@crowi/api-contract 2.0.0-alpha.14 → 2.0.0-alpha.16

package/dist/index.js

@@ -43,6 +43,8 @@ __export(index_exports, {
   AdminRequiredErrorSchema: () => AdminRequiredErrorSchema,
   AdminSidebarSection: () => AdminSidebarSection,
   AdminUserIdParamSchema: () => AdminUserIdParamSchema,
+  AdminUserIdentityParamSchema: () => AdminUserIdentityParamSchema,
+  AdminUserListItemSchema: () => AdminUserListItemSchema,
   AdminUserMutationResponseSchema: () => AdminUserMutationResponseSchema,
   ApiErrorSchema: () => ApiErrorSchema,
   AppInfoResponseSchema: () => AppInfoResponseSchema,
@@ -78,6 +80,8 @@ __export(index_exports, {
   CommentInvalidRequestErrorSchema: () => CommentInvalidRequestErrorSchema,
   CommentNotFoundErrorSchema: () => CommentNotFoundErrorSchema,
   CommentSchema: () => CommentSchema,
+  CompleteProviderLinkConflictErrorSchema: () => CompleteProviderLinkConflictErrorSchema,
+  CompleteProviderLinkResponseSchema: () => CompleteProviderLinkResponseSchema,
   ConfigReadinessIssueSchema: () => ConfigReadinessIssueSchema,
   ConfigReadinessResponseSchema: () => ConfigReadinessResponseSchema,
   ConfirmEmailChangeRequestSchema: () => ConfirmEmailChangeRequestSchema,
@@ -90,8 +94,6 @@ __export(index_exports, {
   CreateAdminResponseSchema: () => CreateAdminResponseSchema,
   CreateDraftRequestSchema: () => CreateDraftRequestSchema,
   CreateDraftResponseSchema: () => CreateDraftResponseSchema,
-  CreateLinkGrantRequestSchema: () => CreateLinkGrantRequestSchema,
-  CreateLinkGrantResponseSchema: () => CreateLinkGrantResponseSchema,
   CreatePageRequestSchema: () => CreatePageRequestSchema,
   CrowiCodeSidecarSchema: () => CrowiCodeSidecarSchema,
   CrowiDiagramNodeSchema: () => CrowiDiagramNodeSchema,
@@ -126,6 +128,7 @@ __export(index_exports, {
   DraftSummarySchema: () => DraftSummarySchema,
   ERROR_CODES: () => ERROR_CODES,
   EditAdminUserRequestSchema: () => EditAdminUserRequestSchema,
+  EmailLockedByFederatedIdentityErrorSchema: () => EmailLockedByFederatedIdentityErrorSchema,
   EncryptionNotConfiguredErrorSchema: () => EncryptionNotConfiguredErrorSchema,
   ErrorCodeSchema: () => ErrorCodeSchema,
   FRONTMATTER_MAX_ENTRIES: () => FRONTMATTER_MAX_ENTRIES,
@@ -181,6 +184,8 @@ __export(index_exports, {
   LanguageSchema: () => LanguageSchema,
   LikerSchema: () => LikerSchema,
   LikersResponseSchema: () => LikersResponseSchema,
+  LinkCompletionCodeSchema: () => LinkCompletionCodeSchema,
+  LinkCompletionConsumedErrorSchema: () => LinkCompletionConsumedErrorSchema,
   LinkedAuthProviderListResponseSchema: () => LinkedAuthProviderListResponseSchema,
   ListAccessTokensResponseSchema: () => ListAccessTokensResponseSchema,
   ListAdminUsersRequestSchema: () => ListAdminUsersRequestSchema,
@@ -245,6 +250,7 @@ __export(index_exports, {
   PasswordErrorResponseSchema: () => PasswordErrorResponseSchema,
   PasswordUpdateSuccessSchema: () => PasswordUpdateSuccessSchema,
   PastAttachmentUsageSchema: () => PastAttachmentUsageSchema,
+  PendingLinkCompletionResponseSchema: () => PendingLinkCompletionResponseSchema,
   PendingUsersCountResponseSchema: () => PendingUsersCountResponseSchema,
   PictureUploadResponseSchema: () => PictureUploadResponseSchema,
   PluginAdminPlacementSchema: () => PluginAdminPlacementSchema,
@@ -324,6 +330,7 @@ __export(index_exports, {
   ShikiTokenLinesSchema: () => ShikiTokenLinesSchema,
   ShikiTokenSchema: () => ShikiTokenSchema,
   ShikiTokenStyleSchema: () => ShikiTokenStyleSchema,
+  StartProviderLinkResponseSchema: () => StartProviderLinkResponseSchema,
   StorageDriverEntrySchema: () => StorageDriverEntrySchema,
   SuccessResponseSchema: () => SuccessResponseSchema,
   ThemeSchema: () => ThemeSchema,
@@ -338,6 +345,9 @@ __export(index_exports, {
   TokenResponseSchema: () => TokenResponseSchema,
   UPLOAD_ALLOWED_MIME: () => UPLOAD_ALLOWED_MIME,
   UnlinkAuthProviderErrorSchema: () => UnlinkAuthProviderErrorSchema,
+  UnlinkUserIdentityConflictErrorSchema: () => UnlinkUserIdentityConflictErrorSchema,
+  UnlinkUserIdentityNotFoundErrorSchema: () => UnlinkUserIdentityNotFoundErrorSchema,
+  UnlinkUserIdentityResponseSchema: () => UnlinkUserIdentityResponseSchema,
   UpdateAdminUserEmailRequestSchema: () => UpdateAdminUserEmailRequestSchema,
   UpdateAppSettingsRequestSchema: () => UpdateAppSettingsRequestSchema,
   UpdateAppSettingsResponseSchema: () => UpdateAppSettingsResponseSchema,
@@ -409,10 +419,10 @@ __export(index_exports, {
   clearRenderCachePluginRoute: () => clearRenderCachePluginRoute,
   clientInfoRoute: () => clientInfoRoute,
   commentRoutes: () => commentRoutes,
+  completeProviderLinkRoute: () => completeProviderLinkRoute,
   confirmEmailChangeRoute: () => confirmEmailChangeRoute,
   createAccessTokenRoute: () => createAccessTokenRoute,
   createAdminRoute: () => createAdminRoute,
