zod_openapi58.z.string() });
-var listRevisionsRoute = (0, import_zod_openapi58.createRoute)({
+var PageIdParamSchema = import_zod_openapi59.z.object({ page_id: import_zod_openapi59.z.string() });
+var RevisionIdParamSchema = import_zod_openapi59.z.object({ id: import_zod_openapi59.z.string() });
+var listRevisionsRoute = (0, import_zod_openapi59.createRoute)({
   method: "get",
   path: "/pages/{page_id}/revisions",
   tags: ["revision"],
@@ -5917,7 +6015,7 @@ var listRevisionsRoute = (0, import_zod_openapi58.createRoute)({
     }
   }
 });
-var getRevisionsRoute = (0, import_zod_openapi58.createRoute)({
+var getRevisionsRoute = (0, import_zod_openapi59.createRoute)({
   method: "get",
   path: "/pages/revisions",
   tags: ["revision"],
@@ -5945,7 +6043,7 @@ var getRevisionsRoute = (0, import_zod_openapi58.createRoute)({
     }
   }
 });
-var getRevisionRoute = (0, import_zod_openapi58.createRoute)({
+var getRevisionRoute = (0, import_zod_openapi59.createRoute)({
   method: "get",
   path: "/pages/revisions/{id}",
   tags: ["revision"],
@@ -5983,39 +6081,39 @@ var revisionRoutes = {
 };
 
 // src/contracts/admin-crypto.ts
-var import_zod_openapi60 = require("@hono/zod-openapi");
+var import_zod_openapi61 = require("@hono/zod-openapi");
 
 // src/schemas/admin-crypto.ts
-var import_zod_openapi59 = require("@hono/zod-openapi");
-var SensitiveConfigEntrySchema = import_zod_openapi59.z.object({
-  ns: import_zod_openapi59.z.string(),
-  key: import_zod_openapi59.z.string(),
-  present: import_zod_openapi59.z.boolean(),
-  encrypted: import_zod_openapi59.z.boolean()
+var import_zod_openapi60 = require("@hono/zod-openapi");
+var SensitiveConfigEntrySchema = import_zod_openapi60.z.object({
+  ns: import_zod_openapi60.z.string(),
+  key: import_zod_openapi60.z.string(),
+  present: import_zod_openapi60.z.boolean(),
+  encrypted: import_zod_openapi60.z.boolean()
 });
-var CryptoStatusResponseSchema = import_zod_openapi59.z.object({
+var CryptoStatusResponseSchema = import_zod_openapi60.z.object({
   /** False when CROWI_ENCRYPTION_KEY is not configured — UI shows a setup hint. */
-  encryptionConfigured: import_zod_openapi59.z.boolean(),
-  unencryptedCount: import_zod_openapi59.z.number().int().min(0),
-  encryptedCount: import_zod_openapi59.z.number().int().min(0),
-  entries: import_zod_openapi59.z.array(SensitiveConfigEntrySchema)
+  encryptionConfigured: import_zod_openapi60.z.boolean(),
+  unencryptedCount: import_zod_openapi60.z.number().int().min(0),
+  encryptedCount: import_zod_openapi60.z.number().int().min(0),
+  entries: import_zod_openapi60.z.array(SensitiveConfigEntrySchema)
 });
-var ReencryptResponseSchema = import_zod_openapi59.z.object({
-  rewritten: import_zod_openapi59.z.number().int().min(0),
+var ReencryptResponseSchema = import_zod_openapi60.z.object({
+  rewritten: import_zod_openapi60.z.number().int().min(0),
   /** Already encrypted, skipped on this run. */
-  alreadyEncrypted: import_zod_openapi59.z.number().int().min(0),
+  alreadyEncrypted: import_zod_openapi60.z.number().int().min(0),
   /** Sensitive registry entries that had no row in the DB at all. */
-  missing: import_zod_openapi59.z.number().int().min(0)
+  missing: import_zod_openapi60.z.number().int().min(0)
 });
-var EncryptionNotConfiguredErrorSchema = import_zod_openapi59.z.object({
-  error: import_zod_openapi59.z.object({
-    code: import_zod_openapi59.z.literal("ENCRYPTION_NOT_CONFIGURED"),
-    message: import_zod_openapi59.z.string()
+var EncryptionNotConfiguredErrorSchema = import_zod_openapi60.z.object({
+  error: import_zod_openapi60.z.object({
+    code: import_zod_openapi60.z.literal("ENCRYPTION_NOT_CONFIGURED"),
+    message: import_zod_openapi60.z.string()
   })
 });
 
 // src/contracts/admin-crypto.ts
-var getCryptoStatusRoute = (0, import_zod_openapi60.createRoute)({
+var getCryptoStatusRoute = (0, import_zod_openapi61.createRoute)({
   method: "get",
   path: "/admin/crypto/status",
   tags: ["adminCrypto"],
@@ -6040,7 +6138,7 @@ var getCryptoStatusRoute = (0, import_zod_openapi60.createRoute)({
     }
   }
 });
-var reencryptAllRoute = (0, import_zod_openapi60.createRoute)({
+var reencryptAllRoute = (0, import_zod_openapi61.createRoute)({
   method: "post",
   path: "/admin/crypto/reencrypt",
   tags: ["adminCrypto"],
@@ -6075,37 +6173,37 @@ var adminCryptoRoutes = {
 };
 
 // src/contracts/search.ts
-var import_zod_openapi62 = require("@hono/zod-openapi");
+var import_zod_openapi63 = require("@hono/zod-openapi");
 
 // src/schemas/search.ts
-var import_zod_openapi61 = require("@hono/zod-openapi");
-var SearchPageTypeSchema = import_zod_openapi61.z.enum(["portal", "public", "user"]);
-var SearchPagesRequestSchema = import_zod_openapi61.z.object({
-  q: import_zod_openapi61.z.string().min(1),
-  tree: import_zod_openapi61.z.string().optional(),
+var import_zod_openapi62 = require("@hono/zod-openapi");
+var SearchPageTypeSchema = import_zod_openapi62.z.enum(["portal", "public", "user"]);
+var SearchPagesRequestSchema = import_zod_openapi62.z.object({
+  q: import_zod_openapi62.z.string().min(1),
+  tree: import_zod_openapi62.z.string().optional(),
   type: SearchPageTypeSchema.optional(),
-  page: import_zod_openapi61.z.coerce.number().int().min(1).default(1),
-  limit: import_zod_openapi61.z.coerce.number().int().min(1).max(100).default(50)
-});
-var SearchHitSchema = import_zod_openapi61.z.object({
-  pageId: import_zod_openapi61.z.string(),
-  path: import_zod_openapi61.z.string(),
-  score: import_zod_openapi61.z.number().optional(),
-  snippet: import_zod_openapi61.z.string().optional(),
-  bookmarkCount: import_zod_openapi61.z.number(),
+  page: import_zod_openapi62.z.coerce.number().int().min(1).default(1),
+  limit: import_zod_openapi62.z.coerce.number().int().min(1).max(100).default(50)
+});
+var SearchHitSchema = import_zod_openapi62.z.object({
+  pageId: import_zod_openapi62.z.string(),
+  path: import_zod_openapi62.z.string(),
+  score: import_zod_openapi62.z.number().optional(),
+  snippet: import_zod_openapi62.z.string().optional(),
+  bookmarkCount: import_zod_openapi62.z.number(),
   page: PageSchema
 });
-var SearchPagesResponseSchema = import_zod_openapi61.z.object({
-  meta: import_zod_openapi61.z.object({
-    took: import_zod_openapi61.z.number().optional(),
-    total: import_zod_openapi61.z.number(),
-    results: import_zod_openapi61.z.number()
+var SearchPagesResponseSchema = import_zod_openapi62.z.object({
+  meta: import_zod_openapi62.z.object({
+    took: import_zod_openapi62.z.number().optional(),
+    total: import_zod_openapi62.z.number(),
+    results: import_zod_openapi62.z.number()
   }),
-  data: import_zod_openapi61.z.array(SearchHitSchema)
+  data: import_zod_openapi62.z.array(SearchHitSchema)
 });
 
 // src/contracts/search.ts
-var searchPagesRoute = (0, import_zod_openapi62.createRoute)({
+var searchPagesRoute = (0, import_zod_openapi63.createRoute)({
   method: "get",
   path: "/search",
   tags: ["search"],
@@ -6142,56 +6240,56 @@ var searchRoutes = {
 };
 
 // src/contracts/token-auth.ts
-var import_zod_openapi64 = require("@hono/zod-openapi");
+var import_zod_openapi65 = require("@hono/zod-openapi");
 
