@greensecurity/javascript-sdk 0.46.0-beta.8 → 0.46.0-beta.9

package/dist/commonjs/models/components/marketplaceappactivationevent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketplaceappactivationevent.d.ts","sourceRoot":"","sources":["../../../../src/models/components/marketplaceappactivationevent.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EACL,gCAAgC,EAEhC,yCAAyC,EAE1C,MAAM,uCAAuC,CAAC;AAE/C;;GAEG;AACH,eAAO,MAAM,mCAAmC;;;;CAItC,CAAC;AACX;;GAEG;AACH,MAAM,MAAM,mCAAmC,GAAG,UAAU,CAC1D,OAAO,mCAAmC,CAC3C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,EAAE,gCAAgC,CAAC;IAC3C;;OAEG;IACH,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB;;OAEG;IACH,MAAM,EAAE,mCAAmC,CAAC;CAC7C,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,iDAAiD,EAAE,CAAC,CAAC,aAAa,CAC7E,OAAO,mCAAmC,CACS,CAAC;AACtD,gBAAgB;AAChB,eAAO,MAAM,kDAAkD,EAC7D,CAAC,CAAC,aAAa,CAAC,OAAO,mCAAmC,CACP,CAAC;AAEtD,gBAAgB;AAChB,eAAO,MAAM,2CAA2C,EAAE,CAAC,CAAC,OAAO,CACjE,6BAA6B,EAC7B,CAAC,CAAC,UAAU,EACZ,OAAO,CAWP,CAAC;AACH,gBAAgB;AAChB,MAAM,MAAM,sCAAsC,GAAG;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,yCAAyC,CAAC;IACpD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,4CAA4C,EAAE,CAAC,CAAC,OAAO,CAClE,sCAAsC,EACtC,CAAC,CAAC,UAAU,EACZ,6BAA6B,CAW7B,CAAC;AAEH,wBAAgB,mCAAmC,CACjD,6BAA6B,EAAE,6BAA6B,GAC3D,MAAM,CAMR;AACD,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,MAAM,GACjB,eAAe,CAAC,6BAA6B,EAAE,kBAAkB,CAAC,CAMpE"}

package/dist/commonjs/models/components/marketplaceappactivationevent.js

@@ -0,0 +1,89 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MarketplaceAppActivationEvent$outboundSchema = exports.MarketplaceAppActivationEvent$inboundSchema = exports.MarketplaceAppActivationEventAction$outboundSchema = exports.MarketplaceAppActivationEventAction$inboundSchema = exports.MarketplaceAppActivationEventAction = void 0;
+exports.marketplaceAppActivationEventToJSON = marketplaceAppActivationEventToJSON;
+exports.marketplaceAppActivationEventFromJSON = marketplaceAppActivationEventFromJSON;
+const z = __importStar(require("zod/v3"));
+const primitives_js_1 = require("../../lib/primitives.js");
+const schemas_js_1 = require("../../lib/schemas.js");
+const types = __importStar(require("../../types/primitives.js"));
+const marketplaceappactivationcoverage_js_1 = require("./marketplaceappactivationcoverage.js");
+/**
+ * What happened, the same action `Green-Security-Event` names.
+ */
+exports.MarketplaceAppActivationEventAction = {
+    Created: "created",
+    Updated: "updated",
+    Destroyed: "destroyed",
+};
+/** @internal */
+exports.MarketplaceAppActivationEventAction$inboundSchema = z.nativeEnum(exports.MarketplaceAppActivationEventAction);
+/** @internal */
+exports.MarketplaceAppActivationEventAction$outboundSchema = exports.MarketplaceAppActivationEventAction$inboundSchema;
+/** @internal */
+exports.MarketplaceAppActivationEvent$inboundSchema = z.object({
+    id: types.number(),
+    marketplace_app_id: types.number(),
+    coverage: marketplaceappactivationcoverage_js_1.MarketplaceAppActivationCoverage$inboundSchema,
+    created: types.nullable(types.date()),
+    action: exports.MarketplaceAppActivationEventAction$inboundSchema,
+}).transform((v) => {
+    return (0, primitives_js_1.remap)(v, {
+        "marketplace_app_id": "marketplaceAppId",
+    });
+});
+/** @internal */
+exports.MarketplaceAppActivationEvent$outboundSchema = z.object({
+    id: z.number().int(),
+    marketplaceAppId: z.number().int(),
+    coverage: marketplaceappactivationcoverage_js_1.MarketplaceAppActivationCoverage$outboundSchema,
+    created: z.nullable(z.date().transform(v => v.toISOString())),
+    action: exports.MarketplaceAppActivationEventAction$outboundSchema,
+}).transform((v) => {
+    return (0, primitives_js_1.remap)(v, {
+        marketplaceAppId: "marketplace_app_id",
+    });
+});
+function marketplaceAppActivationEventToJSON(marketplaceAppActivationEvent) {
+    return JSON.stringify(exports.MarketplaceAppActivationEvent$outboundSchema.parse(marketplaceAppActivationEvent));
+}
+function marketplaceAppActivationEventFromJSON(jsonString) {
+    return (0, schemas_js_1.safeParse)(jsonString, (x) => exports.MarketplaceAppActivationEvent$inboundSchema.parse(JSON.parse(x)), `Failed to parse 'MarketplaceAppActivationEvent' from JSON`);
+}
+//# sourceMappingURL=marketplaceappactivationevent.js.map

