@synqauth/js 0.0.0-stage → 0.2.0

package/dist/index.d.ts

@@ -0,0 +1,2215 @@
+import { A as SignInFlowStep, C as browserLocalStorage, D as PasskeyRequestOptionsJSON, E as PasskeyAssertionJSON, F as ChallengeMethod, I as ChallengeProblem, L as DeniedReason, M as StartSignInOptions, N as CHALLENGE_METHODS, O as SavedSignIn, P as CHALLENGE_PROBLEMS, R as RedirectReason, S as SynqStorage, T as memoryStorage, _ as SessionEvent, a as Problem, b as SynqClientOptions, c as SynqError, d as ERROR_CODES, f as SynqErrorCode, g as Session, h as ServerSignInOptions, i as OAuthErrorCode, j as SignInStepResult, k as SignInFlow, l as isSynqError, m as IdTokenClaims, n as operations$1, o as SynqAnyErrorCode, p as AuthorizationUrlOptions, r as paths$1, s as SynqClientErrorCode, t as components$1, u as problemError, v as SignOutOptions, w as browserSessionStorage, x as createSynqClient, y as SynqClient } from "./management-CWdCiiEv.js";
+//#region src/generated/account.d.ts
+interface paths {
+  readonly "/v1/api-keys": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * The signed-in person's API keys
+     * @description Oldest first, revoked and expired ones too; never a key itself. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Their API keys */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["UserApiKey"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    /**
+     * Make an API key
+     * @description A key for one of the brand's APIs that lets its users make them (`GET /v1/apis`): `ak_live_…` in production, `ak_test_…` elsewhere, in this response only. It acts as the person, with the scopes given, until it is revoked or expires, or the API stops letting its users make keys. At most 25 live at once. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. Recorded as `user.api_key_created`.
+     */
+    readonly post: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody: {
+        readonly content: {
+          readonly "application/json": components["schemas"]["UserApiKeyCreate"];
+        };
+      };
+      readonly responses: {
+        /** @description The new key */
+        readonly 201: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["NewUserApiKey"];
+          };
+        };
+        /** @description A body that is not valid: an API none lists, a scope it doesn’t define, or an expiry not ahead */
+        readonly 400: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks `me:write` (`insufficient_permissions`), the sign-in isn’t recent enough (`fresh_sign_in_required`), or the API doesn’t let its users make keys (`api_keys_not_allowed`) */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The person has 25 live keys already (`api_key_limit_reached`) */
+        readonly 409: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/api-keys/{key}": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    readonly post?: never;
+    /**
+     * Revoke an API key
+     * @description At once: its API's next check of it answers `active: false`. Needs `me:write`. Recorded as `user.api_key_revoked`.
+     */
+    readonly delete: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly key: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Revoked */
+        readonly 204: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No such live key */
+        readonly 404: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/apis": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * The APIs the person may make API keys for
+     * @description The brand's APIs whose tenant lets its users make API keys for them, with the scopes each defines, by name. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description The APIs */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["KeyableApi"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/consents": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * The apps the signed-in person allowed
+     * @description What they allowed each app that isn't the brand's own, oldest first: signing in to it again doesn't ask again for that. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Their consents */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["Consent"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/consents/{consent}": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    readonly post?: never;
+    /**
+     * Withdraw what the person allowed an app
+     * @description The app's grants and tokens for them end, its refresh tokens included, and each session it was signed in to that registered a `backchannel_logout_uri` gets a logout token; their next sign-in to it asks again. Needs `me:write`. Recorded as `user.consent_revoked`.
+     */
+    readonly delete: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly consent: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Withdrawn */
+        readonly 204: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No such consent */
+        readonly 404: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/deletion": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Schedule the signed-in person's account for deletion
+     * @description It is deleted 30 days later. Their sessions end at once, and each app they had signed in to that registered a `backchannel_logout_uri` gets a logout token; they can't sign in meanwhile. Someone who owns a Synq org hands it over or deletes it first. Needs `me:write`. Recorded as `user.deletion_scheduled`.
