@synqauth/js 0.0.0-stage → 0.0.0

package/dist/index.d.ts

@@ -0,0 +1,2055 @@
+import { a as Problem, c as SynqError, d as ERROR_CODES, f as SynqErrorCode, i as OAuthErrorCode, l as isSynqError, n as operations$1, o as SynqAnyErrorCode, r as paths$1, s as SynqClientErrorCode, t as components$1, u as problemError } from "./management-y9-9AIc-.js";
+//#region src/storage.d.ts
+/**
+ * Where the client keeps what it must remember: the session, and a sign-in's
+ * transaction (its PKCE verifier, state and nonce) across the redirect to
+ * Synq and back. Any key-value store fits; each method may be async.
+ *
+ * Refresh tokens are kept only by a store that says it may hold them
+ * (`holdsRefreshTokens`): the memory store, or one on a server or in a
+ * device's secure storage. Everything else keeps the session without its
+ * refresh token, which then lives in the client's memory alone, so a refresh
+ * token never lands in `localStorage` or `sessionStorage`, where any script
+ * on the page reads it.
+ *
+ * Synq rotates refresh tokens and ends the whole grant when a used one comes
+ * back, so only one refresh may run at a time for one session. One client
+ * makes sure of that by itself. When several clients share a store (requests
+ * on one server, or replicas sharing a cookie or Redis), the store must give
+ * them a lock (`lock`); a store without one is for one client per process.
+ */
+interface SynqStorage {
+  get(key: string): string | null | undefined | Promise<string | null | undefined>;
+  set(key: string, value: string): void | Promise<void>;
+  remove(key: string): void | Promise<void>;
+  /** Whether this store may hold refresh tokens: true only for memory, a server or secure device storage. */
+  readonly holdsRefreshTokens?: boolean;
+  /**
+   * Runs `fn` while no other holder of `name`'s lock runs, in any client
+   * sharing this store: the client refreshes inside it, and reads the
+   * session again first, so a refresh another client finished meanwhile is
+   * used rather than repeated. A store shared across requests or replicas
+   * must have one.
+   */
+  lock?<T>(name: string, fn: () => Promise<T>): Promise<T>;
+  /** The keys it holds, so the client can sweep away sign-ins that were never finished. */
+  keys?(): Iterable<string> | Promise<Iterable<string>>;
+}
+/**
+ * Keeps everything in this process's memory: the default, and the only store
+ * that holds refresh tokens unless told. Clients that share one share its
+ * lock, so they never refresh one session twice at once.
+ */
+export declare function memoryStorage(): SynqStorage;
+/**
+ * The tab's `sessionStorage`: it ends with the tab, and no other tab reads
+ * it. As the session's store it keeps the access and ID tokens only, never
+ * the refresh token.
+ */
+export declare function browserSessionStorage(): SynqStorage;
+/**
+ * The browser's `localStorage`, which every tab of the app's origin shares.
+ * Where a sign-in's transaction goes by default in a browser: a magic link
+ * or an email's link opens a new tab, which finishes the sign-in and comes
+ * back to the app there, so the tab that started it can't be the only one
+ * that knows it. Each transaction is kept under its own state, for an hour
+ * at most, deleted when it finishes, and swept away when stale. The price:
+ * any script on the app's origin can read a transaction meanwhile (its PKCE
+ * verifier and nonce, useless without the code Synq sends to the app's own
+ * redirect URI), as it can read anything else the app keeps. As the
+ * session's store it keeps the access and ID tokens only, never the refresh
+ * token.
+ */
+export declare function browserLocalStorage(): SynqStorage;
+//#endregion
+//#region src/client.d.ts
+/** What a Synq client needs to know about the app it signs people in to. */
+interface SynqClientOptions {
+  /** The brand's issuer URL, as the dashboard shows it (`https://<issuer-slug>.auth.<Synq's domain>`). */
+  issuer: string | URL;
+  /** The app's client_id, from the dashboard or the management API. */
+  clientId: string;
+  /**
+   * A confidential app's secret, sent with HTTP Basic. Only on a server:
+   * an app whose code reaches a browser has no secret.
+   */
+  clientSecret?: string;
+  /** Where Synq sends the browser back with the code: one of the app's registered redirect URIs, exactly. */
+  redirectUri: string;
+  /** Where the browser lands after signing out: one of the app's registered post-logout URIs. */
+  postLogoutRedirectUri?: string;
+  /** The scopes to ask for: `openid` by default. Add `offline_access` for a refresh token. */
+  scope?: string;
+  /** The API the access token is for (RFC 8707): a registered API's identifier. Without it the token is only good for userinfo. */
+  resource?: string;
+  /**
+   * Where the session is kept: this process's memory by default. Clients
+   * that share a store (requests on a server, replicas) need one with a
+   * `lock`, so they never present one refresh token twice; without one, use
+   * one client per process.
