@greensecurity/javascript-sdk 0.46.0-beta.9 → 0.46.0

package/src/models/components/marketplaceappactivationevent.ts

@@ -1,136 +0,0 @@
-/*
- * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
- */
-
-import * as z from "zod/v3";
-import { remap as remap$ } from "../../lib/primitives.js";
-import { safeParse } from "../../lib/schemas.js";
-import { ClosedEnum } from "../../types/enums.js";
-import { Result as SafeParseResult } from "../../types/fp.js";
-import * as types from "../../types/primitives.js";
-import { SDKValidationError } from "../errors/sdkvalidationerror.js";
-import {
-  MarketplaceAppActivationCoverage,
-  MarketplaceAppActivationCoverage$inboundSchema,
-  MarketplaceAppActivationCoverage$Outbound,
-  MarketplaceAppActivationCoverage$outboundSchema,
-} from "./marketplaceappactivationcoverage.js";
-
-/**
- * What happened, the same action `Green-Security-Event` names.
- */
-export const MarketplaceAppActivationEventAction = {
-  Created: "created",
-  Updated: "updated",
-  Destroyed: "destroyed",
-} as const;
-/**
- * What happened, the same action `Green-Security-Event` names.
- */
-export type MarketplaceAppActivationEventAction = ClosedEnum<
-  typeof MarketplaceAppActivationEventAction
->;
-
-/**
- * The body of a `MarketplaceAppActivation.*` delivery: the activation, as
- *
- * @remarks
- * `GET /marketplace/activations` lists it, plus what happened to it.
- */
-export type MarketplaceAppActivationEvent = {
-  /**
-   * The activation id.
-   */
-  id: number;
-  /**
-   * The app that was installed.
-   */
-  marketplaceAppId: number;
-  /**
-   * What one activation of your app covers: the site, health system, facility, company or
-   *
-   * @remarks
-   * user it was installed for. An install is made at one of these, so one id is set and the
-   * others are null. A site install covers everything in the site, and a health system
-   * install covers its facilities.
-   */
-  coverage: MarketplaceAppActivationCoverage;
-  /**
-   * When the app was installed. Null for installations made before this was recorded.
-   */
-  created: Date | null;
-  /**
-   * What happened, the same action `Green-Security-Event` names.
-   */
-  action: MarketplaceAppActivationEventAction;
-};
-
-/** @internal */
-export const MarketplaceAppActivationEventAction$inboundSchema: z.ZodNativeEnum<
-  typeof MarketplaceAppActivationEventAction
-> = z.nativeEnum(MarketplaceAppActivationEventAction);
-/** @internal */
-export const MarketplaceAppActivationEventAction$outboundSchema:
-  z.ZodNativeEnum<typeof MarketplaceAppActivationEventAction> =
-    MarketplaceAppActivationEventAction$inboundSchema;
-
-/** @internal */
-export const MarketplaceAppActivationEvent$inboundSchema: z.ZodType<
-  MarketplaceAppActivationEvent,
-  z.ZodTypeDef,
-  unknown
-> = z.object({
-  id: types.number(),
-  marketplace_app_id: types.number(),
-  coverage: MarketplaceAppActivationCoverage$inboundSchema,
-  created: types.nullable(types.date()),
-  action: MarketplaceAppActivationEventAction$inboundSchema,
-}).transform((v) => {
-  return remap$(v, {
-    "marketplace_app_id": "marketplaceAppId",
-  });
-});
-/** @internal */
-export type MarketplaceAppActivationEvent$Outbound = {
-  id: number;
-  marketplace_app_id: number;
-  coverage: MarketplaceAppActivationCoverage$Outbound;
-  created: string | null;
-  action: string;
-};
-
-/** @internal */
-export const MarketplaceAppActivationEvent$outboundSchema: z.ZodType<
-  MarketplaceAppActivationEvent$Outbound,
-  z.ZodTypeDef,
-  MarketplaceAppActivationEvent
-> = z.object({
-  id: z.number().int(),
-  marketplaceAppId: z.number().int(),
-  coverage: MarketplaceAppActivationCoverage$outboundSchema,
-  created: z.nullable(z.date().transform(v => v.toISOString())),
-  action: MarketplaceAppActivationEventAction$outboundSchema,
-}).transform((v) => {
-  return remap$(v, {
-    marketplaceAppId: "marketplace_app_id",
-  });
-});
-
-export function marketplaceAppActivationEventToJSON(
-  marketplaceAppActivationEvent: MarketplaceAppActivationEvent,
-): string {
-  return JSON.stringify(
-    MarketplaceAppActivationEvent$outboundSchema.parse(
-      marketplaceAppActivationEvent,
-    ),
-  );
-}
-export function marketplaceAppActivationEventFromJSON(
-  jsonString: string,
-): SafeParseResult<MarketplaceAppActivationEvent, SDKValidationError> {
-  return safeParse(
-    jsonString,
-    (x) => MarketplaceAppActivationEvent$inboundSchema.parse(JSON.parse(x)),
-    `Failed to parse 'MarketplaceAppActivationEvent' from JSON`,
-  );
-}

