@crowi/api 2.0.0-alpha.0

package/dist/hono/middleware/error-handler.js

@@ -0,0 +1,20 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.honoOnError = void 0;
+const debug_1 = __importDefault(require("debug"));
+const debug = (0, debug_1.default)('crowi:hono:onError');
+const INTERNAL_ERROR_BODY = {
+    error: {
+        code: 'INTERNAL_ERROR',
+        message: 'Internal server error',
+    },
+};
+const honoOnError = (err, c) => {
+    debug('Unhandled error in Hono handler:', err);
+    return c.json(INTERNAL_ERROR_BODY, 500);
+};
+exports.honoOnError = honoOnError;
+//# sourceMappingURL=error-handler.js.map

package/dist/hono/middleware/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../../src/hono/middleware/error-handler.ts"],"names":[],"mappings":";;;;;;AAOA,kDAA0B;AAM1B,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,oBAAoB,CAAC,CAAC;AAE1C,MAAM,mBAAmB,GAAwB;IAC/C,KAAK,EAAE;QACL,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,uBAAuB;KACjC;CACF,CAAC;AAEK,MAAM,WAAW,GAAG,CAAC,GAAU,EAAE,CAAU,EAAY,EAAE;IAC9D,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC,CAAC;AAHW,QAAA,WAAW,eAGtB"}

package/dist/hono/middleware/rate-limit.d.ts

@@ -0,0 +1,57 @@
+/**
+ * RFC-0006 Phase 4 Batch 6 — Hono wrapper around `util/rate-limit.ts`.
+ *
+ * `createRateLimiter` is framework-agnostic (it just exposes
+ * `limiter.hit(userId)`), so the Hono side is a thin adapter that:
+ *
+ *  1. resolves the calling user via `c.get('user')` — the middleware
+ *     MUST be installed AFTER `createJwtAuth(crowi)` so the user is
+ *     populated. Apply order is enforced at the registration site
+ *     (e.g. `autocomplete.ts` / `attachment.ts`); guard at the
+ *     middleware so a mis-order fails loudly.
+ *  2. calls `limiter.hit(userId)` once per request.
+ *  3. emits the wire-identical 429 envelopes used by the ts-rest era:
+ *      - `autocomplete` → `{ error: 'rate_limited', message,
+ *         retryAfterSeconds }` (top-level shape from
+ *         `AutocompleteRateLimitErrorSchema`).
+ *      - `attachment-upload` → `{ error: 'rate_limited', message,
+ *         details: { retryAfterSeconds } }` (lowercase RFC-0004 envelope
+ *         from `UploadAttachmentErrorSchema`).
+ *     A `Retry-After` header (whole seconds) is set on both paths so
+ *     non-JSON clients can back off without parsing the body.
+ *  4. lets the request through (`await next()`) when within budget.
+ *
+ * Per-`crowi` limiter caching: `withRateLimit` itself does not own a
+ * limiter — it is given one by the resource handler so a single
+ * `createRateLimiter(...)` instance is shared across every request
+ * (Redis backed when `crowi.redis !== null`, in-memory fallback
+ * otherwise — see `util/rate-limit.ts`).
+ */
+import type { MiddlewareHandler } from '../../hono';
+import type { RateLimiter } from '../../util/rate-limit';
+import type { CrowiHonoBindings } from '../app';
+/**
+ * Wire shape selector. Each migrated endpoint that needs rate-limiting
+ * declares which envelope its 429 should use; the helper has no opinion
+ * beyond matching the corresponding schema.
+ *
+ *  - `autocomplete-envelope` matches `AutocompleteRateLimitErrorSchema`:
+ *    `{ error: 'rate_limited', message, retryAfterSeconds }`.
+ *  - `attachment-upload-envelope` matches `UploadAttachmentErrorSchema`
+ *    with `error: 'rate_limited'`:
+ *    `{ error: 'rate_limited', message, details: { retryAfterSeconds } }`.
+ */
+export type RateLimitWireShape = 'autocomplete-envelope' | 'attachment-upload-envelope';
+export interface WithRateLimitOptions {
+    limiter: RateLimiter;
+    /** Wire shape of the 429 body for this endpoint family. */
+    wireShape: RateLimitWireShape;
+    /** Human-readable message embedded in the 429 body. */
+    message: (retryAfterSeconds: number) => string;
+}
+/**
+ * Build a Hono middleware that counts one hit against `limiter` and
+ * short-circuits with the configured 429 envelope when the per-user
+ * budget is exceeded. MUST be installed AFTER `createJwtAuth(crowi)`.
+ */
+export declare const withRateLimit: (options: WithRateLimitOptions) => MiddlewareHandler<CrowiHonoBindings>;

