@synqauth/js 0.0.0 → 0.2.0

package/dist/index.d.ts

@@ -1,236 +1,289 @@
-import { a as Problem, c as SynqError, d as ERROR_CODES, f as SynqErrorCode, i as OAuthErrorCode, l as isSynqError, n as operations$1, o as SynqAnyErrorCode, r as paths$1, s as SynqClientErrorCode, t as components$1, u as problemError } from "./management-y9-9AIc-.js";
-//#region src/storage.d.ts
-/**
- * Where the client keeps what it must remember: the session, and a sign-in's
- * transaction (its PKCE verifier, state and nonce) across the redirect to
- * Synq and back. Any key-value store fits; each method may be async.
- *
- * Refresh tokens are kept only by a store that says it may hold them
- * (`holdsRefreshTokens`): the memory store, or one on a server or in a
- * device's secure storage. Everything else keeps the session without its
- * refresh token, which then lives in the client's memory alone, so a refresh
- * token never lands in `localStorage` or `sessionStorage`, where any script
- * on the page reads it.
- *
- * Synq rotates refresh tokens and ends the whole grant when a used one comes
- * back, so only one refresh may run at a time for one session. One client
- * makes sure of that by itself. When several clients share a store (requests
- * on one server, or replicas sharing a cookie or Redis), the store must give
- * them a lock (`lock`); a store without one is for one client per process.
- */
-interface SynqStorage {
-  get(key: string): string | null | undefined | Promise<string | null | undefined>;
-  set(key: string, value: string): void | Promise<void>;
-  remove(key: string): void | Promise<void>;
-  /** Whether this store may hold refresh tokens: true only for memory, a server or secure device storage. */
-  readonly holdsRefreshTokens?: boolean;
-  /**
-   * Runs `fn` while no other holder of `name`'s lock runs, in any client
-   * sharing this store: the client refreshes inside it, and reads the
-   * session again first, so a refresh another client finished meanwhile is
-   * used rather than repeated. A store shared across requests or replicas
-   * must have one.
-   */
-  lock?<T>(name: string, fn: () => Promise<T>): Promise<T>;
-  /** The keys it holds, so the client can sweep away sign-ins that were never finished. */
-  keys?(): Iterable<string> | Promise<Iterable<string>>;
-}
-/**
- * Keeps everything in this process's memory: the default, and the only store
- * that holds refresh tokens unless told. Clients that share one share its
- * lock, so they never refresh one session twice at once.
- */
-export declare function memoryStorage(): SynqStorage;
-/**
- * The tab's `sessionStorage`: it ends with the tab, and no other tab reads
- * it. As the session's store it keeps the access and ID tokens only, never
- * the refresh token.
- */
-export declare function browserSessionStorage(): SynqStorage;
-/**
- * The browser's `localStorage`, which every tab of the app's origin shares.
- * Where a sign-in's transaction goes by default in a browser: a magic link
- * or an email's link opens a new tab, which finishes the sign-in and comes
- * back to the app there, so the tab that started it can't be the only one
- * that knows it. Each transaction is kept under its own state, for an hour
- * at most, deleted when it finishes, and swept away when stale. The price:
- * any script on the app's origin can read a transaction meanwhile (its PKCE
- * verifier and nonce, useless without the code Synq sends to the app's own
- * redirect URI), as it can read anything else the app keeps. As the
- * session's store it keeps the access and ID tokens only, never the refresh
- * token.
- */
-export declare function browserLocalStorage(): SynqStorage;
-//#endregion
-//#region src/client.d.ts
-/** What a Synq client needs to know about the app it signs people in to. */
-interface SynqClientOptions {
-  /** The brand's issuer URL, as the dashboard shows it (`https://<issuer-slug>.auth.<Synq's domain>`). */
-  issuer: string | URL;
-  /** The app's client_id, from the dashboard or the management API. */
-  clientId: string;
-  /**
-   * A confidential app's secret, sent with HTTP Basic. Only on a server:
-   * an app whose code reaches a browser has no secret.
