@crowi/plugin-api 1.0.0-alpha.6 → 1.0.0-alpha.8

package/README.md

@@ -109,6 +109,40 @@ const myPlugin: CrowiPlugin = {
 export default myPlugin;
 ```
 
+## Post-save connectivity verification (`verifyConfig`)
+
+A plugin whose config change needs a real connectivity/permission check (a storage bucket, a search cluster, …) can implement `verifyConfig`. The runtime calls it once after an admin save has already persisted and `reconfigure` has already run — never before, and never as a condition for the save itself:
+
+```ts
+import type { CrowiPlugin, PluginConfigVerificationSnapshot, PluginConfigVerificationOptions, PluginConfigVerificationResult } from '@crowi/plugin-api';
+
+const myPlugin: CrowiPlugin = {
+  // ...
+
+  verifyConfig: async (
+    snapshot: PluginConfigVerificationSnapshot,
+    options: PluginConfigVerificationOptions,
+  ): Promise<PluginConfigVerificationResult> => {
+    const config = snapshot.config<{ endpoint: string; accessKey: string }>();
+    try {
+      await probeMyBackend(config);
+      return { status: 'ok' };
+    } catch (err) {
+      return { status: 'failed', reason: classifyMyError(err) };
+    }
+  },
+};
+```
+
+A few things make this different from every other `register*` / `reconfigure` callback:
+
+- **Snapshot, not `PluginContext`.** `verifyConfig` receives a `PluginConfigVerificationSnapshot` — a read-only, point-in-time view of this plugin's own config (and any declared, `exposesConfigToDependents` dependency's config), frozen at the moment the triggering save was about to persist. It is NOT the live `PluginContext`: there is no `setConfig`, `model`, `state`, or `pageMetadata` on it, and calling `snapshot.config()` later never reflects a different admin request's save that lands while your hook is still running.
+- **Fans out to dependents.** If plugin B `requires` plugin A and B implements `verifyConfig`, saving A's config also re-verifies B (same affected-set walk `reconfigure` uses). B's hook only sees A's dependency config if A also set `exposesConfigToDependents: true`.
+- **Non-blocking, always.** A failing (or throwing, or never-resolving) `verifyConfig` never fails the save — the save already succeeded by the time this hook runs. `options.timeoutMs` (currently 10 seconds) is a NOTICE the caller stops waiting on your promise after, not a cancellation signal: there is no `AbortSignal` anywhere in this contract, and none is threaded down into any `StorageDriver` call your hook makes. Design your hook's own I/O with a bounded retry/attempt policy (e.g. a single attempt, no retries) so it settles well within that budget on its own.
+- **Result is a closed, safe union.** Return `{ status: 'ok' }` or `{ status: 'failed', reason }`, where `reason` is one of `'unreachable' | 'auth-failed' | 'resource-missing' | 'write-denied' | 'unknown'`. Never put raw SDK error text, a stack trace, an endpoint, or credential material anywhere in the result (or in anything you log) — the runtime reports this straight to the admin API response. Anything your hook returns outside this shape is normalized to `{ status: 'failed', reason: 'unknown' }` by the caller, so prefer an honest `'unknown'` yourself over guessing a more specific reason you can't actually confirm.
+- **Optional.** A plugin with no `verifyConfig` is completely unaffected — no extra work at boot or save time, no entry in the response's `verificationResults`.
+- **Instance-local, not cluster-wide.** The runtime calls `verifyConfig` on whichever api process handled the save request and reports only that process's outcome. It never coordinates with other replicas, so a result reflects reachability/permissions from that one instance at that moment — not the deployment as a whole. If your hook's I/O (network reachability, IAM/role assumption, DNS) can differ between replicas, document that for operators; don't imply a passing result means every replica can reach the backend.
+
 ## See also
 
 - [Plugin development guide](https://crowi.wiki/docs/plugins/developing) —

package/dist/index.d.mts

@@ -1,5 +1,6 @@
 import { z } from 'zod/v3';
 import { Readable } from 'node:stream';
+import { Configuration } from 'openid-client';
 import { Context } from 'hono';
 
 /**
@@ -206,6 +207,101 @@ interface PluginLogger {
     error(message: string, ...args: unknown[]): void;
 }
 
+/**
+ * Contract for `CrowiPlugin.verifyConfig` — a non-blocking, post-save
+ * connectivity/permission probe (feature-plugin-config-live-verification).
+ * Deliberately its own module, separate from `context.ts`'s live
+ * `PluginContext`: a verification hook runs AFTER the admin save has
+ * already persisted (and after `reconfigure` has already rebuilt the live
+ * driver), against the EXACT values that request saved — not whatever the
+ * config cache holds by the time the hook actually runs. Handing a hook
+ * `PluginContext` would let it call `ctx.setConfig()` / read a
+ * concurrently-updated cache / touch models, none of which a read-only,
+ * best-effort probe should be able to do.
+ */
+/**
+ * Recursively read-only view of `T`. Used for both `config()` and
+ * `dependencyConfig()` on {@link PluginConfigVerificationSnapshot} — a
+ * verification hook must not be able to mutate the plan's materialized
+ * values (they are shared across the plan and, for a dependency, may be
+ * read by more than one hook).
+ */
+type ReadonlyDeep<T> = T extends readonly (infer U)[] ? readonly ReadonlyDeep<U>[] : T extends object ? {
+    readonly [K in keyof T]: ReadonlyDeep<T[K]>;
+} : T;
+/**
+ * Immutable facade a `verifyConfig` hook reads its plugin's (and its
+ * declared dependencies') config through. NOT `PluginContext`: this
+ * snapshot is materialized once, before the save that triggered
+ * verification, and never changes for the lifetime of the hook call — a
+ * concurrent save of another plugin's config (or of this plugin's config,
+ * from a second in-flight admin request) cannot change what an
+ * already-running hook sees. See `PluginManager.createVerificationPlan()`.
+ */
+interface PluginConfigVerificationSnapshot {
+    /**
+     * This plugin's own config, as it was — or will be, for the plugin whose
+     * save triggered this verification — immediately after the save. Throws
+     * if the plugin does not declare a `configSchema` (mirrors
+     * `PluginContext.config()`).
+     */
+    config<T>(): ReadonlyDeep<T>;
+    /**
+     * A declared dependency's config. Same capability check as
+     * `PluginContext.dependencyConfig()`: `dependencyName` must be listed in
+     * this plugin's `requires`, AND the dependency must declare
+     * `exposesConfigToDependents: true`. Throws otherwise.
+     */
+    dependencyConfig<T>(dependencyName: string): ReadonlyDeep<T>;
+}
+/**
+ * Passed alongside the snapshot to every `verifyConfig` call.
+ *
+ * `timeoutMs` is a NOTICE, not a cancellation mechanism: the caller
+ * (`PluginManager`) stops waiting on the hook's returned promise after
+ * this many milliseconds and normalizes the result to
+ * `{ status: 'failed', reason: 'unreachable' }`, but it never aborts the
+ * hook itself — there is no `AbortSignal` here, and none is passed down to
+ * any `StorageDriver` call a storage hook makes (the driver's public `put`
+ * / `get` / `delete` contract takes no such option; see
+ * `@crowi/plugin-api`'s `registries/storage.ts`). A hook whose underlying
+ * I/O is still in flight when the caller gives up keeps running in the
+ * background; hooks that touch external resources they created (e.g. a
+ * storage probe object) should not rely on ever being told to stop, and
+ * should clean up opportunistically rather than assume they'll get to run
+ * to completion before anyone stops watching.
+ */
+interface PluginConfigVerificationOptions {
+    timeoutMs: number;
+}
+/** The closed set of reasons a verification probe can fail for. Anything a driver can't confidently place in one of these falls into `'unknown'` — a wrong specific reason would mislead an operator more than an honest "couldn't tell". */
+type VerificationFailureReason = 'unreachable' | 'auth-failed' | 'resource-missing' | 'write-denied' | 'unknown';
+/**
+ * What a `verifyConfig` hook resolves to. Deliberately a closed,
+ * allow-listed shape — the caller projects whatever a hook returns onto
+ * this union (an invalid shape normalizes to `{ status: 'failed', reason:
+ * 'unknown' }`), so a hook can never smuggle raw SDK error text, a stack
+ * trace, an endpoint, or credential material into the admin response or
+ * logs by returning it as an extra field.
+ */
+type PluginConfigVerificationResult = {
+    status: 'ok';
+} | {
+    status: 'failed';
+    reason: VerificationFailureReason;
+};
+/**
+ * Key namespace every storage `verifyConfig` probe writes its round-trip
+ * object under — deliberately disjoint from `attachment/*` (core's
+ * uploaded-file namespace) so a probe object can never collide with,
+ * shadow, or get mistaken for a real attachment. A storage hook builds its
+ * probe key as `` `${CONFIG_VERIFICATION_KEY_PREFIX}<random>` ``; because
+ * cleanup after a probe is best-effort (see the `timeoutMs` note on
+ * {@link PluginConfigVerificationOptions}), an operator who finds a
+ * leftover object can safely delete anything under this prefix.
+ */
+declare const CONFIG_VERIFICATION_KEY_PREFIX = "__crowi_config_verification__/";
+
 /**
  * Domain events emitted by core. The full event payload shapes live in
  * `@crowi/server`; this contract publishes only the event names so the
@@ -463,8 +559,8 @@ interface AuthProfile {
     extra?: Record<string, unknown>;
 }
 /**
- * Result of `verify` — either a normalised profile (success) or an
- * error reason the login UI surfaces.
+ * Result of `verify` / `fetchProfile` — either a normalised profile
+ * (success) or an error reason the login UI surfaces.
  */
 type AuthVerifyResult = {
     ok: true;
@@ -473,38 +569,166 @@ type AuthVerifyResult = {
     ok: false;
     reason: string;
 };
+/** One field to render on a `credential` driver's sign-in form. */
+interface CredentialField {
+    /** Form field name, e.g. `'username'` / `'password'`. */
+    name: string;
+    /** Human-readable label rendered next to the field. */
+    label: string;
+    /** Input type. Defaults to `'text'` when omitted. */
+    type?: 'text' | 'email' | 'password';
+    required?: boolean;
+}
 /**
- * Auth provider driver. The login screen asks core for the list of
- * registered drivers and renders one button per driver
- * (`Sign in with Google`). Clicking redirects through the plugin's
- * registered routes (`/api/plugins/<name>/oauth/start`); the
- * provider redirects back to `/api/plugins/<name>/oauth/callback`,
- * which the plugin's contract handles.
- *
- * `verify` is the bridge: given whatever the plugin pulled out of the
- * callback (token / code / SAML response), produce a normalised
- * `AuthProfile` or a failure reason.
+ * Direct-credential auth: the user submits credentials to Crowi itself
+ * (LDAP, local password). No redirect, no external IdP round-trip.
  */
-interface AuthDriver {
-    /**
-     * Human-readable label for the login button (e.g. `'Google'`).
-     * Localisation is the plugin's responsibility — i18n keys can be
-     * resolved by the plugin before registration.
-     */
+interface CredentialAuthDriver {
+    kind: 'credential';
+    /** Usually omitted — credential drivers render as the sign-in form. */
+    buttonLabel?: string;
+    /** Fields to render on the sign-in form (e.g. [username, password]). */
+    fields: CredentialField[];
+    verify(credentials: Record<string, string>): Promise<AuthVerifyResult>;
+}
+/**
+ * OAuth 2.0 / OIDC client credentials, read lazily at request time (see
+ * `getClientConfig()` below) rather than captured at registration.
+ */
+interface OAuthClientConfig {
+    clientId: string;
+    clientSecret: string;
+}
+/** Token response from an OAuth 2.0 / OIDC token endpoint. */
+interface OAuthTokens {
+    accessToken: string;
+    tokenType?: string;
+    expiresIn?: number;
+    refreshToken?: string;
+    scope?: string;
+    /** Present for an OIDC token response — the raw, still-unverified id_token JWT. */
+    idToken?: string;
+}
+/**
+ * Redirect/federated auth: the browser bounces to an external IdP using
+ * the plain OAuth 2.0 authorization-code flow (no id_token).
+ */
+interface OAuth2AuthDriver {
+    kind: 'oauth2';
     buttonLabel: string;
-    /** Optional icon URL for the login button. */
     iconUrl?: string;
-    /**
-     * Map provider-specific verification data into a normalised profile.
-     * Called from inside the plugin's own callback route, with whatever
-     * shape that route extracted. Typed as `unknown` here because the
-     * shape is plugin-private.
-     */
-    verify(verificationData: unknown): Promise<AuthVerifyResult>;
+    authorizeUrl: string;
+    tokenUrl: string;
+    scopes: string[];
+    /** Declare when the IdP supports PKCE (S256). */
+    pkce?: boolean;
+    /**
+     * Lazy accessor, evaluated per request — NOT captured at registration.
+     * Returns null while the plugin is unconfigured; core then hides the
+     * provider from the provider list (enablement) and rejects `/start`.
+     * Lazy evaluation is also what makes admin config changes take effect
+     * without re-registering the driver.
+     */
+    getClientConfig(): OAuthClientConfig | null;
+    /**
+     * Exchange completed; fetch the provider profile and map it. Returns
+     * `AuthVerifyResult` so the driver can REJECT after a successful
+     * exchange (e.g. an org-membership gate) — a successful exchange does
+     * not by itself guarantee a successful sign-in.