package/src/models/components/oauthclientcredentialsgrant.ts

@@ -1,107 +0,0 @@
-/*
- * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
- */
-
-import * as z from "zod/v3";
-import { remap as remap$ } from "../../lib/primitives.js";
-
-/**
- * A token for an API service account's own backend. Authenticate with either:
- *
- * @remarks
- *
- * - `client_id` (the service account's email) and `client_secret` (its permanent token)
- *   in the body, always together; or
- * - neither of them, and the service account's permanent token in the
- *   `Authorization: Bearer` header. This is the only grant that reads `Authorization`,
- *   and it accepts nothing but the permanent token there: a short-lived or narrowed
- *   token, including one this grant issued, is `401` `invalid_client`.
- *
- * A locked service account is `401` `invalid_client` either way.
- *
- * What it issues depends on `activation_id`:
- *
- * - **Without `activation_id`**: a plain 15-minute API access token for the service
- *   account, with no refresh token. The response has no `issued_token_type` and no
- *   `activation_id`, and has `scope` only when the request sent one.
- * - **With `activation_id`**: an app installation token (`gsi_`) narrowed to that
- *   activation. The service account must be a marketplace app's, and the activation one
- *   of that app's. This is how any app's backend acts on one installation, and the only
- *   way a back-end-only app (a manifest with no `ui_extensions`) gets a token for one,
- *   since the host never hands it user or installation tokens.
- */
-export type OAuthClientCredentialsGrant = {
-  grantType: "client_credentials";
-  /**
-   * The service account's email. Send it with `client_secret`, or send neither and use `Authorization`.
-   */
-  clientId?: string | undefined;
-  /**
-   * The service account's permanent token. Send it with `client_id`, or send neither and use `Authorization`.
-   */
-  clientSecret?: string | undefined;
-  /**
-   * Optional. Asks for an app installation token narrowed to this activation of your app
-   *
-   * @remarks
-   * (`invalid_target` if it is not one). Leave it out for a plain API access token.
-   */
-  activationId?: number | undefined;
-  /**
-   * Optional, and only with `activation_id` (`invalid_request` without it). When given, it
-   *
-   * @remarks
-   * must name the activation's app as `app:<id>` (`invalid_target` otherwise).
-   */
-  audience?: string | undefined;
-  /**
-   * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
-   *
-   * @remarks
-   * the device grant) to narrow the token to. Leave it out to get everything the client is
-   * allowed. It can only narrow: names the client is not allowed are dropped, and if none
-   * is left the request fails with `invalid_scope`.
-   */
-  scope?: string | undefined;
-};
-
-/** @internal */
-export type OAuthClientCredentialsGrant$Outbound = {
-  grant_type: "client_credentials";
-  client_id?: string | undefined;
-  client_secret?: string | undefined;
-  activation_id?: number | undefined;
-  audience?: string | undefined;
-  scope?: string | undefined;
-};
-
-/** @internal */
-export const OAuthClientCredentialsGrant$outboundSchema: z.ZodType<
-  OAuthClientCredentialsGrant$Outbound,
-  z.ZodTypeDef,
-  OAuthClientCredentialsGrant
-> = z.object({
-  grantType: z.literal("client_credentials"),
-  clientId: z.string().optional(),
-  clientSecret: z.string().optional(),
-  activationId: z.number().int().optional(),
-  audience: z.string().optional(),
-  scope: z.string().optional(),
-}).transform((v) => {
-  return remap$(v, {
-    grantType: "grant_type",
-    clientId: "client_id",
-    clientSecret: "client_secret",
-    activationId: "activation_id",
-  });
-});
-
-export function oAuthClientCredentialsGrantToJSON(
-  oAuthClientCredentialsGrant: OAuthClientCredentialsGrant,
-): string {
-  return JSON.stringify(
-    OAuthClientCredentialsGrant$outboundSchema.parse(
-      oAuthClientCredentialsGrant,
-    ),
-  );
-}

