@crowi/api-contract 2.0.0-alpha.12 → 2.0.0-alpha.13

package/dist/index.mjs

@@ -105,8 +105,12 @@ var ERROR_CODES = [
   "INVALID_CREDENTIALS",
   "REFRESH_TOKEN_REQUIRED",
   "REGISTRATION_CLOSED",
+  // --- federated sign-in (RFC-0014) ---
+  "FEDERATED_HANDOFF_INVALID",
+  "FEDERATED_HANDOFF_CONSUMED",
   // --- admin subsystems ---
   "ENCRYPTION_NOT_CONFIGURED",
+  "MAIL_FROM_NOT_CONFIGURED",
   "MAIL_TEST_FAILED",
   "PLUGIN_NOT_FOUND",
   "PLUGIN_CONFIG_VALIDATION_FAILED"
@@ -387,10 +391,16 @@ var SendTestMailResponseSchema = z5.object({
   to: z5.string()
 });
 var SendTestMailErrorSchema = z5.object({
-  error: z5.object({
-    code: z5.literal("MAIL_TEST_FAILED"),
-    message: z5.string()
-  })
+  error: z5.discriminatedUnion("code", [
+    z5.object({
+      code: z5.literal("MAIL_FROM_NOT_CONFIGURED"),
+      message: z5.literal("The mail sender address is not configured.")
+    }),
+    z5.object({
+      code: z5.literal("MAIL_TEST_FAILED"),
+      message: z5.enum(["Failed to send the test email. Check the active mail sender configuration.", "No email address on the calling user"])
+    })
+  ])
 });
 var MailSettingsValidationErrorSchema = z5.object({
   bodyResult: z5.object({
@@ -503,7 +513,7 @@ var sendTestMailRoute = createRoute3({
       content: { "application/json": { schema: AdminRequiredErrorSchema } }
     },
     502: {
-      description: "Test mail dispatch failed (SMTP error)",
+      description: "Test mail dispatch failed (mail dispatch failure \u2014 e.g. sender/transport error, or the mail sender address is not configured)",
       content: { "application/json": { schema: SendTestMailErrorSchema } }
     }
   }
@@ -653,13 +663,16 @@ var PluginReadinessFieldSchema = z6.object({
   name: z6.string(),
   configured: z6.literal(false)
 });
-var PluginReadinessIssueSchema = z6.object({
-  name: z6.string(),
-  adminPlacement: PluginAdminPlacementSchema,
+var ConfigReadinessIssueSchema = z6.object({
+  /** Stable id — `plugin:<name>` or a core declaration id (e.g. `core:mail`). */
+  id: z6.string(),
+  source: z6.enum(["plugin", "core"]),
+  label: z6.string(),
+  href: z6.string(),
   fields: z6.array(PluginReadinessFieldSchema)
 });
-var PluginReadinessResponseSchema = z6.object({
-  issues: z6.array(PluginReadinessIssueSchema)
+var ConfigReadinessResponseSchema = z6.object({
+  issues: z6.array(ConfigReadinessIssueSchema)
 });
 
 // src/contracts/admin/plugins.ts
@@ -797,11 +810,11 @@ var getPluginReadinessRoute = createRoute4({
   path: "/admin/plugins/readiness",
   tags: ["admin.plugins"],
   security: [{ bearerAuth: [] }],
-  summary: "List active plugins missing required readiness config fields",
+  summary: "List active plugins and core config missing required readiness fields",
   responses: {
     200: {
-      description: "Readiness issues for active plugins (empty when everything is configured)",
-      content: { "application/json": { schema: PluginReadinessResponseSchema } }
+      description: "Readiness issues for active plugins and core config (empty when everything is configured)",
+      content: { "application/json": { schema: ConfigReadinessResponseSchema } }
     },
     401: {
       description: "Authentication required",
@@ -3518,6 +3531,19 @@ var UserProfileResponseSchema = z31.object({
   introduction: z31.string().optional(),
   hasPassword: z31.boolean(),
   createdAt: z31.string(),
+  /**
+   * True when the account has at least one linked federated identity
+   * (`UserIdentity` row). The email address on a federated account is
+   * fixed to the value the identity provider verified — `PUT /me`
+   * refuses a change and returns `EMAIL_LOCKED_BY_FEDERATED_IDENTITY`
+   * when this is true and a different email is submitted. The web uses
+   * this to disable the email field and point to the Security tab.
+   *
+   * Always reflects the account's current state — on `GET /me` and on
+   * every 200 from `PUT /me`, including a `PUT` that changed only name /
+   * lang.
+   */
+  federated: z31.boolean(),
   /**
    * True when the profile update requested a new email that is awaiting
    * confirmation: the stored `email` is unchanged and a confirmation
@@ -5887,23 +5913,404 @@ var tokenAuthRoutes = {
   tokenMeRoute
 };
 
