@greensecurity/javascript-sdk 0.46.0-beta.7 → 0.46.0-beta.9

package/src/models/components/oauthdevicecodegrant.ts

@@ -0,0 +1,73 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+
+/**
+ * RFC 8628 device authorization, used by `apps-cli login`. Poll with the `device_code`
+ *
+ * @remarks
+ * from `POST /oauth/device_authorization` at the returned `interval` until the user
+ * approves; the result is a 15-minute developer CLI token (`gsd_`) and a `gsdr_` refresh
+ * token that renews it (see `OAuthCliRefreshTokenGrant`). The device authorization starts
+ * the login's 90-day limit. Until then each poll is answered with a
+ * `400` `OAuthError` whose `error` is `authorization_pending` (keep polling), `slow_down`
+ * (add 5 seconds to the interval), `access_denied` (the user declined; stop) or
+ * `expired_token` (start again). `Authorization` is not read.
+ */
+export type OAuthDeviceCodeGrant = {
+  grantType: "urn:ietf:params:oauth:grant-type:device_code";
+  /**
+   * The `device_code` returned by `POST /oauth/device_authorization`.
+   */
+  deviceCode: string;
+  /**
+   * The client that started the flow. `greensecurity-apps-cli` is the only registered client.
+   */
+  clientId: string;
+  /**
+   * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+   *
+   * @remarks
+   * the device grant) to narrow the token to. Leave it out to get everything the client is
+   * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+   * is left the request fails with `invalid_scope`.
+   */
+  scope?: string | undefined;
+};
+
+/** @internal */
+export type OAuthDeviceCodeGrant$Outbound = {
+  grant_type: "urn:ietf:params:oauth:grant-type:device_code";
+  device_code: string;
+  client_id: string;
+  scope?: string | undefined;
+};
+
+/** @internal */
+export const OAuthDeviceCodeGrant$outboundSchema: z.ZodType<
+  OAuthDeviceCodeGrant$Outbound,
+  z.ZodTypeDef,
+  OAuthDeviceCodeGrant
+> = z.object({
+  grantType: z.literal("urn:ietf:params:oauth:grant-type:device_code"),
+  deviceCode: z.string(),
+  clientId: z.string(),
+  scope: z.string().optional(),
+}).transform((v) => {
+  return remap$(v, {
+    grantType: "grant_type",
+    deviceCode: "device_code",
+    clientId: "client_id",
+  });
+});
+
+export function oAuthDeviceCodeGrantToJSON(
+  oAuthDeviceCodeGrant: OAuthDeviceCodeGrant,
+): string {
+  return JSON.stringify(
+    OAuthDeviceCodeGrant$outboundSchema.parse(oAuthDeviceCodeGrant),
+  );
+}