+     */
+    readonly post: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Scheduled */
+        readonly 202: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["Profile"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Someone who owns an org */
+        readonly 409: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    /**
+     * Cancel a scheduled deletion
+     * @description Needs `me:write`. Recorded as `user.deletion_cancelled`.
+     */
+    readonly delete: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Cancelled */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["Profile"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/identities": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * List the signed-in person's ways to sign in
+     * @description Their wallets, their email address and the accounts at providers they sign in with, oldest first. Passkeys are at `/v1/passkeys`. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Their ways to sign in */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["Identity"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/identities/{identity}": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    readonly post?: never;
+    /**
+     * Remove a way to sign in
+     * @description A wallet, the email address (with its password) or an account at a provider stops signing the person in. Their last way to sign in can't be removed (`last_sign_in_method`): an email address counts only with its password, or where people can sign in with an emailed code. Removing their primary wallet makes their most recently used other wallet primary. Removing the email address leaves it their contact address, no longer verified. Sessions it signed in keep going: end them with `DELETE /v1/sessions/{session}`. Passkeys are removed at `/v1/passkeys`. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. Recorded as `user.identity_unlinked`.
+     */
+    readonly delete: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly identity: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Removed */
+        readonly 204: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No such way to sign in */
+        readonly 404: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description It is their last way to sign in (`last_sign_in_method`) */
+        readonly 409: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/link-requests": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Start adding a way to sign in
+     * @description A link request for the person, through this app: send them to sign in from this app with its `authorization_params` added. They sign in again as themselves, then use the method being added (a wallet, an emailed code, a provider), and it joins their account; a way in another person has is never merged. Methods the brand doesn't offer, or that can't show a fresh sign-in (Apple, Facebook, X, Discord), answer 409 `sign_in_method_unavailable`; so does an email address for an account that has one. One person has at most 20 ways to sign in (409 `identity_limit_reached`). Needs `me:write`. An account that signs in with an email address nobody proved yet takes no new way to sign in: 403 `email_unverified` until the person verifies it.
+     */
+    readonly post: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody: {
+        readonly content: {
+          readonly "application/json": components["schemas"]["NewLinkRequest"];
+        };
+      };
+      readonly responses: {
+        /** @description The link request */
+        readonly 201: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["LinkRequest"];
+          };
+        };
+        /** @description A body that is not valid, such as a method that can’t be added */
+        readonly 400: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks `me:write` (`insufficient_permissions`), or the account signs in with an email address nobody proved yet (`email_unverified`) */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The method can’t be added here (`sign_in_method_unavailable`), or the person has as many ways to sign in as one may (`identity_limit_reached`) */
+        readonly 409: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Adding ways to sign in is not set up here */
+        readonly 503: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/metadata": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * Read what the brand keeps about the signed-in person
+     * @description The tenant's own JSON for this user, read-only here. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description The metadata */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly [key: string]: unknown;
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/passkeys": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * List the signed-in person's passkeys
+     * @description Oldest first. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Their passkeys */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["Passkey"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Passkeys are not set up here */
+        readonly 503: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    /**
+     * Keep a new passkey
+     * @description Checks what the browser made from the options of `POST /v1/passkeys/registration-options` (its challenge, origin, relying party and user verification) and keeps it, and emails the person's verified address that a passkey was added. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. An account that signs in with an email address nobody proved yet takes no new way to sign in: 403 `email_unverified` until the person verifies it. Recorded as `user.passkey_added`.
+     */
+    readonly post: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: {
+        readonly content: {
+          readonly "application/json": components["schemas"]["NewPasskey"];
+        };
+      };
+      readonly responses: {
+        /** @description The new passkey */
+        readonly 201: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["Passkey"];
+          };
+        };
+        /** @description The passkey didn't check out (`passkey_rejected`) */
+        readonly 400: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks `me:write` (`insufficient_permissions`), the sign-in isn’t recent enough (`fresh_sign_in_required`), or the account signs in with an email address nobody proved yet (`email_unverified`) */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The person has this passkey already (`passkey_exists`) */
+        readonly 409: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Passkeys are not set up here */
+        readonly 503: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/passkeys/{passkey}": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    readonly post?: never;
+    /**
+     * Remove a passkey
+     * @description It stops signing the person in. Their last way to sign in can't be removed (`last_sign_in_method`): an email address counts only with its password, or where people can sign in with an emailed code. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. Recorded as `user.passkey_removed`.
