@greensecurity/javascript-sdk 0.46.0-beta.8 → 0.46.0-beta.9

package/dist/commonjs/react-query/oauthCreateDeviceAuthorization.d.ts

@@ -0,0 +1,45 @@
+import { MutationKey, UseMutationResult } from "@tanstack/react-query";
+import { GreenSecurityCore } from "../core.js";
+import { RequestOptions } from "../lib/sdks.js";
+import * as components from "../models/components/index.js";
+import { GreenSecurityError } from "../models/errors/greensecurityerror.js";
+import { ConnectionError, InvalidRequestError, RequestAbortedError, RequestTimeoutError, UnexpectedClientError } from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import { MutationHookOptions } from "./_types.js";
+export type OauthCreateDeviceAuthorizationMutationVariables = {
+    request: components.DeviceAuthorizationRequest;
+    options?: RequestOptions;
+};
+export type OauthCreateDeviceAuthorizationMutationData = components.DeviceAuthorizationResponse;
+export type OauthCreateDeviceAuthorizationMutationError = errors.OAuthError | GreenSecurityError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError;
+/**
+ * Start a device login
+ *
+ * @remarks
+ * Starts the RFC 8628 device authorization flow that `apps-cli login` uses:
+ *
+ * 1. Call this endpoint and show the user `user_code`, or open `verification_uri_complete`.
+ * 2. The user approves the request in the Green Security app, signed in as themselves.
+ * 3. Meanwhile, poll `POST /oauth/token` with
+ *    `grant_type=urn:ietf:params:oauth:grant-type:device_code` every `interval` seconds.
+ *    It answers `authorization_pending` until the user approves, and then returns a
+ *    15-minute developer CLI token and a refresh token that renews it, for up to 90 days.
+ *
+ * The codes expire after `expires_in` seconds. Each address may start 20 logins per ten
+ * minutes; past that the endpoint answers `429` with `slow_down`. The request body may be
+ * JSON or `application/x-www-form-urlencoded`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** No authentication required.
+ */
+export declare function useOauthCreateDeviceAuthorizationMutation(options?: MutationHookOptions<OauthCreateDeviceAuthorizationMutationData, OauthCreateDeviceAuthorizationMutationError, OauthCreateDeviceAuthorizationMutationVariables>): UseMutationResult<OauthCreateDeviceAuthorizationMutationData, OauthCreateDeviceAuthorizationMutationError, OauthCreateDeviceAuthorizationMutationVariables>;
+export declare function mutationKeyOauthCreateDeviceAuthorization(): MutationKey;
+export declare function buildOauthCreateDeviceAuthorizationMutation(client$: GreenSecurityCore, hookOptions?: RequestOptions): {
+    mutationKey: MutationKey;
+    mutationFn: (variables: OauthCreateDeviceAuthorizationMutationVariables) => Promise<OauthCreateDeviceAuthorizationMutationData>;
+};
+//# sourceMappingURL=oauthCreateDeviceAuthorization.d.ts.map

package/dist/commonjs/react-query/oauthCreateDeviceAuthorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthCreateDeviceAuthorization.d.ts","sourceRoot":"","sources":["../../../src/react-query/oauthCreateDeviceAuthorization.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,WAAW,EAEX,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAG5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,MAAM,+CAA+C,GAAG;IAC5D,OAAO,EAAE,UAAU,CAAC,0BAA0B,CAAC;IAC/C,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,0CAA0C,GACpD,UAAU,CAAC,2BAA2B,CAAC;AAEzC,MAAM,MAAM,2CAA2C,GACnD,MAAM,CAAC,UAAU,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,CAAC;AAEvB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yCAAyC,CACvD,OAAO,CAAC,EAAE,mBAAmB,CAC3B,0CAA0C,EAC1C,2CAA2C,EAC3C,+CAA+C,CAChD,GACA,iBAAiB,CAClB,0CAA0C,EAC1C,2CAA2C,EAC3C,+CAA+C,CAChD,CAMA;AAED,wBAAgB,yCAAyC,IAAI,WAAW,CAMvE;AAED,wBAAgB,2CAA2C,CACzD,OAAO,EAAE,iBAAiB,EAC1B,WAAW,CAAC,EAAE,cAAc,GAC3B;IACD,WAAW,EAAE,WAAW,CAAC;IACzB,UAAU,EAAE,CACV,SAAS,EAAE,+CAA+C,KACvD,OAAO,CAAC,0CAA0C,CAAC,CAAC;CAC1D,CA0BA"}

package/dist/commonjs/react-query/oauthCreateDeviceAuthorization.js

@@ -0,0 +1,67 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useOauthCreateDeviceAuthorizationMutation = useOauthCreateDeviceAuthorizationMutation;
+exports.mutationKeyOauthCreateDeviceAuthorization = mutationKeyOauthCreateDeviceAuthorization;
+exports.buildOauthCreateDeviceAuthorizationMutation = buildOauthCreateDeviceAuthorizationMutation;
+const react_query_1 = require("@tanstack/react-query");
+const oauthCreateDeviceAuthorization_js_1 = require("../funcs/oauthCreateDeviceAuthorization.js");
+const primitives_js_1 = require("../lib/primitives.js");
+const fp_js_1 = require("../types/fp.js");
+const _context_js_1 = require("./_context.js");
+/**
+ * Start a device login
+ *
+ * @remarks
+ * Starts the RFC 8628 device authorization flow that `apps-cli login` uses:
+ *
+ * 1. Call this endpoint and show the user `user_code`, or open `verification_uri_complete`.
+ * 2. The user approves the request in the Green Security app, signed in as themselves.
+ * 3. Meanwhile, poll `POST /oauth/token` with
+ *    `grant_type=urn:ietf:params:oauth:grant-type:device_code` every `interval` seconds.
+ *    It answers `authorization_pending` until the user approves, and then returns a
+ *    15-minute developer CLI token and a refresh token that renews it, for up to 90 days.
+ *
+ * The codes expire after `expires_in` seconds. Each address may start 20 logins per ten
+ * minutes; past that the endpoint answers `429` with `slow_down`. The request body may be
+ * JSON or `application/x-www-form-urlencoded`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** No authentication required.
+ */
+function useOauthCreateDeviceAuthorizationMutation(options) {
+    const client = (0, _context_js_1.useGreenSecurityContext)();
+    return (0, react_query_1.useMutation)({
+        ...buildOauthCreateDeviceAuthorizationMutation(client, options),
+        ...options,
+    });
+}
+function mutationKeyOauthCreateDeviceAuthorization() {
+    return [
+        "@greensecurity/javascript-sdk",
+        "oauth",
+        "createDeviceAuthorization",
+    ];
+}
+function buildOauthCreateDeviceAuthorizationMutation(client$, hookOptions) {
+    return {
+        mutationKey: mutationKeyOauthCreateDeviceAuthorization(),
+        mutationFn: function oauthCreateDeviceAuthorizationMutationFn({ request, options, }) {
+            const mergedOptions = {
+                ...hookOptions,
+                ...options,
+                fetchOptions: {
+                    ...hookOptions?.fetchOptions,
+                    ...options?.fetchOptions,
+                    signal: (0, primitives_js_1.combineSignals)(hookOptions?.fetchOptions?.signal, options?.fetchOptions?.signal),
+                },
+            };
+            return (0, fp_js_1.unwrapAsync)((0, oauthCreateDeviceAuthorization_js_1.oauthCreateDeviceAuthorization)(client$, request, mergedOptions));
+        },
+    };
+}
+//# sourceMappingURL=oauthCreateDeviceAuthorization.js.map

