notefeed 0.5.0 → 0.7.0

package/README.md

@@ -8,6 +8,8 @@ export NOTEFEED_URL=https://notes.example.com NOTEFEED_FEED=homelab-7f3k2q9x4m8w
 npx notefeed post "# Backup finished"
 backup.sh 2>&1 | npx notefeed post -
 npx notefeed notes --limit 5
+npx notefeed edit 20260929T140512Z-backup-finished "# Backup finished, verified"
+npx notefeed delete 20260929T140512Z-backup-finished
 ```
 
 ```js
@@ -19,6 +21,16 @@ console.log(created.url, created.read_url);
 for await (const note of client.notes()) console.log(note.created_at, note.title); // newest first, page by page
 ```
 
+`read_url` is `null` for a feed without a read link (rare; see the operations docs).
+
 `Client.fromEnv()` reads `NOTEFEED_URL` / `NOTEFEED_FEED` / `NOTEFEED_PASSWORD`; so does the `notefeed` command, unless given `--url` / `--feed` / `--password`.
 
+A feed can have its own password, which gates reading, listing and posting to it. Pass `feedPassword: "..."` to `new Client(...)` (or per call, e.g. `client.post(text, { feedPassword })`), or set `NOTEFEED_FEED_PASSWORD`, which `fromEnv()` and the `notefeed` command both read (there is deliberately no flag, so it stays out of shell history). It is sent as `X-Feed-Password`; `Authorization` stays the instance password. A feed password is 1 to 256 printable ASCII characters with no space at the start or end; an empty one is the same as none.
+
+A posted note can be changed or removed: `await client.edit(id, markdown)` replaces its text and returns the note (its id and URLs stay), and `await client.delete(id)` removes it. Both take the same `{ feed, feedPassword }` options as `post`, and a missing note is a `NotFoundError`. `notefeed edit <id> <text | - | --file PATH>` prints the note URL; `notefeed delete <id>` prints nothing. Anyone who can post to a feed can edit and delete its notes, and deleting is permanent.
+
+A feed can have a title and a description, and can be deleted: `await client.feedInfo()` returns `{ name, title, description, protected, read_url }`, `await client.updateFeed({ title, description })` replaces both (an empty string clears one) and returns the feed, and `await client.deleteFeed()` removes the feed with all its notes for good. All three take the same `{ feed, feedPassword }` options as `post`, and a feed that doesn't exist is a `NotFoundError`. Anyone who can post to a feed can do this, and deleting is permanent; there are no `notefeed` commands for it.
+
+An image can be uploaded to an existing feed and then used in a note: `const { file, url, markdown } = await client.uploadImage(bytes)` takes a `Uint8Array` or a `Blob` (PNG, JPEG, GIF or WebP; the server recognizes the format by the bytes), takes the same `{ feed, feedPassword }` options as `post`, and returns the image's `url` and `markdown` (`![](url)`), which you put in a note. The feed must already have a note, and an image that is too large is a `NoteTooLargeError`. `await client.updateFeed({ title, description, image: file })` makes an uploaded image the feed's title image (`image: ""` removes it; leaving `image` out keeps it). `notefeed image <PATH>` uploads a file and prints the markdown. Images are public to anyone with the feed's read link, and metadata such as EXIF is not removed.
+
 Full documentation: https://docs.notefeed.me/clients/

package/dist/cli.js

@@ -1,4 +1,4 @@
-/** `notefeed post ...` and `notefeed notes ...`: post and read notes from the command line. */
+/** `notefeed post`, `edit`, `delete`, `notes` and `image`: post, change, remove and read notes, and upload images, from the command line. */
 import { readFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { parseArgs } from "node:util";
@@ -6,8 +6,11 @@ import { Client, ConfigError, NotefeedError } from "./client.js";
 class UsageError extends Error {
 }
 const USAGE = [
-    "usage: notefeed post <text | - | --file PATH> [--url URL] [--feed FEED] [--password PASSWORD]",
-    "       notefeed notes [--limit N] [--json] [--url URL] [--feed FEED] [--password PASSWORD]",
+    "usage: notefeed post <text | - | --file PATH> [--tag TAG]... [--url URL] [--feed FEED] [--password PASSWORD]",
+    "       notefeed edit <id> <text | - | --file PATH> [--url URL] [--feed FEED] [--password PASSWORD]",
+    "       notefeed delete <id> [--url URL] [--feed FEED] [--password PASSWORD]",
+    "       notefeed image <PATH> [--url URL] [--feed FEED] [--password PASSWORD]",
+    "       notefeed notes [--limit N] [--tag TAG] [--json] [--url URL] [--feed FEED] [--password PASSWORD]",
 ].join("\n");
 /** Returns the exit code: 0 ok, 1 server/network error, 2 usage/config error. */
 export async function main(argv, io = process) {
@@ -20,6 +23,7 @@ export async function main(argv, io = process) {
                 feed: { type: "string" },
                 password: { type: "string" },
                 file: { type: "string" },
+                tag: { type: "string", multiple: true },
                 limit: { type: "string" },
                 json: { type: "boolean" },
                 version: { type: "boolean" },
@@ -38,16 +42,36 @@ export async function main(argv, io = process) {
         const [command, text, ...rest] = positionals;
         if (command === "post" && !rest.length) {
             const markdown = await read(text, values.file, io);
-            const note = await client(values).post(markdown);
+            const note = await client(values).post(markdown, { tags: values.tag });
             io.stdout.write(`${note.url}\n`);
             return 0;
         }
+        if (command === "edit" && text !== undefined && rest.length <= 1) {
+            const note = await client(values).edit(text, await read(rest[0], values.file, io));
+            io.stdout.write(`${note.url}\n`);
+            return 0;
+        }
+        if (command === "delete" && text !== undefined && !rest.length) {
+            await client(values).delete(text);
+            return 0;
+        }
+        if (command === "image" && text !== undefined && !rest.length) {
+            let bytes;
+            try {
+                bytes = await readFile(text);
+            }
+            catch (e) {
+                throw new UsageError(`cannot read ${text}: ${e.code ?? e.message}`);
+            }
+            io.stdout.write(`${(await client(values).uploadImage(bytes)).markdown}\n`);
+            return 0;
+        }
         if (command === "notes" && text === undefined) {
             const limit = Number(values.limit ?? 20);
             if (!Number.isInteger(limit) || limit < 1)
                 throw new UsageError("--limit must be a whole number, 1 or more");
             let left = limit;
-            for await (const n of client(values).notes({ pageSize: Math.min(limit, 100) })) {
+            for await (const n of client(values).notes({ pageSize: Math.min(limit, 100), tag: values.tag?.[0] })) {
                 // To the second, UTC: the same form as the Python CLI, so scripts read either the same way.
                 const when = new Date(n.created_at).toISOString().replace(/\.\d+Z$/, "Z");
                 // --json: exactly the documented fields, like the Python CLI, even if the server adds more.
@@ -69,7 +93,7 @@ export async function main(argv, io = process) {
         return 2; // parseArgs rejects unknown options with a TypeError
     }
 }
-// Flags win over NOTEFEED_URL, NOTEFEED_FEED and NOTEFEED_PASSWORD.