+     */
+    fetchProfile(tokens: OAuthTokens): Promise<AuthVerifyResult>;
 }
+/** OIDC = OAuth 2.0 + standardised discovery + id_token claims. */
+interface OidcAuthDriver {
+    kind: 'oidc';
+    buttonLabel: string;
+    iconUrl?: string;
+    /** `…/.well-known/openid-configuration` */
+    discoveryUrl: string;
+    /** Default `['openid', 'email', 'profile']`. */
+    scopes: string[];
+    /** OIDC always uses PKCE. */
+    pkce: true;
+    /** Same lazy contract as `OAuth2AuthDriver.getClientConfig()`. */
+    getClientConfig(): OAuthClientConfig | null;
+    /**
+     * Resolve (and cache) the `openid-client` `Configuration` for this
+     * driver's current credentials. Returns `null` without performing any
+     * network I/O while `getClientConfig()` is unconfigured. See the
+     * discovery-cache doc comment below for the caching contract.
+     */
+    getConfiguration(): Promise<Configuration | null>;
+    /**
+     * Optional policy gate, called after core validates the id_token and
+     * before `mapClaims` — the OIDC analogue of `fetchProfile`'s
+     * rejection (e.g. a Google Workspace `hd` domain restriction).
+     */
+    authorize?(claims: Record<string, unknown>): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** Optional claim → AuthProfile override; default maps sub/email/name. */
+    mapClaims?(claims: Record<string, unknown>): Partial<AuthProfile>;
+}
+/**
+ * `'saml'` is reserved (RFC-0014 §9) for a future `SamlAuthDriver` — it is
+ * a valid `AuthDriverKind` so downstream code can already discriminate on
+ * it, but no `SamlAuthDriver` interface exists yet and `AuthDriver` below
+ * does not include it as a member. SAML's required attributes and
+ * callback shape are still undecided; adding a member type ahead of that
+ * design would let a plugin construct a value with no real runtime.
+ */
+type AuthDriverKind = 'credential' | 'oauth2' | 'oidc' | 'saml';
+/**
+ * Auth provider driver. The login screen asks core for the list of
+ * registered drivers and renders one button per `oauth2`/`oidc` driver
+ * (`Sign in with Google`) or one sign-in form per `credential` driver.
+ * See RFC-0014 §3 for the full design rationale.
+ */
+type AuthDriver = CredentialAuthDriver | OAuth2AuthDriver | OidcAuthDriver;
 interface AuthRegistry {
     register(driverName: string, driver: AuthDriver): void;
 }
+interface CreateOAuth2DriverOptions {
+    buttonLabel: string;
+    iconUrl?: string;
+    authorizeUrl: string;
+    tokenUrl: string;
+    /** Defaults to `[]` when omitted. */
+    scopes?: string[];
+    pkce?: boolean;
+    getClientConfig(): OAuthClientConfig | null;
+    fetchProfile(tokens: OAuthTokens): Promise<AuthVerifyResult>;
+}
+/**
+ * Build a plain OAuth 2.0 authorization-code driver. Synchronous, I/O-free
+ * — see the module doc comment above.
+ */
+declare function createOAuth2Driver(options: CreateOAuth2DriverOptions): OAuth2AuthDriver;
+interface CreateOidcDriverOptions {
+    buttonLabel: string;
+    iconUrl?: string;
+    discoveryUrl: string;
+    /** Defaults to `['openid', 'email', 'profile']` when omitted. */
+    scopes?: string[];
+    getClientConfig(): OAuthClientConfig | null;
+    authorize?(claims: Record<string, unknown>): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    mapClaims?(claims: Record<string, unknown>): Partial<AuthProfile>;
+}
+/**
+ * Build an OIDC driver. Synchronous, I/O-free at call time — see the
+ * module doc comment above. `getConfiguration()` on the returned driver
+ * is the only entry point that performs discovery, and only on first use
+ * (see `resolveOidcConfiguration` below).
+ */
+declare function createOidcDriver(options: CreateOidcDriverOptions): OidcAuthDriver;
 
 /**
  * Notification payload — the runtime-neutral shape passed to every
@@ -1349,6 +1573,26 @@ interface PluginReadinessDeclaration {
     /** `configSchema` field names that must be non-empty for `driver` to actually work once selected. */
     requiredConfigFields: string[];
 }
+/**
+ * One all-or-nothing group of `configSchema` fields — see
+ * `CrowiPlugin.configAtomicGroups`.
+ */
+interface PluginConfigAtomicGroup {
+    /**
+     * Stable identifier, part of the physical storage key
+     * (`plugin:<plugin>:__atomic:<name>`). Renaming it orphans the stored
+     * document, so treat it like a migration.
+     */
+    name: string;
+    /** The `configSchema` field names stored together. Non-empty, no duplicates, and each field may belong to only one group. */
+    keys: readonly string[];
+    /**
+     * Encrypt the whole stored group at rest. Set this when ANY member is
+     * secret: the group is one value, so it is either all encrypted or all
+     * not — there is no per-field choice left once they share a document.
+     */
+    sensitive?: boolean;
+}
 /**
  * The contract every Crowi plugin satisfies. Plugins export their
  * `CrowiPlugin` object as the package's default export; the runtime
@@ -1438,6 +1682,24 @@ interface CrowiPlugin {
      * the field that calls the plugin's contributed REST endpoint.
      */
     configSchema?: z.ZodObject<Record<string, z.ZodTypeAny>>;
+    /**
+     * RFC-0014 phase 4 — `configSchema` fields that must never be visible
+     * to anyone in a half-written state, declared as groups that are stored
+     * as ONE Config document instead of one row per field.
+     *
+     * The motivating case is an OAuth client id + secret. Written as
+     * separate rows, a failure between them leaves the instance advertising
+     * a new client id paired with the previous secret — a configuration
+     * that never existed and cannot authenticate, visible to every replica
+     * until an operator notices. As a single document there is no
+     * in-between: readers see the whole previous pair or the whole new one.
+     *
+     * This is a STORAGE contract, not a general escape hatch for making
+     * arbitrary keys atomic — the fields still appear to the plugin (and to
+     * the admin form) as ordinary flat config, and are only reassembled at
+     * the persistence boundary.
+     */
+    configAtomicGroups?: readonly PluginConfigAtomicGroup[];
     /**
      * Per-Page metadata schema. When set, every Page document has a
      * `metadata['<plugin-name>']` slot whose shape matches this schema,
@@ -1572,6 +1834,39 @@ interface CrowiPlugin {
      * of the very UI they need to fix the misconfiguration.
      */
     reconfigure?: (ctx: PluginContext) => void | Promise<void>;
+    /**
+     * Non-blocking connectivity/permission probe run once, after a save that
+     * touched this plugin's own config OR a dependency's config (any plugin
+     * that has this one in `requires`) has already persisted AND already
+     * run `reconfigure` — feature-plugin-config-live-verification. Never
+     * gates the save: whatever this returns is reported alongside a save
+     * that already succeeded, never rolled back.
+     *
+     * Receives a {@link PluginConfigVerificationSnapshot}, NOT the live
+     * `PluginContext` — do not close over or otherwise reach for `ctx` from
+     * inside this hook. The snapshot is a read-only, point-in-time view
+     * materialized from the exact values the triggering save just wrote (own
+     * config) plus any declared, `exposesConfigToDependents`-opted-in
+     * dependency config — it never reflects a LATER save by a different
+     * admin request, even one that lands while this hook is still running.
+     * `snapshot.config()` / `snapshot.dependencyConfig()` can throw if the
+     * runtime couldn't materialize a value (e.g. an existing, currently
+     * invalid dependency config); the runtime skips calling this hook
+     * entirely in that case rather than invoking it with a broken snapshot.
+     *
+     * `options.timeoutMs` is a notice, not a cancellation signal — see its
+     * doc. Must resolve within that budget or the caller treats it as
+     * `{ status: 'failed', reason: 'unreachable' }`; a promise that keeps
+     * running past that point should still clean up after itself when it
+     * eventually settles, but must never throw out of that cleanup in a way
+     * that becomes an unhandled rejection.
+     *
+     * The returned result (and anything it internally logs) must never
+     * include raw SDK/driver error text, stack traces, endpoints, or
+     * credential material — only the closed `reason` enum. See
+     * `PluginConfigVerificationResult`.
+     */
+    verifyConfig?: (snapshot: PluginConfigVerificationSnapshot, options: PluginConfigVerificationOptions) => Promise<PluginConfigVerificationResult>;
 }
 
 /**
@@ -1763,4 +2058,4 @@ type SanitizeSvgResult = {
  */
 declare function sanitizeSvg(input: string, policy: SanitizeSvgPolicy): SanitizeSvgResult;
 
-export { ACTION_FIELD_MARKER, type AdmissionControlConfig, type AppInfo, type AuthContext, type AuthDriver, type AuthProfile, type AuthRegistry, type AuthVerifyResult, type CacheEntry, type CacheKey, type CacheStorage, type CodeBlockInfo, type CodeBlockRenderer, type CrowiPlugin, type EmailMessage, type EmbedFragment, type EmbedInput, type EmbedRenderer, type EventBus, type InlineExpansion, type MailSender, type MailSenderRegistry, type NodeRenderer, type NotificationPayload, type NotifierDriver, type NotifierRegistry, type PageMetadataAccessor, type PluginContext, type PluginEvents, type PluginLogger, type PluginReadinessDeclaration, type PluginRouteHandler, type PluginRouteMethod, type PluginRouteOptions, type PluginRouterScope, type RenderActor, type RenderContext, type RenderError, type RenderPhase, type RenderResult, type RendererRegistry, type Reservation, SENSITIVE_FIELD_MARKER, type SanitizeSvgPolicy, type SanitizeSvgResult, type ScopedCacheStorage, type SearchDriver, type SearchHit, type SearchHits, type SearchPageType, type SearchQuery, type SearchQueryGrants, type SearchQueryViewer, type SearchRegistry, type SearchableDoc, type StateCell, type StorageDriver, type StoragePutMeta, type StoragePutResult, type StorageRegistry, type StructuredRenderPayload, type UrlInlineExpansionRule, escapeHtml, extractSvgDimensions, getActionAnnotation, isSensitiveField, sanitizeSvg };
+export { ACTION_FIELD_MARKER, type AdmissionControlConfig, type AppInfo, type AuthContext, type AuthDriver, type AuthDriverKind, type AuthProfile, type AuthRegistry, type AuthVerifyResult, CONFIG_VERIFICATION_KEY_PREFIX, type CacheEntry, type CacheKey, type CacheStorage, type CodeBlockInfo, type CodeBlockRenderer, type CreateOAuth2DriverOptions, type CreateOidcDriverOptions, type CredentialAuthDriver, type CredentialField, type CrowiPlugin, type EmailMessage, type EmbedFragment, type EmbedInput, type EmbedRenderer, type EventBus, type InlineExpansion, type MailSender, type MailSenderRegistry, type NodeRenderer, type NotificationPayload, type NotifierDriver, type NotifierRegistry, type OAuth2AuthDriver, type OAuthClientConfig, type OAuthTokens, type OidcAuthDriver, type PageMetadataAccessor, type PluginConfigAtomicGroup, type PluginConfigVerificationOptions, type PluginConfigVerificationResult, type PluginConfigVerificationSnapshot, type PluginContext, type PluginEvents, type PluginLogger, type PluginReadinessDeclaration, type PluginRouteHandler, type PluginRouteMethod, type PluginRouteOptions, type PluginRouterScope, type ReadonlyDeep, type RenderActor, type RenderContext, type RenderError, type RenderPhase, type RenderResult, type RendererRegistry, type Reservation, SENSITIVE_FIELD_MARKER, type SanitizeSvgPolicy, type SanitizeSvgResult, type ScopedCacheStorage, type SearchDriver, type SearchHit, type SearchHits, type SearchPageType, type SearchQuery, type SearchQueryGrants, type SearchQueryViewer, type SearchRegistry, type SearchableDoc, type StateCell, type StorageDriver, type StoragePutMeta, type StoragePutResult, type StorageRegistry, type StructuredRenderPayload, type UrlInlineExpansionRule, type VerificationFailureReason, createOAuth2Driver, createOidcDriver, escapeHtml, extractSvgDimensions, getActionAnnotation, isSensitiveField, sanitizeSvg };

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod/v3';
 import { Readable } from 'node:stream';
+import { Configuration } from 'openid-client';
 import { Context } from 'hono';
 
 /**
@@ -206,6 +207,101 @@ interface PluginLogger {
     error(message: string, ...args: unknown[]): void;
 }
 
+/**
+ * Contract for `CrowiPlugin.verifyConfig` — a non-blocking, post-save
+ * connectivity/permission probe (feature-plugin-config-live-verification).
+ * Deliberately its own module, separate from `context.ts`'s live
+ * `PluginContext`: a verification hook runs AFTER the admin save has
+ * already persisted (and after `reconfigure` has already rebuilt the live
+ * driver), against the EXACT values that request saved — not whatever the
+ * config cache holds by the time the hook actually runs. Handing a hook
+ * `PluginContext` would let it call `ctx.setConfig()` / read a
+ * concurrently-updated cache / touch models, none of which a read-only,
+ * best-effort probe should be able to do.
+ */
+/**
+ * Recursively read-only view of `T`. Used for both `config()` and
+ * `dependencyConfig()` on {@link PluginConfigVerificationSnapshot} — a
+ * verification hook must not be able to mutate the plan's materialized
+ * values (they are shared across the plan and, for a dependency, may be
+ * read by more than one hook).