package/dist/commonjs/react-query/oauthCreateDeviceAuthorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthCreateDeviceAuthorization.js","sourceRoot":"","sources":["../../../src/react-query/oauthCreateDeviceAuthorization.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAoEH,8FAgBC;AAED,8FAMC;AAED,kGAkCC;AA9HD,uDAI+B;AAE/B,kGAA4F;AAC5F,wDAAsD;AActD,0CAA6C;AAC7C,+CAAwD;AAsBxD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAgB,yCAAyC,CACvD,OAIC;IAMD,MAAM,MAAM,GAAG,IAAA,qCAAuB,GAAE,CAAC;IACzC,OAAO,IAAA,yBAAW,EAAC;QACjB,GAAG,2CAA2C,CAAC,MAAM,EAAE,OAAO,CAAC;QAC/D,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,yCAAyC;IACvD,OAAO;QACL,+BAA+B;QAC/B,OAAO;QACP,2BAA2B;KAC5B,CAAC;AACJ,CAAC;AAED,SAAgB,2CAA2C,CACzD,OAA0B,EAC1B,WAA4B;IAO5B,OAAO;QACL,WAAW,EAAE,yCAAyC,EAAE;QACxD,UAAU,EAAE,SAAS,wCAAwC,CAAC,EAC5D,OAAO,EACP,OAAO,GACR;YACC,MAAM,aAAa,GAAG;gBACpB,GAAG,WAAW;gBACd,GAAG,OAAO;gBACV,YAAY,EAAE;oBACZ,GAAG,WAAW,EAAE,YAAY;oBAC5B,GAAG,OAAO,EAAE,YAAY;oBACxB,MAAM,EAAE,IAAA,8BAAc,EACpB,WAAW,EAAE,YAAY,EAAE,MAAM,EACjC,OAAO,EAAE,YAAY,EAAE,MAAM,CAC9B;iBACF;aACF,CAAC;YACF,OAAO,IAAA,mBAAW,EAAC,IAAA,kEAA8B,EAC/C,OAAO,EACP,OAAO,EACP,aAAa,CACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/commonjs/react-query/oauthCreateToken.d.ts

@@ -0,0 +1,76 @@
+import { MutationKey, UseMutationResult } from "@tanstack/react-query";
+import { GreenSecurityCore } from "../core.js";
+import { RequestOptions } from "../lib/sdks.js";
+import * as components from "../models/components/index.js";
+import { GreenSecurityError } from "../models/errors/greensecurityerror.js";
+import { ConnectionError, InvalidRequestError, RequestAbortedError, RequestTimeoutError, UnexpectedClientError } from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import { MutationHookOptions } from "./_types.js";
+export type OauthCreateTokenMutationVariables = {
+    request: components.OAuthTokenRequest;
+    options?: RequestOptions;
+};
+export type OauthCreateTokenMutationData = components.TokenResponse;
+export type OauthCreateTokenMutationError = errors.OAuthError | GreenSecurityError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError;
+/**
+ * Issue an access, app or developer token
+ *
+ * @remarks
+ * The OAuth 2.0 token endpoint. It issues four kinds of short-lived token, chosen by
+ * `grant_type`:
+ *
+ * | Grant | Authenticate with | Issues |
+ * | --- | --- | --- |
+ * | `urn:ietf:params:oauth:grant-type:token-exchange` | The user's session token, as `subject_token` | An app user token (`gsu_`) or an app installation token (`gsi_`), 15 minutes |
+ * | `client_credentials` with `activation_id` | The app service account's `client_id` and `client_secret`, or its permanent token as `Authorization: Bearer` | An app installation token (`gsi_`), 15 minutes |
+ * | `client_credentials` without `activation_id` | An API service account's `client_id` and `client_secret`, or its permanent token as `Authorization: Bearer` | A plain API access token, 15 minutes |
+ * | `refresh_token` (service account) | The service account's `client_id` and `client_secret`, and a `refresh_token` | A plain API access token, 15 minutes, and a new refresh token |
+ * | `refresh_token` (apps CLI) | A `gsdr_` refresh token and `client_id=greensecurity-apps-cli`, no secret | A new developer CLI token (`gsd_`), 15 minutes, and a new `gsdr_` refresh token |
+ * | `urn:ietf:params:oauth:grant-type:device_code` | The `device_code` from `POST /oauth/device_authorization` | A developer CLI token (`gsd_`), 15 minutes, and a `gsdr_` refresh token |
+ *
+ * Token exchange is what the Green Security app does when it opens an app's views: the user
+ * must be covered by an activation of the app named in `audience`. `client_credentials` with
+ * `activation_id` is for the app's own backend. Without `activation_id`, `client_credentials`
+ * and a service account's `refresh_token` are the API service account flows: the response is
+ * a plain access token with no `issued_token_type` and no `activation_id` (see
+ * `TokenResponse`). An app token can never be used to obtain another token.
+ *
+ * The apps CLI logs in with the device grant and then renews its 15-minute developer token
+ * with the public-client `refresh_token` grant. Refresh tokens rotate and are single-use;
+ * presenting a spent one revokes the whole login, except for a retry within 30 seconds whose
+ * replacement is still unused. A login lasts at most 90 days from its device authorization.
+ * See `OAuthCliRefreshTokenGrant`.
+ *
+ * Every grant takes an optional `scope`, which can only narrow the token: it gets what was
+ * requested intersected with what the client is allowed, and if that is empty the request
+ * fails with `invalid_scope`. A refreshed token is never wider than the one it replaces.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`, and every parameter
+ * must be in the body: one sent in the query string is refused with `invalid_request`. Errors
+ * follow RFC 6749 and use `OAuthError` rather than the usual error envelope, including a
+ * body that fails validation (`400` `invalid_request`, never `422`). For the device grant,
+ * `authorization_pending` and `slow_down` mean "poll again later", not failure.
+ *
+ * Only `client_credentials` reads `Authorization`, and only when the body carries neither
+ * `client_id` nor `client_secret`. It accepts only the service account's permanent token
+ * there: a short-lived token (including one this endpoint issued), a narrowed token or an app
+ * token (`gsu_`, `gsi_`, `gsd_`) is answered `401` `invalid_client`, so a token can never be
+ * renewed or widened by presenting it. The other grants ignore the header.
+ *
+ * A narrowed `subject_token` is refused with `invalid_grant`, and a locked service account
+ * gets `401` `invalid_client` on `client_credentials` and `refresh_token`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** No named permission.
+ */
+export declare function useOauthCreateTokenMutation(options?: MutationHookOptions<OauthCreateTokenMutationData, OauthCreateTokenMutationError, OauthCreateTokenMutationVariables>): UseMutationResult<OauthCreateTokenMutationData, OauthCreateTokenMutationError, OauthCreateTokenMutationVariables>;
+export declare function mutationKeyOauthCreateToken(): MutationKey;
+export declare function buildOauthCreateTokenMutation(client$: GreenSecurityCore, hookOptions?: RequestOptions): {
+    mutationKey: MutationKey;
+    mutationFn: (variables: OauthCreateTokenMutationVariables) => Promise<OauthCreateTokenMutationData>;
+};
+//# sourceMappingURL=oauthCreateToken.d.ts.map