 // src/schemas/auth.ts
-var import_zod_openapi63 = require("@hono/zod-openapi");
-var TokenAuthLoginRequestSchema = import_zod_openapi63.z.object({
-  email: import_zod_openapi63.z.string().email(),
-  password: import_zod_openapi63.z.string().min(6)
-});
-var TokenAuthResponseSchema = import_zod_openapi63.z.object({
-  accessToken: import_zod_openapi63.z.string(),
-  refreshToken: import_zod_openapi63.z.string(),
-  expiresIn: import_zod_openapi63.z.number(),
+var import_zod_openapi64 = require("@hono/zod-openapi");
+var TokenAuthLoginRequestSchema = import_zod_openapi64.z.object({
+  email: import_zod_openapi64.z.string().email(),
+  password: import_zod_openapi64.z.string().min(6)
+});
+var TokenAuthResponseSchema = import_zod_openapi64.z.object({
+  accessToken: import_zod_openapi64.z.string(),
+  refreshToken: import_zod_openapi64.z.string(),
+  expiresIn: import_zod_openapi64.z.number(),
   // seconds until expiration
-  user: import_zod_openapi63.z.object({
-    id: import_zod_openapi63.z.string(),
-    username: import_zod_openapi63.z.string(),
-    email: import_zod_openapi63.z.string().email(),
-    name: import_zod_openapi63.z.string(),
-    image: import_zod_openapi63.z.string().optional(),
-    admin: import_zod_openapi63.z.boolean().optional()
+  user: import_zod_openapi64.z.object({
+    id: import_zod_openapi64.z.string(),
+    username: import_zod_openapi64.z.string(),
+    email: import_zod_openapi64.z.string().email(),
+    name: import_zod_openapi64.z.string(),
+    image: import_zod_openapi64.z.string().optional(),
+    admin: import_zod_openapi64.z.boolean().optional()
   })
 });
-var RefreshTokenRequestSchema = import_zod_openapi63.z.object({
-  refreshToken: import_zod_openapi63.z.string()
+var RefreshTokenRequestSchema = import_zod_openapi64.z.object({
+  refreshToken: import_zod_openapi64.z.string()
 });
-var TokenAuthRegisterRequestSchema = import_zod_openapi63.z.object({
-  username: import_zod_openapi63.z.string(),
-  name: import_zod_openapi63.z.string(),
-  email: import_zod_openapi63.z.string().email(),
-  password: import_zod_openapi63.z.string().min(6)
+var TokenAuthRegisterRequestSchema = import_zod_openapi64.z.object({
+  username: UsernameSchema,
+  name: import_zod_openapi64.z.string(),
+  email: import_zod_openapi64.z.string().email(),
+  password: import_zod_openapi64.z.string().min(6)
 });
-var RegisterPendingResponseSchema = import_zod_openapi63.z.object({
-  status: import_zod_openapi63.z.enum(["confirmation_required", "approval_required"])
+var RegisterPendingResponseSchema = import_zod_openapi64.z.object({
+  status: import_zod_openapi64.z.enum(["confirmation_required", "approval_required"])
 });
 
 // src/contracts/token-auth.ts
-var TokenLogoutResponseSchema = import_zod_openapi64.z.object({ message: import_zod_openapi64.z.string() });
-var TokenMeResponseSchema = import_zod_openapi64.z.object({
-  user: import_zod_openapi64.z.object({
-    id: import_zod_openapi64.z.string(),
-    username: import_zod_openapi64.z.string(),
-    email: import_zod_openapi64.z.string().email(),
-    name: import_zod_openapi64.z.string(),
-    image: import_zod_openapi64.z.string().optional(),
-    status: import_zod_openapi64.z.number(),
-    admin: import_zod_openapi64.z.boolean().optional(),
-    createdAt: import_zod_openapi64.z.string()
+var TokenLogoutResponseSchema = import_zod_openapi65.z.object({ message: import_zod_openapi65.z.string() });
+var TokenMeResponseSchema = import_zod_openapi65.z.object({
+  user: import_zod_openapi65.z.object({
+    id: import_zod_openapi65.z.string(),
+    username: import_zod_openapi65.z.string(),
+    email: import_zod_openapi65.z.string().email(),
+    name: import_zod_openapi65.z.string(),
+    image: import_zod_openapi65.z.string().optional(),
+    status: import_zod_openapi65.z.number(),
+    admin: import_zod_openapi65.z.boolean().optional(),
+    createdAt: import_zod_openapi65.z.string()
   })
 });
-var tokenLoginRoute = (0, import_zod_openapi64.createRoute)({
+var tokenLoginRoute = (0, import_zod_openapi65.createRoute)({
   method: "post",
   path: "/auth/login",
   tags: ["tokenAuth"],
@@ -6228,7 +6326,7 @@ var tokenLoginRoute = (0, import_zod_openapi64.createRoute)({
     }
   }
 });
-var tokenRegisterRoute = (0, import_zod_openapi64.createRoute)({
+var tokenRegisterRoute = (0, import_zod_openapi65.createRoute)({
   method: "post",
   path: "/auth/register",
   tags: ["tokenAuth"],
@@ -6269,7 +6367,7 @@ var tokenRegisterRoute = (0, import_zod_openapi64.createRoute)({
     }
   }
 });
-var tokenRefreshRoute = (0, import_zod_openapi64.createRoute)({
+var tokenRefreshRoute = (0, import_zod_openapi65.createRoute)({
   method: "post",
   path: "/auth/refresh",
   tags: ["tokenAuth"],
@@ -6306,7 +6404,7 @@ var tokenRefreshRoute = (0, import_zod_openapi64.createRoute)({
     }
   }
 });
-var tokenLogoutRoute = (0, import_zod_openapi64.createRoute)({
+var tokenLogoutRoute = (0, import_zod_openapi65.createRoute)({
   method: "post",
   path: "/auth/logout",
   tags: ["tokenAuth"],
@@ -6316,7 +6414,7 @@ var tokenLogoutRoute = (0, import_zod_openapi64.createRoute)({
     body: {
       content: {
         "application/json": {
-          schema: import_zod_openapi64.z.object({ refreshToken: import_zod_openapi64.z.string().optional() })
+          schema: import_zod_openapi65.z.object({ refreshToken: import_zod_openapi65.z.string().optional() })
         }
       }
     }
@@ -6336,7 +6434,7 @@ var tokenLogoutRoute = (0, import_zod_openapi64.createRoute)({
     }
   }
 });
-var tokenMeRoute = (0, import_zod_openapi64.createRoute)({
+var tokenMeRoute = (0, import_zod_openapi65.createRoute)({
   method: "get",
   path: "/auth/me",
   tags: ["tokenAuth"],
@@ -6365,23 +6463,404 @@ var tokenAuthRoutes = {
   tokenMeRoute
 };
 