-   */
-  clientSecret?: string;
-  /** Where Synq sends the browser back with the code: one of the app's registered redirect URIs, exactly. */
-  redirectUri: string;
-  /** Where the browser lands after signing out: one of the app's registered post-logout URIs. */
-  postLogoutRedirectUri?: string;
-  /** The scopes to ask for: `openid` by default. Add `offline_access` for a refresh token. */
-  scope?: string;
-  /** The API the access token is for (RFC 8707): a registered API's identifier. Without it the token is only good for userinfo. */
-  resource?: string;
-  /**
-   * Where the session is kept: this process's memory by default. Clients
-   * that share a store (requests on a server, replicas) need one with a
-   * `lock`, so they never present one refresh token twice; without one, use
-   * one client per process.
-   */
-  storage?: SynqStorage;
-  /**
-   * Where a sign-in's transaction is kept across the redirect: the browser's
-   * localStorage, which every tab of the app shares (a magic link finishes a
-   * sign-in in a new tab), and memory outside a browser.
-   */
-  transactionStorage?: SynqStorage;
-  /** The `fetch` to call Synq with: the global one by default. */
-  fetch?: typeof fetch;
-  /** How many seconds before the access token expires `getAccessToken` gets a new one: 30 by default. */
-  refreshLeewaySeconds?: number;
-}
-/** What to ask for when sending someone to sign in. */
-interface AuthorizationUrlOptions {
-  /** Go straight to one sign-in method of the hosted page (`synq_method`): `password`, `email`, `passkey`, `wallet`, `google`... */
-  method?: string;
-  /** The address or username to fill in (`login_hint`). */
-  loginHint?: string;
-  /** `login` to ask for a fresh sign-in, `none` to sign in without showing anything (or fail), `consent` to ask again. */
-  prompt?: 'none' | 'login' | 'consent' | 'select_account';
-  /**
-   * The longest ago, in seconds, the person may have signed in (`max_age`);
-   * the ID token's `auth_time` is checked against it. Sent only when given:
-   * Synq asks anyone whose sign-in time it never saw proved (a provider that
-   * says nothing of when, such as Discord) to sign in again whenever
-   * `max_age` is present, so ask for it only where a fresh sign-in matters.
-   */
-  maxAge?: number;
-  /** The scopes for this sign-in, instead of the client's. */
-  scope?: string;
-  /** The API for this sign-in's access token, instead of the client's. */
-  resource?: string;
-  /**
-   * Other APIs the sign-in's grant should cover too (RFC 8707: one
-   * `resource` each). The code is still exchanged for `resource`'s token;
-   * another client sharing the session's store gets one for these by
-   * refreshing with its own `resource`, as @synqauth/nextjs does for the
-   * account API beside the app's own.
-   */
-  additionalResources?: readonly string[];
-  /** Any other parameter Synq takes, such as `synq_intent`. They can't replace the flow's own (state, nonce, PKCE, redirect URI). */
-  params?: Readonly<Record<string, string>>;
-  /**
-   * Sends the request's parameters to the issuer first, as a pushed
-   * authorization request (RFC 9126), and answers a URL that carries only
-   * its reference: for a parameter that must never travel in a URL, such
-   * as a wallet's signature (`synq_siws`).