+     */
+    readonly delete: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly passkey: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Removed */
+        readonly 204: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks `me:write` (`insufficient_permissions`), or the sign-in isn’t recent enough (`fresh_sign_in_required`) */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No such passkey */
+        readonly 404: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description It is their last way to sign in (`last_sign_in_method`) */
+        readonly 409: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Passkeys are not set up here */
+        readonly 503: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/passkeys/registration-options": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Start making a passkey
+     * @description The options to hand the browser for a new passkey: discoverable, with user verification, and none the person has already. Send what the browser makes to `POST /v1/passkeys` within 5 minutes. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. An account that signs in with an email address nobody proved yet takes no new way to sign in: 403 `email_unverified` until the person verifies it.
+     */
+    readonly post: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description The options */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["PasskeyCreationOptions"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks `me:write` (`insufficient_permissions`), the sign-in isn’t recent enough (`fresh_sign_in_required`), or the account signs in with an email address nobody proved yet (`email_unverified`) */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Passkeys are not set up here */
+        readonly 503: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/profile": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * Read the signed-in person's profile
+     * @description Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description The profile */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["Profile"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    /**
+     * Change the signed-in person's profile
+     * @description Their username, names, picture and language; null clears one. Not their email, which a sign-in method proves. Needs `me:write`. Recorded as `user.updated`.
+     */
+    readonly patch: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody: {
+        readonly content: {
+          readonly "application/json": components["schemas"]["ProfileUpdate"];
+        };
+      };
+      readonly responses: {
+        /** @description The profile, changed */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["Profile"];
+          };
+        };
+        /** @description A field that is not valid */
+        readonly 400: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description A username someone else in the brand has */
+        readonly 409: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly trace?: never;
+  };
+  readonly "/v1/sessions": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * List the signed-in person's sessions
+     * @description Newest first, the caller's own marked `current`. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Their sessions */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["Session"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/sessions/{session}": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    readonly post?: never;
+    /**
+     * Sign out of one session
+     * @description Ends it and every grant it made: its refresh tokens stop working. Each app the session had signed in to that registered a `backchannel_logout_uri` gets a logout token; one that turned `backchannel_logout_session_required` off gets it without `sid`, so it signs the person out of every session it has. Needs `me:write`. Recorded as `user.sessions_revoked`.
+     */
+    readonly delete: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly session: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Ended */
+        readonly 204: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No such session */
+        readonly 404: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/sign-ins": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * The signed-in person's recent sign-ins
+     * @description The last 50, newest first. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Their sign-ins */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["SignIn"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/usernames/{username}": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * Check whether a username is free
+     * @description In this brand. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly username: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Whether it is free */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["UsernameAvailability"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/wallets": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * List the signed-in person's wallets
+     * @description The Solana wallets they sign in with, oldest first. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Their wallets */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["Wallet"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/wallets/{wallet}": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    /**
+     * Name a wallet, or make it primary
+     * @description Its label (null clears it), and `primary: true` makes it their primary wallet in place of the one that was. Needs `me:write`. Recorded as `user.updated`.
