@greensecurity/javascript-sdk 0.46.0-beta.7 → 0.46.0-beta.9

package/src/models/components/expand.ts

@@ -26,6 +26,7 @@ export const Expand = {
   FacilityAppointmentPolicy: "facility.appointment_policy",
   FacilityContacts: "facility.contacts",
   FacilityVendorCounts: "facility.vendor_counts",
+  FacilityDeviceCounts: "facility.device_counts",
   FacilityFluCredential: "facility.flu_credential",
   FacilityScrubsPolicy: "facility.scrubs_policy",
   FacilitySystem: "facility.system",
@@ -126,6 +127,7 @@ export const Expand = {
   ZoneFacility: "zone.facility",
   ZoneDepartment: "zone.department",
   ZoneRules: "zone.rules",
+  ZoneDeviceCounts: "zone.device_counts",
   SystemFacilities: "system.facilities",
   SystemLocation: "system.location",
   SystemAggregate: "system.aggregate",

package/src/models/components/facility.ts

@@ -17,6 +17,12 @@ import {
   Contact$Outbound,
   Contact$outboundSchema,
 } from "./contact.js";
+import {
+  DeviceCounts,
+  DeviceCounts$inboundSchema,
+  DeviceCounts$Outbound,
+  DeviceCounts$outboundSchema,
+} from "./devicecounts.js";
 import {
   FacilityVendorType,
   FacilityVendorType$inboundSchema,
@@ -404,6 +410,10 @@ export type Facility = {
    * Counts of vendors associated with the facility, grouped by relationship, subscription status, and approval status. Present only when `facility.vendor_counts` is in `expand`.
    */
   vendorCounts?: VendorCounts | null | undefined;
+  /**
+   * Gateway and iPad kiosk totals across the facility's zones. Present only when `facility.device_counts` is in `expand` and the caller holds `zone_devices.view`, otherwise `null`.
+   */
+  deviceCounts?: DeviceCounts | null | undefined;
   /**
    * The email domain associated with the facility, or `null` if none is set.
    */
@@ -1292,6 +1302,7 @@ export const Facility$inboundSchema: z.ZodType<
   contacts: z.nullable(z.lazy(() => Contacts$inboundSchema)).optional(),
   vendor_counts: z.nullable(z.lazy(() => VendorCounts$inboundSchema))
     .optional(),
+  device_counts: z.nullable(DeviceCounts$inboundSchema).optional(),
   email_domain: z.nullable(types.string()).optional(),
   facility_type: z.nullable(types.string()).optional(),
   flu_credential: types.optional(z.lazy(() => FluCredential$inboundSchema)),
@@ -1319,6 +1330,7 @@ export const Facility$inboundSchema: z.ZodType<
   return remap$(v, {
     "appointment_policy": "appointmentPolicy",
     "vendor_counts": "vendorCounts",
+    "device_counts": "deviceCounts",
     "email_domain": "emailDomain",
     "facility_type": "facilityType",
     "flu_credential": "fluCredential",
@@ -1335,6 +1347,7 @@ export type Facility$Outbound = {
   appointment_policy?: AppointmentPolicy$Outbound | null | undefined;
   contacts?: Contacts$Outbound | null | undefined;
   vendor_counts?: VendorCounts$Outbound | null | undefined;
+  device_counts?: DeviceCounts$Outbound | null | undefined;
   email_domain?: string | null | undefined;
   facility_type?: string | null | undefined;
   flu_credential?: FluCredential$Outbound | undefined;
@@ -1364,6 +1377,7 @@ export const Facility$outboundSchema: z.ZodType<
   contacts: z.nullable(z.lazy(() => Contacts$outboundSchema)).optional(),
   vendorCounts: z.nullable(z.lazy(() => VendorCounts$outboundSchema))
     .optional(),
+  deviceCounts: z.nullable(DeviceCounts$outboundSchema).optional(),
   emailDomain: z.nullable(z.string()).optional(),
   facilityType: z.nullable(z.string()).optional(),
   fluCredential: z.lazy(() => FluCredential$outboundSchema).optional(),
@@ -1390,6 +1404,7 @@ export const Facility$outboundSchema: z.ZodType<
   return remap$(v, {
     appointmentPolicy: "appointment_policy",
     vendorCounts: "vendor_counts",
+    deviceCounts: "device_counts",
     emailDomain: "email_domain",
     facilityType: "facility_type",
     fluCredential: "flu_credential",

