@greensecurity/javascript-sdk 0.46.0-beta.8 → 0.46.0-beta.9

package/src/models/components/oauthtokenexchangegrant.ts

@@ -0,0 +1,146 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import { ClosedEnum } from "../../types/enums.js";
+
+/**
+ * The type of `subject_token`. Only an access token is accepted, which is also the default.
+ */
+export const SubjectTokenType = {
+  UrnIetfParamsOauthTokenTypeAccessToken:
+    "urn:ietf:params:oauth:token-type:access_token",
+} as const;
+/**
+ * The type of `subject_token`. Only an access token is accepted, which is also the default.
+ */
+export type SubjectTokenType = ClosedEnum<typeof SubjectTokenType>;
+
+/**
+ * `app_user` issues a token that acts as the user, limited to the manifest
+ *
+ * @remarks
+ * permissions their own role also grants. `app_installation` issues a token that acts
+ * as the app's service account, narrowed to the tenant of one activation.
+ */
+export const RequestedTokenType = {
+  UrnGreensecurityTokenTypeAppUser: "urn:greensecurity:token-type:app_user",
+  UrnGreensecurityTokenTypeAppInstallation:
+    "urn:greensecurity:token-type:app_installation",
+} as const;
+/**
+ * `app_user` issues a token that acts as the user, limited to the manifest
+ *
+ * @remarks
+ * permissions their own role also grants. `app_installation` issues a token that acts
+ * as the app's service account, narrowed to the tenant of one activation.
+ */
+export type RequestedTokenType = ClosedEnum<typeof RequestedTokenType>;
+
+/**
+ * RFC 8693 token exchange. The host app trades the signed-in user's session token for a
+ *
+ * @remarks
+ * short-lived token bound to one app and one activation. App tokens can never be used as
+ * `subject_token`. `Authorization` is not read.
+ */
+export type OAuthTokenExchangeGrant = {
+  grantType: "urn:ietf:params:oauth:grant-type:token-exchange";
+  /**
+   * The signed-in user's session token (from `POST /users/authenticate`). Missing, it is
+   *
+   * @remarks
+   * `invalid_request`. A token narrowed with `scope` is refused with `invalid_grant`, as
+   * is any app token.
+   */
+  subjectToken: string;
+  /**
+   * The type of `subject_token`. Only an access token is accepted, which is also the default.
+   */
+  subjectTokenType?: SubjectTokenType | undefined;
+  /**
+   * The app the token is for, as `app:<marketplace app id>`. Missing or unknown, it is `invalid_target`.
+   */
+  audience: string;
+  /**
+   * `app_user` issues a token that acts as the user, limited to the manifest
+   *
+   * @remarks
+   * permissions their own role also grants. `app_installation` issues a token that acts
+   * as the app's service account, narrowed to the tenant of one activation.
+   */
+  requestedTokenType: RequestedTokenType;
+  /**
+   * The activation to bind the token to. Required when more than one activation of the
+   *
+   * @remarks
+   * app covers the user (`invalid_request` otherwise); the user must be covered by it
+   * either way (`invalid_target`).
+   */
+  activationId?: number | undefined;
+  /**
+   * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+   *
+   * @remarks
+   * the device grant) to narrow the token to. Leave it out to get everything the client is
+   * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+   * is left the request fails with `invalid_scope`.
+   */
+  scope?: string | undefined;
+};
+
+/** @internal */
+export const SubjectTokenType$outboundSchema: z.ZodNativeEnum<
+  typeof SubjectTokenType
+> = z.nativeEnum(SubjectTokenType);
+
+/** @internal */
+export const RequestedTokenType$outboundSchema: z.ZodNativeEnum<
+  typeof RequestedTokenType
+> = z.nativeEnum(RequestedTokenType);
+
+/** @internal */
+export type OAuthTokenExchangeGrant$Outbound = {
+  grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+  subject_token: string;
+  subject_token_type: string;
+  audience: string;
+  requested_token_type: string;
+  activation_id?: number | undefined;
+  scope?: string | undefined;
+};
+
+/** @internal */
+export const OAuthTokenExchangeGrant$outboundSchema: z.ZodType<
+  OAuthTokenExchangeGrant$Outbound,
+  z.ZodTypeDef,
+  OAuthTokenExchangeGrant
+> = z.object({
+  grantType: z.literal("urn:ietf:params:oauth:grant-type:token-exchange"),
+  subjectToken: z.string(),
+  subjectTokenType: SubjectTokenType$outboundSchema.default(
+    "urn:ietf:params:oauth:token-type:access_token",
+  ),
+  audience: z.string(),
+  requestedTokenType: RequestedTokenType$outboundSchema,
+  activationId: z.number().int().optional(),
+  scope: z.string().optional(),
+}).transform((v) => {
+  return remap$(v, {
+    grantType: "grant_type",
+    subjectToken: "subject_token",
+    subjectTokenType: "subject_token_type",
+    requestedTokenType: "requested_token_type",
+    activationId: "activation_id",
+  });
+});
+
+export function oAuthTokenExchangeGrantToJSON(
+  oAuthTokenExchangeGrant: OAuthTokenExchangeGrant,
+): string {
+  return JSON.stringify(
+    OAuthTokenExchangeGrant$outboundSchema.parse(oAuthTokenExchangeGrant),
+  );
+}