package/dist/commonjs/models/components/marketplaceappactivationevent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketplaceappactivationevent.js","sourceRoot":"","sources":["../../../../src/models/components/marketplaceappactivationevent.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoHH,kFAQC;AACD,sFAQC;AAnID,0CAA4B;AAC5B,2DAA0D;AAC1D,qDAAiD;AAGjD,iEAAmD;AAEnD,+FAK+C;AAE/C;;GAEG;AACU,QAAA,mCAAmC,GAAG;IACjD,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;CACd,CAAC;AA0CX,gBAAgB;AACH,QAAA,iDAAiD,GAE1D,CAAC,CAAC,UAAU,CAAC,2CAAmC,CAAC,CAAC;AACtD,gBAAgB;AACH,QAAA,kDAAkD,GAE3D,yDAAiD,CAAC;AAEtD,gBAAgB;AACH,QAAA,2CAA2C,GAIpD,CAAC,CAAC,MAAM,CAAC;IACX,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE;IAClB,kBAAkB,EAAE,KAAK,CAAC,MAAM,EAAE;IAClC,QAAQ,EAAE,oFAA8C;IACxD,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,EAAE,yDAAiD;CAC1D,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,IAAA,qBAAM,EAAC,CAAC,EAAE;QACf,oBAAoB,EAAE,kBAAkB;KACzC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAUH,gBAAgB;AACH,QAAA,4CAA4C,GAIrD,CAAC,CAAC,MAAM,CAAC;IACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAClC,QAAQ,EAAE,qFAA+C;IACzD,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7D,MAAM,EAAE,0DAAkD;CAC3D,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,IAAA,qBAAM,EAAC,CAAC,EAAE;QACf,gBAAgB,EAAE,oBAAoB;KACvC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAgB,mCAAmC,CACjD,6BAA4D;IAE5D,OAAO,IAAI,CAAC,SAAS,CACnB,oDAA4C,CAAC,KAAK,CAChD,6BAA6B,CAC9B,CACF,CAAC;AACJ,CAAC;AACD,SAAgB,qCAAqC,CACnD,UAAkB;IAElB,OAAO,IAAA,sBAAS,EACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,mDAA2C,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EACvE,2DAA2D,CAC5D,CAAC;AACJ,CAAC"}

