@greensecurity/javascript-sdk 0.46.0 → 0.47.0-beta.1

package/src/react-query/eventsListFeed.ts

@@ -80,15 +80,16 @@ export type EventsListFeedQueryError =
  * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission.
  * The caller's role and their relationship to the record decide what the response includes.
  *
- * Returns `Event` items with the `event.creator` and `event.invitees` scopes already applied,
- * so the server populates `event_creator`, `event_creator_img_url` and `invitees`—the fields this
- * feed has always carried. SDK builds below `0.55.0-beta.1` receive the older `Feed` shape
- * instead, in which `facility` and `department` are name strings, not ids; the server
- * chooses by the `X-SDK-User-Agent` header the SDK sends, so an existing client keeps the
- * shape it was generated against until you regenerate it.
+ * Returns `Event` items with the `event.creator`, `event.invitees`, `event.facility` and
+ * `event.department` scopes already applied, so the server populates `event_creator`,
+ * `event_creator_img_url` and `invitees`, and `facility` and `department` are `{ id, name }`
+ * summaries—the fields this feed has always carried. SDK builds below `0.46.0-beta.1`
+ * receive the older `Feed` shape instead, in which `facility` and `department` are name
+ * strings, not ids; the server chooses by the `X-SDK-User-Agent` header the SDK sends, so an
+ * existing client keeps the shape it was generated against until you regenerate it.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how the server compares a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how the server compares a
  * build against it.
  */
 export function useEventsListFeed(
@@ -115,15 +116,16 @@ export function useEventsListFeed(
  * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission.
  * The caller's role and their relationship to the record decide what the response includes.
  *
- * Returns `Event` items with the `event.creator` and `event.invitees` scopes already applied,
- * so the server populates `event_creator`, `event_creator_img_url` and `invitees`—the fields this
- * feed has always carried. SDK builds below `0.55.0-beta.1` receive the older `Feed` shape
- * instead, in which `facility` and `department` are name strings, not ids; the server
- * chooses by the `X-SDK-User-Agent` header the SDK sends, so an existing client keeps the
- * shape it was generated against until you regenerate it.
+ * Returns `Event` items with the `event.creator`, `event.invitees`, `event.facility` and
+ * `event.department` scopes already applied, so the server populates `event_creator`,
+ * `event_creator_img_url` and `invitees`, and `facility` and `department` are `{ id, name }`
+ * summaries—the fields this feed has always carried. SDK builds below `0.46.0-beta.1`
+ * receive the older `Feed` shape instead, in which `facility` and `department` are name
+ * strings, not ids; the server chooses by the `X-SDK-User-Agent` header the SDK sends, so an
+ * existing client keeps the shape it was generated against until you regenerate it.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how the server compares a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how the server compares a
  * build against it.
  */