package/src/models/components/index.ts

@@ -4,7 +4,38 @@
 
 export * from "./activestatus.js";
 export * from "./alert.js";
+export * from "./appbundle.js";
+export * from "./appconstantvalue.js";
+export * from "./appcsp.js";
+export * from "./appdevcsp.js";
+export * from "./appdeveloper.js";
+export * from "./appdeveloperadd.js";
+export * from "./appdeveloperaddbyemail.js";
+export * from "./appdeveloperaddbyuserid.js";
+export * from "./appdeveloperrole.js";
+export * from "./appdevmanifest.js";
+export * from "./appdevuiextensions.js";
+export * from "./appmanifest.js";
+export * from "./appmanifestid.js";
+export * from "./appmanifestpermission.js";
 export * from "./appointmentsummary.js";
+export * from "./apppostinstallaction.js";
+export * from "./appreviewreason.js";
+export * from "./approute.js";
+export * from "./appsecret.js";
+export * from "./appsecretdeleted.js";
+export * from "./appsecretdeleterequest.js";
+export * from "./appsecretinstallationscope.js";
+export * from "./appsecretscope.js";
+export * from "./appsecretsetrequest.js";
+export * from "./appsecretuserscope.js";
+export * from "./apptokenkind.js";
+export * from "./appuiextensions.js";
+export * from "./appversioninstalls.js";
+export * from "./appview.js";
+export * from "./appviewport.js";
+export * from "./appwebhookendpointsecret.js";
+export * from "./appwebhooks.js";
 export * from "./authenticatesuccessresponse.js";
 export * from "./backgroundcheckresult.js";
 export * from "./company.js";
@@ -30,9 +61,16 @@ export * from "./department.js";
 export * from "./departmentmembership.js";
 export * from "./departmentsummary.js";
 export * from "./desc.js";
+export * from "./deviceauthorizationrequest.js";
+export * from "./deviceauthorizationresponse.js";
+export * from "./devicecountpair.js";
+export * from "./devicecounts.js";
+export * from "./devsession.js";
+export * from "./devsessioncreate.js";
 export * from "./distributor.js";
 export * from "./distributorcreate.js";
 export * from "./distributorupdate.js";
+export * from "./ecpublicjwk.js";
 export * from "./emailpreferences.js";
 export * from "./event.js";
 export * from "./expand.js";
@@ -59,6 +97,9 @@ export * from "./loginrequirementsfromemail.js";
 export * from "./manufacturer.js";
 export * from "./manufacturercreate.js";
 export * from "./manufacturerupdate.js";
+export * from "./marketplaceappactivation.js";
+export * from "./marketplaceappactivationcoverage.js";
+export * from "./marketplaceappactivationevent.js";
 export * from "./medicalproduct.js";
 export * from "./medicalproductcategory.js";
 export * from "./medicalproductcategorycreate.js";
@@ -75,6 +116,14 @@ export * from "./medicalproductspec.js";
 export * from "./medicalproductspecinput.js";
 export * from "./medicalproductupdate.js";
 export * from "./mfarequiredresponse.js";
+export * from "./oauthclientcredentialsgrant.js";
+export * from "./oauthclirefreshtokengrant.js";
+export * from "./oauthdevicecodegrant.js";
+export * from "./oautherrorcode.js";
+export * from "./oauthrefreshtokengrant.js";
+export * from "./oauthtokenexchangegrant.js";
+export * from "./oauthtokenrequest.js";
+export * from "./oauthtokentypehint.js";
 export * from "./pager.js";
 export * from "./passwordnotsetresponse.js";
 export * from "./passwordrequiredresponse.js";
@@ -97,6 +146,10 @@ export * from "./supportarticle.js";
 export * from "./system.js";
 export * from "./systemsummary.js";
 export * from "./targetfacilitystatuschange.js";
+export * from "./tokenintrospection.js";
+export * from "./tokenintrospectionrequest.js";
+export * from "./tokenresponse.js";
+export * from "./tokenrevocationrequest.js";
 export * from "./uploadhistoryitem.js";
 export * from "./user.js";
 export * from "./userdetails.js";

