@greensecurity/javascript-sdk 0.46.0-beta.8 → 0.46.0-beta.9

package/dist/commonjs/funcs/oauthCreateToken.js

@@ -0,0 +1,167 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthCreateToken = oauthCreateToken;
+const encodings_js_1 = require("../lib/encodings.js");
+const http_js_1 = require("../lib/http.js");
+const M = __importStar(require("../lib/matchers.js"));
+const primitives_js_1 = require("../lib/primitives.js");
+const schemas_js_1 = require("../lib/schemas.js");
+const security_js_1 = require("../lib/security.js");
+const url_js_1 = require("../lib/url.js");
+const components = __importStar(require("../models/components/index.js"));
+const errors = __importStar(require("../models/errors/index.js"));
+const async_js_1 = require("../types/async.js");
+/**
+ * Issue an access, app or developer token
+ *
+ * @remarks
+ * The OAuth 2.0 token endpoint. It issues four kinds of short-lived token, chosen by
+ * `grant_type`:
+ *
+ * | Grant | Authenticate with | Issues |
+ * | --- | --- | --- |
+ * | `urn:ietf:params:oauth:grant-type:token-exchange` | The user's session token, as `subject_token` | An app user token (`gsu_`) or an app installation token (`gsi_`), 15 minutes |
+ * | `client_credentials` with `activation_id` | The app service account's `client_id` and `client_secret`, or its permanent token as `Authorization: Bearer` | An app installation token (`gsi_`), 15 minutes |
+ * | `client_credentials` without `activation_id` | An API service account's `client_id` and `client_secret`, or its permanent token as `Authorization: Bearer` | A plain API access token, 15 minutes |
+ * | `refresh_token` (service account) | The service account's `client_id` and `client_secret`, and a `refresh_token` | A plain API access token, 15 minutes, and a new refresh token |
+ * | `refresh_token` (apps CLI) | A `gsdr_` refresh token and `client_id=greensecurity-apps-cli`, no secret | A new developer CLI token (`gsd_`), 15 minutes, and a new `gsdr_` refresh token |
+ * | `urn:ietf:params:oauth:grant-type:device_code` | The `device_code` from `POST /oauth/device_authorization` | A developer CLI token (`gsd_`), 15 minutes, and a `gsdr_` refresh token |
+ *
+ * Token exchange is what the Green Security app does when it opens an app's views: the user
+ * must be covered by an activation of the app named in `audience`. `client_credentials` with
+ * `activation_id` is for the app's own backend. Without `activation_id`, `client_credentials`
+ * and a service account's `refresh_token` are the API service account flows: the response is
+ * a plain access token with no `issued_token_type` and no `activation_id` (see
+ * `TokenResponse`). An app token can never be used to obtain another token.
+ *
+ * The apps CLI logs in with the device grant and then renews its 15-minute developer token
+ * with the public-client `refresh_token` grant. Refresh tokens rotate and are single-use;
+ * presenting a spent one revokes the whole login, except for a retry within 30 seconds whose
+ * replacement is still unused. A login lasts at most 90 days from its device authorization.
+ * See `OAuthCliRefreshTokenGrant`.
+ *
+ * Every grant takes an optional `scope`, which can only narrow the token: it gets what was
+ * requested intersected with what the client is allowed, and if that is empty the request
+ * fails with `invalid_scope`. A refreshed token is never wider than the one it replaces.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`, and every parameter
+ * must be in the body: one sent in the query string is refused with `invalid_request`. Errors
+ * follow RFC 6749 and use `OAuthError` rather than the usual error envelope, including a
+ * body that fails validation (`400` `invalid_request`, never `422`). For the device grant,
+ * `authorization_pending` and `slow_down` mean "poll again later", not failure.
+ *
+ * Only `client_credentials` reads `Authorization`, and only when the body carries neither
+ * `client_id` nor `client_secret`. It accepts only the service account's permanent token
+ * there: a short-lived token (including one this endpoint issued), a narrowed token or an app
+ * token (`gsu_`, `gsi_`, `gsd_`) is answered `401` `invalid_client`, so a token can never be
+ * renewed or widened by presenting it. The other grants ignore the header.
+ *
+ * A narrowed `subject_token` is refused with `invalid_grant`, and a locked service account
+ * gets `401` `invalid_client` on `client_credentials` and `refresh_token`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** No named permission.
+ *
+ * If set, this operation will use {@link Security.bearerJwt} from the global security.
+ */
+function oauthCreateToken(client, request, options) {
+    return new async_js_1.APIPromise($do(client, request, options));
+}
+async function $do(client, request, options) {
+    const parsed = (0, schemas_js_1.safeParse)(request, (value) => components.OAuthTokenRequest$outboundSchema.parse(value), "Input validation failed");
+    if (!parsed.ok) {
+        return [parsed, { status: "invalid" }];
+    }
+    const payload = parsed.value;
+    const body = (0, encodings_js_1.encodeJSON)("body", payload, { explode: true });
+    const path = (0, url_js_1.pathToFunc)("/oauth/token")();
+    const headers = new Headers((0, primitives_js_1.compactMap)({
+        "Content-Type": "application/json",
+        Accept: "application/json",
+    }));
+    const securityInput = await (0, security_js_1.extractSecurity)(client._options.security);
+    const requestSecurity = (0, security_js_1.resolveGlobalSecurity)(securityInput, [1]);
+    const context = {
+        options: client._options,
+        baseURL: options?.serverURL ?? client._baseURL ?? "",
+        operationID: "createToken",
+        oAuth2Scopes: null,
+        resolvedSecurity: requestSecurity,
+        securitySource: client._options.security,
+        retryConfig: options?.retries
+            || client._options.retryConfig
+            || { strategy: "none" },
+        retryCodes: options?.retryCodes || ["429", "500", "502", "503", "504"],
+    };
+    const requestRes = client._createRequest(context, {
+        security: requestSecurity,
+        method: "POST",
+        baseURL: options?.serverURL,
+        path: path,
+        headers: headers,
+        body: body,
+        userAgent: client._options.userAgent,
+        timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+    }, options);
+    if (!requestRes.ok) {
+        return [requestRes, { status: "invalid" }];
+    }
+    const req = requestRes.value;
+    const doResult = await client._do(req, {
+        context,
+        isErrorStatusCode: (statusCode) => (0, http_js_1.matchStatusCode)({ status: statusCode }, ["4XX", "5XX"]),
+        retryConfig: context.retryConfig,
+        retryCodes: context.retryCodes,
+    });
+    if (!doResult.ok) {
+        return [doResult, { status: "request-error", request: req }];
+    }
+    const response = doResult.value;
+    const responseFields = {
+        HttpMeta: { Response: response, Request: req },
+    };
+    const [result] = await M.match(M.json(200, components.TokenResponse$inboundSchema), M.jsonErr([400, 401, 429], errors.OAuthError$inboundSchema), M.fail("4XX"), M.fail([500, "5XX"]))(response, req, { extraFields: responseFields });
+    if (!result.ok) {
+        return [result, { status: "complete", request: req, response }];
+    }
+    return [result, { status: "complete", request: req, response }];
+}
+//# sourceMappingURL=oauthCreateToken.js.map