 export function useEventsListFeedSuspense(
@@ -153,15 +155,16 @@ export function useEventsListFeedSuspense(
  * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission.
  * The caller's role and their relationship to the record decide what the response includes.
  *
- * Returns `Event` items with the `event.creator` and `event.invitees` scopes already applied,
- * so the server populates `event_creator`, `event_creator_img_url` and `invitees`—the fields this
- * feed has always carried. SDK builds below `0.55.0-beta.1` receive the older `Feed` shape
- * instead, in which `facility` and `department` are name strings, not ids; the server
- * chooses by the `X-SDK-User-Agent` header the SDK sends, so an existing client keeps the
- * shape it was generated against until you regenerate it.
+ * Returns `Event` items with the `event.creator`, `event.invitees`, `event.facility` and
+ * `event.department` scopes already applied, so the server populates `event_creator`,
+ * `event_creator_img_url` and `invitees`, and `facility` and `department` are `{ id, name }`
+ * summaries—the fields this feed has always carried. SDK builds below `0.46.0-beta.1`
+ * receive the older `Feed` shape instead, in which `facility` and `department` are name
+ * strings, not ids; the server chooses by the `X-SDK-User-Agent` header the SDK sends, so an
+ * existing client keeps the shape it was generated against until you regenerate it.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how the server compares a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how the server compares a
  * build against it.
  */
 export function useEventsListFeedInfinite(
@@ -202,15 +205,16 @@ export function useEventsListFeedInfinite(
  * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission.
  * The caller's role and their relationship to the record decide what the response includes.
  *
- * Returns `Event` items with the `event.creator` and `event.invitees` scopes already applied,
- * so the server populates `event_creator`, `event_creator_img_url` and `invitees`—the fields this
- * feed has always carried. SDK builds below `0.55.0-beta.1` receive the older `Feed` shape
- * instead, in which `facility` and `department` are name strings, not ids; the server
- * chooses by the `X-SDK-User-Agent` header the SDK sends, so an existing client keeps the
- * shape it was generated against until you regenerate it.
+ * Returns `Event` items with the `event.creator`, `event.invitees`, `event.facility` and
+ * `event.department` scopes already applied, so the server populates `event_creator`,
+ * `event_creator_img_url` and `invitees`, and `facility` and `department` are `{ id, name }`
+ * summaries—the fields this feed has always carried. SDK builds below `0.46.0-beta.1`
+ * receive the older `Feed` shape instead, in which `facility` and `department` are name
+ * strings, not ids; the server chooses by the `X-SDK-User-Agent` header the SDK sends, so an
+ * existing client keeps the shape it was generated against until you regenerate it.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how the server compares a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how the server compares a
  * build against it.
  */
 export function useEventsListFeedInfiniteSuspense(