+ */
+type ReadonlyDeep<T> = T extends readonly (infer U)[] ? readonly ReadonlyDeep<U>[] : T extends object ? {
+    readonly [K in keyof T]: ReadonlyDeep<T[K]>;
+} : T;
+/**
+ * Immutable facade a `verifyConfig` hook reads its plugin's (and its
+ * declared dependencies') config through. NOT `PluginContext`: this
+ * snapshot is materialized once, before the save that triggered
+ * verification, and never changes for the lifetime of the hook call — a
+ * concurrent save of another plugin's config (or of this plugin's config,
+ * from a second in-flight admin request) cannot change what an
+ * already-running hook sees. See `PluginManager.createVerificationPlan()`.
+ */
+interface PluginConfigVerificationSnapshot {
+    /**
+     * This plugin's own config, as it was — or will be, for the plugin whose
+     * save triggered this verification — immediately after the save. Throws
+     * if the plugin does not declare a `configSchema` (mirrors
+     * `PluginContext.config()`).
+     */
+    config<T>(): ReadonlyDeep<T>;
+    /**
+     * A declared dependency's config. Same capability check as
+     * `PluginContext.dependencyConfig()`: `dependencyName` must be listed in
+     * this plugin's `requires`, AND the dependency must declare
+     * `exposesConfigToDependents: true`. Throws otherwise.
+     */
+    dependencyConfig<T>(dependencyName: string): ReadonlyDeep<T>;
+}
+/**
+ * Passed alongside the snapshot to every `verifyConfig` call.
+ *
+ * `timeoutMs` is a NOTICE, not a cancellation mechanism: the caller
+ * (`PluginManager`) stops waiting on the hook's returned promise after
+ * this many milliseconds and normalizes the result to
+ * `{ status: 'failed', reason: 'unreachable' }`, but it never aborts the
+ * hook itself — there is no `AbortSignal` here, and none is passed down to
+ * any `StorageDriver` call a storage hook makes (the driver's public `put`
+ * / `get` / `delete` contract takes no such option; see
+ * `@crowi/plugin-api`'s `registries/storage.ts`). A hook whose underlying
+ * I/O is still in flight when the caller gives up keeps running in the
+ * background; hooks that touch external resources they created (e.g. a
+ * storage probe object) should not rely on ever being told to stop, and
+ * should clean up opportunistically rather than assume they'll get to run
+ * to completion before anyone stops watching.
+ */
+interface PluginConfigVerificationOptions {
+    timeoutMs: number;
+}
+/** The closed set of reasons a verification probe can fail for. Anything a driver can't confidently place in one of these falls into `'unknown'` — a wrong specific reason would mislead an operator more than an honest "couldn't tell". */
+type VerificationFailureReason = 'unreachable' | 'auth-failed' | 'resource-missing' | 'write-denied' | 'unknown';
+/**
+ * What a `verifyConfig` hook resolves to. Deliberately a closed,
+ * allow-listed shape — the caller projects whatever a hook returns onto
+ * this union (an invalid shape normalizes to `{ status: 'failed', reason:
+ * 'unknown' }`), so a hook can never smuggle raw SDK error text, a stack
+ * trace, an endpoint, or credential material into the admin response or
+ * logs by returning it as an extra field.
+ */
+type PluginConfigVerificationResult = {
+    status: 'ok';
+} | {
+    status: 'failed';
+    reason: VerificationFailureReason;
+};
+/**
+ * Key namespace every storage `verifyConfig` probe writes its round-trip
+ * object under — deliberately disjoint from `attachment/*` (core's
+ * uploaded-file namespace) so a probe object can never collide with,
+ * shadow, or get mistaken for a real attachment. A storage hook builds its
+ * probe key as `` `${CONFIG_VERIFICATION_KEY_PREFIX}<random>` ``; because
+ * cleanup after a probe is best-effort (see the `timeoutMs` note on
+ * {@link PluginConfigVerificationOptions}), an operator who finds a
+ * leftover object can safely delete anything under this prefix.
+ */
+declare const CONFIG_VERIFICATION_KEY_PREFIX = "__crowi_config_verification__/";
+
 /**
  * Domain events emitted by core. The full event payload shapes live in
  * `@crowi/server`; this contract publishes only the event names so the
@@ -463,8 +559,8 @@ interface AuthProfile {
     extra?: Record<string, unknown>;
 }
 /**
- * Result of `verify` — either a normalised profile (success) or an
- * error reason the login UI surfaces.
+ * Result of `verify` / `fetchProfile` — either a normalised profile
+ * (success) or an error reason the login UI surfaces.
  */
 type AuthVerifyResult = {
     ok: true;
@@ -473,38 +569,166 @@ type AuthVerifyResult = {
     ok: false;
     reason: string;
 };
+/** One field to render on a `credential` driver's sign-in form. */
+interface CredentialField {
+    /** Form field name, e.g. `'username'` / `'password'`. */
+    name: string;
+    /** Human-readable label rendered next to the field. */
+    label: string;
+    /** Input type. Defaults to `'text'` when omitted. */
+    type?: 'text' | 'email' | 'password';
+    required?: boolean;
+}
 /**
- * Auth provider driver. The login screen asks core for the list of
- * registered drivers and renders one button per driver
- * (`Sign in with Google`). Clicking redirects through the plugin's
- * registered routes (`/api/plugins/<name>/oauth/start`); the
- * provider redirects back to `/api/plugins/<name>/oauth/callback`,
- * which the plugin's contract handles.
- *
- * `verify` is the bridge: given whatever the plugin pulled out of the
- * callback (token / code / SAML response), produce a normalised
- * `AuthProfile` or a failure reason.
+ * Direct-credential auth: the user submits credentials to Crowi itself
+ * (LDAP, local password). No redirect, no external IdP round-trip.
  */
-interface AuthDriver {
-    /**
-     * Human-readable label for the login button (e.g. `'Google'`).
-     * Localisation is the plugin's responsibility — i18n keys can be
-     * resolved by the plugin before registration.
-     */
+interface CredentialAuthDriver {
+    kind: 'credential';
+    /** Usually omitted — credential drivers render as the sign-in form. */
+    buttonLabel?: string;
+    /** Fields to render on the sign-in form (e.g. [username, password]). */
+    fields: CredentialField[];
+    verify(credentials: Record<string, string>): Promise<AuthVerifyResult>;
+}
+/**
+ * OAuth 2.0 / OIDC client credentials, read lazily at request time (see
+ * `getClientConfig()` below) rather than captured at registration.
+ */
+interface OAuthClientConfig {
+    clientId: string;
+    clientSecret: string;
+}
+/** Token response from an OAuth 2.0 / OIDC token endpoint. */
+interface OAuthTokens {
+    accessToken: string;
+    tokenType?: string;
+    expiresIn?: number;
+    refreshToken?: string;
+    scope?: string;
+    /** Present for an OIDC token response — the raw, still-unverified id_token JWT. */
+    idToken?: string;
+}
+/**
+ * Redirect/federated auth: the browser bounces to an external IdP using
+ * the plain OAuth 2.0 authorization-code flow (no id_token).
+ */
+interface OAuth2AuthDriver {
+    kind: 'oauth2';
     buttonLabel: string;
-    /** Optional icon URL for the login button. */
     iconUrl?: string;
-    /**
-     * Map provider-specific verification data into a normalised profile.
-     * Called from inside the plugin's own callback route, with whatever
-     * shape that route extracted. Typed as `unknown` here because the
-     * shape is plugin-private.
-     */
-    verify(verificationData: unknown): Promise<AuthVerifyResult>;
+    authorizeUrl: string;
+    tokenUrl: string;
+    scopes: string[];
+    /** Declare when the IdP supports PKCE (S256). */
+    pkce?: boolean;
+    /**
+     * Lazy accessor, evaluated per request — NOT captured at registration.
+     * Returns null while the plugin is unconfigured; core then hides the
+     * provider from the provider list (enablement) and rejects `/start`.
+     * Lazy evaluation is also what makes admin config changes take effect
+     * without re-registering the driver.
+     */
+    getClientConfig(): OAuthClientConfig | null;
+    /**
+     * Exchange completed; fetch the provider profile and map it. Returns
+     * `AuthVerifyResult` so the driver can REJECT after a successful
+     * exchange (e.g. an org-membership gate) — a successful exchange does
+     * not by itself guarantee a successful sign-in.
+     */
+    fetchProfile(tokens: OAuthTokens): Promise<AuthVerifyResult>;
 }
+/** OIDC = OAuth 2.0 + standardised discovery + id_token claims. */
+interface OidcAuthDriver {
+    kind: 'oidc';
+    buttonLabel: string;
+    iconUrl?: string;
+    /** `…/.well-known/openid-configuration` */
+    discoveryUrl: string;
+    /** Default `['openid', 'email', 'profile']`. */
+    scopes: string[];
+    /** OIDC always uses PKCE. */
+    pkce: true;
+    /** Same lazy contract as `OAuth2AuthDriver.getClientConfig()`. */
+    getClientConfig(): OAuthClientConfig | null;
+    /**
+     * Resolve (and cache) the `openid-client` `Configuration` for this
+     * driver's current credentials. Returns `null` without performing any
+     * network I/O while `getClientConfig()` is unconfigured. See the
+     * discovery-cache doc comment below for the caching contract.
+     */
+    getConfiguration(): Promise<Configuration | null>;
+    /**
+     * Optional policy gate, called after core validates the id_token and
+     * before `mapClaims` — the OIDC analogue of `fetchProfile`'s
+     * rejection (e.g. a Google Workspace `hd` domain restriction).
+     */
+    authorize?(claims: Record<string, unknown>): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** Optional claim → AuthProfile override; default maps sub/email/name. */
+    mapClaims?(claims: Record<string, unknown>): Partial<AuthProfile>;
+}
+/**
+ * `'saml'` is reserved (RFC-0014 §9) for a future `SamlAuthDriver` — it is
+ * a valid `AuthDriverKind` so downstream code can already discriminate on
+ * it, but no `SamlAuthDriver` interface exists yet and `AuthDriver` below
+ * does not include it as a member. SAML's required attributes and
+ * callback shape are still undecided; adding a member type ahead of that
+ * design would let a plugin construct a value with no real runtime.
+ */
+type AuthDriverKind = 'credential' | 'oauth2' | 'oidc' | 'saml';
+/**
+ * Auth provider driver. The login screen asks core for the list of
+ * registered drivers and renders one button per `oauth2`/`oidc` driver
+ * (`Sign in with Google`) or one sign-in form per `credential` driver.
+ * See RFC-0014 §3 for the full design rationale.
+ */
+type AuthDriver = CredentialAuthDriver | OAuth2AuthDriver | OidcAuthDriver;
 interface AuthRegistry {
     register(driverName: string, driver: AuthDriver): void;
 }
+interface CreateOAuth2DriverOptions {
+    buttonLabel: string;
+    iconUrl?: string;
+    authorizeUrl: string;
+    tokenUrl: string;
+    /** Defaults to `[]` when omitted. */
+    scopes?: string[];
+    pkce?: boolean;
+    getClientConfig(): OAuthClientConfig | null;
+    fetchProfile(tokens: OAuthTokens): Promise<AuthVerifyResult>;
+}
+/**
+ * Build a plain OAuth 2.0 authorization-code driver. Synchronous, I/O-free
+ * — see the module doc comment above.
+ */
+declare function createOAuth2Driver(options: CreateOAuth2DriverOptions): OAuth2AuthDriver;
+interface CreateOidcDriverOptions {
+    buttonLabel: string;
+    iconUrl?: string;
+    discoveryUrl: string;
+    /** Defaults to `['openid', 'email', 'profile']` when omitted. */
+    scopes?: string[];
+    getClientConfig(): OAuthClientConfig | null;
+    authorize?(claims: Record<string, unknown>): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    mapClaims?(claims: Record<string, unknown>): Partial<AuthProfile>;
+}
+/**
+ * Build an OIDC driver. Synchronous, I/O-free at call time — see the
+ * module doc comment above. `getConfiguration()` on the returned driver
+ * is the only entry point that performs discovery, and only on first use
+ * (see `resolveOidcConfiguration` below).
+ */
+declare function createOidcDriver(options: CreateOidcDriverOptions): OidcAuthDriver;
 
 /**
  * Notification payload — the runtime-neutral shape passed to every
@@ -1349,6 +1573,26 @@ interface PluginReadinessDeclaration {
     /** `configSchema` field names that must be non-empty for `driver` to actually work once selected. */
     requiredConfigFields: string[];
 }
+/**
+ * One all-or-nothing group of `configSchema` fields — see
+ * `CrowiPlugin.configAtomicGroups`.
+ */
+interface PluginConfigAtomicGroup {
+    /**
+     * Stable identifier, part of the physical storage key
+     * (`plugin:<plugin>:__atomic:<name>`). Renaming it orphans the stored
+     * document, so treat it like a migration.
+     */
+    name: string;
+    /** The `configSchema` field names stored together. Non-empty, no duplicates, and each field may belong to only one group. */
+    keys: readonly string[];
+    /**
+     * Encrypt the whole stored group at rest. Set this when ANY member is
+     * secret: the group is one value, so it is either all encrypted or all
+     * not — there is no per-field choice left once they share a document.
+     */
+    sensitive?: boolean;
+}
 /**
  * The contract every Crowi plugin satisfies. Plugins export their
  * `CrowiPlugin` object as the package's default export; the runtime
@@ -1438,6 +1682,24 @@ interface CrowiPlugin {
      * the field that calls the plugin's contributed REST endpoint.
