@greensecurity/javascript-sdk 0.46.0 → 0.47.0-beta.0

package/dist/commonjs/models/components/oautherrorcode.d.ts

@@ -0,0 +1,57 @@
+import * as z from "zod/v3";
+import { OpenEnum } from "../../types/enums.js";
+/**
+ * The RFC error code:
+ *
+ * @remarks
+ *
+ * | Code | Meaning |
+ * | --- | --- |
+ * | `invalid_request` | A parameter is missing or malformed (including `client_id` without `client_secret` or the reverse), an OAuth parameter was sent in the query string rather than the body, the body could not be parsed, or more than one activation covers the user and `activation_id` was left out. |
+ * | `invalid_client` | The client could not be authenticated. Returned with `401`. On the apps CLI's `refresh_token` (a `gsdr_` token): a `client_id` other than `greensecurity-apps-cli`. On `client_credentials`: wrong `client_id` or `client_secret`; an `Authorization` token that is missing, invalid, or not the service account's permanent token (a short-lived, narrowed or app token is refused); or a locked service account. On `refresh_token`: `client_id` or `client_secret` does not match the refresh token's service account, or that account is locked. On the device grant and `POST /oauth/device_authorization`: an unknown `client_id`. On `POST /oauth/introspect` and `POST /oauth/revoke`: see each endpoint. |
+ * | `invalid_grant` | `subject_token` is invalid or expired, is an app token or a narrowed (scoped) token, or belongs to a locked user or a service account; `refresh_token` is unknown, expired, already used or not a service account's; an apps CLI refresh token is unknown, expired, revoked or reused, its login is past 90 days, or its developer is locked or deleted (all answered "Re-authenticate with `gs-apps login`."); or `device_code` is unknown or already used, or the user who approved it can no longer sign in. |
+ * | `unauthorized_client` | The caller may not use this grant: `client_credentials` from a user who is not an API service account. |
+ * | `unsupported_grant_type` | `grant_type` is not one of the four supported grants. |
+ * | `invalid_target` | `audience` names no app, or an app the user is not covered by; or `activation_id` is not an activation of the caller's app, or does not match `audience`. |
+ * | `invalid_scope` | None of the requested scopes is available to the client: what it asked for and what it is allowed have nothing in common. On `POST /oauth/device_authorization`, any scope other than `apps:develop`. |
+ * | `authorization_pending` | Device flow: the user has not approved the request yet. Keep polling. |
+ * | `slow_down` | Device flow: polling too fast. Add 5 seconds to the interval and keep polling. `POST /oauth/device_authorization` also returns it, with `429`, when one address starts too many logins, and so does the apps CLI's `refresh_token` past 60 refreshes per address in ten minutes. Wait and retry; it is not a failed login. |
+ * | `access_denied` | Device flow: the user declined the request. Stop polling. |
+ * | `expired_token` | Device flow: `device_code` expired. Start again from `POST /oauth/device_authorization`. |
+ */
+export declare const OAuthErrorCode: {
+    readonly InvalidRequest: "invalid_request";
+    readonly InvalidClient: "invalid_client";
+    readonly InvalidGrant: "invalid_grant";
+    readonly UnauthorizedClient: "unauthorized_client";
+    readonly UnsupportedGrantType: "unsupported_grant_type";
+    readonly InvalidTarget: "invalid_target";
+    readonly InvalidScope: "invalid_scope";
+    readonly AuthorizationPending: "authorization_pending";
+    readonly SlowDown: "slow_down";
+    readonly AccessDenied: "access_denied";
+    readonly ExpiredToken: "expired_token";
+};
+/**
+ * The RFC error code:
+ *
+ * @remarks
+ *
+ * | Code | Meaning |
+ * | --- | --- |
+ * | `invalid_request` | A parameter is missing or malformed (including `client_id` without `client_secret` or the reverse), an OAuth parameter was sent in the query string rather than the body, the body could not be parsed, or more than one activation covers the user and `activation_id` was left out. |
+ * | `invalid_client` | The client could not be authenticated. Returned with `401`. On the apps CLI's `refresh_token` (a `gsdr_` token): a `client_id` other than `greensecurity-apps-cli`. On `client_credentials`: wrong `client_id` or `client_secret`; an `Authorization` token that is missing, invalid, or not the service account's permanent token (a short-lived, narrowed or app token is refused); or a locked service account. On `refresh_token`: `client_id` or `client_secret` does not match the refresh token's service account, or that account is locked. On the device grant and `POST /oauth/device_authorization`: an unknown `client_id`. On `POST /oauth/introspect` and `POST /oauth/revoke`: see each endpoint. |
+ * | `invalid_grant` | `subject_token` is invalid or expired, is an app token or a narrowed (scoped) token, or belongs to a locked user or a service account; `refresh_token` is unknown, expired, already used or not a service account's; an apps CLI refresh token is unknown, expired, revoked or reused, its login is past 90 days, or its developer is locked or deleted (all answered "Re-authenticate with `gs-apps login`."); or `device_code` is unknown or already used, or the user who approved it can no longer sign in. |
+ * | `unauthorized_client` | The caller may not use this grant: `client_credentials` from a user who is not an API service account. |
+ * | `unsupported_grant_type` | `grant_type` is not one of the four supported grants. |
+ * | `invalid_target` | `audience` names no app, or an app the user is not covered by; or `activation_id` is not an activation of the caller's app, or does not match `audience`. |
+ * | `invalid_scope` | None of the requested scopes is available to the client: what it asked for and what it is allowed have nothing in common. On `POST /oauth/device_authorization`, any scope other than `apps:develop`. |
+ * | `authorization_pending` | Device flow: the user has not approved the request yet. Keep polling. |
+ * | `slow_down` | Device flow: polling too fast. Add 5 seconds to the interval and keep polling. `POST /oauth/device_authorization` also returns it, with `429`, when one address starts too many logins, and so does the apps CLI's `refresh_token` past 60 refreshes per address in ten minutes. Wait and retry; it is not a failed login. |
+ * | `access_denied` | Device flow: the user declined the request. Stop polling. |
+ * | `expired_token` | Device flow: `device_code` expired. Start again from `POST /oauth/device_authorization`. |
+ */
+export type OAuthErrorCode = OpenEnum<typeof OAuthErrorCode>;
+/** @internal */
+export declare const OAuthErrorCode$inboundSchema: z.ZodType<OAuthErrorCode, z.ZodTypeDef, unknown>;
+//# sourceMappingURL=oautherrorcode.d.ts.map

