@synqauth/js 0.0.0 → 0.2.0

package/dist/{management-y9-9AIc-.d.ts → management-CWdCiiEv.d.ts}

@@ -1,3 +1,441 @@
+import * as oauth from "oauth4webapi";
+//#region src/generated/challenge.d.ts
+/** The ways in an app's own screens sign people in with (`synq_method`). */
+declare const CHALLENGE_METHODS: readonly ["password", "email", "passkey"];
+/** One of `CHALLENGE_METHODS`. */
+type ChallengeMethod = (typeof CHALLENGE_METHODS)[number];
+/** What went wrong with a step (`synq_problem`): branch on it, never on the English. */
+declare const CHALLENGE_PROBLEMS: readonly ["missing", "invalid_email", "wrong_credentials", "email_taken", "password_too_short", "password_too_long", "password_guessable", "password_breached", "wrong_code", "code_expired", "code_used_up", "address_suppressed", "team_only", "send_failed", "passkey_failed", "passkey_unknown", "passkey_expired", "slow_down", "locked", "limited"];
+/** One of `CHALLENGE_PROBLEMS`. */
+type ChallengeProblem = (typeof CHALLENGE_PROBLEMS)[number];
+/** Why only the hosted page can go on (`redirect_to_web`'s `synq_reason`). */
+declare const REDIRECT_REASONS: readonly ["own_ui_off", "paused", "token_gate", "step_up", "passkey_unavailable", "code_locked", "email_in_use", "unproven", "sign_up_gate", "method_unavailable", "hosted_only"];
+/** One of `REDIRECT_REASONS`. */
+type RedirectReason = (typeof REDIRECT_REASONS)[number];
+/** Why this person can't sign in here (`access_denied`'s `synq_reason`). */
+declare const DENIED_REASONS: readonly ["disabled", "deleting", "sign_up_closed", "already_exists"];
+/** One of `DENIED_REASONS`. */
+type DeniedReason = (typeof DENIED_REASONS)[number];
+//#endregion
+//#region src/sign-in-flow.d.ts
+/** A passkey's request options, for `PublicKeyCredential.parseRequestOptionsFromJSON`. */
+type PasskeyRequestOptionsJSON = Record<string, unknown>;
+/** A passkey's assertion, as `PublicKeyCredential.toJSON()` gives it. */
+type PasskeyAssertionJSON = Record<string, unknown>;
+/** Where a flow is: what the app's screen asks for now. */
+type SignInFlowStep = 'start' | 'password' | 'email' | 'code' | 'verify-email' | 'passkey' | 'done';
+/** What a step of a sign-in came to: what to show next. */
+type SignInStepResult<S> =
+/** Signed in: the session is kept, as after a callback. */
+{
+  readonly status: 'signed-in';
+  readonly session: S;
+} |
+/** A code went to the address: ask for it (`email.verify`), or send another (`email.resend`). */
+{
+  readonly status: 'code-sent';
+  readonly email: string;
+  readonly expiresAt: Date;
+} |
+/** Signed in with an address nobody proved: ask for its emailed code, or skip it where `canSkip`. */
+{
+  readonly status: 'verify-email';
+  readonly email: string;
+  readonly canSkip: boolean;
+} |
+/** Ask the browser for a passkey with these options, and give `passkey.signIn` what it answers. */
+{
+  readonly status: 'passkey';
+  readonly options: PasskeyRequestOptionsJSON;
+  /** On a custom domain: the brand's own host's passkeys too (`passkey.signIn(…, { related: true })`). */
+  readonly related?: {
+    readonly rpId: string;
+    readonly options: PasskeyRequestOptionsJSON;
+  };
+  /** What went wrong with the last passkey, when it is asked for again. */
+  readonly problem?: ChallengeProblem;
+  readonly message?: string;
+} |
+/** That didn't work: say `message` (or your own words for `problem`), and let the person try again. */
+{
+  readonly status: 'retry';
+  readonly problem: ChallengeProblem;
+  readonly message: string;
+  /** Seconds to wait first, when Synq said. */
+  readonly retryAfter?: number;
+} |
+/** Only the hosted page can go on: `continue()` starts an ordinary sign-in there. */
+{
+  readonly status: 'hosted';
+  readonly reason: RedirectReason;
+  readonly method?: ChallengeMethod;
+  readonly loginHint?: string;
+  continue(): Promise<void>;
+} |
+/** This person can't sign in here: say `message`. */
+{
+  readonly status: 'refused';
+  readonly reason: DeniedReason;
+  readonly message: string;
+};
+/** What a sign-in asks for, beyond the client's own. */
+interface StartSignInOptions {
+  /** The scopes, instead of the client's. */
+  scope?: string;
+  /** The API the access token is for, instead of the client's. */
+  resource?: string;
+  /** Other APIs the grant should cover too (RFC 8707), as for `authorizationUrl`. */
+  additionalResources?: readonly string[];
+  /** The sign-in level the app needs, as for `authorizationUrl` (`urn:synq:loa:2` is a passkey). */
+  acr?: {
+    readonly values: readonly string[];
+    readonly essential?: boolean;
+  };
+}
+/** A flow as `toJSON` saves it, for `resumeSignIn`: keep it where only the app reads it. */
+interface SavedSignIn {
+  readonly v: 1;
+  readonly verifier: string;
+  readonly nonce: string;
+  readonly scope: string;
+  readonly resource?: string;
+  readonly additionalResources?: readonly string[];
+  readonly acr?: {
+    readonly values: readonly string[];
+    readonly essential?: boolean;
+  };
+  readonly authSession?: string;
+  readonly email?: string;
+  readonly step: SignInFlowStep;
+}
+/** What a flow needs of the client it signs in to. */
+interface SignInPort<S> {
+  server(): Promise<oauth.AuthorizationServer>;
+  readonly client: oauth.Client;
+  readonly auth: oauth.ClientAuth;
+  readonly fetch: typeof fetch;
+  /** Headers every request carries: a server's `Synq-End-User-IP`. */
+  readonly headers?: Readonly<Record<string, string>>;
+  /** Keeps what the code was redeemed for, as a callback does, and answers the session. */
+  finish(result: oauth.TokenEndpointResponse, claims: oauth.IDToken | undefined): Promise<S>;