-// src/contracts/invite-accept.ts
+// src/contracts/federated-auth.ts
+var import_zod_openapi67 = require("@hono/zod-openapi");
+
+// src/schemas/federated-auth.ts
 var import_zod_openapi66 = require("@hono/zod-openapi");
+var FederatedProviderSchema = import_zod_openapi66.z.object({
+  name: import_zod_openapi66.z.string(),
+  buttonLabel: import_zod_openapi66.z.string(),
+  iconUrl: import_zod_openapi66.z.string().optional()
+});
+var ProviderListResponseSchema = import_zod_openapi66.z.object({
+  providers: import_zod_openapi66.z.array(FederatedProviderSchema)
+});
+var SenderPublicJwkSchema = import_zod_openapi66.z.object({
+  kty: import_zod_openapi66.z.literal("EC"),
+  crv: import_zod_openapi66.z.literal("P-256"),
+  x: import_zod_openapi66.z.string(),
+  y: import_zod_openapi66.z.string()
+});
+var SenderProofSchema = import_zod_openapi66.z.object({
+  publicJwk: SenderPublicJwkSchema,
+  /** base64url ES256 signature over the canonical handoff message. */
+  signature: import_zod_openapi66.z.string()
+});
+var FederatedHandoffRequestSchema = import_zod_openapi66.z.object({
+  code: import_zod_openapi66.z.string(),
+  proof: SenderProofSchema
+});
+var FederatedHandoffResponseSchema = TokenAuthResponseSchema;
+var LinkedAuthProviderListResponseSchema = import_zod_openapi66.z.object({
+  identities: import_zod_openapi66.z.array(import_zod_openapi66.z.object({ provider: import_zod_openapi66.z.string() }))
+});
+var CreateLinkGrantRequestSchema = import_zod_openapi66.z.object({
+  /** RFC 7638 thumbprint of the P-256 public key this browser will use at `/start` — binds the grant to this browser (AC-2). */
+  handoffChallenge: import_zod_openapi66.z.string().min(1)
+});
+var CreateLinkGrantResponseSchema = import_zod_openapi66.z.object({
+  linkGrant: import_zod_openapi66.z.string()
+});
+var UnlinkAuthProviderErrorSchema = import_zod_openapi66.z.object({
+  error: import_zod_openapi66.z.object({
+    code: import_zod_openapi66.z.enum(["FEDERATED_UNLINK_DISABLED", "PASSWORD_REQUIRED"]),
+    message: import_zod_openapi66.z.string()
+  })
+});
+
+// src/contracts/federated-auth.ts
+var ContinuePathSchema = import_zod_openapi67.z.string().regex(/^\/(?!\/)[^\\\x00-\x1F\x7F]*$/, 'continue must be a local path starting with a single "/" and contain no backslash or control characters').max(2e3, "continue must be at most 2000 characters");
+var listFederatedProvidersRoute = (0, import_zod_openapi67.createRoute)({
+  method: "get",
+  path: "/auth/providers",
+  tags: ["federatedAuth"],
+  summary: "List enabled OAuth2/OIDC federated sign-in providers",
+  responses: {
+    200: {
+      description: "Enabled providers, in name order",
+      content: { "application/json": { schema: ProviderListResponseSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var startFederatedProviderRoute = (0, import_zod_openapi67.createRoute)({
+  method: "get",
+  path: "/auth/providers/{name}/start",
+  tags: ["federatedAuth"],
+  summary: "Top-level navigation that redirects the browser to the named provider",
+  request: {
+    params: import_zod_openapi67.z.object({ name: import_zod_openapi67.z.string() }),
+    query: import_zod_openapi67.z.object({
+      continue: ContinuePathSchema,
+      /** base64url(JSON) of the sender's P-256 public JWK. */
+      handoff_jwk: import_zod_openapi67.z.string().min(1),
+      /** base64url ES256 signature over the start canonical message. */
+      handoff_proof: import_zod_openapi67.z.string().min(1),
+      /**
+       * RFC-0014 phase 3 — `'1'` switches this start into LINK mode: the
+       * request must carry a web-session JWT, and the flow attaches the
+       * resulting identity to that session's user instead of signing
+       * anyone in. Absent (the ordinary sign-in start) the route stays
+       * fully public.
+       */
+      link: import_zod_openapi67.z.literal("1").optional(),
+      /** The opaque id from `POST /auth/providers/{name}/link-grants`. Required when `link=1`, ignored otherwise. */
+      link_grant: import_zod_openapi67.z.string().min(1).optional()
+    })
+  },
+  responses: {
+    302: { description: "Redirect to the provider authorization endpoint" },
+    400: {
+      description: "Malformed continue / sender proof, or an invalid/expired/mismatched link grant",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    401: {
+      description: "link=1 without a web-session JWT \u2014 never downgraded to the public sign-in start",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    403: {
+      description: "link=1 with a non-web credential (PAT / OAuth access token)",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    404: {
+      description: "Unknown, unconfigured, or credential-kind provider",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var listLinkedAuthProvidersRoute = (0, import_zod_openapi67.createRoute)({
+  method: "get",
+  path: "/auth/providers/identities",
+  tags: ["federatedAuth"],
+  summary: "List the provider slugs the current user has linked",
+  responses: {
+    200: {
+      description: "Linked provider slugs, in name order",
+      content: { "application/json": { schema: LinkedAuthProviderListResponseSchema } }
+    },
+    401: {
+      description: "Authentication required",
+      content: { "application/json": { schema: AuthenticationRequiredErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var createAuthProviderLinkGrantRoute = (0, import_zod_openapi67.createRoute)({
+  method: "post",
+  path: "/auth/providers/{name}/link-grants",
+  tags: ["federatedAuth"],
+  summary: "Mint a short-lived, opaque grant that authorizes ONE link start for the current web session",
+  request: {
+    params: import_zod_openapi67.z.object({ name: import_zod_openapi67.z.string() }),
+    body: { content: { "application/json": { schema: CreateLinkGrantRequestSchema } } }
+  },
+  responses: {
+    200: {
+      description: "Opaque single-use grant id",
+      content: { "application/json": { schema: CreateLinkGrantResponseSchema } }
+    },
+    401: {
+      description: "Authentication required",
+      content: { "application/json": { schema: AuthenticationRequiredErrorSchema } }
+    },
+    403: {
+      description: "Non-web credential (PAT / OAuth access token)",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    404: {
+      description: "Unknown, unconfigured, or credential-kind provider",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var unlinkAuthProviderRoute = (0, import_zod_openapi67.createRoute)({
+  method: "delete",
+  path: "/auth/providers/{name}/identity",
+  tags: ["federatedAuth"],
+  summary: "Disconnect the current user's identity for this provider",
+  request: {
+    params: import_zod_openapi67.z.object({ name: import_zod_openapi67.z.string() })
+  },
+  responses: {
+    204: { description: "Identity removed" },
+    401: {
+      description: "Authentication required",
+      content: { "application/json": { schema: AuthenticationRequiredErrorSchema } }
+    },
+    403: {
+      description: "Non-web credential (PAT / OAuth access token)",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    404: {
+      description: "No identity linked for this provider",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    409: {
+      description: "Refused: password auth is disabled instance-wide, or this user has no password set",
+      content: { "application/json": { schema: UnlinkAuthProviderErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var callbackFederatedProviderRoute = (0, import_zod_openapi67.createRoute)({
+  method: "get",
+  path: "/auth/providers/{name}/callback",
+  tags: ["federatedAuth"],
+  summary: "Provider redirect target; completes the OAuth2/OIDC exchange",
+  request: {
+    params: import_zod_openapi67.z.object({ name: import_zod_openapi67.z.string() }),
+    query: import_zod_openapi67.z.object({
+      code: import_zod_openapi67.z.string().optional(),
+      state: import_zod_openapi67.z.string().optional(),
+      error: import_zod_openapi67.z.string().optional()
+    })
+  },
+  responses: {
+    302: {
+      description: "Redirect to the trusted web login/complete page on success, or back to the trusted web /login on failure"
+    },
+    404: {
+      description: "Unknown or unconfigured provider (also used when trusted origins cannot be resolved)",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var federatedHandoffRoute = (0, import_zod_openapi67.createRoute)({
+  method: "post",
+  path: "/auth/handoff",
+  tags: ["federatedAuth"],
+  summary: "Exchange a sender-constrained federated handoff code for session tokens",
+  request: {
+    body: { content: { "application/json": { schema: FederatedHandoffRequestSchema } } }
+  },
+  responses: {
+    200: {
+      description: "Session tokens \u2014 same shape as POST /auth/login",
+      content: { "application/json": { schema: FederatedHandoffResponseSchema } }
+    },
+    401: {
+      description: "Invalid / expired handoff code, or sender proof did not verify",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    409: {
+      description: "Handoff code already consumed",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var federatedAuthRoutes = {
+  listFederatedProvidersRoute,
+  startFederatedProviderRoute,
+  callbackFederatedProviderRoute,
+  federatedHandoffRoute,
+  listLinkedAuthProvidersRoute,
+  createAuthProviderLinkGrantRoute,
+  unlinkAuthProviderRoute
+};
+
+// src/contracts/federated-registration.ts
+var import_zod_openapi69 = require("@hono/zod-openapi");
+
+// src/schemas/federated-registration.ts
+var import_zod_openapi68 = require("@hono/zod-openapi");
+var FederatedRegistrationSnapshotSchema = import_zod_openapi68.z.object({
+  /** IdP-verified email, prefilled read-only on the registration screen. */
+  email: import_zod_openapi68.z.string().email(),
+  /** Driver slug, e.g. `'google'`. */
+  provider: import_zod_openapi68.z.string(),
+  /** Human-friendly provider name (the driver's `buttonLabel`), e.g. `'Google'`. */
+  providerLabel: import_zod_openapi68.z.string(),
+  /**
+   * This grant's registration has already been submitted and is waiting
+   * for an administrator (Restricted mode). The screen must show that
+   * state instead of the username form.
+   *
+   * Deliberately narrow: it is not a general status field, and it never
+   * distinguishes unknown / expired / cancelled / completed grants (those
+   * are all the same 404 — AC-2). It exists because a submitted
+   * registration is still readable by its own grant, and re-offering an
+   * editable username there invites a change that cannot be applied — the
+   * second submit is refused and the typed value silently discarded.
+   */
+  approvalPending: import_zod_openapi68.z.boolean()
+});
+var FederatedRegistrationSubmitRequestSchema = import_zod_openapi68.z.object({
+  username: UsernameSchema
+});
+var FederatedRegistrationActiveResultSchema = import_zod_openapi68.z.object({
+  status: import_zod_openapi68.z.literal("active"),
+  code: import_zod_openapi68.z.string()
+});
+var FederatedRegistrationApprovalResultSchema = import_zod_openapi68.z.object({
+  status: import_zod_openapi68.z.literal("approval_required")
+});
+var FederatedRegistrationResultSchema = import_zod_openapi68.z.discriminatedUnion("status", [
+  FederatedRegistrationActiveResultSchema,
+  FederatedRegistrationApprovalResultSchema
+]);
+
+// src/contracts/federated-registration.ts
+var TokenParamSchema = import_zod_openapi69.z.object({ token: import_zod_openapi69.z.string().min(1) });
+var getFederatedRegistrationRoute = (0, import_zod_openapi69.createRoute)({
+  method: "get",
+  path: "/auth/federated-registration/{token}",
+  tags: ["federatedRegistration"],
+  summary: "Read-only snapshot (email/provider/providerLabel) for a pending federated registration",
+  request: {
+    params: TokenParamSchema
+  },
+  responses: {
+    200: {
+      description: "Pending registration snapshot",
+      content: { "application/json": { schema: FederatedRegistrationSnapshotSchema } }
+    },
+    404: {
+      description: "Grant is unknown, expired, or cancelled",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var submitFederatedRegistrationRoute = (0, import_zod_openapi69.createRoute)({
+  method: "post",
+  path: "/auth/federated-registration/{token}",
+  tags: ["federatedRegistration"],
+  summary: "Submit the chosen username; provisions the User (JIT) and activates or queues approval",
+  request: {
+    params: TokenParamSchema,
+    body: { content: { "application/json": { schema: FederatedRegistrationSubmitRequestSchema } } }
+  },
+  responses: {
+    200: {
+      description: "Open: account is active \u2014 a Phase 1 handoff code, redeemed via POST /auth/handoff. Restricted: awaiting admin approval.",
+      content: { "application/json": { schema: FederatedRegistrationResultSchema } }
+    },
+    400: {
+      description: "Username fails the shared username contract",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    404: {
+      description: "Grant is unknown, expired, or cancelled",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    409: {
+      description: "Username/email already taken, or the identity is already linked to a different user",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var logoutFederatedRegistrationRoute = (0, import_zod_openapi69.createRoute)({
+  method: "post",
+  path: "/auth/federated-registration/{token}/logout",
+  tags: ["federatedRegistration"],
+  summary: "Cancel a pending federated registration and invalidate the grant",
+  request: {
+    params: TokenParamSchema
+  },
+  responses: {
+    204: { description: "Grant cancelled (or was already inactive) \u2014 idempotent" },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var federatedRegistrationRoutes = {
+  getFederatedRegistrationRoute,
+  submitFederatedRegistrationRoute,
+  logoutFederatedRegistrationRoute
+};
+
+// src/contracts/invite-accept.ts
+var import_zod_openapi71 = require("@hono/zod-openapi");
 