+     */
+    readonly patch: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly wallet: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody: {
+        readonly content: {
+          readonly "application/json": components["schemas"]["WalletUpdate"];
+        };
+      };
+      readonly responses: {
+        /** @description The wallet, changed */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["Wallet"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No such wallet */
+        readonly 404: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly trace?: never;
+  };
+}
+interface components {
+  schemas: {
+    readonly Consent: {
+      /**
+       * Format: date-time
+       * @description When the person first allowed it
+       */
+      readonly allowed_at: string;
+      /** @description Each API's scopes allowed, by the API's identifier */
+      readonly apis: readonly {
+        readonly identifier: string;
+        readonly scopes: readonly string[];
+      }[];
+      readonly app: {
+        /** @example app_01h455vb4pex5vsknk084sn02q */
+        readonly client_id: string;
+        /** @description Its name, for one of the brand’s apps; null for an app known only by its metadata document */
+        readonly name: string | null;
+      };
+      /**
+       * @description The OpenID claims allowed besides what the scopes carry (the `claims` request parameter)
+       * @example []
+       */
+      readonly claims: readonly string[];
+      /** @example cns_01h455vb4pex5vsknk084sn02q */
+      readonly id: string;
+      /**
+       * @description The OpenID scopes allowed
+       * @example [
+       *       "openid",
+       *       "email"
+       *     ]
+       */
+      readonly scopes: readonly string[];
+      /**
+       * Format: date-time
+       * @description When they last allowed it more
+       */
+      readonly updated_at: string;
+    };
+    readonly Identity: {
+      /** Format: date-time */
+      readonly created_at: string;
+      /**
+       * @description Their handle there, without the @, as the provider showed it at their last sign-in with it: X’s, Discord’s, Telegram’s and Matrica’s username. Null where the provider has none. For showing people only: it changes, and never identifies anyone
+       * @example ada
+       */
+      readonly handle: string | null;
+      /** @example idn_01h455vb4pex5vsknk084sn02q */
+      readonly id: string;
+      /** Format: date-time */
+      readonly last_used_at: string | null;
+      /** @description For `email`: whether a password signs in with the address */
+      readonly password?: boolean;
+      /** @example google */
+      readonly provider: string;
+      /** @description Who the person is there: a wallet address (`solana`), their email address (`email`), or the provider’s own id for them */
+      readonly subject: string;
+    };
+    readonly KeyableApi: {
+      /** @example https://api.acme.example */
+      readonly identifier: string;
+      readonly name: string;
+      readonly scopes: readonly {
+        readonly description: string;
+        readonly name: string;
+      }[];
+    };
+    readonly LinkRequest: {
+      /** @description Add these to an authorization request from the same app (its own PKCE, state and redirect URI): the person signs in again as themselves, then uses the method, which joins their account. The request works for 10 minutes, for this person through this app, and only with that sign-in in the browser; it authorizes nothing by itself. */
+      readonly authorization_params: {
+        /** @enum {string} */
+        readonly prompt: "login";
+        /** @enum {string} */
+        readonly synq_intent: "link";
+        readonly synq_link: string;
+      };
+      /** Format: date-time */
+      readonly expires_at: string;
+      /**
+       * @description The way to sign in being added. More are added over time.
+       * @example wallet
+       */
+      readonly method: string;
+    };
+    readonly NewLinkRequest: {
+      /**
+       * @description The way to sign in to add: a Solana wallet, an email address (proved with an emailed code), or an account at a provider the brand offers
+       * @enum {string}
+       */
+      readonly method: "wallet" | "email" | "google" | "microsoft" | "apple" | "facebook" | "x" | "discord" | "telegram" | "matrica";
+    };
+    readonly NewPasskey: {
+      /** @description The new credential, as `PublicKeyCredential.toJSON()` writes it */
+      readonly credential: {
+        readonly [key: string]: unknown;
+      };
+    };
+    readonly NewUserApiKey: components["schemas"]["UserApiKey"] & {
+      /**
+       * @description The key itself, shown this once. Only its hash is kept.