+   */
+  storage?: SynqStorage;
+  /**
+   * Where a sign-in's transaction is kept across the redirect: the browser's
+   * localStorage, which every tab of the app shares (a magic link finishes a
+   * sign-in in a new tab), and memory outside a browser.
+   */
+  transactionStorage?: SynqStorage;
+  /** The `fetch` to call Synq with: the global one by default. */
+  fetch?: typeof fetch;
+  /** How many seconds before the access token expires `getAccessToken` gets a new one: 30 by default. */
+  refreshLeewaySeconds?: number;
+}
+/** What to ask for when sending someone to sign in. */
+interface AuthorizationUrlOptions {
+  /** Go straight to one sign-in method of the hosted page (`synq_method`): `password`, `email`, `passkey`, `wallet`, `google`... */
+  method?: string;
+  /** The address or username to fill in (`login_hint`). */
+  loginHint?: string;
+  /** `login` to ask for a fresh sign-in, `none` to sign in without showing anything (or fail), `consent` to ask again. */
+  prompt?: 'none' | 'login' | 'consent' | 'select_account';
+  /**
+   * The longest ago, in seconds, the person may have signed in (`max_age`);
+   * the ID token's `auth_time` is checked against it. Sent only when given:
+   * Synq asks anyone whose sign-in time it never saw proved (a provider that
+   * says nothing of when, such as Discord) to sign in again whenever
+   * `max_age` is present, so ask for it only where a fresh sign-in matters.
+   */
+  maxAge?: number;
+  /** The scopes for this sign-in, instead of the client's. */
+  scope?: string;
+  /** The API for this sign-in's access token, instead of the client's. */
+  resource?: string;
+  /**
+   * Other APIs the sign-in's grant should cover too (RFC 8707: one
+   * `resource` each). The code is still exchanged for `resource`'s token;
+   * another client sharing the session's store gets one for these by
+   * refreshing with its own `resource`, as @synqauth/nextjs does for the
+   * account API beside the app's own.
+   */
+  additionalResources?: readonly string[];
+  /** Any other parameter Synq takes, such as `synq_intent`. They can't replace the flow's own (state, nonce, PKCE, redirect URI). */
+  params?: Readonly<Record<string, string>>;
+  /**
+   * Sends the request's parameters to the issuer first, as a pushed
+   * authorization request (RFC 9126), and answers a URL that carries only
+   * its reference: for a parameter that must never travel in a URL, such
+   * as a wallet's signature (`synq_siws`).
+   */
+  pushed?: boolean;
+}
+/** The claims of a validated ID token: who signed in, when, and how. */
+interface IdTokenClaims {
+  readonly iss: string;
+  readonly sub: string;
+  readonly aud: string | string[];
+  readonly iat: number;
+  readonly exp: number;
+  readonly auth_time?: number;
+  readonly amr?: string[];
+  readonly acr?: string;
+  readonly [claim: string]: unknown;
+}
+/** A signed-in session, without its refresh token, which the client keeps to itself. */
+interface Session {
+  readonly accessToken: string;
+  readonly tokenType: string;
+  /** When the access token expires, in seconds since the epoch, when Synq said. */
+  readonly expiresAt: number | undefined;
+  readonly scope: string | undefined;
+  readonly idToken: string | undefined;
+  /** The ID token's claims, validated when it was issued. */
+  readonly claims: IdTokenClaims | undefined;
+  /** Whether the client holds a refresh token for this session. */
+  readonly refreshable: boolean;
+}
+/** A change to the session, as `subscribe` reports it. */
+type SessionEvent = {
+  readonly type: 'signed-in';
+  readonly session: Session;
+} | {
+  readonly type: 'refreshed';
+  readonly session: Session;
+} | {
+  readonly type: 'signed-out';
+  readonly session: null;
+};
+/** What `signOut` takes: where the browser lands afterwards, and the `state` handed back there. */
+interface SignOutOptions {
+  /** Where the browser lands afterwards, instead of the client's `postLogoutRedirectUri`. */
+  postLogoutRedirectUri?: string;
+  /** Handed back on the post-logout redirect. */
+  state?: string;
+}
+/**
+ * A client for one app at one brand's issuer, made by `createSynqClient`: it
+ * signs people in with the authorization code flow, keeps the session, and
+ * refreshes and ends it.