+// src/contracts/federated-auth.ts
+import { createRoute as createRoute29, z as z53 } from "@hono/zod-openapi";
+
+// src/schemas/federated-auth.ts
+import { z as z52 } from "@hono/zod-openapi";
+var FederatedProviderSchema = z52.object({
+  name: z52.string(),
+  buttonLabel: z52.string(),
+  iconUrl: z52.string().optional()
+});
+var ProviderListResponseSchema = z52.object({
+  providers: z52.array(FederatedProviderSchema)
+});
+var SenderPublicJwkSchema = z52.object({
+  kty: z52.literal("EC"),
+  crv: z52.literal("P-256"),
+  x: z52.string(),
+  y: z52.string()
+});
+var SenderProofSchema = z52.object({
+  publicJwk: SenderPublicJwkSchema,
+  /** base64url ES256 signature over the canonical handoff message. */
+  signature: z52.string()
+});
+var FederatedHandoffRequestSchema = z52.object({
+  code: z52.string(),
+  proof: SenderProofSchema
+});
+var FederatedHandoffResponseSchema = TokenAuthResponseSchema;
+var LinkedAuthProviderListResponseSchema = z52.object({
+  identities: z52.array(z52.object({ provider: z52.string() }))
+});
+var CreateLinkGrantRequestSchema = z52.object({
+  /** RFC 7638 thumbprint of the P-256 public key this browser will use at `/start` — binds the grant to this browser (AC-2). */
+  handoffChallenge: z52.string().min(1)
+});
+var CreateLinkGrantResponseSchema = z52.object({
+  linkGrant: z52.string()
+});
+var UnlinkAuthProviderErrorSchema = z52.object({
+  error: z52.object({
+    code: z52.enum(["FEDERATED_UNLINK_DISABLED", "PASSWORD_REQUIRED"]),
+    message: z52.string()
+  })
+});
+
+// src/contracts/federated-auth.ts
+var ContinuePathSchema = z53.string().regex(/^\/(?!\/)[^\\\x00-\x1F\x7F]*$/, 'continue must be a local path starting with a single "/" and contain no backslash or control characters').max(2e3, "continue must be at most 2000 characters");
+var listFederatedProvidersRoute = createRoute29({
+  method: "get",
+  path: "/auth/providers",
+  tags: ["federatedAuth"],
+  summary: "List enabled OAuth2/OIDC federated sign-in providers",
+  responses: {
+    200: {
+      description: "Enabled providers, in name order",
+      content: { "application/json": { schema: ProviderListResponseSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var startFederatedProviderRoute = createRoute29({
+  method: "get",
+  path: "/auth/providers/{name}/start",
+  tags: ["federatedAuth"],
+  summary: "Top-level navigation that redirects the browser to the named provider",
+  request: {
+    params: z53.object({ name: z53.string() }),
+    query: z53.object({
+      continue: ContinuePathSchema,
+      /** base64url(JSON) of the sender's P-256 public JWK. */
+      handoff_jwk: z53.string().min(1),
+      /** base64url ES256 signature over the start canonical message. */
+      handoff_proof: z53.string().min(1),
+      /**
+       * RFC-0014 phase 3 — `'1'` switches this start into LINK mode: the
+       * request must carry a web-session JWT, and the flow attaches the
+       * resulting identity to that session's user instead of signing
+       * anyone in. Absent (the ordinary sign-in start) the route stays
+       * fully public.
+       */
+      link: z53.literal("1").optional(),
+      /** The opaque id from `POST /auth/providers/{name}/link-grants`. Required when `link=1`, ignored otherwise. */
+      link_grant: z53.string().min(1).optional()
+    })
+  },
+  responses: {
+    302: { description: "Redirect to the provider authorization endpoint" },
+    400: {
+      description: "Malformed continue / sender proof, or an invalid/expired/mismatched link grant",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    401: {
+      description: "link=1 without a web-session JWT \u2014 never downgraded to the public sign-in start",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    403: {
+      description: "link=1 with a non-web credential (PAT / OAuth access token)",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    404: {
+      description: "Unknown, unconfigured, or credential-kind provider",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var listLinkedAuthProvidersRoute = createRoute29({
+  method: "get",
+  path: "/auth/providers/identities",
+  tags: ["federatedAuth"],
+  summary: "List the provider slugs the current user has linked",
+  responses: {
+    200: {
+      description: "Linked provider slugs, in name order",
+      content: { "application/json": { schema: LinkedAuthProviderListResponseSchema } }
+    },
+    401: {
+      description: "Authentication required",
+      content: { "application/json": { schema: AuthenticationRequiredErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var createAuthProviderLinkGrantRoute = createRoute29({
+  method: "post",
+  path: "/auth/providers/{name}/link-grants",
+  tags: ["federatedAuth"],
+  summary: "Mint a short-lived, opaque grant that authorizes ONE link start for the current web session",
+  request: {
+    params: z53.object({ name: z53.string() }),
+    body: { content: { "application/json": { schema: CreateLinkGrantRequestSchema } } }
+  },
+  responses: {
+    200: {
+      description: "Opaque single-use grant id",
+      content: { "application/json": { schema: CreateLinkGrantResponseSchema } }
+    },
+    401: {
+      description: "Authentication required",
+      content: { "application/json": { schema: AuthenticationRequiredErrorSchema } }
+    },
+    403: {
+      description: "Non-web credential (PAT / OAuth access token)",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    404: {
+      description: "Unknown, unconfigured, or credential-kind provider",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var unlinkAuthProviderRoute = createRoute29({
+  method: "delete",
+  path: "/auth/providers/{name}/identity",
+  tags: ["federatedAuth"],
+  summary: "Disconnect the current user's identity for this provider",
+  request: {
+    params: z53.object({ name: z53.string() })
+  },
+  responses: {
+    204: { description: "Identity removed" },
+    401: {
+      description: "Authentication required",
+      content: { "application/json": { schema: AuthenticationRequiredErrorSchema } }
+    },
+    403: {
+      description: "Non-web credential (PAT / OAuth access token)",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    404: {
+      description: "No identity linked for this provider",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    409: {