-  createAuthProviderLinkGrantRoute: () => createAuthProviderLinkGrantRoute,
   createClient: () => createClient,
   createDraftRoute: () => createDraftRoute,
   createPageRoute: () => createPageRoute,
@@ -450,6 +460,7 @@ __export(index_exports, {
   getPluginReadinessRoute: () => getPluginReadinessRoute,
   getPresenceTokenRoute: () => getPresenceTokenRoute,
   getProfileRoute: () => getProfileRoute,
+  getProviderLinkCompletionRoute: () => getProviderLinkCompletionRoute,
   getRevisionRoute: () => getRevisionRoute,
   getRevisionsRoute: () => getRevisionsRoute,
   getSearchStatusRoute: () => getSearchStatusRoute,
@@ -523,6 +534,7 @@ __export(index_exports, {
   setPageGrantRoute: () => setPageGrantRoute,
   setWatchStatusRoute: () => setWatchStatusRoute,
   startFederatedProviderRoute: () => startFederatedProviderRoute,
+  startProviderLinkRoute: () => startProviderLinkRoute,
   stripKnownHtmlTags: () => stripKnownHtmlTags,
   submitFederatedRegistrationRoute: () => submitFederatedRegistrationRoute,
   suspendUserRoute: () => suspendUserRoute,
@@ -535,6 +547,7 @@ __export(index_exports, {
   tokenRoute: () => tokenRoute,
   unlikePageRoute: () => unlikePageRoute,
   unlinkAuthProviderRoute: () => unlinkAuthProviderRoute,
+  unlinkUserIdentityRoute: () => unlinkUserIdentityRoute,
   unwrapRenderedAst: () => unwrapRenderedAst,
   updateAppSettingsRoute: () => updateAppSettingsRoute,
   updateAuthSettingsRoute: () => updateAuthSettingsRoute,
@@ -665,6 +678,11 @@ var ERROR_CODES = [
   // --- federated sign-in (RFC-0014) ---
   "FEDERATED_HANDOFF_INVALID",
   "FEDERATED_HANDOFF_CONSUMED",
+  // --- federated account linking (RFC-0014 §5.4) ---
+  "FEDERATED_IDENTITY_IN_USE",
+  "FEDERATED_LINK_AUTH_STATE_CHANGED",
+  "FEDERATED_LINK_NOT_LINKED",
+  "LINK_COMPLETION_CONSUMED",
   // --- admin subsystems ---
   "ENCRYPTION_NOT_CONFIGURED",
   "MAIL_FROM_NOT_CONFIGURED",
@@ -1658,8 +1676,11 @@ var ListAdminUsersRequestSchema = import_zod_openapi19.z.object({
   page: import_zod_openapi19.z.coerce.number().int().min(1).optional().default(1),
   limit: import_zod_openapi19.z.coerce.number().int().min(1).max(100).optional().default(50)
 });
+var AdminUserListItemSchema = UserPublicSchema.extend({
+  linkedProviders: import_zod_openapi19.z.array(import_zod_openapi19.z.string())
+});
 var ListAdminUsersResponseSchema = import_zod_openapi19.z.object({
-  users: import_zod_openapi19.z.array(UserPublicSchema),
+  users: import_zod_openapi19.z.array(AdminUserListItemSchema),
   pager: AdminPagerSchema
 });
 var SearchAdminUsersByEmailRequestSchema = import_zod_openapi19.z.object({
@@ -1694,8 +1715,7 @@ var InviteUsersResponseSchema = import_zod_openapi19.z.object({
   results: import_zod_openapi19.z.array(InvitedUserResultSchema)
 });
 var EditAdminUserRequestSchema = import_zod_openapi19.z.object({
-  name: import_zod_openapi19.z.string().min(1),
-  email: import_zod_openapi19.z.string().email()
+  name: import_zod_openapi19.z.string().min(1)
 });
 var AdminUserMutationResponseSchema = import_zod_openapi19.z.object({
   user: UserPublicSchema
@@ -1707,6 +1727,32 @@ var ResetPasswordResponseSchema = import_zod_openapi19.z.object({
 var UpdateAdminUserEmailRequestSchema = import_zod_openapi19.z.object({
   email: import_zod_openapi19.z.string().email()
 });
+var EmailLockedByFederatedIdentityErrorSchema = import_zod_openapi19.z.object({
+  error: import_zod_openapi19.z.object({
+    code: import_zod_openapi19.z.literal("EMAIL_LOCKED_BY_FEDERATED_IDENTITY"),
+    message: import_zod_openapi19.z.string()
+  })
+});
+var AdminUserIdentityParamSchema = AdminUserIdParamSchema.extend({
+  provider: import_zod_openapi19.z.string()
+});
+var UnlinkUserIdentityResponseSchema = import_zod_openapi19.z.object({
+  user: UserPublicSchema,
+  passwordIssued: import_zod_openapi19.z.boolean(),
+  newPassword: import_zod_openapi19.z.string().optional()
+});
+var UnlinkUserIdentityNotFoundErrorSchema = import_zod_openapi19.z.object({
+  error: import_zod_openapi19.z.object({
+    code: import_zod_openapi19.z.enum(["NOT_FOUND", "NOT_LINKED"]),
+    message: import_zod_openapi19.z.string()
+  })
+});
+var UnlinkUserIdentityConflictErrorSchema = import_zod_openapi19.z.object({
+  error: import_zod_openapi19.z.object({
+    code: import_zod_openapi19.z.enum(["CANNOT_UNLINK_SELF", "PASSWORD_AUTH_DISABLED"]),
+    message: import_zod_openapi19.z.string()
+  })
+});
 var DeleteAdminUserResponseSchema = import_zod_openapi19.z.object({
   deletedId: import_zod_openapi19.z.string()
 });
@@ -1810,7 +1856,7 @@ var editUserRoute = (0, import_zod_openapi20.createRoute)({
   path: "/admin/users/{id}",
   tags: ["admin.users"],
   security: [{ bearerAuth: [] }],
-  summary: "Update a user's name and email",
+  summary: "Update a user's name (email changes go through PUT /admin/users/{id}/email)",
   request: {