+// Flags win over NOTEFEED_URL, NOTEFEED_FEED and NOTEFEED_PASSWORD. NOTEFEED_FEED_PASSWORD has no flag: it would end up in shell history.
 function client(values) {
     const url = values.url || process.env.NOTEFEED_URL;
     const feed = values.feed || process.env.NOTEFEED_FEED;
@@ -77,7 +101,12 @@ function client(values) {
         throw new UsageError("no URL given; pass --url or set NOTEFEED_URL");
     if (!feed)
         throw new UsageError("no feed given; pass --feed or set NOTEFEED_FEED");
-    return new Client({ url, feed, password: values.password || process.env.NOTEFEED_PASSWORD });
+    return new Client({
+        url,
+        feed,
+        password: values.password || process.env.NOTEFEED_PASSWORD,
+        feedPassword: process.env.NOTEFEED_FEED_PASSWORD,
+    });
 }
 async function read(text, file, io) {
     if (file) {

package/dist/client.d.ts

@@ -1,12 +1,13 @@
-import type { Created, Error as ApiError, Note } from "./generated/types.gen.js";
+import type { Created, Error as ApiError, Feed, FeedSettings, ImageUploaded, Note } from "./generated/types.gen.js";
 /** The stable error codes the API answers with. */
 export type ErrorCode = NonNullable<ApiError["code"]>;
-export type { Created, Note };
+export type { Created, Feed, FeedSettings, ImageUploaded, Note };
 /** `timeoutMs` (default 10000) limits each whole request, including reading the answer. */
 export type ClientOptions = {
     url: string;
     feed?: string;
     password?: string;
+    feedPassword?: string;
     timeoutMs?: number;
 };
 /** Any failure talking to notefeed. `status` and `code` are null when there was no API answer. */
@@ -29,10 +30,10 @@ export declare class RateLimitedError extends NotefeedError {
 /** No such note, or a malformed read id. */
 export declare class NotFoundError extends NotefeedError {
 }
-/** The instance's feed or note limit is reached. */
+/** The instance's feed or note limit, or the feed's image limit, is reached. */
 export declare class LimitReachedError extends NotefeedError {
 }
-/** The note is over the server's size limit. */
+/** The note or image is over the server's size limit. */
 export declare class NoteTooLargeError extends NotefeedError {
 }
 /** The server refused the request itself: invalid or reserved feed, empty note, bad body or parameter. */
@@ -43,24 +44,62 @@ export declare class Client {
     readonly feed: string | null;
     private readonly api;
     private readonly timeoutMs;
+    private readonly feedPassword;
     /** A notefeed server. The feed set here is the default for every call; each call can override it. */
     constructor(options: ClientOptions);
-    /** NOTEFEED_URL, NOTEFEED_FEED and NOTEFEED_PASSWORD. */
+    /** NOTEFEED_URL, NOTEFEED_FEED, NOTEFEED_PASSWORD and NOTEFEED_FEED_PASSWORD. */
     static fromEnv(env?: Record<string, string | undefined>): Client;
+    /** `feedPassword` overrides the client's, for a feed that has its own password. `tags` label the note (at most 10, each 1 to 32 characters of letters, digits, `-`, `_`, `.`, `:`; not verified). */
     post(markdown: string, options?: {
         feed?: string;
+        feedPassword?: string;
+        tags?: string[];
     }): Promise<Created>;
-    /** Every note in the feed, newest first, fetched a page at a time; stop iterating whenever you like. */
+    /** Upload a PNG, JPEG, GIF or WebP image to an existing feed. The server decides the format by the bytes, so no content type is needed. `markdown` in the answer is `![](url)`, to put in a note. Same options as post(). */
+    uploadImage(data: Uint8Array | Blob, options?: {
+        feed?: string;
+        feedPassword?: string;
+    }): Promise<ImageUploaded>;
+    /** Replace a note's markdown; its id and URLs stay. Same options as post(). */
+    edit(id: string, markdown: string, options?: {
+        feed?: string;
+        feedPassword?: string;
+    }): Promise<Note>;
+    /** Remove a note for good. The feed stays, even with no notes left. Same options as post(). */
+    delete(id: string, options?: {
+        feed?: string;
+        feedPassword?: string;
+    }): Promise<void>;
+    /** The feed's name, title, description, whether it has a password, and its read link (null while it has no notes). Same options as post(). */
+    feedInfo(options?: {
+        feed?: string;
+        feedPassword?: string;
+    }): Promise<Feed>;
+    /** Replace the feed's title and description (both; an empty string clears one), and set (`image`: a file name from uploadImage) or clear (`""`) the title image; leave `image` out to keep it. The feed must already exist. Same options as post(). */
+    updateFeed(settings: FeedSettings, options?: {
+        feed?: string;
+        feedPassword?: string;
+    }): Promise<Feed>;
+    /** Delete the feed with all its notes, settings and password, for good; its name is free again. Same options as post(). */
+    deleteFeed(options?: {
+        feed?: string;
+        feedPassword?: string;
+    }): Promise<void>;
+    /** Every note in the feed, newest first, fetched a page at a time; stop iterating whenever you like. `tag`: only notes carrying it. */
     notes(options?: {
         feed?: string;
+        feedPassword?: string;
         pageSize?: number;
+        tag?: string;
     }): AsyncGenerator<Note>;
     note(id: string, options?: {
         feed?: string;
+        feedPassword?: string;
     }): Promise<Note>;
     /** Like notes(), by the feed's read id: public, read-only, needs no password. */
     readNotes(readId: string, options?: {
         pageSize?: number;
+        tag?: string;
     }): AsyncGenerator<Note>;
     readNote(readId: string, id: string): Promise<Note>;
     private feedFor;

package/dist/client.js

@@ -3,7 +3,7 @@
  * OpenAPI description (./generated, `npm run generate` in the repo). No runtime dependencies.
  */
 import { createClient, createConfig } from "./generated/client/index.js";
-import { getNote, getReadNote, listNotes, listReadNotes, postNote } from "./generated/sdk.gen.js";
+import { deleteFeed, deleteNote, editNote, getFeed, getNote, getReadNote, listNotes, listReadNotes, postNote, updateFeed, uploadImage } from "./generated/sdk.gen.js";
 /** Any failure talking to notefeed. `status` and `code` are null when there was no API answer. */
 export class NotefeedError extends Error {
     status;
@@ -32,10 +32,10 @@ export class RateLimitedError extends NotefeedError {
 /** No such note, or a malformed read id. */
 export class NotFoundError extends NotefeedError {
 }
-/** The instance's feed or note limit is reached. */
+/** The instance's feed or note limit, or the feed's image limit, is reached. */
 export class LimitReachedError extends NotefeedError {
 }
-/** The note is over the server's size limit. */
+/** The note or image is over the server's size limit. */
 export class NoteTooLargeError extends NotefeedError {
 }
 /** The server refused the request itself: invalid or reserved feed, empty note, bad body or parameter. */
@@ -46,12 +46,14 @@ const BY_CODE = {
     not_found: NotFoundError,
     feed_limit: LimitReachedError,
     note_limit: LimitReachedError,
+    image_limit: LimitReachedError,
     too_large: NoteTooLargeError,
     invalid_feed: InvalidRequestError,
     reserved_feed: InvalidRequestError,
     empty_note: InvalidRequestError,
     invalid_body: InvalidRequestError,
     invalid_request: InvalidRequestError,
+    feed_exists: InvalidRequestError,
     unsupported_type: InvalidRequestError,
 };
 const FEED_RE = /^[a-z0-9_-]{1,64}$/; // same rule as the server; reserved names still come back as a 400
@@ -60,9 +62,10 @@ export class Client {
     feed;
     api;
     timeoutMs;
+    feedPassword;
     /** A notefeed server. The feed set here is the default for every call; each call can override it. */
     constructor(options) {
-        const { url, feed, password, timeoutMs } = options ?? {};
+        const { url, feed, password, feedPassword, timeoutMs } = options ?? {};
         if (!url)
             throw new ConfigError("no url given");
         this.url = url.replace(/\/+$/, "");
@@ -71,29 +74,70 @@ export class Client {
         // Never echo the value: it would end up in terminals and CI logs.
