@omelhorsite/sdk 0.2.0 → 0.4.0

package/dist/types/internal/attachments.d.ts

@@ -0,0 +1,17 @@
+/** Attachment helpers shared by the message families. Not part of the public surface. */
+import type { ApiClient } from "../http";
+import type { FileInput, NativeFile, RequestOptions } from "../types";
+/**
+ * Byte length of an attachment, when it is knowable without reading anything.
+ * `undefined` for a stream with no declared `size` and for a picker that
+ * reported none.
+ */
+export declare function attachmentSize(file: FileInput | NativeFile): number | undefined;
+/**
+ * Follows an attachment redirect. In a browser in cookie mode the redirect
+ * to object storage fails CORS and surfaces as a bare network error; that
+ * case is turned into an error that says what to do instead.
+ */
+export declare function followAttachment(http: ApiClient, path: string, what: string, options: RequestOptions): Promise<Blob>;
+/** The bearer token the transport would send, or `null` when there is none (cookie mode). */
+export declare function tokenOf(http: ApiClient): Promise<string | null>;

package/dist/types/internal/helpers.d.ts

@@ -0,0 +1,9 @@
+/** Small helpers shared by resource modules. Not part of the public surface. */
+/** Fails fast on a value the server would answer for with a framework error. */
+export declare function assertPresent(field: string, value: string): void;
+/** Copies the keys that were supplied; `undefined` is skipped, an explicit `null` is kept. */
+export declare function pickOptional<T extends object>(source: T, keys: readonly (keyof T & string)[]): Record<string, unknown>;
+/** Normalises a scope list given as an array or as a space/comma separated string. */
+export declare function scopeList(scopes: readonly string[] | string): string[];
+/** Path-safe form of an integer id. */
+export declare function idSegment(id: number): string;

