0.29.1原版

proto/README.md

@@ -0,0 +1,17 @@
+# Guide
+
+## Prerequisites
+
+- [buf](https://docs.buf.build/installation)
+
+## Generate
+
+```sh
+buf generate
+```
+
+## Format
+
+```sh
+buf format -w
+```

proto/api/v1/README.md

@@ -0,0 +1,3 @@
+# Memos API Design
+
+This API design should follow the guidelines and best practices outlined in the [Google API Improvement Proposals (AIPs)](https://google.aip.dev/).

proto/api/v1/ai_service.proto

@@ -0,0 +1,46 @@
+syntax = "proto3";
+
+package memos.api.v1;
+
+import "google/api/annotations.proto";
+import "google/api/client.proto";
+import "google/api/field_behavior.proto";
+
+option go_package = "gen/api/v1";
+
+service AIService {
+  // Transcribe transcribes an audio file using an instance AI provider.
+  rpc Transcribe(TranscribeRequest) returns (TranscribeResponse) {
+    option (google.api.http) = {
+      post: "/api/v1/ai:transcribe"
+      body: "*"
+    };
+    option (google.api.method_signature) = "audio";
+  }
+}
+
+message TranscribeRequest {
+  // Required. Audio input.
+  TranscriptionAudio audio = 1 [(google.api.field_behavior) = REQUIRED];
+}
+
+message TranscriptionAudio {
+  oneof source {
+    // Inline audio bytes.
+    bytes content = 1 [(google.api.field_behavior) = INPUT_ONLY];
+
+    // URI for audio content. Reserved for future use.
+    string uri = 2;
+  }
+
+  // Optional. The uploaded filename.
+  string filename = 3 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The MIME type of the input audio.
+  string content_type = 4 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message TranscribeResponse {
+  // The transcribed text.
+  string text = 1;
+}

proto/api/v1/attachment_service.proto

@@ -0,0 +1,185 @@
+syntax = "proto3";
+
+package memos.api.v1;
+
+import "google/api/annotations.proto";
+import "google/api/client.proto";
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/field_mask.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "gen/api/v1";
+
+service AttachmentService {
+  // CreateAttachment creates a new attachment.
+  rpc CreateAttachment(CreateAttachmentRequest) returns (Attachment) {
+    option (google.api.http) = {
+      post: "/api/v1/attachments"
+      body: "attachment"
+    };
+    option (google.api.method_signature) = "attachment";
+  }
+  // ListAttachments lists all attachments.
+  rpc ListAttachments(ListAttachmentsRequest) returns (ListAttachmentsResponse) {
+    option (google.api.http) = {get: "/api/v1/attachments"};
+  }
+  // GetAttachment returns an attachment by name.
+  rpc GetAttachment(GetAttachmentRequest) returns (Attachment) {
+    option (google.api.http) = {get: "/api/v1/{name=attachments/*}"};
+    option (google.api.method_signature) = "name";
+  }
+  // UpdateAttachment updates an attachment.
+  rpc UpdateAttachment(UpdateAttachmentRequest) returns (Attachment) {
+    option (google.api.http) = {
+      patch: "/api/v1/{attachment.name=attachments/*}"
+      body: "attachment"
+    };
+    option (google.api.method_signature) = "attachment,update_mask";
+  }
+  // DeleteAttachment deletes an attachment by name.
+  rpc DeleteAttachment(DeleteAttachmentRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {delete: "/api/v1/{name=attachments/*}"};
+    option (google.api.method_signature) = "name";
+  }
+  // BatchDeleteAttachments deletes multiple attachments in one request.
+  rpc BatchDeleteAttachments(BatchDeleteAttachmentsRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {
+      post: "/api/v1/attachments:batchDelete"
+      body: "*"
+    };
+  }
+}
+
+enum MotionMediaFamily {
+  MOTION_MEDIA_FAMILY_UNSPECIFIED = 0;
+  APPLE_LIVE_PHOTO = 1;
+  ANDROID_MOTION_PHOTO = 2;
+}
+
+enum MotionMediaRole {
+  MOTION_MEDIA_ROLE_UNSPECIFIED = 0;
+  STILL = 1;
+  VIDEO = 2;
+  CONTAINER = 3;
+}
+
+message MotionMedia {
+  MotionMediaFamily family = 1;
+  MotionMediaRole role = 2;
+  string group_id = 3;
+  int64 presentation_timestamp_us = 4;
+  bool has_embedded_video = 5;
+}
+
+message Attachment {
+  option (google.api.resource) = {
+    type: "memos.api.v1/Attachment"
+    pattern: "attachments/{attachment}"
+    singular: "attachment"
+    plural: "attachments"
+  };
+
+  // The name of the attachment.
+  // Format: attachments/{attachment}
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // Output only. The creation timestamp.
+  google.protobuf.Timestamp create_time = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // The filename of the attachment.
+  string filename = 3 [(google.api.field_behavior) = REQUIRED];
+
+  // Input only. The content of the attachment.
+  bytes content = 4 [(google.api.field_behavior) = INPUT_ONLY];
+
+  // Optional. The external link of the attachment.
+  string external_link = 5 [(google.api.field_behavior) = OPTIONAL];
+
+  // The MIME type of the attachment.
+  string type = 6 [(google.api.field_behavior) = REQUIRED];
+
+  // Output only. The size of the attachment in bytes.
+  int64 size = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Optional. The related memo. Refer to `Memo.name`.
+  // Format: memos/{memo}
+  optional string memo = 8 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. Motion media metadata.
+  MotionMedia motion_media = 9 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message CreateAttachmentRequest {
+  // Required. The attachment to create.
+  Attachment attachment = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. The attachment ID to use for this attachment.
+  // If empty, a unique ID will be generated.
+  string attachment_id = 2 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message ListAttachmentsRequest {
+  // Optional. The maximum number of attachments to return.
+  // The service may return fewer than this value.
+  // If unspecified, at most 50 attachments will be returned.
+  // The maximum value is 1000; values above 1000 will be coerced to 1000.
+  int32 page_size = 1 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. A page token, received from a previous `ListAttachments` call.
+  // Provide this to retrieve the subsequent page.
+  string page_token = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. Filter to apply to the list results.
+  // Example: "mime_type==\"image/png\"" or "filename.contains(\"test\")"
+  // Supported operators: =, !=, <, <=, >, >=, : (contains), in
+  // Supported fields: filename, mime_type, create_time, memo
+  string filter = 3 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The order to sort results by.
+  // Example: "create_time desc" or "filename asc"
+  string order_by = 4 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message ListAttachmentsResponse {
+  // The list of attachments.
+  repeated Attachment attachments = 1;
+
+  // A token that can be sent as `page_token` to retrieve the next page.
+  // If this field is omitted, there are no subsequent pages.
+  string next_page_token = 2;
+
+  // The total count of attachments (may be approximate).
+  int32 total_size = 3;
+}
+
+message GetAttachmentRequest {
+  // Required. The attachment name of the attachment to retrieve.
+  // Format: attachments/{attachment}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Attachment"}
+  ];
+}
+
+message UpdateAttachmentRequest {
+  // Required. The attachment which replaces the attachment on the server.
+  Attachment attachment = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Required. The list of fields to update.
+  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+message DeleteAttachmentRequest {
+  // Required. The attachment name of the attachment to delete.
+  // Format: attachments/{attachment}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Attachment"}
+  ];
+}
+
+message BatchDeleteAttachmentsRequest {
+  repeated string names = 1 [(google.api.field_behavior) = REQUIRED];
+}

proto/api/v1/auth_service.proto

@@ -0,0 +1,115 @@
+syntax = "proto3";
+
+package memos.api.v1;
+
+import "api/v1/user_service.proto";
+import "google/api/annotations.proto";
+import "google/api/field_behavior.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "gen/api/v1";
+
+service AuthService {
+  // GetCurrentUser returns the authenticated user's information.
+  // Validates the access token and returns user details.
+  // Similar to OIDC's /userinfo endpoint.
+  rpc GetCurrentUser(GetCurrentUserRequest) returns (GetCurrentUserResponse) {
+    option (google.api.http) = {get: "/api/v1/auth/me"};
+  }
+
+  // SignIn authenticates a user with credentials and returns tokens.
+  // On success, returns an access token and sets a refresh token cookie.
+  // Supports password-based and SSO authentication methods.
+  rpc SignIn(SignInRequest) returns (SignInResponse) {
+    option (google.api.http) = {
+      post: "/api/v1/auth/signin"
+      body: "*"
+    };
+  }
+
+  // SignOut terminates the user's authentication.
+  // Revokes the refresh token and clears the authentication cookie.
+  rpc SignOut(SignOutRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {post: "/api/v1/auth/signout"};
+  }
+
+  // RefreshToken exchanges a valid refresh token for a new access token.
+  // The refresh token is read from the HttpOnly cookie.
+  // Returns a new short-lived access token.
+  rpc RefreshToken(RefreshTokenRequest) returns (RefreshTokenResponse) {
+    option (google.api.http) = {
+      post: "/api/v1/auth/refresh"
+      body: "*"
+    };
+  }
+}
+
+message GetCurrentUserRequest {}
+
+message GetCurrentUserResponse {
+  // The authenticated user's information.
+  User user = 1;
+}
+
+message SignInRequest {
+  // Nested message for password-based authentication credentials.
+  message PasswordCredentials {
+    // The username to sign in with.
+    string username = 1 [(google.api.field_behavior) = REQUIRED];
+
+    // The password to sign in with.
+    string password = 2 [(google.api.field_behavior) = REQUIRED];
+  }
+
+  // Nested message for SSO authentication credentials.
+  message SSOCredentials {
+    // The resource name of the SSO provider.
+    // Format: identity-providers/{uid}
+    string idp_name = 1 [(google.api.field_behavior) = REQUIRED];
+
+    // The authorization code from the SSO provider.
+    string code = 2 [(google.api.field_behavior) = REQUIRED];
+
+    // The redirect URI used in the SSO flow.
+    string redirect_uri = 3 [(google.api.field_behavior) = REQUIRED];
+
+    // The PKCE code verifier for enhanced security (RFC 7636).
+    // Optional - enables PKCE flow protection against authorization code interception.
+    string code_verifier = 4 [(google.api.field_behavior) = OPTIONAL];
+  }
+
+  // Authentication credentials. Provide one method.
+  oneof credentials {
+    // Username and password authentication.
+    PasswordCredentials password_credentials = 1;
+
+    // SSO provider authentication.
+    SSOCredentials sso_credentials = 2;
+  }
+}
+
+message SignInResponse {
+  // The authenticated user's information.
+  User user = 1;
+
+  // The short-lived access token for API requests.
+  // Store in memory only, not in localStorage.
+  string access_token = 2;
+
+  // When the access token expires.
+  // Client should call RefreshToken before this time.
+  google.protobuf.Timestamp access_token_expires_at = 3;
+}
+
+message SignOutRequest {}
+
+message RefreshTokenRequest {}
+
+message RefreshTokenResponse {
+  // The new short-lived access token.
+  string access_token = 1;
+
+  // When the access token expires.
+  google.protobuf.Timestamp expires_at = 2;
+}

proto/api/v1/common.proto

@@ -0,0 +1,23 @@
+syntax = "proto3";
+
+package memos.api.v1;
+
+option go_package = "gen/api/v1";
+
+enum State {
+  STATE_UNSPECIFIED = 0;
+  NORMAL = 1;
+  ARCHIVED = 2;
+}
+
+// Used internally for obfuscating the page token.
+message PageToken {
+  int32 limit = 1;
+  int32 offset = 2;
+}
+
+enum Direction {
+  DIRECTION_UNSPECIFIED = 0;
+  ASC = 1;
+  DESC = 2;
+}

proto/api/v1/idp_service.proto

@@ -0,0 +1,147 @@
+syntax = "proto3";
+
+package memos.api.v1;
+
+import "google/api/annotations.proto";
+import "google/api/client.proto";
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/field_mask.proto";
+
+option go_package = "gen/api/v1";
+
+service IdentityProviderService {
+  // ListIdentityProviders lists identity providers.
+  rpc ListIdentityProviders(ListIdentityProvidersRequest) returns (ListIdentityProvidersResponse) {
+    option (google.api.http) = {get: "/api/v1/identity-providers"};
+  }
+
+  // GetIdentityProvider gets an identity provider.
+  rpc GetIdentityProvider(GetIdentityProviderRequest) returns (IdentityProvider) {
+    option (google.api.http) = {get: "/api/v1/{name=identity-providers/*}"};
+    option (google.api.method_signature) = "name";
+  }
+
+  // CreateIdentityProvider creates an identity provider.
+  rpc CreateIdentityProvider(CreateIdentityProviderRequest) returns (IdentityProvider) {
+    option (google.api.http) = {
+      post: "/api/v1/identity-providers"
+      body: "identity_provider"
+    };
+    option (google.api.method_signature) = "identity_provider";
+  }
+
+  // UpdateIdentityProvider updates an identity provider.
+  rpc UpdateIdentityProvider(UpdateIdentityProviderRequest) returns (IdentityProvider) {
+    option (google.api.http) = {
+      patch: "/api/v1/{identity_provider.name=identity-providers/*}"
+      body: "identity_provider"
+    };
+    option (google.api.method_signature) = "identity_provider,update_mask";
+  }
+
+  // DeleteIdentityProvider deletes an identity provider.
+  rpc DeleteIdentityProvider(DeleteIdentityProviderRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {delete: "/api/v1/{name=identity-providers/*}"};
+    option (google.api.method_signature) = "name";
+  }
+}
+
+message IdentityProvider {
+  option (google.api.resource) = {
+    type: "memos.api.v1/IdentityProvider"
+    pattern: "identity-providers/{idp}"
+    name_field: "name"
+    singular: "identityProvider"
+    plural: "identityProviders"
+  };
+
+  // The resource name of the identity provider.
+  // Format: identity-providers/{idp}
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // Required. The type of the identity provider.
+  Type type = 2 [(google.api.field_behavior) = REQUIRED];
+
+  // Required. The display title of the identity provider.
+  string title = 3 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. Filter applied to user identifiers.
+  string identifier_filter = 4 [(google.api.field_behavior) = OPTIONAL];
+
+  // Required. Configuration for the identity provider.
+  IdentityProviderConfig config = 5 [(google.api.field_behavior) = REQUIRED];
+
+  enum Type {
+    TYPE_UNSPECIFIED = 0;
+    // OAuth2 identity provider.
+    OAUTH2 = 1;
+  }
+}
+
+message IdentityProviderConfig {
+  oneof config {
+    OAuth2Config oauth2_config = 1;
+  }
+}
+
+message FieldMapping {
+  string identifier = 1;
+  string display_name = 2;
+  string email = 3;
+  string avatar_url = 4;
+}
+
+message OAuth2Config {
+  string client_id = 1;
+  string client_secret = 2;
+  string auth_url = 3;
+  string token_url = 4;
+  string user_info_url = 5;
+  repeated string scopes = 6;
+  FieldMapping field_mapping = 7;
+}
+
+message ListIdentityProvidersRequest {}
+
+message ListIdentityProvidersResponse {
+  // The list of identity providers.
+  repeated IdentityProvider identity_providers = 1;
+}
+
+message GetIdentityProviderRequest {
+  // Required. The resource name of the identity provider to get.
+  // Format: identity-providers/{idp}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/IdentityProvider"}
+  ];
+}
+
+message CreateIdentityProviderRequest {
+  // Required. The identity provider to create.
+  IdentityProvider identity_provider = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. The ID to use for the identity provider, which will become the final component of the resource name.
+  // If not provided, the system will generate one.
+  string identity_provider_id = 2 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message UpdateIdentityProviderRequest {
+  // Required. The identity provider to update.
+  IdentityProvider identity_provider = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Required. The update mask applies to the resource. Only the top level fields of
+  // IdentityProvider are supported.
+  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+message DeleteIdentityProviderRequest {
+  // Required. The resource name of the identity provider to delete.
+  // Format: identity-providers/{idp}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/IdentityProvider"}
+  ];
+}

proto/api/v1/instance_service.proto

@@ -0,0 +1,347 @@
+syntax = "proto3";
+
+package memos.api.v1;
+
+import "api/v1/user_service.proto";
+import "google/api/annotations.proto";
+import "google/api/client.proto";
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/field_mask.proto";
+import "google/protobuf/timestamp.proto";
+import "google/type/color.proto";
+
+option go_package = "gen/api/v1";
+
+service InstanceService {
+  // Gets the instance profile.
+  rpc GetInstanceProfile(GetInstanceProfileRequest) returns (InstanceProfile) {
+    option (google.api.http) = {get: "/api/v1/instance/profile"};
+  }
+
+  // Gets an instance setting.
+  rpc GetInstanceSetting(GetInstanceSettingRequest) returns (InstanceSetting) {
+    option (google.api.http) = {get: "/api/v1/{name=instance/settings/*}"};
+    option (google.api.method_signature) = "name";
+  }
+
+  // Batch gets instance settings.
+  rpc BatchGetInstanceSettings(BatchGetInstanceSettingsRequest) returns (BatchGetInstanceSettingsResponse) {
+    option (google.api.http) = {
+      post: "/api/v1/instance/settings:batchGet"
+      body: "*"
+    };
+  }
+
+  // Updates an instance setting.
+  rpc UpdateInstanceSetting(UpdateInstanceSettingRequest) returns (InstanceSetting) {
+    option (google.api.http) = {
+      patch: "/api/v1/{setting.name=instance/settings/*}"
+      body: "setting"
+    };
+    option (google.api.method_signature) = "setting,update_mask";
+  }
+
+  // Tests notification email delivery with the provided or stored SMTP settings.
+  rpc TestInstanceEmailSetting(TestInstanceEmailSettingRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {
+      post: "/api/v1/instance/settings/notification:testEmail"
+      body: "*"
+    };
+  }
+
+  // GetInstanceStats returns resource usage statistics for the instance. Admin only.
+  rpc GetInstanceStats(GetInstanceStatsRequest) returns (InstanceStats) {
+    option (google.api.http) = {get: "/api/v1/instance/stats"};
+  }
+}
+
+// Instance profile message containing basic instance information.
+message InstanceProfile {
+  // Version is the current version of instance.
+  string version = 2;
+
+  // Demo indicates if the instance is in demo mode.
+  bool demo = 3;
+
+  // Instance URL is the URL of the instance.
+  string instance_url = 6;
+
+  // The first administrator who set up this instance.
+  // When null, instance requires initial setup (creating the first admin account).
+  User admin = 7;
+
+  // Commit is the current build commit of instance.
+  string commit = 8;
+}
+
+// Request for instance profile.
+message GetInstanceProfileRequest {}
+
+// An instance setting resource.
+message InstanceSetting {
+  option (google.api.resource) = {
+    type: "memos.api.v1/InstanceSetting"
+    pattern: "instance/settings/{setting}"
+    singular: "instanceSetting"
+    plural: "instanceSettings"
+  };
+
+  // The name of the instance setting.
+  // Format: instance/settings/{setting}
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  oneof value {
+    GeneralSetting general_setting = 2;
+    StorageSetting storage_setting = 3;
+    MemoRelatedSetting memo_related_setting = 4;
+    TagsSetting tags_setting = 5;
+    NotificationSetting notification_setting = 6;
+    AISetting ai_setting = 7;
+  }
+
+  // Enumeration of instance setting keys.
+  enum Key {
+    KEY_UNSPECIFIED = 0;
+    // GENERAL is the key for general settings.
+    GENERAL = 1;
+    // STORAGE is the key for storage settings.
+    STORAGE = 2;
+    // MEMO_RELATED is the key for memo related settings.
+    MEMO_RELATED = 3;
+    // TAGS is the key for tag metadata.
+    TAGS = 4;
+    // NOTIFICATION is the key for notification transport settings.
+    NOTIFICATION = 5;
+    // AI is the key for AI provider settings.
+    AI = 6;
+  }
+
+  // General instance settings configuration.
+  message GeneralSetting {
+    // disallow_user_registration disallows user registration.
+    bool disallow_user_registration = 2;
+    // disallow_password_auth disallows password authentication.
+    bool disallow_password_auth = 3;
+    // additional_script is the additional script.
+    string additional_script = 4;
+    // additional_style is the additional style.
+    string additional_style = 5;
+    // custom_profile is the custom profile.
+    CustomProfile custom_profile = 6;
+    // week_start_day_offset is the week start day offset from Sunday.
+    // 0: Sunday, 1: Monday, 2: Tuesday, 3: Wednesday, 4: Thursday, 5: Friday, 6: Saturday
+    // Default is Sunday.
+    int32 week_start_day_offset = 7;
+
+    // disallow_change_username disallows changing username.
+    bool disallow_change_username = 8;
+    // disallow_change_nickname disallows changing nickname.
+    bool disallow_change_nickname = 9;
+
+    // Custom profile configuration for instance branding.
+    message CustomProfile {
+      string title = 1;
+      string description = 2;
+      string logo_url = 3;
+    }
+  }
+
+  // Storage configuration settings for instance attachments.
+  message StorageSetting {
+    // Storage type enumeration for different storage backends.
+    enum StorageType {
+      STORAGE_TYPE_UNSPECIFIED = 0;
+      // DATABASE is the database storage type.
+      DATABASE = 1;
+      // LOCAL is the local storage type.
+      LOCAL = 2;
+      // S3 is the S3 storage type.
+      S3 = 3;
+    }
+    // storage_type is the storage type.
+    StorageType storage_type = 1;
+    // The template of file path.
+    // e.g. assets/{timestamp}_{filename}
+    string filepath_template = 2;
+    // The max upload size in megabytes.
+    int64 upload_size_limit_mb = 3;
+
+    // S3 configuration for cloud storage backend.
+    // Reference: https://developers.cloudflare.com/r2/examples/aws/aws-sdk-go/
+    message S3Config {
+      string access_key_id = 1;
+      string access_key_secret = 2 [(google.api.field_behavior) = INPUT_ONLY];
+      string endpoint = 3;
+      string region = 4;
+      string bucket = 5;
+      bool use_path_style = 6;
+    }
+    // The S3 config.
+    S3Config s3_config = 4;
+  }
+
+  // Memo-related instance settings and policies.
+  message MemoRelatedSetting {
+    reserved 2;
+    reserved "display_with_update_time";
+    // content_length_limit is the limit of content length. Unit is byte.
+    int32 content_length_limit = 3;
+    // enable_double_click_edit enables editing on double click.
+    bool enable_double_click_edit = 4;
+    // reactions is the list of reactions.
+    repeated string reactions = 7;
+  }
+
+  // Metadata for a tag.
+  message TagMetadata {
+    // Optional background color for the tag label.
+    // When unset, the default tag color is used.
+    google.type.Color background_color = 1;
+    // Whether memos with this tag should have their content blurred.
+    bool blur_content = 2;
+  }
+
+  // Tag metadata configuration.
+  message TagsSetting {
+    // Map of tag name pattern to tag metadata.
+    // Each key is treated as an anchored regular expression (^pattern$),
+    // so a single entry like "project/.*" matches all tags under that prefix.
+    // Exact tag names are also valid (they are trivially valid regex patterns).
+    map<string, TagMetadata> tags = 1;
+  }
+
+  // Notification transport configuration.
+  message NotificationSetting {
+    EmailSetting email = 1;
+
+    // Email delivery configuration for notifications.
+    message EmailSetting {
+      bool enabled = 1;
+      string smtp_host = 2;
+      int32 smtp_port = 3;
+      string smtp_username = 4;
+      string smtp_password = 5 [(google.api.field_behavior) = INPUT_ONLY];
+      string from_email = 6;
+      string from_name = 7;
+      string reply_to = 8;
+      bool use_tls = 9;
+      bool use_ssl = 10;
+    }
+  }
+
+  // AI provider configuration settings.
+  message AISetting {
+    // providers is the list of AI provider configurations available instance-wide.
+    repeated AIProviderConfig providers = 1;
+
+    // transcription is the speech-to-text feature configuration.
+    // When unset or transcription.provider_id is empty, transcription is disabled.
+    TranscriptionConfig transcription = 2;
+  }
+
+  // AIProviderConfig represents one callable AI provider connection.
+  message AIProviderConfig {
+    string id = 1;
+    string title = 2;
+    AIProviderType type = 3;
+    string endpoint = 4;
+    // api_key is write-only and is never returned by GetInstanceSetting.
+    string api_key = 5 [(google.api.field_behavior) = INPUT_ONLY];
+    // api_key_set indicates whether an API key is stored for this provider.
+    bool api_key_set = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
+    // api_key_hint is a masked hint for the stored API key.
+    string api_key_hint = 9 [(google.api.field_behavior) = OUTPUT_ONLY];
+  }
+
+  // AIProviderType is the provider implementation type.
+  enum AIProviderType {
+    AI_PROVIDER_TYPE_UNSPECIFIED = 0;
+    OPENAI = 1;
+    GEMINI = 2;
+  }
+
+  // TranscriptionConfig configures the speech-to-text feature.
+  message TranscriptionConfig {
+    // provider_id references an entry in AISetting.providers[].id.
+    // Empty string means transcription is disabled.
+    string provider_id = 1;
+
+    // model is the provider-specific model identifier.
+    // Empty string falls back to the engine default
+    // (whisper-1 for OPENAI providers, gemini-2.5-flash for GEMINI providers).
+    string model = 2;
+
+    // language is the default ISO 639-1 language hint sent to the provider.
+    // Empty string lets the provider auto-detect.
+    string language = 3;
+
+    // prompt is a default spelling/vocabulary hint passed to the provider.
+    string prompt = 4;
+  }
+}
+
+// Request message for GetInstanceSetting method.
+message GetInstanceSettingRequest {
+  // The resource name of the instance setting.
+  // Format: instance/settings/{setting}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/InstanceSetting"}
+  ];
+}
+
+// Request message for BatchGetInstanceSettings method.
+message BatchGetInstanceSettingsRequest {
+  // The resource names of the instance settings.
+  // Format: instance/settings/{setting}
+  repeated string names = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/InstanceSetting"}
+  ];
+}
+
+// Response message for BatchGetInstanceSettings method.
+message BatchGetInstanceSettingsResponse {
+  // The instance settings in the same order as the input names.
+  repeated InstanceSetting settings = 1;
+}
+
+// Request message for UpdateInstanceSetting method.
+message UpdateInstanceSettingRequest {
+  // The instance setting resource which replaces the resource on the server.
+  InstanceSetting setting = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // The list of fields to update.
+  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Request message for TestInstanceEmailSetting method.
+message TestInstanceEmailSettingRequest {
+  // Optional. SMTP email settings to test. If omitted, the stored notification email setting is used.
+  InstanceSetting.NotificationSetting.EmailSetting email = 1 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. Recipient email address. If omitted, the current user's email address is used.
+  string recipient_email = 2 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Request message for GetInstanceStats.
+message GetInstanceStatsRequest {}
+
+// Resource usage statistics for the instance.
+message InstanceStats {
+  DatabaseStats database = 1;
+  // Recursive size of the data directory in bytes. -1 if unavailable.
+  int64 local_storage_bytes = 2;
+  // Server-side timestamp when the snapshot was generated.
+  google.protobuf.Timestamp generated_time = 4;
+
+  // Database size statistics.
+  message DatabaseStats {
+    // driver is one of "sqlite", "mysql", "postgres".
+    string driver = 1;
+    // size_bytes is the database size in bytes; -1 if unavailable.
+    int64 size_bytes = 2;
+  }
+}

proto/api/v1/memo_service.proto

@@ -0,0 +1,637 @@
+syntax = "proto3";
+
+package memos.api.v1;
+
+import "api/v1/attachment_service.proto";
+import "api/v1/common.proto";
+import "google/api/annotations.proto";
+import "google/api/client.proto";
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/field_mask.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "gen/api/v1";
+
+service MemoService {
+  // CreateMemo creates a memo.
+  rpc CreateMemo(CreateMemoRequest) returns (Memo) {
+    option (google.api.http) = {
+      post: "/api/v1/memos"
+      body: "memo"
+    };
+    option (google.api.method_signature) = "memo";
+  }
+  // ListMemos lists memos with pagination and filter.
+  rpc ListMemos(ListMemosRequest) returns (ListMemosResponse) {
+    option (google.api.http) = {get: "/api/v1/memos"};
+    option (google.api.method_signature) = "";
+  }
+  // GetMemo gets a memo.
+  rpc GetMemo(GetMemoRequest) returns (Memo) {
+    option (google.api.http) = {get: "/api/v1/{name=memos/*}"};
+    option (google.api.method_signature) = "name";
+  }
+  // UpdateMemo updates a memo.
+  rpc UpdateMemo(UpdateMemoRequest) returns (Memo) {
+    option (google.api.http) = {
+      patch: "/api/v1/{memo.name=memos/*}"
+      body: "memo"
+    };
+    option (google.api.method_signature) = "memo,update_mask";
+  }
+  // DeleteMemo deletes a memo.
+  rpc DeleteMemo(DeleteMemoRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {delete: "/api/v1/{name=memos/*}"};
+    option (google.api.method_signature) = "name";
+  }
+  // SetMemoAttachments sets attachments for a memo.
+  rpc SetMemoAttachments(SetMemoAttachmentsRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {
+      patch: "/api/v1/{name=memos/*}/attachments"
+      body: "*"
+    };
+    option (google.api.method_signature) = "name";
+  }
+  // ListMemoAttachments lists attachments for a memo.
+  rpc ListMemoAttachments(ListMemoAttachmentsRequest) returns (ListMemoAttachmentsResponse) {
+    option (google.api.http) = {get: "/api/v1/{name=memos/*}/attachments"};
+    option (google.api.method_signature) = "name";
+  }
+  // SetMemoRelations sets relations for a memo.
+  rpc SetMemoRelations(SetMemoRelationsRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {
+      patch: "/api/v1/{name=memos/*}/relations"
+      body: "*"
+    };
+    option (google.api.method_signature) = "name";
+  }
+  // ListMemoRelations lists relations for a memo.
+  rpc ListMemoRelations(ListMemoRelationsRequest) returns (ListMemoRelationsResponse) {
+    option (google.api.http) = {get: "/api/v1/{name=memos/*}/relations"};
+    option (google.api.method_signature) = "name";
+  }
+  // CreateMemoComment creates a comment for a memo.
+  rpc CreateMemoComment(CreateMemoCommentRequest) returns (Memo) {
+    option (google.api.http) = {
+      post: "/api/v1/{name=memos/*}/comments"
+      body: "comment"
+    };
+    option (google.api.method_signature) = "name,comment";
+  }
+  // ListMemoComments lists comments for a memo.
+  rpc ListMemoComments(ListMemoCommentsRequest) returns (ListMemoCommentsResponse) {
+    option (google.api.http) = {get: "/api/v1/{name=memos/*}/comments"};
+    option (google.api.method_signature) = "name";
+  }
+  // ListMemoReactions lists reactions for a memo.
+  rpc ListMemoReactions(ListMemoReactionsRequest) returns (ListMemoReactionsResponse) {
+    option (google.api.http) = {get: "/api/v1/{name=memos/*}/reactions"};
+    option (google.api.method_signature) = "name";
+  }
+  // UpsertMemoReaction upserts a reaction for a memo.
+  rpc UpsertMemoReaction(UpsertMemoReactionRequest) returns (Reaction) {
+    option (google.api.http) = {
+      post: "/api/v1/{name=memos/*}/reactions"
+      body: "*"
+    };
+    option (google.api.method_signature) = "name";
+  }
+  // DeleteMemoReaction deletes a reaction for a memo.
+  rpc DeleteMemoReaction(DeleteMemoReactionRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {delete: "/api/v1/{name=memos/*/reactions/*}"};
+    option (google.api.method_signature) = "name";
+  }
+  // CreateMemoShare creates a share link for a memo. Requires authentication as the memo creator.
+  rpc CreateMemoShare(CreateMemoShareRequest) returns (MemoShare) {
+    option (google.api.http) = {
+      post: "/api/v1/{parent=memos/*}/shares"
+      body: "memo_share"
+    };
+    option (google.api.method_signature) = "parent,memo_share";
+  }
+  // ListMemoShares lists all share links for a memo. Requires authentication as the memo creator.
+  rpc ListMemoShares(ListMemoSharesRequest) returns (ListMemoSharesResponse) {
+    option (google.api.http) = {get: "/api/v1/{parent=memos/*}/shares"};
+    option (google.api.method_signature) = "parent";
+  }
+  // DeleteMemoShare revokes a share link. Requires authentication as the memo creator.
+  rpc DeleteMemoShare(DeleteMemoShareRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {delete: "/api/v1/{name=memos/*/shares/*}"};
+    option (google.api.method_signature) = "name";
+  }
+  // GetMemoByShare resolves a share token to its memo. No authentication required.
+  // Returns NOT_FOUND if the token is invalid or expired.
+  rpc GetMemoByShare(GetMemoByShareRequest) returns (Memo) {
+    option (google.api.http) = {get: "/api/v1/shares/{share_id}"};
+  }
+  // GetLinkMetadata gets metadata for a link.
+  rpc GetLinkMetadata(GetLinkMetadataRequest) returns (LinkMetadata) {
+    option (google.api.http) = {get: "/api/v1/memos/-/linkMetadata"};
+  }
+  // BatchGetLinkMetadata gets metadata for links.
+  rpc BatchGetLinkMetadata(BatchGetLinkMetadataRequest) returns (BatchGetLinkMetadataResponse) {
+    option (google.api.http) = {
+      post: "/api/v1/memos/-/linkMetadata:batchGet"
+      body: "*"
+    };
+  }
+}
+
+enum Visibility {
+  VISIBILITY_UNSPECIFIED = 0;
+  PRIVATE = 1;
+  PROTECTED = 2;
+  PUBLIC = 3;
+}
+
+message Reaction {
+  option (google.api.resource) = {
+    type: "memos.api.v1/Reaction"
+    pattern: "memos/{memo}/reactions/{reaction}"
+    name_field: "name"
+    singular: "reaction"
+    plural: "reactions"
+  };
+
+  // The resource name of the reaction.
+  // Format: memos/{memo}/reactions/{reaction}
+  string name = 1 [
+    (google.api.field_behavior) = OUTPUT_ONLY,
+    (google.api.field_behavior) = IDENTIFIER
+  ];
+
+  // The resource name of the creator.
+  // Format: users/{user}
+  string creator = 2 [
+    (google.api.field_behavior) = OUTPUT_ONLY,
+    (google.api.resource_reference) = {type: "memos.api.v1/User"}
+  ];
+
+  // The resource name of the content.
+  // For memo reactions, this should be the memo's resource name.
+  // Format: memos/{memo}
+  string content_id = 3 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Memo"}
+  ];
+
+  // Required. The type of reaction (e.g., "👍", "❤️", "😄").
+  string reaction_type = 4 [(google.api.field_behavior) = REQUIRED];
+
+  // Output only. The creation timestamp.
+  google.protobuf.Timestamp create_time = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
+}
+
+message Memo {
+  option (google.api.resource) = {
+    type: "memos.api.v1/Memo"
+    pattern: "memos/{memo}"
+    name_field: "name"
+    singular: "memo"
+    plural: "memos"
+  };
+
+  // The resource name of the memo.
+  // Format: memos/{memo}, memo is the user defined id or uuid.
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // The state of the memo.
+  State state = 2 [(google.api.field_behavior) = REQUIRED];
+
+  // The name of the creator.
+  // Format: users/{user}
+  string creator = 3 [
+    (google.api.field_behavior) = OUTPUT_ONLY,
+    (google.api.resource_reference) = {type: "memos.api.v1/User"}
+  ];
+
+  // The creation timestamp.
+  // If not set on creation, the server will set it to the current time.
+  google.protobuf.Timestamp create_time = 4 [(google.api.field_behavior) = OPTIONAL];
+
+  // The last update timestamp.
+  // If not set on creation, the server will set it to the current time.
+  google.protobuf.Timestamp update_time = 5 [(google.api.field_behavior) = OPTIONAL];
+
+  reserved 6;
+  reserved "display_time";
+
+  // Required. The content of the memo in Markdown format.
+  string content = 7 [(google.api.field_behavior) = REQUIRED];
+
+  // The visibility of the memo.
+  Visibility visibility = 9 [(google.api.field_behavior) = REQUIRED];
+
+  // Output only. The tags extracted from the content.
+  repeated string tags = 10 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Whether the memo is pinned.
+  bool pinned = 11 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The attachments of the memo.
+  repeated Attachment attachments = 12 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The relations of the memo.
+  repeated MemoRelation relations = 13 [(google.api.field_behavior) = OPTIONAL];
+
+  // Output only. The reactions to the memo.
+  repeated Reaction reactions = 14 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The computed properties of the memo.
+  Property property = 15 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The name of the parent memo.
+  // Format: memos/{memo}
+  optional string parent = 16 [
+    (google.api.field_behavior) = OUTPUT_ONLY,
+    (google.api.resource_reference) = {type: "memos.api.v1/Memo"}
+  ];
+
+  // Output only. The snippet of the memo content. Plain text only.
+  string snippet = 17 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Optional. The location of the memo.
+  optional Location location = 18 [(google.api.field_behavior) = OPTIONAL];
+
+  // Computed properties of a memo.
+  message Property {
+    bool has_link = 1;
+    bool has_task_list = 2;
+    bool has_code = 3;
+    bool has_incomplete_tasks = 4;
+    // The title extracted from the first H1 heading, if present.
+    string title = 5;
+  }
+}
+
+message Location {
+  // A placeholder text for the location.
+  string placeholder = 1 [(google.api.field_behavior) = OPTIONAL];
+
+  // The latitude of the location.
+  double latitude = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // The longitude of the location.
+  double longitude = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message CreateMemoRequest {
+  // Required. The memo to create.
+  Memo memo = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. The memo ID to use for this memo.
+  // If empty, a unique ID will be generated.
+  string memo_id = 2 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message ListMemosRequest {
+  // Optional. The maximum number of memos to return.
+  // The service may return fewer than this value.
+  // If unspecified, at most 50 memos will be returned.
+  // The maximum value is 1000; values above 1000 will be coerced to 1000.
+  int32 page_size = 1 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. A page token, received from a previous `ListMemos` call.
+  // Provide this to retrieve the subsequent page.
+  string page_token = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The state of the memos to list.
+  // Default to `NORMAL`. Set to `ARCHIVED` to list archived memos.
+  State state = 3 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The order to sort results by.
+  // Default to "create_time desc".
+  // Supports comma-separated list of fields following AIP-132.
+  // Example: "pinned desc, create_time desc" or "update_time asc"
+  // Supported fields: pinned, create_time, update_time, name
+  string order_by = 4 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. Filter to apply to the list results.
+  // Filter is a CEL expression to filter memos.
+  // Refer to `Shortcut.filter`.
+  string filter = 5 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. If true, show deleted memos in the response.
+  bool show_deleted = 6 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message ListMemosResponse {
+  // The list of memos.
+  repeated Memo memos = 1;
+
+  // A token that can be sent as `page_token` to retrieve the next page.
+  // If this field is omitted, there are no subsequent pages.
+  string next_page_token = 2;
+}
+
+message GetMemoRequest {
+  // Required. The resource name of the memo.
+  // Format: memos/{memo}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Memo"}
+  ];
+}
+
+message UpdateMemoRequest {
+  // Required. The memo to update.
+  // The `name` field is required.
+  Memo memo = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Required. The list of fields to update.
+  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+message DeleteMemoRequest {
+  // Required. The resource name of the memo to delete.
+  // Format: memos/{memo}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Memo"}
+  ];
+
+  // Optional. If set to true, the memo will be deleted even if it has associated data.
+  bool force = 2 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message SetMemoAttachmentsRequest {
+  // Required. The resource name of the memo.
+  // Format: memos/{memo}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Memo"}
+  ];
+
+  // Required. The attachments to set for the memo.
+  repeated Attachment attachments = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+message ListMemoAttachmentsRequest {
+  // Required. The resource name of the memo.
+  // Format: memos/{memo}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Memo"}
+  ];
+
+  // Optional. The maximum number of attachments to return.
+  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. A page token for pagination.
+  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message ListMemoAttachmentsResponse {
+  // The list of attachments.
+  repeated Attachment attachments = 1;
+
+  // A token for the next page of results.
+  string next_page_token = 2;
+}
+
+message MemoRelation {
+  // The memo in the relation.
+  Memo memo = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // The related memo.
+  Memo related_memo = 2 [(google.api.field_behavior) = REQUIRED];
+
+  // The type of the relation.
+  enum Type {
+    TYPE_UNSPECIFIED = 0;
+    REFERENCE = 1;
+    COMMENT = 2;
+  }
+  Type type = 3 [(google.api.field_behavior) = REQUIRED];
+
+  // Memo reference in relations.
+  message Memo {
+    // The resource name of the memo.
+    // Format: memos/{memo}
+    string name = 1 [
+      (google.api.field_behavior) = REQUIRED,
+      (google.api.resource_reference) = {type: "memos.api.v1/Memo"}
+    ];
+
+    // Output only. The snippet of the memo content. Plain text only.
+    string snippet = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
+  }
+}
+
+message SetMemoRelationsRequest {
+  // Required. The resource name of the memo.
+  // Format: memos/{memo}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Memo"}
+  ];
+
+  // Required. The relations to set for the memo.
+  repeated MemoRelation relations = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+message ListMemoRelationsRequest {
+  // Required. The resource name of the memo.
+  // Format: memos/{memo}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Memo"}
+  ];
+
+  // Optional. The maximum number of relations to return.
+  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. A page token for pagination.
+  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message ListMemoRelationsResponse {
+  // The list of relations.
+  repeated MemoRelation relations = 1;
+
+  // A token for the next page of results.
+  string next_page_token = 2;
+}
+
+message CreateMemoCommentRequest {
+  // Required. The resource name of the memo.
+  // Format: memos/{memo}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Memo"}
+  ];
+
+  // Required. The comment to create.
+  Memo comment = 2 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. The comment ID to use.
+  string comment_id = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message ListMemoCommentsRequest {
+  // Required. The resource name of the memo.
+  // Format: memos/{memo}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Memo"}
+  ];
+
+  // Optional. The maximum number of comments to return.
+  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. A page token for pagination.
+  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The order to sort results by.
+  string order_by = 4 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message ListMemoCommentsResponse {
+  // The list of comment memos.
+  repeated Memo memos = 1;
+
+  // A token for the next page of results.
+  string next_page_token = 2;
+
+  // The total count of comments.
+  int32 total_size = 3;
+}
+
+message ListMemoReactionsRequest {
+  // Required. The resource name of the memo.
+  // Format: memos/{memo}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Memo"}
+  ];
+
+  // Optional. The maximum number of reactions to return.
+  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. A page token for pagination.
+  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message ListMemoReactionsResponse {
+  // The list of reactions.
+  repeated Reaction reactions = 1;
+
+  // A token for the next page of results.
+  string next_page_token = 2;
+
+  // The total count of reactions.
+  int32 total_size = 3;
+}
+
+message UpsertMemoReactionRequest {
+  // Required. The resource name of the memo.
+  // Format: memos/{memo}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Memo"}
+  ];
+
+  // Required. The reaction to upsert.
+  Reaction reaction = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+message DeleteMemoReactionRequest {
+  // Required. The resource name of the reaction to delete.
+  // Format: memos/{memo}/reactions/{reaction}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Reaction"}
+  ];
+}
+
+// MemoShare is an access grant that permits read-only access to a memo via an opaque bearer token.
+message MemoShare {
+  option (google.api.resource) = {
+    type: "memos.api.v1/MemoShare"
+    pattern: "memos/{memo}/shares/{share}"
+    singular: "share"
+    plural: "shares"
+  };
+
+  // The resource name of the share. Format: memos/{memo}/shares/{share}
+  // The {share} segment is the opaque token used in the share URL.
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // Output only. When this share link was created.
+  google.protobuf.Timestamp create_time = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Optional. When set, the share link stops working after this time.
+  // If unset, the link never expires.
+  optional google.protobuf.Timestamp expire_time = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message CreateMemoShareRequest {
+  // Required. The resource name of the memo to share.
+  // Format: memos/{memo}
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Memo"}
+  ];
+
+  // Required. The share to create.
+  MemoShare memo_share = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+message ListMemoSharesRequest {
+  // Required. The resource name of the memo.
+  // Format: memos/{memo}
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Memo"}
+  ];
+}
+
+message ListMemoSharesResponse {
+  // The list of share links.
+  repeated MemoShare memo_shares = 1;
+}
+
+message DeleteMemoShareRequest {
+  // Required. The resource name of the share to delete.
+  // Format: memos/{memo}/shares/{share}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/MemoShare"}
+  ];
+}
+
+message GetMemoByShareRequest {
+  // Required. The share token extracted from the share URL (/s/{share_id}).
+  string share_id = 1 [(google.api.field_behavior) = REQUIRED];
+}
+
+message GetLinkMetadataRequest {
+  // Required. The link URL.
+  string url = 1 [(google.api.field_behavior) = REQUIRED];
+}
+
+message BatchGetLinkMetadataRequest {
+  // Required. The link URLs.
+  repeated string urls = 1 [(google.api.field_behavior) = REQUIRED];
+}
+
+message BatchGetLinkMetadataResponse {
+  // The link metadata list, in the same order as the input URLs.
+  repeated LinkMetadata link_metadata = 1;
+}
+
+message LinkMetadata {
+  // The original link URL.
+  string url = 1;
+
+  // The link title.
+  string title = 2;
+
+  // The link description.
+  string description = 3;
+
+  // The link image URL.
+  string image = 4;
+}

proto/api/v1/shortcut_service.proto

@@ -0,0 +1,124 @@
+syntax = "proto3";
+
+package memos.api.v1;
+
+import "google/api/annotations.proto";
+import "google/api/client.proto";
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/field_mask.proto";
+
+option go_package = "gen/api/v1";
+
+service ShortcutService {
+  // ListShortcuts returns a list of shortcuts for a user.
+  rpc ListShortcuts(ListShortcutsRequest) returns (ListShortcutsResponse) {
+    option (google.api.http) = {get: "/api/v1/{parent=users/*}/shortcuts"};
+    option (google.api.method_signature) = "parent";
+  }
+
+  // GetShortcut gets a shortcut by name.
+  rpc GetShortcut(GetShortcutRequest) returns (Shortcut) {
+    option (google.api.http) = {get: "/api/v1/{name=users/*/shortcuts/*}"};
+    option (google.api.method_signature) = "name";
+  }
+
+  // CreateShortcut creates a new shortcut for a user.
+  rpc CreateShortcut(CreateShortcutRequest) returns (Shortcut) {
+    option (google.api.http) = {
+      post: "/api/v1/{parent=users/*}/shortcuts"
+      body: "shortcut"
+    };
+    option (google.api.method_signature) = "parent,shortcut";
+  }
+
+  // UpdateShortcut updates a shortcut for a user.
+  rpc UpdateShortcut(UpdateShortcutRequest) returns (Shortcut) {
+    option (google.api.http) = {
+      patch: "/api/v1/{shortcut.name=users/*/shortcuts/*}"
+      body: "shortcut"
+    };
+    option (google.api.method_signature) = "shortcut,update_mask";
+  }
+
+  // DeleteShortcut deletes a shortcut for a user.
+  rpc DeleteShortcut(DeleteShortcutRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {delete: "/api/v1/{name=users/*/shortcuts/*}"};
+    option (google.api.method_signature) = "name";
+  }
+}
+
+message Shortcut {
+  option (google.api.resource) = {
+    type: "memos.api.v1/Shortcut"
+    pattern: "users/{username}/shortcuts/{shortcut}"
+    singular: "shortcut"
+    plural: "shortcuts"
+  };
+
+  // The resource name of the shortcut.
+  // Format: users/{username}/shortcuts/{shortcut}
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // The title of the shortcut.
+  string title = 2 [(google.api.field_behavior) = REQUIRED];
+
+  // The filter expression for the shortcut.
+  string filter = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message ListShortcutsRequest {
+  // Required. The parent resource where shortcuts are listed.
+  // Format: users/{username}
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {child_type: "memos.api.v1/Shortcut"}
+  ];
+}
+
+message ListShortcutsResponse {
+  // The list of shortcuts.
+  repeated Shortcut shortcuts = 1;
+}
+
+message GetShortcutRequest {
+  // Required. The resource name of the shortcut to retrieve.
+  // Format: users/{username}/shortcuts/{shortcut}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Shortcut"}
+  ];
+}
+
+message CreateShortcutRequest {
+  // Required. The parent resource where this shortcut will be created.
+  // Format: users/{username}
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {child_type: "memos.api.v1/Shortcut"}
+  ];
+
+  // Required. The shortcut to create.
+  Shortcut shortcut = 2 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. If set, validate the request, but do not actually create the shortcut.
+  bool validate_only = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message UpdateShortcutRequest {
+  // Required. The shortcut resource which replaces the resource on the server.
+  Shortcut shortcut = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. The list of fields to update.
+  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message DeleteShortcutRequest {
+  // Required. The resource name of the shortcut to delete.
+  // Format: users/{username}/shortcuts/{shortcut}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/Shortcut"}
+  ];
+}

proto/api/v1/user_service.proto

@@ -0,0 +1,843 @@
+syntax = "proto3";
+
+package memos.api.v1;
+
+import "api/v1/common.proto";
+import "google/api/annotations.proto";
+import "google/api/client.proto";
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/field_mask.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "gen/api/v1";
+
+service UserService {
+  // ListUsers returns a list of users.
+  rpc ListUsers(ListUsersRequest) returns (ListUsersResponse) {
+    option (google.api.http) = {get: "/api/v1/users"};
+  }
+
+  // BatchGetUsers returns active users by usernames.
+  rpc BatchGetUsers(BatchGetUsersRequest) returns (BatchGetUsersResponse) {
+    option (google.api.http) = {
+      post: "/api/v1/users:batchGet"
+      body: "*"
+    };
+  }
+
+  // GetUser gets a user by username.
+  // Format: users/{username} (e.g., users/steven)
+  rpc GetUser(GetUserRequest) returns (User) {
+    option (google.api.http) = {get: "/api/v1/{name=users/*}"};
+    option (google.api.method_signature) = "name";
+  }
+
+  // CreateUser creates a new user.
+  rpc CreateUser(CreateUserRequest) returns (User) {
+    option (google.api.http) = {
+      post: "/api/v1/users"
+      body: "user"
+    };
+    option (google.api.method_signature) = "user";
+  }
+
+  // UpdateUser updates a user.
+  rpc UpdateUser(UpdateUserRequest) returns (User) {
+    option (google.api.http) = {
+      patch: "/api/v1/{user.name=users/*}"
+      body: "user"
+    };
+    option (google.api.method_signature) = "user,update_mask";
+  }
+
+  // DeleteUser deletes a user.
+  rpc DeleteUser(DeleteUserRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {delete: "/api/v1/{name=users/*}"};
+    option (google.api.method_signature) = "name";
+  }
+
+  // ListAllUserStats returns statistics for all users.
+  rpc ListAllUserStats(ListAllUserStatsRequest) returns (ListAllUserStatsResponse) {
+    option (google.api.http) = {get: "/api/v1/users:stats"};
+  }
+
+  // GetUserStats returns statistics for a specific user.
+  rpc GetUserStats(GetUserStatsRequest) returns (UserStats) {
+    option (google.api.http) = {get: "/api/v1/{name=users/*}:getStats"};
+    option (google.api.method_signature) = "name";
+  }
+
+  // GetUserSetting returns the user setting.
+  rpc GetUserSetting(GetUserSettingRequest) returns (UserSetting) {
+    option (google.api.http) = {get: "/api/v1/{name=users/*/settings/*}"};
+    option (google.api.method_signature) = "name";
+  }
+
+  // UpdateUserSetting updates the user setting.
+  rpc UpdateUserSetting(UpdateUserSettingRequest) returns (UserSetting) {
+    option (google.api.http) = {
+      patch: "/api/v1/{setting.name=users/*/settings/*}"
+      body: "setting"
+    };
+    option (google.api.method_signature) = "setting,update_mask";
+  }
+
+  // ListUserSettings returns a list of user settings.
+  rpc ListUserSettings(ListUserSettingsRequest) returns (ListUserSettingsResponse) {
+    option (google.api.http) = {get: "/api/v1/{parent=users/*}/settings"};
+    option (google.api.method_signature) = "parent";
+  }
+
+  // ListLinkedIdentities returns a list of linked SSO identities for a user.
+  rpc ListLinkedIdentities(ListLinkedIdentitiesRequest) returns (ListLinkedIdentitiesResponse) {
+    option (google.api.http) = {get: "/api/v1/{parent=users/*}/linkedIdentities"};
+    option (google.api.method_signature) = "parent";
+  }
+
+  // CreateLinkedIdentity links an SSO identity to the authenticated user.
+  rpc CreateLinkedIdentity(CreateLinkedIdentityRequest) returns (LinkedIdentity) {
+    option (google.api.http) = {
+      post: "/api/v1/{parent=users/*}/linkedIdentities"
+      body: "*"
+    };
+    option (google.api.method_signature) = "parent,idp_name";
+  }
+
+  // GetLinkedIdentity gets a linked SSO identity for a user.
+  rpc GetLinkedIdentity(GetLinkedIdentityRequest) returns (LinkedIdentity) {
+    option (google.api.http) = {get: "/api/v1/{name=users/*/linkedIdentities/*}"};
+    option (google.api.method_signature) = "name";
+  }
+
+  // DeleteLinkedIdentity unlinks an SSO identity from a user.
+  rpc DeleteLinkedIdentity(DeleteLinkedIdentityRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {delete: "/api/v1/{name=users/*/linkedIdentities/*}"};
+    option (google.api.method_signature) = "name";
+  }
+
+  // ListPersonalAccessTokens returns a list of Personal Access Tokens (PATs) for a user.
+  // PATs are long-lived tokens for API/script access, distinct from short-lived JWT access tokens.
+  rpc ListPersonalAccessTokens(ListPersonalAccessTokensRequest) returns (ListPersonalAccessTokensResponse) {
+    option (google.api.http) = {get: "/api/v1/{parent=users/*}/personalAccessTokens"};
+    option (google.api.method_signature) = "parent";
+  }
+
+  // CreatePersonalAccessToken creates a new Personal Access Token for a user.
+  // The token value is only returned once upon creation.
+  rpc CreatePersonalAccessToken(CreatePersonalAccessTokenRequest) returns (CreatePersonalAccessTokenResponse) {
+    option (google.api.http) = {
+      post: "/api/v1/{parent=users/*}/personalAccessTokens"
+      body: "*"
+    };
+  }
+
+  // DeletePersonalAccessToken deletes a Personal Access Token.
+  rpc DeletePersonalAccessToken(DeletePersonalAccessTokenRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {delete: "/api/v1/{name=users/*/personalAccessTokens/*}"};
+    option (google.api.method_signature) = "name";
+  }
+
+  // ListUserWebhooks returns a list of webhooks for a user.
+  rpc ListUserWebhooks(ListUserWebhooksRequest) returns (ListUserWebhooksResponse) {
+    option (google.api.http) = {get: "/api/v1/{parent=users/*}/webhooks"};
+    option (google.api.method_signature) = "parent";
+  }
+
+  // CreateUserWebhook creates a new webhook for a user.
+  rpc CreateUserWebhook(CreateUserWebhookRequest) returns (UserWebhook) {
+    option (google.api.http) = {
+      post: "/api/v1/{parent=users/*}/webhooks"
+      body: "webhook"
+    };
+    option (google.api.method_signature) = "parent,webhook";
+  }
+
+  // UpdateUserWebhook updates an existing webhook for a user.
+  rpc UpdateUserWebhook(UpdateUserWebhookRequest) returns (UserWebhook) {
+    option (google.api.http) = {
+      patch: "/api/v1/{webhook.name=users/*/webhooks/*}"
+      body: "webhook"
+    };
+    option (google.api.method_signature) = "webhook,update_mask";
+  }
+
+  // DeleteUserWebhook deletes a webhook for a user.
+  rpc DeleteUserWebhook(DeleteUserWebhookRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {delete: "/api/v1/{name=users/*/webhooks/*}"};
+    option (google.api.method_signature) = "name";
+  }
+
+  // ListUserNotifications lists notifications for a user.
+  rpc ListUserNotifications(ListUserNotificationsRequest) returns (ListUserNotificationsResponse) {
+    option (google.api.http) = {get: "/api/v1/{parent=users/*}/notifications"};
+    option (google.api.method_signature) = "parent";
+  }
+
+  // UpdateUserNotification updates a notification.
+  rpc UpdateUserNotification(UpdateUserNotificationRequest) returns (UserNotification) {
+    option (google.api.http) = {
+      patch: "/api/v1/{notification.name=users/*/notifications/*}"
+      body: "notification"
+    };
+    option (google.api.method_signature) = "notification,update_mask";
+  }
+
+  // DeleteUserNotification deletes a notification.
+  rpc DeleteUserNotification(DeleteUserNotificationRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {delete: "/api/v1/{name=users/*/notifications/*}"};
+    option (google.api.method_signature) = "name";
+  }
+}
+
+message User {
+  option (google.api.resource) = {
+    type: "memos.api.v1/User"
+    pattern: "users/{user}"
+    name_field: "name"
+    singular: "user"
+    plural: "users"
+  };
+
+  // The resource name of the user.
+  // Format: users/{user}
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // The role of the user.
+  Role role = 2 [(google.api.field_behavior) = REQUIRED];
+
+  // Required. The unique username for login.
+  string username = 3 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. The email address of the user.
+  string email = 4 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The display name of the user.
+  string display_name = 5 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The avatar URL of the user.
+  string avatar_url = 6 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The description of the user.
+  string description = 7 [(google.api.field_behavior) = OPTIONAL];
+
+  // Input only. The password for the user.
+  string password = 8 [(google.api.field_behavior) = INPUT_ONLY];
+
+  // The state of the user.
+  State state = 9 [(google.api.field_behavior) = REQUIRED];
+
+  // Output only. The creation timestamp.
+  google.protobuf.Timestamp create_time = 10 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The last update timestamp.
+  google.protobuf.Timestamp update_time = 11 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // User role enumeration.
+  enum Role {
+    ROLE_UNSPECIFIED = 0;
+    // Admin role with system access.
+    ADMIN = 2;
+    // User role with limited access.
+    USER = 3;
+  }
+}
+
+message ListUsersRequest {
+  // Optional. The maximum number of users to return.
+  // The service may return fewer than this value.
+  // If unspecified, at most 50 users will be returned.
+  // The maximum value is 1000; values above 1000 will be coerced to 1000.
+  int32 page_size = 1 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. A page token, received from a previous `ListUsers` call.
+  // Provide this to retrieve the subsequent page.
+  string page_token = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. Filter to apply to the list results.
+  // Example: "username == 'steven'"
+  // Supported operators: ==
+  // Supported fields: username
+  string filter = 3 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. If true, show deleted users in the response.
+  bool show_deleted = 4 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message ListUsersResponse {
+  // The list of users.
+  repeated User users = 1;
+
+  // A token that can be sent as `page_token` to retrieve the next page.
+  // If this field is omitted, there are no subsequent pages.
+  string next_page_token = 2;
+
+  // The total count of users (may be approximate).
+  int32 total_size = 3;
+}
+
+message BatchGetUsersRequest {
+  repeated string usernames = 1;
+}
+
+message BatchGetUsersResponse {
+  repeated User users = 1;
+}
+
+message GetUserRequest {
+  // Required. The resource name of the user.
+  // Format: users/{username}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/User"}
+  ];
+
+  // Optional. The fields to return in the response.
+  // If not specified, all fields are returned.
+  google.protobuf.FieldMask read_mask = 2 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message CreateUserRequest {
+  // Required. The user to create.
+  User user = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.field_behavior) = INPUT_ONLY
+  ];
+
+  // Optional. The user ID to use for this user.
+  // If empty, a unique ID will be generated.
+  // Must match the pattern [a-z0-9-]+
+  string user_id = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. If set, validate the request but don't actually create the user.
+  bool validate_only = 3 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. An idempotency token that can be used to ensure that multiple
+  // requests to create a user have the same result.
+  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message UpdateUserRequest {
+  // Required. The user to update.
+  User user = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Required. The list of fields to update.
+  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. If set to true, allows updating sensitive fields.
+  bool allow_missing = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message DeleteUserRequest {
+  // Required. The resource name of the user to delete.
+  // Format: users/{user}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/User"}
+  ];
+
+  // Optional. If set to true, the user will be deleted even if they have associated data.
+  bool force = 2 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// User statistics messages
+message UserStats {
+  option (google.api.resource) = {
+    type: "memos.api.v1/UserStats"
+    pattern: "users/{user}"
+    singular: "userStats"
+    plural: "userStats"
+  };
+
+  // The resource name of the user whose stats these are.
+  // Format: users/{user}
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  reserved 2;
+  reserved "memo_display_timestamps";
+
+  // The stats of memo types.
+  MemoTypeStats memo_type_stats = 3;
+
+  // The count of tags.
+  map<string, int32> tag_count = 4;
+
+  // The creation timestamps of the user's memos.
+  repeated google.protobuf.Timestamp memo_created_timestamps = 7;
+
+  // The latest update timestamps of the user's memos (one per memo,
+  // mirrors memo_created_timestamps). Used by the activity heatmap when
+  // the client's view is set to update_time basis.
+  repeated google.protobuf.Timestamp memo_updated_timestamps = 8;
+
+  // The pinned memos of the user.
+  repeated string pinned_memos = 5;
+
+  // Total memo count.
+  int32 total_memo_count = 6;
+
+  // Memo type statistics.
+  message MemoTypeStats {
+    int32 link_count = 1;
+    int32 code_count = 2;
+    int32 todo_count = 3;
+    int32 undo_count = 4;
+  }
+}
+
+message GetUserStatsRequest {
+  // Required. The resource name of the user.
+  // Format: users/{user}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/User"}
+  ];
+}
+
+message ListAllUserStatsRequest {
+  // Optional. The state of memos to include. Defaults to NORMAL.
+  State state = 1 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. Filter to apply to memo stats.
+  // Uses the same filter syntax as ListMemos.
+  string filter = 2 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message ListAllUserStatsResponse {
+  // The list of user statistics.
+  repeated UserStats stats = 1;
+}
+
+// User settings message
+message UserSetting {
+  option (google.api.resource) = {
+    type: "memos.api.v1/UserSetting"
+    pattern: "users/{username}/settings/{setting}"
+    singular: "userSetting"
+    plural: "userSettings"
+  };
+
+  // The name of the user setting.
+  // Format: users/{username}/settings/{setting}, {setting} is the key for the setting.
+  // For example, "users/steven/settings/GENERAL" for general settings.
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  oneof value {
+    GeneralSetting general_setting = 2;
+    WebhooksSetting webhooks_setting = 5;
+  }
+
+  // Enumeration of user setting keys.
+  enum Key {
+    KEY_UNSPECIFIED = 0;
+    // GENERAL is the key for general user settings.
+    GENERAL = 1;
+    // WEBHOOKS is the key for user webhooks.
+    WEBHOOKS = 4;
+  }
+
+  // General user settings configuration.
+  message GeneralSetting {
+    // The preferred locale of the user.
+    string locale = 1 [(google.api.field_behavior) = OPTIONAL];
+    // The default visibility of the memo.
+    string memo_visibility = 3 [(google.api.field_behavior) = OPTIONAL];
+    // The preferred theme of the user.
+    // This references a CSS file in the web/public/themes/ directory.
+    // If not set, the default theme will be used.
+    string theme = 4 [(google.api.field_behavior) = OPTIONAL];
+  }
+
+  // User webhooks configuration.
+  message WebhooksSetting {
+    // List of user webhooks.
+    repeated UserWebhook webhooks = 1;
+  }
+}
+
+message GetUserSettingRequest {
+  // Required. The resource name of the user setting.
+  // Format: users/{user}/settings/{setting}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/UserSetting"}
+  ];
+}
+
+message UpdateUserSettingRequest {
+  // Required. The user setting to update.
+  UserSetting setting = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Required. The list of fields to update.
+  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+// Request message for ListUserSettings method.
+message ListUserSettingsRequest {
+  // Required. The parent resource whose settings will be listed.
+  // Format: users/{user}
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/User"}
+  ];
+
+  // Optional. The maximum number of settings to return.
+  // The service may return fewer than this value.
+  // If unspecified, at most 50 settings will be returned.
+  // The maximum value is 1000; values above 1000 will be coerced to 1000.
+  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. A page token, received from a previous `ListUserSettings` call.
+  // Provide this to retrieve the subsequent page.
+  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Response message for ListUserSettings method.
+message ListUserSettingsResponse {
+  // The list of user settings.
+  repeated UserSetting settings = 1;
+
+  // A token that can be sent as `page_token` to retrieve the next page.
+  // If this field is omitted, there are no subsequent pages.
+  string next_page_token = 2;
+
+  // The total count of settings (may be approximate).
+  int32 total_size = 3;
+}
+
+// LinkedIdentity represents an SSO identity linked to a user account.
+message LinkedIdentity {
+  option (google.api.resource) = {
+    type: "memos.api.v1/LinkedIdentity"
+    pattern: "users/{user}/linkedIdentities/{linked_identity}"
+    singular: "linkedIdentity"
+    plural: "linkedIdentities"
+  };
+
+  // The resource name of the linked identity.
+  // Format: users/{user}/linkedIdentities/{linked_identity}
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // The resource name of the identity provider.
+  // Format: identity-providers/{uid}
+  string idp_name = 2 [
+    (google.api.field_behavior) = OUTPUT_ONLY,
+    (google.api.resource_reference) = {type: "memos.api.v1/IdentityProvider"}
+  ];
+
+  // The external user identifier from the identity provider.
+  string extern_uid = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
+}
+
+message ListLinkedIdentitiesRequest {
+  // Required. The parent resource whose linked identities will be listed.
+  // Format: users/{user}
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/User"}
+  ];
+}
+
+message ListLinkedIdentitiesResponse {
+  // The list of linked identities.
+  repeated LinkedIdentity linked_identities = 1;
+}
+
+message CreateLinkedIdentityRequest {
+  // Required. The parent user who owns the linked identity.
+  // Format: users/{user}
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/User"}
+  ];
+
+  // Required. The identity provider to link.
+  // Format: identity-providers/{uid}
+  string idp_name = 2 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/IdentityProvider"}
+  ];
+
+  // Required. The authorization code from the identity provider.
+  string code = 3 [(google.api.field_behavior) = REQUIRED];
+
+  // Required. The redirect URI used in the OAuth flow.
+  string redirect_uri = 4 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. The PKCE code verifier used in the OAuth flow.
+  string code_verifier = 5 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message GetLinkedIdentityRequest {
+  // Required. The resource name of the linked identity to get.
+  // Format: users/{user}/linkedIdentities/{linked_identity}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/LinkedIdentity"}
+  ];
+}
+
+message DeleteLinkedIdentityRequest {
+  // Required. The resource name of the linked identity to delete.
+  // Format: users/{user}/linkedIdentities/{linked_identity}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/LinkedIdentity"}
+  ];
+}
+
+// PersonalAccessToken represents a long-lived token for API/script access.
+// PATs are distinct from short-lived JWT access tokens used for session authentication.
+message PersonalAccessToken {
+  option (google.api.resource) = {
+    type: "memos.api.v1/PersonalAccessToken"
+    pattern: "users/{user}/personalAccessTokens/{personal_access_token}"
+    singular: "personalAccessToken"
+    plural: "personalAccessTokens"
+  };
+
+  // The resource name of the personal access token.
+  // Format: users/{user}/personalAccessTokens/{personal_access_token}
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // The description of the token.
+  string description = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Output only. The creation timestamp.
+  google.protobuf.Timestamp created_at = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Optional. The expiration timestamp.
+  google.protobuf.Timestamp expires_at = 4 [(google.api.field_behavior) = OPTIONAL];
+
+  // Output only. The last used timestamp.
+  google.protobuf.Timestamp last_used_at = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
+}
+
+message ListPersonalAccessTokensRequest {
+  // Required. The parent resource whose personal access tokens will be listed.
+  // Format: users/{user}
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/User"}
+  ];
+
+  // Optional. The maximum number of tokens to return.
+  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. A page token for pagination.
+  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message ListPersonalAccessTokensResponse {
+  // The list of personal access tokens.
+  repeated PersonalAccessToken personal_access_tokens = 1;
+
+  // A token for the next page of results.
+  string next_page_token = 2;
+
+  // The total count of personal access tokens.
+  int32 total_size = 3;
+}
+
+message CreatePersonalAccessTokenRequest {
+  // Required. The parent resource where this token will be created.
+  // Format: users/{user}
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/User"}
+  ];
+
+  // Optional. Description of the personal access token.
+  string description = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. Expiration duration in days (0 = never expires).
+  int32 expires_in_days = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message CreatePersonalAccessTokenResponse {
+  // The personal access token metadata.
+  PersonalAccessToken personal_access_token = 1;
+
+  // The actual token value - only returned on creation.
+  // This is the only time the token value will be visible.
+  string token = 2;
+}
+
+message DeletePersonalAccessTokenRequest {
+  // Required. The resource name of the personal access token to delete.
+  // Format: users/{user}/personalAccessTokens/{personal_access_token}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/PersonalAccessToken"}
+  ];
+}
+
+// UserWebhook represents a webhook owned by a user.
+message UserWebhook {
+  // The name of the webhook.
+  // Format: users/{user}/webhooks/{webhook}
+  string name = 1;
+
+  // The URL to send the webhook to.
+  string url = 2;
+
+  // Optional. Human-readable name for the webhook.
+  string display_name = 3;
+
+  // The creation time of the webhook.
+  google.protobuf.Timestamp create_time = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // The last update time of the webhook.
+  google.protobuf.Timestamp update_time = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
+}
+
+message ListUserWebhooksRequest {
+  // The parent user resource.
+  // Format: users/{user}
+  string parent = 1 [(google.api.field_behavior) = REQUIRED];
+}
+
+message ListUserWebhooksResponse {
+  // The list of webhooks.
+  repeated UserWebhook webhooks = 1;
+}
+
+message CreateUserWebhookRequest {
+  // The parent user resource.
+  // Format: users/{user}
+  string parent = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // The webhook to create.
+  UserWebhook webhook = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+message UpdateUserWebhookRequest {
+  // The webhook to update.
+  UserWebhook webhook = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // The list of fields to update.
+  google.protobuf.FieldMask update_mask = 2;
+}
+
+message DeleteUserWebhookRequest {
+  // The name of the webhook to delete.
+  // Format: users/{user}/webhooks/{webhook}
+  string name = 1 [(google.api.field_behavior) = REQUIRED];
+}
+
+message UserNotification {
+  option (google.api.resource) = {
+    type: "memos.api.v1/UserNotification"
+    pattern: "users/{user}/notifications/{notification}"
+    name_field: "name"
+    singular: "notification"
+    plural: "notifications"
+  };
+
+  // The resource name of the notification.
+  // Format: users/{user}/notifications/{notification}
+  string name = 1 [
+    (google.api.field_behavior) = OUTPUT_ONLY,
+    (google.api.field_behavior) = IDENTIFIER
+  ];
+
+  // The sender of the notification.
+  // Format: users/{user}
+  string sender = 2 [
+    (google.api.field_behavior) = OUTPUT_ONLY,
+    (google.api.resource_reference) = {type: "memos.api.v1/User"}
+  ];
+
+  // The sender user details.
+  User sender_user = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // The status of the notification.
+  Status status = 3 [(google.api.field_behavior) = OPTIONAL];
+
+  // The creation timestamp.
+  google.protobuf.Timestamp create_time = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // The type of the notification.
+  Type type = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  oneof payload {
+    MemoCommentPayload memo_comment = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
+    MemoMentionPayload memo_mention = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
+  }
+
+  message MemoCommentPayload {
+    // The memo name of comment.
+    // Format: memos/{memo}
+    string memo = 1;
+
+    // The name of related memo.
+    // Format: memos/{memo}
+    string related_memo = 2;
+
+    // Preview text of the comment memo.
+    string memo_snippet = 3;
+
+    // Preview text of the related memo.
+    string related_memo_snippet = 4;
+  }
+
+  message MemoMentionPayload {
+    // The memo that contains the mention.
+    // Format: memos/{memo}
+    string memo = 1;
+
+    // The related parent memo when the mention was created in a comment.
+    // Format: memos/{memo}
+    string related_memo = 2;
+
+    // Preview text of the memo that contains the mention.
+    string memo_snippet = 3;
+
+    // Preview text of the related parent memo.
+    string related_memo_snippet = 4;
+  }
+
+  enum Status {
+    STATUS_UNSPECIFIED = 0;
+    UNREAD = 1;
+    ARCHIVED = 2;
+  }
+
+  enum Type {
+    TYPE_UNSPECIFIED = 0;
+    MEMO_COMMENT = 1;
+    MEMO_MENTION = 2;
+  }
+}
+
+message ListUserNotificationsRequest {
+  // The parent user resource.
+  // Format: users/{user}
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/User"}
+  ];
+
+  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
+  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
+  string filter = 4 [(google.api.field_behavior) = OPTIONAL];
+}
+
+message ListUserNotificationsResponse {
+  repeated UserNotification notifications = 1;
+  string next_page_token = 2;
+}
+
+message UpdateUserNotificationRequest {
+  UserNotification notification = 1 [(google.api.field_behavior) = REQUIRED];
+  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+message DeleteUserNotificationRequest {
+  // Format: users/{user}/notifications/{notification}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {type: "memos.api.v1/UserNotification"}
+  ];
+}