package/dist/commonjs/funcs/oauthCreateToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthCreateToken.js","sourceRoot":"","sources":["../../../src/funcs/oauthCreateToken.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiFH,4CAuBC;AArGD,sDAAiD;AACjD,4CAAiD;AACjD,sDAAwC;AACxC,wDAAkD;AAClD,kDAA8C;AAE9C,oDAA4E;AAC5E,0CAA2C;AAC3C,0EAA4D;AAS5D,kEAAoD;AAGpD,gDAAwD;AAGxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,SAAgB,gBAAgB,CAC9B,MAAyB,EACzB,OAAqC,EACrC,OAAwB;IAexB,OAAO,IAAI,qBAAU,CAAC,GAAG,CACvB,MAAM,EACN,OAAO,EACP,OAAO,CACR,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,MAAyB,EACzB,OAAqC,EACrC,OAAwB;IAkBxB,MAAM,MAAM,GAAG,IAAA,sBAAS,EACtB,OAAO,EACP,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,gCAAgC,CAAC,KAAK,CAAC,KAAK,CAAC,EACnE,yBAAyB,CAC1B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAA,yBAAU,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,cAAc,CAAC,EAAE,CAAC;IAE1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAA,0BAAU,EAAC;QACrC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;KAC3B,CAAC,CAAC,CAAC;IAEJ,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAe,EAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,IAAA,mCAAqB,EAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,OAAO,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE;QACpD,WAAW,EAAE,aAAa;QAC1B,YAAY,EAAE,IAAI;QAElB,gBAAgB,EAAE,eAAe;QAEjC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;QACxC,WAAW,EAAE,OAAO,EAAE,OAAO;eACxB,MAAM,CAAC,QAAQ,CAAC,WAAW;eAC3B,EAAE,QAAQ,EAAE,MAAM,EAAE;QACzB,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;KACvE,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE;QAChD,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO,EAAE,SAAS;QAC3B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;QACpC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC;KACjE,EAAE,OAAO,CAAC,CAAC;IACZ,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC;IAE7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;QACrC,OAAO;QACP,iBAAiB,EAAE,CAAC,UAAkB,EAAE,EAAE,CACxC,IAAA,yBAAe,EAAC,EAAE,MAAM,EAAE,UAAU,EAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC;IAEhC,MAAM,cAAc,GAAG;QACrB,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;KAC/C,CAAC;IAEF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAY5B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,2BAA2B,CAAC,EACnD,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,wBAAwB,CAAC,EAC3D,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EACb,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CACrB,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/commonjs/funcs/oauthIntrospectToken.d.ts