package/dist/types/listing.d.ts

@@ -0,0 +1,90 @@
+/**
+ * The listing query language every `list()` in the SDK accepts.
+ *
+ * | wire                       | meaning                                                   |
+ * |----------------------------|-----------------------------------------------------------|
+ * | `search[col]=v`            | partial match; strings are accent- and case-insensitive   |
+ * | `exact_search[col]=v`      | equality; an array is `IN (...)`, `null` is `IS NULL`     |
+ * | `modifiers[page]=N:SIZE`   | 1-based page, `SIZE` capped at 500                        |
+ * | `modifiers[order]=col:asc` | sort; an unknown column is ignored                        |
+ * | `modifiers[random]=true`   | random order; replaces any sort and disables the `ETag`   |
+ * | `extra_options[key]=v`     | endpoint-specific filters, typed per resource             |
+ *
+ * Filter keys are validated by the server: a column outside the endpoint's
+ * allowlist is a `400`, never a wider result. Each resource names its columns
+ * as a string-literal union so the mistake is caught at compile time instead.
+ *
+ * Column TYPES are not visible to the compiler. `search` on a number or date
+ * column is an exact `IN`, not a prefix; on a string column it compares
+ * lower-cased, accent-stripped slugs on both sides.
+ */
+import type { PageParams, Paginated, QueryParams } from "./types";
+/** Columns every listing accepts in `search` and `exactSearch`, whatever else it declares. */
+export declare const BASE_FILTER_COLUMNS: readonly ["id", "created_at", "updated_at"];
+/** One of {@link BASE_FILTER_COLUMNS}. */
+export type BaseFilterColumn = (typeof BASE_FILTER_COLUMNS)[number];
+/** The scalar half of {@link FilterValue}. A `Date` is sent as ISO-8601. */
+export type FilterScalar = string | number | boolean | Date | null;
+/**
+ * A filter value. An array is `IN (...)` under `exactSearch` and an OR of
+ * partial matches under `search`; `null` means `IS NULL` (only `exactSearch`
+ * can express it); `undefined` is not sent.
+ */
+export type FilterValue = FilterScalar | readonly FilterScalar[] | undefined;
+/** Filters keyed by column. `string` is the untyped escape hatch. */
+export type FilterBag<Column extends string = string> = {
+    readonly [K in Column]?: FilterValue;
+};
+/**
+ * The parameters every `list()` accepts. Resources extend this with their
+ * column union, their `extra_options` shape, and camelCased shortcuts.
+ *
+ * Shortcuts and buckets may name the same column; the bucket wins, key by
+ * key, so `{ userId: "a", exactSearch: { user_id: "b" } }` sends `b`.
+ *
+ * @typeParam Column columns accepted in `search` / `exactSearch`, on top of
+ *   {@link BaseFilterColumn}.
+ * @typeParam Extra the `extra_options` shape. Defaults to `never`, which makes
+ *   `extraOptions` unsettable on the endpoints that declare none.
+ */
+export interface ListParams<Column extends string = string, Extra extends object = never> extends PageParams {
+    /** Partial match per column. */
+    readonly search?: FilterBag<Column | BaseFilterColumn>;
+    /** Equality per column. Use it for ids, enums and foreign keys. */
+    readonly exactSearch?: FilterBag<Column | BaseFilterColumn>;
+    /**
+     * Random order. The shuffle is redrawn on every request, so pages overlap;
+     * use it for "give me N rows", not for walking a listing.
+     */
+    readonly random?: boolean;
+    /** Endpoint-specific filters. Typed per resource. */
+    readonly extraOptions?: Extra;
+}
+/** What a resource adds to a caller's {@link ListParams} before encoding. */
+export interface ListQueryBase {
+    /** Sort applied when the caller gave none. */
+    readonly order?: string;
+    /** Shortcut-derived `search` keys. The caller's bucket wins. */
+    readonly search?: FilterBag;
+    /** Shortcut-derived `exact_search` keys. The caller's bucket wins. */
+    readonly exactSearch?: FilterBag;
+    /** Shortcut-derived `extra_options` keys. The caller's bucket wins. */
+    readonly extraOptions?: FilterBag;
+    /** Top-level query keys outside the DSL, copied verbatim. */
+    readonly top?: QueryParams;
+}
+/** The page a loader is asked for. */
+export interface PageAt {
+    readonly page: number;
+    readonly pageSize: number;
+}
+/**
+ * Encodes one page of a listing as a query bag. Pass `at: undefined` for an
+ * endpoint that must see the whole scope rather than a page.
+ */
+export declare function listQuery(params: ListParams<string, object>, at: PageAt | undefined, base?: ListQueryBase): QueryParams;
+/**
+ * Loads the first page of a listing and returns it as a {@link Paginated}
+ * whose `next()` fetches the following pages at the same size.
+ */
+export declare function paginate<T>(params: PageParams, defaultPageSize: number, load: (at: PageAt) => Promise<readonly T[] | undefined>): Promise<Paginated<T>>;