package/dist/commonjs/react-query/oauthCreateToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthCreateToken.d.ts","sourceRoot":"","sources":["../../../src/react-query/oauthCreateToken.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,WAAW,EAEX,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAG5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,MAAM,iCAAiC,GAAG;IAC9C,OAAO,EAAE,UAAU,CAAC,iBAAiB,CAAC;IACtC,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,UAAU,CAAC,aAAa,CAAC;AAEpE,MAAM,MAAM,6BAA6B,GACrC,MAAM,CAAC,UAAU,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,CAAC;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,CAAC,EAAE,mBAAmB,CAC3B,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,CAClC,GACA,iBAAiB,CAClB,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,CAClC,CAMA;AAED,wBAAgB,2BAA2B,IAAI,WAAW,CAEzD;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,iBAAiB,EAC1B,WAAW,CAAC,EAAE,cAAc,GAC3B;IACD,WAAW,EAAE,WAAW,CAAC;IACzB,UAAU,EAAE,CACV,SAAS,EAAE,iCAAiC,KACzC,OAAO,CAAC,4BAA4B,CAAC,CAAC;CAC5C,CA0BA"}

package/dist/commonjs/react-query/oauthCreateToken.js

@@ -0,0 +1,94 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useOauthCreateTokenMutation = useOauthCreateTokenMutation;
+exports.mutationKeyOauthCreateToken = mutationKeyOauthCreateToken;
+exports.buildOauthCreateTokenMutation = buildOauthCreateTokenMutation;
+const react_query_1 = require("@tanstack/react-query");
+const oauthCreateToken_js_1 = require("../funcs/oauthCreateToken.js");
+const primitives_js_1 = require("../lib/primitives.js");
+const fp_js_1 = require("../types/fp.js");
+const _context_js_1 = require("./_context.js");
+/**
+ * Issue an access, app or developer token
+ *
+ * @remarks
+ * The OAuth 2.0 token endpoint. It issues four kinds of short-lived token, chosen by
+ * `grant_type`:
+ *
+ * | Grant | Authenticate with | Issues |
+ * | --- | --- | --- |
+ * | `urn:ietf:params:oauth:grant-type:token-exchange` | The user's session token, as `subject_token` | An app user token (`gsu_`) or an app installation token (`gsi_`), 15 minutes |
+ * | `client_credentials` with `activation_id` | The app service account's `client_id` and `client_secret`, or its permanent token as `Authorization: Bearer` | An app installation token (`gsi_`), 15 minutes |
+ * | `client_credentials` without `activation_id` | An API service account's `client_id` and `client_secret`, or its permanent token as `Authorization: Bearer` | A plain API access token, 15 minutes |
+ * | `refresh_token` (service account) | The service account's `client_id` and `client_secret`, and a `refresh_token` | A plain API access token, 15 minutes, and a new refresh token |
+ * | `refresh_token` (apps CLI) | A `gsdr_` refresh token and `client_id=greensecurity-apps-cli`, no secret | A new developer CLI token (`gsd_`), 15 minutes, and a new `gsdr_` refresh token |
+ * | `urn:ietf:params:oauth:grant-type:device_code` | The `device_code` from `POST /oauth/device_authorization` | A developer CLI token (`gsd_`), 15 minutes, and a `gsdr_` refresh token |
+ *
+ * Token exchange is what the Green Security app does when it opens an app's views: the user
+ * must be covered by an activation of the app named in `audience`. `client_credentials` with
+ * `activation_id` is for the app's own backend. Without `activation_id`, `client_credentials`
+ * and a service account's `refresh_token` are the API service account flows: the response is
+ * a plain access token with no `issued_token_type` and no `activation_id` (see
+ * `TokenResponse`). An app token can never be used to obtain another token.
+ *
+ * The apps CLI logs in with the device grant and then renews its 15-minute developer token
+ * with the public-client `refresh_token` grant. Refresh tokens rotate and are single-use;
+ * presenting a spent one revokes the whole login, except for a retry within 30 seconds whose
+ * replacement is still unused. A login lasts at most 90 days from its device authorization.
+ * See `OAuthCliRefreshTokenGrant`.
+ *
+ * Every grant takes an optional `scope`, which can only narrow the token: it gets what was
+ * requested intersected with what the client is allowed, and if that is empty the request
+ * fails with `invalid_scope`. A refreshed token is never wider than the one it replaces.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`, and every parameter
+ * must be in the body: one sent in the query string is refused with `invalid_request`. Errors
+ * follow RFC 6749 and use `OAuthError` rather than the usual error envelope, including a
+ * body that fails validation (`400` `invalid_request`, never `422`). For the device grant,
+ * `authorization_pending` and `slow_down` mean "poll again later", not failure.
+ *
+ * Only `client_credentials` reads `Authorization`, and only when the body carries neither
+ * `client_id` nor `client_secret`. It accepts only the service account's permanent token
+ * there: a short-lived token (including one this endpoint issued), a narrowed token or an app
+ * token (`gsu_`, `gsi_`, `gsd_`) is answered `401` `invalid_client`, so a token can never be
+ * renewed or widened by presenting it. The other grants ignore the header.
+ *
+ * A narrowed `subject_token` is refused with `invalid_grant`, and a locked service account
+ * gets `401` `invalid_client` on `client_credentials` and `refresh_token`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** No named permission.
+ */
+function useOauthCreateTokenMutation(options) {
+    const client = (0, _context_js_1.useGreenSecurityContext)();
+    return (0, react_query_1.useMutation)({
+        ...buildOauthCreateTokenMutation(client, options),
+        ...options,
+    });
+}
+function mutationKeyOauthCreateToken() {
+    return ["@greensecurity/javascript-sdk", "oauth", "createToken"];
+}
+function buildOauthCreateTokenMutation(client$, hookOptions) {
+    return {
+        mutationKey: mutationKeyOauthCreateToken(),
+        mutationFn: function oauthCreateTokenMutationFn({ request, options, }) {
+            const mergedOptions = {
+                ...hookOptions,
+                ...options,
+                fetchOptions: {
+                    ...hookOptions?.fetchOptions,
+                    ...options?.fetchOptions,
+                    signal: (0, primitives_js_1.combineSignals)(hookOptions?.fetchOptions?.signal, options?.fetchOptions?.signal),
+                },
+            };
+            return (0, fp_js_1.unwrapAsync)((0, oauthCreateToken_js_1.oauthCreateToken)(client$, request, mergedOptions));
+        },
+    };
+}
+//# sourceMappingURL=oauthCreateToken.js.map