package/src/models/components/oauthclirefreshtokengrant.ts

@@ -1,86 +0,0 @@
-/*
- * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
- */
-
-import * as z from "zod/v3";
-import { remap as remap$ } from "../../lib/primitives.js";
-
-/**
- * The apps CLI's refresh, as the public client `greensecurity-apps-cli`: no
- *
- * @remarks
- * `client_secret`, and `Authorization` is not read. The `gsdr_` refresh token is the
- * credential. The response is a new `gsd_` developer token and a new `gsdr_` refresh
- * token, in the device grant's shape.
- *
- * - **Rotation.** A refresh token works once. Refreshing spends it and revokes the
- *   login's live developer token, so keep only the newest pair. `scope` can only narrow.
- * - **Reuse detection.** Presenting a spent refresh token revokes every token of that
- *   login (every token descended from one device authorization) and answers
- *   `invalid_grant`. So does presenting a revoked one, or losing a race to spend one.
- * - **Grace window.** One exception: a spent refresh token presented again within 30
- *   seconds of being spent, while its direct replacement has been neither used nor
- *   revoked, is taken as a retry after a lost response. It answers `200` with a fresh
- *   pair, and the unused replacement pair is revoked.
- * - **Lifetimes.** A refresh token expires after 30 days unused. A login ends 90 days
- *   after its device authorization however often it is refreshed; tokens are issued
- *   capped at that end, and a refresh past it is `invalid_grant`.
- * - **Rate limit.** 60 refreshes per address per ten minutes, then `429` `slow_down`.
- *
- * Every `invalid_grant` here reads "Re-authenticate with `gs-apps login`.": start a new
- * device login.
- */
-export type OAuthCliRefreshTokenGrant = {
-  grantType: "refresh_token";
-  /**
-   * The `gsdr_` refresh token to spend.
-   */
-  refreshToken: string;
-  /**
-   * The apps CLI's public client id. Any other `client_id` with a `gsdr_` token is `401` `invalid_client`.
-   */
-  clientId: "greensecurity-apps-cli";
-  /**
-   * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
-   *
-   * @remarks
-   * the device grant) to narrow the token to. Leave it out to get everything the client is
-   * allowed. It can only narrow: names the client is not allowed are dropped, and if none
-   * is left the request fails with `invalid_scope`.
-   */
-  scope?: string | undefined;
-};
-
-/** @internal */
-export type OAuthCliRefreshTokenGrant$Outbound = {
-  grant_type: "refresh_token";
-  refresh_token: string;
-  client_id: "greensecurity-apps-cli";
-  scope?: string | undefined;
-};
-
-/** @internal */
-export const OAuthCliRefreshTokenGrant$outboundSchema: z.ZodType<
-  OAuthCliRefreshTokenGrant$Outbound,
-  z.ZodTypeDef,
-  OAuthCliRefreshTokenGrant
-> = z.object({
-  grantType: z.literal("refresh_token"),
-  refreshToken: z.string(),
-  clientId: z.literal("greensecurity-apps-cli"),
-  scope: z.string().optional(),
-}).transform((v) => {
-  return remap$(v, {
-    grantType: "grant_type",
-    refreshToken: "refresh_token",
-    clientId: "client_id",
-  });
-});
-
-export function oAuthCliRefreshTokenGrantToJSON(
-  oAuthCliRefreshTokenGrant: OAuthCliRefreshTokenGrant,
-): string {
-  return JSON.stringify(
-    OAuthCliRefreshTokenGrant$outboundSchema.parse(oAuthCliRefreshTokenGrant),
-  );
-}