package/dist/types/resources/account.d.ts

@@ -7,7 +7,8 @@
  * that a stored credential is still alive.
  */
 import { type ApiClient, Resource } from "../http";
-import type { BaseRecord, FileInput, Id, Paginated, PageParams, RequestOptions, Timestamp } from "../types";
+import type { ListParams } from "../listing";
+import type { BaseRecord, FileInput, Id, Paginated, RequestOptions, Timestamp } from "../types";
 /**
  * A user as the API renders them.
  *
@@ -178,8 +179,10 @@ export interface AccountSession extends BaseRecord {
     /** The owner, rendered inline. */
     readonly user?: User;
 }
+/** Filter columns of `GET /sessions`, on top of {@link BASE_FILTER_COLUMNS}. */
+export declare const ACCOUNT_SESSION_FILTER_COLUMNS: readonly ["user_id"];
 /** Filters for {@link AccountSessionsNamespace.list}. */
-export interface ListAccountSessionsParams extends PageParams {
+export interface ListAccountSessionsParams extends ListParams<(typeof ACCOUNT_SESSION_FILTER_COLUMNS)[number]> {
     /** Administrators only: someone else's sessions. */
     readonly userId?: Id;
 }
@@ -283,11 +286,74 @@ export declare class AccountNamespace extends Resource {
     /**
      * `GET /users/:id/picture` - the avatar bytes.
      *
-     * Answers 302 towards object storage and `fetch` follows it; the platform
-     * drops `Authorization` on the cross-origin hop, so the credential never
-     * reaches the storage host. Answers 404 when the user has no avatar.
+     * SENT WITH NO CREDENTIAL AT ALL, and that is the point of this method rather
+     * than an oversight.
+     *
+     * The endpoint is anonymous by design: `UsersController` lists `picture` in
+     * `allow_unauthenticated_access`, and `User.viewable_by` is `->(user) { all }`,
+     * so a signed-in caller and a stranger resolve the same row and get the same
+     * bytes. Sending a credential buys nothing, and it is what breaks the call.
+     *
+     * Why it breaks. The action answers `302` to `minio.omelhorsite.pt` with a
+     * presigned URL, and `fetch` follows that hop. Per the Fetch standard, when a
+     * CORS request is redirected cross-origin and the request's origin already
+     * differs from the current URL's origin, the origin is replaced by an opaque
+     * one - so the second hop reaches the store with `Origin: null`. MinIO
+     * answers a null origin with `Access-Control-Allow-Origin: *`. A wildcard is
+     * illegal for a credentialed request no matter what
+     * `Access-Control-Allow-Credentials` says, so a client built with
+     * `sessionCookie: true` - the production web app - would have the browser
+     * reject the response before any JavaScript saw it. Every avatar on the page
+     * would fail, and fail as an opaque "Failed to fetch".
+     *
+     * Dropping the credential removes the wildcard problem entirely: an
+     * uncredentialed request accepts `*`, so this behaves identically in a
+     * browser, in Bun and in a Worker, in cookie mode and in token mode.
+     *
+     * Going around the transport costs the usual thing, the same trade
+     * `storage.download` makes: no retry, no per-call deadline, and only the
+     * caller's `signal` is honoured.
+     *
+     * Prefer {@link pictureUrl} when the avatar is going into an `<img>`. This
+     * method is for when the bytes themselves are wanted - a re-upload, a cache,
+     * a file written to disk.
+     *
+     * @throws {OmsApiError} 404 when the user does not exist OR has no avatar
+     *   attached. The two are not distinguishable from the status alone.
      */
     picture(id: Id, options?: RequestOptions): Promise<Blob>;
+    /**
+     * Absolute URL of a user's avatar, for an `<img>`, a CSS `background-image`,
+     * or anywhere else the platform fetches the bytes for you.
+     *
+     * Synchronous, and it has to stay that way. This gets called once per row
+     * while rendering a friends list, a member picker or a message thread; an
+     * async URL would turn every avatar into a state update and a second paint.
+     *
+     * It can be synchronous because the route carries no credential: `picture` is
+     * in `allow_unauthenticated_access` and `User.viewable_by` is `all`, so there
+     * is nothing to resolve and nothing to leak. The URL is safe to put in
+     * markup, to log, and to hand to someone else.
+     *
+     * ```tsx
+     * <img src={oms.account.pictureUrl(user.id)} alt={user.handle} />
+     * ```
+     *
+     * Do NOT add a `crossorigin` attribute. Without one the element makes a
+     * no-cors request and the `302` to the object store is followed with no CORS
+     * check at all, which is why this path has always worked in the web app.
+     * `crossorigin="use-credentials"` re-creates exactly the failure
+     * {@link picture} documents, and `crossorigin="anonymous"` only buys the
+     * ability to read the pixels back out of a canvas.
+     *
+     * A user with no avatar answers 404, so give the element an `onError` that
+     * falls back to initials rather than assuming every id has an image.
+     *
+     * The `302` itself carries `Cache-Control: private, max-age=300` while the
+     * presigned target is good for six hours, so a re-render inside five minutes
+     * costs nothing and a cached redirect can never outlive its signature.
+     */
+    pictureUrl(id: Id): string;
     /** `POST /users/:id/follow` - returns the followed user's updated profile. */
     follow(id: Id, options?: RequestOptions): Promise<UserProfile>;
     /**

