@greensecurity/javascript-sdk 0.46.0 → 0.47.0-beta.0

package/dist/esm/models/components/oautherrorcode.d.ts

@@ -0,0 +1,57 @@
+import * as z from "zod/v3";
+import { OpenEnum } from "../../types/enums.js";
+/**
+ * The RFC error code:
+ *
+ * @remarks
+ *
+ * | Code | Meaning |
+ * | --- | --- |
+ * | `invalid_request` | A parameter is missing or malformed (including `client_id` without `client_secret` or the reverse), an OAuth parameter was sent in the query string rather than the body, the body could not be parsed, or more than one activation covers the user and `activation_id` was left out. |
+ * | `invalid_client` | The client could not be authenticated. Returned with `401`. On the apps CLI's `refresh_token` (a `gsdr_` token): a `client_id` other than `greensecurity-apps-cli`. On `client_credentials`: wrong `client_id` or `client_secret`; an `Authorization` token that is missing, invalid, or not the service account's permanent token (a short-lived, narrowed or app token is refused); or a locked service account. On `refresh_token`: `client_id` or `client_secret` does not match the refresh token's service account, or that account is locked. On the device grant and `POST /oauth/device_authorization`: an unknown `client_id`. On `POST /oauth/introspect` and `POST /oauth/revoke`: see each endpoint. |
+ * | `invalid_grant` | `subject_token` is invalid or expired, is an app token or a narrowed (scoped) token, or belongs to a locked user or a service account; `refresh_token` is unknown, expired, already used or not a service account's; an apps CLI refresh token is unknown, expired, revoked or reused, its login is past 90 days, or its developer is locked or deleted (all answered "Re-authenticate with `gs-apps login`."); or `device_code` is unknown or already used, or the user who approved it can no longer sign in. |
+ * | `unauthorized_client` | The caller may not use this grant: `client_credentials` from a user who is not an API service account. |
+ * | `unsupported_grant_type` | `grant_type` is not one of the four supported grants. |
+ * | `invalid_target` | `audience` names no app, or an app the user is not covered by; or `activation_id` is not an activation of the caller's app, or does not match `audience`. |
+ * | `invalid_scope` | None of the requested scopes is available to the client: what it asked for and what it is allowed have nothing in common. On `POST /oauth/device_authorization`, any scope other than `apps:develop`. |
+ * | `authorization_pending` | Device flow: the user has not approved the request yet. Keep polling. |
+ * | `slow_down` | Device flow: polling too fast. Add 5 seconds to the interval and keep polling. `POST /oauth/device_authorization` also returns it, with `429`, when one address starts too many logins, and so does the apps CLI's `refresh_token` past 60 refreshes per address in ten minutes. Wait and retry; it is not a failed login. |
+ * | `access_denied` | Device flow: the user declined the request. Stop polling. |
+ * | `expired_token` | Device flow: `device_code` expired. Start again from `POST /oauth/device_authorization`. |
+ */
+export declare const OAuthErrorCode: {
+    readonly InvalidRequest: "invalid_request";
+    readonly InvalidClient: "invalid_client";
+    readonly InvalidGrant: "invalid_grant";
+    readonly UnauthorizedClient: "unauthorized_client";
+    readonly UnsupportedGrantType: "unsupported_grant_type";
+    readonly InvalidTarget: "invalid_target";
+    readonly InvalidScope: "invalid_scope";
+    readonly AuthorizationPending: "authorization_pending";
+    readonly SlowDown: "slow_down";
+    readonly AccessDenied: "access_denied";
+    readonly ExpiredToken: "expired_token";
+};
+/**
+ * The RFC error code:
+ *
+ * @remarks
+ *
+ * | Code | Meaning |
+ * | --- | --- |
+ * | `invalid_request` | A parameter is missing or malformed (including `client_id` without `client_secret` or the reverse), an OAuth parameter was sent in the query string rather than the body, the body could not be parsed, or more than one activation covers the user and `activation_id` was left out. |
+ * | `invalid_client` | The client could not be authenticated. Returned with `401`. On the apps CLI's `refresh_token` (a `gsdr_` token): a `client_id` other than `greensecurity-apps-cli`. On `client_credentials`: wrong `client_id` or `client_secret`; an `Authorization` token that is missing, invalid, or not the service account's permanent token (a short-lived, narrowed or app token is refused); or a locked service account. On `refresh_token`: `client_id` or `client_secret` does not match the refresh token's service account, or that account is locked. On the device grant and `POST /oauth/device_authorization`: an unknown `client_id`. On `POST /oauth/introspect` and `POST /oauth/revoke`: see each endpoint. |
+ * | `invalid_grant` | `subject_token` is invalid or expired, is an app token or a narrowed (scoped) token, or belongs to a locked user or a service account; `refresh_token` is unknown, expired, already used or not a service account's; an apps CLI refresh token is unknown, expired, revoked or reused, its login is past 90 days, or its developer is locked or deleted (all answered "Re-authenticate with `gs-apps login`."); or `device_code` is unknown or already used, or the user who approved it can no longer sign in. |
+ * | `unauthorized_client` | The caller may not use this grant: `client_credentials` from a user who is not an API service account. |
+ * | `unsupported_grant_type` | `grant_type` is not one of the four supported grants. |
+ * | `invalid_target` | `audience` names no app, or an app the user is not covered by; or `activation_id` is not an activation of the caller's app, or does not match `audience`. |
+ * | `invalid_scope` | None of the requested scopes is available to the client: what it asked for and what it is allowed have nothing in common. On `POST /oauth/device_authorization`, any scope other than `apps:develop`. |
+ * | `authorization_pending` | Device flow: the user has not approved the request yet. Keep polling. |
+ * | `slow_down` | Device flow: polling too fast. Add 5 seconds to the interval and keep polling. `POST /oauth/device_authorization` also returns it, with `429`, when one address starts too many logins, and so does the apps CLI's `refresh_token` past 60 refreshes per address in ten minutes. Wait and retry; it is not a failed login. |
+ * | `access_denied` | Device flow: the user declined the request. Stop polling. |
+ * | `expired_token` | Device flow: `device_code` expired. Start again from `POST /oauth/device_authorization`. |
+ */
+export type OAuthErrorCode = OpenEnum<typeof OAuthErrorCode>;
+/** @internal */
+export declare const OAuthErrorCode$inboundSchema: z.ZodType<OAuthErrorCode, z.ZodTypeDef, unknown>;
+//# sourceMappingURL=oautherrorcode.d.ts.map

