@onplo/sdk 0.0.0-stage → 0.0.1

package/generated/identity.d.ts

@@ -0,0 +1,2492 @@
+export interface paths {
+    "/.well-known/openid-configuration": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read where the sign-in provider is and what it supports
+         * @description THE DISCOVERY DOCUMENT (OpenID Connect Discovery 1.0). Every Onplo app — web, desktop, phone,
+         *     the command line and the agent connector — signs in through identity as an OpenID Connect client
+         *     (architecture decision record 037), and reads this first: where to send a person to sign in,
+         *     where to trade the answer for tokens, and where the keys are that check them.
+         *
+         *     IT NAMES ONLY WHAT IS SUPPORTED: the authorization code with PKCE (`S256`), public clients that
+         *     hold no secret, the `openid` scope, and ID tokens signed ES256. No implicit flow, no password
+         *     grant and no device code (record 037, rule One).
+         *
+         *     SIGNED OUT, because nobody is signed in yet when it is read, and LIMITED by how often it is
+         *     called, never by who calls (decision 0732). It may be kept for five minutes.
+         */
+        get: operations["readProviderDiscovery"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/.well-known/jwks.json": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read the public keys that check the provider's tokens
+         * @description THE KEY SET (RFC 7517): the public half of every key whose ID tokens may still be in a client's
+         *     hands. A client checks an ID token's signature with the key its header names by `kid`.
+         *
+         *     THE PRIVATE HALF NEVER LEAVES ONPLO'S KEY SERVICE: identity asks it to sign, and reads only the
+         *     public half to publish here.
+         *
+         *     ACROSS A ROTATION THERE ARE TWO: the key signing now, and the one before it, kept for at least a
+         *     day after the change, so a token signed just before it is still checked. A `kid` is the key's own
+         *     thumbprint (RFC 7638), so one id never names two keys.
+         *
+         *     SIGNED OUT AND LIMITED, as the discovery document is. It may be kept for five minutes; a client
+         *     that meets a `kid` it does not know reads it again.
+         */
+        get: operations["readProviderKeySet"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/authorize": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Send a person from an app to sign in
+         * @description THE AUTHORIZATION ENDPOINT (OpenID Connect Core §3.1.2, architecture decision record 037). An
+         *     app sends the browser here with its request, and Onplo answers one of three ways:
+         *
+         *     - TO THE SIGN-IN SCREEN, carrying the request, when the app, its return address and every
+         *       field are ones Onplo takes. The screen asks for the passkey, then
+         *       `grantAuthorizationCode` sends the browser back to the app with its code.
+         *     - BACK TO THE APP'S REGISTERED ADDRESS WITH AN OAUTH `error` (RFC 6749 §4.1.2.1), and its
+         *       `state`, when the app and its address are Onplo's but another field is not.
+         *     - NOWHERE, AS A 400 `not_registered`, when the app or its return address is not one Onplo
+         *       lists. A code or an error sent to an address nobody registered is how a sign-in is stolen.
+         *
+         *     THE FIELDS ARE READ BY THE RULES OF `AuthorizationRequest`, not by the parameters' own bounds:
+         *     each is optional here so that a wrong one is answered as OAuth answers it, never as a 422.
+         *
+         *     SIGNED OUT, because nobody is signed in yet, and LIMITED by how often it is called (decision
+         *     0732). It writes nothing.
+         */
+        get: operations["authorizeSignIn"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/passkey-proofs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Ask for the question a passkey answers
+         * @description THE FIRST HALF OF PROVING IT IS YOU. Onplo mints a ceremony and answers
+         *     `request_options`: hand it to the browser's passkey API untouched, and the browser asks
+         *     the person for their fingerprint, face or PIN.
+         *
+         *     USER VERIFICATION IS REQUIRED, ALWAYS. A touch with no fingerprint and no PIN proves a
+         *     device is present, not that the person is.
+         *
+         *     BOUND TO THE SESSION THAT ASKED. The ceremony can be completed only with the same
+         *     credential, so an answer lifted from one session proves nothing in another.
+         *
+         *     SHORT-LIVED AND SINGLE USE. A person who walks away starts again; nothing has to be
+         *     cancelled.
+         *
+         *     A `POST` because every call mints a new ceremony. It takes no body: everything it needs is
+         *     the credential.
+         *
+         *     Not gated: proving it is you is not something a company grants or withholds.
+         */
+        post: operations["startPasskeyProof"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/passkey-proofs/{passkey_proof_id}/completion": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                passkey_proof_id: components["parameters"]["PasskeyProofId"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Bring the passkey's answer back
+         * @description THE SECOND HALF. Send what the browser's passkey API returned, untouched. Onplo checks
+         *     that it answers the question this ceremony asked, on this site, signed by a passkey or
+         *     security key this person holds, with the person verified.
+         *
+         *     WHAT CHANGES IS ONE MOMENT. The session's `proved_at` becomes now — the moment every
+         *     service holds against its own freshness window. The session itself is the same session:
+         *     same credential, same reach, and whatever was on screen is still there.
+         *
+         *     IT WIDENS NOTHING. A fresh proof is what reaching for more demands; it is never the
+         *     reaching itself.
+         *
+         *     ONE ANSWER PER CEREMONY. Completed, refused or expired, a ceremony is spent, and its id
+         *     answers `not_found` from then on — as it does from any other session. The cases are not
+         *     told apart, so nothing is learned by trying ids.
+         *
+         *     A REFUSED ANSWER SAYS ONLY THAT IT WAS REFUSED — `passkey_not_verified`. A wrong
+         *     signature, another site, no user verification, a passkey that is not this person's: saying
+         *     which would teach somebody what to fix. Start a new ceremony.
+         *
+         *     Not gated: proving it is you is not something a company grants or withholds.
+         */
+        post: operations["completePasskeyProof"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/device-tokens": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Trade a statement a device signed for a short-lived token
+         * @description HOW AN ENROLLED DEVICE GETS A CREDENTIAL. At enrolment a device was issued a certificate;
+         *     its private half never leaves the device. Here the device proves it holds that half: it
+         *     signs a short statement and is answered a token, which it then sends as
+         *     `Authorization: Bearer` on its own calls like any other credential.
+         *
+         *     THE STATEMENT IS A STANDARD ONE (decision 0647): a signed JSON Web Token as RFC 7523
+         *     describes a client proving itself with its own key. `iss` and `sub` are both the device
+         *     record's id; `aud` is the full address of this operation; `exp` is when it stops being
+         *     good; `jti` is a value used once. Its header names the certificate by its SHA-256
+         *     thumbprint (`x5t#S256`, RFC 7515). The device never sends the certificate itself: Onplo
+         *     issued it and finds it by that thumbprint.
+         *
+         *     GOOD FOR AT MOST FIVE MINUTES, AND FOR ONE USE. `exp` may be no more than five minutes
+         *     ahead of Onplo's clock, and a `jti` is refused the second time. So a device signs a new
+         *     statement at the moment it sends one — after a week asleep as well — and nothing signed
+         *     earlier is worth keeping.
+         *
+         *     WHAT THE TOKEN IS. It says which device record is calling, in which account environment,
+         *     and nothing else. It lives at most an hour. It ends AT ONCE when the device's certificate
+         *     ends — a retired or un-enrolled device is refused on its next call, not when the hour is
+         *     up. It signs no person in and carries no permission: what a device may call is marked in
+         *     each contract as an operation a device makes about itself.
+         *
+         *     ONE KIND OF KEY IS CERTIFIED: an elliptic-curve key on the P-256 curve (decision 0963). So a
+         *     statement is signed ES256, and one whose header names any other `alg` is not verified. A
+         *     Mac's Secure Enclave and a TPM both make such a key, and it never leaves them.
+         *
+         *     A CERTIFICATE IS VALID FOR 90 DAYS, AND IT IS RENEWED HERE. Every token answers when the
+         *     certificate that signed its statement stops being valid. When 30 days or fewer are left,
+         *     the device makes a NEW key pair and sends a certificate request for it beside its next
+         *     statement; the answer carries the new certificate as well as the token. The old certificate
+         *     stays in force until the first statement the new key signs is traded, and ends then. A
+         *     device that lost that answer sends the same request again and is answered the same
+         *     certificate. A device whose certificate ran out can no longer prove itself here: it is
+         *     enrolled again.
+         *
+         *     TWO REFUSALS, AND ONLY ONE SAYS WHY. `statement_not_verified` covers everything about WHO
+         *     signed it — a certificate Onplo does not know, one that has ended, a signature that does
+         *     not match, another audience, a `jti` already used. They are never told apart, so nothing
+         *     is learned by trying, and a device cannot learn here that it was un-enrolled.
+         *     `statement_outside_its_time` is told apart on purpose: a device with a wrong clock can do
+         *     nothing with "not verified", and every answer's `Date` header carries Onplo's own time to
+         *     set a statement by.
+         *
+         *     A RENEWAL'S REFUSALS ARE TOLD APART, because the statement is judged first and has already
+         *     proved the device by then. `certificate_request_unreadable`: no PKCS #10 request can be
+         *     read from it. `certificate_request_not_signed_by_its_key`: its signature was not made by
+         *     the key inside it. `key_not_certified`: the key is not a P-256 one. `key_ended`: a
+         *     certificate for that key was ended, and such a key is never certified again.
+         *     `key_already_certified`: the key signed this statement, or another device's certificate
+         *     holds it.