package/src/models/components/marketplaceappactivation.ts

@@ -0,0 +1,71 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import { safeParse } from "../../lib/schemas.js";
+import { Result as SafeParseResult } from "../../types/fp.js";
+import * as types from "../../types/primitives.js";
+import { SDKValidationError } from "../errors/sdkvalidationerror.js";
+import {
+  MarketplaceAppActivationCoverage,
+  MarketplaceAppActivationCoverage$inboundSchema,
+} from "./marketplaceappactivationcoverage.js";
+
+/**
+ * One installation of your app. Its `id` is the `activation_id` your backend passes to
+ *
+ * @remarks
+ * `POST /oauth/token` with `grant_type=client_credentials` to get an installation token
+ * narrowed to it.
+ */
+export type MarketplaceAppActivation = {
+  /**
+   * The activation id.
+   */
+  id: number;
+  /**
+   * The app that was installed.
+   */
+  marketplaceAppId: number;
+  /**
+   * What one activation of your app covers: the site, health system, facility, company or
+   *
+   * @remarks
+   * user it was installed for. An install is made at one of these, so one id is set and the
+   * others are null. A site install covers everything in the site, and a health system
+   * install covers its facilities.
+   */
+  coverage: MarketplaceAppActivationCoverage;
+  /**
+   * When the app was installed. Null for installations made before this was recorded.
+   */
+  created: Date | null;
+};
+
+/** @internal */
+export const MarketplaceAppActivation$inboundSchema: z.ZodType<
+  MarketplaceAppActivation,
+  z.ZodTypeDef,
+  unknown
+> = z.object({
+  id: types.number(),
+  marketplace_app_id: types.number(),
+  coverage: MarketplaceAppActivationCoverage$inboundSchema,
+  created: types.nullable(types.date()),
+}).transform((v) => {
+  return remap$(v, {
+    "marketplace_app_id": "marketplaceAppId",
+  });
+});
+
+export function marketplaceAppActivationFromJSON(
+  jsonString: string,
+): SafeParseResult<MarketplaceAppActivation, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => MarketplaceAppActivation$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'MarketplaceAppActivation' from JSON`,
+  );
+}

package/src/models/components/marketplaceappactivationcoverage.ts

@@ -0,0 +1,110 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import { safeParse } from "../../lib/schemas.js";
+import { Result as SafeParseResult } from "../../types/fp.js";
+import * as types from "../../types/primitives.js";
+import { SDKValidationError } from "../errors/sdkvalidationerror.js";
+
+/**
+ * What one activation of your app covers: the site, health system, facility, company or
+ *
+ * @remarks
+ * user it was installed for. An install is made at one of these, so one id is set and the
+ * others are null. A site install covers everything in the site, and a health system
+ * install covers its facilities.
+ */
+export type MarketplaceAppActivationCoverage = {
+  /**
+   * Set for an install at site level.
+   */
+  siteId: number | null;
+  /**
+   * Set for an install for a health system.
+   */
+  systemId: number | null;
+  /**
+   * Set for an install for a facility.
+   */
+  facilityId: number | null;
+  /**
+   * Set for an install for a vendor company.
+   */
+  companyId: number | null;
+  /**
+   * Set for an install for one user.
+   */
+  userId: number | null;
+};
+
+/** @internal */
+export const MarketplaceAppActivationCoverage$inboundSchema: z.ZodType<
+  MarketplaceAppActivationCoverage,
+  z.ZodTypeDef,
+  unknown
+> = z.object({
+  site_id: types.nullable(types.number()),
+  system_id: types.nullable(types.number()),
+  facility_id: types.nullable(types.number()),
+  company_id: types.nullable(types.number()),
+  user_id: types.nullable(types.number()),
+}).transform((v) => {
+  return remap$(v, {
+    "site_id": "siteId",
+    "system_id": "systemId",
+    "facility_id": "facilityId",
+    "company_id": "companyId",
+    "user_id": "userId",
+  });
+});
+/** @internal */
+export type MarketplaceAppActivationCoverage$Outbound = {
+  site_id: number | null;
+  system_id: number | null;
+  facility_id: number | null;
+  company_id: number | null;
+  user_id: number | null;
+};
+
+/** @internal */
+export const MarketplaceAppActivationCoverage$outboundSchema: z.ZodType<
+  MarketplaceAppActivationCoverage$Outbound,
+  z.ZodTypeDef,
+  MarketplaceAppActivationCoverage
+> = z.object({
+  siteId: z.nullable(z.number().int()),
+  systemId: z.nullable(z.number().int()),
+  facilityId: z.nullable(z.number().int()),
+  companyId: z.nullable(z.number().int()),
+  userId: z.nullable(z.number().int()),
+}).transform((v) => {
+  return remap$(v, {
+    siteId: "site_id",
+    systemId: "system_id",
+    facilityId: "facility_id",
+    companyId: "company_id",
+    userId: "user_id",
+  });
+});
+
+export function marketplaceAppActivationCoverageToJSON(
+  marketplaceAppActivationCoverage: MarketplaceAppActivationCoverage,
+): string {
+  return JSON.stringify(
+    MarketplaceAppActivationCoverage$outboundSchema.parse(
+      marketplaceAppActivationCoverage,
+    ),
+  );
+}
+export function marketplaceAppActivationCoverageFromJSON(
+  jsonString: string,
+): SafeParseResult<MarketplaceAppActivationCoverage, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => MarketplaceAppActivationCoverage$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'MarketplaceAppActivationCoverage' from JSON`,
+  );
+}