         if (pw && /[\x00-\x1f\x7f]/.test(pw))
             throw new ConfigError("password contains invalid characters");
+        this.feedPassword = checkFeedPassword(feedPassword);
         this.timeoutMs = timeoutMs ?? 10_000;
         this.api = createClient(createConfig({ baseUrl: this.url, headers: pw ? { Authorization: `Bearer ${pw}` } : {} }));
     }
-    /** NOTEFEED_URL, NOTEFEED_FEED and NOTEFEED_PASSWORD. */
+    /** NOTEFEED_URL, NOTEFEED_FEED, NOTEFEED_PASSWORD and NOTEFEED_FEED_PASSWORD. */
     static fromEnv(env = process.env) {
-        return new Client({ url: env.NOTEFEED_URL ?? "", feed: env.NOTEFEED_FEED || undefined, password: env.NOTEFEED_PASSWORD });
+        return new Client({
+            url: env.NOTEFEED_URL ?? "",
+            feed: env.NOTEFEED_FEED || undefined,
+            password: env.NOTEFEED_PASSWORD,
+            feedPassword: env.NOTEFEED_FEED_PASSWORD,
+        });
     }
+    /** `feedPassword` overrides the client's, for a feed that has its own password. `tags` label the note (at most 10, each 1 to 32 characters of letters, digits, `-`, `_`, `.`, `:`; not verified). */
     async post(markdown, options = {}) {
         const feed = this.feedFor(options.feed);
-        return this.call(postNote({ client: this.api, path: { feed }, body: { markdown }, ...this.opts() }));
+        const body = { markdown, ...(options.tags?.length && { tags: options.tags }) };
+        return this.call(postNote({ client: this.api, path: { feed }, body, ...this.opts(options.feedPassword) }));
     }
-    /** Every note in the feed, newest first, fetched a page at a time; stop iterating whenever you like. */
+    /** Upload a PNG, JPEG, GIF or WebP image to an existing feed. The server decides the format by the bytes, so no content type is needed. `markdown` in the answer is `![](url)`, to put in a note. Same options as post(). */
+    async uploadImage(data, options = {}) {
+        const feed = this.feedFor(options.feed);
+        const body = data instanceof Blob ? data : new Blob([data]);
+        const headers = { ...this.opts(options.feedPassword).headers, "Content-Type": "application/octet-stream" };
+        return this.call(uploadImage({ client: this.api, path: { feed }, body, signal: AbortSignal.timeout(this.timeoutMs), headers }));
+    }
+    /** Replace a note's markdown; its id and URLs stay. Same options as post(). */
+    async edit(id, markdown, options = {}) {
+        const feed = this.feedFor(options.feed);
+        return this.call(editNote({ client: this.api, path: { feed, id }, body: { markdown }, ...this.opts(options.feedPassword) }));
+    }
+    /** Remove a note for good. The feed stays, even with no notes left. Same options as post(). */
+    async delete(id, options = {}) {
+        const feed = this.feedFor(options.feed);
+        await this.call(deleteNote({ client: this.api, path: { feed, id }, ...this.opts(options.feedPassword) }));
+    }
+    /** The feed's name, title, description, whether it has a password, and its read link (null while it has no notes). Same options as post(). */
+    async feedInfo(options = {}) {
+        const feed = this.feedFor(options.feed);
+        return this.call(getFeed({ client: this.api, path: { feed }, ...this.opts(options.feedPassword) }));
+    }
+    /** Replace the feed's title and description (both; an empty string clears one), and set (`image`: a file name from uploadImage) or clear (`""`) the title image; leave `image` out to keep it. The feed must already exist. Same options as post(). */
+    async updateFeed(settings, options = {}) {
+        const feed = this.feedFor(options.feed);
+        const body = { title: settings.title, description: settings.description, ...(settings.image === undefined ? {} : { image: settings.image }) };
+        return this.call(updateFeed({ client: this.api, path: { feed }, body, ...this.opts(options.feedPassword) }));
+    }
+    /** Delete the feed with all its notes, settings and password, for good; its name is free again. Same options as post(). */
+    async deleteFeed(options = {}) {
+        const feed = this.feedFor(options.feed);
+        await this.call(deleteFeed({ client: this.api, path: { feed }, ...this.opts(options.feedPassword) }));
+    }
+    /** Every note in the feed, newest first, fetched a page at a time; stop iterating whenever you like. `tag`: only notes carrying it. */
     notes(options = {}) {
         const feed = this.feedFor(options.feed);
-        return this.pages((before) => listNotes({ client: this.api, path: { feed }, query: { limit: options.pageSize, before }, ...this.opts() }));
+        return this.pages((before) => listNotes({ client: this.api, path: { feed }, query: { limit: options.pageSize, before, tag: options.tag }, ...this.opts(options.feedPassword) }));
     }
     async note(id, options = {}) {
         const feed = this.feedFor(options.feed);
-        return this.call(getNote({ client: this.api, path: { feed, id }, ...this.opts() }));
+        return this.call(getNote({ client: this.api, path: { feed, id }, ...this.opts(options.feedPassword) }));
     }
     /** Like notes(), by the feed's read id: public, read-only, needs no password. */
     readNotes(readId, options = {}) {
-        return this.pages((before) => listReadNotes({ client: this.api, path: { readId }, query: { limit: options.pageSize, before }, ...this.opts() }));
+        return this.pages((before) => listReadNotes({ client: this.api, path: { readId }, query: { limit: options.pageSize, before, tag: options.tag }, ...this.opts() }));
     }
     async readNote(readId, id) {
         return this.call(getReadNote({ client: this.api, path: { readId, id }, ...this.opts() }));
@@ -104,8 +148,9 @@ export class Client {
             throw new ConfigError("no feed given");
         return checkFeed(f);
     }
-    opts() {
-        return { signal: AbortSignal.timeout(this.timeoutMs) };
+    opts(feedPassword) {
+        const fp = checkFeedPassword(feedPassword) ?? this.feedPassword;
+        return { signal: AbortSignal.timeout(this.timeoutMs), headers: fp ? { "X-Feed-Password": fp } : {} };
     }
     // `before` is the previous page's `next`: older notes only, so notes posted meanwhile never repeat.
     async *pages(fetchPage) {
@@ -128,6 +173,8 @@ export class Client {
         if (response.redirected) {
             throw new NotefeedError(`${this.url} redirected to ${new URL(response.url).origin}: use that address as the URL`, response.status);
         }
+        if (response.status === 204 && error === undefined)
+            return undefined; // delete: no body
         if (response.ok) {
             if (error === undefined && isObject(data))
                 return data;
@@ -155,3 +202,10 @@ function checkFeed(feed) {
         throw new ConfigError("invalid feed name: use 1-64 of a-z, 0-9, _ and -");
     return feed;
 }
+function checkFeedPassword(value) {
+    const v = value?.trim() || null;
+    // Never echo the value: it would end up in terminals and CI logs.