+  /** Starts an ordinary sign-in on the hosted page. */
+  hosted(options: {
+    method?: ChallengeMethod;
+    loginHint?: string;
+  }): Promise<void>;
+}
+/** One sign-in on an app's own screens. */
+declare class SignInFlow<S> {
+  #private;
+  constructor(port: SignInPort<S>, state: SavedSignIn);
+  /** What the app's screen asks for now. */
+  get step(): SignInFlowStep;
+  /** The address the sign-in is for, once one was typed. */
+  get address(): string | undefined;
+  /** Email and password. */
+  readonly password: {
+    signIn: (input: {
+      email: string;
+      password: string;
+    }) => Promise<SignInStepResult<S>>;
+    /** Makes an account where the brand lets people sign up; its address is verified next. */
+    signUp: (input: {
+      email: string;
+      password: string;
+    }) => Promise<SignInStepResult<S>>;
+  };
+  /** A code by email. */
+  readonly email: {
+    send: (email: string) => Promise<SignInStepResult<S>>;
+    verify: (code: string) => Promise<SignInStepResult<S>>;
+    resend: () => Promise<SignInStepResult<S>>;
+  };
+  /** A passkey: `options()`, then the browser's assertion to `signIn`. */
+  readonly passkey: {
+    options: () => Promise<SignInStepResult<S>>;
+    signIn: (credential: PasskeyAssertionJSON, options?: {
+      related?: boolean;
+    }) => Promise<SignInStepResult<S>>;
+  };
+  /** Verifying an address after a sign-in that didn't prove it. */
+  readonly verifyEmail: {
+    verify: (code: string) => Promise<SignInStepResult<S>>;
+    resend: () => Promise<SignInStepResult<S>>;
+    skip: () => Promise<SignInStepResult<S>>;
+  };
+  /** The flow, to keep between requests (a server's sealed cookie, a phone's secure storage). */
+  toJSON(): SavedSignIn;
+}
+//#endregion
+//#region src/storage.d.ts
+/**
+ * Where the client keeps what it must remember: the session, and a sign-in's
+ * transaction (its PKCE verifier, state and nonce) across the redirect to
+ * Synq and back. Any key-value store fits; each method may be async.
+ *
+ * Refresh tokens are kept only by a store that says it may hold them
+ * (`holdsRefreshTokens`): the memory store, or one on a server or in a
+ * device's secure storage. Everything else keeps the session without its
+ * refresh token, which then lives in the client's memory alone, so a refresh
+ * token never lands in `localStorage` or `sessionStorage`, where any script
+ * on the page reads it.
+ *
+ * Synq rotates refresh tokens and ends the whole grant when a used one comes
+ * back, so only one refresh may run at a time for one session. One client
+ * makes sure of that by itself. When several clients share a store (requests
+ * on one server, or replicas sharing a cookie or Redis), the store must give
+ * them a lock (`lock`); a store without one is for one client per process.
+ */
+interface SynqStorage {
+  get(key: string): string | null | undefined | Promise<string | null | undefined>;
+  set(key: string, value: string): void | Promise<void>;
+  remove(key: string): void | Promise<void>;
+  /** Whether this store may hold refresh tokens: true only for memory, a server or secure device storage. */
+  readonly holdsRefreshTokens?: boolean;
+  /**
+   * Runs `fn` while no other holder of `name`'s lock runs, in any client
+   * sharing this store: the client refreshes inside it, and reads the
+   * session again first, so a refresh another client finished meanwhile is
+   * used rather than repeated. A store shared across requests or replicas
+   * must have one.
+   */
+  lock?<T>(name: string, fn: () => Promise<T>): Promise<T>;
+  /** The keys it holds, so the client can sweep away sign-ins that were never finished. */
+  keys?(): Iterable<string> | Promise<Iterable<string>>;
+}
+/**
+ * Keeps everything in this process's memory: the default, and the only store
+ * that holds refresh tokens unless told. Clients that share one share its
+ * lock, so they never refresh one session twice at once.
+ */
+declare function memoryStorage(): SynqStorage;
+/**
+ * The tab's `sessionStorage`: it ends with the tab, and no other tab reads
+ * it. As the session's store it keeps the access and ID tokens only, never
+ * the refresh token.
+ */
+declare function browserSessionStorage(): SynqStorage;
+/**
+ * The browser's `localStorage`, which every tab of the app's origin shares.
+ * Where a sign-in's transaction goes by default in a browser: a magic link
+ * or an email's link opens a new tab, which finishes the sign-in and comes
+ * back to the app there, so the tab that started it can't be the only one
+ * that knows it. Each transaction is kept under its own state, for an hour
+ * at most, deleted when it finishes, and swept away when stale. The price:
+ * any script on the app's origin can read a transaction meanwhile (its PKCE
+ * verifier and nonce, useless without the code Synq sends to the app's own
+ * redirect URI), as it can read anything else the app keeps. As the
+ * session's store it keeps the access and ID tokens only, never the refresh
+ * token.
+ */
+declare function browserLocalStorage(): SynqStorage;
+//#endregion
+//#region src/client.d.ts
+/** What a Synq client needs to know about the app it signs people in to. */
+interface SynqClientOptions {
+  /** The brand's issuer URL, as the dashboard shows it (`https://<issuer-slug>.auth.<Synq's domain>`). */
+  issuer: string | URL;
+  /** The app's client_id, from the dashboard or the management API. */
+  clientId: string;
+  /**
+   * A confidential app's secret, sent with HTTP Basic. Only on a server:
+   * an app whose code reaches a browser has no secret.