+      description: "Refused: password auth is disabled instance-wide, or this user has no password set",
+      content: { "application/json": { schema: UnlinkAuthProviderErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var callbackFederatedProviderRoute = createRoute29({
+  method: "get",
+  path: "/auth/providers/{name}/callback",
+  tags: ["federatedAuth"],
+  summary: "Provider redirect target; completes the OAuth2/OIDC exchange",
+  request: {
+    params: z53.object({ name: z53.string() }),
+    query: z53.object({
+      code: z53.string().optional(),
+      state: z53.string().optional(),
+      error: z53.string().optional()
+    })
+  },
+  responses: {
+    302: {
+      description: "Redirect to the trusted web login/complete page on success, or back to the trusted web /login on failure"
+    },
+    404: {
+      description: "Unknown or unconfigured provider (also used when trusted origins cannot be resolved)",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var federatedHandoffRoute = createRoute29({
+  method: "post",
+  path: "/auth/handoff",
+  tags: ["federatedAuth"],
+  summary: "Exchange a sender-constrained federated handoff code for session tokens",
+  request: {
+    body: { content: { "application/json": { schema: FederatedHandoffRequestSchema } } }
+  },
+  responses: {
+    200: {
+      description: "Session tokens \u2014 same shape as POST /auth/login",
+      content: { "application/json": { schema: FederatedHandoffResponseSchema } }
+    },
+    401: {
+      description: "Invalid / expired handoff code, or sender proof did not verify",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    409: {
+      description: "Handoff code already consumed",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var federatedAuthRoutes = {
+  listFederatedProvidersRoute,
+  startFederatedProviderRoute,
+  callbackFederatedProviderRoute,
+  federatedHandoffRoute,
+  listLinkedAuthProvidersRoute,
+  createAuthProviderLinkGrantRoute,
+  unlinkAuthProviderRoute
+};
+
+// src/contracts/federated-registration.ts
+import { createRoute as createRoute30, z as z55 } from "@hono/zod-openapi";
+
+// src/schemas/federated-registration.ts
+import { z as z54 } from "@hono/zod-openapi";
+var FederatedRegistrationSnapshotSchema = z54.object({
+  /** IdP-verified email, prefilled read-only on the registration screen. */
+  email: z54.string().email(),
+  /** Driver slug, e.g. `'google'`. */
+  provider: z54.string(),
+  /** Human-friendly provider name (the driver's `buttonLabel`), e.g. `'Google'`. */
+  providerLabel: z54.string(),
+  /**
+   * This grant's registration has already been submitted and is waiting
+   * for an administrator (Restricted mode). The screen must show that
+   * state instead of the username form.
+   *
+   * Deliberately narrow: it is not a general status field, and it never
+   * distinguishes unknown / expired / cancelled / completed grants (those
+   * are all the same 404 — AC-2). It exists because a submitted
+   * registration is still readable by its own grant, and re-offering an
+   * editable username there invites a change that cannot be applied — the
+   * second submit is refused and the typed value silently discarded.
+   */
+  approvalPending: z54.boolean()
+});
+var FederatedRegistrationSubmitRequestSchema = z54.object({
+  username: UsernameSchema
+});
+var FederatedRegistrationActiveResultSchema = z54.object({
+  status: z54.literal("active"),
+  code: z54.string()
+});
+var FederatedRegistrationApprovalResultSchema = z54.object({
+  status: z54.literal("approval_required")
+});
+var FederatedRegistrationResultSchema = z54.discriminatedUnion("status", [
+  FederatedRegistrationActiveResultSchema,
+  FederatedRegistrationApprovalResultSchema
+]);
+
+// src/contracts/federated-registration.ts
+var TokenParamSchema = z55.object({ token: z55.string().min(1) });
+var getFederatedRegistrationRoute = createRoute30({
+  method: "get",
+  path: "/auth/federated-registration/{token}",
+  tags: ["federatedRegistration"],
+  summary: "Read-only snapshot (email/provider/providerLabel) for a pending federated registration",
+  request: {
+    params: TokenParamSchema
+  },
+  responses: {
+    200: {
+      description: "Pending registration snapshot",
+      content: { "application/json": { schema: FederatedRegistrationSnapshotSchema } }
+    },
+    404: {
+      description: "Grant is unknown, expired, or cancelled",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var submitFederatedRegistrationRoute = createRoute30({
+  method: "post",
+  path: "/auth/federated-registration/{token}",
+  tags: ["federatedRegistration"],
+  summary: "Submit the chosen username; provisions the User (JIT) and activates or queues approval",
+  request: {
+    params: TokenParamSchema,
+    body: { content: { "application/json": { schema: FederatedRegistrationSubmitRequestSchema } } }
+  },
+  responses: {
+    200: {
+      description: "Open: account is active \u2014 a Phase 1 handoff code, redeemed via POST /auth/handoff. Restricted: awaiting admin approval.",
+      content: { "application/json": { schema: FederatedRegistrationResultSchema } }
+    },
+    400: {
+      description: "Username fails the shared username contract",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    404: {
+      description: "Grant is unknown, expired, or cancelled",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    409: {
+      description: "Username/email already taken, or the identity is already linked to a different user",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var logoutFederatedRegistrationRoute = createRoute30({
+  method: "post",
+  path: "/auth/federated-registration/{token}/logout",
+  tags: ["federatedRegistration"],
+  summary: "Cancel a pending federated registration and invalidate the grant",
+  request: {
+    params: TokenParamSchema
+  },
+  responses: {
+    204: { description: "Grant cancelled (or was already inactive) \u2014 idempotent" },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var federatedRegistrationRoutes = {
+  getFederatedRegistrationRoute,
+  submitFederatedRegistrationRoute,
+  logoutFederatedRegistrationRoute
+};
+
 // src/contracts/invite-accept.ts
-import { createRoute as createRoute29 } from "@hono/zod-openapi";
+import { createRoute as createRoute31 } from "@hono/zod-openapi";
 