-   */
-  pushed?: boolean;
-}
-/** The claims of a validated ID token: who signed in, when, and how. */
-interface IdTokenClaims {
-  readonly iss: string;
-  readonly sub: string;
-  readonly aud: string | string[];
-  readonly iat: number;
-  readonly exp: number;
-  readonly auth_time?: number;
-  readonly amr?: string[];
-  readonly acr?: string;
-  readonly [claim: string]: unknown;
-}
-/** A signed-in session, without its refresh token, which the client keeps to itself. */
-interface Session {
-  readonly accessToken: string;
-  readonly tokenType: string;
-  /** When the access token expires, in seconds since the epoch, when Synq said. */
-  readonly expiresAt: number | undefined;
-  readonly scope: string | undefined;
-  readonly idToken: string | undefined;
-  /** The ID token's claims, validated when it was issued. */
-  readonly claims: IdTokenClaims | undefined;
-  /** Whether the client holds a refresh token for this session. */
-  readonly refreshable: boolean;
-}
-/** A change to the session, as `subscribe` reports it. */
-type SessionEvent = {
-  readonly type: 'signed-in';
-  readonly session: Session;
-} | {
-  readonly type: 'refreshed';
-  readonly session: Session;
-} | {
-  readonly type: 'signed-out';
-  readonly session: null;
-};
-/** What `signOut` takes: where the browser lands afterwards, and the `state` handed back there. */
-interface SignOutOptions {
-  /** Where the browser lands afterwards, instead of the client's `postLogoutRedirectUri`. */
-  postLogoutRedirectUri?: string;
-  /** Handed back on the post-logout redirect. */
-  state?: string;
-}
-/**
- * A client for one app at one brand's issuer, made by `createSynqClient`: it
- * signs people in with the authorization code flow, keeps the session, and
- * refreshes and ends it.
- */
-interface SynqClient {
-  /** The URL to send the browser to, to sign in; the transaction it starts is kept in `transactionStorage`. */
-  authorizationUrl(options?: AuthorizationUrlOptions): Promise<URL>;
-  /** In a browser: sends it to Synq to sign in. */
-  signIn(options?: AuthorizationUrlOptions): Promise<void>;
-  /** Finishes a sign-in from the URL Synq sent the browser back to; each transaction finishes once. */
-  handleCallback(url: string | URL): Promise<Session>;
-  /** The current session, or `null` when nobody is signed in. */
-  getSession(): Promise<Session | null>;
-  /**
-   * After a page loads: the session, while it can still give a current
-   * access token (its access token is good for the leeway, or the client
-   * holds its refresh token), or `null` when there is none. A session the
-   * browser kept without its refresh token, whose access token is running
-   * out, is ended here, and the browser is sent to Synq with `prompt=none` to
-   * sign the person in again without showing anything; it resolves `null` as
-   * the page leaves. On the way back, `handleCallback` signs them in, or
-   * fails with `login_required` when they are no longer signed in at Synq.
-   * Call it on page load, but not on the callback's own page.
-   */
-  restoreSession(options?: Omit<AuthorizationUrlOptions, 'prompt'>): Promise<Session | null>;
-  /** A current access token, refreshed first when it expires within `minValiditySeconds` (the client's leeway by default). */
-  getAccessToken(options?: {
-    minValiditySeconds?: number;
-  }): Promise<string>;
-  /**
-   * Gets new tokens with the refresh token. Calls at once share one request:
-   * Synq rotates refresh tokens and treats a used one presented again as
-   * theft, ending the whole grant.
-   */
-  refresh(): Promise<Session>;
-  /** Calls `listener` on every sign-in, refresh and sign-out; returns the function that stops it. */
-  subscribe(listener: (event: SessionEvent) => void): () => void;
-  /**
-   * Ends the session here, revokes its refresh token, and returns Synq's
-   * sign-out URL (RP-initiated logout), to send the browser to so the
-   * brand's session ends too: `null` when the issuer has none.