package/src/models/components/oauthtokenrequest.ts

@@ -0,0 +1,76 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { smartUnion } from "../../types/smartUnion.js";
+import {
+  OAuthClientCredentialsGrant,
+  OAuthClientCredentialsGrant$Outbound,
+  OAuthClientCredentialsGrant$outboundSchema,
+} from "./oauthclientcredentialsgrant.js";
+import {
+  OAuthCliRefreshTokenGrant,
+  OAuthCliRefreshTokenGrant$Outbound,
+  OAuthCliRefreshTokenGrant$outboundSchema,
+} from "./oauthclirefreshtokengrant.js";
+import {
+  OAuthDeviceCodeGrant,
+  OAuthDeviceCodeGrant$Outbound,
+  OAuthDeviceCodeGrant$outboundSchema,
+} from "./oauthdevicecodegrant.js";
+import {
+  OAuthRefreshTokenGrant,
+  OAuthRefreshTokenGrant$Outbound,
+  OAuthRefreshTokenGrant$outboundSchema,
+} from "./oauthrefreshtokengrant.js";
+import {
+  OAuthTokenExchangeGrant,
+  OAuthTokenExchangeGrant$Outbound,
+  OAuthTokenExchangeGrant$outboundSchema,
+} from "./oauthtokenexchangegrant.js";
+
+/**
+ * One of the four supported grants, selected by `grant_type`. `refresh_token` has two
+ *
+ * @remarks
+ * variants, told apart by the client: a service account's (`OAuthRefreshTokenGrant`,
+ * with `client_secret`) and the apps CLI's public-client refresh
+ * (`OAuthCliRefreshTokenGrant`, `client_id=greensecurity-apps-cli` and a `gsdr_` token).
+ * No body matches both: the CLI variant takes no `client_secret`.
+ */
+export type OAuthTokenRequest =
+  | OAuthTokenExchangeGrant
+  | OAuthRefreshTokenGrant
+  | OAuthCliRefreshTokenGrant
+  | OAuthDeviceCodeGrant
+  | OAuthClientCredentialsGrant;
+
+/** @internal */
+export type OAuthTokenRequest$Outbound =
+  | OAuthTokenExchangeGrant$Outbound
+  | OAuthRefreshTokenGrant$Outbound
+  | OAuthCliRefreshTokenGrant$Outbound
+  | OAuthDeviceCodeGrant$Outbound
+  | OAuthClientCredentialsGrant$Outbound;
+
+/** @internal */
+export const OAuthTokenRequest$outboundSchema: z.ZodType<
+  OAuthTokenRequest$Outbound,
+  z.ZodTypeDef,
+  OAuthTokenRequest
+> = smartUnion([
+  OAuthTokenExchangeGrant$outboundSchema,
+  OAuthRefreshTokenGrant$outboundSchema,
+  OAuthCliRefreshTokenGrant$outboundSchema,
+  OAuthDeviceCodeGrant$outboundSchema,
+  OAuthClientCredentialsGrant$outboundSchema,
+]);
+
+export function oAuthTokenRequestToJSON(
+  oAuthTokenRequest: OAuthTokenRequest,
+): string {
+  return JSON.stringify(
+    OAuthTokenRequest$outboundSchema.parse(oAuthTokenRequest),
+  );
+}