package/dist/esm/models/components/oautherrorcode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oautherrorcode.d.ts","sourceRoot":"","sources":["../../../../src/models/components/oautherrorcode.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;CAYjB,CAAC;AACX;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,cAAc,CAAC,CAAC;AAE7D,gBAAgB;AAChB,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,OAAO,CAClD,cAAc,EACd,CAAC,CAAC,UAAU,EACZ,OAAO,CACkC,CAAC"}

package/dist/esm/models/components/oautherrorcode.js

@@ -0,0 +1,39 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+import * as openEnums from "../../types/enums.js";
+/**
+ * The RFC error code:
+ *
+ * @remarks
+ *
+ * | Code | Meaning |
+ * | --- | --- |
+ * | `invalid_request` | A parameter is missing or malformed (including `client_id` without `client_secret` or the reverse), an OAuth parameter was sent in the query string rather than the body, the body could not be parsed, or more than one activation covers the user and `activation_id` was left out. |
+ * | `invalid_client` | The client could not be authenticated. Returned with `401`. On the apps CLI's `refresh_token` (a `gsdr_` token): a `client_id` other than `greensecurity-apps-cli`. On `client_credentials`: wrong `client_id` or `client_secret`; an `Authorization` token that is missing, invalid, or not the service account's permanent token (a short-lived, narrowed or app token is refused); or a locked service account. On `refresh_token`: `client_id` or `client_secret` does not match the refresh token's service account, or that account is locked. On the device grant and `POST /oauth/device_authorization`: an unknown `client_id`. On `POST /oauth/introspect` and `POST /oauth/revoke`: see each endpoint. |
+ * | `invalid_grant` | `subject_token` is invalid or expired, is an app token or a narrowed (scoped) token, or belongs to a locked user or a service account; `refresh_token` is unknown, expired, already used or not a service account's; an apps CLI refresh token is unknown, expired, revoked or reused, its login is past 90 days, or its developer is locked or deleted (all answered "Re-authenticate with `gs-apps login`."); or `device_code` is unknown or already used, or the user who approved it can no longer sign in. |
+ * | `unauthorized_client` | The caller may not use this grant: `client_credentials` from a user who is not an API service account. |
+ * | `unsupported_grant_type` | `grant_type` is not one of the four supported grants. |
+ * | `invalid_target` | `audience` names no app, or an app the user is not covered by; or `activation_id` is not an activation of the caller's app, or does not match `audience`. |
+ * | `invalid_scope` | None of the requested scopes is available to the client: what it asked for and what it is allowed have nothing in common. On `POST /oauth/device_authorization`, any scope other than `apps:develop`. |
+ * | `authorization_pending` | Device flow: the user has not approved the request yet. Keep polling. |
+ * | `slow_down` | Device flow: polling too fast. Add 5 seconds to the interval and keep polling. `POST /oauth/device_authorization` also returns it, with `429`, when one address starts too many logins, and so does the apps CLI's `refresh_token` past 60 refreshes per address in ten minutes. Wait and retry; it is not a failed login. |
+ * | `access_denied` | Device flow: the user declined the request. Stop polling. |
+ * | `expired_token` | Device flow: `device_code` expired. Start again from `POST /oauth/device_authorization`. |
+ */
+export const OAuthErrorCode = {
+    InvalidRequest: "invalid_request",
+    InvalidClient: "invalid_client",
+    InvalidGrant: "invalid_grant",
+    UnauthorizedClient: "unauthorized_client",
+    UnsupportedGrantType: "unsupported_grant_type",
+    InvalidTarget: "invalid_target",
+    InvalidScope: "invalid_scope",
+    AuthorizationPending: "authorization_pending",
+    SlowDown: "slow_down",
+    AccessDenied: "access_denied",
+    ExpiredToken: "expired_token",
+};
+/** @internal */
+export const OAuthErrorCode$inboundSchema = openEnums.inboundSchema(OAuthErrorCode);
+//# sourceMappingURL=oautherrorcode.js.map

package/dist/esm/models/components/oautherrorcode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oautherrorcode.js","sourceRoot":"","sources":["../../../../src/models/components/oautherrorcode.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAC;AAGlD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,cAAc,EAAE,iBAAiB;IACjC,aAAa,EAAE,gBAAgB;IAC/B,YAAY,EAAE,eAAe;IAC7B,kBAAkB,EAAE,qBAAqB;IACzC,oBAAoB,EAAE,wBAAwB;IAC9C,aAAa,EAAE,gBAAgB;IAC/B,YAAY,EAAE,eAAe;IAC7B,oBAAoB,EAAE,uBAAuB;IAC7C,QAAQ,EAAE,WAAW;IACrB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;CACrB,CAAC;AAsBX,gBAAgB;AAChB,MAAM,CAAC,MAAM,4BAA4B,GAIrC,SAAS,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC"}