-   */
-  signOut(options?: SignOutOptions): Promise<URL | null>;
-}
-/** A client for one app at one of a brand's Synq issuers. */
-export declare function createSynqClient(options: SynqClientOptions): SynqClient;
-//#endregion
+import { A as SignInFlowStep, C as browserLocalStorage, D as PasskeyRequestOptionsJSON, E as PasskeyAssertionJSON, F as ChallengeMethod, I as ChallengeProblem, L as DeniedReason, M as StartSignInOptions, N as CHALLENGE_METHODS, O as SavedSignIn, P as CHALLENGE_PROBLEMS, R as RedirectReason, S as SynqStorage, T as memoryStorage, _ as SessionEvent, a as Problem, b as SynqClientOptions, c as SynqError, d as ERROR_CODES, f as SynqErrorCode, g as Session, h as ServerSignInOptions, i as OAuthErrorCode, j as SignInStepResult, k as SignInFlow, l as isSynqError, m as IdTokenClaims, n as operations$1, o as SynqAnyErrorCode, p as AuthorizationUrlOptions, r as paths$1, s as SynqClientErrorCode, t as components$1, u as problemError, v as SignOutOptions, w as browserSessionStorage, x as createSynqClient, y as SynqClient } from "./management-CWdCiiEv.js";
 //#region src/generated/account.d.ts
 interface paths {
+  readonly "/v1/api-keys": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * The signed-in person's API keys
+     * @description Oldest first, revoked and expired ones too; never a key itself. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Their API keys */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["UserApiKey"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    /**
+     * Make an API key
+     * @description A key for one of the brand's APIs that lets its users make them (`GET /v1/apis`): `ak_live_…` in production, `ak_test_…` elsewhere, in this response only. It acts as the person, with the scopes given, until it is revoked or expires, or the API stops letting its users make keys. At most 25 live at once. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. Recorded as `user.api_key_created`.
+     */
+    readonly post: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody: {
+        readonly content: {
+          readonly "application/json": components["schemas"]["UserApiKeyCreate"];
+        };
+      };
+      readonly responses: {
+        /** @description The new key */
+        readonly 201: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": components["schemas"]["NewUserApiKey"];
+          };
+        };
+        /** @description A body that is not valid: an API none lists, a scope it doesn’t define, or an expiry not ahead */
+        readonly 400: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks `me:write` (`insufficient_permissions`), the sign-in isn’t recent enough (`fresh_sign_in_required`), or the API doesn’t let its users make keys (`api_keys_not_allowed`) */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The person has 25 live keys already (`api_key_limit_reached`) */
+        readonly 409: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/api-keys/{key}": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    readonly post?: never;
+    /**
+     * Revoke an API key
+     * @description At once: its API's next check of it answers `active: false`. Needs `me:write`. Recorded as `user.api_key_revoked`.
+     */
+    readonly delete: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly key: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Revoked */
+        readonly 204: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No such live key */
+        readonly 404: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/apis": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * The APIs the person may make API keys for
+     * @description The brand's APIs whose tenant lets its users make API keys for them, with the scopes each defines, by name. Needs `me:read`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path?: never;
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description The APIs */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["KeyableApi"][];
+            };
+          };
+        };
+        /** @description No access token for this API, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The token lacks the scope this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly "/v1/consents": {
     readonly parameters: {
       readonly query?: never;
@@ -1752,6 +1805,11 @@ interface components {
     readonly Identity: {
       /** Format: date-time */
       readonly created_at: string;
+      /**
+       * @description Their handle there, without the @, as the provider showed it at their last sign-in with it: X’s, Discord’s, Telegram’s and Matrica’s username. Null where the provider has none. For showing people only: it changes, and never identifies anyone
+       * @example ada
+       */
+      readonly handle: string | null;
       /** @example idn_01h455vb4pex5vsknk084sn02q */
       readonly id: string;
       /** Format: date-time */
@@ -1763,6 +1821,15 @@ interface components {
       /** @description Who the person is there: a wallet address (`solana`), their email address (`email`), or the provider’s own id for them */
       readonly subject: string;
     };
+    readonly KeyableApi: {
+      /** @example https://api.acme.example */
+      readonly identifier: string;
+      readonly name: string;
+      readonly scopes: readonly {
+        readonly description: string;
+        readonly name: string;
+      }[];
+    };
     readonly LinkRequest: {
       /** @description Add these to an authorization request from the same app (its own PKCE, state and redirect URI): the person signs in again as themselves, then uses the method, which joins their account. The request works for 10 minutes, for this person through this app, and only with that sign-in in the browser; it authorizes nothing by itself. */
       readonly authorization_params: {
@@ -1793,6 +1860,13 @@ interface components {
         readonly [key: string]: unknown;
       };
     };
+    readonly NewUserApiKey: components["schemas"]["UserApiKey"] & {
+      /**
+       * @description The key itself, shown this once. Only its hash is kept.