package/src/models/components/marketplaceappactivationevent.ts

@@ -0,0 +1,136 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import { safeParse } from "../../lib/schemas.js";
+import { ClosedEnum } from "../../types/enums.js";
+import { Result as SafeParseResult } from "../../types/fp.js";
+import * as types from "../../types/primitives.js";
+import { SDKValidationError } from "../errors/sdkvalidationerror.js";
+import {
+  MarketplaceAppActivationCoverage,
+  MarketplaceAppActivationCoverage$inboundSchema,
+  MarketplaceAppActivationCoverage$Outbound,
+  MarketplaceAppActivationCoverage$outboundSchema,
+} from "./marketplaceappactivationcoverage.js";
+
+/**
+ * What happened, the same action `Green-Security-Event` names.
+ */
+export const MarketplaceAppActivationEventAction = {
+  Created: "created",
+  Updated: "updated",
+  Destroyed: "destroyed",
+} as const;
+/**
+ * What happened, the same action `Green-Security-Event` names.
+ */
+export type MarketplaceAppActivationEventAction = ClosedEnum<
+  typeof MarketplaceAppActivationEventAction
+>;
+
+/**
+ * The body of a `MarketplaceAppActivation.*` delivery: the activation, as
+ *
+ * @remarks
+ * `GET /marketplace/activations` lists it, plus what happened to it.
+ */
+export type MarketplaceAppActivationEvent = {
+  /**
+   * The activation id.
+   */
+  id: number;
+  /**
+   * The app that was installed.
+   */
+  marketplaceAppId: number;
+  /**
+   * What one activation of your app covers: the site, health system, facility, company or
+   *
+   * @remarks
+   * user it was installed for. An install is made at one of these, so one id is set and the
+   * others are null. A site install covers everything in the site, and a health system
+   * install covers its facilities.
+   */
+  coverage: MarketplaceAppActivationCoverage;
+  /**
+   * When the app was installed. Null for installations made before this was recorded.
+   */
+  created: Date | null;
+  /**
+   * What happened, the same action `Green-Security-Event` names.
+   */
+  action: MarketplaceAppActivationEventAction;
+};
+
+/** @internal */
+export const MarketplaceAppActivationEventAction$inboundSchema: z.ZodNativeEnum<
+  typeof MarketplaceAppActivationEventAction
+> = z.nativeEnum(MarketplaceAppActivationEventAction);
+/** @internal */
+export const MarketplaceAppActivationEventAction$outboundSchema:
+  z.ZodNativeEnum<typeof MarketplaceAppActivationEventAction> =
+    MarketplaceAppActivationEventAction$inboundSchema;
+
+/** @internal */
+export const MarketplaceAppActivationEvent$inboundSchema: z.ZodType<
+  MarketplaceAppActivationEvent,
+  z.ZodTypeDef,
+  unknown
+> = z.object({
+  id: types.number(),
+  marketplace_app_id: types.number(),
+  coverage: MarketplaceAppActivationCoverage$inboundSchema,
+  created: types.nullable(types.date()),
+  action: MarketplaceAppActivationEventAction$inboundSchema,
+}).transform((v) => {
+  return remap$(v, {
+    "marketplace_app_id": "marketplaceAppId",
+  });
+});
+/** @internal */
+export type MarketplaceAppActivationEvent$Outbound = {
+  id: number;
+  marketplace_app_id: number;
+  coverage: MarketplaceAppActivationCoverage$Outbound;
+  created: string | null;
+  action: string;
+};
+
+/** @internal */
+export const MarketplaceAppActivationEvent$outboundSchema: z.ZodType<
+  MarketplaceAppActivationEvent$Outbound,
+  z.ZodTypeDef,
+  MarketplaceAppActivationEvent
+> = z.object({
+  id: z.number().int(),
+  marketplaceAppId: z.number().int(),
+  coverage: MarketplaceAppActivationCoverage$outboundSchema,
+  created: z.nullable(z.date().transform(v => v.toISOString())),
+  action: MarketplaceAppActivationEventAction$outboundSchema,
+}).transform((v) => {
+  return remap$(v, {
+    marketplaceAppId: "marketplace_app_id",
+  });
+});
+
+export function marketplaceAppActivationEventToJSON(
+  marketplaceAppActivationEvent: MarketplaceAppActivationEvent,
+): string {
+  return JSON.stringify(
+    MarketplaceAppActivationEvent$outboundSchema.parse(
+      marketplaceAppActivationEvent,
+    ),
+  );
+}
+export function marketplaceAppActivationEventFromJSON(
+  jsonString: string,
+): SafeParseResult<MarketplaceAppActivationEvent, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => MarketplaceAppActivationEvent$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'MarketplaceAppActivationEvent' from JSON`,
+  );
+}