+       * @example ak_live_Ab3dEf…
+       */
+      readonly key: string;
+    };
+    readonly Passkey: {
+      /** @description Whether a synced passkey is backed up now */
+      readonly backed_up: boolean;
+      /** Format: date-time */
+      readonly created_at: string;
+      /** @example pky_01h455vb4pex5vsknk084sn02q */
+      readonly id: string;
+      /** Format: date-time */
+      readonly last_used_at: string | null;
+      /** @description Whether the passkey can leave its device: a synced passkey, kept by a password manager or a platform account */
+      readonly synced: boolean;
+      /**
+       * @example [
+       *       "internal",
+       *       "hybrid"
+       *     ]
+       */
+      readonly transports: readonly string[];
+    };
+    /** @description WebAuthn's `PublicKeyCredentialCreationOptionsJSON`, for `navigator.credentials.create` (through `PublicKeyCredential.parseCreationOptionsFromJSON`). The relying party is this issuer's host; a page on one of the brand's own apps' origins may use it where the browser supports related origins (`/.well-known/webauthn`). Its challenge works for 5 minutes, once, for this person through this app. */
+    readonly PasskeyCreationOptions: {
+      readonly [key: string]: unknown;
+    };
+    readonly Problem: {
+      /** @example insufficient_permissions */
+      readonly code: string;
+      /** @example This key lacks org.brands.edit. */
+      readonly detail?: string;
+      /** @description What was wrong with the request, field by field */
+      readonly errors?: readonly {
+        readonly message: string;
+        readonly path: string;
+      }[];
+      /** @example org.brands.edit */
+      readonly missing_permission?: string;
+      /**
+       * @description Why, for code to read, where a code has several causes
+       * @example public_mailbox
+       */
+      readonly reason?: string;
+      /** @example 403 */
+      readonly status: number;
+      /** @example Insufficient permissions */
+      readonly title: string;
+      /** @example https://docs.synq.build/errors/insufficient_permissions */
+      readonly type: string;
+    };
+    readonly Profile: {
+      /** Format: date-time */
+      readonly created_at: string;
+      /**
+       * Format: date-time
+       * @description When the account will be deleted, if the person asked for it
+       */
+      readonly deletion_scheduled_for: string | null;
+      readonly email: string | null;
+      readonly email_verified: boolean;
+      readonly family_name: string | null;
+      readonly given_name: string | null;
+      readonly locale: string | null;
+      readonly name: string | null;
+      readonly picture: string | null;
+      /** @example usr_01h455vb4pex5vsknk084sn02q */
+      readonly sub: string;
+      readonly username: string | null;
+    };
+    readonly ProfileUpdate: {
+      readonly family_name?: string | null;
+      readonly given_name?: string | null;
+      readonly locale?: string | null;
+      readonly name?: string | null;
+      /** Format: uri */
+      readonly picture?: string | null;
+      readonly username?: string | null;
+    };
+    readonly Session: {
+      readonly amr: readonly string[];
+      /** @description The apps signed in to: their client ids */
+      readonly apps: readonly string[];
+      /** @description Whether this is the session the calling access token came from: the device making the call */
+      readonly current: boolean;
+      /** Format: date-time */
+      readonly expires_at: string | null;
+      readonly id: string;
+      /** Format: date-time */
+      readonly signed_in_at: string | null;
+      /**
+       * @description Where it was signed in: the brand's hosted page, or an app's own screens, whose session no browser holds
+       * @enum {string}
+       */
+      readonly via: "hosted" | "app";
+    };
+    readonly SignIn: {
+      readonly amr: readonly string[];
+      /** @description The client id of the app signed in to */
+      readonly app: string;
+      /** Format: date-time */
+      readonly at: string;
+      /** @example email */
+      readonly provider: string;
+    };
+    readonly UserApiKey: {
+      readonly api: {
+        /** @example https://api.acme.example */
+        readonly identifier: string;
+        readonly name: string;
+      };
+      /** Format: date-time */
+      readonly created_at: string;
+      /** Format: date-time */
+      readonly expires_at: string | null;
+      /** @example uak_01h455vb4pex5vsknk084sn02q */
+      readonly id: string;
+      /**
+       * Format: date-time
+       * @description When its API last checked it, to the minute
+       */
+      readonly last_used_at: string | null;
+      /** @example Reports script */
+      readonly name: string;
+      /**
+       * @description The start of the key, to tell keys apart
+       * @example ak_live_Ab3d
+       */
+      readonly prefix: string;
+      /** Format: date-time */
+      readonly revoked_at: string | null;