+         *
+         *     NO 401, NO 403 AND NO 503: it never asks who is calling, because the statement is the
+         *     whole of the answer to that, so it refuses nobody for a credential and the service that
+         *     would judge one is never asked. An `Authorization` header sent anyway is not read.
+         *
+         *     A `POST` because every call mints a new token.
+         */
+        post: operations["tradeDeviceStatement"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/environment-switches": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Open a session in another environment you are a member of
+         * @description HOW A SIGNED-IN PERSON STEPS INTO ANOTHER COMPANY. A session acts in one environment, so a
+         *     switch opens a NEW session in the one named, and answers its token once. The session that
+         *     asked is not changed and not ended: switching back uses it while it lasts.
+         *
+         *     ONLY A MEMBER, NOW. The person must be a member of that environment at the moment of
+         *     asking, and not suspended there. An environment that does not exist and one the person is
+         *     not a member of are refused alike, `not_a_member`, so nothing is learned by trying ids.
+         *
+         *     A PASSKEY TOUCH FIRST, WHEN ONE IS NEEDED — `passkey_proof_needed`. Reaching an environment
+         *     the sign-in left off needs a touch made in the last five minutes; an environment it chose
+         *     needs only what the company's entering gate asks. Prove it is you on the session you have,
+         *     with `startPasskeyProof` and `completePasskeyProof`, and send the switch again. Signing in
+         *     does not record its chosen environments yet, so today every switch needs the touch.
+         *
+         *     THE NEW SESSION carries the moment of the touch that opened it as its `proved_at`, and it
+         *     ends no later than the session that asked.
+         *
+         *     `503 authorization_unavailable` also when the company's entering gate could not be read:
+         *     whether the switch may proceed is unknown, so it is refused, never let through.
+         *
+         *     A `POST` because every call opens a new session.
+         *
+         *     Not gated: stepping into a company you belong to is not something a role grants.
+         */
+        post: operations["switchEnvironment"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/sign-ins": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Ask for the question a passkey answers to sign in
+         * @description THE FIRST OF THREE CALLS THAT SIGN A PERSON IN. Onplo mints a sign-in and answers
+         *     `request_options`: hand it to the browser's passkey API untouched, and the device shows the
+         *     Onplo accounts it holds a passkey for. The person picks one and is verified by fingerprint,
+         *     face or PIN.
+         *
+         *     NOBODY IS NAMED, AND NO KEY IS LISTED. The call takes no body, so it cannot be asked about
+         *     a username, and `allowCredentials` is always empty: every sign-in is put the same question,
+         *     whoever is asking and whether or not an account exists (decision 0529). Nothing is learned
+         *     by trying. A passkey and a security key alike are made to be found this way when they are
+         *     registered (`startPasskeyRegistration`).
+         *
+         *     A PERSON WHO TYPED A USERNAME sends it with the answer, and an answer from another
+         *     person's passkey is refused exactly as a wrong passkey is.
+         *
+         *     SHORT-LIVED AND SINGLE USE. A person who walks away starts again; nothing has to be
+         *     cancelled.
+         *
+         *     A `POST` because every call mints a new sign-in.
+         */
+        post: operations["startSignIn"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/sign-ins/{sign_in_id}/completion": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sign_in_id: components["parameters"]["SignInId"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Bring the passkey's answer back, and see where you may go
+         * @description THE SECOND CALL. Send what the browser's passkey API returned, untouched. Onplo checks
+         *     that it answers the question this sign-in asked, on this site, signed by a passkey or
+         *     security key Onplo holds, with the person verified. Which person it is, is read from the
+         *     answer's `userHandle`.
+         *
+         *     WHAT IT ANSWERS IS A CHOICE, NOT A SESSION. The person has proved who they are and has not
+         *     chosen where they go (Account → Sign in, step 4): the answer lists the environments they may
+         *     choose (decision 0562) and a `sign_in_token`, good once and for minutes, that opens the
+         *     session they choose (`openSignedInSession`). Nothing is signed in until then.
+         *
+         *     WITH THE DEVICE'S OWN TOKEN, WHEN THE CLIENT HAS ONE. An enrolled device shows the token it
+         *     traded for (`tradeDeviceStatement`) beside the answer, and the session this sign-in opens
+         *     keeps that device (decision 0886): the passkey says who, the device says where. A token that
+         *     is not a live device's is refused `device_token_not_verified`; send the answer again in a new
+         *     sign-in without it, or with a fresh one.
+         *
+         *     A REFUSED ANSWER SAYS ONLY THAT IT WAS REFUSED — `passkey_not_verified`. A wrong signature,
+         *     another site, no user verification, an answer without a `userHandle`, a passkey Onplo does
+         *     not hold, and a username that is not the passkey's are never told apart. The person sees
+         *     "That did not work", whichever it was.
+         *
+         *     ONE ANSWER PER SIGN-IN. Completed, refused or expired, a sign-in is spent, and its id
+         *     answers `not_found` from then on. The cases are not told apart.
+         *
+         *     `503` when the list of environments could not be read: nothing is answered, and the person
+         *     starts again.
+         */
+        post: operations["completeSignIn"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/sign-ins/{sign_in_id}/sessions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sign_in_id: components["parameters"]["SignInId"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Open the session you chose
+         * @description THE THIRD CALL. Send the `sign_in_token` the completion answered, the environments the
+         *     person chose, and the one they land in. Onplo opens ONE session, in that environment, and
+         *     answers its token once.
+         *
+         *     ONE SESSION, IN ONE ENVIRONMENT (decision 0798, rule 3). The other environments chosen are
+         *     recorded on it: switching into one of them later (`switchEnvironment`) asks only the
+         *     company's entering gate, while one left off asks a passkey touch first (decision 0873). So
+         *     "Full access" is every choice sent here, and a session is still opened in only one.
+         *
+         *     WHERE TO LAND is the client's to propose, from the sign-in page's rule: the Personal
+         *     environment, or the most recently used Business one when Personal is off. It must be one of
+         *     the environments chosen.
+         *
+         *     THE SIGN-IN TOKEN IS GOOD ONCE. Used, expired, or not this sign-in's, it answers
+         *     `not_found`, and the cases are not told apart.
+         *
+         *     THE SESSION carries the moment of this sign-in's passkey touch as its `proved_at`, and the
+         *     device shown at completion, if one was.
+         *
+         *     A `POST` because it opens a session.
+         */
+        post: operations["openSignedInSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/sign-ins/{sign_in_id}/authorization-codes": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sign_in_id: components["parameters"]["SignInId"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Send the person back to the app they came from, with its one code
+         * @description THE THIRD CALL, FOR AN APP SIGNING IN THROUGH SINGLE SIGN-ON (architecture decision record
+         *     037). It takes the place `openSignedInSession` has when the sign-in screen signs itself in:
+         *     where that opens a session and hands its token to the screen, this keeps a one-time code for
+         *     the app the person was sent from, and answers the address to send the browser to, back to
+         *     that app with the code.
+         *
+         *     SEND what `openSignedInSession` takes, the `sign_in_token`, the environments chosen and the
+         *     one to land in, and beside them the app's request exactly as it arrived at the
+         *     authorization endpoint. Onplo reads the request again by the same rules, because the screen
+         *     carried it and nothing it carries is trusted.
+         *
+         *     THE CODE is good once, for one minute, and only for the app it names, at the exact return
+         *     address it names, with the PKCE verifier that matches its challenge. The app trades it for
+         *     the session at the token endpoint. Only its hash is kept.
+         *
+         *     THE SIGN-IN TOKEN IS GOOD ONCE. Used, expired, or not this sign-in's, it answers
+         *     `not_found`, and the cases are not told apart. One sign-in token hands out one code.
+         *
+         *     A `POST` because it keeps a code.
+         */
+        post: operations["grantAuthorizationCode"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/passkey-registrations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Ask for the question a new passkey answers
+         * @description THE FIRST HALF OF ADDING A PASSKEY OR A SECURITY KEY, for a person already signed in
+         *     (Account → Settings → Security → Sign-in methods). Onplo mints a registration and answers
+         *     `creation_options`: hand it to the browser's passkey API untouched, and the device makes a
+         *     new key for this person on `onplo.com`.
+         *
+         *     A PASSKEY TOUCH FIRST: ONE MADE IN THE LAST FIVE MINUTES — `passkey_proof_needed`. A new way
+         *     in is the most sensitive thing a session can add, so the person proves it is them on the
+         *     session they have (`startPasskeyProof`, `completePasskeyProof`) and asks again. Right after
+         *     signing in, that proof is already fresh.
+         *
+         *     EVERY KEY IS MADE TO BE FOUND WITHOUT A USERNAME (`residentKey: required`), so signing in
+         *     never has to list anyone's keys (`startSignIn`). The keys this person already holds are
+         *     listed in `excludeCredentials`, so the same key is not added twice.
+         *
+         *     BOUND TO THE SESSION THAT ASKED, SHORT-LIVED AND SINGLE USE, as a proof is.
+         *
+         *     A `POST` because every call mints a new registration. It takes no body: everything it needs
+         *     is the credential.
+         *
+         *     GATED BY `account:sign-in-method.create`, the catalogue's act of adding a passkey or a security
+         *     key (ring 1, a personal environment's): a key or an agent never holds it.
+         */
+        post: operations["startPasskeyRegistration"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/passkey-registrations/{passkey_registration_id}/completion": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                passkey_registration_id: components["parameters"]["PasskeyRegistrationId"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Bring the new key back, and keep it
+         * @description THE SECOND HALF. Send what the browser's passkey API returned, untouched, and the name the
+         *     person gives the key. Onplo checks that it answers the question this registration asked, on
+         *     this site, from a key that verified the person and can be found without a username, and
+         *     keeps it as one of the person's sign-in methods.