@@ -0,0 +1,45 @@
+import { GreenSecurityCore } from "../core.js";
+import { RequestOptions } from "../lib/sdks.js";
+import * as components from "../models/components/index.js";
+import { GreenSecurityError } from "../models/errors/greensecurityerror.js";
+import { ConnectionError, InvalidRequestError, RequestAbortedError, RequestTimeoutError, UnexpectedClientError } from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import { APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+/**
+ * Check an app token
+ *
+ * @remarks
+ * RFC 7662 token introspection, for your app's backend. When your app's UI calls your own
+ * API it sends the app user token it was given; call this endpoint to confirm the token is
+ * live and find out which user, app and activation it belongs to before you act on it.
+ *
+ * A back-end-only app (a manifest with no `ui_extensions`) has no UI, so no user token
+ * ever reaches it, and the installation tokens it uses it mints itself with
+ * `client_credentials`. It needs this endpoint only to check an app token that another
+ * party sends it.
+ *
+ * Only app user and app installation tokens issued to your own app are reported as
+ * `active`. Any other token, whether unknown, expired, revoked, another app's, a developer
+ * CLI token, or one whose user has since been locked, returns `{"active": false}` with a
+ * `200`, never an error.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** Only your app service account's permanent token is accepted, as
+ * `Authorization: Bearer`. A short-lived or narrowed token (including one from
+ * `client_credentials`), a locked service account's token, or a token of a user who is not
+ * an API service account is refused with `401` `invalid_client`. Every app token is refused
+ * the same way, and that includes installation tokens (`gsi_`): the host also hands those to
+ * your app's sandboxed UI, so accepting them here would let code running in the UI introspect
+ * tokens. Keep the service account token on your backend.
+ *
+ * If set, this operation will use {@link Security.bearerJwt} from the global security.
+ */
+export declare function oauthIntrospectToken(client: GreenSecurityCore, request: components.TokenIntrospectionRequest, options?: RequestOptions): APIPromise<Result<components.TokenIntrospection, errors.OAuthError | GreenSecurityError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
+//# sourceMappingURL=oauthIntrospectToken.d.ts.map

package/dist/commonjs/funcs/oauthIntrospectToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthIntrospectToken.d.ts","sourceRoot":"","sources":["../../../src/funcs/oauthIntrospectToken.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAM/C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAW,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,UAAU,CAAC,yBAAyB,EAC7C,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CACX,MAAM,CACJ,UAAU,CAAC,kBAAkB,EAC3B,MAAM,CAAC,UAAU,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,CACrB,CACF,CAMA"}

package/dist/commonjs/funcs/oauthIntrospectToken.js

@@ -0,0 +1,145 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthIntrospectToken = oauthIntrospectToken;
+const encodings_js_1 = require("../lib/encodings.js");
+const http_js_1 = require("../lib/http.js");
+const M = __importStar(require("../lib/matchers.js"));
+const primitives_js_1 = require("../lib/primitives.js");
+const schemas_js_1 = require("../lib/schemas.js");
+const security_js_1 = require("../lib/security.js");
+const url_js_1 = require("../lib/url.js");
+const components = __importStar(require("../models/components/index.js"));
+const errors = __importStar(require("../models/errors/index.js"));
+const async_js_1 = require("../types/async.js");
+/**
+ * Check an app token
+ *
+ * @remarks
+ * RFC 7662 token introspection, for your app's backend. When your app's UI calls your own
+ * API it sends the app user token it was given; call this endpoint to confirm the token is
+ * live and find out which user, app and activation it belongs to before you act on it.
+ *
+ * A back-end-only app (a manifest with no `ui_extensions`) has no UI, so no user token
+ * ever reaches it, and the installation tokens it uses it mints itself with
+ * `client_credentials`. It needs this endpoint only to check an app token that another
+ * party sends it.
+ *
+ * Only app user and app installation tokens issued to your own app are reported as
+ * `active`. Any other token, whether unknown, expired, revoked, another app's, a developer
+ * CLI token, or one whose user has since been locked, returns `{"active": false}` with a
+ * `200`, never an error.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** Only your app service account's permanent token is accepted, as
+ * `Authorization: Bearer`. A short-lived or narrowed token (including one from
+ * `client_credentials`), a locked service account's token, or a token of a user who is not
+ * an API service account is refused with `401` `invalid_client`. Every app token is refused
+ * the same way, and that includes installation tokens (`gsi_`): the host also hands those to
+ * your app's sandboxed UI, so accepting them here would let code running in the UI introspect
+ * tokens. Keep the service account token on your backend.
+ *
+ * If set, this operation will use {@link Security.bearerJwt} from the global security.
+ */
+function oauthIntrospectToken(client, request, options) {
+    return new async_js_1.APIPromise($do(client, request, options));
+}
+async function $do(client, request, options) {
+    const parsed = (0, schemas_js_1.safeParse)(request, (value) => components.TokenIntrospectionRequest$outboundSchema.parse(value), "Input validation failed");
+    if (!parsed.ok) {
+        return [parsed, { status: "invalid" }];
+    }
+    const payload = parsed.value;
+    const body = (0, encodings_js_1.encodeJSON)("body", payload, { explode: true });
+    const path = (0, url_js_1.pathToFunc)("/oauth/introspect")();
+    const headers = new Headers((0, primitives_js_1.compactMap)({
+        "Content-Type": "application/json",
+        Accept: "application/json",
+    }));
+    const securityInput = await (0, security_js_1.extractSecurity)(client._options.security);
+    const requestSecurity = (0, security_js_1.resolveGlobalSecurity)(securityInput, [1]);
+    const context = {
+        options: client._options,
+        baseURL: options?.serverURL ?? client._baseURL ?? "",
+        operationID: "introspectToken",
+        oAuth2Scopes: null,
+        resolvedSecurity: requestSecurity,
+        securitySource: client._options.security,
+        retryConfig: options?.retries
+            || client._options.retryConfig
+            || { strategy: "none" },
+        retryCodes: options?.retryCodes || ["429", "500", "502", "503", "504"],
+    };
+    const requestRes = client._createRequest(context, {
+        security: requestSecurity,
+        method: "POST",
+        baseURL: options?.serverURL,
+        path: path,
+        headers: headers,
+        body: body,
+        userAgent: client._options.userAgent,
+        timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+    }, options);
+    if (!requestRes.ok) {
+        return [requestRes, { status: "invalid" }];
+    }
+    const req = requestRes.value;
+    const doResult = await client._do(req, {
+        context,
+        isErrorStatusCode: (statusCode) => (0, http_js_1.matchStatusCode)({ status: statusCode }, ["4XX", "5XX"]),
+        retryConfig: context.retryConfig,
+        retryCodes: context.retryCodes,
+    });
+    if (!doResult.ok) {
+        return [doResult, { status: "request-error", request: req }];
+    }
+    const response = doResult.value;
+    const responseFields = {
+        HttpMeta: { Response: response, Request: req },
+    };
+    const [result] = await M.match(M.json(200, components.TokenIntrospection$inboundSchema), M.jsonErr([400, 401], errors.OAuthError$inboundSchema), M.fail("4XX"), M.fail([500, "5XX"]))(response, req, { extraFields: responseFields });
+    if (!result.ok) {
+        return [result, { status: "complete", request: req, response }];
+    }
+    return [result, { status: "complete", request: req, response }];
+}
+//# sourceMappingURL=oauthIntrospectToken.js.map