+ */
+interface SynqClient {
+  /** The URL to send the browser to, to sign in; the transaction it starts is kept in `transactionStorage`. */
+  authorizationUrl(options?: AuthorizationUrlOptions): Promise<URL>;
+  /** In a browser: sends it to Synq to sign in. */
+  signIn(options?: AuthorizationUrlOptions): Promise<void>;
+  /** Finishes a sign-in from the URL Synq sent the browser back to; each transaction finishes once. */
+  handleCallback(url: string | URL): Promise<Session>;
+  /** The current session, or `null` when nobody is signed in. */
+  getSession(): Promise<Session | null>;
+  /**
+   * After a page loads: the session, while it can still give a current
+   * access token (its access token is good for the leeway, or the client
+   * holds its refresh token), or `null` when there is none. A session the
+   * browser kept without its refresh token, whose access token is running
+   * out, is ended here, and the browser is sent to Synq with `prompt=none` to
+   * sign the person in again without showing anything; it resolves `null` as
+   * the page leaves. On the way back, `handleCallback` signs them in, or
+   * fails with `login_required` when they are no longer signed in at Synq.
+   * Call it on page load, but not on the callback's own page.
+   */
+  restoreSession(options?: Omit<AuthorizationUrlOptions, 'prompt'>): Promise<Session | null>;
+  /** A current access token, refreshed first when it expires within `minValiditySeconds` (the client's leeway by default). */
+  getAccessToken(options?: {
+    minValiditySeconds?: number;
+  }): Promise<string>;
+  /**
+   * Gets new tokens with the refresh token. Calls at once share one request:
+   * Synq rotates refresh tokens and treats a used one presented again as
+   * theft, ending the whole grant.
+   */
+  refresh(): Promise<Session>;
+  /** Calls `listener` on every sign-in, refresh and sign-out; returns the function that stops it. */
+  subscribe(listener: (event: SessionEvent) => void): () => void;
+  /**
+   * Ends the session here, revokes its refresh token, and returns Synq's
+   * sign-out URL (RP-initiated logout), to send the browser to so the
+   * brand's session ends too: `null` when the issuer has none.
+   */
+  signOut(options?: SignOutOptions): Promise<URL | null>;
+}
+/** A client for one app at one of a brand's Synq issuers. */
+export declare function createSynqClient(options: SynqClientOptions): SynqClient;
+//#endregion
+//#region src/generated/account.d.ts
+interface paths {
+  readonly "/v1/consents": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * The apps the signed-in person allowed
+     * @description What they allowed each app that isn't the brand's own, oldest first: signing in to it again doesn't ask again for that. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Their consents */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["Consent"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/consents/{consent}": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    readonly post?: never;
+    /**
+     * Withdraw what the person allowed an app
+     * @description The app's grants and tokens for them end, its refresh tokens included, and each session it was signed in to that registered a `backchannel_logout_uri` gets a logout token; their next sign-in to it asks again. Needs `me:write`. Recorded as `user.consent_revoked`.
+     */
+    readonly delete: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly consent: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Withdrawn */
+        readonly 204: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No such consent */
+        readonly 404: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/deletion": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Schedule the signed-in person's account for deletion
+     * @description It is deleted 30 days later. Their sessions end at once, and each app they had signed in to that registered a `backchannel_logout_uri` gets a logout token; they can't sign in meanwhile. Someone who owns a Synq org hands it over or deletes it first. Needs `me:write`. Recorded as `user.deletion_scheduled`.
+     */
+    readonly post: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Scheduled */
+        readonly 202: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["Profile"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Someone who owns an org */
+        readonly 409: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    /**
+     * Cancel a scheduled deletion
+     * @description Needs `me:write`. Recorded as `user.deletion_cancelled`.
+     */
+    readonly delete: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Cancelled */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["Profile"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/identities": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * List the signed-in person's ways to sign in
+     * @description Their wallets, their email address and the accounts at providers they sign in with, oldest first. Passkeys are at `/v1/passkeys`. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Their ways to sign in */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["Identity"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/identities/{identity}": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    readonly post?: never;
+    /**
+     * Remove a way to sign in
+     * @description A wallet, the email address (with its password) or an account at a provider stops signing the person in. Their last way to sign in can't be removed (`last_sign_in_method`): an email address counts only with its password, or where people can sign in with an emailed code. Removing their primary wallet makes their most recently used other wallet primary. Removing the email address leaves it their contact address, no longer verified. Sessions it signed in keep going: end them with `DELETE /v1/sessions/{session}`. Passkeys are removed at `/v1/passkeys`. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. Recorded as `user.identity_unlinked`.