package/dist/commonjs/models/components/oautherrorcode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oautherrorcode.d.ts","sourceRoot":"","sources":["../../../../src/models/components/oautherrorcode.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;CAYjB,CAAC;AACX;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,cAAc,CAAC,CAAC;AAE7D,gBAAgB;AAChB,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,OAAO,CAClD,cAAc,EACd,CAAC,CAAC,UAAU,EACZ,OAAO,CACkC,CAAC"}

package/dist/commonjs/models/components/oautherrorcode.js

@@ -0,0 +1,75 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthErrorCode$inboundSchema = exports.OAuthErrorCode = void 0;
+const openEnums = __importStar(require("../../types/enums.js"));
+/**
+ * The RFC error code:
+ *
+ * @remarks
+ *
+ * | Code | Meaning |
+ * | --- | --- |
+ * | `invalid_request` | A parameter is missing or malformed (including `client_id` without `client_secret` or the reverse), an OAuth parameter was sent in the query string rather than the body, the body could not be parsed, or more than one activation covers the user and `activation_id` was left out. |
+ * | `invalid_client` | The client could not be authenticated. Returned with `401`. On the apps CLI's `refresh_token` (a `gsdr_` token): a `client_id` other than `greensecurity-apps-cli`. On `client_credentials`: wrong `client_id` or `client_secret`; an `Authorization` token that is missing, invalid, or not the service account's permanent token (a short-lived, narrowed or app token is refused); or a locked service account. On `refresh_token`: `client_id` or `client_secret` does not match the refresh token's service account, or that account is locked. On the device grant and `POST /oauth/device_authorization`: an unknown `client_id`. On `POST /oauth/introspect` and `POST /oauth/revoke`: see each endpoint. |
+ * | `invalid_grant` | `subject_token` is invalid or expired, is an app token or a narrowed (scoped) token, or belongs to a locked user or a service account; `refresh_token` is unknown, expired, already used or not a service account's; an apps CLI refresh token is unknown, expired, revoked or reused, its login is past 90 days, or its developer is locked or deleted (all answered "Re-authenticate with `gs-apps login`."); or `device_code` is unknown or already used, or the user who approved it can no longer sign in. |
+ * | `unauthorized_client` | The caller may not use this grant: `client_credentials` from a user who is not an API service account. |
+ * | `unsupported_grant_type` | `grant_type` is not one of the four supported grants. |
+ * | `invalid_target` | `audience` names no app, or an app the user is not covered by; or `activation_id` is not an activation of the caller's app, or does not match `audience`. |
+ * | `invalid_scope` | None of the requested scopes is available to the client: what it asked for and what it is allowed have nothing in common. On `POST /oauth/device_authorization`, any scope other than `apps:develop`. |
+ * | `authorization_pending` | Device flow: the user has not approved the request yet. Keep polling. |
+ * | `slow_down` | Device flow: polling too fast. Add 5 seconds to the interval and keep polling. `POST /oauth/device_authorization` also returns it, with `429`, when one address starts too many logins, and so does the apps CLI's `refresh_token` past 60 refreshes per address in ten minutes. Wait and retry; it is not a failed login. |
+ * | `access_denied` | Device flow: the user declined the request. Stop polling. |
+ * | `expired_token` | Device flow: `device_code` expired. Start again from `POST /oauth/device_authorization`. |
+ */
+exports.OAuthErrorCode = {
+    InvalidRequest: "invalid_request",
+    InvalidClient: "invalid_client",
+    InvalidGrant: "invalid_grant",
+    UnauthorizedClient: "unauthorized_client",
+    UnsupportedGrantType: "unsupported_grant_type",
+    InvalidTarget: "invalid_target",
+    InvalidScope: "invalid_scope",
+    AuthorizationPending: "authorization_pending",
+    SlowDown: "slow_down",
+    AccessDenied: "access_denied",
+    ExpiredToken: "expired_token",
+};
+/** @internal */
+exports.OAuthErrorCode$inboundSchema = openEnums.inboundSchema(exports.OAuthErrorCode);
+//# sourceMappingURL=oautherrorcode.js.map