package/src/models/components/oauthdevicecodegrant.ts

@@ -1,73 +0,0 @@
-/*
- * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
- */
-
-import * as z from "zod/v3";
-import { remap as remap$ } from "../../lib/primitives.js";
-
-/**
- * RFC 8628 device authorization, used by `apps-cli login`. Poll with the `device_code`
- *
- * @remarks
- * from `POST /oauth/device_authorization` at the returned `interval` until the user
- * approves; the result is a 15-minute developer CLI token (`gsd_`) and a `gsdr_` refresh
- * token that renews it (see `OAuthCliRefreshTokenGrant`). The device authorization starts
- * the login's 90-day limit. Until then each poll is answered with a
- * `400` `OAuthError` whose `error` is `authorization_pending` (keep polling), `slow_down`
- * (add 5 seconds to the interval), `access_denied` (the user declined; stop) or
- * `expired_token` (start again). `Authorization` is not read.
- */
-export type OAuthDeviceCodeGrant = {
-  grantType: "urn:ietf:params:oauth:grant-type:device_code";
-  /**
-   * The `device_code` returned by `POST /oauth/device_authorization`.
-   */
-  deviceCode: string;
-  /**
-   * The client that started the flow. `greensecurity-apps-cli` is the only registered client.
-   */
-  clientId: string;
-  /**
-   * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
-   *
-   * @remarks
-   * the device grant) to narrow the token to. Leave it out to get everything the client is
-   * allowed. It can only narrow: names the client is not allowed are dropped, and if none
-   * is left the request fails with `invalid_scope`.
-   */
-  scope?: string | undefined;
-};
-
-/** @internal */
-export type OAuthDeviceCodeGrant$Outbound = {
-  grant_type: "urn:ietf:params:oauth:grant-type:device_code";
-  device_code: string;
-  client_id: string;
-  scope?: string | undefined;
-};
-
-/** @internal */
-export const OAuthDeviceCodeGrant$outboundSchema: z.ZodType<
-  OAuthDeviceCodeGrant$Outbound,
-  z.ZodTypeDef,
-  OAuthDeviceCodeGrant
-> = z.object({
-  grantType: z.literal("urn:ietf:params:oauth:grant-type:device_code"),
-  deviceCode: z.string(),
-  clientId: z.string(),
-  scope: z.string().optional(),
-}).transform((v) => {
-  return remap$(v, {
-    grantType: "grant_type",
-    deviceCode: "device_code",
-    clientId: "client_id",
-  });
-});
-
-export function oAuthDeviceCodeGrantToJSON(
-  oAuthDeviceCodeGrant: OAuthDeviceCodeGrant,
-): string {
-  return JSON.stringify(
-    OAuthDeviceCodeGrant$outboundSchema.parse(oAuthDeviceCodeGrant),
-  );
-}