     params: AdminUserIdParamSchema,
     body: {
@@ -1838,10 +1884,6 @@ var editUserRoute = (0, import_zod_openapi20.createRoute)({
       description: "User not found",
       content: { "application/json": { schema: NotFoundErrorSchema } }
     },
-    409: {
-      description: "Email already in use by another user",
-      content: { "application/json": { schema: ConflictErrorSchema } }
-    },
     500: {
       description: "Internal server error",
       content: { "application/json": { schema: InternalServerErrorSchema } }
@@ -2102,8 +2144,48 @@ var updateUserEmailRoute = (0, import_zod_openapi20.createRoute)({
       content: { "application/json": { schema: NotFoundErrorSchema } }
     },
     409: {
-      description: "Email already in use by another user",
-      content: { "application/json": { schema: ConflictErrorSchema } }
+      description: "Email already in use by another user, or locked by a linked federated identity",
+      content: { "application/json": { schema: import_zod_openapi20.z.union([ConflictErrorSchema, EmailLockedByFederatedIdentityErrorSchema]) } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var unlinkUserIdentityRoute = (0, import_zod_openapi20.createRoute)({
+  method: "delete",
+  path: "/admin/users/{id}/identities/{provider}",
+  tags: ["admin.users"],
+  security: [{ bearerAuth: [] }],
+  summary: "Unlink a user's federated identity for a provider (admin-initiated)",
+  request: {
+    params: AdminUserIdentityParamSchema
+  },
+  responses: {
+    200: {
+      description: "Identity removed; passwordIssued/newPassword report whether a password was generated",
+      content: { "application/json": { schema: UnlinkUserIdentityResponseSchema } }
+    },
+    400: {
+      description: "Invalid id",
+      content: { "application/json": { schema: ValidationErrorSchema } }
+    },
+    401: {
+      description: "Authentication required",
+      content: { "application/json": { schema: AuthenticationRequiredErrorSchema } }
+    },
+    403: {
+      description: "Admin permission required",
+      content: { "application/json": { schema: AdminRequiredErrorSchema } }
+    },
+    404: {
+      description: "User not found, or the user has no identity for this provider",
+      content: { "application/json": { schema: UnlinkUserIdentityNotFoundErrorSchema } }
+    },
+    409: {
+      description: "Refused: the target is the operating admin themself, or password auth is disabled instance-wide",
+      content: { "application/json": { schema: UnlinkUserIdentityConflictErrorSchema } }
     },
     500: {
       description: "Internal server error",
@@ -2188,6 +2270,7 @@ var adminUsersRoutes = {
   resetPasswordRoute,
   resendInviteRoute,
   updateUserEmailRoute,
+  unlinkUserIdentityRoute,
   pendingUsersCountRoute,
   deleteUserRoute
 };
@@ -6545,12 +6628,28 @@ var FederatedHandoffResponseSchema = TokenAuthResponseSchema;
 var LinkedAuthProviderListResponseSchema = import_zod_openapi66.z.object({
   identities: import_zod_openapi66.z.array(import_zod_openapi66.z.object({ provider: import_zod_openapi66.z.string() }))
 });
-var CreateLinkGrantRequestSchema = import_zod_openapi66.z.object({
-  /** RFC 7638 thumbprint of the P-256 public key this browser will use at `/start` — binds the grant to this browser (AC-2). */
-  handoffChallenge: import_zod_openapi66.z.string().min(1)
+var LinkCompletionCodeSchema = import_zod_openapi66.z.string().regex(/^[A-Za-z0-9_-]{43}$/, "must be a 43-character base64url completion code");
+var StartProviderLinkResponseSchema = import_zod_openapi66.z.object({
+  authorizationUrl: import_zod_openapi66.z.string().url()
+});
+var PendingLinkCompletionResponseSchema = import_zod_openapi66.z.object({
+  provider: import_zod_openapi66.z.string(),
+  accountLabel: import_zod_openapi66.z.string().optional()
 });
-var CreateLinkGrantResponseSchema = import_zod_openapi66.z.object({
-  linkGrant: import_zod_openapi66.z.string()
+var CompleteProviderLinkResponseSchema = import_zod_openapi66.z.object({
+  result: import_zod_openapi66.z.literal("linked")
+});
+var LinkCompletionConsumedErrorSchema = ApiErrorSchema.extend({
+  error: import_zod_openapi66.z.object({
+    code: import_zod_openapi66.z.literal("LINK_COMPLETION_CONSUMED"),
+    message: import_zod_openapi66.z.string()
+  })
+});
+var CompleteProviderLinkConflictErrorSchema = ApiErrorSchema.extend({
+  error: import_zod_openapi66.z.object({
+    code: import_zod_openapi66.z.enum(["FEDERATED_IDENTITY_IN_USE", "FEDERATED_LINK_AUTH_STATE_CHANGED", "FEDERATED_LINK_NOT_LINKED"]),
+    message: import_zod_openapi66.z.string()
+  })
 });
 var UnlinkAuthProviderErrorSchema = import_zod_openapi66.z.object({
   error: import_zod_openapi66.z.object({
@@ -6581,7 +6680,7 @@ var startFederatedProviderRoute = (0, import_zod_openapi67.createRoute)({