package/dist/commonjs/models/components/oautherrorcode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oautherrorcode.js","sourceRoot":"","sources":["../../../../src/models/components/oautherrorcode.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGH,gEAAkD;AAGlD;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,cAAc,GAAG;IAC5B,cAAc,EAAE,iBAAiB;IACjC,aAAa,EAAE,gBAAgB;IAC/B,YAAY,EAAE,eAAe;IAC7B,kBAAkB,EAAE,qBAAqB;IACzC,oBAAoB,EAAE,wBAAwB;IAC9C,aAAa,EAAE,gBAAgB;IAC/B,YAAY,EAAE,eAAe;IAC7B,oBAAoB,EAAE,uBAAuB;IAC7C,QAAQ,EAAE,WAAW;IACrB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;CACrB,CAAC;AAsBX,gBAAgB;AACH,QAAA,4BAA4B,GAIrC,SAAS,CAAC,aAAa,CAAC,sBAAc,CAAC,CAAC"}

package/dist/commonjs/models/components/oauthrefreshtokengrant.d.ts

@@ -0,0 +1,48 @@
+import * as z from "zod/v3";
+/**
+ * A confidential client's refresh: trades an API service account's refresh token for a
+ *
+ * @remarks
+ * new plain API access token and a new refresh token. (The apps CLI's public-client
+ * refresh is `OAuthCliRefreshTokenGrant`.) Refresh tokens rotate: each works once, and the one presented stops
+ * working as soon as it is spent. The new token is never wider than the one it replaces:
+ * `scope` can only narrow what the refresh token carried. The client authenticates with
+ * `client_id` and `client_secret` in the body; `Authorization` is not read. A locked
+ * service account is `401` `invalid_client`.
+ */
+export type OAuthRefreshTokenGrant = {
+    grantType: "refresh_token";
+    /**
+     * The refresh token to spend.
+     */
+    refreshToken: string;
+    /**
+     * The email of the service account the refresh token belongs to.
+     */
+    clientId: string;
+    /**
+     * The service account's permanent token.
+     */
+    clientSecret: string;
+    /**
+     * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+     *
+     * @remarks
+     * the device grant) to narrow the token to. Leave it out to get everything the client is
+     * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+     * is left the request fails with `invalid_scope`.
+     */
+    scope?: string | undefined;
+};
+/** @internal */
+export type OAuthRefreshTokenGrant$Outbound = {
+    grant_type: "refresh_token";
+    refresh_token: string;
+    client_id: string;
+    client_secret: string;
+    scope?: string | undefined;
+};
+/** @internal */
+export declare const OAuthRefreshTokenGrant$outboundSchema: z.ZodType<OAuthRefreshTokenGrant$Outbound, z.ZodTypeDef, OAuthRefreshTokenGrant>;
+export declare function oAuthRefreshTokenGrantToJSON(oAuthRefreshTokenGrant: OAuthRefreshTokenGrant): string;
+//# sourceMappingURL=oauthrefreshtokengrant.d.ts.map

package/dist/commonjs/models/components/oauthrefreshtokengrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthrefreshtokengrant.d.ts","sourceRoot":"","sources":["../../../../src/models/components/oauthrefreshtokengrant.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,gBAAgB;AAChB,MAAM,MAAM,+BAA+B,GAAG;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,qCAAqC,EAAE,CAAC,CAAC,OAAO,CAC3D,+BAA+B,EAC/B,CAAC,CAAC,UAAU,EACZ,sBAAsB,CActB,CAAC;AAEH,wBAAgB,4BAA4B,CAC1C,sBAAsB,EAAE,sBAAsB,GAC7C,MAAM,CAIR"}