package/dist/commonjs/models/components/oauthclientcredentialsgrant.d.ts

@@ -0,0 +1,73 @@
+import * as z from "zod/v3";
+/**
+ * A token for an API service account's own backend. Authenticate with either:
+ *
+ * @remarks
+ *
+ * - `client_id` (the service account's email) and `client_secret` (its permanent token)
+ *   in the body, always together; or
+ * - neither of them, and the service account's permanent token in the
+ *   `Authorization: Bearer` header. This is the only grant that reads `Authorization`,
+ *   and it accepts nothing but the permanent token there: a short-lived or narrowed
+ *   token, including one this grant issued, is `401` `invalid_client`.
+ *
+ * A locked service account is `401` `invalid_client` either way.
+ *
+ * What it issues depends on `activation_id`:
+ *
+ * - **Without `activation_id`**: a plain 15-minute API access token for the service
+ *   account, with no refresh token. The response has no `issued_token_type` and no
+ *   `activation_id`, and has `scope` only when the request sent one.
+ * - **With `activation_id`**: an app installation token (`gsi_`) narrowed to that
+ *   activation. The service account must be a marketplace app's, and the activation one
+ *   of that app's. This is how any app's backend acts on one installation, and the only
+ *   way a back-end-only app (a manifest with no `ui_extensions`) gets a token for one,
+ *   since the host never hands it user or installation tokens.
+ */
+export type OAuthClientCredentialsGrant = {
+    grantType: "client_credentials";
+    /**
+     * The service account's email. Send it with `client_secret`, or send neither and use `Authorization`.
+     */
+    clientId?: string | undefined;
+    /**
+     * The service account's permanent token. Send it with `client_id`, or send neither and use `Authorization`.
+     */
+    clientSecret?: string | undefined;
+    /**
+     * Optional. Asks for an app installation token narrowed to this activation of your app
+     *
+     * @remarks
+     * (`invalid_target` if it is not one). Leave it out for a plain API access token.
+     */
+    activationId?: number | undefined;
+    /**
+     * Optional, and only with `activation_id` (`invalid_request` without it). When given, it
+     *
+     * @remarks
+     * must name the activation's app as `app:<id>` (`invalid_target` otherwise).
+     */
+    audience?: string | undefined;
+    /**
+     * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+     *
+     * @remarks
+     * the device grant) to narrow the token to. Leave it out to get everything the client is
+     * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+     * is left the request fails with `invalid_scope`.
+     */
+    scope?: string | undefined;
+};
+/** @internal */
+export type OAuthClientCredentialsGrant$Outbound = {
+    grant_type: "client_credentials";
+    client_id?: string | undefined;
+    client_secret?: string | undefined;
+    activation_id?: number | undefined;
+    audience?: string | undefined;
+    scope?: string | undefined;
+};
+/** @internal */
+export declare const OAuthClientCredentialsGrant$outboundSchema: z.ZodType<OAuthClientCredentialsGrant$Outbound, z.ZodTypeDef, OAuthClientCredentialsGrant>;
+export declare function oAuthClientCredentialsGrantToJSON(oAuthClientCredentialsGrant: OAuthClientCredentialsGrant): string;
+//# sourceMappingURL=oauthclientcredentialsgrant.d.ts.map

package/dist/commonjs/models/components/oauthclientcredentialsgrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthclientcredentialsgrant.d.ts","sourceRoot":"","sources":["../../../../src/models/components/oauthclientcredentialsgrant.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,SAAS,EAAE,oBAAoB,CAAC;IAChC;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,gBAAgB;AAChB,MAAM,MAAM,oCAAoC,GAAG;IACjD,UAAU,EAAE,oBAAoB,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,0CAA0C,EAAE,CAAC,CAAC,OAAO,CAChE,oCAAoC,EACpC,CAAC,CAAC,UAAU,EACZ,2BAA2B,CAe3B,CAAC;AAEH,wBAAgB,iCAAiC,CAC/C,2BAA2B,EAAE,2BAA2B,GACvD,MAAM,CAMR"}

package/dist/commonjs/models/components/oauthclientcredentialsgrant.js

@@ -0,0 +1,62 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthClientCredentialsGrant$outboundSchema = void 0;
+exports.oAuthClientCredentialsGrantToJSON = oAuthClientCredentialsGrantToJSON;
+const z = __importStar(require("zod/v3"));
+const primitives_js_1 = require("../../lib/primitives.js");
+/** @internal */
+exports.OAuthClientCredentialsGrant$outboundSchema = z.object({
+    grantType: z.literal("client_credentials"),
+    clientId: z.string().optional(),
+    clientSecret: z.string().optional(),
+    activationId: z.number().int().optional(),
+    audience: z.string().optional(),
+    scope: z.string().optional(),
+}).transform((v) => {
+    return (0, primitives_js_1.remap)(v, {
+        grantType: "grant_type",
+        clientId: "client_id",
+        clientSecret: "client_secret",
+        activationId: "activation_id",
+    });
+});
+function oAuthClientCredentialsGrantToJSON(oAuthClientCredentialsGrant) {
+    return JSON.stringify(exports.OAuthClientCredentialsGrant$outboundSchema.parse(oAuthClientCredentialsGrant));
+}
+//# sourceMappingURL=oauthclientcredentialsgrant.js.map

package/dist/commonjs/models/components/oauthclientcredentialsgrant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthclientcredentialsgrant.js","sourceRoot":"","sources":["../../../../src/models/components/oauthclientcredentialsgrant.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgGH,8EAQC;AAtGD,0CAA4B;AAC5B,2DAA0D;AAwE1D,gBAAgB;AACH,QAAA,0CAA0C,GAInD,CAAC,CAAC,MAAM,CAAC;IACX,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,IAAA,qBAAM,EAAC,CAAC,EAAE;QACf,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,WAAW;QACrB,YAAY,EAAE,eAAe;QAC7B,YAAY,EAAE,eAAe;KAC9B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAgB,iCAAiC,CAC/C,2BAAwD;IAExD,OAAO,IAAI,CAAC,SAAS,CACnB,kDAA0C,CAAC,KAAK,CAC9C,2BAA2B,CAC5B,CACF,CAAC;AACJ,CAAC"}