package/dist/hono/middleware/rate-limit.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withRateLimit = void 0;
+const factory_1 = require("hono/factory");
+/**
+ * Build a Hono middleware that counts one hit against `limiter` and
+ * short-circuits with the configured 429 envelope when the per-user
+ * budget is exceeded. MUST be installed AFTER `createJwtAuth(crowi)`.
+ */
+const withRateLimit = (options) => {
+    const { limiter, wireShape, message } = options;
+    return (0, factory_1.createMiddleware)(async (c, next) => {
+        const user = c.get('user');
+        if (!user) {
+            // Defensive: jwtAuth populates `user`. A missing value here would
+            // mean an apply-order bug at registration; surfacing it as a 401
+            // (rather than a 500) keeps the wire predictable.
+            return c.json({ error: { code: 'AUTHENTICATION_REQUIRED', message: 'Authentication is required' } }, 401);
+        }
+        const result = await limiter.hit(user._id.toString());
+        if (result.allowed) {
+            await next();
+            return;
+        }
+        c.header('Retry-After', String(result.retryAfterSeconds));
+        if (wireShape === 'autocomplete-envelope') {
+            return c.json({
+                error: 'rate_limited',
+                message: message(result.retryAfterSeconds),
+                retryAfterSeconds: result.retryAfterSeconds,
+            }, 429);
+        }
+        // attachment-upload-envelope
+        return c.json({
+            error: 'rate_limited',
+            message: message(result.retryAfterSeconds),
+            details: { retryAfterSeconds: result.retryAfterSeconds },
+        }, 429);
+    });
+};
+exports.withRateLimit = withRateLimit;
+//# sourceMappingURL=rate-limit.js.map

package/dist/hono/middleware/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/hono/middleware/rate-limit.ts"],"names":[],"mappings":";;;AA8BA,0CAAgD;AA2BhD;;;;GAIG;AACI,MAAM,aAAa,GAAG,CAAC,OAA6B,EAAwC,EAAE;IACnG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAEhD,OAAO,IAAA,0BAAgB,EAAoB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC3D,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,kEAAkE;YAClE,iEAAiE;YACjE,kDAAkD;YAClD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,yBAAkC,EAAE,OAAO,EAAE,4BAAqC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9H,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAE1D,IAAI,SAAS,KAAK,uBAAuB,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,cAAuB;gBAC9B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBAC1C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;aAC5C,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,6BAA6B;QAC7B,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,cAAuB;YAC9B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;YAC1C,OAAO,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE;SACzD,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAzCW,QAAA,aAAa,iBAyCxB"}

package/dist/hono/middleware/require-scope.d.ts

@@ -0,0 +1,50 @@
+/**
+ * RFC-0010 — `requireScope(scope)` route guard.
+ *
+ * Reads `authScopes` (set by `createJwtAuth`) and checks it against the
+ * route's required scope via `scopeSatisfies` (which encodes write→read
+ * and umbrella read/write implication). On failure it returns
+ * `403 INSUFFICIENT_SCOPE` with a `WWW-Authenticate: Bearer
+ * error="insufficient_scope"` header (RFC 6750 §3.1) so SDKs can detect a
+ * scope shortfall without parsing the body.
+ *
+ * Web sessions authenticate with `authScopes = ALL_SCOPES`, so every
+ * `requireScope` passes for them — the existing UI behaviour is
+ * unchanged. Only OAuth tokens (Phase 1) / PATs (Phase 2) are ever
+ * narrowed.
+ *
+ * MUST be installed AFTER `createJwtAuth(crowi)` so `authScopes` is
+ * populated; a missing value indicates an apply-order bug at the
+ * registration site and is surfaced as 401 (not 500) to keep the wire
+ * predictable.
+ */
+import { type Scope } from '@crowi/api-contract';
+import type { Hono } from '../../hono';
+import type { CrowiHonoBindings } from '../app';
+/**
+ * A `@hono/zod-openapi` `createRoute(...)` definition exposes its HTTP
+ * method + path; we read both to attach the scope guard to the exact
+ * `method + path` pair (not the whole prefix — `GET /pages` is read but
+ * `POST /pages` is write).
+ */
+type RouteLike = {
+    method: string;
+    path: string;
+};
+/**
+ * Attach `requireScope(scope)` to a single `method + path` route on the
+ * shared Hono chain. Registering as a method-scoped middleware (via
+ * `app.on`) BEFORE the `.openapi(route, handler)` call means the guard
+ * runs first and the handler only sees scope-satisfied requests.
+ *
+ * Using the contract route's own `method` / `path` keeps the scope
+ * mapping declarative and free of stringly-typed path drift — the path
+ * comes from the same object the handler registers.
+ *
+ * `app` is typed as the bare `Hono` to avoid extending the already-deep
+ * `OpenAPIHono` chain (TS2589); the middleware itself is fully typed
+ * against `CrowiHonoBindings`.
+ */
+export declare const applyScope: (app: Hono<CrowiHonoBindings>, route: RouteLike, scope: Scope) => void;
+export declare const requireScope: (scope: Scope) => import("../../hono").MiddlewareHandler<CrowiHonoBindings, string, {}, Response>;
+export {};