package/dist/commonjs/models/components/oauthrefreshtokengrant.js

@@ -0,0 +1,61 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthRefreshTokenGrant$outboundSchema = void 0;
+exports.oAuthRefreshTokenGrantToJSON = oAuthRefreshTokenGrantToJSON;
+const z = __importStar(require("zod/v3"));
+const primitives_js_1 = require("../../lib/primitives.js");
+/** @internal */
+exports.OAuthRefreshTokenGrant$outboundSchema = z.object({
+    grantType: z.literal("refresh_token"),
+    refreshToken: z.string(),
+    clientId: z.string(),
+    clientSecret: z.string(),
+    scope: z.string().optional(),
+}).transform((v) => {
+    return (0, primitives_js_1.remap)(v, {
+        grantType: "grant_type",
+        refreshToken: "refresh_token",
+        clientId: "client_id",
+        clientSecret: "client_secret",
+    });
+});
+function oAuthRefreshTokenGrantToJSON(oAuthRefreshTokenGrant) {
+    return JSON.stringify(exports.OAuthRefreshTokenGrant$outboundSchema.parse(oAuthRefreshTokenGrant));
+}
+//# sourceMappingURL=oauthrefreshtokengrant.js.map

package/dist/commonjs/models/components/oauthrefreshtokengrant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthrefreshtokengrant.js","sourceRoot":"","sources":["../../../../src/models/components/oauthrefreshtokengrant.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsEH,oEAMC;AA1ED,0CAA4B;AAC5B,2DAA0D;AA+C1D,gBAAgB;AACH,QAAA,qCAAqC,GAI9C,CAAC,CAAC,MAAM,CAAC;IACX,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,IAAA,qBAAM,EAAC,CAAC,EAAE;QACf,SAAS,EAAE,YAAY;QACvB,YAAY,EAAE,eAAe;QAC7B,QAAQ,EAAE,WAAW;QACrB,YAAY,EAAE,eAAe;KAC9B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAgB,4BAA4B,CAC1C,sBAA8C;IAE9C,OAAO,IAAI,CAAC,SAAS,CACnB,6CAAqC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CACpE,CAAC;AACJ,CAAC"}

package/dist/commonjs/models/components/oauthtokenexchangegrant.d.ts

@@ -0,0 +1,100 @@
+import * as z from "zod/v3";
+import { ClosedEnum } from "../../types/enums.js";
+/**
+ * The type of `subject_token`. Only an access token is accepted, which is also the default.
+ */
+export declare const SubjectTokenType: {
+    readonly UrnIetfParamsOauthTokenTypeAccessToken: "urn:ietf:params:oauth:token-type:access_token";
+};
+/**
+ * The type of `subject_token`. Only an access token is accepted, which is also the default.
+ */
+export type SubjectTokenType = ClosedEnum<typeof SubjectTokenType>;
+/**
+ * `app_user` issues a token that acts as the user, limited to the manifest
+ *
+ * @remarks
+ * permissions their own role also grants. `app_installation` issues a token that acts
+ * as the app's service account, narrowed to the tenant of one activation.
+ */
+export declare const RequestedTokenType: {
+    readonly UrnGreensecurityTokenTypeAppUser: "urn:greensecurity:token-type:app_user";
+    readonly UrnGreensecurityTokenTypeAppInstallation: "urn:greensecurity:token-type:app_installation";
+};
+/**
+ * `app_user` issues a token that acts as the user, limited to the manifest
+ *
+ * @remarks
+ * permissions their own role also grants. `app_installation` issues a token that acts
+ * as the app's service account, narrowed to the tenant of one activation.
+ */
+export type RequestedTokenType = ClosedEnum<typeof RequestedTokenType>;
+/**
+ * RFC 8693 token exchange. The host app trades the signed-in user's session token for a
+ *
+ * @remarks
+ * short-lived token bound to one app and one activation. App tokens can never be used as
+ * `subject_token`. `Authorization` is not read.
+ */
+export type OAuthTokenExchangeGrant = {
+    grantType: "urn:ietf:params:oauth:grant-type:token-exchange";
+    /**
+     * The signed-in user's session token (from `POST /users/authenticate`). Missing, it is
+     *
+     * @remarks
+     * `invalid_request`. A token narrowed with `scope` is refused with `invalid_grant`, as
+     * is any app token.
+     */
+    subjectToken: string;
+    /**
+     * The type of `subject_token`. Only an access token is accepted, which is also the default.
+     */
+    subjectTokenType?: SubjectTokenType | undefined;
+    /**
+     * The app the token is for, as `app:<marketplace app id>`. Missing or unknown, it is `invalid_target`.
+     */
+    audience: string;
+    /**
+     * `app_user` issues a token that acts as the user, limited to the manifest
+     *
+     * @remarks
+     * permissions their own role also grants. `app_installation` issues a token that acts
+     * as the app's service account, narrowed to the tenant of one activation.
+     */
+    requestedTokenType: RequestedTokenType;
+    /**
+     * The activation to bind the token to. Required when more than one activation of the
+     *
+     * @remarks
+     * app covers the user (`invalid_request` otherwise); the user must be covered by it
+     * either way (`invalid_target`).
+     */
+    activationId?: number | undefined;
+    /**
+     * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+     *
+     * @remarks
+     * the device grant) to narrow the token to. Leave it out to get everything the client is
+     * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+     * is left the request fails with `invalid_scope`.
+     */
+    scope?: string | undefined;
+};
+/** @internal */
+export declare const SubjectTokenType$outboundSchema: z.ZodNativeEnum<typeof SubjectTokenType>;
+/** @internal */
+export declare const RequestedTokenType$outboundSchema: z.ZodNativeEnum<typeof RequestedTokenType>;
+/** @internal */
+export type OAuthTokenExchangeGrant$Outbound = {
+    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+    subject_token: string;
+    subject_token_type: string;
+    audience: string;
+    requested_token_type: string;
+    activation_id?: number | undefined;
+    scope?: string | undefined;
+};
+/** @internal */
+export declare const OAuthTokenExchangeGrant$outboundSchema: z.ZodType<OAuthTokenExchangeGrant$Outbound, z.ZodTypeDef, OAuthTokenExchangeGrant>;
+export declare function oAuthTokenExchangeGrantToJSON(oAuthTokenExchangeGrant: OAuthTokenExchangeGrant): string;
+//# sourceMappingURL=oauthtokenexchangegrant.d.ts.map