+     */
+    readonly delete: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly identity: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Removed */
+        readonly 204: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No such way to sign in */
+        readonly 404: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description It is their last way to sign in (`last_sign_in_method`) */
+        readonly 409: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/link-requests": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Start adding a way to sign in
+     * @description A link request for the person, through this app: send them to sign in from this app with its `authorization_params` added. They sign in again as themselves, then use the method being added (a wallet, an emailed code, a provider), and it joins their account; a way in another person has is never merged. Methods the brand doesn't offer, or that can't show a fresh sign-in (Apple, Facebook, X, Discord), answer 409 `sign_in_method_unavailable`; so does an email address for an account that has one. One person has at most 20 ways to sign in (409 `identity_limit_reached`). Needs `me:write`. An account that signs in with an email address nobody proved yet takes no new way to sign in: 403 `email_unverified` until the person verifies it.
+     */
+    readonly post: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody: {
+        readonly content: {
+          readonly "application/json": components["schemas"]["NewLinkRequest"];
+        };
+      };
+      readonly responses: {
+        /** @description The link request */
+        readonly 201: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["LinkRequest"];
+          };
+        };
+        /** @description A body that is not valid, such as a method that can’t be added */
+        readonly 400: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks `me:write` (`insufficient_permissions`), or the account signs in with an email address nobody proved yet (`email_unverified`) */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The method can’t be added here (`sign_in_method_unavailable`), or the person has as many ways to sign in as one may (`identity_limit_reached`) */
+        readonly 409: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Adding ways to sign in is not set up here */
+        readonly 503: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/metadata": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * Read what the brand keeps about the signed-in person
+     * @description The tenant's own JSON for this user, read-only here. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description The metadata */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly [key: string]: unknown;
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/passkeys": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * List the signed-in person's passkeys
+     * @description Oldest first. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Their passkeys */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["Passkey"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Passkeys are not set up here */
+        readonly 503: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    /**
+     * Keep a new passkey
+     * @description Checks what the browser made from the options of `POST /v1/passkeys/registration-options` (its challenge, origin, relying party and user verification) and keeps it, and emails the person's verified address that a passkey was added. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. An account that signs in with an email address nobody proved yet takes no new way to sign in: 403 `email_unverified` until the person verifies it. Recorded as `user.passkey_added`.
+     */
+    readonly post: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: {
+        readonly content: {
+          readonly "application/json": components["schemas"]["NewPasskey"];
+        };
+      };
+      readonly responses: {
+        /** @description The new passkey */
+        readonly 201: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["Passkey"];
+          };
+        };
+        /** @description The passkey didn't check out (`passkey_rejected`) */
+        readonly 400: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks `me:write` (`insufficient_permissions`), the sign-in isn’t recent enough (`fresh_sign_in_required`), or the account signs in with an email address nobody proved yet (`email_unverified`) */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The person has this passkey already (`passkey_exists`) */
+        readonly 409: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Passkeys are not set up here */
+        readonly 503: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/passkeys/{passkey}": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    readonly post?: never;
+    /**
+     * Remove a passkey
+     * @description It stops signing the person in. Their last way to sign in can't be removed (`last_sign_in_method`): an email address counts only with its password, or where people can sign in with an emailed code. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. Recorded as `user.passkey_removed`.
+     */
+    readonly delete: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly passkey: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Removed */
+        readonly 204: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks `me:write` (`insufficient_permissions`), or the sign-in isn’t recent enough (`fresh_sign_in_required`) */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No such passkey */
+        readonly 404: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description It is their last way to sign in (`last_sign_in_method`) */
+        readonly 409: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Passkeys are not set up here */
+        readonly 503: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/passkeys/registration-options": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Start making a passkey
+     * @description The options to hand the browser for a new passkey: discoverable, with user verification, and none the person has already. Send what the browser makes to `POST /v1/passkeys` within 5 minutes. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. An account that signs in with an email address nobody proved yet takes no new way to sign in: 403 `email_unverified` until the person verifies it.
+     */
+    readonly post: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description The options */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["PasskeyCreationOptions"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks `me:write` (`insufficient_permissions`), the sign-in isn’t recent enough (`fresh_sign_in_required`), or the account signs in with an email address nobody proved yet (`email_unverified`) */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Passkeys are not set up here */
+        readonly 503: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/profile": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * Read the signed-in person's profile
+     * @description Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description The profile */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["Profile"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    /**
+     * Change the signed-in person's profile
+     * @description Their username, names, picture and language; null clears one. Not their email, which a sign-in method proves. Needs `me:write`. Recorded as `user.updated`.