+    if (v && /[\x00-\x1f\x7f]/.test(v))
+        throw new ConfigError("feed password contains invalid characters");
+    return v;
+}

package/dist/generated/index.d.ts

@@ -1,2 +1,2 @@
-export { getNote, getOpenApi, getReadNote, listNotes, listReadNotes, type Options, postNote } from './sdk.gen.js';
-export type { ClientOptions, Created, Error, GetNoteData, GetNoteError, GetNoteErrors, GetNoteResponse, GetNoteResponses, GetOpenApiData, GetOpenApiResponse, GetOpenApiResponses, GetReadNoteData, GetReadNoteError, GetReadNoteErrors, GetReadNoteResponse, GetReadNoteResponses, ListNotesData, ListNotesError, ListNotesErrors, ListNotesResponse, ListNotesResponses, ListReadNotesData, ListReadNotesError, ListReadNotesErrors, ListReadNotesResponse, ListReadNotesResponses, Note, NoteList, PostForm, PostJson, PostNoteData, PostNoteError, PostNoteErrors, PostNoteResponse, PostNoteResponses } from './types.gen.js';
+export { changeFeedPassword, deleteFeed, deleteNote, editNote, getFeed, getNote, getOpenApi, getReadFeed, getReadNote, listNotes, listReadNotes, type Options, postNote, removeFeedPassword, updateFeed, uploadImage } from './sdk.gen.js';
+export type { ChangeFeedPasswordData, ChangeFeedPasswordError, ChangeFeedPasswordErrors, ChangeFeedPasswordResponse, ChangeFeedPasswordResponses, ClientOptions, Created, DeleteFeedData, DeleteFeedError, DeleteFeedErrors, DeleteFeedResponse, DeleteFeedResponses, DeleteNoteData, DeleteNoteError, DeleteNoteErrors, DeleteNoteResponse, DeleteNoteResponses, EditNoteData, EditNoteError, EditNoteErrors, EditNoteResponse, EditNoteResponses, Error, Feed, FeedSettings, GetFeedData, GetFeedError, GetFeedErrors, GetFeedResponse, GetFeedResponses, GetNoteData, GetNoteError, GetNoteErrors, GetNoteResponse, GetNoteResponses, GetOpenApiData, GetOpenApiResponse, GetOpenApiResponses, GetReadFeedData, GetReadFeedError, GetReadFeedErrors, GetReadFeedResponse, GetReadFeedResponses, GetReadNoteData, GetReadNoteError, GetReadNoteErrors, GetReadNoteResponse, GetReadNoteResponses, ImageUploaded, ListNotesData, ListNotesError, ListNotesErrors, ListNotesResponse, ListNotesResponses, ListReadNotesData, ListReadNotesError, ListReadNotesErrors, ListReadNotesResponse, ListReadNotesResponses, Note, NoteList, PasswordJson, PostForm, PostJson, PostNoteData, PostNoteError, PostNoteErrors, PostNoteResponse, PostNoteResponses, ReadFeed, RemoveFeedPasswordData, RemoveFeedPasswordError, RemoveFeedPasswordErrors, RemoveFeedPasswordResponse, RemoveFeedPasswordResponses, UpdateFeedData, UpdateFeedError, UpdateFeedErrors, UpdateFeedResponse, UpdateFeedResponses, UploadImageData, UploadImageError, UploadImageErrors, UploadImageResponse, UploadImageResponses } from './types.gen.js';

package/dist/generated/index.js

@@ -1,2 +1,2 @@
 // This file is auto-generated by @hey-api/openapi-ts
-export { getNote, getOpenApi, getReadNote, listNotes, listReadNotes, postNote } from './sdk.gen.js';
+export { changeFeedPassword, deleteFeed, deleteNote, editNote, getFeed, getNote, getOpenApi, getReadFeed, getReadNote, listNotes, listReadNotes, postNote, removeFeedPassword, updateFeed, uploadImage } from './sdk.gen.js';

package/dist/generated/sdk.gen.d.ts

@@ -1,5 +1,5 @@
 import type { Client, ClientMeta, Options as Options2, RequestResult, TDataShape } from './client/index.js';
-import type { GetNoteData, GetNoteErrors, GetNoteResponses, GetOpenApiData, GetOpenApiResponses, GetReadNoteData, GetReadNoteErrors, GetReadNoteResponses, ListNotesData, ListNotesErrors, ListNotesResponses, ListReadNotesData, ListReadNotesErrors, ListReadNotesResponses, PostNoteData, PostNoteErrors, PostNoteResponses } from './types.gen.js';
+import type { ChangeFeedPasswordData, ChangeFeedPasswordErrors, ChangeFeedPasswordResponses, DeleteFeedData, DeleteFeedErrors, DeleteFeedResponses, DeleteNoteData, DeleteNoteErrors, DeleteNoteResponses, EditNoteData, EditNoteErrors, EditNoteResponses, GetFeedData, GetFeedErrors, GetFeedResponses, GetNoteData, GetNoteErrors, GetNoteResponses, GetOpenApiData, GetOpenApiResponses, GetReadFeedData, GetReadFeedErrors, GetReadFeedResponses, GetReadNoteData, GetReadNoteErrors, GetReadNoteResponses, ListNotesData, ListNotesErrors, ListNotesResponses, ListReadNotesData, ListReadNotesErrors, ListReadNotesResponses, PostNoteData, PostNoteErrors, PostNoteResponses, RemoveFeedPasswordData, RemoveFeedPasswordErrors, RemoveFeedPasswordResponses, UpdateFeedData, UpdateFeedErrors, UpdateFeedResponses, UploadImageData, UploadImageErrors, UploadImageResponses } from './types.gen.js';
 export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options2<TData, ThrowOnError, TResponse> & {
     /**
      * You can provide a client instance returned by `createClient()` instead of
@@ -22,13 +22,67 @@ export declare const listNotes: <ThrowOnError extends boolean = false>(options:
 /**
  * Post a note
  *
- * Creates the feed with its first note. Also served at `POST /{feed}`, the short form the client packages and curl one-liners use. The body is at most 102400 bytes and must be UTF-8. `application/x-www-form-urlencoded` (what `curl -d` sends) is read as raw markdown, not as form fields.
+ * Creates the feed with its first note, optionally protected by its own password (`X-Feed-Password` header or a `password` field in the JSON or form body; 1 to 256 printable ASCII characters, with no space at the start or end). Posting to a protected feed needs that password. Also served at `POST /{feed}`, the short form the client packages and curl one-liners use. The body is at most 102400 bytes and must be UTF-8. `application/x-www-form-urlencoded` (what `curl -d` sends) is read as raw markdown, not as form fields. Tags (at most 10 tags, each 1 to 32 characters of letters, digits, `-`, `_`, `.` and `:`; case is folded to lowercase, duplicates are removed) go in the JSON `tags` array, a repeated `tags` form field, or, for a raw body, the `X-Note-Tags` header.
  */
 export declare const postNote: <ThrowOnError extends boolean = false>(options: Options<PostNoteData, ThrowOnError>) => RequestResult<PostNoteResponses, PostNoteErrors, ThrowOnError>;
+/**
+ * Delete a note
+ *
+ * Needs the feed's password if it has one, and counts against the post rate limit. The feed stays, even with no notes left. Read links can't delete.
+ */
+export declare const deleteNote: <ThrowOnError extends boolean = false>(options: Options<DeleteNoteData, ThrowOnError>) => RequestResult<DeleteNoteResponses, DeleteNoteErrors, ThrowOnError>;
 /**
  * Get one note
  */
 export declare const getNote: <ThrowOnError extends boolean = false>(options: Options<GetNoteData, ThrowOnError>) => RequestResult<GetNoteResponses, GetNoteErrors, ThrowOnError>;
+/**
+ * Edit a note
+ *
+ * Replaces the note's markdown; its id and creation time stay, the title follows the new text. Needs the feed's password if it has one, and counts against the post rate limit. Read links can't edit. The body is as for posting: at most 102400 bytes, UTF-8, a `password` field is ignored.
+ */
+export declare const editNote: <ThrowOnError extends boolean = false>(options: Options<EditNoteData, ThrowOnError>) => RequestResult<EditNoteResponses, EditNoteErrors, ThrowOnError>;
+/**
+ * Upload an image
+ *
+ * The body is the image itself: PNG, JPEG, GIF or WebP, recognized by its first bytes, whatever `Content-Type` is sent (SVG is refused). Stored byte-for-byte, with no resizing and no metadata stripped (EXIF such as GPS position stays in the file), as the first 32 hex characters of its SHA-256 plus an extension: the same bytes always give the same URL. The URL is under the feed's read id, so it works in the feed page, the read-only view and RSS readers without any password. Needs the same credentials as posting and counts against the post rate limit. The feed must exist: it is created by its first note. The size limit is NOTEFEED_MAX_IMAGE_BYTES (default 5 MiB); images deleted only with the feed.