package/dist/commonjs/models/components/oauthclirefreshtokengrant.d.ts

@@ -0,0 +1,57 @@
+import * as z from "zod/v3";
+/**
+ * The apps CLI's refresh, as the public client `greensecurity-apps-cli`: no
+ *
+ * @remarks
+ * `client_secret`, and `Authorization` is not read. The `gsdr_` refresh token is the
+ * credential. The response is a new `gsd_` developer token and a new `gsdr_` refresh
+ * token, in the device grant's shape.
+ *
+ * - **Rotation.** A refresh token works once. Refreshing spends it and revokes the
+ *   login's live developer token, so keep only the newest pair. `scope` can only narrow.
+ * - **Reuse detection.** Presenting a spent refresh token revokes every token of that
+ *   login (every token descended from one device authorization) and answers
+ *   `invalid_grant`. So does presenting a revoked one, or losing a race to spend one.
+ * - **Grace window.** One exception: a spent refresh token presented again within 30
+ *   seconds of being spent, while its direct replacement has been neither used nor
+ *   revoked, is taken as a retry after a lost response. It answers `200` with a fresh
+ *   pair, and the unused replacement pair is revoked.
+ * - **Lifetimes.** A refresh token expires after 30 days unused. A login ends 90 days
+ *   after its device authorization however often it is refreshed; tokens are issued
+ *   capped at that end, and a refresh past it is `invalid_grant`.
+ * - **Rate limit.** 60 refreshes per address per ten minutes, then `429` `slow_down`.
+ *
+ * Every `invalid_grant` here reads "Re-authenticate with `gs-apps login`.": start a new
+ * device login.
+ */
+export type OAuthCliRefreshTokenGrant = {
+    grantType: "refresh_token";
+    /**
+     * The `gsdr_` refresh token to spend.
+     */
+    refreshToken: string;
+    /**
+     * The apps CLI's public client id. Any other `client_id` with a `gsdr_` token is `401` `invalid_client`.
+     */
+    clientId: "greensecurity-apps-cli";
+    /**
+     * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+     *
+     * @remarks
+     * the device grant) to narrow the token to. Leave it out to get everything the client is
+     * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+     * is left the request fails with `invalid_scope`.
+     */
+    scope?: string | undefined;
+};
+/** @internal */
+export type OAuthCliRefreshTokenGrant$Outbound = {
+    grant_type: "refresh_token";
+    refresh_token: string;
+    client_id: "greensecurity-apps-cli";
+    scope?: string | undefined;
+};
+/** @internal */
+export declare const OAuthCliRefreshTokenGrant$outboundSchema: z.ZodType<OAuthCliRefreshTokenGrant$Outbound, z.ZodTypeDef, OAuthCliRefreshTokenGrant>;
+export declare function oAuthCliRefreshTokenGrantToJSON(oAuthCliRefreshTokenGrant: OAuthCliRefreshTokenGrant): string;
+//# sourceMappingURL=oauthclirefreshtokengrant.d.ts.map

package/dist/commonjs/models/components/oauthclirefreshtokengrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthclirefreshtokengrant.d.ts","sourceRoot":"","sources":["../../../../src/models/components/oauthclirefreshtokengrant.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,eAAe,CAAC;IAC3B;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,QAAQ,EAAE,wBAAwB,CAAC;IACnC;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,gBAAgB;AAChB,MAAM,MAAM,kCAAkC,GAAG;IAC/C,UAAU,EAAE,eAAe,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,wBAAwB,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,wCAAwC,EAAE,CAAC,CAAC,OAAO,CAC9D,kCAAkC,EAClC,CAAC,CAAC,UAAU,EACZ,yBAAyB,CAYzB,CAAC;AAEH,wBAAgB,+BAA+B,CAC7C,yBAAyB,EAAE,yBAAyB,GACnD,MAAM,CAIR"}