+   */
+  clientSecret?: string;
+  /** Where Synq sends the browser back with the code: one of the app's registered redirect URIs, exactly. */
+  redirectUri: string;
+  /** Where the browser lands after signing out: one of the app's registered post-logout URIs. */
+  postLogoutRedirectUri?: string;
+  /** The scopes to ask for: `openid` by default. Add `offline_access` for a refresh token. */
+  scope?: string;
+  /** The API the access token is for (RFC 8707): a registered API's identifier. Without it the token is only good for userinfo. */
+  resource?: string;
+  /**
+   * Where the session is kept: this process's memory by default. Clients
+   * that share a store (requests on a server, replicas) need one with a
+   * `lock`, so they never present one refresh token twice; without one, use
+   * one client per process.
+   */
+  storage?: SynqStorage;
+  /**
+   * Where a sign-in's transaction is kept across the redirect: the browser's
+   * localStorage, which every tab of the app shares (a magic link finishes a
+   * sign-in in a new tab), and memory outside a browser.
+   */
+  transactionStorage?: SynqStorage;
+  /** The `fetch` to call Synq with: the global one by default. */
+  fetch?: typeof fetch;
+  /** How many seconds before the access token expires `getAccessToken` gets a new one: 30 by default. */
+  refreshLeewaySeconds?: number;
+}
+/** What to ask for when sending someone to sign in. */
+interface AuthorizationUrlOptions {
+  /** Go straight to one sign-in method of the hosted page (`synq_method`): `password`, `email`, `passkey`, `wallet`, `google`... */
+  method?: string;
+  /** The address or username to fill in (`login_hint`). */
+  loginHint?: string;
+  /** `login` to ask for a fresh sign-in, `none` to sign in without showing anything (or fail), `consent` to ask again. */
+  prompt?: 'none' | 'login' | 'consent' | 'select_account';
+  /**
+   * The longest ago, in seconds, the person may have signed in (`max_age`);
+   * the ID token's `auth_time` is checked against it. Sent only when given:
+   * Synq asks anyone whose sign-in time it never saw proved (a provider that
+   * says nothing of when, such as Discord) to sign in again whenever
+   * `max_age` is present, so ask for it only where a fresh sign-in matters.
+   */
+  maxAge?: number;
+  /** The scopes for this sign-in, instead of the client's. */
+  scope?: string;
+  /** The API for this sign-in's access token, instead of the client's. */
+  resource?: string;
+  /**
+   * Other APIs the sign-in's grant should cover too (RFC 8707: one
+   * `resource` each). The code is still exchanged for `resource`'s token;
+   * another client sharing the session's store gets one for these by
+   * refreshing with its own `resource`, as @synqauth/nextjs does for the
+   * account API beside the app's own.
+   */
+  additionalResources?: readonly string[];
+  /** Any other parameter Synq takes, such as `synq_intent`. They can't replace the flow's own (state, nonce, PKCE, redirect URI). */
+  params?: Readonly<Record<string, string>>;
+  /**
+   * Sends the request's parameters to the issuer first, as a pushed
+   * authorization request (RFC 9126), and answers a URL that carries only
+   * its reference: for a parameter that must never travel in a URL, such
+   * as a wallet's signature (`synq_siws`).
+   */
+  pushed?: boolean;
+  /**
+   * The sign-in level the app needs, as an `acr` value: Synq's passkey
+   * sign-in is `urn:synq:loa:2`, every other `urn:synq:loa:1`. By default it
+   * is a request (`acr_values`): someone without a passkey still signs in,
+   * at loa:1, and the app checks `claims.acr`. With `essential: true` it is
+   * a requirement, through the claims parameter: a sign-in below it fails
+   * with `unmet_authentication_requirements` instead, and `handleCallback`
+   * checks the ID token's `acr` too.
+   */
+  acr?: {
+    readonly values: readonly string[];
+    readonly essential?: boolean;
+  };
+}
+/** The claims of a validated ID token: who signed in, when, and how. */
+interface IdTokenClaims {
+  readonly iss: string;
+  readonly sub: string;
+  readonly aud: string | string[];
+  readonly iat: number;
+  readonly exp: number;
+  readonly auth_time?: number;
+  readonly amr?: string[];
+  readonly acr?: string;
+  readonly [claim: string]: unknown;
+}
+/** A signed-in session, without its refresh token, which the client keeps to itself. */
+interface Session {
+  readonly accessToken: string;
+  readonly tokenType: string;
+  /** When the access token expires, in seconds since the epoch, when Synq said. */
+  readonly expiresAt: number | undefined;
+  readonly scope: string | undefined;
+  readonly idToken: string | undefined;
+  /** The ID token's claims, validated when it was issued. */
+  readonly claims: IdTokenClaims | undefined;
+  /** Whether the client holds a refresh token for this session. */
+  readonly refreshable: boolean;
+  /**
+   * Where the person signed in: `hosted` on the brand's hosted page, `app`
+   * on the app's own screens (`startSignIn`), whose session no browser
+   * cookie at Synq holds, so signing out revokes its refresh token alone.
+   */
+  readonly via: 'hosted' | 'app';
+}
+/** A change to the session, as `subscribe` reports it. */
+type SessionEvent = {
+  readonly type: 'signed-in';
+  readonly session: Session;
+} | {
+  readonly type: 'refreshed';
+  readonly session: Session;
+} | {
+  readonly type: 'signed-out';
+  readonly session: null;
+};
+/** What a server signing people in for its app's own screens adds to a flow (`@synqauth/nextjs`). */
+interface ServerSignInOptions {
+  /**
+   * The address the person is at, as the server saw it: Synq counts its
+   * per-address limits for the app with it, and counts none without it.