package/dist/commonjs/models/components/oauthtokenexchangegrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthtokenexchangegrant.d.ts","sourceRoot":"","sources":["../../../../src/models/components/oauthtokenexchangegrant.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD;;GAEG;AACH,eAAO,MAAM,gBAAgB;;CAGnB,CAAC;AACX;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;;;CAIrB,CAAC;AACX;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,EAAE,iDAAiD,CAAC;IAC7D;;;;;;OAMG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAChD;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,kBAAkB,EAAE,kBAAkB,CAAC;IACvC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,+BAA+B,EAAE,CAAC,CAAC,aAAa,CAC3D,OAAO,gBAAgB,CACS,CAAC;AAEnC,gBAAgB;AAChB,eAAO,MAAM,iCAAiC,EAAE,CAAC,CAAC,aAAa,CAC7D,OAAO,kBAAkB,CACS,CAAC;AAErC,gBAAgB;AAChB,MAAM,MAAM,gCAAgC,GAAG;IAC7C,UAAU,EAAE,iDAAiD,CAAC;IAC9D,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,sCAAsC,EAAE,CAAC,CAAC,OAAO,CAC5D,gCAAgC,EAChC,CAAC,CAAC,UAAU,EACZ,uBAAuB,CAmBvB,CAAC;AAEH,wBAAgB,6BAA6B,CAC3C,uBAAuB,EAAE,uBAAuB,GAC/C,MAAM,CAIR"}