 // src/schemas/invite-accept.ts
-import { z as z52 } from "@hono/zod-openapi";
-var InviteAcceptRequestSchema = z52.object({
-  token: z52.string(),
+import { z as z56 } from "@hono/zod-openapi";
+var InviteAcceptRequestSchema = z56.object({
+  token: z56.string(),
   username: UsernameSchema,
-  name: z52.string().min(1),
-  password: z52.string().min(6)
+  name: z56.string().min(1),
+  password: z56.string().min(6)
 });
-var InvitePreviewResponseSchema = z52.object({
-  email: z52.string().email()
+var InvitePreviewResponseSchema = z56.object({
+  email: z56.string().email()
 });
 
 // src/contracts/invite-accept.ts
-var invitePreviewRoute = createRoute29({
+var invitePreviewRoute = createRoute31({
   method: "get",
   path: "/invite/accept",
   tags: ["inviteAccept"],
@@ -5930,7 +6337,7 @@ var invitePreviewRoute = createRoute29({
     }
   }
 });
-var acceptInviteRoute = createRoute29({
+var acceptInviteRoute = createRoute31({
   method: "post",
   path: "/invite/accept",
   tags: ["inviteAccept"],
@@ -5973,23 +6380,23 @@ var inviteAcceptRoutes = {
 };
 
 // src/contracts/password-reset.ts
-import { createRoute as createRoute30 } from "@hono/zod-openapi";
+import { createRoute as createRoute32 } from "@hono/zod-openapi";
 
 // src/schemas/password-reset.ts
-import { z as z53 } from "@hono/zod-openapi";
-var ForgotPasswordRequestSchema = z53.object({
-  email: z53.string().email()
+import { z as z57 } from "@hono/zod-openapi";
+var ForgotPasswordRequestSchema = z57.object({
+  email: z57.string().email()
 });
-var ForgotPasswordResponseSchema = z53.object({
-  ok: z53.literal(true)
+var ForgotPasswordResponseSchema = z57.object({
+  ok: z57.literal(true)
 });
-var ResetPasswordRequestSchema = z53.object({
-  token: z53.string(),
-  password: z53.string().min(6)
+var ResetPasswordRequestSchema = z57.object({
+  token: z57.string(),
+  password: z57.string().min(6)
 });
 