   method: "get",
   path: "/auth/providers/{name}/start",
   tags: ["federatedAuth"],
-  summary: "Top-level navigation that redirects the browser to the named provider",
+  summary: "Top-level navigation that redirects the browser to the named provider (public sign-in ONLY)",
   request: {
     params: import_zod_openapi67.z.object({ name: import_zod_openapi67.z.string() }),
     query: import_zod_openapi67.z.object({
@@ -6589,31 +6688,13 @@ var startFederatedProviderRoute = (0, import_zod_openapi67.createRoute)({
       /** base64url(JSON) of the sender's P-256 public JWK. */
       handoff_jwk: import_zod_openapi67.z.string().min(1),
       /** base64url ES256 signature over the start canonical message. */
-      handoff_proof: import_zod_openapi67.z.string().min(1),
-      /**
-       * RFC-0014 phase 3 — `'1'` switches this start into LINK mode: the
-       * request must carry a web-session JWT, and the flow attaches the
-       * resulting identity to that session's user instead of signing
-       * anyone in. Absent (the ordinary sign-in start) the route stays
-       * fully public.
-       */
-      link: import_zod_openapi67.z.literal("1").optional(),
-      /** The opaque id from `POST /auth/providers/{name}/link-grants`. Required when `link=1`, ignored otherwise. */
-      link_grant: import_zod_openapi67.z.string().min(1).optional()
+      handoff_proof: import_zod_openapi67.z.string().min(1)
     })
   },
   responses: {
     302: { description: "Redirect to the provider authorization endpoint" },
     400: {
-      description: "Malformed continue / sender proof, or an invalid/expired/mismatched link grant",
-      content: { "application/json": { schema: ApiErrorSchema } }
-    },
-    401: {
-      description: "link=1 without a web-session JWT \u2014 never downgraded to the public sign-in start",
-      content: { "application/json": { schema: ApiErrorSchema } }
-    },
-    403: {
-      description: "link=1 with a non-web credential (PAT / OAuth access token)",
+      description: "Malformed continue / sender proof, OR a raw `link` query key is present (any value) \u2014 the retired link-via-GET flow is gone entirely; a raw `link` key is always rejected rather than silently downgraded to public sign-in.",
       content: { "application/json": { schema: ApiErrorSchema } }
     },
     404: {
@@ -6646,32 +6727,113 @@ var listLinkedAuthProvidersRoute = (0, import_zod_openapi67.createRoute)({
     }
   }
 });
-var createAuthProviderLinkGrantRoute = (0, import_zod_openapi67.createRoute)({
+var startProviderLinkRoute = (0, import_zod_openapi67.createRoute)({
   method: "post",
-  path: "/auth/providers/{name}/link-grants",
+  path: "/auth/providers/{name}/link-start",
   tags: ["federatedAuth"],
-  summary: "Mint a short-lived, opaque grant that authorizes ONE link start for the current web session",
+  summary: "Mint an IdP authorization URL + flow-specific state cookie for the current web session (stage 1 of 3)",
   request: {
-    params: import_zod_openapi67.z.object({ name: import_zod_openapi67.z.string() }),
-    body: { content: { "application/json": { schema: CreateLinkGrantRequestSchema } } }
+    params: import_zod_openapi67.z.object({ name: import_zod_openapi67.z.string() })
   },
   responses: {
     200: {
-      description: "Opaque single-use grant id",
-      content: { "application/json": { schema: CreateLinkGrantResponseSchema } }
+      description: "Authorization URL to navigate the browser to. Sets a flow-specific, 300s state cookie.",
+      content: { "application/json": { schema: StartProviderLinkResponseSchema } }
+    },
+    400: {
+      description: "The signed link-state cookie value would exceed its per-cookie byte limit, or the aggregate Cookie-header admission budget cannot be satisfied even after pruning \u2014 no Set-Cookie or authorizationUrl is returned.",
+      content: { "application/json": { schema: ApiErrorSchema } }
     },
     401: {
-      description: "Authentication required",
+      description: "Authentication required (credential missing/invalid \u2014 resolved by middleware before this route's own validation)",
       content: { "application/json": { schema: AuthenticationRequiredErrorSchema } }
     },
     403: {
-      description: "Non-web credential (PAT / OAuth access token)",
+      description: "Non-web credential (PAT / OAuth access token) \u2014 linking is a session-level account change",
       content: { "application/json": { schema: ApiErrorSchema } }
     },
     404: {
       description: "Unknown, unconfigured, or credential-kind provider",
       content: { "application/json": { schema: ApiErrorSchema } }
     },
+    500: {
+      description: "Internal server error (e.g. a declared multi-instance topology with no reachable Redis)",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var getProviderLinkCompletionRoute = (0, import_zod_openapi67.createRoute)({