package/src/models/components/oautherrorcode.ts

@@ -0,0 +1,67 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import * as openEnums from "../../types/enums.js";
+import { OpenEnum } from "../../types/enums.js";
+
+/**
+ * The RFC error code:
+ *
+ * @remarks
+ *
+ * | Code | Meaning |
+ * | --- | --- |
+ * | `invalid_request` | A parameter is missing or malformed (including `client_id` without `client_secret` or the reverse), an OAuth parameter was sent in the query string rather than the body, the body could not be parsed, or more than one activation covers the user and `activation_id` was left out. |
+ * | `invalid_client` | The client could not be authenticated. Returned with `401`. On the apps CLI's `refresh_token` (a `gsdr_` token): a `client_id` other than `greensecurity-apps-cli`. On `client_credentials`: wrong `client_id` or `client_secret`; an `Authorization` token that is missing, invalid, or not the service account's permanent token (a short-lived, narrowed or app token is refused); or a locked service account. On `refresh_token`: `client_id` or `client_secret` does not match the refresh token's service account, or that account is locked. On the device grant and `POST /oauth/device_authorization`: an unknown `client_id`. On `POST /oauth/introspect` and `POST /oauth/revoke`: see each endpoint. |
+ * | `invalid_grant` | `subject_token` is invalid or expired, is an app token or a narrowed (scoped) token, or belongs to a locked user or a service account; `refresh_token` is unknown, expired, already used or not a service account's; an apps CLI refresh token is unknown, expired, revoked or reused, its login is past 90 days, or its developer is locked or deleted (all answered "Re-authenticate with `gs-apps login`."); or `device_code` is unknown or already used, or the user who approved it can no longer sign in. |
+ * | `unauthorized_client` | The caller may not use this grant: `client_credentials` from a user who is not an API service account. |
+ * | `unsupported_grant_type` | `grant_type` is not one of the four supported grants. |
+ * | `invalid_target` | `audience` names no app, or an app the user is not covered by; or `activation_id` is not an activation of the caller's app, or does not match `audience`. |
+ * | `invalid_scope` | None of the requested scopes is available to the client: what it asked for and what it is allowed have nothing in common. On `POST /oauth/device_authorization`, any scope other than `apps:develop`. |
+ * | `authorization_pending` | Device flow: the user has not approved the request yet. Keep polling. |
+ * | `slow_down` | Device flow: polling too fast. Add 5 seconds to the interval and keep polling. `POST /oauth/device_authorization` also returns it, with `429`, when one address starts too many logins, and so does the apps CLI's `refresh_token` past 60 refreshes per address in ten minutes. Wait and retry; it is not a failed login. |
+ * | `access_denied` | Device flow: the user declined the request. Stop polling. |
+ * | `expired_token` | Device flow: `device_code` expired. Start again from `POST /oauth/device_authorization`. |
+ */
+export const OAuthErrorCode = {
+  InvalidRequest: "invalid_request",
+  InvalidClient: "invalid_client",
+  InvalidGrant: "invalid_grant",
+  UnauthorizedClient: "unauthorized_client",
+  UnsupportedGrantType: "unsupported_grant_type",
+  InvalidTarget: "invalid_target",
+  InvalidScope: "invalid_scope",
+  AuthorizationPending: "authorization_pending",
+  SlowDown: "slow_down",
+  AccessDenied: "access_denied",
+  ExpiredToken: "expired_token",
+} as const;
+/**
+ * The RFC error code:
+ *
+ * @remarks
+ *
+ * | Code | Meaning |
+ * | --- | --- |
+ * | `invalid_request` | A parameter is missing or malformed (including `client_id` without `client_secret` or the reverse), an OAuth parameter was sent in the query string rather than the body, the body could not be parsed, or more than one activation covers the user and `activation_id` was left out. |
+ * | `invalid_client` | The client could not be authenticated. Returned with `401`. On the apps CLI's `refresh_token` (a `gsdr_` token): a `client_id` other than `greensecurity-apps-cli`. On `client_credentials`: wrong `client_id` or `client_secret`; an `Authorization` token that is missing, invalid, or not the service account's permanent token (a short-lived, narrowed or app token is refused); or a locked service account. On `refresh_token`: `client_id` or `client_secret` does not match the refresh token's service account, or that account is locked. On the device grant and `POST /oauth/device_authorization`: an unknown `client_id`. On `POST /oauth/introspect` and `POST /oauth/revoke`: see each endpoint. |
+ * | `invalid_grant` | `subject_token` is invalid or expired, is an app token or a narrowed (scoped) token, or belongs to a locked user or a service account; `refresh_token` is unknown, expired, already used or not a service account's; an apps CLI refresh token is unknown, expired, revoked or reused, its login is past 90 days, or its developer is locked or deleted (all answered "Re-authenticate with `gs-apps login`."); or `device_code` is unknown or already used, or the user who approved it can no longer sign in. |
+ * | `unauthorized_client` | The caller may not use this grant: `client_credentials` from a user who is not an API service account. |
+ * | `unsupported_grant_type` | `grant_type` is not one of the four supported grants. |
+ * | `invalid_target` | `audience` names no app, or an app the user is not covered by; or `activation_id` is not an activation of the caller's app, or does not match `audience`. |
+ * | `invalid_scope` | None of the requested scopes is available to the client: what it asked for and what it is allowed have nothing in common. On `POST /oauth/device_authorization`, any scope other than `apps:develop`. |
+ * | `authorization_pending` | Device flow: the user has not approved the request yet. Keep polling. |
+ * | `slow_down` | Device flow: polling too fast. Add 5 seconds to the interval and keep polling. `POST /oauth/device_authorization` also returns it, with `429`, when one address starts too many logins, and so does the apps CLI's `refresh_token` past 60 refreshes per address in ten minutes. Wait and retry; it is not a failed login. |
+ * | `access_denied` | Device flow: the user declined the request. Stop polling. |
+ * | `expired_token` | Device flow: `device_code` expired. Start again from `POST /oauth/device_authorization`. |
+ */
+export type OAuthErrorCode = OpenEnum<typeof OAuthErrorCode>;
+
+/** @internal */
+export const OAuthErrorCode$inboundSchema: z.ZodType<
+  OAuthErrorCode,
+  z.ZodTypeDef,
+  unknown
+> = openEnums.inboundSchema(OAuthErrorCode);