package/dist/commonjs/react-query/oauthCreateToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthCreateToken.js","sourceRoot":"","sources":["../../../src/react-query/oauthCreateToken.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAkGH,kEAgBC;AAED,kEAEC;AAED,sEAkCC;AAxJD,uDAI+B;AAE/B,sEAAgE;AAChE,wDAAsD;AActD,0CAA6C;AAC7C,+CAAwD;AAqBxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,SAAgB,2BAA2B,CACzC,OAIC;IAMD,MAAM,MAAM,GAAG,IAAA,qCAAuB,GAAE,CAAC;IACzC,OAAO,IAAA,yBAAW,EAAC;QACjB,GAAG,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC;QACjD,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,2BAA2B;IACzC,OAAO,CAAC,+BAA+B,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,6BAA6B,CAC3C,OAA0B,EAC1B,WAA4B;IAO5B,OAAO;QACL,WAAW,EAAE,2BAA2B,EAAE;QAC1C,UAAU,EAAE,SAAS,0BAA0B,CAAC,EAC9C,OAAO,EACP,OAAO,GACR;YACC,MAAM,aAAa,GAAG;gBACpB,GAAG,WAAW;gBACd,GAAG,OAAO;gBACV,YAAY,EAAE;oBACZ,GAAG,WAAW,EAAE,YAAY;oBAC5B,GAAG,OAAO,EAAE,YAAY;oBACxB,MAAM,EAAE,IAAA,8BAAc,EACpB,WAAW,EAAE,YAAY,EAAE,MAAM,EACjC,OAAO,EAAE,YAAY,EAAE,MAAM,CAC9B;iBACF;aACF,CAAC;YACF,OAAO,IAAA,mBAAW,EAAC,IAAA,sCAAgB,EACjC,OAAO,EACP,OAAO,EACP,aAAa,CACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/commonjs/react-query/oauthIntrospectToken.d.ts

@@ -0,0 +1,54 @@
+import { MutationKey, UseMutationResult } from "@tanstack/react-query";
+import { GreenSecurityCore } from "../core.js";
+import { RequestOptions } from "../lib/sdks.js";
+import * as components from "../models/components/index.js";
+import { GreenSecurityError } from "../models/errors/greensecurityerror.js";
+import { ConnectionError, InvalidRequestError, RequestAbortedError, RequestTimeoutError, UnexpectedClientError } from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import { MutationHookOptions } from "./_types.js";
+export type OauthIntrospectTokenMutationVariables = {
+    request: components.TokenIntrospectionRequest;
+    options?: RequestOptions;
+};
+export type OauthIntrospectTokenMutationData = components.TokenIntrospection;
+export type OauthIntrospectTokenMutationError = errors.OAuthError | GreenSecurityError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError;
+/**
+ * Check an app token
+ *
+ * @remarks
+ * RFC 7662 token introspection, for your app's backend. When your app's UI calls your own
+ * API it sends the app user token it was given; call this endpoint to confirm the token is
+ * live and find out which user, app and activation it belongs to before you act on it.
+ *
+ * A back-end-only app (a manifest with no `ui_extensions`) has no UI, so no user token
+ * ever reaches it, and the installation tokens it uses it mints itself with
+ * `client_credentials`. It needs this endpoint only to check an app token that another
+ * party sends it.
+ *
+ * Only app user and app installation tokens issued to your own app are reported as
+ * `active`. Any other token, whether unknown, expired, revoked, another app's, a developer
+ * CLI token, or one whose user has since been locked, returns `{"active": false}` with a
+ * `200`, never an error.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** Only your app service account's permanent token is accepted, as
+ * `Authorization: Bearer`. A short-lived or narrowed token (including one from
+ * `client_credentials`), a locked service account's token, or a token of a user who is not
+ * an API service account is refused with `401` `invalid_client`. Every app token is refused
+ * the same way, and that includes installation tokens (`gsi_`): the host also hands those to
+ * your app's sandboxed UI, so accepting them here would let code running in the UI introspect
+ * tokens. Keep the service account token on your backend.
+ */
+export declare function useOauthIntrospectTokenMutation(options?: MutationHookOptions<OauthIntrospectTokenMutationData, OauthIntrospectTokenMutationError, OauthIntrospectTokenMutationVariables>): UseMutationResult<OauthIntrospectTokenMutationData, OauthIntrospectTokenMutationError, OauthIntrospectTokenMutationVariables>;
+export declare function mutationKeyOauthIntrospectToken(): MutationKey;
+export declare function buildOauthIntrospectTokenMutation(client$: GreenSecurityCore, hookOptions?: RequestOptions): {
+    mutationKey: MutationKey;
+    mutationFn: (variables: OauthIntrospectTokenMutationVariables) => Promise<OauthIntrospectTokenMutationData>;
+};
+//# sourceMappingURL=oauthIntrospectToken.d.ts.map