+      /**
+       * @description What it may do: scopes of its API (one the API drops leaves every key)
+       * @example [
+       *       "reports:read"
+       *     ]
+       */
+      readonly scopes: readonly string[];
+    };
+    readonly UserApiKeyCreate: {
+      /**
+       * @description The API's identifier, one `GET /v1/apis` lists
+       * @example https://api.acme.example
+       */
+      readonly api: string;
+      /**
+       * Format: date-time
+       * @description When it stops working, within 366 days; never, when not given
+       */
+      readonly expires_at?: string;
+      /** @example Reports script */
+      readonly name: string;
+      /**
+       * @description What it may do: scopes the API defines
+       * @example [
+       *       "reports:read"
+       *     ]
+       */
+      readonly scopes: readonly string[];
+    };
+    readonly UsernameAvailability: {
+      readonly available: boolean;
+      /** @enum {string|null} */
+      readonly reason: "format" | "taken" | null;
+      readonly username: string;
+    };
+    readonly Wallet: {
+      /** @example seedYs9i7pN9W4yJ5wUZn3tqxV4o5fH8sZ7mJm6dRKA */
+      readonly address: string;
+      /** Format: date-time */
+      readonly created_at: string;
+      /** @example idn_01h455vb4pex5vsknk084sn02q */
+      readonly id: string;
+      /** @description What the person calls it */
+      readonly label: string | null;
+      /** Format: date-time */
+      readonly last_used_at: string | null;
+      /** @description Their primary wallet: at most one is */
+      readonly primary: boolean;
+    };
+    readonly WalletUpdate: {
+      readonly label?: string | null;
+      /**
+       * @description Makes it their primary wallet, in place of the one that was
+       * @enum {boolean}
+       */
+      readonly primary?: true;
+    };
+  };
+  responses: never;
+  parameters: never;
+  requestBodies: never;
+  headers: never;
+  pathItems: never;
+}
+type operations = Record<string, never>;
+//#endregion
+//#region src/account.d.ts
+type Schemas = components['schemas'];
+/** The signed-in person's profile, as the account API answers it. */
+type AccountProfile = Schemas['Profile'];
+/** What `user.update()` may change: only the fields given. */
+type AccountProfileUpdate = Schemas['ProfileUpdate'];
+/** One of the person's wallets. */
+type AccountWallet = Schemas['Wallet'];
+/** What `wallets.update()` may change: the label, or making it primary. */
+type AccountWalletUpdate = Schemas['WalletUpdate'];
+/** One of the person's ways to sign in: a wallet, an email address or a provider's account. */
+type AccountIdentity = Schemas['Identity'];
+/** One of the person's sessions at the brand; `current` marks the one the call came from. */
+type AccountSession = Schemas['Session'];
+/** One recent sign-in: when, how and to which app. */
+type AccountSignIn = Schemas['SignIn'];
+/** What the person allowed an app outside the brand's own to do. */
+type AccountConsent = Schemas['Consent'];
+/** One of the person's passkeys. */
+type AccountPasskey = Schemas['Passkey'];
+/** A link request: the sign-in that adds a way in carries its `authorization_params`. */
+type AccountLinkRequest = Schemas['LinkRequest'];
+/** Whether a username is free for the person to take, and why not. */
+type AccountUsernameAvailability = Schemas['UsernameAvailability'];
+/** A way to sign in a link request can add. */
+type LinkMethod = Schemas['NewLinkRequest']['method'];
+/** One of the person's API keys for the brand's APIs (AERO-1693): never the key itself. */
+type AccountApiKey = Schemas['UserApiKey'];
+/** A new API key: `key` is the key itself, in this answer only. */
+type AccountNewApiKey = Schemas['NewUserApiKey'];
+/** What `apiKeys.create()` takes: the API's identifier, a name, its scopes, and an expiry if any. */
+type AccountApiKeyCreate = Schemas['UserApiKeyCreate'];
+/** An API the person may make keys for, with the scopes it defines. */
+type AccountKeyableApi = Schemas['KeyableApi'];
+/** A call's outcome: its data, or the `SynqError` it failed with (branch on `error.code`). */
+type AccountResult<T> = {
+  readonly data: T;
+  readonly error: null;
+} | {
+  readonly data: null;
+  readonly error: SynqError;
+};
+/** What every change takes. */
+interface ChangeOptions {
+  /** Sent as `Idempotency-Key`. One is made for each call when left out; pass your own to send a call again after a lost answer. */
+  idempotencyKey?: string;
+  signal?: AbortSignal;
+}
+/** What every read takes. */
+interface ReadOptions {
+  signal?: AbortSignal;
+}
+/** What `createAccountClient` takes. */
+interface AccountClientOptions {
+  /** The brand's issuer URL, as for `createSynqClient`. */
+  issuer: string | URL;
+  /**
+   * The access token for the account API, a token Synq issued for the
+   * resource `accountApiUrl(issuer)`. Pass a `SynqClient`'s `getAccessToken`
+   * when that client's `resource` is the account API, so the token refreshes
+   * on its own.
