@greensecurity/javascript-sdk 0.46.0-beta.8 → 0.46.0-beta.9

package/src/models/components/marketplaceappactivationcoverage.ts

@@ -0,0 +1,110 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import { safeParse } from "../../lib/schemas.js";
+import { Result as SafeParseResult } from "../../types/fp.js";
+import * as types from "../../types/primitives.js";
+import { SDKValidationError } from "../errors/sdkvalidationerror.js";
+
+/**
+ * What one activation of your app covers: the site, health system, facility, company or
+ *
+ * @remarks
+ * user it was installed for. An install is made at one of these, so one id is set and the
+ * others are null. A site install covers everything in the site, and a health system
+ * install covers its facilities.
+ */
+export type MarketplaceAppActivationCoverage = {
+  /**
+   * Set for an install at site level.
+   */
+  siteId: number | null;
+  /**
+   * Set for an install for a health system.
+   */
+  systemId: number | null;
+  /**
+   * Set for an install for a facility.
+   */
+  facilityId: number | null;
+  /**
+   * Set for an install for a vendor company.
+   */
+  companyId: number | null;
+  /**
+   * Set for an install for one user.
+   */
+  userId: number | null;
+};
+
+/** @internal */
+export const MarketplaceAppActivationCoverage$inboundSchema: z.ZodType<
+  MarketplaceAppActivationCoverage,
+  z.ZodTypeDef,
+  unknown
+> = z.object({
+  site_id: types.nullable(types.number()),
+  system_id: types.nullable(types.number()),
+  facility_id: types.nullable(types.number()),
+  company_id: types.nullable(types.number()),
+  user_id: types.nullable(types.number()),
+}).transform((v) => {
+  return remap$(v, {
+    "site_id": "siteId",
+    "system_id": "systemId",
+    "facility_id": "facilityId",
+    "company_id": "companyId",
+    "user_id": "userId",
+  });
+});
+/** @internal */
+export type MarketplaceAppActivationCoverage$Outbound = {
+  site_id: number | null;
+  system_id: number | null;
+  facility_id: number | null;
+  company_id: number | null;
+  user_id: number | null;
+};
+
+/** @internal */
+export const MarketplaceAppActivationCoverage$outboundSchema: z.ZodType<
+  MarketplaceAppActivationCoverage$Outbound,
+  z.ZodTypeDef,
+  MarketplaceAppActivationCoverage
+> = z.object({
+  siteId: z.nullable(z.number().int()),
+  systemId: z.nullable(z.number().int()),
+  facilityId: z.nullable(z.number().int()),
+  companyId: z.nullable(z.number().int()),
+  userId: z.nullable(z.number().int()),
+}).transform((v) => {
+  return remap$(v, {
+    siteId: "site_id",
+    systemId: "system_id",
+    facilityId: "facility_id",
+    companyId: "company_id",
+    userId: "user_id",
+  });
+});
+
+export function marketplaceAppActivationCoverageToJSON(
+  marketplaceAppActivationCoverage: MarketplaceAppActivationCoverage,
+): string {
+  return JSON.stringify(
+    MarketplaceAppActivationCoverage$outboundSchema.parse(
+      marketplaceAppActivationCoverage,
+    ),
+  );
+}
+export function marketplaceAppActivationCoverageFromJSON(
+  jsonString: string,
+): SafeParseResult<MarketplaceAppActivationCoverage, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => MarketplaceAppActivationCoverage$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'MarketplaceAppActivationCoverage' from JSON`,
+  );
+}