+   * Only a confidential app's is taken.
+   */
+  endUserIp?: string;
+}
+/** What `signOut` takes: where the browser lands afterwards, and the `state` handed back there. */
+interface SignOutOptions {
+  /** Where the browser lands afterwards, instead of the client's `postLogoutRedirectUri`. */
+  postLogoutRedirectUri?: string;
+  /** Handed back on the post-logout redirect. */
+  state?: string;
+}
+/**
+ * A client for one app at one brand's issuer, made by `createSynqClient`: it
+ * signs people in with the authorization code flow, keeps the session, and
+ * refreshes and ends it.
+ */
+interface SynqClient {
+  /** The URL to send the browser to, to sign in; the transaction it starts is kept in `transactionStorage`. */
+  authorizationUrl(options?: AuthorizationUrlOptions): Promise<URL>;
+  /** In a browser: sends it to Synq to sign in. */
+  signIn(options?: AuthorizationUrlOptions): Promise<void>;
+  /** Finishes a sign-in from the URL Synq sent the browser back to; each transaction finishes once. */
+  handleCallback(url: string | URL): Promise<Session>;
+  /** The current session, or `null` when nobody is signed in. */
+  getSession(): Promise<Session | null>;
+  /**
+   * After a page loads: the session, while it can still give a current
+   * access token (its access token is good for the leeway, or the client
+   * holds its refresh token), or `null` when there is none. A session the
+   * browser kept without its refresh token, whose access token is running
+   * out, is ended here, and the browser is sent to Synq with `prompt=none` to
+   * sign the person in again without showing anything; it resolves `null` as
+   * the page leaves. On the way back, `handleCallback` signs them in, or
+   * fails with `login_required` when they are no longer signed in at Synq.
+   * Call it on page load, but not on the callback's own page.
+   */
+  restoreSession(options?: Omit<AuthorizationUrlOptions, 'prompt'>): Promise<Session | null>;
+  /** A current access token, refreshed first when it expires within `minValiditySeconds` (the client's leeway by default). */
+  getAccessToken(options?: {
+    minValiditySeconds?: number;
+  }): Promise<string>;
+  /**
+   * Gets new tokens with the refresh token. Calls at once share one request:
+   * Synq rotates refresh tokens and treats a used one presented again as
+   * theft, ending the whole grant.
+   */
+  refresh(): Promise<Session>;
+  /** Calls `listener` on every sign-in, refresh and sign-out; returns the function that stops it. */
+  subscribe(listener: (event: SessionEvent) => void): () => void;
+  /**
+   * Ends the session here, revokes its refresh token, and returns Synq's
+   * sign-out URL (RP-initiated logout), to send the browser to so the
+   * brand's session ends too: `null` when the issuer has none, or for a
+   * session signed in on the app's own screens, which revoking its refresh
+   * token ends.
+   */
+  signOut(options?: SignOutOptions): Promise<URL | null>;
+  /**
+   * Starts a sign-in on the app's own screens (AERO-1411): its forms call
+   * the flow's methods, and each resolves to what to show next. For the
+   * brand's own native app with own-UI sign-in on; a web app does this
+   * from its server (`@synqauth/nextjs`).
+   */
+  startSignIn(options?: StartSignInOptions & ServerSignInOptions): SignInFlow<Session>;
+  /** Picks up a flow `toJSON()` saved: after the app was closed, say, or on a server's next request. */
+  resumeSignIn(saved: SavedSignIn | string, options?: ServerSignInOptions): SignInFlow<Session>;
+}
+/** A client for one app at one of a brand's Synq issuers. */
+declare function createSynqClient(options: SynqClientOptions): SynqClient;
+//#endregion
 //#region src/generated/errors.d.ts
 /** Each `code` a Synq API's problem documents carry, with its HTTP status. */
 declare const ERROR_CODES: {
@@ -53,6 +491,8 @@ declare const ERROR_CODES: {
   readonly upload_expired: 410;
   readonly file_rejected: 422;
   readonly upload_limit_reached: 409;
+  readonly api_keys_not_allowed: 403;
+  readonly api_key_limit_reached: 409;
   readonly rate_limited: 429;
   readonly internal_error: 500;
   readonly service_unavailable: 503;
@@ -84,7 +524,15 @@ type SynqClientErrorCode =
 /** A webhook delivery signed outside the tolerance: a replay, or a clock far off. */
 'stale_webhook';
 /** OAuth's and OpenID Connect's error codes, which Synq's issuers answer with. */
-type OAuthErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope' | 'invalid_target' | 'access_denied' | 'login_required' | 'consent_required' | 'interaction_required' | 'invalid_token' | 'insufficient_scope' | 'server_error' | 'temporarily_unavailable';
+type OAuthErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope' | 'invalid_target' | 'access_denied' | 'login_required' | 'consent_required' | 'interaction_required' |
+/** The sign-in didn't reach the `acr` the app insisted on (`acr: { essential: true }`). */
+'unmet_authentication_requirements' | 'invalid_token' | 'insufficient_scope' | 'server_error' | 'temporarily_unavailable' |
+/** A sign-in on the app's own screens ended or expired (AERO-1411): start another. */
+'invalid_session' |
+/** Only the hosted page can go on with this sign-in. */
+'redirect_to_web' |
+/** Too many requests: wait `retryAfter` seconds. */
+'too_many_requests';
 /** Every code a `SynqError` can carry; an unknown one from a newer Synq passes through as a string. */
 type SynqAnyErrorCode = SynqErrorCode | OAuthErrorCode | SynqClientErrorCode | (string & Record<never, never>);
 /**
@@ -934,7 +1382,7 @@ interface paths {
     readonly get: {
       readonly parameters: {
         readonly query?: {
-          /** @description Only this action: org.created, org.updated, org.deleted, org.plan_changed, org.disabled, org.enabled, brand.created, brand.updated, brand.deleted, brand.reply_to_confirmed, app.created, app.updated, app.secret_rotated, app.deleted, app.api_access_changed, app.refresh_token_replayed, api.created, api.updated, api.deleted, org.ownership_transferred, member.added, member.role_assigned, member.removed, member.left, role.created, role.updated, role.deleted, invite.created, invite.revoked, invite.accepted, webhook.created, webhook.updated, webhook.secret_rotated, webhook.deleted, webhook.disabled, token_gate.created, token_gate.updated, token_gate.deleted, email_domain.created, email_domain.verified, email_domain.failed, email_domain.deleted, brand.custom_domain_added, brand.custom_domain_verified, brand.custom_domain_activated, brand.custom_domain_failed, brand.custom_domain_suspended, brand.custom_domain_restored, brand.custom_domain_removed, api_key.created, api_key.revoked, change_request.created, change_request.approved, change_request.declined, file.uploaded, file.rejected, file.downloaded, staff.role_granted, user.created, user.updated, user.looked_up, user.email_verified, user.password_reset, user.passkey_added, user.passkey_removed, user.identity_linked, user.identity_unlinked, user.consent_granted, user.consent_revoked, user.sessions_revoked, user.deletion_scheduled, user.deletion_cancelled, user.deleted, user.sign_in_failed, user.token_gate_checked, user.token_gate_dry_run. */