package/dist/hono/middleware/require-scope.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireScope = exports.applyScope = void 0;
+/**
+ * RFC-0010 — `requireScope(scope)` route guard.
+ *
+ * Reads `authScopes` (set by `createJwtAuth`) and checks it against the
+ * route's required scope via `scopeSatisfies` (which encodes write→read
+ * and umbrella read/write implication). On failure it returns
+ * `403 INSUFFICIENT_SCOPE` with a `WWW-Authenticate: Bearer
+ * error="insufficient_scope"` header (RFC 6750 §3.1) so SDKs can detect a
+ * scope shortfall without parsing the body.
+ *
+ * Web sessions authenticate with `authScopes = ALL_SCOPES`, so every
+ * `requireScope` passes for them — the existing UI behaviour is
+ * unchanged. Only OAuth tokens (Phase 1) / PATs (Phase 2) are ever
+ * narrowed.
+ *
+ * MUST be installed AFTER `createJwtAuth(crowi)` so `authScopes` is
+ * populated; a missing value indicates an apply-order bug at the
+ * registration site and is surfaced as 401 (not 500) to keep the wire
+ * predictable.
+ */
+const api_contract_1 = require("@crowi/api-contract");
+const factory_1 = require("hono/factory");
+const auth_1 = require("./auth");
+/**
+ * Attach `requireScope(scope)` to a single `method + path` route on the
+ * shared Hono chain. Registering as a method-scoped middleware (via
+ * `app.on`) BEFORE the `.openapi(route, handler)` call means the guard
+ * runs first and the handler only sees scope-satisfied requests.
+ *
+ * Using the contract route's own `method` / `path` keeps the scope
+ * mapping declarative and free of stringly-typed path drift — the path
+ * comes from the same object the handler registers.
+ *
+ * `app` is typed as the bare `Hono` to avoid extending the already-deep
+ * `OpenAPIHono` chain (TS2589); the middleware itself is fully typed
+ * against `CrowiHonoBindings`.
+ */
+const applyScope = (app, route, scope) => {
+    app.on(route.method, route.path, (0, exports.requireScope)(scope));
+};
+exports.applyScope = applyScope;
+const requireScope = (scope) => (0, factory_1.createMiddleware)(async (c, next) => {
+    const authScopes = c.get('authScopes');
+    if (!authScopes) {
+        return c.json(auth_1.AUTH_REQUIRED_BODY, 401);
+    }
+    if (!(0, api_contract_1.scopeSatisfies)(scope, authScopes)) {
+        c.header('WWW-Authenticate', `Bearer error="insufficient_scope", scope="${scope}"`);
+        const body = {
+            error: {
+                code: 'INSUFFICIENT_SCOPE',
+                message: `This action requires the '${scope}' scope.`,
+                details: { requiredScope: scope },
+            },
+        };
+        return c.json(body, 403);
+    }
+    await next();
+});
+exports.requireScope = requireScope;
+//# sourceMappingURL=require-scope.js.map

package/dist/hono/middleware/require-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-scope.js","sourceRoot":"","sources":["../../../src/hono/middleware/require-scope.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAA8F;AAE9F,0CAAgD;AAGhD,iCAA4C;AAU5C;;;;;;;;;;;;;GAaG;AACI,MAAM,UAAU,GAAG,CAAC,GAA4B,EAAE,KAAgB,EAAE,KAAY,EAAQ,EAAE;IAC/F,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,IAAA,oBAAY,EAAC,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC,CAAC;AAFW,QAAA,UAAU,cAErB;AAEK,MAAM,YAAY,GAAG,CAAC,KAAY,EAAE,EAAE,CAC3C,IAAA,0BAAgB,EAAoB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACpD,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,CAAC,IAAI,CAAC,yBAAkB,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,IAAA,6BAAc,EAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QACvC,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,6CAA6C,KAAK,GAAG,CAAC,CAAC;QACpF,MAAM,IAAI,GAA2B;YACnC,KAAK,EAAE;gBACL,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,6BAA6B,KAAK,UAAU;gBACrD,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE;aAClC;SACF,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AApBQ,QAAA,YAAY,gBAoBpB"}