package/dist/commonjs/react-query/oauthIntrospectToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthIntrospectToken.d.ts","sourceRoot":"","sources":["../../../src/react-query/oauthIntrospectToken.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,WAAW,EAEX,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAG5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,MAAM,qCAAqC,GAAG;IAClD,OAAO,EAAE,UAAU,CAAC,yBAAyB,CAAC;IAC9C,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG,UAAU,CAAC,kBAAkB,CAAC;AAE7E,MAAM,MAAM,iCAAiC,GACzC,MAAM,CAAC,UAAU,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,CAAC;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,CAAC,EAAE,mBAAmB,CAC3B,gCAAgC,EAChC,iCAAiC,EACjC,qCAAqC,CACtC,GACA,iBAAiB,CAClB,gCAAgC,EAChC,iCAAiC,EACjC,qCAAqC,CACtC,CAMA;AAED,wBAAgB,+BAA+B,IAAI,WAAW,CAE7D;AAED,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,iBAAiB,EAC1B,WAAW,CAAC,EAAE,cAAc,GAC3B;IACD,WAAW,EAAE,WAAW,CAAC;IACzB,UAAU,EAAE,CACV,SAAS,EAAE,qCAAqC,KAC7C,OAAO,CAAC,gCAAgC,CAAC,CAAC;CAChD,CA0BA"}

package/dist/commonjs/react-query/oauthIntrospectToken.js

@@ -0,0 +1,72 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useOauthIntrospectTokenMutation = useOauthIntrospectTokenMutation;
+exports.mutationKeyOauthIntrospectToken = mutationKeyOauthIntrospectToken;
+exports.buildOauthIntrospectTokenMutation = buildOauthIntrospectTokenMutation;
+const react_query_1 = require("@tanstack/react-query");
+const oauthIntrospectToken_js_1 = require("../funcs/oauthIntrospectToken.js");
+const primitives_js_1 = require("../lib/primitives.js");
+const fp_js_1 = require("../types/fp.js");
+const _context_js_1 = require("./_context.js");
+/**
+ * Check an app token
+ *
+ * @remarks
+ * RFC 7662 token introspection, for your app's backend. When your app's UI calls your own
+ * API it sends the app user token it was given; call this endpoint to confirm the token is
+ * live and find out which user, app and activation it belongs to before you act on it.
+ *
+ * A back-end-only app (a manifest with no `ui_extensions`) has no UI, so no user token
+ * ever reaches it, and the installation tokens it uses it mints itself with
+ * `client_credentials`. It needs this endpoint only to check an app token that another
+ * party sends it.
+ *
+ * Only app user and app installation tokens issued to your own app are reported as
+ * `active`. Any other token, whether unknown, expired, revoked, another app's, a developer
+ * CLI token, or one whose user has since been locked, returns `{"active": false}` with a
+ * `200`, never an error.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** Only your app service account's permanent token is accepted, as
+ * `Authorization: Bearer`. A short-lived or narrowed token (including one from
+ * `client_credentials`), a locked service account's token, or a token of a user who is not
+ * an API service account is refused with `401` `invalid_client`. Every app token is refused
+ * the same way, and that includes installation tokens (`gsi_`): the host also hands those to
+ * your app's sandboxed UI, so accepting them here would let code running in the UI introspect
+ * tokens. Keep the service account token on your backend.
+ */
+function useOauthIntrospectTokenMutation(options) {
+    const client = (0, _context_js_1.useGreenSecurityContext)();
+    return (0, react_query_1.useMutation)({
+        ...buildOauthIntrospectTokenMutation(client, options),
+        ...options,
+    });
+}
+function mutationKeyOauthIntrospectToken() {
+    return ["@greensecurity/javascript-sdk", "oauth", "introspectToken"];
+}
+function buildOauthIntrospectTokenMutation(client$, hookOptions) {
+    return {
+        mutationKey: mutationKeyOauthIntrospectToken(),
+        mutationFn: function oauthIntrospectTokenMutationFn({ request, options, }) {
+            const mergedOptions = {
+                ...hookOptions,
+                ...options,
+                fetchOptions: {
+                    ...hookOptions?.fetchOptions,
+                    ...options?.fetchOptions,
+                    signal: (0, primitives_js_1.combineSignals)(hookOptions?.fetchOptions?.signal, options?.fetchOptions?.signal),
+                },
+            };
+            return (0, fp_js_1.unwrapAsync)((0, oauthIntrospectToken_js_1.oauthIntrospectToken)(client$, request, mergedOptions));
+        },
+    };
+}
+//# sourceMappingURL=oauthIntrospectToken.js.map

package/dist/commonjs/react-query/oauthIntrospectToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthIntrospectToken.js","sourceRoot":"","sources":["../../../src/react-query/oauthIntrospectToken.ts"],"names":[],"mappings":";AAAA;;GAEG;;AA4EH,0EAgBC;AAED,0EAEC;AAED,8EAkCC;AAlID,uDAI+B;AAE/B,8EAAwE;AACxE,wDAAsD;AActD,0CAA6C;AAC7C,+CAAwD;AAqBxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,SAAgB,+BAA+B,CAC7C,OAIC;IAMD,MAAM,MAAM,GAAG,IAAA,qCAAuB,GAAE,CAAC;IACzC,OAAO,IAAA,yBAAW,EAAC;QACjB,GAAG,iCAAiC,CAAC,MAAM,EAAE,OAAO,CAAC;QACrD,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,+BAA+B;IAC7C,OAAO,CAAC,+BAA+B,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;AACvE,CAAC;AAED,SAAgB,iCAAiC,CAC/C,OAA0B,EAC1B,WAA4B;IAO5B,OAAO;QACL,WAAW,EAAE,+BAA+B,EAAE;QAC9C,UAAU,EAAE,SAAS,8BAA8B,CAAC,EAClD,OAAO,EACP,OAAO,GACR;YACC,MAAM,aAAa,GAAG;gBACpB,GAAG,WAAW;gBACd,GAAG,OAAO;gBACV,YAAY,EAAE;oBACZ,GAAG,WAAW,EAAE,YAAY;oBAC5B,GAAG,OAAO,EAAE,YAAY;oBACxB,MAAM,EAAE,IAAA,8BAAc,EACpB,WAAW,EAAE,YAAY,EAAE,MAAM,EACjC,OAAO,EAAE,YAAY,EAAE,MAAM,CAC9B;iBACF;aACF,CAAC;YACF,OAAO,IAAA,mBAAW,EAAC,IAAA,8CAAoB,EACrC,OAAO,EACP,OAAO,EACP,aAAa,CACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/commonjs/react-query/oauthRevokeToken.d.ts