package/dist/commonjs/models/components/oauthtokenexchangegrant.js

@@ -0,0 +1,85 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthTokenExchangeGrant$outboundSchema = exports.RequestedTokenType$outboundSchema = exports.SubjectTokenType$outboundSchema = exports.RequestedTokenType = exports.SubjectTokenType = void 0;
+exports.oAuthTokenExchangeGrantToJSON = oAuthTokenExchangeGrantToJSON;
+const z = __importStar(require("zod/v3"));
+const primitives_js_1 = require("../../lib/primitives.js");
+/**
+ * The type of `subject_token`. Only an access token is accepted, which is also the default.
+ */
+exports.SubjectTokenType = {
+    UrnIetfParamsOauthTokenTypeAccessToken: "urn:ietf:params:oauth:token-type:access_token",
+};
+/**
+ * `app_user` issues a token that acts as the user, limited to the manifest
+ *
+ * @remarks
+ * permissions their own role also grants. `app_installation` issues a token that acts
+ * as the app's service account, narrowed to the tenant of one activation.
+ */
+exports.RequestedTokenType = {
+    UrnGreensecurityTokenTypeAppUser: "urn:greensecurity:token-type:app_user",
+    UrnGreensecurityTokenTypeAppInstallation: "urn:greensecurity:token-type:app_installation",
+};
+/** @internal */
+exports.SubjectTokenType$outboundSchema = z.nativeEnum(exports.SubjectTokenType);
+/** @internal */
+exports.RequestedTokenType$outboundSchema = z.nativeEnum(exports.RequestedTokenType);
+/** @internal */
+exports.OAuthTokenExchangeGrant$outboundSchema = z.object({
+    grantType: z.literal("urn:ietf:params:oauth:grant-type:token-exchange"),
+    subjectToken: z.string(),
+    subjectTokenType: exports.SubjectTokenType$outboundSchema.default("urn:ietf:params:oauth:token-type:access_token"),
+    audience: z.string(),
+    requestedTokenType: exports.RequestedTokenType$outboundSchema,
+    activationId: z.number().int().optional(),
+    scope: z.string().optional(),
+}).transform((v) => {
+    return (0, primitives_js_1.remap)(v, {
+        grantType: "grant_type",
+        subjectToken: "subject_token",
+        subjectTokenType: "subject_token_type",
+        requestedTokenType: "requested_token_type",
+        activationId: "activation_id",
+    });
+});
+function oAuthTokenExchangeGrantToJSON(oAuthTokenExchangeGrant) {
+    return JSON.stringify(exports.OAuthTokenExchangeGrant$outboundSchema.parse(oAuthTokenExchangeGrant));
+}
+//# sourceMappingURL=oauthtokenexchangegrant.js.map

package/dist/commonjs/models/components/oauthtokenexchangegrant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthtokenexchangegrant.js","sourceRoot":"","sources":["../../../../src/models/components/oauthtokenexchangegrant.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyIH,sEAMC;AA7ID,0CAA4B;AAC5B,2DAA0D;AAG1D;;GAEG;AACU,QAAA,gBAAgB,GAAG;IAC9B,sCAAsC,EACpC,+CAA+C;CACzC,CAAC;AAMX;;;;;;GAMG;AACU,QAAA,kBAAkB,GAAG;IAChC,gCAAgC,EAAE,uCAAuC;IACzE,wCAAwC,EACtC,+CAA+C;CACzC,CAAC;AA8DX,gBAAgB;AACH,QAAA,+BAA+B,GAExC,CAAC,CAAC,UAAU,CAAC,wBAAgB,CAAC,CAAC;AAEnC,gBAAgB;AACH,QAAA,iCAAiC,GAE1C,CAAC,CAAC,UAAU,CAAC,0BAAkB,CAAC,CAAC;AAarC,gBAAgB;AACH,QAAA,sCAAsC,GAI/C,CAAC,CAAC,MAAM,CAAC;IACX,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,iDAAiD,CAAC;IACvE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,gBAAgB,EAAE,uCAA+B,CAAC,OAAO,CACvD,+CAA+C,CAChD;IACD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,kBAAkB,EAAE,yCAAiC;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,IAAA,qBAAM,EAAC,CAAC,EAAE;QACf,SAAS,EAAE,YAAY;QACvB,YAAY,EAAE,eAAe;QAC7B,gBAAgB,EAAE,oBAAoB;QACtC,kBAAkB,EAAE,sBAAsB;QAC1C,YAAY,EAAE,eAAe;KAC9B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAgB,6BAA6B,CAC3C,uBAAgD;IAEhD,OAAO,IAAI,CAAC,SAAS,CACnB,8CAAsC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CACtE,CAAC;AACJ,CAAC"}