+         *
+         *     WHAT IS KEPT is the key's public half and how to reach it; its private half never leaves the
+         *     device. The key is listed in Account → Settings → Security → Sign-in methods from then on,
+         *     where it can be renamed, made Primary or removed.
+         *
+         *     NO ATTESTATION IS ASKED FOR (`attestation: none`). Onplo does not judge which maker built a
+         *     key, only that the person holds it and was verified by it.
+         *
+         *     ONE ANSWER PER REGISTRATION. Completed, refused or expired, it is spent, and its id answers
+         *     `not_found` from then on — as it does from any other session.
+         *
+         *     A REFUSED KEY SAYS ONLY THAT IT WAS REFUSED — `passkey_not_verified`, as a proof's refusal
+         *     does. `already_registered` is told apart: the person already holds this very key, and a
+         *     client says so rather than "try again".
+         *
+         *     A `POST` because it adds a sign-in method, which has its own id.
+         *
+         *     GATED BY `account:sign-in-method.create`, the catalogue's act of adding a passkey or a security
+         *     key (ring 1, a personal environment's): a key or an agent never holds it.
+         */
+        post: operations["completePasskeyRegistration"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/username-checks": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Ask whether a username may be chosen
+         * @description THE CHECK AS YOU TYPE, on the first screen of signing up (Account → Sign up, step 1). Send the
+         *     username being typed; Onplo answers whether it may be chosen now.
+         *
+         *     ONE ANSWER FOR EVERY NAME THAT MAY NOT BE CHOSEN: somebody holds it, or somebody gave it up
+         *     less than 90 days ago, or it is reserved. Which of them is never said, because it says
+         *     something about a person the one signing up has never met (Account's `RegisterPerson`).
+         *
+         *     WHY THIS DOES NOT UNDO SIGN-IN'S RULE. Signing in never says whether a username exists
+         *     (decision 0529). Signing up must, at the moment a name is chosen, and says only "may be chosen"
+         *     or "may not", from the same list `RegisterPerson` judges. It is limited per address by the
+         *     gate, as every signed-out call is.
+         *
+         *     ADVICE, NEVER A HOLD. Nothing is reserved by asking: the name is judged again when the sign-up
+         *     finishes, and another person may have taken it in between.
+         *
+         *     A `POST` so the name travels in the body and never in a URL a log keeps.
+         *
+         *     `503` when Account, which knows the list, could not be asked: nothing was judged, and the check
+         *     may be tried again.
+         */
+        post: operations["checkUsername"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/sign-ups": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start signing up, and get the question the first passkey answers
+         * @description THE FIRST OF TWO CALLS THAT MAKE AN ONPLO ACCOUNT (Account → Sign up). Send the username and
+         *     the facts Account records about the person; Onplo mints a sign-up and answers
+         *     `creation_options`: hand it to the browser's passkey API untouched, and the device makes the
+         *     person's first passkey, or a security key does.
+         *
+         *     THE USERNAME IS JUDGED HERE, as `checkUsername` judges it, and again when the sign-up finishes.
+         *     `username_not_available` here means pick another.
+         *
+         *     THE EMAIL ADDRESS IS ASKED, NOT REQUIRED, AND IS NEVER A WAY IN (decisions 0198 and 0935). When
+         *     sent it is recorded as the person's own and mailed its confirmation link; it may be left out.
+         *     Nothing signs in by it.
+         *
+         *     AN INVITED GUEST SIGNS UP THE SAME WAY. An invitation is accepted afterwards, from the
+         *     person's own Companies → Requests, by somebody who holds the invited address confirmed
+         *     (Account's rule, ONPLO-1694). A sign-up carries no invitation, so a forwarded mail lets nobody
+         *     in.
+         *
+         *     SHORT-LIVED AND SINGLE USE, as a sign-in is. Nothing is recorded anywhere until the sign-up
+         *     finishes: a person who walks away leaves no account behind.
+         *
+         *     `503` when Account, which judges the username, could not be asked: no sign-up was minted, and
+         *     the call may be tried again.
+         */
+        post: operations["startSignUp"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/sign-ups/{sign_up_id}/completion": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sign_up_id: components["parameters"]["SignUpId"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Bring the first passkey back, and get the recovery codes and the first session
+         * @description THE SECOND CALL. Send what the browser's passkey API returned, untouched, and the name the
+         *     person gives the key. Onplo checks it as `completePasskeyRegistration` checks a new key, and
+         *     then, in one act: keeps the key, has Account record the person, their personal environment
+         *     and its one membership (`RegisterPerson`), mints the person's recovery codes, and opens their
+         *     first session there.
+         *
+         *     THE RECOVERY CODES ARE SHOWN ONCE, HERE, AND NEVER AGAIN. They are the only way back for a
+         *     person who loses every passkey (Account → Sign up, step 3). Onplo keeps none of them in the
+         *     clear, so nobody can show them a second time. They are not yet counted as a way in: the
+         *     person says they kept them, on Settings → Security (decision 0614).
+         *
+         *     THE SESSION LANDS IN THE PERSONAL ENVIRONMENT, the only one the person has (step 5). Its
+         *     `proved_at` is the moment of this passkey touch.
+         *
+         *     ONE ANSWER PER SIGN-UP. Completed, refused or expired, a sign-up is spent, and its id answers
+         *     `not_found` from then on.
+         *
+         *     `username_not_available` when somebody took the name since the sign-up started: nothing was
+         *     recorded, and the person starts again with another.
+         *
+         *     `503` when Account could not be asked to record the person: the sign-up is not spent, no codes
+         *     were minted, and the same answer may be sent again until the sign-up expires.
+         */
+        post: operations["completeSignUp"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/recoveries": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Use a recovery code, and get the question a new passkey answers
+         * @description THE EMERGENCY DOOR, for a person who lost every passkey (Account → Sign in → Choose another
+         *     sign-in method → Recovery code). Send the username and one recovery code. Onplo spends the code
+         *     and answers `creation_options` for a new passkey: using a code requires registering a new
+         *     passkey, which becomes the Primary one (Account → Settings → Security).
+         *
+         *     A REFUSED CODE SAYS ONLY THAT IT WAS REFUSED — `recovery_not_verified`. An unknown username, a
+         *     wrong code and a code already used are never told apart, so trying says nothing about whether
+         *     an account exists (decision 0529).
+         *
+         *     A CODE IS SPENT WHEN IT IS ACCEPTED HERE, whether or not the new passkey is then made. A person
+         *     who walks away uses another code next time. The person's other codes stay good.
+         *
+         *     USING A CODE RAISES A SECURITY ALERT to the person, so somebody who used a stolen code is seen
+         *     (Account, "Recovery codes & sessions").
+         *
+         *     SHORT-LIVED AND SINGLE USE, as a sign-in is.
+         */
+        post: operations["startRecovery"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/recoveries/{recovery_id}/completion": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                recovery_id: components["parameters"]["RecoveryId"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Bring the new passkey back, and see where you may go
+         * @description THE SECOND CALL. Send what the browser's passkey API returned, untouched, and the name the
+         *     person gives the key. Onplo checks it as `completePasskeyRegistration` checks a new key, keeps
+         *     it as the person's Primary passkey, and answers as `completeSignIn` does: the environments the
+         *     person may choose and a `sign_in_token` that opens one session. A RECOVERY IS A SIGN-IN THAT
+         *     BEGAN WITH A CODE: open the session with `openSignedInSession`, naming this recovery's id as
+         *     its `sign_in_id`.
+         *
+         *     ONE ANSWER PER RECOVERY. Completed, refused or expired, a recovery is spent, and its id answers
+         *     `not_found` from then on.
+         *
+         *     `503` when the list of environments could not be read: the key is kept, and the person signs in
+         *     with it.
+         */
+        post: operations["completeRecovery"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        /**
+         * Format: uuid
+         * @description A UUID version 7 (RFC 9562) — sortable by creation, and never a counter.
+         * @example 019250e1-8f3c-7c21-9a4d-3a2f7b6c1d90
+         */
+        Id: string;
+        /**
+         * @description ONE CEREMONY: the question to put to a passkey, and until when an answer is taken. Single
+         *     use, and only the session that asked can complete it.
+         */
+        PasskeyProof: {
+            /** @description What the completion names. */
+            id: components["schemas"]["Id"];
+            request_options: components["schemas"]["PasskeyRequestOptions"];
+            /** @description When the ceremony dies. Seconds to minutes; after it, start again. */
+            expires_at: components["schemas"]["Timestamp"];
+        };
+        /**
+         * @description WHAT THE BROWSER HANDS THE PASSKEY — the JSON form of the standard's request options, in the
+         *     standard's own field names (see the note at the top of this document). Pass it to the
+         *     browser's passkey API untouched.
+         */
+        PasskeyRequestOptions: {
+            /** @description Random bytes minted for this ceremony. The passkey signs them, so an old answer cannot be replayed. */
+            challenge: string;
+            /** @description A hint, in milliseconds, for how long the browser waits for the person. `expires_at` is what binds. */
+            timeout?: number;
+            /**
+             * @description The site the passkey belongs to, always `onplo.com` (decision 0728): the registrable
+             *     domain and never the host the product is served from, so a passkey made once answers on every
+             *     Onplo site and none outside them. It never changes, because a new one strands every passkey
+             *     made under the old. A passkey made for another site cannot answer.