package/dist/hono/path-rewrite.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Return a new `Request` whose URL has the leading `/api/v2` removed
+ * (`/api/v2/foo/bar` → `/foo/bar`, `/api/v2` → `/`). All other
+ * properties (method / headers / body / signal) are preserved by
+ * re-using the original `Request` object as the second argument to
+ * the `Request` constructor.
+ *
+ * Requests that do not start with the prefix are returned unchanged.
+ *
+ * `duplex: 'half'` is passed alongside so the undici-backed `Request`
+ * constructor accepts a streaming body (Node 20+ rejects a Request
+ * with a stream body unless `duplex` is set). It's a no-op for
+ * GET/HEAD or already-buffered bodies.
+ */
+export declare function stripApiV2Prefix(request: Request): Request;

package/dist/hono/path-rewrite.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripApiV2Prefix = stripApiV2Prefix;
+/**
+ * RFC-0006 Phase 6 Sub-batch D — `/api/v2` prefix stripper.
+ *
+ * The OpenAPI contracts in `@crowi/api-contract` register every route
+ * at its un-prefixed path (`/app/info`, `/pages/:id`, ...) — keeping
+ * the path literal short keeps the inferred `AppType` chain shallow,
+ * which matters for the `hc<AppType>` client (RFC-0006 Phase 4 hit
+ * TS2589 on a deeper chain).
+ *
+ * Production traffic arrives as `/api/v2/<path>`. Rather than re-mount
+ * every route through `app.route('/api/v2', child)` (which re-engages
+ * the AppType chain — see the TS2589 note in
+ * `packages/api-contract/src/client.ts`), we strip the prefix on the
+ * boundary: the production listener in `crowi/index.ts:start()` and
+ * the test request listener in `src/test/setup.ts` both pre-process
+ * the inbound `Request` here.
+ *
+ * Paths that do not start with `/api/v2` are returned unchanged — the
+ * `/docs` + `/openapi.json` documentation routes inside Hono are
+ * already at the root and we want them addressable at
+ * `/api/v2/docs` / `/api/v2/openapi.json` once stripped. (See
+ * `src/hono/index.ts` for those route registrations.)
+ */
+const PREFIX = '/api/v2';
+/**
+ * Return a new `Request` whose URL has the leading `/api/v2` removed
+ * (`/api/v2/foo/bar` → `/foo/bar`, `/api/v2` → `/`). All other
+ * properties (method / headers / body / signal) are preserved by
+ * re-using the original `Request` object as the second argument to
+ * the `Request` constructor.
+ *
+ * Requests that do not start with the prefix are returned unchanged.
+ *
+ * `duplex: 'half'` is passed alongside so the undici-backed `Request`
+ * constructor accepts a streaming body (Node 20+ rejects a Request
+ * with a stream body unless `duplex` is set). It's a no-op for
+ * GET/HEAD or already-buffered bodies.
+ */
+function stripApiV2Prefix(request) {
+    const url = new URL(request.url);
+    if (url.pathname === PREFIX) {
+        url.pathname = '/';
+    }
+    else if (url.pathname.startsWith(`${PREFIX}/`)) {
+        url.pathname = url.pathname.slice(PREFIX.length);
+    }
+    else {
+        return request;
+    }
+    // Re-use the original Request as the init; the constructor copies
+    // method / headers / body / signal. Passing a Request as init avoids
+    // having to set `duplex: 'half'` manually for stream bodies — the
+    // platform inherits the duplex hint from the source Request.
+    return new Request(url.toString(), request);
+}
+//# sourceMappingURL=path-rewrite.js.map

package/dist/hono/path-rewrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-rewrite.js","sourceRoot":"","sources":["../../src/hono/path-rewrite.ts"],"names":[],"mappings":";;AAuCA,4CAcC;AArDD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,GAAG,SAAS,CAAC;AAEzB;;;;;;;;;;;;;GAaG;AACH,SAAgB,gBAAgB,CAAC,OAAgB;IAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC5B,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC;IACrB,CAAC;SAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,kEAAkE;IAClE,qEAAqE;IACrE,kEAAkE;IAClE,6DAA6D;IAC7D,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC"}