proto/buf.gen.yaml

@@ -0,0 +1,30 @@
+version: v2
+managed:
+  enabled: true
+  disable:
+    - file_option: go_package
+      module: buf.build/googleapis/googleapis
+  override:
+    - file_option: go_package_prefix
+      value: github.com/usememos/memos/proto/gen
+plugins:
+  - remote: buf.build/protocolbuffers/go
+    out: gen
+    opt: paths=source_relative
+  - remote: buf.build/grpc/go
+    out: gen
+    opt: paths=source_relative
+  - remote: buf.build/connectrpc/go
+    out: gen
+    opt: paths=source_relative
+  - remote: buf.build/grpc-ecosystem/gateway
+    out: gen
+    opt: paths=source_relative
+  - remote: buf.build/community/google-gnostic-openapi
+    out: gen
+    opt: enum_type=string
+  - remote: buf.build/bufbuild/es
+    out: ../web/src/types/proto
+    opt:
+      - target=ts
+    include_imports: true

proto/buf.lock

@@ -0,0 +1,6 @@
+# Generated by buf. DO NOT EDIT.
+version: v2
+deps:
+  - name: buf.build/googleapis/googleapis
+    commit: 004180b77378443887d3b55cabc00384
+    digest: b5:e8f475fe3330f31f5fd86ac689093bcd274e19611a09db91f41d637cb9197881ce89882b94d13a58738e53c91c6e4bae7dc1feba85f590164c975a89e25115dc

proto/buf.yaml

@@ -0,0 +1,19 @@
+version: v2
+deps:
+  - buf.build/googleapis/googleapis
+lint:
+  use:
+    - BASIC
+  except:
+    - ENUM_VALUE_PREFIX
+    - FIELD_NOT_REQUIRED
+    - PACKAGE_DIRECTORY_MATCH
+    - PACKAGE_NO_IMPORT_CYCLE
+    - PACKAGE_VERSION_SUFFIX
+  disallow_comment_ignores: true
+breaking:
+  use:
+    - FILE
+  except:
+    - EXTENSION_NO_DELETE
+    - FIELD_SAME_DEFAULT

proto/gen/api/v1/ai_service.pb.go

@@ -0,0 +1,292 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: api/v1/ai_service.proto
+
+package apiv1
+
+import (
+	_ "google.golang.org/genproto/googleapis/api/annotations"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type TranscribeRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Required. Audio input.
+	Audio         *TranscriptionAudio `protobuf:"bytes,1,opt,name=audio,proto3" json:"audio,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TranscribeRequest) Reset() {
+	*x = TranscribeRequest{}
+	mi := &file_api_v1_ai_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TranscribeRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TranscribeRequest) ProtoMessage() {}
+
+func (x *TranscribeRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_ai_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TranscribeRequest.ProtoReflect.Descriptor instead.
+func (*TranscribeRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_ai_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *TranscribeRequest) GetAudio() *TranscriptionAudio {
+	if x != nil {
+		return x.Audio
+	}
+	return nil
+}
+
+type TranscriptionAudio struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Source:
+	//
+	//	*TranscriptionAudio_Content
+	//	*TranscriptionAudio_Uri
+	Source isTranscriptionAudio_Source `protobuf_oneof:"source"`
+	// Optional. The uploaded filename.
+	Filename string `protobuf:"bytes,3,opt,name=filename,proto3" json:"filename,omitempty"`
+	// Optional. The MIME type of the input audio.
+	ContentType   string `protobuf:"bytes,4,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TranscriptionAudio) Reset() {
+	*x = TranscriptionAudio{}
+	mi := &file_api_v1_ai_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TranscriptionAudio) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TranscriptionAudio) ProtoMessage() {}
+
+func (x *TranscriptionAudio) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_ai_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TranscriptionAudio.ProtoReflect.Descriptor instead.
+func (*TranscriptionAudio) Descriptor() ([]byte, []int) {
+	return file_api_v1_ai_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *TranscriptionAudio) GetSource() isTranscriptionAudio_Source {
+	if x != nil {
+		return x.Source
+	}
+	return nil
+}
+
+func (x *TranscriptionAudio) GetContent() []byte {
+	if x != nil {
+		if x, ok := x.Source.(*TranscriptionAudio_Content); ok {
+			return x.Content
+		}
+	}
+	return nil
+}
+
+func (x *TranscriptionAudio) GetUri() string {
+	if x != nil {
+		if x, ok := x.Source.(*TranscriptionAudio_Uri); ok {
+			return x.Uri
+		}
+	}
+	return ""
+}
+
+func (x *TranscriptionAudio) GetFilename() string {
+	if x != nil {
+		return x.Filename
+	}
+	return ""
+}
+
+func (x *TranscriptionAudio) GetContentType() string {
+	if x != nil {
+		return x.ContentType
+	}
+	return ""
+}
+
+type isTranscriptionAudio_Source interface {
+	isTranscriptionAudio_Source()
+}
+
+type TranscriptionAudio_Content struct {
+	// Inline audio bytes.
+	Content []byte `protobuf:"bytes,1,opt,name=content,proto3,oneof"`
+}
+
+type TranscriptionAudio_Uri struct {
+	// URI for audio content. Reserved for future use.
+	Uri string `protobuf:"bytes,2,opt,name=uri,proto3,oneof"`
+}
+
+func (*TranscriptionAudio_Content) isTranscriptionAudio_Source() {}
+
+func (*TranscriptionAudio_Uri) isTranscriptionAudio_Source() {}
+
+type TranscribeResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The transcribed text.
+	Text          string `protobuf:"bytes,1,opt,name=text,proto3" json:"text,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TranscribeResponse) Reset() {
+	*x = TranscribeResponse{}
+	mi := &file_api_v1_ai_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TranscribeResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TranscribeResponse) ProtoMessage() {}
+
+func (x *TranscribeResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_ai_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TranscribeResponse.ProtoReflect.Descriptor instead.
+func (*TranscribeResponse) Descriptor() ([]byte, []int) {
+	return file_api_v1_ai_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *TranscribeResponse) GetText() string {
+	if x != nil {
+		return x.Text
+	}
+	return ""
+}
+
+var File_api_v1_ai_service_proto protoreflect.FileDescriptor
+
+const file_api_v1_ai_service_proto_rawDesc = "" +
+	"\n" +
+	"\x17api/v1/ai_service.proto\x12\fmemos.api.v1\x1a\x1cgoogle/api/annotations.proto\x1a\x17google/api/client.proto\x1a\x1fgoogle/api/field_behavior.proto\"P\n" +
+	"\x11TranscribeRequest\x12;\n" +
+	"\x05audio\x18\x01 \x01(\v2 .memos.api.v1.TranscriptionAudioB\x03\xe0A\x02R\x05audio\"\x9c\x01\n" +
+	"\x12TranscriptionAudio\x12\x1f\n" +
+	"\acontent\x18\x01 \x01(\fB\x03\xe0A\x04H\x00R\acontent\x12\x12\n" +
+	"\x03uri\x18\x02 \x01(\tH\x00R\x03uri\x12\x1f\n" +
+	"\bfilename\x18\x03 \x01(\tB\x03\xe0A\x01R\bfilename\x12&\n" +
+	"\fcontent_type\x18\x04 \x01(\tB\x03\xe0A\x01R\vcontentTypeB\b\n" +
+	"\x06source\"(\n" +
+	"\x12TranscribeResponse\x12\x12\n" +
+	"\x04text\x18\x01 \x01(\tR\x04text2\x86\x01\n" +
+	"\tAIService\x12y\n" +
+	"\n" +
+	"Transcribe\x12\x1f.memos.api.v1.TranscribeRequest\x1a .memos.api.v1.TranscribeResponse\"(\xdaA\x05audio\x82\xd3\xe4\x93\x02\x1a:\x01*\"\x15/api/v1/ai:transcribeB\xa6\x01\n" +
+	"\x10com.memos.api.v1B\x0eAiServiceProtoP\x01Z0github.com/usememos/memos/proto/gen/api/v1;apiv1\xa2\x02\x03MAX\xaa\x02\fMemos.Api.V1\xca\x02\fMemos\\Api\\V1\xe2\x02\x18Memos\\Api\\V1\\GPBMetadata\xea\x02\x0eMemos::Api::V1b\x06proto3"
+
+var (
+	file_api_v1_ai_service_proto_rawDescOnce sync.Once
+	file_api_v1_ai_service_proto_rawDescData []byte
+)
+
+func file_api_v1_ai_service_proto_rawDescGZIP() []byte {
+	file_api_v1_ai_service_proto_rawDescOnce.Do(func() {
+		file_api_v1_ai_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_api_v1_ai_service_proto_rawDesc), len(file_api_v1_ai_service_proto_rawDesc)))
+	})
+	return file_api_v1_ai_service_proto_rawDescData
+}
+
+var file_api_v1_ai_service_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_api_v1_ai_service_proto_goTypes = []any{
+	(*TranscribeRequest)(nil),  // 0: memos.api.v1.TranscribeRequest
+	(*TranscriptionAudio)(nil), // 1: memos.api.v1.TranscriptionAudio
+	(*TranscribeResponse)(nil), // 2: memos.api.v1.TranscribeResponse
+}
+var file_api_v1_ai_service_proto_depIdxs = []int32{
+	1, // 0: memos.api.v1.TranscribeRequest.audio:type_name -> memos.api.v1.TranscriptionAudio
+	0, // 1: memos.api.v1.AIService.Transcribe:input_type -> memos.api.v1.TranscribeRequest
+	2, // 2: memos.api.v1.AIService.Transcribe:output_type -> memos.api.v1.TranscribeResponse
+	2, // [2:3] is the sub-list for method output_type
+	1, // [1:2] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_api_v1_ai_service_proto_init() }
+func file_api_v1_ai_service_proto_init() {
+	if File_api_v1_ai_service_proto != nil {
+		return
+	}
+	file_api_v1_ai_service_proto_msgTypes[1].OneofWrappers = []any{
+		(*TranscriptionAudio_Content)(nil),
+		(*TranscriptionAudio_Uri)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_v1_ai_service_proto_rawDesc), len(file_api_v1_ai_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_api_v1_ai_service_proto_goTypes,
+		DependencyIndexes: file_api_v1_ai_service_proto_depIdxs,
+		MessageInfos:      file_api_v1_ai_service_proto_msgTypes,
+	}.Build()
+	File_api_v1_ai_service_proto = out.File
+	file_api_v1_ai_service_proto_goTypes = nil
+	file_api_v1_ai_service_proto_depIdxs = nil
+}

proto/gen/api/v1/ai_service.pb.gw.go

@@ -0,0 +1,157 @@
+// Code generated by protoc-gen-grpc-gateway. DO NOT EDIT.
+// source: api/v1/ai_service.proto
+
+/*
+Package apiv1 is a reverse proxy.
+
+It translates gRPC into RESTful JSON APIs.
+*/
+package apiv1
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// Suppress "imported and not used" errors
+var (
+	_ codes.Code
+	_ io.Reader
+	_ status.Status
+	_ = errors.New
+	_ = runtime.String
+	_ = utilities.NewDoubleArray
+	_ = metadata.Join
+)
+
+func request_AIService_Transcribe_0(ctx context.Context, marshaler runtime.Marshaler, client AIServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq TranscribeRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.Transcribe(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_AIService_Transcribe_0(ctx context.Context, marshaler runtime.Marshaler, server AIServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq TranscribeRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.Transcribe(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+// RegisterAIServiceHandlerServer registers the http handlers for service AIService to "mux".
+// UnaryRPC     :call AIServiceServer directly.
+// StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+// Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterAIServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
+func RegisterAIServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server AIServiceServer) error {
+	mux.Handle(http.MethodPost, pattern_AIService_Transcribe_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.AIService/Transcribe", runtime.WithHTTPPathPattern("/api/v1/ai:transcribe"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AIService_Transcribe_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AIService_Transcribe_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+
+	return nil
+}
+
+// RegisterAIServiceHandlerFromEndpoint is same as RegisterAIServiceHandler but
+// automatically dials to "endpoint" and closes the connection when "ctx" gets done.
+func RegisterAIServiceHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+	conn, err := grpc.NewClient(endpoint, opts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+			return
+		}
+		go func() {
+			<-ctx.Done()
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+		}()
+	}()
+	return RegisterAIServiceHandler(ctx, mux, conn)
+}
+
+// RegisterAIServiceHandler registers the http handlers for service AIService to "mux".
+// The handlers forward requests to the grpc endpoint over "conn".
+func RegisterAIServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return RegisterAIServiceHandlerClient(ctx, mux, NewAIServiceClient(conn))
+}
+
+// RegisterAIServiceHandlerClient registers the http handlers for service AIService
+// to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "AIServiceClient".
+// Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "AIServiceClient"
+// doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+// "AIServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
+func RegisterAIServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client AIServiceClient) error {
+	mux.Handle(http.MethodPost, pattern_AIService_Transcribe_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.AIService/Transcribe", runtime.WithHTTPPathPattern("/api/v1/ai:transcribe"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AIService_Transcribe_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AIService_Transcribe_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	return nil
+}
+
+var (
+	pattern_AIService_Transcribe_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"api", "v1", "ai"}, "transcribe"))
+)
+
+var (
+	forward_AIService_Transcribe_0 = runtime.ForwardResponseMessage
+)

proto/gen/api/v1/ai_service_grpc.pb.go

@@ -0,0 +1,123 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             (unknown)
+// source: api/v1/ai_service.proto
+
+package apiv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	AIService_Transcribe_FullMethodName = "/memos.api.v1.AIService/Transcribe"
+)
+
+// AIServiceClient is the client API for AIService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type AIServiceClient interface {
+	// Transcribe transcribes an audio file using an instance AI provider.
+	Transcribe(ctx context.Context, in *TranscribeRequest, opts ...grpc.CallOption) (*TranscribeResponse, error)
+}
+
+type aIServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewAIServiceClient(cc grpc.ClientConnInterface) AIServiceClient {
+	return &aIServiceClient{cc}
+}
+
+func (c *aIServiceClient) Transcribe(ctx context.Context, in *TranscribeRequest, opts ...grpc.CallOption) (*TranscribeResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(TranscribeResponse)
+	err := c.cc.Invoke(ctx, AIService_Transcribe_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// AIServiceServer is the server API for AIService service.
+// All implementations must embed UnimplementedAIServiceServer
+// for forward compatibility.
+type AIServiceServer interface {
+	// Transcribe transcribes an audio file using an instance AI provider.
+	Transcribe(context.Context, *TranscribeRequest) (*TranscribeResponse, error)
+	mustEmbedUnimplementedAIServiceServer()
+}
+
+// UnimplementedAIServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedAIServiceServer struct{}
+
+func (UnimplementedAIServiceServer) Transcribe(context.Context, *TranscribeRequest) (*TranscribeResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method Transcribe not implemented")
+}
+func (UnimplementedAIServiceServer) mustEmbedUnimplementedAIServiceServer() {}
+func (UnimplementedAIServiceServer) testEmbeddedByValue()                   {}
+
+// UnsafeAIServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to AIServiceServer will
+// result in compilation errors.
+type UnsafeAIServiceServer interface {
+	mustEmbedUnimplementedAIServiceServer()
+}
+
+func RegisterAIServiceServer(s grpc.ServiceRegistrar, srv AIServiceServer) {
+	// If the following call panics, it indicates UnimplementedAIServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&AIService_ServiceDesc, srv)
+}
+
+func _AIService_Transcribe_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(TranscribeRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AIServiceServer).Transcribe(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AIService_Transcribe_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AIServiceServer).Transcribe(ctx, req.(*TranscribeRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// AIService_ServiceDesc is the grpc.ServiceDesc for AIService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var AIService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "memos.api.v1.AIService",
+	HandlerType: (*AIServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Transcribe",
+			Handler:    _AIService_Transcribe_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "api/v1/ai_service.proto",
+}

proto/gen/api/v1/apiv1connect/ai_service.connect.go

@@ -0,0 +1,110 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: api/v1/ai_service.proto
+
+package apiv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "github.com/usememos/memos/proto/gen/api/v1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// AIServiceName is the fully-qualified name of the AIService service.
+	AIServiceName = "memos.api.v1.AIService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// AIServiceTranscribeProcedure is the fully-qualified name of the AIService's Transcribe RPC.
+	AIServiceTranscribeProcedure = "/memos.api.v1.AIService/Transcribe"
+)
+
+// AIServiceClient is a client for the memos.api.v1.AIService service.
+type AIServiceClient interface {
+	// Transcribe transcribes an audio file using an instance AI provider.
+	Transcribe(context.Context, *connect.Request[v1.TranscribeRequest]) (*connect.Response[v1.TranscribeResponse], error)
+}
+
+// NewAIServiceClient constructs a client for the memos.api.v1.AIService service. By default, it
+// uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and sends
+// uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or
+// connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewAIServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) AIServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	aIServiceMethods := v1.File_api_v1_ai_service_proto.Services().ByName("AIService").Methods()
+	return &aIServiceClient{
+		transcribe: connect.NewClient[v1.TranscribeRequest, v1.TranscribeResponse](
+			httpClient,
+			baseURL+AIServiceTranscribeProcedure,
+			connect.WithSchema(aIServiceMethods.ByName("Transcribe")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// aIServiceClient implements AIServiceClient.
+type aIServiceClient struct {
+	transcribe *connect.Client[v1.TranscribeRequest, v1.TranscribeResponse]
+}
+
+// Transcribe calls memos.api.v1.AIService.Transcribe.
+func (c *aIServiceClient) Transcribe(ctx context.Context, req *connect.Request[v1.TranscribeRequest]) (*connect.Response[v1.TranscribeResponse], error) {
+	return c.transcribe.CallUnary(ctx, req)
+}
+
+// AIServiceHandler is an implementation of the memos.api.v1.AIService service.
+type AIServiceHandler interface {
+	// Transcribe transcribes an audio file using an instance AI provider.
+	Transcribe(context.Context, *connect.Request[v1.TranscribeRequest]) (*connect.Response[v1.TranscribeResponse], error)
+}
+
+// NewAIServiceHandler builds an HTTP handler from the service implementation. It returns the path
+// on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewAIServiceHandler(svc AIServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	aIServiceMethods := v1.File_api_v1_ai_service_proto.Services().ByName("AIService").Methods()
+	aIServiceTranscribeHandler := connect.NewUnaryHandler(
+		AIServiceTranscribeProcedure,
+		svc.Transcribe,
+		connect.WithSchema(aIServiceMethods.ByName("Transcribe")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/memos.api.v1.AIService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case AIServiceTranscribeProcedure:
+			aIServiceTranscribeHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedAIServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedAIServiceHandler struct{}
+
+func (UnimplementedAIServiceHandler) Transcribe(context.Context, *connect.Request[v1.TranscribeRequest]) (*connect.Response[v1.TranscribeResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.AIService.Transcribe is not implemented"))
+}

proto/gen/api/v1/apiv1connect/attachment_service.connect.go

@@ -0,0 +1,267 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: api/v1/attachment_service.proto
+
+package apiv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "github.com/usememos/memos/proto/gen/api/v1"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// AttachmentServiceName is the fully-qualified name of the AttachmentService service.
+	AttachmentServiceName = "memos.api.v1.AttachmentService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// AttachmentServiceCreateAttachmentProcedure is the fully-qualified name of the AttachmentService's
+	// CreateAttachment RPC.
+	AttachmentServiceCreateAttachmentProcedure = "/memos.api.v1.AttachmentService/CreateAttachment"
+	// AttachmentServiceListAttachmentsProcedure is the fully-qualified name of the AttachmentService's
+	// ListAttachments RPC.
+	AttachmentServiceListAttachmentsProcedure = "/memos.api.v1.AttachmentService/ListAttachments"
+	// AttachmentServiceGetAttachmentProcedure is the fully-qualified name of the AttachmentService's
+	// GetAttachment RPC.
+	AttachmentServiceGetAttachmentProcedure = "/memos.api.v1.AttachmentService/GetAttachment"
+	// AttachmentServiceUpdateAttachmentProcedure is the fully-qualified name of the AttachmentService's
+	// UpdateAttachment RPC.
+	AttachmentServiceUpdateAttachmentProcedure = "/memos.api.v1.AttachmentService/UpdateAttachment"
+	// AttachmentServiceDeleteAttachmentProcedure is the fully-qualified name of the AttachmentService's
+	// DeleteAttachment RPC.
+	AttachmentServiceDeleteAttachmentProcedure = "/memos.api.v1.AttachmentService/DeleteAttachment"
+	// AttachmentServiceBatchDeleteAttachmentsProcedure is the fully-qualified name of the
+	// AttachmentService's BatchDeleteAttachments RPC.
+	AttachmentServiceBatchDeleteAttachmentsProcedure = "/memos.api.v1.AttachmentService/BatchDeleteAttachments"
+)
+
+// AttachmentServiceClient is a client for the memos.api.v1.AttachmentService service.
+type AttachmentServiceClient interface {
+	// CreateAttachment creates a new attachment.
+	CreateAttachment(context.Context, *connect.Request[v1.CreateAttachmentRequest]) (*connect.Response[v1.Attachment], error)
+	// ListAttachments lists all attachments.
+	ListAttachments(context.Context, *connect.Request[v1.ListAttachmentsRequest]) (*connect.Response[v1.ListAttachmentsResponse], error)
+	// GetAttachment returns an attachment by name.
+	GetAttachment(context.Context, *connect.Request[v1.GetAttachmentRequest]) (*connect.Response[v1.Attachment], error)
+	// UpdateAttachment updates an attachment.
+	UpdateAttachment(context.Context, *connect.Request[v1.UpdateAttachmentRequest]) (*connect.Response[v1.Attachment], error)
+	// DeleteAttachment deletes an attachment by name.
+	DeleteAttachment(context.Context, *connect.Request[v1.DeleteAttachmentRequest]) (*connect.Response[emptypb.Empty], error)
+	// BatchDeleteAttachments deletes multiple attachments in one request.
+	BatchDeleteAttachments(context.Context, *connect.Request[v1.BatchDeleteAttachmentsRequest]) (*connect.Response[emptypb.Empty], error)
+}
+
+// NewAttachmentServiceClient constructs a client for the memos.api.v1.AttachmentService service. By
+// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
+// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewAttachmentServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) AttachmentServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	attachmentServiceMethods := v1.File_api_v1_attachment_service_proto.Services().ByName("AttachmentService").Methods()
+	return &attachmentServiceClient{
+		createAttachment: connect.NewClient[v1.CreateAttachmentRequest, v1.Attachment](
+			httpClient,
+			baseURL+AttachmentServiceCreateAttachmentProcedure,
+			connect.WithSchema(attachmentServiceMethods.ByName("CreateAttachment")),
+			connect.WithClientOptions(opts...),
+		),
+		listAttachments: connect.NewClient[v1.ListAttachmentsRequest, v1.ListAttachmentsResponse](
+			httpClient,
+			baseURL+AttachmentServiceListAttachmentsProcedure,
+			connect.WithSchema(attachmentServiceMethods.ByName("ListAttachments")),
+			connect.WithClientOptions(opts...),
+		),
+		getAttachment: connect.NewClient[v1.GetAttachmentRequest, v1.Attachment](
+			httpClient,
+			baseURL+AttachmentServiceGetAttachmentProcedure,
+			connect.WithSchema(attachmentServiceMethods.ByName("GetAttachment")),
+			connect.WithClientOptions(opts...),
+		),
+		updateAttachment: connect.NewClient[v1.UpdateAttachmentRequest, v1.Attachment](
+			httpClient,
+			baseURL+AttachmentServiceUpdateAttachmentProcedure,
+			connect.WithSchema(attachmentServiceMethods.ByName("UpdateAttachment")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteAttachment: connect.NewClient[v1.DeleteAttachmentRequest, emptypb.Empty](
+			httpClient,
+			baseURL+AttachmentServiceDeleteAttachmentProcedure,
+			connect.WithSchema(attachmentServiceMethods.ByName("DeleteAttachment")),
+			connect.WithClientOptions(opts...),
+		),
+		batchDeleteAttachments: connect.NewClient[v1.BatchDeleteAttachmentsRequest, emptypb.Empty](
+			httpClient,
+			baseURL+AttachmentServiceBatchDeleteAttachmentsProcedure,
+			connect.WithSchema(attachmentServiceMethods.ByName("BatchDeleteAttachments")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// attachmentServiceClient implements AttachmentServiceClient.
+type attachmentServiceClient struct {
+	createAttachment       *connect.Client[v1.CreateAttachmentRequest, v1.Attachment]
+	listAttachments        *connect.Client[v1.ListAttachmentsRequest, v1.ListAttachmentsResponse]
+	getAttachment          *connect.Client[v1.GetAttachmentRequest, v1.Attachment]
+	updateAttachment       *connect.Client[v1.UpdateAttachmentRequest, v1.Attachment]
+	deleteAttachment       *connect.Client[v1.DeleteAttachmentRequest, emptypb.Empty]
+	batchDeleteAttachments *connect.Client[v1.BatchDeleteAttachmentsRequest, emptypb.Empty]
+}
+
+// CreateAttachment calls memos.api.v1.AttachmentService.CreateAttachment.
+func (c *attachmentServiceClient) CreateAttachment(ctx context.Context, req *connect.Request[v1.CreateAttachmentRequest]) (*connect.Response[v1.Attachment], error) {
+	return c.createAttachment.CallUnary(ctx, req)
+}
+
+// ListAttachments calls memos.api.v1.AttachmentService.ListAttachments.
+func (c *attachmentServiceClient) ListAttachments(ctx context.Context, req *connect.Request[v1.ListAttachmentsRequest]) (*connect.Response[v1.ListAttachmentsResponse], error) {
+	return c.listAttachments.CallUnary(ctx, req)
+}
+
+// GetAttachment calls memos.api.v1.AttachmentService.GetAttachment.
+func (c *attachmentServiceClient) GetAttachment(ctx context.Context, req *connect.Request[v1.GetAttachmentRequest]) (*connect.Response[v1.Attachment], error) {
+	return c.getAttachment.CallUnary(ctx, req)
+}
+
+// UpdateAttachment calls memos.api.v1.AttachmentService.UpdateAttachment.
+func (c *attachmentServiceClient) UpdateAttachment(ctx context.Context, req *connect.Request[v1.UpdateAttachmentRequest]) (*connect.Response[v1.Attachment], error) {
+	return c.updateAttachment.CallUnary(ctx, req)
+}
+
+// DeleteAttachment calls memos.api.v1.AttachmentService.DeleteAttachment.
+func (c *attachmentServiceClient) DeleteAttachment(ctx context.Context, req *connect.Request[v1.DeleteAttachmentRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.deleteAttachment.CallUnary(ctx, req)
+}
+
+// BatchDeleteAttachments calls memos.api.v1.AttachmentService.BatchDeleteAttachments.
+func (c *attachmentServiceClient) BatchDeleteAttachments(ctx context.Context, req *connect.Request[v1.BatchDeleteAttachmentsRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.batchDeleteAttachments.CallUnary(ctx, req)
+}
+
+// AttachmentServiceHandler is an implementation of the memos.api.v1.AttachmentService service.
+type AttachmentServiceHandler interface {
+	// CreateAttachment creates a new attachment.
+	CreateAttachment(context.Context, *connect.Request[v1.CreateAttachmentRequest]) (*connect.Response[v1.Attachment], error)
+	// ListAttachments lists all attachments.
+	ListAttachments(context.Context, *connect.Request[v1.ListAttachmentsRequest]) (*connect.Response[v1.ListAttachmentsResponse], error)
+	// GetAttachment returns an attachment by name.
+	GetAttachment(context.Context, *connect.Request[v1.GetAttachmentRequest]) (*connect.Response[v1.Attachment], error)
+	// UpdateAttachment updates an attachment.
+	UpdateAttachment(context.Context, *connect.Request[v1.UpdateAttachmentRequest]) (*connect.Response[v1.Attachment], error)
+	// DeleteAttachment deletes an attachment by name.
+	DeleteAttachment(context.Context, *connect.Request[v1.DeleteAttachmentRequest]) (*connect.Response[emptypb.Empty], error)
+	// BatchDeleteAttachments deletes multiple attachments in one request.
+	BatchDeleteAttachments(context.Context, *connect.Request[v1.BatchDeleteAttachmentsRequest]) (*connect.Response[emptypb.Empty], error)
+}
+
+// NewAttachmentServiceHandler builds an HTTP handler from the service implementation. It returns
+// the path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewAttachmentServiceHandler(svc AttachmentServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	attachmentServiceMethods := v1.File_api_v1_attachment_service_proto.Services().ByName("AttachmentService").Methods()
+	attachmentServiceCreateAttachmentHandler := connect.NewUnaryHandler(
+		AttachmentServiceCreateAttachmentProcedure,
+		svc.CreateAttachment,
+		connect.WithSchema(attachmentServiceMethods.ByName("CreateAttachment")),
+		connect.WithHandlerOptions(opts...),
+	)
+	attachmentServiceListAttachmentsHandler := connect.NewUnaryHandler(
+		AttachmentServiceListAttachmentsProcedure,
+		svc.ListAttachments,
+		connect.WithSchema(attachmentServiceMethods.ByName("ListAttachments")),
+		connect.WithHandlerOptions(opts...),
+	)
+	attachmentServiceGetAttachmentHandler := connect.NewUnaryHandler(
+		AttachmentServiceGetAttachmentProcedure,
+		svc.GetAttachment,
+		connect.WithSchema(attachmentServiceMethods.ByName("GetAttachment")),
+		connect.WithHandlerOptions(opts...),
+	)
+	attachmentServiceUpdateAttachmentHandler := connect.NewUnaryHandler(
+		AttachmentServiceUpdateAttachmentProcedure,
+		svc.UpdateAttachment,
+		connect.WithSchema(attachmentServiceMethods.ByName("UpdateAttachment")),
+		connect.WithHandlerOptions(opts...),
+	)
+	attachmentServiceDeleteAttachmentHandler := connect.NewUnaryHandler(
+		AttachmentServiceDeleteAttachmentProcedure,
+		svc.DeleteAttachment,
+		connect.WithSchema(attachmentServiceMethods.ByName("DeleteAttachment")),
+		connect.WithHandlerOptions(opts...),
+	)
+	attachmentServiceBatchDeleteAttachmentsHandler := connect.NewUnaryHandler(
+		AttachmentServiceBatchDeleteAttachmentsProcedure,
+		svc.BatchDeleteAttachments,
+		connect.WithSchema(attachmentServiceMethods.ByName("BatchDeleteAttachments")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/memos.api.v1.AttachmentService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case AttachmentServiceCreateAttachmentProcedure:
+			attachmentServiceCreateAttachmentHandler.ServeHTTP(w, r)
+		case AttachmentServiceListAttachmentsProcedure:
+			attachmentServiceListAttachmentsHandler.ServeHTTP(w, r)
+		case AttachmentServiceGetAttachmentProcedure:
+			attachmentServiceGetAttachmentHandler.ServeHTTP(w, r)
+		case AttachmentServiceUpdateAttachmentProcedure:
+			attachmentServiceUpdateAttachmentHandler.ServeHTTP(w, r)
+		case AttachmentServiceDeleteAttachmentProcedure:
+			attachmentServiceDeleteAttachmentHandler.ServeHTTP(w, r)
+		case AttachmentServiceBatchDeleteAttachmentsProcedure:
+			attachmentServiceBatchDeleteAttachmentsHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedAttachmentServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedAttachmentServiceHandler struct{}
+
+func (UnimplementedAttachmentServiceHandler) CreateAttachment(context.Context, *connect.Request[v1.CreateAttachmentRequest]) (*connect.Response[v1.Attachment], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.AttachmentService.CreateAttachment is not implemented"))
+}
+
+func (UnimplementedAttachmentServiceHandler) ListAttachments(context.Context, *connect.Request[v1.ListAttachmentsRequest]) (*connect.Response[v1.ListAttachmentsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.AttachmentService.ListAttachments is not implemented"))
+}
+
+func (UnimplementedAttachmentServiceHandler) GetAttachment(context.Context, *connect.Request[v1.GetAttachmentRequest]) (*connect.Response[v1.Attachment], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.AttachmentService.GetAttachment is not implemented"))
+}
+
+func (UnimplementedAttachmentServiceHandler) UpdateAttachment(context.Context, *connect.Request[v1.UpdateAttachmentRequest]) (*connect.Response[v1.Attachment], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.AttachmentService.UpdateAttachment is not implemented"))
+}
+
+func (UnimplementedAttachmentServiceHandler) DeleteAttachment(context.Context, *connect.Request[v1.DeleteAttachmentRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.AttachmentService.DeleteAttachment is not implemented"))
+}
+
+func (UnimplementedAttachmentServiceHandler) BatchDeleteAttachments(context.Context, *connect.Request[v1.BatchDeleteAttachmentsRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.AttachmentService.BatchDeleteAttachments is not implemented"))
+}

proto/gen/api/v1/apiv1connect/auth_service.connect.go

@@ -0,0 +1,217 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: api/v1/auth_service.proto
+
+package apiv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "github.com/usememos/memos/proto/gen/api/v1"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// AuthServiceName is the fully-qualified name of the AuthService service.
+	AuthServiceName = "memos.api.v1.AuthService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// AuthServiceGetCurrentUserProcedure is the fully-qualified name of the AuthService's
+	// GetCurrentUser RPC.
+	AuthServiceGetCurrentUserProcedure = "/memos.api.v1.AuthService/GetCurrentUser"
+	// AuthServiceSignInProcedure is the fully-qualified name of the AuthService's SignIn RPC.
+	AuthServiceSignInProcedure = "/memos.api.v1.AuthService/SignIn"
+	// AuthServiceSignOutProcedure is the fully-qualified name of the AuthService's SignOut RPC.
+	AuthServiceSignOutProcedure = "/memos.api.v1.AuthService/SignOut"
+	// AuthServiceRefreshTokenProcedure is the fully-qualified name of the AuthService's RefreshToken
+	// RPC.
+	AuthServiceRefreshTokenProcedure = "/memos.api.v1.AuthService/RefreshToken"
+)
+
+// AuthServiceClient is a client for the memos.api.v1.AuthService service.
+type AuthServiceClient interface {
+	// GetCurrentUser returns the authenticated user's information.
+	// Validates the access token and returns user details.
+	// Similar to OIDC's /userinfo endpoint.
+	GetCurrentUser(context.Context, *connect.Request[v1.GetCurrentUserRequest]) (*connect.Response[v1.GetCurrentUserResponse], error)
+	// SignIn authenticates a user with credentials and returns tokens.
+	// On success, returns an access token and sets a refresh token cookie.
+	// Supports password-based and SSO authentication methods.
+	SignIn(context.Context, *connect.Request[v1.SignInRequest]) (*connect.Response[v1.SignInResponse], error)
+	// SignOut terminates the user's authentication.
+	// Revokes the refresh token and clears the authentication cookie.
+	SignOut(context.Context, *connect.Request[v1.SignOutRequest]) (*connect.Response[emptypb.Empty], error)
+	// RefreshToken exchanges a valid refresh token for a new access token.
+	// The refresh token is read from the HttpOnly cookie.
+	// Returns a new short-lived access token.
+	RefreshToken(context.Context, *connect.Request[v1.RefreshTokenRequest]) (*connect.Response[v1.RefreshTokenResponse], error)
+}
+
+// NewAuthServiceClient constructs a client for the memos.api.v1.AuthService service. By default, it
+// uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and sends
+// uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or
+// connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewAuthServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) AuthServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	authServiceMethods := v1.File_api_v1_auth_service_proto.Services().ByName("AuthService").Methods()
+	return &authServiceClient{
+		getCurrentUser: connect.NewClient[v1.GetCurrentUserRequest, v1.GetCurrentUserResponse](
+			httpClient,
+			baseURL+AuthServiceGetCurrentUserProcedure,
+			connect.WithSchema(authServiceMethods.ByName("GetCurrentUser")),
+			connect.WithClientOptions(opts...),
+		),
+		signIn: connect.NewClient[v1.SignInRequest, v1.SignInResponse](
+			httpClient,
+			baseURL+AuthServiceSignInProcedure,
+			connect.WithSchema(authServiceMethods.ByName("SignIn")),
+			connect.WithClientOptions(opts...),
+		),
+		signOut: connect.NewClient[v1.SignOutRequest, emptypb.Empty](
+			httpClient,
+			baseURL+AuthServiceSignOutProcedure,
+			connect.WithSchema(authServiceMethods.ByName("SignOut")),
+			connect.WithClientOptions(opts...),
+		),
+		refreshToken: connect.NewClient[v1.RefreshTokenRequest, v1.RefreshTokenResponse](
+			httpClient,
+			baseURL+AuthServiceRefreshTokenProcedure,
+			connect.WithSchema(authServiceMethods.ByName("RefreshToken")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// authServiceClient implements AuthServiceClient.
+type authServiceClient struct {
+	getCurrentUser *connect.Client[v1.GetCurrentUserRequest, v1.GetCurrentUserResponse]
+	signIn         *connect.Client[v1.SignInRequest, v1.SignInResponse]
+	signOut        *connect.Client[v1.SignOutRequest, emptypb.Empty]
+	refreshToken   *connect.Client[v1.RefreshTokenRequest, v1.RefreshTokenResponse]
+}
+
+// GetCurrentUser calls memos.api.v1.AuthService.GetCurrentUser.
+func (c *authServiceClient) GetCurrentUser(ctx context.Context, req *connect.Request[v1.GetCurrentUserRequest]) (*connect.Response[v1.GetCurrentUserResponse], error) {
+	return c.getCurrentUser.CallUnary(ctx, req)
+}
+
+// SignIn calls memos.api.v1.AuthService.SignIn.
+func (c *authServiceClient) SignIn(ctx context.Context, req *connect.Request[v1.SignInRequest]) (*connect.Response[v1.SignInResponse], error) {
+	return c.signIn.CallUnary(ctx, req)
+}
+
+// SignOut calls memos.api.v1.AuthService.SignOut.
+func (c *authServiceClient) SignOut(ctx context.Context, req *connect.Request[v1.SignOutRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.signOut.CallUnary(ctx, req)
+}
+
+// RefreshToken calls memos.api.v1.AuthService.RefreshToken.
+func (c *authServiceClient) RefreshToken(ctx context.Context, req *connect.Request[v1.RefreshTokenRequest]) (*connect.Response[v1.RefreshTokenResponse], error) {
+	return c.refreshToken.CallUnary(ctx, req)
+}
+
+// AuthServiceHandler is an implementation of the memos.api.v1.AuthService service.
+type AuthServiceHandler interface {
+	// GetCurrentUser returns the authenticated user's information.
+	// Validates the access token and returns user details.
+	// Similar to OIDC's /userinfo endpoint.
+	GetCurrentUser(context.Context, *connect.Request[v1.GetCurrentUserRequest]) (*connect.Response[v1.GetCurrentUserResponse], error)
+	// SignIn authenticates a user with credentials and returns tokens.
+	// On success, returns an access token and sets a refresh token cookie.
+	// Supports password-based and SSO authentication methods.
+	SignIn(context.Context, *connect.Request[v1.SignInRequest]) (*connect.Response[v1.SignInResponse], error)
+	// SignOut terminates the user's authentication.
+	// Revokes the refresh token and clears the authentication cookie.
+	SignOut(context.Context, *connect.Request[v1.SignOutRequest]) (*connect.Response[emptypb.Empty], error)
+	// RefreshToken exchanges a valid refresh token for a new access token.
+	// The refresh token is read from the HttpOnly cookie.
+	// Returns a new short-lived access token.
+	RefreshToken(context.Context, *connect.Request[v1.RefreshTokenRequest]) (*connect.Response[v1.RefreshTokenResponse], error)
+}
+
+// NewAuthServiceHandler builds an HTTP handler from the service implementation. It returns the path
+// on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewAuthServiceHandler(svc AuthServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	authServiceMethods := v1.File_api_v1_auth_service_proto.Services().ByName("AuthService").Methods()
+	authServiceGetCurrentUserHandler := connect.NewUnaryHandler(
+		AuthServiceGetCurrentUserProcedure,
+		svc.GetCurrentUser,
+		connect.WithSchema(authServiceMethods.ByName("GetCurrentUser")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceSignInHandler := connect.NewUnaryHandler(
+		AuthServiceSignInProcedure,
+		svc.SignIn,
+		connect.WithSchema(authServiceMethods.ByName("SignIn")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceSignOutHandler := connect.NewUnaryHandler(
+		AuthServiceSignOutProcedure,
+		svc.SignOut,
+		connect.WithSchema(authServiceMethods.ByName("SignOut")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceRefreshTokenHandler := connect.NewUnaryHandler(
+		AuthServiceRefreshTokenProcedure,
+		svc.RefreshToken,
+		connect.WithSchema(authServiceMethods.ByName("RefreshToken")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/memos.api.v1.AuthService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case AuthServiceGetCurrentUserProcedure:
+			authServiceGetCurrentUserHandler.ServeHTTP(w, r)
+		case AuthServiceSignInProcedure:
+			authServiceSignInHandler.ServeHTTP(w, r)
+		case AuthServiceSignOutProcedure:
+			authServiceSignOutHandler.ServeHTTP(w, r)
+		case AuthServiceRefreshTokenProcedure:
+			authServiceRefreshTokenHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedAuthServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedAuthServiceHandler struct{}
+
+func (UnimplementedAuthServiceHandler) GetCurrentUser(context.Context, *connect.Request[v1.GetCurrentUserRequest]) (*connect.Response[v1.GetCurrentUserResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.AuthService.GetCurrentUser is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) SignIn(context.Context, *connect.Request[v1.SignInRequest]) (*connect.Response[v1.SignInResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.AuthService.SignIn is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) SignOut(context.Context, *connect.Request[v1.SignOutRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.AuthService.SignOut is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) RefreshToken(context.Context, *connect.Request[v1.RefreshTokenRequest]) (*connect.Response[v1.RefreshTokenResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.AuthService.RefreshToken is not implemented"))
+}

proto/gen/api/v1/apiv1connect/idp_service.connect.go

@@ -0,0 +1,237 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: api/v1/idp_service.proto
+
+package apiv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "github.com/usememos/memos/proto/gen/api/v1"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// IdentityProviderServiceName is the fully-qualified name of the IdentityProviderService service.
+	IdentityProviderServiceName = "memos.api.v1.IdentityProviderService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// IdentityProviderServiceListIdentityProvidersProcedure is the fully-qualified name of the
+	// IdentityProviderService's ListIdentityProviders RPC.
+	IdentityProviderServiceListIdentityProvidersProcedure = "/memos.api.v1.IdentityProviderService/ListIdentityProviders"
+	// IdentityProviderServiceGetIdentityProviderProcedure is the fully-qualified name of the
+	// IdentityProviderService's GetIdentityProvider RPC.
+	IdentityProviderServiceGetIdentityProviderProcedure = "/memos.api.v1.IdentityProviderService/GetIdentityProvider"
+	// IdentityProviderServiceCreateIdentityProviderProcedure is the fully-qualified name of the
+	// IdentityProviderService's CreateIdentityProvider RPC.
+	IdentityProviderServiceCreateIdentityProviderProcedure = "/memos.api.v1.IdentityProviderService/CreateIdentityProvider"
+	// IdentityProviderServiceUpdateIdentityProviderProcedure is the fully-qualified name of the
+	// IdentityProviderService's UpdateIdentityProvider RPC.
+	IdentityProviderServiceUpdateIdentityProviderProcedure = "/memos.api.v1.IdentityProviderService/UpdateIdentityProvider"
+	// IdentityProviderServiceDeleteIdentityProviderProcedure is the fully-qualified name of the
+	// IdentityProviderService's DeleteIdentityProvider RPC.
+	IdentityProviderServiceDeleteIdentityProviderProcedure = "/memos.api.v1.IdentityProviderService/DeleteIdentityProvider"
+)
+
+// IdentityProviderServiceClient is a client for the memos.api.v1.IdentityProviderService service.
+type IdentityProviderServiceClient interface {
+	// ListIdentityProviders lists identity providers.
+	ListIdentityProviders(context.Context, *connect.Request[v1.ListIdentityProvidersRequest]) (*connect.Response[v1.ListIdentityProvidersResponse], error)
+	// GetIdentityProvider gets an identity provider.
+	GetIdentityProvider(context.Context, *connect.Request[v1.GetIdentityProviderRequest]) (*connect.Response[v1.IdentityProvider], error)
+	// CreateIdentityProvider creates an identity provider.
+	CreateIdentityProvider(context.Context, *connect.Request[v1.CreateIdentityProviderRequest]) (*connect.Response[v1.IdentityProvider], error)
+	// UpdateIdentityProvider updates an identity provider.
+	UpdateIdentityProvider(context.Context, *connect.Request[v1.UpdateIdentityProviderRequest]) (*connect.Response[v1.IdentityProvider], error)
+	// DeleteIdentityProvider deletes an identity provider.
+	DeleteIdentityProvider(context.Context, *connect.Request[v1.DeleteIdentityProviderRequest]) (*connect.Response[emptypb.Empty], error)
+}
+
+// NewIdentityProviderServiceClient constructs a client for the memos.api.v1.IdentityProviderService
+// service. By default, it uses the Connect protocol with the binary Protobuf Codec, asks for
+// gzipped responses, and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply
+// the connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewIdentityProviderServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) IdentityProviderServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	identityProviderServiceMethods := v1.File_api_v1_idp_service_proto.Services().ByName("IdentityProviderService").Methods()
+	return &identityProviderServiceClient{
+		listIdentityProviders: connect.NewClient[v1.ListIdentityProvidersRequest, v1.ListIdentityProvidersResponse](
+			httpClient,
+			baseURL+IdentityProviderServiceListIdentityProvidersProcedure,
+			connect.WithSchema(identityProviderServiceMethods.ByName("ListIdentityProviders")),
+			connect.WithClientOptions(opts...),
+		),
+		getIdentityProvider: connect.NewClient[v1.GetIdentityProviderRequest, v1.IdentityProvider](
+			httpClient,
+			baseURL+IdentityProviderServiceGetIdentityProviderProcedure,
+			connect.WithSchema(identityProviderServiceMethods.ByName("GetIdentityProvider")),
+			connect.WithClientOptions(opts...),
+		),
+		createIdentityProvider: connect.NewClient[v1.CreateIdentityProviderRequest, v1.IdentityProvider](
+			httpClient,
+			baseURL+IdentityProviderServiceCreateIdentityProviderProcedure,
+			connect.WithSchema(identityProviderServiceMethods.ByName("CreateIdentityProvider")),
+			connect.WithClientOptions(opts...),
+		),
+		updateIdentityProvider: connect.NewClient[v1.UpdateIdentityProviderRequest, v1.IdentityProvider](
+			httpClient,
+			baseURL+IdentityProviderServiceUpdateIdentityProviderProcedure,
+			connect.WithSchema(identityProviderServiceMethods.ByName("UpdateIdentityProvider")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteIdentityProvider: connect.NewClient[v1.DeleteIdentityProviderRequest, emptypb.Empty](
+			httpClient,
+			baseURL+IdentityProviderServiceDeleteIdentityProviderProcedure,
+			connect.WithSchema(identityProviderServiceMethods.ByName("DeleteIdentityProvider")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// identityProviderServiceClient implements IdentityProviderServiceClient.
+type identityProviderServiceClient struct {
+	listIdentityProviders  *connect.Client[v1.ListIdentityProvidersRequest, v1.ListIdentityProvidersResponse]
+	getIdentityProvider    *connect.Client[v1.GetIdentityProviderRequest, v1.IdentityProvider]
+	createIdentityProvider *connect.Client[v1.CreateIdentityProviderRequest, v1.IdentityProvider]
+	updateIdentityProvider *connect.Client[v1.UpdateIdentityProviderRequest, v1.IdentityProvider]
+	deleteIdentityProvider *connect.Client[v1.DeleteIdentityProviderRequest, emptypb.Empty]
+}
+
+// ListIdentityProviders calls memos.api.v1.IdentityProviderService.ListIdentityProviders.
+func (c *identityProviderServiceClient) ListIdentityProviders(ctx context.Context, req *connect.Request[v1.ListIdentityProvidersRequest]) (*connect.Response[v1.ListIdentityProvidersResponse], error) {
+	return c.listIdentityProviders.CallUnary(ctx, req)
+}
+
+// GetIdentityProvider calls memos.api.v1.IdentityProviderService.GetIdentityProvider.
+func (c *identityProviderServiceClient) GetIdentityProvider(ctx context.Context, req *connect.Request[v1.GetIdentityProviderRequest]) (*connect.Response[v1.IdentityProvider], error) {
+	return c.getIdentityProvider.CallUnary(ctx, req)
+}
+
+// CreateIdentityProvider calls memos.api.v1.IdentityProviderService.CreateIdentityProvider.
+func (c *identityProviderServiceClient) CreateIdentityProvider(ctx context.Context, req *connect.Request[v1.CreateIdentityProviderRequest]) (*connect.Response[v1.IdentityProvider], error) {
+	return c.createIdentityProvider.CallUnary(ctx, req)
+}
+
+// UpdateIdentityProvider calls memos.api.v1.IdentityProviderService.UpdateIdentityProvider.
+func (c *identityProviderServiceClient) UpdateIdentityProvider(ctx context.Context, req *connect.Request[v1.UpdateIdentityProviderRequest]) (*connect.Response[v1.IdentityProvider], error) {
+	return c.updateIdentityProvider.CallUnary(ctx, req)
+}
+
+// DeleteIdentityProvider calls memos.api.v1.IdentityProviderService.DeleteIdentityProvider.
+func (c *identityProviderServiceClient) DeleteIdentityProvider(ctx context.Context, req *connect.Request[v1.DeleteIdentityProviderRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.deleteIdentityProvider.CallUnary(ctx, req)
+}
+
+// IdentityProviderServiceHandler is an implementation of the memos.api.v1.IdentityProviderService
+// service.
+type IdentityProviderServiceHandler interface {
+	// ListIdentityProviders lists identity providers.
+	ListIdentityProviders(context.Context, *connect.Request[v1.ListIdentityProvidersRequest]) (*connect.Response[v1.ListIdentityProvidersResponse], error)
+	// GetIdentityProvider gets an identity provider.
+	GetIdentityProvider(context.Context, *connect.Request[v1.GetIdentityProviderRequest]) (*connect.Response[v1.IdentityProvider], error)
+	// CreateIdentityProvider creates an identity provider.
+	CreateIdentityProvider(context.Context, *connect.Request[v1.CreateIdentityProviderRequest]) (*connect.Response[v1.IdentityProvider], error)
+	// UpdateIdentityProvider updates an identity provider.
+	UpdateIdentityProvider(context.Context, *connect.Request[v1.UpdateIdentityProviderRequest]) (*connect.Response[v1.IdentityProvider], error)
+	// DeleteIdentityProvider deletes an identity provider.
+	DeleteIdentityProvider(context.Context, *connect.Request[v1.DeleteIdentityProviderRequest]) (*connect.Response[emptypb.Empty], error)
+}
+
+// NewIdentityProviderServiceHandler builds an HTTP handler from the service implementation. It
+// returns the path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewIdentityProviderServiceHandler(svc IdentityProviderServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	identityProviderServiceMethods := v1.File_api_v1_idp_service_proto.Services().ByName("IdentityProviderService").Methods()
+	identityProviderServiceListIdentityProvidersHandler := connect.NewUnaryHandler(
+		IdentityProviderServiceListIdentityProvidersProcedure,
+		svc.ListIdentityProviders,
+		connect.WithSchema(identityProviderServiceMethods.ByName("ListIdentityProviders")),
+		connect.WithHandlerOptions(opts...),
+	)
+	identityProviderServiceGetIdentityProviderHandler := connect.NewUnaryHandler(
+		IdentityProviderServiceGetIdentityProviderProcedure,
+		svc.GetIdentityProvider,
+		connect.WithSchema(identityProviderServiceMethods.ByName("GetIdentityProvider")),
+		connect.WithHandlerOptions(opts...),
+	)
+	identityProviderServiceCreateIdentityProviderHandler := connect.NewUnaryHandler(
+		IdentityProviderServiceCreateIdentityProviderProcedure,
+		svc.CreateIdentityProvider,
+		connect.WithSchema(identityProviderServiceMethods.ByName("CreateIdentityProvider")),
+		connect.WithHandlerOptions(opts...),
+	)
+	identityProviderServiceUpdateIdentityProviderHandler := connect.NewUnaryHandler(
+		IdentityProviderServiceUpdateIdentityProviderProcedure,
+		svc.UpdateIdentityProvider,
+		connect.WithSchema(identityProviderServiceMethods.ByName("UpdateIdentityProvider")),
+		connect.WithHandlerOptions(opts...),
+	)
+	identityProviderServiceDeleteIdentityProviderHandler := connect.NewUnaryHandler(
+		IdentityProviderServiceDeleteIdentityProviderProcedure,
+		svc.DeleteIdentityProvider,
+		connect.WithSchema(identityProviderServiceMethods.ByName("DeleteIdentityProvider")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/memos.api.v1.IdentityProviderService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case IdentityProviderServiceListIdentityProvidersProcedure:
+			identityProviderServiceListIdentityProvidersHandler.ServeHTTP(w, r)
+		case IdentityProviderServiceGetIdentityProviderProcedure:
+			identityProviderServiceGetIdentityProviderHandler.ServeHTTP(w, r)
+		case IdentityProviderServiceCreateIdentityProviderProcedure:
+			identityProviderServiceCreateIdentityProviderHandler.ServeHTTP(w, r)
+		case IdentityProviderServiceUpdateIdentityProviderProcedure:
+			identityProviderServiceUpdateIdentityProviderHandler.ServeHTTP(w, r)
+		case IdentityProviderServiceDeleteIdentityProviderProcedure:
+			identityProviderServiceDeleteIdentityProviderHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedIdentityProviderServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedIdentityProviderServiceHandler struct{}
+
+func (UnimplementedIdentityProviderServiceHandler) ListIdentityProviders(context.Context, *connect.Request[v1.ListIdentityProvidersRequest]) (*connect.Response[v1.ListIdentityProvidersResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.IdentityProviderService.ListIdentityProviders is not implemented"))
+}
+
+func (UnimplementedIdentityProviderServiceHandler) GetIdentityProvider(context.Context, *connect.Request[v1.GetIdentityProviderRequest]) (*connect.Response[v1.IdentityProvider], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.IdentityProviderService.GetIdentityProvider is not implemented"))
+}
+
+func (UnimplementedIdentityProviderServiceHandler) CreateIdentityProvider(context.Context, *connect.Request[v1.CreateIdentityProviderRequest]) (*connect.Response[v1.IdentityProvider], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.IdentityProviderService.CreateIdentityProvider is not implemented"))
+}
+
+func (UnimplementedIdentityProviderServiceHandler) UpdateIdentityProvider(context.Context, *connect.Request[v1.UpdateIdentityProviderRequest]) (*connect.Response[v1.IdentityProvider], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.IdentityProviderService.UpdateIdentityProvider is not implemented"))
+}
+
+func (UnimplementedIdentityProviderServiceHandler) DeleteIdentityProvider(context.Context, *connect.Request[v1.DeleteIdentityProviderRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.IdentityProviderService.DeleteIdentityProvider is not implemented"))
+}