package/dist/commonjs/models/components/oauthclirefreshtokengrant.js

@@ -0,0 +1,59 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthCliRefreshTokenGrant$outboundSchema = void 0;
+exports.oAuthCliRefreshTokenGrantToJSON = oAuthCliRefreshTokenGrantToJSON;
+const z = __importStar(require("zod/v3"));
+const primitives_js_1 = require("../../lib/primitives.js");
+/** @internal */
+exports.OAuthCliRefreshTokenGrant$outboundSchema = z.object({
+    grantType: z.literal("refresh_token"),
+    refreshToken: z.string(),
+    clientId: z.literal("greensecurity-apps-cli"),
+    scope: z.string().optional(),
+}).transform((v) => {
+    return (0, primitives_js_1.remap)(v, {
+        grantType: "grant_type",
+        refreshToken: "refresh_token",
+        clientId: "client_id",
+    });
+});
+function oAuthCliRefreshTokenGrantToJSON(oAuthCliRefreshTokenGrant) {
+    return JSON.stringify(exports.OAuthCliRefreshTokenGrant$outboundSchema.parse(oAuthCliRefreshTokenGrant));
+}
+//# sourceMappingURL=oauthclirefreshtokengrant.js.map

package/dist/commonjs/models/components/oauthclirefreshtokengrant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthclirefreshtokengrant.js","sourceRoot":"","sources":["../../../../src/models/components/oauthclirefreshtokengrant.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6EH,0EAMC;AAjFD,0CAA4B;AAC5B,2DAA0D;AAwD1D,gBAAgB;AACH,QAAA,wCAAwC,GAIjD,CAAC,CAAC,MAAM,CAAC;IACX,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,IAAA,qBAAM,EAAC,CAAC,EAAE;QACf,SAAS,EAAE,YAAY;QACvB,YAAY,EAAE,eAAe;QAC7B,QAAQ,EAAE,WAAW;KACtB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAgB,+BAA+B,CAC7C,yBAAoD;IAEpD,OAAO,IAAI,CAAC,SAAS,CACnB,gDAAwC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAC1E,CAAC;AACJ,CAAC"}

package/dist/commonjs/models/components/oauthdevicecodegrant.d.ts

@@ -0,0 +1,44 @@
+import * as z from "zod/v3";
+/**
+ * RFC 8628 device authorization, used by `apps-cli login`. Poll with the `device_code`
+ *
+ * @remarks
+ * from `POST /oauth/device_authorization` at the returned `interval` until the user
+ * approves; the result is a 15-minute developer CLI token (`gsd_`) and a `gsdr_` refresh
+ * token that renews it (see `OAuthCliRefreshTokenGrant`). The device authorization starts
+ * the login's 90-day limit. Until then each poll is answered with a
+ * `400` `OAuthError` whose `error` is `authorization_pending` (keep polling), `slow_down`
+ * (add 5 seconds to the interval), `access_denied` (the user declined; stop) or
+ * `expired_token` (start again). `Authorization` is not read.
+ */
+export type OAuthDeviceCodeGrant = {
+    grantType: "urn:ietf:params:oauth:grant-type:device_code";
+    /**
+     * The `device_code` returned by `POST /oauth/device_authorization`.
+     */
+    deviceCode: string;
+    /**
+     * The client that started the flow. `greensecurity-apps-cli` is the only registered client.
+     */
+    clientId: string;
+    /**
+     * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+     *
+     * @remarks
+     * the device grant) to narrow the token to. Leave it out to get everything the client is
+     * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+     * is left the request fails with `invalid_scope`.
+     */
+    scope?: string | undefined;
+};
+/** @internal */
+export type OAuthDeviceCodeGrant$Outbound = {
+    grant_type: "urn:ietf:params:oauth:grant-type:device_code";
+    device_code: string;
+    client_id: string;
+    scope?: string | undefined;
+};
+/** @internal */
+export declare const OAuthDeviceCodeGrant$outboundSchema: z.ZodType<OAuthDeviceCodeGrant$Outbound, z.ZodTypeDef, OAuthDeviceCodeGrant>;
+export declare function oAuthDeviceCodeGrantToJSON(oAuthDeviceCodeGrant: OAuthDeviceCodeGrant): string;
+//# sourceMappingURL=oauthdevicecodegrant.d.ts.map

package/dist/commonjs/models/components/oauthdevicecodegrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthdevicecodegrant.d.ts","sourceRoot":"","sources":["../../../../src/models/components/oauthdevicecodegrant.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,8CAA8C,CAAC;IAC1D;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,gBAAgB;AAChB,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,8CAA8C,CAAC;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,mCAAmC,EAAE,CAAC,CAAC,OAAO,CACzD,6BAA6B,EAC7B,CAAC,CAAC,UAAU,EACZ,oBAAoB,CAYpB,CAAC;AAEH,wBAAgB,0BAA0B,CACxC,oBAAoB,EAAE,oBAAoB,GACzC,MAAM,CAIR"}