package/dist/mail/i18n/en.d.ts

@@ -0,0 +1,2 @@
+import type { MailCatalog } from './index';
+export declare const en: MailCatalog;

package/dist/mail/i18n/en.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.en = void 0;
+exports.en = {
+    invite: {
+        subject: "You're invited to {{ appTitle }}",
+        preheader: 'Accept your invitation and set up your account.',
+        heading: "You've been invited",
+        intro: 'You have been invited to join the wiki. Click the button below to choose your username and password and activate your account.',
+        cta: 'Accept invitation',
+        expiresNote: 'This invitation link expires in 7 days.',
+        ignoreNote: "If you weren't expecting this invitation, you can safely ignore this email.",
+    },
+    activation: {
+        subject: 'Confirm your email for {{ appTitle }}',
+        preheader: 'Confirm your email address to activate your account.',
+        heading: 'Confirm your email',
+        intro: 'Thanks for registering. Please confirm your email address to activate your account by clicking the button below.',
+        cta: 'Confirm email',
+        expiresNote: 'This confirmation link expires in 24 hours.',
+        ignoreNote: "If you didn't create this account, you can safely ignore this email.",
+    },
+    passwordReset: {
+        subject: 'Reset your password for {{ appTitle }}',
+        preheader: 'Reset your password.',
+        heading: 'Reset your password',
+        intro: 'We received a request to reset your password. Click the button below to choose a new one.',
+        cta: 'Reset password',
+        expiresNote: 'This password reset link expires in 1 hour.',
+        ignoreNote: "If you didn't request a password reset, you can safely ignore this email — your password will stay the same.",
+    },
+    test: {
+        subject: '{{ appTitle }}: test email',
+        preheader: 'Your mail settings are working.',
+        heading: 'Your mail settings are working',
+        intro: 'This is a test message sent from the admin mail settings page. If you received it, outgoing email is configured correctly.',
+    },
+    passwordChanged: {
+        subject: 'Your {{ appTitle }} password was changed',
+        preheader: 'Your password was just changed.',
+        heading: 'Your password was changed',
+        intro: 'This is a confirmation that the password for your account was just changed.',
+        ignoreNote: "If you didn't make this change, please reset your password immediately and contact your administrator.",
+    },
+    adminApprovalPending: {
+        subject: 'A new user is awaiting approval on {{ appTitle }}',
+        preheader: 'A self-registered user needs your approval.',
+        heading: 'A user is awaiting approval',
+        intro: 'A new user has registered and is waiting for an administrator to approve their account:',
+        cta: 'Review users',
+    },
+    emailChange: {
+        subject: 'Confirm your new email address for {{ appTitle }}',
+        preheader: 'Confirm your new email address.',
+        heading: 'Confirm your new email address',
+        intro: 'A request was made to change the email address for your account to this one. Click the button below to confirm the change.',
+        cta: 'Confirm new email',
+        expiresNote: 'This confirmation link expires in 24 hours.',
+        ignoreNote: "If you didn't request this change, you can safely ignore this email — your address will stay the same.",
+    },
+    common: {
+        footerTagline: 'Empower the team with sharing your knowledge.',
+        linkFallback: "If the button above doesn't work, copy and paste this URL into your browser:",
+    },
+};
+//# sourceMappingURL=en.js.map