+  method: "get",
+  path: "/auth/providers/{name}/link-completions/{code}",
+  tags: ["federatedAuth"],
+  summary: "Read a pending link completion's confirmation details (stage 3a \u2014 non-destructive)",
+  request: {
+    params: import_zod_openapi67.z.object({ name: import_zod_openapi67.z.string(), code: LinkCompletionCodeSchema })
+  },
+  responses: {
+    200: {
+      description: "Pending, unconsumed completion bound to the caller \u2014 provider label fallback + optional display-only accountLabel",
+      content: { "application/json": { schema: PendingLinkCompletionResponseSchema } }
+    },
+    400: {
+      description: "Authenticated but `{code}` fails the 43-character base64url shape (VALIDATION_ERROR)",
+      content: { "application/json": { schema: ValidationErrorSchema } }
+    },
+    401: {
+      description: "Authentication required \u2014 resolved by middleware before this route's own `{code}` shape validation, so an unauthenticated + malformed code is still 401, never 400",
+      content: { "application/json": { schema: AuthenticationRequiredErrorSchema } }
+    },
+    403: {
+      description: "Non-web credential (PAT / OAuth access token)",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    404: {
+      description: "Never-issued, expired, retention-expired, or bound to a different user/provider/authVersion \u2014 all collapse to the same generic NOT_FOUND (no result-unknown code exists)",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    409: {
+      description: "The caller's own completion was already consumed",
+      content: { "application/json": { schema: LinkCompletionConsumedErrorSchema } }
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: InternalServerErrorSchema } }
+    }
+  }
+});
+var completeProviderLinkRoute = (0, import_zod_openapi67.createRoute)({
+  method: "post",
+  path: "/auth/providers/{name}/link-completions/{code}",
+  tags: ["federatedAuth"],
+  summary: "Atomically consume a link completion code and insert the identity (stage 3b \u2014 terminal)",
+  request: {
+    params: import_zod_openapi67.z.object({ name: import_zod_openapi67.z.string(), code: LinkCompletionCodeSchema })
+  },
+  responses: {
+    200: {
+      description: "Linked (fresh winner OR an already-consumed replay that resolves to the same owner) \u2014 the same body either way",
+      content: { "application/json": { schema: CompleteProviderLinkResponseSchema } }
+    },
+    400: {
+      description: "Authenticated but `{code}` fails the 43-character base64url shape (VALIDATION_ERROR)",
+      content: { "application/json": { schema: ValidationErrorSchema } }
+    },
+    401: {
+      description: "Authentication required \u2014 resolved by middleware before this route's own `{code}` shape validation, so an unauthenticated + malformed code is still 401, never 400",
+      content: { "application/json": { schema: AuthenticationRequiredErrorSchema } }
+    },
+    403: {
+      description: "Non-web credential (PAT / OAuth access token)",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    404: {
+      description: "Never-issued, expired, retention-expired, or bound to a different user/provider \u2014 all collapse to the same generic NOT_FOUND",
+      content: { "application/json": { schema: ApiErrorSchema } }
+    },
+    409: {
+      description: "FEDERATED_IDENTITY_IN_USE (provider account owned by someone else, or this user already has a different account of this provider), FEDERATED_LINK_AUTH_STATE_CHANGED (fresh User re-read found the session inactive or authVersion changed since link-start), or FEDERATED_LINK_NOT_LINKED (an already-consumed replay whose original insert has not landed) \u2014 no other conflict code exists.",
+      content: { "application/json": { schema: CompleteProviderLinkConflictErrorSchema } }
+    },
     500: {
       description: "Internal server error",
       content: { "application/json": { schema: InternalServerErrorSchema } }
@@ -6725,7 +6887,7 @@ var callbackFederatedProviderRoute = (0, import_zod_openapi67.createRoute)({
   },
   responses: {
     302: {
-      description: "Redirect to the trusted web login/complete page on success, or back to the trusted web /login on failure"
+      description: "Ordinary sign-in: redirect to the trusted web login/complete page on success, or back to the trusted web /login on failure. Link flow (query `state` in the reserved crowilnk_ namespace): success redirects to `/me?provider=<name>&link_completion=<code>` (provider + completion code ONLY); failure redirects to `/me?provider=<name>&link=link_failed` (provider + the generic marker ONLY \u2014 never a completion code, never accountLabel, never the underlying reason)."