package/dist/esm/models/components/oauthrefreshtokengrant.d.ts

@@ -0,0 +1,48 @@
+import * as z from "zod/v3";
+/**
+ * A confidential client's refresh: trades an API service account's refresh token for a
+ *
+ * @remarks
+ * new plain API access token and a new refresh token. (The apps CLI's public-client
+ * refresh is `OAuthCliRefreshTokenGrant`.) Refresh tokens rotate: each works once, and the one presented stops
+ * working as soon as it is spent. The new token is never wider than the one it replaces:
+ * `scope` can only narrow what the refresh token carried. The client authenticates with
+ * `client_id` and `client_secret` in the body; `Authorization` is not read. A locked
+ * service account is `401` `invalid_client`.
+ */
+export type OAuthRefreshTokenGrant = {
+    grantType: "refresh_token";
+    /**
+     * The refresh token to spend.
+     */
+    refreshToken: string;
+    /**
+     * The email of the service account the refresh token belongs to.
+     */
+    clientId: string;
+    /**
+     * The service account's permanent token.
+     */
+    clientSecret: string;
+    /**
+     * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+     *
+     * @remarks
+     * the device grant) to narrow the token to. Leave it out to get everything the client is
+     * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+     * is left the request fails with `invalid_scope`.
+     */
+    scope?: string | undefined;
+};
+/** @internal */
+export type OAuthRefreshTokenGrant$Outbound = {
+    grant_type: "refresh_token";
+    refresh_token: string;
+    client_id: string;
+    client_secret: string;
+    scope?: string | undefined;
+};
+/** @internal */
+export declare const OAuthRefreshTokenGrant$outboundSchema: z.ZodType<OAuthRefreshTokenGrant$Outbound, z.ZodTypeDef, OAuthRefreshTokenGrant>;
+export declare function oAuthRefreshTokenGrantToJSON(oAuthRefreshTokenGrant: OAuthRefreshTokenGrant): string;
+//# sourceMappingURL=oauthrefreshtokengrant.d.ts.map

package/dist/esm/models/components/oauthrefreshtokengrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthrefreshtokengrant.d.ts","sourceRoot":"","sources":["../../../../src/models/components/oauthrefreshtokengrant.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,gBAAgB;AAChB,MAAM,MAAM,+BAA+B,GAAG;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,qCAAqC,EAAE,CAAC,CAAC,OAAO,CAC3D,+BAA+B,EAC/B,CAAC,CAAC,UAAU,EACZ,sBAAsB,CActB,CAAC;AAEH,wBAAgB,4BAA4B,CAC1C,sBAAsB,EAAE,sBAAsB,GAC7C,MAAM,CAIR"}

package/dist/esm/models/components/oauthrefreshtokengrant.js

@@ -0,0 +1,24 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+/** @internal */
+export const OAuthRefreshTokenGrant$outboundSchema = z.object({
+    grantType: z.literal("refresh_token"),
+    refreshToken: z.string(),
+    clientId: z.string(),
+    clientSecret: z.string(),
+    scope: z.string().optional(),
+}).transform((v) => {
+    return remap$(v, {
+        grantType: "grant_type",
+        refreshToken: "refresh_token",
+        clientId: "client_id",
+        clientSecret: "client_secret",
+    });
+});
+export function oAuthRefreshTokenGrantToJSON(oAuthRefreshTokenGrant) {
+    return JSON.stringify(OAuthRefreshTokenGrant$outboundSchema.parse(oAuthRefreshTokenGrant));
+}
+//# sourceMappingURL=oauthrefreshtokengrant.js.map

package/dist/esm/models/components/oauthrefreshtokengrant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthrefreshtokengrant.js","sourceRoot":"","sources":["../../../../src/models/components/oauthrefreshtokengrant.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,KAAK,IAAI,MAAM,EAAE,MAAM,yBAAyB,CAAC;AA+C1D,gBAAgB;AAChB,MAAM,CAAC,MAAM,qCAAqC,GAI9C,CAAC,CAAC,MAAM,CAAC;IACX,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,MAAM,CAAC,CAAC,EAAE;QACf,SAAS,EAAE,YAAY;QACvB,YAAY,EAAE,eAAe;QAC7B,QAAQ,EAAE,WAAW;QACrB,YAAY,EAAE,eAAe;KAC9B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,4BAA4B,CAC1C,sBAA8C;IAE9C,OAAO,IAAI,CAAC,SAAS,CACnB,qCAAqC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CACpE,CAAC;AACJ,CAAC"}