+       * @example ak_live_Ab3dEf…
+       */
+      readonly key: string;
+    };
     readonly Passkey: {
       /** @description Whether a synced passkey is backed up now */
       readonly backed_up: boolean;
@@ -1879,6 +1953,11 @@ interface components {
       readonly id: string;
       /** Format: date-time */
       readonly signed_in_at: string | null;
+      /**
+       * @description Where it was signed in: the brand's hosted page, or an app's own screens, whose session no browser holds
+       * @enum {string}
+       */
+      readonly via: "hosted" | "app";
     };
     readonly SignIn: {
       readonly amr: readonly string[];
@@ -1889,6 +1968,61 @@ interface components {
       /** @example email */
       readonly provider: string;
     };
+    readonly UserApiKey: {
+      readonly api: {
+        /** @example https://api.acme.example */
+        readonly identifier: string;
+        readonly name: string;
+      };
+      /** Format: date-time */
+      readonly created_at: string;
+      /** Format: date-time */
+      readonly expires_at: string | null;
+      /** @example uak_01h455vb4pex5vsknk084sn02q */
+      readonly id: string;
+      /**
+       * Format: date-time
+       * @description When its API last checked it, to the minute
+       */
+      readonly last_used_at: string | null;
+      /** @example Reports script */
+      readonly name: string;
+      /**
+       * @description The start of the key, to tell keys apart
+       * @example ak_live_Ab3d
+       */
+      readonly prefix: string;
+      /** Format: date-time */
+      readonly revoked_at: string | null;
+      /**
+       * @description What it may do: scopes of its API (one the API drops leaves every key)
+       * @example [
+       *       "reports:read"
+       *     ]
+       */
+      readonly scopes: readonly string[];
+    };
+    readonly UserApiKeyCreate: {
+      /**
+       * @description The API's identifier, one `GET /v1/apis` lists
+       * @example https://api.acme.example
+       */
+      readonly api: string;
+      /**
+       * Format: date-time
+       * @description When it stops working, within 366 days; never, when not given
+       */
+      readonly expires_at?: string;
+      /** @example Reports script */
+      readonly name: string;
+      /**
+       * @description What it may do: scopes the API defines
+       * @example [
+       *       "reports:read"
+       *     ]
+       */
+      readonly scopes: readonly string[];
+    };
     readonly UsernameAvailability: {
       readonly available: boolean;
       /** @enum {string|null} */
@@ -1952,6 +2086,14 @@ type AccountLinkRequest = Schemas['LinkRequest'];
 type AccountUsernameAvailability = Schemas['UsernameAvailability'];
 /** A way to sign in a link request can add. */
 type LinkMethod = Schemas['NewLinkRequest']['method'];
+/** One of the person's API keys for the brand's APIs (AERO-1693): never the key itself. */
+type AccountApiKey = Schemas['UserApiKey'];
+/** A new API key: `key` is the key itself, in this answer only. */
+type AccountNewApiKey = Schemas['NewUserApiKey'];
+/** What `apiKeys.create()` takes: the API's identifier, a name, its scopes, and an expiry if any. */
+type AccountApiKeyCreate = Schemas['UserApiKeyCreate'];
+/** An API the person may make keys for, with the scopes it defines. */
+type AccountKeyableApi = Schemas['KeyableApi'];
 /** A call's outcome: its data, or the `SynqError` it failed with (branch on `error.code`). */
 type AccountResult<T> = {
   readonly data: T;
@@ -2033,6 +2175,24 @@ interface AccountClient {
     list: (options?: ReadOptions) => Promise<AccountResult<readonly AccountConsent[]>>;
     withdraw: (consent: string, options?: ChangeOptions) => Promise<AccountResult<null>>;
   };
+  /**
+   * Their API keys for the brand's own APIs (AERO-1693): what a script of
+   * theirs sends the brand's API in place of an access token.