      */
     configSchema?: z.ZodObject<Record<string, z.ZodTypeAny>>;
+    /**
+     * RFC-0014 phase 4 — `configSchema` fields that must never be visible
+     * to anyone in a half-written state, declared as groups that are stored
+     * as ONE Config document instead of one row per field.
+     *
+     * The motivating case is an OAuth client id + secret. Written as
+     * separate rows, a failure between them leaves the instance advertising
+     * a new client id paired with the previous secret — a configuration
+     * that never existed and cannot authenticate, visible to every replica
+     * until an operator notices. As a single document there is no
+     * in-between: readers see the whole previous pair or the whole new one.
+     *
+     * This is a STORAGE contract, not a general escape hatch for making
+     * arbitrary keys atomic — the fields still appear to the plugin (and to
+     * the admin form) as ordinary flat config, and are only reassembled at
+     * the persistence boundary.
+     */
+    configAtomicGroups?: readonly PluginConfigAtomicGroup[];
     /**
      * Per-Page metadata schema. When set, every Page document has a
      * `metadata['<plugin-name>']` slot whose shape matches this schema,
@@ -1572,6 +1834,39 @@ interface CrowiPlugin {
      * of the very UI they need to fix the misconfiguration.
      */
     reconfigure?: (ctx: PluginContext) => void | Promise<void>;
+    /**
+     * Non-blocking connectivity/permission probe run once, after a save that
+     * touched this plugin's own config OR a dependency's config (any plugin
+     * that has this one in `requires`) has already persisted AND already
+     * run `reconfigure` — feature-plugin-config-live-verification. Never
+     * gates the save: whatever this returns is reported alongside a save
+     * that already succeeded, never rolled back.
+     *
+     * Receives a {@link PluginConfigVerificationSnapshot}, NOT the live
+     * `PluginContext` — do not close over or otherwise reach for `ctx` from
+     * inside this hook. The snapshot is a read-only, point-in-time view
+     * materialized from the exact values the triggering save just wrote (own
+     * config) plus any declared, `exposesConfigToDependents`-opted-in
+     * dependency config — it never reflects a LATER save by a different
+     * admin request, even one that lands while this hook is still running.
+     * `snapshot.config()` / `snapshot.dependencyConfig()` can throw if the
+     * runtime couldn't materialize a value (e.g. an existing, currently
+     * invalid dependency config); the runtime skips calling this hook
+     * entirely in that case rather than invoking it with a broken snapshot.
+     *
+     * `options.timeoutMs` is a notice, not a cancellation signal — see its
+     * doc. Must resolve within that budget or the caller treats it as
+     * `{ status: 'failed', reason: 'unreachable' }`; a promise that keeps
+     * running past that point should still clean up after itself when it
+     * eventually settles, but must never throw out of that cleanup in a way
+     * that becomes an unhandled rejection.
+     *
+     * The returned result (and anything it internally logs) must never
+     * include raw SDK/driver error text, stack traces, endpoints, or
+     * credential material — only the closed `reason` enum. See
+     * `PluginConfigVerificationResult`.
+     */
+    verifyConfig?: (snapshot: PluginConfigVerificationSnapshot, options: PluginConfigVerificationOptions) => Promise<PluginConfigVerificationResult>;
 }
 
 /**
@@ -1763,4 +2058,4 @@ type SanitizeSvgResult = {
  */
 declare function sanitizeSvg(input: string, policy: SanitizeSvgPolicy): SanitizeSvgResult;
 
-export { ACTION_FIELD_MARKER, type AdmissionControlConfig, type AppInfo, type AuthContext, type AuthDriver, type AuthProfile, type AuthRegistry, type AuthVerifyResult, type CacheEntry, type CacheKey, type CacheStorage, type CodeBlockInfo, type CodeBlockRenderer, type CrowiPlugin, type EmailMessage, type EmbedFragment, type EmbedInput, type EmbedRenderer, type EventBus, type InlineExpansion, type MailSender, type MailSenderRegistry, type NodeRenderer, type NotificationPayload, type NotifierDriver, type NotifierRegistry, type PageMetadataAccessor, type PluginContext, type PluginEvents, type PluginLogger, type PluginReadinessDeclaration, type PluginRouteHandler, type PluginRouteMethod, type PluginRouteOptions, type PluginRouterScope, type RenderActor, type RenderContext, type RenderError, type RenderPhase, type RenderResult, type RendererRegistry, type Reservation, SENSITIVE_FIELD_MARKER, type SanitizeSvgPolicy, type SanitizeSvgResult, type ScopedCacheStorage, type SearchDriver, type SearchHit, type SearchHits, type SearchPageType, type SearchQuery, type SearchQueryGrants, type SearchQueryViewer, type SearchRegistry, type SearchableDoc, type StateCell, type StorageDriver, type StoragePutMeta, type StoragePutResult, type StorageRegistry, type StructuredRenderPayload, type UrlInlineExpansionRule, escapeHtml, extractSvgDimensions, getActionAnnotation, isSensitiveField, sanitizeSvg };
+export { ACTION_FIELD_MARKER, type AdmissionControlConfig, type AppInfo, type AuthContext, type AuthDriver, type AuthDriverKind, type AuthProfile, type AuthRegistry, type AuthVerifyResult, CONFIG_VERIFICATION_KEY_PREFIX, type CacheEntry, type CacheKey, type CacheStorage, type CodeBlockInfo, type CodeBlockRenderer, type CreateOAuth2DriverOptions, type CreateOidcDriverOptions, type CredentialAuthDriver, type CredentialField, type CrowiPlugin, type EmailMessage, type EmbedFragment, type EmbedInput, type EmbedRenderer, type EventBus, type InlineExpansion, type MailSender, type MailSenderRegistry, type NodeRenderer, type NotificationPayload, type NotifierDriver, type NotifierRegistry, type OAuth2AuthDriver, type OAuthClientConfig, type OAuthTokens, type OidcAuthDriver, type PageMetadataAccessor, type PluginConfigAtomicGroup, type PluginConfigVerificationOptions, type PluginConfigVerificationResult, type PluginConfigVerificationSnapshot, type PluginContext, type PluginEvents, type PluginLogger, type PluginReadinessDeclaration, type PluginRouteHandler, type PluginRouteMethod, type PluginRouteOptions, type PluginRouterScope, type ReadonlyDeep, type RenderActor, type RenderContext, type RenderError, type RenderPhase, type RenderResult, type RendererRegistry, type Reservation, SENSITIVE_FIELD_MARKER, type SanitizeSvgPolicy, type SanitizeSvgResult, type ScopedCacheStorage, type SearchDriver, type SearchHit, type SearchHits, type SearchPageType, type SearchQuery, type SearchQueryGrants, type SearchQueryViewer, type SearchRegistry, type SearchableDoc, type StateCell, type StorageDriver, type StoragePutMeta, type StoragePutResult, type StorageRegistry, type StructuredRenderPayload, type UrlInlineExpansionRule, type VerificationFailureReason, createOAuth2Driver, createOidcDriver, escapeHtml, extractSvgDimensions, getActionAnnotation, isSensitiveField, sanitizeSvg };

package/dist/index.js

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,13 +17,24 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
   ACTION_FIELD_MARKER: () => ACTION_FIELD_MARKER,
+  CONFIG_VERIFICATION_KEY_PREFIX: () => CONFIG_VERIFICATION_KEY_PREFIX,
   SENSITIVE_FIELD_MARKER: () => SENSITIVE_FIELD_MARKER,
+  createOAuth2Driver: () => createOAuth2Driver,
+  createOidcDriver: () => createOidcDriver,
   escapeHtml: () => escapeHtml,
   extractSvgDimensions: () => extractSvgDimensions,
   getActionAnnotation: () => getActionAnnotation,
@@ -30,6 +43,9 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/config-verification.ts
+var CONFIG_VERIFICATION_KEY_PREFIX = "__crowi_config_verification__/";
+
 // src/html.ts
 function escapeHtml(s) {
   return s.replace(/[&<>"']/g, (c) => {
@@ -50,6 +66,117 @@ function escapeHtml(s) {
   });
 }
 
+// src/registries/auth.ts
+var import_node_crypto = require("crypto");
+function assertNonEmptyString(value, label, factory) {
+  if (value.trim() === "") {
+    throw new TypeError(`${factory}: '${label}' must be a non-empty string.`);
+  }
+}
+function assertValidUrl(value, label, factory) {
+  try {
+    new URL(value);
+  } catch {
+    throw new TypeError(`${factory}: '${label}' must be a valid URL, got '${value}'.`);
+  }
+}
+function assertNonEmptyScopes(scopes, factory) {
+  for (const scope of scopes) {
+    assertNonEmptyString(scope, "scopes[]", factory);
+  }
+}