package/dist/esm/models/components/oauthtokenexchangegrant.d.ts

@@ -0,0 +1,100 @@
+import * as z from "zod/v3";
+import { ClosedEnum } from "../../types/enums.js";
+/**
+ * The type of `subject_token`. Only an access token is accepted, which is also the default.
+ */
+export declare const SubjectTokenType: {
+    readonly UrnIetfParamsOauthTokenTypeAccessToken: "urn:ietf:params:oauth:token-type:access_token";
+};
+/**
+ * The type of `subject_token`. Only an access token is accepted, which is also the default.
+ */
+export type SubjectTokenType = ClosedEnum<typeof SubjectTokenType>;
+/**
+ * `app_user` issues a token that acts as the user, limited to the manifest
+ *
+ * @remarks
+ * permissions their own role also grants. `app_installation` issues a token that acts
+ * as the app's service account, narrowed to the tenant of one activation.
+ */
+export declare const RequestedTokenType: {
+    readonly UrnGreensecurityTokenTypeAppUser: "urn:greensecurity:token-type:app_user";
+    readonly UrnGreensecurityTokenTypeAppInstallation: "urn:greensecurity:token-type:app_installation";
+};
+/**
+ * `app_user` issues a token that acts as the user, limited to the manifest
+ *
+ * @remarks
+ * permissions their own role also grants. `app_installation` issues a token that acts
+ * as the app's service account, narrowed to the tenant of one activation.
+ */
+export type RequestedTokenType = ClosedEnum<typeof RequestedTokenType>;
+/**
+ * RFC 8693 token exchange. The host app trades the signed-in user's session token for a
+ *
+ * @remarks
+ * short-lived token bound to one app and one activation. App tokens can never be used as
+ * `subject_token`. `Authorization` is not read.
+ */
+export type OAuthTokenExchangeGrant = {
+    grantType: "urn:ietf:params:oauth:grant-type:token-exchange";
+    /**
+     * The signed-in user's session token (from `POST /users/authenticate`). Missing, it is
+     *
+     * @remarks
+     * `invalid_request`. A token narrowed with `scope` is refused with `invalid_grant`, as
+     * is any app token.
+     */
+    subjectToken: string;
+    /**
+     * The type of `subject_token`. Only an access token is accepted, which is also the default.
+     */
+    subjectTokenType?: SubjectTokenType | undefined;
+    /**
+     * The app the token is for, as `app:<marketplace app id>`. Missing or unknown, it is `invalid_target`.
+     */
+    audience: string;
+    /**
+     * `app_user` issues a token that acts as the user, limited to the manifest
+     *
+     * @remarks
+     * permissions their own role also grants. `app_installation` issues a token that acts
+     * as the app's service account, narrowed to the tenant of one activation.
+     */
+    requestedTokenType: RequestedTokenType;
+    /**
+     * The activation to bind the token to. Required when more than one activation of the
+     *
+     * @remarks
+     * app covers the user (`invalid_request` otherwise); the user must be covered by it
+     * either way (`invalid_target`).
+     */
+    activationId?: number | undefined;
+    /**
+     * Optional space-delimited list of permissions (`resource.action`, or `apps:develop` for
+     *
+     * @remarks
+     * the device grant) to narrow the token to. Leave it out to get everything the client is
+     * allowed. It can only narrow: names the client is not allowed are dropped, and if none
+     * is left the request fails with `invalid_scope`.
+     */
+    scope?: string | undefined;
+};
+/** @internal */
+export declare const SubjectTokenType$outboundSchema: z.ZodNativeEnum<typeof SubjectTokenType>;
+/** @internal */
+export declare const RequestedTokenType$outboundSchema: z.ZodNativeEnum<typeof RequestedTokenType>;
+/** @internal */
+export type OAuthTokenExchangeGrant$Outbound = {
+    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+    subject_token: string;
+    subject_token_type: string;
+    audience: string;
+    requested_token_type: string;
+    activation_id?: number | undefined;
+    scope?: string | undefined;
+};
+/** @internal */
+export declare const OAuthTokenExchangeGrant$outboundSchema: z.ZodType<OAuthTokenExchangeGrant$Outbound, z.ZodTypeDef, OAuthTokenExchangeGrant>;
+export declare function oAuthTokenExchangeGrantToJSON(oAuthTokenExchangeGrant: OAuthTokenExchangeGrant): string;
+//# sourceMappingURL=oauthtokenexchangegrant.d.ts.map

package/dist/esm/models/components/oauthtokenexchangegrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthtokenexchangegrant.d.ts","sourceRoot":"","sources":["../../../../src/models/components/oauthtokenexchangegrant.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD;;GAEG;AACH,eAAO,MAAM,gBAAgB;;CAGnB,CAAC;AACX;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;;;CAIrB,CAAC;AACX;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,EAAE,iDAAiD,CAAC;IAC7D;;;;;;OAMG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAChD;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,kBAAkB,EAAE,kBAAkB,CAAC;IACvC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,+BAA+B,EAAE,CAAC,CAAC,aAAa,CAC3D,OAAO,gBAAgB,CACS,CAAC;AAEnC,gBAAgB;AAChB,eAAO,MAAM,iCAAiC,EAAE,CAAC,CAAC,aAAa,CAC7D,OAAO,kBAAkB,CACS,CAAC;AAErC,gBAAgB;AAChB,MAAM,MAAM,gCAAgC,GAAG;IAC7C,UAAU,EAAE,iDAAiD,CAAC;IAC9D,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,sCAAsC,EAAE,CAAC,CAAC,OAAO,CAC5D,gCAAgC,EAChC,CAAC,CAAC,UAAU,EACZ,uBAAuB,CAmBvB,CAAC;AAEH,wBAAgB,6BAA6B,CAC3C,uBAAuB,EAAE,uBAAuB,GAC/C,MAAM,CAIR"}