+             */
+            rpId: string;
+            /**
+             * @description The passkeys and security keys this person holds, so the browser offers theirs and no
+             *     one else's.
+             */
+            allowCredentials: {
+                id: string;
+                /** @enum {string} */
+                type: "public-key";
+                /** @description How that key was last reached — a hint the browser uses to look in the right place. */
+                transports?: string[];
+            }[];
+            /**
+             * @description Always `required`. The person is verified, not merely present.
+             * @enum {string}
+             */
+            userVerification: "required";
+        };
+        PasskeyProofCompletion: {
+            answer: components["schemas"]["PasskeyAnswer"];
+        };
+        /**
+         * @description WHAT THE BROWSER'S PASSKEY API RETURNED — the JSON form of the standard's authentication
+         *     response, in the standard's own field names. Send it untouched.
+         */
+        PasskeyAnswer: {
+            /** @description Which passkey or security key answered. */
+            id: string;
+            /** @description The same, as the standard repeats it. */
+            rawId: string;
+            /** @enum {string} */
+            type: "public-key";
+            /**
+             * @description Whether the key is part of this device or was reached from another.
+             * @enum {string}
+             */
+            authenticatorAttachment?: "platform" | "cross-platform";
+            response: {
+                /**
+                 * @description What the browser says it asked — the challenge and the page it asked from. The page's
+                 *     origin must be one identity lists, `https://app.onplo.com` at launch, or the answer is
+                 *     refused, whatever the passkey signed: any page under `onplo.com` may ask a passkey, and the
+                 *     list is what keeps a page that is not ours from completing a sign-in (decision 0728).
+                 */
+                clientDataJSON: string;
+                /** @description What the key says about itself — the site it is for, and that the person was verified. */
+                authenticatorData: string;
+                signature: string;
+                /** @description Whose passkey this is, as the key recorded it. Left out by a key that does not keep one. */
+                userHandle?: string;
+            };
+            /**
+             * @description Always present in the standard's form, and always empty here: this API asks for no
+             *     extension, so an answer carrying one is not an answer to its question.
+             */
+            clientExtensionResults: Record<string, never>;
+        };
+        /** @description What a completed proof leaves behind. */
+        SessionProof: {
+            /**
+             * @description When this session last proved itself — now. The same moment every service holds
+             *     against its own freshness window.
+             */
+            proved_at: components["schemas"]["Timestamp"];
+        };
+        /**
+         * @description WHAT A DEVICE SENDS AS ITS CREDENTIAL, and until when. Opaque: a device stores it, sends
+         *     it, and never reads it.
+         */
+        DeviceToken: {
+            /**
+             * @description The credential. Sent as `Authorization: Bearer` on the device's own calls. Never a
+             *     token a client can decode: what it means is asked of Onplo on every call.
+             */
+            token: string;
+            /**
+             * @description When the token stops being good by itself — at most an hour from now. It may stop
+             *     sooner: it ends with the device's certificate, at once.
+             */
+            expires_at: components["schemas"]["Timestamp"];
+            /**
+             * @description When the certificate that signed this statement stops being valid by itself, 90 days
+             *     after it was issued. With 30 days or fewer left, the device sends a renewal.
+             */
+            certificate_expires_at: components["schemas"]["Timestamp"];
+            /**
+             * @description Only on an answer to a renewal: the certificate for the new key. It comes into force
+             *     when the first statement the new key signs is traded.
+             */
+            renewed_certificate?: components["schemas"]["RenewedDeviceCertificate"];
+        };
+        /**
+         * @description A DEVICE'S NEXT CERTIFICATE, and what signed it. Public, every part of it: a certificate
+         *     authority's key never leaves a managed KMS (architecture decision record 030).
+         */
+        RenewedDeviceCertificate: {
+            /**
+             * @description The certificate, X.509 in DER, written base64url with no padding. It names the device
+             *     record and its environment, as the one it follows did.
+             */
+            certificate: string;
+            /**
+             * @description What signed it, the certificate's own issuer first — each X.509 in DER, written
+             *     base64url with no padding.
+             */
+            authority_certificates: string[];
+            /** @description When the new certificate stops being valid by itself, 90 days after it was issued. */
+            expires_at: components["schemas"]["Timestamp"];
+        };
+        /**
+         * @description THE SESSION A SWITCH OPENED. Opaque, like every token here: a client stores it, sends it,
+         *     and never reads it.
+         */
+        SwitchedSession: {
+            /**
+             * @description The new session's credential, shown this once. Sent as `Authorization: Bearer` on every
+             *     call made in the environment switched into.
+             */
+            token: string;
+            /** @description The account environment this session acts in — the one the switch named. */
+            environment_id: components["schemas"]["Id"];
+            /**
+             * @description When this session stops being good by itself: never later than the session that asked
+             *     for it.
+             */
+            expires_at: components["schemas"]["Timestamp"];
+            /**
+             * @description The moment of the passkey touch that opened this session — the one the asking session
+             *     carried.
+             */
+            proved_at: components["schemas"]["Timestamp"];
+        };
+        /** @description ONE SIGN-IN: the question to put to a passkey, and until when an answer is taken. Single use. */
+        SignIn: {
+            /** @description What the completion and the session's opening name. */
+            id: components["schemas"]["Id"];
+            /**
+             * @description With `allowCredentials` always empty: the person is not known yet, and the device offers
+             *     every Onplo key it holds.
+             */
+            request_options: components["schemas"]["PasskeyRequestOptions"];
+            /** @description When the sign-in dies. Seconds to minutes; after it, start again. */
+            expires_at: components["schemas"]["Timestamp"];
+        };
+        SignInCompletion: {
+            answer: components["schemas"]["PasskeyAnswer"];
+            /**
+             * @description The username the person typed, when they typed one — Account's `Username`, lower case
+             *     (decision 0561). The answer must come from that person's key, or it is refused as a
+             *     wrong passkey is. Left out when the person picked their account on the device.
+             */
+            username?: string;
+            /**
+             * @description The token this device traded for (`DeviceToken.token`), when the client runs on an
+             *     enrolled device. It proves which device the person is on, never who they are (decisions
+             *     0644 and 0886).
+             */
+            device_token?: string;
+        };
+        /**
+         * @description WHERE A PERSON WHO HAS JUST PROVED THEMSELVES MAY GO, and the token that opens one session.
+         *     The list is the person's own (decision 0562): which environments they belong to, each one's
+         *     kind and name, and their state there — never anything inside one.
+         */
+        SignInChoices: {
+            /**
+             * @description Good once, and until `expires_at`, for opening this sign-in's session
+             *     (`openSignedInSession`). It is not a session and opens nothing else.
+             */
+            sign_in_token: string;
+            /** @description When the sign-in token dies. Minutes; after it, sign in again. */
+            expires_at: components["schemas"]["Timestamp"];
+            /** @description The moment of the passkey touch — the `proved_at` the session will carry. */
+            proved_at: components["schemas"]["Timestamp"];
+            /**
+             * @description EVERY ENVIRONMENT THE PERSON MAY CHOOSE, WHOLE — never a page, because the chooser shows
+             *     them all on one screen with one "Full access" toggle. Personal first, then Business, then
+             *     the Onplo team, and oldest first within a kind. A membership the person left is never
+             *     here; a suspended one is, so the chooser can say access is paused.
+             */
+            choices: components["schemas"]["SignInChoice"][];
+        };
+        SignInChoice: {
+            /** @description The account environment. */
+            environment_id: components["schemas"]["Id"];
+            /**
+             * @description Which kind of environment it is.
+             * @enum {string}
+             */
+            kind: "personal" | "business" | "onplo";
+            /**
+             * @description A company's name. Absent exactly when `kind` is `personal`: the client names a personal
+             *     environment from its kind, in the reader's language.
+             */
+            name?: string;
+            /**
+             * @description The person's state there. A suspended membership can be seen and not landed in.
+             * @enum {string}
+             */
+            membership_state: "active" | "suspended";
+        };
+        SignedInSessionOpening: {
+            /** @description The token the completion answered. */
+            sign_in_token: string;
+            /**
+             * @description THE ENVIRONMENTS THE PERSON CHOSE for this sign-in, each one of the completion's
+             *     choices, each named once. "Full access" sends them all. Switching into one of these later asks no passkey
+             *     touch; one left out does.
+             */
+            environment_ids: components["schemas"]["Id"][];
+            /** @description The one of them the session acts in. */
+            land_in: components["schemas"]["Id"];
+        };
+        AuthorizationCodeGrant: {
+            /** @description The token the completion answered. */
+            sign_in_token: string;
+            /** @description The environments the person chose, each one of the completion's choices, each named once. */
+            environment_ids: components["schemas"]["Id"][];
+            /** @description The one of them the app's session will act in. */
+            land_in: components["schemas"]["Id"];
+            authorization_request: components["schemas"]["AuthorizationRequest"];
+        };
+        /**
+         * @description THE APP'S REQUEST, field for field as it arrived at the authorization endpoint (RFC 6749
+         *     §4.1.1, RFC 7636 §4.3, OpenID Connect Core §3.1.2.1).
+         */
+        AuthorizationRequest: {
+            /** @description The app, by the id Onplo lists it under. */
+            client_id: string;
+            /** @description Where the app is sent back to, exactly as it registered it. */
+            redirect_uri: string;
+            /**
+             * @description Always `code`, the authorization code.