package/src/react-query/eventsListPendingInvitations.ts

@@ -80,15 +80,16 @@ export type EventsListPendingInvitationsQueryError =
  * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission:
  * the caller's role and their relationship to the record decide what the endpoint returns.
  *
- * Returns `Invite` items with the `invite.event` and `invite.invitee` scopes already applied,
- * so `event` is the expanded `{ id, name }` summary instead of a bare id, and `invitee` is
- * populated—the appointment and the recipient this list has always named. This endpoint
- * takes no `expand` parameter; the endpoint always applies both scopes.
- * SDK builds earlier than `0.55.0-beta.1` receive the older `PendingInvitation` shape instead, which
+ * Returns `Invite` items with the `invite.event`, `invite.invitee`, `event.location` and
+ * `event.creator` scopes already applied. So `event` is the expanded summary instead of a bare
+ * id, with the appointment's dates, flags, notes, location and organizer, and `invitee` is
+ * populated with the recipient's name and thumbnail—what this list has always published. This
+ * endpoint takes no `expand` parameter; the endpoint always applies these scopes.
+ * SDK builds earlier than `0.46.0-beta.1` receive the older `PendingInvitation` shape instead, which
  * embeds the appointment.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Invite`. See the `Invite` schema for exactly how a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Invite`. See the `Invite` schema for exactly how a
  * build compares against it.
  */
 export function useEventsListPendingInvitations(
@@ -121,15 +122,16 @@ export function useEventsListPendingInvitations(
  * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission:
  * the caller's role and their relationship to the record decide what the endpoint returns.
  *
- * Returns `Invite` items with the `invite.event` and `invite.invitee` scopes already applied,
- * so `event` is the expanded `{ id, name }` summary instead of a bare id, and `invitee` is
- * populated—the appointment and the recipient this list has always named. This endpoint
- * takes no `expand` parameter; the endpoint always applies both scopes.
- * SDK builds earlier than `0.55.0-beta.1` receive the older `PendingInvitation` shape instead, which
+ * Returns `Invite` items with the `invite.event`, `invite.invitee`, `event.location` and
+ * `event.creator` scopes already applied. So `event` is the expanded summary instead of a bare
+ * id, with the appointment's dates, flags, notes, location and organizer, and `invitee` is
+ * populated with the recipient's name and thumbnail—what this list has always published. This
+ * endpoint takes no `expand` parameter; the endpoint always applies these scopes.
+ * SDK builds earlier than `0.46.0-beta.1` receive the older `PendingInvitation` shape instead, which
  * embeds the appointment.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Invite`. See the `Invite` schema for exactly how a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Invite`. See the `Invite` schema for exactly how a
  * build compares against it.
  */
 export function useEventsListPendingInvitationsSuspense(
@@ -162,15 +164,16 @@ export function useEventsListPendingInvitationsSuspense(
  * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission:
  * the caller's role and their relationship to the record decide what the endpoint returns.
  *
- * Returns `Invite` items with the `invite.event` and `invite.invitee` scopes already applied,
- * so `event` is the expanded `{ id, name }` summary instead of a bare id, and `invitee` is
- * populated—the appointment and the recipient this list has always named. This endpoint
- * takes no `expand` parameter; the endpoint always applies both scopes.
- * SDK builds earlier than `0.55.0-beta.1` receive the older `PendingInvitation` shape instead, which
+ * Returns `Invite` items with the `invite.event`, `invite.invitee`, `event.location` and
+ * `event.creator` scopes already applied. So `event` is the expanded summary instead of a bare
+ * id, with the appointment's dates, flags, notes, location and organizer, and `invitee` is
+ * populated with the recipient's name and thumbnail—what this list has always published. This
+ * endpoint takes no `expand` parameter; the endpoint always applies these scopes.
+ * SDK builds earlier than `0.46.0-beta.1` receive the older `PendingInvitation` shape instead, which
  * embeds the appointment.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Invite`. See the `Invite` schema for exactly how a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Invite`. See the `Invite` schema for exactly how a
  * build compares against it.
  */
 export function useEventsListPendingInvitationsInfinite(
@@ -217,15 +220,16 @@ export function useEventsListPendingInvitationsInfinite(
  * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission:
  * the caller's role and their relationship to the record decide what the endpoint returns.
  *
- * Returns `Invite` items with the `invite.event` and `invite.invitee` scopes already applied,
- * so `event` is the expanded `{ id, name }` summary instead of a bare id, and `invitee` is
- * populated—the appointment and the recipient this list has always named. This endpoint
- * takes no `expand` parameter; the endpoint always applies both scopes.
- * SDK builds earlier than `0.55.0-beta.1` receive the older `PendingInvitation` shape instead, which
+ * Returns `Invite` items with the `invite.event`, `invite.invitee`, `event.location` and
+ * `event.creator` scopes already applied. So `event` is the expanded summary instead of a bare
+ * id, with the appointment's dates, flags, notes, location and organizer, and `invitee` is
+ * populated with the recipient's name and thumbnail—what this list has always published. This
+ * endpoint takes no `expand` parameter; the endpoint always applies these scopes.
+ * SDK builds earlier than `0.46.0-beta.1` receive the older `PendingInvitation` shape instead, which
  * embeds the appointment.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Invite`. See the `Invite` schema for exactly how a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Invite`. See the `Invite` schema for exactly how a
  * build compares against it.
  */
 export function useEventsListPendingInvitationsInfiniteSuspense(