+ */
+export declare const uploadImage: <ThrowOnError extends boolean = false>(options: Options<UploadImageData, ThrowOnError>) => RequestResult<UploadImageResponses, UploadImageErrors, ThrowOnError>;
+/**
+ * Delete a feed
+ *
+ * Deletes the feed with all its notes, its settings, its password and its read link, for good: there is no undo. The name is free again; a feed created there later gets a new read link, and the old one answers like an unknown one. Needs the feed's password if it has one, and counts against the post rate limit.
+ */
+export declare const deleteFeed: <ThrowOnError extends boolean = false>(options: Options<DeleteFeedData, ThrowOnError>) => RequestResult<DeleteFeedResponses, DeleteFeedErrors, ThrowOnError>;
+/**
+ * Get a feed's settings
+ *
+ * The title and description, the title image, whether the feed is protected, and its read link (null while it has no notes). A feed exists once its first note is posted.
+ */
+export declare const getFeed: <ThrowOnError extends boolean = false>(options: Options<GetFeedData, ThrowOnError>) => RequestResult<GetFeedResponses, GetFeedErrors, ThrowOnError>;
+/**
+ * Change a feed's settings
+ *
+ * Replaces both the title (at most 100 characters) and the description (at most 500); surrounding whitespace is trimmed and control characters are refused. `show_sender` (default true) shows who posted each note to readers; omitted leaves it as it is. `image` is the file name `uploadImage` returned for this feed (title image), empty to remove it, or omitted to leave it as it is; any other value is a 400. Needs the feed's password if it has one, and counts against the post rate limit. Only on a feed that exists: it is created by its first note. Read links can't change settings.
+ */
+export declare const updateFeed: <ThrowOnError extends boolean = false>(options: Options<UpdateFeedData, ThrowOnError>) => RequestResult<UpdateFeedResponses, UpdateFeedErrors, ThrowOnError>;
+/**
+ * Remove a feed's password
+ *
+ * Needs the current password in `X-Feed-Password`. The feed stays, open to anyone who knows its name. An open feed answers 409.
+ */
+export declare const removeFeedPassword: <ThrowOnError extends boolean = false>(options: Options<RemoveFeedPasswordData, ThrowOnError>) => RequestResult<RemoveFeedPasswordResponses, RemoveFeedPasswordErrors, ThrowOnError>;
+/**
+ * Change a feed's password
+ *
+ * Needs the current password in `X-Feed-Password`. A feed can only get a password when it is created, so an open feed answers 409.
+ */
+export declare const changeFeedPassword: <ThrowOnError extends boolean = false>(options: Options<ChangeFeedPasswordData, ThrowOnError>) => RequestResult<ChangeFeedPasswordResponses, ChangeFeedPasswordErrors, ThrowOnError>;
+/**
+ * Get a feed's title and description by its read id
+ *
+ * Public, even on an instance with a password, and never reveals the feed's name. An unknown read id has an empty title and description, so read ids can't be probed.
+ */
+export declare const getReadFeed: <ThrowOnError extends boolean = false>(options: Options<GetReadFeedData, ThrowOnError>) => RequestResult<GetReadFeedResponses, GetReadFeedErrors, ThrowOnError>;
 /**
  * List a feed's notes by its read id
  *

package/dist/generated/sdk.gen.js

@@ -13,7 +13,7 @@ export const listNotes = (options) => (options.client ?? client).get({
 /**
  * Post a note
  *
- * Creates the feed with its first note. Also served at `POST /{feed}`, the short form the client packages and curl one-liners use. The body is at most 102400 bytes and must be UTF-8. `application/x-www-form-urlencoded` (what `curl -d` sends) is read as raw markdown, not as form fields.
+ * Creates the feed with its first note, optionally protected by its own password (`X-Feed-Password` header or a `password` field in the JSON or form body; 1 to 256 printable ASCII characters, with no space at the start or end). Posting to a protected feed needs that password. Also served at `POST /{feed}`, the short form the client packages and curl one-liners use. The body is at most 102400 bytes and must be UTF-8. `application/x-www-form-urlencoded` (what `curl -d` sends) is read as raw markdown, not as form fields. Tags (at most 10 tags, each 1 to 32 characters of letters, digits, `-`, `_`, `.` and `:`; case is folded to lowercase, duplicates are removed) go in the JSON `tags` array, a repeated `tags` form field, or, for a raw body, the `X-Note-Tags` header.
  */
 export const postNote = (options) => (options.client ?? client).post({
     security: [{ scheme: 'bearer', type: 'http' }],
@@ -24,6 +24,16 @@ export const postNote = (options) => (options.client ?? client).post({
         ...options.headers
     }
 });
+/**
+ * Delete a note
+ *
+ * Needs the feed's password if it has one, and counts against the post rate limit. The feed stays, even with no notes left. Read links can't delete.
+ */
+export const deleteNote = (options) => (options.client ?? client).delete({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/api/v1/feeds/{feed}/notes/{id}',
+    ...options
+});
 /**
  * Get one note
  */
@@ -32,6 +42,99 @@ export const getNote = (options) => (options.client ?? client).get({
     url: '/api/v1/feeds/{feed}/notes/{id}',
     ...options
 });
+/**
+ * Edit a note
+ *
+ * Replaces the note's markdown; its id and creation time stay, the title follows the new text. Needs the feed's password if it has one, and counts against the post rate limit. Read links can't edit. The body is as for posting: at most 102400 bytes, UTF-8, a `password` field is ignored.
+ */
+export const editNote = (options) => (options.client ?? client).put({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/api/v1/feeds/{feed}/notes/{id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Upload an image
+ *
+ * The body is the image itself: PNG, JPEG, GIF or WebP, recognized by its first bytes, whatever `Content-Type` is sent (SVG is refused). Stored byte-for-byte, with no resizing and no metadata stripped (EXIF such as GPS position stays in the file), as the first 32 hex characters of its SHA-256 plus an extension: the same bytes always give the same URL. The URL is under the feed's read id, so it works in the feed page, the read-only view and RSS readers without any password. Needs the same credentials as posting and counts against the post rate limit. The feed must exist: it is created by its first note. The size limit is NOTEFEED_MAX_IMAGE_BYTES (default 5 MiB); images deleted only with the feed.
+ */
+export const uploadImage = (options) => (options.client ?? client).post({
+    bodySerializer: null,
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/api/v1/feeds/{feed}/images',
+    ...options,
+    headers: {
+        'Content-Type': 'image/png',
+        ...options.headers
+    }
+});
+/**
+ * Delete a feed
+ *
+ * Deletes the feed with all its notes, its settings, its password and its read link, for good: there is no undo. The name is free again; a feed created there later gets a new read link, and the old one answers like an unknown one. Needs the feed's password if it has one, and counts against the post rate limit.
+ */
+export const deleteFeed = (options) => (options.client ?? client).delete({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/api/v1/feeds/{feed}',
+    ...options
+});
+/**
+ * Get a feed's settings
+ *
+ * The title and description, the title image, whether the feed is protected, and its read link (null while it has no notes). A feed exists once its first note is posted.
+ */
+export const getFeed = (options) => (options.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/api/v1/feeds/{feed}',
+    ...options
+});
+/**
+ * Change a feed's settings
+ *
+ * Replaces both the title (at most 100 characters) and the description (at most 500); surrounding whitespace is trimmed and control characters are refused. `show_sender` (default true) shows who posted each note to readers; omitted leaves it as it is. `image` is the file name `uploadImage` returned for this feed (title image), empty to remove it, or omitted to leave it as it is; any other value is a 400. Needs the feed's password if it has one, and counts against the post rate limit. Only on a feed that exists: it is created by its first note. Read links can't change settings.