proto/gen/api/v1/apiv1connect/instance_service.connect.go

@@ -0,0 +1,267 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: api/v1/instance_service.proto
+
+package apiv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "github.com/usememos/memos/proto/gen/api/v1"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// InstanceServiceName is the fully-qualified name of the InstanceService service.
+	InstanceServiceName = "memos.api.v1.InstanceService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// InstanceServiceGetInstanceProfileProcedure is the fully-qualified name of the InstanceService's
+	// GetInstanceProfile RPC.
+	InstanceServiceGetInstanceProfileProcedure = "/memos.api.v1.InstanceService/GetInstanceProfile"
+	// InstanceServiceGetInstanceSettingProcedure is the fully-qualified name of the InstanceService's
+	// GetInstanceSetting RPC.
+	InstanceServiceGetInstanceSettingProcedure = "/memos.api.v1.InstanceService/GetInstanceSetting"
+	// InstanceServiceBatchGetInstanceSettingsProcedure is the fully-qualified name of the
+	// InstanceService's BatchGetInstanceSettings RPC.
+	InstanceServiceBatchGetInstanceSettingsProcedure = "/memos.api.v1.InstanceService/BatchGetInstanceSettings"
+	// InstanceServiceUpdateInstanceSettingProcedure is the fully-qualified name of the
+	// InstanceService's UpdateInstanceSetting RPC.
+	InstanceServiceUpdateInstanceSettingProcedure = "/memos.api.v1.InstanceService/UpdateInstanceSetting"
+	// InstanceServiceTestInstanceEmailSettingProcedure is the fully-qualified name of the
+	// InstanceService's TestInstanceEmailSetting RPC.
+	InstanceServiceTestInstanceEmailSettingProcedure = "/memos.api.v1.InstanceService/TestInstanceEmailSetting"
+	// InstanceServiceGetInstanceStatsProcedure is the fully-qualified name of the InstanceService's
+	// GetInstanceStats RPC.
+	InstanceServiceGetInstanceStatsProcedure = "/memos.api.v1.InstanceService/GetInstanceStats"
+)
+
+// InstanceServiceClient is a client for the memos.api.v1.InstanceService service.
+type InstanceServiceClient interface {
+	// Gets the instance profile.
+	GetInstanceProfile(context.Context, *connect.Request[v1.GetInstanceProfileRequest]) (*connect.Response[v1.InstanceProfile], error)
+	// Gets an instance setting.
+	GetInstanceSetting(context.Context, *connect.Request[v1.GetInstanceSettingRequest]) (*connect.Response[v1.InstanceSetting], error)
+	// Batch gets instance settings.
+	BatchGetInstanceSettings(context.Context, *connect.Request[v1.BatchGetInstanceSettingsRequest]) (*connect.Response[v1.BatchGetInstanceSettingsResponse], error)
+	// Updates an instance setting.
+	UpdateInstanceSetting(context.Context, *connect.Request[v1.UpdateInstanceSettingRequest]) (*connect.Response[v1.InstanceSetting], error)
+	// Tests notification email delivery with the provided or stored SMTP settings.
+	TestInstanceEmailSetting(context.Context, *connect.Request[v1.TestInstanceEmailSettingRequest]) (*connect.Response[emptypb.Empty], error)
+	// GetInstanceStats returns resource usage statistics for the instance. Admin only.
+	GetInstanceStats(context.Context, *connect.Request[v1.GetInstanceStatsRequest]) (*connect.Response[v1.InstanceStats], error)
+}
+
+// NewInstanceServiceClient constructs a client for the memos.api.v1.InstanceService service. By
+// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
+// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewInstanceServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) InstanceServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	instanceServiceMethods := v1.File_api_v1_instance_service_proto.Services().ByName("InstanceService").Methods()
+	return &instanceServiceClient{
+		getInstanceProfile: connect.NewClient[v1.GetInstanceProfileRequest, v1.InstanceProfile](
+			httpClient,
+			baseURL+InstanceServiceGetInstanceProfileProcedure,
+			connect.WithSchema(instanceServiceMethods.ByName("GetInstanceProfile")),
+			connect.WithClientOptions(opts...),
+		),
+		getInstanceSetting: connect.NewClient[v1.GetInstanceSettingRequest, v1.InstanceSetting](
+			httpClient,
+			baseURL+InstanceServiceGetInstanceSettingProcedure,
+			connect.WithSchema(instanceServiceMethods.ByName("GetInstanceSetting")),
+			connect.WithClientOptions(opts...),
+		),
+		batchGetInstanceSettings: connect.NewClient[v1.BatchGetInstanceSettingsRequest, v1.BatchGetInstanceSettingsResponse](
+			httpClient,
+			baseURL+InstanceServiceBatchGetInstanceSettingsProcedure,
+			connect.WithSchema(instanceServiceMethods.ByName("BatchGetInstanceSettings")),
+			connect.WithClientOptions(opts...),
+		),
+		updateInstanceSetting: connect.NewClient[v1.UpdateInstanceSettingRequest, v1.InstanceSetting](
+			httpClient,
+			baseURL+InstanceServiceUpdateInstanceSettingProcedure,
+			connect.WithSchema(instanceServiceMethods.ByName("UpdateInstanceSetting")),
+			connect.WithClientOptions(opts...),
+		),
+		testInstanceEmailSetting: connect.NewClient[v1.TestInstanceEmailSettingRequest, emptypb.Empty](
+			httpClient,
+			baseURL+InstanceServiceTestInstanceEmailSettingProcedure,
+			connect.WithSchema(instanceServiceMethods.ByName("TestInstanceEmailSetting")),
+			connect.WithClientOptions(opts...),
+		),
+		getInstanceStats: connect.NewClient[v1.GetInstanceStatsRequest, v1.InstanceStats](
+			httpClient,
+			baseURL+InstanceServiceGetInstanceStatsProcedure,
+			connect.WithSchema(instanceServiceMethods.ByName("GetInstanceStats")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// instanceServiceClient implements InstanceServiceClient.
+type instanceServiceClient struct {
+	getInstanceProfile       *connect.Client[v1.GetInstanceProfileRequest, v1.InstanceProfile]
+	getInstanceSetting       *connect.Client[v1.GetInstanceSettingRequest, v1.InstanceSetting]
+	batchGetInstanceSettings *connect.Client[v1.BatchGetInstanceSettingsRequest, v1.BatchGetInstanceSettingsResponse]
+	updateInstanceSetting    *connect.Client[v1.UpdateInstanceSettingRequest, v1.InstanceSetting]
+	testInstanceEmailSetting *connect.Client[v1.TestInstanceEmailSettingRequest, emptypb.Empty]
+	getInstanceStats         *connect.Client[v1.GetInstanceStatsRequest, v1.InstanceStats]
+}
+
+// GetInstanceProfile calls memos.api.v1.InstanceService.GetInstanceProfile.
+func (c *instanceServiceClient) GetInstanceProfile(ctx context.Context, req *connect.Request[v1.GetInstanceProfileRequest]) (*connect.Response[v1.InstanceProfile], error) {
+	return c.getInstanceProfile.CallUnary(ctx, req)
+}
+
+// GetInstanceSetting calls memos.api.v1.InstanceService.GetInstanceSetting.
+func (c *instanceServiceClient) GetInstanceSetting(ctx context.Context, req *connect.Request[v1.GetInstanceSettingRequest]) (*connect.Response[v1.InstanceSetting], error) {
+	return c.getInstanceSetting.CallUnary(ctx, req)
+}
+
+// BatchGetInstanceSettings calls memos.api.v1.InstanceService.BatchGetInstanceSettings.
+func (c *instanceServiceClient) BatchGetInstanceSettings(ctx context.Context, req *connect.Request[v1.BatchGetInstanceSettingsRequest]) (*connect.Response[v1.BatchGetInstanceSettingsResponse], error) {
+	return c.batchGetInstanceSettings.CallUnary(ctx, req)
+}
+
+// UpdateInstanceSetting calls memos.api.v1.InstanceService.UpdateInstanceSetting.
+func (c *instanceServiceClient) UpdateInstanceSetting(ctx context.Context, req *connect.Request[v1.UpdateInstanceSettingRequest]) (*connect.Response[v1.InstanceSetting], error) {
+	return c.updateInstanceSetting.CallUnary(ctx, req)
+}
+
+// TestInstanceEmailSetting calls memos.api.v1.InstanceService.TestInstanceEmailSetting.
+func (c *instanceServiceClient) TestInstanceEmailSetting(ctx context.Context, req *connect.Request[v1.TestInstanceEmailSettingRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.testInstanceEmailSetting.CallUnary(ctx, req)
+}
+
+// GetInstanceStats calls memos.api.v1.InstanceService.GetInstanceStats.
+func (c *instanceServiceClient) GetInstanceStats(ctx context.Context, req *connect.Request[v1.GetInstanceStatsRequest]) (*connect.Response[v1.InstanceStats], error) {
+	return c.getInstanceStats.CallUnary(ctx, req)
+}
+
+// InstanceServiceHandler is an implementation of the memos.api.v1.InstanceService service.
+type InstanceServiceHandler interface {
+	// Gets the instance profile.
+	GetInstanceProfile(context.Context, *connect.Request[v1.GetInstanceProfileRequest]) (*connect.Response[v1.InstanceProfile], error)
+	// Gets an instance setting.
+	GetInstanceSetting(context.Context, *connect.Request[v1.GetInstanceSettingRequest]) (*connect.Response[v1.InstanceSetting], error)
+	// Batch gets instance settings.
+	BatchGetInstanceSettings(context.Context, *connect.Request[v1.BatchGetInstanceSettingsRequest]) (*connect.Response[v1.BatchGetInstanceSettingsResponse], error)
+	// Updates an instance setting.
+	UpdateInstanceSetting(context.Context, *connect.Request[v1.UpdateInstanceSettingRequest]) (*connect.Response[v1.InstanceSetting], error)
+	// Tests notification email delivery with the provided or stored SMTP settings.
+	TestInstanceEmailSetting(context.Context, *connect.Request[v1.TestInstanceEmailSettingRequest]) (*connect.Response[emptypb.Empty], error)
+	// GetInstanceStats returns resource usage statistics for the instance. Admin only.
+	GetInstanceStats(context.Context, *connect.Request[v1.GetInstanceStatsRequest]) (*connect.Response[v1.InstanceStats], error)
+}
+
+// NewInstanceServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewInstanceServiceHandler(svc InstanceServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	instanceServiceMethods := v1.File_api_v1_instance_service_proto.Services().ByName("InstanceService").Methods()
+	instanceServiceGetInstanceProfileHandler := connect.NewUnaryHandler(
+		InstanceServiceGetInstanceProfileProcedure,
+		svc.GetInstanceProfile,
+		connect.WithSchema(instanceServiceMethods.ByName("GetInstanceProfile")),
+		connect.WithHandlerOptions(opts...),
+	)
+	instanceServiceGetInstanceSettingHandler := connect.NewUnaryHandler(
+		InstanceServiceGetInstanceSettingProcedure,
+		svc.GetInstanceSetting,
+		connect.WithSchema(instanceServiceMethods.ByName("GetInstanceSetting")),
+		connect.WithHandlerOptions(opts...),
+	)
+	instanceServiceBatchGetInstanceSettingsHandler := connect.NewUnaryHandler(
+		InstanceServiceBatchGetInstanceSettingsProcedure,
+		svc.BatchGetInstanceSettings,
+		connect.WithSchema(instanceServiceMethods.ByName("BatchGetInstanceSettings")),
+		connect.WithHandlerOptions(opts...),
+	)
+	instanceServiceUpdateInstanceSettingHandler := connect.NewUnaryHandler(
+		InstanceServiceUpdateInstanceSettingProcedure,
+		svc.UpdateInstanceSetting,
+		connect.WithSchema(instanceServiceMethods.ByName("UpdateInstanceSetting")),
+		connect.WithHandlerOptions(opts...),
+	)
+	instanceServiceTestInstanceEmailSettingHandler := connect.NewUnaryHandler(
+		InstanceServiceTestInstanceEmailSettingProcedure,
+		svc.TestInstanceEmailSetting,
+		connect.WithSchema(instanceServiceMethods.ByName("TestInstanceEmailSetting")),
+		connect.WithHandlerOptions(opts...),
+	)
+	instanceServiceGetInstanceStatsHandler := connect.NewUnaryHandler(
+		InstanceServiceGetInstanceStatsProcedure,
+		svc.GetInstanceStats,
+		connect.WithSchema(instanceServiceMethods.ByName("GetInstanceStats")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/memos.api.v1.InstanceService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case InstanceServiceGetInstanceProfileProcedure:
+			instanceServiceGetInstanceProfileHandler.ServeHTTP(w, r)
+		case InstanceServiceGetInstanceSettingProcedure:
+			instanceServiceGetInstanceSettingHandler.ServeHTTP(w, r)
+		case InstanceServiceBatchGetInstanceSettingsProcedure:
+			instanceServiceBatchGetInstanceSettingsHandler.ServeHTTP(w, r)
+		case InstanceServiceUpdateInstanceSettingProcedure:
+			instanceServiceUpdateInstanceSettingHandler.ServeHTTP(w, r)
+		case InstanceServiceTestInstanceEmailSettingProcedure:
+			instanceServiceTestInstanceEmailSettingHandler.ServeHTTP(w, r)
+		case InstanceServiceGetInstanceStatsProcedure:
+			instanceServiceGetInstanceStatsHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedInstanceServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedInstanceServiceHandler struct{}
+
+func (UnimplementedInstanceServiceHandler) GetInstanceProfile(context.Context, *connect.Request[v1.GetInstanceProfileRequest]) (*connect.Response[v1.InstanceProfile], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.InstanceService.GetInstanceProfile is not implemented"))
+}
+
+func (UnimplementedInstanceServiceHandler) GetInstanceSetting(context.Context, *connect.Request[v1.GetInstanceSettingRequest]) (*connect.Response[v1.InstanceSetting], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.InstanceService.GetInstanceSetting is not implemented"))
+}
+
+func (UnimplementedInstanceServiceHandler) BatchGetInstanceSettings(context.Context, *connect.Request[v1.BatchGetInstanceSettingsRequest]) (*connect.Response[v1.BatchGetInstanceSettingsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.InstanceService.BatchGetInstanceSettings is not implemented"))
+}
+
+func (UnimplementedInstanceServiceHandler) UpdateInstanceSetting(context.Context, *connect.Request[v1.UpdateInstanceSettingRequest]) (*connect.Response[v1.InstanceSetting], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.InstanceService.UpdateInstanceSetting is not implemented"))
+}
+
+func (UnimplementedInstanceServiceHandler) TestInstanceEmailSetting(context.Context, *connect.Request[v1.TestInstanceEmailSettingRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.InstanceService.TestInstanceEmailSetting is not implemented"))
+}
+
+func (UnimplementedInstanceServiceHandler) GetInstanceStats(context.Context, *connect.Request[v1.GetInstanceStatsRequest]) (*connect.Response[v1.InstanceStats], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.InstanceService.GetInstanceStats is not implemented"))
+}

proto/gen/api/v1/apiv1connect/memo_service.connect.go

@@ -0,0 +1,698 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: api/v1/memo_service.proto
+
+package apiv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "github.com/usememos/memos/proto/gen/api/v1"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// MemoServiceName is the fully-qualified name of the MemoService service.
+	MemoServiceName = "memos.api.v1.MemoService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// MemoServiceCreateMemoProcedure is the fully-qualified name of the MemoService's CreateMemo RPC.
+	MemoServiceCreateMemoProcedure = "/memos.api.v1.MemoService/CreateMemo"
+	// MemoServiceListMemosProcedure is the fully-qualified name of the MemoService's ListMemos RPC.
+	MemoServiceListMemosProcedure = "/memos.api.v1.MemoService/ListMemos"
+	// MemoServiceGetMemoProcedure is the fully-qualified name of the MemoService's GetMemo RPC.
+	MemoServiceGetMemoProcedure = "/memos.api.v1.MemoService/GetMemo"
+	// MemoServiceUpdateMemoProcedure is the fully-qualified name of the MemoService's UpdateMemo RPC.
+	MemoServiceUpdateMemoProcedure = "/memos.api.v1.MemoService/UpdateMemo"
+	// MemoServiceDeleteMemoProcedure is the fully-qualified name of the MemoService's DeleteMemo RPC.
+	MemoServiceDeleteMemoProcedure = "/memos.api.v1.MemoService/DeleteMemo"
+	// MemoServiceSetMemoAttachmentsProcedure is the fully-qualified name of the MemoService's
+	// SetMemoAttachments RPC.
+	MemoServiceSetMemoAttachmentsProcedure = "/memos.api.v1.MemoService/SetMemoAttachments"
+	// MemoServiceListMemoAttachmentsProcedure is the fully-qualified name of the MemoService's
+	// ListMemoAttachments RPC.
+	MemoServiceListMemoAttachmentsProcedure = "/memos.api.v1.MemoService/ListMemoAttachments"
+	// MemoServiceSetMemoRelationsProcedure is the fully-qualified name of the MemoService's
+	// SetMemoRelations RPC.
+	MemoServiceSetMemoRelationsProcedure = "/memos.api.v1.MemoService/SetMemoRelations"
+	// MemoServiceListMemoRelationsProcedure is the fully-qualified name of the MemoService's
+	// ListMemoRelations RPC.
+	MemoServiceListMemoRelationsProcedure = "/memos.api.v1.MemoService/ListMemoRelations"
+	// MemoServiceCreateMemoCommentProcedure is the fully-qualified name of the MemoService's
+	// CreateMemoComment RPC.
+	MemoServiceCreateMemoCommentProcedure = "/memos.api.v1.MemoService/CreateMemoComment"
+	// MemoServiceListMemoCommentsProcedure is the fully-qualified name of the MemoService's
+	// ListMemoComments RPC.
+	MemoServiceListMemoCommentsProcedure = "/memos.api.v1.MemoService/ListMemoComments"
+	// MemoServiceListMemoReactionsProcedure is the fully-qualified name of the MemoService's
+	// ListMemoReactions RPC.
+	MemoServiceListMemoReactionsProcedure = "/memos.api.v1.MemoService/ListMemoReactions"
+	// MemoServiceUpsertMemoReactionProcedure is the fully-qualified name of the MemoService's
+	// UpsertMemoReaction RPC.
+	MemoServiceUpsertMemoReactionProcedure = "/memos.api.v1.MemoService/UpsertMemoReaction"
+	// MemoServiceDeleteMemoReactionProcedure is the fully-qualified name of the MemoService's
+	// DeleteMemoReaction RPC.
+	MemoServiceDeleteMemoReactionProcedure = "/memos.api.v1.MemoService/DeleteMemoReaction"
+	// MemoServiceCreateMemoShareProcedure is the fully-qualified name of the MemoService's
+	// CreateMemoShare RPC.
+	MemoServiceCreateMemoShareProcedure = "/memos.api.v1.MemoService/CreateMemoShare"
+	// MemoServiceListMemoSharesProcedure is the fully-qualified name of the MemoService's
+	// ListMemoShares RPC.
+	MemoServiceListMemoSharesProcedure = "/memos.api.v1.MemoService/ListMemoShares"
+	// MemoServiceDeleteMemoShareProcedure is the fully-qualified name of the MemoService's
+	// DeleteMemoShare RPC.
+	MemoServiceDeleteMemoShareProcedure = "/memos.api.v1.MemoService/DeleteMemoShare"
+	// MemoServiceGetMemoByShareProcedure is the fully-qualified name of the MemoService's
+	// GetMemoByShare RPC.
+	MemoServiceGetMemoByShareProcedure = "/memos.api.v1.MemoService/GetMemoByShare"
+	// MemoServiceGetLinkMetadataProcedure is the fully-qualified name of the MemoService's
+	// GetLinkMetadata RPC.
+	MemoServiceGetLinkMetadataProcedure = "/memos.api.v1.MemoService/GetLinkMetadata"
+	// MemoServiceBatchGetLinkMetadataProcedure is the fully-qualified name of the MemoService's
+	// BatchGetLinkMetadata RPC.
+	MemoServiceBatchGetLinkMetadataProcedure = "/memos.api.v1.MemoService/BatchGetLinkMetadata"
+)
+
+// MemoServiceClient is a client for the memos.api.v1.MemoService service.
+type MemoServiceClient interface {
+	// CreateMemo creates a memo.
+	CreateMemo(context.Context, *connect.Request[v1.CreateMemoRequest]) (*connect.Response[v1.Memo], error)
+	// ListMemos lists memos with pagination and filter.
+	ListMemos(context.Context, *connect.Request[v1.ListMemosRequest]) (*connect.Response[v1.ListMemosResponse], error)
+	// GetMemo gets a memo.
+	GetMemo(context.Context, *connect.Request[v1.GetMemoRequest]) (*connect.Response[v1.Memo], error)
+	// UpdateMemo updates a memo.
+	UpdateMemo(context.Context, *connect.Request[v1.UpdateMemoRequest]) (*connect.Response[v1.Memo], error)
+	// DeleteMemo deletes a memo.
+	DeleteMemo(context.Context, *connect.Request[v1.DeleteMemoRequest]) (*connect.Response[emptypb.Empty], error)
+	// SetMemoAttachments sets attachments for a memo.
+	SetMemoAttachments(context.Context, *connect.Request[v1.SetMemoAttachmentsRequest]) (*connect.Response[emptypb.Empty], error)
+	// ListMemoAttachments lists attachments for a memo.
+	ListMemoAttachments(context.Context, *connect.Request[v1.ListMemoAttachmentsRequest]) (*connect.Response[v1.ListMemoAttachmentsResponse], error)
+	// SetMemoRelations sets relations for a memo.
+	SetMemoRelations(context.Context, *connect.Request[v1.SetMemoRelationsRequest]) (*connect.Response[emptypb.Empty], error)
+	// ListMemoRelations lists relations for a memo.
+	ListMemoRelations(context.Context, *connect.Request[v1.ListMemoRelationsRequest]) (*connect.Response[v1.ListMemoRelationsResponse], error)
+	// CreateMemoComment creates a comment for a memo.
+	CreateMemoComment(context.Context, *connect.Request[v1.CreateMemoCommentRequest]) (*connect.Response[v1.Memo], error)
+	// ListMemoComments lists comments for a memo.
+	ListMemoComments(context.Context, *connect.Request[v1.ListMemoCommentsRequest]) (*connect.Response[v1.ListMemoCommentsResponse], error)
+	// ListMemoReactions lists reactions for a memo.
+	ListMemoReactions(context.Context, *connect.Request[v1.ListMemoReactionsRequest]) (*connect.Response[v1.ListMemoReactionsResponse], error)
+	// UpsertMemoReaction upserts a reaction for a memo.
+	UpsertMemoReaction(context.Context, *connect.Request[v1.UpsertMemoReactionRequest]) (*connect.Response[v1.Reaction], error)
+	// DeleteMemoReaction deletes a reaction for a memo.
+	DeleteMemoReaction(context.Context, *connect.Request[v1.DeleteMemoReactionRequest]) (*connect.Response[emptypb.Empty], error)
+	// CreateMemoShare creates a share link for a memo. Requires authentication as the memo creator.
+	CreateMemoShare(context.Context, *connect.Request[v1.CreateMemoShareRequest]) (*connect.Response[v1.MemoShare], error)
+	// ListMemoShares lists all share links for a memo. Requires authentication as the memo creator.
+	ListMemoShares(context.Context, *connect.Request[v1.ListMemoSharesRequest]) (*connect.Response[v1.ListMemoSharesResponse], error)
+	// DeleteMemoShare revokes a share link. Requires authentication as the memo creator.
+	DeleteMemoShare(context.Context, *connect.Request[v1.DeleteMemoShareRequest]) (*connect.Response[emptypb.Empty], error)
+	// GetMemoByShare resolves a share token to its memo. No authentication required.
+	// Returns NOT_FOUND if the token is invalid or expired.
+	GetMemoByShare(context.Context, *connect.Request[v1.GetMemoByShareRequest]) (*connect.Response[v1.Memo], error)
+	// GetLinkMetadata gets metadata for a link.
+	GetLinkMetadata(context.Context, *connect.Request[v1.GetLinkMetadataRequest]) (*connect.Response[v1.LinkMetadata], error)
+	// BatchGetLinkMetadata gets metadata for links.
+	BatchGetLinkMetadata(context.Context, *connect.Request[v1.BatchGetLinkMetadataRequest]) (*connect.Response[v1.BatchGetLinkMetadataResponse], error)
+}
+
+// NewMemoServiceClient constructs a client for the memos.api.v1.MemoService service. By default, it
+// uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and sends
+// uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or
+// connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewMemoServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) MemoServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	memoServiceMethods := v1.File_api_v1_memo_service_proto.Services().ByName("MemoService").Methods()
+	return &memoServiceClient{
+		createMemo: connect.NewClient[v1.CreateMemoRequest, v1.Memo](
+			httpClient,
+			baseURL+MemoServiceCreateMemoProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("CreateMemo")),
+			connect.WithClientOptions(opts...),
+		),
+		listMemos: connect.NewClient[v1.ListMemosRequest, v1.ListMemosResponse](
+			httpClient,
+			baseURL+MemoServiceListMemosProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("ListMemos")),
+			connect.WithClientOptions(opts...),
+		),
+		getMemo: connect.NewClient[v1.GetMemoRequest, v1.Memo](
+			httpClient,
+			baseURL+MemoServiceGetMemoProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("GetMemo")),
+			connect.WithClientOptions(opts...),
+		),
+		updateMemo: connect.NewClient[v1.UpdateMemoRequest, v1.Memo](
+			httpClient,
+			baseURL+MemoServiceUpdateMemoProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("UpdateMemo")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteMemo: connect.NewClient[v1.DeleteMemoRequest, emptypb.Empty](
+			httpClient,
+			baseURL+MemoServiceDeleteMemoProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("DeleteMemo")),
+			connect.WithClientOptions(opts...),
+		),
+		setMemoAttachments: connect.NewClient[v1.SetMemoAttachmentsRequest, emptypb.Empty](
+			httpClient,
+			baseURL+MemoServiceSetMemoAttachmentsProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("SetMemoAttachments")),
+			connect.WithClientOptions(opts...),
+		),
+		listMemoAttachments: connect.NewClient[v1.ListMemoAttachmentsRequest, v1.ListMemoAttachmentsResponse](
+			httpClient,
+			baseURL+MemoServiceListMemoAttachmentsProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("ListMemoAttachments")),
+			connect.WithClientOptions(opts...),
+		),
+		setMemoRelations: connect.NewClient[v1.SetMemoRelationsRequest, emptypb.Empty](
+			httpClient,
+			baseURL+MemoServiceSetMemoRelationsProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("SetMemoRelations")),
+			connect.WithClientOptions(opts...),
+		),
+		listMemoRelations: connect.NewClient[v1.ListMemoRelationsRequest, v1.ListMemoRelationsResponse](
+			httpClient,
+			baseURL+MemoServiceListMemoRelationsProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("ListMemoRelations")),
+			connect.WithClientOptions(opts...),
+		),
+		createMemoComment: connect.NewClient[v1.CreateMemoCommentRequest, v1.Memo](
+			httpClient,
+			baseURL+MemoServiceCreateMemoCommentProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("CreateMemoComment")),
+			connect.WithClientOptions(opts...),
+		),
+		listMemoComments: connect.NewClient[v1.ListMemoCommentsRequest, v1.ListMemoCommentsResponse](
+			httpClient,
+			baseURL+MemoServiceListMemoCommentsProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("ListMemoComments")),
+			connect.WithClientOptions(opts...),
+		),
+		listMemoReactions: connect.NewClient[v1.ListMemoReactionsRequest, v1.ListMemoReactionsResponse](
+			httpClient,
+			baseURL+MemoServiceListMemoReactionsProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("ListMemoReactions")),
+			connect.WithClientOptions(opts...),
+		),
+		upsertMemoReaction: connect.NewClient[v1.UpsertMemoReactionRequest, v1.Reaction](
+			httpClient,
+			baseURL+MemoServiceUpsertMemoReactionProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("UpsertMemoReaction")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteMemoReaction: connect.NewClient[v1.DeleteMemoReactionRequest, emptypb.Empty](
+			httpClient,
+			baseURL+MemoServiceDeleteMemoReactionProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("DeleteMemoReaction")),
+			connect.WithClientOptions(opts...),
+		),
+		createMemoShare: connect.NewClient[v1.CreateMemoShareRequest, v1.MemoShare](
+			httpClient,
+			baseURL+MemoServiceCreateMemoShareProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("CreateMemoShare")),
+			connect.WithClientOptions(opts...),
+		),
+		listMemoShares: connect.NewClient[v1.ListMemoSharesRequest, v1.ListMemoSharesResponse](
+			httpClient,
+			baseURL+MemoServiceListMemoSharesProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("ListMemoShares")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteMemoShare: connect.NewClient[v1.DeleteMemoShareRequest, emptypb.Empty](
+			httpClient,
+			baseURL+MemoServiceDeleteMemoShareProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("DeleteMemoShare")),
+			connect.WithClientOptions(opts...),
+		),
+		getMemoByShare: connect.NewClient[v1.GetMemoByShareRequest, v1.Memo](
+			httpClient,
+			baseURL+MemoServiceGetMemoByShareProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("GetMemoByShare")),
+			connect.WithClientOptions(opts...),
+		),
+		getLinkMetadata: connect.NewClient[v1.GetLinkMetadataRequest, v1.LinkMetadata](
+			httpClient,
+			baseURL+MemoServiceGetLinkMetadataProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("GetLinkMetadata")),
+			connect.WithClientOptions(opts...),
+		),
+		batchGetLinkMetadata: connect.NewClient[v1.BatchGetLinkMetadataRequest, v1.BatchGetLinkMetadataResponse](
+			httpClient,
+			baseURL+MemoServiceBatchGetLinkMetadataProcedure,
+			connect.WithSchema(memoServiceMethods.ByName("BatchGetLinkMetadata")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// memoServiceClient implements MemoServiceClient.
+type memoServiceClient struct {
+	createMemo           *connect.Client[v1.CreateMemoRequest, v1.Memo]
+	listMemos            *connect.Client[v1.ListMemosRequest, v1.ListMemosResponse]
+	getMemo              *connect.Client[v1.GetMemoRequest, v1.Memo]
+	updateMemo           *connect.Client[v1.UpdateMemoRequest, v1.Memo]
+	deleteMemo           *connect.Client[v1.DeleteMemoRequest, emptypb.Empty]
+	setMemoAttachments   *connect.Client[v1.SetMemoAttachmentsRequest, emptypb.Empty]
+	listMemoAttachments  *connect.Client[v1.ListMemoAttachmentsRequest, v1.ListMemoAttachmentsResponse]
+	setMemoRelations     *connect.Client[v1.SetMemoRelationsRequest, emptypb.Empty]
+	listMemoRelations    *connect.Client[v1.ListMemoRelationsRequest, v1.ListMemoRelationsResponse]
+	createMemoComment    *connect.Client[v1.CreateMemoCommentRequest, v1.Memo]
+	listMemoComments     *connect.Client[v1.ListMemoCommentsRequest, v1.ListMemoCommentsResponse]
+	listMemoReactions    *connect.Client[v1.ListMemoReactionsRequest, v1.ListMemoReactionsResponse]
+	upsertMemoReaction   *connect.Client[v1.UpsertMemoReactionRequest, v1.Reaction]
+	deleteMemoReaction   *connect.Client[v1.DeleteMemoReactionRequest, emptypb.Empty]
+	createMemoShare      *connect.Client[v1.CreateMemoShareRequest, v1.MemoShare]
+	listMemoShares       *connect.Client[v1.ListMemoSharesRequest, v1.ListMemoSharesResponse]
+	deleteMemoShare      *connect.Client[v1.DeleteMemoShareRequest, emptypb.Empty]
+	getMemoByShare       *connect.Client[v1.GetMemoByShareRequest, v1.Memo]
+	getLinkMetadata      *connect.Client[v1.GetLinkMetadataRequest, v1.LinkMetadata]
+	batchGetLinkMetadata *connect.Client[v1.BatchGetLinkMetadataRequest, v1.BatchGetLinkMetadataResponse]
+}
+
+// CreateMemo calls memos.api.v1.MemoService.CreateMemo.
+func (c *memoServiceClient) CreateMemo(ctx context.Context, req *connect.Request[v1.CreateMemoRequest]) (*connect.Response[v1.Memo], error) {
+	return c.createMemo.CallUnary(ctx, req)
+}
+
+// ListMemos calls memos.api.v1.MemoService.ListMemos.
+func (c *memoServiceClient) ListMemos(ctx context.Context, req *connect.Request[v1.ListMemosRequest]) (*connect.Response[v1.ListMemosResponse], error) {
+	return c.listMemos.CallUnary(ctx, req)
+}
+
+// GetMemo calls memos.api.v1.MemoService.GetMemo.
+func (c *memoServiceClient) GetMemo(ctx context.Context, req *connect.Request[v1.GetMemoRequest]) (*connect.Response[v1.Memo], error) {
+	return c.getMemo.CallUnary(ctx, req)
+}
+
+// UpdateMemo calls memos.api.v1.MemoService.UpdateMemo.
+func (c *memoServiceClient) UpdateMemo(ctx context.Context, req *connect.Request[v1.UpdateMemoRequest]) (*connect.Response[v1.Memo], error) {
+	return c.updateMemo.CallUnary(ctx, req)
+}
+
+// DeleteMemo calls memos.api.v1.MemoService.DeleteMemo.
+func (c *memoServiceClient) DeleteMemo(ctx context.Context, req *connect.Request[v1.DeleteMemoRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.deleteMemo.CallUnary(ctx, req)
+}
+
+// SetMemoAttachments calls memos.api.v1.MemoService.SetMemoAttachments.
+func (c *memoServiceClient) SetMemoAttachments(ctx context.Context, req *connect.Request[v1.SetMemoAttachmentsRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.setMemoAttachments.CallUnary(ctx, req)
+}
+
+// ListMemoAttachments calls memos.api.v1.MemoService.ListMemoAttachments.
+func (c *memoServiceClient) ListMemoAttachments(ctx context.Context, req *connect.Request[v1.ListMemoAttachmentsRequest]) (*connect.Response[v1.ListMemoAttachmentsResponse], error) {
+	return c.listMemoAttachments.CallUnary(ctx, req)
+}
+
+// SetMemoRelations calls memos.api.v1.MemoService.SetMemoRelations.
+func (c *memoServiceClient) SetMemoRelations(ctx context.Context, req *connect.Request[v1.SetMemoRelationsRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.setMemoRelations.CallUnary(ctx, req)
+}
+
+// ListMemoRelations calls memos.api.v1.MemoService.ListMemoRelations.
+func (c *memoServiceClient) ListMemoRelations(ctx context.Context, req *connect.Request[v1.ListMemoRelationsRequest]) (*connect.Response[v1.ListMemoRelationsResponse], error) {
+	return c.listMemoRelations.CallUnary(ctx, req)
+}
+
+// CreateMemoComment calls memos.api.v1.MemoService.CreateMemoComment.
+func (c *memoServiceClient) CreateMemoComment(ctx context.Context, req *connect.Request[v1.CreateMemoCommentRequest]) (*connect.Response[v1.Memo], error) {
+	return c.createMemoComment.CallUnary(ctx, req)
+}
+
+// ListMemoComments calls memos.api.v1.MemoService.ListMemoComments.
+func (c *memoServiceClient) ListMemoComments(ctx context.Context, req *connect.Request[v1.ListMemoCommentsRequest]) (*connect.Response[v1.ListMemoCommentsResponse], error) {
+	return c.listMemoComments.CallUnary(ctx, req)
+}
+
+// ListMemoReactions calls memos.api.v1.MemoService.ListMemoReactions.
+func (c *memoServiceClient) ListMemoReactions(ctx context.Context, req *connect.Request[v1.ListMemoReactionsRequest]) (*connect.Response[v1.ListMemoReactionsResponse], error) {
+	return c.listMemoReactions.CallUnary(ctx, req)
+}
+
+// UpsertMemoReaction calls memos.api.v1.MemoService.UpsertMemoReaction.
+func (c *memoServiceClient) UpsertMemoReaction(ctx context.Context, req *connect.Request[v1.UpsertMemoReactionRequest]) (*connect.Response[v1.Reaction], error) {
+	return c.upsertMemoReaction.CallUnary(ctx, req)
+}
+
+// DeleteMemoReaction calls memos.api.v1.MemoService.DeleteMemoReaction.
+func (c *memoServiceClient) DeleteMemoReaction(ctx context.Context, req *connect.Request[v1.DeleteMemoReactionRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.deleteMemoReaction.CallUnary(ctx, req)
+}
+
+// CreateMemoShare calls memos.api.v1.MemoService.CreateMemoShare.
+func (c *memoServiceClient) CreateMemoShare(ctx context.Context, req *connect.Request[v1.CreateMemoShareRequest]) (*connect.Response[v1.MemoShare], error) {
+	return c.createMemoShare.CallUnary(ctx, req)
+}
+
+// ListMemoShares calls memos.api.v1.MemoService.ListMemoShares.
+func (c *memoServiceClient) ListMemoShares(ctx context.Context, req *connect.Request[v1.ListMemoSharesRequest]) (*connect.Response[v1.ListMemoSharesResponse], error) {
+	return c.listMemoShares.CallUnary(ctx, req)
+}
+
+// DeleteMemoShare calls memos.api.v1.MemoService.DeleteMemoShare.
+func (c *memoServiceClient) DeleteMemoShare(ctx context.Context, req *connect.Request[v1.DeleteMemoShareRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.deleteMemoShare.CallUnary(ctx, req)
+}
+
+// GetMemoByShare calls memos.api.v1.MemoService.GetMemoByShare.
+func (c *memoServiceClient) GetMemoByShare(ctx context.Context, req *connect.Request[v1.GetMemoByShareRequest]) (*connect.Response[v1.Memo], error) {
+	return c.getMemoByShare.CallUnary(ctx, req)
+}
+
+// GetLinkMetadata calls memos.api.v1.MemoService.GetLinkMetadata.
+func (c *memoServiceClient) GetLinkMetadata(ctx context.Context, req *connect.Request[v1.GetLinkMetadataRequest]) (*connect.Response[v1.LinkMetadata], error) {
+	return c.getLinkMetadata.CallUnary(ctx, req)
+}
+
+// BatchGetLinkMetadata calls memos.api.v1.MemoService.BatchGetLinkMetadata.
+func (c *memoServiceClient) BatchGetLinkMetadata(ctx context.Context, req *connect.Request[v1.BatchGetLinkMetadataRequest]) (*connect.Response[v1.BatchGetLinkMetadataResponse], error) {
+	return c.batchGetLinkMetadata.CallUnary(ctx, req)
+}
+
+// MemoServiceHandler is an implementation of the memos.api.v1.MemoService service.
+type MemoServiceHandler interface {
+	// CreateMemo creates a memo.
+	CreateMemo(context.Context, *connect.Request[v1.CreateMemoRequest]) (*connect.Response[v1.Memo], error)
+	// ListMemos lists memos with pagination and filter.
+	ListMemos(context.Context, *connect.Request[v1.ListMemosRequest]) (*connect.Response[v1.ListMemosResponse], error)
+	// GetMemo gets a memo.
+	GetMemo(context.Context, *connect.Request[v1.GetMemoRequest]) (*connect.Response[v1.Memo], error)
+	// UpdateMemo updates a memo.
+	UpdateMemo(context.Context, *connect.Request[v1.UpdateMemoRequest]) (*connect.Response[v1.Memo], error)
+	// DeleteMemo deletes a memo.
+	DeleteMemo(context.Context, *connect.Request[v1.DeleteMemoRequest]) (*connect.Response[emptypb.Empty], error)
+	// SetMemoAttachments sets attachments for a memo.
+	SetMemoAttachments(context.Context, *connect.Request[v1.SetMemoAttachmentsRequest]) (*connect.Response[emptypb.Empty], error)
+	// ListMemoAttachments lists attachments for a memo.
+	ListMemoAttachments(context.Context, *connect.Request[v1.ListMemoAttachmentsRequest]) (*connect.Response[v1.ListMemoAttachmentsResponse], error)
+	// SetMemoRelations sets relations for a memo.
+	SetMemoRelations(context.Context, *connect.Request[v1.SetMemoRelationsRequest]) (*connect.Response[emptypb.Empty], error)
+	// ListMemoRelations lists relations for a memo.
+	ListMemoRelations(context.Context, *connect.Request[v1.ListMemoRelationsRequest]) (*connect.Response[v1.ListMemoRelationsResponse], error)
+	// CreateMemoComment creates a comment for a memo.
+	CreateMemoComment(context.Context, *connect.Request[v1.CreateMemoCommentRequest]) (*connect.Response[v1.Memo], error)
+	// ListMemoComments lists comments for a memo.
+	ListMemoComments(context.Context, *connect.Request[v1.ListMemoCommentsRequest]) (*connect.Response[v1.ListMemoCommentsResponse], error)
+	// ListMemoReactions lists reactions for a memo.
+	ListMemoReactions(context.Context, *connect.Request[v1.ListMemoReactionsRequest]) (*connect.Response[v1.ListMemoReactionsResponse], error)
+	// UpsertMemoReaction upserts a reaction for a memo.
+	UpsertMemoReaction(context.Context, *connect.Request[v1.UpsertMemoReactionRequest]) (*connect.Response[v1.Reaction], error)
+	// DeleteMemoReaction deletes a reaction for a memo.
+	DeleteMemoReaction(context.Context, *connect.Request[v1.DeleteMemoReactionRequest]) (*connect.Response[emptypb.Empty], error)
+	// CreateMemoShare creates a share link for a memo. Requires authentication as the memo creator.
+	CreateMemoShare(context.Context, *connect.Request[v1.CreateMemoShareRequest]) (*connect.Response[v1.MemoShare], error)
+	// ListMemoShares lists all share links for a memo. Requires authentication as the memo creator.
+	ListMemoShares(context.Context, *connect.Request[v1.ListMemoSharesRequest]) (*connect.Response[v1.ListMemoSharesResponse], error)
+	// DeleteMemoShare revokes a share link. Requires authentication as the memo creator.
+	DeleteMemoShare(context.Context, *connect.Request[v1.DeleteMemoShareRequest]) (*connect.Response[emptypb.Empty], error)
+	// GetMemoByShare resolves a share token to its memo. No authentication required.
+	// Returns NOT_FOUND if the token is invalid or expired.
+	GetMemoByShare(context.Context, *connect.Request[v1.GetMemoByShareRequest]) (*connect.Response[v1.Memo], error)
+	// GetLinkMetadata gets metadata for a link.
+	GetLinkMetadata(context.Context, *connect.Request[v1.GetLinkMetadataRequest]) (*connect.Response[v1.LinkMetadata], error)
+	// BatchGetLinkMetadata gets metadata for links.
+	BatchGetLinkMetadata(context.Context, *connect.Request[v1.BatchGetLinkMetadataRequest]) (*connect.Response[v1.BatchGetLinkMetadataResponse], error)
+}
+
+// NewMemoServiceHandler builds an HTTP handler from the service implementation. It returns the path
+// on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewMemoServiceHandler(svc MemoServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	memoServiceMethods := v1.File_api_v1_memo_service_proto.Services().ByName("MemoService").Methods()
+	memoServiceCreateMemoHandler := connect.NewUnaryHandler(
+		MemoServiceCreateMemoProcedure,
+		svc.CreateMemo,
+		connect.WithSchema(memoServiceMethods.ByName("CreateMemo")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceListMemosHandler := connect.NewUnaryHandler(
+		MemoServiceListMemosProcedure,
+		svc.ListMemos,
+		connect.WithSchema(memoServiceMethods.ByName("ListMemos")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceGetMemoHandler := connect.NewUnaryHandler(
+		MemoServiceGetMemoProcedure,
+		svc.GetMemo,
+		connect.WithSchema(memoServiceMethods.ByName("GetMemo")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceUpdateMemoHandler := connect.NewUnaryHandler(
+		MemoServiceUpdateMemoProcedure,
+		svc.UpdateMemo,
+		connect.WithSchema(memoServiceMethods.ByName("UpdateMemo")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceDeleteMemoHandler := connect.NewUnaryHandler(
+		MemoServiceDeleteMemoProcedure,
+		svc.DeleteMemo,
+		connect.WithSchema(memoServiceMethods.ByName("DeleteMemo")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceSetMemoAttachmentsHandler := connect.NewUnaryHandler(
+		MemoServiceSetMemoAttachmentsProcedure,
+		svc.SetMemoAttachments,
+		connect.WithSchema(memoServiceMethods.ByName("SetMemoAttachments")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceListMemoAttachmentsHandler := connect.NewUnaryHandler(
+		MemoServiceListMemoAttachmentsProcedure,
+		svc.ListMemoAttachments,
+		connect.WithSchema(memoServiceMethods.ByName("ListMemoAttachments")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceSetMemoRelationsHandler := connect.NewUnaryHandler(
+		MemoServiceSetMemoRelationsProcedure,
+		svc.SetMemoRelations,
+		connect.WithSchema(memoServiceMethods.ByName("SetMemoRelations")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceListMemoRelationsHandler := connect.NewUnaryHandler(
+		MemoServiceListMemoRelationsProcedure,
+		svc.ListMemoRelations,
+		connect.WithSchema(memoServiceMethods.ByName("ListMemoRelations")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceCreateMemoCommentHandler := connect.NewUnaryHandler(
+		MemoServiceCreateMemoCommentProcedure,
+		svc.CreateMemoComment,
+		connect.WithSchema(memoServiceMethods.ByName("CreateMemoComment")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceListMemoCommentsHandler := connect.NewUnaryHandler(
+		MemoServiceListMemoCommentsProcedure,
+		svc.ListMemoComments,
+		connect.WithSchema(memoServiceMethods.ByName("ListMemoComments")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceListMemoReactionsHandler := connect.NewUnaryHandler(
+		MemoServiceListMemoReactionsProcedure,
+		svc.ListMemoReactions,
+		connect.WithSchema(memoServiceMethods.ByName("ListMemoReactions")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceUpsertMemoReactionHandler := connect.NewUnaryHandler(
+		MemoServiceUpsertMemoReactionProcedure,
+		svc.UpsertMemoReaction,
+		connect.WithSchema(memoServiceMethods.ByName("UpsertMemoReaction")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceDeleteMemoReactionHandler := connect.NewUnaryHandler(
+		MemoServiceDeleteMemoReactionProcedure,
+		svc.DeleteMemoReaction,
+		connect.WithSchema(memoServiceMethods.ByName("DeleteMemoReaction")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceCreateMemoShareHandler := connect.NewUnaryHandler(
+		MemoServiceCreateMemoShareProcedure,
+		svc.CreateMemoShare,
+		connect.WithSchema(memoServiceMethods.ByName("CreateMemoShare")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceListMemoSharesHandler := connect.NewUnaryHandler(
+		MemoServiceListMemoSharesProcedure,
+		svc.ListMemoShares,
+		connect.WithSchema(memoServiceMethods.ByName("ListMemoShares")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceDeleteMemoShareHandler := connect.NewUnaryHandler(
+		MemoServiceDeleteMemoShareProcedure,
+		svc.DeleteMemoShare,
+		connect.WithSchema(memoServiceMethods.ByName("DeleteMemoShare")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceGetMemoByShareHandler := connect.NewUnaryHandler(
+		MemoServiceGetMemoByShareProcedure,
+		svc.GetMemoByShare,
+		connect.WithSchema(memoServiceMethods.ByName("GetMemoByShare")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceGetLinkMetadataHandler := connect.NewUnaryHandler(
+		MemoServiceGetLinkMetadataProcedure,
+		svc.GetLinkMetadata,
+		connect.WithSchema(memoServiceMethods.ByName("GetLinkMetadata")),
+		connect.WithHandlerOptions(opts...),
+	)
+	memoServiceBatchGetLinkMetadataHandler := connect.NewUnaryHandler(
+		MemoServiceBatchGetLinkMetadataProcedure,
+		svc.BatchGetLinkMetadata,
+		connect.WithSchema(memoServiceMethods.ByName("BatchGetLinkMetadata")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/memos.api.v1.MemoService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case MemoServiceCreateMemoProcedure:
+			memoServiceCreateMemoHandler.ServeHTTP(w, r)
+		case MemoServiceListMemosProcedure:
+			memoServiceListMemosHandler.ServeHTTP(w, r)
+		case MemoServiceGetMemoProcedure:
+			memoServiceGetMemoHandler.ServeHTTP(w, r)
+		case MemoServiceUpdateMemoProcedure:
+			memoServiceUpdateMemoHandler.ServeHTTP(w, r)
+		case MemoServiceDeleteMemoProcedure:
+			memoServiceDeleteMemoHandler.ServeHTTP(w, r)
+		case MemoServiceSetMemoAttachmentsProcedure:
+			memoServiceSetMemoAttachmentsHandler.ServeHTTP(w, r)
+		case MemoServiceListMemoAttachmentsProcedure:
+			memoServiceListMemoAttachmentsHandler.ServeHTTP(w, r)
+		case MemoServiceSetMemoRelationsProcedure:
+			memoServiceSetMemoRelationsHandler.ServeHTTP(w, r)
+		case MemoServiceListMemoRelationsProcedure:
+			memoServiceListMemoRelationsHandler.ServeHTTP(w, r)
+		case MemoServiceCreateMemoCommentProcedure:
+			memoServiceCreateMemoCommentHandler.ServeHTTP(w, r)
+		case MemoServiceListMemoCommentsProcedure:
+			memoServiceListMemoCommentsHandler.ServeHTTP(w, r)
+		case MemoServiceListMemoReactionsProcedure:
+			memoServiceListMemoReactionsHandler.ServeHTTP(w, r)
+		case MemoServiceUpsertMemoReactionProcedure:
+			memoServiceUpsertMemoReactionHandler.ServeHTTP(w, r)
+		case MemoServiceDeleteMemoReactionProcedure:
+			memoServiceDeleteMemoReactionHandler.ServeHTTP(w, r)
+		case MemoServiceCreateMemoShareProcedure:
+			memoServiceCreateMemoShareHandler.ServeHTTP(w, r)
+		case MemoServiceListMemoSharesProcedure:
+			memoServiceListMemoSharesHandler.ServeHTTP(w, r)
+		case MemoServiceDeleteMemoShareProcedure:
+			memoServiceDeleteMemoShareHandler.ServeHTTP(w, r)
+		case MemoServiceGetMemoByShareProcedure:
+			memoServiceGetMemoByShareHandler.ServeHTTP(w, r)
+		case MemoServiceGetLinkMetadataProcedure:
+			memoServiceGetLinkMetadataHandler.ServeHTTP(w, r)
+		case MemoServiceBatchGetLinkMetadataProcedure:
+			memoServiceBatchGetLinkMetadataHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedMemoServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedMemoServiceHandler struct{}
+
+func (UnimplementedMemoServiceHandler) CreateMemo(context.Context, *connect.Request[v1.CreateMemoRequest]) (*connect.Response[v1.Memo], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.CreateMemo is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) ListMemos(context.Context, *connect.Request[v1.ListMemosRequest]) (*connect.Response[v1.ListMemosResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.ListMemos is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) GetMemo(context.Context, *connect.Request[v1.GetMemoRequest]) (*connect.Response[v1.Memo], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.GetMemo is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) UpdateMemo(context.Context, *connect.Request[v1.UpdateMemoRequest]) (*connect.Response[v1.Memo], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.UpdateMemo is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) DeleteMemo(context.Context, *connect.Request[v1.DeleteMemoRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.DeleteMemo is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) SetMemoAttachments(context.Context, *connect.Request[v1.SetMemoAttachmentsRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.SetMemoAttachments is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) ListMemoAttachments(context.Context, *connect.Request[v1.ListMemoAttachmentsRequest]) (*connect.Response[v1.ListMemoAttachmentsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.ListMemoAttachments is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) SetMemoRelations(context.Context, *connect.Request[v1.SetMemoRelationsRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.SetMemoRelations is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) ListMemoRelations(context.Context, *connect.Request[v1.ListMemoRelationsRequest]) (*connect.Response[v1.ListMemoRelationsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.ListMemoRelations is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) CreateMemoComment(context.Context, *connect.Request[v1.CreateMemoCommentRequest]) (*connect.Response[v1.Memo], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.CreateMemoComment is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) ListMemoComments(context.Context, *connect.Request[v1.ListMemoCommentsRequest]) (*connect.Response[v1.ListMemoCommentsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.ListMemoComments is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) ListMemoReactions(context.Context, *connect.Request[v1.ListMemoReactionsRequest]) (*connect.Response[v1.ListMemoReactionsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.ListMemoReactions is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) UpsertMemoReaction(context.Context, *connect.Request[v1.UpsertMemoReactionRequest]) (*connect.Response[v1.Reaction], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.UpsertMemoReaction is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) DeleteMemoReaction(context.Context, *connect.Request[v1.DeleteMemoReactionRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.DeleteMemoReaction is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) CreateMemoShare(context.Context, *connect.Request[v1.CreateMemoShareRequest]) (*connect.Response[v1.MemoShare], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.CreateMemoShare is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) ListMemoShares(context.Context, *connect.Request[v1.ListMemoSharesRequest]) (*connect.Response[v1.ListMemoSharesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.ListMemoShares is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) DeleteMemoShare(context.Context, *connect.Request[v1.DeleteMemoShareRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.DeleteMemoShare is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) GetMemoByShare(context.Context, *connect.Request[v1.GetMemoByShareRequest]) (*connect.Response[v1.Memo], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.GetMemoByShare is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) GetLinkMetadata(context.Context, *connect.Request[v1.GetLinkMetadataRequest]) (*connect.Response[v1.LinkMetadata], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.GetLinkMetadata is not implemented"))
+}
+
+func (UnimplementedMemoServiceHandler) BatchGetLinkMetadata(context.Context, *connect.Request[v1.BatchGetLinkMetadataRequest]) (*connect.Response[v1.BatchGetLinkMetadataResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.MemoService.BatchGetLinkMetadata is not implemented"))
+}

proto/gen/api/v1/apiv1connect/shortcut_service.connect.go

@@ -0,0 +1,236 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: api/v1/shortcut_service.proto
+
+package apiv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "github.com/usememos/memos/proto/gen/api/v1"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// ShortcutServiceName is the fully-qualified name of the ShortcutService service.
+	ShortcutServiceName = "memos.api.v1.ShortcutService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// ShortcutServiceListShortcutsProcedure is the fully-qualified name of the ShortcutService's
+	// ListShortcuts RPC.
+	ShortcutServiceListShortcutsProcedure = "/memos.api.v1.ShortcutService/ListShortcuts"
+	// ShortcutServiceGetShortcutProcedure is the fully-qualified name of the ShortcutService's
+	// GetShortcut RPC.
+	ShortcutServiceGetShortcutProcedure = "/memos.api.v1.ShortcutService/GetShortcut"
+	// ShortcutServiceCreateShortcutProcedure is the fully-qualified name of the ShortcutService's
+	// CreateShortcut RPC.
+	ShortcutServiceCreateShortcutProcedure = "/memos.api.v1.ShortcutService/CreateShortcut"
+	// ShortcutServiceUpdateShortcutProcedure is the fully-qualified name of the ShortcutService's
+	// UpdateShortcut RPC.
+	ShortcutServiceUpdateShortcutProcedure = "/memos.api.v1.ShortcutService/UpdateShortcut"
+	// ShortcutServiceDeleteShortcutProcedure is the fully-qualified name of the ShortcutService's
+	// DeleteShortcut RPC.
+	ShortcutServiceDeleteShortcutProcedure = "/memos.api.v1.ShortcutService/DeleteShortcut"
+)
+
+// ShortcutServiceClient is a client for the memos.api.v1.ShortcutService service.
+type ShortcutServiceClient interface {
+	// ListShortcuts returns a list of shortcuts for a user.
+	ListShortcuts(context.Context, *connect.Request[v1.ListShortcutsRequest]) (*connect.Response[v1.ListShortcutsResponse], error)
+	// GetShortcut gets a shortcut by name.
+	GetShortcut(context.Context, *connect.Request[v1.GetShortcutRequest]) (*connect.Response[v1.Shortcut], error)
+	// CreateShortcut creates a new shortcut for a user.
+	CreateShortcut(context.Context, *connect.Request[v1.CreateShortcutRequest]) (*connect.Response[v1.Shortcut], error)
+	// UpdateShortcut updates a shortcut for a user.
+	UpdateShortcut(context.Context, *connect.Request[v1.UpdateShortcutRequest]) (*connect.Response[v1.Shortcut], error)
+	// DeleteShortcut deletes a shortcut for a user.
+	DeleteShortcut(context.Context, *connect.Request[v1.DeleteShortcutRequest]) (*connect.Response[emptypb.Empty], error)
+}
+
+// NewShortcutServiceClient constructs a client for the memos.api.v1.ShortcutService service. By
+// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
+// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewShortcutServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) ShortcutServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	shortcutServiceMethods := v1.File_api_v1_shortcut_service_proto.Services().ByName("ShortcutService").Methods()
+	return &shortcutServiceClient{
+		listShortcuts: connect.NewClient[v1.ListShortcutsRequest, v1.ListShortcutsResponse](
+			httpClient,
+			baseURL+ShortcutServiceListShortcutsProcedure,
+			connect.WithSchema(shortcutServiceMethods.ByName("ListShortcuts")),
+			connect.WithClientOptions(opts...),
+		),
+		getShortcut: connect.NewClient[v1.GetShortcutRequest, v1.Shortcut](
+			httpClient,
+			baseURL+ShortcutServiceGetShortcutProcedure,
+			connect.WithSchema(shortcutServiceMethods.ByName("GetShortcut")),
+			connect.WithClientOptions(opts...),
+		),
+		createShortcut: connect.NewClient[v1.CreateShortcutRequest, v1.Shortcut](
+			httpClient,
+			baseURL+ShortcutServiceCreateShortcutProcedure,
+			connect.WithSchema(shortcutServiceMethods.ByName("CreateShortcut")),
+			connect.WithClientOptions(opts...),
+		),
+		updateShortcut: connect.NewClient[v1.UpdateShortcutRequest, v1.Shortcut](
+			httpClient,
+			baseURL+ShortcutServiceUpdateShortcutProcedure,
+			connect.WithSchema(shortcutServiceMethods.ByName("UpdateShortcut")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteShortcut: connect.NewClient[v1.DeleteShortcutRequest, emptypb.Empty](
+			httpClient,
+			baseURL+ShortcutServiceDeleteShortcutProcedure,
+			connect.WithSchema(shortcutServiceMethods.ByName("DeleteShortcut")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// shortcutServiceClient implements ShortcutServiceClient.
+type shortcutServiceClient struct {
+	listShortcuts  *connect.Client[v1.ListShortcutsRequest, v1.ListShortcutsResponse]
+	getShortcut    *connect.Client[v1.GetShortcutRequest, v1.Shortcut]
+	createShortcut *connect.Client[v1.CreateShortcutRequest, v1.Shortcut]
+	updateShortcut *connect.Client[v1.UpdateShortcutRequest, v1.Shortcut]
+	deleteShortcut *connect.Client[v1.DeleteShortcutRequest, emptypb.Empty]
+}
+
+// ListShortcuts calls memos.api.v1.ShortcutService.ListShortcuts.
+func (c *shortcutServiceClient) ListShortcuts(ctx context.Context, req *connect.Request[v1.ListShortcutsRequest]) (*connect.Response[v1.ListShortcutsResponse], error) {
+	return c.listShortcuts.CallUnary(ctx, req)
+}
+
+// GetShortcut calls memos.api.v1.ShortcutService.GetShortcut.
+func (c *shortcutServiceClient) GetShortcut(ctx context.Context, req *connect.Request[v1.GetShortcutRequest]) (*connect.Response[v1.Shortcut], error) {
+	return c.getShortcut.CallUnary(ctx, req)
+}
+
+// CreateShortcut calls memos.api.v1.ShortcutService.CreateShortcut.
+func (c *shortcutServiceClient) CreateShortcut(ctx context.Context, req *connect.Request[v1.CreateShortcutRequest]) (*connect.Response[v1.Shortcut], error) {
+	return c.createShortcut.CallUnary(ctx, req)
+}
+
+// UpdateShortcut calls memos.api.v1.ShortcutService.UpdateShortcut.
+func (c *shortcutServiceClient) UpdateShortcut(ctx context.Context, req *connect.Request[v1.UpdateShortcutRequest]) (*connect.Response[v1.Shortcut], error) {
+	return c.updateShortcut.CallUnary(ctx, req)
+}
+
+// DeleteShortcut calls memos.api.v1.ShortcutService.DeleteShortcut.
+func (c *shortcutServiceClient) DeleteShortcut(ctx context.Context, req *connect.Request[v1.DeleteShortcutRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.deleteShortcut.CallUnary(ctx, req)
+}
+
+// ShortcutServiceHandler is an implementation of the memos.api.v1.ShortcutService service.
+type ShortcutServiceHandler interface {
+	// ListShortcuts returns a list of shortcuts for a user.
+	ListShortcuts(context.Context, *connect.Request[v1.ListShortcutsRequest]) (*connect.Response[v1.ListShortcutsResponse], error)
+	// GetShortcut gets a shortcut by name.
+	GetShortcut(context.Context, *connect.Request[v1.GetShortcutRequest]) (*connect.Response[v1.Shortcut], error)
+	// CreateShortcut creates a new shortcut for a user.
+	CreateShortcut(context.Context, *connect.Request[v1.CreateShortcutRequest]) (*connect.Response[v1.Shortcut], error)
+	// UpdateShortcut updates a shortcut for a user.
+	UpdateShortcut(context.Context, *connect.Request[v1.UpdateShortcutRequest]) (*connect.Response[v1.Shortcut], error)
+	// DeleteShortcut deletes a shortcut for a user.
+	DeleteShortcut(context.Context, *connect.Request[v1.DeleteShortcutRequest]) (*connect.Response[emptypb.Empty], error)
+}
+
+// NewShortcutServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewShortcutServiceHandler(svc ShortcutServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	shortcutServiceMethods := v1.File_api_v1_shortcut_service_proto.Services().ByName("ShortcutService").Methods()
+	shortcutServiceListShortcutsHandler := connect.NewUnaryHandler(
+		ShortcutServiceListShortcutsProcedure,
+		svc.ListShortcuts,
+		connect.WithSchema(shortcutServiceMethods.ByName("ListShortcuts")),
+		connect.WithHandlerOptions(opts...),
+	)
+	shortcutServiceGetShortcutHandler := connect.NewUnaryHandler(
+		ShortcutServiceGetShortcutProcedure,
+		svc.GetShortcut,
+		connect.WithSchema(shortcutServiceMethods.ByName("GetShortcut")),
+		connect.WithHandlerOptions(opts...),
+	)
+	shortcutServiceCreateShortcutHandler := connect.NewUnaryHandler(
+		ShortcutServiceCreateShortcutProcedure,
+		svc.CreateShortcut,
+		connect.WithSchema(shortcutServiceMethods.ByName("CreateShortcut")),
+		connect.WithHandlerOptions(opts...),
+	)
+	shortcutServiceUpdateShortcutHandler := connect.NewUnaryHandler(
+		ShortcutServiceUpdateShortcutProcedure,
+		svc.UpdateShortcut,
+		connect.WithSchema(shortcutServiceMethods.ByName("UpdateShortcut")),
+		connect.WithHandlerOptions(opts...),
+	)
+	shortcutServiceDeleteShortcutHandler := connect.NewUnaryHandler(
+		ShortcutServiceDeleteShortcutProcedure,
+		svc.DeleteShortcut,
+		connect.WithSchema(shortcutServiceMethods.ByName("DeleteShortcut")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/memos.api.v1.ShortcutService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case ShortcutServiceListShortcutsProcedure:
+			shortcutServiceListShortcutsHandler.ServeHTTP(w, r)
+		case ShortcutServiceGetShortcutProcedure:
+			shortcutServiceGetShortcutHandler.ServeHTTP(w, r)
+		case ShortcutServiceCreateShortcutProcedure:
+			shortcutServiceCreateShortcutHandler.ServeHTTP(w, r)
+		case ShortcutServiceUpdateShortcutProcedure:
+			shortcutServiceUpdateShortcutHandler.ServeHTTP(w, r)
+		case ShortcutServiceDeleteShortcutProcedure:
+			shortcutServiceDeleteShortcutHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedShortcutServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedShortcutServiceHandler struct{}
+
+func (UnimplementedShortcutServiceHandler) ListShortcuts(context.Context, *connect.Request[v1.ListShortcutsRequest]) (*connect.Response[v1.ListShortcutsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.ShortcutService.ListShortcuts is not implemented"))
+}
+
+func (UnimplementedShortcutServiceHandler) GetShortcut(context.Context, *connect.Request[v1.GetShortcutRequest]) (*connect.Response[v1.Shortcut], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.ShortcutService.GetShortcut is not implemented"))
+}
+
+func (UnimplementedShortcutServiceHandler) CreateShortcut(context.Context, *connect.Request[v1.CreateShortcutRequest]) (*connect.Response[v1.Shortcut], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.ShortcutService.CreateShortcut is not implemented"))
+}
+
+func (UnimplementedShortcutServiceHandler) UpdateShortcut(context.Context, *connect.Request[v1.UpdateShortcutRequest]) (*connect.Response[v1.Shortcut], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.ShortcutService.UpdateShortcut is not implemented"))
+}
+
+func (UnimplementedShortcutServiceHandler) DeleteShortcut(context.Context, *connect.Request[v1.DeleteShortcutRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.ShortcutService.DeleteShortcut is not implemented"))
+}