@@ -0,0 +1,58 @@
+import { MutationKey, UseMutationResult } from "@tanstack/react-query";
+import { GreenSecurityCore } from "../core.js";
+import { RequestOptions } from "../lib/sdks.js";
+import * as components from "../models/components/index.js";
+import { GreenSecurityError } from "../models/errors/greensecurityerror.js";
+import { ConnectionError, InvalidRequestError, RequestAbortedError, RequestTimeoutError, UnexpectedClientError } from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import * as operations from "../models/operations/index.js";
+import { MutationHookOptions } from "./_types.js";
+export type OauthRevokeTokenMutationVariables = {
+    request: components.TokenRevocationRequest;
+    options?: RequestOptions;
+};
+export type OauthRevokeTokenMutationData = operations.RevokeTokenRevokeTokenOk;
+export type OauthRevokeTokenMutationError = errors.OAuthError | GreenSecurityError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError;
+/**
+ * Revoke a token
+ *
+ * @remarks
+ * RFC 7009 token revocation. Revokes an app user, app installation or developer CLI token,
+ * or an apps CLI refresh token, immediately. Revoking any token of an apps CLI login (its
+ * `gsd_` developer token or its `gsdr_` refresh token) revokes every token of that login.
+ * `apps-cli logout` sends its refresh token this way.
+ *
+ * Once the caller is authenticated the response is `200` with `{}`, whether or not anything
+ * was revoked, so it cannot be used to probe for valid tokens. A token the caller may not
+ * revoke is left alone.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** For an apps CLI refresh token, send `token=gsdr_…` with
+ * `client_id=greensecurity-apps-cli` and no `Authorization` (RFC 7009 public client). It
+ * always answers `200`.
+ *
+ * Otherwise send one of these as `Authorization: Bearer`:
+ *
+ * - the token being revoked, which may revoke itself (a `gsd_` token may also revoke any
+ *   token of its own login), and no other token;
+ * - an unscoped token (session, permanent, or an access token issued without `scope`) of the
+ *   token's subject, or of the user whose view caused it to be issued;
+ * - an unscoped token of the service account of the app it was issued for.
+ *
+ * A narrowed token (an access token issued with `scope`) is refused with `401`
+ * `invalid_client`: its scope says nothing about revoking the caller's other tokens. So is
+ * the token of a locked user.
+ */
+export declare function useOauthRevokeTokenMutation(options?: MutationHookOptions<OauthRevokeTokenMutationData, OauthRevokeTokenMutationError, OauthRevokeTokenMutationVariables>): UseMutationResult<OauthRevokeTokenMutationData, OauthRevokeTokenMutationError, OauthRevokeTokenMutationVariables>;
+export declare function mutationKeyOauthRevokeToken(): MutationKey;
+export declare function buildOauthRevokeTokenMutation(client$: GreenSecurityCore, hookOptions?: RequestOptions): {
+    mutationKey: MutationKey;
+    mutationFn: (variables: OauthRevokeTokenMutationVariables) => Promise<OauthRevokeTokenMutationData>;
+};
+//# sourceMappingURL=oauthRevokeToken.d.ts.map

package/dist/commonjs/react-query/oauthRevokeToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthRevokeToken.d.ts","sourceRoot":"","sources":["../../../src/react-query/oauthRevokeToken.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,WAAW,EAEX,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAG5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,MAAM,iCAAiC,GAAG;IAC9C,OAAO,EAAE,UAAU,CAAC,sBAAsB,CAAC;IAC3C,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,UAAU,CAAC,wBAAwB,CAAC;AAE/E,MAAM,MAAM,6BAA6B,GACrC,MAAM,CAAC,UAAU,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,CAAC;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,CAAC,EAAE,mBAAmB,CAC3B,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,CAClC,GACA,iBAAiB,CAClB,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,CAClC,CAMA;AAED,wBAAgB,2BAA2B,IAAI,WAAW,CAEzD;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,iBAAiB,EAC1B,WAAW,CAAC,EAAE,cAAc,GAC3B;IACD,WAAW,EAAE,WAAW,CAAC;IACzB,UAAU,EAAE,CACV,SAAS,EAAE,iCAAiC,KACzC,OAAO,CAAC,4BAA4B,CAAC,CAAC;CAC5C,CA0BA"}