package/src/models/components/oauthtokentypehint.ts

@@ -0,0 +1,23 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { ClosedEnum } from "../../types/enums.js";
+
+/**
+ * Optional hint about the kind of token. Tokens are recognised by prefix, so this is informational.
+ */
+export const OAuthTokenTypeHint = {
+  AccessToken: "access_token",
+  RefreshToken: "refresh_token",
+} as const;
+/**
+ * Optional hint about the kind of token. Tokens are recognised by prefix, so this is informational.
+ */
+export type OAuthTokenTypeHint = ClosedEnum<typeof OAuthTokenTypeHint>;
+
+/** @internal */
+export const OAuthTokenTypeHint$outboundSchema: z.ZodNativeEnum<
+  typeof OAuthTokenTypeHint
+> = z.nativeEnum(OAuthTokenTypeHint);

package/src/models/components/pager.ts

@@ -48,6 +48,15 @@ export type Pager = {
    * - items_per_page
    */
   useUrlParams: boolean;
+  /**
+   * How the server narrowed the list to your tenant, when it did, or `null`. Only some
+   *
+   * @remarks
+   * list endpoints return it, such as `GET /apps/secrets` and
+   * `GET /marketplace/apps/{id}/developers`; the others omit the field. Don't rely on
+   * its contents.
+   */
+  scope?: Array<any> | null | undefined;
 };
 
 /** @internal */
@@ -60,6 +69,7 @@ export const Pager$inboundSchema: z.ZodType<Pager, z.ZodTypeDef, unknown> = z
     items_per_page: types.number(),
     page: types.number(),
     use_url_params: types.boolean(),
+    scope: z.nullable(z.array(z.any())).optional(),
   }).transform((v) => {
     return remap$(v, {
       "base_url": "baseUrl",

package/src/models/components/tokenintrospection.ts

@@ -0,0 +1,132 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import { safeParse } from "../../lib/schemas.js";
+import { Result as SafeParseResult } from "../../types/fp.js";
+import * as types from "../../types/primitives.js";
+import { SDKValidationError } from "../errors/sdkvalidationerror.js";
+import { AppTokenKind, AppTokenKind$inboundSchema } from "./apptokenkind.js";
+
+/**
+ * RFC 8693 actor claim: who caused the token to be issued. Present only on an
+ *
+ * @remarks
+ * installation token obtained by token exchange, where `sub` is the service account and
+ * `act.sub` is the signed-in user whose view requested it.
+ */
+export type TokenIntrospectionActor = {
+  /**
+   * The user id, as a string.
+   */
+  sub: string;
+};
+
+/**
+ * RFC 7662 section 2.2. When `active` is `false` no other field is returned: the token is
+ *
+ * @remarks
+ * unknown, expired or revoked, was issued to a different app than the caller's, is a
+ * developer CLI token, or belongs to a user who has since been locked.
+ */
+export type TokenIntrospection = {
+  /**
+   * Whether the token is currently valid for your app.
+   */
+  active: boolean;
+  /**
+   * The id of the user the token acts as, as a string (RFC 7662). For an app user token
+   *
+   * @remarks
+   * this is the viewer; for an installation token it is the app's service account.
+   */
+  sub?: string | undefined;
+  /**
+   * The marketplace app the token was issued to.
+   */
+  appId?: number | undefined;
+  /**
+   * The activation the token is bound to.
+   */
+  activationId?: number | undefined;
+  /**
+   * Space-delimited scopes, as in `TokenResponse.scope`.
+   */
+  scope?: string | undefined;
+  /**
+   * Expiry, in seconds since the Unix epoch.
+   */
+  exp?: number | undefined;
+  /**
+   * When the token was issued, in seconds since the Unix epoch.
+   */
+  iat?: number | undefined;
+  /**
+   * `app_user` tokens act as a user; `app_installation` tokens act as the app's service account within one activation.
+   */
+  kind?: AppTokenKind | undefined;
+  tokenType?: "Bearer" | undefined;
+  /**
+   * RFC 8693 actor claim: who caused the token to be issued. Present only on an
+   *
+   * @remarks
+   * installation token obtained by token exchange, where `sub` is the service account and
+   * `act.sub` is the signed-in user whose view requested it.
+   */
+  act?: TokenIntrospectionActor | undefined;
+};
+
+/** @internal */
+export const TokenIntrospectionActor$inboundSchema: z.ZodType<
+  TokenIntrospectionActor,
+  z.ZodTypeDef,
+  unknown
+> = z.object({
+  sub: types.string(),
+});
+
+export function tokenIntrospectionActorFromJSON(
+  jsonString: string,
+): SafeParseResult<TokenIntrospectionActor, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => TokenIntrospectionActor$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'TokenIntrospectionActor' from JSON`,
+  );
+}
+
+/** @internal */
+export const TokenIntrospection$inboundSchema: z.ZodType<
+  TokenIntrospection,
+  z.ZodTypeDef,
+  unknown
+> = z.object({
+  active: types.boolean(),
+  sub: types.optional(types.string()),
+  app_id: types.optional(types.number()),
+  activation_id: types.optional(types.number()),
+  scope: types.optional(types.string()),
+  exp: types.optional(types.number()),
+  iat: types.optional(types.number()),
+  kind: types.optional(AppTokenKind$inboundSchema),
+  token_type: types.optional(types.literal("Bearer")),
+  act: types.optional(z.lazy(() => TokenIntrospectionActor$inboundSchema)),
+}).transform((v) => {
+  return remap$(v, {
+    "app_id": "appId",
+    "activation_id": "activationId",
+    "token_type": "tokenType",
+  });
+});
+
+export function tokenIntrospectionFromJSON(
+  jsonString: string,
+): SafeParseResult<TokenIntrospection, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => TokenIntrospection$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'TokenIntrospection' from JSON`,
+  );
+}