package/src/models/components/marketplaceappactivationevent.ts

@@ -0,0 +1,136 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import { safeParse } from "../../lib/schemas.js";
+import { ClosedEnum } from "../../types/enums.js";
+import { Result as SafeParseResult } from "../../types/fp.js";
+import * as types from "../../types/primitives.js";
+import { SDKValidationError } from "../errors/sdkvalidationerror.js";
+import {
+  MarketplaceAppActivationCoverage,
+  MarketplaceAppActivationCoverage$inboundSchema,
+  MarketplaceAppActivationCoverage$Outbound,
+  MarketplaceAppActivationCoverage$outboundSchema,
+} from "./marketplaceappactivationcoverage.js";
+
+/**
+ * What happened, the same action `Green-Security-Event` names.
+ */
+export const MarketplaceAppActivationEventAction = {
+  Created: "created",
+  Updated: "updated",
+  Destroyed: "destroyed",
+} as const;
+/**
+ * What happened, the same action `Green-Security-Event` names.
+ */
+export type MarketplaceAppActivationEventAction = ClosedEnum<
+  typeof MarketplaceAppActivationEventAction
+>;
+
+/**
+ * The body of a `MarketplaceAppActivation.*` delivery: the activation, as
+ *
+ * @remarks
+ * `GET /marketplace/activations` lists it, plus what happened to it.
+ */
+export type MarketplaceAppActivationEvent = {
+  /**
+   * The activation id.
+   */
+  id: number;
+  /**
+   * The app that was installed.
+   */
+  marketplaceAppId: number;
+  /**
+   * What one activation of your app covers: the site, health system, facility, company or
+   *
+   * @remarks
+   * user it was installed for. An install is made at one of these, so one id is set and the
+   * others are null. A site install covers everything in the site, and a health system
+   * install covers its facilities.
+   */
+  coverage: MarketplaceAppActivationCoverage;
+  /**
+   * When the app was installed. Null for installations made before this was recorded.
+   */
+  created: Date | null;
+  /**
+   * What happened, the same action `Green-Security-Event` names.
+   */
+  action: MarketplaceAppActivationEventAction;
+};
+
+/** @internal */
+export const MarketplaceAppActivationEventAction$inboundSchema: z.ZodNativeEnum<
+  typeof MarketplaceAppActivationEventAction
+> = z.nativeEnum(MarketplaceAppActivationEventAction);
+/** @internal */
+export const MarketplaceAppActivationEventAction$outboundSchema:
+  z.ZodNativeEnum<typeof MarketplaceAppActivationEventAction> =
+    MarketplaceAppActivationEventAction$inboundSchema;
+
+/** @internal */
+export const MarketplaceAppActivationEvent$inboundSchema: z.ZodType<
+  MarketplaceAppActivationEvent,
+  z.ZodTypeDef,
+  unknown
+> = z.object({
+  id: types.number(),
+  marketplace_app_id: types.number(),
+  coverage: MarketplaceAppActivationCoverage$inboundSchema,
+  created: types.nullable(types.date()),
+  action: MarketplaceAppActivationEventAction$inboundSchema,
+}).transform((v) => {
+  return remap$(v, {
+    "marketplace_app_id": "marketplaceAppId",
+  });
+});
+/** @internal */
+export type MarketplaceAppActivationEvent$Outbound = {
+  id: number;
+  marketplace_app_id: number;
+  coverage: MarketplaceAppActivationCoverage$Outbound;
+  created: string | null;
+  action: string;
+};
+
+/** @internal */
+export const MarketplaceAppActivationEvent$outboundSchema: z.ZodType<
+  MarketplaceAppActivationEvent$Outbound,
+  z.ZodTypeDef,
+  MarketplaceAppActivationEvent
+> = z.object({
+  id: z.number().int(),
+  marketplaceAppId: z.number().int(),
+  coverage: MarketplaceAppActivationCoverage$outboundSchema,
+  created: z.nullable(z.date().transform(v => v.toISOString())),
+  action: MarketplaceAppActivationEventAction$outboundSchema,
+}).transform((v) => {
+  return remap$(v, {
+    marketplaceAppId: "marketplace_app_id",
+  });
+});
+
+export function marketplaceAppActivationEventToJSON(
+  marketplaceAppActivationEvent: MarketplaceAppActivationEvent,
+): string {
+  return JSON.stringify(
+    MarketplaceAppActivationEvent$outboundSchema.parse(
+      marketplaceAppActivationEvent,
+    ),
+  );
+}
+export function marketplaceAppActivationEventFromJSON(
+  jsonString: string,
+): SafeParseResult<MarketplaceAppActivationEvent, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => MarketplaceAppActivationEvent$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'MarketplaceAppActivationEvent' from JSON`,
+  );
+}