package/dist/mail/i18n/en.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"en.js","sourceRoot":"","sources":["../../../src/mail/i18n/en.ts"],"names":[],"mappings":";;;AAEa,QAAA,EAAE,GAAgB;IAC7B,MAAM,EAAE;QACN,OAAO,EAAE,kCAAkC;QAC3C,SAAS,EAAE,iDAAiD;QAC5D,OAAO,EAAE,qBAAqB;QAC9B,KAAK,EAAE,gIAAgI;QACvI,GAAG,EAAE,mBAAmB;QACxB,WAAW,EAAE,yCAAyC;QACtD,UAAU,EAAE,6EAA6E;KAC1F;IACD,UAAU,EAAE;QACV,OAAO,EAAE,uCAAuC;QAChD,SAAS,EAAE,sDAAsD;QACjE,OAAO,EAAE,oBAAoB;QAC7B,KAAK,EAAE,kHAAkH;QACzH,GAAG,EAAE,eAAe;QACpB,WAAW,EAAE,6CAA6C;QAC1D,UAAU,EAAE,sEAAsE;KACnF;IACD,aAAa,EAAE;QACb,OAAO,EAAE,wCAAwC;QACjD,SAAS,EAAE,sBAAsB;QACjC,OAAO,EAAE,qBAAqB;QAC9B,KAAK,EAAE,2FAA2F;QAClG,GAAG,EAAE,gBAAgB;QACrB,WAAW,EAAE,6CAA6C;QAC1D,UAAU,EAAE,8GAA8G;KAC3H;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,4BAA4B;QACrC,SAAS,EAAE,iCAAiC;QAC5C,OAAO,EAAE,gCAAgC;QACzC,KAAK,EAAE,4HAA4H;KACpI;IACD,eAAe,EAAE;QACf,OAAO,EAAE,0CAA0C;QACnD,SAAS,EAAE,iCAAiC;QAC5C,OAAO,EAAE,2BAA2B;QACpC,KAAK,EAAE,6EAA6E;QACpF,UAAU,EAAE,wGAAwG;KACrH;IACD,oBAAoB,EAAE;QACpB,OAAO,EAAE,mDAAmD;QAC5D,SAAS,EAAE,6CAA6C;QACxD,OAAO,EAAE,6BAA6B;QACtC,KAAK,EAAE,yFAAyF;QAChG,GAAG,EAAE,cAAc;KACpB;IACD,WAAW,EAAE;QACX,OAAO,EAAE,mDAAmD;QAC5D,SAAS,EAAE,iCAAiC;QAC5C,OAAO,EAAE,gCAAgC;QACzC,KAAK,EAAE,4HAA4H;QACnI,GAAG,EAAE,mBAAmB;QACxB,WAAW,EAAE,6CAA6C;QAC1D,UAAU,EAAE,wGAAwG;KACrH;IACD,MAAM,EAAE;QACN,aAAa,EAAE,+CAA+C;QAC9D,YAAY,EAAE,8EAA8E;KAC7F;CACF,CAAC"}

package/dist/mail/i18n/index.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Strings for one email type. `subject` / `preheader` / `heading` /
+ * `intro` are shared by all; the link-related fields are optional so
+ * pure notification mails (no CTA) can omit them.
+ */
+export interface MailMessageStrings {
+    /** Subject line. MAY contain `{{ appTitle }}` (rendered standalone). */
+    subject: string;
+    /** Hidden inbox-preview text. */
+    preheader: string;
+    /** Main heading. */
+    heading: string;
+    /** Lead paragraph. */
+    intro: string;
+    /** Call-to-action button label (omit for notification-only mails). */
+    cta?: string;
+    /** Note about the link's expiry. */
+    expiresNote?: string;
+    /** "If you didn't expect this, ignore it" note. */
+    ignoreNote?: string;
+}
+export interface MailCatalog {
+    invite: MailMessageStrings;
+    activation: MailMessageStrings;
+    passwordReset: MailMessageStrings;
+    /** Test mail from the admin mail settings page. */
+    test: MailMessageStrings;
+    /** Security notification: the account's password was changed. */
+    passwordChanged: MailMessageStrings;
+    /** Admin notification: a self-registered user is awaiting approval. */
+    adminApprovalPending: MailMessageStrings;
+    /** Confirm a requested email-address change (link sent to the new address). */
+    emailChange: MailMessageStrings;
+    common: {
+        /** Small line under the footer logo. */
+        footerTagline: string;
+        /** Fallback line: "If the button doesn't work, copy this URL". */
+        linkFallback: string;
+    };
+}
+/**
+ * Resolve a `MailCatalog` for a user language. Normalises regional
+ * variants (`en-US` / `en-GB` → `en`) and falls back to English for
+ * unknown / missing languages.
+ */
+export declare function getMailCatalog(lang?: string): MailCatalog;

package/dist/mail/i18n/index.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getMailCatalog = getMailCatalog;
+/**
+ * Lightweight i18n for transactional emails. The api has no general
+ * i18n runtime (the web uses paraglide), so mail strings live here as
+ * typed TS catalogs — one per language, structurally identical (the
+ * `MailCatalog` type guarantees no key drifts between en and ja).
+ *
+ * Catalog strings are brand-neutral and contain NO `{{ }}` placeholders
+ * (except `subject`, which the MailService renders standalone). Dynamic
+ * brand values (appTitle / appUrl / logoUrl / link URLs) come from
+ * `vars` and are placed by the MJML template structure, because a string
+ * injected via `{{ t.invite.intro }}` is not re-scanned for further
+ * placeholders.
+ */
+const en_1 = require("./en");
+const ja_1 = require("./ja");
+const CATALOGS = { en: en_1.en, ja: ja_1.ja };
+/**
+ * Resolve a `MailCatalog` for a user language. Normalises regional
+ * variants (`en-US` / `en-GB` → `en`) and falls back to English for
+ * unknown / missing languages.
+ */
+function getMailCatalog(lang) {
+    if (lang && lang.toLowerCase().startsWith('ja')) {
+        return CATALOGS.ja;
+    }
+    return CATALOGS.en;
+}
+//# sourceMappingURL=index.js.map