+          /** @description Only this action: org.created, org.updated, org.deleted, org.plan_changed, org.disabled, org.enabled, brand.created, brand.updated, brand.deleted, brand.reply_to_confirmed, brand.app_registrations_full, app.created, app.updated, app.secret_rotated, app.deleted, app.api_access_changed, app.refresh_token_replayed, api.created, api.updated, api.deleted, org.ownership_transferred, member.added, member.role_assigned, member.removed, member.left, role.created, role.updated, role.deleted, invite.created, invite.revoked, invite.accepted, webhook.created, webhook.updated, webhook.secret_rotated, webhook.deleted, webhook.disabled, token_gate.created, token_gate.updated, token_gate.deleted, email_domain.created, email_domain.verified, email_domain.failed, email_domain.deleted, brand.custom_domain_added, brand.custom_domain_verified, brand.custom_domain_activated, brand.custom_domain_failed, brand.custom_domain_suspended, brand.custom_domain_restored, brand.custom_domain_removed, api_key.created, api_key.revoked, change_request.created, change_request.approved, change_request.declined, file.uploaded, file.rejected, file.downloaded, staff.role_granted, user.created, user.updated, user.looked_up, user.email_verified, user.password_reset, user.passkey_added, user.passkey_removed, user.identity_linked, user.identity_unlinked, user.consent_granted, user.consent_revoked, user.api_key_created, user.api_key_revoked, user.sessions_revoked, user.deletion_scheduled, user.deletion_cancelled, user.deleted, user.sign_in_failed, user.token_gate_checked, user.token_gate_dry_run. */
           readonly action?: string;
           /** @description Only this actor's changes: a user's or an API key's id. */
           readonly actor?: string;
@@ -5162,6 +5610,165 @@ interface paths {
     };
     readonly trace?: never;
   };
+  readonly "/v1/orgs/{org}/brands/{brand}/users/{user}/api-keys": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * A user's API keys
+     * @description The keys they made for the brand's APIs (AERO-1693), oldest first, revoked and expired ones too; never a key itself. Needs `org.users.view`.
+     */
+    readonly get: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly brand: string;
+          readonly org: string;
+          readonly user: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Their API keys */
+        readonly 200: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/json": {
+              readonly data: readonly components["schemas"]["UserApiKey"][];
+            };
+          };
+        };
+        /** @description No credential, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The credential lacks the permission this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No such org, or one the credential may not act in */
+        readonly 404: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly "/v1/orgs/{org}/brands/{brand}/users/{user}/api-keys/{key}": {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    readonly post?: never;
+    /**
+     * Revoke a user's API key
+     * @description At once: its API's next check of it answers `active: false`. Needs `org.users.edit`. Recorded as `user.api_key_revoked`.
+     */
+    readonly delete: {
+      readonly parameters: {
+        readonly query?: never;
+        readonly header?: never;
+        readonly path: {
+          readonly brand: string;
+          readonly key: string;
+          readonly org: string;
+          readonly user: string;
+        };
+        readonly cookie?: never;
+      };
+      readonly requestBody?: never;
+      readonly responses: {
+        /** @description Revoked */
+        readonly 204: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description No credential, or one that is not valid */
+        readonly 401: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description The credential lacks the permission this route needs */
+        readonly 403: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description No such org, or one the credential may not act in */
+        readonly 404: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+        /** @description Too many requests */
+        readonly 429: {
+          headers: {
+            readonly [name: string]: unknown;
+          };
+          content: {
+            readonly "application/problem+json": components["schemas"]["Problem"];
+          };
+        };
+      };
+    };
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly "/v1/orgs/{org}/brands/{brand}/users/{user}/consents": {
     readonly parameters: {
       readonly query?: never;
@@ -8121,7 +8728,7 @@ interface paths {
     readonly put?: never;
     /**
      * Test a token gate or a draft rule
-     * @description Checks a gate (`gate`), or a rule not saved yet (`rule`, with an optional `schedule`), against wallets (`wallets`, at most 10 addresses) or a user's wallets in a brand (`user` and `brand`), as a sign-in would, at `at` (an ISO time, for the window; now when left out), with what was read in the last minute unless `fresh`. Answers what each condition came to, how many reads it cost, and the refusal page's words for it. A draft is read from the chain as saving it would read it (400 at the path of what isn't what its condition says, 503 when the chain can't say), so it is tested as the gate it would be. Saves nothing. Needs `org.tokenGates.view`, and `org.users.view` to test a user, which is recorded as `user.token_gate_dry_run` (a test against addresses reads only public chain data, and isn't). Limited per org (`token_gate.dry_runs`), and reads the chain from the org's own budget (`token_gate.org_reads`), never a brand's sign-ins'.