 // src/schemas/invite-accept.ts
-var import_zod_openapi65 = require("@hono/zod-openapi");
-var InviteAcceptRequestSchema = import_zod_openapi65.z.object({
-  token: import_zod_openapi65.z.string(),
-  username: import_zod_openapi65.z.string().min(1),
-  name: import_zod_openapi65.z.string().min(1),
-  password: import_zod_openapi65.z.string().min(6)
+var import_zod_openapi70 = require("@hono/zod-openapi");
+var InviteAcceptRequestSchema = import_zod_openapi70.z.object({
+  token: import_zod_openapi70.z.string(),
+  username: UsernameSchema,
+  name: import_zod_openapi70.z.string().min(1),
+  password: import_zod_openapi70.z.string().min(6)
 });
-var InvitePreviewResponseSchema = import_zod_openapi65.z.object({
-  email: import_zod_openapi65.z.string().email()
+var InvitePreviewResponseSchema = import_zod_openapi70.z.object({
+  email: import_zod_openapi70.z.string().email()
 });
 
 // src/contracts/invite-accept.ts
-var invitePreviewRoute = (0, import_zod_openapi66.createRoute)({
+var invitePreviewRoute = (0, import_zod_openapi71.createRoute)({
   method: "get",
   path: "/invite/accept",
   tags: ["inviteAccept"],
@@ -6408,7 +6887,7 @@ var invitePreviewRoute = (0, import_zod_openapi66.createRoute)({
     }
   }
 });
-var acceptInviteRoute = (0, import_zod_openapi66.createRoute)({
+var acceptInviteRoute = (0, import_zod_openapi71.createRoute)({
   method: "post",
   path: "/invite/accept",
   tags: ["inviteAccept"],
@@ -6451,23 +6930,23 @@ var inviteAcceptRoutes = {
 };
 
 // src/contracts/password-reset.ts
-var import_zod_openapi68 = require("@hono/zod-openapi");
+var import_zod_openapi73 = require("@hono/zod-openapi");
 
 // src/schemas/password-reset.ts
-var import_zod_openapi67 = require("@hono/zod-openapi");
-var ForgotPasswordRequestSchema = import_zod_openapi67.z.object({
-  email: import_zod_openapi67.z.string().email()
+var import_zod_openapi72 = require("@hono/zod-openapi");
+var ForgotPasswordRequestSchema = import_zod_openapi72.z.object({
+  email: import_zod_openapi72.z.string().email()
 });
-var ForgotPasswordResponseSchema = import_zod_openapi67.z.object({
-  ok: import_zod_openapi67.z.literal(true)
+var ForgotPasswordResponseSchema = import_zod_openapi72.z.object({
+  ok: import_zod_openapi72.z.literal(true)
 });
-var ResetPasswordRequestSchema = import_zod_openapi67.z.object({
-  token: import_zod_openapi67.z.string(),
-  password: import_zod_openapi67.z.string().min(6)
+var ResetPasswordRequestSchema = import_zod_openapi72.z.object({
+  token: import_zod_openapi72.z.string(),
+  password: import_zod_openapi72.z.string().min(6)
 });
 
 // src/contracts/password-reset.ts
-var forgotPasswordRoute = (0, import_zod_openapi68.createRoute)({
+var forgotPasswordRoute = (0, import_zod_openapi73.createRoute)({
   method: "post",
   path: "/auth/forgot-password",
   tags: ["passwordReset"],
@@ -6492,7 +6971,7 @@ var forgotPasswordRoute = (0, import_zod_openapi68.createRoute)({
     }
   }
 });
-var validateResetTokenRoute = (0, import_zod_openapi68.createRoute)({
+var validateResetTokenRoute = (0, import_zod_openapi73.createRoute)({
   method: "get",
   path: "/auth/reset-password",
   tags: ["passwordReset"],
@@ -6515,7 +6994,7 @@ var validateResetTokenRoute = (0, import_zod_openapi68.createRoute)({
     }
   }
 });
-var selfResetPasswordRoute = (0, import_zod_openapi68.createRoute)({
+var selfResetPasswordRoute = (0, import_zod_openapi73.createRoute)({
   method: "post",
   path: "/auth/reset-password",
   tags: ["passwordReset"],
@@ -6555,19 +7034,19 @@ var passwordResetRoutes = {
 };
 
 // src/contracts/activation.ts
-var import_zod_openapi70 = require("@hono/zod-openapi");
+var import_zod_openapi75 = require("@hono/zod-openapi");
 
 // src/schemas/activation.ts
-var import_zod_openapi69 = require("@hono/zod-openapi");
-var ActivateRequestSchema = import_zod_openapi69.z.object({
-  token: import_zod_openapi69.z.string()
+var import_zod_openapi74 = require("@hono/zod-openapi");
+var ActivateRequestSchema = import_zod_openapi74.z.object({
+  token: import_zod_openapi74.z.string()
 });
-var ActivateValidationResponseSchema = import_zod_openapi69.z.object({
-  ok: import_zod_openapi69.z.literal(true)
+var ActivateValidationResponseSchema = import_zod_openapi74.z.object({
+  ok: import_zod_openapi74.z.literal(true)
 });
 
 // src/contracts/activation.ts
-var validateActivationTokenRoute = (0, import_zod_openapi70.createRoute)({
+var validateActivationTokenRoute = (0, import_zod_openapi75.createRoute)({
   method: "get",
   path: "/auth/activate",
   tags: ["activation"],
@@ -6590,7 +7069,7 @@ var validateActivationTokenRoute = (0, import_zod_openapi70.createRoute)({
     }
   }
 });
-var activateAccountRoute = (0, import_zod_openapi70.createRoute)({
+var activateAccountRoute = (0, import_zod_openapi75.createRoute)({
   method: "post",
   path: "/auth/activate",
   tags: ["activation"],
@@ -6625,21 +7104,21 @@ var activationRoutes = {
 };
 
 // src/contracts/email-change.ts
-var import_zod_openapi72 = require("@hono/zod-openapi");
+var import_zod_openapi77 = require("@hono/zod-openapi");
 
 // src/schemas/email-change.ts
-var import_zod_openapi71 = require("@hono/zod-openapi");
-var ConfirmEmailChangeRequestSchema = import_zod_openapi71.z.object({
-  token: import_zod_openapi71.z.string()
+var import_zod_openapi76 = require("@hono/zod-openapi");
+var ConfirmEmailChangeRequestSchema = import_zod_openapi76.z.object({
+  token: import_zod_openapi76.z.string()
 });
-var ConfirmEmailChangeResponseSchema = import_zod_openapi71.z.object({
-  ok: import_zod_openapi71.z.literal(true),
+var ConfirmEmailChangeResponseSchema = import_zod_openapi76.z.object({
+  ok: import_zod_openapi76.z.literal(true),
   /** The newly-confirmed email address. */
-  email: import_zod_openapi71.z.string().email()
+  email: import_zod_openapi76.z.string().email()
 });
 