package/src/models/components/oauthrefreshtokengrant.ts

@@ -0,0 +1,79 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+
+/**
+ * A confidential client's refresh: trades an API service account's refresh token for a
+ *
+ * @remarks
+ * new plain API access token and a new refresh token. (The apps CLI's public-client
+ * refresh is `OAuthCliRefreshTokenGrant`.) Refresh tokens rotate: each works once, and the one presented stops
+ * working as soon as it is spent. The new token is never wider than the one it replaces:
+ * `scope` can only narrow what the refresh token carried. The client authenticates with
+ * `client_id` and `client_secret` in the body; `Authorization` is not read. A locked
+ * service account is `401` `invalid_client`.
+ */
+export type OAuthRefreshTokenGrant = {
+  grantType: "refresh_token";
+  /**
+   * The refresh token to spend.
+   */
+  refreshToken: string;
+  /**
+   * The email of the service account the refresh token belongs to.
+   */
+  clientId: string;
+  /**
+   * The service account's permanent token.
+   */
+  clientSecret: string;
+  /**
+   * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+   *
+   * @remarks
+   * the device grant) to narrow the token to. Leave it out to get everything the client is
+   * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+   * is left the request fails with `invalid_scope`.
+   */
+  scope?: string | undefined;
+};
+
+/** @internal */
+export type OAuthRefreshTokenGrant$Outbound = {
+  grant_type: "refresh_token";
+  refresh_token: string;
+  client_id: string;
+  client_secret: string;
+  scope?: string | undefined;
+};
+
+/** @internal */
+export const OAuthRefreshTokenGrant$outboundSchema: z.ZodType<
+  OAuthRefreshTokenGrant$Outbound,
+  z.ZodTypeDef,
+  OAuthRefreshTokenGrant
+> = z.object({
+  grantType: z.literal("refresh_token"),
+  refreshToken: z.string(),
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scope: z.string().optional(),
+}).transform((v) => {
+  return remap$(v, {
+    grantType: "grant_type",
+    refreshToken: "refresh_token",
+    clientId: "client_id",
+    clientSecret: "client_secret",
+  });
+});
+
+export function oAuthRefreshTokenGrantToJSON(
+  oAuthRefreshTokenGrant: OAuthRefreshTokenGrant,
+): string {
+  return JSON.stringify(
+    OAuthRefreshTokenGrant$outboundSchema.parse(oAuthRefreshTokenGrant),
+  );
+}