proto/gen/api/v1/apiv1connect/user_service.connect.go

@@ -0,0 +1,857 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: api/v1/user_service.proto
+
+package apiv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "github.com/usememos/memos/proto/gen/api/v1"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// UserServiceName is the fully-qualified name of the UserService service.
+	UserServiceName = "memos.api.v1.UserService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// UserServiceListUsersProcedure is the fully-qualified name of the UserService's ListUsers RPC.
+	UserServiceListUsersProcedure = "/memos.api.v1.UserService/ListUsers"
+	// UserServiceBatchGetUsersProcedure is the fully-qualified name of the UserService's BatchGetUsers
+	// RPC.
+	UserServiceBatchGetUsersProcedure = "/memos.api.v1.UserService/BatchGetUsers"
+	// UserServiceGetUserProcedure is the fully-qualified name of the UserService's GetUser RPC.
+	UserServiceGetUserProcedure = "/memos.api.v1.UserService/GetUser"
+	// UserServiceCreateUserProcedure is the fully-qualified name of the UserService's CreateUser RPC.
+	UserServiceCreateUserProcedure = "/memos.api.v1.UserService/CreateUser"
+	// UserServiceUpdateUserProcedure is the fully-qualified name of the UserService's UpdateUser RPC.
+	UserServiceUpdateUserProcedure = "/memos.api.v1.UserService/UpdateUser"
+	// UserServiceDeleteUserProcedure is the fully-qualified name of the UserService's DeleteUser RPC.
+	UserServiceDeleteUserProcedure = "/memos.api.v1.UserService/DeleteUser"
+	// UserServiceListAllUserStatsProcedure is the fully-qualified name of the UserService's
+	// ListAllUserStats RPC.
+	UserServiceListAllUserStatsProcedure = "/memos.api.v1.UserService/ListAllUserStats"
+	// UserServiceGetUserStatsProcedure is the fully-qualified name of the UserService's GetUserStats
+	// RPC.
+	UserServiceGetUserStatsProcedure = "/memos.api.v1.UserService/GetUserStats"
+	// UserServiceGetUserSettingProcedure is the fully-qualified name of the UserService's
+	// GetUserSetting RPC.
+	UserServiceGetUserSettingProcedure = "/memos.api.v1.UserService/GetUserSetting"
+	// UserServiceUpdateUserSettingProcedure is the fully-qualified name of the UserService's
+	// UpdateUserSetting RPC.
+	UserServiceUpdateUserSettingProcedure = "/memos.api.v1.UserService/UpdateUserSetting"
+	// UserServiceListUserSettingsProcedure is the fully-qualified name of the UserService's
+	// ListUserSettings RPC.
+	UserServiceListUserSettingsProcedure = "/memos.api.v1.UserService/ListUserSettings"
+	// UserServiceListLinkedIdentitiesProcedure is the fully-qualified name of the UserService's
+	// ListLinkedIdentities RPC.
+	UserServiceListLinkedIdentitiesProcedure = "/memos.api.v1.UserService/ListLinkedIdentities"
+	// UserServiceCreateLinkedIdentityProcedure is the fully-qualified name of the UserService's
+	// CreateLinkedIdentity RPC.
+	UserServiceCreateLinkedIdentityProcedure = "/memos.api.v1.UserService/CreateLinkedIdentity"
+	// UserServiceGetLinkedIdentityProcedure is the fully-qualified name of the UserService's
+	// GetLinkedIdentity RPC.
+	UserServiceGetLinkedIdentityProcedure = "/memos.api.v1.UserService/GetLinkedIdentity"
+	// UserServiceDeleteLinkedIdentityProcedure is the fully-qualified name of the UserService's
+	// DeleteLinkedIdentity RPC.
+	UserServiceDeleteLinkedIdentityProcedure = "/memos.api.v1.UserService/DeleteLinkedIdentity"
+	// UserServiceListPersonalAccessTokensProcedure is the fully-qualified name of the UserService's
+	// ListPersonalAccessTokens RPC.
+	UserServiceListPersonalAccessTokensProcedure = "/memos.api.v1.UserService/ListPersonalAccessTokens"
+	// UserServiceCreatePersonalAccessTokenProcedure is the fully-qualified name of the UserService's
+	// CreatePersonalAccessToken RPC.
+	UserServiceCreatePersonalAccessTokenProcedure = "/memos.api.v1.UserService/CreatePersonalAccessToken"
+	// UserServiceDeletePersonalAccessTokenProcedure is the fully-qualified name of the UserService's
+	// DeletePersonalAccessToken RPC.
+	UserServiceDeletePersonalAccessTokenProcedure = "/memos.api.v1.UserService/DeletePersonalAccessToken"
+	// UserServiceListUserWebhooksProcedure is the fully-qualified name of the UserService's
+	// ListUserWebhooks RPC.
+	UserServiceListUserWebhooksProcedure = "/memos.api.v1.UserService/ListUserWebhooks"
+	// UserServiceCreateUserWebhookProcedure is the fully-qualified name of the UserService's
+	// CreateUserWebhook RPC.
+	UserServiceCreateUserWebhookProcedure = "/memos.api.v1.UserService/CreateUserWebhook"
+	// UserServiceUpdateUserWebhookProcedure is the fully-qualified name of the UserService's
+	// UpdateUserWebhook RPC.
+	UserServiceUpdateUserWebhookProcedure = "/memos.api.v1.UserService/UpdateUserWebhook"
+	// UserServiceDeleteUserWebhookProcedure is the fully-qualified name of the UserService's
+	// DeleteUserWebhook RPC.
+	UserServiceDeleteUserWebhookProcedure = "/memos.api.v1.UserService/DeleteUserWebhook"
+	// UserServiceListUserNotificationsProcedure is the fully-qualified name of the UserService's
+	// ListUserNotifications RPC.
+	UserServiceListUserNotificationsProcedure = "/memos.api.v1.UserService/ListUserNotifications"
+	// UserServiceUpdateUserNotificationProcedure is the fully-qualified name of the UserService's
+	// UpdateUserNotification RPC.
+	UserServiceUpdateUserNotificationProcedure = "/memos.api.v1.UserService/UpdateUserNotification"
+	// UserServiceDeleteUserNotificationProcedure is the fully-qualified name of the UserService's
+	// DeleteUserNotification RPC.
+	UserServiceDeleteUserNotificationProcedure = "/memos.api.v1.UserService/DeleteUserNotification"
+)
+
+// UserServiceClient is a client for the memos.api.v1.UserService service.
+type UserServiceClient interface {
+	// ListUsers returns a list of users.
+	ListUsers(context.Context, *connect.Request[v1.ListUsersRequest]) (*connect.Response[v1.ListUsersResponse], error)
+	// BatchGetUsers returns active users by usernames.
+	BatchGetUsers(context.Context, *connect.Request[v1.BatchGetUsersRequest]) (*connect.Response[v1.BatchGetUsersResponse], error)
+	// GetUser gets a user by username.
+	// Format: users/{username} (e.g., users/steven)
+	GetUser(context.Context, *connect.Request[v1.GetUserRequest]) (*connect.Response[v1.User], error)
+	// CreateUser creates a new user.
+	CreateUser(context.Context, *connect.Request[v1.CreateUserRequest]) (*connect.Response[v1.User], error)
+	// UpdateUser updates a user.
+	UpdateUser(context.Context, *connect.Request[v1.UpdateUserRequest]) (*connect.Response[v1.User], error)
+	// DeleteUser deletes a user.
+	DeleteUser(context.Context, *connect.Request[v1.DeleteUserRequest]) (*connect.Response[emptypb.Empty], error)
+	// ListAllUserStats returns statistics for all users.
+	ListAllUserStats(context.Context, *connect.Request[v1.ListAllUserStatsRequest]) (*connect.Response[v1.ListAllUserStatsResponse], error)
+	// GetUserStats returns statistics for a specific user.
+	GetUserStats(context.Context, *connect.Request[v1.GetUserStatsRequest]) (*connect.Response[v1.UserStats], error)
+	// GetUserSetting returns the user setting.
+	GetUserSetting(context.Context, *connect.Request[v1.GetUserSettingRequest]) (*connect.Response[v1.UserSetting], error)
+	// UpdateUserSetting updates the user setting.
+	UpdateUserSetting(context.Context, *connect.Request[v1.UpdateUserSettingRequest]) (*connect.Response[v1.UserSetting], error)
+	// ListUserSettings returns a list of user settings.
+	ListUserSettings(context.Context, *connect.Request[v1.ListUserSettingsRequest]) (*connect.Response[v1.ListUserSettingsResponse], error)
+	// ListLinkedIdentities returns a list of linked SSO identities for a user.
+	ListLinkedIdentities(context.Context, *connect.Request[v1.ListLinkedIdentitiesRequest]) (*connect.Response[v1.ListLinkedIdentitiesResponse], error)
+	// CreateLinkedIdentity links an SSO identity to the authenticated user.
+	CreateLinkedIdentity(context.Context, *connect.Request[v1.CreateLinkedIdentityRequest]) (*connect.Response[v1.LinkedIdentity], error)
+	// GetLinkedIdentity gets a linked SSO identity for a user.
+	GetLinkedIdentity(context.Context, *connect.Request[v1.GetLinkedIdentityRequest]) (*connect.Response[v1.LinkedIdentity], error)
+	// DeleteLinkedIdentity unlinks an SSO identity from a user.
+	DeleteLinkedIdentity(context.Context, *connect.Request[v1.DeleteLinkedIdentityRequest]) (*connect.Response[emptypb.Empty], error)
+	// ListPersonalAccessTokens returns a list of Personal Access Tokens (PATs) for a user.
+	// PATs are long-lived tokens for API/script access, distinct from short-lived JWT access tokens.
+	ListPersonalAccessTokens(context.Context, *connect.Request[v1.ListPersonalAccessTokensRequest]) (*connect.Response[v1.ListPersonalAccessTokensResponse], error)
+	// CreatePersonalAccessToken creates a new Personal Access Token for a user.
+	// The token value is only returned once upon creation.
+	CreatePersonalAccessToken(context.Context, *connect.Request[v1.CreatePersonalAccessTokenRequest]) (*connect.Response[v1.CreatePersonalAccessTokenResponse], error)
+	// DeletePersonalAccessToken deletes a Personal Access Token.
+	DeletePersonalAccessToken(context.Context, *connect.Request[v1.DeletePersonalAccessTokenRequest]) (*connect.Response[emptypb.Empty], error)
+	// ListUserWebhooks returns a list of webhooks for a user.
+	ListUserWebhooks(context.Context, *connect.Request[v1.ListUserWebhooksRequest]) (*connect.Response[v1.ListUserWebhooksResponse], error)
+	// CreateUserWebhook creates a new webhook for a user.
+	CreateUserWebhook(context.Context, *connect.Request[v1.CreateUserWebhookRequest]) (*connect.Response[v1.UserWebhook], error)
+	// UpdateUserWebhook updates an existing webhook for a user.
+	UpdateUserWebhook(context.Context, *connect.Request[v1.UpdateUserWebhookRequest]) (*connect.Response[v1.UserWebhook], error)
+	// DeleteUserWebhook deletes a webhook for a user.
+	DeleteUserWebhook(context.Context, *connect.Request[v1.DeleteUserWebhookRequest]) (*connect.Response[emptypb.Empty], error)
+	// ListUserNotifications lists notifications for a user.
+	ListUserNotifications(context.Context, *connect.Request[v1.ListUserNotificationsRequest]) (*connect.Response[v1.ListUserNotificationsResponse], error)
+	// UpdateUserNotification updates a notification.
+	UpdateUserNotification(context.Context, *connect.Request[v1.UpdateUserNotificationRequest]) (*connect.Response[v1.UserNotification], error)
+	// DeleteUserNotification deletes a notification.
+	DeleteUserNotification(context.Context, *connect.Request[v1.DeleteUserNotificationRequest]) (*connect.Response[emptypb.Empty], error)
+}
+
+// NewUserServiceClient constructs a client for the memos.api.v1.UserService service. By default, it
+// uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and sends
+// uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or
+// connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewUserServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) UserServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	userServiceMethods := v1.File_api_v1_user_service_proto.Services().ByName("UserService").Methods()
+	return &userServiceClient{
+		listUsers: connect.NewClient[v1.ListUsersRequest, v1.ListUsersResponse](
+			httpClient,
+			baseURL+UserServiceListUsersProcedure,
+			connect.WithSchema(userServiceMethods.ByName("ListUsers")),
+			connect.WithClientOptions(opts...),
+		),
+		batchGetUsers: connect.NewClient[v1.BatchGetUsersRequest, v1.BatchGetUsersResponse](
+			httpClient,
+			baseURL+UserServiceBatchGetUsersProcedure,
+			connect.WithSchema(userServiceMethods.ByName("BatchGetUsers")),
+			connect.WithClientOptions(opts...),
+		),
+		getUser: connect.NewClient[v1.GetUserRequest, v1.User](
+			httpClient,
+			baseURL+UserServiceGetUserProcedure,
+			connect.WithSchema(userServiceMethods.ByName("GetUser")),
+			connect.WithClientOptions(opts...),
+		),
+		createUser: connect.NewClient[v1.CreateUserRequest, v1.User](
+			httpClient,
+			baseURL+UserServiceCreateUserProcedure,
+			connect.WithSchema(userServiceMethods.ByName("CreateUser")),
+			connect.WithClientOptions(opts...),
+		),
+		updateUser: connect.NewClient[v1.UpdateUserRequest, v1.User](
+			httpClient,
+			baseURL+UserServiceUpdateUserProcedure,
+			connect.WithSchema(userServiceMethods.ByName("UpdateUser")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteUser: connect.NewClient[v1.DeleteUserRequest, emptypb.Empty](
+			httpClient,
+			baseURL+UserServiceDeleteUserProcedure,
+			connect.WithSchema(userServiceMethods.ByName("DeleteUser")),
+			connect.WithClientOptions(opts...),
+		),
+		listAllUserStats: connect.NewClient[v1.ListAllUserStatsRequest, v1.ListAllUserStatsResponse](
+			httpClient,
+			baseURL+UserServiceListAllUserStatsProcedure,
+			connect.WithSchema(userServiceMethods.ByName("ListAllUserStats")),
+			connect.WithClientOptions(opts...),
+		),
+		getUserStats: connect.NewClient[v1.GetUserStatsRequest, v1.UserStats](
+			httpClient,
+			baseURL+UserServiceGetUserStatsProcedure,
+			connect.WithSchema(userServiceMethods.ByName("GetUserStats")),
+			connect.WithClientOptions(opts...),
+		),
+		getUserSetting: connect.NewClient[v1.GetUserSettingRequest, v1.UserSetting](
+			httpClient,
+			baseURL+UserServiceGetUserSettingProcedure,
+			connect.WithSchema(userServiceMethods.ByName("GetUserSetting")),
+			connect.WithClientOptions(opts...),
+		),
+		updateUserSetting: connect.NewClient[v1.UpdateUserSettingRequest, v1.UserSetting](
+			httpClient,
+			baseURL+UserServiceUpdateUserSettingProcedure,
+			connect.WithSchema(userServiceMethods.ByName("UpdateUserSetting")),
+			connect.WithClientOptions(opts...),
+		),
+		listUserSettings: connect.NewClient[v1.ListUserSettingsRequest, v1.ListUserSettingsResponse](
+			httpClient,
+			baseURL+UserServiceListUserSettingsProcedure,
+			connect.WithSchema(userServiceMethods.ByName("ListUserSettings")),
+			connect.WithClientOptions(opts...),
+		),
+		listLinkedIdentities: connect.NewClient[v1.ListLinkedIdentitiesRequest, v1.ListLinkedIdentitiesResponse](
+			httpClient,
+			baseURL+UserServiceListLinkedIdentitiesProcedure,
+			connect.WithSchema(userServiceMethods.ByName("ListLinkedIdentities")),
+			connect.WithClientOptions(opts...),
+		),
+		createLinkedIdentity: connect.NewClient[v1.CreateLinkedIdentityRequest, v1.LinkedIdentity](
+			httpClient,
+			baseURL+UserServiceCreateLinkedIdentityProcedure,
+			connect.WithSchema(userServiceMethods.ByName("CreateLinkedIdentity")),
+			connect.WithClientOptions(opts...),
+		),
+		getLinkedIdentity: connect.NewClient[v1.GetLinkedIdentityRequest, v1.LinkedIdentity](
+			httpClient,
+			baseURL+UserServiceGetLinkedIdentityProcedure,
+			connect.WithSchema(userServiceMethods.ByName("GetLinkedIdentity")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteLinkedIdentity: connect.NewClient[v1.DeleteLinkedIdentityRequest, emptypb.Empty](
+			httpClient,
+			baseURL+UserServiceDeleteLinkedIdentityProcedure,
+			connect.WithSchema(userServiceMethods.ByName("DeleteLinkedIdentity")),
+			connect.WithClientOptions(opts...),
+		),
+		listPersonalAccessTokens: connect.NewClient[v1.ListPersonalAccessTokensRequest, v1.ListPersonalAccessTokensResponse](
+			httpClient,
+			baseURL+UserServiceListPersonalAccessTokensProcedure,
+			connect.WithSchema(userServiceMethods.ByName("ListPersonalAccessTokens")),
+			connect.WithClientOptions(opts...),
+		),
+		createPersonalAccessToken: connect.NewClient[v1.CreatePersonalAccessTokenRequest, v1.CreatePersonalAccessTokenResponse](
+			httpClient,
+			baseURL+UserServiceCreatePersonalAccessTokenProcedure,
+			connect.WithSchema(userServiceMethods.ByName("CreatePersonalAccessToken")),
+			connect.WithClientOptions(opts...),
+		),
+		deletePersonalAccessToken: connect.NewClient[v1.DeletePersonalAccessTokenRequest, emptypb.Empty](
+			httpClient,
+			baseURL+UserServiceDeletePersonalAccessTokenProcedure,
+			connect.WithSchema(userServiceMethods.ByName("DeletePersonalAccessToken")),
+			connect.WithClientOptions(opts...),
+		),
+		listUserWebhooks: connect.NewClient[v1.ListUserWebhooksRequest, v1.ListUserWebhooksResponse](
+			httpClient,
+			baseURL+UserServiceListUserWebhooksProcedure,
+			connect.WithSchema(userServiceMethods.ByName("ListUserWebhooks")),
+			connect.WithClientOptions(opts...),
+		),
+		createUserWebhook: connect.NewClient[v1.CreateUserWebhookRequest, v1.UserWebhook](
+			httpClient,
+			baseURL+UserServiceCreateUserWebhookProcedure,
+			connect.WithSchema(userServiceMethods.ByName("CreateUserWebhook")),
+			connect.WithClientOptions(opts...),
+		),
+		updateUserWebhook: connect.NewClient[v1.UpdateUserWebhookRequest, v1.UserWebhook](
+			httpClient,
+			baseURL+UserServiceUpdateUserWebhookProcedure,
+			connect.WithSchema(userServiceMethods.ByName("UpdateUserWebhook")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteUserWebhook: connect.NewClient[v1.DeleteUserWebhookRequest, emptypb.Empty](
+			httpClient,
+			baseURL+UserServiceDeleteUserWebhookProcedure,
+			connect.WithSchema(userServiceMethods.ByName("DeleteUserWebhook")),
+			connect.WithClientOptions(opts...),
+		),
+		listUserNotifications: connect.NewClient[v1.ListUserNotificationsRequest, v1.ListUserNotificationsResponse](
+			httpClient,
+			baseURL+UserServiceListUserNotificationsProcedure,
+			connect.WithSchema(userServiceMethods.ByName("ListUserNotifications")),
+			connect.WithClientOptions(opts...),
+		),
+		updateUserNotification: connect.NewClient[v1.UpdateUserNotificationRequest, v1.UserNotification](
+			httpClient,
+			baseURL+UserServiceUpdateUserNotificationProcedure,
+			connect.WithSchema(userServiceMethods.ByName("UpdateUserNotification")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteUserNotification: connect.NewClient[v1.DeleteUserNotificationRequest, emptypb.Empty](
+			httpClient,
+			baseURL+UserServiceDeleteUserNotificationProcedure,
+			connect.WithSchema(userServiceMethods.ByName("DeleteUserNotification")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// userServiceClient implements UserServiceClient.
+type userServiceClient struct {
+	listUsers                 *connect.Client[v1.ListUsersRequest, v1.ListUsersResponse]
+	batchGetUsers             *connect.Client[v1.BatchGetUsersRequest, v1.BatchGetUsersResponse]
+	getUser                   *connect.Client[v1.GetUserRequest, v1.User]
+	createUser                *connect.Client[v1.CreateUserRequest, v1.User]
+	updateUser                *connect.Client[v1.UpdateUserRequest, v1.User]
+	deleteUser                *connect.Client[v1.DeleteUserRequest, emptypb.Empty]
+	listAllUserStats          *connect.Client[v1.ListAllUserStatsRequest, v1.ListAllUserStatsResponse]
+	getUserStats              *connect.Client[v1.GetUserStatsRequest, v1.UserStats]
+	getUserSetting            *connect.Client[v1.GetUserSettingRequest, v1.UserSetting]
+	updateUserSetting         *connect.Client[v1.UpdateUserSettingRequest, v1.UserSetting]
+	listUserSettings          *connect.Client[v1.ListUserSettingsRequest, v1.ListUserSettingsResponse]
+	listLinkedIdentities      *connect.Client[v1.ListLinkedIdentitiesRequest, v1.ListLinkedIdentitiesResponse]
+	createLinkedIdentity      *connect.Client[v1.CreateLinkedIdentityRequest, v1.LinkedIdentity]
+	getLinkedIdentity         *connect.Client[v1.GetLinkedIdentityRequest, v1.LinkedIdentity]
+	deleteLinkedIdentity      *connect.Client[v1.DeleteLinkedIdentityRequest, emptypb.Empty]
+	listPersonalAccessTokens  *connect.Client[v1.ListPersonalAccessTokensRequest, v1.ListPersonalAccessTokensResponse]
+	createPersonalAccessToken *connect.Client[v1.CreatePersonalAccessTokenRequest, v1.CreatePersonalAccessTokenResponse]
+	deletePersonalAccessToken *connect.Client[v1.DeletePersonalAccessTokenRequest, emptypb.Empty]
+	listUserWebhooks          *connect.Client[v1.ListUserWebhooksRequest, v1.ListUserWebhooksResponse]
+	createUserWebhook         *connect.Client[v1.CreateUserWebhookRequest, v1.UserWebhook]
+	updateUserWebhook         *connect.Client[v1.UpdateUserWebhookRequest, v1.UserWebhook]
+	deleteUserWebhook         *connect.Client[v1.DeleteUserWebhookRequest, emptypb.Empty]
+	listUserNotifications     *connect.Client[v1.ListUserNotificationsRequest, v1.ListUserNotificationsResponse]
+	updateUserNotification    *connect.Client[v1.UpdateUserNotificationRequest, v1.UserNotification]
+	deleteUserNotification    *connect.Client[v1.DeleteUserNotificationRequest, emptypb.Empty]
+}
+
+// ListUsers calls memos.api.v1.UserService.ListUsers.
+func (c *userServiceClient) ListUsers(ctx context.Context, req *connect.Request[v1.ListUsersRequest]) (*connect.Response[v1.ListUsersResponse], error) {
+	return c.listUsers.CallUnary(ctx, req)
+}
+
+// BatchGetUsers calls memos.api.v1.UserService.BatchGetUsers.
+func (c *userServiceClient) BatchGetUsers(ctx context.Context, req *connect.Request[v1.BatchGetUsersRequest]) (*connect.Response[v1.BatchGetUsersResponse], error) {
+	return c.batchGetUsers.CallUnary(ctx, req)
+}
+
+// GetUser calls memos.api.v1.UserService.GetUser.
+func (c *userServiceClient) GetUser(ctx context.Context, req *connect.Request[v1.GetUserRequest]) (*connect.Response[v1.User], error) {
+	return c.getUser.CallUnary(ctx, req)
+}
+
+// CreateUser calls memos.api.v1.UserService.CreateUser.
+func (c *userServiceClient) CreateUser(ctx context.Context, req *connect.Request[v1.CreateUserRequest]) (*connect.Response[v1.User], error) {
+	return c.createUser.CallUnary(ctx, req)
+}
+
+// UpdateUser calls memos.api.v1.UserService.UpdateUser.
+func (c *userServiceClient) UpdateUser(ctx context.Context, req *connect.Request[v1.UpdateUserRequest]) (*connect.Response[v1.User], error) {
+	return c.updateUser.CallUnary(ctx, req)
+}
+
+// DeleteUser calls memos.api.v1.UserService.DeleteUser.
+func (c *userServiceClient) DeleteUser(ctx context.Context, req *connect.Request[v1.DeleteUserRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.deleteUser.CallUnary(ctx, req)
+}
+
+// ListAllUserStats calls memos.api.v1.UserService.ListAllUserStats.
+func (c *userServiceClient) ListAllUserStats(ctx context.Context, req *connect.Request[v1.ListAllUserStatsRequest]) (*connect.Response[v1.ListAllUserStatsResponse], error) {
+	return c.listAllUserStats.CallUnary(ctx, req)
+}
+
+// GetUserStats calls memos.api.v1.UserService.GetUserStats.
+func (c *userServiceClient) GetUserStats(ctx context.Context, req *connect.Request[v1.GetUserStatsRequest]) (*connect.Response[v1.UserStats], error) {
+	return c.getUserStats.CallUnary(ctx, req)
+}
+
+// GetUserSetting calls memos.api.v1.UserService.GetUserSetting.
+func (c *userServiceClient) GetUserSetting(ctx context.Context, req *connect.Request[v1.GetUserSettingRequest]) (*connect.Response[v1.UserSetting], error) {
+	return c.getUserSetting.CallUnary(ctx, req)
+}
+
+// UpdateUserSetting calls memos.api.v1.UserService.UpdateUserSetting.
+func (c *userServiceClient) UpdateUserSetting(ctx context.Context, req *connect.Request[v1.UpdateUserSettingRequest]) (*connect.Response[v1.UserSetting], error) {
+	return c.updateUserSetting.CallUnary(ctx, req)
+}
+
+// ListUserSettings calls memos.api.v1.UserService.ListUserSettings.
+func (c *userServiceClient) ListUserSettings(ctx context.Context, req *connect.Request[v1.ListUserSettingsRequest]) (*connect.Response[v1.ListUserSettingsResponse], error) {
+	return c.listUserSettings.CallUnary(ctx, req)
+}
+
+// ListLinkedIdentities calls memos.api.v1.UserService.ListLinkedIdentities.
+func (c *userServiceClient) ListLinkedIdentities(ctx context.Context, req *connect.Request[v1.ListLinkedIdentitiesRequest]) (*connect.Response[v1.ListLinkedIdentitiesResponse], error) {
+	return c.listLinkedIdentities.CallUnary(ctx, req)
+}
+
+// CreateLinkedIdentity calls memos.api.v1.UserService.CreateLinkedIdentity.
+func (c *userServiceClient) CreateLinkedIdentity(ctx context.Context, req *connect.Request[v1.CreateLinkedIdentityRequest]) (*connect.Response[v1.LinkedIdentity], error) {
+	return c.createLinkedIdentity.CallUnary(ctx, req)
+}
+
+// GetLinkedIdentity calls memos.api.v1.UserService.GetLinkedIdentity.
+func (c *userServiceClient) GetLinkedIdentity(ctx context.Context, req *connect.Request[v1.GetLinkedIdentityRequest]) (*connect.Response[v1.LinkedIdentity], error) {
+	return c.getLinkedIdentity.CallUnary(ctx, req)
+}
+
+// DeleteLinkedIdentity calls memos.api.v1.UserService.DeleteLinkedIdentity.
+func (c *userServiceClient) DeleteLinkedIdentity(ctx context.Context, req *connect.Request[v1.DeleteLinkedIdentityRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.deleteLinkedIdentity.CallUnary(ctx, req)
+}
+
+// ListPersonalAccessTokens calls memos.api.v1.UserService.ListPersonalAccessTokens.
+func (c *userServiceClient) ListPersonalAccessTokens(ctx context.Context, req *connect.Request[v1.ListPersonalAccessTokensRequest]) (*connect.Response[v1.ListPersonalAccessTokensResponse], error) {
+	return c.listPersonalAccessTokens.CallUnary(ctx, req)
+}
+
+// CreatePersonalAccessToken calls memos.api.v1.UserService.CreatePersonalAccessToken.
+func (c *userServiceClient) CreatePersonalAccessToken(ctx context.Context, req *connect.Request[v1.CreatePersonalAccessTokenRequest]) (*connect.Response[v1.CreatePersonalAccessTokenResponse], error) {
+	return c.createPersonalAccessToken.CallUnary(ctx, req)
+}
+
+// DeletePersonalAccessToken calls memos.api.v1.UserService.DeletePersonalAccessToken.
+func (c *userServiceClient) DeletePersonalAccessToken(ctx context.Context, req *connect.Request[v1.DeletePersonalAccessTokenRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.deletePersonalAccessToken.CallUnary(ctx, req)
+}
+
+// ListUserWebhooks calls memos.api.v1.UserService.ListUserWebhooks.
+func (c *userServiceClient) ListUserWebhooks(ctx context.Context, req *connect.Request[v1.ListUserWebhooksRequest]) (*connect.Response[v1.ListUserWebhooksResponse], error) {
+	return c.listUserWebhooks.CallUnary(ctx, req)
+}
+
+// CreateUserWebhook calls memos.api.v1.UserService.CreateUserWebhook.
+func (c *userServiceClient) CreateUserWebhook(ctx context.Context, req *connect.Request[v1.CreateUserWebhookRequest]) (*connect.Response[v1.UserWebhook], error) {
+	return c.createUserWebhook.CallUnary(ctx, req)
+}
+
+// UpdateUserWebhook calls memos.api.v1.UserService.UpdateUserWebhook.
+func (c *userServiceClient) UpdateUserWebhook(ctx context.Context, req *connect.Request[v1.UpdateUserWebhookRequest]) (*connect.Response[v1.UserWebhook], error) {
+	return c.updateUserWebhook.CallUnary(ctx, req)
+}
+
+// DeleteUserWebhook calls memos.api.v1.UserService.DeleteUserWebhook.
+func (c *userServiceClient) DeleteUserWebhook(ctx context.Context, req *connect.Request[v1.DeleteUserWebhookRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.deleteUserWebhook.CallUnary(ctx, req)
+}
+
+// ListUserNotifications calls memos.api.v1.UserService.ListUserNotifications.
+func (c *userServiceClient) ListUserNotifications(ctx context.Context, req *connect.Request[v1.ListUserNotificationsRequest]) (*connect.Response[v1.ListUserNotificationsResponse], error) {
+	return c.listUserNotifications.CallUnary(ctx, req)
+}
+
+// UpdateUserNotification calls memos.api.v1.UserService.UpdateUserNotification.
+func (c *userServiceClient) UpdateUserNotification(ctx context.Context, req *connect.Request[v1.UpdateUserNotificationRequest]) (*connect.Response[v1.UserNotification], error) {
+	return c.updateUserNotification.CallUnary(ctx, req)
+}
+
+// DeleteUserNotification calls memos.api.v1.UserService.DeleteUserNotification.
+func (c *userServiceClient) DeleteUserNotification(ctx context.Context, req *connect.Request[v1.DeleteUserNotificationRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.deleteUserNotification.CallUnary(ctx, req)
+}
+
+// UserServiceHandler is an implementation of the memos.api.v1.UserService service.
+type UserServiceHandler interface {
+	// ListUsers returns a list of users.
+	ListUsers(context.Context, *connect.Request[v1.ListUsersRequest]) (*connect.Response[v1.ListUsersResponse], error)
+	// BatchGetUsers returns active users by usernames.
+	BatchGetUsers(context.Context, *connect.Request[v1.BatchGetUsersRequest]) (*connect.Response[v1.BatchGetUsersResponse], error)
+	// GetUser gets a user by username.
+	// Format: users/{username} (e.g., users/steven)
+	GetUser(context.Context, *connect.Request[v1.GetUserRequest]) (*connect.Response[v1.User], error)
+	// CreateUser creates a new user.
+	CreateUser(context.Context, *connect.Request[v1.CreateUserRequest]) (*connect.Response[v1.User], error)
+	// UpdateUser updates a user.
+	UpdateUser(context.Context, *connect.Request[v1.UpdateUserRequest]) (*connect.Response[v1.User], error)
+	// DeleteUser deletes a user.
+	DeleteUser(context.Context, *connect.Request[v1.DeleteUserRequest]) (*connect.Response[emptypb.Empty], error)
+	// ListAllUserStats returns statistics for all users.
+	ListAllUserStats(context.Context, *connect.Request[v1.ListAllUserStatsRequest]) (*connect.Response[v1.ListAllUserStatsResponse], error)
+	// GetUserStats returns statistics for a specific user.
+	GetUserStats(context.Context, *connect.Request[v1.GetUserStatsRequest]) (*connect.Response[v1.UserStats], error)
+	// GetUserSetting returns the user setting.
+	GetUserSetting(context.Context, *connect.Request[v1.GetUserSettingRequest]) (*connect.Response[v1.UserSetting], error)
+	// UpdateUserSetting updates the user setting.
+	UpdateUserSetting(context.Context, *connect.Request[v1.UpdateUserSettingRequest]) (*connect.Response[v1.UserSetting], error)
+	// ListUserSettings returns a list of user settings.
+	ListUserSettings(context.Context, *connect.Request[v1.ListUserSettingsRequest]) (*connect.Response[v1.ListUserSettingsResponse], error)
+	// ListLinkedIdentities returns a list of linked SSO identities for a user.
+	ListLinkedIdentities(context.Context, *connect.Request[v1.ListLinkedIdentitiesRequest]) (*connect.Response[v1.ListLinkedIdentitiesResponse], error)
+	// CreateLinkedIdentity links an SSO identity to the authenticated user.
+	CreateLinkedIdentity(context.Context, *connect.Request[v1.CreateLinkedIdentityRequest]) (*connect.Response[v1.LinkedIdentity], error)
+	// GetLinkedIdentity gets a linked SSO identity for a user.
+	GetLinkedIdentity(context.Context, *connect.Request[v1.GetLinkedIdentityRequest]) (*connect.Response[v1.LinkedIdentity], error)
+	// DeleteLinkedIdentity unlinks an SSO identity from a user.
+	DeleteLinkedIdentity(context.Context, *connect.Request[v1.DeleteLinkedIdentityRequest]) (*connect.Response[emptypb.Empty], error)
+	// ListPersonalAccessTokens returns a list of Personal Access Tokens (PATs) for a user.
+	// PATs are long-lived tokens for API/script access, distinct from short-lived JWT access tokens.
+	ListPersonalAccessTokens(context.Context, *connect.Request[v1.ListPersonalAccessTokensRequest]) (*connect.Response[v1.ListPersonalAccessTokensResponse], error)
+	// CreatePersonalAccessToken creates a new Personal Access Token for a user.
+	// The token value is only returned once upon creation.
+	CreatePersonalAccessToken(context.Context, *connect.Request[v1.CreatePersonalAccessTokenRequest]) (*connect.Response[v1.CreatePersonalAccessTokenResponse], error)
+	// DeletePersonalAccessToken deletes a Personal Access Token.
+	DeletePersonalAccessToken(context.Context, *connect.Request[v1.DeletePersonalAccessTokenRequest]) (*connect.Response[emptypb.Empty], error)
+	// ListUserWebhooks returns a list of webhooks for a user.
+	ListUserWebhooks(context.Context, *connect.Request[v1.ListUserWebhooksRequest]) (*connect.Response[v1.ListUserWebhooksResponse], error)
+	// CreateUserWebhook creates a new webhook for a user.
+	CreateUserWebhook(context.Context, *connect.Request[v1.CreateUserWebhookRequest]) (*connect.Response[v1.UserWebhook], error)
+	// UpdateUserWebhook updates an existing webhook for a user.
+	UpdateUserWebhook(context.Context, *connect.Request[v1.UpdateUserWebhookRequest]) (*connect.Response[v1.UserWebhook], error)
+	// DeleteUserWebhook deletes a webhook for a user.
+	DeleteUserWebhook(context.Context, *connect.Request[v1.DeleteUserWebhookRequest]) (*connect.Response[emptypb.Empty], error)
+	// ListUserNotifications lists notifications for a user.
+	ListUserNotifications(context.Context, *connect.Request[v1.ListUserNotificationsRequest]) (*connect.Response[v1.ListUserNotificationsResponse], error)
+	// UpdateUserNotification updates a notification.
+	UpdateUserNotification(context.Context, *connect.Request[v1.UpdateUserNotificationRequest]) (*connect.Response[v1.UserNotification], error)
+	// DeleteUserNotification deletes a notification.
+	DeleteUserNotification(context.Context, *connect.Request[v1.DeleteUserNotificationRequest]) (*connect.Response[emptypb.Empty], error)
+}
+
+// NewUserServiceHandler builds an HTTP handler from the service implementation. It returns the path
+// on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewUserServiceHandler(svc UserServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	userServiceMethods := v1.File_api_v1_user_service_proto.Services().ByName("UserService").Methods()
+	userServiceListUsersHandler := connect.NewUnaryHandler(
+		UserServiceListUsersProcedure,
+		svc.ListUsers,
+		connect.WithSchema(userServiceMethods.ByName("ListUsers")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceBatchGetUsersHandler := connect.NewUnaryHandler(
+		UserServiceBatchGetUsersProcedure,
+		svc.BatchGetUsers,
+		connect.WithSchema(userServiceMethods.ByName("BatchGetUsers")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceGetUserHandler := connect.NewUnaryHandler(
+		UserServiceGetUserProcedure,
+		svc.GetUser,
+		connect.WithSchema(userServiceMethods.ByName("GetUser")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceCreateUserHandler := connect.NewUnaryHandler(
+		UserServiceCreateUserProcedure,
+		svc.CreateUser,
+		connect.WithSchema(userServiceMethods.ByName("CreateUser")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceUpdateUserHandler := connect.NewUnaryHandler(
+		UserServiceUpdateUserProcedure,
+		svc.UpdateUser,
+		connect.WithSchema(userServiceMethods.ByName("UpdateUser")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceDeleteUserHandler := connect.NewUnaryHandler(
+		UserServiceDeleteUserProcedure,
+		svc.DeleteUser,
+		connect.WithSchema(userServiceMethods.ByName("DeleteUser")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceListAllUserStatsHandler := connect.NewUnaryHandler(
+		UserServiceListAllUserStatsProcedure,
+		svc.ListAllUserStats,
+		connect.WithSchema(userServiceMethods.ByName("ListAllUserStats")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceGetUserStatsHandler := connect.NewUnaryHandler(
+		UserServiceGetUserStatsProcedure,
+		svc.GetUserStats,
+		connect.WithSchema(userServiceMethods.ByName("GetUserStats")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceGetUserSettingHandler := connect.NewUnaryHandler(
+		UserServiceGetUserSettingProcedure,
+		svc.GetUserSetting,
+		connect.WithSchema(userServiceMethods.ByName("GetUserSetting")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceUpdateUserSettingHandler := connect.NewUnaryHandler(
+		UserServiceUpdateUserSettingProcedure,
+		svc.UpdateUserSetting,
+		connect.WithSchema(userServiceMethods.ByName("UpdateUserSetting")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceListUserSettingsHandler := connect.NewUnaryHandler(
+		UserServiceListUserSettingsProcedure,
+		svc.ListUserSettings,
+		connect.WithSchema(userServiceMethods.ByName("ListUserSettings")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceListLinkedIdentitiesHandler := connect.NewUnaryHandler(
+		UserServiceListLinkedIdentitiesProcedure,
+		svc.ListLinkedIdentities,
+		connect.WithSchema(userServiceMethods.ByName("ListLinkedIdentities")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceCreateLinkedIdentityHandler := connect.NewUnaryHandler(
+		UserServiceCreateLinkedIdentityProcedure,
+		svc.CreateLinkedIdentity,
+		connect.WithSchema(userServiceMethods.ByName("CreateLinkedIdentity")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceGetLinkedIdentityHandler := connect.NewUnaryHandler(
+		UserServiceGetLinkedIdentityProcedure,
+		svc.GetLinkedIdentity,
+		connect.WithSchema(userServiceMethods.ByName("GetLinkedIdentity")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceDeleteLinkedIdentityHandler := connect.NewUnaryHandler(
+		UserServiceDeleteLinkedIdentityProcedure,
+		svc.DeleteLinkedIdentity,
+		connect.WithSchema(userServiceMethods.ByName("DeleteLinkedIdentity")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceListPersonalAccessTokensHandler := connect.NewUnaryHandler(
+		UserServiceListPersonalAccessTokensProcedure,
+		svc.ListPersonalAccessTokens,
+		connect.WithSchema(userServiceMethods.ByName("ListPersonalAccessTokens")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceCreatePersonalAccessTokenHandler := connect.NewUnaryHandler(
+		UserServiceCreatePersonalAccessTokenProcedure,
+		svc.CreatePersonalAccessToken,
+		connect.WithSchema(userServiceMethods.ByName("CreatePersonalAccessToken")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceDeletePersonalAccessTokenHandler := connect.NewUnaryHandler(
+		UserServiceDeletePersonalAccessTokenProcedure,
+		svc.DeletePersonalAccessToken,
+		connect.WithSchema(userServiceMethods.ByName("DeletePersonalAccessToken")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceListUserWebhooksHandler := connect.NewUnaryHandler(
+		UserServiceListUserWebhooksProcedure,
+		svc.ListUserWebhooks,
+		connect.WithSchema(userServiceMethods.ByName("ListUserWebhooks")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceCreateUserWebhookHandler := connect.NewUnaryHandler(
+		UserServiceCreateUserWebhookProcedure,
+		svc.CreateUserWebhook,
+		connect.WithSchema(userServiceMethods.ByName("CreateUserWebhook")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceUpdateUserWebhookHandler := connect.NewUnaryHandler(
+		UserServiceUpdateUserWebhookProcedure,
+		svc.UpdateUserWebhook,
+		connect.WithSchema(userServiceMethods.ByName("UpdateUserWebhook")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceDeleteUserWebhookHandler := connect.NewUnaryHandler(
+		UserServiceDeleteUserWebhookProcedure,
+		svc.DeleteUserWebhook,
+		connect.WithSchema(userServiceMethods.ByName("DeleteUserWebhook")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceListUserNotificationsHandler := connect.NewUnaryHandler(
+		UserServiceListUserNotificationsProcedure,
+		svc.ListUserNotifications,
+		connect.WithSchema(userServiceMethods.ByName("ListUserNotifications")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceUpdateUserNotificationHandler := connect.NewUnaryHandler(
+		UserServiceUpdateUserNotificationProcedure,
+		svc.UpdateUserNotification,
+		connect.WithSchema(userServiceMethods.ByName("UpdateUserNotification")),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceDeleteUserNotificationHandler := connect.NewUnaryHandler(
+		UserServiceDeleteUserNotificationProcedure,
+		svc.DeleteUserNotification,
+		connect.WithSchema(userServiceMethods.ByName("DeleteUserNotification")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/memos.api.v1.UserService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case UserServiceListUsersProcedure:
+			userServiceListUsersHandler.ServeHTTP(w, r)
+		case UserServiceBatchGetUsersProcedure:
+			userServiceBatchGetUsersHandler.ServeHTTP(w, r)
+		case UserServiceGetUserProcedure:
+			userServiceGetUserHandler.ServeHTTP(w, r)
+		case UserServiceCreateUserProcedure:
+			userServiceCreateUserHandler.ServeHTTP(w, r)
+		case UserServiceUpdateUserProcedure:
+			userServiceUpdateUserHandler.ServeHTTP(w, r)
+		case UserServiceDeleteUserProcedure:
+			userServiceDeleteUserHandler.ServeHTTP(w, r)
+		case UserServiceListAllUserStatsProcedure:
+			userServiceListAllUserStatsHandler.ServeHTTP(w, r)
+		case UserServiceGetUserStatsProcedure:
+			userServiceGetUserStatsHandler.ServeHTTP(w, r)
+		case UserServiceGetUserSettingProcedure:
+			userServiceGetUserSettingHandler.ServeHTTP(w, r)
+		case UserServiceUpdateUserSettingProcedure:
+			userServiceUpdateUserSettingHandler.ServeHTTP(w, r)
+		case UserServiceListUserSettingsProcedure:
+			userServiceListUserSettingsHandler.ServeHTTP(w, r)
+		case UserServiceListLinkedIdentitiesProcedure:
+			userServiceListLinkedIdentitiesHandler.ServeHTTP(w, r)
+		case UserServiceCreateLinkedIdentityProcedure:
+			userServiceCreateLinkedIdentityHandler.ServeHTTP(w, r)
+		case UserServiceGetLinkedIdentityProcedure:
+			userServiceGetLinkedIdentityHandler.ServeHTTP(w, r)
+		case UserServiceDeleteLinkedIdentityProcedure:
+			userServiceDeleteLinkedIdentityHandler.ServeHTTP(w, r)
+		case UserServiceListPersonalAccessTokensProcedure:
+			userServiceListPersonalAccessTokensHandler.ServeHTTP(w, r)
+		case UserServiceCreatePersonalAccessTokenProcedure:
+			userServiceCreatePersonalAccessTokenHandler.ServeHTTP(w, r)
+		case UserServiceDeletePersonalAccessTokenProcedure:
+			userServiceDeletePersonalAccessTokenHandler.ServeHTTP(w, r)
+		case UserServiceListUserWebhooksProcedure:
+			userServiceListUserWebhooksHandler.ServeHTTP(w, r)
+		case UserServiceCreateUserWebhookProcedure:
+			userServiceCreateUserWebhookHandler.ServeHTTP(w, r)
+		case UserServiceUpdateUserWebhookProcedure:
+			userServiceUpdateUserWebhookHandler.ServeHTTP(w, r)
+		case UserServiceDeleteUserWebhookProcedure:
+			userServiceDeleteUserWebhookHandler.ServeHTTP(w, r)
+		case UserServiceListUserNotificationsProcedure:
+			userServiceListUserNotificationsHandler.ServeHTTP(w, r)
+		case UserServiceUpdateUserNotificationProcedure:
+			userServiceUpdateUserNotificationHandler.ServeHTTP(w, r)
+		case UserServiceDeleteUserNotificationProcedure:
+			userServiceDeleteUserNotificationHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedUserServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedUserServiceHandler struct{}
+
+func (UnimplementedUserServiceHandler) ListUsers(context.Context, *connect.Request[v1.ListUsersRequest]) (*connect.Response[v1.ListUsersResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.ListUsers is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) BatchGetUsers(context.Context, *connect.Request[v1.BatchGetUsersRequest]) (*connect.Response[v1.BatchGetUsersResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.BatchGetUsers is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) GetUser(context.Context, *connect.Request[v1.GetUserRequest]) (*connect.Response[v1.User], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.GetUser is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) CreateUser(context.Context, *connect.Request[v1.CreateUserRequest]) (*connect.Response[v1.User], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.CreateUser is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) UpdateUser(context.Context, *connect.Request[v1.UpdateUserRequest]) (*connect.Response[v1.User], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.UpdateUser is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) DeleteUser(context.Context, *connect.Request[v1.DeleteUserRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.DeleteUser is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) ListAllUserStats(context.Context, *connect.Request[v1.ListAllUserStatsRequest]) (*connect.Response[v1.ListAllUserStatsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.ListAllUserStats is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) GetUserStats(context.Context, *connect.Request[v1.GetUserStatsRequest]) (*connect.Response[v1.UserStats], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.GetUserStats is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) GetUserSetting(context.Context, *connect.Request[v1.GetUserSettingRequest]) (*connect.Response[v1.UserSetting], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.GetUserSetting is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) UpdateUserSetting(context.Context, *connect.Request[v1.UpdateUserSettingRequest]) (*connect.Response[v1.UserSetting], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.UpdateUserSetting is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) ListUserSettings(context.Context, *connect.Request[v1.ListUserSettingsRequest]) (*connect.Response[v1.ListUserSettingsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.ListUserSettings is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) ListLinkedIdentities(context.Context, *connect.Request[v1.ListLinkedIdentitiesRequest]) (*connect.Response[v1.ListLinkedIdentitiesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.ListLinkedIdentities is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) CreateLinkedIdentity(context.Context, *connect.Request[v1.CreateLinkedIdentityRequest]) (*connect.Response[v1.LinkedIdentity], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.CreateLinkedIdentity is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) GetLinkedIdentity(context.Context, *connect.Request[v1.GetLinkedIdentityRequest]) (*connect.Response[v1.LinkedIdentity], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.GetLinkedIdentity is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) DeleteLinkedIdentity(context.Context, *connect.Request[v1.DeleteLinkedIdentityRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.DeleteLinkedIdentity is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) ListPersonalAccessTokens(context.Context, *connect.Request[v1.ListPersonalAccessTokensRequest]) (*connect.Response[v1.ListPersonalAccessTokensResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.ListPersonalAccessTokens is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) CreatePersonalAccessToken(context.Context, *connect.Request[v1.CreatePersonalAccessTokenRequest]) (*connect.Response[v1.CreatePersonalAccessTokenResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.CreatePersonalAccessToken is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) DeletePersonalAccessToken(context.Context, *connect.Request[v1.DeletePersonalAccessTokenRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.DeletePersonalAccessToken is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) ListUserWebhooks(context.Context, *connect.Request[v1.ListUserWebhooksRequest]) (*connect.Response[v1.ListUserWebhooksResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.ListUserWebhooks is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) CreateUserWebhook(context.Context, *connect.Request[v1.CreateUserWebhookRequest]) (*connect.Response[v1.UserWebhook], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.CreateUserWebhook is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) UpdateUserWebhook(context.Context, *connect.Request[v1.UpdateUserWebhookRequest]) (*connect.Response[v1.UserWebhook], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.UpdateUserWebhook is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) DeleteUserWebhook(context.Context, *connect.Request[v1.DeleteUserWebhookRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.DeleteUserWebhook is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) ListUserNotifications(context.Context, *connect.Request[v1.ListUserNotificationsRequest]) (*connect.Response[v1.ListUserNotificationsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.ListUserNotifications is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) UpdateUserNotification(context.Context, *connect.Request[v1.UpdateUserNotificationRequest]) (*connect.Response[v1.UserNotification], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.UpdateUserNotification is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) DeleteUserNotification(context.Context, *connect.Request[v1.DeleteUserNotificationRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("memos.api.v1.UserService.DeleteUserNotification is not implemented"))
+}

proto/gen/api/v1/attachment_service.pb.go

@@ -0,0 +1,872 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: api/v1/attachment_service.proto
+
+package apiv1
+
+import (
+	_ "google.golang.org/genproto/googleapis/api/annotations"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	fieldmaskpb "google.golang.org/protobuf/types/known/fieldmaskpb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type MotionMediaFamily int32
+
+const (
+	MotionMediaFamily_MOTION_MEDIA_FAMILY_UNSPECIFIED MotionMediaFamily = 0
+	MotionMediaFamily_APPLE_LIVE_PHOTO                MotionMediaFamily = 1
+	MotionMediaFamily_ANDROID_MOTION_PHOTO            MotionMediaFamily = 2
+)
+
+// Enum value maps for MotionMediaFamily.
+var (
+	MotionMediaFamily_name = map[int32]string{
+		0: "MOTION_MEDIA_FAMILY_UNSPECIFIED",
+		1: "APPLE_LIVE_PHOTO",
+		2: "ANDROID_MOTION_PHOTO",
+	}
+	MotionMediaFamily_value = map[string]int32{
+		"MOTION_MEDIA_FAMILY_UNSPECIFIED": 0,
+		"APPLE_LIVE_PHOTO":                1,
+		"ANDROID_MOTION_PHOTO":            2,
+	}
+)
+
+func (x MotionMediaFamily) Enum() *MotionMediaFamily {
+	p := new(MotionMediaFamily)
+	*p = x
+	return p
+}
+
+func (x MotionMediaFamily) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MotionMediaFamily) Descriptor() protoreflect.EnumDescriptor {
+	return file_api_v1_attachment_service_proto_enumTypes[0].Descriptor()
+}
+
+func (MotionMediaFamily) Type() protoreflect.EnumType {
+	return &file_api_v1_attachment_service_proto_enumTypes[0]
+}
+
+func (x MotionMediaFamily) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MotionMediaFamily.Descriptor instead.
+func (MotionMediaFamily) EnumDescriptor() ([]byte, []int) {
+	return file_api_v1_attachment_service_proto_rawDescGZIP(), []int{0}
+}
+
+type MotionMediaRole int32
+
+const (
+	MotionMediaRole_MOTION_MEDIA_ROLE_UNSPECIFIED MotionMediaRole = 0
+	MotionMediaRole_STILL                         MotionMediaRole = 1
+	MotionMediaRole_VIDEO                         MotionMediaRole = 2
+	MotionMediaRole_CONTAINER                     MotionMediaRole = 3
+)
+
+// Enum value maps for MotionMediaRole.
+var (
+	MotionMediaRole_name = map[int32]string{
+		0: "MOTION_MEDIA_ROLE_UNSPECIFIED",
+		1: "STILL",
+		2: "VIDEO",
+		3: "CONTAINER",
+	}
+	MotionMediaRole_value = map[string]int32{
+		"MOTION_MEDIA_ROLE_UNSPECIFIED": 0,
+		"STILL":                         1,
+		"VIDEO":                         2,
+		"CONTAINER":                     3,
+	}
+)
+
+func (x MotionMediaRole) Enum() *MotionMediaRole {
+	p := new(MotionMediaRole)
+	*p = x
+	return p
+}
+
+func (x MotionMediaRole) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MotionMediaRole) Descriptor() protoreflect.EnumDescriptor {
+	return file_api_v1_attachment_service_proto_enumTypes[1].Descriptor()
+}
+
+func (MotionMediaRole) Type() protoreflect.EnumType {
+	return &file_api_v1_attachment_service_proto_enumTypes[1]
+}
+
+func (x MotionMediaRole) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MotionMediaRole.Descriptor instead.
+func (MotionMediaRole) EnumDescriptor() ([]byte, []int) {
+	return file_api_v1_attachment_service_proto_rawDescGZIP(), []int{1}
+}
+
+type MotionMedia struct {
+	state                   protoimpl.MessageState `protogen:"open.v1"`
+	Family                  MotionMediaFamily      `protobuf:"varint,1,opt,name=family,proto3,enum=memos.api.v1.MotionMediaFamily" json:"family,omitempty"`
+	Role                    MotionMediaRole        `protobuf:"varint,2,opt,name=role,proto3,enum=memos.api.v1.MotionMediaRole" json:"role,omitempty"`
+	GroupId                 string                 `protobuf:"bytes,3,opt,name=group_id,json=groupId,proto3" json:"group_id,omitempty"`
+	PresentationTimestampUs int64                  `protobuf:"varint,4,opt,name=presentation_timestamp_us,json=presentationTimestampUs,proto3" json:"presentation_timestamp_us,omitempty"`
+	HasEmbeddedVideo        bool                   `protobuf:"varint,5,opt,name=has_embedded_video,json=hasEmbeddedVideo,proto3" json:"has_embedded_video,omitempty"`
+	unknownFields           protoimpl.UnknownFields
+	sizeCache               protoimpl.SizeCache
+}
+
+func (x *MotionMedia) Reset() {
+	*x = MotionMedia{}
+	mi := &file_api_v1_attachment_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *MotionMedia) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MotionMedia) ProtoMessage() {}
+
+func (x *MotionMedia) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_attachment_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MotionMedia.ProtoReflect.Descriptor instead.
+func (*MotionMedia) Descriptor() ([]byte, []int) {
+	return file_api_v1_attachment_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *MotionMedia) GetFamily() MotionMediaFamily {
+	if x != nil {
+		return x.Family
+	}
+	return MotionMediaFamily_MOTION_MEDIA_FAMILY_UNSPECIFIED
+}
+
+func (x *MotionMedia) GetRole() MotionMediaRole {
+	if x != nil {
+		return x.Role
+	}
+	return MotionMediaRole_MOTION_MEDIA_ROLE_UNSPECIFIED
+}
+
+func (x *MotionMedia) GetGroupId() string {
+	if x != nil {
+		return x.GroupId
+	}
+	return ""
+}
+
+func (x *MotionMedia) GetPresentationTimestampUs() int64 {
+	if x != nil {
+		return x.PresentationTimestampUs
+	}
+	return 0
+}
+
+func (x *MotionMedia) GetHasEmbeddedVideo() bool {
+	if x != nil {
+		return x.HasEmbeddedVideo
+	}
+	return false
+}
+
+type Attachment struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The name of the attachment.
+	// Format: attachments/{attachment}
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Output only. The creation timestamp.
+	CreateTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
+	// The filename of the attachment.
+	Filename string `protobuf:"bytes,3,opt,name=filename,proto3" json:"filename,omitempty"`
+	// Input only. The content of the attachment.
+	Content []byte `protobuf:"bytes,4,opt,name=content,proto3" json:"content,omitempty"`
+	// Optional. The external link of the attachment.
+	ExternalLink string `protobuf:"bytes,5,opt,name=external_link,json=externalLink,proto3" json:"external_link,omitempty"`
+	// The MIME type of the attachment.
+	Type string `protobuf:"bytes,6,opt,name=type,proto3" json:"type,omitempty"`
+	// Output only. The size of the attachment in bytes.
+	Size int64 `protobuf:"varint,7,opt,name=size,proto3" json:"size,omitempty"`
+	// Optional. The related memo. Refer to `Memo.name`.
+	// Format: memos/{memo}
+	Memo *string `protobuf:"bytes,8,opt,name=memo,proto3,oneof" json:"memo,omitempty"`
+	// Optional. Motion media metadata.
+	MotionMedia   *MotionMedia `protobuf:"bytes,9,opt,name=motion_media,json=motionMedia,proto3" json:"motion_media,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Attachment) Reset() {
+	*x = Attachment{}
+	mi := &file_api_v1_attachment_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Attachment) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Attachment) ProtoMessage() {}
+
+func (x *Attachment) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_attachment_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Attachment.ProtoReflect.Descriptor instead.
+func (*Attachment) Descriptor() ([]byte, []int) {
+	return file_api_v1_attachment_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *Attachment) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Attachment) GetCreateTime() *timestamppb.Timestamp {
+	if x != nil {
+		return x.CreateTime
+	}
+	return nil
+}
+
+func (x *Attachment) GetFilename() string {
+	if x != nil {
+		return x.Filename
+	}
+	return ""
+}
+
+func (x *Attachment) GetContent() []byte {
+	if x != nil {
+		return x.Content
+	}
+	return nil
+}
+
+func (x *Attachment) GetExternalLink() string {
+	if x != nil {
+		return x.ExternalLink
+	}
+	return ""
+}
+
+func (x *Attachment) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *Attachment) GetSize() int64 {
+	if x != nil {
+		return x.Size
+	}
+	return 0
+}
+
+func (x *Attachment) GetMemo() string {
+	if x != nil && x.Memo != nil {
+		return *x.Memo
+	}
+	return ""
+}
+
+func (x *Attachment) GetMotionMedia() *MotionMedia {
+	if x != nil {
+		return x.MotionMedia
+	}
+	return nil
+}
+
+type CreateAttachmentRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Required. The attachment to create.
+	Attachment *Attachment `protobuf:"bytes,1,opt,name=attachment,proto3" json:"attachment,omitempty"`
+	// Optional. The attachment ID to use for this attachment.
+	// If empty, a unique ID will be generated.
+	AttachmentId  string `protobuf:"bytes,2,opt,name=attachment_id,json=attachmentId,proto3" json:"attachment_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateAttachmentRequest) Reset() {
+	*x = CreateAttachmentRequest{}
+	mi := &file_api_v1_attachment_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateAttachmentRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateAttachmentRequest) ProtoMessage() {}
+
+func (x *CreateAttachmentRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_attachment_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateAttachmentRequest.ProtoReflect.Descriptor instead.
+func (*CreateAttachmentRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_attachment_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *CreateAttachmentRequest) GetAttachment() *Attachment {
+	if x != nil {
+		return x.Attachment
+	}
+	return nil
+}
+
+func (x *CreateAttachmentRequest) GetAttachmentId() string {
+	if x != nil {
+		return x.AttachmentId
+	}
+	return ""
+}
+
+type ListAttachmentsRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Optional. The maximum number of attachments to return.
+	// The service may return fewer than this value.
+	// If unspecified, at most 50 attachments will be returned.
+	// The maximum value is 1000; values above 1000 will be coerced to 1000.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// Optional. A page token, received from a previous `ListAttachments` call.
+	// Provide this to retrieve the subsequent page.
+	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+	// Optional. Filter to apply to the list results.
+	// Example: "mime_type==\"image/png\"" or "filename.contains(\"test\")"
+	// Supported operators: =, !=, <, <=, >, >=, : (contains), in
+	// Supported fields: filename, mime_type, create_time, memo
+	Filter string `protobuf:"bytes,3,opt,name=filter,proto3" json:"filter,omitempty"`
+	// Optional. The order to sort results by.
+	// Example: "create_time desc" or "filename asc"
+	OrderBy       string `protobuf:"bytes,4,opt,name=order_by,json=orderBy,proto3" json:"order_by,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListAttachmentsRequest) Reset() {
+	*x = ListAttachmentsRequest{}
+	mi := &file_api_v1_attachment_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListAttachmentsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAttachmentsRequest) ProtoMessage() {}
+
+func (x *ListAttachmentsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_attachment_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAttachmentsRequest.ProtoReflect.Descriptor instead.
+func (*ListAttachmentsRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_attachment_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ListAttachmentsRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListAttachmentsRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+func (x *ListAttachmentsRequest) GetFilter() string {
+	if x != nil {
+		return x.Filter
+	}
+	return ""
+}
+
+func (x *ListAttachmentsRequest) GetOrderBy() string {
+	if x != nil {
+		return x.OrderBy
+	}
+	return ""
+}
+
+type ListAttachmentsResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The list of attachments.
+	Attachments []*Attachment `protobuf:"bytes,1,rep,name=attachments,proto3" json:"attachments,omitempty"`
+	// A token that can be sent as `page_token` to retrieve the next page.
+	// If this field is omitted, there are no subsequent pages.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	// The total count of attachments (may be approximate).
+	TotalSize     int32 `protobuf:"varint,3,opt,name=total_size,json=totalSize,proto3" json:"total_size,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListAttachmentsResponse) Reset() {
+	*x = ListAttachmentsResponse{}
+	mi := &file_api_v1_attachment_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListAttachmentsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAttachmentsResponse) ProtoMessage() {}
+
+func (x *ListAttachmentsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_attachment_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAttachmentsResponse.ProtoReflect.Descriptor instead.
+func (*ListAttachmentsResponse) Descriptor() ([]byte, []int) {
+	return file_api_v1_attachment_service_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ListAttachmentsResponse) GetAttachments() []*Attachment {
+	if x != nil {
+		return x.Attachments
+	}
+	return nil
+}
+
+func (x *ListAttachmentsResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
+func (x *ListAttachmentsResponse) GetTotalSize() int32 {
+	if x != nil {
+		return x.TotalSize
+	}
+	return 0
+}
+
+type GetAttachmentRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Required. The attachment name of the attachment to retrieve.
+	// Format: attachments/{attachment}
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetAttachmentRequest) Reset() {
+	*x = GetAttachmentRequest{}
+	mi := &file_api_v1_attachment_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetAttachmentRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetAttachmentRequest) ProtoMessage() {}
+
+func (x *GetAttachmentRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_attachment_service_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetAttachmentRequest.ProtoReflect.Descriptor instead.
+func (*GetAttachmentRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_attachment_service_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *GetAttachmentRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+type UpdateAttachmentRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Required. The attachment which replaces the attachment on the server.
+	Attachment *Attachment `protobuf:"bytes,1,opt,name=attachment,proto3" json:"attachment,omitempty"`
+	// Required. The list of fields to update.
+	UpdateMask    *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateAttachmentRequest) Reset() {
+	*x = UpdateAttachmentRequest{}
+	mi := &file_api_v1_attachment_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateAttachmentRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateAttachmentRequest) ProtoMessage() {}
+
+func (x *UpdateAttachmentRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_attachment_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateAttachmentRequest.ProtoReflect.Descriptor instead.
+func (*UpdateAttachmentRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_attachment_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *UpdateAttachmentRequest) GetAttachment() *Attachment {
+	if x != nil {
+		return x.Attachment
+	}
+	return nil
+}
+
+func (x *UpdateAttachmentRequest) GetUpdateMask() *fieldmaskpb.FieldMask {
+	if x != nil {
+		return x.UpdateMask
+	}
+	return nil
+}
+
+type DeleteAttachmentRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Required. The attachment name of the attachment to delete.
+	// Format: attachments/{attachment}
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteAttachmentRequest) Reset() {
+	*x = DeleteAttachmentRequest{}
+	mi := &file_api_v1_attachment_service_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteAttachmentRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteAttachmentRequest) ProtoMessage() {}
+
+func (x *DeleteAttachmentRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_attachment_service_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteAttachmentRequest.ProtoReflect.Descriptor instead.
+func (*DeleteAttachmentRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_attachment_service_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *DeleteAttachmentRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+type BatchDeleteAttachmentsRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Names         []string               `protobuf:"bytes,1,rep,name=names,proto3" json:"names,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BatchDeleteAttachmentsRequest) Reset() {
+	*x = BatchDeleteAttachmentsRequest{}
+	mi := &file_api_v1_attachment_service_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BatchDeleteAttachmentsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BatchDeleteAttachmentsRequest) ProtoMessage() {}
+
+func (x *BatchDeleteAttachmentsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_attachment_service_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BatchDeleteAttachmentsRequest.ProtoReflect.Descriptor instead.
+func (*BatchDeleteAttachmentsRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_attachment_service_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *BatchDeleteAttachmentsRequest) GetNames() []string {
+	if x != nil {
+		return x.Names
+	}
+	return nil
+}
+
+var File_api_v1_attachment_service_proto protoreflect.FileDescriptor
+
+const file_api_v1_attachment_service_proto_rawDesc = "" +
+	"\n" +
+	"\x1fapi/v1/attachment_service.proto\x12\fmemos.api.v1\x1a\x1cgoogle/api/annotations.proto\x1a\x17google/api/client.proto\x1a\x1fgoogle/api/field_behavior.proto\x1a\x19google/api/resource.proto\x1a\x1bgoogle/protobuf/empty.proto\x1a google/protobuf/field_mask.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xfe\x01\n" +
+	"\vMotionMedia\x127\n" +
+	"\x06family\x18\x01 \x01(\x0e2\x1f.memos.api.v1.MotionMediaFamilyR\x06family\x121\n" +
+	"\x04role\x18\x02 \x01(\x0e2\x1d.memos.api.v1.MotionMediaRoleR\x04role\x12\x19\n" +
+	"\bgroup_id\x18\x03 \x01(\tR\agroupId\x12:\n" +
+	"\x19presentation_timestamp_us\x18\x04 \x01(\x03R\x17presentationTimestampUs\x12,\n" +
+	"\x12has_embedded_video\x18\x05 \x01(\bR\x10hasEmbeddedVideo\"\xbe\x03\n" +
+	"\n" +
+	"Attachment\x12\x17\n" +
+	"\x04name\x18\x01 \x01(\tB\x03\xe0A\bR\x04name\x12@\n" +
+	"\vcreate_time\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampB\x03\xe0A\x03R\n" +
+	"createTime\x12\x1f\n" +
+	"\bfilename\x18\x03 \x01(\tB\x03\xe0A\x02R\bfilename\x12\x1d\n" +
+	"\acontent\x18\x04 \x01(\fB\x03\xe0A\x04R\acontent\x12(\n" +
+	"\rexternal_link\x18\x05 \x01(\tB\x03\xe0A\x01R\fexternalLink\x12\x17\n" +
+	"\x04type\x18\x06 \x01(\tB\x03\xe0A\x02R\x04type\x12\x17\n" +
+	"\x04size\x18\a \x01(\x03B\x03\xe0A\x03R\x04size\x12\x1c\n" +
+	"\x04memo\x18\b \x01(\tB\x03\xe0A\x01H\x00R\x04memo\x88\x01\x01\x12A\n" +
+	"\fmotion_media\x18\t \x01(\v2\x19.memos.api.v1.MotionMediaB\x03\xe0A\x01R\vmotionMedia:O\xeaAL\n" +
+	"\x17memos.api.v1/Attachment\x12\x18attachments/{attachment}*\vattachments2\n" +
+	"attachmentB\a\n" +
+	"\x05_memo\"\x82\x01\n" +
+	"\x17CreateAttachmentRequest\x12=\n" +
+	"\n" +
+	"attachment\x18\x01 \x01(\v2\x18.memos.api.v1.AttachmentB\x03\xe0A\x02R\n" +
+	"attachment\x12(\n" +
+	"\rattachment_id\x18\x02 \x01(\tB\x03\xe0A\x01R\fattachmentId\"\x9b\x01\n" +
+	"\x16ListAttachmentsRequest\x12 \n" +
+	"\tpage_size\x18\x01 \x01(\x05B\x03\xe0A\x01R\bpageSize\x12\"\n" +
+	"\n" +
+	"page_token\x18\x02 \x01(\tB\x03\xe0A\x01R\tpageToken\x12\x1b\n" +
+	"\x06filter\x18\x03 \x01(\tB\x03\xe0A\x01R\x06filter\x12\x1e\n" +
+	"\border_by\x18\x04 \x01(\tB\x03\xe0A\x01R\aorderBy\"\x9c\x01\n" +
+	"\x17ListAttachmentsResponse\x12:\n" +
+	"\vattachments\x18\x01 \x03(\v2\x18.memos.api.v1.AttachmentR\vattachments\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\x12\x1d\n" +
+	"\n" +
+	"total_size\x18\x03 \x01(\x05R\ttotalSize\"K\n" +
+	"\x14GetAttachmentRequest\x123\n" +
+	"\x04name\x18\x01 \x01(\tB\x1f\xe0A\x02\xfaA\x19\n" +
+	"\x17memos.api.v1/AttachmentR\x04name\"\x9a\x01\n" +
+	"\x17UpdateAttachmentRequest\x12=\n" +
+	"\n" +
+	"attachment\x18\x01 \x01(\v2\x18.memos.api.v1.AttachmentB\x03\xe0A\x02R\n" +
+	"attachment\x12@\n" +
+	"\vupdate_mask\x18\x02 \x01(\v2\x1a.google.protobuf.FieldMaskB\x03\xe0A\x02R\n" +
+	"updateMask\"N\n" +
+	"\x17DeleteAttachmentRequest\x123\n" +
+	"\x04name\x18\x01 \x01(\tB\x1f\xe0A\x02\xfaA\x19\n" +
+	"\x17memos.api.v1/AttachmentR\x04name\":\n" +
+	"\x1dBatchDeleteAttachmentsRequest\x12\x19\n" +
+	"\x05names\x18\x01 \x03(\tB\x03\xe0A\x02R\x05names*h\n" +
+	"\x11MotionMediaFamily\x12#\n" +
+	"\x1fMOTION_MEDIA_FAMILY_UNSPECIFIED\x10\x00\x12\x14\n" +
+	"\x10APPLE_LIVE_PHOTO\x10\x01\x12\x18\n" +
+	"\x14ANDROID_MOTION_PHOTO\x10\x02*Y\n" +
+	"\x0fMotionMediaRole\x12!\n" +
+	"\x1dMOTION_MEDIA_ROLE_UNSPECIFIED\x10\x00\x12\t\n" +
+	"\x05STILL\x10\x01\x12\t\n" +
+	"\x05VIDEO\x10\x02\x12\r\n" +
+	"\tCONTAINER\x10\x032\xd0\x06\n" +
+	"\x11AttachmentService\x12\x89\x01\n" +
+	"\x10CreateAttachment\x12%.memos.api.v1.CreateAttachmentRequest\x1a\x18.memos.api.v1.Attachment\"4\xdaA\n" +
+	"attachment\x82\xd3\xe4\x93\x02!:\n" +
+	"attachment\"\x13/api/v1/attachments\x12{\n" +
+	"\x0fListAttachments\x12$.memos.api.v1.ListAttachmentsRequest\x1a%.memos.api.v1.ListAttachmentsResponse\"\x1b\x82\xd3\xe4\x93\x02\x15\x12\x13/api/v1/attachments\x12z\n" +
+	"\rGetAttachment\x12\".memos.api.v1.GetAttachmentRequest\x1a\x18.memos.api.v1.Attachment\"+\xdaA\x04name\x82\xd3\xe4\x93\x02\x1e\x12\x1c/api/v1/{name=attachments/*}\x12\xa9\x01\n" +
+	"\x10UpdateAttachment\x12%.memos.api.v1.UpdateAttachmentRequest\x1a\x18.memos.api.v1.Attachment\"T\xdaA\x16attachment,update_mask\x82\xd3\xe4\x93\x025:\n" +
+	"attachment2'/api/v1/{attachment.name=attachments/*}\x12~\n" +
+	"\x10DeleteAttachment\x12%.memos.api.v1.DeleteAttachmentRequest\x1a\x16.google.protobuf.Empty\"+\xdaA\x04name\x82\xd3\xe4\x93\x02\x1e*\x1c/api/v1/{name=attachments/*}\x12\x89\x01\n" +
+	"\x16BatchDeleteAttachments\x12+.memos.api.v1.BatchDeleteAttachmentsRequest\x1a\x16.google.protobuf.Empty\"*\x82\xd3\xe4\x93\x02$:\x01*\"\x1f/api/v1/attachments:batchDeleteB\xae\x01\n" +
+	"\x10com.memos.api.v1B\x16AttachmentServiceProtoP\x01Z0github.com/usememos/memos/proto/gen/api/v1;apiv1\xa2\x02\x03MAX\xaa\x02\fMemos.Api.V1\xca\x02\fMemos\\Api\\V1\xe2\x02\x18Memos\\Api\\V1\\GPBMetadata\xea\x02\x0eMemos::Api::V1b\x06proto3"
+
+var (
+	file_api_v1_attachment_service_proto_rawDescOnce sync.Once
+	file_api_v1_attachment_service_proto_rawDescData []byte
+)
+
+func file_api_v1_attachment_service_proto_rawDescGZIP() []byte {
+	file_api_v1_attachment_service_proto_rawDescOnce.Do(func() {
+		file_api_v1_attachment_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_api_v1_attachment_service_proto_rawDesc), len(file_api_v1_attachment_service_proto_rawDesc)))
+	})
+	return file_api_v1_attachment_service_proto_rawDescData
+}
+
+var file_api_v1_attachment_service_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
+var file_api_v1_attachment_service_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_api_v1_attachment_service_proto_goTypes = []any{
+	(MotionMediaFamily)(0),                // 0: memos.api.v1.MotionMediaFamily
+	(MotionMediaRole)(0),                  // 1: memos.api.v1.MotionMediaRole
+	(*MotionMedia)(nil),                   // 2: memos.api.v1.MotionMedia
+	(*Attachment)(nil),                    // 3: memos.api.v1.Attachment
+	(*CreateAttachmentRequest)(nil),       // 4: memos.api.v1.CreateAttachmentRequest
+	(*ListAttachmentsRequest)(nil),        // 5: memos.api.v1.ListAttachmentsRequest
+	(*ListAttachmentsResponse)(nil),       // 6: memos.api.v1.ListAttachmentsResponse
+	(*GetAttachmentRequest)(nil),          // 7: memos.api.v1.GetAttachmentRequest
+	(*UpdateAttachmentRequest)(nil),       // 8: memos.api.v1.UpdateAttachmentRequest
+	(*DeleteAttachmentRequest)(nil),       // 9: memos.api.v1.DeleteAttachmentRequest
+	(*BatchDeleteAttachmentsRequest)(nil), // 10: memos.api.v1.BatchDeleteAttachmentsRequest
+	(*timestamppb.Timestamp)(nil),         // 11: google.protobuf.Timestamp
+	(*fieldmaskpb.FieldMask)(nil),         // 12: google.protobuf.FieldMask
+	(*emptypb.Empty)(nil),                 // 13: google.protobuf.Empty
+}
+var file_api_v1_attachment_service_proto_depIdxs = []int32{
+	0,  // 0: memos.api.v1.MotionMedia.family:type_name -> memos.api.v1.MotionMediaFamily
+	1,  // 1: memos.api.v1.MotionMedia.role:type_name -> memos.api.v1.MotionMediaRole
+	11, // 2: memos.api.v1.Attachment.create_time:type_name -> google.protobuf.Timestamp
+	2,  // 3: memos.api.v1.Attachment.motion_media:type_name -> memos.api.v1.MotionMedia
+	3,  // 4: memos.api.v1.CreateAttachmentRequest.attachment:type_name -> memos.api.v1.Attachment
+	3,  // 5: memos.api.v1.ListAttachmentsResponse.attachments:type_name -> memos.api.v1.Attachment
+	3,  // 6: memos.api.v1.UpdateAttachmentRequest.attachment:type_name -> memos.api.v1.Attachment
+	12, // 7: memos.api.v1.UpdateAttachmentRequest.update_mask:type_name -> google.protobuf.FieldMask
+	4,  // 8: memos.api.v1.AttachmentService.CreateAttachment:input_type -> memos.api.v1.CreateAttachmentRequest
+	5,  // 9: memos.api.v1.AttachmentService.ListAttachments:input_type -> memos.api.v1.ListAttachmentsRequest
+	7,  // 10: memos.api.v1.AttachmentService.GetAttachment:input_type -> memos.api.v1.GetAttachmentRequest
+	8,  // 11: memos.api.v1.AttachmentService.UpdateAttachment:input_type -> memos.api.v1.UpdateAttachmentRequest
+	9,  // 12: memos.api.v1.AttachmentService.DeleteAttachment:input_type -> memos.api.v1.DeleteAttachmentRequest
+	10, // 13: memos.api.v1.AttachmentService.BatchDeleteAttachments:input_type -> memos.api.v1.BatchDeleteAttachmentsRequest
+	3,  // 14: memos.api.v1.AttachmentService.CreateAttachment:output_type -> memos.api.v1.Attachment
+	6,  // 15: memos.api.v1.AttachmentService.ListAttachments:output_type -> memos.api.v1.ListAttachmentsResponse
+	3,  // 16: memos.api.v1.AttachmentService.GetAttachment:output_type -> memos.api.v1.Attachment
+	3,  // 17: memos.api.v1.AttachmentService.UpdateAttachment:output_type -> memos.api.v1.Attachment
+	13, // 18: memos.api.v1.AttachmentService.DeleteAttachment:output_type -> google.protobuf.Empty
+	13, // 19: memos.api.v1.AttachmentService.BatchDeleteAttachments:output_type -> google.protobuf.Empty
+	14, // [14:20] is the sub-list for method output_type
+	8,  // [8:14] is the sub-list for method input_type
+	8,  // [8:8] is the sub-list for extension type_name
+	8,  // [8:8] is the sub-list for extension extendee
+	0,  // [0:8] is the sub-list for field type_name
+}
+
+func init() { file_api_v1_attachment_service_proto_init() }
+func file_api_v1_attachment_service_proto_init() {
+	if File_api_v1_attachment_service_proto != nil {
+		return
+	}
+	file_api_v1_attachment_service_proto_msgTypes[1].OneofWrappers = []any{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_v1_attachment_service_proto_rawDesc), len(file_api_v1_attachment_service_proto_rawDesc)),
+			NumEnums:      2,
+			NumMessages:   9,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_api_v1_attachment_service_proto_goTypes,
+		DependencyIndexes: file_api_v1_attachment_service_proto_depIdxs,
+		EnumInfos:         file_api_v1_attachment_service_proto_enumTypes,
+		MessageInfos:      file_api_v1_attachment_service_proto_msgTypes,
+	}.Build()
+	File_api_v1_attachment_service_proto = out.File
+	file_api_v1_attachment_service_proto_goTypes = nil
+	file_api_v1_attachment_service_proto_depIdxs = nil
+}