package/dist/mail/i18n/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mail/i18n/index.ts"],"names":[],"mappings":";;AAiEA,wCAKC;AAtED;;;;;;;;;;;;GAYG;AACH,6BAA0B;AAC1B,6BAA0B;AA4C1B,MAAM,QAAQ,GAAqC,EAAE,EAAE,EAAF,OAAE,EAAE,EAAE,EAAF,OAAE,EAAE,CAAC;AAE9D;;;;GAIG;AACH,SAAgB,cAAc,CAAC,IAAa;IAC1C,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC"}

package/dist/mail/i18n/ja.d.ts

@@ -0,0 +1,2 @@
+import type { MailCatalog } from './index';
+export declare const ja: MailCatalog;

package/dist/mail/i18n/ja.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ja = void 0;
+exports.ja = {
+    invite: {
+        subject: '{{ appTitle }} への招待',
+        preheader: '招待を受けてアカウントをセットアップしてください。',
+        heading: '招待が届いています',
+        intro: 'Wiki に招待されました。下のボタンからユーザー名とパスワードを設定して、アカウントを有効化してください。',
+        cta: '招待を受ける',
+        expiresNote: 'この招待リンクは 7 日間有効です。',
+        ignoreNote: 'この招待に心当たりがない場合は、このメールを無視してください。',
+    },
+    activation: {
+        subject: '{{ appTitle }} のメールアドレス確認',
+        preheader: 'メールアドレスを確認してアカウントを有効化してください。',
+        heading: 'メールアドレスの確認',
+        intro: 'ご登録ありがとうございます。下のボタンからメールアドレスを確認して、アカウントを有効化してください。',
+        cta: 'メールアドレスを確認',
+        expiresNote: 'この確認リンクは 24 時間有効です。',
+        ignoreNote: 'このアカウントに心当たりがない場合は、このメールを無視してください。',
+    },
+    passwordReset: {
+        subject: '{{ appTitle }} のパスワード再設定',
+        preheader: 'パスワードを再設定してください。',
+        heading: 'パスワードの再設定',
+        intro: 'パスワード再設定のリクエストを受け付けました。下のボタンから新しいパスワードを設定してください。',
+        cta: 'パスワードを再設定',
+        expiresNote: 'このパスワード再設定リンクは 1 時間有効です。',
+        ignoreNote: 'パスワード再設定をリクエストしていない場合は、このメールを無視してください。パスワードは変更されません。',
+    },
+    test: {
+        subject: '{{ appTitle }}: テストメール',
+        preheader: 'メール設定は正常に動作しています。',
+        heading: 'メール設定は正常に動作しています',
+        intro: 'これは管理画面のメール設定から送信されたテストメールです。これが届いていれば、メール送信は正しく設定されています。',
+    },
+    passwordChanged: {
+        subject: '{{ appTitle }} のパスワードが変更されました',
+        preheader: 'パスワードが変更されました。',
+        heading: 'パスワードが変更されました',
+        intro: 'あなたのアカウントのパスワードが変更されたことをお知らせします。',
+        ignoreNote: 'この変更に心当たりがない場合は、ただちにパスワードを再設定し、管理者に連絡してください。',
+    },
+    adminApprovalPending: {
+        subject: '{{ appTitle }} に承認待ちのユーザーがいます',
+        preheader: '自己登録したユーザーの承認が必要です。',
+        heading: '承認待ちのユーザーがいます',
+        intro: '新しいユーザーが登録し、管理者による承認を待っています:',
+        cta: 'ユーザーを確認',
+    },
+    emailChange: {
+        subject: '{{ appTitle }} の新しいメールアドレスの確認',
+        preheader: '新しいメールアドレスを確認してください。',
+        heading: '新しいメールアドレスの確認',
+        intro: 'あなたのアカウントのメールアドレスをこのアドレスに変更するリクエストがありました。下のボタンをクリックして変更を確定してください。',
+        cta: '新しいメールアドレスを確認',
+        expiresNote: 'この確認リンクは 24 時間有効です。',
+        ignoreNote: 'この変更に心当たりがない場合は、このメールを無視してください。メールアドレスは変更されません。',
+    },
+    common: {
+        footerTagline: 'Empower the team with sharing your knowledge.',
+        linkFallback: '上のボタンが動作しない場合は、次の URL をブラウザに貼り付けてください:',
+    },
+};
+//# sourceMappingURL=ja.js.map