+   */
+  accessToken: () => string | Promise<string>;
+  /** The `fetch` to call Synq with: the global one by default. */
+  fetch?: typeof fetch;
+}
+/** The brand's account API for the signed-in person, as `createAccountClient` makes it: every call answers `{ data, error }`. */
+interface AccountClient {
+  /** Who is signed in: their profile. */
+  me: (options?: ReadOptions) => Promise<AccountResult<AccountProfile>>;
+  user: {
+    /** Changes their profile: only the fields given. */
+    update: (changes: AccountProfileUpdate, options?: ChangeOptions) => Promise<AccountResult<AccountProfile>>;
+    /** What the brand keeps for them (the brand's servers write it, through the management API). */
+    metadata: (options?: ReadOptions) => Promise<AccountResult<Record<string, unknown>>>;
+    /** Whether a username is free for them to take. */
+    usernameAvailable: (username: string, options?: ReadOptions) => Promise<AccountResult<AccountUsernameAvailability>>;
+  };
+  wallets: {
+    list: (options?: ReadOptions) => Promise<AccountResult<readonly AccountWallet[]>>;
+    /** Names a wallet, or makes it their primary one. */
+    update: (wallet: string, changes: AccountWalletUpdate, options?: ChangeOptions) => Promise<AccountResult<AccountWallet>>;
+    /** Removes a wallet: it is one of their ways to sign in, so its identity goes. */
+    remove: (wallet: string, options?: ChangeOptions) => Promise<AccountResult<null>>;
+  };
+  accounts: {
+    /** Their ways to sign in: wallets, email, providers. */
+    list: (options?: ReadOptions) => Promise<AccountResult<readonly AccountIdentity[]>>;
+    /**
+     * Starts adding a way to sign in: send them to sign in from the same
+     * app with `linkSignIn(answer)`, as `client.signIn(linkSignIn(answer))`.
+     */
+    link: (method: LinkMethod, options?: ChangeOptions) => Promise<AccountResult<AccountLinkRequest>>;
+    /** Removes a way to sign in; the last one can't go (`last_sign_in_method`). */
+    unlink: (identity: string, options?: ChangeOptions) => Promise<AccountResult<null>>;
+  };
+  sessions: {
+    /** Where they are signed in; `current` marks this one. */
+    list: (options?: ReadOptions) => Promise<AccountResult<readonly AccountSession[]>>;
+    /** Signs that session out, at every app in it. */
+    revoke: (session: string, options?: ChangeOptions) => Promise<AccountResult<null>>;
+  };
+  passkeys: {
+    list: (options?: ReadOptions) => Promise<AccountResult<readonly AccountPasskey[]>>;
+    /** WebAuthn creation options, for `navigator.credentials.create`. */
+    registrationOptions: (options?: ChangeOptions) => Promise<AccountResult<Record<string, unknown>>>;
+    /** Adds the passkey `navigator.credentials.create` made, as `credential.toJSON()` writes it. */
+    register: (credential: Record<string, unknown>, options?: ChangeOptions) => Promise<AccountResult<AccountPasskey>>;
+    remove: (passkey: string, options?: ChangeOptions) => Promise<AccountResult<null>>;
+  };
+  consents: {
+    /** What they allowed apps outside the brand's own to do. */
+    list: (options?: ReadOptions) => Promise<AccountResult<readonly AccountConsent[]>>;
+    withdraw: (consent: string, options?: ChangeOptions) => Promise<AccountResult<null>>;
+  };
+  /**
+   * Their API keys for the brand's own APIs (AERO-1693): what a script of
+   * theirs sends the brand's API in place of an access token.