+function createOAuth2Driver(options) {
+  const FACTORY = "createOAuth2Driver";
+  assertNonEmptyString(options.buttonLabel, "buttonLabel", FACTORY);
+  assertValidUrl(options.authorizeUrl, "authorizeUrl", FACTORY);
+  assertValidUrl(options.tokenUrl, "tokenUrl", FACTORY);
+  const scopes = options.scopes ?? [];
+  assertNonEmptyScopes(scopes, FACTORY);
+  return {
+    kind: "oauth2",
+    buttonLabel: options.buttonLabel,
+    iconUrl: options.iconUrl,
+    authorizeUrl: options.authorizeUrl,
+    tokenUrl: options.tokenUrl,
+    scopes,
+    pkce: options.pkce,
+    getClientConfig: options.getClientConfig,
+    fetchProfile: options.fetchProfile
+  };
+}
+var DEFAULT_OIDC_SCOPES = ["openid", "email", "profile"];
+function createOidcDriver(options) {
+  const FACTORY = "createOidcDriver";
+  assertNonEmptyString(options.buttonLabel, "buttonLabel", FACTORY);
+  assertValidUrl(options.discoveryUrl, "discoveryUrl", FACTORY);
+  const scopes = options.scopes ?? [...DEFAULT_OIDC_SCOPES];
+  assertNonEmptyScopes(scopes, FACTORY);
+  return {
+    kind: "oidc",
+    buttonLabel: options.buttonLabel,
+    iconUrl: options.iconUrl,
+    discoveryUrl: options.discoveryUrl,
+    scopes,
+    pkce: true,
+    getClientConfig: options.getClientConfig,
+    getConfiguration: () => resolveOidcConfiguration(options.discoveryUrl, options.getClientConfig),
+    authorize: options.authorize,
+    mapClaims: options.mapClaims
+  };
+}
+var DISCOVERY_CACHE_TTL_MS = 5 * 60 * 1e3;
+var DISCOVERY_CACHE_MAX_ENTRIES = 64;
+var discoveryCache = /* @__PURE__ */ new Map();
+var inFlightDiscoveries = /* @__PURE__ */ new Map();
+function discoveryCacheKey(discoveryUrl, clientId, clientSecret) {
+  const secretFingerprint = (0, import_node_crypto.createHash)("sha256").update(clientSecret).digest("hex");
+  return (0, import_node_crypto.createHash)("sha256").update(`${discoveryUrl}\0${clientId}\0${secretFingerprint}`).digest("hex");
+}
+function evictOldestDiscoveryCacheEntry() {
+  let oldestKey;
+  let oldestExpiresAt = Number.POSITIVE_INFINITY;
+  for (const [key, entry] of discoveryCache) {
+    if (entry.expiresAt < oldestExpiresAt) {
+      oldestExpiresAt = entry.expiresAt;
+      oldestKey = key;
+    }
+  }
+  if (oldestKey !== void 0) {
+    discoveryCache.delete(oldestKey);
+  }
+}
+function cacheDiscoveryResult(key, configuration) {
+  if (!discoveryCache.has(key) && discoveryCache.size >= DISCOVERY_CACHE_MAX_ENTRIES) {
+    evictOldestDiscoveryCacheEntry();
+  }
+  discoveryCache.set(key, { configuration, expiresAt: Date.now() + DISCOVERY_CACHE_TTL_MS });
+}
+async function resolveOidcConfiguration(discoveryUrl, getClientConfig) {
+  const clientConfig = getClientConfig();
+  if (clientConfig == null) return null;
+  const { clientId, clientSecret } = clientConfig;
+  const key = discoveryCacheKey(discoveryUrl, clientId, clientSecret);
+  const cached = discoveryCache.get(key);
+  if (cached !== void 0) {
+    if (cached.expiresAt > Date.now()) return cached.configuration;
+    discoveryCache.delete(key);
+  }
+  const inFlight = inFlightDiscoveries.get(key);
+  if (inFlight !== void 0) return inFlight;
+  const discoveryPromise = (async () => {
+    const { discovery } = await import("openid-client");
+    const configuration = await discovery(new URL(discoveryUrl), clientId, clientSecret);
+    cacheDiscoveryResult(key, configuration);
+    return configuration;
+  })();
+  inFlightDiscoveries.set(key, discoveryPromise);
+  try {
+    return await discoveryPromise;
+  } finally {
+    inFlightDiscoveries.delete(key);
+  }
+}
+
 // src/schema-markers.ts
 var SENSITIVE_FIELD_MARKER = "@sensitive";
 var ACTION_FIELD_MARKER = "@action";
@@ -272,7 +399,10 @@ function cssUnescape(css) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ACTION_FIELD_MARKER,
+  CONFIG_VERIFICATION_KEY_PREFIX,
   SENSITIVE_FIELD_MARKER,
+  createOAuth2Driver,
+  createOidcDriver,
   escapeHtml,
   extractSvgDimensions,
   getActionAnnotation,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/html.ts","../src/schema-markers.ts","../../svg-sanitize/src/dimensions.ts","../../svg-sanitize/src/sanitize.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACaO,SAAS,WAAW,GAAmB;AAC5C,SAAO,EAAE,QAAQ,YAAY,CAAC,MAAM;AAClC,YAAQ,GAAG;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF,CAAC;AACH;;;ACNO,IAAM,yBAAyB;AAa/B,IAAM,sBAAsB;AAQ5B,SAAS,iBAAiB,OAA8B;AAC7D,QAAM,cAAc,MAAM;AAC1B,SAAO,OAAO,gBAAgB,YAAY,YAAY,UAAU,EAAE,WAAW,sBAAsB;AACrG;AA6BO,SAAS,oBAAoB,OAA8C;AAChF,QAAM,cAAc,MAAM;AAC1B,MAAI,OAAO,gBAAgB,SAAU,QAAO;AAC5C,QAAM,UAAU,YAAY,UAAU;AACtC,MAAI,CAAC,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AAErD,QAAM,OAAO,QAAQ,MAAM,oBAAoB,MAAM,EAAE,UAAU;AAEjE,QAAM,QAAQ,KAAK,MAAM,mCAAmC;AAC5D,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,CAAC,EAAE,OAAO,QAAQ,IAAI,IAAI;AAChC,SAAO,EAAE,OAAO,QAA8C,KAAK;AACrE;;;AEzFA,oBAAyC;ADqBzC,IAAM,mBAAmB;AAElB,SAAS,qBAAqB,KAAuD;AAC1F,QAAM,QAAQ,uFAAuF,KAAK,GAAG;AAC7G,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,KAAK,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC;AACzC,QAAM,SAAS,KAAK,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC;AAC1C,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,CAAC,OAAO,SAAS,MAAM,EAAG,QAAO;AAChE,MAAI,SAAS,KAAK,UAAU,KAAK,QAAQ,oBAAoB,SAAS,iBAAkB,QAAO;AAC/F,SAAO,EAAE,OAAO,OAAO;AACzB;AC+CO,SAAS,YAAY,OAAe,QAA8C;AACvF,QAAM,MAAM,SAAS,KAAK;AAC1B,MAAI,CAAC,IAAK,QAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAEtD,MAAI,IAAI,SAAS;AAKf,WAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB;EACpD;AACA,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,uBAAuB,IAAI,GAAG;AACjC,WAAO,EAAE,IAAI,OAAO,QAAQ,kBAAkB;EAChD;AAEA,sBAAoB,MAAM,QAAQ,IAAI;AAEtC,QAAM,aAAa,IAAI,4BAAc;AACrC,QAAM,aAAa,WAAW,kBAAkB,IAAI;AAOpD,QAAM,YAAY,SAAS,UAAU;AACrC,MAAI,CAAC,aAAa,CAAC,uBAAuB,UAAU,eAAe,GAAG;AACpE,WAAO,EAAE,IAAI,OAAO,QAAQ,uCAAuC;EACrE;AAEA,SAAO,EAAE,IAAI,MAAM,KAAK,WAAW;AACrC;AAEA,IAAM,oBAAoB;AAW1B,IAAM,oBAAoB;AAU1B,IAAM,sBAAsB;AAgB5B,SAAS,sBAAsB,IAAsB;AACnD,SAAO,GAAG,iBAAiB,qBAAqB,GAAG,UAAU;AAC/D;AAUA,SAAS,uBAAuB,IAA+C;AAC7E,SAAO,MAAM,QAAQ,GAAG,cAAc,SAAS,sBAAsB,EAAE;AACzE;AAWA,SAAS,SAAS,QAAgB;AAChC,MAAI;AACF,WAAO,IAAI,wBAAU,EAAE,SAAS,MAAM,OAAU,CAAC,EAAE,gBAAgB,QAAQ,eAAe;EAC5F,QAAQ;AACN,WAAO;EACT;AACF;AAWA,IAAM,mBAAmB,oBAAI,IAAI;EAC/B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;AACF,CAAC;AAED,IAAM,8BAA8B;AACpC,IAAM,eAAe;AAErB,SAAS,oBAAoB,IAAa,QAA2B,QAAuB;AAC1F,qBAAmB,IAAI,QAAQ,MAAM;AAErC,MAAI,GAAG,cAAc,SAAS;AAG5B,OAAG,cAAc,kBAAkB,GAAG,eAAe,EAAE;AACvD;EACF;AAEA,aAAW,SAAS,MAAM,KAAK,GAAG,UAAU,GAAG;AAC7C,QAAI,MAAM,aAAa,6BAA6B;AAClD,SAAG,YAAY,KAAK;AACpB;IACF;AACA,QAAI,MAAM,aAAa,aAAc;AACrC,UAAM,UAAU;AAMhB,QAAI,CAAC,sBAAsB,OAAO,KAAK,CAAC,iBAAiB,IAAI,QAAQ,aAAa,QAAQ,QAAQ,GAAG;AACnG,SAAG,YAAY,OAAO;AACtB;IACF;AACA,wBAAoB,SAAS,QAAQ,KAAK;EAC5C;AACF;AAEA,SAAS,mBAAmB,IAAa,QAA2B,QAAuB;AACzF,aAAW,QAAQ,MAAM,KAAK,GAAG,UAAU,GAAG;AAC5C,UAAM,YAAY,KAAK,aAAa,KAAK;AACzC,QAAI,OAAO,KAAK,SAAS,GAAG;AAC1B,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,SAAS;AACzB,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,UAAU,KAAK,iBAAiB,mBAAmB;AAcnE,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,QAAQ;AACxB,YAAM,iBAAiB,kBAAkB,KAAK,OAAO,MAAM;AAC3D,UAAI,mBAAmB,MAAM;AAC3B,WAAG,oBAAoB,IAAI;MAC7B,OAAO;AACL,aAAK,QAAQ;MACf;AACA;IACF;AACA,QAAI,8BAA8B,IAAI,SAAS,GAAG;AAChD,UAAI,CAAC,iBAAiB,KAAK,KAAK,GAAG;AACjC,WAAG,oBAAoB,IAAI;MAC7B;AACA;IACF;AACA,QAAI,KAAK,SAAS,WAAW,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC3D,UAAI,CAAC,UAAU,CAAC,oCAAoC,IAAI,GAAG;AACzD,WAAG,oBAAoB,IAAI;MAC7B;IACF;EACF;AACF;AAoBA,SAAS,oCAAoC,MAAqB;AAChE,MAAI,KAAK,SAAS,QAAS,QAAO;AAClC,SAAO,KAAK,SAAS,iBAAiB,KAAK,UAAU;AACvD;AAQA,IAAM,gCAAgC,oBAAI,IAAI;EAC5C;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;AACF,CAAC;AAED,IAAM,mBAAmB;AAWzB,SAAS,iBAAiB,UAA2B;AAOnD,QAAM,UAAU,MAAM,KAAK,YAAY,QAAQ,EAAE,SAAS,gBAAgB,CAAC;AAC3E,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,SAAO,QAAQ,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,MAAM,OAAO,KAAK,EAAE,WAAW,GAAG,CAAC;AACtE;AAGA,SAAS,kBAAkB,UAAkB,QAA0C;AACrF,QAAM,QAAQ,SAAS,KAAK;AAC5B,MAAI,MAAM,WAAW,GAAG,EAAG,QAAO;AAClC,MAAI,gBAAgB,KAAK,KAAK,EAAG,QAAO;AACxC,MAAI,UAAU,KAAK,KAAK,EAAG,QAAO;AAClC,MAAI,MAAM,WAAW,IAAI,EAAG,QAAO;AACnC,MAAI,OAAO,iBAAiB,eAAe,KAAK,KAAK,EAAG,QAAO;AAC/D,SAAO;AACT;AA6CA,SAAS,kBAAkB,KAAqB;AAM9C,QAAM,kBAAkB,IAAI,QAAQ,qBAAqB,GAAG;AAC5D,MAAI,MAAM,YAAY,eAAe;AACrC,QAAM,IAAI,QAAQ,sBAAsB,EAAE;AAC1C,QAAM,IAAI,QAAQ,kBAAkB,CAAC,OAAO,QAAQ,WAAY,OAAO,KAAK,EAAE,WAAW,GAAG,IAAI,QAAQ,MAAO;AAC/G,SAAO;AACT;AAaA,SAAS,YAAY,KAAqB;AACxC,SAAO,IAAI,QAAQ,uDAAuD,CAAC,QAAQ,KAAyB,YAAgC;AAC1I,QAAI,QAAQ,QAAW;AACrB,YAAM,YAAY,OAAO,SAAS,KAAK,EAAE;AACzC,UAAI,cAAc,KAAK,YAAY,WAAa,aAAa,SAAU,aAAa,MAAS,QAAO;AACpG,aAAO,OAAO,cAAc,SAAS;IACvC;AACA,QAAI,YAAY,OAAW,QAAO;AAClC,WAAO;EACT,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/config-verification.ts","../src/html.ts","../src/registries/auth.ts","../src/schema-markers.ts","../../svg-sanitize/src/dimensions.ts","../../svg-sanitize/src/sanitize.