package/src/models/components/oauthclientcredentialsgrant.ts

@@ -0,0 +1,107 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+
+/**
+ * A token for an API service account's own backend. Authenticate with either:
+ *
+ * @remarks
+ *
+ * - `client_id` (the service account's email) and `client_secret` (its permanent token)
+ *   in the body, always together; or
+ * - neither of them, and the service account's permanent token in the
+ *   `Authorization: Bearer` header. This is the only grant that reads `Authorization`,
+ *   and it accepts nothing but the permanent token there: a short-lived or narrowed
+ *   token, including one this grant issued, is `401` `invalid_client`.
+ *
+ * A locked service account is `401` `invalid_client` either way.
+ *
+ * What it issues depends on `activation_id`:
+ *
+ * - **Without `activation_id`**: a plain 15-minute API access token for the service
+ *   account, with no refresh token. The response has no `issued_token_type` and no
+ *   `activation_id`, and has `scope` only when the request sent one.
+ * - **With `activation_id`**: an app installation token (`gsi_`) narrowed to that
+ *   activation. The service account must be a marketplace app's, and the activation one
+ *   of that app's. This is how any app's backend acts on one installation, and the only
+ *   way a back-end-only app (a manifest with no `ui_extensions`) gets a token for one,
+ *   since the host never hands it user or installation tokens.
+ */
+export type OAuthClientCredentialsGrant = {
+  grantType: "client_credentials";
+  /**
+   * The service account's email. Send it with `client_secret`, or send neither and use `Authorization`.
+   */
+  clientId?: string | undefined;
+  /**
+   * The service account's permanent token. Send it with `client_id`, or send neither and use `Authorization`.
+   */
+  clientSecret?: string | undefined;
+  /**
+   * Optional. Asks for an app installation token narrowed to this activation of your app
+   *
+   * @remarks
+   * (`invalid_target` if it is not one). Leave it out for a plain API access token.
+   */
+  activationId?: number | undefined;
+  /**
+   * Optional, and only with `activation_id` (`invalid_request` without it). When given, it
+   *
+   * @remarks
+   * must name the activation's app as `app:<id>` (`invalid_target` otherwise).
+   */
+  audience?: string | undefined;
+  /**
+   * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+   *
+   * @remarks
+   * the device grant) to narrow the token to. Leave it out to get everything the client is
+   * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+   * is left the request fails with `invalid_scope`.
+   */
+  scope?: string | undefined;
+};
+
+/** @internal */
+export type OAuthClientCredentialsGrant$Outbound = {
+  grant_type: "client_credentials";
+  client_id?: string | undefined;
+  client_secret?: string | undefined;
+  activation_id?: number | undefined;
+  audience?: string | undefined;
+  scope?: string | undefined;
+};
+
+/** @internal */
+export const OAuthClientCredentialsGrant$outboundSchema: z.ZodType<
+  OAuthClientCredentialsGrant$Outbound,
+  z.ZodTypeDef,
+  OAuthClientCredentialsGrant
+> = z.object({
+  grantType: z.literal("client_credentials"),
+  clientId: z.string().optional(),
+  clientSecret: z.string().optional(),
+  activationId: z.number().int().optional(),
+  audience: z.string().optional(),
+  scope: z.string().optional(),
+}).transform((v) => {
+  return remap$(v, {
+    grantType: "grant_type",
+    clientId: "client_id",
+    clientSecret: "client_secret",
+    activationId: "activation_id",
+  });
+});
+
+export function oAuthClientCredentialsGrantToJSON(
+  oAuthClientCredentialsGrant: OAuthClientCredentialsGrant,
+): string {
+  return JSON.stringify(
+    OAuthClientCredentialsGrant$outboundSchema.parse(
+      oAuthClientCredentialsGrant,
+    ),
+  );
+}