package/dist/commonjs/models/components/oauthdevicecodegrant.js

@@ -0,0 +1,59 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthDeviceCodeGrant$outboundSchema = void 0;
+exports.oAuthDeviceCodeGrantToJSON = oAuthDeviceCodeGrantToJSON;
+const z = __importStar(require("zod/v3"));
+const primitives_js_1 = require("../../lib/primitives.js");
+/** @internal */
+exports.OAuthDeviceCodeGrant$outboundSchema = z.object({
+    grantType: z.literal("urn:ietf:params:oauth:grant-type:device_code"),
+    deviceCode: z.string(),
+    clientId: z.string(),
+    scope: z.string().optional(),
+}).transform((v) => {
+    return (0, primitives_js_1.remap)(v, {
+        grantType: "grant_type",
+        deviceCode: "device_code",
+        clientId: "client_id",
+    });
+});
+function oAuthDeviceCodeGrantToJSON(oAuthDeviceCodeGrant) {
+    return JSON.stringify(exports.OAuthDeviceCodeGrant$outboundSchema.parse(oAuthDeviceCodeGrant));
+}
+//# sourceMappingURL=oauthdevicecodegrant.js.map

package/dist/commonjs/models/components/oauthdevicecodegrant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthdevicecodegrant.js","sourceRoot":"","sources":["../../../../src/models/components/oauthdevicecodegrant.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgEH,gEAMC;AApED,0CAA4B;AAC5B,2DAA0D;AA2C1D,gBAAgB;AACH,QAAA,mCAAmC,GAI5C,CAAC,CAAC,MAAM,CAAC;IACX,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC;IACpE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,IAAA,qBAAM,EAAC,CAAC,EAAE;QACf,SAAS,EAAE,YAAY;QACvB,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,WAAW;KACtB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAgB,0BAA0B,CACxC,oBAA0C;IAE1C,OAAO,IAAI,CAAC,SAAS,CACnB,2CAAmC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAChE,CAAC;AACJ,CAAC"}