package/dist/types/resources/admin/authorizedApplications.d.ts

@@ -0,0 +1,133 @@
+/** `oms.admin.authorizedApplications` - the applications you gave access to your account. */
+import { Resource } from "../../http";
+import type { RequestOptions, Timestamp } from "../../types";
+import type { OauthApprovalStatus } from "./types";
+/**
+ * An application holding a live token for YOUR account.
+ *
+ * This is OAuth going OUT (a third party acting in your account), which is the
+ * opposite direction from {@link LinkedIdentity} - logging IN with Google or
+ * Spotify. Two things with similar names that live in the same settings tab.
+ */
+export interface AuthorizedApplication {
+    /**
+     * The **application** id, not a token id, and an integer like every
+     * `oauth_applications` primary key. Revocation is per client on purpose: a
+     * person thinks "stop that application", not "kill token 4712".
+     */
+    readonly id: number;
+    readonly client_id: string;
+    readonly name: string;
+    /**
+     * The scopes of **your tokens**, not of the client's registration.
+     *
+     * The question this list answers is "what can that application do in MY
+     * account", and a client registered for eight scopes may hold a token for
+     * two. The union across your tokens, ordered by the server's own scope list
+     * so the same set always renders in the same order whatever order the client
+     * asked in.
+     */
+    readonly scopes: string[];
+    /**
+     * The client's CURRENT review state, which is not the same question as
+     * whether it has access.
+     *
+     * A client that was approved and later rejected still holds live tokens until
+     * they expire, and this listing shows them: it queries the token table
+     * directly and never goes through the approval gate, because the person whose
+     * account it is has more right to see the access than anyone.
+     */
+    readonly approval_status: OauthApprovalStatus;
+    /**
+     * True for a client this project SHIPS, read off the pinned `client_id` list
+     * (`oms-cli`, `oms-mcp`) rather than off `owner_id IS NULL`.
+     *
+     * The backend deliberately uses the pinned list here, because NULL owner also
+     * means "orphaned when its owner deleted their account", and this is the
+     * screen where a person decides what to cut off. {@link isShippedClient}
+     * computes the same answer from `client_id` alone.
+     */
+    readonly first_party: boolean;
+    /**
+     * How many unrevoked tokens this client holds for you.
+     *
+     * "Unrevoked", NOT "unexpired", and the difference matters: refresh tokens
+     * are on, and a row whose two-hour access token expired an hour ago still
+     * buys a fresh one on demand. Counting only unexpired rows would hide exactly
+     * the access that most needs revoking.
+     */
+    readonly token_count: number;
+    /**
+     * `created_at` of the most recent of those tokens, `null` if there are none.
+     *
+     * Read it as "last time this renewed its access", NOT as "authorised since":
+     * every refresh writes a new token row, so this moves forward on its own
+     * while the client keeps working. The list is sorted by this, newest first.
+     */
+    readonly last_authorized_at: Timestamp | null;
+}
+/** What {@link AuthorizedApplicationsNamespace.revoke} answers with. */
+export interface AuthorizedApplicationRevocation {
+    /** The application id you asked about, echoed back. */
+    readonly id: number;
+    /** How many live tokens were killed. `0` when there was nothing to kill. */
+    readonly revoked_tokens: number;
+}
+/**
+ * `oms.admin.authorizedApplications` - "which applications have access to my
+ * account", and the button that takes it away.
+ *
+ * Any authenticated user, about their own account only. Nothing here can touch
+ * another person's grants: every write is filtered by BOTH the application id
+ * and the caller, so an id belonging to somebody else's client can only ever
+ * revoke rows the caller owns, which is none.
+ *
+ * Without this pair of calls, consent would be a one-way door: the device
+ * approval page hands out a credential that outlives the browser session, and
+ * every consent screen in this product promises the access can be withdrawn
+ * later from account settings. These two calls are that promise.
+ */
+export declare class AuthorizedApplicationsNamespace extends Resource {
+    /**
+     * `GET /authorized_applications` - every application holding a live token for
+     * you, most recently renewed first.
+     *
+     * Always `200`, `[]` included. No pagination: this list has units, not pages.
+     * The response is enveloped and this method unwraps it.
+     *
+     * The listing does NOT filter by approval state. See
+     * {@link AuthorizedApplication.approval_status}.
+     */
+    list(options?: RequestOptions): Promise<AuthorizedApplication[]>;
+    /**
+     * `DELETE /authorized_applications/:id` - cuts one application off your
+     * account.
+     *
+     * **Idempotent by construction, and it never answers `404`.** Revoking access
+     * that is already gone is a `200` with `revoked_tokens: 0`: your intent
+     * ("this must not have access") is satisfied either way, and a `404` for an
+     * unknown id would answer "does this client exist?" to anyone willing to
+     * count upwards. So a `200` here does not prove the client existed.
+     *
+     * **What actually dies**, which is more than it looks:
+     *
+     * - every unrevoked access token of yours for that client. A refresh token is
+     *   not a row of its own in this system, it is a column ON the access token
+     *   row, so revoking the row kills the refresh token with it. That is the
+     *   whole point: a half-done revoke leaves the client walking back in on its
+     *   next refresh;
+     * - every access grant of yours for it;
+     * - every device grant you already approved but whose client has not polled
+     *   the token endpoint yet. Those are tokens waiting to be minted and are
+     *   easy to forget, so they are deleted outright - a missing device code is
+     *   the terminal `invalid_grant` a polling client needs to see.
+     *
+     * Strictly your own rows. Killing every grant a client holds across all users
+     * is an administrator's action
+     * ({@link AdminOauthApplicationsNamespace.revokeTokens}).
+     *
+     * The tokens are counted BEFORE the writes, because afterwards there is
+     * nothing left to count.
+     */
+    revoke(id: number | string, options?: RequestOptions): Promise<AuthorizedApplicationRevocation>;
+}