package/src/models/components/tokenintrospectionrequest.ts

@@ -0,0 +1,49 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import {
+  OAuthTokenTypeHint,
+  OAuthTokenTypeHint$outboundSchema,
+} from "./oauthtokentypehint.js";
+
+export type TokenIntrospectionRequest = {
+  /**
+   * The token to check, typically an app user token your app's UI sent to your backend.
+   */
+  token: string;
+  /**
+   * Optional hint about the kind of token. Tokens are recognised by prefix, so this is informational.
+   */
+  tokenTypeHint?: OAuthTokenTypeHint | undefined;
+};
+
+/** @internal */
+export type TokenIntrospectionRequest$Outbound = {
+  token: string;
+  token_type_hint?: string | undefined;
+};
+
+/** @internal */
+export const TokenIntrospectionRequest$outboundSchema: z.ZodType<
+  TokenIntrospectionRequest$Outbound,
+  z.ZodTypeDef,
+  TokenIntrospectionRequest
+> = z.object({
+  token: z.string(),
+  tokenTypeHint: OAuthTokenTypeHint$outboundSchema.optional(),
+}).transform((v) => {
+  return remap$(v, {
+    tokenTypeHint: "token_type_hint",
+  });
+});
+
+export function tokenIntrospectionRequestToJSON(
+  tokenIntrospectionRequest: TokenIntrospectionRequest,
+): string {
+  return JSON.stringify(
+    TokenIntrospectionRequest$outboundSchema.parse(tokenIntrospectionRequest),
+  );
+}