+     */
+    readonly patch: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody: {
+        readonly content: {
+          readonly "application/json": components["schemas"]["ProfileUpdate"];
+        };
+      };
+      readonly responses: {
+        /** @description The profile, changed */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["Profile"];
+          };
+        };
+        /** @description A field that is not valid */
+        readonly 400: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description A username someone else in the brand has */
+        readonly 409: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly trace?: never;
+  };
+  readonly "/v1/sessions": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * List the signed-in person's sessions
+     * @description Newest first, the caller's own marked `current`. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Their sessions */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["Session"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/sessions/{session}": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    readonly post?: never;
+    /**
+     * Sign out of one session
+     * @description Ends it and every grant it made: its refresh tokens stop working. Each app the session had signed in to that registered a `backchannel_logout_uri` gets a logout token; one that turned `backchannel_logout_session_required` off gets it without `sid`, so it signs the person out of every session it has. Needs `me:write`. Recorded as `user.sessions_revoked`.
+     */
+    readonly delete: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly session: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Ended */
+        readonly 204: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No such session */
+        readonly 404: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/sign-ins": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * The signed-in person's recent sign-ins
+     * @description The last 50, newest first. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Their sign-ins */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["SignIn"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/usernames/{username}": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * Check whether a username is free
+     * @description In this brand. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly username: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Whether it is free */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["UsernameAvailability"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/wallets": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * List the signed-in person's wallets
+     * @description The Solana wallets they sign in with, oldest first. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Their wallets */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["Wallet"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/wallets/{wallet}": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    /**
+     * Name a wallet, or make it primary
+     * @description Its label (null clears it), and `primary: true` makes it their primary wallet in place of the one that was. Needs `me:write`. Recorded as `user.updated`.
+     */
+    readonly patch: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly wallet: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody: {
+        readonly content: {
+          readonly "application/json": components["schemas"]["WalletUpdate"];
+        };
+      };
+      readonly responses: {
+        /** @description The wallet, changed */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["Wallet"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No such wallet */
+        readonly 404: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly trace?: never;
+  };
+}
+interface components {
+  schemas: {
+    readonly Consent: {
+      /**
+       * Format: date-time
+       * @description When the person first allowed it
+       */
+      readonly allowed_at: string;
+      /** @description Each API's scopes allowed, by the API's identifier */
+      readonly apis: readonly {
+        readonly identifier: string;
+        readonly scopes: readonly string[];
+      }[];
+      readonly app: {
+        /** @example app_01h455vb4pex5vsknk084sn02q */
+        readonly client_id: string;
+        /** @description Its name, for one of the brand’s apps; null for an app known only by its metadata document */
+        readonly name: string | null;
+      };
+      /**
+       * @description The OpenID claims allowed besides what the scopes carry (the `claims` request parameter)
+       * @example []
+       */
+      readonly claims: readonly string[];
+      /** @example cns_01h455vb4pex5vsknk084sn02q */
+      readonly id: string;
+      /**
+       * @description The OpenID scopes allowed
+       * @example [
+       *       "openid",
+       *       "email"
+       *     ]
+       */
+      readonly scopes: readonly string[];
+      /**
+       * Format: date-time
+       * @description When they last allowed it more
+       */
+      readonly updated_at: string;
+    };
+    readonly Identity: {
+      /** Format: date-time */
+      readonly created_at: string;
+      /** @example idn_01h455vb4pex5vsknk084sn02q */
+      readonly id: string;
+      /** Format: date-time */
+      readonly last_used_at: string | null;
+      /** @description For `email`: whether a password signs in with the address */
+      readonly password?: boolean;
+      /** @example google */
+      readonly provider: string;
+      /** @description Who the person is there: a wallet address (`solana`), their email address (`email`), or the provider’s own id for them */
+      readonly subject: string;
+    };
+    readonly LinkRequest: {
+      /** @description Add these to an authorization request from the same app (its own PKCE, state and redirect URI): the person signs in again as themselves, then uses the method, which joins their account. The request works for 10 minutes, for this person through this app, and only with that sign-in in the browser; it authorizes nothing by itself. */
+      readonly authorization_params: {
+        /** @enum {string} */
+        readonly prompt: "login";
+        /** @enum {string} */
+        readonly synq_intent: "link";
+        readonly synq_link: string;
+      };
+      /** Format: date-time */
+      readonly expires_at: string;
+      /**
+       * @description The way to sign in being added. More are added over time.