package/dist/esm/models/components/oauthtokenexchangegrant.js

@@ -0,0 +1,48 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+/**
+ * The type of `subject_token`. Only an access token is accepted, which is also the default.
+ */
+export const SubjectTokenType = {
+    UrnIetfParamsOauthTokenTypeAccessToken: "urn:ietf:params:oauth:token-type:access_token",
+};
+/**
+ * `app_user` issues a token that acts as the user, limited to the manifest
+ *
+ * @remarks
+ * permissions their own role also grants. `app_installation` issues a token that acts
+ * as the app's service account, narrowed to the tenant of one activation.
+ */
+export const RequestedTokenType = {
+    UrnGreensecurityTokenTypeAppUser: "urn:greensecurity:token-type:app_user",
+    UrnGreensecurityTokenTypeAppInstallation: "urn:greensecurity:token-type:app_installation",
+};
+/** @internal */
+export const SubjectTokenType$outboundSchema = z.nativeEnum(SubjectTokenType);
+/** @internal */
+export const RequestedTokenType$outboundSchema = z.nativeEnum(RequestedTokenType);
+/** @internal */
+export const OAuthTokenExchangeGrant$outboundSchema = z.object({
+    grantType: z.literal("urn:ietf:params:oauth:grant-type:token-exchange"),
+    subjectToken: z.string(),
+    subjectTokenType: SubjectTokenType$outboundSchema.default("urn:ietf:params:oauth:token-type:access_token"),
+    audience: z.string(),
+    requestedTokenType: RequestedTokenType$outboundSchema,
+    activationId: z.number().int().optional(),
+    scope: z.string().optional(),
+}).transform((v) => {
+    return remap$(v, {
+        grantType: "grant_type",
+        subjectToken: "subject_token",
+        subjectTokenType: "subject_token_type",
+        requestedTokenType: "requested_token_type",
+        activationId: "activation_id",
+    });
+});
+export function oAuthTokenExchangeGrantToJSON(oAuthTokenExchangeGrant) {
+    return JSON.stringify(OAuthTokenExchangeGrant$outboundSchema.parse(oAuthTokenExchangeGrant));
+}
+//# sourceMappingURL=oauthtokenexchangegrant.js.map

package/dist/esm/models/components/oauthtokenexchangegrant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthtokenexchangegrant.js","sourceRoot":"","sources":["../../../../src/models/components/oauthtokenexchangegrant.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,KAAK,IAAI,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAG1D;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,sCAAsC,EACpC,+CAA+C;CACzC,CAAC;AAMX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,gCAAgC,EAAE,uCAAuC;IACzE,wCAAwC,EACtC,+CAA+C;CACzC,CAAC;AA8DX,gBAAgB;AAChB,MAAM,CAAC,MAAM,+BAA+B,GAExC,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AAEnC,gBAAgB;AAChB,MAAM,CAAC,MAAM,iCAAiC,GAE1C,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAarC,gBAAgB;AAChB,MAAM,CAAC,MAAM,sCAAsC,GAI/C,CAAC,CAAC,MAAM,CAAC;IACX,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,iDAAiD,CAAC;IACvE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,gBAAgB,EAAE,+BAA+B,CAAC,OAAO,CACvD,+CAA+C,CAChD;IACD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,kBAAkB,EAAE,iCAAiC;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,MAAM,CAAC,CAAC,EAAE;QACf,SAAS,EAAE,YAAY;QACvB,YAAY,EAAE,eAAe;QAC7B,gBAAgB,EAAE,oBAAoB;QACtC,kBAAkB,EAAE,sBAAsB;QAC1C,YAAY,EAAE,eAAe;KAC9B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,6BAA6B,CAC3C,uBAAgD;IAEhD,OAAO,IAAI,CAAC,SAAS,CACnB,sCAAsC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CACtE,CAAC;AACJ,CAAC"}

package/dist/esm/models/components/oauthtokenrequest.d.ts

@@ -0,0 +1,22 @@
+import * as z from "zod/v3";
+import { OAuthClientCredentialsGrant, OAuthClientCredentialsGrant$Outbound } from "./oauthclientcredentialsgrant.js";
+import { OAuthCliRefreshTokenGrant, OAuthCliRefreshTokenGrant$Outbound } from "./oauthclirefreshtokengrant.js";
+import { OAuthDeviceCodeGrant, OAuthDeviceCodeGrant$Outbound } from "./oauthdevicecodegrant.js";
+import { OAuthRefreshTokenGrant, OAuthRefreshTokenGrant$Outbound } from "./oauthrefreshtokengrant.js";
+import { OAuthTokenExchangeGrant, OAuthTokenExchangeGrant$Outbound } from "./oauthtokenexchangegrant.js";
+/**
+ * One of the four supported grants, selected by `grant_type`. `refresh_token` has two
+ *
+ * @remarks
+ * variants, told apart by the client: a service account's (`OAuthRefreshTokenGrant`,
+ * with `client_secret`) and the apps CLI's public-client refresh
+ * (`OAuthCliRefreshTokenGrant`, `client_id=greensecurity-apps-cli` and a `gsdr_` token).
+ * No body matches both: the CLI variant takes no `client_secret`.
+ */
+export type OAuthTokenRequest = OAuthTokenExchangeGrant | OAuthRefreshTokenGrant | OAuthCliRefreshTokenGrant | OAuthDeviceCodeGrant | OAuthClientCredentialsGrant;
+/** @internal */
+export type OAuthTokenRequest$Outbound = OAuthTokenExchangeGrant$Outbound | OAuthRefreshTokenGrant$Outbound | OAuthCliRefreshTokenGrant$Outbound | OAuthDeviceCodeGrant$Outbound | OAuthClientCredentialsGrant$Outbound;
+/** @internal */
+export declare const OAuthTokenRequest$outboundSchema: z.ZodType<OAuthTokenRequest$Outbound, z.ZodTypeDef, OAuthTokenRequest>;
+export declare function oAuthTokenRequestToJSON(oAuthTokenRequest: OAuthTokenRequest): string;
+//# sourceMappingURL=oauthtokenrequest.d.ts.map