package/dist/types/resources/admin/chests.d.ts

@@ -0,0 +1,51 @@
+/** `oms.admin.chests` - aggregate chest statistics. Administrators only. */
+import { Resource } from "../../http";
+import type { RequestOptions } from "../../types";
+import type { AdminDailyCount } from "./types";
+/** What {@link AdminChestsNamespace.stats} answers with. Counts only, never a chest. */
+export interface AdminChestStats {
+    /** Chests that have not expired. */
+    readonly active_count: number;
+    /** Creation is refused server-wide once `active_count` reaches it. */
+    readonly active_limit: number;
+    /** Entries in active chests, split by kind. */
+    readonly entries_file: number;
+    readonly entries_note: number;
+    /** Sum of `current_size` across active chests. */
+    readonly active_size_bytes: number;
+    readonly created_last_1h: number;
+    readonly created_last_24h: number;
+    readonly created_last_7d: number;
+    /** Rounded to two decimals; `0` when there are no active chests. */
+    readonly avg_entries_per_chest: number;
+    /** Rounded to whole bytes; `0` when there are no active chests. */
+    readonly avg_chest_size_bytes: number;
+    /** Active chests with an owner, and without one. */
+    readonly active_auth_count: number;
+    readonly active_anon_count: number;
+    /** Active chests expiring within the next 15 minutes. */
+    readonly expiring_soon: number;
+    /**
+     * Creations per day. Counted over ALL chests, expired ones included, unlike
+     * every other number here.
+     */
+    readonly creations_daily: AdminDailyCount[];
+}
+/**
+ * `oms.admin.chests` - **administrators only**. Aggregate chest statistics.
+ *
+ * `stats` is the ONLY route: there is no admin listing of chests and no way to
+ * read one from here. A chest is opened by knowing its code, and the admin
+ * surface deliberately does not become a second way in.
+ */
+export declare class AdminChestsNamespace extends Resource {
+    /**
+     * `GET /admin/chests/stats`.
+     *
+     * Several full-table aggregates in one request. Cheap enough for a dashboard,
+     * not cheap enough for a tight poll.
+     *
+     * @throws {OmsAuthError} 403 for a non-admin.
+     */
+    stats(options?: RequestOptions): Promise<AdminChestStats>;
+}