+ */
+export const updateFeed = (options) => (options.client ?? client).put({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/api/v1/feeds/{feed}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Remove a feed's password
+ *
+ * Needs the current password in `X-Feed-Password`. The feed stays, open to anyone who knows its name. An open feed answers 409.
+ */
+export const removeFeedPassword = (options) => (options.client ?? client).delete({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/api/v1/feeds/{feed}/password',
+    ...options
+});
+/**
+ * Change a feed's password
+ *
+ * Needs the current password in `X-Feed-Password`. A feed can only get a password when it is created, so an open feed answers 409.
+ */
+export const changeFeedPassword = (options) => (options.client ?? client).put({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/api/v1/feeds/{feed}/password',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get a feed's title and description by its read id
+ *
+ * Public, even on an instance with a password, and never reveals the feed's name. An unknown read id has an empty title and description, so read ids can't be probed.
+ */
+export const getReadFeed = (options) => (options.client ?? client).get({ url: '/api/v1/read/{readId}', ...options });
 /**
  * List a feed's notes by its read id
  *

package/dist/generated/types.gen.d.ts

@@ -22,6 +22,14 @@ export type Note = {
      * The note's page in the web UI
      */
     url: string;
+    /**
+     * Verified sign-in name of the poster; absent when the note was posted without a sign-in
+     */
+    sender?: string | null;
+    /**
+     * Labels the poster gave the note (not verified, and shown to readers like the note itself); empty when none
+     */
+    tags: Array<string>;
 };
 export type NoteList = {
     /**
@@ -44,9 +52,23 @@ export type Created = {
      */
     feed_url: string;
     /**
-     * The feed's read-only RSS link, safe to share
+     * The feed's read-only RSS link, safe to share; null only if the server can't read the feed's stored read id, or if that id and the derived one both belong to other feeds
+     */
+    read_url: string | null;
+};
+export type ImageUploaded = {
+    /**
+     * The stored file's name: 32 hex characters of the SHA-256 plus the extension. Pass it as a feed's `image` setting
+     */
+    file: string;
+    /**
+     * Where the image is served, absolute, under the feed's read id; public like the read link
+     */
+    url: string;
+    /**
+     * `![](url)`, to paste into a note
      */
-    read_url: string;
+    markdown: string;
 };
 export type Error = {
     /**
@@ -56,16 +78,106 @@ export type Error = {
     /**
      * Stable machine-readable code; absent only on a 500
      */
-    code?: 'invalid_feed' | 'reserved_feed' | 'auth' | 'rate_limited' | 'too_many_attempts' | 'feed_limit' | 'note_limit' | 'empty_note' | 'too_large' | 'unsupported_type' | 'invalid_body' | 'invalid_request' | 'not_found';
+    code?: 'invalid_feed' | 'reserved_feed' | 'auth' | 'rate_limited' | 'too_many_attempts' | 'feed_limit' | 'note_limit' | 'image_limit' | 'empty_note' | 'too_large' | 'unsupported_type' | 'invalid_body' | 'invalid_request' | 'not_found' | 'feed_exists';
 };
 export type PostJson = {
     markdown: string;
+    /**
+     * Protects the feed: 1 to 256 printable ASCII characters, with no space at the start or end. Only honored on the post that creates the feed; an existing open feed answers 409. Empty is the same as leaving it out.
+     */
+    password?: string;
+    /**
+     * Labels for the note: at most 10 tags, each 1 to 32 characters of letters, digits, `-`, `_`, `.` and `:`; case is folded to lowercase, duplicates are removed. Free labels, not verified, shown with the note (also to readers of the read link and RSS). Ignored when editing a note: an edit keeps its tags.
+     */
+    tags?: Array<string>;
 };
 export type PostForm = {
     markdown: string;
+    /**
+     * Protects the feed: 1 to 256 printable ASCII characters, with no space at the start or end. Only honored on the post that creates the feed; an existing open feed answers 409. Empty is the same as leaving it out.
+     */
+    password?: string;
+    /**
+     * Labels for the note: at most 10 tags, each 1 to 32 characters of letters, digits, `-`, `_`, `.` and `:`; case is folded to lowercase, duplicates are removed. Free labels, not verified, shown with the note (also to readers of the read link and RSS). Ignored when editing a note: an edit keeps its tags.
+     */
+    tags?: Array<string>;
+};
+export type PasswordJson = {
+    /**
+     * The new password: 1 to 256 printable ASCII characters, with no space at the start or end
+     */
+    password: string;
+};
+export type FeedSettings = {
+    /**
+     * Display title, at most 100 characters, one line; empty means none (the feed's name is shown)
+     */
+    title: string;
+    /**
+     * Description, at most 500 characters, one line; may be empty
+     */
+    description: string;
+    /**
+     * The file name of an image uploaded to this feed (see uploadImage), shown as the feed's title image; empty removes it, omitted leaves it as it is
+     */
+    image?: string;
+    /**
+     * Whether readers (RSS, the read API and pages) see who posted each note; omitted leaves it as it is, a new feed starts with true
+     */
+    show_sender?: boolean;
+};
+export type Feed = {
+    /**
+     * The feed's name
+     */
+    name: string;
+    /**
+     * Display title, at most 100 characters, one line; empty means none (the feed's name is shown)
+     */
+    title: string;
+    /**
+     * Description, at most 500 characters, one line; may be empty
+     */
+    description: string;
+    /**
+     * Whether the feed has its own password
+     */
+    protected: boolean;
+    /**
+     * The feed's read-only RSS link; null while the feed has no notes, or if the server can't read the feed's stored read id
+     */
+    read_url: string | null;
+    /**
+     * The feed's title image (absolute URL, served under the read id), or null
+     */
+    image_url: string | null;
+    /**
+     * Whether readers see who posted each note
+     */
+    show_sender: boolean;
+};
+export type ReadFeed = {
+    /**
+     * Display title, at most 100 characters, one line; empty means none (the feed's name is shown)
+     */
+    title: string;
+    /**
+     * Description, at most 500 characters, one line; may be empty
+     */
+    description: string;
+    /**
+     * The feed's title image (absolute URL, served under the read id), or null
+     */
+    image_url: string | null;
 };
 export type ListNotesData = {
     body?: never;
+    headers?: {
+        /**
+         * The feed's own password, when it has one: to post, list or get, and (as the current password) to change or remove it. On the `POST` that creates a feed it sets the feed's password; on a `POST` to an existing feed that has none it answers 409. An empty value is the same as no header, so a `POST` with an empty one creates an open feed.
+         */
+        'X-Feed-Password'?: string;
+    };
     path: {
         /**
          * The feed's name. It is the write key: anyone who knows it can post.
@@ -81,6 +193,10 @@ export type ListNotesData = {
          * Only notes older than this id: the previous page's `next`
          */
         before?: string;
+        /**
+         * Only notes carrying this tag
+         */
+        tag?: string;
     };
     url: '/api/v1/feeds/{feed}/notes';
 };
@@ -90,7 +206,7 @@ export type ListNotesErrors = {
      */
     400: Error;
     /**
-     * The instance has a password and it is missing or wrong
+     * The instance has a password, or the feed has its own, and it is missing or wrong
      */
     401: Error;
     /**
@@ -108,6 +224,16 @@ export type ListNotesResponses = {
 export type ListNotesResponse = ListNotesResponses[keyof ListNotesResponses];
 export type PostNoteData = {
     body: PostJson;
+    headers?: {
+        /**
+         * The feed's own password, when it has one: to post, list or get, and (as the current password) to change or remove it. On the `POST` that creates a feed it sets the feed's password; on a `POST` to an existing feed that has none it answers 409. An empty value is the same as no header, so a `POST` with an empty one creates an open feed.
+         */
+        'X-Feed-Password'?: string;
+        /**
+         * Tags for the note, comma-separated (`ci,deploy`): at most 10 tags, each 1 to 32 characters of letters, digits, `-`, `_`, `.` and `:`; case is folded to lowercase, duplicates are removed. For a raw markdown body; a JSON or form body's own `tags` wins. Empty is none.