package/src/models/components/oauthtokenexchangegrant.ts

@@ -0,0 +1,146 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import { ClosedEnum } from "../../types/enums.js";
+
+/**
+ * The type of `subject_token`. Only an access token is accepted, which is also the default.
+ */
+export const SubjectTokenType = {
+  UrnIetfParamsOauthTokenTypeAccessToken:
+    "urn:ietf:params:oauth:token-type:access_token",
+} as const;
+/**
+ * The type of `subject_token`. Only an access token is accepted, which is also the default.
+ */
+export type SubjectTokenType = ClosedEnum<typeof SubjectTokenType>;
+
+/**
+ * `app_user` issues a token that acts as the user, limited to the manifest
+ *
+ * @remarks
+ * permissions their own role also grants. `app_installation` issues a token that acts
+ * as the app's service account, narrowed to the tenant of one activation.
+ */
+export const RequestedTokenType = {
+  UrnGreensecurityTokenTypeAppUser: "urn:greensecurity:token-type:app_user",
+  UrnGreensecurityTokenTypeAppInstallation:
+    "urn:greensecurity:token-type:app_installation",
+} as const;
+/**
+ * `app_user` issues a token that acts as the user, limited to the manifest
+ *
+ * @remarks
+ * permissions their own role also grants. `app_installation` issues a token that acts
+ * as the app's service account, narrowed to the tenant of one activation.
+ */
+export type RequestedTokenType = ClosedEnum<typeof RequestedTokenType>;
+
+/**
+ * RFC 8693 token exchange. The host app trades the signed-in user's session token for a
+ *
+ * @remarks
+ * short-lived token bound to one app and one activation. App tokens can never be used as
+ * `subject_token`. `Authorization` is not read.
+ */
+export type OAuthTokenExchangeGrant = {
+  grantType: "urn:ietf:params:oauth:grant-type:token-exchange";
+  /**
+   * The signed-in user's session token (from `POST /users/authenticate`). Missing, it is
+   *
+   * @remarks
+   * `invalid_request`. A token narrowed with `scope` is refused with `invalid_grant`, as
+   * is any app token.
+   */
+  subjectToken: string;
+  /**
+   * The type of `subject_token`. Only an access token is accepted, which is also the default.
+   */
+  subjectTokenType?: SubjectTokenType | undefined;
+  /**
+   * The app the token is for, as `app:<marketplace app id>`. Missing or unknown, it is `invalid_target`.
+   */
+  audience: string;
+  /**
+   * `app_user` issues a token that acts as the user, limited to the manifest
+   *
+   * @remarks
+   * permissions their own role also grants. `app_installation` issues a token that acts
+   * as the app's service account, narrowed to the tenant of one activation.
+   */
+  requestedTokenType: RequestedTokenType;
+  /**
+   * The activation to bind the token to. Required when more than one activation of the
+   *
+   * @remarks
+   * app covers the user (`invalid_request` otherwise); the user must be covered by it
+   * either way (`invalid_target`).
+   */
+  activationId?: number | undefined;
+  /**
+   * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+   *
+   * @remarks
+   * the device grant) to narrow the token to. Leave it out to get everything the client is
+   * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+   * is left the request fails with `invalid_scope`.
+   */
+  scope?: string | undefined;
+};
+
+/** @internal */
+export const SubjectTokenType$outboundSchema: z.ZodNativeEnum<
+  typeof SubjectTokenType
+> = z.nativeEnum(SubjectTokenType);
+
+/** @internal */
+export const RequestedTokenType$outboundSchema: z.ZodNativeEnum<
+  typeof RequestedTokenType
+> = z.nativeEnum(RequestedTokenType);
+
+/** @internal */
+export type OAuthTokenExchangeGrant$Outbound = {
+  grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+  subject_token: string;
+  subject_token_type: string;
+  audience: string;
+  requested_token_type: string;
+  activation_id?: number | undefined;
+  scope?: string | undefined;
+};
+
+/** @internal */
+export const OAuthTokenExchangeGrant$outboundSchema: z.ZodType<
+  OAuthTokenExchangeGrant$Outbound,
+  z.ZodTypeDef,
+  OAuthTokenExchangeGrant
+> = z.object({
+  grantType: z.literal("urn:ietf:params:oauth:grant-type:token-exchange"),
+  subjectToken: z.string(),
+  subjectTokenType: SubjectTokenType$outboundSchema.default(
+    "urn:ietf:params:oauth:token-type:access_token",
+  ),
+  audience: z.string(),
+  requestedTokenType: RequestedTokenType$outboundSchema,
+  activationId: z.number().int().optional(),
+  scope: z.string().optional(),
+}).transform((v) => {
+  return remap$(v, {
+    grantType: "grant_type",
+    subjectToken: "subject_token",
+    subjectTokenType: "subject_token_type",
+    requestedTokenType: "requested_token_type",
+    activationId: "activation_id",
+  });
+});
+
+export function oAuthTokenExchangeGrantToJSON(
+  oAuthTokenExchangeGrant: OAuthTokenExchangeGrant,
+): string {
+  return JSON.stringify(
+    OAuthTokenExchangeGrant$outboundSchema.parse(oAuthTokenExchangeGrant),
+  );
+}