 // src/contracts/password-reset.ts
-var forgotPasswordRoute = createRoute30({
+var forgotPasswordRoute = createRoute32({
   method: "post",
   path: "/auth/forgot-password",
   tags: ["passwordReset"],
@@ -6014,7 +6421,7 @@ var forgotPasswordRoute = createRoute30({
     }
   }
 });
-var validateResetTokenRoute = createRoute30({
+var validateResetTokenRoute = createRoute32({
   method: "get",
   path: "/auth/reset-password",
   tags: ["passwordReset"],
@@ -6037,7 +6444,7 @@ var validateResetTokenRoute = createRoute30({
     }
   }
 });
-var selfResetPasswordRoute = createRoute30({
+var selfResetPasswordRoute = createRoute32({
   method: "post",
   path: "/auth/reset-password",
   tags: ["passwordReset"],
@@ -6077,19 +6484,19 @@ var passwordResetRoutes = {
 };
 
 // src/contracts/activation.ts
-import { createRoute as createRoute31 } from "@hono/zod-openapi";
+import { createRoute as createRoute33 } from "@hono/zod-openapi";
 
 // src/schemas/activation.ts
-import { z as z54 } from "@hono/zod-openapi";
-var ActivateRequestSchema = z54.object({
-  token: z54.string()
+import { z as z58 } from "@hono/zod-openapi";
+var ActivateRequestSchema = z58.object({
+  token: z58.string()
 });
-var ActivateValidationResponseSchema = z54.object({
-  ok: z54.literal(true)
+var ActivateValidationResponseSchema = z58.object({
+  ok: z58.literal(true)
 });
 
 // src/contracts/activation.ts
-var validateActivationTokenRoute = createRoute31({
+var validateActivationTokenRoute = createRoute33({
   method: "get",
   path: "/auth/activate",
   tags: ["activation"],
@@ -6112,7 +6519,7 @@ var validateActivationTokenRoute = createRoute31({
     }
   }
 });
-var activateAccountRoute = createRoute31({
+var activateAccountRoute = createRoute33({
   method: "post",
   path: "/auth/activate",
   tags: ["activation"],
@@ -6147,21 +6554,21 @@ var activationRoutes = {
 };
 
 // src/contracts/email-change.ts
-import { createRoute as createRoute32 } from "@hono/zod-openapi";
+import { createRoute as createRoute34 } from "@hono/zod-openapi";
 
 // src/schemas/email-change.ts
-import { z as z55 } from "@hono/zod-openapi";
-var ConfirmEmailChangeRequestSchema = z55.object({
-  token: z55.string()
+import { z as z59 } from "@hono/zod-openapi";
+var ConfirmEmailChangeRequestSchema = z59.object({
+  token: z59.string()
 });
-var ConfirmEmailChangeResponseSchema = z55.object({
-  ok: z55.literal(true),
+var ConfirmEmailChangeResponseSchema = z59.object({
+  ok: z59.literal(true),
   /** The newly-confirmed email address. */
-  email: z55.string().email()
+  email: z59.string().email()
 });
 
 // src/contracts/email-change.ts
-var validateEmailChangeTokenRoute = createRoute32({
+var validateEmailChangeTokenRoute = createRoute34({
   method: "get",
   path: "/auth/confirm-email-change",
   tags: ["emailChange"],
@@ -6184,7 +6591,7 @@ var validateEmailChangeTokenRoute = createRoute32({
     }
   }
 });
-var confirmEmailChangeRoute = createRoute32({
+var confirmEmailChangeRoute = createRoute34({
   method: "post",
   path: "/auth/confirm-email-change",
   tags: ["emailChange"],
@@ -6223,9 +6630,9 @@ var emailChangeRoutes = {
 };
 