     },
     404: {
       description: "Unknown or unconfigured provider (also used when trusted origins cannot be resolved)",
@@ -6770,7 +6932,9 @@ var federatedAuthRoutes = {
   callbackFederatedProviderRoute,
   federatedHandoffRoute,
   listLinkedAuthProvidersRoute,
-  createAuthProviderLinkGrantRoute,
+  startProviderLinkRoute,
+  getProviderLinkCompletionRoute,
+  completeProviderLinkRoute,
   unlinkAuthProviderRoute
 };
 
@@ -7658,6 +7822,7 @@ var stubSearchAdminUsersByEmail = { users: [] };
 var stubInviteUsers = { results: [] };
 var stubAdminUserMutation = { user: stubUserPublic };
 var stubResetPassword = { user: stubUserPublic, newPassword: "" };
+var stubUnlinkUserIdentity = { user: stubUserPublic, passwordIssued: false };
 var stubDeleteAdminUser = { deletedId: "" };
 var stubPendingUsersCount = { count: 0 };
 var stubListPlugins = { plugins: [] };
@@ -7703,9 +7868,9 @@ var bookmarkBacklinkCommentRevisionChain = new import_zod_openapi79.OpenAPIHono(
 var pageChain = new import_zod_openapi79.OpenAPIHono().openapi(pageRoutes.getPageRoute, (c) => c.json(stubPageWithRevision, 200)).openapi(pageRoutes.listPagesRoute, (c) => c.json(stubListPages, 200)).openapi(pageRoutes.listPageChildrenRoute, (c) => c.json(stubListPageChildren, 200)).openapi(pageRoutes.createPageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.updatePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.setPageGrantRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.seenPageRoute, (c) => c.json(stubSeenUsers, 200)).openapi(pageRoutes.getSeenUsersRoute, (c) => c.json(stubSeenUsers, 200)).openapi(pageRoutes.likePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.unlikePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.claimPageLinkAccessRoute, (c) => c.json({ ...stubPageWithRevision, granted: false }, 200)).openapi(pageRoutes.getWatchStatusRoute, (c) => c.json(stubWatchStatus, 200)).openapi(pageRoutes.setWatchStatusRoute, (c) => c.json(stubWatchStatus, 200)).openapi(pageRoutes.deletePageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.revertDeletedPageRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.revertToRevisionRoute, (c) => c.json(stubPageResponse, 200)).openapi(pageRoutes.renamePageRoute, (c) => c.json({ ...stubPageResponse, renamed_count: 1 }, 200)).openapi(pageRoutes.renameSubtreeRoute, (c) => c.json({ renamed_count: 0 }, 200)).openapi(pagePreviewRoutes.previewPageRoute, (c) => c.json(stubPreview, 200)).openapi(pageCollabRoutes.getYjsTokenRoute, (c) => c.json(stubWsToken, 200)).openapi(presenceRoutes.getPresenceTokenRoute, (c) => c.json(stubPresenceToken, 200)).openapi(presenceRoutes.getLikersRoute, (c) => c.json(stubLikers, 200));
 var lateContractApp = new import_zod_openapi79.OpenAPIHono().openapi(draftRoutes.createDraftRoute, (c) => c.json(stubCreateDraft, 201)).openapi(draftRoutes.listDraftsRoute, (c) => c.json(stubListDrafts, 200)).openapi(draftRoutes.cancelDraftRoute, (c) => c.json(stubCreateDraft, 200)).openapi(autocompleteRoutes.autocompleteUsersRoute, (c) => c.json(stubAutocomplete, 200)).openapi(autocompleteRoutes.autocompletePagesRoute, (c) => c.json(stubAutocomplete, 200)).openapi(attachmentRoutes.getAttachmentUsageRoute, (c) => c.json(stubAttachmentUsage, 200)).openapi(attachmentRoutes.listAttachmentsRoute, (c) => c.json(stubListAttachments, 200)).openapi(attachmentRoutes.addAttachmentRoute, (c) => c.json(stubAddAttachment, 200)).openapi(attachmentRoutes.uploadAttachmentRoute, (c) => c.json(stubUploadAttachment, 200)).openapi(attachmentRoutes.getAttachmentMetaRoute, (c) => c.json(stubAttachmentMeta, 200)).openapi(attachmentRoutes.removeAttachmentRoute, (c) => c.json(stubRemoveAttachment, 200)).openapi(attachmentRoutes.getUploadPolicyRoute, (c) => c.json(stubUploadPolicy, 200)).openapi(searchRoutes.searchPagesRoute, (c) => c.json(stubSearchPages, 200)).openapi(adminCryptoRoutes.getCryptoStatusRoute, (c) => c.json(stubCryptoStatus, 200)).openapi(adminCryptoRoutes.reencryptAllRoute, (c) => c.json(stubReencrypt, 200)).openapi(notificationRoutes.listNotificationsRoute, (c) => c.json(stubListNotifications, 200)).openapi(notificationRoutes.markAllAsReadRoute, (c) => c.json(stubMarkAllAsRead, 200)).openapi(notificationRoutes.getNotificationsTokenRoute, (c) => c.json(stubNotificationsToken, 200)).openapi(notificationRoutes.getUnreadCountRoute, (c) => c.json(stubNotificationStatus, 200)).openapi(notificationRoutes.openNotificationRoute, (c) => c.json(stubOpenNotification, 200));