package/dist/esm/models/components/oauthtokenrequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthtokenrequest.d.ts","sourceRoot":"","sources":["../../../../src/models/components/oauthtokenrequest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EACL,2BAA2B,EAC3B,oCAAoC,EAErC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,yBAAyB,EACzB,kCAAkC,EAEnC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAE9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAEhC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,uBAAuB,EACvB,gCAAgC,EAEjC,MAAM,8BAA8B,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GACzB,uBAAuB,GACvB,sBAAsB,GACtB,yBAAyB,GACzB,oBAAoB,GACpB,2BAA2B,CAAC;AAEhC,gBAAgB;AAChB,MAAM,MAAM,0BAA0B,GAClC,gCAAgC,GAChC,+BAA+B,GAC/B,kCAAkC,GAClC,6BAA6B,GAC7B,oCAAoC,CAAC;AAEzC,gBAAgB;AAChB,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,OAAO,CACtD,0BAA0B,EAC1B,CAAC,CAAC,UAAU,EACZ,iBAAiB,CAOjB,CAAC;AAEH,wBAAgB,uBAAuB,CACrC,iBAAiB,EAAE,iBAAiB,GACnC,MAAM,CAIR"}

package/dist/esm/models/components/oauthtokenrequest.js

@@ -0,0 +1,21 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+import { smartUnion } from "../../types/smartUnion.js";
+import { OAuthClientCredentialsGrant$outboundSchema, } from "./oauthclientcredentialsgrant.js";
+import { OAuthCliRefreshTokenGrant$outboundSchema, } from "./oauthclirefreshtokengrant.js";
+import { OAuthDeviceCodeGrant$outboundSchema, } from "./oauthdevicecodegrant.js";
+import { OAuthRefreshTokenGrant$outboundSchema, } from "./oauthrefreshtokengrant.js";
+import { OAuthTokenExchangeGrant$outboundSchema, } from "./oauthtokenexchangegrant.js";
+/** @internal */
+export const OAuthTokenRequest$outboundSchema = smartUnion([
+    OAuthTokenExchangeGrant$outboundSchema,
+    OAuthRefreshTokenGrant$outboundSchema,
+    OAuthCliRefreshTokenGrant$outboundSchema,
+    OAuthDeviceCodeGrant$outboundSchema,
+    OAuthClientCredentialsGrant$outboundSchema,
+]);
+export function oAuthTokenRequestToJSON(oAuthTokenRequest) {
+    return JSON.stringify(OAuthTokenRequest$outboundSchema.parse(oAuthTokenRequest));
+}
+//# sourceMappingURL=oauthtokenrequest.js.map

package/dist/esm/models/components/oauthtokenrequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthtokenrequest.js","sourceRoot":"","sources":["../../../../src/models/components/oauthtokenrequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAGL,0CAA0C,GAC3C,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAGL,wCAAwC,GACzC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAGL,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGL,qCAAqC,GACtC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAGL,sCAAsC,GACvC,MAAM,8BAA8B,CAAC;AA0BtC,gBAAgB;AAChB,MAAM,CAAC,MAAM,gCAAgC,GAIzC,UAAU,CAAC;IACb,sCAAsC;IACtC,qCAAqC;IACrC,wCAAwC;IACxC,mCAAmC;IACnC,0CAA0C;CAC3C,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB,CACrC,iBAAoC;IAEpC,OAAO,IAAI,CAAC,SAAS,CACnB,gCAAgC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAC1D,CAAC;AACJ,CAAC"}

package/dist/esm/models/components/oauthtokentypehint.d.ts

@@ -0,0 +1,16 @@
+import * as z from "zod/v3";
+import { ClosedEnum } from "../../types/enums.js";
+/**
+ * Optional hint about the kind of token. Tokens are recognised by prefix, so this is informational.
+ */
+export declare const OAuthTokenTypeHint: {
+    readonly AccessToken: "access_token";
+    readonly RefreshToken: "refresh_token";
+};
+/**
+ * Optional hint about the kind of token. Tokens are recognised by prefix, so this is informational.
+ */
+export type OAuthTokenTypeHint = ClosedEnum<typeof OAuthTokenTypeHint>;
+/** @internal */
+export declare const OAuthTokenTypeHint$outboundSchema: z.ZodNativeEnum<typeof OAuthTokenTypeHint>;
+//# sourceMappingURL=oauthtokentypehint.d.ts.map

package/dist/esm/models/components/oauthtokentypehint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthtokentypehint.d.ts","sourceRoot":"","sources":["../../../../src/models/components/oauthtokentypehint.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;CAGrB,CAAC;AACX;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEvE,gBAAgB;AAChB,eAAO,MAAM,iCAAiC,EAAE,CAAC,CAAC,aAAa,CAC7D,OAAO,kBAAkB,CACS,CAAC"}

package/dist/esm/models/components/oauthtokentypehint.js

@@ -0,0 +1,14 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+import * as z from "zod/v3";
+/**
+ * Optional hint about the kind of token. Tokens are recognised by prefix, so this is informational.
+ */
+export const OAuthTokenTypeHint = {
+    AccessToken: "access_token",
+    RefreshToken: "refresh_token",
+};
+/** @internal */
+export const OAuthTokenTypeHint$outboundSchema = z.nativeEnum(OAuthTokenTypeHint);
+//# sourceMappingURL=oauthtokentypehint.js.map