package/dist/mail/i18n/ja.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ja.js","sourceRoot":"","sources":["../../../src/mail/i18n/ja.ts"],"names":[],"mappings":";;;AAEa,QAAA,EAAE,GAAgB;IAC7B,MAAM,EAAE;QACN,OAAO,EAAE,qBAAqB;QAC9B,SAAS,EAAE,2BAA2B;QACtC,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE,wDAAwD;QAC/D,GAAG,EAAE,QAAQ;QACb,WAAW,EAAE,oBAAoB;QACjC,UAAU,EAAE,iCAAiC;KAC9C;IACD,UAAU,EAAE;QACV,OAAO,EAAE,2BAA2B;QACpC,SAAS,EAAE,8BAA8B;QACzC,OAAO,EAAE,YAAY;QACrB,KAAK,EAAE,oDAAoD;QAC3D,GAAG,EAAE,YAAY;QACjB,WAAW,EAAE,qBAAqB;QAClC,UAAU,EAAE,oCAAoC;KACjD;IACD,aAAa,EAAE;QACb,OAAO,EAAE,0BAA0B;QACnC,SAAS,EAAE,kBAAkB;QAC7B,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE,kDAAkD;QACzD,GAAG,EAAE,WAAW;QAChB,WAAW,EAAE,0BAA0B;QACvC,UAAU,EAAE,sDAAsD;KACnE;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,wBAAwB;QACjC,SAAS,EAAE,mBAAmB;QAC9B,OAAO,EAAE,kBAAkB;QAC3B,KAAK,EAAE,2DAA2D;KACnE;IACD,eAAe,EAAE;QACf,OAAO,EAAE,+BAA+B;QACxC,SAAS,EAAE,gBAAgB;QAC3B,OAAO,EAAE,eAAe;QACxB,KAAK,EAAE,kCAAkC;QACzC,UAAU,EAAE,8CAA8C;KAC3D;IACD,oBAAoB,EAAE;QACpB,OAAO,EAAE,+BAA+B;QACxC,SAAS,EAAE,qBAAqB;QAChC,OAAO,EAAE,eAAe;QACxB,KAAK,EAAE,8BAA8B;QACrC,GAAG,EAAE,SAAS;KACf;IACD,WAAW,EAAE;QACX,OAAO,EAAE,+BAA+B;QACxC,SAAS,EAAE,sBAAsB;QACjC,OAAO,EAAE,eAAe;QACxB,KAAK,EAAE,mEAAmE;QAC1E,GAAG,EAAE,eAAe;QACpB,WAAW,EAAE,qBAAqB;QAClC,UAAU,EAAE,iDAAiD;KAC9D;IACD,MAAM,EAAE;QACN,aAAa,EAAE,+CAA+C;QAC9D,YAAY,EAAE,wCAAwC;KACvD;CACF,CAAC"}

package/dist/mcp/attach.d.ts

@@ -0,0 +1,25 @@
+/**
+ * RFC-0011 §7 — attach the built-in MCP server to the Hono app.
+ *
+ * `attachMcp(app, crowi)` registers `app.all('/mcp', …)` under
+ * `createJwtAuth(crowi)` so the request carries an authenticated user +
+ * `authScopes` (PAT or OAuth access token — no new auth code, RFC-0011
+ * §5.1). Per-tool scope is NOT enforced here: each tool dispatches to a
+ * scoped route that runs `requireScope` itself (RFC-0011 §5.2), so a
+ * read-only token calling a write tool gets the route's 403 mapped to an
+ * MCP `isError` result.
+ *
+ * Unlike `collab/attach.ts` / `notifications/attach.ts` (which attach a
+ * WS upgrade handler to the `http.Server`), `/mcp` is a normal Hono
+ * route, so this is called **inside `buildHonoApp`** (RFC-0011 §7).
+ *
+ * Transport: `@hono/mcp`'s `StreamableHTTPTransport`, **stateless /
+ * per-request** (`sessionIdGenerator: undefined`) — matches Crowi's
+ * per-request JWT model and needs no sticky sessions for multi-instance
+ * deployments (RFC-0011 §4). A fresh `McpServer` + transport per request
+ * binds that request's identity (the forwarded bearer).
+ */
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import type Crowi from '../crowi';
+import type { CrowiHonoBindings } from '../hono/app';
+export declare const attachMcp: (app: OpenAPIHono<CrowiHonoBindings>, crowi: Crowi) => void;