+         */
+        'X-Note-Tags'?: string;
+    };
     path: {
         /**
          * The feed's name. It is the write key: anyone who knows it can post.
@@ -119,13 +245,17 @@ export type PostNoteData = {
 };
 export type PostNoteErrors = {
     /**
-     * Invalid or reserved feed name; empty note; bad JSON, form or UTF-8
+     * Invalid or reserved feed name; empty note; bad JSON, form or UTF-8; a new password that is not printable ASCII; invalid tags
      */
     400: Error;
     /**
-     * The instance has a password and it is missing or wrong
+     * The instance has a password, or the feed has its own, and it is missing or wrong
      */
     401: Error;
+    /**
+     * A password was sent for a feed that already exists without one: it can't be claimed
+     */
+    409: Error;
     /**
      * Body over 102400 bytes
      */
@@ -151,8 +281,61 @@ export type PostNoteResponses = {
     201: Created;
 };
 export type PostNoteResponse = PostNoteResponses[keyof PostNoteResponses];
+export type DeleteNoteData = {
+    body?: never;
+    headers?: {
+        /**
+         * The feed's own password, when it has one: to post, list or get, and (as the current password) to change or remove it. On the `POST` that creates a feed it sets the feed's password; on a `POST` to an existing feed that has none it answers 409. An empty value is the same as no header, so a `POST` with an empty one creates an open feed.
+         */
+        'X-Feed-Password'?: string;
+    };
+    path: {
+        /**
+         * The feed's name. It is the write key: anyone who knows it can post.
+         */
+        feed: string;
+        /**
+         * The note's id
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/feeds/{feed}/notes/{id}';
+};
+export type DeleteNoteErrors = {
+    /**
+     * Invalid or reserved feed name
+     */
+    400: Error;
+    /**
+     * The instance has a password, or the feed has its own, and it is missing or wrong
+     */
+    401: Error;
+    /**
+     * No such note
+     */
+    404: Error;
+    /**
+     * Too many posts, edits and deletes, or wrong passwords, from this client
+     */
+    429: Error;
+};
+export type DeleteNoteError = DeleteNoteErrors[keyof DeleteNoteErrors];
+export type DeleteNoteResponses = {
+    /**
+     * Deleted
+     */
+    204: void;
+};
+export type DeleteNoteResponse = DeleteNoteResponses[keyof DeleteNoteResponses];
 export type GetNoteData = {
     body?: never;
+    headers?: {
+        /**
+         * The feed's own password, when it has one: to post, list or get, and (as the current password) to change or remove it. On the `POST` that creates a feed it sets the feed's password; on a `POST` to an existing feed that has none it answers 409. An empty value is the same as no header, so a `POST` with an empty one creates an open feed.
+         */
+        'X-Feed-Password'?: string;
+    };
     path: {
         /**
          * The feed's name. It is the write key: anyone who knows it can post.
@@ -172,7 +355,7 @@ export type GetNoteErrors = {
      */
     400: Error;
     /**
-     * The instance has a password and it is missing or wrong
+     * The instance has a password, or the feed has its own, and it is missing or wrong
      */
     401: Error;
     /**
@@ -192,11 +375,364 @@ export type GetNoteResponses = {
     200: Note;
 };
 export type GetNoteResponse = GetNoteResponses[keyof GetNoteResponses];
+export type EditNoteData = {
+    body: PostJson;
+    headers?: {
+        /**
+         * The feed's own password, when it has one: to post, list or get, and (as the current password) to change or remove it. On the `POST` that creates a feed it sets the feed's password; on a `POST` to an existing feed that has none it answers 409. An empty value is the same as no header, so a `POST` with an empty one creates an open feed.
+         */
+        'X-Feed-Password'?: string;
+    };
+    path: {
+        /**
+         * The feed's name. It is the write key: anyone who knows it can post.
+         */
+        feed: string;
+        /**
+         * The note's id
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/feeds/{feed}/notes/{id}';
+};
+export type EditNoteErrors = {
+    /**
+     * Invalid or reserved feed name; empty note; bad JSON, form or UTF-8
+     */
+    400: Error;
+    /**
+     * The instance has a password, or the feed has its own, and it is missing or wrong
+     */
+    401: Error;
+    /**
+     * No such note
+     */
+    404: Error;
+    /**
+     * Body over 102400 bytes
+     */
+    413: Error;
+    /**
+     * Unsupported content type
+     */
+    415: Error;
+    /**
+     * Too many posts, edits and deletes, or wrong passwords, from this client
+     */
+    429: Error;
+};
+export type EditNoteError = EditNoteErrors[keyof EditNoteErrors];
+export type EditNoteResponses = {
+    /**
+     * The note as it is now
+     */
+    200: Note;
+};
+export type EditNoteResponse = EditNoteResponses[keyof EditNoteResponses];
+export type UploadImageData = {
+    /**
+     * The image's bytes: PNG, JPEG, GIF or WebP, recognized by their first bytes, not by the Content-Type
+     */
+    body: Blob | File;
+    headers?: {
+        /**
+         * The feed's own password, when it has one: to post, list or get, and (as the current password) to change or remove it. On the `POST` that creates a feed it sets the feed's password; on a `POST` to an existing feed that has none it answers 409. An empty value is the same as no header, so a `POST` with an empty one creates an open feed.
+         */
+        'X-Feed-Password'?: string;
+    };
+    path: {
+        /**
+         * The feed's name. It is the write key: anyone who knows it can post.
+         */
+        feed: string;
+    };
+    query?: never;
+    url: '/api/v1/feeds/{feed}/images';
+};
+export type UploadImageErrors = {
+    /**
+     * Invalid or reserved feed name
+     */
+    400: Error;
+    /**
+     * The instance has a password, or the feed has its own, and it is missing or wrong
+     */
+    401: Error;
+    /**
+     * No such feed
+     */
+    404: Error;
+    /**
+     * Body over NOTEFEED_MAX_IMAGE_BYTES
+     */
+    413: Error;
+    /**
+     * Not a PNG, JPEG, GIF or WebP image
+     */
+    415: Error;
+    /**
+     * Too many posts, uploads, edits and deletes, or wrong passwords, from this client
+     */
+    429: Error;
+    /**
+     * NOTEFEED_MAX_IMAGES_PER_FEED reached
+     */
+    507: Error;
+};
+export type UploadImageError = UploadImageErrors[keyof UploadImageErrors];
+export type UploadImageResponses = {
+    /**
+     * Stored (or already there)
+     */
+    201: ImageUploaded;
+};
+export type UploadImageResponse = UploadImageResponses[keyof UploadImageResponses];
+export type DeleteFeedData = {
+    body?: never;
+    headers?: {
+        /**
+         * The feed's own password, when it has one: to post, list or get, and (as the current password) to change or remove it. On the `POST` that creates a feed it sets the feed's password; on a `POST` to an existing feed that has none it answers 409. An empty value is the same as no header, so a `POST` with an empty one creates an open feed.
+         */
+        'X-Feed-Password'?: string;
+    };
+    path: {
+        /**
+         * The feed's name. It is the write key: anyone who knows it can post.