package/dist/esm/models/components/oauthtokentypehint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthtokentypehint.js","sourceRoot":"","sources":["../../../../src/models/components/oauthtokentypehint.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,WAAW,EAAE,cAAc;IAC3B,YAAY,EAAE,eAAe;CACrB,CAAC;AAMX,gBAAgB;AAChB,MAAM,CAAC,MAAM,iCAAiC,GAE1C,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC"}

package/dist/esm/models/components/pager.d.ts

@@ -40,6 +40,15 @@ export type Pager = {
      * - items_per_page
      */
     useUrlParams: boolean;
+    /**
+     * How the server narrowed the list to your tenant, when it did, or `null`. Only some
+     *
+     * @remarks
+     * list endpoints return it, such as `GET /apps/secrets` and
+     * `GET /marketplace/apps/{id}/developers`; the others omit the field. Don't rely on
+     * its contents.
+     */
+    scope?: Array<any> | null | undefined;
 };
 /** @internal */
 export declare const Pager$inboundSchema: z.ZodType<Pager, z.ZodTypeDef, unknown>;

package/dist/esm/models/components/pager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pager.d.ts","sourceRoot":"","sources":["../../../../src/models/components/pager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE;;GAEG;AACH,MAAM,MAAM,KAAK,GAAG;IAClB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAgBpE,CAAC;AAEL,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,GACjB,eAAe,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAM5C"}
+{"version":3,"file":"pager.d.ts","sourceRoot":"","sources":["../../../../src/models/components/pager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE;;GAEG;AACH,MAAM,MAAM,KAAK,GAAG;IAClB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;CACvC,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAiBpE,CAAC;AAEL,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,GACjB,eAAe,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAM5C"}

package/dist/esm/models/components/pager.js

@@ -15,6 +15,7 @@ export const Pager$inboundSchema = z
     items_per_page: types.number(),
     page: types.number(),
     use_url_params: types.boolean(),
+    scope: z.nullable(z.array(z.any())).optional(),
 }).transform((v) => {
     return remap$(v, {
         "base_url": "baseUrl",

package/dist/esm/models/components/pager.js.map

@@ -1 +1 @@
-{"version":3,"file":"pager.js","sourceRoot":"","sources":["../../../../src/models/components/pager.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,KAAK,IAAI,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC;AA4CnD,gBAAgB;AAChB,MAAM,CAAC,MAAM,mBAAmB,GAA4C,CAAC;KAC1E,MAAM,CAAC;IACN,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE;IACxB,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE;IACpB,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE;IAC1B,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE;IAC9B,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE;IACpB,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE;CAChC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,MAAM,CAAC,CAAC,EAAE;QACf,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,WAAW;QACzB,gBAAgB,EAAE,cAAc;QAChC,gBAAgB,EAAE,cAAc;KACjC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,UAAU,aAAa,CAC3B,UAAkB;IAElB,OAAO,SAAS,CACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAC/C,mCAAmC,CACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"pager.js","sourceRoot":"","sources":["../../../../src/models/components/pager.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,KAAK,IAAI,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC;AAqDnD,gBAAgB;AAChB,MAAM,CAAC,MAAM,mBAAmB,GAA4C,CAAC;KAC1E,MAAM,CAAC;IACN,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE;IACxB,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE;IACpB,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE;IAC1B,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE;IAC9B,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE;IACpB,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,MAAM,CAAC,CAAC,EAAE;QACf,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,WAAW;QACzB,gBAAgB,EAAE,cAAc;QAChC,gBAAgB,EAAE,cAAc;KACjC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,UAAU,aAAa,CAC3B,UAAkB;IAElB,OAAO,SAAS,CACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAC/C,mCAAmC,CACpC,CAAC;AACJ,CAAC"}