package/dist/commonjs/funcs/oauthIntrospectToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthIntrospectToken.js","sourceRoot":"","sources":["../../../src/funcs/oauthIntrospectToken.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DH,oDAuBC;AA/ED,sDAAiD;AACjD,4CAAiD;AACjD,sDAAwC;AACxC,wDAAkD;AAClD,kDAA8C;AAE9C,oDAA4E;AAC5E,0CAA2C;AAC3C,0EAA4D;AAS5D,kEAAoD;AAGpD,gDAAwD;AAGxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,SAAgB,oBAAoB,CAClC,MAAyB,EACzB,OAA6C,EAC7C,OAAwB;IAexB,OAAO,IAAI,qBAAU,CAAC,GAAG,CACvB,MAAM,EACN,OAAO,EACP,OAAO,CACR,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,MAAyB,EACzB,OAA6C,EAC7C,OAAwB;IAkBxB,MAAM,MAAM,GAAG,IAAA,sBAAS,EACtB,OAAO,EACP,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,wCAAwC,CAAC,KAAK,CAAC,KAAK,CAAC,EAC3E,yBAAyB,CAC1B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAA,yBAAU,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,mBAAmB,CAAC,EAAE,CAAC;IAE/C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAA,0BAAU,EAAC;QACrC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;KAC3B,CAAC,CAAC,CAAC;IAEJ,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAe,EAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,IAAA,mCAAqB,EAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,OAAO,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE;QACpD,WAAW,EAAE,iBAAiB;QAC9B,YAAY,EAAE,IAAI;QAElB,gBAAgB,EAAE,eAAe;QAEjC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;QACxC,WAAW,EAAE,OAAO,EAAE,OAAO;eACxB,MAAM,CAAC,QAAQ,CAAC,WAAW;eAC3B,EAAE,QAAQ,EAAE,MAAM,EAAE;QACzB,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;KACvE,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE;QAChD,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO,EAAE,SAAS;QAC3B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;QACpC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC;KACjE,EAAE,OAAO,CAAC,CAAC;IACZ,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC;IAE7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;QACrC,OAAO;QACP,iBAAiB,EAAE,CAAC,UAAkB,EAAE,EAAE,CACxC,IAAA,yBAAe,EAAC,EAAE,MAAM,EAAE,UAAU,EAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC;IAEhC,MAAM,cAAc,GAAG;QACrB,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;KAC/C,CAAC;IAEF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAY5B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,gCAAgC,CAAC,EACxD,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,wBAAwB,CAAC,EACtD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EACb,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CACrB,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/commonjs/funcs/oauthRevokeToken.d.ts