+         */
+        feed: string;
+    };
+    query?: never;
+    url: '/api/v1/feeds/{feed}';
+};
+export type DeleteFeedErrors = {
+    /**
+     * Invalid or reserved feed name
+     */
+    400: Error;
+    /**
+     * The instance has a password, or the feed has its own, and it is missing or wrong
+     */
+    401: Error;
+    /**
+     * No such feed
+     */
+    404: Error;
+    /**
+     * Too many posts, edits and deletes, or wrong passwords, from this client
+     */
+    429: Error;
+};
+export type DeleteFeedError = DeleteFeedErrors[keyof DeleteFeedErrors];
+export type DeleteFeedResponses = {
+    /**
+     * Deleted
+     */
+    204: void;
+};
+export type DeleteFeedResponse = DeleteFeedResponses[keyof DeleteFeedResponses];
+export type GetFeedData = {
+    body?: never;
+    headers?: {
+        /**
+         * The feed's own password, when it has one: to post, list or get, and (as the current password) to change or remove it. On the `POST` that creates a feed it sets the feed's password; on a `POST` to an existing feed that has none it answers 409. An empty value is the same as no header, so a `POST` with an empty one creates an open feed.
+         */
+        'X-Feed-Password'?: string;
+    };
+    path: {
+        /**
+         * The feed's name. It is the write key: anyone who knows it can post.
+         */
+        feed: string;
+    };
+    query?: never;
+    url: '/api/v1/feeds/{feed}';
+};
+export type GetFeedErrors = {
+    /**
+     * Invalid or reserved feed name
+     */
+    400: Error;
+    /**
+     * The instance has a password, or the feed has its own, and it is missing or wrong
+     */
+    401: Error;
+    /**
+     * No such feed
+     */
+    404: Error;
+    /**
+     * Too many wrong passwords from this client
+     */
+    429: Error;
+};
+export type GetFeedError = GetFeedErrors[keyof GetFeedErrors];
+export type GetFeedResponses = {
+    /**
+     * The feed
+     */
+    200: Feed;
+};
+export type GetFeedResponse = GetFeedResponses[keyof GetFeedResponses];
+export type UpdateFeedData = {
+    body: FeedSettings;
+    headers?: {
+        /**
+         * The feed's own password, when it has one: to post, list or get, and (as the current password) to change or remove it. On the `POST` that creates a feed it sets the feed's password; on a `POST` to an existing feed that has none it answers 409. An empty value is the same as no header, so a `POST` with an empty one creates an open feed.
+         */
+        'X-Feed-Password'?: string;
+    };
+    path: {
+        /**
+         * The feed's name. It is the write key: anyone who knows it can post.
+         */
+        feed: string;
+    };
+    query?: never;
+    url: '/api/v1/feeds/{feed}';
+};
+export type UpdateFeedErrors = {
+    /**
+     * Invalid or reserved feed name, bad JSON, or a title or description that is too long or has control characters
+     */
+    400: Error;
+    /**
+     * The instance has a password, or the feed has its own, and it is missing or wrong
+     */
+    401: Error;
+    /**
+     * No such feed
+     */
+    404: Error;
+    /**
+     * Too many posts, edits and deletes, or wrong passwords, from this client
+     */
+    429: Error;
+};
+export type UpdateFeedError = UpdateFeedErrors[keyof UpdateFeedErrors];
+export type UpdateFeedResponses = {
+    /**
+     * The feed as it is now
+     */
+    200: Feed;
+};
+export type UpdateFeedResponse = UpdateFeedResponses[keyof UpdateFeedResponses];
+export type RemoveFeedPasswordData = {
+    body?: never;
+    headers?: {
+        /**
+         * The feed's current password
+         */
+        'X-Feed-Password'?: string;
+    };
+    path: {
+        /**
+         * The feed's name. It is the write key: anyone who knows it can post.
+         */
+        feed: string;
+    };
+    query?: never;
+    url: '/api/v1/feeds/{feed}/password';
+};
+export type RemoveFeedPasswordErrors = {
+    /**
+     * Invalid or reserved feed name
+     */
+    400: Error;
+    /**
+     * The instance has a password, or the feed has its own, and it is missing or wrong
+     */
+    401: Error;
+    /**
+     * The feed has no password
+     */
+    409: Error;
+    /**
+     * Too many wrong passwords from this client
+     */
+    429: Error;
+};
+export type RemoveFeedPasswordError = RemoveFeedPasswordErrors[keyof RemoveFeedPasswordErrors];
+export type RemoveFeedPasswordResponses = {
+    /**
+     * Removed
+     */
+    204: void;
+};
+export type RemoveFeedPasswordResponse = RemoveFeedPasswordResponses[keyof RemoveFeedPasswordResponses];
+export type ChangeFeedPasswordData = {
+    body: PasswordJson;
+    headers?: {
+        /**
+         * The feed's current password
+         */
+        'X-Feed-Password'?: string;
+    };
+    path: {
+        /**
+         * The feed's name. It is the write key: anyone who knows it can post.
+         */
+        feed: string;
+    };
+    query?: never;
+    url: '/api/v1/feeds/{feed}/password';
+};
+export type ChangeFeedPasswordErrors = {
+    /**
+     * Invalid or reserved feed name, bad JSON, or a new password that is not 1 to 256 printable ASCII characters, with no space at the start or end
+     */
+    400: Error;
+    /**
+     * The instance has a password, or the feed has its own, and it is missing or wrong
+     */
+    401: Error;
+    /**
+     * The feed has no password
+     */
+    409: Error;
+    /**
+     * Too many wrong passwords from this client
+     */
+    429: Error;
+};
+export type ChangeFeedPasswordError = ChangeFeedPasswordErrors[keyof ChangeFeedPasswordErrors];
+export type ChangeFeedPasswordResponses = {
+    /**
+     * Changed; the old password and unlock cookies stop working
+     */
+    204: void;
+};
+export type ChangeFeedPasswordResponse = ChangeFeedPasswordResponses[keyof ChangeFeedPasswordResponses];
+export type GetReadFeedData = {
+    body?: never;
+    path: {
+        /**
+         * The feed's read id, from its read link: 22 random characters, or the feed's own name for a reserved feed. Read-only; never reveals the name of any other feed.
+         */
+        readId: string;
+    };
+    query?: never;
+    url: '/api/v1/read/{readId}';
+};
+export type GetReadFeedErrors = {
+    /**
+     * Malformed read id
+     */
+    404: Error;
+};
+export type GetReadFeedError = GetReadFeedErrors[keyof GetReadFeedErrors];
+export type GetReadFeedResponses = {
+    /**
+     * The feed's public settings
+     */
+    200: ReadFeed;
+};
+export type GetReadFeedResponse = GetReadFeedResponses[keyof GetReadFeedResponses];
 export type ListReadNotesData = {
     body?: never;
     path: {
         /**
-         * The feed's read id, from its read link. Read-only; never reveals the name.
+         * The feed's read id, from its read link: 22 random characters, or the feed's own name for a reserved feed. Read-only; never reveals the name of any other feed.
          */
         readId: string;
     };
@@ -209,6 +745,10 @@ export type ListReadNotesData = {
          * Only notes older than this id: the previous page's `next`
          */
         before?: string;
+        /**
+         * Only notes carrying this tag
+         */
+        tag?: string;
     };
     url: '/api/v1/read/{readId}/notes';
 };
@@ -234,7 +774,7 @@ export type GetReadNoteData = {
     body?: never;
     path: {
         /**
-         * The feed's read id, from its read link. Read-only; never reveals the name.
+         * The feed's read id, from its read link: 22 random characters, or the feed's own name for a reserved feed. Read-only; never reveals the name of any other feed.
          */
         readId: string;
         /**

package/dist/index.d.ts

@@ -1,2 +1,2 @@
 export { AuthError, Client, ConfigError, InvalidRequestError, LimitReachedError, NotefeedError, NotFoundError, NoteTooLargeError, RateLimitedError, } from "./client.js";
-export type { ClientOptions, Created, ErrorCode, Note } from "./client.js";
+export type { ClientOptions, Created, ErrorCode, Feed, FeedSettings, ImageUploaded, Note } from "./client.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "notefeed",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Client and CLI for notefeed, a self-hosted inbox for markdown notes that you read back as RSS.",
   "license": "Apache-2.0",
   "author": "Marcel Bruckner",