+             * @enum {string}
+             */
+            response_type: "code";
+            /** @description The scopes asked, space-separated. `openid` is always one of them. */
+            scope: string;
+            /** @description The app's own value, sent back to it beside the code. */
+            state: string;
+            /** @description The PKCE challenge, the SHA-256 of the app's verifier in base64url. */
+            code_challenge: string;
+            /**
+             * @description Always `S256`.
+             * @enum {string}
+             */
+            code_challenge_method: "S256";
+            /** @description The app's value the ID token echoes, when it sent one. */
+            nonce?: string;
+        };
+        AuthorizationCodeGranted: {
+            /**
+             * Format: uri
+             * @description The app's return address with `code` and `state` added. The screen sends the browser
+             *     there at once; the code in it is good for one minute.
+             */
+            redirect_to: string;
+        };
+        /**
+         * @description THE SESSION A SIGN-IN OPENED. Opaque, like every token here: a client stores it, sends it,
+         *     and never reads it.
+         */
+        SignedInSession: {
+            /**
+             * @description The session's credential, shown this once. Sent as `Authorization: Bearer` on every call
+             *     made in the environment it acts in.
+             */
+            token: string;
+            /** @description The account environment this session acts in — `land_in`. */
+            environment_id: components["schemas"]["Id"];
+            /** @description When this session stops being good by itself. */
+            expires_at: components["schemas"]["Timestamp"];
+            /** @description The moment of the passkey touch that signed the person in. */
+            proved_at: components["schemas"]["Timestamp"];
+        };
+        /**
+         * @description ONE REGISTRATION: the question a new key answers, and until when an answer is taken. Single
+         *     use, and only the session that asked can complete it.
+         */
+        PasskeyRegistration: {
+            /** @description What the completion names. */
+            id: components["schemas"]["Id"];
+            creation_options: components["schemas"]["PasskeyCreationOptions"];
+            /** @description When the registration dies. Seconds to minutes; after it, start again. */
+            expires_at: components["schemas"]["Timestamp"];
+        };
+        /**
+         * @description WHAT THE BROWSER HANDS THE DEVICE TO MAKE A NEW KEY — the JSON form of the standard's
+         *     creation options, in the standard's own field names (see the note at the top of this
+         *     document). Pass it to the browser's passkey API untouched.
+         */
+        PasskeyCreationOptions: {
+            rp: {
+                /** @description Always `onplo.com` (decision 0728), as `PasskeyRequestOptions.rpId` is. */
+                id: string;
+                /** @description What the device shows the key as being for — `Onplo`. */
+                name: string;
+            };
+            user: {
+                /**
+                 * @description The person, as the key records them and hands back as `userHandle` at every sign-in.
+                 *     Opaque bytes that name nobody outside Onplo.
+                 */
+                id: string;
+                /** @description The person's username, so the device can tell their keys apart. */
+                name: string;
+                /** @description The person's name, as the device shows it. */
+                displayName: string;
+            };
+            /** @description Random bytes minted for this registration. The new key signs them. */
+            challenge: string;
+            /** @description The signature kinds Onplo accepts, most preferred first. */
+            pubKeyCredParams: {
+                /** @enum {string} */
+                type: "public-key";
+                /** @description A COSE algorithm number — `-8` EdDSA, `-7` ES256, `-257` RS256. */
+                alg: number;
+            }[];
+            /** @description A hint, in milliseconds, for how long the browser waits for the person. `expires_at` is what binds. */
+            timeout?: number;
+            /** @description The keys this person already holds, so the device does not add one twice. */
+            excludeCredentials: {
+                id: string;
+                /** @enum {string} */
+                type: "public-key";
+                transports?: string[];
+            }[];
+            authenticatorSelection: {
+                /**
+                 * @description Always `required`: the key keeps who it is for, so signing in finds it without a
+                 *     username and never lists anyone's keys.
+                 * @enum {string}
+                 */
+                residentKey: "required";
+                /**
+                 * @description Always `required`. The person is verified, not merely present.
+                 * @enum {string}
+                 */
+                userVerification: "required";
+            };
+            /**
+             * @description Always `none`. Onplo does not judge which maker built a key.
+             * @enum {string}
+             */
+            attestation: "none";
+        };
+        PasskeyRegistrationCompletion: {
+            attestation: components["schemas"]["PasskeyAttestation"];
+            /**
+             * @description What the person calls this key in their list of sign-in methods — Account's
+             *     `SignInMethod.name`, renamed there later.
+             */
+            name: string;
+        };
+        /**
+         * @description WHAT THE BROWSER'S PASSKEY API RETURNED WHEN IT MADE THE KEY — the JSON form of the
+         *     standard's registration response, in the standard's own field names. Send it untouched.
+         */
+        PasskeyAttestation: {
+            /** @description The new key's id. */
+            id: string;
+            /** @description The same, as the standard repeats it. */
+            rawId: string;
+            /** @enum {string} */
+            type: "public-key";
+            /**
+             * @description Whether the key is part of this device or was reached from another.
+             * @enum {string}
+             */
+            authenticatorAttachment?: "platform" | "cross-platform";
+            response: {
+                /**
+                 * @description What the browser says it asked — the challenge and the page it asked from, which must
+                 *     be one identity lists, as for a sign-in (decision 0728).
+                 */
+                clientDataJSON: string;
+                /** @description The new key's public half and what the key says about itself. */
+                attestationObject: string;
+                /** @description How the key can be reached, kept so the browser looks in the right place. */
+                transports?: string[];
+            };
+            /** @description Always empty, because this API asks for no extension. */
+            clientExtensionResults: Record<string, never>;
+        };
+        /** @description THE KEY JUST KEPT, by the id Account's list of sign-in methods names it with. */
+        AddedSignInMethod: {
+            /** @description The sign-in method's id — `SignInMethod.id` in Account's list. */
+            id: components["schemas"]["Id"];
+            /** @description The name it was given. */
+            name: string;
+            /** @description When it was kept. */
+            added_at: components["schemas"]["Timestamp"];
+        };
+        /**
+         * @description A person's one identifier, lower case — Account's `Username` (decision 0561). The client lowers
+         *     what the person types before sending it.
+         */
+        Username: string;
+        UsernameCheck: {
+            username: components["schemas"]["Username"];
+        };
+        UsernameAvailability: {
+            /**
+             * @description Whether the name may be chosen now. False for a name somebody holds, gave up less than 90
+             *     days ago, or that is reserved — never which. Advice, never a hold.
+             */
+            available: boolean;
+        };
+        /**
+         * @description WHAT ACCOUNT RECORDS ABOUT A NEW PERSON (`RegisterPerson`), asked on the sign-up screens and
+         *     held by identity until the sign-up finishes.
+         *
+         *     A FIRST NAME, AND A LAST NAME IF THEY HAVE ONE (Account → Sign in, "How signing up works",
+         *     step 1; ONPLO-4080). There is no middle name, and where one name divides is never guessed.
+         */
+        SignUpStart: {
+            username: components["schemas"]["Username"];
+            /**
+             * @description The person's first name, as typed, by the rule Account's `ProfileUpdate` holds: something a
+             *     person can see, on one line.
+             */
+            first_name: string;
+            /** @description The person's last name, as typed, by the same rule. Left out by a person who has one name. */
+            last_name?: string;
+            /**
+             * Format: email
+             * @description The person's own address, OR LEFT OUT: it is asked, and is not required to get in (step 4,
+             *     decision 0935). When sent it is recorded as theirs and mailed its confirmation link, and it is
+             *     never a way in (decision 0198). Left out, no address is written and no mail is sent.
+             */
+            email_address?: string;
+            /**
+             * @description The language Onplo speaks to them in, a BCP 47 tag, from the browser and confirmed once. The same rule as Account's `Preferences.language`.
+             * @example nl-BE
+             */
+            language: string;
+            /** @description The zone times are shown in for them, an IANA name, from the device and confirmed once. */
+            time_zone: string;
+            /**
+             * @description The country they are in, ISO 3166-1 alpha-2, which their working calendar counts public
+             *     holidays by. Left out when the client does not know it.
+             */
+            country?: string;
+        };
+        /**
+         * @description ONE SIGN-UP: the question the first passkey answers, and until when an answer is taken. Single
+         *     use.
+         */
+        SignUp: {
+            /** @description What the completion names. */
+            id: components["schemas"]["Id"];
+            /** @description With `excludeCredentials` always empty, since the person holds no key yet. */
+            creation_options: components["schemas"]["PasskeyCreationOptions"];
+            /** @description When the sign-up dies. Minutes; after it, start again. */
+            expires_at: components["schemas"]["Timestamp"];
+        };
+        SignUpCompletion: {
+            attestation: components["schemas"]["PasskeyAttestation"];
+            /** @description What the person calls their first key in their list of sign-in methods. */
+            name: string;
+        };
+        /**
+         * @description AN ACCOUNT MADE: the recovery codes, shown this once, and the first session, in the person's
+         *     personal environment.
+         */
+        SignedUp: {
+            /**
+             * @description TEN ONE-TIME CODES, each good once, the only way back for a person who loses every passkey.
+             *     Shown here and never again: Onplo keeps none of them in the clear.
+             */
+            recovery_codes: string[];
+            session: components["schemas"]["SignedInSession"];
+        };
+        RecoveryStart: {
+            username: components["schemas"]["Username"];
+            /**
+             * @description One of the person's recovery codes, as it was shown, lower case.