+   */
+  apiKeys: {
+    /** The brand's APIs that let them make keys, with each scope it defines. */
+    apis: (options?: ReadOptions) => Promise<AccountResult<readonly AccountKeyableApi[]>>;
+    /** Their keys, revoked and expired ones too; never a key itself. */
+    list: (options?: ReadOptions) => Promise<AccountResult<readonly AccountApiKey[]>>;
+    /**
+     * Makes a key: its `key` is in this answer only, so show it once. Needs
+     * a sign-in from the last 5 minutes (`fresh_sign_in_required`: sign in
+     * again with `maxAge: 300`).
+     */
+    create: (input: AccountApiKeyCreate, options?: ChangeOptions) => Promise<AccountResult<AccountNewApiKey>>;
+    /** Revokes a key at once. */
+    revoke: (key: string, options?: ChangeOptions) => Promise<AccountResult<null>>;
+  };
   /** Their recent sign-ins, newest first. */
   activity: (options?: ReadOptions) => Promise<AccountResult<readonly AccountSignIn[]>>;
   deletion: {
@@ -2052,4 +2212,4 @@ export declare function accountApiUrl(issuer: string | URL): string;
 /** A client for the brand's account API, for an app that holds its own session: everything the signed-in person can do to their own account. */
 export declare function createAccountClient(options: AccountClientOptions): AccountClient;
 //#endregion
-export { type AccountClient, type AccountClientOptions, type components as AccountComponents, type AccountConsent, type AccountIdentity, type AccountLinkRequest, type operations as AccountOperations, type AccountPasskey, type paths as AccountPaths, type AccountProfile, type AccountProfileUpdate, type AccountResult, type AccountSession, type AccountSignIn, type AccountUsernameAvailability, type AccountWallet, type AccountWalletUpdate, type AuthorizationUrlOptions, type ChangeOptions, ERROR_CODES, type IdTokenClaims, type LinkMethod, type components$1 as ManagementComponents, type operations$1 as ManagementOperations, type paths$1 as ManagementPaths, type OAuthErrorCode, type Problem, type ReadOptions, type Session, type SessionEvent, type SignOutOptions, type SynqAnyErrorCode, type SynqClient, type SynqClientErrorCode, type SynqClientOptions, SynqError, type SynqErrorCode, type SynqStorage, isSynqError, problemError };
+export { type AccountApiKey, type AccountApiKeyCreate, type AccountClient, type AccountClientOptions, type components as AccountComponents, type AccountConsent, type AccountIdentity, type AccountKeyableApi, type AccountLinkRequest, type AccountNewApiKey, type operations as AccountOperations, type AccountPasskey, type paths as AccountPaths, type AccountProfile, type AccountProfileUpdate, type AccountResult, type AccountSession, type AccountSignIn, type AccountUsernameAvailability, type AccountWallet, type AccountWalletUpdate, type AuthorizationUrlOptions, CHALLENGE_METHODS, CHALLENGE_PROBLEMS, type ChallengeMethod, type ChallengeProblem, type ChangeOptions, type DeniedReason, ERROR_CODES, type IdTokenClaims, type LinkMethod, type components$1 as ManagementComponents, type operations$1 as ManagementOperations, type paths$1 as ManagementPaths, type OAuthErrorCode, type PasskeyAssertionJSON, type PasskeyRequestOptionsJSON, type Problem, type ReadOptions, type RedirectReason, type SavedSignIn, type ServerSignInOptions, type Session, type SessionEvent, SignInFlow, type SignInFlowStep, type SignInStepResult, type SignOutOptions, type StartSignInOptions, type SynqAnyErrorCode, type SynqClient, type SynqClientErrorCode, type SynqClientOptions, SynqError, type SynqErrorCode, type SynqStorage, browserLocalStorage, browserSessionStorage, createSynqClient, isSynqError, memoryStorage, problemError };