+     * @description Checks a gate (`gate`), or a rule not saved yet (`rule`, with an optional `schedule`), against wallets (`wallets`, at most 10 addresses) or a user's wallets in a brand (`user` and `brand`), as a sign-in would, at `at` (an ISO time, for the window; now when left out), with what was read in the last minute unless `fresh`. Answers what each condition came to, how many reads it cost, and the refusal page's words for it. A draft is read from the chain as saving it would read it (400 at the path of what isn't what its condition says, 503 when the chain can't say), so it is tested as the gate it would be. Saves nothing. Wants the org's plan to have token gating (`auth.token_gating`, 403 `plan_feature_unavailable` otherwise), since every test may read the chain through Synq's own key. Needs `org.tokenGates.view`, and `org.users.view` to test a user, which is recorded as `user.token_gate_dry_run` (a test against addresses reads only public chain data, and isn't). Limited per org (`token_gate.dry_runs`), and reads the chain from the org's own budget (`token_gate.org_reads`), never a brand's sign-ins'.
      */
     readonly post: {
       readonly parameters: {
@@ -8183,13 +8790,13 @@ interface paths {
             readonly "application/problem+json": components["schemas"]["Problem"];
           };
         };
-        /** @description The credential lacks the permission this route needs */
+        /** @description The credential lacks org.tokenGates.view (or org.users.view to test a user), or the org's plan has no token gating */
         readonly 403: {
           headers: {
             readonly [name: string]: unknown;
           };
           content: {
-            readonly "application/problem+json": components["schemas"]["Problem"];
+            readonly "application/problem+json": components["schemas"]["PlanProblem"];
           };
         };
         /** @description No such org, or one the credential may not act in */
@@ -8407,7 +9014,7 @@ interface paths {
           readonly "application/json": {
             readonly description?: string | null;
             /** @description The event types it wants, or `*` for every one */
-            readonly events: readonly ("*" | "org.created" | "org.updated" | "org.deleted" | "org.plan_changed" | "org.disabled" | "org.enabled" | "brand.created" | "brand.updated" | "brand.deleted" | "brand.reply_to_confirmed" | "app.created" | "app.updated" | "app.secret_rotated" | "app.deleted" | "app.api_access_changed" | "app.refresh_token_replayed" | "api.created" | "api.updated" | "api.deleted" | "org.ownership_transferred" | "member.added" | "member.role_assigned" | "member.removed" | "member.left" | "role.created" | "role.updated" | "role.deleted" | "invite.created" | "invite.revoked" | "invite.accepted" | "webhook.created" | "webhook.updated" | "webhook.secret_rotated" | "webhook.deleted" | "webhook.disabled" | "token_gate.created" | "token_gate.updated" | "token_gate.deleted" | "email_domain.created" | "email_domain.verified" | "email_domain.failed" | "email_domain.deleted" | "brand.custom_domain_added" | "brand.custom_domain_verified" | "brand.custom_domain_activated" | "brand.custom_domain_failed" | "brand.custom_domain_suspended" | "brand.custom_domain_restored" | "brand.custom_domain_removed" | "api_key.created" | "api_key.revoked" | "change_request.created" | "change_request.approved" | "change_request.declined" | "file.uploaded" | "file.rejected" | "file.downloaded" | "staff.role_granted" | "user.created" | "user.updated" | "user.looked_up" | "user.email_verified" | "user.password_reset" | "user.passkey_added" | "user.passkey_removed" | "user.identity_linked" | "user.identity_unlinked" | "user.consent_granted" | "user.consent_revoked" | "user.sessions_revoked" | "user.deletion_scheduled" | "user.deletion_cancelled" | "user.deleted" | "user.sign_in_failed" | "user.token_gate_checked" | "user.token_gate_dry_run" | "webhook.test")[];
+            readonly events: readonly ("*" | "org.created" | "org.updated" | "org.deleted" | "org.plan_changed" | "org.disabled" | "org.enabled" | "brand.created" | "brand.updated" | "brand.deleted" | "brand.reply_to_confirmed" | "brand.app_registrations_full" | "app.created" | "app.updated" | "app.secret_rotated" | "app.deleted" | "app.api_access_changed" | "app.refresh_token_replayed" | "api.created" | "api.updated" | "api.deleted" | "org.ownership_transferred" | "member.added" | "member.role_assigned" | "member.removed" | "member.left" | "role.created" | "role.updated" | "role.deleted" | "invite.created" | "invite.revoked" | "invite.accepted" | "webhook.created" | "webhook.updated" | "webhook.secret_rotated" | "webhook.deleted" | "webhook.disabled" | "token_gate.created" | "token_gate.updated" | "token_gate.deleted" | "email_domain.created" | "email_domain.verified" | "email_domain.failed" | "email_domain.deleted" | "brand.custom_domain_added" | "brand.custom_domain_verified" | "brand.custom_domain_activated" | "brand.custom_domain_failed" | "brand.custom_domain_suspended" | "brand.custom_domain_restored" | "brand.custom_domain_removed" | "api_key.created" | "api_key.revoked" | "change_request.created" | "change_request.approved" | "change_request.declined" | "file.uploaded" | "file.rejected" | "file.downloaded" | "staff.role_granted" | "user.created" | "user.updated" | "user.looked_up" | "user.email_verified" | "user.password_reset" | "user.passkey_added" | "user.passkey_removed" | "user.identity_linked" | "user.identity_unlinked" | "user.consent_granted" | "user.consent_revoked" | "user.api_key_created" | "user.api_key_revoked" | "user.sessions_revoked" | "user.deletion_scheduled" | "user.deletion_cancelled" | "user.deleted" | "user.sign_in_failed" | "user.token_gate_checked" | "user.token_gate_dry_run" | "webhook.test")[];