+             * @example abcde-12345
+             */
+            recovery_code: string;
+        };
+        /**
+         * @description ONE RECOVERY: the question the new passkey answers, and until when an answer is taken. Single
+         *     use. Its id is the `sign_in_id` that opens the session afterwards.
+         */
+        Recovery: {
+            /** @description What the completion, and then `openSignedInSession`, name. */
+            id: components["schemas"]["Id"];
+            creation_options: components["schemas"]["PasskeyCreationOptions"];
+            /** @description When the recovery dies. Minutes; after it, use another code. */
+            expires_at: components["schemas"]["Timestamp"];
+        };
+        RecoveryCompletion: {
+            attestation: components["schemas"]["PasskeyAttestation"];
+            /** @description What the person calls the new key. It becomes their Primary passkey. */
+            name: string;
+        };
+        /**
+         * Format: date-time
+         * @description RFC 3339, always UTC, always with the offset written out.
+         * @example 2026-09-13T06:06:00Z
+         */
+        Timestamp: string;
+        /**
+         * @description RFC 9457. Served as `application/problem+json`, on every failure, from every operation —
+         *     one shape to handle rather than one per endpoint. CLOSED, like every other object here:
+         *     the server validates its own answers against this schema, and an open object is the one
+         *     shape that check cannot see through.
+         */
+        Problem: {
+            /**
+             * Format: uri
+             * @description A stable URI naming the kind of problem. Dereferenceable; documentation lives there.
+             * @example https://onplo.com/problems/passkey_not_verified
+             */
+            type: string;
+            /** @example The passkey did not verify */
+            title: string;
+            status: number;
+            /** @description What went wrong THIS time, in a sentence a person could be shown. */
+            detail?: string;
+            /**
+             * Format: uri-reference
+             * @description The request path this happened on.
+             */
+            instance?: string;
+            /**
+             * @description The machine name, stable across wording changes. `type` is the URI a human opens; this
+             *     is what a client branches on.
+             * @example passkey_not_verified
+             */
+            code: string;
+            /**
+             * Format: uuid
+             * @description Quote it in a support request and the exact call can be found. It is also on the
+             *     `Onplo-Request-Id` response header of every response, failed or not.
+             */
+            request_id: string;
+            /** @description One entry per field that is wrong. REQUIRED on a 422. */
+            errors?: {
+                /**
+                 * @description A JSON Pointer (RFC 6901) at the wrong value, rooted at the REQUEST: `/body/...`
+                 *     for a body field, `/path/...` for a path segment.
+                 * @example /body/answer/response/signature
+                 */
+                pointer: string;
+                code: string;
+                detail: string;
+            }[];
+        };
+        /**
+         * @description The provider's metadata, under the names OpenID Connect Discovery 1.0 gives them, so any
+         *     standard client reads it unchanged. Every list holds only what identity supports.
+         */
+        ProviderDiscovery: {
+            /**
+             * Format: uri
+             * @description The provider's address. Every ID token's `iss` is exactly this.
+             */
+            issuer: string;
+            /**
+             * Format: uri
+             * @description Where a person is sent to sign in.
+             */
+            authorization_endpoint: string;
+            /**
+             * Format: uri
+             * @description Where the answer is traded for tokens.
+             */
+            token_endpoint: string;
+            /**
+             * Format: uri
+             * @description Where the key set is, `readProviderKeySet`.
+             */
+            jwks_uri: string;
+            scopes_supported: "openid"[];
+            response_types_supported: "code"[];
+            response_modes_supported: "query"[];
+            grant_types_supported: ("authorization_code" | "refresh_token")[];
+            subject_types_supported: "public"[];
+            id_token_signing_alg_values_supported: "ES256"[];
+            /** @description `none`: every Onplo app is a public client and holds no secret. */
+            token_endpoint_auth_methods_supported: "none"[];
+            code_challenge_methods_supported: "S256"[];
+            claims_supported: ("iss" | "sub" | "aud" | "exp" | "iat" | "auth_time" | "amr")[];
+        };
+        /** @description A JSON Web Key Set (RFC 7517). */
+        ProviderKeySet: {
+            keys: components["schemas"]["ProviderKey"][];
+        };
+        /**
+         * @description One public key, an elliptic-curve key on P-256 as RFC 7518 writes it. The private half is never
+         *     anywhere this API reaches.
+         */
+        ProviderKey: {
+            /**
+             * @description The key type.
+             * @enum {string}
+             */
+            kty: "EC";
+            /**
+             * @description The curve.
+             * @enum {string}
+             */
+            crv: "P-256";
+            /** @description The point's x coordinate, 32 bytes in base64url. */
+            x: string;
+            /** @description The point's y coordinate, 32 bytes in base64url. */
+            y: string;
+            /** @description The key's id, its RFC 7638 thumbprint. An ID token's header names its key by it. */
+            kid: string;
+            /**
+             * @description The key signs; it encrypts nothing.
+             * @enum {string}
+             */
+            use: "sig";
+            /**
+             * @description The one algorithm it signs with.
+             * @enum {string}
+             */
+            alg: "ES256";
+        };
+    };
+    responses: {
+        /**
+         * @description The request could not be read, so nothing in it was looked at — `malformed_request`. Its body
+         *     is not valid JSON, or its address carries a broken `%`-escape. No field is named, because
+         *     none was read. Declared on every operation, the ones that take no body included: a body is
+         *     read before the server knows which operation it was sent to.
+         */
+        BadRequest: {
+            headers: {
+                "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                [name: string]: unknown;
+            };
+            content: {
+                "application/problem+json": components["schemas"]["Problem"] & {
+                    /** @enum {unknown} */
+                    code?: "malformed_request";
+                };
+            };
+        };
+        /**
+         * @description There is no usable credential on this call — it is missing, malformed, unknown, expired, or
+         *     it has been REVOKED. A revoked credential fails HERE and not with 403, because it is no
+         *     longer a credential.
+         */
+        Unauthorized: {
+            headers: {
+                "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                "WWW-Authenticate": components["headers"]["WwwAuthenticate"];
+                [name: string]: unknown;
+            };
+            content: {
+                "application/problem+json": components["schemas"]["Problem"] & {
+                    /** @enum {unknown} */
+                    code?: "credential_missing" | "credential_malformed" | "credential_unknown" | "credential_expired" | "credential_revoked";
+                };
+            };
+        };
+        /**
+         * @description The credential is good and this call is refused anyway. `permission_missing`: the
+         *     credential does not carry the permission this operation needs. `ring_requires_person`: a
+         *     ring-1 act attempted by a raw key, refused regardless of scopes. `outside_session_scope`:
+         *     allowed to this subject and not within the scope this session declared at sign-in.
+         *
+         *     ONE COMPONENT ON EVERY OPERATION, the ungated ones included, because the three reasons are
+         *     the same on every contract and a client writes one branch for them.
+         */
+        Forbidden: {
+            headers: {
+                "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                [name: string]: unknown;
+            };
+            content: {
+                "application/problem+json": components["schemas"]["Problem"] & {
+                    /** @enum {unknown} */
+                    code?: "permission_missing" | "ring_requires_person" | "outside_session_scope";
+                };
+            };
+        };
+        /**
+         * @description No such ceremony, or not one this session started. The two are never told apart, and
+         *     neither is one that expired or was already answered: saying which would let somebody learn
+         *     about a ceremony by trying its id.
+         */
+        NotFound: {
+            headers: {
+                "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                "Cache-Control": components["headers"]["CacheControl"];
+                [name: string]: unknown;
+            };
+            content: {
+                "application/problem+json": components["schemas"]["Problem"] & {
+                    /** @enum {unknown} */
+                    code?: "not_found";
+                };
+            };
+        };
+        /**
+         * @description The request body is larger than this API reads — `request_too_large`. `detail` names the
+         *     limit in bytes. Declared on every operation, for the reason `BadRequest` gives.
+         */
+        ContentTooLarge: {
+            headers: {
+                "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                [name: string]: unknown;
+            };
+            content: {
+                "application/problem+json": components["schemas"]["Problem"] & {
+                    /** @enum {unknown} */
+                    code?: "request_too_large";
+                };
+            };
+        };
+        /**
+         * @description The request body is in a form this API does not read — `unsupported_media_type`. This API
+         *     reads JSON, sent uncompressed as `application/json`, and nothing else.
+         */
+        UnsupportedMediaType: {
+            headers: {
+                "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                [name: string]: unknown;
+            };
+            content: {
+                "application/problem+json": components["schemas"]["Problem"] & {
+                    /** @enum {unknown} */
+                    code?: "unsupported_media_type";
+                };
+            };
+        };
+        /**
+         * @description The request parsed and something in it is wrong. `errors` says what, one entry per field,
+         *     each with a JSON Pointer at it. ONE `code`, because the detail is in `errors`. This is
+         *     about the SHAPE of what was sent; an answer of the right shape that does not verify is the
+         *     409 on that operation.
+         */
+        Unprocessable: {
+            headers: {
+                "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                [name: string]: unknown;
+            };
+            content: {
+                "application/problem+json": components["schemas"]["Problem"] & {
+                    /** @enum {unknown} */
+                    code?: "unprocessable_request";
+                };
+            };
+        };
+        /**
+         * @description This door was called too often in the last minute, from this address or from everyone
+         *     together — `too_many_requests`. Nothing was read and no token was issued. `Retry-After`
+         *     says how many whole seconds to wait; the same call is then answered as usual.
+         *
+         *     Only a door that answers with no credential is limited this way, because nobody is charged
+         *     for the call (decision 0732). How many calls a minute it takes is not part of this contract.