package/src/models/components/oautherrorcode.ts

@@ -1,67 +0,0 @@
-/*
- * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
- */
-
-import * as z from "zod/v3";
-import * as openEnums from "../../types/enums.js";
-import { OpenEnum } from "../../types/enums.js";
-
-/**
- * The RFC error code:
- *
- * @remarks
- *
- * | Code | Meaning |
- * | --- | --- |
- * | `invalid_request` | A parameter is missing or malformed (including `client_id` without `client_secret` or the reverse), an OAuth parameter was sent in the query string rather than the body, the body could not be parsed, or more than one activation covers the user and `activation_id` was left out. |
- * | `invalid_client` | The client could not be authenticated. Returned with `401`. On the apps CLI's `refresh_token` (a `gsdr_` token): a `client_id` other than `greensecurity-apps-cli`. On `client_credentials`: wrong `client_id` or `client_secret`; an `Authorization` token that is missing, invalid, or not the service account's permanent token (a short-lived, narrowed or app token is refused); or a locked service account. On `refresh_token`: `client_id` or `client_secret` does not match the refresh token's service account, or that account is locked. On the device grant and `POST /oauth/device_authorization`: an unknown `client_id`. On `POST /oauth/introspect` and `POST /oauth/revoke`: see each endpoint. |
- * | `invalid_grant` | `subject_token` is invalid or expired, is an app token or a narrowed (scoped) token, or belongs to a locked user or a service account; `refresh_token` is unknown, expired, already used or not a service account's; an apps CLI refresh token is unknown, expired, revoked or reused, its login is past 90 days, or its developer is locked or deleted (all answered "Re-authenticate with `gs-apps login`."); or `device_code` is unknown or already used, or the user who approved it can no longer sign in. |
- * | `unauthorized_client` | The caller may not use this grant: `client_credentials` from a user who is not an API service account. |
- * | `unsupported_grant_type` | `grant_type` is not one of the four supported grants. |
- * | `invalid_target` | `audience` names no app, or an app the user is not covered by; or `activation_id` is not an activation of the caller's app, or does not match `audience`. |
- * | `invalid_scope` | None of the requested scopes is available to the client: what it asked for and what it is allowed have nothing in common. On `POST /oauth/device_authorization`, any scope other than `apps:develop`. |
- * | `authorization_pending` | Device flow: the user has not approved the request yet. Keep polling. |
- * | `slow_down` | Device flow: polling too fast. Add 5 seconds to the interval and keep polling. `POST /oauth/device_authorization` also returns it, with `429`, when one address starts too many logins, and so does the apps CLI's `refresh_token` past 60 refreshes per address in ten minutes. Wait and retry; it is not a failed login. |
- * | `access_denied` | Device flow: the user declined the request. Stop polling. |
- * | `expired_token` | Device flow: `device_code` expired. Start again from `POST /oauth/device_authorization`. |
- */
-export const OAuthErrorCode = {
-  InvalidRequest: "invalid_request",
-  InvalidClient: "invalid_client",
-  InvalidGrant: "invalid_grant",
-  UnauthorizedClient: "unauthorized_client",
-  UnsupportedGrantType: "unsupported_grant_type",
-  InvalidTarget: "invalid_target",
-  InvalidScope: "invalid_scope",
-  AuthorizationPending: "authorization_pending",
-  SlowDown: "slow_down",
-  AccessDenied: "access_denied",
-  ExpiredToken: "expired_token",
-} as const;
-/**
- * The RFC error code:
- *
- * @remarks
- *
- * | Code | Meaning |
- * | --- | --- |
- * | `invalid_request` | A parameter is missing or malformed (including `client_id` without `client_secret` or the reverse), an OAuth parameter was sent in the query string rather than the body, the body could not be parsed, or more than one activation covers the user and `activation_id` was left out. |
- * | `invalid_client` | The client could not be authenticated. Returned with `401`. On the apps CLI's `refresh_token` (a `gsdr_` token): a `client_id` other than `greensecurity-apps-cli`. On `client_credentials`: wrong `client_id` or `client_secret`; an `Authorization` token that is missing, invalid, or not the service account's permanent token (a short-lived, narrowed or app token is refused); or a locked service account. On `refresh_token`: `client_id` or `client_secret` does not match the refresh token's service account, or that account is locked. On the device grant and `POST /oauth/device_authorization`: an unknown `client_id`. On `POST /oauth/introspect` and `POST /oauth/revoke`: see each endpoint. |
- * | `invalid_grant` | `subject_token` is invalid or expired, is an app token or a narrowed (scoped) token, or belongs to a locked user or a service account; `refresh_token` is unknown, expired, already used or not a service account's; an apps CLI refresh token is unknown, expired, revoked or reused, its login is past 90 days, or its developer is locked or deleted (all answered "Re-authenticate with `gs-apps login`."); or `device_code` is unknown or already used, or the user who approved it can no longer sign in. |
- * | `unauthorized_client` | The caller may not use this grant: `client_credentials` from a user who is not an API service account. |
- * | `unsupported_grant_type` | `grant_type` is not one of the four supported grants. |
- * | `invalid_target` | `audience` names no app, or an app the user is not covered by; or `activation_id` is not an activation of the caller's app, or does not match `audience`. |
- * | `invalid_scope` | None of the requested scopes is available to the client: what it asked for and what it is allowed have nothing in common. On `POST /oauth/device_authorization`, any scope other than `apps:develop`. |
- * | `authorization_pending` | Device flow: the user has not approved the request yet. Keep polling. |
- * | `slow_down` | Device flow: polling too fast. Add 5 seconds to the interval and keep polling. `POST /oauth/device_authorization` also returns it, with `429`, when one address starts too many logins, and so does the apps CLI's `refresh_token` past 60 refreshes per address in ten minutes. Wait and retry; it is not a failed login. |
- * | `access_denied` | Device flow: the user declined the request. Stop polling. |
- * | `expired_token` | Device flow: `device_code` expired. Start again from `POST /oauth/device_authorization`. |
- */
-export type OAuthErrorCode = OpenEnum<typeof OAuthErrorCode>;
-
-/** @internal */
-export const OAuthErrorCode$inboundSchema: z.ZodType<
-  OAuthErrorCode,
-  z.ZodTypeDef,
-  unknown
-> = openEnums.inboundSchema(OAuthErrorCode);