 // src/contracts/email-change.ts
-var validateEmailChangeTokenRoute = (0, import_zod_openapi72.createRoute)({
+var validateEmailChangeTokenRoute = (0, import_zod_openapi77.createRoute)({
   method: "get",
   path: "/auth/confirm-email-change",
   tags: ["emailChange"],
@@ -6662,7 +7141,7 @@ var validateEmailChangeTokenRoute = (0, import_zod_openapi72.createRoute)({
     }
   }
 });
-var confirmEmailChangeRoute = (0, import_zod_openapi72.createRoute)({
+var confirmEmailChangeRoute = (0, import_zod_openapi77.createRoute)({
   method: "post",
   path: "/auth/confirm-email-change",
   tags: ["emailChange"],
@@ -6701,9 +7180,9 @@ var emailChangeRoutes = {
 };
 
 // src/contracts/user.ts
-var import_zod_openapi73 = require("@hono/zod-openapi");
-var UsernameParamSchema = import_zod_openapi73.z.object({ username: import_zod_openapi73.z.string() });
-var getUserPageRoute = (0, import_zod_openapi73.createRoute)({
+var import_zod_openapi78 = require("@hono/zod-openapi");
+var UsernameParamSchema = import_zod_openapi78.z.object({ username: import_zod_openapi78.z.string() });
+var getUserPageRoute = (0, import_zod_openapi78.createRoute)({
   method: "get",
   path: "/user/{username}",
   tags: ["user"],
@@ -6731,7 +7210,7 @@ var getUserPageRoute = (0, import_zod_openapi73.createRoute)({
     }
   }
 });
-var getUserBookmarksRoute = (0, import_zod_openapi73.createRoute)({
+var getUserBookmarksRoute = (0, import_zod_openapi78.createRoute)({
   method: "get",
   path: "/user/{username}/bookmarks",
   tags: ["user"],
@@ -6760,7 +7239,7 @@ var getUserBookmarksRoute = (0, import_zod_openapi73.createRoute)({
     }
   }
 });
-var getUserPagesRoute = (0, import_zod_openapi73.createRoute)({
+var getUserPagesRoute = (0, import_zod_openapi78.createRoute)({
   method: "get",
   path: "/user/{username}/pages",
   tags: ["user"],
@@ -6789,7 +7268,7 @@ var getUserPagesRoute = (0, import_zod_openapi73.createRoute)({
     }
   }
 });
-var getUserSubpagesRoute = (0, import_zod_openapi73.createRoute)({
+var getUserSubpagesRoute = (0, import_zod_openapi78.createRoute)({
   method: "get",
   path: "/user/{username}/subpages",
   tags: ["user"],
@@ -6826,7 +7305,7 @@ var getUserSubpagesRoute = (0, import_zod_openapi73.createRoute)({
     }
   }
 });
-var listMembersRoute = (0, import_zod_openapi73.createRoute)({
+var listMembersRoute = (0, import_zod_openapi78.createRoute)({
   method: "get",
   path: "/users",
   tags: ["user"],
@@ -6872,6 +7351,13 @@ var stubTokens = {
   expiresIn: 0,
   user: stubUser
 };
+var stubProviderList = { providers: [] };
+var stubFederatedRegistrationSnapshot = {
+  email: "stub@example.com",
+  provider: "",
+  providerLabel: "",
+  approvalPending: false
+};
 var stubProfile = {
   id: "",
   username: "",
@@ -6881,7 +7367,8 @@ var stubProfile = {
   theme: "system",
   image: null,
   hasPassword: false,
-  createdAt: ""
+  createdAt: "",
+  federated: false
 };
 var stubAccessToken = {
   id: "",
@@ -7120,8 +7607,9 @@ var stubPendingUsersCount = { count: 0 };
 var stubListPlugins = { plugins: [] };
 var stubPluginConfig = { name: "", fields: [], values: {} };
 var stubUpdatePluginConfig = { ok: true, hotReloaded: false, reconfigureFailed: false };
+var stubPluginReadiness = { issues: [] };
 var stubClearRenderCache = { ok: true, clearedAt: "", removedCount: 0 };
-var appAuthMeUserChain = new import_zod_openapi74.OpenAPIHono().openapi(
+var appAuthMeUserChain = new import_zod_openapi79.OpenAPIHono().openapi(
   appRoutes.getAppInfoRoute,
   (c) => c.json(
     {
@@ -7155,31 +7643,33 @@ var appAuthMeUserChain = new import_zod_openapi74.OpenAPIHono().openapi(
   meRoutes.updatePasswordRoute,
   (c) => c.json({ status: "ok", message: "", accessToken: "", refreshToken: "", expiresIn: 0 }, 200)
 ).openapi(meRoutes.recentlyViewedPagesRoute, (c) => c.json({ pages: [] }, 200)).openapi(accessTokenRoutes.listAccessTokensRoute, (c) => c.json({ accessTokens: [] }, 200)).openapi(accessTokenRoutes.createAccessTokenRoute, (c) => c.json(stubCreateAccessToken, 201)).openapi(accessTokenRoutes.deleteAccessTokenRoute, (c) => c.json(stubAccessToken, 200)).openapi(userRoutes.getUserPageRoute, (c) => c.json(stubUserPage, 200)).openapi(userRoutes.getUserBookmarksRoute, (c) => c.json(stubUserBookmarks, 200)).openapi(userRoutes.getUserPagesRoute, (c) => c.json(stubUserPages, 200)).openapi(userRoutes.getUserSubpagesRoute, (c) => c.json(stubUserPages, 200)).openapi(userRoutes.listMembersRoute, (c) => c.json(stubListUsers, 200));
-var bookmarkBacklinkCommentRevisionChain = new import_zod_openapi74.OpenAPIHono().openapi(bookmarkRoutes.getBookmarkRoute, (c) => c.json(stubBookmarkResponse, 200)).openapi(bookmarkRoutes.listMyBookmarksRoute, (c) => c.json(stubListMyBookmarks, 200)).openapi(bookmarkRoutes.addBookmarkRoute, (c) => c.json(stubBookmarkResponse, 200)).openapi(bookmarkRoutes.removeBookmarkRoute, (c) => c.json(stubRemoveBookmark, 200)).openapi(backlinkRoutes.getBacklinksRoute, (c) => c.json(stubBacklinks, 200)).openapi(commentRoutes.listCommentsRoute, (c) => c.json(stubListComments, 200)).openapi(commentRoutes.addCommentRoute, (c) => c.json(stubAddComment, 200)).openapi(commentRoutes.deleteCommentRoute, (c) => c.json(stubDeleteComment, 200)).openapi(revisionRoutes.listRevisionsRoute, (c) => c.json(stubListRevisions, 200)).openapi(revisionRoutes.getRevisionsRoute, (c) => c.json(stubGetRevisions, 200)).openapi(revisionRoutes.getRevisionRoute, (c) => c.json(stubGetRevision, 200));
-var pageChain = new import_zod_openapi74.OpenAPIHono().openapi(pageRoutes.getPageRoute, (c) => c.json(stubPageWithRevision, 200)).openapi(pageRoutes.listPagesRoute, (c) => c.json(stubListPages, 200)).openapi(pageRoutes.listPageChildrenRoute, (c) => c.json(stubListPageChildren, 200)).openapi(pageRoutes.createPageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.updatePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.setPageGrantRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.seenPageRoute, (c) => c.json(stubSeenUsers, 200)).openapi(pageRoutes.getSeenUsersRoute, (c) => c.json(stubSeenUsers, 200)).openapi(pageRoutes.likePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.unlikePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.claimPageLinkAccessRoute, (c) => c.json({ ...stubPageWithRevision, granted: false }, 200)).openapi(pageRoutes.getWatchStatusRoute, (c) => c.json(stubWatchStatus, 200)).openapi(pageRoutes.setWatchStatusRoute, (c) => c.json(stubWatchStatus, 200)).openapi(pageRoutes.deletePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.revertDeletedPageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.revertToRevisionRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.renamePageRoute, (c) => c.json({ ...stubPageResponse, renamed_count: 1 }, 200)).openapi(pageRoutes.renameSubtreeRoute, (c) => c.json({ renamed_count: 0 }, 200)).openapi(pagePreviewRoutes.previewPageRoute, (c) => c.json(stubPreview, 200)).openapi(pageCollabRoutes.getYjsTokenRoute, (c) => c.json(stubWsToken, 200)).openapi(presenceRoutes.getPresenceTokenRoute, (c) => c.json(stubPresenceToken, 200)).openapi(presenceRoutes.getLikersRoute, (c) => c.json(stubLikers, 200));
-var lateContractApp = new import_zod_openapi74.OpenAPIHono().openapi(draftRoutes.createDraftRoute, (c) => c.json(stubCreateDraft, 201)).openapi(draftRoutes.listDraftsRoute, (c) => c.json(stubListDrafts, 200)).openapi(draftRoutes.cancelDraftRoute, (c) => c.json(stubCreateDraft, 200)).openapi(autocompleteRoutes.autocompleteUsersRoute, (c) => c.json(stubAutocomplete, 200)).openapi(autocompleteRoutes.autocompletePagesRoute, (c) => c.json(stubAutocomplete, 200)).openapi(attachmentRoutes.getAttachmentUsageRoute, (c) => c.json(stubAttachmentUsage, 200)).openapi(attachmentRoutes.listAttachmentsRoute, (c) => c.json(stubListAttachments, 200)).openapi(attachmentRoutes.addAttachmentRoute, (c) => c.json(stubAddAttachment, 200)).openapi(attachmentRoutes.uploadAttachmentRoute, (c) => c.json(stubUploadAttachment, 200)).openapi(attachmentRoutes.getAttachmentMetaRoute, (c) => c.json(stubAttachmentMeta, 200)).openapi(attachmentRoutes.removeAttachmentRoute, (c) => c.json(stubRemoveAttachment, 200)).openapi(searchRoutes.searchPagesRoute, (c) => c.json(stubSearchPages, 200)).openapi(adminCryptoRoutes.getCryptoStatusRoute, (c) => c.json(stubCryptoStatus, 200)).openapi(adminCryptoRoutes.reencryptAllRoute, (c) => c.json(stubReencrypt, 200)).openapi(notificationRoutes.listNotificationsRoute, (c) => c.json(stubListNotifications, 200)).openapi(notificationRoutes.markAllAsReadRoute, (c) => c.json(stubMarkAllAsRead, 200)).openapi(notificationRoutes.getNotificationsTokenRoute, (c) => c.json(stubNotificationsToken, 200)).openapi(notificationRoutes.getUnreadCountRoute, (c) => c.json(stubNotificationStatus, 200)).openapi(notificationRoutes.openNotificationRoute, (c) => c.json(stubOpenNotification, 200));
-var adminSettingsContractApp = new import_zod_openapi74.OpenAPIHono().openapi(adminAppRoutes.getAppSettingsRoute, (c) => c.json(stubGetAppSettings, 200)).openapi(adminAppRoutes.updateAppSettingsRoute, (c) => c.json(stubUpdateAppSettings, 200)).openapi(adminAuthRoutes.getAuthSettingsRoute, (c) => c.json(stubAuthSettings, 200)).openapi(adminAuthRoutes.updateAuthSettingsRoute, (c) => c.json(stubAuthSettings, 200)).openapi(adminSecurityRoutes.getSecuritySettingsRoute, (c) => c.json(stubSecuritySettings, 200)).openapi(adminSecurityRoutes.updateSecuritySettingsRoute, (c) => c.json(stubSecuritySettings, 200)).openapi(adminMailRoutes.getMailSettingsRoute, (c) => c.json(stubMailSettings, 200)).openapi(adminMailRoutes.updateMailSettingsRoute, (c) => c.json(stubUpdateMailSettings, 200)).openapi(adminMailRoutes.sendTestMailRoute, (c) => c.json(stubSendTestMail, 200)).openapi(adminStorageRoutes.getStorageStatusRoute, (c) => c.json(stubStorageStatus, 200)).openapi(adminSearchRoutes.getSearchStatusRoute, (c) => c.json(stubSearchStatus, 200));