+         */
+        TooManyCalls: {
+            headers: {
+                "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                "Retry-After": components["headers"]["RetryAfter"];
+                [name: string]: unknown;
+            };
+            content: {
+                "application/problem+json": components["schemas"]["Problem"] & {
+                    /** @enum {unknown} */
+                    code?: "too_many_requests";
+                };
+            };
+        };
+        /**
+         * @description Something failed that this contract cannot describe — including an answer this API produced
+         *     and then refused to send, because the contract does not describe that answer either
+         *     (`response_not_in_contract`). Response validation stays on in production (decision 0551).
+         *     `request_id` is what finds the call.
+         */
+        ServerError: {
+            headers: {
+                "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                [name: string]: unknown;
+            };
+            content: {
+                "application/problem+json": components["schemas"]["Problem"] & {
+                    /** @enum {unknown} */
+                    code?: "internal_error" | "response_not_in_contract";
+                };
+            };
+        };
+        /**
+         * @description The authorization service could not be asked, so whether this call may proceed is UNKNOWN —
+         *     `authorization_unavailable`. Never a 403, which would claim a refusal when all that is
+         *     known is that we could not ask.
+         */
+        ServiceUnavailable: {
+            headers: {
+                "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                [name: string]: unknown;
+            };
+            content: {
+                "application/problem+json": components["schemas"]["Problem"] & {
+                    /** @enum {unknown} */
+                    code?: "authorization_unavailable";
+                };
+            };
+        };
+        /**
+         * @description **Onplo has not built this operation yet** — `not_implemented` (decision 0580). It is
+         *     declared here because the contract is written before the code; it is not a 404, because the
+         *     address is right, and not a 503, because there is nothing to retry. Treat the operation as
+         *     absent for now. Nothing about your credential or your request caused this.
+         */
+        NotImplemented: {
+            headers: {
+                "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                "Cache-Control": components["headers"]["CacheControl"];
+                [name: string]: unknown;
+            };
+            content: {
+                "application/problem+json": components["schemas"]["Problem"] & {
+                    /** @enum {unknown} */
+                    code?: "not_implemented";
+                };
+            };
+        };
+    };
+    parameters: {
+        PasskeyProofId: components["schemas"]["Id"];
+        SignInId: components["schemas"]["Id"];
+        PasskeyRegistrationId: components["schemas"]["Id"];
+        SignUpId: components["schemas"]["Id"];
+        RecoveryId: components["schemas"]["Id"];
+    };
+    requestBodies: never;
+    headers: {
+        /**
+         * @description The id of this call. Minted by the server as a UUID version 7 and **never taken from a
+         *     request header** (decision 0553). It rides EVERY response, and it is the same value as the
+         *     problem document's `request_id` when there is one. Quote it in a support request and the
+         *     exact call can be found.
+         */
+        OnploRequestId: string;
+        /**
+         * @description The challenge RFC 9110 §11.6.1 and RFC 6750 §3 require on a 401 under a bearer scheme
+         *     (decision 0569). `Bearer realm="onplo"` alone when no credential was sent; otherwise
+         *     `Bearer realm="onplo", error="invalid_token"`. It never carries `error_description` and never
+         *     `scope`. A 403 carries no challenge at all.
+         */
+        WwwAuthenticate: string;
+        /**
+         * @description `no-store`, in two places. On the statuses RFC 9110 §15.1 makes cacheable by default — a
+         *     404 and a 501 (decision 0580): a cached "not built yet" would outlive the day the operation
+         *     is built. And on every answer that carries a credential — `tradeDeviceStatement`'s,
+         *     `switchEnvironment`'s, `completeSignIn`'s, `openSignedInSession`'s, `completeSignUp`'s and
+         *     `completeRecovery`'s — each marked `x-carries-secret` so the server sends it.
+         */
+        CacheControl: "no-store";
+        /**
+         * @description Whole seconds until a limited caller may call this door again (decision 0732). It rides a
+         *     429 and no other status.
+         */
+        RetryAfter: number;
+        /**
+         * @description Where the browser is sent (decision 1027): identity's sign-in screen, or the app's registered
+         *     return address with an OAuth `error`. It rides a redirect and no other answer.
+         */
+        Location: string;
+    };
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+    readProviderDiscovery: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The discovery document. */
+            200: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProviderDiscovery"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            429: components["responses"]["TooManyCalls"];
+            500: components["responses"]["ServerError"];
+            501: components["responses"]["NotImplemented"];
+        };
+    };
+    readProviderKeySet: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The key set. */
+            200: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProviderKeySet"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            429: components["responses"]["TooManyCalls"];
+            500: components["responses"]["ServerError"];
+            501: components["responses"]["NotImplemented"];
+        };
+    };
+    authorizeSignIn: {
+        parameters: {
+            query?: {
+                /** @description The app, by the id Onplo lists it under. */
+                client_id?: string;
+                /** @description Where the app is sent back to, exactly as it registered it. */
+                redirect_uri?: string;
+                /** @description Always `code`. */
+                response_type?: string;
+                /** @description The scopes asked, space-separated. `openid` is always one of them. */
+                scope?: string;
+                /** @description The app's own value, sent back to it. */
+                state?: string;
+                /** @description The PKCE challenge, the SHA-256 of the app's verifier in base64url. */
+                code_challenge?: string;
+                /** @description Always `S256`. */
+                code_challenge_method?: string;
+                /** @description The app's value the ID token echoes. */
+                nonce?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The browser is sent to the sign-in screen, or back to the app with an error. */
+            302: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    Location: components["headers"]["Location"];
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /**
+             * @description Nothing is redirected. `not_registered`: the app, or its return address, is not one Onplo
+             *     lists. `malformed_request`: the address could not be read.
+             */
+            400: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"] & {
+                        /** @enum {unknown} */
+                        code?: "malformed_request" | "not_registered";
+                    };
+                };
+            };
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            422: components["responses"]["Unprocessable"];
+            429: components["responses"]["TooManyCalls"];
+            500: components["responses"]["ServerError"];
+        };
+    };
+    startPasskeyProof: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The ceremony, and the question to put to the passkey. */
+            201: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PasskeyProof"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /**
+             * @description Refused: the credential is not a person's signed-in session (`not_a_person_session`).
+             *     A key, a grant and an AI agent have no passkey to ask.
+             */
+            409: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"] & {
+                        /** @enum {unknown} */
+                        code?: "not_a_person_session";
+                    };
+                };
+            };
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            500: components["responses"]["ServerError"];
+            503: components["responses"]["ServiceUnavailable"];
+        };
+    };
+    completePasskeyProof: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                passkey_proof_id: components["parameters"]["PasskeyProofId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PasskeyProofCompletion"];
+            };
+        };
+        responses: {
+            /** @description Proved. The moment this session now carries. */
+            200: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SessionProof"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /**
+             * @description Refused: the passkey's answer did not verify (`passkey_not_verified`). The ceremony is
+             *     spent.
+             */
+            409: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"] & {
+                        /** @enum {unknown} */
+                        code?: "passkey_not_verified";
+                    };
+                };
+            };
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            422: components["responses"]["Unprocessable"];
+            500: components["responses"]["ServerError"];
+            503: components["responses"]["ServiceUnavailable"];
+        };
+    };
+    tradeDeviceStatement: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description The signed statement, in the compact form: three base64url parts joined by
+                     *     dots. Bounded, because an unbounded string in a body makes the body limit
+                     *     unprovable. The example shows the SHAPE and is no statement at all: its three
+                     *     parts are the words header, claims and signature.
+                     * @example aGVhZGVy.Y2xhaW1z.c2lnbmF0dXJl
+                     */
+                    statement: string;
+                    /**
+                     * @description A RENEWAL, sent only when the device wants its next certificate: a PKCS #10
+                     *     certificate request (RFC 2986) for a NEW P-256 key, signed by that key, in DER
+                     *     and written base64url with no padding. One for P-256 is a few hundred bytes;
+                     *     the ceiling leaves room for the names it carries.
+                     */
+                    certificate_request?: string;
+                };
+            };
+        };
+        responses: {
+            /**
+             * @description The token, and when it stops being good, and when the certificate behind it does. With
+             *     a renewal, the new certificate too. Sent with `no-store`.
+             */
+            201: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    "Cache-Control": components["headers"]["CacheControl"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["DeviceToken"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            /**
+             * @description Refused. `statement_not_verified`: the statement does not prove a device Onplo will
+             *     answer — which check failed is never said. `statement_outside_its_time`: its `exp` is
+             *     past, or more than five minutes ahead; set the clock by this answer's `Date` header
+             *     and sign a new one. The five others refuse a renewal's certificate request, and the
+             *     operation's description says each. No token is issued, and no certificate, either way.
+             */
+            409: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"] & {
+                        /** @enum {unknown} */
+                        code?: "statement_not_verified" | "statement_outside_its_time" | "certificate_request_unreadable" | "certificate_request_not_signed_by_its_key" | "key_not_certified" | "key_ended" | "key_already_certified";
+                    };
+                };
+            };
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            422: components["responses"]["Unprocessable"];
+            429: components["responses"]["TooManyCalls"];
+            500: components["responses"]["ServerError"];
+            501: components["responses"]["NotImplemented"];
+        };
+    };
+    switchEnvironment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The account environment to open a session in. */
+                    environment_id: components["schemas"]["Id"];
+                };
+            };
+        };
+        responses: {
+            /** @description The new session's token, where it acts, and until when. Sent with `no-store`. */
+            201: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    "Cache-Control": components["headers"]["CacheControl"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SwitchedSession"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /**
+             * @description Refused, and no session is opened. `not_a_person_session`: the credential is not a
+             *     person's signed-in session. `not_a_member`: the person is not a member of that
+             *     environment now, or it does not exist. `membership_suspended`: they are a member and
+             *     suspended there. `passkey_proof_needed`: prove it is you on this session, then send the
+             *     switch again. `already_in_that_environment`: the session that asked already acts there.