proto/gen/api/v1/attachment_service.pb.gw.go

@@ -0,0 +1,587 @@
+// Code generated by protoc-gen-grpc-gateway. DO NOT EDIT.
+// source: api/v1/attachment_service.proto
+
+/*
+Package apiv1 is a reverse proxy.
+
+It translates gRPC into RESTful JSON APIs.
+*/
+package apiv1
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// Suppress "imported and not used" errors
+var (
+	_ codes.Code
+	_ io.Reader
+	_ status.Status
+	_ = errors.New
+	_ = runtime.String
+	_ = utilities.NewDoubleArray
+	_ = metadata.Join
+)
+
+var filter_AttachmentService_CreateAttachment_0 = &utilities.DoubleArray{Encoding: map[string]int{"attachment": 0}, Base: []int{1, 1, 0}, Check: []int{0, 1, 2}}
+
+func request_AttachmentService_CreateAttachment_0(ctx context.Context, marshaler runtime.Marshaler, client AttachmentServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq CreateAttachmentRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq.Attachment); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AttachmentService_CreateAttachment_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.CreateAttachment(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_AttachmentService_CreateAttachment_0(ctx context.Context, marshaler runtime.Marshaler, server AttachmentServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq CreateAttachmentRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq.Attachment); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AttachmentService_CreateAttachment_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.CreateAttachment(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+var filter_AttachmentService_ListAttachments_0 = &utilities.DoubleArray{Encoding: map[string]int{}, Base: []int(nil), Check: []int(nil)}
+
+func request_AttachmentService_ListAttachments_0(ctx context.Context, marshaler runtime.Marshaler, client AttachmentServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListAttachmentsRequest
+		metadata runtime.ServerMetadata
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AttachmentService_ListAttachments_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.ListAttachments(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_AttachmentService_ListAttachments_0(ctx context.Context, marshaler runtime.Marshaler, server AttachmentServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListAttachmentsRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AttachmentService_ListAttachments_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.ListAttachments(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_AttachmentService_GetAttachment_0(ctx context.Context, marshaler runtime.Marshaler, client AttachmentServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetAttachmentRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	val, ok := pathParams["name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
+	}
+	protoReq.Name, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
+	}
+	msg, err := client.GetAttachment(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_AttachmentService_GetAttachment_0(ctx context.Context, marshaler runtime.Marshaler, server AttachmentServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetAttachmentRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
+	}
+	protoReq.Name, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
+	}
+	msg, err := server.GetAttachment(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+var filter_AttachmentService_UpdateAttachment_0 = &utilities.DoubleArray{Encoding: map[string]int{"attachment": 0, "name": 1}, Base: []int{1, 2, 1, 0, 0}, Check: []int{0, 1, 2, 3, 2}}
+
+func request_AttachmentService_UpdateAttachment_0(ctx context.Context, marshaler runtime.Marshaler, client AttachmentServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq UpdateAttachmentRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq.Attachment); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	if protoReq.UpdateMask == nil || len(protoReq.UpdateMask.GetPaths()) == 0 {
+		if fieldMask, err := runtime.FieldMaskFromRequestBody(newReader(), protoReq.Attachment); err != nil {
+			return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+		} else {
+			protoReq.UpdateMask = fieldMask
+		}
+	}
+	val, ok := pathParams["attachment.name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "attachment.name")
+	}
+	err = runtime.PopulateFieldFromPath(&protoReq, "attachment.name", val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "attachment.name", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AttachmentService_UpdateAttachment_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.UpdateAttachment(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_AttachmentService_UpdateAttachment_0(ctx context.Context, marshaler runtime.Marshaler, server AttachmentServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq UpdateAttachmentRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq.Attachment); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if protoReq.UpdateMask == nil || len(protoReq.UpdateMask.GetPaths()) == 0 {
+		if fieldMask, err := runtime.FieldMaskFromRequestBody(newReader(), protoReq.Attachment); err != nil {
+			return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+		} else {
+			protoReq.UpdateMask = fieldMask
+		}
+	}
+	val, ok := pathParams["attachment.name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "attachment.name")
+	}
+	err = runtime.PopulateFieldFromPath(&protoReq, "attachment.name", val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "attachment.name", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_AttachmentService_UpdateAttachment_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.UpdateAttachment(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_AttachmentService_DeleteAttachment_0(ctx context.Context, marshaler runtime.Marshaler, client AttachmentServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DeleteAttachmentRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	val, ok := pathParams["name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
+	}
+	protoReq.Name, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
+	}
+	msg, err := client.DeleteAttachment(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_AttachmentService_DeleteAttachment_0(ctx context.Context, marshaler runtime.Marshaler, server AttachmentServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DeleteAttachmentRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
+	}
+	protoReq.Name, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
+	}
+	msg, err := server.DeleteAttachment(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_AttachmentService_BatchDeleteAttachments_0(ctx context.Context, marshaler runtime.Marshaler, client AttachmentServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq BatchDeleteAttachmentsRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.BatchDeleteAttachments(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_AttachmentService_BatchDeleteAttachments_0(ctx context.Context, marshaler runtime.Marshaler, server AttachmentServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq BatchDeleteAttachmentsRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.BatchDeleteAttachments(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+// RegisterAttachmentServiceHandlerServer registers the http handlers for service AttachmentService to "mux".
+// UnaryRPC     :call AttachmentServiceServer directly.
+// StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+// Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterAttachmentServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
+func RegisterAttachmentServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server AttachmentServiceServer) error {
+	mux.Handle(http.MethodPost, pattern_AttachmentService_CreateAttachment_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.AttachmentService/CreateAttachment", runtime.WithHTTPPathPattern("/api/v1/attachments"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AttachmentService_CreateAttachment_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AttachmentService_CreateAttachment_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_AttachmentService_ListAttachments_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.AttachmentService/ListAttachments", runtime.WithHTTPPathPattern("/api/v1/attachments"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AttachmentService_ListAttachments_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AttachmentService_ListAttachments_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_AttachmentService_GetAttachment_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.AttachmentService/GetAttachment", runtime.WithHTTPPathPattern("/api/v1/{name=attachments/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AttachmentService_GetAttachment_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AttachmentService_GetAttachment_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPatch, pattern_AttachmentService_UpdateAttachment_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.AttachmentService/UpdateAttachment", runtime.WithHTTPPathPattern("/api/v1/{attachment.name=attachments/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AttachmentService_UpdateAttachment_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AttachmentService_UpdateAttachment_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodDelete, pattern_AttachmentService_DeleteAttachment_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.AttachmentService/DeleteAttachment", runtime.WithHTTPPathPattern("/api/v1/{name=attachments/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AttachmentService_DeleteAttachment_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AttachmentService_DeleteAttachment_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_AttachmentService_BatchDeleteAttachments_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.AttachmentService/BatchDeleteAttachments", runtime.WithHTTPPathPattern("/api/v1/attachments:batchDelete"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AttachmentService_BatchDeleteAttachments_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AttachmentService_BatchDeleteAttachments_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+
+	return nil
+}
+
+// RegisterAttachmentServiceHandlerFromEndpoint is same as RegisterAttachmentServiceHandler but
+// automatically dials to "endpoint" and closes the connection when "ctx" gets done.
+func RegisterAttachmentServiceHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+	conn, err := grpc.NewClient(endpoint, opts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+			return
+		}
+		go func() {
+			<-ctx.Done()
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+		}()
+	}()
+	return RegisterAttachmentServiceHandler(ctx, mux, conn)
+}
+
+// RegisterAttachmentServiceHandler registers the http handlers for service AttachmentService to "mux".
+// The handlers forward requests to the grpc endpoint over "conn".
+func RegisterAttachmentServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return RegisterAttachmentServiceHandlerClient(ctx, mux, NewAttachmentServiceClient(conn))
+}
+
+// RegisterAttachmentServiceHandlerClient registers the http handlers for service AttachmentService
+// to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "AttachmentServiceClient".
+// Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "AttachmentServiceClient"
+// doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+// "AttachmentServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
+func RegisterAttachmentServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client AttachmentServiceClient) error {
+	mux.Handle(http.MethodPost, pattern_AttachmentService_CreateAttachment_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.AttachmentService/CreateAttachment", runtime.WithHTTPPathPattern("/api/v1/attachments"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AttachmentService_CreateAttachment_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AttachmentService_CreateAttachment_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_AttachmentService_ListAttachments_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.AttachmentService/ListAttachments", runtime.WithHTTPPathPattern("/api/v1/attachments"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AttachmentService_ListAttachments_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AttachmentService_ListAttachments_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_AttachmentService_GetAttachment_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.AttachmentService/GetAttachment", runtime.WithHTTPPathPattern("/api/v1/{name=attachments/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AttachmentService_GetAttachment_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AttachmentService_GetAttachment_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPatch, pattern_AttachmentService_UpdateAttachment_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.AttachmentService/UpdateAttachment", runtime.WithHTTPPathPattern("/api/v1/{attachment.name=attachments/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AttachmentService_UpdateAttachment_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AttachmentService_UpdateAttachment_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodDelete, pattern_AttachmentService_DeleteAttachment_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.AttachmentService/DeleteAttachment", runtime.WithHTTPPathPattern("/api/v1/{name=attachments/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AttachmentService_DeleteAttachment_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AttachmentService_DeleteAttachment_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_AttachmentService_BatchDeleteAttachments_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.AttachmentService/BatchDeleteAttachments", runtime.WithHTTPPathPattern("/api/v1/attachments:batchDelete"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AttachmentService_BatchDeleteAttachments_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AttachmentService_BatchDeleteAttachments_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	return nil
+}
+
+var (
+	pattern_AttachmentService_CreateAttachment_0       = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"api", "v1", "attachments"}, ""))
+	pattern_AttachmentService_ListAttachments_0        = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"api", "v1", "attachments"}, ""))
+	pattern_AttachmentService_GetAttachment_0          = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 2, 5, 3}, []string{"api", "v1", "attachments", "name"}, ""))
+	pattern_AttachmentService_UpdateAttachment_0       = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 2, 5, 3}, []string{"api", "v1", "attachments", "attachment.name"}, ""))
+	pattern_AttachmentService_DeleteAttachment_0       = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 2, 5, 3}, []string{"api", "v1", "attachments", "name"}, ""))
+	pattern_AttachmentService_BatchDeleteAttachments_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"api", "v1", "attachments"}, "batchDelete"))
+)
+
+var (
+	forward_AttachmentService_CreateAttachment_0       = runtime.ForwardResponseMessage
+	forward_AttachmentService_ListAttachments_0        = runtime.ForwardResponseMessage
+	forward_AttachmentService_GetAttachment_0          = runtime.ForwardResponseMessage
+	forward_AttachmentService_UpdateAttachment_0       = runtime.ForwardResponseMessage
+	forward_AttachmentService_DeleteAttachment_0       = runtime.ForwardResponseMessage
+	forward_AttachmentService_BatchDeleteAttachments_0 = runtime.ForwardResponseMessage
+)

proto/gen/api/v1/attachment_service_grpc.pb.go

@@ -0,0 +1,324 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             (unknown)
+// source: api/v1/attachment_service.proto
+
+package apiv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	AttachmentService_CreateAttachment_FullMethodName       = "/memos.api.v1.AttachmentService/CreateAttachment"
+	AttachmentService_ListAttachments_FullMethodName        = "/memos.api.v1.AttachmentService/ListAttachments"
+	AttachmentService_GetAttachment_FullMethodName          = "/memos.api.v1.AttachmentService/GetAttachment"
+	AttachmentService_UpdateAttachment_FullMethodName       = "/memos.api.v1.AttachmentService/UpdateAttachment"
+	AttachmentService_DeleteAttachment_FullMethodName       = "/memos.api.v1.AttachmentService/DeleteAttachment"
+	AttachmentService_BatchDeleteAttachments_FullMethodName = "/memos.api.v1.AttachmentService/BatchDeleteAttachments"
+)
+
+// AttachmentServiceClient is the client API for AttachmentService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type AttachmentServiceClient interface {
+	// CreateAttachment creates a new attachment.
+	CreateAttachment(ctx context.Context, in *CreateAttachmentRequest, opts ...grpc.CallOption) (*Attachment, error)
+	// ListAttachments lists all attachments.
+	ListAttachments(ctx context.Context, in *ListAttachmentsRequest, opts ...grpc.CallOption) (*ListAttachmentsResponse, error)
+	// GetAttachment returns an attachment by name.
+	GetAttachment(ctx context.Context, in *GetAttachmentRequest, opts ...grpc.CallOption) (*Attachment, error)
+	// UpdateAttachment updates an attachment.
+	UpdateAttachment(ctx context.Context, in *UpdateAttachmentRequest, opts ...grpc.CallOption) (*Attachment, error)
+	// DeleteAttachment deletes an attachment by name.
+	DeleteAttachment(ctx context.Context, in *DeleteAttachmentRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// BatchDeleteAttachments deletes multiple attachments in one request.
+	BatchDeleteAttachments(ctx context.Context, in *BatchDeleteAttachmentsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+}
+
+type attachmentServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewAttachmentServiceClient(cc grpc.ClientConnInterface) AttachmentServiceClient {
+	return &attachmentServiceClient{cc}
+}
+
+func (c *attachmentServiceClient) CreateAttachment(ctx context.Context, in *CreateAttachmentRequest, opts ...grpc.CallOption) (*Attachment, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Attachment)
+	err := c.cc.Invoke(ctx, AttachmentService_CreateAttachment_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *attachmentServiceClient) ListAttachments(ctx context.Context, in *ListAttachmentsRequest, opts ...grpc.CallOption) (*ListAttachmentsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListAttachmentsResponse)
+	err := c.cc.Invoke(ctx, AttachmentService_ListAttachments_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *attachmentServiceClient) GetAttachment(ctx context.Context, in *GetAttachmentRequest, opts ...grpc.CallOption) (*Attachment, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Attachment)
+	err := c.cc.Invoke(ctx, AttachmentService_GetAttachment_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *attachmentServiceClient) UpdateAttachment(ctx context.Context, in *UpdateAttachmentRequest, opts ...grpc.CallOption) (*Attachment, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Attachment)
+	err := c.cc.Invoke(ctx, AttachmentService_UpdateAttachment_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *attachmentServiceClient) DeleteAttachment(ctx context.Context, in *DeleteAttachmentRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, AttachmentService_DeleteAttachment_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *attachmentServiceClient) BatchDeleteAttachments(ctx context.Context, in *BatchDeleteAttachmentsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, AttachmentService_BatchDeleteAttachments_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// AttachmentServiceServer is the server API for AttachmentService service.
+// All implementations must embed UnimplementedAttachmentServiceServer
+// for forward compatibility.
+type AttachmentServiceServer interface {
+	// CreateAttachment creates a new attachment.
+	CreateAttachment(context.Context, *CreateAttachmentRequest) (*Attachment, error)
+	// ListAttachments lists all attachments.
+	ListAttachments(context.Context, *ListAttachmentsRequest) (*ListAttachmentsResponse, error)
+	// GetAttachment returns an attachment by name.
+	GetAttachment(context.Context, *GetAttachmentRequest) (*Attachment, error)
+	// UpdateAttachment updates an attachment.
+	UpdateAttachment(context.Context, *UpdateAttachmentRequest) (*Attachment, error)
+	// DeleteAttachment deletes an attachment by name.
+	DeleteAttachment(context.Context, *DeleteAttachmentRequest) (*emptypb.Empty, error)
+	// BatchDeleteAttachments deletes multiple attachments in one request.
+	BatchDeleteAttachments(context.Context, *BatchDeleteAttachmentsRequest) (*emptypb.Empty, error)
+	mustEmbedUnimplementedAttachmentServiceServer()
+}
+
+// UnimplementedAttachmentServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedAttachmentServiceServer struct{}
+
+func (UnimplementedAttachmentServiceServer) CreateAttachment(context.Context, *CreateAttachmentRequest) (*Attachment, error) {
+	return nil, status.Error(codes.Unimplemented, "method CreateAttachment not implemented")
+}
+func (UnimplementedAttachmentServiceServer) ListAttachments(context.Context, *ListAttachmentsRequest) (*ListAttachmentsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListAttachments not implemented")
+}
+func (UnimplementedAttachmentServiceServer) GetAttachment(context.Context, *GetAttachmentRequest) (*Attachment, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetAttachment not implemented")
+}
+func (UnimplementedAttachmentServiceServer) UpdateAttachment(context.Context, *UpdateAttachmentRequest) (*Attachment, error) {
+	return nil, status.Error(codes.Unimplemented, "method UpdateAttachment not implemented")
+}
+func (UnimplementedAttachmentServiceServer) DeleteAttachment(context.Context, *DeleteAttachmentRequest) (*emptypb.Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method DeleteAttachment not implemented")
+}
+func (UnimplementedAttachmentServiceServer) BatchDeleteAttachments(context.Context, *BatchDeleteAttachmentsRequest) (*emptypb.Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method BatchDeleteAttachments not implemented")
+}
+func (UnimplementedAttachmentServiceServer) mustEmbedUnimplementedAttachmentServiceServer() {}
+func (UnimplementedAttachmentServiceServer) testEmbeddedByValue()                           {}
+
+// UnsafeAttachmentServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to AttachmentServiceServer will
+// result in compilation errors.
+type UnsafeAttachmentServiceServer interface {
+	mustEmbedUnimplementedAttachmentServiceServer()
+}
+
+func RegisterAttachmentServiceServer(s grpc.ServiceRegistrar, srv AttachmentServiceServer) {
+	// If the following call panics, it indicates UnimplementedAttachmentServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&AttachmentService_ServiceDesc, srv)
+}
+
+func _AttachmentService_CreateAttachment_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateAttachmentRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AttachmentServiceServer).CreateAttachment(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AttachmentService_CreateAttachment_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AttachmentServiceServer).CreateAttachment(ctx, req.(*CreateAttachmentRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AttachmentService_ListAttachments_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListAttachmentsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AttachmentServiceServer).ListAttachments(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AttachmentService_ListAttachments_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AttachmentServiceServer).ListAttachments(ctx, req.(*ListAttachmentsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AttachmentService_GetAttachment_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetAttachmentRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AttachmentServiceServer).GetAttachment(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AttachmentService_GetAttachment_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AttachmentServiceServer).GetAttachment(ctx, req.(*GetAttachmentRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AttachmentService_UpdateAttachment_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateAttachmentRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AttachmentServiceServer).UpdateAttachment(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AttachmentService_UpdateAttachment_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AttachmentServiceServer).UpdateAttachment(ctx, req.(*UpdateAttachmentRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AttachmentService_DeleteAttachment_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteAttachmentRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AttachmentServiceServer).DeleteAttachment(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AttachmentService_DeleteAttachment_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AttachmentServiceServer).DeleteAttachment(ctx, req.(*DeleteAttachmentRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AttachmentService_BatchDeleteAttachments_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(BatchDeleteAttachmentsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AttachmentServiceServer).BatchDeleteAttachments(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AttachmentService_BatchDeleteAttachments_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AttachmentServiceServer).BatchDeleteAttachments(ctx, req.(*BatchDeleteAttachmentsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// AttachmentService_ServiceDesc is the grpc.ServiceDesc for AttachmentService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var AttachmentService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "memos.api.v1.AttachmentService",
+	HandlerType: (*AttachmentServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "CreateAttachment",
+			Handler:    _AttachmentService_CreateAttachment_Handler,
+		},
+		{
+			MethodName: "ListAttachments",
+			Handler:    _AttachmentService_ListAttachments_Handler,
+		},
+		{
+			MethodName: "GetAttachment",
+			Handler:    _AttachmentService_GetAttachment_Handler,
+		},
+		{
+			MethodName: "UpdateAttachment",
+			Handler:    _AttachmentService_UpdateAttachment_Handler,
+		},
+		{
+			MethodName: "DeleteAttachment",
+			Handler:    _AttachmentService_DeleteAttachment_Handler,
+		},
+		{
+			MethodName: "BatchDeleteAttachments",
+			Handler:    _AttachmentService_BatchDeleteAttachments_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "api/v1/attachment_service.proto",
+}

proto/gen/api/v1/auth_service.pb.go

@@ -0,0 +1,628 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: api/v1/auth_service.proto
+
+package apiv1
+
+import (
+	_ "google.golang.org/genproto/googleapis/api/annotations"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type GetCurrentUserRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetCurrentUserRequest) Reset() {
+	*x = GetCurrentUserRequest{}
+	mi := &file_api_v1_auth_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetCurrentUserRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetCurrentUserRequest) ProtoMessage() {}
+
+func (x *GetCurrentUserRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_auth_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetCurrentUserRequest.ProtoReflect.Descriptor instead.
+func (*GetCurrentUserRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_auth_service_proto_rawDescGZIP(), []int{0}
+}
+
+type GetCurrentUserResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The authenticated user's information.
+	User          *User `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetCurrentUserResponse) Reset() {
+	*x = GetCurrentUserResponse{}
+	mi := &file_api_v1_auth_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetCurrentUserResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetCurrentUserResponse) ProtoMessage() {}
+
+func (x *GetCurrentUserResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_auth_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetCurrentUserResponse.ProtoReflect.Descriptor instead.
+func (*GetCurrentUserResponse) Descriptor() ([]byte, []int) {
+	return file_api_v1_auth_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GetCurrentUserResponse) GetUser() *User {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+type SignInRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Authentication credentials. Provide one method.
+	//
+	// Types that are valid to be assigned to Credentials:
+	//
+	//	*SignInRequest_PasswordCredentials_
+	//	*SignInRequest_SsoCredentials
+	Credentials   isSignInRequest_Credentials `protobuf_oneof:"credentials"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SignInRequest) Reset() {
+	*x = SignInRequest{}
+	mi := &file_api_v1_auth_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SignInRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SignInRequest) ProtoMessage() {}
+
+func (x *SignInRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_auth_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SignInRequest.ProtoReflect.Descriptor instead.
+func (*SignInRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_auth_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *SignInRequest) GetCredentials() isSignInRequest_Credentials {
+	if x != nil {
+		return x.Credentials
+	}
+	return nil
+}
+
+func (x *SignInRequest) GetPasswordCredentials() *SignInRequest_PasswordCredentials {
+	if x != nil {
+		if x, ok := x.Credentials.(*SignInRequest_PasswordCredentials_); ok {
+			return x.PasswordCredentials
+		}
+	}
+	return nil
+}
+
+func (x *SignInRequest) GetSsoCredentials() *SignInRequest_SSOCredentials {
+	if x != nil {
+		if x, ok := x.Credentials.(*SignInRequest_SsoCredentials); ok {
+			return x.SsoCredentials
+		}
+	}
+	return nil
+}
+
+type isSignInRequest_Credentials interface {
+	isSignInRequest_Credentials()
+}
+
+type SignInRequest_PasswordCredentials_ struct {
+	// Username and password authentication.
+	PasswordCredentials *SignInRequest_PasswordCredentials `protobuf:"bytes,1,opt,name=password_credentials,json=passwordCredentials,proto3,oneof"`
+}
+
+type SignInRequest_SsoCredentials struct {
+	// SSO provider authentication.
+	SsoCredentials *SignInRequest_SSOCredentials `protobuf:"bytes,2,opt,name=sso_credentials,json=ssoCredentials,proto3,oneof"`
+}
+
+func (*SignInRequest_PasswordCredentials_) isSignInRequest_Credentials() {}
+
+func (*SignInRequest_SsoCredentials) isSignInRequest_Credentials() {}
+
+type SignInResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The authenticated user's information.
+	User *User `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
+	// The short-lived access token for API requests.
+	// Store in memory only, not in localStorage.
+	AccessToken string `protobuf:"bytes,2,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
+	// When the access token expires.
+	// Client should call RefreshToken before this time.
+	AccessTokenExpiresAt *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=access_token_expires_at,json=accessTokenExpiresAt,proto3" json:"access_token_expires_at,omitempty"`
+	unknownFields        protoimpl.UnknownFields
+	sizeCache            protoimpl.SizeCache
+}
+
+func (x *SignInResponse) Reset() {
+	*x = SignInResponse{}
+	mi := &file_api_v1_auth_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SignInResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SignInResponse) ProtoMessage() {}
+
+func (x *SignInResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_auth_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SignInResponse.ProtoReflect.Descriptor instead.
+func (*SignInResponse) Descriptor() ([]byte, []int) {
+	return file_api_v1_auth_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *SignInResponse) GetUser() *User {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+func (x *SignInResponse) GetAccessToken() string {
+	if x != nil {
+		return x.AccessToken
+	}
+	return ""
+}
+
+func (x *SignInResponse) GetAccessTokenExpiresAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.AccessTokenExpiresAt
+	}
+	return nil
+}
+
+type SignOutRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SignOutRequest) Reset() {
+	*x = SignOutRequest{}
+	mi := &file_api_v1_auth_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SignOutRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SignOutRequest) ProtoMessage() {}
+
+func (x *SignOutRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_auth_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SignOutRequest.ProtoReflect.Descriptor instead.
+func (*SignOutRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_auth_service_proto_rawDescGZIP(), []int{4}
+}
+
+type RefreshTokenRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RefreshTokenRequest) Reset() {
+	*x = RefreshTokenRequest{}
+	mi := &file_api_v1_auth_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RefreshTokenRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RefreshTokenRequest) ProtoMessage() {}
+
+func (x *RefreshTokenRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_auth_service_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RefreshTokenRequest.ProtoReflect.Descriptor instead.
+func (*RefreshTokenRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_auth_service_proto_rawDescGZIP(), []int{5}
+}
+
+type RefreshTokenResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The new short-lived access token.
+	AccessToken string `protobuf:"bytes,1,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
+	// When the access token expires.
+	ExpiresAt     *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RefreshTokenResponse) Reset() {
+	*x = RefreshTokenResponse{}
+	mi := &file_api_v1_auth_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RefreshTokenResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RefreshTokenResponse) ProtoMessage() {}
+
+func (x *RefreshTokenResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_auth_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RefreshTokenResponse.ProtoReflect.Descriptor instead.
+func (*RefreshTokenResponse) Descriptor() ([]byte, []int) {
+	return file_api_v1_auth_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *RefreshTokenResponse) GetAccessToken() string {
+	if x != nil {
+		return x.AccessToken
+	}
+	return ""
+}
+
+func (x *RefreshTokenResponse) GetExpiresAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.ExpiresAt
+	}
+	return nil
+}
+
+// Nested message for password-based authentication credentials.
+type SignInRequest_PasswordCredentials struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The username to sign in with.
+	Username string `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
+	// The password to sign in with.
+	Password      string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SignInRequest_PasswordCredentials) Reset() {
+	*x = SignInRequest_PasswordCredentials{}
+	mi := &file_api_v1_auth_service_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SignInRequest_PasswordCredentials) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SignInRequest_PasswordCredentials) ProtoMessage() {}
+
+func (x *SignInRequest_PasswordCredentials) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_auth_service_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SignInRequest_PasswordCredentials.ProtoReflect.Descriptor instead.
+func (*SignInRequest_PasswordCredentials) Descriptor() ([]byte, []int) {
+	return file_api_v1_auth_service_proto_rawDescGZIP(), []int{2, 0}
+}
+
+func (x *SignInRequest_PasswordCredentials) GetUsername() string {
+	if x != nil {
+		return x.Username
+	}
+	return ""
+}
+
+func (x *SignInRequest_PasswordCredentials) GetPassword() string {
+	if x != nil {
+		return x.Password
+	}
+	return ""
+}
+
+// Nested message for SSO authentication credentials.
+type SignInRequest_SSOCredentials struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The resource name of the SSO provider.
+	// Format: identity-providers/{uid}
+	IdpName string `protobuf:"bytes,1,opt,name=idp_name,json=idpName,proto3" json:"idp_name,omitempty"`
+	// The authorization code from the SSO provider.
+	Code string `protobuf:"bytes,2,opt,name=code,proto3" json:"code,omitempty"`
+	// The redirect URI used in the SSO flow.
+	RedirectUri string `protobuf:"bytes,3,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
+	// The PKCE code verifier for enhanced security (RFC 7636).
+	// Optional - enables PKCE flow protection against authorization code interception.
+	CodeVerifier  string `protobuf:"bytes,4,opt,name=code_verifier,json=codeVerifier,proto3" json:"code_verifier,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SignInRequest_SSOCredentials) Reset() {
+	*x = SignInRequest_SSOCredentials{}
+	mi := &file_api_v1_auth_service_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SignInRequest_SSOCredentials) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SignInRequest_SSOCredentials) ProtoMessage() {}
+
+func (x *SignInRequest_SSOCredentials) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_auth_service_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SignInRequest_SSOCredentials.ProtoReflect.Descriptor instead.
+func (*SignInRequest_SSOCredentials) Descriptor() ([]byte, []int) {
+	return file_api_v1_auth_service_proto_rawDescGZIP(), []int{2, 1}
+}
+
+func (x *SignInRequest_SSOCredentials) GetIdpName() string {
+	if x != nil {
+		return x.IdpName
+	}
+	return ""
+}
+
+func (x *SignInRequest_SSOCredentials) GetCode() string {
+	if x != nil {
+		return x.Code
+	}
+	return ""
+}
+
+func (x *SignInRequest_SSOCredentials) GetRedirectUri() string {
+	if x != nil {
+		return x.RedirectUri
+	}
+	return ""
+}
+
+func (x *SignInRequest_SSOCredentials) GetCodeVerifier() string {
+	if x != nil {
+		return x.CodeVerifier
+	}
+	return ""
+}
+
+var File_api_v1_auth_service_proto protoreflect.FileDescriptor
+
+const file_api_v1_auth_service_proto_rawDesc = "" +
+	"\n" +
+	"\x19api/v1/auth_service.proto\x12\fmemos.api.v1\x1a\x19api/v1/user_service.proto\x1a\x1cgoogle/api/annotations.proto\x1a\x1fgoogle/api/field_behavior.proto\x1a\x1bgoogle/protobuf/empty.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\x17\n" +
+	"\x15GetCurrentUserRequest\"@\n" +
+	"\x16GetCurrentUserResponse\x12&\n" +
+	"\x04user\x18\x01 \x01(\v2\x12.memos.api.v1.UserR\x04user\"\xd2\x03\n" +
+	"\rSignInRequest\x12d\n" +
+	"\x14password_credentials\x18\x01 \x01(\v2/.memos.api.v1.SignInRequest.PasswordCredentialsH\x00R\x13passwordCredentials\x12U\n" +
+	"\x0fsso_credentials\x18\x02 \x01(\v2*.memos.api.v1.SignInRequest.SSOCredentialsH\x00R\x0essoCredentials\x1aW\n" +
+	"\x13PasswordCredentials\x12\x1f\n" +
+	"\busername\x18\x01 \x01(\tB\x03\xe0A\x02R\busername\x12\x1f\n" +
+	"\bpassword\x18\x02 \x01(\tB\x03\xe0A\x02R\bpassword\x1a\x9b\x01\n" +
+	"\x0eSSOCredentials\x12\x1e\n" +
+	"\bidp_name\x18\x01 \x01(\tB\x03\xe0A\x02R\aidpName\x12\x17\n" +
+	"\x04code\x18\x02 \x01(\tB\x03\xe0A\x02R\x04code\x12&\n" +
+	"\fredirect_uri\x18\x03 \x01(\tB\x03\xe0A\x02R\vredirectUri\x12(\n" +
+	"\rcode_verifier\x18\x04 \x01(\tB\x03\xe0A\x01R\fcodeVerifierB\r\n" +
+	"\vcredentials\"\xae\x01\n" +
+	"\x0eSignInResponse\x12&\n" +
+	"\x04user\x18\x01 \x01(\v2\x12.memos.api.v1.UserR\x04user\x12!\n" +
+	"\faccess_token\x18\x02 \x01(\tR\vaccessToken\x12Q\n" +
+	"\x17access_token_expires_at\x18\x03 \x01(\v2\x1a.google.protobuf.TimestampR\x14accessTokenExpiresAt\"\x10\n" +
+	"\x0eSignOutRequest\"\x15\n" +
+	"\x13RefreshTokenRequest\"t\n" +
+	"\x14RefreshTokenResponse\x12!\n" +
+	"\faccess_token\x18\x01 \x01(\tR\vaccessToken\x129\n" +
+	"\n" +
+	"expires_at\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\texpiresAt2\xbf\x03\n" +
+	"\vAuthService\x12t\n" +
+	"\x0eGetCurrentUser\x12#.memos.api.v1.GetCurrentUserRequest\x1a$.memos.api.v1.GetCurrentUserResponse\"\x17\x82\xd3\xe4\x93\x02\x11\x12\x0f/api/v1/auth/me\x12c\n" +
+	"\x06SignIn\x12\x1b.memos.api.v1.SignInRequest\x1a\x1c.memos.api.v1.SignInResponse\"\x1e\x82\xd3\xe4\x93\x02\x18:\x01*\"\x13/api/v1/auth/signin\x12]\n" +
+	"\aSignOut\x12\x1c.memos.api.v1.SignOutRequest\x1a\x16.google.protobuf.Empty\"\x1c\x82\xd3\xe4\x93\x02\x16\"\x14/api/v1/auth/signout\x12v\n" +
+	"\fRefreshToken\x12!.memos.api.v1.RefreshTokenRequest\x1a\".memos.api.v1.RefreshTokenResponse\"\x1f\x82\xd3\xe4\x93\x02\x19:\x01*\"\x14/api/v1/auth/refreshB\xa8\x01\n" +
+	"\x10com.memos.api.v1B\x10AuthServiceProtoP\x01Z0github.com/usememos/memos/proto/gen/api/v1;apiv1\xa2\x02\x03MAX\xaa\x02\fMemos.Api.V1\xca\x02\fMemos\\Api\\V1\xe2\x02\x18Memos\\Api\\V1\\GPBMetadata\xea\x02\x0eMemos::Api::V1b\x06proto3"
+
+var (
+	file_api_v1_auth_service_proto_rawDescOnce sync.Once
+	file_api_v1_auth_service_proto_rawDescData []byte
+)
+
+func file_api_v1_auth_service_proto_rawDescGZIP() []byte {
+	file_api_v1_auth_service_proto_rawDescOnce.Do(func() {
+		file_api_v1_auth_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_api_v1_auth_service_proto_rawDesc), len(file_api_v1_auth_service_proto_rawDesc)))
+	})
+	return file_api_v1_auth_service_proto_rawDescData
+}
+
+var file_api_v1_auth_service_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_api_v1_auth_service_proto_goTypes = []any{
+	(*GetCurrentUserRequest)(nil),             // 0: memos.api.v1.GetCurrentUserRequest
+	(*GetCurrentUserResponse)(nil),            // 1: memos.api.v1.GetCurrentUserResponse
+	(*SignInRequest)(nil),                     // 2: memos.api.v1.SignInRequest
+	(*SignInResponse)(nil),                    // 3: memos.api.v1.SignInResponse
+	(*SignOutRequest)(nil),                    // 4: memos.api.v1.SignOutRequest
+	(*RefreshTokenRequest)(nil),               // 5: memos.api.v1.RefreshTokenRequest
+	(*RefreshTokenResponse)(nil),              // 6: memos.api.v1.RefreshTokenResponse
+	(*SignInRequest_PasswordCredentials)(nil), // 7: memos.api.v1.SignInRequest.PasswordCredentials
+	(*SignInRequest_SSOCredentials)(nil),      // 8: memos.api.v1.SignInRequest.SSOCredentials
+	(*User)(nil),                              // 9: memos.api.v1.User
+	(*timestamppb.Timestamp)(nil),             // 10: google.protobuf.Timestamp
+	(*emptypb.Empty)(nil),                     // 11: google.protobuf.Empty
+}
+var file_api_v1_auth_service_proto_depIdxs = []int32{
+	9,  // 0: memos.api.v1.GetCurrentUserResponse.user:type_name -> memos.api.v1.User
+	7,  // 1: memos.api.v1.SignInRequest.password_credentials:type_name -> memos.api.v1.SignInRequest.PasswordCredentials
+	8,  // 2: memos.api.v1.SignInRequest.sso_credentials:type_name -> memos.api.v1.SignInRequest.SSOCredentials
+	9,  // 3: memos.api.v1.SignInResponse.user:type_name -> memos.api.v1.User
+	10, // 4: memos.api.v1.SignInResponse.access_token_expires_at:type_name -> google.protobuf.Timestamp
+	10, // 5: memos.api.v1.RefreshTokenResponse.expires_at:type_name -> google.protobuf.Timestamp
+	0,  // 6: memos.api.v1.AuthService.GetCurrentUser:input_type -> memos.api.v1.GetCurrentUserRequest
+	2,  // 7: memos.api.v1.AuthService.SignIn:input_type -> memos.api.v1.SignInRequest
+	4,  // 8: memos.api.v1.AuthService.SignOut:input_type -> memos.api.v1.SignOutRequest
+	5,  // 9: memos.api.v1.AuthService.RefreshToken:input_type -> memos.api.v1.RefreshTokenRequest
+	1,  // 10: memos.api.v1.AuthService.GetCurrentUser:output_type -> memos.api.v1.GetCurrentUserResponse
+	3,  // 11: memos.api.v1.AuthService.SignIn:output_type -> memos.api.v1.SignInResponse
+	11, // 12: memos.api.v1.AuthService.SignOut:output_type -> google.protobuf.Empty
+	6,  // 13: memos.api.v1.AuthService.RefreshToken:output_type -> memos.api.v1.RefreshTokenResponse
+	10, // [10:14] is the sub-list for method output_type
+	6,  // [6:10] is the sub-list for method input_type
+	6,  // [6:6] is the sub-list for extension type_name
+	6,  // [6:6] is the sub-list for extension extendee
+	0,  // [0:6] is the sub-list for field type_name
+}
+
+func init() { file_api_v1_auth_service_proto_init() }
+func file_api_v1_auth_service_proto_init() {
+	if File_api_v1_auth_service_proto != nil {
+		return
+	}
+	file_api_v1_user_service_proto_init()
+	file_api_v1_auth_service_proto_msgTypes[2].OneofWrappers = []any{
+		(*SignInRequest_PasswordCredentials_)(nil),
+		(*SignInRequest_SsoCredentials)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_v1_auth_service_proto_rawDesc), len(file_api_v1_auth_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   9,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_api_v1_auth_service_proto_goTypes,
+		DependencyIndexes: file_api_v1_auth_service_proto_depIdxs,
+		MessageInfos:      file_api_v1_auth_service_proto_msgTypes,
+	}.Build()
+	File_api_v1_auth_service_proto = out.File
+	file_api_v1_auth_service_proto_goTypes = nil
+	file_api_v1_auth_service_proto_depIdxs = nil
+}

proto/gen/api/v1/auth_service.pb.gw.go

@@ -0,0 +1,343 @@
+// Code generated by protoc-gen-grpc-gateway. DO NOT EDIT.
+// source: api/v1/auth_service.proto
+
+/*
+Package apiv1 is a reverse proxy.
+
+It translates gRPC into RESTful JSON APIs.
+*/
+package apiv1
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// Suppress "imported and not used" errors
+var (
+	_ codes.Code
+	_ io.Reader
+	_ status.Status
+	_ = errors.New
+	_ = runtime.String
+	_ = utilities.NewDoubleArray
+	_ = metadata.Join
+)
+
+func request_AuthService_GetCurrentUser_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetCurrentUserRequest
+		metadata runtime.ServerMetadata
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.GetCurrentUser(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_AuthService_GetCurrentUser_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetCurrentUserRequest
+		metadata runtime.ServerMetadata
+	)
+	msg, err := server.GetCurrentUser(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_AuthService_SignIn_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SignInRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.SignIn(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_AuthService_SignIn_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SignInRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.SignIn(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_AuthService_SignOut_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SignOutRequest
+		metadata runtime.ServerMetadata
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.SignOut(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_AuthService_SignOut_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SignOutRequest
+		metadata runtime.ServerMetadata
+	)
+	msg, err := server.SignOut(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_AuthService_RefreshToken_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RefreshTokenRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.RefreshToken(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_AuthService_RefreshToken_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RefreshTokenRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.RefreshToken(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+// RegisterAuthServiceHandlerServer registers the http handlers for service AuthService to "mux".
+// UnaryRPC     :call AuthServiceServer directly.
+// StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+// Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterAuthServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
+func RegisterAuthServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server AuthServiceServer) error {
+	mux.Handle(http.MethodGet, pattern_AuthService_GetCurrentUser_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.AuthService/GetCurrentUser", runtime.WithHTTPPathPattern("/api/v1/auth/me"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_GetCurrentUser_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AuthService_GetCurrentUser_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_AuthService_SignIn_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.AuthService/SignIn", runtime.WithHTTPPathPattern("/api/v1/auth/signin"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_SignIn_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AuthService_SignIn_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_AuthService_SignOut_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.AuthService/SignOut", runtime.WithHTTPPathPattern("/api/v1/auth/signout"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_SignOut_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AuthService_SignOut_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_AuthService_RefreshToken_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.AuthService/RefreshToken", runtime.WithHTTPPathPattern("/api/v1/auth/refresh"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_RefreshToken_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AuthService_RefreshToken_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+
+	return nil
+}
+
+// RegisterAuthServiceHandlerFromEndpoint is same as RegisterAuthServiceHandler but
+// automatically dials to "endpoint" and closes the connection when "ctx" gets done.
+func RegisterAuthServiceHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+	conn, err := grpc.NewClient(endpoint, opts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+			return
+		}
+		go func() {
+			<-ctx.Done()
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+		}()
+	}()
+	return RegisterAuthServiceHandler(ctx, mux, conn)
+}
+
+// RegisterAuthServiceHandler registers the http handlers for service AuthService to "mux".
+// The handlers forward requests to the grpc endpoint over "conn".
+func RegisterAuthServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return RegisterAuthServiceHandlerClient(ctx, mux, NewAuthServiceClient(conn))
+}
+
+// RegisterAuthServiceHandlerClient registers the http handlers for service AuthService
+// to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "AuthServiceClient".
+// Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "AuthServiceClient"
+// doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+// "AuthServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
+func RegisterAuthServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client AuthServiceClient) error {
+	mux.Handle(http.MethodGet, pattern_AuthService_GetCurrentUser_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.AuthService/GetCurrentUser", runtime.WithHTTPPathPattern("/api/v1/auth/me"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_GetCurrentUser_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AuthService_GetCurrentUser_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_AuthService_SignIn_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.AuthService/SignIn", runtime.WithHTTPPathPattern("/api/v1/auth/signin"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_SignIn_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AuthService_SignIn_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_AuthService_SignOut_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.AuthService/SignOut", runtime.WithHTTPPathPattern("/api/v1/auth/signout"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_SignOut_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AuthService_SignOut_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_AuthService_RefreshToken_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.AuthService/RefreshToken", runtime.WithHTTPPathPattern("/api/v1/auth/refresh"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_RefreshToken_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AuthService_RefreshToken_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	return nil
+}
+
+var (
+	pattern_AuthService_GetCurrentUser_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"api", "v1", "auth", "me"}, ""))
+	pattern_AuthService_SignIn_0         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"api", "v1", "auth", "signin"}, ""))
+	pattern_AuthService_SignOut_0        = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"api", "v1", "auth", "signout"}, ""))
+	pattern_AuthService_RefreshToken_0   = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"api", "v1", "auth", "refresh"}, ""))
+)
+
+var (
+	forward_AuthService_GetCurrentUser_0 = runtime.ForwardResponseMessage
+	forward_AuthService_SignIn_0         = runtime.ForwardResponseMessage
+	forward_AuthService_SignOut_0        = runtime.ForwardResponseMessage
+	forward_AuthService_RefreshToken_0   = runtime.ForwardResponseMessage
+)

proto/gen/api/v1/auth_service_grpc.pb.go

@@ -0,0 +1,258 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             (unknown)
+// source: api/v1/auth_service.proto
+
+package apiv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	AuthService_GetCurrentUser_FullMethodName = "/memos.api.v1.AuthService/GetCurrentUser"
+	AuthService_SignIn_FullMethodName         = "/memos.api.v1.AuthService/SignIn"
+	AuthService_SignOut_FullMethodName        = "/memos.api.v1.AuthService/SignOut"
+	AuthService_RefreshToken_FullMethodName   = "/memos.api.v1.AuthService/RefreshToken"
+)
+
+// AuthServiceClient is the client API for AuthService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type AuthServiceClient interface {
+	// GetCurrentUser returns the authenticated user's information.
+	// Validates the access token and returns user details.
+	// Similar to OIDC's /userinfo endpoint.
+	GetCurrentUser(ctx context.Context, in *GetCurrentUserRequest, opts ...grpc.CallOption) (*GetCurrentUserResponse, error)
+	// SignIn authenticates a user with credentials and returns tokens.
+	// On success, returns an access token and sets a refresh token cookie.
+	// Supports password-based and SSO authentication methods.
+	SignIn(ctx context.Context, in *SignInRequest, opts ...grpc.CallOption) (*SignInResponse, error)
+	// SignOut terminates the user's authentication.
+	// Revokes the refresh token and clears the authentication cookie.
+	SignOut(ctx context.Context, in *SignOutRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// RefreshToken exchanges a valid refresh token for a new access token.
+	// The refresh token is read from the HttpOnly cookie.
+	// Returns a new short-lived access token.
+	RefreshToken(ctx context.Context, in *RefreshTokenRequest, opts ...grpc.CallOption) (*RefreshTokenResponse, error)
+}
+
+type authServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewAuthServiceClient(cc grpc.ClientConnInterface) AuthServiceClient {
+	return &authServiceClient{cc}
+}
+
+func (c *authServiceClient) GetCurrentUser(ctx context.Context, in *GetCurrentUserRequest, opts ...grpc.CallOption) (*GetCurrentUserResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetCurrentUserResponse)
+	err := c.cc.Invoke(ctx, AuthService_GetCurrentUser_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) SignIn(ctx context.Context, in *SignInRequest, opts ...grpc.CallOption) (*SignInResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(SignInResponse)
+	err := c.cc.Invoke(ctx, AuthService_SignIn_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) SignOut(ctx context.Context, in *SignOutRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, AuthService_SignOut_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) RefreshToken(ctx context.Context, in *RefreshTokenRequest, opts ...grpc.CallOption) (*RefreshTokenResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RefreshTokenResponse)
+	err := c.cc.Invoke(ctx, AuthService_RefreshToken_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// AuthServiceServer is the server API for AuthService service.
+// All implementations must embed UnimplementedAuthServiceServer
+// for forward compatibility.
+type AuthServiceServer interface {
+	// GetCurrentUser returns the authenticated user's information.
+	// Validates the access token and returns user details.
+	// Similar to OIDC's /userinfo endpoint.
+	GetCurrentUser(context.Context, *GetCurrentUserRequest) (*GetCurrentUserResponse, error)
+	// SignIn authenticates a user with credentials and returns tokens.
+	// On success, returns an access token and sets a refresh token cookie.
+	// Supports password-based and SSO authentication methods.
+	SignIn(context.Context, *SignInRequest) (*SignInResponse, error)
+	// SignOut terminates the user's authentication.
+	// Revokes the refresh token and clears the authentication cookie.
+	SignOut(context.Context, *SignOutRequest) (*emptypb.Empty, error)
+	// RefreshToken exchanges a valid refresh token for a new access token.
+	// The refresh token is read from the HttpOnly cookie.
+	// Returns a new short-lived access token.
+	RefreshToken(context.Context, *RefreshTokenRequest) (*RefreshTokenResponse, error)
+	mustEmbedUnimplementedAuthServiceServer()
+}
+
+// UnimplementedAuthServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedAuthServiceServer struct{}
+
+func (UnimplementedAuthServiceServer) GetCurrentUser(context.Context, *GetCurrentUserRequest) (*GetCurrentUserResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetCurrentUser not implemented")
+}
+func (UnimplementedAuthServiceServer) SignIn(context.Context, *SignInRequest) (*SignInResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method SignIn not implemented")
+}
+func (UnimplementedAuthServiceServer) SignOut(context.Context, *SignOutRequest) (*emptypb.Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method SignOut not implemented")
+}
+func (UnimplementedAuthServiceServer) RefreshToken(context.Context, *RefreshTokenRequest) (*RefreshTokenResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method RefreshToken not implemented")
+}
+func (UnimplementedAuthServiceServer) mustEmbedUnimplementedAuthServiceServer() {}
+func (UnimplementedAuthServiceServer) testEmbeddedByValue()                     {}
+
+// UnsafeAuthServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to AuthServiceServer will
+// result in compilation errors.
+type UnsafeAuthServiceServer interface {
+	mustEmbedUnimplementedAuthServiceServer()
+}
+
+func RegisterAuthServiceServer(s grpc.ServiceRegistrar, srv AuthServiceServer) {
+	// If the following call panics, it indicates UnimplementedAuthServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&AuthService_ServiceDesc, srv)
+}
+
+func _AuthService_GetCurrentUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetCurrentUserRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).GetCurrentUser(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_GetCurrentUser_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).GetCurrentUser(ctx, req.(*GetCurrentUserRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_SignIn_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SignInRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).SignIn(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_SignIn_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).SignIn(ctx, req.(*SignInRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_SignOut_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SignOutRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).SignOut(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_SignOut_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).SignOut(ctx, req.(*SignOutRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_RefreshToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RefreshTokenRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).RefreshToken(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_RefreshToken_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).RefreshToken(ctx, req.(*RefreshTokenRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// AuthService_ServiceDesc is the grpc.ServiceDesc for AuthService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var AuthService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "memos.api.v1.AuthService",
+	HandlerType: (*AuthServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetCurrentUser",
+			Handler:    _AuthService_GetCurrentUser_Handler,
+		},
+		{
+			MethodName: "SignIn",
+			Handler:    _AuthService_SignIn_Handler,
+		},
+		{
+			MethodName: "SignOut",
+			Handler:    _AuthService_SignOut_Handler,
+		},
+		{
+			MethodName: "RefreshToken",
+			Handler:    _AuthService_RefreshToken_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "api/v1/auth_service.proto",
+}