package/src/models/components/oauthclirefreshtokengrant.ts

@@ -0,0 +1,86 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+
+/**
+ * The apps CLI's refresh, as the public client `greensecurity-apps-cli`: no
+ *
+ * @remarks
+ * `client_secret`, and `Authorization` is not read. The `gsdr_` refresh token is the
+ * credential. The response is a new `gsd_` developer token and a new `gsdr_` refresh
+ * token, in the device grant's shape.
+ *
+ * - **Rotation.** A refresh token works once. Refreshing spends it and revokes the
+ *   login's live developer token, so keep only the newest pair. `scope` can only narrow.
+ * - **Reuse detection.** Presenting a spent refresh token revokes every token of that
+ *   login (every token descended from one device authorization) and answers
+ *   `invalid_grant`. So does presenting a revoked one, or losing a race to spend one.
+ * - **Grace window.** One exception: a spent refresh token presented again within 30
+ *   seconds of being spent, while its direct replacement has been neither used nor
+ *   revoked, is taken as a retry after a lost response. It answers `200` with a fresh
+ *   pair, and the unused replacement pair is revoked.
+ * - **Lifetimes.** A refresh token expires after 30 days unused. A login ends 90 days
+ *   after its device authorization however often it is refreshed; tokens are issued
+ *   capped at that end, and a refresh past it is `invalid_grant`.
+ * - **Rate limit.** 60 refreshes per address per ten minutes, then `429` `slow_down`.
+ *
+ * Every `invalid_grant` here reads "Re-authenticate with `gs-apps login`.": start a new
+ * device login.
+ */
+export type OAuthCliRefreshTokenGrant = {
+  grantType: "refresh_token";
+  /**
+   * The `gsdr_` refresh token to spend.
+   */
+  refreshToken: string;
+  /**
+   * The apps CLI's public client id. Any other `client_id` with a `gsdr_` token is `401` `invalid_client`.
+   */
+  clientId: "greensecurity-apps-cli";
+  /**
+   * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+   *
+   * @remarks
+   * the device grant) to narrow the token to. Leave it out to get everything the client is
+   * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+   * is left the request fails with `invalid_scope`.
+   */
+  scope?: string | undefined;
+};
+
+/** @internal */
+export type OAuthCliRefreshTokenGrant$Outbound = {
+  grant_type: "refresh_token";
+  refresh_token: string;
+  client_id: "greensecurity-apps-cli";
+  scope?: string | undefined;
+};
+
+/** @internal */
+export const OAuthCliRefreshTokenGrant$outboundSchema: z.ZodType<
+  OAuthCliRefreshTokenGrant$Outbound,
+  z.ZodTypeDef,
+  OAuthCliRefreshTokenGrant
+> = z.object({
+  grantType: z.literal("refresh_token"),
+  refreshToken: z.string(),
+  clientId: z.literal("greensecurity-apps-cli"),
+  scope: z.string().optional(),
+}).transform((v) => {
+  return remap$(v, {
+    grantType: "grant_type",
+    refreshToken: "refresh_token",
+    clientId: "client_id",
+  });
+});
+
+export function oAuthCliRefreshTokenGrantToJSON(
+  oAuthCliRefreshTokenGrant: OAuthCliRefreshTokenGrant,
+): string {
+  return JSON.stringify(
+    OAuthCliRefreshTokenGrant$outboundSchema.parse(oAuthCliRefreshTokenGrant),
+  );
+}

package/src/models/components/oauthdevicecodegrant.ts

@@ -0,0 +1,73 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+
+/**
+ * RFC 8628 device authorization, used by `apps-cli login`. Poll with the `device_code`
+ *
+ * @remarks
+ * from `POST /oauth/device_authorization` at the returned `interval` until the user
+ * approves; the result is a 15-minute developer CLI token (`gsd_`) and a `gsdr_` refresh
+ * token that renews it (see `OAuthCliRefreshTokenGrant`). The device authorization starts
+ * the login's 90-day limit. Until then each poll is answered with a
+ * `400` `OAuthError` whose `error` is `authorization_pending` (keep polling), `slow_down`
+ * (add 5 seconds to the interval), `access_denied` (the user declined; stop) or
+ * `expired_token` (start again). `Authorization` is not read.
+ */
+export type OAuthDeviceCodeGrant = {
+  grantType: "urn:ietf:params:oauth:grant-type:device_code";
+  /**
+   * The `device_code` returned by `POST /oauth/device_authorization`.
+   */
+  deviceCode: string;
+  /**
+   * The client that started the flow. `greensecurity-apps-cli` is the only registered client.
+   */
+  clientId: string;
+  /**
+   * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+   *
+   * @remarks
+   * the device grant) to narrow the token to. Leave it out to get everything the client is
+   * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+   * is left the request fails with `invalid_scope`.
+   */
+  scope?: string | undefined;
+};
+
+/** @internal */
+export type OAuthDeviceCodeGrant$Outbound = {
+  grant_type: "urn:ietf:params:oauth:grant-type:device_code";
+  device_code: string;
+  client_id: string;
+  scope?: string | undefined;
+};
+
+/** @internal */
+export const OAuthDeviceCodeGrant$outboundSchema: z.ZodType<
+  OAuthDeviceCodeGrant$Outbound,
+  z.ZodTypeDef,
+  OAuthDeviceCodeGrant
+> = z.object({
+  grantType: z.literal("urn:ietf:params:oauth:grant-type:device_code"),
+  deviceCode: z.string(),
+  clientId: z.string(),
+  scope: z.string().optional(),
+}).transform((v) => {
+  return remap$(v, {
+    grantType: "grant_type",
+    deviceCode: "device_code",
+    clientId: "client_id",
+  });
+});
+
+export function oAuthDeviceCodeGrantToJSON(
+  oAuthDeviceCodeGrant: OAuthDeviceCodeGrant,
+): string {
+  return JSON.stringify(
+    OAuthDeviceCodeGrant$outboundSchema.parse(oAuthDeviceCodeGrant),
+  );
+}