-var adminUsersPluginsContractApp = new import_zod_openapi74.OpenAPIHono().openapi(adminUsersRoutes.listUsersRoute, (c) => c.json(stubListAdminUsers, 200)).openapi(adminUsersRoutes.searchUsersByEmailRoute, (c) => c.json(stubSearchAdminUsersByEmail, 200)).openapi(adminUsersRoutes.pendingUsersCountRoute, (c) => c.json(stubPendingUsersCount, 200)).openapi(adminUsersRoutes.inviteUsersRoute, (c) => c.json(stubInviteUsers, 200)).openapi(adminUsersRoutes.editUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.makeAdminRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.removeFromAdminRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.activateUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.suspendUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.resetPasswordRoute, (c) => c.json(stubResetPassword, 200)).openapi(adminUsersRoutes.resendInviteRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.updateUserEmailRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.deleteUserRoute, (c) => c.json(stubDeleteAdminUser, 200)).openapi(adminPluginsRoutes.listPluginsRoute, (c) => c.json(stubListPlugins, 200)).openapi(adminPluginsRoutes.getPluginConfigRoute, (c) => c.json(stubPluginConfig, 200)).openapi(adminPluginsRoutes.updatePluginConfigRoute, (c) => c.json(stubUpdatePluginConfig, 200)).openapi(adminPluginsRoutes.clearRenderCacheAllRoute, (c) => c.json(stubClearRenderCache, 200)).openapi(adminPluginsRoutes.clearRenderCachePluginRoute, (c) => c.json(stubClearRenderCache, 200));
-var oauthContractApp = new import_zod_openapi74.OpenAPIHono().openapi(oauthRoutes.authorizeRoute, (c) => c.json(stubAuthorize, 200)).openapi(oauthRoutes.tokenRoute, (c) => c.json(stubToken, 200)).openapi(oauthRoutes.revokeRoute, (c) => c.json(stubRevoke, 200)).openapi(oauthRoutes.discoveryRoute, (c) => c.json(stubDiscovery, 200)).openapi(oauthRoutes.deviceAuthorizeRoute, (c) => c.json(stubDeviceAuthorize, 200)).openapi(oauthRoutes.deviceInfoRoute, (c) => c.json(stubDeviceInfo, 200)).openapi(oauthRoutes.deviceVerifyRoute, (c) => c.json(stubDeviceVerify, 200)).openapi(oauthRoutes.clientInfoRoute, (c) => c.json(stubClientInfo, 200));
+var bookmarkBacklinkCommentRevisionChain = new import_zod_openapi79.OpenAPIHono().openapi(bookmarkRoutes.getBookmarkRoute, (c) => c.json(stubBookmarkResponse, 200)).openapi(bookmarkRoutes.listMyBookmarksRoute, (c) => c.json(stubListMyBookmarks, 200)).openapi(bookmarkRoutes.addBookmarkRoute, (c) => c.json(stubBookmarkResponse, 200)).openapi(bookmarkRoutes.removeBookmarkRoute, (c) => c.json(stubRemoveBookmark, 200)).openapi(backlinkRoutes.getBacklinksRoute, (c) => c.json(stubBacklinks, 200)).openapi(commentRoutes.listCommentsRoute, (c) => c.json(stubListComments, 200)).openapi(commentRoutes.addCommentRoute, (c) => c.json(stubAddComment, 200)).openapi(commentRoutes.deleteCommentRoute, (c) => c.json(stubDeleteComment, 200)).openapi(revisionRoutes.listRevisionsRoute, (c) => c.json(stubListRevisions, 200)).openapi(revisionRoutes.getRevisionsRoute, (c) => c.json(stubGetRevisions, 200)).openapi(revisionRoutes.getRevisionRoute, (c) => c.json(stubGetRevision, 200));
+var pageChain = new import_zod_openapi79.OpenAPIHono().openapi(pageRoutes.getPageRoute, (c) => c.json(stubPageWithRevision, 200)).openapi(pageRoutes.listPagesRoute, (c) => c.json(stubListPages, 200)).openapi(pageRoutes.listPageChildrenRoute, (c) => c.json(stubListPageChildren, 200)).openapi(pageRoutes.createPageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.updatePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.setPageGrantRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.seenPageRoute, (c) => c.json(stubSeenUsers, 200)).openapi(pageRoutes.getSeenUsersRoute, (c) => c.json(stubSeenUsers, 200)).openapi(pageRoutes.likePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.unlikePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.claimPageLinkAccessRoute, (c) => c.json({ ...stubPageWithRevision, granted: false }, 200)).openapi(pageRoutes.getWatchStatusRoute, (c) => c.json(stubWatchStatus, 200)).openapi(pageRoutes.setWatchStatusRoute, (c) => c.json(stubWatchStatus, 200)).openapi(pageRoutes.deletePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.revertDeletedPageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.revertToRevisionRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.renamePageRoute, (c) => c.json({ ...stubPageResponse, renamed_count: 1 }, 200)).openapi(pageRoutes.renameSubtreeRoute, (c) => c.json({ renamed_count: 0 }, 200)).openapi(pagePreviewRoutes.previewPageRoute, (c) => c.json(stubPreview, 200)).openapi(pageCollabRoutes.getYjsTokenRoute, (c) => c.json(stubWsToken, 200)).openapi(presenceRoutes.getPresenceTokenRoute, (c) => c.json(stubPresenceToken, 200)).openapi(presenceRoutes.getLikersRoute, (c) => c.json(stubLikers, 200));
+var lateContractApp = new import_zod_openapi79.OpenAPIHono().openapi(draftRoutes.createDraftRoute, (c) => c.json(stubCreateDraft, 201)).openapi(draftRoutes.listDraftsRoute, (c) => c.json(stubListDrafts, 200)).openapi(draftRoutes.cancelDraftRoute, (c) => c.json(stubCreateDraft, 200)).openapi(autocompleteRoutes.autocompleteUsersRoute, (c) => c.json(stubAutocomplete, 200)).openapi(autocompleteRoutes.autocompletePagesRoute, (c) => c.json(stubAutocomplete, 200)).openapi(attachmentRoutes.getAttachmentUsageRoute, (c) => c.json(stubAttachmentUsage, 200)).openapi(attachmentRoutes.listAttachmentsRoute, (c) => c.json(stubListAttachments, 200)).openapi(attachmentRoutes.addAttachmentRoute, (c) => c.json(stubAddAttachment, 200)).openapi(attachmentRoutes.uploadAttachmentRoute, (c) => c.json(stubUploadAttachment, 200)).openapi(attachmentRoutes.getAttachmentMetaRoute, (c) => c.json(stubAttachmentMeta, 200)).openapi(attachmentRoutes.removeAttachmentRoute, (c) => c.json(stubRemoveAttachment, 200)).openapi(searchRoutes.searchPagesRoute, (c) => c.json(stubSearchPages, 200)).openapi(adminCryptoRoutes.getCryptoStatusRoute, (c) => c.json(stubCryptoStatus, 200)).openapi(adminCryptoRoutes.reencryptAllRoute, (c) => c.json(stubReencrypt, 200)).openapi(notificationRoutes.listNotificationsRoute, (c) => c.json(stubListNotifications, 200)).openapi(notificationRoutes.markAllAsReadRoute, (c) => c.json(stubMarkAllAsRead, 200)).openapi(notificationRoutes.getNotificationsTokenRoute, (c) => c.json(stubNotificationsToken, 200)).openapi(notificationRoutes.getUnreadCountRoute, (c) => c.json(stubNotificationStatus, 200)).openapi(notificationRoutes.openNotificationRoute, (c) => c.json(stubOpenNotification, 200));
+var adminSettingsContractApp = new import_zod_openapi79.OpenAPIHono().openapi(adminAppRoutes.getAppSettingsRoute, (c) => c.json(stubGetAppSettings, 200)).openapi(adminAppRoutes.updateAppSettingsRoute, (c) => c.json(stubUpdateAppSettings, 200)).openapi(adminAuthRoutes.getAuthSettingsRoute, (c) => c.json(stubAuthSettings, 200)).openapi(adminAuthRoutes.updateAuthSettingsRoute, (c) => c.json(stubAuthSettings, 200)).openapi(adminSecurityRoutes.getSecuritySettingsRoute, (c) => c.json(stubSecuritySettings, 200)).openapi(adminSecurityRoutes.updateSecuritySettingsRoute, (c) => c.json(stubSecuritySettings, 200)).openapi(adminMailRoutes.getMailSettingsRoute, (c) => c.json(stubMailSettings, 200)).openapi(adminMailRoutes.updateMailSettingsRoute, (c) => c.json(stubUpdateMailSettings, 200)).openapi(adminMailRoutes.sendTestMailRoute, (c) => c.json(stubSendTestMail, 200)).openapi(adminStorageRoutes.getStorageStatusRoute, (c) => c.json(stubStorageStatus, 200)).openapi(adminSearchRoutes.getSearchStatusRoute, (c) => c.json(stubSearchStatus, 200));
+var adminUsersPluginsContractApp = new import_zod_openapi79.OpenAPIHono().openapi(adminUsersRoutes.listUsersRoute, (c) => c.json(stubListAdminUsers, 200)).openapi(adminUsersRoutes.searchUsersByEmailRoute, (c) => c.json(stubSearchAdminUsersByEmail, 200)).openapi(adminUsersRoutes.pendingUsersCountRoute, (c) => c.json(stubPendingUsersCount, 200)).openapi(adminUsersRoutes.inviteUsersRoute, (c) => c.json(stubInviteUsers, 200)).openapi(adminUsersRoutes.editUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.makeAdminRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.removeFromAdminRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.activateUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.suspendUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.resetPasswordRoute, (c) => c.json(stubResetPassword, 200)).openapi(adminUsersRoutes.resendInviteRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.updateUserEmailRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.deleteUserRoute, (c) => c.json(stubDeleteAdminUser, 200)).openapi(adminPluginsRoutes.listPluginsRoute, (c) => c.json(stubListPlugins, 200)).openapi(adminPluginsRoutes.getPluginConfigRoute, (c) => c.json(stubPluginConfig, 200)).openapi(adminPluginsRoutes.updatePluginConfigRoute, (c) => c.json(stubUpdatePluginConfig, 200)).openapi(adminPluginsRoutes.getPluginReadinessRoute, (c) => c.json(stubPluginReadiness, 200)).openapi(adminPluginsRoutes.clearRenderCacheAllRoute, (c) => c.json(stubClearRenderCache, 200)).openapi(adminPluginsRoutes.clearRenderCachePluginRoute, (c) => c.json(stubClearRenderCache, 200));
+var oauthContractApp = new import_zod_openapi79.OpenAPIHono().openapi(oauthRoutes.authorizeRoute, (c) => c.json(stubAuthorize, 200)).openapi(oauthRoutes.tokenRoute, (c) => c.json(stubToken, 200)).openapi(oauthRoutes.revokeRoute, (c) => c.json(stubRevoke, 200)).openapi(oauthRoutes.discoveryRoute, (c) => c.json(stubDiscovery, 200)).openapi(oauthRoutes.deviceAuthorizeRoute, (c) => c.json(stubDeviceAuthorize, 200)).openapi(oauthRoutes.deviceInfoRoute, (c) => c.json(stubDeviceInfo, 200)).openapi(oauthRoutes.deviceVerifyRoute, (c) => c.json(stubDeviceVerify, 200)).openapi(oauthRoutes.clientInfoRoute, (c) => c.json(stubClientInfo, 200));
+var federatedAuthContractApp = new import_zod_openapi79.OpenAPIHono().openapi(federatedAuthRoutes.listFederatedProvidersRoute, (c) => c.json(stubProviderList, 200)).openapi(federatedAuthRoutes.startFederatedProviderRoute, (c) => c.redirect("", 302)).openapi(federatedAuthRoutes.callbackFederatedProviderRoute, (c) => c.redirect("", 302)).openapi(federatedAuthRoutes.federatedHandoffRoute, (c) => c.json(stubTokens, 200)).openapi(federatedAuthRoutes.listLinkedAuthProvidersRoute, (c) => c.json({ identities: [] }, 200)).openapi(federatedAuthRoutes.createAuthProviderLinkGrantRoute, (c) => c.json({ linkGrant: "" }, 200)).openapi(federatedAuthRoutes.unlinkAuthProviderRoute, (c) => c.body(null, 204));
+var federatedRegistrationContractApp = new import_zod_openapi79.OpenAPIHono().openapi(federatedRegistrationRoutes.getFederatedRegistrationRoute, (c) => c.json(stubFederatedRegistrationSnapshot, 200)).openapi(federatedRegistrationRoutes.submitFederatedRegistrationRoute, (c) => c.json({ status: "approval_required" }, 200)).openapi(federatedRegistrationRoutes.logoutFederatedRegistrationRoute, (c) => c.body(null, 204));
 var createClient = (baseUrl, options = {}) => (0, import_client.hc)(baseUrl, {
   headers: options.headers,
   fetch: options.fetch
 });
 