proto/gen/api/v1/common.pb.go

@@ -0,0 +1,244 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: api/v1/common.proto
+
+package apiv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type State int32
+
+const (
+	State_STATE_UNSPECIFIED State = 0
+	State_NORMAL            State = 1
+	State_ARCHIVED          State = 2
+)
+
+// Enum value maps for State.
+var (
+	State_name = map[int32]string{
+		0: "STATE_UNSPECIFIED",
+		1: "NORMAL",
+		2: "ARCHIVED",
+	}
+	State_value = map[string]int32{
+		"STATE_UNSPECIFIED": 0,
+		"NORMAL":            1,
+		"ARCHIVED":          2,
+	}
+)
+
+func (x State) Enum() *State {
+	p := new(State)
+	*p = x
+	return p
+}
+
+func (x State) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (State) Descriptor() protoreflect.EnumDescriptor {
+	return file_api_v1_common_proto_enumTypes[0].Descriptor()
+}
+
+func (State) Type() protoreflect.EnumType {
+	return &file_api_v1_common_proto_enumTypes[0]
+}
+
+func (x State) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use State.Descriptor instead.
+func (State) EnumDescriptor() ([]byte, []int) {
+	return file_api_v1_common_proto_rawDescGZIP(), []int{0}
+}
+
+type Direction int32
+
+const (
+	Direction_DIRECTION_UNSPECIFIED Direction = 0
+	Direction_ASC                   Direction = 1
+	Direction_DESC                  Direction = 2
+)
+
+// Enum value maps for Direction.
+var (
+	Direction_name = map[int32]string{
+		0: "DIRECTION_UNSPECIFIED",
+		1: "ASC",
+		2: "DESC",
+	}
+	Direction_value = map[string]int32{
+		"DIRECTION_UNSPECIFIED": 0,
+		"ASC":                   1,
+		"DESC":                  2,
+	}
+)
+
+func (x Direction) Enum() *Direction {
+	p := new(Direction)
+	*p = x
+	return p
+}
+
+func (x Direction) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Direction) Descriptor() protoreflect.EnumDescriptor {
+	return file_api_v1_common_proto_enumTypes[1].Descriptor()
+}
+
+func (Direction) Type() protoreflect.EnumType {
+	return &file_api_v1_common_proto_enumTypes[1]
+}
+
+func (x Direction) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Direction.Descriptor instead.
+func (Direction) EnumDescriptor() ([]byte, []int) {
+	return file_api_v1_common_proto_rawDescGZIP(), []int{1}
+}
+
+// Used internally for obfuscating the page token.
+type PageToken struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Limit         int32                  `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"`
+	Offset        int32                  `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PageToken) Reset() {
+	*x = PageToken{}
+	mi := &file_api_v1_common_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PageToken) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PageToken) ProtoMessage() {}
+
+func (x *PageToken) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_common_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PageToken.ProtoReflect.Descriptor instead.
+func (*PageToken) Descriptor() ([]byte, []int) {
+	return file_api_v1_common_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *PageToken) GetLimit() int32 {
+	if x != nil {
+		return x.Limit
+	}
+	return 0
+}
+
+func (x *PageToken) GetOffset() int32 {
+	if x != nil {
+		return x.Offset
+	}
+	return 0
+}
+
+var File_api_v1_common_proto protoreflect.FileDescriptor
+
+const file_api_v1_common_proto_rawDesc = "" +
+	"\n" +
+	"\x13api/v1/common.proto\x12\fmemos.api.v1\"9\n" +
+	"\tPageToken\x12\x14\n" +
+	"\x05limit\x18\x01 \x01(\x05R\x05limit\x12\x16\n" +
+	"\x06offset\x18\x02 \x01(\x05R\x06offset*8\n" +
+	"\x05State\x12\x15\n" +
+	"\x11STATE_UNSPECIFIED\x10\x00\x12\n" +
+	"\n" +
+	"\x06NORMAL\x10\x01\x12\f\n" +
+	"\bARCHIVED\x10\x02*9\n" +
+	"\tDirection\x12\x19\n" +
+	"\x15DIRECTION_UNSPECIFIED\x10\x00\x12\a\n" +
+	"\x03ASC\x10\x01\x12\b\n" +
+	"\x04DESC\x10\x02B\xa3\x01\n" +
+	"\x10com.memos.api.v1B\vCommonProtoP\x01Z0github.com/usememos/memos/proto/gen/api/v1;apiv1\xa2\x02\x03MAX\xaa\x02\fMemos.Api.V1\xca\x02\fMemos\\Api\\V1\xe2\x02\x18Memos\\Api\\V1\\GPBMetadata\xea\x02\x0eMemos::Api::V1b\x06proto3"
+
+var (
+	file_api_v1_common_proto_rawDescOnce sync.Once
+	file_api_v1_common_proto_rawDescData []byte
+)
+
+func file_api_v1_common_proto_rawDescGZIP() []byte {
+	file_api_v1_common_proto_rawDescOnce.Do(func() {
+		file_api_v1_common_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_api_v1_common_proto_rawDesc), len(file_api_v1_common_proto_rawDesc)))
+	})
+	return file_api_v1_common_proto_rawDescData
+}
+
+var file_api_v1_common_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
+var file_api_v1_common_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_api_v1_common_proto_goTypes = []any{
+	(State)(0),        // 0: memos.api.v1.State
+	(Direction)(0),    // 1: memos.api.v1.Direction
+	(*PageToken)(nil), // 2: memos.api.v1.PageToken
+}
+var file_api_v1_common_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_api_v1_common_proto_init() }
+func file_api_v1_common_proto_init() {
+	if File_api_v1_common_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_v1_common_proto_rawDesc), len(file_api_v1_common_proto_rawDesc)),
+			NumEnums:      2,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_api_v1_common_proto_goTypes,
+		DependencyIndexes: file_api_v1_common_proto_depIdxs,
+		EnumInfos:         file_api_v1_common_proto_enumTypes,
+		MessageInfos:      file_api_v1_common_proto_msgTypes,
+	}.Build()
+	File_api_v1_common_proto = out.File
+	file_api_v1_common_proto_goTypes = nil
+	file_api_v1_common_proto_depIdxs = nil
+}

proto/gen/api/v1/idp_service.pb.go

@@ -0,0 +1,805 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: api/v1/idp_service.proto
+
+package apiv1
+
+import (
+	_ "google.golang.org/genproto/googleapis/api/annotations"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	fieldmaskpb "google.golang.org/protobuf/types/known/fieldmaskpb"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type IdentityProvider_Type int32
+
+const (
+	IdentityProvider_TYPE_UNSPECIFIED IdentityProvider_Type = 0
+	// OAuth2 identity provider.
+	IdentityProvider_OAUTH2 IdentityProvider_Type = 1
+)
+
+// Enum value maps for IdentityProvider_Type.
+var (
+	IdentityProvider_Type_name = map[int32]string{
+		0: "TYPE_UNSPECIFIED",
+		1: "OAUTH2",
+	}
+	IdentityProvider_Type_value = map[string]int32{
+		"TYPE_UNSPECIFIED": 0,
+		"OAUTH2":           1,
+	}
+)
+
+func (x IdentityProvider_Type) Enum() *IdentityProvider_Type {
+	p := new(IdentityProvider_Type)
+	*p = x
+	return p
+}
+
+func (x IdentityProvider_Type) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (IdentityProvider_Type) Descriptor() protoreflect.EnumDescriptor {
+	return file_api_v1_idp_service_proto_enumTypes[0].Descriptor()
+}
+
+func (IdentityProvider_Type) Type() protoreflect.EnumType {
+	return &file_api_v1_idp_service_proto_enumTypes[0]
+}
+
+func (x IdentityProvider_Type) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use IdentityProvider_Type.Descriptor instead.
+func (IdentityProvider_Type) EnumDescriptor() ([]byte, []int) {
+	return file_api_v1_idp_service_proto_rawDescGZIP(), []int{0, 0}
+}
+
+type IdentityProvider struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The resource name of the identity provider.
+	// Format: identity-providers/{idp}
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Required. The type of the identity provider.
+	Type IdentityProvider_Type `protobuf:"varint,2,opt,name=type,proto3,enum=memos.api.v1.IdentityProvider_Type" json:"type,omitempty"`
+	// Required. The display title of the identity provider.
+	Title string `protobuf:"bytes,3,opt,name=title,proto3" json:"title,omitempty"`
+	// Optional. Filter applied to user identifiers.
+	IdentifierFilter string `protobuf:"bytes,4,opt,name=identifier_filter,json=identifierFilter,proto3" json:"identifier_filter,omitempty"`
+	// Required. Configuration for the identity provider.
+	Config        *IdentityProviderConfig `protobuf:"bytes,5,opt,name=config,proto3" json:"config,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *IdentityProvider) Reset() {
+	*x = IdentityProvider{}
+	mi := &file_api_v1_idp_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *IdentityProvider) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IdentityProvider) ProtoMessage() {}
+
+func (x *IdentityProvider) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_idp_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IdentityProvider.ProtoReflect.Descriptor instead.
+func (*IdentityProvider) Descriptor() ([]byte, []int) {
+	return file_api_v1_idp_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *IdentityProvider) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *IdentityProvider) GetType() IdentityProvider_Type {
+	if x != nil {
+		return x.Type
+	}
+	return IdentityProvider_TYPE_UNSPECIFIED
+}
+
+func (x *IdentityProvider) GetTitle() string {
+	if x != nil {
+		return x.Title
+	}
+	return ""
+}
+
+func (x *IdentityProvider) GetIdentifierFilter() string {
+	if x != nil {
+		return x.IdentifierFilter
+	}
+	return ""
+}
+
+func (x *IdentityProvider) GetConfig() *IdentityProviderConfig {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
+type IdentityProviderConfig struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Config:
+	//
+	//	*IdentityProviderConfig_Oauth2Config
+	Config        isIdentityProviderConfig_Config `protobuf_oneof:"config"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *IdentityProviderConfig) Reset() {
+	*x = IdentityProviderConfig{}
+	mi := &file_api_v1_idp_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *IdentityProviderConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IdentityProviderConfig) ProtoMessage() {}
+
+func (x *IdentityProviderConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_idp_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IdentityProviderConfig.ProtoReflect.Descriptor instead.
+func (*IdentityProviderConfig) Descriptor() ([]byte, []int) {
+	return file_api_v1_idp_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *IdentityProviderConfig) GetConfig() isIdentityProviderConfig_Config {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
+func (x *IdentityProviderConfig) GetOauth2Config() *OAuth2Config {
+	if x != nil {
+		if x, ok := x.Config.(*IdentityProviderConfig_Oauth2Config); ok {
+			return x.Oauth2Config
+		}
+	}
+	return nil
+}
+
+type isIdentityProviderConfig_Config interface {
+	isIdentityProviderConfig_Config()
+}
+
+type IdentityProviderConfig_Oauth2Config struct {
+	Oauth2Config *OAuth2Config `protobuf:"bytes,1,opt,name=oauth2_config,json=oauth2Config,proto3,oneof"`
+}
+
+func (*IdentityProviderConfig_Oauth2Config) isIdentityProviderConfig_Config() {}
+
+type FieldMapping struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Identifier    string                 `protobuf:"bytes,1,opt,name=identifier,proto3" json:"identifier,omitempty"`
+	DisplayName   string                 `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
+	Email         string                 `protobuf:"bytes,3,opt,name=email,proto3" json:"email,omitempty"`
+	AvatarUrl     string                 `protobuf:"bytes,4,opt,name=avatar_url,json=avatarUrl,proto3" json:"avatar_url,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *FieldMapping) Reset() {
+	*x = FieldMapping{}
+	mi := &file_api_v1_idp_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *FieldMapping) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FieldMapping) ProtoMessage() {}
+
+func (x *FieldMapping) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_idp_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FieldMapping.ProtoReflect.Descriptor instead.
+func (*FieldMapping) Descriptor() ([]byte, []int) {
+	return file_api_v1_idp_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *FieldMapping) GetIdentifier() string {
+	if x != nil {
+		return x.Identifier
+	}
+	return ""
+}
+
+func (x *FieldMapping) GetDisplayName() string {
+	if x != nil {
+		return x.DisplayName
+	}
+	return ""
+}
+
+func (x *FieldMapping) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *FieldMapping) GetAvatarUrl() string {
+	if x != nil {
+		return x.AvatarUrl
+	}
+	return ""
+}
+
+type OAuth2Config struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ClientId      string                 `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	ClientSecret  string                 `protobuf:"bytes,2,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
+	AuthUrl       string                 `protobuf:"bytes,3,opt,name=auth_url,json=authUrl,proto3" json:"auth_url,omitempty"`
+	TokenUrl      string                 `protobuf:"bytes,4,opt,name=token_url,json=tokenUrl,proto3" json:"token_url,omitempty"`
+	UserInfoUrl   string                 `protobuf:"bytes,5,opt,name=user_info_url,json=userInfoUrl,proto3" json:"user_info_url,omitempty"`
+	Scopes        []string               `protobuf:"bytes,6,rep,name=scopes,proto3" json:"scopes,omitempty"`
+	FieldMapping  *FieldMapping          `protobuf:"bytes,7,opt,name=field_mapping,json=fieldMapping,proto3" json:"field_mapping,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *OAuth2Config) Reset() {
+	*x = OAuth2Config{}
+	mi := &file_api_v1_idp_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *OAuth2Config) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OAuth2Config) ProtoMessage() {}
+
+func (x *OAuth2Config) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_idp_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OAuth2Config.ProtoReflect.Descriptor instead.
+func (*OAuth2Config) Descriptor() ([]byte, []int) {
+	return file_api_v1_idp_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *OAuth2Config) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+func (x *OAuth2Config) GetClientSecret() string {
+	if x != nil {
+		return x.ClientSecret
+	}
+	return ""
+}
+
+func (x *OAuth2Config) GetAuthUrl() string {
+	if x != nil {
+		return x.AuthUrl
+	}
+	return ""
+}
+
+func (x *OAuth2Config) GetTokenUrl() string {
+	if x != nil {
+		return x.TokenUrl
+	}
+	return ""
+}
+
+func (x *OAuth2Config) GetUserInfoUrl() string {
+	if x != nil {
+		return x.UserInfoUrl
+	}
+	return ""
+}
+
+func (x *OAuth2Config) GetScopes() []string {
+	if x != nil {
+		return x.Scopes
+	}
+	return nil
+}
+
+func (x *OAuth2Config) GetFieldMapping() *FieldMapping {
+	if x != nil {
+		return x.FieldMapping
+	}
+	return nil
+}
+
+type ListIdentityProvidersRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListIdentityProvidersRequest) Reset() {
+	*x = ListIdentityProvidersRequest{}
+	mi := &file_api_v1_idp_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListIdentityProvidersRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListIdentityProvidersRequest) ProtoMessage() {}
+
+func (x *ListIdentityProvidersRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_idp_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListIdentityProvidersRequest.ProtoReflect.Descriptor instead.
+func (*ListIdentityProvidersRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_idp_service_proto_rawDescGZIP(), []int{4}
+}
+
+type ListIdentityProvidersResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The list of identity providers.
+	IdentityProviders []*IdentityProvider `protobuf:"bytes,1,rep,name=identity_providers,json=identityProviders,proto3" json:"identity_providers,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *ListIdentityProvidersResponse) Reset() {
+	*x = ListIdentityProvidersResponse{}
+	mi := &file_api_v1_idp_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListIdentityProvidersResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListIdentityProvidersResponse) ProtoMessage() {}
+
+func (x *ListIdentityProvidersResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_idp_service_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListIdentityProvidersResponse.ProtoReflect.Descriptor instead.
+func (*ListIdentityProvidersResponse) Descriptor() ([]byte, []int) {
+	return file_api_v1_idp_service_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *ListIdentityProvidersResponse) GetIdentityProviders() []*IdentityProvider {
+	if x != nil {
+		return x.IdentityProviders
+	}
+	return nil
+}
+
+type GetIdentityProviderRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Required. The resource name of the identity provider to get.
+	// Format: identity-providers/{idp}
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetIdentityProviderRequest) Reset() {
+	*x = GetIdentityProviderRequest{}
+	mi := &file_api_v1_idp_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetIdentityProviderRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetIdentityProviderRequest) ProtoMessage() {}
+
+func (x *GetIdentityProviderRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_idp_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetIdentityProviderRequest.ProtoReflect.Descriptor instead.
+func (*GetIdentityProviderRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_idp_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *GetIdentityProviderRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+type CreateIdentityProviderRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Required. The identity provider to create.
+	IdentityProvider *IdentityProvider `protobuf:"bytes,1,opt,name=identity_provider,json=identityProvider,proto3" json:"identity_provider,omitempty"`
+	// Optional. The ID to use for the identity provider, which will become the final component of the resource name.
+	// If not provided, the system will generate one.
+	IdentityProviderId string `protobuf:"bytes,2,opt,name=identity_provider_id,json=identityProviderId,proto3" json:"identity_provider_id,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
+}
+
+func (x *CreateIdentityProviderRequest) Reset() {
+	*x = CreateIdentityProviderRequest{}
+	mi := &file_api_v1_idp_service_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateIdentityProviderRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateIdentityProviderRequest) ProtoMessage() {}
+
+func (x *CreateIdentityProviderRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_idp_service_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateIdentityProviderRequest.ProtoReflect.Descriptor instead.
+func (*CreateIdentityProviderRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_idp_service_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *CreateIdentityProviderRequest) GetIdentityProvider() *IdentityProvider {
+	if x != nil {
+		return x.IdentityProvider
+	}
+	return nil
+}
+
+func (x *CreateIdentityProviderRequest) GetIdentityProviderId() string {
+	if x != nil {
+		return x.IdentityProviderId
+	}
+	return ""
+}
+
+type UpdateIdentityProviderRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Required. The identity provider to update.
+	IdentityProvider *IdentityProvider `protobuf:"bytes,1,opt,name=identity_provider,json=identityProvider,proto3" json:"identity_provider,omitempty"`
+	// Required. The update mask applies to the resource. Only the top level fields of
+	// IdentityProvider are supported.
+	UpdateMask    *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateIdentityProviderRequest) Reset() {
+	*x = UpdateIdentityProviderRequest{}
+	mi := &file_api_v1_idp_service_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateIdentityProviderRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateIdentityProviderRequest) ProtoMessage() {}
+
+func (x *UpdateIdentityProviderRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_idp_service_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateIdentityProviderRequest.ProtoReflect.Descriptor instead.
+func (*UpdateIdentityProviderRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_idp_service_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *UpdateIdentityProviderRequest) GetIdentityProvider() *IdentityProvider {
+	if x != nil {
+		return x.IdentityProvider
+	}
+	return nil
+}
+
+func (x *UpdateIdentityProviderRequest) GetUpdateMask() *fieldmaskpb.FieldMask {
+	if x != nil {
+		return x.UpdateMask
+	}
+	return nil
+}
+
+type DeleteIdentityProviderRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Required. The resource name of the identity provider to delete.
+	// Format: identity-providers/{idp}
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteIdentityProviderRequest) Reset() {
+	*x = DeleteIdentityProviderRequest{}
+	mi := &file_api_v1_idp_service_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteIdentityProviderRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteIdentityProviderRequest) ProtoMessage() {}
+
+func (x *DeleteIdentityProviderRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_idp_service_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteIdentityProviderRequest.ProtoReflect.Descriptor instead.
+func (*DeleteIdentityProviderRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_idp_service_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *DeleteIdentityProviderRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+var File_api_v1_idp_service_proto protoreflect.FileDescriptor
+
+const file_api_v1_idp_service_proto_rawDesc = "" +
+	"\n" +
+	"\x18api/v1/idp_service.proto\x12\fmemos.api.v1\x1a\x1cgoogle/api/annotations.proto\x1a\x17google/api/client.proto\x1a\x1fgoogle/api/field_behavior.proto\x1a\x19google/api/resource.proto\x1a\x1bgoogle/protobuf/empty.proto\x1a google/protobuf/field_mask.proto\"\x8c\x03\n" +
+	"\x10IdentityProvider\x12\x17\n" +
+	"\x04name\x18\x01 \x01(\tB\x03\xe0A\bR\x04name\x12<\n" +
+	"\x04type\x18\x02 \x01(\x0e2#.memos.api.v1.IdentityProvider.TypeB\x03\xe0A\x02R\x04type\x12\x19\n" +
+	"\x05title\x18\x03 \x01(\tB\x03\xe0A\x02R\x05title\x120\n" +
+	"\x11identifier_filter\x18\x04 \x01(\tB\x03\xe0A\x01R\x10identifierFilter\x12A\n" +
+	"\x06config\x18\x05 \x01(\v2$.memos.api.v1.IdentityProviderConfigB\x03\xe0A\x02R\x06config\"(\n" +
+	"\x04Type\x12\x14\n" +
+	"\x10TYPE_UNSPECIFIED\x10\x00\x12\n" +
+	"\n" +
+	"\x06OAUTH2\x10\x01:g\xeaAd\n" +
+	"\x1dmemos.api.v1/IdentityProvider\x12\x18identity-providers/{idp}\x1a\x04name*\x11identityProviders2\x10identityProvider\"e\n" +
+	"\x16IdentityProviderConfig\x12A\n" +
+	"\roauth2_config\x18\x01 \x01(\v2\x1a.memos.api.v1.OAuth2ConfigH\x00R\foauth2ConfigB\b\n" +
+	"\x06config\"\x86\x01\n" +
+	"\fFieldMapping\x12\x1e\n" +
+	"\n" +
+	"identifier\x18\x01 \x01(\tR\n" +
+	"identifier\x12!\n" +
+	"\fdisplay_name\x18\x02 \x01(\tR\vdisplayName\x12\x14\n" +
+	"\x05email\x18\x03 \x01(\tR\x05email\x12\x1d\n" +
+	"\n" +
+	"avatar_url\x18\x04 \x01(\tR\tavatarUrl\"\x85\x02\n" +
+	"\fOAuth2Config\x12\x1b\n" +
+	"\tclient_id\x18\x01 \x01(\tR\bclientId\x12#\n" +
+	"\rclient_secret\x18\x02 \x01(\tR\fclientSecret\x12\x19\n" +
+	"\bauth_url\x18\x03 \x01(\tR\aauthUrl\x12\x1b\n" +
+	"\ttoken_url\x18\x04 \x01(\tR\btokenUrl\x12\"\n" +
+	"\ruser_info_url\x18\x05 \x01(\tR\vuserInfoUrl\x12\x16\n" +
+	"\x06scopes\x18\x06 \x03(\tR\x06scopes\x12?\n" +
+	"\rfield_mapping\x18\a \x01(\v2\x1a.memos.api.v1.FieldMappingR\ffieldMapping\"\x1e\n" +
+	"\x1cListIdentityProvidersRequest\"n\n" +
+	"\x1dListIdentityProvidersResponse\x12M\n" +
+	"\x12identity_providers\x18\x01 \x03(\v2\x1e.memos.api.v1.IdentityProviderR\x11identityProviders\"W\n" +
+	"\x1aGetIdentityProviderRequest\x129\n" +
+	"\x04name\x18\x01 \x01(\tB%\xe0A\x02\xfaA\x1f\n" +
+	"\x1dmemos.api.v1/IdentityProviderR\x04name\"\xa8\x01\n" +
+	"\x1dCreateIdentityProviderRequest\x12P\n" +
+	"\x11identity_provider\x18\x01 \x01(\v2\x1e.memos.api.v1.IdentityProviderB\x03\xe0A\x02R\x10identityProvider\x125\n" +
+	"\x14identity_provider_id\x18\x02 \x01(\tB\x03\xe0A\x01R\x12identityProviderId\"\xb3\x01\n" +
+	"\x1dUpdateIdentityProviderRequest\x12P\n" +
+	"\x11identity_provider\x18\x01 \x01(\v2\x1e.memos.api.v1.IdentityProviderB\x03\xe0A\x02R\x10identityProvider\x12@\n" +
+	"\vupdate_mask\x18\x02 \x01(\v2\x1a.google.protobuf.FieldMaskB\x03\xe0A\x02R\n" +
+	"updateMask\"Z\n" +
+	"\x1dDeleteIdentityProviderRequest\x129\n" +
+	"\x04name\x18\x01 \x01(\tB%\xe0A\x02\xfaA\x1f\n" +
+	"\x1dmemos.api.v1/IdentityProviderR\x04name2\xe7\x06\n" +
+	"\x17IdentityProviderService\x12\x94\x01\n" +
+	"\x15ListIdentityProviders\x12*.memos.api.v1.ListIdentityProvidersRequest\x1a+.memos.api.v1.ListIdentityProvidersResponse\"\"\x82\xd3\xe4\x93\x02\x1c\x12\x1a/api/v1/identity-providers\x12\x93\x01\n" +
+	"\x13GetIdentityProvider\x12(.memos.api.v1.GetIdentityProviderRequest\x1a\x1e.memos.api.v1.IdentityProvider\"2\xdaA\x04name\x82\xd3\xe4\x93\x02%\x12#/api/v1/{name=identity-providers/*}\x12\xb0\x01\n" +
+	"\x16CreateIdentityProvider\x12+.memos.api.v1.CreateIdentityProviderRequest\x1a\x1e.memos.api.v1.IdentityProvider\"I\xdaA\x11identity_provider\x82\xd3\xe4\x93\x02/:\x11identity_provider\"\x1a/api/v1/identity-providers\x12\xd7\x01\n" +
+	"\x16UpdateIdentityProvider\x12+.memos.api.v1.UpdateIdentityProviderRequest\x1a\x1e.memos.api.v1.IdentityProvider\"p\xdaA\x1didentity_provider,update_mask\x82\xd3\xe4\x93\x02J:\x11identity_provider25/api/v1/{identity_provider.name=identity-providers/*}\x12\x91\x01\n" +
+	"\x16DeleteIdentityProvider\x12+.memos.api.v1.DeleteIdentityProviderRequest\x1a\x16.google.protobuf.Empty\"2\xdaA\x04name\x82\xd3\xe4\x93\x02%*#/api/v1/{name=identity-providers/*}B\xa7\x01\n" +
+	"\x10com.memos.api.v1B\x0fIdpServiceProtoP\x01Z0github.com/usememos/memos/proto/gen/api/v1;apiv1\xa2\x02\x03MAX\xaa\x02\fMemos.Api.V1\xca\x02\fMemos\\Api\\V1\xe2\x02\x18Memos\\Api\\V1\\GPBMetadata\xea\x02\x0eMemos::Api::V1b\x06proto3"
+
+var (
+	file_api_v1_idp_service_proto_rawDescOnce sync.Once
+	file_api_v1_idp_service_proto_rawDescData []byte
+)
+
+func file_api_v1_idp_service_proto_rawDescGZIP() []byte {
+	file_api_v1_idp_service_proto_rawDescOnce.Do(func() {
+		file_api_v1_idp_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_api_v1_idp_service_proto_rawDesc), len(file_api_v1_idp_service_proto_rawDesc)))
+	})
+	return file_api_v1_idp_service_proto_rawDescData
+}
+
+var file_api_v1_idp_service_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_api_v1_idp_service_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
+var file_api_v1_idp_service_proto_goTypes = []any{
+	(IdentityProvider_Type)(0),            // 0: memos.api.v1.IdentityProvider.Type
+	(*IdentityProvider)(nil),              // 1: memos.api.v1.IdentityProvider
+	(*IdentityProviderConfig)(nil),        // 2: memos.api.v1.IdentityProviderConfig
+	(*FieldMapping)(nil),                  // 3: memos.api.v1.FieldMapping
+	(*OAuth2Config)(nil),                  // 4: memos.api.v1.OAuth2Config
+	(*ListIdentityProvidersRequest)(nil),  // 5: memos.api.v1.ListIdentityProvidersRequest
+	(*ListIdentityProvidersResponse)(nil), // 6: memos.api.v1.ListIdentityProvidersResponse
+	(*GetIdentityProviderRequest)(nil),    // 7: memos.api.v1.GetIdentityProviderRequest
+	(*CreateIdentityProviderRequest)(nil), // 8: memos.api.v1.CreateIdentityProviderRequest
+	(*UpdateIdentityProviderRequest)(nil), // 9: memos.api.v1.UpdateIdentityProviderRequest
+	(*DeleteIdentityProviderRequest)(nil), // 10: memos.api.v1.DeleteIdentityProviderRequest
+	(*fieldmaskpb.FieldMask)(nil),         // 11: google.protobuf.FieldMask
+	(*emptypb.Empty)(nil),                 // 12: google.protobuf.Empty
+}
+var file_api_v1_idp_service_proto_depIdxs = []int32{
+	0,  // 0: memos.api.v1.IdentityProvider.type:type_name -> memos.api.v1.IdentityProvider.Type
+	2,  // 1: memos.api.v1.IdentityProvider.config:type_name -> memos.api.v1.IdentityProviderConfig
+	4,  // 2: memos.api.v1.IdentityProviderConfig.oauth2_config:type_name -> memos.api.v1.OAuth2Config
+	3,  // 3: memos.api.v1.OAuth2Config.field_mapping:type_name -> memos.api.v1.FieldMapping
+	1,  // 4: memos.api.v1.ListIdentityProvidersResponse.identity_providers:type_name -> memos.api.v1.IdentityProvider
+	1,  // 5: memos.api.v1.CreateIdentityProviderRequest.identity_provider:type_name -> memos.api.v1.IdentityProvider
+	1,  // 6: memos.api.v1.UpdateIdentityProviderRequest.identity_provider:type_name -> memos.api.v1.IdentityProvider
+	11, // 7: memos.api.v1.UpdateIdentityProviderRequest.update_mask:type_name -> google.protobuf.FieldMask
+	5,  // 8: memos.api.v1.IdentityProviderService.ListIdentityProviders:input_type -> memos.api.v1.ListIdentityProvidersRequest
+	7,  // 9: memos.api.v1.IdentityProviderService.GetIdentityProvider:input_type -> memos.api.v1.GetIdentityProviderRequest
+	8,  // 10: memos.api.v1.IdentityProviderService.CreateIdentityProvider:input_type -> memos.api.v1.CreateIdentityProviderRequest
+	9,  // 11: memos.api.v1.IdentityProviderService.UpdateIdentityProvider:input_type -> memos.api.v1.UpdateIdentityProviderRequest
+	10, // 12: memos.api.v1.IdentityProviderService.DeleteIdentityProvider:input_type -> memos.api.v1.DeleteIdentityProviderRequest
+	6,  // 13: memos.api.v1.IdentityProviderService.ListIdentityProviders:output_type -> memos.api.v1.ListIdentityProvidersResponse
+	1,  // 14: memos.api.v1.IdentityProviderService.GetIdentityProvider:output_type -> memos.api.v1.IdentityProvider
+	1,  // 15: memos.api.v1.IdentityProviderService.CreateIdentityProvider:output_type -> memos.api.v1.IdentityProvider
+	1,  // 16: memos.api.v1.IdentityProviderService.UpdateIdentityProvider:output_type -> memos.api.v1.IdentityProvider
+	12, // 17: memos.api.v1.IdentityProviderService.DeleteIdentityProvider:output_type -> google.protobuf.Empty
+	13, // [13:18] is the sub-list for method output_type
+	8,  // [8:13] is the sub-list for method input_type
+	8,  // [8:8] is the sub-list for extension type_name
+	8,  // [8:8] is the sub-list for extension extendee
+	0,  // [0:8] is the sub-list for field type_name
+}
+
+func init() { file_api_v1_idp_service_proto_init() }
+func file_api_v1_idp_service_proto_init() {
+	if File_api_v1_idp_service_proto != nil {
+		return
+	}
+	file_api_v1_idp_service_proto_msgTypes[1].OneofWrappers = []any{
+		(*IdentityProviderConfig_Oauth2Config)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_v1_idp_service_proto_rawDesc), len(file_api_v1_idp_service_proto_rawDesc)),
+			NumEnums:      1,
+			NumMessages:   10,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_api_v1_idp_service_proto_goTypes,
+		DependencyIndexes: file_api_v1_idp_service_proto_depIdxs,
+		EnumInfos:         file_api_v1_idp_service_proto_enumTypes,
+		MessageInfos:      file_api_v1_idp_service_proto_msgTypes,
+	}.Build()
+	File_api_v1_idp_service_proto = out.File
+	file_api_v1_idp_service_proto_goTypes = nil
+	file_api_v1_idp_service_proto_depIdxs = nil
+}

proto/gen/api/v1/idp_service.pb.gw.go

@@ -0,0 +1,507 @@
+// Code generated by protoc-gen-grpc-gateway. DO NOT EDIT.
+// source: api/v1/idp_service.proto
+
+/*
+Package apiv1 is a reverse proxy.
+
+It translates gRPC into RESTful JSON APIs.
+*/
+package apiv1
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// Suppress "imported and not used" errors
+var (
+	_ codes.Code
+	_ io.Reader
+	_ status.Status
+	_ = errors.New
+	_ = runtime.String
+	_ = utilities.NewDoubleArray
+	_ = metadata.Join
+)
+
+func request_IdentityProviderService_ListIdentityProviders_0(ctx context.Context, marshaler runtime.Marshaler, client IdentityProviderServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListIdentityProvidersRequest
+		metadata runtime.ServerMetadata
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.ListIdentityProviders(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_IdentityProviderService_ListIdentityProviders_0(ctx context.Context, marshaler runtime.Marshaler, server IdentityProviderServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListIdentityProvidersRequest
+		metadata runtime.ServerMetadata
+	)
+	msg, err := server.ListIdentityProviders(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_IdentityProviderService_GetIdentityProvider_0(ctx context.Context, marshaler runtime.Marshaler, client IdentityProviderServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetIdentityProviderRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	val, ok := pathParams["name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
+	}
+	protoReq.Name, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
+	}
+	msg, err := client.GetIdentityProvider(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_IdentityProviderService_GetIdentityProvider_0(ctx context.Context, marshaler runtime.Marshaler, server IdentityProviderServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetIdentityProviderRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
+	}
+	protoReq.Name, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
+	}
+	msg, err := server.GetIdentityProvider(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+var filter_IdentityProviderService_CreateIdentityProvider_0 = &utilities.DoubleArray{Encoding: map[string]int{"identity_provider": 0}, Base: []int{1, 1, 0}, Check: []int{0, 1, 2}}
+
+func request_IdentityProviderService_CreateIdentityProvider_0(ctx context.Context, marshaler runtime.Marshaler, client IdentityProviderServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq CreateIdentityProviderRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq.IdentityProvider); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_IdentityProviderService_CreateIdentityProvider_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.CreateIdentityProvider(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_IdentityProviderService_CreateIdentityProvider_0(ctx context.Context, marshaler runtime.Marshaler, server IdentityProviderServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq CreateIdentityProviderRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq.IdentityProvider); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_IdentityProviderService_CreateIdentityProvider_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.CreateIdentityProvider(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+var filter_IdentityProviderService_UpdateIdentityProvider_0 = &utilities.DoubleArray{Encoding: map[string]int{"identity_provider": 0, "name": 1}, Base: []int{1, 2, 1, 0, 0}, Check: []int{0, 1, 2, 3, 2}}
+
+func request_IdentityProviderService_UpdateIdentityProvider_0(ctx context.Context, marshaler runtime.Marshaler, client IdentityProviderServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq UpdateIdentityProviderRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq.IdentityProvider); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	if protoReq.UpdateMask == nil || len(protoReq.UpdateMask.GetPaths()) == 0 {
+		if fieldMask, err := runtime.FieldMaskFromRequestBody(newReader(), protoReq.IdentityProvider); err != nil {
+			return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+		} else {
+			protoReq.UpdateMask = fieldMask
+		}
+	}
+	val, ok := pathParams["identity_provider.name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "identity_provider.name")
+	}
+	err = runtime.PopulateFieldFromPath(&protoReq, "identity_provider.name", val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "identity_provider.name", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_IdentityProviderService_UpdateIdentityProvider_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.UpdateIdentityProvider(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_IdentityProviderService_UpdateIdentityProvider_0(ctx context.Context, marshaler runtime.Marshaler, server IdentityProviderServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq UpdateIdentityProviderRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq.IdentityProvider); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if protoReq.UpdateMask == nil || len(protoReq.UpdateMask.GetPaths()) == 0 {
+		if fieldMask, err := runtime.FieldMaskFromRequestBody(newReader(), protoReq.IdentityProvider); err != nil {
+			return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+		} else {
+			protoReq.UpdateMask = fieldMask
+		}
+	}
+	val, ok := pathParams["identity_provider.name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "identity_provider.name")
+	}
+	err = runtime.PopulateFieldFromPath(&protoReq, "identity_provider.name", val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "identity_provider.name", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_IdentityProviderService_UpdateIdentityProvider_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.UpdateIdentityProvider(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_IdentityProviderService_DeleteIdentityProvider_0(ctx context.Context, marshaler runtime.Marshaler, client IdentityProviderServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DeleteIdentityProviderRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	val, ok := pathParams["name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
+	}
+	protoReq.Name, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
+	}
+	msg, err := client.DeleteIdentityProvider(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_IdentityProviderService_DeleteIdentityProvider_0(ctx context.Context, marshaler runtime.Marshaler, server IdentityProviderServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DeleteIdentityProviderRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
+	}
+	protoReq.Name, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
+	}
+	msg, err := server.DeleteIdentityProvider(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+// RegisterIdentityProviderServiceHandlerServer registers the http handlers for service IdentityProviderService to "mux".
+// UnaryRPC     :call IdentityProviderServiceServer directly.
+// StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+// Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterIdentityProviderServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
+func RegisterIdentityProviderServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server IdentityProviderServiceServer) error {
+	mux.Handle(http.MethodGet, pattern_IdentityProviderService_ListIdentityProviders_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.IdentityProviderService/ListIdentityProviders", runtime.WithHTTPPathPattern("/api/v1/identity-providers"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_IdentityProviderService_ListIdentityProviders_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_IdentityProviderService_ListIdentityProviders_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_IdentityProviderService_GetIdentityProvider_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.IdentityProviderService/GetIdentityProvider", runtime.WithHTTPPathPattern("/api/v1/{name=identity-providers/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_IdentityProviderService_GetIdentityProvider_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_IdentityProviderService_GetIdentityProvider_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_IdentityProviderService_CreateIdentityProvider_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.IdentityProviderService/CreateIdentityProvider", runtime.WithHTTPPathPattern("/api/v1/identity-providers"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_IdentityProviderService_CreateIdentityProvider_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_IdentityProviderService_CreateIdentityProvider_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPatch, pattern_IdentityProviderService_UpdateIdentityProvider_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.IdentityProviderService/UpdateIdentityProvider", runtime.WithHTTPPathPattern("/api/v1/{identity_provider.name=identity-providers/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_IdentityProviderService_UpdateIdentityProvider_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_IdentityProviderService_UpdateIdentityProvider_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodDelete, pattern_IdentityProviderService_DeleteIdentityProvider_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.IdentityProviderService/DeleteIdentityProvider", runtime.WithHTTPPathPattern("/api/v1/{name=identity-providers/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_IdentityProviderService_DeleteIdentityProvider_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_IdentityProviderService_DeleteIdentityProvider_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+
+	return nil
+}
+
+// RegisterIdentityProviderServiceHandlerFromEndpoint is same as RegisterIdentityProviderServiceHandler but
+// automatically dials to "endpoint" and closes the connection when "ctx" gets done.
+func RegisterIdentityProviderServiceHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+	conn, err := grpc.NewClient(endpoint, opts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+			return
+		}
+		go func() {
+			<-ctx.Done()
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+		}()
+	}()
+	return RegisterIdentityProviderServiceHandler(ctx, mux, conn)
+}
+
+// RegisterIdentityProviderServiceHandler registers the http handlers for service IdentityProviderService to "mux".
+// The handlers forward requests to the grpc endpoint over "conn".
+func RegisterIdentityProviderServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return RegisterIdentityProviderServiceHandlerClient(ctx, mux, NewIdentityProviderServiceClient(conn))
+}
+
+// RegisterIdentityProviderServiceHandlerClient registers the http handlers for service IdentityProviderService
+// to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "IdentityProviderServiceClient".
+// Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "IdentityProviderServiceClient"
+// doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+// "IdentityProviderServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
+func RegisterIdentityProviderServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client IdentityProviderServiceClient) error {
+	mux.Handle(http.MethodGet, pattern_IdentityProviderService_ListIdentityProviders_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.IdentityProviderService/ListIdentityProviders", runtime.WithHTTPPathPattern("/api/v1/identity-providers"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_IdentityProviderService_ListIdentityProviders_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_IdentityProviderService_ListIdentityProviders_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_IdentityProviderService_GetIdentityProvider_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.IdentityProviderService/GetIdentityProvider", runtime.WithHTTPPathPattern("/api/v1/{name=identity-providers/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_IdentityProviderService_GetIdentityProvider_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_IdentityProviderService_GetIdentityProvider_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_IdentityProviderService_CreateIdentityProvider_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.IdentityProviderService/CreateIdentityProvider", runtime.WithHTTPPathPattern("/api/v1/identity-providers"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_IdentityProviderService_CreateIdentityProvider_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_IdentityProviderService_CreateIdentityProvider_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPatch, pattern_IdentityProviderService_UpdateIdentityProvider_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.IdentityProviderService/UpdateIdentityProvider", runtime.WithHTTPPathPattern("/api/v1/{identity_provider.name=identity-providers/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_IdentityProviderService_UpdateIdentityProvider_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_IdentityProviderService_UpdateIdentityProvider_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodDelete, pattern_IdentityProviderService_DeleteIdentityProvider_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.IdentityProviderService/DeleteIdentityProvider", runtime.WithHTTPPathPattern("/api/v1/{name=identity-providers/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_IdentityProviderService_DeleteIdentityProvider_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_IdentityProviderService_DeleteIdentityProvider_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	return nil
+}
+
+var (
+	pattern_IdentityProviderService_ListIdentityProviders_0  = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"api", "v1", "identity-providers"}, ""))
+	pattern_IdentityProviderService_GetIdentityProvider_0    = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 2, 5, 3}, []string{"api", "v1", "identity-providers", "name"}, ""))
+	pattern_IdentityProviderService_CreateIdentityProvider_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"api", "v1", "identity-providers"}, ""))
+	pattern_IdentityProviderService_UpdateIdentityProvider_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 2, 5, 3}, []string{"api", "v1", "identity-providers", "identity_provider.name"}, ""))
+	pattern_IdentityProviderService_DeleteIdentityProvider_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 2, 5, 3}, []string{"api", "v1", "identity-providers", "name"}, ""))
+)
+
+var (
+	forward_IdentityProviderService_ListIdentityProviders_0  = runtime.ForwardResponseMessage
+	forward_IdentityProviderService_GetIdentityProvider_0    = runtime.ForwardResponseMessage
+	forward_IdentityProviderService_CreateIdentityProvider_0 = runtime.ForwardResponseMessage
+	forward_IdentityProviderService_UpdateIdentityProvider_0 = runtime.ForwardResponseMessage
+	forward_IdentityProviderService_DeleteIdentityProvider_0 = runtime.ForwardResponseMessage
+)

proto/gen/api/v1/idp_service_grpc.pb.go

@@ -0,0 +1,285 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             (unknown)
+// source: api/v1/idp_service.proto
+
+package apiv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	IdentityProviderService_ListIdentityProviders_FullMethodName  = "/memos.api.v1.IdentityProviderService/ListIdentityProviders"
+	IdentityProviderService_GetIdentityProvider_FullMethodName    = "/memos.api.v1.IdentityProviderService/GetIdentityProvider"
+	IdentityProviderService_CreateIdentityProvider_FullMethodName = "/memos.api.v1.IdentityProviderService/CreateIdentityProvider"
+	IdentityProviderService_UpdateIdentityProvider_FullMethodName = "/memos.api.v1.IdentityProviderService/UpdateIdentityProvider"
+	IdentityProviderService_DeleteIdentityProvider_FullMethodName = "/memos.api.v1.IdentityProviderService/DeleteIdentityProvider"
+)
+
+// IdentityProviderServiceClient is the client API for IdentityProviderService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type IdentityProviderServiceClient interface {
+	// ListIdentityProviders lists identity providers.
+	ListIdentityProviders(ctx context.Context, in *ListIdentityProvidersRequest, opts ...grpc.CallOption) (*ListIdentityProvidersResponse, error)
+	// GetIdentityProvider gets an identity provider.
+	GetIdentityProvider(ctx context.Context, in *GetIdentityProviderRequest, opts ...grpc.CallOption) (*IdentityProvider, error)
+	// CreateIdentityProvider creates an identity provider.
+	CreateIdentityProvider(ctx context.Context, in *CreateIdentityProviderRequest, opts ...grpc.CallOption) (*IdentityProvider, error)
+	// UpdateIdentityProvider updates an identity provider.
+	UpdateIdentityProvider(ctx context.Context, in *UpdateIdentityProviderRequest, opts ...grpc.CallOption) (*IdentityProvider, error)
+	// DeleteIdentityProvider deletes an identity provider.
+	DeleteIdentityProvider(ctx context.Context, in *DeleteIdentityProviderRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+}
+
+type identityProviderServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewIdentityProviderServiceClient(cc grpc.ClientConnInterface) IdentityProviderServiceClient {
+	return &identityProviderServiceClient{cc}
+}
+
+func (c *identityProviderServiceClient) ListIdentityProviders(ctx context.Context, in *ListIdentityProvidersRequest, opts ...grpc.CallOption) (*ListIdentityProvidersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListIdentityProvidersResponse)
+	err := c.cc.Invoke(ctx, IdentityProviderService_ListIdentityProviders_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *identityProviderServiceClient) GetIdentityProvider(ctx context.Context, in *GetIdentityProviderRequest, opts ...grpc.CallOption) (*IdentityProvider, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(IdentityProvider)
+	err := c.cc.Invoke(ctx, IdentityProviderService_GetIdentityProvider_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *identityProviderServiceClient) CreateIdentityProvider(ctx context.Context, in *CreateIdentityProviderRequest, opts ...grpc.CallOption) (*IdentityProvider, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(IdentityProvider)
+	err := c.cc.Invoke(ctx, IdentityProviderService_CreateIdentityProvider_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *identityProviderServiceClient) UpdateIdentityProvider(ctx context.Context, in *UpdateIdentityProviderRequest, opts ...grpc.CallOption) (*IdentityProvider, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(IdentityProvider)
+	err := c.cc.Invoke(ctx, IdentityProviderService_UpdateIdentityProvider_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *identityProviderServiceClient) DeleteIdentityProvider(ctx context.Context, in *DeleteIdentityProviderRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, IdentityProviderService_DeleteIdentityProvider_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// IdentityProviderServiceServer is the server API for IdentityProviderService service.
+// All implementations must embed UnimplementedIdentityProviderServiceServer
+// for forward compatibility.
+type IdentityProviderServiceServer interface {
+	// ListIdentityProviders lists identity providers.
+	ListIdentityProviders(context.Context, *ListIdentityProvidersRequest) (*ListIdentityProvidersResponse, error)
+	// GetIdentityProvider gets an identity provider.
+	GetIdentityProvider(context.Context, *GetIdentityProviderRequest) (*IdentityProvider, error)
+	// CreateIdentityProvider creates an identity provider.
+	CreateIdentityProvider(context.Context, *CreateIdentityProviderRequest) (*IdentityProvider, error)
+	// UpdateIdentityProvider updates an identity provider.
+	UpdateIdentityProvider(context.Context, *UpdateIdentityProviderRequest) (*IdentityProvider, error)
+	// DeleteIdentityProvider deletes an identity provider.
+	DeleteIdentityProvider(context.Context, *DeleteIdentityProviderRequest) (*emptypb.Empty, error)
+	mustEmbedUnimplementedIdentityProviderServiceServer()
+}
+
+// UnimplementedIdentityProviderServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedIdentityProviderServiceServer struct{}
+
+func (UnimplementedIdentityProviderServiceServer) ListIdentityProviders(context.Context, *ListIdentityProvidersRequest) (*ListIdentityProvidersResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListIdentityProviders not implemented")
+}
+func (UnimplementedIdentityProviderServiceServer) GetIdentityProvider(context.Context, *GetIdentityProviderRequest) (*IdentityProvider, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetIdentityProvider not implemented")
+}
+func (UnimplementedIdentityProviderServiceServer) CreateIdentityProvider(context.Context, *CreateIdentityProviderRequest) (*IdentityProvider, error) {
+	return nil, status.Error(codes.Unimplemented, "method CreateIdentityProvider not implemented")
+}
+func (UnimplementedIdentityProviderServiceServer) UpdateIdentityProvider(context.Context, *UpdateIdentityProviderRequest) (*IdentityProvider, error) {
+	return nil, status.Error(codes.Unimplemented, "method UpdateIdentityProvider not implemented")
+}
+func (UnimplementedIdentityProviderServiceServer) DeleteIdentityProvider(context.Context, *DeleteIdentityProviderRequest) (*emptypb.Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method DeleteIdentityProvider not implemented")
+}
+func (UnimplementedIdentityProviderServiceServer) mustEmbedUnimplementedIdentityProviderServiceServer() {
+}
+func (UnimplementedIdentityProviderServiceServer) testEmbeddedByValue() {}
+
+// UnsafeIdentityProviderServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to IdentityProviderServiceServer will
+// result in compilation errors.
+type UnsafeIdentityProviderServiceServer interface {
+	mustEmbedUnimplementedIdentityProviderServiceServer()
+}
+
+func RegisterIdentityProviderServiceServer(s grpc.ServiceRegistrar, srv IdentityProviderServiceServer) {
+	// If the following call panics, it indicates UnimplementedIdentityProviderServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&IdentityProviderService_ServiceDesc, srv)
+}
+
+func _IdentityProviderService_ListIdentityProviders_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListIdentityProvidersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(IdentityProviderServiceServer).ListIdentityProviders(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: IdentityProviderService_ListIdentityProviders_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(IdentityProviderServiceServer).ListIdentityProviders(ctx, req.(*ListIdentityProvidersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _IdentityProviderService_GetIdentityProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetIdentityProviderRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(IdentityProviderServiceServer).GetIdentityProvider(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: IdentityProviderService_GetIdentityProvider_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(IdentityProviderServiceServer).GetIdentityProvider(ctx, req.(*GetIdentityProviderRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _IdentityProviderService_CreateIdentityProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateIdentityProviderRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(IdentityProviderServiceServer).CreateIdentityProvider(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: IdentityProviderService_CreateIdentityProvider_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(IdentityProviderServiceServer).CreateIdentityProvider(ctx, req.(*CreateIdentityProviderRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _IdentityProviderService_UpdateIdentityProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateIdentityProviderRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(IdentityProviderServiceServer).UpdateIdentityProvider(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: IdentityProviderService_UpdateIdentityProvider_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(IdentityProviderServiceServer).UpdateIdentityProvider(ctx, req.(*UpdateIdentityProviderRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _IdentityProviderService_DeleteIdentityProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteIdentityProviderRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(IdentityProviderServiceServer).DeleteIdentityProvider(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: IdentityProviderService_DeleteIdentityProvider_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(IdentityProviderServiceServer).DeleteIdentityProvider(ctx, req.(*DeleteIdentityProviderRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// IdentityProviderService_ServiceDesc is the grpc.ServiceDesc for IdentityProviderService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var IdentityProviderService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "memos.api.v1.IdentityProviderService",
+	HandlerType: (*IdentityProviderServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "ListIdentityProviders",
+			Handler:    _IdentityProviderService_ListIdentityProviders_Handler,
+		},
+		{
+			MethodName: "GetIdentityProvider",
+			Handler:    _IdentityProviderService_GetIdentityProvider_Handler,
+		},
+		{
+			MethodName: "CreateIdentityProvider",
+			Handler:    _IdentityProviderService_CreateIdentityProvider_Handler,
+		},
+		{
+			MethodName: "UpdateIdentityProvider",
+			Handler:    _IdentityProviderService_UpdateIdentityProvider_Handler,
+		},
+		{
+			MethodName: "DeleteIdentityProvider",
+			Handler:    _IdentityProviderService_DeleteIdentityProvider_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "api/v1/idp_service.proto",
+}

proto/gen/api/v1/instance_service.pb.gw.go

@@ -0,0 +1,541 @@
+// Code generated by protoc-gen-grpc-gateway. DO NOT EDIT.
+// source: api/v1/instance_service.proto
+
+/*
+Package apiv1 is a reverse proxy.
+
+It translates gRPC into RESTful JSON APIs.
+*/
+package apiv1
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// Suppress "imported and not used" errors
+var (
+	_ codes.Code
+	_ io.Reader
+	_ status.Status
+	_ = errors.New
+	_ = runtime.String
+	_ = utilities.NewDoubleArray
+	_ = metadata.Join
+)
+
+func request_InstanceService_GetInstanceProfile_0(ctx context.Context, marshaler runtime.Marshaler, client InstanceServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetInstanceProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.GetInstanceProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_InstanceService_GetInstanceProfile_0(ctx context.Context, marshaler runtime.Marshaler, server InstanceServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetInstanceProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	msg, err := server.GetInstanceProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_InstanceService_GetInstanceSetting_0(ctx context.Context, marshaler runtime.Marshaler, client InstanceServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetInstanceSettingRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	val, ok := pathParams["name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
+	}
+	protoReq.Name, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
+	}
+	msg, err := client.GetInstanceSetting(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_InstanceService_GetInstanceSetting_0(ctx context.Context, marshaler runtime.Marshaler, server InstanceServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetInstanceSettingRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
+	}
+	protoReq.Name, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
+	}
+	msg, err := server.GetInstanceSetting(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_InstanceService_BatchGetInstanceSettings_0(ctx context.Context, marshaler runtime.Marshaler, client InstanceServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq BatchGetInstanceSettingsRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.BatchGetInstanceSettings(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_InstanceService_BatchGetInstanceSettings_0(ctx context.Context, marshaler runtime.Marshaler, server InstanceServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq BatchGetInstanceSettingsRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.BatchGetInstanceSettings(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+var filter_InstanceService_UpdateInstanceSetting_0 = &utilities.DoubleArray{Encoding: map[string]int{"setting": 0, "name": 1}, Base: []int{1, 2, 1, 0, 0}, Check: []int{0, 1, 2, 3, 2}}
+
+func request_InstanceService_UpdateInstanceSetting_0(ctx context.Context, marshaler runtime.Marshaler, client InstanceServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq UpdateInstanceSettingRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq.Setting); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	if protoReq.UpdateMask == nil || len(protoReq.UpdateMask.GetPaths()) == 0 {
+		if fieldMask, err := runtime.FieldMaskFromRequestBody(newReader(), protoReq.Setting); err != nil {
+			return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+		} else {
+			protoReq.UpdateMask = fieldMask
+		}
+	}
+	val, ok := pathParams["setting.name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "setting.name")
+	}
+	err = runtime.PopulateFieldFromPath(&protoReq, "setting.name", val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "setting.name", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_InstanceService_UpdateInstanceSetting_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.UpdateInstanceSetting(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_InstanceService_UpdateInstanceSetting_0(ctx context.Context, marshaler runtime.Marshaler, server InstanceServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq UpdateInstanceSettingRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq.Setting); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if protoReq.UpdateMask == nil || len(protoReq.UpdateMask.GetPaths()) == 0 {
+		if fieldMask, err := runtime.FieldMaskFromRequestBody(newReader(), protoReq.Setting); err != nil {
+			return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+		} else {
+			protoReq.UpdateMask = fieldMask
+		}
+	}
+	val, ok := pathParams["setting.name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "setting.name")
+	}
+	err = runtime.PopulateFieldFromPath(&protoReq, "setting.name", val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "setting.name", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_InstanceService_UpdateInstanceSetting_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.UpdateInstanceSetting(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_InstanceService_TestInstanceEmailSetting_0(ctx context.Context, marshaler runtime.Marshaler, client InstanceServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq TestInstanceEmailSettingRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.TestInstanceEmailSetting(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_InstanceService_TestInstanceEmailSetting_0(ctx context.Context, marshaler runtime.Marshaler, server InstanceServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq TestInstanceEmailSettingRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.TestInstanceEmailSetting(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_InstanceService_GetInstanceStats_0(ctx context.Context, marshaler runtime.Marshaler, client InstanceServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetInstanceStatsRequest
+		metadata runtime.ServerMetadata
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.GetInstanceStats(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_InstanceService_GetInstanceStats_0(ctx context.Context, marshaler runtime.Marshaler, server InstanceServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetInstanceStatsRequest
+		metadata runtime.ServerMetadata
+	)
+	msg, err := server.GetInstanceStats(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+// RegisterInstanceServiceHandlerServer registers the http handlers for service InstanceService to "mux".
+// UnaryRPC     :call InstanceServiceServer directly.
+// StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+// Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterInstanceServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
+func RegisterInstanceServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server InstanceServiceServer) error {
+	mux.Handle(http.MethodGet, pattern_InstanceService_GetInstanceProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.InstanceService/GetInstanceProfile", runtime.WithHTTPPathPattern("/api/v1/instance/profile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_InstanceService_GetInstanceProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_InstanceService_GetInstanceProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_InstanceService_GetInstanceSetting_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.InstanceService/GetInstanceSetting", runtime.WithHTTPPathPattern("/api/v1/{name=instance/settings/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_InstanceService_GetInstanceSetting_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_InstanceService_GetInstanceSetting_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_InstanceService_BatchGetInstanceSettings_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.InstanceService/BatchGetInstanceSettings", runtime.WithHTTPPathPattern("/api/v1/instance/settings:batchGet"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_InstanceService_BatchGetInstanceSettings_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_InstanceService_BatchGetInstanceSettings_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPatch, pattern_InstanceService_UpdateInstanceSetting_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.InstanceService/UpdateInstanceSetting", runtime.WithHTTPPathPattern("/api/v1/{setting.name=instance/settings/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_InstanceService_UpdateInstanceSetting_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_InstanceService_UpdateInstanceSetting_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_InstanceService_TestInstanceEmailSetting_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.InstanceService/TestInstanceEmailSetting", runtime.WithHTTPPathPattern("/api/v1/instance/settings/notification:testEmail"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_InstanceService_TestInstanceEmailSetting_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_InstanceService_TestInstanceEmailSetting_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_InstanceService_GetInstanceStats_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.InstanceService/GetInstanceStats", runtime.WithHTTPPathPattern("/api/v1/instance/stats"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_InstanceService_GetInstanceStats_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_InstanceService_GetInstanceStats_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+
+	return nil
+}
+
+// RegisterInstanceServiceHandlerFromEndpoint is same as RegisterInstanceServiceHandler but
+// automatically dials to "endpoint" and closes the connection when "ctx" gets done.
+func RegisterInstanceServiceHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+	conn, err := grpc.NewClient(endpoint, opts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+			return
+		}
+		go func() {
+			<-ctx.Done()
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+		}()
+	}()
+	return RegisterInstanceServiceHandler(ctx, mux, conn)
+}
+
+// RegisterInstanceServiceHandler registers the http handlers for service InstanceService to "mux".
+// The handlers forward requests to the grpc endpoint over "conn".
+func RegisterInstanceServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return RegisterInstanceServiceHandlerClient(ctx, mux, NewInstanceServiceClient(conn))
+}
+
+// RegisterInstanceServiceHandlerClient registers the http handlers for service InstanceService
+// to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "InstanceServiceClient".
+// Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "InstanceServiceClient"
+// doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+// "InstanceServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
+func RegisterInstanceServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client InstanceServiceClient) error {
+	mux.Handle(http.MethodGet, pattern_InstanceService_GetInstanceProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.InstanceService/GetInstanceProfile", runtime.WithHTTPPathPattern("/api/v1/instance/profile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_InstanceService_GetInstanceProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_InstanceService_GetInstanceProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_InstanceService_GetInstanceSetting_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.InstanceService/GetInstanceSetting", runtime.WithHTTPPathPattern("/api/v1/{name=instance/settings/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_InstanceService_GetInstanceSetting_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_InstanceService_GetInstanceSetting_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_InstanceService_BatchGetInstanceSettings_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.InstanceService/BatchGetInstanceSettings", runtime.WithHTTPPathPattern("/api/v1/instance/settings:batchGet"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_InstanceService_BatchGetInstanceSettings_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_InstanceService_BatchGetInstanceSettings_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPatch, pattern_InstanceService_UpdateInstanceSetting_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.InstanceService/UpdateInstanceSetting", runtime.WithHTTPPathPattern("/api/v1/{setting.name=instance/settings/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_InstanceService_UpdateInstanceSetting_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_InstanceService_UpdateInstanceSetting_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_InstanceService_TestInstanceEmailSetting_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.InstanceService/TestInstanceEmailSetting", runtime.WithHTTPPathPattern("/api/v1/instance/settings/notification:testEmail"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_InstanceService_TestInstanceEmailSetting_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_InstanceService_TestInstanceEmailSetting_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_InstanceService_GetInstanceStats_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.InstanceService/GetInstanceStats", runtime.WithHTTPPathPattern("/api/v1/instance/stats"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_InstanceService_GetInstanceStats_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_InstanceService_GetInstanceStats_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	return nil
+}
+
+var (
+	pattern_InstanceService_GetInstanceProfile_0       = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"api", "v1", "instance", "profile"}, ""))
+	pattern_InstanceService_GetInstanceSetting_0       = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 1, 0, 4, 3, 5, 4}, []string{"api", "v1", "instance", "settings", "name"}, ""))
+	pattern_InstanceService_BatchGetInstanceSettings_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"api", "v1", "instance", "settings"}, "batchGet"))
+	pattern_InstanceService_UpdateInstanceSetting_0    = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 1, 0, 4, 3, 5, 4}, []string{"api", "v1", "instance", "settings", "setting.name"}, ""))
+	pattern_InstanceService_TestInstanceEmailSetting_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4}, []string{"api", "v1", "instance", "settings", "notification"}, "testEmail"))
+	pattern_InstanceService_GetInstanceStats_0         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"api", "v1", "instance", "stats"}, ""))
+)
+
+var (
+	forward_InstanceService_GetInstanceProfile_0       = runtime.ForwardResponseMessage
+	forward_InstanceService_GetInstanceSetting_0       = runtime.ForwardResponseMessage
+	forward_InstanceService_BatchGetInstanceSettings_0 = runtime.ForwardResponseMessage
+	forward_InstanceService_UpdateInstanceSetting_0    = runtime.ForwardResponseMessage
+	forward_InstanceService_TestInstanceEmailSetting_0 = runtime.ForwardResponseMessage
+	forward_InstanceService_GetInstanceStats_0         = runtime.ForwardResponseMessage
+)