package/dist/commonjs/react-query/oauthRevokeToken.js

@@ -0,0 +1,75 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useOauthRevokeTokenMutation = useOauthRevokeTokenMutation;
+exports.mutationKeyOauthRevokeToken = mutationKeyOauthRevokeToken;
+exports.buildOauthRevokeTokenMutation = buildOauthRevokeTokenMutation;
+const react_query_1 = require("@tanstack/react-query");
+const oauthRevokeToken_js_1 = require("../funcs/oauthRevokeToken.js");
+const primitives_js_1 = require("../lib/primitives.js");
+const fp_js_1 = require("../types/fp.js");
+const _context_js_1 = require("./_context.js");
+/**
+ * Revoke a token
+ *
+ * @remarks
+ * RFC 7009 token revocation. Revokes an app user, app installation or developer CLI token,
+ * or an apps CLI refresh token, immediately. Revoking any token of an apps CLI login (its
+ * `gsd_` developer token or its `gsdr_` refresh token) revokes every token of that login.
+ * `apps-cli logout` sends its refresh token this way.
+ *
+ * Once the caller is authenticated the response is `200` with `{}`, whether or not anything
+ * was revoked, so it cannot be used to probe for valid tokens. A token the caller may not
+ * revoke is left alone.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** For an apps CLI refresh token, send `token=gsdr_…` with
+ * `client_id=greensecurity-apps-cli` and no `Authorization` (RFC 7009 public client). It
+ * always answers `200`.
+ *
+ * Otherwise send one of these as `Authorization: Bearer`:
+ *
+ * - the token being revoked, which may revoke itself (a `gsd_` token may also revoke any
+ *   token of its own login), and no other token;
+ * - an unscoped token (session, permanent, or an access token issued without `scope`) of the
+ *   token's subject, or of the user whose view caused it to be issued;
+ * - an unscoped token of the service account of the app it was issued for.
+ *
+ * A narrowed token (an access token issued with `scope`) is refused with `401`
+ * `invalid_client`: its scope says nothing about revoking the caller's other tokens. So is
+ * the token of a locked user.
+ */
+function useOauthRevokeTokenMutation(options) {
+    const client = (0, _context_js_1.useGreenSecurityContext)();
+    return (0, react_query_1.useMutation)({
+        ...buildOauthRevokeTokenMutation(client, options),
+        ...options,
+    });
+}
+function mutationKeyOauthRevokeToken() {
+    return ["@greensecurity/javascript-sdk", "oauth", "revokeToken"];
+}
+function buildOauthRevokeTokenMutation(client$, hookOptions) {
+    return {
+        mutationKey: mutationKeyOauthRevokeToken(),
+        mutationFn: function oauthRevokeTokenMutationFn({ request, options, }) {
+            const mergedOptions = {
+                ...hookOptions,
+                ...options,
+                fetchOptions: {
+                    ...hookOptions?.fetchOptions,
+                    ...options?.fetchOptions,
+                    signal: (0, primitives_js_1.combineSignals)(hookOptions?.fetchOptions?.signal, options?.fetchOptions?.signal),
+                },
+            };
+            return (0, fp_js_1.unwrapAsync)((0, oauthRevokeToken_js_1.oauthRevokeToken)(client$, request, mergedOptions));
+        },
+    };
+}
+//# sourceMappingURL=oauthRevokeToken.js.map

package/dist/commonjs/react-query/oauthRevokeToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthRevokeToken.js","sourceRoot":"","sources":["../../../src/react-query/oauthRevokeToken.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAgFH,kEAgBC;AAED,kEAEC;AAED,sEAkCC;AAtID,uDAI+B;AAE/B,sEAAgE;AAChE,wDAAsD;AAetD,0CAA6C;AAC7C,+CAAwD;AAqBxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAgB,2BAA2B,CACzC,OAIC;IAMD,MAAM,MAAM,GAAG,IAAA,qCAAuB,GAAE,CAAC;IACzC,OAAO,IAAA,yBAAW,EAAC;QACjB,GAAG,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC;QACjD,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,2BAA2B;IACzC,OAAO,CAAC,+BAA+B,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,6BAA6B,CAC3C,OAA0B,EAC1B,WAA4B;IAO5B,OAAO;QACL,WAAW,EAAE,2BAA2B,EAAE;QAC1C,UAAU,EAAE,SAAS,0BAA0B,CAAC,EAC9C,OAAO,EACP,OAAO,GACR;YACC,MAAM,aAAa,GAAG;gBACpB,GAAG,WAAW;gBACd,GAAG,OAAO;gBACV,YAAY,EAAE;oBACZ,GAAG,WAAW,EAAE,YAAY;oBAC5B,GAAG,OAAO,EAAE,YAAY;oBACxB,MAAM,EAAE,IAAA,8BAAc,EACpB,WAAW,EAAE,YAAY,EAAE,MAAM,EACjC,OAAO,EAAE,YAAY,EAAE,MAAM,CAC9B;iBACF;aACF,CAAC;YACF,OAAO,IAAA,mBAAW,EAAC,IAAA,sCAAgB,EACjC,OAAO,EACP,OAAO,EACP,aAAa,CACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/commonjs/react-query/vendorsAddVendorManagedByCompany.d.ts

@@ -22,6 +22,9 @@ export type VendorsAddVendorManagedByCompanyMutationError = errors.ApiErrorRespo
  * turned off. The company must be on the same site as the vendor. Otherwise, the API returns
  * `404`.
  *
+ * The company the vendor belongs to can't be added, because it already has full rights over the
+ * vendor. The API returns `400`, as it does for a company that already manages the vendor.
+ *
  * **Permissions.** Requires the `vendors.edit` permission. Only these callers can change which
  * companies manage the vendor: the vendor, a company manager at the company the vendor belongs to,
  * a Green Security administrator, or an app whose API token can update the vendor (an app

package/dist/commonjs/react-query/vendorsAddVendorManagedByCompany.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vendorsAddVendorManagedByCompany.d.ts","sourceRoot":"","sources":["../../../src/react-query/vendorsAddVendorManagedByCompany.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,WAAW,EAEX,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAG5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,MAAM,iDAAiD,GAAG;IAC9D,OAAO,EAAE,UAAU,CAAC,gCAAgC,CAAC;IACrD,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,4CAA4C,GACtD,UAAU,CAAC,oDAAoD,CAAC;AAElE,MAAM,MAAM,6CAA6C,GACrD,MAAM,CAAC,gBAAgB,GACvB,kBAAkB,GAClB,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,CAAC;AAEvB;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2CAA2C,CACzD,OAAO,CAAC,EAAE,mBAAmB,CAC3B,4CAA4C,EAC5C,6CAA6C,EAC7C,iDAAiD,CAClD,GACA,iBAAiB,CAClB,4CAA4C,EAC5C,6CAA6C,EAC7C,iDAAiD,CAClD,CAMA;AAED,wBAAgB,2CAA2C,IAAI,WAAW,CAMzE;AAED,wBAAgB,6CAA6C,CAC3D,OAAO,EAAE,iBAAiB,EAC1B,WAAW,CAAC,EAAE,cAAc,GAC3B;IACD,WAAW,EAAE,WAAW,CAAC;IACzB,UAAU,EAAE,CACV,SAAS,EAAE,iDAAiD,KACzD,OAAO,CAAC,4CAA4C,CAAC,CAAC;CAC5D,CA0BA"}
+{"version":3,"file":"vendorsAddVendorManagedByCompany.d.ts","sourceRoot":"","sources":["../../../src/react-query/vendorsAddVendorManagedByCompany.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,WAAW,EAEX,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAG5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,MAAM,iDAAiD,GAAG;IAC9D,OAAO,EAAE,UAAU,CAAC,gCAAgC,CAAC;IACrD,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,4CAA4C,GACtD,UAAU,CAAC,oDAAoD,CAAC;AAElE,MAAM,MAAM,6CAA6C,GACrD,MAAM,CAAC,gBAAgB,GACvB,kBAAkB,GAClB,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,CAAC;AAEvB;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2CAA2C,CACzD,OAAO,CAAC,EAAE,mBAAmB,CAC3B,4CAA4C,EAC5C,6CAA6C,EAC7C,iDAAiD,CAClD,GACA,iBAAiB,CAClB,4CAA4C,EAC5C,6CAA6C,EAC7C,iDAAiD,CAClD,CAMA;AAED,wBAAgB,2CAA2C,IAAI,WAAW,CAMzE;AAED,wBAAgB,6CAA6C,CAC3D,OAAO,EAAE,iBAAiB,EAC1B,WAAW,CAAC,EAAE,cAAc,GAC3B;IACD,WAAW,EAAE,WAAW,CAAC;IACzB,UAAU,EAAE,CACV,SAAS,EAAE,iDAAiD,KACzD,OAAO,CAAC,4CAA4C,CAAC,CAAC;CAC5D,CA0BA"}