package/src/models/components/oauthrefreshtokengrant.ts

@@ -1,79 +0,0 @@
-/*
- * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
- */
-
-import * as z from "zod/v3";
-import { remap as remap$ } from "../../lib/primitives.js";
-
-/**
- * A confidential client's refresh: trades an API service account's refresh token for a
- *
- * @remarks
- * new plain API access token and a new refresh token. (The apps CLI's public-client
- * refresh is `OAuthCliRefreshTokenGrant`.) Refresh tokens rotate: each works once, and the one presented stops
- * working as soon as it is spent. The new token is never wider than the one it replaces:
- * `scope` can only narrow what the refresh token carried. The client authenticates with
- * `client_id` and `client_secret` in the body; `Authorization` is not read. A locked
- * service account is `401` `invalid_client`.
- */
-export type OAuthRefreshTokenGrant = {
-  grantType: "refresh_token";
-  /**
-   * The refresh token to spend.
-   */
-  refreshToken: string;
-  /**
-   * The email of the service account the refresh token belongs to.
-   */
-  clientId: string;
-  /**
-   * The service account's permanent token.
-   */
-  clientSecret: string;
-  /**
-   * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
-   *
-   * @remarks
-   * the device grant) to narrow the token to. Leave it out to get everything the client is
-   * allowed. It can only narrow: names the client is not allowed are dropped, and if none
-   * is left the request fails with `invalid_scope`.
-   */
-  scope?: string | undefined;
-};
-
-/** @internal */
-export type OAuthRefreshTokenGrant$Outbound = {
-  grant_type: "refresh_token";
-  refresh_token: string;
-  client_id: string;
-  client_secret: string;
-  scope?: string | undefined;
-};
-
-/** @internal */
-export const OAuthRefreshTokenGrant$outboundSchema: z.ZodType<
-  OAuthRefreshTokenGrant$Outbound,
-  z.ZodTypeDef,
-  OAuthRefreshTokenGrant
-> = z.object({
-  grantType: z.literal("refresh_token"),
-  refreshToken: z.string(),
-  clientId: z.string(),
-  clientSecret: z.string(),
-  scope: z.string().optional(),
-}).transform((v) => {
-  return remap$(v, {
-    grantType: "grant_type",
-    refreshToken: "refresh_token",
-    clientId: "client_id",
-    clientSecret: "client_secret",
-  });
-});
-
-export function oAuthRefreshTokenGrantToJSON(
-  oAuthRefreshTokenGrant: OAuthRefreshTokenGrant,
-): string {
-  return JSON.stringify(
-    OAuthRefreshTokenGrant$outboundSchema.parse(oAuthRefreshTokenGrant),
-  );
-}