 var adminSettingsContractApp = new import_zod_openapi79.OpenAPIHono().openapi(adminAppRoutes.getAppSettingsRoute, (c) => c.json(stubGetAppSettings, 200)).openapi(adminAppRoutes.updateAppSettingsRoute, (c) => c.json(stubUpdateAppSettings, 200)).openapi(adminAuthRoutes.getAuthSettingsRoute, (c) => c.json(stubAuthSettings, 200)).openapi(adminAuthRoutes.updateAuthSettingsRoute, (c) => c.json(stubAuthSettings, 200)).openapi(adminSecurityRoutes.getSecuritySettingsRoute, (c) => c.json(stubSecuritySettings, 200)).openapi(adminSecurityRoutes.updateSecuritySettingsRoute, (c) => c.json(stubSecuritySettings, 200)).openapi(adminMailRoutes.getMailSettingsRoute, (c) => c.json(stubMailSettings, 200)).openapi(adminMailRoutes.updateMailSettingsRoute, (c) => c.json(stubUpdateMailSettings, 200)).openapi(adminMailRoutes.sendTestMailRoute, (c) => c.json(stubSendTestMail, 200)).openapi(adminStorageRoutes.getStorageStatusRoute, (c) => c.json(stubStorageStatus, 200)).openapi(adminSearchRoutes.getSearchStatusRoute, (c) => c.json(stubSearchStatus, 200));
-var adminUsersPluginsContractApp = new import_zod_openapi79.OpenAPIHono().openapi(adminUsersRoutes.listUsersRoute, (c) => c.json(stubListAdminUsers, 200)).openapi(adminUsersRoutes.searchUsersByEmailRoute, (c) => c.json(stubSearchAdminUsersByEmail, 200)).openapi(adminUsersRoutes.pendingUsersCountRoute, (c) => c.json(stubPendingUsersCount, 200)).openapi(adminUsersRoutes.inviteUsersRoute, (c) => c.json(stubInviteUsers, 200)).openapi(adminUsersRoutes.editUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.makeAdminRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.removeFromAdminRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.activateUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.suspendUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.resetPasswordRoute, (c) => c.json(stubResetPassword, 200)).openapi(adminUsersRoutes.resendInviteRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.updateUserEmailRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.deleteUserRoute, (c) => c.json(stubDeleteAdminUser, 200)).openapi(adminPluginsRoutes.listPluginsRoute, (c) => c.json(stubListPlugins, 200)).openapi(adminPluginsRoutes.getPluginConfigRoute, (c) => c.json(stubPluginConfig, 200)).openapi(adminPluginsRoutes.updatePluginConfigRoute, (c) => c.json(stubUpdatePluginConfig, 200)).openapi(adminPluginsRoutes.getPluginReadinessRoute, (c) => c.json(stubPluginReadiness, 200)).openapi(adminPluginsRoutes.clearRenderCacheAllRoute, (c) => c.json(stubClearRenderCache, 200)).openapi(adminPluginsRoutes.clearRenderCachePluginRoute, (c) => c.json(stubClearRenderCache, 200));
+var adminUsersPluginsContractApp = new import_zod_openapi79.OpenAPIHono().openapi(adminUsersRoutes.listUsersRoute, (c) => c.json(stubListAdminUsers, 200)).openapi(adminUsersRoutes.searchUsersByEmailRoute, (c) => c.json(stubSearchAdminUsersByEmail, 200)).openapi(adminUsersRoutes.pendingUsersCountRoute, (c) => c.json(stubPendingUsersCount, 200)).openapi(adminUsersRoutes.inviteUsersRoute, (c) => c.json(stubInviteUsers, 200)).openapi(adminUsersRoutes.editUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.makeAdminRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.removeFromAdminRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.activateUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.suspendUserRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.resetPasswordRoute, (c) => c.json(stubResetPassword, 200)).openapi(adminUsersRoutes.resendInviteRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.updateUserEmailRoute, (c) => c.json(stubAdminUserMutation, 200)).openapi(adminUsersRoutes.unlinkUserIdentityRoute, (c) => c.json(stubUnlinkUserIdentity, 200)).openapi(adminUsersRoutes.deleteUserRoute, (c) => c.json(stubDeleteAdminUser, 200)).openapi(adminPluginsRoutes.listPluginsRoute, (c) => c.json(stubListPlugins, 200)).openapi(adminPluginsRoutes.getPluginConfigRoute, (c) => c.json(stubPluginConfig, 200)).openapi(adminPluginsRoutes.updatePluginConfigRoute, (c) => c.json(stubUpdatePluginConfig, 200)).openapi(adminPluginsRoutes.getPluginReadinessRoute, (c) => c.json(stubPluginReadiness, 200)).openapi(adminPluginsRoutes.clearRenderCacheAllRoute, (c) => c.json(stubClearRenderCache, 200)).openapi(adminPluginsRoutes.clearRenderCachePluginRoute, (c) => c.json(stubClearRenderCache, 200));
 var oauthContractApp = new import_zod_openapi79.OpenAPIHono().openapi(oauthRoutes.authorizeRoute, (c) => c.json(stubAuthorize, 200)).openapi(oauthRoutes.tokenRoute, (c) => c.json(stubToken, 200)).openapi(oauthRoutes.revokeRoute, (c) => c.json(stubRevoke, 200)).openapi(oauthRoutes.discoveryRoute, (c) => c.json(stubDiscovery, 200)).openapi(oauthRoutes.deviceAuthorizeRoute, (c) => c.json(stubDeviceAuthorize, 200)).openapi(oauthRoutes.deviceInfoRoute, (c) => c.json(stubDeviceInfo, 200)).openapi(oauthRoutes.deviceVerifyRoute, (c) => c.json(stubDeviceVerify, 200)).openapi(oauthRoutes.clientInfoRoute, (c) => c.json(stubClientInfo, 200));
-var federatedAuthContractApp = new import_zod_openapi79.OpenAPIHono().openapi(federatedAuthRoutes.listFederatedProvidersRoute, (c) => c.json(stubProviderList, 200)).openapi(federatedAuthRoutes.startFederatedProviderRoute, (c) => c.redirect("", 302)).openapi(federatedAuthRoutes.callbackFederatedProviderRoute, (c) => c.redirect("", 302)).openapi(federatedAuthRoutes.federatedHandoffRoute, (c) => c.json(stubTokens, 200)).openapi(federatedAuthRoutes.listLinkedAuthProvidersRoute, (c) => c.json({ identities: [] }, 200)).openapi(federatedAuthRoutes.createAuthProviderLinkGrantRoute, (c) => c.json({ linkGrant: "" }, 200)).openapi(federatedAuthRoutes.unlinkAuthProviderRoute, (c) => c.body(null, 204));