+   */
+  apiKeys: {
+    /** The brand's APIs that let them make keys, with each scope it defines. */
+    apis: (options?: ReadOptions) => Promise<AccountResult<readonly AccountKeyableApi[]>>;
+    /** Their keys, revoked and expired ones too; never a key itself. */
+    list: (options?: ReadOptions) => Promise<AccountResult<readonly AccountApiKey[]>>;
+    /**
+     * Makes a key: its `key` is in this answer only, so show it once. Needs
+     * a sign-in from the last 5 minutes (`fresh_sign_in_required`: sign in
+     * again with `maxAge: 300`).
+     */
+    create: (input: AccountApiKeyCreate, options?: ChangeOptions) => Promise<AccountResult<AccountNewApiKey>>;
+    /** Revokes a key at once. */
+    revoke: (key: string, options?: ChangeOptions) => Promise<AccountResult<null>>;
+  };
+  /** Their recent sign-ins, newest first. */
+  activity: (options?: ReadOptions) => Promise<AccountResult<readonly AccountSignIn[]>>;
+  deletion: {
+    /** Asks for the account to be deleted, after the grace period: `me().deletion_scheduled_for` says when. */
+    schedule: (options?: ChangeOptions) => Promise<AccountResult<unknown>>;
+    /** Takes the request back while the grace period lasts. */
+    cancel: (options?: ChangeOptions) => Promise<AccountResult<unknown>>;
+  };
+}
+/**
+ * The sign-in that finishes a link request, for `SynqClient.signIn` or
+ * `authorizationUrl`: a fresh sign-in (`prompt=login`) carrying the request.
+ */
+export declare function linkSignIn(request: AccountLinkRequest): AuthorizationUrlOptions;
+/** The account API's URL for a brand: the resource its access tokens are for. */
+export declare function accountApiUrl(issuer: string | URL): string;
+/** A client for the brand's account API, for an app that holds its own session: everything the signed-in person can do to their own account. */
+export declare function createAccountClient(options: AccountClientOptions): AccountClient;
+//#endregion
+export { type AccountApiKey, type AccountApiKeyCreate, type AccountClient, type AccountClientOptions, type components as AccountComponents, type AccountConsent, type AccountIdentity, type AccountKeyableApi, type AccountLinkRequest, type AccountNewApiKey, type operations as AccountOperations, type AccountPasskey, type paths as AccountPaths, type AccountProfile, type AccountProfileUpdate, type AccountResult, type AccountSession, type AccountSignIn, type AccountUsernameAvailability, type AccountWallet, type AccountWalletUpdate, type AuthorizationUrlOptions, CHALLENGE_METHODS, CHALLENGE_PROBLEMS, type ChallengeMethod, type ChallengeProblem, type ChangeOptions, type DeniedReason, ERROR_CODES, type IdTokenClaims, type LinkMethod, type components$1 as ManagementComponents, type operations$1 as ManagementOperations, type paths$1 as ManagementPaths, type OAuthErrorCode, type PasskeyAssertionJSON, type PasskeyRequestOptionsJSON, type Problem, type ReadOptions, type RedirectReason, type SavedSignIn, type ServerSignInOptions, type Session, type SessionEvent, SignInFlow, type SignInFlowStep, type SignInStepResult, type SignOutOptions, type StartSignInOptions, type SynqAnyErrorCode, type SynqClient, type SynqClientErrorCode, type SynqClientOptions, SynqError, type SynqErrorCode, type SynqStorage, browserLocalStorage, browserSessionStorage, createSynqClient, isSynqError, memoryStorage, problemError };