             readonly url: string;
           };
         };
@@ -8630,7 +9237,7 @@ interface paths {
             readonly description?: string | null;
             readonly enabled?: boolean;
             /** @description The event types it wants, or `*` for every one */
-            readonly events?: readonly ("*" | "org.created" | "org.updated" | "org.deleted" | "org.plan_changed" | "org.disabled" | "org.enabled" | "brand.created" | "brand.updated" | "brand.deleted" | "brand.reply_to_confirmed" | "app.created" | "app.updated" | "app.secret_rotated" | "app.deleted" | "app.api_access_changed" | "app.refresh_token_replayed" | "api.created" | "api.updated" | "api.deleted" | "org.ownership_transferred" | "member.added" | "member.role_assigned" | "member.removed" | "member.left" | "role.created" | "role.updated" | "role.deleted" | "invite.created" | "invite.revoked" | "invite.accepted" | "webhook.created" | "webhook.updated" | "webhook.secret_rotated" | "webhook.deleted" | "webhook.disabled" | "token_gate.created" | "token_gate.updated" | "token_gate.deleted" | "email_domain.created" | "email_domain.verified" | "email_domain.failed" | "email_domain.deleted" | "brand.custom_domain_added" | "brand.custom_domain_verified" | "brand.custom_domain_activated" | "brand.custom_domain_failed" | "brand.custom_domain_suspended" | "brand.custom_domain_restored" | "brand.custom_domain_removed" | "api_key.created" | "api_key.revoked" | "change_request.created" | "change_request.approved" | "change_request.declined" | "file.uploaded" | "file.rejected" | "file.downloaded" | "staff.role_granted" | "user.created" | "user.updated" | "user.looked_up" | "user.email_verified" | "user.password_reset" | "user.passkey_added" | "user.passkey_removed" | "user.identity_linked" | "user.identity_unlinked" | "user.consent_granted" | "user.consent_revoked" | "user.sessions_revoked" | "user.deletion_scheduled" | "user.deletion_cancelled" | "user.deleted" | "user.sign_in_failed" | "user.token_gate_checked" | "user.token_gate_dry_run" | "webhook.test")[];
+            readonly events?: readonly ("*" | "org.created" | "org.updated" | "org.deleted" | "org.plan_changed" | "org.disabled" | "org.enabled" | "brand.created" | "brand.updated" | "brand.deleted" | "brand.reply_to_confirmed" | "brand.app_registrations_full" | "app.created" | "app.updated" | "app.secret_rotated" | "app.deleted" | "app.api_access_changed" | "app.refresh_token_replayed" | "api.created" | "api.updated" | "api.deleted" | "org.ownership_transferred" | "member.added" | "member.role_assigned" | "member.removed" | "member.left" | "role.created" | "role.updated" | "role.deleted" | "invite.created" | "invite.revoked" | "invite.accepted" | "webhook.created" | "webhook.updated" | "webhook.secret_rotated" | "webhook.deleted" | "webhook.disabled" | "token_gate.created" | "token_gate.updated" | "token_gate.deleted" | "email_domain.created" | "email_domain.verified" | "email_domain.failed" | "email_domain.deleted" | "brand.custom_domain_added" | "brand.custom_domain_verified" | "brand.custom_domain_activated" | "brand.custom_domain_failed" | "brand.custom_domain_suspended" | "brand.custom_domain_restored" | "brand.custom_domain_removed" | "api_key.created" | "api_key.revoked" | "change_request.created" | "change_request.approved" | "change_request.declined" | "file.uploaded" | "file.rejected" | "file.downloaded" | "staff.role_granted" | "user.created" | "user.updated" | "user.looked_up" | "user.email_verified" | "user.password_reset" | "user.passkey_added" | "user.passkey_removed" | "user.identity_linked" | "user.identity_unlinked" | "user.consent_granted" | "user.consent_revoked" | "user.api_key_created" | "user.api_key_revoked" | "user.sessions_revoked" | "user.deletion_scheduled" | "user.deletion_cancelled" | "user.deleted" | "user.sign_in_failed" | "user.token_gate_checked" | "user.token_gate_dry_run" | "webhook.test")[];
             readonly url?: string;
           };
         };
@@ -9049,8 +9656,10 @@ interface components {
       /** @description Seconds, 300 to 900 */
       readonly access_token_ttl: number;
       readonly allow_third_party: boolean;
+      /** @description Whether the brand's users may make API keys for it (AERO-1693), which its own app checks at the issuer's `POST /api-keys/verify` */
+      readonly allow_user_api_keys: boolean;
       readonly brand_id: string;
-      /** @description The app that may introspect this API's tokens */
+      /** @description The app that may introspect this API's tokens, and check its users' API keys */
       readonly client_id: string | null;
       /** Format: date-time */
       readonly created_at: string;
@@ -9121,6 +9730,8 @@ interface components {
     readonly ApiUpdate: {
       readonly access_token_ttl?: number;
       readonly allow_third_party?: boolean;
+      /** @description Let the brand's users make API keys for it. Needs the API's own app (`client_id`), which alone checks them. Turning it off revokes every key its users made, for good. */
+      readonly allow_user_api_keys?: boolean;
       /** @description One of the brand's web or machine apps, or null */
       readonly client_id?: string | null;
       readonly name?: string;
@@ -9149,6 +9760,8 @@ interface components {
       readonly last_used_at: string | null;
       readonly logo_uri: string | null;
       readonly name: string;
+      /** @description Whether the app signs people in on its own screens, through the issuer's `/authorize-challenge` */
+      readonly own_ui_sign_in: boolean;
       readonly pkce_optional: boolean;
       readonly policy_uri: string | null;
       readonly post_logout_redirect_uris: readonly string[];
@@ -9208,6 +9821,8 @@ interface components {
       readonly logo_uri?: string | null;
       /** @example Acme web */