package/src/models/components/tokenresponse.ts

@@ -0,0 +1,178 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import { safeParse } from "../../lib/schemas.js";
+import * as openEnums from "../../types/enums.js";
+import { OpenEnum } from "../../types/enums.js";
+import { Result as SafeParseResult } from "../../types/fp.js";
+import * as types from "../../types/primitives.js";
+import { SDKValidationError } from "../errors/sdkvalidationerror.js";
+
+/**
+ * What kind of token was issued. Returned for app user, app installation and developer
+ *
+ * @remarks
+ * CLI tokens, including every CLI refresh; absent from the plain API token that
+ * `client_credentials` without `activation_id` and a service account's
+ * `refresh_token` return.
+ */
+export const IssuedTokenType = {
+  UrnGreensecurityTokenTypeAppUser: "urn:greensecurity:token-type:app_user",
+  UrnGreensecurityTokenTypeAppInstallation:
+    "urn:greensecurity:token-type:app_installation",
+  UrnGreensecurityTokenTypeDeveloperCli:
+    "urn:greensecurity:token-type:developer_cli",
+} as const;
+/**
+ * What kind of token was issued. Returned for app user, app installation and developer
+ *
+ * @remarks
+ * CLI tokens, including every CLI refresh; absent from the plain API token that
+ * `client_credentials` without `activation_id` and a service account's
+ * `refresh_token` return.
+ */
+export type IssuedTokenType = OpenEnum<typeof IssuedTokenType>;
+
+/**
+ * A successful `POST /oauth/token` response (RFC 6749 section 5.1, RFC 8693 section 2.2.1).
+ *
+ * @remarks
+ * Send `access_token` as `Authorization: Bearer <access_token>`; app and developer tokens
+ * are refused as a `?token=` query parameter.
+ *
+ * Which fields are present depends on the grant:
+ *
+ * | Grant | Fields |
+ * | --- | --- |
+ * | Token exchange, and `client_credentials` with `activation_id` | `access_token`, `issued_token_type`, `token_type`, `expires_in`, `scope`, `activation_id` |
+ * | Device code, and the apps CLI's `refresh_token` | `access_token`, `issued_token_type`, `token_type`, `expires_in`, `scope`, `refresh_token`, `refresh_token_expires_in` |
+ * | `client_credentials` without `activation_id` | `access_token`, `token_type`, `expires_in`, and `scope` only when the request sent one |
+ * | A service account's `refresh_token` | As `client_credentials` without `activation_id`, plus `refresh_token` |
+ */
+export type TokenResponse = {
+  /**
+   * The token. An app or developer token's prefix names its kind: `gsu_` for an app user
+   *
+   * @remarks
+   * token, `gsi_` for an app installation token, `gsd_` for a developer CLI token. These
+   * are shown only once and cannot be retrieved later. The access
+   * token of a `client_credentials` grant without `activation_id`, or of a service
+   * account's `refresh_token` grant, is an ordinary API token with no prefix.
+   */
+  accessToken: string;
+  /**
+   * What kind of token was issued. Returned for app user, app installation and developer
+   *
+   * @remarks
+   * CLI tokens, including every CLI refresh; absent from the plain API token that
+   * `client_credentials` without `activation_id` and a service account's
+   * `refresh_token` return.
+   */
+  issuedTokenType?: IssuedTokenType | undefined;
+  tokenType: "Bearer";
+  /**
+   * Seconds until the token expires: 900 (15 minutes) for every kind. A developer CLI
+   *
+   * @remarks
+   * token is capped at the end of its login (90 days after the device authorization), so
+   * near that end it can be less. Request a new token before then. Only the device grant
+   * and the `refresh_token` grant return a `refresh_token`.
+   */
+  expiresIn: number;
+  /**
+   * Space-delimited scopes the token carries. For an app user token these are the
+   *
+   * @remarks
+   * manifest permissions (`resource.action`) that the user's own role also grants; for an
+   * installation token, the app's manifest permissions; for a developer CLI token,
+   * `apps:develop`. A `scope` in the request narrows this further.
+   *
+   * A plain API access token (`client_credentials` without `activation_id`, or
+   * `refresh_token`) carries `scope` only when it was narrowed: when the request sent a
+   * `scope`, or when the refresh token it replaces was itself narrowed. Without it the
+   * token has every permission of the service account.
+   *
+   * A narrowed token (any app or developer token, or a plain API access token that
+   * carries `scope`) can only use its scope. An endpoint that names a permission
+   * outside it answers `403` ("App token doesn't have permission" for an app token,
+   * "Token scope doesn't permit this." for a plain one); an endpoint that checks no
+   * named permission answers `403` "This endpoint does not accept scoped tokens."
+   * unless it applies the scope itself. `GET /users/{id}` does, but returns no
+   * `user_token` to a narrowed token and refuses `expand=user.payment_profile` with
+   * `403`. A narrowed token is also refused as the `client_credentials` Bearer, as a
+   * `subject_token`, and as the credential for `POST /oauth/introspect` and
+   * `POST /oauth/revoke`.
+   */
+  scope?: string | undefined;
+  /**
+   * The activation an app user or app installation token is bound to. Not returned for any other token.
+   */
+  activationId?: number | undefined;
+  /**
+   * A single-use refresh token. Keep it as secret as a password; it is never a Bearer
+   *
+   * @remarks
+   * credential.
+   *
+   * - **Apps CLI** (`gsdr_…`): returned by the device grant and by every CLI refresh.
+   *   Each refresh spends it and returns a new one (see `OAuthCliRefreshTokenGrant`).
+   * - **Service account** (no prefix): returned by a service account's `refresh_token`
+   *   grant, replacing the token just spent. It expires after 30 days.
+   */
+  refreshToken?: string | undefined;
+  /**
+   * Apps CLI only: seconds until `refresh_token` expires if it is not used, normally
+   *
+   * @remarks
+   * 2592000 (30 days). A CLI login ends 90 days after the device authorization however
+   * often it is refreshed, so in its last 30 days this is capped at that end (for
+   * example 259200 on day 87).
+   */
+  refreshTokenExpiresIn?: number | undefined;
+};
+
+/** @internal */
+export const IssuedTokenType$inboundSchema: z.ZodType<
+  IssuedTokenType,
+  z.ZodTypeDef,
+  unknown
+> = openEnums.inboundSchema(IssuedTokenType);
+
+/** @internal */
+export const TokenResponse$inboundSchema: z.ZodType<
+  TokenResponse,
+  z.ZodTypeDef,
+  unknown
+> = z.object({
+  access_token: types.string(),
+  issued_token_type: types.optional(IssuedTokenType$inboundSchema),
+  token_type: types.literal("Bearer"),
+  expires_in: types.number(),
+  scope: types.optional(types.string()),
+  activation_id: types.optional(types.number()),
+  refresh_token: types.optional(types.string()),
+  refresh_token_expires_in: types.optional(types.number()),
+}).transform((v) => {
+  return remap$(v, {
+    "access_token": "accessToken",
+    "issued_token_type": "issuedTokenType",
+    "token_type": "tokenType",
+    "expires_in": "expiresIn",
+    "activation_id": "activationId",
+    "refresh_token": "refreshToken",
+    "refresh_token_expires_in": "refreshTokenExpiresIn",
+  });
+});
+
+export function tokenResponseFromJSON(
+  jsonString: string,
+): SafeParseResult<TokenResponse, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => TokenResponse$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'TokenResponse' from JSON`,
+  );
+}