package/src/models/components/oautherrorcode.ts

@@ -0,0 +1,67 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import * as openEnums from "../../types/enums.js";
+import { OpenEnum } from "../../types/enums.js";
+
+/**
+ * The RFC error code:
+ *
+ * @remarks
+ *
+ * | Code | Meaning |
+ * | --- | --- |
+ * | `invalid_request` | A parameter is missing or malformed (including `client_id` without `client_secret` or the reverse), an OAuth parameter was sent in the query string rather than the body, the body could not be parsed, or more than one activation covers the user and `activation_id` was left out. |
+ * | `invalid_client` | The client could not be authenticated. Returned with `401`. On the apps CLI's `refresh_token` (a `gsdr_` token): a `client_id` other than `greensecurity-apps-cli`. On `client_credentials`: wrong `client_id` or `client_secret`; an `Authorization` token that is missing, invalid, or not the service account's permanent token (a short-lived, narrowed or app token is refused); or a locked service account. On `refresh_token`: `client_id` or `client_secret` does not match the refresh token's service account, or that account is locked. On the device grant and `POST /oauth/device_authorization`: an unknown `client_id`. On `POST /oauth/introspect` and `POST /oauth/revoke`: see each endpoint. |
+ * | `invalid_grant` | `subject_token` is invalid or expired, is an app token or a narrowed (scoped) token, or belongs to a locked user or a service account; `refresh_token` is unknown, expired, already used or not a service account's; an apps CLI refresh token is unknown, expired, revoked or reused, its login is past 90 days, or its developer is locked or deleted (all answered "Re-authenticate with `gs-apps login`."); or `device_code` is unknown or already used, or the user who approved it can no longer sign in. |
+ * | `unauthorized_client` | The caller may not use this grant: `client_credentials` from a user who is not an API service account. |
+ * | `unsupported_grant_type` | `grant_type` is not one of the four supported grants. |
+ * | `invalid_target` | `audience` names no app, or an app the user is not covered by; or `activation_id` is not an activation of the caller's app, or does not match `audience`. |
+ * | `invalid_scope` | None of the requested scopes is available to the client: what it asked for and what it is allowed have nothing in common. On `POST /oauth/device_authorization`, any scope other than `apps:develop`. |
+ * | `authorization_pending` | Device flow: the user has not approved the request yet. Keep polling. |
+ * | `slow_down` | Device flow: polling too fast. Add 5 seconds to the interval and keep polling. `POST /oauth/device_authorization` also returns it, with `429`, when one address starts too many logins, and so does the apps CLI's `refresh_token` past 60 refreshes per address in ten minutes. Wait and retry; it is not a failed login. |
+ * | `access_denied` | Device flow: the user declined the request. Stop polling. |
+ * | `expired_token` | Device flow: `device_code` expired. Start again from `POST /oauth/device_authorization`. |
+ */
+export const OAuthErrorCode = {
+  InvalidRequest: "invalid_request",
+  InvalidClient: "invalid_client",
+  InvalidGrant: "invalid_grant",
+  UnauthorizedClient: "unauthorized_client",
+  UnsupportedGrantType: "unsupported_grant_type",
+  InvalidTarget: "invalid_target",
+  InvalidScope: "invalid_scope",
+  AuthorizationPending: "authorization_pending",
+  SlowDown: "slow_down",
+  AccessDenied: "access_denied",
+  ExpiredToken: "expired_token",
+} as const;
+/**
+ * The RFC error code:
+ *
+ * @remarks
+ *
+ * | Code | Meaning |
+ * | --- | --- |
+ * | `invalid_request` | A parameter is missing or malformed (including `client_id` without `client_secret` or the reverse), an OAuth parameter was sent in the query string rather than the body, the body could not be parsed, or more than one activation covers the user and `activation_id` was left out. |
+ * | `invalid_client` | The client could not be authenticated. Returned with `401`. On the apps CLI's `refresh_token` (a `gsdr_` token): a `client_id` other than `greensecurity-apps-cli`. On `client_credentials`: wrong `client_id` or `client_secret`; an `Authorization` token that is missing, invalid, or not the service account's permanent token (a short-lived, narrowed or app token is refused); or a locked service account. On `refresh_token`: `client_id` or `client_secret` does not match the refresh token's service account, or that account is locked. On the device grant and `POST /oauth/device_authorization`: an unknown `client_id`. On `POST /oauth/introspect` and `POST /oauth/revoke`: see each endpoint. |
+ * | `invalid_grant` | `subject_token` is invalid or expired, is an app token or a narrowed (scoped) token, or belongs to a locked user or a service account; `refresh_token` is unknown, expired, already used or not a service account's; an apps CLI refresh token is unknown, expired, revoked or reused, its login is past 90 days, or its developer is locked or deleted (all answered "Re-authenticate with `gs-apps login`."); or `device_code` is unknown or already used, or the user who approved it can no longer sign in. |
+ * | `unauthorized_client` | The caller may not use this grant: `client_credentials` from a user who is not an API service account. |
+ * | `unsupported_grant_type` | `grant_type` is not one of the four supported grants. |
+ * | `invalid_target` | `audience` names no app, or an app the user is not covered by; or `activation_id` is not an activation of the caller's app, or does not match `audience`. |
+ * | `invalid_scope` | None of the requested scopes is available to the client: what it asked for and what it is allowed have nothing in common. On `POST /oauth/device_authorization`, any scope other than `apps:develop`. |
+ * | `authorization_pending` | Device flow: the user has not approved the request yet. Keep polling. |
+ * | `slow_down` | Device flow: polling too fast. Add 5 seconds to the interval and keep polling. `POST /oauth/device_authorization` also returns it, with `429`, when one address starts too many logins, and so does the apps CLI's `refresh_token` past 60 refreshes per address in ten minutes. Wait and retry; it is not a failed login. |
+ * | `access_denied` | Device flow: the user declined the request. Stop polling. |
+ * | `expired_token` | Device flow: `device_code` expired. Start again from `POST /oauth/device_authorization`. |
+ */
+export type OAuthErrorCode = OpenEnum<typeof OAuthErrorCode>;
+
+/** @internal */
+export const OAuthErrorCode$inboundSchema: z.ZodType<
+  OAuthErrorCode,
+  z.ZodTypeDef,
+  unknown
+> = openEnums.inboundSchema(OAuthErrorCode);