 // src/contracts/user.ts
-import { createRoute as createRoute33, z as z56 } from "@hono/zod-openapi";
-var UsernameParamSchema = z56.object({ username: z56.string() });
-var getUserPageRoute = createRoute33({
+import { createRoute as createRoute35, z as z60 } from "@hono/zod-openapi";
+var UsernameParamSchema = z60.object({ username: z60.string() });
+var getUserPageRoute = createRoute35({
   method: "get",
   path: "/user/{username}",
   tags: ["user"],
@@ -6253,7 +6660,7 @@ var getUserPageRoute = createRoute33({
     }
   }
 });
-var getUserBookmarksRoute = createRoute33({
+var getUserBookmarksRoute = createRoute35({
   method: "get",
   path: "/user/{username}/bookmarks",
   tags: ["user"],
@@ -6282,7 +6689,7 @@ var getUserBookmarksRoute = createRoute33({
     }
   }
 });
-var getUserPagesRoute = createRoute33({
+var getUserPagesRoute = createRoute35({
   method: "get",
   path: "/user/{username}/pages",
   tags: ["user"],
@@ -6311,7 +6718,7 @@ var getUserPagesRoute = createRoute33({
     }
   }
 });
-var getUserSubpagesRoute = createRoute33({
+var getUserSubpagesRoute = createRoute35({
   method: "get",
   path: "/user/{username}/subpages",
   tags: ["user"],
@@ -6348,7 +6755,7 @@ var getUserSubpagesRoute = createRoute33({
     }
   }
 });
-var listMembersRoute = createRoute33({
+var listMembersRoute = createRoute35({
   method: "get",
   path: "/users",
   tags: ["user"],
@@ -6394,6 +6801,13 @@ var stubTokens = {
   expiresIn: 0,
   user: stubUser
 };
+var stubProviderList = { providers: [] };
+var stubFederatedRegistrationSnapshot = {
+  email: "stub@example.com",
+  provider: "",
+  providerLabel: "",
+  approvalPending: false
+};
 var stubProfile = {
   id: "",
   username: "",
@@ -6403,7 +6817,8 @@ var stubProfile = {
   theme: "system",
   image: null,
   hasPassword: false,
-  createdAt: ""
+  createdAt: "",
+  federated: false
 };
 var stubAccessToken = {
   id: "",
@@ -6684,25 +7099,27 @@ var lateContractApp = new OpenAPIHono().openapi(draftRoutes.createDraftRoute, (c
 var adminSettingsContractApp = new OpenAPIHono().openapi(adminAppRoutes.getAppSettingsRoute, (c) => c.json(stubGetAppSettings, 200)).openapi(adminAppRoutes.updateAppSettingsRoute, (c) => c.json(stubUpdateAppSettings, 200)).openapi(adminAuthRoutes.getAuthSettingsRoute, (c) => c.json(stubAuthSettings, 200)).openapi(adminAuthRoutes.updateAuthSettingsRoute, (c) => c.json(stubAuthSettings, 200)).openapi(adminSecurityRoutes.getSecuritySettingsRoute, (c) => c.json(stubSecuritySettings, 200)).openapi(adminSecurityRoutes.updateSecuritySettingsRoute, (c) => c.json(stubSecuritySettings, 200)).openapi(adminMailRoutes.getMailSettingsRoute, (c) => c.json(stubMailSettings, 200)).openapi(adminMailRoutes.updateMailSettingsRoute, (c) => c.json(stubUpdateMailSettings, 200)).openapi(adminMailRoutes.sendTestMailRoute, (c) => c.json(stubSendTestMail, 200)).openapi(adminStorageRoutes.getStorageStatusRoute, (c) => c.json(stubStorageStatus, 200)).openapi(adminSearchRoutes.getSearchStatusRoute, (c) => c.json(stubSearchStatus, 200));
 var adminUsersPluginsContractApp = new OpenAPIHono().openapi(adminUsersRoutes.listUsersRoute, (c) => c.json(stubListAdminUsers, 200)).openapi(adminUsersRoutes.searchUsersByEmailRoute, (c) => c.json(stubSearchAdminUsersByEmail, 200)).openapi(adminUsersRoutes.pendingUsersCountRoute, (c) => c.json(stubPendingUsersCount, 200)).openapi(adminUsersRoutes.inviteUsersRoute, (c) => c.json(stubInviteUsers, 200)).openapi(adminUsersRoutes.editUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.makeAdminRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.removeFromAdminRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.activateUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.suspendUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.resetPasswordRoute, (c) => c.json(stubResetPassword, 200)).openapi(adminUsersRoutes.resendInviteRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.updateUserEmailRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.deleteUserRoute, (c) => c.json(stubDeleteAdminUser, 200)).openapi(adminPluginsRoutes.listPluginsRoute, (c) => c.json(stubListPlugins, 200)).openapi(adminPluginsRoutes.getPluginConfigRoute, (c) => c.json(stubPluginConfig, 200)).openapi(adminPluginsRoutes.updatePluginConfigRoute, (c) => c.json(stubUpdatePluginConfig, 200)).openapi(adminPluginsRoutes.getPluginReadinessRoute, (c) => c.json(stubPluginReadiness, 200)).openapi(adminPluginsRoutes.clearRenderCacheAllRoute, (c) => c.json(stubClearRenderCache, 200)).openapi(adminPluginsRoutes.clearRenderCachePluginRoute, (c) => c.json(stubClearRenderCache, 200));
 var oauthContractApp = new OpenAPIHono().openapi(oauthRoutes.authorizeRoute, (c) => c.json(stubAuthorize, 200)).openapi(oauthRoutes.tokenRoute, (c) => c.json(stubToken, 200)).openapi(oauthRoutes.revokeRoute, (c) => c.json(stubRevoke, 200)).openapi(oauthRoutes.discoveryRoute, (c) => c.json(stubDiscovery, 200)).openapi(oauthRoutes.deviceAuthorizeRoute, (c) => c.json(stubDeviceAuthorize, 200)).openapi(oauthRoutes.deviceInfoRoute, (c) => c.json(stubDeviceInfo, 200)).openapi(oauthRoutes.deviceVerifyRoute, (c) => c.json(stubDeviceVerify, 200)).openapi(oauthRoutes.clientInfoRoute, (c) => c.json(stubClientInfo, 200));
+var federatedAuthContractApp = new OpenAPIHono().openapi(federatedAuthRoutes.listFederatedProvidersRoute, (c) => c.json(stubProviderList, 200)).openapi(federatedAuthRoutes.startFederatedProviderRoute, (c) => c.redirect("", 302)).openapi(federatedAuthRoutes.callbackFederatedProviderRoute, (c) => c.redirect("", 302)).openapi(federatedAuthRoutes.federatedHandoffRoute, (c) => c.json(stubTokens, 200)).openapi(federatedAuthRoutes.listLinkedAuthProvidersRoute, (c) => c.json({ identities: [] }, 200)).openapi(federatedAuthRoutes.createAuthProviderLinkGrantRoute, (c) => c.json({ linkGrant: "" }, 200)).openapi(federatedAuthRoutes.unlinkAuthProviderRoute, (c) => c.body(null, 204));
+var federatedRegistrationContractApp = new OpenAPIHono().openapi(federatedRegistrationRoutes.getFederatedRegistrationRoute, (c) => c.json(stubFederatedRegistrationSnapshot, 200)).openapi(federatedRegistrationRoutes.submitFederatedRegistrationRoute, (c) => c.json({ status: "approval_required" }, 200)).openapi(federatedRegistrationRoutes.logoutFederatedRegistrationRoute, (c) => c.body(null, 204));
 var createClient = (baseUrl, options = {}) => hc(baseUrl, {
   headers: options.headers,
   fetch: options.fetch
 });
 