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACiGO,IAAM,iCAAiC;;;ACpFvC,SAAS,WAAW,GAAmB;AAC5C,SAAO,EAAE,QAAQ,YAAY,CAAC,MAAM;AAClC,YAAQ,GAAG;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF,CAAC;AACH;;;AC9BA,yBAA2B;AA2K3B,SAAS,qBAAqB,OAAe,OAAe,SAAuB;AACjF,MAAI,MAAM,KAAK,MAAM,IAAI;AACvB,UAAM,IAAI,UAAU,GAAG,OAAO,MAAM,KAAK,+BAA+B;AAAA,EAC1E;AACF;AAEA,SAAS,eAAe,OAAe,OAAe,SAAuB;AAC3E,MAAI;AACF,QAAI,IAAI,KAAK;AAAA,EACf,QAAQ;AACN,UAAM,IAAI,UAAU,GAAG,OAAO,MAAM,KAAK,+BAA+B,KAAK,IAAI;AAAA,EACnF;AACF;AAEA,SAAS,qBAAqB,QAAkB,SAAuB;AACrE,aAAW,SAAS,QAAQ;AAC1B,yBAAqB,OAAO,YAAY,OAAO;AAAA,EACjD;AACF;AAkBO,SAAS,mBAAmB,SAAsD;AACvF,QAAM,UAAU;AAChB,uBAAqB,QAAQ,aAAa,eAAe,OAAO;AAChE,iBAAe,QAAQ,cAAc,gBAAgB,OAAO;AAC5D,iBAAe,QAAQ,UAAU,YAAY,OAAO;AACpD,QAAM,SAAS,QAAQ,UAAU,CAAC;AAClC,uBAAqB,QAAQ,OAAO;AAEpC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa,QAAQ;AAAA,IACrB,SAAS,QAAQ;AAAA,IACjB,cAAc,QAAQ;AAAA,IACtB,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,MAAM,QAAQ;AAAA,IACd,iBAAiB,QAAQ;AAAA,IACzB,cAAc,QAAQ;AAAA,EACxB;AACF;AAEA,IAAM,sBAAyC,CAAC,UAAU,SAAS,SAAS;AAmBrE,SAAS,iBAAiB,SAAkD;AACjF,QAAM,UAAU;AAChB,uBAAqB,QAAQ,aAAa,eAAe,OAAO;AAChE,iBAAe,QAAQ,cAAc,gBAAgB,OAAO;AAC5D,QAAM,SAAS,QAAQ,UAAU,CAAC,GAAG,mBAAmB;AACxD,uBAAqB,QAAQ,OAAO;AAEpC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa,QAAQ;AAAA,IACrB,SAAS,QAAQ;AAAA,IACjB,cAAc,QAAQ;AAAA,IACtB;AAAA,IACA,MAAM;AAAA,IACN,iBAAiB,QAAQ;AAAA,IACzB,kBAAkB,MAAM,yBAAyB,QAAQ,cAAc,QAAQ,eAAe;AAAA,IAC9F,WAAW,QAAQ;AAAA,IACnB,WAAW,QAAQ;AAAA,EACrB;AACF;AAsBA,IAAM,yBAAyB,IAAI,KAAK;AACxC,IAAM,8BAA8B;AAOpC,IAAM,iBAAiB,oBAAI,IAAiC;AAC5D,IAAM,sBAAsB,oBAAI,IAAoC;AAEpE,SAAS,kBAAkB,cAAsB,UAAkB,cAA8B;AAC/F,QAAM,wBAAoB,+BAAW,QAAQ,EAAE,OAAO,YAAY,EAAE,OAAO,KAAK;AAChF,aAAO,+BAAW,QAAQ,EAAE,OAAO,GAAG,YAAY,KAAK,QAAQ,KAAK,iBAAiB,EAAE,EAAE,OAAO,KAAK;AACvG;AAEA,SAAS,iCAAuC;AAC9C,MAAI;AACJ,MAAI,kBAAkB,OAAO;AAC7B,aAAW,CAAC,KAAK,KAAK,KAAK,gBAAgB;AACzC,QAAI,MAAM,YAAY,iBAAiB;AACrC,wBAAkB,MAAM;AACxB,kBAAY;AAAA,IACd;AAAA,EACF;AACA,MAAI,cAAc,QAAW;AAC3B,mBAAe,OAAO,SAAS;AAAA,EACjC;AACF;AAEA,SAAS,qBAAqB,KAAa,eAAoC;AAC7E,MAAI,CAAC,eAAe,IAAI,GAAG,KAAK,eAAe,QAAQ,6BAA6B;AAClF,mCAA+B;AAAA,EACjC;AACA,iBAAe,IAAI,KAAK,EAAE,eAAe,WAAW,KAAK,IAAI,IAAI,uBAAuB,CAAC;AAC3F;AASA,eAAe,yBAAyB,cAAsB,iBAAgF;AAC5I,QAAM,eAAe,gBAAgB;AACrC,MAAI,gBAAgB,KAAM,QAAO;AAajC,QAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,QAAM,MAAM,kBAAkB,cAAc,UAAU,YAAY;AAElE,QAAM,SAAS,eAAe,IAAI,GAAG;AACrC,MAAI,WAAW,QAAW;AACxB,QAAI,OAAO,YAAY,KAAK,IAAI,EAAG,QAAO,OAAO;AACjD,mBAAe,OAAO,GAAG;AAAA,EAC3B;AAEA,QAAM,WAAW,oBAAoB,IAAI,GAAG;AAC5C,MAAI,aAAa,OAAW,QAAO;AAEnC,QAAM,oBAAoB,YAAY;AACpC,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,eAAe;AAClD,UAAM,gBAAgB,MAAM,UAAU,IAAI,IAAI,YAAY,GAAG,UAAU,YAAY;AACnF,yBAAqB,KAAK,aAAa;AACvC,WAAO;AAAA,EACT,GAAG;AAEH,sBAAoB,IAAI,KAAK,gBAAgB;AAC7C,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,wBAAoB,OAAO,GAAG;AAAA,EAChC;AACF;;;AC7VO,IAAM,yBAAyB;AAa/B,IAAM,sBAAsB;AAQ5B,SAAS,iBAAiB,OAA8B;AAC7D,QAAM,cAAc,MAAM;AAC1B,SAAO,OAAO,gBAAgB,YAAY,YAAY,UAAU,EAAE,WAAW,sBAAsB;AACrG;AA6BO,SAAS,oBAAoB,OAA8C;AAChF,QAAM,cAAc,MAAM;AAC1B,MAAI,OAAO,gBAAgB,SAAU,QAAO;AAC5C,QAAM,UAAU,YAAY,UAAU;AACtC,MAAI,CAAC,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AAErD,QAAM,OAAO,QAAQ,MAAM,oBAAoB,MAAM,EAAE,UAAU;AAEjE,QAAM,QAAQ,KAAK,MAAM,mCAAmC;AAC5D,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,CAAC,EAAE,OAAO,QAAQ,IAAI,IAAI;AAChC,SAAO,EAAE,OAAO,QAA8C,KAAK;AACrE;;;AEzFA,oBAAyC;ADqBzC,IAAM,mBAAmB;AAElB,SAAS,qBAAqB,KAAuD;AAC1F,QAAM,QAAQ,uFAAuF,KAAK,GAAG;AAC7G,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,KAAK,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC;AACzC,QAAM,SAAS,KAAK,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC;AAC1C,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,CAAC,OAAO,SAAS,MAAM,EAAG,QAAO;AAChE,MAAI,SAAS,KAAK,UAAU,KAAK,QAAQ,oBAAoB,SAAS,iBAAkB,QAAO;AAC/F,SAAO,EAAE,OAAO,OAAO;AACzB;AC+CO,SAAS,YAAY,OAAe,QAA8C;AACvF,QAAM,MAAM,SAAS,KAAK;AAC1B,MAAI,CAAC,IAAK,QAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAEtD,MAAI,IAAI,SAAS;AAKf,WAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB;EACpD;AACA,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,uBAAuB,IAAI,GAAG;AACjC,WAAO,EAAE,IAAI,OAAO,QAAQ,kBAAkB;EAChD;AAEA,sBAAoB,MAAM,QAAQ,IAAI;AAEtC,QAAM,aAAa,IAAI,4BAAc;AACrC,QAAM,aAAa,WAAW,kBAAkB,IAAI;AAOpD,QAAM,YAAY,SAAS,UAAU;AACrC,MAAI,CAAC,aAAa,CAAC,uBAAuB,UAAU,eAAe,GAAG;AACpE,WAAO,EAAE,IAAI,OAAO,QAAQ,uCAAuC;EACrE;AAEA,SAAO,EAAE,IAAI,MAAM,KAAK,WAAW;AACrC;AAEA,IAAM,oBAAoB;AAW1B,IAAM,oBAAoB;AAU1B,IAAM,sBAAsB;AAgB5B,SAAS,sBAAsB,IAAsB;AACnD,SAAO,GAAG,iBAAiB,qBAAqB,GAAG,UAAU;AAC/D;AAUA,SAAS,uBAAuB,IAA+C;AAC7E,SAAO,MAAM,QAAQ,GAAG,cAAc,SAAS,sBAAsB,EAAE;AACzE;AAWA,SAAS,SAAS,QAAgB;AAChC,MAAI;AACF,WAAO,IAAI,wBAAU,EAAE,SAAS,MAAM,OAAU,CAAC,EAAE,gBAAgB,QAAQ,eAAe;EAC5F,QAAQ;AACN,WAAO;EACT;AACF;AAWA,IAAM,mBAAmB,oBAAI,IAAI;EAC/B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;AACF,CAAC;AAED,IAAM,8BAA8B;AACpC,IAAM,eAAe;AAErB,SAAS,oBAAoB,IAAa,QAA2B,QAAuB;AAC1F,qBAAmB,IAAI,QAAQ,MAAM;AAErC,MAAI,GAAG,cAAc,SAAS;AAG5B,OAAG,cAAc,kBAAkB,GAAG,eAAe,EAAE;AACvD;EACF;AAEA,aAAW,SAAS,MAAM,KAAK,GAAG,UAAU,GAAG;AAC7C,QAAI,MAAM,aAAa,6BAA6B;AAClD,SAAG,YAAY,KAAK;AACpB;IACF;AACA,QAAI,MAAM,aAAa,aAAc;AACrC,UAAM,UAAU;AAMhB,QAAI,CAAC,sBAAsB,OAAO,KAAK,CAAC,iBAAiB,IAAI,QAAQ,aAAa,QAAQ,QAAQ,GAAG;AACnG,SAAG,YAAY,OAAO;AACtB;IACF;AACA,wBAAoB,SAAS,QAAQ,KAAK;EAC5C;AACF;AAEA,SAAS,mBAAmB,IAAa,QAA2B,QAAuB;AACzF,aAAW,QAAQ,MAAM,KAAK,GAAG,UAAU,GAAG;AAC5C,UAAM,YAAY,KAAK,aAAa,KAAK;AACzC,QAAI,OAAO,KAAK,SAAS,GAAG;AAC1B,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,SAAS;AACzB,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,UAAU,KAAK,iBAAiB,mBAAmB;AAcnE,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,QAAQ;AACxB,YAAM,iBAAiB,kBAAkB,KAAK,OAAO,MAAM;AAC3D,UAAI,mBAAmB,MAAM;AAC3B,WAAG,oBAAoB,IAAI;MAC7B,OAAO;AACL,aAAK,QAAQ;MACf;AACA;IACF;AACA,QAAI,8BAA8B,IAAI,SAAS,GAAG;AAChD,UAAI,CAAC,iBAAiB,KAAK,KAAK,GAAG;AACjC,WAAG,oBAAoB,IAAI;MAC7B;AACA;IACF;AACA,QAAI,KAAK,SAAS,WAAW,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC3D,UAAI,CAAC,UAAU,CAAC,oCAAoC,IAAI,GAAG;AACzD,WAAG,oBAAoB,IAAI;MAC7B;IACF;EACF;AACF;AAoBA,SAAS,oCAAoC,MAAqB;AAChE,MAAI,KAAK,SAAS,QAAS,QAAO;AAClC,SAAO,KAAK,SAAS,iBAAiB,KAAK,UAAU;AACvD;AAQA,IAAM,gCAAgC,oBAAI,IAAI;EAC5C;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;AACF,CAAC;AAED,IAAM,mBAAmB;AAWzB,SAAS,iBAAiB,UAA2B;AAOnD,QAAM,UAAU,MAAM,KAAK,YAAY,QAAQ,EAAE,SAAS,gBAAgB,CAAC;AAC3E,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,SAAO,QAAQ,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,MAAM,OAAO,KAAK,EAAE,WAAW,GAAG,CAAC;AACtE;AAGA,SAAS,kBAAkB,UAAkB,QAA0C;AACrF,QAAM,QAAQ,SAAS,KAAK;AAC5B,MAAI,MAAM,WAAW,GAAG,EAAG,QAAO;AAClC,MAAI,gBAAgB,KAAK,KAAK,EAAG,QAAO;AACxC,MAAI,UAAU,KAAK,KAAK,EAAG,QAAO;AAClC,MAAI,MAAM,WAAW,IAAI,EAAG,QAAO;AACnC,MAAI,OAAO,iBAAiB,eAAe,KAAK,KAAK,EAAG,QAAO;AAC/D,SAAO;AACT;AA6CA,SAAS,kBAAkB,KAAqB;AAM9C,QAAM,kBAAkB,IAAI,QAAQ,qBAAqB,GAAG;AAC5D,MAAI,MAAM,YAAY,eAAe;AACrC,QAAM,IAAI,QAAQ,sBAAsB,EAAE;AAC1C,QAAM,IAAI,QAAQ,kBAAkB,CAAC,OAAO,QAAQ,WAAY,OAAO,KAAK,EAAE,WAAW,GAAG,IAAI,QAAQ,MAAO;AAC/G,SAAO;AACT;AAaA,SAAS,YAAY,KAAqB;AACxC,SAAO,IAAI,QAAQ,uDAAuD,CAAC,QAAQ,KAAyB,YAAgC;AAC1I,QAAI,QAAQ,QAAW;AACrB,YAAM,YAAY,OAAO,SAAS,KAAK,EAAE;AACzC,UAAI,cAAc,KAAK,YAAY,WAAa,aAAa,SAAU,aAAa,MAAS,QAAO;AACpG,aAAO,OAAO,cAAc,SAAS;IACvC;AACA,QAAI,YAAY,OAAW,QAAO;AAClC,WAAO;EACT,CAAC;AACH;","names":[]}

package/dist/index.mjs

@@ -1,3 +1,6 @@
+// src/config-verification.ts
+var CONFIG_VERIFICATION_KEY_PREFIX = "__crowi_config_verification__/";
+
 // src/html.ts
 function escapeHtml(s) {
   return s.replace(/[&<>"']/g, (c) => {
@@ -18,6 +21,117 @@ function escapeHtml(s) {
   });
 }
 
+// src/registries/auth.ts
+import { createHash } from "crypto";
+function assertNonEmptyString(value, label, factory) {
+  if (value.trim() === "") {
+    throw new TypeError(`${factory}: '${label}' must be a non-empty string.`);
+  }
+}
+function assertValidUrl(value, label, factory) {
+  try {
+    new URL(value);
+  } catch {