package/src/models/components/oauthrefreshtokengrant.ts

@@ -0,0 +1,79 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+
+/**
+ * A confidential client's refresh: trades an API service account's refresh token for a
+ *
+ * @remarks
+ * new plain API access token and a new refresh token. (The apps CLI's public-client
+ * refresh is `OAuthCliRefreshTokenGrant`.) Refresh tokens rotate: each works once, and the one presented stops
+ * working as soon as it is spent. The new token is never wider than the one it replaces:
+ * `scope` can only narrow what the refresh token carried. The client authenticates with
+ * `client_id` and `client_secret` in the body; `Authorization` is not read. A locked
+ * service account is `401` `invalid_client`.
+ */
+export type OAuthRefreshTokenGrant = {
+  grantType: "refresh_token";
+  /**
+   * The refresh token to spend.
+   */
+  refreshToken: string;
+  /**
+   * The email of the service account the refresh token belongs to.
+   */
+  clientId: string;
+  /**
+   * The service account's permanent token.
+   */
+  clientSecret: string;
+  /**
+   * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+   *
+   * @remarks
+   * the device grant) to narrow the token to. Leave it out to get everything the client is
+   * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+   * is left the request fails with `invalid_scope`.
+   */
+  scope?: string | undefined;
+};
+
+/** @internal */
+export type OAuthRefreshTokenGrant$Outbound = {
+  grant_type: "refresh_token";
+  refresh_token: string;
+  client_id: string;
+  client_secret: string;
+  scope?: string | undefined;
+};
+
+/** @internal */
+export const OAuthRefreshTokenGrant$outboundSchema: z.ZodType<
+  OAuthRefreshTokenGrant$Outbound,
+  z.ZodTypeDef,
+  OAuthRefreshTokenGrant
+> = z.object({
+  grantType: z.literal("refresh_token"),
+  refreshToken: z.string(),
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scope: z.string().optional(),
+}).transform((v) => {
+  return remap$(v, {
+    grantType: "grant_type",
+    refreshToken: "refresh_token",
+    clientId: "client_id",
+    clientSecret: "client_secret",
+  });
+});
+
+export function oAuthRefreshTokenGrantToJSON(
+  oAuthRefreshTokenGrant: OAuthRefreshTokenGrant,
+): string {
+  return JSON.stringify(
+    OAuthRefreshTokenGrant$outboundSchema.parse(oAuthRefreshTokenGrant),
+  );
+}