package/src/react-query/eventsListStandingAppointments.ts

@@ -81,13 +81,14 @@ export type EventsListStandingAppointmentsQueryError =
  * the caller's role and their relationship to the record decide what the endpoint returns.
  *
  * Returns `Event` items with the `event.location`, `event.attendees`, `event.viewer_invite`,
- * `event.creator` and `event.invitees` scopes already applied, so `location`, `attendees`,
- * `event_creator`, `event_creator_img_url` and `invitees` are populated and `status` carries
- * the reader's own outstanding invite. SDK builds earlier than `0.55.0-beta.1` receive the older
+ * `event.creator`, `event.invitees`, `event.facility` and `event.department` scopes already
+ * applied, so `location`, `attendees`, `event_creator`, `event_creator_img_url` and `invitees`
+ * are populated, `facility` and `department` are `{ id, name }` summaries, and `status` carries
+ * the reader's own outstanding invite. SDK builds earlier than `0.46.0-beta.1` receive the older
  * `StandingAppointment` shape instead.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
  * build compares against it.
  */
 export function useEventsListStandingAppointments(
@@ -121,13 +122,14 @@ export function useEventsListStandingAppointments(
  * the caller's role and their relationship to the record decide what the endpoint returns.
  *
  * Returns `Event` items with the `event.location`, `event.attendees`, `event.viewer_invite`,
- * `event.creator` and `event.invitees` scopes already applied, so `location`, `attendees`,
- * `event_creator`, `event_creator_img_url` and `invitees` are populated and `status` carries
- * the reader's own outstanding invite. SDK builds earlier than `0.55.0-beta.1` receive the older
+ * `event.creator`, `event.invitees`, `event.facility` and `event.department` scopes already
+ * applied, so `location`, `attendees`, `event_creator`, `event_creator_img_url` and `invitees`
+ * are populated, `facility` and `department` are `{ id, name }` summaries, and `status` carries
+ * the reader's own outstanding invite. SDK builds earlier than `0.46.0-beta.1` receive the older
  * `StandingAppointment` shape instead.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
  * build compares against it.
  */
 export function useEventsListStandingAppointmentsSuspense(
@@ -161,13 +163,14 @@ export function useEventsListStandingAppointmentsSuspense(
  * the caller's role and their relationship to the record decide what the endpoint returns.
  *
  * Returns `Event` items with the `event.location`, `event.attendees`, `event.viewer_invite`,
- * `event.creator` and `event.invitees` scopes already applied, so `location`, `attendees`,
- * `event_creator`, `event_creator_img_url` and `invitees` are populated and `status` carries
- * the reader's own outstanding invite. SDK builds earlier than `0.55.0-beta.1` receive the older
+ * `event.creator`, `event.invitees`, `event.facility` and `event.department` scopes already
+ * applied, so `location`, `attendees`, `event_creator`, `event_creator_img_url` and `invitees`
+ * are populated, `facility` and `department` are `{ id, name }` summaries, and `status` carries
+ * the reader's own outstanding invite. SDK builds earlier than `0.46.0-beta.1` receive the older
  * `StandingAppointment` shape instead.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
  * build compares against it.
  */
 export function useEventsListStandingAppointmentsInfinite(
@@ -215,13 +218,14 @@ export function useEventsListStandingAppointmentsInfinite(
  * the caller's role and their relationship to the record decide what the endpoint returns.
  *
  * Returns `Event` items with the `event.location`, `event.attendees`, `event.viewer_invite`,
- * `event.creator` and `event.invitees` scopes already applied, so `location`, `attendees`,
- * `event_creator`, `event_creator_img_url` and `invitees` are populated and `status` carries
- * the reader's own outstanding invite. SDK builds earlier than `0.55.0-beta.1` receive the older
+ * `event.creator`, `event.invitees`, `event.facility` and `event.department` scopes already
+ * applied, so `location`, `attendees`, `event_creator`, `event_creator_img_url` and `invitees`
+ * are populated, `facility` and `department` are `{ id, name }` summaries, and `status` carries
+ * the reader's own outstanding invite. SDK builds earlier than `0.46.0-beta.1` receive the older
  * `StandingAppointment` shape instead.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
  * build compares against it.
  */
 export function useEventsListStandingAppointmentsInfiniteSuspense(

package/src/react-query/index.ts

@@ -7,6 +7,20 @@ export * from "./_types.js";
 