package/dist/commonjs/react-query/vendorsAddVendorManagedByCompany.js

@@ -19,6 +19,9 @@ const _context_js_1 = require("./_context.js");
  * turned off. The company must be on the same site as the vendor. Otherwise, the API returns
  * `404`.
  *
+ * The company the vendor belongs to can't be added, because it already has full rights over the
+ * vendor. The API returns `400`, as it does for a company that already manages the vendor.
+ *
  * **Permissions.** Requires the `vendors.edit` permission. Only these callers can change which
  * companies manage the vendor: the vendor, a company manager at the company the vendor belongs to,
  * a Green Security administrator, or an app whose API token can update the vendor (an app

package/dist/commonjs/react-query/vendorsAddVendorManagedByCompany.js.map

@@ -1 +1 @@
-{"version":3,"file":"vendorsAddVendorManagedByCompany.js","sourceRoot":"","sources":["../../../src/react-query/vendorsAddVendorManagedByCompany.ts"],"names":[],"mappings":";AAAA;;GAEG;;AA6DH,kGAgBC;AAED,kGAMC;AAED,sGAkCC;AAvHD,uDAI+B;AAE/B,sGAAgG;AAChG,wDAAsD;AActD,0CAA6C;AAC7C,+CAAwD;AAsBxD;;;;;;;;;;;;;;GAcG;AACH,SAAgB,2CAA2C,CACzD,OAIC;IAMD,MAAM,MAAM,GAAG,IAAA,qCAAuB,GAAE,CAAC;IACzC,OAAO,IAAA,yBAAW,EAAC;QACjB,GAAG,6CAA6C,CAAC,MAAM,EAAE,OAAO,CAAC;QACjE,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,2CAA2C;IACzD,OAAO;QACL,+BAA+B;QAC/B,SAAS;QACT,2BAA2B;KAC5B,CAAC;AACJ,CAAC;AAED,SAAgB,6CAA6C,CAC3D,OAA0B,EAC1B,WAA4B;IAO5B,OAAO;QACL,WAAW,EAAE,2CAA2C,EAAE;QAC1D,UAAU,EAAE,SAAS,0CAA0C,CAAC,EAC9D,OAAO,EACP,OAAO,GACR;YACC,MAAM,aAAa,GAAG;gBACpB,GAAG,WAAW;gBACd,GAAG,OAAO;gBACV,YAAY,EAAE;oBACZ,GAAG,WAAW,EAAE,YAAY;oBAC5B,GAAG,OAAO,EAAE,YAAY;oBACxB,MAAM,EAAE,IAAA,8BAAc,EACpB,WAAW,EAAE,YAAY,EAAE,MAAM,EACjC,OAAO,EAAE,YAAY,EAAE,MAAM,CAC9B;iBACF;aACF,CAAC;YACF,OAAO,IAAA,mBAAW,EAAC,IAAA,sEAAgC,EACjD,OAAO,EACP,OAAO,EACP,aAAa,CACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"vendorsAddVendorManagedByCompany.js","sourceRoot":"","sources":["../../../src/react-query/vendorsAddVendorManagedByCompany.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAgEH,kGAgBC;AAED,kGAMC;AAED,sGAkCC;AA1HD,uDAI+B;AAE/B,sGAAgG;AAChG,wDAAsD;AActD,0CAA6C;AAC7C,+CAAwD;AAsBxD;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,2CAA2C,CACzD,OAIC;IAMD,MAAM,MAAM,GAAG,IAAA,qCAAuB,GAAE,CAAC;IACzC,OAAO,IAAA,yBAAW,EAAC;QACjB,GAAG,6CAA6C,CAAC,MAAM,EAAE,OAAO,CAAC;QACjE,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,2CAA2C;IACzD,OAAO;QACL,+BAA+B;QAC/B,SAAS;QACT,2BAA2B;KAC5B,CAAC;AACJ,CAAC;AAED,SAAgB,6CAA6C,CAC3D,OAA0B,EAC1B,WAA4B;IAO5B,OAAO;QACL,WAAW,EAAE,2CAA2C,EAAE;QAC1D,UAAU,EAAE,SAAS,0CAA0C,CAAC,EAC9D,OAAO,EACP,OAAO,GACR;YACC,MAAM,aAAa,GAAG;gBACpB,GAAG,WAAW;gBACd,GAAG,OAAO;gBACV,YAAY,EAAE;oBACZ,GAAG,WAAW,EAAE,YAAY;oBAC5B,GAAG,OAAO,EAAE,YAAY;oBACxB,MAAM,EAAE,IAAA,8BAAc,EACpB,WAAW,EAAE,YAAY,EAAE,MAAM,EACjC,OAAO,EAAE,YAAY,EAAE,MAAM,CAC9B;iBACF;aACF,CAAC;YACF,OAAO,IAAA,mBAAW,EAAC,IAAA,sEAAgC,EACjD,OAAO,EACP,OAAO,EACP,aAAa,CACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}