@@ -0,0 +1,49 @@
+import { GreenSecurityCore } from "../core.js";
+import { RequestOptions } from "../lib/sdks.js";
+import * as components from "../models/components/index.js";
+import { GreenSecurityError } from "../models/errors/greensecurityerror.js";
+import { ConnectionError, InvalidRequestError, RequestAbortedError, RequestTimeoutError, UnexpectedClientError } from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import * as operations from "../models/operations/index.js";
+import { APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+/**
+ * Revoke a token
+ *
+ * @remarks
+ * RFC 7009 token revocation. Revokes an app user, app installation or developer CLI token,
+ * or an apps CLI refresh token, immediately. Revoking any token of an apps CLI login (its
+ * `gsd_` developer token or its `gsdr_` refresh token) revokes every token of that login.
+ * `apps-cli logout` sends its refresh token this way.
+ *
+ * Once the caller is authenticated the response is `200` with `{}`, whether or not anything
+ * was revoked, so it cannot be used to probe for valid tokens. A token the caller may not
+ * revoke is left alone.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** For an apps CLI refresh token, send `token=gsdr_…` with
+ * `client_id=greensecurity-apps-cli` and no `Authorization` (RFC 7009 public client). It
+ * always answers `200`.
+ *
+ * Otherwise send one of these as `Authorization: Bearer`:
+ *
+ * - the token being revoked, which may revoke itself (a `gsd_` token may also revoke any
+ *   token of its own login), and no other token;
+ * - an unscoped token (session, permanent, or an access token issued without `scope`) of the
+ *   token's subject, or of the user whose view caused it to be issued;
+ * - an unscoped token of the service account of the app it was issued for.
+ *
+ * A narrowed token (an access token issued with `scope`) is refused with `401`
+ * `invalid_client`: its scope says nothing about revoking the caller's other tokens. So is
+ * the token of a locked user.
+ *
+ * If set, this operation will use {@link Security.bearerJwt} from the global security.
+ */
+export declare function oauthRevokeToken(client: GreenSecurityCore, request: components.TokenRevocationRequest, options?: RequestOptions): APIPromise<Result<operations.RevokeTokenRevokeTokenOk, errors.OAuthError | GreenSecurityError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
+//# sourceMappingURL=oauthRevokeToken.d.ts.map

package/dist/commonjs/funcs/oauthRevokeToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthRevokeToken.d.ts","sourceRoot":"","sources":["../../../src/funcs/oauthRevokeToken.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAM/C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAW,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,UAAU,CAAC,sBAAsB,EAC1C,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CACX,MAAM,CACJ,UAAU,CAAC,wBAAwB,EACjC,MAAM,CAAC,UAAU,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,CACrB,CACF,CAMA"}

package/dist/commonjs/funcs/oauthRevokeToken.js

@@ -0,0 +1,149 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthRevokeToken = oauthRevokeToken;
+const encodings_js_1 = require("../lib/encodings.js");
+const http_js_1 = require("../lib/http.js");
+const M = __importStar(require("../lib/matchers.js"));
+const primitives_js_1 = require("../lib/primitives.js");
+const schemas_js_1 = require("../lib/schemas.js");
+const security_js_1 = require("../lib/security.js");
+const url_js_1 = require("../lib/url.js");
+const components = __importStar(require("../models/components/index.js"));
+const errors = __importStar(require("../models/errors/index.js"));
+const operations = __importStar(require("../models/operations/index.js"));
+const async_js_1 = require("../types/async.js");
+/**
+ * Revoke a token
+ *
+ * @remarks
+ * RFC 7009 token revocation. Revokes an app user, app installation or developer CLI token,
+ * or an apps CLI refresh token, immediately. Revoking any token of an apps CLI login (its
+ * `gsd_` developer token or its `gsdr_` refresh token) revokes every token of that login.
+ * `apps-cli logout` sends its refresh token this way.
+ *
+ * Once the caller is authenticated the response is `200` with `{}`, whether or not anything
+ * was revoked, so it cannot be used to probe for valid tokens. A token the caller may not
+ * revoke is left alone.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** For an apps CLI refresh token, send `token=gsdr_…` with
+ * `client_id=greensecurity-apps-cli` and no `Authorization` (RFC 7009 public client). It
+ * always answers `200`.
+ *
+ * Otherwise send one of these as `Authorization: Bearer`:
+ *
+ * - the token being revoked, which may revoke itself (a `gsd_` token may also revoke any
+ *   token of its own login), and no other token;
+ * - an unscoped token (session, permanent, or an access token issued without `scope`) of the
+ *   token's subject, or of the user whose view caused it to be issued;
+ * - an unscoped token of the service account of the app it was issued for.
+ *
+ * A narrowed token (an access token issued with `scope`) is refused with `401`
+ * `invalid_client`: its scope says nothing about revoking the caller's other tokens. So is
+ * the token of a locked user.
+ *
+ * If set, this operation will use {@link Security.bearerJwt} from the global security.
+ */
+function oauthRevokeToken(client, request, options) {
+    return new async_js_1.APIPromise($do(client, request, options));
+}
+async function $do(client, request, options) {
+    const parsed = (0, schemas_js_1.safeParse)(request, (value) => components.TokenRevocationRequest$outboundSchema.parse(value), "Input validation failed");
+    if (!parsed.ok) {
+        return [parsed, { status: "invalid" }];
+    }
+    const payload = parsed.value;
+    const body = (0, encodings_js_1.encodeJSON)("body", payload, { explode: true });
+    const path = (0, url_js_1.pathToFunc)("/oauth/revoke")();
+    const headers = new Headers((0, primitives_js_1.compactMap)({
+        "Content-Type": "application/json",
+        Accept: "application/json",
+    }));
+    const securityInput = await (0, security_js_1.extractSecurity)(client._options.security);
+    const requestSecurity = (0, security_js_1.resolveGlobalSecurity)(securityInput, [1]);
+    const context = {
+        options: client._options,
+        baseURL: options?.serverURL ?? client._baseURL ?? "",
+        operationID: "revokeToken",
+        oAuth2Scopes: null,
+        resolvedSecurity: requestSecurity,
+        securitySource: client._options.security,
+        retryConfig: options?.retries
+            || client._options.retryConfig
+            || { strategy: "none" },
+        retryCodes: options?.retryCodes || ["429", "500", "502", "503", "504"],
+    };
+    const requestRes = client._createRequest(context, {
+        security: requestSecurity,
+        method: "POST",
+        baseURL: options?.serverURL,
+        path: path,
+        headers: headers,
+        body: body,
+        userAgent: client._options.userAgent,
+        timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+    }, options);
+    if (!requestRes.ok) {
+        return [requestRes, { status: "invalid" }];
+    }
+    const req = requestRes.value;
+    const doResult = await client._do(req, {
+        context,
+        isErrorStatusCode: (statusCode) => (0, http_js_1.matchStatusCode)({ status: statusCode }, ["4XX", "5XX"]),
+        retryConfig: context.retryConfig,
+        retryCodes: context.retryCodes,
+    });
+    if (!doResult.ok) {
+        return [doResult, { status: "request-error", request: req }];
+    }
+    const response = doResult.value;
+    const responseFields = {
+        HttpMeta: { Response: response, Request: req },
+    };
+    const [result] = await M.match(M.json(200, operations.RevokeTokenRevokeTokenOk$inboundSchema), M.jsonErr([400, 401], errors.OAuthError$inboundSchema), M.fail("4XX"), M.fail([500, "5XX"]))(response, req, { extraFields: responseFields });
+    if (!result.ok) {
+        return [result, { status: "complete", request: req, response }];
+    }
+    return [result, { status: "complete", request: req, response }];
+}
+//# sourceMappingURL=oauthRevokeToken.js.map