 // src/schemas/mail-token.ts
-import { z as z57 } from "@hono/zod-openapi";
-var MailTokenPurposeSchema = z57.enum(["invite", "activate", "reset", "email-change"]);
-var MailTokenPayloadSchema = z57.object({
+import { z as z61 } from "@hono/zod-openapi";
+var MailTokenPurposeSchema = z61.enum(["invite", "activate", "reset", "email-change"]);
+var MailTokenPayloadSchema = z61.object({
   purpose: MailTokenPurposeSchema,
-  userId: z57.string(),
+  userId: z61.string(),
   /** Target address. For `email-change` this is the NEW address. */
-  email: z57.string().email(),
+  email: z61.string().email(),
   /**
    * For `email-change`: the account's email at issue time. The confirm
    * endpoint rejects the token unless it still matches, making the token
    * single-use (a stale token cannot revert a later change).
    */
-  fromEmail: z57.string().email().optional(),
+  fromEmail: z61.string().email().optional(),
   /**
    * For `reset`: the account's `passwordResetGeneration` at issue time.
    * Consuming the link increments that counter, so the token only matches
@@ -6711,7 +7128,7 @@ var MailTokenPayloadSchema = z57.object({
    * schema because the other purposes don't carry it (and links minted
    * before the claim existed simply no longer match).
    */
-  resetGeneration: z57.number().int().nonnegative().optional(),
+  resetGeneration: z61.number().int().nonnegative().optional(),
   /**
    * For `email-change`: the account's `authVersion` at issue time. The
    * confirm endpoint requires it to still match, so a pending address change
@@ -6723,7 +7140,7 @@ var MailTokenPayloadSchema = z57.object({
    * semantics wanted are exactly "the session that asked for this is gone",
    * and that is what every bump of it already means.
    */
-  authVersion: z57.number().int().nonnegative().optional(),
+  authVersion: z61.number().int().nonnegative().optional(),
   /**
    * For `email-change`: the account's `emailChangeGeneration` at issue time.
    * Requesting a change increments it, so asking for a different address
@@ -6735,10 +7152,10 @@ var MailTokenPayloadSchema = z57.object({
    * Optional in the schema for the same reason as the others — links minted
    * before the claim existed simply no longer match.
    */
-  emailChangeGeneration: z57.number().int().nonnegative().optional(),
+  emailChangeGeneration: z61.number().int().nonnegative().optional(),
   // iat / exp are injected and verified by the JWT layer.
-  iat: z57.number().optional(),
-  exp: z57.number().optional()
+  iat: z61.number().optional(),
+  exp: z61.number().optional()
 });
 