package/dist/types/resources/admin/eventAlerts.d.ts

@@ -0,0 +1,60 @@
+/** `oms.admin.eventAlerts` - the Discord alert catalogue. Administrators only. */
+import { Resource } from "../../http";
+import type { RequestOptions } from "../../types";
+/** One event in the alert catalogue. */
+export interface AdminEventAlert {
+    /** Stable identifier, e.g. `"oauth_client_created"`. */
+    readonly event: string;
+    /** Short human label. */
+    readonly label: string;
+    /** What the event means and when it fires. */
+    readonly description: string;
+    /**
+     * The fields the Discord message carries, in order. Always starts with
+     * `"Actor"`, and when {@link AdminEventAlert.includes_geo} is true the next
+     * three are `"IP"`, `"Country"` and `"Network"`.
+     */
+    readonly fields: string[];
+    /** Whether the message carries the actor's IP and its geo enrichment. */
+    readonly includes_geo: boolean;
+    /** Whether this particular event is currently switched on. */
+    readonly enabled: boolean;
+}
+/**
+ * What {@link AdminEventAlertsNamespace.list} answers with.
+ *
+ * Self-describing on purpose: the catalogue is built by the server, so adding
+ * or removing an event needs no client change. Render the array, do not
+ * hardcode the events.
+ */
+export interface AdminEventAlertsCatalog {
+    /** Whether alerts are actually being sent right now. */
+    readonly delivering: boolean;
+    /**
+     * Whether a webhook URL is configured at all.
+     *
+     * The two booleans are not the same question, and the pair is the diagnosis:
+     * `webhook_configured: false` means nothing was ever set up, while
+     * `webhook_configured: true` with `delivering: false` means it is configured
+     * and switched off (a non-production environment, typically).
+     */
+    readonly webhook_configured: boolean;
+    readonly events: AdminEventAlert[];
+}
+/**
+ * `oms.admin.eventAlerts` - **administrators only**. The catalogue of activity
+ * alerts sent to Discord.
+ *
+ * Read-only, and there is exactly one route. Nothing here switches an event on
+ * or off: `enabled` is decided by the server's configuration, and the only way
+ * to change it is to change that. This answers "what would be reported, and is
+ * anything being reported at all".
+ */
+export declare class AdminEventAlertsNamespace extends Resource {
+    /**
+     * `GET /admin/event_alerts`.
+     *
+     * @throws {OmsAuthError} 403 for a non-admin.
+     */
+    list(options?: RequestOptions): Promise<AdminEventAlertsCatalog>;
+}