package/dist/commonjs/models/components/oautherrorcode.d.ts

@@ -0,0 +1,57 @@
+import * as z from "zod/v3";
+import { OpenEnum } from "../../types/enums.js";
+/**
+ * The RFC error code:
+ *
+ * @remarks
+ *
+ * | Code | Meaning |
+ * | --- | --- |
+ * | `invalid_request` | A parameter is missing or malformed (including `client_id` without `client_secret` or the reverse), an OAuth parameter was sent in the query string rather than the body, the body could not be parsed, or more than one activation covers the user and `activation_id` was left out. |
+ * | `invalid_client` | The client could not be authenticated. Returned with `401`. On the apps CLI's `refresh_token` (a `gsdr_` token): a `client_id` other than `greensecurity-apps-cli`. On `client_credentials`: wrong `client_id` or `client_secret`; an `Authorization` token that is missing, invalid, or not the service account's permanent token (a short-lived, narrowed or app token is refused); or a locked service account. On `refresh_token`: `client_id` or `client_secret` does not match the refresh token's service account, or that account is locked. On the device grant and `POST /oauth/device_authorization`: an unknown `client_id`. On `POST /oauth/introspect` and `POST /oauth/revoke`: see each endpoint. |
+ * | `invalid_grant` | `subject_token` is invalid or expired, is an app token or a narrowed (scoped) token, or belongs to a locked user or a service account; `refresh_token` is unknown, expired, already used or not a service account's; an apps CLI refresh token is unknown, expired, revoked or reused, its login is past 90 days, or its developer is locked or deleted (all answered "Re-authenticate with `gs-apps login`."); or `device_code` is unknown or already used, or the user who approved it can no longer sign in. |
+ * | `unauthorized_client` | The caller may not use this grant: `client_credentials` from a user who is not an API service account. |
+ * | `unsupported_grant_type` | `grant_type` is not one of the four supported grants. |
+ * | `invalid_target` | `audience` names no app, or an app the user is not covered by; or `activation_id` is not an activation of the caller's app, or does not match `audience`. |
+ * | `invalid_scope` | None of the requested scopes is available to the client: what it asked for and what it is allowed have nothing in common. On `POST /oauth/device_authorization`, any scope other than `apps:develop`. |
+ * | `authorization_pending` | Device flow: the user has not approved the request yet. Keep polling. |
+ * | `slow_down` | Device flow: polling too fast. Add 5 seconds to the interval and keep polling. `POST /oauth/device_authorization` also returns it, with `429`, when one address starts too many logins, and so does the apps CLI's `refresh_token` past 60 refreshes per address in ten minutes. Wait and retry; it is not a failed login. |
+ * | `access_denied` | Device flow: the user declined the request. Stop polling. |
+ * | `expired_token` | Device flow: `device_code` expired. Start again from `POST /oauth/device_authorization`. |
+ */
+export declare const OAuthErrorCode: {
+    readonly InvalidRequest: "invalid_request";
+    readonly InvalidClient: "invalid_client";
+    readonly InvalidGrant: "invalid_grant";
+    readonly UnauthorizedClient: "unauthorized_client";
+    readonly UnsupportedGrantType: "unsupported_grant_type";
+    readonly InvalidTarget: "invalid_target";
+    readonly InvalidScope: "invalid_scope";
+    readonly AuthorizationPending: "authorization_pending";
+    readonly SlowDown: "slow_down";
+    readonly AccessDenied: "access_denied";
+    readonly ExpiredToken: "expired_token";
+};
+/**
+ * The RFC error code:
+ *
+ * @remarks
+ *
+ * | Code | Meaning |
+ * | --- | --- |
+ * | `invalid_request` | A parameter is missing or malformed (including `client_id` without `client_secret` or the reverse), an OAuth parameter was sent in the query string rather than the body, the body could not be parsed, or more than one activation covers the user and `activation_id` was left out. |
+ * | `invalid_client` | The client could not be authenticated. Returned with `401`. On the apps CLI's `refresh_token` (a `gsdr_` token): a `client_id` other than `greensecurity-apps-cli`. On `client_credentials`: wrong `client_id` or `client_secret`; an `Authorization` token that is missing, invalid, or not the service account's permanent token (a short-lived, narrowed or app token is refused); or a locked service account. On `refresh_token`: `client_id` or `client_secret` does not match the refresh token's service account, or that account is locked. On the device grant and `POST /oauth/device_authorization`: an unknown `client_id`. On `POST /oauth/introspect` and `POST /oauth/revoke`: see each endpoint. |
+ * | `invalid_grant` | `subject_token` is invalid or expired, is an app token or a narrowed (scoped) token, or belongs to a locked user or a service account; `refresh_token` is unknown, expired, already used or not a service account's; an apps CLI refresh token is unknown, expired, revoked or reused, its login is past 90 days, or its developer is locked or deleted (all answered "Re-authenticate with `gs-apps login`."); or `device_code` is unknown or already used, or the user who approved it can no longer sign in. |
+ * | `unauthorized_client` | The caller may not use this grant: `client_credentials` from a user who is not an API service account. |
+ * | `unsupported_grant_type` | `grant_type` is not one of the four supported grants. |
+ * | `invalid_target` | `audience` names no app, or an app the user is not covered by; or `activation_id` is not an activation of the caller's app, or does not match `audience`. |
+ * | `invalid_scope` | None of the requested scopes is available to the client: what it asked for and what it is allowed have nothing in common. On `POST /oauth/device_authorization`, any scope other than `apps:develop`. |
+ * | `authorization_pending` | Device flow: the user has not approved the request yet. Keep polling. |
+ * | `slow_down` | Device flow: polling too fast. Add 5 seconds to the interval and keep polling. `POST /oauth/device_authorization` also returns it, with `429`, when one address starts too many logins, and so does the apps CLI's `refresh_token` past 60 refreshes per address in ten minutes. Wait and retry; it is not a failed login. |
+ * | `access_denied` | Device flow: the user declined the request. Stop polling. |
+ * | `expired_token` | Device flow: `device_code` expired. Start again from `POST /oauth/device_authorization`. |
+ */
+export type OAuthErrorCode = OpenEnum<typeof OAuthErrorCode>;
+/** @internal */
+export declare const OAuthErrorCode$inboundSchema: z.ZodType<OAuthErrorCode, z.ZodTypeDef, unknown>;
+//# sourceMappingURL=oautherrorcode.d.ts.map

package/dist/commonjs/models/components/oautherrorcode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oautherrorcode.d.ts","sourceRoot":"","sources":["../../../../src/models/components/oautherrorcode.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;CAYjB,CAAC;AACX;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,cAAc,CAAC,CAAC;AAE7D,gBAAgB;AAChB,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,OAAO,CAClD,cAAc,EACd,CAAC,CAAC,UAAU,EACZ,OAAO,CACkC,CAAC"}