+       * @example wallet
+       */
+      readonly method: string;
+    };
+    readonly NewLinkRequest: {
+      /**
+       * @description The way to sign in to add: a Solana wallet, an email address (proved with an emailed code), or an account at a provider the brand offers
+       * @enum {string}
+       */
+      readonly method: "wallet" | "email" | "google" | "microsoft" | "apple" | "facebook" | "x" | "discord" | "telegram" | "matrica";
+    };
+    readonly NewPasskey: {
+      /** @description The new credential, as `PublicKeyCredential.toJSON()` writes it */
+      readonly credential: {
+        readonly [key: string]: unknown;
+      };
+    };
+    readonly Passkey: {
+      /** @description Whether a synced passkey is backed up now */
+      readonly backed_up: boolean;
+      /** Format: date-time */
+      readonly created_at: string;
+      /** @example pky_01h455vb4pex5vsknk084sn02q */
+      readonly id: string;
+      /** Format: date-time */
+      readonly last_used_at: string | null;
+      /** @description Whether the passkey can leave its device: a synced passkey, kept by a password manager or a platform account */
+      readonly synced: boolean;
+      /**
+       * @example [
+       *       "internal",
+       *       "hybrid"
+       *     ]
+       */
+      readonly transports: readonly string[];
+    };
+    /** @description WebAuthn's `PublicKeyCredentialCreationOptionsJSON`, for `navigator.credentials.create` (through `PublicKeyCredential.parseCreationOptionsFromJSON`). The relying party is this issuer's host; a page on one of the brand's own apps' origins may use it where the browser supports related origins (`/.well-known/webauthn`). Its challenge works for 5 minutes, once, for this person through this app. */
+    readonly PasskeyCreationOptions: {
+      readonly [key: string]: unknown;
+    };
+    readonly Problem: {
+      /** @example insufficient_permissions */
+      readonly code: string;
+      /** @example This key lacks org.brands.edit. */
+      readonly detail?: string;
+      /** @description What was wrong with the request, field by field */
+      readonly errors?: readonly {
+        readonly message: string;
+        readonly path: string;
+      }[];
+      /** @example org.brands.edit */
+      readonly missing_permission?: string;
+      /**
+       * @description Why, for code to read, where a code has several causes
+       * @example public_mailbox
+       */
+      readonly reason?: string;
+      /** @example 403 */
+      readonly status: number;
+      /** @example Insufficient permissions */
+      readonly title: string;
+      /** @example https://docs.synq.build/errors/insufficient_permissions */
+      readonly type: string;
+    };
+    readonly Profile: {
+      /** Format: date-time */
+      readonly created_at: string;
+      /**
+       * Format: date-time
+       * @description When the account will be deleted, if the person asked for it
+       */
+      readonly deletion_scheduled_for: string | null;
+      readonly email: string | null;
+      readonly email_verified: boolean;
+      readonly family_name: string | null;
+      readonly given_name: string | null;
+      readonly locale: string | null;
+      readonly name: string | null;
+      readonly picture: string | null;
+      /** @example usr_01h455vb4pex5vsknk084sn02q */
+      readonly sub: string;
+      readonly username: string | null;
+    };
+    readonly ProfileUpdate: {
+      readonly family_name?: string | null;
+      readonly given_name?: string | null;
+      readonly locale?: string | null;
+      readonly name?: string | null;
+      /** Format: uri */
+      readonly picture?: string | null;
+      readonly username?: string | null;
+    };
+    readonly Session: {
+      readonly amr: readonly string[];
+      /** @description The apps signed in to: their client ids */
+      readonly apps: readonly string[];
+      /** @description Whether this is the session the calling access token came from: the device making the call */
+      readonly current: boolean;
+      /** Format: date-time */
+      readonly expires_at: string | null;
+      readonly id: string;
+      /** Format: date-time */
+      readonly signed_in_at: string | null;
+    };
+    readonly SignIn: {
+      readonly amr: readonly string[];
+      /** @description The client id of the app signed in to */
+      readonly app: string;
+      /** Format: date-time */
+      readonly at: string;
+      /** @example email */
+      readonly provider: string;
+    };
+    readonly UsernameAvailability: {
+      readonly available: boolean;
+      /** @enum {string|null} */
+      readonly reason: "format" | "taken" | null;
+      readonly username: string;
+    };
+    readonly Wallet: {
+      /** @example seedYs9i7pN9W4yJ5wUZn3tqxV4o5fH8sZ7mJm6dRKA */
+      readonly address: string;
+      /** Format: date-time */
+      readonly created_at: string;