package/dist/types/resources/admin/identities.d.ts

@@ -0,0 +1,99 @@
+/** `oms.admin.identities` - the social logins linked to your account. */
+import { Resource } from "../../http";
+import type { ListParams } from "../../listing";
+import type { Id, Paginated, RequestOptions, Timestamp } from "../../types";
+/** The identity providers this server accepts. */
+export declare const IDENTITY_PROVIDERS: readonly ["google_oauth2", "github", "spotify"];
+/**
+ * One of {@link IDENTITY_PROVIDERS}. Note `"google_oauth2"`, not `"google"`:
+ * it is the exact value the server stores and matches on.
+ */
+export type IdentityProvider = (typeof IDENTITY_PROVIDERS)[number];
+/**
+ * A social login linked to your account.
+ *
+ * This is OAuth coming IN - signing in with Google, GitHub or Spotify - and it
+ * is the opposite direction from {@link AuthorizedApplication}.
+ *
+ * Seven fields and NOTHING else, which is the interesting part: the server also
+ * holds `uid`, `oauth_token`, `oauth_refresh_token`, `oauth_expires_at` and the
+ * entire `raw_info` payload from the provider, and none of them cross the wire.
+ * There is no endpoint that will hand you a provider token.
+ */
+export interface LinkedIdentity {
+    /** A **string** id, 12 characters. `identities` is not one of the integer tables. */
+    readonly id: Id;
+    readonly provider: IdentityProvider;
+    /**
+     * The address the provider asserted, or `null` when it asserted none.
+     *
+     * Not necessarily the account's own email, and never proof of it: linking a
+     * provider to an existing account does not touch `email_verified_at`.
+     */
+    readonly email: string | null;
+    /** Display name from the provider, or `null`. */
+    readonly name: string | null;
+    /** Provider avatar URL, or `null`. A remote URL, not something this API serves. */
+    readonly avatar_url: string | null;
+    readonly created_at: Timestamp;
+    readonly updated_at: Timestamp;
+}
+/** Filter columns of `GET /identities`, on top of {@link BASE_FILTER_COLUMNS}. */
+export declare const LINKED_IDENTITY_FILTER_COLUMNS: readonly ["user_id"];
+/** Filters for {@link LinkedIdentitiesNamespace.list}. */
+export interface ListLinkedIdentitiesParams extends ListParams<(typeof LINKED_IDENTITY_FILTER_COLUMNS)[number]> {
+    /** Defaults to `"created_at:desc"`. */
+    readonly order?: string;
+}
+/**
+ * `oms.admin.identities` - the Google, GitHub and Spotify logins linked to
+ * YOUR account.
+ *
+ * Any authenticated user, and strictly their own rows: the listing is narrowed
+ * to the caller and being an administrator buys nothing extra here. There is no
+ * admin view of other people's identities anywhere in this API.
+ *
+ * **Linking a new provider is not in this SDK and cannot be.** It is a browser
+ * redirect flow (`GET /auth/link/:provider` into the provider and back through
+ * `/auth/:provider/callback`), it depends on a single-use nonce held in a
+ * server-side session, and it ends by redirecting to an allowlisted origin or
+ * to the `omsmusic://` scheme. A host that needs it opens a browser; there is
+ * nothing here to call. UNLINKING, which is the destructive half, is
+ * {@link destroy}.
+ */
+export declare class LinkedIdentitiesNamespace extends Resource {
+    /**
+     * `GET /identities` - your linked providers.
+     *
+     * A bare JSON array, not an envelope, unlike the two OAuth application
+     * listings above. This one goes through the generic list DSL, so it paginates
+     * (default page size applies even when you do not ask) and it answers ETag
+     * and `304`.
+     *
+     * In practice this returns at most three rows, one per provider, since
+     * `(provider, uid)` is unique and a person has one account per provider. The
+     * pagination is the framework's, not a hint that the list is long.
+     */
+    list(params?: ListLinkedIdentitiesParams, options?: RequestOptions): Promise<Paginated<LinkedIdentity>>;
+    /**
+     * `DELETE /identities/:id` - unlinks a provider. Answers `204`, empty.
+     *
+     * Only your own: the row is looked up inside your own scope, so somebody
+     * else's identity id is a `404` and never a `403`.
+     *
+     * **This is the last-credential footgun.** Nothing here checks that you still
+     * have another way in. An account created through a provider gets a random
+     * UUID as its password, which nobody knows, so unlinking the only identity on
+     * such an account can lock it out until a password reset is done through
+     * email. Check what else the account has - a password, a passkey, another
+     * provider - before calling this.
+     *
+     * It does not revoke anything at the provider, and it does not touch the
+     * sessions that identity was used to create. Those keep working; this only
+     * removes the link.
+     *
+     * @throws {OmsApiError} 404 `"Resource not found"` (a bare JSON string, not
+     *   the structured body the `/oauth_applications` routes use).
+     */
+    destroy(id: Id, options?: RequestOptions): Promise<void>;
+}