+var federatedAuthContractApp = new import_zod_openapi79.OpenAPIHono().openapi(federatedAuthRoutes.listFederatedProvidersRoute, (c) => c.json(stubProviderList, 200)).openapi(federatedAuthRoutes.startFederatedProviderRoute, (c) => c.redirect("", 302)).openapi(federatedAuthRoutes.callbackFederatedProviderRoute, (c) => c.redirect("", 302)).openapi(federatedAuthRoutes.federatedHandoffRoute, (c) => c.json(stubTokens, 200)).openapi(federatedAuthRoutes.listLinkedAuthProvidersRoute, (c) => c.json({ identities: [] }, 200)).openapi(federatedAuthRoutes.startProviderLinkRoute, (c) => c.json({ authorizationUrl: "" }, 200)).openapi(federatedAuthRoutes.getProviderLinkCompletionRoute, (c) => c.json({ provider: "" }, 200)).openapi(federatedAuthRoutes.completeProviderLinkRoute, (c) => c.json({ result: "linked" }, 200)).openapi(federatedAuthRoutes.unlinkAuthProviderRoute, (c) => c.body(null, 204));
 var federatedRegistrationContractApp = new import_zod_openapi79.OpenAPIHono().openapi(federatedRegistrationRoutes.getFederatedRegistrationRoute, (c) => c.json(stubFederatedRegistrationSnapshot, 200)).openapi(federatedRegistrationRoutes.submitFederatedRegistrationRoute, (c) => c.json({ status: "approval_required" }, 200)).openapi(federatedRegistrationRoutes.logoutFederatedRegistrationRoute, (c) => c.body(null, 204));
 var createClient = (baseUrl, options = {}) => (0, import_client.hc)(baseUrl, {
   headers: options.headers,
@@ -7942,6 +8107,8 @@ var WS_CLOSE_CODES = {
   AdminRequiredErrorSchema,
   AdminSidebarSection,
   AdminUserIdParamSchema,
+  AdminUserIdentityParamSchema,
+  AdminUserListItemSchema,
   AdminUserMutationResponseSchema,
   ApiErrorSchema,
   AppInfoResponseSchema,
@@ -7977,6 +8144,8 @@ var WS_CLOSE_CODES = {
   CommentInvalidRequestErrorSchema,
   CommentNotFoundErrorSchema,
   CommentSchema,
+  CompleteProviderLinkConflictErrorSchema,
+  CompleteProviderLinkResponseSchema,
   ConfigReadinessIssueSchema,
   ConfigReadinessResponseSchema,
   ConfirmEmailChangeRequestSchema,
@@ -7989,8 +8158,6 @@ var WS_CLOSE_CODES = {
   CreateAdminResponseSchema,
   CreateDraftRequestSchema,
   CreateDraftResponseSchema,
-  CreateLinkGrantRequestSchema,
-  CreateLinkGrantResponseSchema,
   CreatePageRequestSchema,
   CrowiCodeSidecarSchema,
   CrowiDiagramNodeSchema,
@@ -8025,6 +8192,7 @@ var WS_CLOSE_CODES = {
   DraftSummarySchema,
   ERROR_CODES,
   EditAdminUserRequestSchema,
+  EmailLockedByFederatedIdentityErrorSchema,
   EncryptionNotConfiguredErrorSchema,
   ErrorCodeSchema,
   FRONTMATTER_MAX_ENTRIES,
@@ -8080,6 +8248,8 @@ var WS_CLOSE_CODES = {
   LanguageSchema,
   LikerSchema,
   LikersResponseSchema,
+  LinkCompletionCodeSchema,
+  LinkCompletionConsumedErrorSchema,
   LinkedAuthProviderListResponseSchema,
   ListAccessTokensResponseSchema,
   ListAdminUsersRequestSchema,
@@ -8144,6 +8314,7 @@ var WS_CLOSE_CODES = {
   PasswordErrorResponseSchema,
   PasswordUpdateSuccessSchema,
   PastAttachmentUsageSchema,
+  PendingLinkCompletionResponseSchema,
   PendingUsersCountResponseSchema,
   PictureUploadResponseSchema,
   PluginAdminPlacementSchema,
@@ -8223,6 +8394,7 @@ var WS_CLOSE_CODES = {
   ShikiTokenLinesSchema,
   ShikiTokenSchema,
   ShikiTokenStyleSchema,
+  StartProviderLinkResponseSchema,
   StorageDriverEntrySchema,
   SuccessResponseSchema,
   ThemeSchema,
@@ -8237,6 +8409,9 @@ var WS_CLOSE_CODES = {
   TokenResponseSchema,
   UPLOAD_ALLOWED_MIME,
   UnlinkAuthProviderErrorSchema,
+  UnlinkUserIdentityConflictErrorSchema,
+  UnlinkUserIdentityNotFoundErrorSchema,
+  UnlinkUserIdentityResponseSchema,
   UpdateAdminUserEmailRequestSchema,
   UpdateAppSettingsRequestSchema,
   UpdateAppSettingsResponseSchema,
@@ -8308,10 +8483,10 @@ var WS_CLOSE_CODES = {
   clearRenderCachePluginRoute,
   clientInfoRoute,
   commentRoutes,
+  completeProviderLinkRoute,
   confirmEmailChangeRoute,
   createAccessTokenRoute,
   createAdminRoute,
-  createAuthProviderLinkGrantRoute,
   createClient,
   createDraftRoute,
   createPageRoute,
@@ -8349,6 +8524,7 @@ var WS_CLOSE_CODES = {
   getPluginReadinessRoute,
   getPresenceTokenRoute,
   getProfileRoute,
+  getProviderLinkCompletionRoute,
   getRevisionRoute,
   getRevisionsRoute,
   getSearchStatusRoute,
@@ -8422,6 +8598,7 @@ var WS_CLOSE_CODES = {
   setPageGrantRoute,
   setWatchStatusRoute,
   startFederatedProviderRoute,
+  startProviderLinkRoute,
   stripKnownHtmlTags,
   submitFederatedRegistrationRoute,
   suspendUserRoute,
@@ -8434,6 +8611,7 @@ var WS_CLOSE_CODES = {
   tokenRoute,
   unlikePageRoute,
   unlinkAuthProviderRoute,
+  unlinkUserIdentityRoute,
   unwrapRenderedAst,
   updateAppSettingsRoute,
   updateAuthSettingsRoute,