package/src/models/components/tokenrevocationrequest.ts

@@ -0,0 +1,60 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import {
+  OAuthTokenTypeHint,
+  OAuthTokenTypeHint$outboundSchema,
+} from "./oauthtokentypehint.js";
+
+export type TokenRevocationRequest = {
+  /**
+   * The token to revoke. Revoking any token of an apps CLI login (`gsd_` or `gsdr_`) revokes the whole login.
+   */
+  token: string;
+  /**
+   * Optional hint about the kind of token. Tokens are recognised by prefix, so this is informational.
+   */
+  tokenTypeHint?: OAuthTokenTypeHint | undefined;
+  /**
+   * The apps CLI's public client id (RFC 7009 section 2.1). With a `gsdr_` refresh token
+   *
+   * @remarks
+   * as `token`, no `Authorization` is needed: holding the refresh token entitles the
+   * caller to revoke its login. Ignored with any other token.
+   */
+  clientId?: "greensecurity-apps-cli" | undefined;
+};
+
+/** @internal */
+export type TokenRevocationRequest$Outbound = {
+  token: string;
+  token_type_hint?: string | undefined;
+  client_id?: "greensecurity-apps-cli" | undefined;
+};
+
+/** @internal */
+export const TokenRevocationRequest$outboundSchema: z.ZodType<
+  TokenRevocationRequest$Outbound,
+  z.ZodTypeDef,
+  TokenRevocationRequest
+> = z.object({
+  token: z.string(),
+  tokenTypeHint: OAuthTokenTypeHint$outboundSchema.optional(),
+  clientId: z.literal("greensecurity-apps-cli").optional(),
+}).transform((v) => {
+  return remap$(v, {
+    tokenTypeHint: "token_type_hint",
+    clientId: "client_id",
+  });
+});
+
+export function tokenRevocationRequestToJSON(
+  tokenRevocationRequest: TokenRevocationRequest,
+): string {
+  return JSON.stringify(
+    TokenRevocationRequest$outboundSchema.parse(tokenRevocationRequest),
+  );
+}