proto/gen/api/v1/instance_service_grpc.pb.go

@@ -0,0 +1,324 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             (unknown)
+// source: api/v1/instance_service.proto
+
+package apiv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	InstanceService_GetInstanceProfile_FullMethodName       = "/memos.api.v1.InstanceService/GetInstanceProfile"
+	InstanceService_GetInstanceSetting_FullMethodName       = "/memos.api.v1.InstanceService/GetInstanceSetting"
+	InstanceService_BatchGetInstanceSettings_FullMethodName = "/memos.api.v1.InstanceService/BatchGetInstanceSettings"
+	InstanceService_UpdateInstanceSetting_FullMethodName    = "/memos.api.v1.InstanceService/UpdateInstanceSetting"
+	InstanceService_TestInstanceEmailSetting_FullMethodName = "/memos.api.v1.InstanceService/TestInstanceEmailSetting"
+	InstanceService_GetInstanceStats_FullMethodName         = "/memos.api.v1.InstanceService/GetInstanceStats"
+)
+
+// InstanceServiceClient is the client API for InstanceService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type InstanceServiceClient interface {
+	// Gets the instance profile.
+	GetInstanceProfile(ctx context.Context, in *GetInstanceProfileRequest, opts ...grpc.CallOption) (*InstanceProfile, error)
+	// Gets an instance setting.
+	GetInstanceSetting(ctx context.Context, in *GetInstanceSettingRequest, opts ...grpc.CallOption) (*InstanceSetting, error)
+	// Batch gets instance settings.
+	BatchGetInstanceSettings(ctx context.Context, in *BatchGetInstanceSettingsRequest, opts ...grpc.CallOption) (*BatchGetInstanceSettingsResponse, error)
+	// Updates an instance setting.
+	UpdateInstanceSetting(ctx context.Context, in *UpdateInstanceSettingRequest, opts ...grpc.CallOption) (*InstanceSetting, error)
+	// Tests notification email delivery with the provided or stored SMTP settings.
+	TestInstanceEmailSetting(ctx context.Context, in *TestInstanceEmailSettingRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// GetInstanceStats returns resource usage statistics for the instance. Admin only.
+	GetInstanceStats(ctx context.Context, in *GetInstanceStatsRequest, opts ...grpc.CallOption) (*InstanceStats, error)
+}
+
+type instanceServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewInstanceServiceClient(cc grpc.ClientConnInterface) InstanceServiceClient {
+	return &instanceServiceClient{cc}
+}
+
+func (c *instanceServiceClient) GetInstanceProfile(ctx context.Context, in *GetInstanceProfileRequest, opts ...grpc.CallOption) (*InstanceProfile, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(InstanceProfile)
+	err := c.cc.Invoke(ctx, InstanceService_GetInstanceProfile_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *instanceServiceClient) GetInstanceSetting(ctx context.Context, in *GetInstanceSettingRequest, opts ...grpc.CallOption) (*InstanceSetting, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(InstanceSetting)
+	err := c.cc.Invoke(ctx, InstanceService_GetInstanceSetting_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *instanceServiceClient) BatchGetInstanceSettings(ctx context.Context, in *BatchGetInstanceSettingsRequest, opts ...grpc.CallOption) (*BatchGetInstanceSettingsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(BatchGetInstanceSettingsResponse)
+	err := c.cc.Invoke(ctx, InstanceService_BatchGetInstanceSettings_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *instanceServiceClient) UpdateInstanceSetting(ctx context.Context, in *UpdateInstanceSettingRequest, opts ...grpc.CallOption) (*InstanceSetting, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(InstanceSetting)
+	err := c.cc.Invoke(ctx, InstanceService_UpdateInstanceSetting_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *instanceServiceClient) TestInstanceEmailSetting(ctx context.Context, in *TestInstanceEmailSettingRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, InstanceService_TestInstanceEmailSetting_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *instanceServiceClient) GetInstanceStats(ctx context.Context, in *GetInstanceStatsRequest, opts ...grpc.CallOption) (*InstanceStats, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(InstanceStats)
+	err := c.cc.Invoke(ctx, InstanceService_GetInstanceStats_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// InstanceServiceServer is the server API for InstanceService service.
+// All implementations must embed UnimplementedInstanceServiceServer
+// for forward compatibility.
+type InstanceServiceServer interface {
+	// Gets the instance profile.
+	GetInstanceProfile(context.Context, *GetInstanceProfileRequest) (*InstanceProfile, error)
+	// Gets an instance setting.
+	GetInstanceSetting(context.Context, *GetInstanceSettingRequest) (*InstanceSetting, error)
+	// Batch gets instance settings.
+	BatchGetInstanceSettings(context.Context, *BatchGetInstanceSettingsRequest) (*BatchGetInstanceSettingsResponse, error)
+	// Updates an instance setting.
+	UpdateInstanceSetting(context.Context, *UpdateInstanceSettingRequest) (*InstanceSetting, error)
+	// Tests notification email delivery with the provided or stored SMTP settings.
+	TestInstanceEmailSetting(context.Context, *TestInstanceEmailSettingRequest) (*emptypb.Empty, error)
+	// GetInstanceStats returns resource usage statistics for the instance. Admin only.
+	GetInstanceStats(context.Context, *GetInstanceStatsRequest) (*InstanceStats, error)
+	mustEmbedUnimplementedInstanceServiceServer()
+}
+
+// UnimplementedInstanceServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedInstanceServiceServer struct{}
+
+func (UnimplementedInstanceServiceServer) GetInstanceProfile(context.Context, *GetInstanceProfileRequest) (*InstanceProfile, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetInstanceProfile not implemented")
+}
+func (UnimplementedInstanceServiceServer) GetInstanceSetting(context.Context, *GetInstanceSettingRequest) (*InstanceSetting, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetInstanceSetting not implemented")
+}
+func (UnimplementedInstanceServiceServer) BatchGetInstanceSettings(context.Context, *BatchGetInstanceSettingsRequest) (*BatchGetInstanceSettingsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method BatchGetInstanceSettings not implemented")
+}
+func (UnimplementedInstanceServiceServer) UpdateInstanceSetting(context.Context, *UpdateInstanceSettingRequest) (*InstanceSetting, error) {
+	return nil, status.Error(codes.Unimplemented, "method UpdateInstanceSetting not implemented")
+}
+func (UnimplementedInstanceServiceServer) TestInstanceEmailSetting(context.Context, *TestInstanceEmailSettingRequest) (*emptypb.Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method TestInstanceEmailSetting not implemented")
+}
+func (UnimplementedInstanceServiceServer) GetInstanceStats(context.Context, *GetInstanceStatsRequest) (*InstanceStats, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetInstanceStats not implemented")
+}
+func (UnimplementedInstanceServiceServer) mustEmbedUnimplementedInstanceServiceServer() {}
+func (UnimplementedInstanceServiceServer) testEmbeddedByValue()                         {}
+
+// UnsafeInstanceServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to InstanceServiceServer will
+// result in compilation errors.
+type UnsafeInstanceServiceServer interface {
+	mustEmbedUnimplementedInstanceServiceServer()
+}
+
+func RegisterInstanceServiceServer(s grpc.ServiceRegistrar, srv InstanceServiceServer) {
+	// If the following call panics, it indicates UnimplementedInstanceServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&InstanceService_ServiceDesc, srv)
+}
+
+func _InstanceService_GetInstanceProfile_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetInstanceProfileRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(InstanceServiceServer).GetInstanceProfile(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: InstanceService_GetInstanceProfile_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(InstanceServiceServer).GetInstanceProfile(ctx, req.(*GetInstanceProfileRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _InstanceService_GetInstanceSetting_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetInstanceSettingRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(InstanceServiceServer).GetInstanceSetting(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: InstanceService_GetInstanceSetting_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(InstanceServiceServer).GetInstanceSetting(ctx, req.(*GetInstanceSettingRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _InstanceService_BatchGetInstanceSettings_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(BatchGetInstanceSettingsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(InstanceServiceServer).BatchGetInstanceSettings(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: InstanceService_BatchGetInstanceSettings_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(InstanceServiceServer).BatchGetInstanceSettings(ctx, req.(*BatchGetInstanceSettingsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _InstanceService_UpdateInstanceSetting_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateInstanceSettingRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(InstanceServiceServer).UpdateInstanceSetting(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: InstanceService_UpdateInstanceSetting_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(InstanceServiceServer).UpdateInstanceSetting(ctx, req.(*UpdateInstanceSettingRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _InstanceService_TestInstanceEmailSetting_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(TestInstanceEmailSettingRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(InstanceServiceServer).TestInstanceEmailSetting(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: InstanceService_TestInstanceEmailSetting_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(InstanceServiceServer).TestInstanceEmailSetting(ctx, req.(*TestInstanceEmailSettingRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _InstanceService_GetInstanceStats_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetInstanceStatsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(InstanceServiceServer).GetInstanceStats(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: InstanceService_GetInstanceStats_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(InstanceServiceServer).GetInstanceStats(ctx, req.(*GetInstanceStatsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// InstanceService_ServiceDesc is the grpc.ServiceDesc for InstanceService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var InstanceService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "memos.api.v1.InstanceService",
+	HandlerType: (*InstanceServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetInstanceProfile",
+			Handler:    _InstanceService_GetInstanceProfile_Handler,
+		},
+		{
+			MethodName: "GetInstanceSetting",
+			Handler:    _InstanceService_GetInstanceSetting_Handler,
+		},
+		{
+			MethodName: "BatchGetInstanceSettings",
+			Handler:    _InstanceService_BatchGetInstanceSettings_Handler,
+		},
+		{
+			MethodName: "UpdateInstanceSetting",
+			Handler:    _InstanceService_UpdateInstanceSetting_Handler,
+		},
+		{
+			MethodName: "TestInstanceEmailSetting",
+			Handler:    _InstanceService_TestInstanceEmailSetting_Handler,
+		},
+		{
+			MethodName: "GetInstanceStats",
+			Handler:    _InstanceService_GetInstanceStats_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "api/v1/instance_service.proto",
+}

proto/gen/api/v1/memo_service_grpc.pb.go

@@ -0,0 +1,886 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             (unknown)
+// source: api/v1/memo_service.proto
+
+package apiv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	MemoService_CreateMemo_FullMethodName           = "/memos.api.v1.MemoService/CreateMemo"
+	MemoService_ListMemos_FullMethodName            = "/memos.api.v1.MemoService/ListMemos"
+	MemoService_GetMemo_FullMethodName              = "/memos.api.v1.MemoService/GetMemo"
+	MemoService_UpdateMemo_FullMethodName           = "/memos.api.v1.MemoService/UpdateMemo"
+	MemoService_DeleteMemo_FullMethodName           = "/memos.api.v1.MemoService/DeleteMemo"
+	MemoService_SetMemoAttachments_FullMethodName   = "/memos.api.v1.MemoService/SetMemoAttachments"
+	MemoService_ListMemoAttachments_FullMethodName  = "/memos.api.v1.MemoService/ListMemoAttachments"
+	MemoService_SetMemoRelations_FullMethodName     = "/memos.api.v1.MemoService/SetMemoRelations"
+	MemoService_ListMemoRelations_FullMethodName    = "/memos.api.v1.MemoService/ListMemoRelations"
+	MemoService_CreateMemoComment_FullMethodName    = "/memos.api.v1.MemoService/CreateMemoComment"
+	MemoService_ListMemoComments_FullMethodName     = "/memos.api.v1.MemoService/ListMemoComments"
+	MemoService_ListMemoReactions_FullMethodName    = "/memos.api.v1.MemoService/ListMemoReactions"
+	MemoService_UpsertMemoReaction_FullMethodName   = "/memos.api.v1.MemoService/UpsertMemoReaction"
+	MemoService_DeleteMemoReaction_FullMethodName   = "/memos.api.v1.MemoService/DeleteMemoReaction"
+	MemoService_CreateMemoShare_FullMethodName      = "/memos.api.v1.MemoService/CreateMemoShare"
+	MemoService_ListMemoShares_FullMethodName       = "/memos.api.v1.MemoService/ListMemoShares"
+	MemoService_DeleteMemoShare_FullMethodName      = "/memos.api.v1.MemoService/DeleteMemoShare"
+	MemoService_GetMemoByShare_FullMethodName       = "/memos.api.v1.MemoService/GetMemoByShare"
+	MemoService_GetLinkMetadata_FullMethodName      = "/memos.api.v1.MemoService/GetLinkMetadata"
+	MemoService_BatchGetLinkMetadata_FullMethodName = "/memos.api.v1.MemoService/BatchGetLinkMetadata"
+)
+
+// MemoServiceClient is the client API for MemoService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type MemoServiceClient interface {
+	// CreateMemo creates a memo.
+	CreateMemo(ctx context.Context, in *CreateMemoRequest, opts ...grpc.CallOption) (*Memo, error)
+	// ListMemos lists memos with pagination and filter.
+	ListMemos(ctx context.Context, in *ListMemosRequest, opts ...grpc.CallOption) (*ListMemosResponse, error)
+	// GetMemo gets a memo.
+	GetMemo(ctx context.Context, in *GetMemoRequest, opts ...grpc.CallOption) (*Memo, error)
+	// UpdateMemo updates a memo.
+	UpdateMemo(ctx context.Context, in *UpdateMemoRequest, opts ...grpc.CallOption) (*Memo, error)
+	// DeleteMemo deletes a memo.
+	DeleteMemo(ctx context.Context, in *DeleteMemoRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// SetMemoAttachments sets attachments for a memo.
+	SetMemoAttachments(ctx context.Context, in *SetMemoAttachmentsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// ListMemoAttachments lists attachments for a memo.
+	ListMemoAttachments(ctx context.Context, in *ListMemoAttachmentsRequest, opts ...grpc.CallOption) (*ListMemoAttachmentsResponse, error)
+	// SetMemoRelations sets relations for a memo.
+	SetMemoRelations(ctx context.Context, in *SetMemoRelationsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// ListMemoRelations lists relations for a memo.
+	ListMemoRelations(ctx context.Context, in *ListMemoRelationsRequest, opts ...grpc.CallOption) (*ListMemoRelationsResponse, error)
+	// CreateMemoComment creates a comment for a memo.
+	CreateMemoComment(ctx context.Context, in *CreateMemoCommentRequest, opts ...grpc.CallOption) (*Memo, error)
+	// ListMemoComments lists comments for a memo.
+	ListMemoComments(ctx context.Context, in *ListMemoCommentsRequest, opts ...grpc.CallOption) (*ListMemoCommentsResponse, error)
+	// ListMemoReactions lists reactions for a memo.
+	ListMemoReactions(ctx context.Context, in *ListMemoReactionsRequest, opts ...grpc.CallOption) (*ListMemoReactionsResponse, error)
+	// UpsertMemoReaction upserts a reaction for a memo.
+	UpsertMemoReaction(ctx context.Context, in *UpsertMemoReactionRequest, opts ...grpc.CallOption) (*Reaction, error)
+	// DeleteMemoReaction deletes a reaction for a memo.
+	DeleteMemoReaction(ctx context.Context, in *DeleteMemoReactionRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// CreateMemoShare creates a share link for a memo. Requires authentication as the memo creator.
+	CreateMemoShare(ctx context.Context, in *CreateMemoShareRequest, opts ...grpc.CallOption) (*MemoShare, error)
+	// ListMemoShares lists all share links for a memo. Requires authentication as the memo creator.
+	ListMemoShares(ctx context.Context, in *ListMemoSharesRequest, opts ...grpc.CallOption) (*ListMemoSharesResponse, error)
+	// DeleteMemoShare revokes a share link. Requires authentication as the memo creator.
+	DeleteMemoShare(ctx context.Context, in *DeleteMemoShareRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// GetMemoByShare resolves a share token to its memo. No authentication required.
+	// Returns NOT_FOUND if the token is invalid or expired.
+	GetMemoByShare(ctx context.Context, in *GetMemoByShareRequest, opts ...grpc.CallOption) (*Memo, error)
+	// GetLinkMetadata gets metadata for a link.
+	GetLinkMetadata(ctx context.Context, in *GetLinkMetadataRequest, opts ...grpc.CallOption) (*LinkMetadata, error)
+	// BatchGetLinkMetadata gets metadata for links.
+	BatchGetLinkMetadata(ctx context.Context, in *BatchGetLinkMetadataRequest, opts ...grpc.CallOption) (*BatchGetLinkMetadataResponse, error)
+}
+
+type memoServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewMemoServiceClient(cc grpc.ClientConnInterface) MemoServiceClient {
+	return &memoServiceClient{cc}
+}
+
+func (c *memoServiceClient) CreateMemo(ctx context.Context, in *CreateMemoRequest, opts ...grpc.CallOption) (*Memo, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Memo)
+	err := c.cc.Invoke(ctx, MemoService_CreateMemo_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) ListMemos(ctx context.Context, in *ListMemosRequest, opts ...grpc.CallOption) (*ListMemosResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListMemosResponse)
+	err := c.cc.Invoke(ctx, MemoService_ListMemos_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) GetMemo(ctx context.Context, in *GetMemoRequest, opts ...grpc.CallOption) (*Memo, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Memo)
+	err := c.cc.Invoke(ctx, MemoService_GetMemo_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) UpdateMemo(ctx context.Context, in *UpdateMemoRequest, opts ...grpc.CallOption) (*Memo, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Memo)
+	err := c.cc.Invoke(ctx, MemoService_UpdateMemo_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) DeleteMemo(ctx context.Context, in *DeleteMemoRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, MemoService_DeleteMemo_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) SetMemoAttachments(ctx context.Context, in *SetMemoAttachmentsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, MemoService_SetMemoAttachments_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) ListMemoAttachments(ctx context.Context, in *ListMemoAttachmentsRequest, opts ...grpc.CallOption) (*ListMemoAttachmentsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListMemoAttachmentsResponse)
+	err := c.cc.Invoke(ctx, MemoService_ListMemoAttachments_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) SetMemoRelations(ctx context.Context, in *SetMemoRelationsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, MemoService_SetMemoRelations_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) ListMemoRelations(ctx context.Context, in *ListMemoRelationsRequest, opts ...grpc.CallOption) (*ListMemoRelationsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListMemoRelationsResponse)
+	err := c.cc.Invoke(ctx, MemoService_ListMemoRelations_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) CreateMemoComment(ctx context.Context, in *CreateMemoCommentRequest, opts ...grpc.CallOption) (*Memo, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Memo)
+	err := c.cc.Invoke(ctx, MemoService_CreateMemoComment_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) ListMemoComments(ctx context.Context, in *ListMemoCommentsRequest, opts ...grpc.CallOption) (*ListMemoCommentsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListMemoCommentsResponse)
+	err := c.cc.Invoke(ctx, MemoService_ListMemoComments_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) ListMemoReactions(ctx context.Context, in *ListMemoReactionsRequest, opts ...grpc.CallOption) (*ListMemoReactionsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListMemoReactionsResponse)
+	err := c.cc.Invoke(ctx, MemoService_ListMemoReactions_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) UpsertMemoReaction(ctx context.Context, in *UpsertMemoReactionRequest, opts ...grpc.CallOption) (*Reaction, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Reaction)
+	err := c.cc.Invoke(ctx, MemoService_UpsertMemoReaction_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) DeleteMemoReaction(ctx context.Context, in *DeleteMemoReactionRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, MemoService_DeleteMemoReaction_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) CreateMemoShare(ctx context.Context, in *CreateMemoShareRequest, opts ...grpc.CallOption) (*MemoShare, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(MemoShare)
+	err := c.cc.Invoke(ctx, MemoService_CreateMemoShare_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) ListMemoShares(ctx context.Context, in *ListMemoSharesRequest, opts ...grpc.CallOption) (*ListMemoSharesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListMemoSharesResponse)
+	err := c.cc.Invoke(ctx, MemoService_ListMemoShares_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) DeleteMemoShare(ctx context.Context, in *DeleteMemoShareRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, MemoService_DeleteMemoShare_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) GetMemoByShare(ctx context.Context, in *GetMemoByShareRequest, opts ...grpc.CallOption) (*Memo, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Memo)
+	err := c.cc.Invoke(ctx, MemoService_GetMemoByShare_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) GetLinkMetadata(ctx context.Context, in *GetLinkMetadataRequest, opts ...grpc.CallOption) (*LinkMetadata, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(LinkMetadata)
+	err := c.cc.Invoke(ctx, MemoService_GetLinkMetadata_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *memoServiceClient) BatchGetLinkMetadata(ctx context.Context, in *BatchGetLinkMetadataRequest, opts ...grpc.CallOption) (*BatchGetLinkMetadataResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(BatchGetLinkMetadataResponse)
+	err := c.cc.Invoke(ctx, MemoService_BatchGetLinkMetadata_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// MemoServiceServer is the server API for MemoService service.
+// All implementations must embed UnimplementedMemoServiceServer
+// for forward compatibility.
+type MemoServiceServer interface {
+	// CreateMemo creates a memo.
+	CreateMemo(context.Context, *CreateMemoRequest) (*Memo, error)
+	// ListMemos lists memos with pagination and filter.
+	ListMemos(context.Context, *ListMemosRequest) (*ListMemosResponse, error)
+	// GetMemo gets a memo.
+	GetMemo(context.Context, *GetMemoRequest) (*Memo, error)
+	// UpdateMemo updates a memo.
+	UpdateMemo(context.Context, *UpdateMemoRequest) (*Memo, error)
+	// DeleteMemo deletes a memo.
+	DeleteMemo(context.Context, *DeleteMemoRequest) (*emptypb.Empty, error)
+	// SetMemoAttachments sets attachments for a memo.
+	SetMemoAttachments(context.Context, *SetMemoAttachmentsRequest) (*emptypb.Empty, error)
+	// ListMemoAttachments lists attachments for a memo.
+	ListMemoAttachments(context.Context, *ListMemoAttachmentsRequest) (*ListMemoAttachmentsResponse, error)
+	// SetMemoRelations sets relations for a memo.
+	SetMemoRelations(context.Context, *SetMemoRelationsRequest) (*emptypb.Empty, error)
+	// ListMemoRelations lists relations for a memo.
+	ListMemoRelations(context.Context, *ListMemoRelationsRequest) (*ListMemoRelationsResponse, error)
+	// CreateMemoComment creates a comment for a memo.
+	CreateMemoComment(context.Context, *CreateMemoCommentRequest) (*Memo, error)
+	// ListMemoComments lists comments for a memo.
+	ListMemoComments(context.Context, *ListMemoCommentsRequest) (*ListMemoCommentsResponse, error)
+	// ListMemoReactions lists reactions for a memo.
+	ListMemoReactions(context.Context, *ListMemoReactionsRequest) (*ListMemoReactionsResponse, error)
+	// UpsertMemoReaction upserts a reaction for a memo.
+	UpsertMemoReaction(context.Context, *UpsertMemoReactionRequest) (*Reaction, error)
+	// DeleteMemoReaction deletes a reaction for a memo.
+	DeleteMemoReaction(context.Context, *DeleteMemoReactionRequest) (*emptypb.Empty, error)
+	// CreateMemoShare creates a share link for a memo. Requires authentication as the memo creator.
+	CreateMemoShare(context.Context, *CreateMemoShareRequest) (*MemoShare, error)
+	// ListMemoShares lists all share links for a memo. Requires authentication as the memo creator.
+	ListMemoShares(context.Context, *ListMemoSharesRequest) (*ListMemoSharesResponse, error)
+	// DeleteMemoShare revokes a share link. Requires authentication as the memo creator.
+	DeleteMemoShare(context.Context, *DeleteMemoShareRequest) (*emptypb.Empty, error)
+	// GetMemoByShare resolves a share token to its memo. No authentication required.
+	// Returns NOT_FOUND if the token is invalid or expired.
+	GetMemoByShare(context.Context, *GetMemoByShareRequest) (*Memo, error)
+	// GetLinkMetadata gets metadata for a link.
+	GetLinkMetadata(context.Context, *GetLinkMetadataRequest) (*LinkMetadata, error)
+	// BatchGetLinkMetadata gets metadata for links.
+	BatchGetLinkMetadata(context.Context, *BatchGetLinkMetadataRequest) (*BatchGetLinkMetadataResponse, error)
+	mustEmbedUnimplementedMemoServiceServer()
+}
+
+// UnimplementedMemoServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedMemoServiceServer struct{}
+
+func (UnimplementedMemoServiceServer) CreateMemo(context.Context, *CreateMemoRequest) (*Memo, error) {
+	return nil, status.Error(codes.Unimplemented, "method CreateMemo not implemented")
+}
+func (UnimplementedMemoServiceServer) ListMemos(context.Context, *ListMemosRequest) (*ListMemosResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListMemos not implemented")
+}
+func (UnimplementedMemoServiceServer) GetMemo(context.Context, *GetMemoRequest) (*Memo, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetMemo not implemented")
+}
+func (UnimplementedMemoServiceServer) UpdateMemo(context.Context, *UpdateMemoRequest) (*Memo, error) {
+	return nil, status.Error(codes.Unimplemented, "method UpdateMemo not implemented")
+}
+func (UnimplementedMemoServiceServer) DeleteMemo(context.Context, *DeleteMemoRequest) (*emptypb.Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method DeleteMemo not implemented")
+}
+func (UnimplementedMemoServiceServer) SetMemoAttachments(context.Context, *SetMemoAttachmentsRequest) (*emptypb.Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method SetMemoAttachments not implemented")
+}
+func (UnimplementedMemoServiceServer) ListMemoAttachments(context.Context, *ListMemoAttachmentsRequest) (*ListMemoAttachmentsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListMemoAttachments not implemented")
+}
+func (UnimplementedMemoServiceServer) SetMemoRelations(context.Context, *SetMemoRelationsRequest) (*emptypb.Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method SetMemoRelations not implemented")
+}
+func (UnimplementedMemoServiceServer) ListMemoRelations(context.Context, *ListMemoRelationsRequest) (*ListMemoRelationsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListMemoRelations not implemented")
+}
+func (UnimplementedMemoServiceServer) CreateMemoComment(context.Context, *CreateMemoCommentRequest) (*Memo, error) {
+	return nil, status.Error(codes.Unimplemented, "method CreateMemoComment not implemented")
+}
+func (UnimplementedMemoServiceServer) ListMemoComments(context.Context, *ListMemoCommentsRequest) (*ListMemoCommentsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListMemoComments not implemented")
+}
+func (UnimplementedMemoServiceServer) ListMemoReactions(context.Context, *ListMemoReactionsRequest) (*ListMemoReactionsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListMemoReactions not implemented")
+}
+func (UnimplementedMemoServiceServer) UpsertMemoReaction(context.Context, *UpsertMemoReactionRequest) (*Reaction, error) {
+	return nil, status.Error(codes.Unimplemented, "method UpsertMemoReaction not implemented")
+}
+func (UnimplementedMemoServiceServer) DeleteMemoReaction(context.Context, *DeleteMemoReactionRequest) (*emptypb.Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method DeleteMemoReaction not implemented")
+}
+func (UnimplementedMemoServiceServer) CreateMemoShare(context.Context, *CreateMemoShareRequest) (*MemoShare, error) {
+	return nil, status.Error(codes.Unimplemented, "method CreateMemoShare not implemented")
+}
+func (UnimplementedMemoServiceServer) ListMemoShares(context.Context, *ListMemoSharesRequest) (*ListMemoSharesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListMemoShares not implemented")
+}
+func (UnimplementedMemoServiceServer) DeleteMemoShare(context.Context, *DeleteMemoShareRequest) (*emptypb.Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method DeleteMemoShare not implemented")
+}
+func (UnimplementedMemoServiceServer) GetMemoByShare(context.Context, *GetMemoByShareRequest) (*Memo, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetMemoByShare not implemented")
+}
+func (UnimplementedMemoServiceServer) GetLinkMetadata(context.Context, *GetLinkMetadataRequest) (*LinkMetadata, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetLinkMetadata not implemented")
+}
+func (UnimplementedMemoServiceServer) BatchGetLinkMetadata(context.Context, *BatchGetLinkMetadataRequest) (*BatchGetLinkMetadataResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method BatchGetLinkMetadata not implemented")
+}
+func (UnimplementedMemoServiceServer) mustEmbedUnimplementedMemoServiceServer() {}
+func (UnimplementedMemoServiceServer) testEmbeddedByValue()                     {}
+
+// UnsafeMemoServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to MemoServiceServer will
+// result in compilation errors.
+type UnsafeMemoServiceServer interface {
+	mustEmbedUnimplementedMemoServiceServer()
+}
+
+func RegisterMemoServiceServer(s grpc.ServiceRegistrar, srv MemoServiceServer) {
+	// If the following call panics, it indicates UnimplementedMemoServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&MemoService_ServiceDesc, srv)
+}
+
+func _MemoService_CreateMemo_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateMemoRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).CreateMemo(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_CreateMemo_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).CreateMemo(ctx, req.(*CreateMemoRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_ListMemos_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListMemosRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).ListMemos(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_ListMemos_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).ListMemos(ctx, req.(*ListMemosRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_GetMemo_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetMemoRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).GetMemo(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_GetMemo_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).GetMemo(ctx, req.(*GetMemoRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_UpdateMemo_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateMemoRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).UpdateMemo(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_UpdateMemo_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).UpdateMemo(ctx, req.(*UpdateMemoRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_DeleteMemo_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteMemoRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).DeleteMemo(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_DeleteMemo_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).DeleteMemo(ctx, req.(*DeleteMemoRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_SetMemoAttachments_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SetMemoAttachmentsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).SetMemoAttachments(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_SetMemoAttachments_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).SetMemoAttachments(ctx, req.(*SetMemoAttachmentsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_ListMemoAttachments_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListMemoAttachmentsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).ListMemoAttachments(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_ListMemoAttachments_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).ListMemoAttachments(ctx, req.(*ListMemoAttachmentsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_SetMemoRelations_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SetMemoRelationsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).SetMemoRelations(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_SetMemoRelations_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).SetMemoRelations(ctx, req.(*SetMemoRelationsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_ListMemoRelations_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListMemoRelationsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).ListMemoRelations(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_ListMemoRelations_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).ListMemoRelations(ctx, req.(*ListMemoRelationsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_CreateMemoComment_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateMemoCommentRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).CreateMemoComment(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_CreateMemoComment_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).CreateMemoComment(ctx, req.(*CreateMemoCommentRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_ListMemoComments_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListMemoCommentsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).ListMemoComments(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_ListMemoComments_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).ListMemoComments(ctx, req.(*ListMemoCommentsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_ListMemoReactions_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListMemoReactionsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).ListMemoReactions(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_ListMemoReactions_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).ListMemoReactions(ctx, req.(*ListMemoReactionsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_UpsertMemoReaction_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpsertMemoReactionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).UpsertMemoReaction(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_UpsertMemoReaction_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).UpsertMemoReaction(ctx, req.(*UpsertMemoReactionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_DeleteMemoReaction_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteMemoReactionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).DeleteMemoReaction(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_DeleteMemoReaction_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).DeleteMemoReaction(ctx, req.(*DeleteMemoReactionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_CreateMemoShare_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateMemoShareRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).CreateMemoShare(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_CreateMemoShare_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).CreateMemoShare(ctx, req.(*CreateMemoShareRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_ListMemoShares_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListMemoSharesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).ListMemoShares(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_ListMemoShares_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).ListMemoShares(ctx, req.(*ListMemoSharesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_DeleteMemoShare_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteMemoShareRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).DeleteMemoShare(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_DeleteMemoShare_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).DeleteMemoShare(ctx, req.(*DeleteMemoShareRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_GetMemoByShare_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetMemoByShareRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).GetMemoByShare(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_GetMemoByShare_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).GetMemoByShare(ctx, req.(*GetMemoByShareRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_GetLinkMetadata_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetLinkMetadataRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).GetLinkMetadata(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_GetLinkMetadata_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).GetLinkMetadata(ctx, req.(*GetLinkMetadataRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _MemoService_BatchGetLinkMetadata_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(BatchGetLinkMetadataRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MemoServiceServer).BatchGetLinkMetadata(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: MemoService_BatchGetLinkMetadata_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MemoServiceServer).BatchGetLinkMetadata(ctx, req.(*BatchGetLinkMetadataRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// MemoService_ServiceDesc is the grpc.ServiceDesc for MemoService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var MemoService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "memos.api.v1.MemoService",
+	HandlerType: (*MemoServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "CreateMemo",
+			Handler:    _MemoService_CreateMemo_Handler,
+		},
+		{
+			MethodName: "ListMemos",
+			Handler:    _MemoService_ListMemos_Handler,
+		},
+		{
+			MethodName: "GetMemo",
+			Handler:    _MemoService_GetMemo_Handler,
+		},
+		{
+			MethodName: "UpdateMemo",
+			Handler:    _MemoService_UpdateMemo_Handler,
+		},
+		{
+			MethodName: "DeleteMemo",
+			Handler:    _MemoService_DeleteMemo_Handler,
+		},
+		{
+			MethodName: "SetMemoAttachments",
+			Handler:    _MemoService_SetMemoAttachments_Handler,
+		},
+		{
+			MethodName: "ListMemoAttachments",
+			Handler:    _MemoService_ListMemoAttachments_Handler,
+		},
+		{
+			MethodName: "SetMemoRelations",
+			Handler:    _MemoService_SetMemoRelations_Handler,
+		},
+		{
+			MethodName: "ListMemoRelations",
+			Handler:    _MemoService_ListMemoRelations_Handler,
+		},
+		{
+			MethodName: "CreateMemoComment",
+			Handler:    _MemoService_CreateMemoComment_Handler,
+		},
+		{
+			MethodName: "ListMemoComments",
+			Handler:    _MemoService_ListMemoComments_Handler,
+		},
+		{
+			MethodName: "ListMemoReactions",
+			Handler:    _MemoService_ListMemoReactions_Handler,
+		},
+		{
+			MethodName: "UpsertMemoReaction",
+			Handler:    _MemoService_UpsertMemoReaction_Handler,
+		},
+		{
+			MethodName: "DeleteMemoReaction",
+			Handler:    _MemoService_DeleteMemoReaction_Handler,
+		},
+		{
+			MethodName: "CreateMemoShare",
+			Handler:    _MemoService_CreateMemoShare_Handler,
+		},
+		{
+			MethodName: "ListMemoShares",
+			Handler:    _MemoService_ListMemoShares_Handler,
+		},
+		{
+			MethodName: "DeleteMemoShare",
+			Handler:    _MemoService_DeleteMemoShare_Handler,
+		},
+		{
+			MethodName: "GetMemoByShare",
+			Handler:    _MemoService_GetMemoByShare_Handler,
+		},
+		{
+			MethodName: "GetLinkMetadata",
+			Handler:    _MemoService_GetLinkMetadata_Handler,
+		},
+		{
+			MethodName: "BatchGetLinkMetadata",
+			Handler:    _MemoService_BatchGetLinkMetadata_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "api/v1/memo_service.proto",
+}

proto/gen/api/v1/shortcut_service.pb.go

@@ -0,0 +1,496 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: api/v1/shortcut_service.proto
+
+package apiv1
+
+import (
+	_ "google.golang.org/genproto/googleapis/api/annotations"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	fieldmaskpb "google.golang.org/protobuf/types/known/fieldmaskpb"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Shortcut struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The resource name of the shortcut.
+	// Format: users/{username}/shortcuts/{shortcut}
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// The title of the shortcut.
+	Title string `protobuf:"bytes,2,opt,name=title,proto3" json:"title,omitempty"`
+	// The filter expression for the shortcut.
+	Filter        string `protobuf:"bytes,3,opt,name=filter,proto3" json:"filter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Shortcut) Reset() {
+	*x = Shortcut{}
+	mi := &file_api_v1_shortcut_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Shortcut) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Shortcut) ProtoMessage() {}
+
+func (x *Shortcut) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_shortcut_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Shortcut.ProtoReflect.Descriptor instead.
+func (*Shortcut) Descriptor() ([]byte, []int) {
+	return file_api_v1_shortcut_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Shortcut) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Shortcut) GetTitle() string {
+	if x != nil {
+		return x.Title
+	}
+	return ""
+}
+
+func (x *Shortcut) GetFilter() string {
+	if x != nil {
+		return x.Filter
+	}
+	return ""
+}
+
+type ListShortcutsRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Required. The parent resource where shortcuts are listed.
+	// Format: users/{username}
+	Parent        string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListShortcutsRequest) Reset() {
+	*x = ListShortcutsRequest{}
+	mi := &file_api_v1_shortcut_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListShortcutsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListShortcutsRequest) ProtoMessage() {}
+
+func (x *ListShortcutsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_shortcut_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListShortcutsRequest.ProtoReflect.Descriptor instead.
+func (*ListShortcutsRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_shortcut_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ListShortcutsRequest) GetParent() string {
+	if x != nil {
+		return x.Parent
+	}
+	return ""
+}
+
+type ListShortcutsResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The list of shortcuts.
+	Shortcuts     []*Shortcut `protobuf:"bytes,1,rep,name=shortcuts,proto3" json:"shortcuts,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListShortcutsResponse) Reset() {
+	*x = ListShortcutsResponse{}
+	mi := &file_api_v1_shortcut_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListShortcutsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListShortcutsResponse) ProtoMessage() {}
+
+func (x *ListShortcutsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_shortcut_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListShortcutsResponse.ProtoReflect.Descriptor instead.
+func (*ListShortcutsResponse) Descriptor() ([]byte, []int) {
+	return file_api_v1_shortcut_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ListShortcutsResponse) GetShortcuts() []*Shortcut {
+	if x != nil {
+		return x.Shortcuts
+	}
+	return nil
+}
+
+type GetShortcutRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Required. The resource name of the shortcut to retrieve.
+	// Format: users/{username}/shortcuts/{shortcut}
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetShortcutRequest) Reset() {
+	*x = GetShortcutRequest{}
+	mi := &file_api_v1_shortcut_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetShortcutRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetShortcutRequest) ProtoMessage() {}
+
+func (x *GetShortcutRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_shortcut_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetShortcutRequest.ProtoReflect.Descriptor instead.
+func (*GetShortcutRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_shortcut_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *GetShortcutRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+type CreateShortcutRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Required. The parent resource where this shortcut will be created.
+	// Format: users/{username}
+	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
+	// Required. The shortcut to create.
+	Shortcut *Shortcut `protobuf:"bytes,2,opt,name=shortcut,proto3" json:"shortcut,omitempty"`
+	// Optional. If set, validate the request, but do not actually create the shortcut.
+	ValidateOnly  bool `protobuf:"varint,3,opt,name=validate_only,json=validateOnly,proto3" json:"validate_only,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateShortcutRequest) Reset() {
+	*x = CreateShortcutRequest{}
+	mi := &file_api_v1_shortcut_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateShortcutRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateShortcutRequest) ProtoMessage() {}
+
+func (x *CreateShortcutRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_shortcut_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateShortcutRequest.ProtoReflect.Descriptor instead.
+func (*CreateShortcutRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_shortcut_service_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *CreateShortcutRequest) GetParent() string {
+	if x != nil {
+		return x.Parent
+	}
+	return ""
+}
+
+func (x *CreateShortcutRequest) GetShortcut() *Shortcut {
+	if x != nil {
+		return x.Shortcut
+	}
+	return nil
+}
+
+func (x *CreateShortcutRequest) GetValidateOnly() bool {
+	if x != nil {
+		return x.ValidateOnly
+	}
+	return false
+}
+
+type UpdateShortcutRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Required. The shortcut resource which replaces the resource on the server.
+	Shortcut *Shortcut `protobuf:"bytes,1,opt,name=shortcut,proto3" json:"shortcut,omitempty"`
+	// Optional. The list of fields to update.
+	UpdateMask    *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateShortcutRequest) Reset() {
+	*x = UpdateShortcutRequest{}
+	mi := &file_api_v1_shortcut_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateShortcutRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateShortcutRequest) ProtoMessage() {}
+
+func (x *UpdateShortcutRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_shortcut_service_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateShortcutRequest.ProtoReflect.Descriptor instead.
+func (*UpdateShortcutRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_shortcut_service_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *UpdateShortcutRequest) GetShortcut() *Shortcut {
+	if x != nil {
+		return x.Shortcut
+	}
+	return nil
+}
+
+func (x *UpdateShortcutRequest) GetUpdateMask() *fieldmaskpb.FieldMask {
+	if x != nil {
+		return x.UpdateMask
+	}
+	return nil
+}
+
+type DeleteShortcutRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Required. The resource name of the shortcut to delete.
+	// Format: users/{username}/shortcuts/{shortcut}
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteShortcutRequest) Reset() {
+	*x = DeleteShortcutRequest{}
+	mi := &file_api_v1_shortcut_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteShortcutRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteShortcutRequest) ProtoMessage() {}
+
+func (x *DeleteShortcutRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v1_shortcut_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteShortcutRequest.ProtoReflect.Descriptor instead.
+func (*DeleteShortcutRequest) Descriptor() ([]byte, []int) {
+	return file_api_v1_shortcut_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *DeleteShortcutRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+var File_api_v1_shortcut_service_proto protoreflect.FileDescriptor
+
+const file_api_v1_shortcut_service_proto_rawDesc = "" +
+	"\n" +
+	"\x1dapi/v1/shortcut_service.proto\x12\fmemos.api.v1\x1a\x1cgoogle/api/annotations.proto\x1a\x17google/api/client.proto\x1a\x1fgoogle/api/field_behavior.proto\x1a\x19google/api/resource.proto\x1a\x1bgoogle/protobuf/empty.proto\x1a google/protobuf/field_mask.proto\"\xb3\x01\n" +
+	"\bShortcut\x12\x17\n" +
+	"\x04name\x18\x01 \x01(\tB\x03\xe0A\bR\x04name\x12\x19\n" +
+	"\x05title\x18\x02 \x01(\tB\x03\xe0A\x02R\x05title\x12\x1b\n" +
+	"\x06filter\x18\x03 \x01(\tB\x03\xe0A\x01R\x06filter:V\xeaAS\n" +
+	"\x15memos.api.v1/Shortcut\x12%users/{username}/shortcuts/{shortcut}*\tshortcuts2\bshortcut\"M\n" +
+	"\x14ListShortcutsRequest\x125\n" +
+	"\x06parent\x18\x01 \x01(\tB\x1d\xe0A\x02\xfaA\x17\x12\x15memos.api.v1/ShortcutR\x06parent\"M\n" +
+	"\x15ListShortcutsResponse\x124\n" +
+	"\tshortcuts\x18\x01 \x03(\v2\x16.memos.api.v1.ShortcutR\tshortcuts\"G\n" +
+	"\x12GetShortcutRequest\x121\n" +
+	"\x04name\x18\x01 \x01(\tB\x1d\xe0A\x02\xfaA\x17\n" +
+	"\x15memos.api.v1/ShortcutR\x04name\"\xb1\x01\n" +
+	"\x15CreateShortcutRequest\x125\n" +
+	"\x06parent\x18\x01 \x01(\tB\x1d\xe0A\x02\xfaA\x17\x12\x15memos.api.v1/ShortcutR\x06parent\x127\n" +
+	"\bshortcut\x18\x02 \x01(\v2\x16.memos.api.v1.ShortcutB\x03\xe0A\x02R\bshortcut\x12(\n" +
+	"\rvalidate_only\x18\x03 \x01(\bB\x03\xe0A\x01R\fvalidateOnly\"\x92\x01\n" +
+	"\x15UpdateShortcutRequest\x127\n" +
+	"\bshortcut\x18\x01 \x01(\v2\x16.memos.api.v1.ShortcutB\x03\xe0A\x02R\bshortcut\x12@\n" +
+	"\vupdate_mask\x18\x02 \x01(\v2\x1a.google.protobuf.FieldMaskB\x03\xe0A\x01R\n" +
+	"updateMask\"J\n" +
+	"\x15DeleteShortcutRequest\x121\n" +
+	"\x04name\x18\x01 \x01(\tB\x1d\xe0A\x02\xfaA\x17\n" +
+	"\x15memos.api.v1/ShortcutR\x04name2\xde\x05\n" +
+	"\x0fShortcutService\x12\x8d\x01\n" +
+	"\rListShortcuts\x12\".memos.api.v1.ListShortcutsRequest\x1a#.memos.api.v1.ListShortcutsResponse\"3\xdaA\x06parent\x82\xd3\xe4\x93\x02$\x12\"/api/v1/{parent=users/*}/shortcuts\x12z\n" +
+	"\vGetShortcut\x12 .memos.api.v1.GetShortcutRequest\x1a\x16.memos.api.v1.Shortcut\"1\xdaA\x04name\x82\xd3\xe4\x93\x02$\x12\"/api/v1/{name=users/*/shortcuts/*}\x12\x95\x01\n" +
+	"\x0eCreateShortcut\x12#.memos.api.v1.CreateShortcutRequest\x1a\x16.memos.api.v1.Shortcut\"F\xdaA\x0fparent,shortcut\x82\xd3\xe4\x93\x02.:\bshortcut\"\"/api/v1/{parent=users/*}/shortcuts\x12\xa3\x01\n" +
+	"\x0eUpdateShortcut\x12#.memos.api.v1.UpdateShortcutRequest\x1a\x16.memos.api.v1.Shortcut\"T\xdaA\x14shortcut,update_mask\x82\xd3\xe4\x93\x027:\bshortcut2+/api/v1/{shortcut.name=users/*/shortcuts/*}\x12\x80\x01\n" +
+	"\x0eDeleteShortcut\x12#.memos.api.v1.DeleteShortcutRequest\x1a\x16.google.protobuf.Empty\"1\xdaA\x04name\x82\xd3\xe4\x93\x02$*\"/api/v1/{name=users/*/shortcuts/*}B\xac\x01\n" +
+	"\x10com.memos.api.v1B\x14ShortcutServiceProtoP\x01Z0github.com/usememos/memos/proto/gen/api/v1;apiv1\xa2\x02\x03MAX\xaa\x02\fMemos.Api.V1\xca\x02\fMemos\\Api\\V1\xe2\x02\x18Memos\\Api\\V1\\GPBMetadata\xea\x02\x0eMemos::Api::V1b\x06proto3"
+
+var (
+	file_api_v1_shortcut_service_proto_rawDescOnce sync.Once
+	file_api_v1_shortcut_service_proto_rawDescData []byte
+)
+
+func file_api_v1_shortcut_service_proto_rawDescGZIP() []byte {
+	file_api_v1_shortcut_service_proto_rawDescOnce.Do(func() {
+		file_api_v1_shortcut_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_api_v1_shortcut_service_proto_rawDesc), len(file_api_v1_shortcut_service_proto_rawDesc)))
+	})
+	return file_api_v1_shortcut_service_proto_rawDescData
+}
+
+var file_api_v1_shortcut_service_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
+var file_api_v1_shortcut_service_proto_goTypes = []any{
+	(*Shortcut)(nil),              // 0: memos.api.v1.Shortcut
+	(*ListShortcutsRequest)(nil),  // 1: memos.api.v1.ListShortcutsRequest
+	(*ListShortcutsResponse)(nil), // 2: memos.api.v1.ListShortcutsResponse
+	(*GetShortcutRequest)(nil),    // 3: memos.api.v1.GetShortcutRequest
+	(*CreateShortcutRequest)(nil), // 4: memos.api.v1.CreateShortcutRequest
+	(*UpdateShortcutRequest)(nil), // 5: memos.api.v1.UpdateShortcutRequest
+	(*DeleteShortcutRequest)(nil), // 6: memos.api.v1.DeleteShortcutRequest
+	(*fieldmaskpb.FieldMask)(nil), // 7: google.protobuf.FieldMask
+	(*emptypb.Empty)(nil),         // 8: google.protobuf.Empty
+}
+var file_api_v1_shortcut_service_proto_depIdxs = []int32{
+	0, // 0: memos.api.v1.ListShortcutsResponse.shortcuts:type_name -> memos.api.v1.Shortcut
+	0, // 1: memos.api.v1.CreateShortcutRequest.shortcut:type_name -> memos.api.v1.Shortcut
+	0, // 2: memos.api.v1.UpdateShortcutRequest.shortcut:type_name -> memos.api.v1.Shortcut
+	7, // 3: memos.api.v1.UpdateShortcutRequest.update_mask:type_name -> google.protobuf.FieldMask
+	1, // 4: memos.api.v1.ShortcutService.ListShortcuts:input_type -> memos.api.v1.ListShortcutsRequest
+	3, // 5: memos.api.v1.ShortcutService.GetShortcut:input_type -> memos.api.v1.GetShortcutRequest
+	4, // 6: memos.api.v1.ShortcutService.CreateShortcut:input_type -> memos.api.v1.CreateShortcutRequest
+	5, // 7: memos.api.v1.ShortcutService.UpdateShortcut:input_type -> memos.api.v1.UpdateShortcutRequest
+	6, // 8: memos.api.v1.ShortcutService.DeleteShortcut:input_type -> memos.api.v1.DeleteShortcutRequest
+	2, // 9: memos.api.v1.ShortcutService.ListShortcuts:output_type -> memos.api.v1.ListShortcutsResponse
+	0, // 10: memos.api.v1.ShortcutService.GetShortcut:output_type -> memos.api.v1.Shortcut
+	0, // 11: memos.api.v1.ShortcutService.CreateShortcut:output_type -> memos.api.v1.Shortcut
+	0, // 12: memos.api.v1.ShortcutService.UpdateShortcut:output_type -> memos.api.v1.Shortcut
+	8, // 13: memos.api.v1.ShortcutService.DeleteShortcut:output_type -> google.protobuf.Empty
+	9, // [9:14] is the sub-list for method output_type
+	4, // [4:9] is the sub-list for method input_type
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
+}
+
+func init() { file_api_v1_shortcut_service_proto_init() }
+func file_api_v1_shortcut_service_proto_init() {
+	if File_api_v1_shortcut_service_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_v1_shortcut_service_proto_rawDesc), len(file_api_v1_shortcut_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   7,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_api_v1_shortcut_service_proto_goTypes,
+		DependencyIndexes: file_api_v1_shortcut_service_proto_depIdxs,
+		MessageInfos:      file_api_v1_shortcut_service_proto_msgTypes,
+	}.Build()
+	File_api_v1_shortcut_service_proto = out.File
+	file_api_v1_shortcut_service_proto_goTypes = nil
+	file_api_v1_shortcut_service_proto_depIdxs = nil
+}

proto/gen/api/v1/shortcut_service.pb.gw.go

@@ -0,0 +1,543 @@
+// Code generated by protoc-gen-grpc-gateway. DO NOT EDIT.
+// source: api/v1/shortcut_service.proto
+
+/*
+Package apiv1 is a reverse proxy.
+
+It translates gRPC into RESTful JSON APIs.
+*/
+package apiv1
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// Suppress "imported and not used" errors
+var (
+	_ codes.Code
+	_ io.Reader
+	_ status.Status
+	_ = errors.New
+	_ = runtime.String
+	_ = utilities.NewDoubleArray
+	_ = metadata.Join
+)
+
+func request_ShortcutService_ListShortcuts_0(ctx context.Context, marshaler runtime.Marshaler, client ShortcutServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListShortcutsRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	val, ok := pathParams["parent"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "parent")
+	}
+	protoReq.Parent, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "parent", err)
+	}
+	msg, err := client.ListShortcuts(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_ShortcutService_ListShortcuts_0(ctx context.Context, marshaler runtime.Marshaler, server ShortcutServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListShortcutsRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["parent"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "parent")
+	}
+	protoReq.Parent, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "parent", err)
+	}
+	msg, err := server.ListShortcuts(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_ShortcutService_GetShortcut_0(ctx context.Context, marshaler runtime.Marshaler, client ShortcutServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetShortcutRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	val, ok := pathParams["name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
+	}
+	protoReq.Name, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
+	}
+	msg, err := client.GetShortcut(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_ShortcutService_GetShortcut_0(ctx context.Context, marshaler runtime.Marshaler, server ShortcutServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetShortcutRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
+	}
+	protoReq.Name, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
+	}
+	msg, err := server.GetShortcut(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+var filter_ShortcutService_CreateShortcut_0 = &utilities.DoubleArray{Encoding: map[string]int{"shortcut": 0, "parent": 1}, Base: []int{1, 1, 2, 0, 0}, Check: []int{0, 1, 1, 2, 3}}
+
+func request_ShortcutService_CreateShortcut_0(ctx context.Context, marshaler runtime.Marshaler, client ShortcutServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq CreateShortcutRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq.Shortcut); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	val, ok := pathParams["parent"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "parent")
+	}
+	protoReq.Parent, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "parent", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ShortcutService_CreateShortcut_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.CreateShortcut(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_ShortcutService_CreateShortcut_0(ctx context.Context, marshaler runtime.Marshaler, server ShortcutServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq CreateShortcutRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq.Shortcut); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	val, ok := pathParams["parent"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "parent")
+	}
+	protoReq.Parent, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "parent", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ShortcutService_CreateShortcut_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.CreateShortcut(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+var filter_ShortcutService_UpdateShortcut_0 = &utilities.DoubleArray{Encoding: map[string]int{"shortcut": 0, "name": 1}, Base: []int{1, 2, 1, 0, 0}, Check: []int{0, 1, 2, 3, 2}}
+
+func request_ShortcutService_UpdateShortcut_0(ctx context.Context, marshaler runtime.Marshaler, client ShortcutServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq UpdateShortcutRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq.Shortcut); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	if protoReq.UpdateMask == nil || len(protoReq.UpdateMask.GetPaths()) == 0 {
+		if fieldMask, err := runtime.FieldMaskFromRequestBody(newReader(), protoReq.Shortcut); err != nil {
+			return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+		} else {
+			protoReq.UpdateMask = fieldMask
+		}
+	}
+	val, ok := pathParams["shortcut.name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "shortcut.name")
+	}
+	err = runtime.PopulateFieldFromPath(&protoReq, "shortcut.name", val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "shortcut.name", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ShortcutService_UpdateShortcut_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.UpdateShortcut(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_ShortcutService_UpdateShortcut_0(ctx context.Context, marshaler runtime.Marshaler, server ShortcutServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq UpdateShortcutRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq.Shortcut); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if protoReq.UpdateMask == nil || len(protoReq.UpdateMask.GetPaths()) == 0 {
+		if fieldMask, err := runtime.FieldMaskFromRequestBody(newReader(), protoReq.Shortcut); err != nil {
+			return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+		} else {
+			protoReq.UpdateMask = fieldMask
+		}
+	}
+	val, ok := pathParams["shortcut.name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "shortcut.name")
+	}
+	err = runtime.PopulateFieldFromPath(&protoReq, "shortcut.name", val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "shortcut.name", err)
+	}
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ShortcutService_UpdateShortcut_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.UpdateShortcut(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_ShortcutService_DeleteShortcut_0(ctx context.Context, marshaler runtime.Marshaler, client ShortcutServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DeleteShortcutRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	val, ok := pathParams["name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
+	}
+	protoReq.Name, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
+	}
+	msg, err := client.DeleteShortcut(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_ShortcutService_DeleteShortcut_0(ctx context.Context, marshaler runtime.Marshaler, server ShortcutServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DeleteShortcutRequest
+		metadata runtime.ServerMetadata
+		err      error
+	)
+	val, ok := pathParams["name"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "name")
+	}
+	protoReq.Name, err = runtime.String(val)
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "name", err)
+	}
+	msg, err := server.DeleteShortcut(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+// RegisterShortcutServiceHandlerServer registers the http handlers for service ShortcutService to "mux".
+// UnaryRPC     :call ShortcutServiceServer directly.
+// StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+// Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterShortcutServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
+func RegisterShortcutServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server ShortcutServiceServer) error {
+	mux.Handle(http.MethodGet, pattern_ShortcutService_ListShortcuts_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.ShortcutService/ListShortcuts", runtime.WithHTTPPathPattern("/api/v1/{parent=users/*}/shortcuts"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ShortcutService_ListShortcuts_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_ShortcutService_ListShortcuts_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_ShortcutService_GetShortcut_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.ShortcutService/GetShortcut", runtime.WithHTTPPathPattern("/api/v1/{name=users/*/shortcuts/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ShortcutService_GetShortcut_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_ShortcutService_GetShortcut_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_ShortcutService_CreateShortcut_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.ShortcutService/CreateShortcut", runtime.WithHTTPPathPattern("/api/v1/{parent=users/*}/shortcuts"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ShortcutService_CreateShortcut_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_ShortcutService_CreateShortcut_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPatch, pattern_ShortcutService_UpdateShortcut_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.ShortcutService/UpdateShortcut", runtime.WithHTTPPathPattern("/api/v1/{shortcut.name=users/*/shortcuts/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ShortcutService_UpdateShortcut_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_ShortcutService_UpdateShortcut_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodDelete, pattern_ShortcutService_DeleteShortcut_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/memos.api.v1.ShortcutService/DeleteShortcut", runtime.WithHTTPPathPattern("/api/v1/{name=users/*/shortcuts/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ShortcutService_DeleteShortcut_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_ShortcutService_DeleteShortcut_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+
+	return nil
+}
+
+// RegisterShortcutServiceHandlerFromEndpoint is same as RegisterShortcutServiceHandler but
+// automatically dials to "endpoint" and closes the connection when "ctx" gets done.
+func RegisterShortcutServiceHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+	conn, err := grpc.NewClient(endpoint, opts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+			return
+		}
+		go func() {
+			<-ctx.Done()
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+		}()
+	}()
+	return RegisterShortcutServiceHandler(ctx, mux, conn)
+}
+
+// RegisterShortcutServiceHandler registers the http handlers for service ShortcutService to "mux".
+// The handlers forward requests to the grpc endpoint over "conn".
+func RegisterShortcutServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return RegisterShortcutServiceHandlerClient(ctx, mux, NewShortcutServiceClient(conn))
+}
+
+// RegisterShortcutServiceHandlerClient registers the http handlers for service ShortcutService
+// to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "ShortcutServiceClient".
+// Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "ShortcutServiceClient"
+// doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+// "ShortcutServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
+func RegisterShortcutServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client ShortcutServiceClient) error {
+	mux.Handle(http.MethodGet, pattern_ShortcutService_ListShortcuts_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.ShortcutService/ListShortcuts", runtime.WithHTTPPathPattern("/api/v1/{parent=users/*}/shortcuts"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ShortcutService_ListShortcuts_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_ShortcutService_ListShortcuts_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_ShortcutService_GetShortcut_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.ShortcutService/GetShortcut", runtime.WithHTTPPathPattern("/api/v1/{name=users/*/shortcuts/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ShortcutService_GetShortcut_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_ShortcutService_GetShortcut_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_ShortcutService_CreateShortcut_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.ShortcutService/CreateShortcut", runtime.WithHTTPPathPattern("/api/v1/{parent=users/*}/shortcuts"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ShortcutService_CreateShortcut_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_ShortcutService_CreateShortcut_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPatch, pattern_ShortcutService_UpdateShortcut_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.ShortcutService/UpdateShortcut", runtime.WithHTTPPathPattern("/api/v1/{shortcut.name=users/*/shortcuts/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ShortcutService_UpdateShortcut_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_ShortcutService_UpdateShortcut_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodDelete, pattern_ShortcutService_DeleteShortcut_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/memos.api.v1.ShortcutService/DeleteShortcut", runtime.WithHTTPPathPattern("/api/v1/{name=users/*/shortcuts/*}"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ShortcutService_DeleteShortcut_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_ShortcutService_DeleteShortcut_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	return nil
+}
+
+var (
+	pattern_ShortcutService_ListShortcuts_0  = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 2, 5, 3, 2, 4}, []string{"api", "v1", "users", "parent", "shortcuts"}, ""))
+	pattern_ShortcutService_GetShortcut_0    = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 2, 3, 1, 0, 4, 4, 5, 4}, []string{"api", "v1", "users", "shortcuts", "name"}, ""))
+	pattern_ShortcutService_CreateShortcut_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 2, 5, 3, 2, 4}, []string{"api", "v1", "users", "parent", "shortcuts"}, ""))
+	pattern_ShortcutService_UpdateShortcut_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 2, 3, 1, 0, 4, 4, 5, 4}, []string{"api", "v1", "users", "shortcuts", "shortcut.name"}, ""))
+	pattern_ShortcutService_DeleteShortcut_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 2, 3, 1, 0, 4, 4, 5, 4}, []string{"api", "v1", "users", "shortcuts", "name"}, ""))
+)
+
+var (
+	forward_ShortcutService_ListShortcuts_0  = runtime.ForwardResponseMessage
+	forward_ShortcutService_GetShortcut_0    = runtime.ForwardResponseMessage
+	forward_ShortcutService_CreateShortcut_0 = runtime.ForwardResponseMessage
+	forward_ShortcutService_UpdateShortcut_0 = runtime.ForwardResponseMessage
+	forward_ShortcutService_DeleteShortcut_0 = runtime.ForwardResponseMessage
+)

proto/gen/api/v1/shortcut_service_grpc.pb.go

@@ -0,0 +1,284 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             (unknown)
+// source: api/v1/shortcut_service.proto
+
+package apiv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	ShortcutService_ListShortcuts_FullMethodName  = "/memos.api.v1.ShortcutService/ListShortcuts"
+	ShortcutService_GetShortcut_FullMethodName    = "/memos.api.v1.ShortcutService/GetShortcut"
+	ShortcutService_CreateShortcut_FullMethodName = "/memos.api.v1.ShortcutService/CreateShortcut"
+	ShortcutService_UpdateShortcut_FullMethodName = "/memos.api.v1.ShortcutService/UpdateShortcut"
+	ShortcutService_DeleteShortcut_FullMethodName = "/memos.api.v1.ShortcutService/DeleteShortcut"
+)
+
+// ShortcutServiceClient is the client API for ShortcutService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type ShortcutServiceClient interface {
+	// ListShortcuts returns a list of shortcuts for a user.
+	ListShortcuts(ctx context.Context, in *ListShortcutsRequest, opts ...grpc.CallOption) (*ListShortcutsResponse, error)
+	// GetShortcut gets a shortcut by name.
+	GetShortcut(ctx context.Context, in *GetShortcutRequest, opts ...grpc.CallOption) (*Shortcut, error)
+	// CreateShortcut creates a new shortcut for a user.
+	CreateShortcut(ctx context.Context, in *CreateShortcutRequest, opts ...grpc.CallOption) (*Shortcut, error)
+	// UpdateShortcut updates a shortcut for a user.
+	UpdateShortcut(ctx context.Context, in *UpdateShortcutRequest, opts ...grpc.CallOption) (*Shortcut, error)
+	// DeleteShortcut deletes a shortcut for a user.
+	DeleteShortcut(ctx context.Context, in *DeleteShortcutRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+}
+
+type shortcutServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewShortcutServiceClient(cc grpc.ClientConnInterface) ShortcutServiceClient {
+	return &shortcutServiceClient{cc}
+}
+
+func (c *shortcutServiceClient) ListShortcuts(ctx context.Context, in *ListShortcutsRequest, opts ...grpc.CallOption) (*ListShortcutsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListShortcutsResponse)
+	err := c.cc.Invoke(ctx, ShortcutService_ListShortcuts_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *shortcutServiceClient) GetShortcut(ctx context.Context, in *GetShortcutRequest, opts ...grpc.CallOption) (*Shortcut, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Shortcut)
+	err := c.cc.Invoke(ctx, ShortcutService_GetShortcut_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *shortcutServiceClient) CreateShortcut(ctx context.Context, in *CreateShortcutRequest, opts ...grpc.CallOption) (*Shortcut, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Shortcut)
+	err := c.cc.Invoke(ctx, ShortcutService_CreateShortcut_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *shortcutServiceClient) UpdateShortcut(ctx context.Context, in *UpdateShortcutRequest, opts ...grpc.CallOption) (*Shortcut, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Shortcut)
+	err := c.cc.Invoke(ctx, ShortcutService_UpdateShortcut_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *shortcutServiceClient) DeleteShortcut(ctx context.Context, in *DeleteShortcutRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, ShortcutService_DeleteShortcut_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ShortcutServiceServer is the server API for ShortcutService service.
+// All implementations must embed UnimplementedShortcutServiceServer
+// for forward compatibility.
+type ShortcutServiceServer interface {
+	// ListShortcuts returns a list of shortcuts for a user.
+	ListShortcuts(context.Context, *ListShortcutsRequest) (*ListShortcutsResponse, error)
+	// GetShortcut gets a shortcut by name.
+	GetShortcut(context.Context, *GetShortcutRequest) (*Shortcut, error)
+	// CreateShortcut creates a new shortcut for a user.
+	CreateShortcut(context.Context, *CreateShortcutRequest) (*Shortcut, error)
+	// UpdateShortcut updates a shortcut for a user.
+	UpdateShortcut(context.Context, *UpdateShortcutRequest) (*Shortcut, error)
+	// DeleteShortcut deletes a shortcut for a user.
+	DeleteShortcut(context.Context, *DeleteShortcutRequest) (*emptypb.Empty, error)
+	mustEmbedUnimplementedShortcutServiceServer()
+}
+
+// UnimplementedShortcutServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedShortcutServiceServer struct{}
+
+func (UnimplementedShortcutServiceServer) ListShortcuts(context.Context, *ListShortcutsRequest) (*ListShortcutsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListShortcuts not implemented")
+}
+func (UnimplementedShortcutServiceServer) GetShortcut(context.Context, *GetShortcutRequest) (*Shortcut, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetShortcut not implemented")
+}
+func (UnimplementedShortcutServiceServer) CreateShortcut(context.Context, *CreateShortcutRequest) (*Shortcut, error) {
+	return nil, status.Error(codes.Unimplemented, "method CreateShortcut not implemented")
+}
+func (UnimplementedShortcutServiceServer) UpdateShortcut(context.Context, *UpdateShortcutRequest) (*Shortcut, error) {
+	return nil, status.Error(codes.Unimplemented, "method UpdateShortcut not implemented")
+}
+func (UnimplementedShortcutServiceServer) DeleteShortcut(context.Context, *DeleteShortcutRequest) (*emptypb.Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method DeleteShortcut not implemented")
+}
+func (UnimplementedShortcutServiceServer) mustEmbedUnimplementedShortcutServiceServer() {}
+func (UnimplementedShortcutServiceServer) testEmbeddedByValue()                         {}
+
+// UnsafeShortcutServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ShortcutServiceServer will
+// result in compilation errors.
+type UnsafeShortcutServiceServer interface {
+	mustEmbedUnimplementedShortcutServiceServer()
+}
+
+func RegisterShortcutServiceServer(s grpc.ServiceRegistrar, srv ShortcutServiceServer) {
+	// If the following call panics, it indicates UnimplementedShortcutServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&ShortcutService_ServiceDesc, srv)
+}
+
+func _ShortcutService_ListShortcuts_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListShortcutsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ShortcutServiceServer).ListShortcuts(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ShortcutService_ListShortcuts_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ShortcutServiceServer).ListShortcuts(ctx, req.(*ListShortcutsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ShortcutService_GetShortcut_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetShortcutRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ShortcutServiceServer).GetShortcut(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ShortcutService_GetShortcut_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ShortcutServiceServer).GetShortcut(ctx, req.(*GetShortcutRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ShortcutService_CreateShortcut_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateShortcutRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ShortcutServiceServer).CreateShortcut(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ShortcutService_CreateShortcut_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ShortcutServiceServer).CreateShortcut(ctx, req.(*CreateShortcutRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ShortcutService_UpdateShortcut_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateShortcutRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ShortcutServiceServer).UpdateShortcut(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ShortcutService_UpdateShortcut_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ShortcutServiceServer).UpdateShortcut(ctx, req.(*UpdateShortcutRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ShortcutService_DeleteShortcut_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteShortcutRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ShortcutServiceServer).DeleteShortcut(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ShortcutService_DeleteShortcut_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ShortcutServiceServer).DeleteShortcut(ctx, req.(*DeleteShortcutRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// ShortcutService_ServiceDesc is the grpc.ServiceDesc for ShortcutService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ShortcutService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "memos.api.v1.ShortcutService",
+	HandlerType: (*ShortcutServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "ListShortcuts",
+			Handler:    _ShortcutService_ListShortcuts_Handler,
+		},
+		{
+			MethodName: "GetShortcut",
+			Handler:    _ShortcutService_GetShortcut_Handler,
+		},
+		{
+			MethodName: "CreateShortcut",
+			Handler:    _ShortcutService_CreateShortcut_Handler,
+		},
+		{
+			MethodName: "UpdateShortcut",
+			Handler:    _ShortcutService_UpdateShortcut_Handler,
+		},
+		{
+			MethodName: "DeleteShortcut",
+			Handler:    _ShortcutService_DeleteShortcut_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "api/v1/shortcut_service.proto",
+}