       readonly name: string;
+      /** @description The app signs people in on its own screens, with a password, an emailed code or a passkey, through the issuer's `/authorize-challenge` (OAuth 2.0 for First-Party Applications), rather than sending them to the hosted page. For the brand's own web or native apps only (`first_party`), and off by default: the app's code then sees the passwords and codes people type. Turning `first_party` off turns this off too */
+      readonly own_ui_sign_in?: boolean;
       /** @description A web app may skip PKCE (not recommended); public apps never can */
       readonly pkce_optional?: boolean;
       /** Format: uri */
@@ -9264,6 +9879,8 @@ interface components {
       /** Format: uri */
       readonly logo_uri?: string | null;
       readonly name?: string;
+      /** @description The app signs people in on its own screens, with a password, an emailed code or a passkey, through the issuer's `/authorize-challenge` (OAuth 2.0 for First-Party Applications), rather than sending them to the hosted page. For the brand's own web or native apps only (`first_party`), and off by default: the app's code then sees the passwords and codes people type. Turning `first_party` off turns this off too */
+      readonly own_ui_sign_in?: boolean;
       /** @description A web app may skip PKCE (not recommended); public apps never can */
       readonly pkce_optional?: boolean;
       /** Format: uri */
@@ -9289,7 +9906,7 @@ interface components {
     };
     readonly AppWarning: {
       /**
-       * @description What it is about, for code to read. `loopback_redirect_uris`: deployed, a web app or SPA still has redirect or post-logout URIs on a loopback address (localhost, 127.0.0.1, [::1]), a dev server on a laptop
+       * @description What it is about, for code to read. `loopback_redirect_uris`: deployed, a web app or SPA still has redirect or post-logout URIs on a loopback address (localhost, 127.0.0.1, [::1]), a dev server on a laptop. `passkey_origin_beyond_related_origins_limit`: a web app that signs people in on its own screens has an origin past the first 5 sites of the brand's passkey list, which browsers read, so passkeys from there go through the hosted page
        * @example loopback_redirect_uris
        */
       readonly code: string;
@@ -11032,6 +11649,40 @@ interface components {
       /** @description Solana addresses they sign in with */
       readonly wallets: readonly string[];
     };
+    readonly UserApiKey: {
+      readonly api: {
+        /** @example https://api.acme.example */
+        readonly identifier: string;
+        readonly name: string;
+      };
+      /** Format: date-time */
+      readonly created_at: string;
+      /** Format: date-time */
+      readonly expires_at: string | null;
+      /** @example uak_01h455vb4pex5vsknk084sn02q */
+      readonly id: string;
+      /**
+       * Format: date-time
+       * @description When its API last checked it, to the minute
+       */
+      readonly last_used_at: string | null;
+      /** @example Reports script */
+      readonly name: string;
+      /**
+       * @description The start of the key, to tell keys apart
+       * @example ak_live_Ab3d
+       */
+      readonly prefix: string;
+      /** Format: date-time */
+      readonly revoked_at: string | null;
+      /**
+       * @description What it may do: scopes of its API (one the API drops leaves every key)
+       * @example [
+       *       "reports:read"
+       *     ]
+       */
+      readonly scopes: readonly string[];
+    };
     readonly UserCreate: {
       /** Format: email */
       readonly email: string;
@@ -11056,6 +11707,8 @@ interface components {
       readonly identities: readonly {
         /** Format: date-time */
         readonly created_at: string;
+        /** @description Their handle at the provider, without the @, as of their last sign-in with it: X’s, Discord’s, Telegram’s and Matrica’s username (AERO-2078). For showing people only: it changes, and never identifies anyone */
+        readonly handle: string | null;
         /** @example idn_01h455vb4pex5vsknk084sn02q */
         readonly id: string;
         /** @description A wallet’s name, as its person called it (AERO-1397) */
@@ -11078,6 +11731,11 @@ interface components {
         readonly id: string;
         /** Format: date-time */
         readonly signed_in_at: string | null;
+        /**
+         * @description Where it was signed in: the brand's hosted page, or one of its apps' own screens
+         * @enum {string}
+         */
+        readonly via: "hosted" | "app";
       }[];
     };
     readonly UserPage: {
@@ -11195,4 +11853,4 @@ interface components {
 }
 type operations = Record<string, never>;
 //#endregion
-export { Problem as a, SynqError as c, ERROR_CODES as d, SynqErrorCode as f, OAuthErrorCode as i, isSynqError as l, operations as n, SynqAnyErrorCode as o, paths as r, SynqClientErrorCode as s, components as t, problemError as u };
+export { SignInFlowStep as A, browserLocalStorage as C, PasskeyRequestOptionsJSON as D, PasskeyAssertionJSON as E, ChallengeMethod as F, ChallengeProblem as I, DeniedReason as L, StartSignInOptions as M, CHALLENGE_METHODS as N, SavedSignIn as O, CHALLENGE_PROBLEMS as P, RedirectReason as R, SynqStorage as S, memoryStorage as T, SessionEvent as _, Problem as a, SynqClientOptions as b, SynqError as c, ERROR_CODES as d, SynqErrorCode as f, Session as g, ServerSignInOptions as h, OAuthErrorCode as i, SignInStepResult as j, SignInFlow as k, isSynqError as l, IdTokenClaims as m, operations as n, SynqAnyErrorCode as o, AuthorizationUrlOptions as p, paths as r, SynqClientErrorCode as s, components as t, problemError as u, SignOutOptions as v, browserSessionStorage as w, createSynqClient as x, SynqClient as y };