+             */
+            409: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"] & {
+                        /** @enum {unknown} */
+                        code?: "not_a_person_session" | "not_a_member" | "membership_suspended" | "passkey_proof_needed" | "already_in_that_environment";
+                    };
+                };
+            };
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            422: components["responses"]["Unprocessable"];
+            500: components["responses"]["ServerError"];
+            503: components["responses"]["ServiceUnavailable"];
+        };
+    };
+    startSignIn: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The sign-in, and the question to put to the passkey. */
+            201: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SignIn"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            429: components["responses"]["TooManyCalls"];
+            500: components["responses"]["ServerError"];
+        };
+    };
+    completeSignIn: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sign_in_id: components["parameters"]["SignInId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SignInCompletion"];
+            };
+        };
+        responses: {
+            /** @description Proved. Where the person may go, and the token that opens one session. Sent with `no-store`. */
+            200: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    "Cache-Control": components["headers"]["CacheControl"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SignInChoices"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            404: components["responses"]["NotFound"];
+            /**
+             * @description Refused, and the sign-in is spent. `passkey_not_verified`: the answer did not prove a
+             *     person Onplo will sign in, and which check failed is never said.
+             *     `device_token_not_verified`: the device token shown beside it is not a live device's.
+             */
+            409: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"] & {
+                        /** @enum {unknown} */
+                        code?: "passkey_not_verified" | "device_token_not_verified";
+                    };
+                };
+            };
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            422: components["responses"]["Unprocessable"];
+            429: components["responses"]["TooManyCalls"];
+            500: components["responses"]["ServerError"];
+            503: components["responses"]["ServiceUnavailable"];
+        };
+    };
+    openSignedInSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sign_in_id: components["parameters"]["SignInId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SignedInSessionOpening"];
+            };
+        };
+        responses: {
+            /** @description The session's token, where it acts, and until when. Sent with `no-store`. */
+            201: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    "Cache-Control": components["headers"]["CacheControl"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SignedInSession"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            404: components["responses"]["NotFound"];
+            /**
+             * @description Refused, and no session is opened; the sign-in token is still good until it expires.
+             *     `not_a_choice`: an environment sent is not one the completion listed, or the one to land
+             *     in is not among those chosen. `membership_suspended`: the person is suspended in the
+             *     environment they would land in; choose another.
+             */
+            409: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"] & {
+                        /** @enum {unknown} */
+                        code?: "not_a_choice" | "membership_suspended";
+                    };
+                };
+            };
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            422: components["responses"]["Unprocessable"];
+            429: components["responses"]["TooManyCalls"];
+            500: components["responses"]["ServerError"];
+        };
+    };
+    grantAuthorizationCode: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sign_in_id: components["parameters"]["SignInId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AuthorizationCodeGrant"];
+            };
+        };
+        responses: {
+            /** @description Where to send the browser, back to the app with its code. Sent with `no-store`. */
+            201: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    "Cache-Control": components["headers"]["CacheControl"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AuthorizationCodeGranted"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            404: components["responses"]["NotFound"];
+            /**
+             * @description Refused, and no code is kept; the sign-in token is still good until it expires.
+             *     `not_a_choice` and `membership_suspended` are what `openSignedInSession` answers.
+             *     `not_registered`: the app, or its return address, is not one Onplo lists. The browser is
+             *     never sent there. `authorization_request_refused`: the request is not one the
+             *     authorization endpoint takes.
+             */
+            409: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"] & {
+                        /** @enum {unknown} */
+                        code?: "not_a_choice" | "membership_suspended" | "not_registered" | "authorization_request_refused";
+                    };
+                };
+            };
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            422: components["responses"]["Unprocessable"];
+            429: components["responses"]["TooManyCalls"];
+            500: components["responses"]["ServerError"];
+        };
+    };
+    startPasskeyRegistration: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The registration, and the question to put to the new key. */
+            201: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PasskeyRegistration"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /**
+             * @description Refused. `not_a_person_session`: the credential is not a person's signed-in session.
+             *     `passkey_proof_needed`: prove it is you on this session, then ask again.
+             */
+            409: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"] & {
+                        /** @enum {unknown} */
+                        code?: "not_a_person_session" | "passkey_proof_needed";
+                    };
+                };
+            };
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            500: components["responses"]["ServerError"];
+            503: components["responses"]["ServiceUnavailable"];
+        };
+    };
+    completePasskeyRegistration: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                passkey_registration_id: components["parameters"]["PasskeyRegistrationId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PasskeyRegistrationCompletion"];
+            };
+        };
+        responses: {
+            /** @description Kept. The new sign-in method, as Account lists it. */
+            201: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AddedSignInMethod"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /**
+             * @description Refused, and nothing is kept. `passkey_not_verified`: the new key did not prove what it
+             *     must, and which check failed is never said. `already_registered`: this person already
+             *     holds this key.
+             */
+            409: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"] & {
+                        /** @enum {unknown} */
+                        code?: "passkey_not_verified" | "already_registered";
+                    };
+                };
+            };
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            422: components["responses"]["Unprocessable"];
+            500: components["responses"]["ServerError"];
+            503: components["responses"]["ServiceUnavailable"];
+        };
+    };
+    checkUsername: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UsernameCheck"];
+            };
+        };
+        responses: {
+            /** @description Whether the name may be chosen now. */
+            200: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["UsernameAvailability"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            422: components["responses"]["Unprocessable"];
+            429: components["responses"]["TooManyCalls"];
+            500: components["responses"]["ServerError"];
+            503: components["responses"]["ServiceUnavailable"];
+        };
+    };
+    startSignUp: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SignUpStart"];
+            };
+        };
+        responses: {
+            /** @description The sign-up, and the question to put to the first passkey. */
+            201: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SignUp"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            /**
+             * @description Refused. `username_not_available`: somebody holds the name, gave it up recently, or it is
+             *     reserved — never which.
+             */
+            409: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"] & {
+                        /** @enum {unknown} */
+                        code?: "username_not_available";
+                    };
+                };
+            };
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            422: components["responses"]["Unprocessable"];
+            429: components["responses"]["TooManyCalls"];
+            500: components["responses"]["ServerError"];
+            503: components["responses"]["ServiceUnavailable"];
+        };
+    };
+    completeSignUp: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sign_up_id: components["parameters"]["SignUpId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SignUpCompletion"];
+            };
+        };
+        responses: {
+            /** @description Signed up. The recovery codes, shown this once, and the first session. Sent with `no-store`. */
+            201: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    "Cache-Control": components["headers"]["CacheControl"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SignedUp"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            404: components["responses"]["NotFound"];
+            /**
+             * @description Refused, and the sign-up is spent. `passkey_not_verified`: the answer did not prove a new
+             *     key Onplo will keep, and which check failed is never said. `username_not_available`:
+             *     somebody took the name since the sign-up started.
+             */
+            409: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"] & {
+                        /** @enum {unknown} */
+                        code?: "passkey_not_verified" | "username_not_available";
+                    };
+                };
+            };
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            422: components["responses"]["Unprocessable"];
+            429: components["responses"]["TooManyCalls"];
+            500: components["responses"]["ServerError"];
+            503: components["responses"]["ServiceUnavailable"];
+        };
+    };
+    startRecovery: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["RecoveryStart"];
+            };
+        };
+        responses: {
+            /** @description The recovery, and the question to put to the new passkey. */
+            201: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Recovery"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            /**
+             * @description Refused. `recovery_not_verified`: the username and code did not prove a person, and why is
+             *     never said.
+             */
+            409: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"] & {
+                        /** @enum {unknown} */
+                        code?: "recovery_not_verified";
+                    };
+                };
+            };
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            422: components["responses"]["Unprocessable"];
+            429: components["responses"]["TooManyCalls"];
+            500: components["responses"]["ServerError"];
+            501: components["responses"]["NotImplemented"];
+        };
+    };
+    completeRecovery: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                recovery_id: components["parameters"]["RecoveryId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["RecoveryCompletion"];
+            };
+        };
+        responses: {
+            /** @description Back in. Where the person may go, and the token that opens one session. Sent with `no-store`. */
+            200: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    "Cache-Control": components["headers"]["CacheControl"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SignInChoices"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            404: components["responses"]["NotFound"];
+            /**
+             * @description Refused, and the recovery is spent. `passkey_not_verified`: the answer did not prove a new
+             *     key Onplo will keep. `already_registered`: that key is kept already.
+             */
+            409: {
+                headers: {
+                    "Onplo-Request-Id": components["headers"]["OnploRequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"] & {
+                        /** @enum {unknown} */
+                        code?: "passkey_not_verified" | "already_registered";
+                    };
+                };
+            };
+            413: components["responses"]["ContentTooLarge"];
+            415: components["responses"]["UnsupportedMediaType"];
+            422: components["responses"]["Unprocessable"];
+            429: components["responses"]["TooManyCalls"];
+            500: components["responses"]["ServerError"];
+            501: components["responses"]["NotImplemented"];
+            503: components["responses"]["ServiceUnavailable"];
+        };
+    };
+}