+    throw new TypeError(`${factory}: '${label}' must be a valid URL, got '${value}'.`);
+  }
+}
+function assertNonEmptyScopes(scopes, factory) {
+  for (const scope of scopes) {
+    assertNonEmptyString(scope, "scopes[]", factory);
+  }
+}
+function createOAuth2Driver(options) {
+  const FACTORY = "createOAuth2Driver";
+  assertNonEmptyString(options.buttonLabel, "buttonLabel", FACTORY);
+  assertValidUrl(options.authorizeUrl, "authorizeUrl", FACTORY);
+  assertValidUrl(options.tokenUrl, "tokenUrl", FACTORY);
+  const scopes = options.scopes ?? [];
+  assertNonEmptyScopes(scopes, FACTORY);
+  return {
+    kind: "oauth2",
+    buttonLabel: options.buttonLabel,
+    iconUrl: options.iconUrl,
+    authorizeUrl: options.authorizeUrl,
+    tokenUrl: options.tokenUrl,
+    scopes,
+    pkce: options.pkce,
+    getClientConfig: options.getClientConfig,
+    fetchProfile: options.fetchProfile
+  };
+}
+var DEFAULT_OIDC_SCOPES = ["openid", "email", "profile"];
+function createOidcDriver(options) {
+  const FACTORY = "createOidcDriver";
+  assertNonEmptyString(options.buttonLabel, "buttonLabel", FACTORY);
+  assertValidUrl(options.discoveryUrl, "discoveryUrl", FACTORY);
+  const scopes = options.scopes ?? [...DEFAULT_OIDC_SCOPES];
+  assertNonEmptyScopes(scopes, FACTORY);
+  return {
+    kind: "oidc",
+    buttonLabel: options.buttonLabel,
+    iconUrl: options.iconUrl,
+    discoveryUrl: options.discoveryUrl,
+    scopes,
+    pkce: true,
+    getClientConfig: options.getClientConfig,
+    getConfiguration: () => resolveOidcConfiguration(options.discoveryUrl, options.getClientConfig),
+    authorize: options.authorize,
+    mapClaims: options.mapClaims
+  };
+}
+var DISCOVERY_CACHE_TTL_MS = 5 * 60 * 1e3;
+var DISCOVERY_CACHE_MAX_ENTRIES = 64;
+var discoveryCache = /* @__PURE__ */ new Map();
+var inFlightDiscoveries = /* @__PURE__ */ new Map();
+function discoveryCacheKey(discoveryUrl, clientId, clientSecret) {
+  const secretFingerprint = createHash("sha256").update(clientSecret).digest("hex");
+  return createHash("sha256").update(`${discoveryUrl}\0${clientId}\0${secretFingerprint}`).digest("hex");
+}
+function evictOldestDiscoveryCacheEntry() {
+  let oldestKey;
+  let oldestExpiresAt = Number.POSITIVE_INFINITY;
+  for (const [key, entry] of discoveryCache) {
+    if (entry.expiresAt < oldestExpiresAt) {
+      oldestExpiresAt = entry.expiresAt;
+      oldestKey = key;
+    }
+  }
+  if (oldestKey !== void 0) {
+    discoveryCache.delete(oldestKey);
+  }
+}
+function cacheDiscoveryResult(key, configuration) {
+  if (!discoveryCache.has(key) && discoveryCache.size >= DISCOVERY_CACHE_MAX_ENTRIES) {
+    evictOldestDiscoveryCacheEntry();
+  }
+  discoveryCache.set(key, { configuration, expiresAt: Date.now() + DISCOVERY_CACHE_TTL_MS });
+}
+async function resolveOidcConfiguration(discoveryUrl, getClientConfig) {
+  const clientConfig = getClientConfig();
+  if (clientConfig == null) return null;
+  const { clientId, clientSecret } = clientConfig;
+  const key = discoveryCacheKey(discoveryUrl, clientId, clientSecret);
+  const cached = discoveryCache.get(key);
+  if (cached !== void 0) {
+    if (cached.expiresAt > Date.now()) return cached.configuration;
+    discoveryCache.delete(key);
+  }
+  const inFlight = inFlightDiscoveries.get(key);
+  if (inFlight !== void 0) return inFlight;
+  const discoveryPromise = (async () => {
+    const { discovery } = await import("openid-client");
+    const configuration = await discovery(new URL(discoveryUrl), clientId, clientSecret);
+    cacheDiscoveryResult(key, configuration);
+    return configuration;
+  })();
+  inFlightDiscoveries.set(key, discoveryPromise);
+  try {
+    return await discoveryPromise;
+  } finally {
+    inFlightDiscoveries.delete(key);
+  }
+}
+
 // src/schema-markers.ts
 var SENSITIVE_FIELD_MARKER = "@sensitive";
 var ACTION_FIELD_MARKER = "@action";
@@ -239,7 +353,10 @@ function cssUnescape(css) {
 }
 export {
   ACTION_FIELD_MARKER,
+  CONFIG_VERIFICATION_KEY_PREFIX,
   SENSITIVE_FIELD_MARKER,
+  createOAuth2Driver,
+  createOidcDriver,
   escapeHtml,
   extractSvgDimensions,
   getActionAnnotation,

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/html.ts","../src/schema-markers.ts","../../svg-sanitize/src/dimensions.ts","../../svg-sanitize/src/sanitize.ts"],"mappings":";AAaO,SAAS,WAAW,GAAmB;AAC5C,SAAO,EAAE,QAAQ,YAAY,CAAC,MAAM;AAClC,YAAQ,GAAG;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF,CAAC;AACH;;;ACNO,IAAM,yBAAyB;AAa/B,IAAM,sBAAsB;AAQ5B,SAAS,iBAAiB,OAA8B;AAC7D,QAAM,cAAc,MAAM;AAC1B,SAAO,OAAO,gBAAgB,YAAY,YAAY,UAAU,EAAE,WAAW,sBAAsB;AACrG;AA6BO,SAAS,oBAAoB,OAA8C;AAChF,QAAM,cAAc,MAAM;AAC1B,MAAI,OAAO,gBAAgB,SAAU,QAAO;AAC5C,QAAM,UAAU,YAAY,UAAU;AACtC,MAAI,CAAC,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AAErD,QAAM,OAAO,QAAQ,MAAM,oBAAoB,MAAM,EAAE,UAAU;AAEjE,QAAM,QAAQ,KAAK,MAAM,mCAAmC;AAC5D,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,CAAC,EAAE,OAAO,QAAQ,IAAI,IAAI;AAChC,SAAO,EAAE,OAAO,QAA8C,KAAK;AACrE;;;AEzFA,SAAS,WAAW,qBAAqB;ADqBzC,IAAM,mBAAmB;AAElB,SAAS,qBAAqB,KAAuD;AAC1F,QAAM,QAAQ,uFAAuF,KAAK,GAAG;AAC7G,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,KAAK,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC;AACzC,QAAM,SAAS,KAAK,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC;AAC1C,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,CAAC,OAAO,SAAS,MAAM,EAAG,QAAO;AAChE,MAAI,SAAS,KAAK,UAAU,KAAK,QAAQ,oBAAoB,SAAS,iBAAkB,QAAO;AAC/F,SAAO,EAAE,OAAO,OAAO;AACzB;AC+CO,SAAS,YAAY,OAAe,QAA8C;AACvF,QAAM,MAAM,SAAS,KAAK;AAC1B,MAAI,CAAC,IAAK,QAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAEtD,MAAI,IAAI,SAAS;AAKf,WAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB;EACpD;AACA,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,uBAAuB,IAAI,GAAG;AACjC,WAAO,EAAE,IAAI,OAAO,QAAQ,kBAAkB;EAChD;AAEA,sBAAoB,MAAM,QAAQ,IAAI;AAEtC,QAAM,aAAa,IAAI,cAAc;AACrC,QAAM,aAAa,WAAW,kBAAkB,IAAI;AAOpD,QAAM,YAAY,SAAS,UAAU;AACrC,MAAI,CAAC,aAAa,CAAC,uBAAuB,UAAU,eAAe,GAAG;AACpE,WAAO,EAAE,IAAI,OAAO,QAAQ,uCAAuC;EACrE;AAEA,SAAO,EAAE,IAAI,MAAM,KAAK,WAAW;AACrC;AAEA,IAAM,oBAAoB;AAW1B,IAAM,oBAAoB;AAU1B,IAAM,sBAAsB;AAgB5B,SAAS,sBAAsB,IAAsB;AACnD,SAAO,GAAG,iBAAiB,qBAAqB,GAAG,UAAU;AAC/D;AAUA,SAAS,uBAAuB,IAA+C;AAC7E,SAAO,MAAM,QAAQ,GAAG,cAAc,SAAS,sBAAsB,EAAE;AACzE;AAWA,SAAS,SAAS,QAAgB;AAChC,MAAI;AACF,WAAO,IAAI,UAAU,EAAE,SAAS,MAAM,OAAU,CAAC,EAAE,gBAAgB,QAAQ,eAAe;EAC5F,QAAQ;AACN,WAAO;EACT;AACF;AAWA,IAAM,mBAAmB,oBAAI,IAAI;EAC/B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;AACF,CAAC;AAED,IAAM,8BAA8B;AACpC,IAAM,eAAe;AAErB,SAAS,oBAAoB,IAAa,QAA2B,QAAuB;AAC1F,qBAAmB,IAAI,QAAQ,MAAM;AAErC,MAAI,GAAG,cAAc,SAAS;AAG5B,OAAG,cAAc,kBAAkB,GAAG,eAAe,EAAE;AACvD;EACF;AAEA,aAAW,SAAS,MAAM,KAAK,GAAG,UAAU,GAAG;AAC7C,QAAI,MAAM,aAAa,6BAA6B;AAClD,SAAG,YAAY,KAAK;AACpB;IACF;AACA,QAAI,MAAM,aAAa,aAAc;AACrC,UAAM,UAAU;AAMhB,QAAI,CAAC,sBAAsB,OAAO,KAAK,CAAC,iBAAiB,IAAI,QAAQ,aAAa,QAAQ,QAAQ,GAAG;AACnG,SAAG,YAAY,OAAO;AACtB;IACF;AACA,wBAAoB,SAAS,QAAQ,KAAK;EAC5C;AACF;AAEA,SAAS,mBAAmB,IAAa,QAA2B,QAAuB;AACzF,aAAW,QAAQ,MAAM,KAAK,GAAG,UAAU,GAAG;AAC5C,UAAM,YAAY,KAAK,aAAa,KAAK;AACzC,QAAI,OAAO,KAAK,SAAS,GAAG;AAC1B,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,SAAS;AACzB,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,UAAU,KAAK,iBAAiB,mBAAmB;AAcnE,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,QAAQ;AACxB,YAAM,iBAAiB,kBAAkB,KAAK,OAAO,MAAM;AAC3D,UAAI,mBAAmB,MAAM;AAC3B,WAAG,oBAAoB,IAAI;MAC7B,OAAO;AACL,aAAK,QAAQ;MACf;AACA;IACF;AACA,QAAI,8BAA8B,IAAI,SAAS,GAAG;AAChD,UAAI,CAAC,iBAAiB,KAAK,KAAK,GAAG;AACjC,WAAG,oBAAoB,IAAI;MAC7B;AACA;IACF;AACA,QAAI,KAAK,SAAS,WAAW,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC3D,UAAI,CAAC,UAAU,CAAC,oCAAoC,IAAI,GAAG;AACzD,WAAG,oBAAoB,IAAI;MAC7B;IACF;EACF;AACF;AAoBA,SAAS,oCAAoC,MAAqB;AAChE,MAAI,KAAK,SAAS,QAAS,QAAO;AAClC,SAAO,KAAK,SAAS,iBAAiB,KAAK,UAAU;AACvD;AAQA,IAAM,gCAAgC,oBAAI,IAAI;EAC5C;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;AACF,CAAC;AAED,IAAM,mBAAmB;AAWzB,SAAS,iBAAiB,UAA2B;AAOnD,QAAM,UAAU,MAAM,KAAK,YAAY,QAAQ,EAAE,SAAS,gBAAgB,CAAC;AAC3E,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,SAAO,QAAQ,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,MAAM,OAAO,KAAK,EAAE,WAAW,GAAG,CAAC;AACtE;AAGA,SAAS,kBAAkB,UAAkB,QAA0C;AACrF,QAAM,QAAQ,SAAS,KAAK;AAC5B,MAAI,MAAM,WAAW,GAAG,EAAG,QAAO;AAClC,MAAI,gBAAgB,KAAK,KAAK,EAAG,QAAO;AACxC,MAAI,UAAU,KAAK,KAAK,EAAG,QAAO;AAClC,MAAI,MAAM,WAAW,IAAI,EAAG,QAAO;AACnC,MAAI,OAAO,iBAAiB,eAAe,KAAK,KAAK,EAAG,QAAO;AAC/D,SAAO;AACT;AA6CA,SAAS,kBAAkB,KAAqB;AAM9C,QAAM,kBAAkB,IAAI,