package/src/models/components/oauthclientcredentialsgrant.ts

@@ -0,0 +1,107 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+
+/**
+ * A token for an API service account's own backend. Authenticate with either:
+ *
+ * @remarks
+ *
+ * - `client_id` (the service account's email) and `client_secret` (its permanent token)
+ *   in the body, always together; or
+ * - neither of them, and the service account's permanent token in the
+ *   `Authorization: Bearer` header. This is the only grant that reads `Authorization`,
+ *   and it accepts nothing but the permanent token there: a short-lived or narrowed
+ *   token, including one this grant issued, is `401` `invalid_client`.
+ *
+ * A locked service account is `401` `invalid_client` either way.
+ *
+ * What it issues depends on `activation_id`:
+ *
+ * - **Without `activation_id`**: a plain 15-minute API access token for the service
+ *   account, with no refresh token. The response has no `issued_token_type` and no
+ *   `activation_id`, and has `scope` only when the request sent one.
+ * - **With `activation_id`**: an app installation token (`gsi_`) narrowed to that
+ *   activation. The service account must be a marketplace app's, and the activation one
+ *   of that app's. This is how any app's backend acts on one installation, and the only
+ *   way a back-end-only app (a manifest with no `ui_extensions`) gets a token for one,
+ *   since the host never hands it user or installation tokens.
+ */
+export type OAuthClientCredentialsGrant = {
+  grantType: "client_credentials";
+  /**
+   * The service account's email. Send it with `client_secret`, or send neither and use `Authorization`.
+   */
+  clientId?: string | undefined;
+  /**
+   * The service account's permanent token. Send it with `client_id`, or send neither and use `Authorization`.
+   */
+  clientSecret?: string | undefined;
+  /**
+   * Optional. Asks for an app installation token narrowed to this activation of your app
+   *
+   * @remarks
+   * (`invalid_target` if it is not one). Leave it out for a plain API access token.
+   */
+  activationId?: number | undefined;
+  /**
+   * Optional, and only with `activation_id` (`invalid_request` without it). When given, it
+   *
+   * @remarks
+   * must name the activation's app as `app:<id>` (`invalid_target` otherwise).
+   */
+  audience?: string | undefined;
+  /**
+   * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+   *
+   * @remarks
+   * the device grant) to narrow the token to. Leave it out to get everything the client is
+   * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+   * is left the request fails with `invalid_scope`.
+   */
+  scope?: string | undefined;
+};
+
+/** @internal */
+export type OAuthClientCredentialsGrant$Outbound = {
+  grant_type: "client_credentials";
+  client_id?: string | undefined;
+  client_secret?: string | undefined;
+  activation_id?: number | undefined;
+  audience?: string | undefined;
+  scope?: string | undefined;
+};
+
+/** @internal */
+export const OAuthClientCredentialsGrant$outboundSchema: z.ZodType<
+  OAuthClientCredentialsGrant$Outbound,
+  z.ZodTypeDef,
+  OAuthClientCredentialsGrant
+> = z.object({
+  grantType: z.literal("client_credentials"),
+  clientId: z.string().optional(),
+  clientSecret: z.string().optional(),
+  activationId: z.number().int().optional(),
+  audience: z.string().optional(),
+  scope: z.string().optional(),
+}).transform((v) => {
+  return remap$(v, {
+    grantType: "grant_type",
+    clientId: "client_id",
+    clientSecret: "client_secret",
+    activationId: "activation_id",
+  });
+});
+
+export function oAuthClientCredentialsGrantToJSON(
+  oAuthClientCredentialsGrant: OAuthClientCredentialsGrant,
+): string {
+  return JSON.stringify(
+    OAuthClientCredentialsGrant$outboundSchema.parse(
+      oAuthClientCredentialsGrant,
+    ),
+  );
+}