+      /** @example idn_01h455vb4pex5vsknk084sn02q */
+      readonly id: string;
+      /** @description What the person calls it */
+      readonly label: string | null;
+      /** Format: date-time */
+      readonly last_used_at: string | null;
+      /** @description Their primary wallet: at most one is */
+      readonly primary: boolean;
+    };
+    readonly WalletUpdate: {
+      readonly label?: string | null;
+      /**
+       * @description Makes it their primary wallet, in place of the one that was
+       * @enum {boolean}
+       */
+      readonly primary?: true;
+    };
+  };
+  responses: never;
+  parameters: never;
+  requestBodies: never;
+  headers: never;
+  pathItems: never;
+}
+type operations = Record<string, never>;
+//#endregion
+//#region src/account.d.ts
+type Schemas = components['schemas'];
+/** The signed-in person's profile, as the account API answers it. */
+type AccountProfile = Schemas['Profile'];
+/** What `user.update()` may change: only the fields given. */
+type AccountProfileUpdate = Schemas['ProfileUpdate'];
+/** One of the person's wallets. */
+type AccountWallet = Schemas['Wallet'];
+/** What `wallets.update()` may change: the label, or making it primary. */
+type AccountWalletUpdate = Schemas['WalletUpdate'];
+/** One of the person's ways to sign in: a wallet, an email address or a provider's account. */
+type AccountIdentity = Schemas['Identity'];
+/** One of the person's sessions at the brand; `current` marks the one the call came from. */
+type AccountSession = Schemas['Session'];
+/** One recent sign-in: when, how and to which app. */
+type AccountSignIn = Schemas['SignIn'];
+/** What the person allowed an app outside the brand's own to do. */
+type AccountConsent = Schemas['Consent'];
+/** One of the person's passkeys. */
+type AccountPasskey = Schemas['Passkey'];
+/** A link request: the sign-in that adds a way in carries its `authorization_params`. */
+type AccountLinkRequest = Schemas['LinkRequest'];
+/** Whether a username is free for the person to take, and why not. */
+type AccountUsernameAvailability = Schemas['UsernameAvailability'];
+/** A way to sign in a link request can add. */
+type LinkMethod = Schemas['NewLinkRequest']['method'];
+/** A call's outcome: its data, or the `SynqError` it failed with (branch on `error.code`). */
+type AccountResult<T> = {
+  readonly data: T;
+  readonly error: null;
+} | {
+  readonly data: null;
+  readonly error: SynqError;
+};
+/** What every change takes. */
+interface ChangeOptions {
+  /** Sent as `Idempotency-Key`. One is made for each call when left out; pass your own to send a call again after a lost answer. */
+  idempotencyKey?: string;
+  signal?: AbortSignal;
+}
+/** What every read takes. */
+interface ReadOptions {
+  signal?: AbortSignal;
+}
+/** What `createAccountClient` takes. */
+interface AccountClientOptions {
+  /** The brand's issuer URL, as for `createSynqClient`. */
+  issuer: string | URL;
+  /**
+   * The access token for the account API, a token Synq issued for the
+   * resource `accountApiUrl(issuer)`. Pass a `SynqClient`'s `getAccessToken`
+   * when that client's `resource` is the account API, so the token refreshes
+   * on its own.
+   */
+  accessToken: () => string | Promise<string>;
+  /** The `fetch` to call Synq with: the global one by default. */
+  fetch?: typeof fetch;
+}
+/** The brand's account API for the signed-in person, as `createAccountClient` makes it: every call answers `{ data, error }`. */
+interface AccountClient {
+  /** Who is signed in: their profile. */
+  me: (options?: ReadOptions) => Promise<AccountResult<AccountProfile>>;
+  user: {
+    /** Changes their profile: only the fields given. */
+    update: (changes: AccountProfileUpdate, options?: ChangeOptions) => Promise<AccountResult<AccountProfile>>;
+    /** What the brand keeps for them (the brand's servers write it, through the management API). */
+    metadata: (options?: ReadOptions) => Promise<AccountResult<Record<string, unknown>>>;
+    /** Whether a username is free for them to take. */
+    usernameAvailable: (username: string, options?: ReadOptions) => Promise<AccountResult<AccountUsernameAvailability>>;
+  };
+  wallets: {
+    list: (options?: ReadOptions) => Promise<AccountResult<readonly AccountWallet[]>>;
+    /** Names a wallet, or makes it their primary one. */
+    update: (wallet: string, changes: AccountWalletUpdate, options?: ChangeOptions) => Promise<AccountResult<AccountWallet>>;
+    /** Removes a wallet: it is one of their ways to sign in, so its identity goes. */
+    remove: (wallet: string, options?: ChangeOptions) => Promise<AccountResult<null>>;
+  };
+  accounts: {
+    /** Their ways to sign in: wallets, email, providers. */
+    list: (options?: ReadOptions) => Promise<AccountResult<readonly AccountIdentity[]>>;
+    /**
+     * Starts adding a way to sign in: send them to sign in from the same
+     * app with `linkSignIn(answer)`, as `client.signIn(linkSignIn(answer))`.