package/dist/commonjs/models/components/oauthtokenrequest.d.ts

@@ -0,0 +1,22 @@
+import * as z from "zod/v3";
+import { OAuthClientCredentialsGrant, OAuthClientCredentialsGrant$Outbound } from "./oauthclientcredentialsgrant.js";
+import { OAuthCliRefreshTokenGrant, OAuthCliRefreshTokenGrant$Outbound } from "./oauthclirefreshtokengrant.js";
+import { OAuthDeviceCodeGrant, OAuthDeviceCodeGrant$Outbound } from "./oauthdevicecodegrant.js";
+import { OAuthRefreshTokenGrant, OAuthRefreshTokenGrant$Outbound } from "./oauthrefreshtokengrant.js";
+import { OAuthTokenExchangeGrant, OAuthTokenExchangeGrant$Outbound } from "./oauthtokenexchangegrant.js";
+/**
+ * One of the four supported grants, selected by `grant_type`. `refresh_token` has two
+ *
+ * @remarks
+ * variants, told apart by the client: a service account's (`OAuthRefreshTokenGrant`,
+ * with `client_secret`) and the apps CLI's public-client refresh
+ * (`OAuthCliRefreshTokenGrant`, `client_id=greensecurity-apps-cli` and a `gsdr_` token).
+ * No body matches both: the CLI variant takes no `client_secret`.
+ */
+export type OAuthTokenRequest = OAuthTokenExchangeGrant | OAuthRefreshTokenGrant | OAuthCliRefreshTokenGrant | OAuthDeviceCodeGrant | OAuthClientCredentialsGrant;
+/** @internal */
+export type OAuthTokenRequest$Outbound = OAuthTokenExchangeGrant$Outbound | OAuthRefreshTokenGrant$Outbound | OAuthCliRefreshTokenGrant$Outbound | OAuthDeviceCodeGrant$Outbound | OAuthClientCredentialsGrant$Outbound;
+/** @internal */
+export declare const OAuthTokenRequest$outboundSchema: z.ZodType<OAuthTokenRequest$Outbound, z.ZodTypeDef, OAuthTokenRequest>;
+export declare function oAuthTokenRequestToJSON(oAuthTokenRequest: OAuthTokenRequest): string;
+//# sourceMappingURL=oauthtokenrequest.d.ts.map

package/dist/commonjs/models/components/oauthtokenrequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthtokenrequest.d.ts","sourceRoot":"","sources":["../../../../src/models/components/oauthtokenrequest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EACL,2BAA2B,EAC3B,oCAAoC,EAErC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,yBAAyB,EACzB,kCAAkC,EAEnC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAE9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAEhC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,uBAAuB,EACvB,gCAAgC,EAEjC,MAAM,8BAA8B,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GACzB,uBAAuB,GACvB,sBAAsB,GACtB,yBAAyB,GACzB,oBAAoB,GACpB,2BAA2B,CAAC;AAEhC,gBAAgB;AAChB,MAAM,MAAM,0BAA0B,GAClC,gCAAgC,GAChC,+BAA+B,GAC/B,kCAAkC,GAClC,6BAA6B,GAC7B,oCAAoC,CAAC;AAEzC,gBAAgB;AAChB,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,OAAO,CACtD,0BAA0B,EAC1B,CAAC,CAAC,UAAU,EACZ,iBAAiB,CAOjB,CAAC;AAEH,wBAAgB,uBAAuB,CACrC,iBAAiB,EAAE,iBAAiB,GACnC,MAAM,CAIR"}

package/dist/commonjs/models/components/oauthtokenrequest.js

@@ -0,0 +1,25 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthTokenRequest$outboundSchema = void 0;
+exports.oAuthTokenRequestToJSON = oAuthTokenRequestToJSON;
+const smartUnion_js_1 = require("../../types/smartUnion.js");
+const oauthclientcredentialsgrant_js_1 = require("./oauthclientcredentialsgrant.js");
+const oauthclirefreshtokengrant_js_1 = require("./oauthclirefreshtokengrant.js");
+const oauthdevicecodegrant_js_1 = require("./oauthdevicecodegrant.js");
+const oauthrefreshtokengrant_js_1 = require("./oauthrefreshtokengrant.js");
+const oauthtokenexchangegrant_js_1 = require("./oauthtokenexchangegrant.js");
+/** @internal */
+exports.OAuthTokenRequest$outboundSchema = (0, smartUnion_js_1.smartUnion)([
+    oauthtokenexchangegrant_js_1.OAuthTokenExchangeGrant$outboundSchema,
+    oauthrefreshtokengrant_js_1.OAuthRefreshTokenGrant$outboundSchema,
+    oauthclirefreshtokengrant_js_1.OAuthCliRefreshTokenGrant$outboundSchema,
+    oauthdevicecodegrant_js_1.OAuthDeviceCodeGrant$outboundSchema,
+    oauthclientcredentialsgrant_js_1.OAuthClientCredentialsGrant$outboundSchema,
+]);
+function oAuthTokenRequestToJSON(oAuthTokenRequest) {
+    return JSON.stringify(exports.OAuthTokenRequest$outboundSchema.parse(oAuthTokenRequest));
+}
+//# sourceMappingURL=oauthtokenrequest.js.map

package/dist/commonjs/models/components/oauthtokenrequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthtokenrequest.js","sourceRoot":"","sources":["../../../../src/models/components/oauthtokenrequest.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAmEH,0DAMC;AAtED,6DAAuD;AACvD,qFAI0C;AAC1C,iFAIwC;AACxC,uEAImC;AACnC,2EAIqC;AACrC,6EAIsC;AA0BtC,gBAAgB;AACH,QAAA,gCAAgC,GAIzC,IAAA,0BAAU,EAAC;IACb,mEAAsC;IACtC,iEAAqC;IACrC,uEAAwC;IACxC,6DAAmC;IACnC,2EAA0C;CAC3C,CAAC,CAAC;AAEH,SAAgB,uBAAuB,CACrC,iBAAoC;IAEpC,OAAO,IAAI,CAAC,SAAS,CACnB,wCAAgC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAC1D,CAAC;AACJ,CAAC"}