package/src/models/components/oauthtokenrequest.ts

@@ -0,0 +1,76 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { smartUnion } from "../../types/smartUnion.js";
+import {
+  OAuthClientCredentialsGrant,
+  OAuthClientCredentialsGrant$Outbound,
+  OAuthClientCredentialsGrant$outboundSchema,
+} from "./oauthclientcredentialsgrant.js";
+import {
+  OAuthCliRefreshTokenGrant,
+  OAuthCliRefreshTokenGrant$Outbound,
+  OAuthCliRefreshTokenGrant$outboundSchema,
+} from "./oauthclirefreshtokengrant.js";
+import {
+  OAuthDeviceCodeGrant,
+  OAuthDeviceCodeGrant$Outbound,
+  OAuthDeviceCodeGrant$outboundSchema,
+} from "./oauthdevicecodegrant.js";
+import {
+  OAuthRefreshTokenGrant,
+  OAuthRefreshTokenGrant$Outbound,
+  OAuthRefreshTokenGrant$outboundSchema,
+} from "./oauthrefreshtokengrant.js";
+import {
+  OAuthTokenExchangeGrant,
+  OAuthTokenExchangeGrant$Outbound,
+  OAuthTokenExchangeGrant$outboundSchema,
+} from "./oauthtokenexchangegrant.js";
+
+/**
+ * One of the four supported grants, selected by `grant_type`. `refresh_token` has two
+ *
+ * @remarks
+ * variants, told apart by the client: a service account's (`OAuthRefreshTokenGrant`,
+ * with `client_secret`) and the apps CLI's public-client refresh
+ * (`OAuthCliRefreshTokenGrant`, `client_id=greensecurity-apps-cli` and a `gsdr_` token).
+ * No body matches both: the CLI variant takes no `client_secret`.
+ */
+export type OAuthTokenRequest =
+  | OAuthTokenExchangeGrant
+  | OAuthRefreshTokenGrant
+  | OAuthCliRefreshTokenGrant
+  | OAuthDeviceCodeGrant
+  | OAuthClientCredentialsGrant;
+
+/** @internal */
+export type OAuthTokenRequest$Outbound =
+  | OAuthTokenExchangeGrant$Outbound
+  | OAuthRefreshTokenGrant$Outbound
+  | OAuthCliRefreshTokenGrant$Outbound
+  | OAuthDeviceCodeGrant$Outbound
+  | OAuthClientCredentialsGrant$Outbound;
+
+/** @internal */
+export const OAuthTokenRequest$outboundSchema: z.ZodType<
+  OAuthTokenRequest$Outbound,
+  z.ZodTypeDef,
+  OAuthTokenRequest
+> = smartUnion([
+  OAuthTokenExchangeGrant$outboundSchema,
+  OAuthRefreshTokenGrant$outboundSchema,
+  OAuthCliRefreshTokenGrant$outboundSchema,
+  OAuthDeviceCodeGrant$outboundSchema,
+  OAuthClientCredentialsGrant$outboundSchema,
+]);
+
+export function oAuthTokenRequestToJSON(
+  oAuthTokenRequest: OAuthTokenRequest,
+): string {
+  return JSON.stringify(
+    OAuthTokenRequest$outboundSchema.parse(oAuthTokenRequest),
+  );
+}