package/dist/esm/models/components/tokenintrospection.d.ts

@@ -0,0 +1,77 @@
+import * as z from "zod/v3";
+import { Result as SafeParseResult } from "../../types/fp.js";
+import { SDKValidationError } from "../errors/sdkvalidationerror.js";
+import { AppTokenKind } from "./apptokenkind.js";
+/**
+ * RFC 8693 actor claim: who caused the token to be issued. Present only on an
+ *
+ * @remarks
+ * installation token obtained by token exchange, where `sub` is the service account and
+ * `act.sub` is the signed-in user whose view requested it.
+ */
+export type TokenIntrospectionActor = {
+    /**
+     * The user id, as a string.
+     */
+    sub: string;
+};
+/**
+ * RFC 7662 section 2.2. When `active` is `false` no other field is returned: the token is
+ *
+ * @remarks
+ * unknown, expired or revoked, was issued to a different app than the caller's, is a
+ * developer CLI token, or belongs to a user who has since been locked.
+ */
+export type TokenIntrospection = {
+    /**
+     * Whether the token is currently valid for your app.
+     */
+    active: boolean;
+    /**
+     * The id of the user the token acts as, as a string (RFC 7662). For an app user token
+     *
+     * @remarks
+     * this is the viewer; for an installation token it is the app's service account.
+     */
+    sub?: string | undefined;
+    /**
+     * The marketplace app the token was issued to.
+     */
+    appId?: number | undefined;
+    /**
+     * The activation the token is bound to.
+     */
+    activationId?: number | undefined;
+    /**
+     * Space-delimited scopes, as in `TokenResponse.scope`.
+     */
+    scope?: string | undefined;
+    /**
+     * Expiry, in seconds since the Unix epoch.
+     */
+    exp?: number | undefined;
+    /**
+     * When the token was issued, in seconds since the Unix epoch.
+     */
+    iat?: number | undefined;
+    /**
+     * `app_user` tokens act as a user; `app_installation` tokens act as the app's service account within one activation.
+     */
+    kind?: AppTokenKind | undefined;
+    tokenType?: "Bearer" | undefined;
+    /**
+     * RFC 8693 actor claim: who caused the token to be issued. Present only on an
+     *
+     * @remarks
+     * installation token obtained by token exchange, where `sub` is the service account and
+     * `act.sub` is the signed-in user whose view requested it.
+     */
+    act?: TokenIntrospectionActor | undefined;
+};
+/** @internal */
+export declare const TokenIntrospectionActor$inboundSchema: z.ZodType<TokenIntrospectionActor, z.ZodTypeDef, unknown>;
+export declare function tokenIntrospectionActorFromJSON(jsonString: string): SafeParseResult<TokenIntrospectionActor, SDKValidationError>;
+/** @internal */
+export declare const TokenIntrospection$inboundSchema: z.ZodType<TokenIntrospection, z.ZodTypeDef, unknown>;
+export declare function tokenIntrospectionFromJSON(jsonString: string): SafeParseResult<TokenIntrospection, SDKValidationError>;
+//# sourceMappingURL=tokenintrospection.d.ts.map

package/dist/esm/models/components/tokenintrospection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenintrospection.d.ts","sourceRoot":"","sources":["../../../../src/models/components/tokenintrospection.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,YAAY,EAA8B,MAAM,mBAAmB,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;OAEG;IACH,IAAI,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,SAAS,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IACjC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;CAC3C,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,qCAAqC,EAAE,CAAC,CAAC,OAAO,CAC3D,uBAAuB,EACvB,CAAC,CAAC,UAAU,EACZ,OAAO,CAGP,CAAC;AAEH,wBAAgB,+BAA+B,CAC7C,UAAU,EAAE,MAAM,GACjB,eAAe,CAAC,uBAAuB,EAAE,kBAAkB,CAAC,CAM9D;AAED,gBAAgB;AAChB,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,OAAO,CACtD,kBAAkB,EAClB,CAAC,CAAC,UAAU,EACZ,OAAO,CAkBP,CAAC;AAEH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,GACjB,eAAe,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAMzD"}

package/dist/esm/models/components/tokenintrospection.js

@@ -0,0 +1,38 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import { safeParse } from "../../lib/schemas.js";
+import * as types from "../../types/primitives.js";
+import { AppTokenKind$inboundSchema } from "./apptokenkind.js";
+/** @internal */
+export const TokenIntrospectionActor$inboundSchema = z.object({
+    sub: types.string(),
+});
+export function tokenIntrospectionActorFromJSON(jsonString) {
+    return safeParse(jsonString, (x) => TokenIntrospectionActor$inboundSchema.parse(JSON.parse(x)), `Failed to parse 'TokenIntrospectionActor' from JSON`);
+}
+/** @internal */
+export const TokenIntrospection$inboundSchema = z.object({
+    active: types.boolean(),
+    sub: types.optional(types.string()),
+    app_id: types.optional(types.number()),
+    activation_id: types.optional(types.number()),
+    scope: types.optional(types.string()),
+    exp: types.optional(types.number()),
+    iat: types.optional(types.number()),
+    kind: types.optional(AppTokenKind$inboundSchema),
+    token_type: types.optional(types.literal("Bearer")),
+    act: types.optional(z.lazy(() => TokenIntrospectionActor$inboundSchema)),
+}).transform((v) => {
+    return remap$(v, {
+        "app_id": "appId",
+        "activation_id": "activationId",
+        "token_type": "tokenType",
+    });
+});
+export function tokenIntrospectionFromJSON(jsonString) {
+    return safeParse(jsonString, (x) => TokenIntrospection$inboundSchema.parse(JSON.parse(x)), `Failed to parse 'TokenIntrospection' from JSON`);
+}
+//# sourceMappingURL=tokenintrospection.js.map

package/dist/esm/models/components/tokenintrospection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenintrospection.js","sourceRoot":"","sources":["../../../../src/models/components/tokenintrospection.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,KAAK,IAAI,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC;AAEnD,OAAO,EAAgB,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAsE7E,gBAAgB;AAChB,MAAM,CAAC,MAAM,qCAAqC,GAI9C,CAAC,CAAC,MAAM,CAAC;IACX,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,UAAU,+BAA+B,CAC7C,UAAkB;IAElB,OAAO,SAAS,CACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,qCAAqC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EACjE,qDAAqD,CACtD,CAAC;AACJ,CAAC;AAED,gBAAgB;AAChB,MAAM,CAAC,MAAM,gCAAgC,GAIzC,CAAC,CAAC,MAAM,CAAC;IACX,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE;IACvB,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACtC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAC7C,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACrC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAChD,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,qCAAqC,CAAC,CAAC;CACzE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,MAAM,CAAC,CAAC,EAAE;QACf,QAAQ,EAAE,OAAO;QACjB,eAAe,EAAE,cAAc;QAC/B,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,0BAA0B,CACxC,UAAkB;IAElB,OAAO,SAAS,CACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAC5D,gDAAgD,CACjD,CAAC;AACJ,CAAC"}