package/dist/types/resources/admin/index.d.ts

@@ -0,0 +1,77 @@
+/** The `admin` namespace: OAuth client management and the operator surface. */
+import { Resource } from "../../http";
+import { AuthorizedApplicationsNamespace } from "./authorizedApplications";
+import { AdminChestsNamespace } from "./chests";
+import { AdminEventAlertsNamespace } from "./eventAlerts";
+import { LinkedIdentitiesNamespace } from "./identities";
+import { AdminJobsNamespace } from "./jobs";
+import { MyOauthApplicationsNamespace } from "./myOauthApplications";
+import { AdminNotepadsNamespace } from "./notepads";
+import { AdminOauthApplicationsNamespace } from "./oauthApplications";
+import { AdminQuotasNamespace } from "./quotas";
+import { AdminShortLinksNamespace } from "./shortLinks";
+import { AdminVocalSeparationsNamespace } from "./vocalSeparations";
+export * from "./authorizedApplications";
+export * from "./chests";
+export * from "./eventAlerts";
+export * from "./identities";
+export * from "./jobs";
+export * from "./myOauthApplications";
+export * from "./notepads";
+export * from "./oauthApplications";
+export * from "./quotas";
+export * from "./shortLinks";
+export * from "./types";
+export * from "./vocalSeparations";
+/**
+ * The `admin` namespace, reachable as `oms.admin`.
+ *
+ * A container and nothing else: it has no methods of its own, because the
+ * eleven routes underneath it answer to three different publics and putting a
+ * bare `list()` here would hide which one a caller had reached. Read the module
+ * documentation at the top of this file for the table.
+ *
+ * The short version, and the rule to check a call site against:
+ *
+ * ```ts
+ * // Any authenticated user, about themselves:
+ * await oms.admin.myApplications.list();          // clients I registered
+ * await oms.admin.authorizedApplications.list();  // apps I gave access to
+ * await oms.admin.identities.list();              // logins linked to my account
+ *
+ * // Administrators only. Everything below answers 403 to everybody else.
+ * await oms.admin.oauthApplications.pending();    // the review queue
+ * await oms.admin.quotas.get("someone");          // somebody else's ceilings
+ * await oms.admin.jobs.list();                    // every job on the server
+ * ```
+ *
+ * A client that is not sure whether the signed-in person is an administrator
+ * should read `group` off `oms.account` once and branch on it, rather than
+ * calling an `/admin/*` route to find out: the `403` is real, cheap to trigger
+ * and easy to mistake for a broken credential.
+ */
+export declare class AdminNamespace extends Resource {
+    /** Your own registered OAuth clients. Any authenticated user. */
+    readonly myApplications: MyOauthApplicationsNamespace;
+    /** Applications holding a token for your account. Any authenticated user. */
+    readonly authorizedApplications: AuthorizedApplicationsNamespace;
+    /** Social logins linked to your account. Any authenticated user. */
+    readonly identities: LinkedIdentitiesNamespace;
+    /** The OAuth client registry and review queue. **Administrators only.** */
+    readonly oauthApplications: AdminOauthApplicationsNamespace;
+    /** Another person's quota ceilings. **Administrators only.** */
+    readonly quotas: AdminQuotasNamespace;
+    /** Every background job on the server. **Administrators only.** */
+    readonly jobs: AdminJobsNamespace;
+    /** Every public short link and its traffic. **Administrators only.** */
+    readonly shortLinks: AdminShortLinksNamespace;
+    /** Every vocal separation run on the server. **Administrators only.** */
+    readonly vocalSeparations: AdminVocalSeparationsNamespace;
+    /** Aggregate chest statistics. **Administrators only.** */
+    readonly chests: AdminChestsNamespace;
+    /** Aggregate notepad statistics. **Administrators only.** */
+    readonly notepads: AdminNotepadsNamespace;
+    /** The Discord alert catalogue. **Administrators only.** */
+    readonly eventAlerts: AdminEventAlertsNamespace;
+    constructor(http: ConstructorParameters<typeof Resource>[0]);
+}