 // src/schemas/mail-token.ts
-var import_zod_openapi75 = require("@hono/zod-openapi");
-var MailTokenPurposeSchema = import_zod_openapi75.z.enum(["invite", "activate", "reset", "email-change"]);
-var MailTokenPayloadSchema = import_zod_openapi75.z.object({
+var import_zod_openapi80 = require("@hono/zod-openapi");
+var MailTokenPurposeSchema = import_zod_openapi80.z.enum(["invite", "activate", "reset", "email-change"]);
+var MailTokenPayloadSchema = import_zod_openapi80.z.object({
   purpose: MailTokenPurposeSchema,
-  userId: import_zod_openapi75.z.string(),
+  userId: import_zod_openapi80.z.string(),
   /** Target address. For `email-change` this is the NEW address. */
-  email: import_zod_openapi75.z.string().email(),
+  email: import_zod_openapi80.z.string().email(),
   /**
    * For `email-change`: the account's email at issue time. The confirm
    * endpoint rejects the token unless it still matches, making the token
    * single-use (a stale token cannot revert a later change).
    */
-  fromEmail: import_zod_openapi75.z.string().email().optional(),
+  fromEmail: import_zod_openapi80.z.string().email().optional(),
   /**
    * For `reset`: the account's `passwordResetGeneration` at issue time.
    * Consuming the link increments that counter, so the token only matches
@@ -7188,7 +7678,7 @@ var MailTokenPayloadSchema = import_zod_openapi75.z.object({
    * schema because the other purposes don't carry it (and links minted
    * before the claim existed simply no longer match).
    */
-  resetGeneration: import_zod_openapi75.z.number().int().nonnegative().optional(),
+  resetGeneration: import_zod_openapi80.z.number().int().nonnegative().optional(),
   /**
    * For `email-change`: the account's `authVersion` at issue time. The
    * confirm endpoint requires it to still match, so a pending address change
@@ -7200,10 +7690,22 @@ var MailTokenPayloadSchema = import_zod_openapi75.z.object({
    * semantics wanted are exactly "the session that asked for this is gone",
    * and that is what every bump of it already means.
    */
-  authVersion: import_zod_openapi75.z.number().int().nonnegative().optional(),
+  authVersion: import_zod_openapi80.z.number().int().nonnegative().optional(),
+  /**
+   * For `email-change`: the account's `emailChangeGeneration` at issue time.
+   * Requesting a change increments it, so asking for a different address
+   * supersedes any link still pending — which is what lets a user call off a
+   * change they did not want (one an attacker started with a stolen session,
+   * or one sent to a mistyped address). `authVersion` cannot serve this: it
+   * means "the session that asked is gone", and bumping it on a mere request
+   * would log the user out of their own account for editing their profile.
+   * Optional in the schema for the same reason as the others — links minted
+   * before the claim existed simply no longer match.
+   */
+  emailChangeGeneration: import_zod_openapi80.z.number().int().nonnegative().optional(),
   // iat / exp are injected and verified by the JWT layer.
-  iat: import_zod_openapi75.z.number().optional(),
-  exp: import_zod_openapi75.z.number().optional()
+  iat: import_zod_openapi80.z.number().optional(),
+  exp: import_zod_openapi80.z.number().optional()
 });
 