package/src/models/components/oauthtokentypehint.ts

@@ -0,0 +1,23 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { ClosedEnum } from "../../types/enums.js";
+
+/**
+ * Optional hint about the kind of token. Tokens are recognised by prefix, so this is informational.
+ */
+export const OAuthTokenTypeHint = {
+  AccessToken: "access_token",
+  RefreshToken: "refresh_token",
+} as const;
+/**
+ * Optional hint about the kind of token. Tokens are recognised by prefix, so this is informational.
+ */
+export type OAuthTokenTypeHint = ClosedEnum<typeof OAuthTokenTypeHint>;
+
+/** @internal */
+export const OAuthTokenTypeHint$outboundSchema: z.ZodNativeEnum<
+  typeof OAuthTokenTypeHint
+> = z.nativeEnum(OAuthTokenTypeHint);

package/src/models/components/pager.ts

@@ -48,6 +48,15 @@ export type Pager = {
    * - items_per_page
    */
   useUrlParams: boolean;
+  /**
+   * How the server narrowed the list to your tenant, when it did, or `null`. Only some
+   *
+   * @remarks
+   * list endpoints return it, such as `GET /apps/secrets` and
+   * `GET /marketplace/apps/{id}/developers`; the others omit the field. Don't rely on
+   * its contents.
+   */
+  scope?: Array<any> | null | undefined;
 };
 
 /** @internal */
@@ -60,6 +69,7 @@ export const Pager$inboundSchema: z.ZodType<Pager, z.ZodTypeDef, unknown> = z
     items_per_page: types.number(),
     page: types.number(),
     use_url_params: types.boolean(),
+    scope: z.nullable(z.array(z.any())).optional(),
   }).transform((v) => {
     return remap$(v, {
       "base_url": "baseUrl",