package/dist/commonjs/funcs/oauthRevokeToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthRevokeToken.js","sourceRoot":"","sources":["../../../src/funcs/oauthRevokeToken.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DH,4CAuBC;AAnFD,sDAAiD;AACjD,4CAAiD;AACjD,sDAAwC;AACxC,wDAAkD;AAClD,kDAA8C;AAE9C,oDAA4E;AAC5E,0CAA2C;AAC3C,0EAA4D;AAS5D,kEAAoD;AAGpD,0EAA4D;AAC5D,gDAAwD;AAGxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,SAAgB,gBAAgB,CAC9B,MAAyB,EACzB,OAA0C,EAC1C,OAAwB;IAexB,OAAO,IAAI,qBAAU,CAAC,GAAG,CACvB,MAAM,EACN,OAAO,EACP,OAAO,CACR,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,MAAyB,EACzB,OAA0C,EAC1C,OAAwB;IAkBxB,MAAM,MAAM,GAAG,IAAA,sBAAS,EACtB,OAAO,EACP,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,qCAAqC,CAAC,KAAK,CAAC,KAAK,CAAC,EACxE,yBAAyB,CAC1B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAA,yBAAU,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,eAAe,CAAC,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAA,0BAAU,EAAC;QACrC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;KAC3B,CAAC,CAAC,CAAC;IAEJ,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAe,EAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,IAAA,mCAAqB,EAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,OAAO,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE;QACpD,WAAW,EAAE,aAAa;QAC1B,YAAY,EAAE,IAAI;QAElB,gBAAgB,EAAE,eAAe;QAEjC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;QACxC,WAAW,EAAE,OAAO,EAAE,OAAO;eACxB,MAAM,CAAC,QAAQ,CAAC,WAAW;eAC3B,EAAE,QAAQ,EAAE,MAAM,EAAE;QACzB,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;KACvE,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE;QAChD,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO,EAAE,SAAS;QAC3B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;QACpC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC;KACjE,EAAE,OAAO,CAAC,CAAC;IACZ,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC;IAE7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;QACrC,OAAO;QACP,iBAAiB,EAAE,CAAC,UAAkB,EAAE,EAAE,CACxC,IAAA,yBAAe,EAAC,EAAE,MAAM,EAAE,UAAU,EAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC;IAEhC,MAAM,cAAc,GAAG;QACrB,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;KAC/C,CAAC;IAEF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAY5B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,sCAAsC,CAAC,EAC9D,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,wBAAwB,CAAC,EACtD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EACb,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CACrB,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/commonjs/funcs/validateWebhook.d.ts