 // src/util/html-elements.ts
@@ -7419,6 +7921,8 @@ var WS_CLOSE_CODES = {
   CommentInvalidRequestErrorSchema,
   CommentNotFoundErrorSchema,
   CommentSchema,
+  ConfigReadinessIssueSchema,
+  ConfigReadinessResponseSchema,
   ConfirmEmailChangeRequestSchema,
   ConfirmEmailChangeResponseSchema,
   ConflictErrorSchema,
@@ -7429,6 +7933,8 @@ var WS_CLOSE_CODES = {
   CreateAdminResponseSchema,
   CreateDraftRequestSchema,
   CreateDraftResponseSchema,
+  CreateLinkGrantRequestSchema,
+  CreateLinkGrantResponseSchema,
   CreatePageRequestSchema,
   CrowiCodeSidecarSchema,
   CrowiDiagramNodeSchema,
@@ -7464,6 +7970,14 @@ var WS_CLOSE_CODES = {
   EditAdminUserRequestSchema,
   EncryptionNotConfiguredErrorSchema,
   ErrorCodeSchema,
+  FederatedHandoffRequestSchema,
+  FederatedHandoffResponseSchema,
+  FederatedProviderSchema,
+  FederatedRegistrationActiveResultSchema,
+  FederatedRegistrationApprovalResultSchema,
+  FederatedRegistrationResultSchema,
+  FederatedRegistrationSnapshotSchema,
+  FederatedRegistrationSubmitRequestSchema,
   ForbiddenErrorSchema,
   ForgotPasswordRequestSchema,
   ForgotPasswordResponseSchema,
@@ -7505,6 +8019,7 @@ var WS_CLOSE_CODES = {
   LanguageSchema,
   LikerSchema,
   LikersResponseSchema,
+  LinkedAuthProviderListResponseSchema,
   ListAccessTokensResponseSchema,
   ListAdminUsersRequestSchema,
   ListAdminUsersResponseSchema,
@@ -7576,6 +8091,7 @@ var WS_CLOSE_CODES = {
   PluginFieldSchema,
   PluginInfoSchema,
   PluginNotFoundErrorSchema,
+  PluginReadinessFieldSchema,
   PresenceClientMessageSchema,
   PresenceCommentChangedMessageSchema,
   PresenceHeartbeatMessageSchema,
@@ -7588,6 +8104,7 @@ var WS_CLOSE_CODES = {
   PreviewPageRequestSchema,
   PreviewPageResponseSchema,
   ProfileErrorResponseSchema,
+  ProviderListResponseSchema,
   RENDERED_AST_NODE_DEFS,
   RecentlyViewedPagesResponseSchema,
   ReencryptResponseSchema,
@@ -7636,6 +8153,8 @@ var WS_CLOSE_CODES = {
   SendTestMailErrorSchema,
   SendTestMailRequestSchema,
   SendTestMailResponseSchema,
+  SenderProofSchema,
+  SenderPublicJwkSchema,
   SensitiveConfigEntrySchema,
   ServiceUnavailableErrorSchema,
   SetPageGrantRequestSchema,
@@ -7656,6 +8175,7 @@ var WS_CLOSE_CODES = {
   TokenRequestSchema,
   TokenResponseSchema,
   UPLOAD_ALLOWED_MIME,
+  UnlinkAuthProviderErrorSchema,
   UpdateAdminUserEmailRequestSchema,
   UpdateAppSettingsRequestSchema,
   UpdateAppSettingsResponseSchema,
@@ -7687,6 +8207,7 @@ var WS_CLOSE_CODES = {
   UserStatusErrorSchema,
   UserStatusSchema,
   UserSubpagesRequestSchema,
+  UsernameSchema,
   ValidationErrorSchema,
   WS_CLOSE_CODES,
   WatchStatusResponseSchema,
@@ -7718,6 +8239,7 @@ var WS_CLOSE_CODES = {
   autocompleteUsersRoute,
   backlinkRoutes,
   bookmarkRoutes,
+  callbackFederatedProviderRoute,
   cancelDraftRoute,
   claimPageLinkAccessRoute,
   clearRenderCacheAllRoute,
@@ -7727,6 +8249,7 @@ var WS_CLOSE_CODES = {
   confirmEmailChangeRoute,
   createAccessTokenRoute,
   createAdminRoute,
+  createAuthProviderLinkGrantRoute,
   createClient,
   createDraftRoute,
   createPageRoute,
@@ -7742,6 +8265,9 @@ var WS_CLOSE_CODES = {
   draftRoutes,
   editUserRoute,
   emailChangeRoutes,
+  federatedAuthRoutes,
+  federatedHandoffRoute,
+  federatedRegistrationRoutes,
   forgotPasswordRoute,
   getAppInfoRoute,
   getAppSettingsRoute,
@@ -7751,12 +8277,14 @@ var WS_CLOSE_CODES = {
   getBacklinksRoute,
   getBookmarkRoute,
   getCryptoStatusRoute,
+  getFederatedRegistrationRoute,
   getInstallerStatusRoute,
   getLikersRoute,
   getMailSettingsRoute,
   getNotificationsTokenRoute,
   getPageRoute,
   getPluginConfigRoute,
+  getPluginReadinessRoute,
   getPresenceTokenRoute,
   getProfileRoute,
   getRevisionRoute,
@@ -7783,6 +8311,8 @@ var WS_CLOSE_CODES = {
   listAttachmentsRoute,
   listCommentsRoute,
   listDraftsRoute,
+  listFederatedProvidersRoute,
+  listLinkedAuthProvidersRoute,
   listMembersRoute,
   listMyBookmarksRoute,
   listNotificationsRoute,
@@ -7791,6 +8321,7 @@ var WS_CLOSE_CODES = {
   listPluginsRoute,
   listRevisionsRoute,
   listUsersRoute,
+  logoutFederatedRegistrationRoute,
   makeAdminRoute,
   markAllAsReadRoute,
   meRoutes,
@@ -7827,7 +8358,9 @@ var WS_CLOSE_CODES = {
   sendTestMailRoute,
   setPageGrantRoute,
   setWatchStatusRoute,
+  startFederatedProviderRoute,
   stripKnownHtmlTags,
+  submitFederatedRegistrationRoute,
   suspendUserRoute,
   tokenAuthRoutes,
   tokenLoginRoute,
@@ -7837,6 +8370,7 @@ var WS_CLOSE_CODES = {
   tokenRegisterRoute,
   tokenRoute,
   unlikePageRoute,
+  unlinkAuthProviderRoute,
   unwrapRenderedAst,
   updateAppSettingsRoute,
   updateAuthSettingsRoute,