 // src/util/html-elements.ts
@@ -6953,6 +7370,8 @@ export {
   CommentInvalidRequestErrorSchema,
   CommentNotFoundErrorSchema,
   CommentSchema,
+  ConfigReadinessIssueSchema,
+  ConfigReadinessResponseSchema,
   ConfirmEmailChangeRequestSchema,
   ConfirmEmailChangeResponseSchema,
   ConflictErrorSchema,
@@ -6963,6 +7382,8 @@ export {
   CreateAdminResponseSchema,
   CreateDraftRequestSchema,
   CreateDraftResponseSchema,
+  CreateLinkGrantRequestSchema,
+  CreateLinkGrantResponseSchema,
   CreatePageRequestSchema,
   CrowiCodeSidecarSchema,
   CrowiDiagramNodeSchema,
@@ -6998,6 +7419,14 @@ export {
   EditAdminUserRequestSchema,
   EncryptionNotConfiguredErrorSchema,
   ErrorCodeSchema,
+  FederatedHandoffRequestSchema,
+  FederatedHandoffResponseSchema,
+  FederatedProviderSchema,
+  FederatedRegistrationActiveResultSchema,
+  FederatedRegistrationApprovalResultSchema,
+  FederatedRegistrationResultSchema,
+  FederatedRegistrationSnapshotSchema,
+  FederatedRegistrationSubmitRequestSchema,
   ForbiddenErrorSchema,
   ForgotPasswordRequestSchema,
   ForgotPasswordResponseSchema,
@@ -7039,6 +7468,7 @@ export {
   LanguageSchema,
   LikerSchema,
   LikersResponseSchema,
+  LinkedAuthProviderListResponseSchema,
   ListAccessTokensResponseSchema,
   ListAdminUsersRequestSchema,
   ListAdminUsersResponseSchema,
@@ -7111,8 +7541,6 @@ export {
   PluginInfoSchema,
   PluginNotFoundErrorSchema,
   PluginReadinessFieldSchema,
-  PluginReadinessIssueSchema,
-  PluginReadinessResponseSchema,
   PresenceClientMessageSchema,
   PresenceCommentChangedMessageSchema,
   PresenceHeartbeatMessageSchema,
@@ -7125,6 +7553,7 @@ export {
   PreviewPageRequestSchema,
   PreviewPageResponseSchema,
   ProfileErrorResponseSchema,
+  ProviderListResponseSchema,
   RENDERED_AST_NODE_DEFS,
   RecentlyViewedPagesResponseSchema,
   ReencryptResponseSchema,
@@ -7173,6 +7602,8 @@ export {
   SendTestMailErrorSchema,
   SendTestMailRequestSchema,
   SendTestMailResponseSchema,
+  SenderProofSchema,
+  SenderPublicJwkSchema,
   SensitiveConfigEntrySchema,
   ServiceUnavailableErrorSchema,
   SetPageGrantRequestSchema,
@@ -7193,6 +7624,7 @@ export {
   TokenRequestSchema,
   TokenResponseSchema,
   UPLOAD_ALLOWED_MIME,
+  UnlinkAuthProviderErrorSchema,
   UpdateAdminUserEmailRequestSchema,
   UpdateAppSettingsRequestSchema,
   UpdateAppSettingsResponseSchema,
@@ -7256,6 +7688,7 @@ export {
   autocompleteUsersRoute,
   backlinkRoutes,
   bookmarkRoutes,
+  callbackFederatedProviderRoute,
   cancelDraftRoute,
   claimPageLinkAccessRoute,
   clearRenderCacheAllRoute,
@@ -7265,6 +7698,7 @@ export {
   confirmEmailChangeRoute,
   createAccessTokenRoute,
   createAdminRoute,
+  createAuthProviderLinkGrantRoute,
   createClient,
   createDraftRoute,
   createPageRoute,
@@ -7280,6 +7714,9 @@ export {
   draftRoutes,
   editUserRoute,
   emailChangeRoutes,
+  federatedAuthRoutes,
+  federatedHandoffRoute,
+  federatedRegistrationRoutes,
   forgotPasswordRoute,
   getAppInfoRoute,
   getAppSettingsRoute,
@@ -7289,6 +7726,7 @@ export {
   getBacklinksRoute,
   getBookmarkRoute,
   getCryptoStatusRoute,
+  getFederatedRegistrationRoute,
   getInstallerStatusRoute,
   getLikersRoute,
   getMailSettingsRoute,
@@ -7322,6 +7760,8 @@ export {
   listAttachmentsRoute,
   listCommentsRoute,
   listDraftsRoute,
+  listFederatedProvidersRoute,
+  listLinkedAuthProvidersRoute,
   listMembersRoute,
   listMyBookmarksRoute,
   listNotificationsRoute,
@@ -7330,6 +7770,7 @@ export {
   listPluginsRoute,
   listRevisionsRoute,
   listUsersRoute,
+  logoutFederatedRegistrationRoute,
   makeAdminRoute,
   markAllAsReadRoute,
   meRoutes,
@@ -7366,7 +7807,9 @@ export {
   sendTestMailRoute,
   setPageGrantRoute,
   setWatchStatusRoute,
+  startFederatedProviderRoute,
   stripKnownHtmlTags,
+  submitFederatedRegistrationRoute,
   suspendUserRoute,
   tokenAuthRoutes,
   tokenLoginRoute,
@@ -7376,6 +7819,7 @@ export {
   tokenRegisterRoute,
   tokenRoute,
   unlikePageRoute,
+  unlinkAuthProviderRoute,
   unwrapRenderedAst,
   updateAppSettingsRoute,
   updateAuthSettingsRoute,