@@ -11,5 +11,5 @@ export declare function validateWebhook(client: GreenSecurityCore, { request: ra
         headers: Record<string, string> | Headers;
     } | Request;
     secret: string;
-}): Promise<Result<webhooks.SendFullReportCreatedRequest | webhooks.SendFullReportUpdatedRequest | webhooks.SendFullReportDestroyedRequest | webhooks.SendVendorCreatedRequest | webhooks.SendVendorUpdatedRequest | webhooks.SendVendorDestroyedRequest | webhooks.SendTargetFacilityStatusChangeCreatedRequest | webhooks.SendTargetFacilityStatusChangeUpdatedRequest | webhooks.SendTargetFacilityStatusChangeDestroyedRequest | webhooks.SendVendorScanCreatedRequest | webhooks.SendVendorScanUpdatedRequest | webhooks.SendVendorScanDestroyedRequest | webhooks.SendVisitorCheckinCreatedRequest | webhooks.SendVisitorCheckinUpdatedRequest | webhooks.SendVisitorCheckinDestroyedRequest, SDKValidationError | WebhookAuthenticationError>>;
+}): Promise<Result<webhooks.SendFullReportCreatedRequest | webhooks.SendFullReportUpdatedRequest | webhooks.SendFullReportDestroyedRequest | webhooks.SendMarketplaceAppActivationCreatedRequest | webhooks.SendMarketplaceAppActivationUpdatedRequest | webhooks.SendMarketplaceAppActivationDestroyedRequest | webhooks.SendVendorCreatedRequest | webhooks.SendVendorUpdatedRequest | webhooks.SendVendorDestroyedRequest | webhooks.SendTargetFacilityStatusChangeCreatedRequest | webhooks.SendTargetFacilityStatusChangeUpdatedRequest | webhooks.SendTargetFacilityStatusChangeDestroyedRequest | webhooks.SendVendorScanCreatedRequest | webhooks.SendVendorScanUpdatedRequest | webhooks.SendVendorScanDestroyedRequest | webhooks.SendVisitorCheckinCreatedRequest | webhooks.SendVisitorCheckinUpdatedRequest | webhooks.SendVisitorCheckinDestroyedRequest, SDKValidationError | WebhookAuthenticationError>>;
 //# sourceMappingURL=validateWebhook.d.ts.map

package/dist/commonjs/funcs/validateWebhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateWebhook.d.ts","sourceRoot":"","sources":["../../../src/funcs/validateWebhook.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,QAAQ,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAO,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAElE,wBAAsB,eAAe,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAC/D,OAAO,EAAE,UAAU,EACnB,MAAM,GACP,EAAE;IACD,OAAO,EAAE;QACP,IAAI,EAAE,QAAQ,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;KAC3C,GAAG,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CACT,MAAM,CACF,QAAQ,CAAC,4BAA4B,GACrC,QAAQ,CAAC,4BAA4B,GACrC,QAAQ,CAAC,8BAA8B,GACvC,QAAQ,CAAC,wBAAwB,GACjC,QAAQ,CAAC,wBAAwB,GACjC,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,4CAA4C,GACrD,QAAQ,CAAC,4CAA4C,GACrD,QAAQ,CAAC,8CAA8C,GACvD,QAAQ,CAAC,4BAA4B,GACrC,QAAQ,CAAC,4BAA4B,GACrC,QAAQ,CAAC,8BAA8B,GACvC,QAAQ,CAAC,gCAAgC,GACzC,QAAQ,CAAC,gCAAgC,GACzC,QAAQ,CAAC,kCAAkC,EAC7C,kBAAkB,GAAG,0BAA0B,CAChD,CACF,CAuCA"}
+{"version":3,"file":"validateWebhook.d.ts","sourceRoot":"","sources":["../../../src/funcs/validateWebhook.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,QAAQ,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAO,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAElE,wBAAsB,eAAe,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAC/D,OAAO,EAAE,UAAU,EACnB,MAAM,GACP,EAAE;IACD,OAAO,EAAE;QACP,IAAI,EAAE,QAAQ,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;KAC3C,GAAG,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CACT,MAAM,CACF,QAAQ,CAAC,4BAA4B,GACrC,QAAQ,CAAC,4BAA4B,GACrC,QAAQ,CAAC,8BAA8B,GACvC,QAAQ,CAAC,0CAA0C,GACnD,QAAQ,CAAC,0CAA0C,GACnD,QAAQ,CAAC,4CAA4C,GACrD,QAAQ,CAAC,wBAAwB,GACjC,QAAQ,CAAC,wBAAwB,GACjC,QAAQ,CAAC,0BAA0B,GACnC,QAAQ,CAAC,4CAA4C,GACrD,QAAQ,CAAC,4CAA4C,GACrD,QAAQ,CAAC,8CAA8C,GACvD,QAAQ,CAAC,4BAA4B,GACrC,QAAQ,CAAC,4BAA4B,GACrC,QAAQ,CAAC,8BAA8B,GACvC,QAAQ,CAAC,gCAAgC,GACzC,QAAQ,CAAC,gCAAgC,GACzC,QAAQ,CAAC,kCAAkC,EAC7C,kBAAkB,GAAG,0BAA0B,CAChD,CACF,CA0CA"}