proto/gen/store/attachment.pb.go

@@ -0,0 +1,495 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: store/attachment.proto
+
+package store
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type AttachmentStorageType int32
+
+const (
+	AttachmentStorageType_ATTACHMENT_STORAGE_TYPE_UNSPECIFIED AttachmentStorageType = 0
+	// Attachment is stored locally. AKA, local file system.
+	AttachmentStorageType_LOCAL AttachmentStorageType = 1
+	// Attachment is stored in S3.
+	AttachmentStorageType_S3 AttachmentStorageType = 2
+	// Attachment is stored in an external storage. The reference is a URL.
+	AttachmentStorageType_EXTERNAL AttachmentStorageType = 3
+)
+
+// Enum value maps for AttachmentStorageType.
+var (
+	AttachmentStorageType_name = map[int32]string{
+		0: "ATTACHMENT_STORAGE_TYPE_UNSPECIFIED",
+		1: "LOCAL",
+		2: "S3",
+		3: "EXTERNAL",
+	}
+	AttachmentStorageType_value = map[string]int32{
+		"ATTACHMENT_STORAGE_TYPE_UNSPECIFIED": 0,
+		"LOCAL":                               1,
+		"S3":                                  2,
+		"EXTERNAL":                            3,
+	}
+)
+
+func (x AttachmentStorageType) Enum() *AttachmentStorageType {
+	p := new(AttachmentStorageType)
+	*p = x
+	return p
+}
+
+func (x AttachmentStorageType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (AttachmentStorageType) Descriptor() protoreflect.EnumDescriptor {
+	return file_store_attachment_proto_enumTypes[0].Descriptor()
+}
+
+func (AttachmentStorageType) Type() protoreflect.EnumType {
+	return &file_store_attachment_proto_enumTypes[0]
+}
+
+func (x AttachmentStorageType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use AttachmentStorageType.Descriptor instead.
+func (AttachmentStorageType) EnumDescriptor() ([]byte, []int) {
+	return file_store_attachment_proto_rawDescGZIP(), []int{0}
+}
+
+type MotionMediaFamily int32
+
+const (
+	MotionMediaFamily_MOTION_MEDIA_FAMILY_UNSPECIFIED MotionMediaFamily = 0
+	MotionMediaFamily_APPLE_LIVE_PHOTO                MotionMediaFamily = 1
+	MotionMediaFamily_ANDROID_MOTION_PHOTO            MotionMediaFamily = 2
+)
+
+// Enum value maps for MotionMediaFamily.
+var (
+	MotionMediaFamily_name = map[int32]string{
+		0: "MOTION_MEDIA_FAMILY_UNSPECIFIED",
+		1: "APPLE_LIVE_PHOTO",
+		2: "ANDROID_MOTION_PHOTO",
+	}
+	MotionMediaFamily_value = map[string]int32{
+		"MOTION_MEDIA_FAMILY_UNSPECIFIED": 0,
+		"APPLE_LIVE_PHOTO":                1,
+		"ANDROID_MOTION_PHOTO":            2,
+	}
+)
+
+func (x MotionMediaFamily) Enum() *MotionMediaFamily {
+	p := new(MotionMediaFamily)
+	*p = x
+	return p
+}
+
+func (x MotionMediaFamily) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MotionMediaFamily) Descriptor() protoreflect.EnumDescriptor {
+	return file_store_attachment_proto_enumTypes[1].Descriptor()
+}
+
+func (MotionMediaFamily) Type() protoreflect.EnumType {
+	return &file_store_attachment_proto_enumTypes[1]
+}
+
+func (x MotionMediaFamily) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MotionMediaFamily.Descriptor instead.
+func (MotionMediaFamily) EnumDescriptor() ([]byte, []int) {
+	return file_store_attachment_proto_rawDescGZIP(), []int{1}
+}
+
+type MotionMediaRole int32
+
+const (
+	MotionMediaRole_MOTION_MEDIA_ROLE_UNSPECIFIED MotionMediaRole = 0
+	MotionMediaRole_STILL                         MotionMediaRole = 1
+	MotionMediaRole_VIDEO                         MotionMediaRole = 2
+	MotionMediaRole_CONTAINER                     MotionMediaRole = 3
+)
+
+// Enum value maps for MotionMediaRole.
+var (
+	MotionMediaRole_name = map[int32]string{
+		0: "MOTION_MEDIA_ROLE_UNSPECIFIED",
+		1: "STILL",
+		2: "VIDEO",
+		3: "CONTAINER",
+	}
+	MotionMediaRole_value = map[string]int32{
+		"MOTION_MEDIA_ROLE_UNSPECIFIED": 0,
+		"STILL":                         1,
+		"VIDEO":                         2,
+		"CONTAINER":                     3,
+	}
+)
+
+func (x MotionMediaRole) Enum() *MotionMediaRole {
+	p := new(MotionMediaRole)
+	*p = x
+	return p
+}
+
+func (x MotionMediaRole) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MotionMediaRole) Descriptor() protoreflect.EnumDescriptor {
+	return file_store_attachment_proto_enumTypes[2].Descriptor()
+}
+
+func (MotionMediaRole) Type() protoreflect.EnumType {
+	return &file_store_attachment_proto_enumTypes[2]
+}
+
+func (x MotionMediaRole) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MotionMediaRole.Descriptor instead.
+func (MotionMediaRole) EnumDescriptor() ([]byte, []int) {
+	return file_store_attachment_proto_rawDescGZIP(), []int{2}
+}
+
+type MotionMedia struct {
+	state                   protoimpl.MessageState `protogen:"open.v1"`
+	Family                  MotionMediaFamily      `protobuf:"varint,1,opt,name=family,proto3,enum=memos.store.MotionMediaFamily" json:"family,omitempty"`
+	Role                    MotionMediaRole        `protobuf:"varint,2,opt,name=role,proto3,enum=memos.store.MotionMediaRole" json:"role,omitempty"`
+	GroupId                 string                 `protobuf:"bytes,3,opt,name=group_id,json=groupId,proto3" json:"group_id,omitempty"`
+	PresentationTimestampUs int64                  `protobuf:"varint,4,opt,name=presentation_timestamp_us,json=presentationTimestampUs,proto3" json:"presentation_timestamp_us,omitempty"`
+	HasEmbeddedVideo        bool                   `protobuf:"varint,5,opt,name=has_embedded_video,json=hasEmbeddedVideo,proto3" json:"has_embedded_video,omitempty"`
+	unknownFields           protoimpl.UnknownFields
+	sizeCache               protoimpl.SizeCache
+}
+
+func (x *MotionMedia) Reset() {
+	*x = MotionMedia{}
+	mi := &file_store_attachment_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *MotionMedia) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MotionMedia) ProtoMessage() {}
+
+func (x *MotionMedia) ProtoReflect() protoreflect.Message {
+	mi := &file_store_attachment_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MotionMedia.ProtoReflect.Descriptor instead.
+func (*MotionMedia) Descriptor() ([]byte, []int) {
+	return file_store_attachment_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *MotionMedia) GetFamily() MotionMediaFamily {
+	if x != nil {
+		return x.Family
+	}
+	return MotionMediaFamily_MOTION_MEDIA_FAMILY_UNSPECIFIED
+}
+
+func (x *MotionMedia) GetRole() MotionMediaRole {
+	if x != nil {
+		return x.Role
+	}
+	return MotionMediaRole_MOTION_MEDIA_ROLE_UNSPECIFIED
+}
+
+func (x *MotionMedia) GetGroupId() string {
+	if x != nil {
+		return x.GroupId
+	}
+	return ""
+}
+
+func (x *MotionMedia) GetPresentationTimestampUs() int64 {
+	if x != nil {
+		return x.PresentationTimestampUs
+	}
+	return 0
+}
+
+func (x *MotionMedia) GetHasEmbeddedVideo() bool {
+	if x != nil {
+		return x.HasEmbeddedVideo
+	}
+	return false
+}
+
+type AttachmentPayload struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Payload:
+	//
+	//	*AttachmentPayload_S3Object_
+	Payload       isAttachmentPayload_Payload `protobuf_oneof:"payload"`
+	MotionMedia   *MotionMedia                `protobuf:"bytes,10,opt,name=motion_media,json=motionMedia,proto3" json:"motion_media,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AttachmentPayload) Reset() {
+	*x = AttachmentPayload{}
+	mi := &file_store_attachment_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AttachmentPayload) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AttachmentPayload) ProtoMessage() {}
+
+func (x *AttachmentPayload) ProtoReflect() protoreflect.Message {
+	mi := &file_store_attachment_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AttachmentPayload.ProtoReflect.Descriptor instead.
+func (*AttachmentPayload) Descriptor() ([]byte, []int) {
+	return file_store_attachment_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *AttachmentPayload) GetPayload() isAttachmentPayload_Payload {
+	if x != nil {
+		return x.Payload
+	}
+	return nil
+}
+
+func (x *AttachmentPayload) GetS3Object() *AttachmentPayload_S3Object {
+	if x != nil {
+		if x, ok := x.Payload.(*AttachmentPayload_S3Object_); ok {
+			return x.S3Object
+		}
+	}
+	return nil
+}
+
+func (x *AttachmentPayload) GetMotionMedia() *MotionMedia {
+	if x != nil {
+		return x.MotionMedia
+	}
+	return nil
+}
+
+type isAttachmentPayload_Payload interface {
+	isAttachmentPayload_Payload()
+}
+
+type AttachmentPayload_S3Object_ struct {
+	S3Object *AttachmentPayload_S3Object `protobuf:"bytes,1,opt,name=s3_object,json=s3Object,proto3,oneof"`
+}
+
+func (*AttachmentPayload_S3Object_) isAttachmentPayload_Payload() {}
+
+type AttachmentPayload_S3Object struct {
+	state    protoimpl.MessageState `protogen:"open.v1"`
+	S3Config *StorageS3Config       `protobuf:"bytes,1,opt,name=s3_config,json=s3Config,proto3" json:"s3_config,omitempty"`
+	// key is the S3 object key.
+	Key string `protobuf:"bytes,2,opt,name=key,proto3" json:"key,omitempty"`
+	// last_presigned_time is the last time the object was presigned.
+	// This is used to determine if the presigned URL is still valid.
+	LastPresignedTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=last_presigned_time,json=lastPresignedTime,proto3" json:"last_presigned_time,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *AttachmentPayload_S3Object) Reset() {
+	*x = AttachmentPayload_S3Object{}
+	mi := &file_store_attachment_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AttachmentPayload_S3Object) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AttachmentPayload_S3Object) ProtoMessage() {}
+
+func (x *AttachmentPayload_S3Object) ProtoReflect() protoreflect.Message {
+	mi := &file_store_attachment_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AttachmentPayload_S3Object.ProtoReflect.Descriptor instead.
+func (*AttachmentPayload_S3Object) Descriptor() ([]byte, []int) {
+	return file_store_attachment_proto_rawDescGZIP(), []int{1, 0}
+}
+
+func (x *AttachmentPayload_S3Object) GetS3Config() *StorageS3Config {
+	if x != nil {
+		return x.S3Config
+	}
+	return nil
+}
+
+func (x *AttachmentPayload_S3Object) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *AttachmentPayload_S3Object) GetLastPresignedTime() *timestamppb.Timestamp {
+	if x != nil {
+		return x.LastPresignedTime
+	}
+	return nil
+}
+
+var File_store_attachment_proto protoreflect.FileDescriptor
+
+const file_store_attachment_proto_rawDesc = "" +
+	"\n" +
+	"\x16store/attachment.proto\x12\vmemos.store\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1cstore/instance_setting.proto\"\xfc\x01\n" +
+	"\vMotionMedia\x126\n" +
+	"\x06family\x18\x01 \x01(\x0e2\x1e.memos.store.MotionMediaFamilyR\x06family\x120\n" +
+	"\x04role\x18\x02 \x01(\x0e2\x1c.memos.store.MotionMediaRoleR\x04role\x12\x19\n" +
+	"\bgroup_id\x18\x03 \x01(\tR\agroupId\x12:\n" +
+	"\x19presentation_timestamp_us\x18\x04 \x01(\x03R\x17presentationTimestampUs\x12,\n" +
+	"\x12has_embedded_video\x18\x05 \x01(\bR\x10hasEmbeddedVideo\"\xc9\x02\n" +
+	"\x11AttachmentPayload\x12F\n" +
+	"\ts3_object\x18\x01 \x01(\v2'.memos.store.AttachmentPayload.S3ObjectH\x00R\bs3Object\x12;\n" +
+	"\fmotion_media\x18\n" +
+	" \x01(\v2\x18.memos.store.MotionMediaR\vmotionMedia\x1a\xa3\x01\n" +
+	"\bS3Object\x129\n" +
+	"\ts3_config\x18\x01 \x01(\v2\x1c.memos.store.StorageS3ConfigR\bs3Config\x12\x10\n" +
+	"\x03key\x18\x02 \x01(\tR\x03key\x12J\n" +
+	"\x13last_presigned_time\x18\x03 \x01(\v2\x1a.google.protobuf.TimestampR\x11lastPresignedTimeB\t\n" +
+	"\apayload*a\n" +
+	"\x15AttachmentStorageType\x12'\n" +
+	"#ATTACHMENT_STORAGE_TYPE_UNSPECIFIED\x10\x00\x12\t\n" +
+	"\x05LOCAL\x10\x01\x12\x06\n" +
+	"\x02S3\x10\x02\x12\f\n" +
+	"\bEXTERNAL\x10\x03*h\n" +
+	"\x11MotionMediaFamily\x12#\n" +
+	"\x1fMOTION_MEDIA_FAMILY_UNSPECIFIED\x10\x00\x12\x14\n" +
+	"\x10APPLE_LIVE_PHOTO\x10\x01\x12\x18\n" +
+	"\x14ANDROID_MOTION_PHOTO\x10\x02*Y\n" +
+	"\x0fMotionMediaRole\x12!\n" +
+	"\x1dMOTION_MEDIA_ROLE_UNSPECIFIED\x10\x00\x12\t\n" +
+	"\x05STILL\x10\x01\x12\t\n" +
+	"\x05VIDEO\x10\x02\x12\r\n" +
+	"\tCONTAINER\x10\x03B\x9a\x01\n" +
+	"\x0fcom.memos.storeB\x0fAttachmentProtoP\x01Z)github.com/usememos/memos/proto/gen/store\xa2\x02\x03MSX\xaa\x02\vMemos.Store\xca\x02\vMemos\\Store\xe2\x02\x17Memos\\Store\\GPBMetadata\xea\x02\fMemos::Storeb\x06proto3"
+
+var (
+	file_store_attachment_proto_rawDescOnce sync.Once
+	file_store_attachment_proto_rawDescData []byte
+)
+
+func file_store_attachment_proto_rawDescGZIP() []byte {
+	file_store_attachment_proto_rawDescOnce.Do(func() {
+		file_store_attachment_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_store_attachment_proto_rawDesc), len(file_store_attachment_proto_rawDesc)))
+	})
+	return file_store_attachment_proto_rawDescData
+}
+
+var file_store_attachment_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
+var file_store_attachment_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_store_attachment_proto_goTypes = []any{
+	(AttachmentStorageType)(0),         // 0: memos.store.AttachmentStorageType
+	(MotionMediaFamily)(0),             // 1: memos.store.MotionMediaFamily
+	(MotionMediaRole)(0),               // 2: memos.store.MotionMediaRole
+	(*MotionMedia)(nil),                // 3: memos.store.MotionMedia
+	(*AttachmentPayload)(nil),          // 4: memos.store.AttachmentPayload
+	(*AttachmentPayload_S3Object)(nil), // 5: memos.store.AttachmentPayload.S3Object
+	(*StorageS3Config)(nil),            // 6: memos.store.StorageS3Config
+	(*timestamppb.Timestamp)(nil),      // 7: google.protobuf.Timestamp
+}
+var file_store_attachment_proto_depIdxs = []int32{
+	1, // 0: memos.store.MotionMedia.family:type_name -> memos.store.MotionMediaFamily
+	2, // 1: memos.store.MotionMedia.role:type_name -> memos.store.MotionMediaRole
+	5, // 2: memos.store.AttachmentPayload.s3_object:type_name -> memos.store.AttachmentPayload.S3Object
+	3, // 3: memos.store.AttachmentPayload.motion_media:type_name -> memos.store.MotionMedia
+	6, // 4: memos.store.AttachmentPayload.S3Object.s3_config:type_name -> memos.store.StorageS3Config
+	7, // 5: memos.store.AttachmentPayload.S3Object.last_presigned_time:type_name -> google.protobuf.Timestamp
+	6, // [6:6] is the sub-list for method output_type
+	6, // [6:6] is the sub-list for method input_type
+	6, // [6:6] is the sub-list for extension type_name
+	6, // [6:6] is the sub-list for extension extendee
+	0, // [0:6] is the sub-list for field type_name
+}
+
+func init() { file_store_attachment_proto_init() }
+func file_store_attachment_proto_init() {
+	if File_store_attachment_proto != nil {
+		return
+	}
+	file_store_instance_setting_proto_init()
+	file_store_attachment_proto_msgTypes[1].OneofWrappers = []any{
+		(*AttachmentPayload_S3Object_)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_store_attachment_proto_rawDesc), len(file_store_attachment_proto_rawDesc)),
+			NumEnums:      3,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_store_attachment_proto_goTypes,
+		DependencyIndexes: file_store_attachment_proto_depIdxs,
+		EnumInfos:         file_store_attachment_proto_enumTypes,
+		MessageInfos:      file_store_attachment_proto_msgTypes,
+	}.Build()
+	File_store_attachment_proto = out.File
+	file_store_attachment_proto_goTypes = nil
+	file_store_attachment_proto_depIdxs = nil
+}

proto/gen/store/idp.pb.go

@@ -0,0 +1,476 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: store/idp.proto
+
+package store
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type IdentityProvider_Type int32
+
+const (
+	IdentityProvider_TYPE_UNSPECIFIED IdentityProvider_Type = 0
+	IdentityProvider_OAUTH2           IdentityProvider_Type = 1
+)
+
+// Enum value maps for IdentityProvider_Type.
+var (
+	IdentityProvider_Type_name = map[int32]string{
+		0: "TYPE_UNSPECIFIED",
+		1: "OAUTH2",
+	}
+	IdentityProvider_Type_value = map[string]int32{
+		"TYPE_UNSPECIFIED": 0,
+		"OAUTH2":           1,
+	}
+)
+
+func (x IdentityProvider_Type) Enum() *IdentityProvider_Type {
+	p := new(IdentityProvider_Type)
+	*p = x
+	return p
+}
+
+func (x IdentityProvider_Type) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (IdentityProvider_Type) Descriptor() protoreflect.EnumDescriptor {
+	return file_store_idp_proto_enumTypes[0].Descriptor()
+}
+
+func (IdentityProvider_Type) Type() protoreflect.EnumType {
+	return &file_store_idp_proto_enumTypes[0]
+}
+
+func (x IdentityProvider_Type) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use IdentityProvider_Type.Descriptor instead.
+func (IdentityProvider_Type) EnumDescriptor() ([]byte, []int) {
+	return file_store_idp_proto_rawDescGZIP(), []int{0, 0}
+}
+
+type IdentityProvider struct {
+	state            protoimpl.MessageState  `protogen:"open.v1"`
+	Id               int32                   `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	Name             string                  `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	Type             IdentityProvider_Type   `protobuf:"varint,3,opt,name=type,proto3,enum=memos.store.IdentityProvider_Type" json:"type,omitempty"`
+	IdentifierFilter string                  `protobuf:"bytes,4,opt,name=identifier_filter,json=identifierFilter,proto3" json:"identifier_filter,omitempty"`
+	Config           *IdentityProviderConfig `protobuf:"bytes,5,opt,name=config,proto3" json:"config,omitempty"`
+	Uid              string                  `protobuf:"bytes,6,opt,name=uid,proto3" json:"uid,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
+}
+
+func (x *IdentityProvider) Reset() {
+	*x = IdentityProvider{}
+	mi := &file_store_idp_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *IdentityProvider) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IdentityProvider) ProtoMessage() {}
+
+func (x *IdentityProvider) ProtoReflect() protoreflect.Message {
+	mi := &file_store_idp_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IdentityProvider.ProtoReflect.Descriptor instead.
+func (*IdentityProvider) Descriptor() ([]byte, []int) {
+	return file_store_idp_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *IdentityProvider) GetId() int32 {
+	if x != nil {
+		return x.Id
+	}
+	return 0
+}
+
+func (x *IdentityProvider) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *IdentityProvider) GetType() IdentityProvider_Type {
+	if x != nil {
+		return x.Type
+	}
+	return IdentityProvider_TYPE_UNSPECIFIED
+}
+
+func (x *IdentityProvider) GetIdentifierFilter() string {
+	if x != nil {
+		return x.IdentifierFilter
+	}
+	return ""
+}
+
+func (x *IdentityProvider) GetConfig() *IdentityProviderConfig {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
+func (x *IdentityProvider) GetUid() string {
+	if x != nil {
+		return x.Uid
+	}
+	return ""
+}
+
+type IdentityProviderConfig struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Config:
+	//
+	//	*IdentityProviderConfig_Oauth2Config
+	Config        isIdentityProviderConfig_Config `protobuf_oneof:"config"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *IdentityProviderConfig) Reset() {
+	*x = IdentityProviderConfig{}
+	mi := &file_store_idp_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *IdentityProviderConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IdentityProviderConfig) ProtoMessage() {}
+
+func (x *IdentityProviderConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_store_idp_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IdentityProviderConfig.ProtoReflect.Descriptor instead.
+func (*IdentityProviderConfig) Descriptor() ([]byte, []int) {
+	return file_store_idp_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *IdentityProviderConfig) GetConfig() isIdentityProviderConfig_Config {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
+func (x *IdentityProviderConfig) GetOauth2Config() *OAuth2Config {
+	if x != nil {
+		if x, ok := x.Config.(*IdentityProviderConfig_Oauth2Config); ok {
+			return x.Oauth2Config
+		}
+	}
+	return nil
+}
+
+type isIdentityProviderConfig_Config interface {
+	isIdentityProviderConfig_Config()
+}
+
+type IdentityProviderConfig_Oauth2Config struct {
+	Oauth2Config *OAuth2Config `protobuf:"bytes,1,opt,name=oauth2_config,json=oauth2Config,proto3,oneof"`
+}
+
+func (*IdentityProviderConfig_Oauth2Config) isIdentityProviderConfig_Config() {}
+
+type FieldMapping struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Identifier    string                 `protobuf:"bytes,1,opt,name=identifier,proto3" json:"identifier,omitempty"`
+	DisplayName   string                 `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
+	Email         string                 `protobuf:"bytes,3,opt,name=email,proto3" json:"email,omitempty"`
+	AvatarUrl     string                 `protobuf:"bytes,4,opt,name=avatar_url,json=avatarUrl,proto3" json:"avatar_url,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *FieldMapping) Reset() {
+	*x = FieldMapping{}
+	mi := &file_store_idp_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *FieldMapping) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FieldMapping) ProtoMessage() {}
+
+func (x *FieldMapping) ProtoReflect() protoreflect.Message {
+	mi := &file_store_idp_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FieldMapping.ProtoReflect.Descriptor instead.
+func (*FieldMapping) Descriptor() ([]byte, []int) {
+	return file_store_idp_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *FieldMapping) GetIdentifier() string {
+	if x != nil {
+		return x.Identifier
+	}
+	return ""
+}
+
+func (x *FieldMapping) GetDisplayName() string {
+	if x != nil {
+		return x.DisplayName
+	}
+	return ""
+}
+
+func (x *FieldMapping) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *FieldMapping) GetAvatarUrl() string {
+	if x != nil {
+		return x.AvatarUrl
+	}
+	return ""
+}
+
+type OAuth2Config struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ClientId      string                 `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	ClientSecret  string                 `protobuf:"bytes,2,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
+	AuthUrl       string                 `protobuf:"bytes,3,opt,name=auth_url,json=authUrl,proto3" json:"auth_url,omitempty"`
+	TokenUrl      string                 `protobuf:"bytes,4,opt,name=token_url,json=tokenUrl,proto3" json:"token_url,omitempty"`
+	UserInfoUrl   string                 `protobuf:"bytes,5,opt,name=user_info_url,json=userInfoUrl,proto3" json:"user_info_url,omitempty"`
+	Scopes        []string               `protobuf:"bytes,6,rep,name=scopes,proto3" json:"scopes,omitempty"`
+	FieldMapping  *FieldMapping          `protobuf:"bytes,7,opt,name=field_mapping,json=fieldMapping,proto3" json:"field_mapping,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *OAuth2Config) Reset() {
+	*x = OAuth2Config{}
+	mi := &file_store_idp_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *OAuth2Config) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OAuth2Config) ProtoMessage() {}
+
+func (x *OAuth2Config) ProtoReflect() protoreflect.Message {
+	mi := &file_store_idp_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OAuth2Config.ProtoReflect.Descriptor instead.
+func (*OAuth2Config) Descriptor() ([]byte, []int) {
+	return file_store_idp_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *OAuth2Config) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+func (x *OAuth2Config) GetClientSecret() string {
+	if x != nil {
+		return x.ClientSecret
+	}
+	return ""
+}
+
+func (x *OAuth2Config) GetAuthUrl() string {
+	if x != nil {
+		return x.AuthUrl
+	}
+	return ""
+}
+
+func (x *OAuth2Config) GetTokenUrl() string {
+	if x != nil {
+		return x.TokenUrl
+	}
+	return ""
+}
+
+func (x *OAuth2Config) GetUserInfoUrl() string {
+	if x != nil {
+		return x.UserInfoUrl
+	}
+	return ""
+}
+
+func (x *OAuth2Config) GetScopes() []string {
+	if x != nil {
+		return x.Scopes
+	}
+	return nil
+}
+
+func (x *OAuth2Config) GetFieldMapping() *FieldMapping {
+	if x != nil {
+		return x.FieldMapping
+	}
+	return nil
+}
+
+var File_store_idp_proto protoreflect.FileDescriptor
+
+const file_store_idp_proto_rawDesc = "" +
+	"\n" +
+	"\x0fstore/idp.proto\x12\vmemos.store\"\x94\x02\n" +
+	"\x10IdentityProvider\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\x05R\x02id\x12\x12\n" +
+	"\x04name\x18\x02 \x01(\tR\x04name\x126\n" +
+	"\x04type\x18\x03 \x01(\x0e2\".memos.store.IdentityProvider.TypeR\x04type\x12+\n" +
+	"\x11identifier_filter\x18\x04 \x01(\tR\x10identifierFilter\x12;\n" +
+	"\x06config\x18\x05 \x01(\v2#.memos.store.IdentityProviderConfigR\x06config\x12\x10\n" +
+	"\x03uid\x18\x06 \x01(\tR\x03uid\"(\n" +
+	"\x04Type\x12\x14\n" +
+	"\x10TYPE_UNSPECIFIED\x10\x00\x12\n" +
+	"\n" +
+	"\x06OAUTH2\x10\x01\"d\n" +
+	"\x16IdentityProviderConfig\x12@\n" +
+	"\roauth2_config\x18\x01 \x01(\v2\x19.memos.store.OAuth2ConfigH\x00R\foauth2ConfigB\b\n" +
+	"\x06config\"\x86\x01\n" +
+	"\fFieldMapping\x12\x1e\n" +
+	"\n" +
+	"identifier\x18\x01 \x01(\tR\n" +
+	"identifier\x12!\n" +
+	"\fdisplay_name\x18\x02 \x01(\tR\vdisplayName\x12\x14\n" +
+	"\x05email\x18\x03 \x01(\tR\x05email\x12\x1d\n" +
+	"\n" +
+	"avatar_url\x18\x04 \x01(\tR\tavatarUrl\"\x84\x02\n" +
+	"\fOAuth2Config\x12\x1b\n" +
+	"\tclient_id\x18\x01 \x01(\tR\bclientId\x12#\n" +
+	"\rclient_secret\x18\x02 \x01(\tR\fclientSecret\x12\x19\n" +
+	"\bauth_url\x18\x03 \x01(\tR\aauthUrl\x12\x1b\n" +
+	"\ttoken_url\x18\x04 \x01(\tR\btokenUrl\x12\"\n" +
+	"\ruser_info_url\x18\x05 \x01(\tR\vuserInfoUrl\x12\x16\n" +
+	"\x06scopes\x18\x06 \x03(\tR\x06scopes\x12>\n" +
+	"\rfield_mapping\x18\a \x01(\v2\x19.memos.store.FieldMappingR\ffieldMappingB\x93\x01\n" +
+	"\x0fcom.memos.storeB\bIdpProtoP\x01Z)github.com/usememos/memos/proto/gen/store\xa2\x02\x03MSX\xaa\x02\vMemos.Store\xca\x02\vMemos\\Store\xe2\x02\x17Memos\\Store\\GPBMetadata\xea\x02\fMemos::Storeb\x06proto3"
+
+var (
+	file_store_idp_proto_rawDescOnce sync.Once
+	file_store_idp_proto_rawDescData []byte
+)
+
+func file_store_idp_proto_rawDescGZIP() []byte {
+	file_store_idp_proto_rawDescOnce.Do(func() {
+		file_store_idp_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_store_idp_proto_rawDesc), len(file_store_idp_proto_rawDesc)))
+	})
+	return file_store_idp_proto_rawDescData
+}
+
+var file_store_idp_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_store_idp_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_store_idp_proto_goTypes = []any{
+	(IdentityProvider_Type)(0),     // 0: memos.store.IdentityProvider.Type
+	(*IdentityProvider)(nil),       // 1: memos.store.IdentityProvider
+	(*IdentityProviderConfig)(nil), // 2: memos.store.IdentityProviderConfig
+	(*FieldMapping)(nil),           // 3: memos.store.FieldMapping
+	(*OAuth2Config)(nil),           // 4: memos.store.OAuth2Config
+}
+var file_store_idp_proto_depIdxs = []int32{
+	0, // 0: memos.store.IdentityProvider.type:type_name -> memos.store.IdentityProvider.Type
+	2, // 1: memos.store.IdentityProvider.config:type_name -> memos.store.IdentityProviderConfig
+	4, // 2: memos.store.IdentityProviderConfig.oauth2_config:type_name -> memos.store.OAuth2Config
+	3, // 3: memos.store.OAuth2Config.field_mapping:type_name -> memos.store.FieldMapping
+	4, // [4:4] is the sub-list for method output_type
+	4, // [4:4] is the sub-list for method input_type
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
+}
+
+func init() { file_store_idp_proto_init() }
+func file_store_idp_proto_init() {
+	if File_store_idp_proto != nil {
+		return
+	}
+	file_store_idp_proto_msgTypes[1].OneofWrappers = []any{
+		(*IdentityProviderConfig_Oauth2Config)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_store_idp_proto_rawDesc), len(file_store_idp_proto_rawDesc)),
+			NumEnums:      1,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_store_idp_proto_goTypes,
+		DependencyIndexes: file_store_idp_proto_depIdxs,
+		EnumInfos:         file_store_idp_proto_enumTypes,
+		MessageInfos:      file_store_idp_proto_msgTypes,
+	}.Build()
+	File_store_idp_proto = out.File
+	file_store_idp_proto_goTypes = nil
+	file_store_idp_proto_depIdxs = nil
+}

proto/gen/store/inbox.pb.go

@@ -0,0 +1,351 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: store/inbox.proto
+
+package store
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type InboxMessage_Type int32
+
+const (
+	InboxMessage_TYPE_UNSPECIFIED InboxMessage_Type = 0
+	// Memo comment notification.
+	InboxMessage_MEMO_COMMENT InboxMessage_Type = 1
+	// Memo mention notification.
+	InboxMessage_MEMO_MENTION InboxMessage_Type = 2
+)
+
+// Enum value maps for InboxMessage_Type.
+var (
+	InboxMessage_Type_name = map[int32]string{
+		0: "TYPE_UNSPECIFIED",
+		1: "MEMO_COMMENT",
+		2: "MEMO_MENTION",
+	}
+	InboxMessage_Type_value = map[string]int32{
+		"TYPE_UNSPECIFIED": 0,
+		"MEMO_COMMENT":     1,
+		"MEMO_MENTION":     2,
+	}
+)
+
+func (x InboxMessage_Type) Enum() *InboxMessage_Type {
+	p := new(InboxMessage_Type)
+	*p = x
+	return p
+}
+
+func (x InboxMessage_Type) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (InboxMessage_Type) Descriptor() protoreflect.EnumDescriptor {
+	return file_store_inbox_proto_enumTypes[0].Descriptor()
+}
+
+func (InboxMessage_Type) Type() protoreflect.EnumType {
+	return &file_store_inbox_proto_enumTypes[0]
+}
+
+func (x InboxMessage_Type) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use InboxMessage_Type.Descriptor instead.
+func (InboxMessage_Type) EnumDescriptor() ([]byte, []int) {
+	return file_store_inbox_proto_rawDescGZIP(), []int{0, 0}
+}
+
+type InboxMessage struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The type of the inbox message.
+	Type InboxMessage_Type `protobuf:"varint,1,opt,name=type,proto3,enum=memos.store.InboxMessage_Type" json:"type,omitempty"`
+	// Types that are valid to be assigned to Payload:
+	//
+	//	*InboxMessage_MemoComment
+	//	*InboxMessage_MemoMention
+	Payload       isInboxMessage_Payload `protobuf_oneof:"payload"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *InboxMessage) Reset() {
+	*x = InboxMessage{}
+	mi := &file_store_inbox_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *InboxMessage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*InboxMessage) ProtoMessage() {}
+
+func (x *InboxMessage) ProtoReflect() protoreflect.Message {
+	mi := &file_store_inbox_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use InboxMessage.ProtoReflect.Descriptor instead.
+func (*InboxMessage) Descriptor() ([]byte, []int) {
+	return file_store_inbox_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *InboxMessage) GetType() InboxMessage_Type {
+	if x != nil {
+		return x.Type
+	}
+	return InboxMessage_TYPE_UNSPECIFIED
+}
+
+func (x *InboxMessage) GetPayload() isInboxMessage_Payload {
+	if x != nil {
+		return x.Payload
+	}
+	return nil
+}
+
+func (x *InboxMessage) GetMemoComment() *InboxMessage_MemoCommentPayload {
+	if x != nil {
+		if x, ok := x.Payload.(*InboxMessage_MemoComment); ok {
+			return x.MemoComment
+		}
+	}
+	return nil
+}
+
+func (x *InboxMessage) GetMemoMention() *InboxMessage_MemoMentionPayload {
+	if x != nil {
+		if x, ok := x.Payload.(*InboxMessage_MemoMention); ok {
+			return x.MemoMention
+		}
+	}
+	return nil
+}
+
+type isInboxMessage_Payload interface {
+	isInboxMessage_Payload()
+}
+
+type InboxMessage_MemoComment struct {
+	MemoComment *InboxMessage_MemoCommentPayload `protobuf:"bytes,2,opt,name=memo_comment,json=memoComment,proto3,oneof"`
+}
+
+type InboxMessage_MemoMention struct {
+	MemoMention *InboxMessage_MemoMentionPayload `protobuf:"bytes,3,opt,name=memo_mention,json=memoMention,proto3,oneof"`
+}
+
+func (*InboxMessage_MemoComment) isInboxMessage_Payload() {}
+
+func (*InboxMessage_MemoMention) isInboxMessage_Payload() {}
+
+type InboxMessage_MemoCommentPayload struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	MemoId        int32                  `protobuf:"varint,1,opt,name=memo_id,json=memoId,proto3" json:"memo_id,omitempty"`
+	RelatedMemoId int32                  `protobuf:"varint,2,opt,name=related_memo_id,json=relatedMemoId,proto3" json:"related_memo_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *InboxMessage_MemoCommentPayload) Reset() {
+	*x = InboxMessage_MemoCommentPayload{}
+	mi := &file_store_inbox_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *InboxMessage_MemoCommentPayload) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*InboxMessage_MemoCommentPayload) ProtoMessage() {}
+
+func (x *InboxMessage_MemoCommentPayload) ProtoReflect() protoreflect.Message {
+	mi := &file_store_inbox_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use InboxMessage_MemoCommentPayload.ProtoReflect.Descriptor instead.
+func (*InboxMessage_MemoCommentPayload) Descriptor() ([]byte, []int) {
+	return file_store_inbox_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *InboxMessage_MemoCommentPayload) GetMemoId() int32 {
+	if x != nil {
+		return x.MemoId
+	}
+	return 0
+}
+
+func (x *InboxMessage_MemoCommentPayload) GetRelatedMemoId() int32 {
+	if x != nil {
+		return x.RelatedMemoId
+	}
+	return 0
+}
+
+type InboxMessage_MemoMentionPayload struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	MemoId        int32                  `protobuf:"varint,1,opt,name=memo_id,json=memoId,proto3" json:"memo_id,omitempty"`
+	RelatedMemoId int32                  `protobuf:"varint,2,opt,name=related_memo_id,json=relatedMemoId,proto3" json:"related_memo_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *InboxMessage_MemoMentionPayload) Reset() {
+	*x = InboxMessage_MemoMentionPayload{}
+	mi := &file_store_inbox_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *InboxMessage_MemoMentionPayload) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*InboxMessage_MemoMentionPayload) ProtoMessage() {}
+
+func (x *InboxMessage_MemoMentionPayload) ProtoReflect() protoreflect.Message {
+	mi := &file_store_inbox_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use InboxMessage_MemoMentionPayload.ProtoReflect.Descriptor instead.
+func (*InboxMessage_MemoMentionPayload) Descriptor() ([]byte, []int) {
+	return file_store_inbox_proto_rawDescGZIP(), []int{0, 1}
+}
+
+func (x *InboxMessage_MemoMentionPayload) GetMemoId() int32 {
+	if x != nil {
+		return x.MemoId
+	}
+	return 0
+}
+
+func (x *InboxMessage_MemoMentionPayload) GetRelatedMemoId() int32 {
+	if x != nil {
+		return x.RelatedMemoId
+	}
+	return 0
+}
+
+var File_store_inbox_proto protoreflect.FileDescriptor
+
+const file_store_inbox_proto_rawDesc = "" +
+	"\n" +
+	"\x11store/inbox.proto\x12\vmemos.store\"\xe3\x03\n" +
+	"\fInboxMessage\x122\n" +
+	"\x04type\x18\x01 \x01(\x0e2\x1e.memos.store.InboxMessage.TypeR\x04type\x12Q\n" +
+	"\fmemo_comment\x18\x02 \x01(\v2,.memos.store.InboxMessage.MemoCommentPayloadH\x00R\vmemoComment\x12Q\n" +
+	"\fmemo_mention\x18\x03 \x01(\v2,.memos.store.InboxMessage.MemoMentionPayloadH\x00R\vmemoMention\x1aU\n" +
+	"\x12MemoCommentPayload\x12\x17\n" +
+	"\amemo_id\x18\x01 \x01(\x05R\x06memoId\x12&\n" +
+	"\x0frelated_memo_id\x18\x02 \x01(\x05R\rrelatedMemoId\x1aU\n" +
+	"\x12MemoMentionPayload\x12\x17\n" +
+	"\amemo_id\x18\x01 \x01(\x05R\x06memoId\x12&\n" +
+	"\x0frelated_memo_id\x18\x02 \x01(\x05R\rrelatedMemoId\"@\n" +
+	"\x04Type\x12\x14\n" +
+	"\x10TYPE_UNSPECIFIED\x10\x00\x12\x10\n" +
+	"\fMEMO_COMMENT\x10\x01\x12\x10\n" +
+	"\fMEMO_MENTION\x10\x02B\t\n" +
+	"\apayloadB\x95\x01\n" +
+	"\x0fcom.memos.storeB\n" +
+	"InboxProtoP\x01Z)github.com/usememos/memos/proto/gen/store\xa2\x02\x03MSX\xaa\x02\vMemos.Store\xca\x02\vMemos\\Store\xe2\x02\x17Memos\\Store\\GPBMetadata\xea\x02\fMemos::Storeb\x06proto3"
+
+var (
+	file_store_inbox_proto_rawDescOnce sync.Once
+	file_store_inbox_proto_rawDescData []byte
+)
+
+func file_store_inbox_proto_rawDescGZIP() []byte {
+	file_store_inbox_proto_rawDescOnce.Do(func() {
+		file_store_inbox_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_store_inbox_proto_rawDesc), len(file_store_inbox_proto_rawDesc)))
+	})
+	return file_store_inbox_proto_rawDescData
+}
+
+var file_store_inbox_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_store_inbox_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_store_inbox_proto_goTypes = []any{
+	(InboxMessage_Type)(0),                  // 0: memos.store.InboxMessage.Type
+	(*InboxMessage)(nil),                    // 1: memos.store.InboxMessage
+	(*InboxMessage_MemoCommentPayload)(nil), // 2: memos.store.InboxMessage.MemoCommentPayload
+	(*InboxMessage_MemoMentionPayload)(nil), // 3: memos.store.InboxMessage.MemoMentionPayload
+}
+var file_store_inbox_proto_depIdxs = []int32{
+	0, // 0: memos.store.InboxMessage.type:type_name -> memos.store.InboxMessage.Type
+	2, // 1: memos.store.InboxMessage.memo_comment:type_name -> memos.store.InboxMessage.MemoCommentPayload
+	3, // 2: memos.store.InboxMessage.memo_mention:type_name -> memos.store.InboxMessage.MemoMentionPayload
+	3, // [3:3] is the sub-list for method output_type
+	3, // [3:3] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_store_inbox_proto_init() }
+func file_store_inbox_proto_init() {
+	if File_store_inbox_proto != nil {
+		return
+	}
+	file_store_inbox_proto_msgTypes[0].OneofWrappers = []any{
+		(*InboxMessage_MemoComment)(nil),
+		(*InboxMessage_MemoMention)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_store_inbox_proto_rawDesc), len(file_store_inbox_proto_rawDesc)),
+			NumEnums:      1,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_store_inbox_proto_goTypes,
+		DependencyIndexes: file_store_inbox_proto_depIdxs,
+		EnumInfos:         file_store_inbox_proto_enumTypes,
+		MessageInfos:      file_store_inbox_proto_msgTypes,
+	}.Build()
+	File_store_inbox_proto = out.File
+	file_store_inbox_proto_goTypes = nil
+	file_store_inbox_proto_depIdxs = nil
+}

proto/gen/store/memo.pb.go

@@ -0,0 +1,293 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: store/memo.proto
+
+package store
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type MemoPayload struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Property      *MemoPayload_Property  `protobuf:"bytes,1,opt,name=property,proto3" json:"property,omitempty"`
+	Location      *MemoPayload_Location  `protobuf:"bytes,2,opt,name=location,proto3" json:"location,omitempty"`
+	Tags          []string               `protobuf:"bytes,3,rep,name=tags,proto3" json:"tags,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *MemoPayload) Reset() {
+	*x = MemoPayload{}
+	mi := &file_store_memo_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *MemoPayload) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MemoPayload) ProtoMessage() {}
+
+func (x *MemoPayload) ProtoReflect() protoreflect.Message {
+	mi := &file_store_memo_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MemoPayload.ProtoReflect.Descriptor instead.
+func (*MemoPayload) Descriptor() ([]byte, []int) {
+	return file_store_memo_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *MemoPayload) GetProperty() *MemoPayload_Property {
+	if x != nil {
+		return x.Property
+	}
+	return nil
+}
+
+func (x *MemoPayload) GetLocation() *MemoPayload_Location {
+	if x != nil {
+		return x.Location
+	}
+	return nil
+}
+
+func (x *MemoPayload) GetTags() []string {
+	if x != nil {
+		return x.Tags
+	}
+	return nil
+}
+
+// The calculated properties from the memo content.
+type MemoPayload_Property struct {
+	state              protoimpl.MessageState `protogen:"open.v1"`
+	HasLink            bool                   `protobuf:"varint,1,opt,name=has_link,json=hasLink,proto3" json:"has_link,omitempty"`
+	HasTaskList        bool                   `protobuf:"varint,2,opt,name=has_task_list,json=hasTaskList,proto3" json:"has_task_list,omitempty"`
+	HasCode            bool                   `protobuf:"varint,3,opt,name=has_code,json=hasCode,proto3" json:"has_code,omitempty"`
+	HasIncompleteTasks bool                   `protobuf:"varint,4,opt,name=has_incomplete_tasks,json=hasIncompleteTasks,proto3" json:"has_incomplete_tasks,omitempty"`
+	// The title extracted from the first H1 heading, if present.
+	Title         string `protobuf:"bytes,5,opt,name=title,proto3" json:"title,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *MemoPayload_Property) Reset() {
+	*x = MemoPayload_Property{}
+	mi := &file_store_memo_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *MemoPayload_Property) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MemoPayload_Property) ProtoMessage() {}
+
+func (x *MemoPayload_Property) ProtoReflect() protoreflect.Message {
+	mi := &file_store_memo_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MemoPayload_Property.ProtoReflect.Descriptor instead.
+func (*MemoPayload_Property) Descriptor() ([]byte, []int) {
+	return file_store_memo_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *MemoPayload_Property) GetHasLink() bool {
+	if x != nil {
+		return x.HasLink
+	}
+	return false
+}
+
+func (x *MemoPayload_Property) GetHasTaskList() bool {
+	if x != nil {
+		return x.HasTaskList
+	}
+	return false
+}
+
+func (x *MemoPayload_Property) GetHasCode() bool {
+	if x != nil {
+		return x.HasCode
+	}
+	return false
+}
+
+func (x *MemoPayload_Property) GetHasIncompleteTasks() bool {
+	if x != nil {
+		return x.HasIncompleteTasks
+	}
+	return false
+}
+
+func (x *MemoPayload_Property) GetTitle() string {
+	if x != nil {
+		return x.Title
+	}
+	return ""
+}
+
+type MemoPayload_Location struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Placeholder   string                 `protobuf:"bytes,1,opt,name=placeholder,proto3" json:"placeholder,omitempty"`
+	Latitude      float64                `protobuf:"fixed64,2,opt,name=latitude,proto3" json:"latitude,omitempty"`
+	Longitude     float64                `protobuf:"fixed64,3,opt,name=longitude,proto3" json:"longitude,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *MemoPayload_Location) Reset() {
+	*x = MemoPayload_Location{}
+	mi := &file_store_memo_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *MemoPayload_Location) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MemoPayload_Location) ProtoMessage() {}
+
+func (x *MemoPayload_Location) ProtoReflect() protoreflect.Message {
+	mi := &file_store_memo_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MemoPayload_Location.ProtoReflect.Descriptor instead.
+func (*MemoPayload_Location) Descriptor() ([]byte, []int) {
+	return file_store_memo_proto_rawDescGZIP(), []int{0, 1}
+}
+
+func (x *MemoPayload_Location) GetPlaceholder() string {
+	if x != nil {
+		return x.Placeholder
+	}
+	return ""
+}
+
+func (x *MemoPayload_Location) GetLatitude() float64 {
+	if x != nil {
+		return x.Latitude
+	}
+	return 0
+}
+
+func (x *MemoPayload_Location) GetLongitude() float64 {
+	if x != nil {
+		return x.Longitude
+	}
+	return 0
+}
+
+var File_store_memo_proto protoreflect.FileDescriptor
+
+const file_store_memo_proto_rawDesc = "" +
+	"\n" +
+	"\x10store/memo.proto\x12\vmemos.store\"\xb6\x03\n" +
+	"\vMemoPayload\x12=\n" +
+	"\bproperty\x18\x01 \x01(\v2!.memos.store.MemoPayload.PropertyR\bproperty\x12=\n" +
+	"\blocation\x18\x02 \x01(\v2!.memos.store.MemoPayload.LocationR\blocation\x12\x12\n" +
+	"\x04tags\x18\x03 \x03(\tR\x04tags\x1a\xac\x01\n" +
+	"\bProperty\x12\x19\n" +
+	"\bhas_link\x18\x01 \x01(\bR\ahasLink\x12\"\n" +
+	"\rhas_task_list\x18\x02 \x01(\bR\vhasTaskList\x12\x19\n" +
+	"\bhas_code\x18\x03 \x01(\bR\ahasCode\x120\n" +
+	"\x14has_incomplete_tasks\x18\x04 \x01(\bR\x12hasIncompleteTasks\x12\x14\n" +
+	"\x05title\x18\x05 \x01(\tR\x05title\x1af\n" +
+	"\bLocation\x12 \n" +
+	"\vplaceholder\x18\x01 \x01(\tR\vplaceholder\x12\x1a\n" +
+	"\blatitude\x18\x02 \x01(\x01R\blatitude\x12\x1c\n" +
+	"\tlongitude\x18\x03 \x01(\x01R\tlongitudeB\x94\x01\n" +
+	"\x0fcom.memos.storeB\tMemoProtoP\x01Z)github.com/usememos/memos/proto/gen/store\xa2\x02\x03MSX\xaa\x02\vMemos.Store\xca\x02\vMemos\\Store\xe2\x02\x17Memos\\Store\\GPBMetadata\xea\x02\fMemos::Storeb\x06proto3"
+
+var (
+	file_store_memo_proto_rawDescOnce sync.Once
+	file_store_memo_proto_rawDescData []byte
+)
+
+func file_store_memo_proto_rawDescGZIP() []byte {
+	file_store_memo_proto_rawDescOnce.Do(func() {
+		file_store_memo_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_store_memo_proto_rawDesc), len(file_store_memo_proto_rawDesc)))
+	})
+	return file_store_memo_proto_rawDescData
+}
+
+var file_store_memo_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_store_memo_proto_goTypes = []any{
+	(*MemoPayload)(nil),          // 0: memos.store.MemoPayload
+	(*MemoPayload_Property)(nil), // 1: memos.store.MemoPayload.Property
+	(*MemoPayload_Location)(nil), // 2: memos.store.MemoPayload.Location
+}
+var file_store_memo_proto_depIdxs = []int32{
+	1, // 0: memos.store.MemoPayload.property:type_name -> memos.store.MemoPayload.Property
+	2, // 1: memos.store.MemoPayload.location:type_name -> memos.store.MemoPayload.Location
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_store_memo_proto_init() }
+func file_store_memo_proto_init() {
+	if File_store_memo_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_store_memo_proto_rawDesc), len(file_store_memo_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_store_memo_proto_goTypes,
+		DependencyIndexes: file_store_memo_proto_depIdxs,
+		MessageInfos:      file_store_memo_proto_msgTypes,
+	}.Build()
+	File_store_memo_proto = out.File
+	file_store_memo_proto_goTypes = nil
+	file_store_memo_proto_depIdxs = nil
+}

proto/store/attachment.proto

@@ -0,0 +1,56 @@
+syntax = "proto3";
+
+package memos.store;
+
+import "google/protobuf/timestamp.proto";
+import "store/instance_setting.proto";
+
+option go_package = "gen/store";
+
+enum AttachmentStorageType {
+  ATTACHMENT_STORAGE_TYPE_UNSPECIFIED = 0;
+  // Attachment is stored locally. AKA, local file system.
+  LOCAL = 1;
+  // Attachment is stored in S3.
+  S3 = 2;
+  // Attachment is stored in an external storage. The reference is a URL.
+  EXTERNAL = 3;
+}
+
+enum MotionMediaFamily {
+  MOTION_MEDIA_FAMILY_UNSPECIFIED = 0;
+  APPLE_LIVE_PHOTO = 1;
+  ANDROID_MOTION_PHOTO = 2;
+}
+
+enum MotionMediaRole {
+  MOTION_MEDIA_ROLE_UNSPECIFIED = 0;
+  STILL = 1;
+  VIDEO = 2;
+  CONTAINER = 3;
+}
+
+message MotionMedia {
+  MotionMediaFamily family = 1;
+  MotionMediaRole role = 2;
+  string group_id = 3;
+  int64 presentation_timestamp_us = 4;
+  bool has_embedded_video = 5;
+}
+
+message AttachmentPayload {
+  oneof payload {
+    S3Object s3_object = 1;
+  }
+
+  MotionMedia motion_media = 10;
+
+  message S3Object {
+    StorageS3Config s3_config = 1;
+    // key is the S3 object key.
+    string key = 2;
+    // last_presigned_time is the last time the object was presigned.
+    // This is used to determine if the presigned URL is still valid.
+    google.protobuf.Timestamp last_presigned_time = 3;
+  }
+}

proto/store/idp.proto

@@ -0,0 +1,42 @@
+syntax = "proto3";
+
+package memos.store;
+
+option go_package = "gen/store";
+
+message IdentityProvider {
+  int32 id = 1;
+  string name = 2;
+
+  enum Type {
+    TYPE_UNSPECIFIED = 0;
+    OAUTH2 = 1;
+  }
+  Type type = 3;
+  string identifier_filter = 4;
+  IdentityProviderConfig config = 5;
+  string uid = 6;
+}
+
+message IdentityProviderConfig {
+  oneof config {
+    OAuth2Config oauth2_config = 1;
+  }
+}
+
+message FieldMapping {
+  string identifier = 1;
+  string display_name = 2;
+  string email = 3;
+  string avatar_url = 4;
+}
+
+message OAuth2Config {
+  string client_id = 1;
+  string client_secret = 2;
+  string auth_url = 3;
+  string token_url = 4;
+  string user_info_url = 5;
+  repeated string scopes = 6;
+  FieldMapping field_mapping = 7;
+}

proto/store/inbox.proto

@@ -0,0 +1,32 @@
+syntax = "proto3";
+
+package memos.store;
+
+option go_package = "gen/store";
+
+message InboxMessage {
+  message MemoCommentPayload {
+    int32 memo_id = 1;
+    int32 related_memo_id = 2;
+  }
+
+  message MemoMentionPayload {
+    int32 memo_id = 1;
+    int32 related_memo_id = 2;
+  }
+
+  // The type of the inbox message.
+  Type type = 1;
+  oneof payload {
+    MemoCommentPayload memo_comment = 2;
+    MemoMentionPayload memo_mention = 3;
+  }
+
+  enum Type {
+    TYPE_UNSPECIFIED = 0;
+    // Memo comment notification.
+    MEMO_COMMENT = 1;
+    // Memo mention notification.
+    MEMO_MENTION = 2;
+  }
+}

proto/store/instance_setting.proto

@@ -0,0 +1,199 @@
+syntax = "proto3";
+
+package memos.store;
+
+import "google/type/color.proto";
+
+option go_package = "gen/store";
+
+enum InstanceSettingKey {
+  INSTANCE_SETTING_KEY_UNSPECIFIED = 0;
+  // BASIC is the key for basic settings.
+  BASIC = 1;
+  // GENERAL is the key for general settings.
+  GENERAL = 2;
+  // STORAGE is the key for storage settings.
+  STORAGE = 3;
+  // MEMO_RELATED is the key for memo related settings.
+  MEMO_RELATED = 4;
+  // TAGS is the key for tag metadata.
+  TAGS = 5;
+  // NOTIFICATION is the key for notification transport settings.
+  NOTIFICATION = 6;
+  // AI is the key for AI provider settings.
+  AI = 7;
+}
+
+message InstanceSetting {
+  InstanceSettingKey key = 1;
+  oneof value {
+    InstanceBasicSetting basic_setting = 2;
+    InstanceGeneralSetting general_setting = 3;
+    InstanceStorageSetting storage_setting = 4;
+    InstanceMemoRelatedSetting memo_related_setting = 5;
+    InstanceTagsSetting tags_setting = 6;
+    InstanceNotificationSetting notification_setting = 7;
+    InstanceAISetting ai_setting = 8;
+  }
+}
+
+message InstanceBasicSetting {
+  // The secret key for instance. Mainly used for session management.
+  string secret_key = 1;
+  // The current schema version of database.
+  string schema_version = 2;
+}
+
+message InstanceGeneralSetting {
+  // disallow_user_registration disallows user registration.
+  bool disallow_user_registration = 2;
+  // disallow_password_auth disallows password authentication.
+  bool disallow_password_auth = 3;
+  // additional_script is the additional script.
+  string additional_script = 4;
+  // additional_style is the additional style.
+  string additional_style = 5;
+  // custom_profile is the custom profile.
+  InstanceCustomProfile custom_profile = 6;
+  // week_start_day_offset is the week start day offset from Sunday.
+  // 0: Sunday, 1: Monday, 2: Tuesday, 3: Wednesday, 4: Thursday, 5: Friday, 6: Saturday
+  // Default is Sunday.
+  int32 week_start_day_offset = 7;
+  // disallow_change_username disallows changing username.
+  bool disallow_change_username = 8;
+  // disallow_change_nickname disallows changing nickname.
+  bool disallow_change_nickname = 9;
+}
+
+message InstanceCustomProfile {
+  string title = 1;
+  string description = 2;
+  string logo_url = 3;
+}
+
+message InstanceStorageSetting {
+  enum StorageType {
+    STORAGE_TYPE_UNSPECIFIED = 0;
+    // STORAGE_TYPE_DATABASE is the database storage type.
+    DATABASE = 1;
+    // STORAGE_TYPE_LOCAL is the local storage type.
+    LOCAL = 2;
+    // STORAGE_TYPE_S3 is the S3 storage type.
+    S3 = 3;
+  }
+  // storage_type is the storage type.
+  StorageType storage_type = 1;
+  // The template of file path.
+  // e.g. assets/{timestamp}_{filename}
+  string filepath_template = 2;
+  // The max upload size in megabytes.
+  int64 upload_size_limit_mb = 3;
+  // The S3 config.
+  StorageS3Config s3_config = 4;
+}
+
+// Reference: https://developers.cloudflare.com/r2/examples/aws/aws-sdk-go/
+message StorageS3Config {
+  string access_key_id = 1;
+  string access_key_secret = 2;
+  string endpoint = 3;
+  string region = 4;
+  string bucket = 5;
+  bool use_path_style = 6;
+}
+
+message InstanceMemoRelatedSetting {
+  reserved 2;
+  reserved "display_with_update_time";
+  // content_length_limit is the limit of content length. Unit is byte.
+  int32 content_length_limit = 3;
+  // enable_double_click_edit enables editing on double click.
+  bool enable_double_click_edit = 4;
+  // reactions is the list of reactions.
+  repeated string reactions = 7;
+}
+
+message InstanceTagMetadata {
+  // Optional background color for the tag label.
+  // When unset, the default tag color is used.
+  google.type.Color background_color = 1;
+  // Whether memos with this tag should have their content blurred.
+  bool blur_content = 2;
+}
+
+message InstanceTagsSetting {
+  // Map of tag name pattern to tag metadata.
+  // Each key is treated as an anchored regular expression (^pattern$),
+  // so a single entry like "project/.*" matches all tags under that prefix.
+  // Exact tag names are also valid (they are trivially valid regex patterns).
+  map<string, InstanceTagMetadata> tags = 1;
+}
+
+message InstanceNotificationSetting {
+  EmailSetting email = 1;
+
+  message EmailSetting {
+    bool enabled = 1;
+    string smtp_host = 2;
+    int32 smtp_port = 3;
+    string smtp_username = 4;
+    string smtp_password = 5;
+    string from_email = 6;
+    string from_name = 7;
+    string reply_to = 8;
+    bool use_tls = 9;
+    bool use_ssl = 10;
+  }
+}
+
+message InstanceAISetting {
+  // providers is the list of AI provider configurations available instance-wide.
+  repeated AIProviderConfig providers = 1;
+
+  // transcription is the speech-to-text feature configuration.
+  // When unset or transcription.provider_id is empty, transcription is disabled.
+  TranscriptionConfig transcription = 2;
+}
+
+message AIProviderConfig {
+  string id = 1;
+  string title = 2;
+  AIProviderType type = 3;
+  string endpoint = 4;
+  // api_key is write-only at the API layer and is required by the server to call providers.
+  string api_key = 5;
+}
+
+enum AIProviderType {
+  AI_PROVIDER_TYPE_UNSPECIFIED = 0;
+  OPENAI = 1;
+  GEMINI = 2;
+}
+
+// TranscriptionConfig configures the speech-to-text feature.
+message TranscriptionConfig {
+  // provider_id references an entry in InstanceAISetting.providers[].id.
+  // Empty string means transcription is disabled.
+  string provider_id = 1;
+
+  // model is the provider-specific model identifier.
+  // Empty string falls back to the engine default.
+  // OPENAI examples:
+  //   - whisper-1 (legacy, lower cost)
+  //   - gpt-4o-transcribe, gpt-4o-mini-transcribe (higher quality)
+  //   - gpt-4o-transcribe-diarize (includes speaker labels)
+  // GEMINI examples:
+  //   - gemini-2.5-flash (default, multimodal call)
+  //   - gemini-2.5-pro
+  string model = 2;
+
+  // language is the default ISO 639-1 language hint sent to the provider.
+  // Empty string lets the provider auto-detect.
+  string language = 3;
+
+  // prompt is a default spelling/vocabulary hint passed to the provider.
+  // Used as the OpenAI Whisper "prompt" parameter (a soft hint that the model
+  // may ignore) and folded into the Gemini generation prompt as a "Context and
+  // spelling hints" block (which the LLM will treat more literally).
+  string prompt = 4;
+}

proto/store/memo.proto

@@ -0,0 +1,29 @@
+syntax = "proto3";
+
+package memos.store;
+
+option go_package = "gen/store";
+
+message MemoPayload {
+  Property property = 1;
+
+  Location location = 2;
+
+  repeated string tags = 3;
+
+  // The calculated properties from the memo content.
+  message Property {
+    bool has_link = 1;
+    bool has_task_list = 2;
+    bool has_code = 3;
+    bool has_incomplete_tasks = 4;
+    // The title extracted from the first H1 heading, if present.
+    string title = 5;
+  }
+
+  message Location {
+    string placeholder = 1;
+    double latitude = 2;
+    double longitude = 3;
+  }
+}

proto/store/user_setting.proto

@@ -0,0 +1,113 @@
+syntax = "proto3";
+
+package memos.store;
+
+import "google/protobuf/timestamp.proto";
+
+option go_package = "gen/store";
+
+message UserSetting {
+  enum Key {
+    KEY_UNSPECIFIED = 0;
+    // General user settings.
+    GENERAL = 1;
+    // The shortcuts of the user.
+    SHORTCUTS = 4;
+    // The webhooks of the user.
+    WEBHOOKS = 5;
+    // Refresh tokens for the user.
+    REFRESH_TOKENS = 6;
+    // Personal access tokens for the user.
+    PERSONAL_ACCESS_TOKENS = 7;
+  }
+
+  int32 user_id = 1;
+
+  Key key = 2;
+  oneof value {
+    GeneralUserSetting general = 3;
+    ShortcutsUserSetting shortcuts = 6;
+    WebhooksUserSetting webhooks = 7;
+    RefreshTokensUserSetting refresh_tokens = 8;
+    PersonalAccessTokensUserSetting personal_access_tokens = 9;
+  }
+}
+
+message GeneralUserSetting {
+  // The user's locale.
+  string locale = 1;
+  // The user's memo visibility setting.
+  string memo_visibility = 2;
+  // The user's theme preference.
+  // This references a CSS file in the web/public/themes/ directory.
+  string theme = 3;
+}
+
+message RefreshTokensUserSetting {
+  message RefreshToken {
+    // Unique identifier (matches 'tid' claim in JWT)
+    string token_id = 1;
+    // When the token expires
+    google.protobuf.Timestamp expires_at = 2;
+    // When the token was created
+    google.protobuf.Timestamp created_at = 3;
+    // Client information for session management UI
+    ClientInfo client_info = 4;
+    // Optional description
+    string description = 5;
+  }
+
+  message ClientInfo {
+    // User agent string of the client.
+    string user_agent = 1;
+    // IP address of the client.
+    string ip_address = 2;
+    // Optional. Device type (e.g., "mobile", "desktop", "tablet").
+    string device_type = 3;
+    // Optional. Operating system (e.g., "iOS 17.0", "Windows 11").
+    string os = 4;
+    // Optional. Browser name and version (e.g., "Chrome 119.0").
+    string browser = 5;
+  }
+
+  repeated RefreshToken refresh_tokens = 1;
+}
+
+message PersonalAccessTokensUserSetting {
+  message PersonalAccessToken {
+    // Unique identifier for this token
+    string token_id = 1;
+    // SHA-256 hash of the actual token
+    string token_hash = 2;
+    // User-provided description
+    string description = 3;
+    // When the token expires (null = never)
+    google.protobuf.Timestamp expires_at = 4;
+    // When the token was created
+    google.protobuf.Timestamp created_at = 5;
+    // When the token was last used
+    google.protobuf.Timestamp last_used_at = 6;
+  }
+  repeated PersonalAccessToken tokens = 1;
+}
+
+message ShortcutsUserSetting {
+  message Shortcut {
+    string id = 1;
+    string title = 2;
+    string filter = 3;
+  }
+  repeated Shortcut shortcuts = 1;
+}
+
+message WebhooksUserSetting {
+  message Webhook {
+    // Unique identifier for the webhook
+    string id = 1;
+    // Descriptive title for the webhook
+    string title = 2;
+    // The webhook URL endpoint
+    string url = 3;
+  }
+  repeated Webhook webhooks = 1;
+}