package/src/models/components/tokenintrospection.ts

@@ -0,0 +1,132 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import { safeParse } from "../../lib/schemas.js";
+import { Result as SafeParseResult } from "../../types/fp.js";
+import * as types from "../../types/primitives.js";
+import { SDKValidationError } from "../errors/sdkvalidationerror.js";
+import { AppTokenKind, AppTokenKind$inboundSchema } from "./apptokenkind.js";
+
+/**
+ * RFC 8693 actor claim: who caused the token to be issued. Present only on an
+ *
+ * @remarks
+ * installation token obtained by token exchange, where `sub` is the service account and
+ * `act.sub` is the signed-in user whose view requested it.
+ */
+export type TokenIntrospectionActor = {
+  /**
+   * The user id, as a string.
+   */
+  sub: string;
+};
+
+/**
+ * RFC 7662 section 2.2. When `active` is `false` no other field is returned: the token is
+ *
+ * @remarks
+ * unknown, expired or revoked, was issued to a different app than the caller's, is a
+ * developer CLI token, or belongs to a user who has since been locked.
+ */
+export type TokenIntrospection = {
+  /**
+   * Whether the token is currently valid for your app.
+   */
+  active: boolean;
+  /**
+   * The id of the user the token acts as, as a string (RFC 7662). For an app user token
+   *
+   * @remarks
+   * this is the viewer; for an installation token it is the app's service account.
+   */
+  sub?: string | undefined;
+  /**
+   * The marketplace app the token was issued to.
+   */
+  appId?: number | undefined;
+  /**
+   * The activation the token is bound to.
+   */
+  activationId?: number | undefined;
+  /**
+   * Space-delimited scopes, as in `TokenResponse.scope`.
+   */
+  scope?: string | undefined;
+  /**
+   * Expiry, in seconds since the Unix epoch.
+   */
+  exp?: number | undefined;
+  /**
+   * When the token was issued, in seconds since the Unix epoch.
+   */
+  iat?: number | undefined;
+  /**
+   * `app_user` tokens act as a user; `app_installation` tokens act as the app's service account within one activation.
+   */
+  kind?: AppTokenKind | undefined;
+  tokenType?: "Bearer" | undefined;
+  /**
+   * RFC 8693 actor claim: who caused the token to be issued. Present only on an
+   *
+   * @remarks
+   * installation token obtained by token exchange, where `sub` is the service account and
+   * `act.sub` is the signed-in user whose view requested it.
+   */
+  act?: TokenIntrospectionActor | undefined;
+};
+
+/** @internal */
+export const TokenIntrospectionActor$inboundSchema: z.ZodType<
+  TokenIntrospectionActor,
+  z.ZodTypeDef,
+  unknown
+> = z.object({
+  sub: types.string(),
+});
+
+export function tokenIntrospectionActorFromJSON(
+  jsonString: string,
+): SafeParseResult<TokenIntrospectionActor, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => TokenIntrospectionActor$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'TokenIntrospectionActor' from JSON`,
+  );
+}
+
+/** @internal */
+export const TokenIntrospection$inboundSchema: z.ZodType<
+  TokenIntrospection,
+  z.ZodTypeDef,
+  unknown
+> = z.object({
+  active: types.boolean(),
+  sub: types.optional(types.string()),
+  app_id: types.optional(types.number()),
+  activation_id: types.optional(types.number()),
+  scope: types.optional(types.string()),
+  exp: types.optional(types.number()),
+  iat: types.optional(types.number()),
+  kind: types.optional(AppTokenKind$inboundSchema),
+  token_type: types.optional(types.literal("Bearer")),
+  act: types.optional(z.lazy(() => TokenIntrospectionActor$inboundSchema)),
+}).transform((v) => {
+  return remap$(v, {
+    "app_id": "appId",
+    "activation_id": "activationId",
+    "token_type": "tokenType",
+  });
+});
+
+export function tokenIntrospectionFromJSON(
+  jsonString: string,
+): SafeParseResult<TokenIntrospection, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => TokenIntrospection$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'TokenIntrospection' from JSON`,
+  );
+}

package/src/models/components/tokenintrospectionrequest.ts

@@ -0,0 +1,49 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import {
+  OAuthTokenTypeHint,
+  OAuthTokenTypeHint$outboundSchema,
+} from "./oauthtokentypehint.js";
+
+export type TokenIntrospectionRequest = {
+  /**
+   * The token to check, typically an app user token your app's UI sent to your backend.
+   */
+  token: string;
+  /**
+   * Optional hint about the kind of token. Tokens are recognised by prefix, so this is informational.
+   */
+  tokenTypeHint?: OAuthTokenTypeHint | undefined;
+};
+
+/** @internal */
+export type TokenIntrospectionRequest$Outbound = {
+  token: string;
+  token_type_hint?: string | undefined;
+};
+
+/** @internal */
+export const TokenIntrospectionRequest$outboundSchema: z.ZodType<
+  TokenIntrospectionRequest$Outbound,
+  z.ZodTypeDef,
+  TokenIntrospectionRequest
+> = z.object({
+  token: z.string(),
+  tokenTypeHint: OAuthTokenTypeHint$outboundSchema.optional(),
+}).transform((v) => {
+  return remap$(v, {
+    tokenTypeHint: "token_type_hint",
+  });
+});
+
+export function tokenIntrospectionRequestToJSON(
+  tokenIntrospectionRequest: TokenIntrospectionRequest,
+): string {
+  return JSON.stringify(
+    TokenIntrospectionRequest$outboundSchema.parse(tokenIntrospectionRequest),
+  );
+}