package/dist/commonjs/funcs/validateWebhook.js

@@ -51,6 +51,9 @@ async function validateWebhook(client, { request: rawRequest, secret, }) {
         webhooks.sendFullReportCreatedRequestFromJSON,
         webhooks.sendFullReportUpdatedRequestFromJSON,
         webhooks.sendFullReportDestroyedRequestFromJSON,
+        webhooks.sendMarketplaceAppActivationCreatedRequestFromJSON,
+        webhooks.sendMarketplaceAppActivationUpdatedRequestFromJSON,
+        webhooks.sendMarketplaceAppActivationDestroyedRequestFromJSON,
         webhooks.sendVendorCreatedRequestFromJSON,
         webhooks.sendVendorUpdatedRequestFromJSON,
         webhooks.sendVendorDestroyedRequestFromJSON,

package/dist/commonjs/funcs/validateWebhook.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateWebhook.js","sourceRoot":"","sources":["../../../src/funcs/validateWebhook.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQH,0CAqEC;AA1ED,kFAA4E;AAC5E,sEAAwD;AACxD,0CAA6C;AAGtC,KAAK,UAAU,eAAe,CAAC,MAAyB,EAAE,EAC/D,OAAO,EAAE,UAAU,EACnB,MAAM,GASP;IAoBC,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,YAAY,GAAG;QACnB,QAAQ,CAAC,oCAAoC;QAC7C,QAAQ,CAAC,oCAAoC;QAC7C,QAAQ,CAAC,sCAAsC;QAC/C,QAAQ,CAAC,gCAAgC;QACzC,QAAQ,CAAC,gCAAgC;QACzC,QAAQ,CAAC,kCAAkC;QAC3C,QAAQ,CAAC,oDAAoD;QAC7D,QAAQ,CAAC,oDAAoD;QAC7D,QAAQ,CAAC,sDAAsD;QAC/D,QAAQ,CAAC,oCAAoC;QAC7C,QAAQ,CAAC,oCAAoC;QAC7C,QAAQ,CAAC,sCAAsC;QAC/C,QAAQ,CAAC,wCAAwC;QACjD,QAAQ,CAAC,wCAAwC;QACjD,QAAQ,CAAC,0CAA0C;KACpD,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IAED,OAAO,IAAA,WAAG,EACR,IAAI,0CAAkB,CACpB,wDAAwD,EACxD,UAAU,EACV,UAAU,CACX,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,OAKW;IAEX,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"validateWebhook.js","sourceRoot":"","sources":["../../../src/funcs/validateWebhook.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQH,0CA2EC;AAhFD,kFAA4E;AAC5E,sEAAwD;AACxD,0CAA6C;AAGtC,KAAK,UAAU,eAAe,CAAC,MAAyB,EAAE,EAC/D,OAAO,EAAE,UAAU,EACnB,MAAM,GASP;IAuBC,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,YAAY,GAAG;QACnB,QAAQ,CAAC,oCAAoC;QAC7C,QAAQ,CAAC,oCAAoC;QAC7C,QAAQ,CAAC,sCAAsC;QAC/C,QAAQ,CAAC,kDAAkD;QAC3D,QAAQ,CAAC,kDAAkD;QAC3D,QAAQ,CAAC,oDAAoD;QAC7D,QAAQ,CAAC,gCAAgC;QACzC,QAAQ,CAAC,gCAAgC;QACzC,QAAQ,CAAC,kCAAkC;QAC3C,QAAQ,CAAC,oDAAoD;QAC7D,QAAQ,CAAC,oDAAoD;QAC7D,QAAQ,CAAC,sDAAsD;QAC/D,QAAQ,CAAC,oCAAoC;QAC7C,QAAQ,CAAC,oCAAoC;QAC7C,QAAQ,CAAC,sCAAsC;QAC/C,QAAQ,CAAC,wCAAwC;QACjD,QAAQ,CAAC,wCAAwC;QACjD,QAAQ,CAAC,0CAA0C;KACpD,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IAED,OAAO,IAAA,WAAG,EACR,IAAI,0CAAkB,CACpB,wDAAwD,EACxD,UAAU,EACV,UAAU,CACX,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,OAKW;IAEX,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC"}

package/dist/commonjs/funcs/vendorsAddVendorManagedByCompany.d.ts

@@ -16,6 +16,9 @@ import { Result } from "../types/fp.js";
  * turned off. The company must be on the same site as the vendor. Otherwise, the API returns
  * `404`.
  *
+ * The company the vendor belongs to can't be added, because it already has full rights over the
+ * vendor. The API returns `400`, as it does for a company that already manages the vendor.
+ *
  * **Permissions.** Requires the `vendors.edit` permission. Only these callers can change which
  * companies manage the vendor: the vendor, a company manager at the company the vendor belongs to,
  * a Green Security administrator, or an app whose API token can update the vendor (an app