+     */
+    link: (method: LinkMethod, options?: ChangeOptions) => Promise<AccountResult<AccountLinkRequest>>;
+    /** Removes a way to sign in; the last one can't go (`last_sign_in_method`). */
+    unlink: (identity: string, options?: ChangeOptions) => Promise<AccountResult<null>>;
+  };
+  sessions: {
+    /** Where they are signed in; `current` marks this one. */
+    list: (options?: ReadOptions) => Promise<AccountResult<readonly AccountSession[]>>;
+    /** Signs that session out, at every app in it. */
+    revoke: (session: string, options?: ChangeOptions) => Promise<AccountResult<null>>;
+  };
+  passkeys: {
+    list: (options?: ReadOptions) => Promise<AccountResult<readonly AccountPasskey[]>>;
+    /** WebAuthn creation options, for `navigator.credentials.create`. */
+    registrationOptions: (options?: ChangeOptions) => Promise<AccountResult<Record<string, unknown>>>;
+    /** Adds the passkey `navigator.credentials.create` made, as `credential.toJSON()` writes it. */
+    register: (credential: Record<string, unknown>, options?: ChangeOptions) => Promise<AccountResult<AccountPasskey>>;
+    remove: (passkey: string, options?: ChangeOptions) => Promise<AccountResult<null>>;
+  };
+  consents: {
+    /** What they allowed apps outside the brand's own to do. */
+    list: (options?: ReadOptions) => Promise<AccountResult<readonly AccountConsent[]>>;
+    withdraw: (consent: string, options?: ChangeOptions) => Promise<AccountResult<null>>;
+  };
+  /** Their recent sign-ins, newest first. */
+  activity: (options?: ReadOptions) => Promise<AccountResult<readonly AccountSignIn[]>>;
+  deletion: {
+    /** Asks for the account to be deleted, after the grace period: `me().deletion_scheduled_for` says when. */
+    schedule: (options?: ChangeOptions) => Promise<AccountResult<unknown>>;
+    /** Takes the request back while the grace period lasts. */
+    cancel: (options?: ChangeOptions) => Promise<AccountResult<unknown>>;
+  };
+}
+/**
+ * The sign-in that finishes a link request, for `SynqClient.signIn` or
+ * `authorizationUrl`: a fresh sign-in (`prompt=login`) carrying the request.
+ */
+export declare function linkSignIn(request: AccountLinkRequest): AuthorizationUrlOptions;
+/** The account API's URL for a brand: the resource its access tokens are for. */
+export declare function accountApiUrl(issuer: string | URL): string;
+/** A client for the brand's account API, for an app that holds its own session: everything the signed-in person can do to their own account. */
+export declare function createAccountClient(options: AccountClientOptions): AccountClient;
+//#endregion
+export { type AccountClient, type AccountClientOptions, type components as AccountComponents, type AccountConsent, type AccountIdentity, type AccountLinkRequest, type operations as AccountOperations, type AccountPasskey, type paths as AccountPaths, type AccountProfile, type AccountProfileUpdate, type AccountResult, type AccountSession, type AccountSignIn, type AccountUsernameAvailability, type AccountWallet, type AccountWalletUpdate, type AuthorizationUrlOptions, type ChangeOptions, ERROR_CODES, type IdTokenClaims, type LinkMethod, type components$1 as ManagementComponents, type operations$1 as ManagementOperations, type paths$1 as ManagementPaths, type OAuthErrorCode, type Problem, type ReadOptions, type Session, type SessionEvent, type SignOutOptions, type SynqAnyErrorCode, type SynqClient, type SynqClientErrorCode, type SynqClientOptions, SynqError, type SynqErrorCode, type SynqStorage, isSynqError, problemError };