QAAQ,qBAAqB,GAAG;AAC5D,MAAI,MAAM,YAAY,eAAe;AACrC,QAAM,IAAI,QAAQ,sBAAsB,EAAE;AAC1C,QAAM,IAAI,QAAQ,kBAAkB,CAAC,OAAO,QAAQ,WAAY,OAAO,KAAK,EAAE,WAAW,GAAG,IAAI,QAAQ,MAAO;AAC/G,SAAO;AACT;AAaA,SAAS,YAAY,KAAqB;AACxC,SAAO,IAAI,QAAQ,uDAAuD,CAAC,QAAQ,KAAyB,YAAgC;AAC1I,QAAI,QAAQ,QAAW;AACrB,YAAM,YAAY,OAAO,SAAS,KAAK,EAAE;AACzC,UAAI,cAAc,KAAK,YAAY,WAAa,aAAa,SAAU,aAAa,MAAS,QAAO;AACpG,aAAO,OAAO,cAAc,SAAS;IACvC;AACA,QAAI,YAAY,OAAW,QAAO;AAClC,WAAO;EACT,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/config-verification.ts","../src/html.ts","../src/registries/auth.ts","../src/schema-markers.ts","../../svg-sanitize/src/dimensions.ts","../../svg-sanitize/src/sanitize.ts"],"mappings":";AAiGO,IAAM,iCAAiC;;;ACpFvC,SAAS,WAAW,GAAmB;AAC5C,SAAO,EAAE,QAAQ,YAAY,CAAC,MAAM;AAClC,YAAQ,GAAG;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF,CAAC;AACH;;;AC9BA,SAAS,kBAAkB;AA2K3B,SAAS,qBAAqB,OAAe,OAAe,SAAuB;AACjF,MAAI,MAAM,KAAK,MAAM,IAAI;AACvB,UAAM,IAAI,UAAU,GAAG,OAAO,MAAM,KAAK,+BAA+B;AAAA,EAC1E;AACF;AAEA,SAAS,eAAe,OAAe,OAAe,SAAuB;AAC3E,MAAI;AACF,QAAI,IAAI,KAAK;AAAA,EACf,QAAQ;AACN,UAAM,IAAI,UAAU,GAAG,OAAO,MAAM,KAAK,+BAA+B,KAAK,IAAI;AAAA,EACnF;AACF;AAEA,SAAS,qBAAqB,QAAkB,SAAuB;AACrE,aAAW,SAAS,QAAQ;AAC1B,yBAAqB,OAAO,YAAY,OAAO;AAAA,EACjD;AACF;AAkBO,SAAS,mBAAmB,SAAsD;AACvF,QAAM,UAAU;AAChB,uBAAqB,QAAQ,aAAa,eAAe,OAAO;AAChE,iBAAe,QAAQ,cAAc,gBAAgB,OAAO;AAC5D,iBAAe,QAAQ,UAAU,YAAY,OAAO;AACpD,QAAM,SAAS,QAAQ,UAAU,CAAC;AAClC,uBAAqB,QAAQ,OAAO;AAEpC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa,QAAQ;AAAA,IACrB,SAAS,QAAQ;AAAA,IACjB,cAAc,QAAQ;AAAA,IACtB,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,MAAM,QAAQ;AAAA,IACd,iBAAiB,QAAQ;AAAA,IACzB,cAAc,QAAQ;AAAA,EACxB;AACF;AAEA,IAAM,sBAAyC,CAAC,UAAU,SAAS,SAAS;AAmBrE,SAAS,iBAAiB,SAAkD;AACjF,QAAM,UAAU;AAChB,uBAAqB,QAAQ,aAAa,eAAe,OAAO;AAChE,iBAAe,QAAQ,cAAc,gBAAgB,OAAO;AAC5D,QAAM,SAAS,QAAQ,UAAU,CAAC,GAAG,mBAAmB;AACxD,uBAAqB,QAAQ,OAAO;AAEpC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa,QAAQ;AAAA,IACrB,SAAS,QAAQ;AAAA,IACjB,cAAc,QAAQ;AAAA,IACtB;AAAA,IACA,MAAM;AAAA,IACN,iBAAiB,QAAQ;AAAA,IACzB,kBAAkB,MAAM,yBAAyB,QAAQ,cAAc,QAAQ,eAAe;AAAA,IAC9F,WAAW,QAAQ;AAAA,IACnB,WAAW,QAAQ;AAAA,EACrB;AACF;AAsBA,IAAM,yBAAyB,IAAI,KAAK;AACxC,IAAM,8BAA8B;AAOpC,IAAM,iBAAiB,oBAAI,IAAiC;AAC5D,IAAM,sBAAsB,oBAAI,IAAoC;AAEpE,SAAS,kBAAkB,cAAsB,UAAkB,cAA8B;AAC/F,QAAM,oBAAoB,WAAW,QAAQ,EAAE,OAAO,YAAY,EAAE,OAAO,KAAK;AAChF,SAAO,WAAW,QAAQ,EAAE,OAAO,GAAG,YAAY,KAAK,QAAQ,KAAK,iBAAiB,EAAE,EAAE,OAAO,KAAK;AACvG;AAEA,SAAS,iCAAuC;AAC9C,MAAI;AACJ,MAAI,kBAAkB,OAAO;AAC7B,aAAW,CAAC,KAAK,KAAK,KAAK,gBAAgB;AACzC,QAAI,MAAM,YAAY,iBAAiB;AACrC,wBAAkB,MAAM;AACxB,kBAAY;AAAA,IACd;AAAA,EACF;AACA,MAAI,cAAc,QAAW;AAC3B,mBAAe,OAAO,SAAS;AAAA,EACjC;AACF;AAEA,SAAS,qBAAqB,KAAa,eAAoC;AAC7E,MAAI,CAAC,eAAe,IAAI,GAAG,KAAK,eAAe,QAAQ,6BAA6B;AAClF,mCAA+B;AAAA,EACjC;AACA,iBAAe,IAAI,KAAK,EAAE,eAAe,WAAW,KAAK,IAAI,IAAI,uBAAuB,CAAC;AAC3F;AASA,eAAe,yBAAyB,cAAsB,iBAAgF;AAC5I,QAAM,eAAe,gBAAgB;AACrC,MAAI,gBAAgB,KAAM,QAAO;AAajC,QAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,QAAM,MAAM,kBAAkB,cAAc,UAAU,YAAY;AAElE,QAAM,SAAS,eAAe,IAAI,GAAG;AACrC,MAAI,WAAW,QAAW;AACxB,QAAI,OAAO,YAAY,KAAK,IAAI,EAAG,QAAO,OAAO;AACjD,mBAAe,OAAO,GAAG;AAAA,EAC3B;AAEA,QAAM,WAAW,oBAAoB,IAAI,GAAG;AAC5C,MAAI,aAAa,OAAW,QAAO;AAEnC,QAAM,oBAAoB,YAAY;AACpC,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,eAAe;AAClD,UAAM,gBAAgB,MAAM,UAAU,IAAI,IAAI,YAAY,GAAG,UAAU,YAAY;AACnF,yBAAqB,KAAK,aAAa;AACvC,WAAO;AAAA,EACT,GAAG;AAEH,sBAAoB,IAAI,KAAK,gBAAgB;AAC7C,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,wBAAoB,OAAO,GAAG;AAAA,EAChC;AACF;;;AC7VO,IAAM,yBAAyB;AAa/B,IAAM,sBAAsB;AAQ5B,SAAS,iBAAiB,OAA8B;AAC7D,QAAM,cAAc,MAAM;AAC1B,SAAO,OAAO,gBAAgB,YAAY,YAAY,UAAU,EAAE,WAAW,sBAAsB;AACrG;AA6BO,SAAS,oBAAoB,OAA8C;AAChF,QAAM,cAAc,MAAM;AAC1B,MAAI,OAAO,gBAAgB,SAAU,QAAO;AAC5C,QAAM,UAAU,YAAY,UAAU;AACtC,MAAI,CAAC,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AAErD,QAAM,OAAO,QAAQ,MAAM,oBAAoB,MAAM,EAAE,UAAU;AAEjE,QAAM,QAAQ,KAAK,MAAM,mCAAmC;AAC5D,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,CAAC,EAAE,OAAO,QAAQ,IAAI,IAAI;AAChC,SAAO,EAAE,OAAO,QAA8C,KAAK;AACrE;;;AEzFA,SAAS,WAAW,qBAAqB;ADqBzC,IAAM,mBAAmB;AAElB,SAAS,qBAAqB,KAAuD;AAC1F,QAAM,QAAQ,uFAAuF,KAAK,GAAG;AAC7G,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,KAAK,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC;AACzC,QAAM,SAAS,KAAK,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC;AAC1C,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,CAAC,OAAO,SAAS,MAAM,EAAG,QAAO;AAChE,MAAI,SAAS,KAAK,UAAU,KAAK,QAAQ,oBAAoB,SAAS,iBAAkB,QAAO;AAC/F,SAAO,EAAE,OAAO,OAAO;AACzB;AC+CO,SAAS,YAAY,OAAe,QAA8C;AACvF,QAAM,MAAM,SAAS,KAAK;AAC1B,MAAI,CAAC,IAAK,QAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAEtD,MAAI,IAAI,SAAS;AAKf,WAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB;EACpD;AACA,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,uBAAuB,IAAI,GAAG;AACjC,WAAO,EAAE,IAAI,OAAO,QAAQ,kBAAkB;EAChD;AAEA,sBAAoB,MAAM,QAAQ,IAAI;AAEtC,QAAM,aAAa,IAAI,cAAc;AACrC,QAAM,aAAa,WAAW,kBAAkB,IAAI;AAOpD,QAAM,YAAY,SAAS,UAAU;AACrC,MAAI,CAAC,aAAa,CAAC,uBAAuB,UAAU,eAAe,GAAG;AACpE,WAAO,EAAE,IAAI,OAAO,QAAQ,uCAAuC;EACrE;AAEA,SAAO,EAAE,IAAI,MAAM,KAAK,WAAW;AACrC;AAEA,IAAM,oBAAoB;AAW1B,IAAM,oBAAoB;AAU1B,IAAM,sBAAsB;AAgB5B,SAAS,sBAAsB,IAAsB;AACnD,SAAO,GAAG,iBAAiB,qBAAqB,GAAG,UAAU;AAC/D;AAUA,SAAS,uBAAuB,IAA+C;AAC7E,SAAO,MAAM,QAAQ,GAAG,cAAc,SAAS,sBAAsB,EAAE;AACzE;AAWA,SAAS,SAAS,QAAgB;AAChC,MAAI;AACF,WAAO,IAAI,UAAU,EAAE,SAAS,MAAM,OAAU,CAAC,EAAE,gBAAgB,QAAQ,eAAe;EAC5F,QAAQ;AACN,WAAO;EACT;AACF;AAWA,IAAM,mBAAmB,oBAAI,IAAI;EAC/B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;AACF,CAAC;AAED,IAAM,8BAA8B;AACpC,IAAM,eAAe;AAErB,SAAS,oBAAoB,IAAa,QAA2B,QAAuB;AAC1F,qBAAmB,IAAI,QAAQ,MAAM;AAErC,MAAI,GAAG,cAAc,SAAS;AAG5B,OAAG,cAAc,kBAAkB,GAAG,eAAe,EAAE;AACvD;EACF;AAEA,aAAW,SAAS,MAAM,KAAK,GAAG,UAAU,GAAG;AAC7C,QAAI,MAAM,aAAa,6BAA6B;AAClD,SAAG,YAAY,KAAK;AACpB;IACF;AACA,QAAI,MAAM,aAAa,aAAc;AACrC,UAAM,UAAU;AAMhB,QAAI,CAAC,sBAAsB,OAAO,KAAK,CAAC,iBAAiB,IAAI,QAAQ,aAAa,QAAQ,QAAQ,GAAG;AACnG,SAAG,YAAY,OAAO;AACtB;IACF;AACA,wBAAoB,SAAS,QAAQ,KAAK;EAC5C;AACF;AAEA,SAAS,mBAAmB,IAAa,QAA2B,QAAuB;AACzF,aAAW,QAAQ,MAAM,KAAK,GAAG,UAAU,GAAG;AAC5C,UAAM,YAAY,KAAK,aAAa,KAAK;AACzC,QAAI,OAAO,KAAK,SAAS,GAAG;AAC1B,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,SAAS;AACzB,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,UAAU,KAAK,iBAAiB,mBAAmB;AAcnE,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,QAAQ;AACxB,YAAM,iBAAiB,kBAAkB,KAAK,OAAO,MAAM;AAC3D,UAAI,mBAAmB,MAAM;AAC3B,WAAG,oBAAoB,IAAI;MAC7B,OAAO;AACL,aAAK,QAAQ;MACf;AACA;IACF;AACA,QAAI,8BAA8B,IAAI,SAAS,GAAG;AAChD,UAAI,CAAC,iBAAiB,KAAK,KAAK,GAAG;AACjC,WAAG,oBAAoB,IAAI;MAC7B;AACA;IACF;AACA,QAAI,KAAK,SAAS,WAAW,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC3D,UAAI,CAAC,UAAU,CAAC,oCAAoC,IAAI,GAAG;AACzD,WAAG,oBAAoB,IAAI;MAC7B;IACF;EACF;AACF;AAoBA,SAAS,oCAAoC,MAAqB;AAChE,MAAI,KAAK,SAAS,QAAS,QAAO;AAClC,SAAO,KAAK,SAAS,iBAAiB,KAAK,UAAU;AACvD;AAQA,IAAM,gCAAgC,oBAAI,IAAI;EAC5C;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;AACF,CAAC;AAED,IAAM,mBAAmB;AAWzB,SAAS,iBAAiB,UAA2B;AAOnD,QAAM,UAAU,MAAM,KAAK,YAAY,QAAQ,EAAE,SAAS,gBAAgB,CAAC;AAC3E,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,SAAO,QAAQ,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,MAAM,OAAO,KAAK,EAAE,WAAW,GAAG,CAAC;AACtE;AAGA,SAAS,kBAAkB,UAAkB,QAA0C;AACrF,QAAM,QAAQ,SAAS,KAAK;AAC5B,MAAI,MAAM,WAAW,GAAG,EAAG,QAAO;AAClC,MAAI,gBAAgB,KAAK,KAAK,EAAG,QAAO;AACxC,MAAI,UAAU,KAAK,KAAK,EAAG,QAAO;AAClC,MAAI,MAAM,WAAW,IAAI,EAAG,QAAO;AACnC,MAAI,OAAO,iBAAiB,eAAe,KAAK,KAAK,EAAG,QAAO;AAC/D,SAAO;AACT;AA6CA,SAAS,kBAAkB,KAAqB;AAM9C,QAAM,kBAAkB,IAAI,QAAQ,qBAAqB,GAAG;AAC5D,MAAI,MAAM,YAAY,eAAe;AACrC,QAAM,IAAI,QAAQ,sBAAsB,EAAE;AAC1C,QAAM,IAAI,QAAQ,kBAAkB,CAAC,OAAO,QAAQ,WAAY,OAAO,KAAK,EAAE,WAAW,GAAG,IAAI,QAAQ,MAAO;AAC/G,SAAO;AACT;AAaA,SAAS,YAAY,KAAqB;AACxC,SAAO,IAAI,QAAQ,uDAAuD,CAAC,QAAQ,KAAyB,YAAgC;AAC1I,QAAI,QAAQ,QAAW;AACrB,YAAM,YAAY,OAAO,SAAS,KAAK,EAAE;AACzC,UAAI,cAAc,KAAK,YAAY,WAAa,aAAa,SAAU,aAAa,MAAS,QAAO;AACpG,aAAO,OAAO,cAAc,SAAS;IACvC;AACA,QAAI,YAAY,OAAW,QAAO;AAClC,WAAO;EACT,CAAC;AACH;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crowi/plugin-api",
-  "version": "1.0.0-alpha.6",
+  "version": "1.0.0-alpha.8",
   "description": "Type-only contract for Crowi 2.0 plugins. See docs/rfcs/0001-plugin-architecture.md.",
   "repository": {
     "type": "git",
@@ -41,7 +41,8 @@
     "@crowi/tsconfig": "0.1.0-alpha.0"
   },
   "dependencies": {
-    "@xmldom/xmldom": "^0.9.10"
+    "@xmldom/xmldom": "^0.9.10",
+    "openid-client": "^6.8.4"
   },
   "scripts": {
     "build": "tsup",