package/dist/commonjs/models/components/oautherrorcode.js

@@ -0,0 +1,75 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthErrorCode$inboundSchema = exports.OAuthErrorCode = void 0;
+const openEnums = __importStar(require("../../types/enums.js"));
+/**
+ * The RFC error code:
+ *
+ * @remarks
+ *
+ * | Code | Meaning |
+ * | --- | --- |
+ * | `invalid_request` | A parameter is missing or malformed (including `client_id` without `client_secret` or the reverse), an OAuth parameter was sent in the query string rather than the body, the body could not be parsed, or more than one activation covers the user and `activation_id` was left out. |
+ * | `invalid_client` | The client could not be authenticated. Returned with `401`. On the apps CLI's `refresh_token` (a `gsdr_` token): a `client_id` other than `greensecurity-apps-cli`. On `client_credentials`: wrong `client_id` or `client_secret`; an `Authorization` token that is missing, invalid, or not the service account's permanent token (a short-lived, narrowed or app token is refused); or a locked service account. On `refresh_token`: `client_id` or `client_secret` does not match the refresh token's service account, or that account is locked. On the device grant and `POST /oauth/device_authorization`: an unknown `client_id`. On `POST /oauth/introspect` and `POST /oauth/revoke`: see each endpoint. |
+ * | `invalid_grant` | `subject_token` is invalid or expired, is an app token or a narrowed (scoped) token, or belongs to a locked user or a service account; `refresh_token` is unknown, expired, already used or not a service account's; an apps CLI refresh token is unknown, expired, revoked or reused, its login is past 90 days, or its developer is locked or deleted (all answered "Re-authenticate with `gs-apps login`."); or `device_code` is unknown or already used, or the user who approved it can no longer sign in. |
+ * | `unauthorized_client` | The caller may not use this grant: `client_credentials` from a user who is not an API service account. |
+ * | `unsupported_grant_type` | `grant_type` is not one of the four supported grants. |
+ * | `invalid_target` | `audience` names no app, or an app the user is not covered by; or `activation_id` is not an activation of the caller's app, or does not match `audience`. |
+ * | `invalid_scope` | None of the requested scopes is available to the client: what it asked for and what it is allowed have nothing in common. On `POST /oauth/device_authorization`, any scope other than `apps:develop`. |
+ * | `authorization_pending` | Device flow: the user has not approved the request yet. Keep polling. |
+ * | `slow_down` | Device flow: polling too fast. Add 5 seconds to the interval and keep polling. `POST /oauth/device_authorization` also returns it, with `429`, when one address starts too many logins, and so does the apps CLI's `refresh_token` past 60 refreshes per address in ten minutes. Wait and retry; it is not a failed login. |
+ * | `access_denied` | Device flow: the user declined the request. Stop polling. |
+ * | `expired_token` | Device flow: `device_code` expired. Start again from `POST /oauth/device_authorization`. |
+ */
+exports.OAuthErrorCode = {
+    InvalidRequest: "invalid_request",
+    InvalidClient: "invalid_client",
+    InvalidGrant: "invalid_grant",
+    UnauthorizedClient: "unauthorized_client",
+    UnsupportedGrantType: "unsupported_grant_type",
+    InvalidTarget: "invalid_target",
+    InvalidScope: "invalid_scope",
+    AuthorizationPending: "authorization_pending",
+    SlowDown: "slow_down",
+    AccessDenied: "access_denied",
+    ExpiredToken: "expired_token",
+};
+/** @internal */
+exports.OAuthErrorCode$inboundSchema = openEnums.inboundSchema(exports.OAuthErrorCode);
+//# sourceMappingURL=oautherrorcode.js.map

package/dist/commonjs/models/components/oautherrorcode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oautherrorcode.js","sourceRoot":"","sources":["../../../../src/models/components/oautherrorcode.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGH,gEAAkD;AAGlD;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,cAAc,GAAG;IAC5B,cAAc,EAAE,iBAAiB;IACjC,aAAa,EAAE,gBAAgB;IAC/B,YAAY,EAAE,eAAe;IAC7B,kBAAkB,EAAE,qBAAqB;IACzC,oBAAoB,EAAE,wBAAwB;IAC9C,aAAa,EAAE,gBAAgB;IAC/B,YAAY,EAAE,eAAe;IAC7B,oBAAoB,EAAE,uBAAuB;IAC7C,QAAQ,EAAE,WAAW;IACrB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;CACrB,CAAC;AAsBX,gBAAgB;AACH,QAAA,4BAA4B,GAIrC,SAAS,CAAC,aAAa,CAAC,sBAAc,CAAC,CAAC"}