package/dist/commonjs/models/components/oauthtokentypehint.d.ts

@@ -0,0 +1,16 @@
+import * as z from "zod/v3";
+import { ClosedEnum } from "../../types/enums.js";
+/**
+ * Optional hint about the kind of token. Tokens are recognised by prefix, so this is informational.
+ */
+export declare const OAuthTokenTypeHint: {
+    readonly AccessToken: "access_token";
+    readonly RefreshToken: "refresh_token";
+};
+/**
+ * Optional hint about the kind of token. Tokens are recognised by prefix, so this is informational.
+ */
+export type OAuthTokenTypeHint = ClosedEnum<typeof OAuthTokenTypeHint>;
+/** @internal */
+export declare const OAuthTokenTypeHint$outboundSchema: z.ZodNativeEnum<typeof OAuthTokenTypeHint>;
+//# sourceMappingURL=oauthtokentypehint.d.ts.map

package/dist/commonjs/models/components/oauthtokentypehint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthtokentypehint.d.ts","sourceRoot":"","sources":["../../../../src/models/components/oauthtokentypehint.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;CAGrB,CAAC;AACX;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEvE,gBAAgB;AAChB,eAAO,MAAM,iCAAiC,EAAE,CAAC,CAAC,aAAa,CAC7D,OAAO,kBAAkB,CACS,CAAC"}

package/dist/commonjs/models/components/oauthtokentypehint.js

@@ -0,0 +1,50 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthTokenTypeHint$outboundSchema = exports.OAuthTokenTypeHint = void 0;
+const z = __importStar(require("zod/v3"));
+/**
+ * Optional hint about the kind of token. Tokens are recognised by prefix, so this is informational.
+ */
+exports.OAuthTokenTypeHint = {
+    AccessToken: "access_token",
+    RefreshToken: "refresh_token",
+};
+/** @internal */
+exports.OAuthTokenTypeHint$outboundSchema = z.nativeEnum(exports.OAuthTokenTypeHint);
+//# sourceMappingURL=oauthtokentypehint.js.map

package/dist/commonjs/models/components/oauthtokentypehint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthtokentypehint.js","sourceRoot":"","sources":["../../../../src/models/components/oauthtokentypehint.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,0CAA4B;AAG5B;;GAEG;AACU,QAAA,kBAAkB,GAAG;IAChC,WAAW,EAAE,cAAc;IAC3B,YAAY,EAAE,eAAe;CACrB,CAAC;AAMX,gBAAgB;AACH,QAAA,iCAAiC,GAE1C,CAAC,CAAC,UAAU,CAAC,0BAAkB,CAAC,CAAC"}

package/dist/commonjs/models/components/pager.d.ts

@@ -40,6 +40,15 @@ export type Pager = {
      * - items_per_page
      */
     useUrlParams: boolean;
+    /**
+     * How the server narrowed the list to your tenant, when it did, or `null`. Only some
+     *
+     * @remarks
+     * list endpoints return it, such as `GET /apps/secrets` and
+     * `GET /marketplace/apps/{id}/developers`; the others omit the field. Don't rely on
+     * its contents.
+     */
+    scope?: Array<any> | null | undefined;
 };
 /** @internal */
 export declare const Pager$inboundSchema: z.ZodType<Pager, z.ZodTypeDef, unknown>;

package/dist/commonjs/models/components/pager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pager.d.ts","sourceRoot":"","sources":["../../../../src/models/components/pager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE;;GAEG;AACH,MAAM,MAAM,KAAK,GAAG;IAClB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAgBpE,CAAC;AAEL,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,GACjB,eAAe,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAM5C"}
+{"version":3,"file":"pager.d.ts","sourceRoot":"","sources":["../../../../src/models/components/pager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE;;GAEG;AACH,MAAM,MAAM,KAAK,GAAG;IAClB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;CACvC,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAiBpE,CAAC;AAEL,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,GACjB,eAAe,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAM5C"}

package/dist/commonjs/models/components/pager.js

@@ -52,6 +52,7 @@ exports.Pager$inboundSchema = z
     items_per_page: types.number(),
     page: types.number(),
     use_url_params: types.boolean(),
+    scope: z.nullable(z.array(z.any())).optional(),
 }).transform((v) => {
     return (0, primitives_js_1.remap)(v, {
         "base_url": "baseUrl",