package/src/models/components/oauthclirefreshtokengrant.ts

@@ -0,0 +1,86 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+
+/**
+ * The apps CLI's refresh, as the public client `greensecurity-apps-cli`: no
+ *
+ * @remarks
+ * `client_secret`, and `Authorization` is not read. The `gsdr_` refresh token is the
+ * credential. The response is a new `gsd_` developer token and a new `gsdr_` refresh
+ * token, in the device grant's shape.
+ *
+ * - **Rotation.** A refresh token works once. Refreshing spends it and revokes the
+ *   login's live developer token, so keep only the newest pair. `scope` can only narrow.
+ * - **Reuse detection.** Presenting a spent refresh token revokes every token of that
+ *   login (every token descended from one device authorization) and answers
+ *   `invalid_grant`. So does presenting a revoked one, or losing a race to spend one.
+ * - **Grace window.** One exception: a spent refresh token presented again within 30
+ *   seconds of being spent, while its direct replacement has been neither used nor
+ *   revoked, is taken as a retry after a lost response. It answers `200` with a fresh
+ *   pair, and the unused replacement pair is revoked.
+ * - **Lifetimes.** A refresh token expires after 30 days unused. A login ends 90 days
+ *   after its device authorization however often it is refreshed; tokens are issued
+ *   capped at that end, and a refresh past it is `invalid_grant`.
+ * - **Rate limit.** 60 refreshes per address per ten minutes, then `429` `slow_down`.
+ *
+ * Every `invalid_grant` here reads "Re-authenticate with `gs-apps login`.": start a new
+ * device login.
+ */
+export type OAuthCliRefreshTokenGrant = {
+  grantType: "refresh_token";
+  /**
+   * The `gsdr_` refresh token to spend.
+   */
+  refreshToken: string;
+  /**
+   * The apps CLI's public client id. Any other `client_id` with a `gsdr_` token is `401` `invalid_client`.
+   */
+  clientId: "greensecurity-apps-cli";
+  /**
+   * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+   *
+   * @remarks
+   * the device grant) to narrow the token to. Leave it out to get everything the client is
+   * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+   * is left the request fails with `invalid_scope`.
+   */
+  scope?: string | undefined;
+};
+
+/** @internal */
+export type OAuthCliRefreshTokenGrant$Outbound = {
+  grant_type: "refresh_token";
+  refresh_token: string;
+  client_id: "greensecurity-apps-cli";
+  scope?: string | undefined;
+};
+
+/** @internal */
+export const OAuthCliRefreshTokenGrant$outboundSchema: z.ZodType<
+  OAuthCliRefreshTokenGrant$Outbound,
+  z.ZodTypeDef,
+  OAuthCliRefreshTokenGrant
+> = z.object({
+  grantType: z.literal("refresh_token"),
+  refreshToken: z.string(),
+  clientId: z.literal("greensecurity-apps-cli"),
+  scope: z.string().optional(),
+}).transform((v) => {
+  return remap$(v, {
+    grantType: "grant_type",
+    refreshToken: "refresh_token",
+    clientId: "client_id",
+  });
+});
+
+export function oAuthCliRefreshTokenGrantToJSON(
+  oAuthCliRefreshTokenGrant: OAuthCliRefreshTokenGrant,
+): string {
+  return JSON.stringify(
+    OAuthCliRefreshTokenGrant$outboundSchema.parse(oAuthCliRefreshTokenGrant),
+  );
+}