 export * from "./alertsListAlerts.js";
 export * from "./alertsUpdateUserAlerts.js";
+export * from "./appsAddAppDeveloper.js";
+export * from "./appsCloseAppDevSession.js";
+export * from "./appsCreateAppDevSession.js";
+export * from "./appsDeleteAppSecret.js";
+export * from "./appsFindAppSecret.js";
+export * from "./appsHeartbeatAppDevSession.js";
+export * from "./appsListAppActivations.js";
+export * from "./appsListAppDevelopers.js";
+export * from "./appsListAppSecrets.js";
+export * from "./appsListAppVersions.js";
+export * from "./appsPublishAppManifest.js";
+export * from "./appsRemoveAppDeveloper.js";
+export * from "./appsRotateAppWebhookEndpointSecret.js";
+export * from "./appsSetAppSecret.js";
 export * from "./companiesAddCompanyManager.js";
 export * from "./companiesGetCompany.js";
 export * from "./companiesListCompanyCredentials.js";
@@ -77,6 +91,10 @@ export * from "./medicalProductsUpdateMedicalProduct.js";
 export * from "./medicalProductsUpdateMedicalProductCategory.js";
 export * from "./medicalProductsUpdateMedicalProductFamily.js";
 export * from "./mobileDevicesAddMobileDevice.js";
+export * from "./oauthCreateDeviceAuthorization.js";
+export * from "./oauthCreateToken.js";
+export * from "./oauthIntrospectToken.js";
+export * from "./oauthRevokeToken.js";
 export * from "./organizationsCreateCompanyTargetFacility.js";
 export * from "./organizationsDeleteCompanyTargetFacility.js";
 export * from "./organizationsDownloadCompanyTargetFacilitiesExport.js";

package/src/react-query/oauthCreateDeviceAuthorization.ts

@@ -0,0 +1,131 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import {
+  MutationKey,
+  useMutation,
+  UseMutationResult,
+} from "@tanstack/react-query";
+import { GreenSecurityCore } from "../core.js";
+import { oauthCreateDeviceAuthorization } from "../funcs/oauthCreateDeviceAuthorization.js";
+import { combineSignals } from "../lib/primitives.js";
+import { RequestOptions } from "../lib/sdks.js";
+import * as components from "../models/components/index.js";
+import { GreenSecurityError } from "../models/errors/greensecurityerror.js";
+import {
+  ConnectionError,
+  InvalidRequestError,
+  RequestAbortedError,
+  RequestTimeoutError,
+  UnexpectedClientError,
+} from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import { unwrapAsync } from "../types/fp.js";
+import { useGreenSecurityContext } from "./_context.js";
+import { MutationHookOptions } from "./_types.js";
+
+export type OauthCreateDeviceAuthorizationMutationVariables = {
+  request: components.DeviceAuthorizationRequest;
+  options?: RequestOptions;
+};
+
+export type OauthCreateDeviceAuthorizationMutationData =
+  components.DeviceAuthorizationResponse;
+
+export type OauthCreateDeviceAuthorizationMutationError =
+  | errors.OAuthError
+  | GreenSecurityError
+  | ResponseValidationError
+  | ConnectionError
+  | RequestAbortedError
+  | RequestTimeoutError
+  | InvalidRequestError
+  | UnexpectedClientError
+  | SDKValidationError;
+
+/**
+ * Start a device login
+ *
+ * @remarks
+ * Starts the RFC 8628 device authorization flow that `apps-cli login` uses:
+ *
+ * 1. Call this endpoint and show the user `user_code`, or open `verification_uri_complete`.
+ * 2. The user approves the request in the Green Security app, signed in as themselves.
+ * 3. Meanwhile, poll `POST /oauth/token` with
+ *    `grant_type=urn:ietf:params:oauth:grant-type:device_code` every `interval` seconds.
+ *    It answers `authorization_pending` until the user approves, and then returns a
+ *    15-minute developer CLI token and a refresh token that renews it, for up to 90 days.
+ *
+ * The codes expire after `expires_in` seconds. Each address may start 20 logins per ten
+ * minutes; past that the endpoint answers `429` with `slow_down`. The request body may be
+ * JSON or `application/x-www-form-urlencoded`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** No authentication required.
+ */
+export function useOauthCreateDeviceAuthorizationMutation(
+  options?: MutationHookOptions<
+    OauthCreateDeviceAuthorizationMutationData,
+    OauthCreateDeviceAuthorizationMutationError,
+    OauthCreateDeviceAuthorizationMutationVariables
+  >,
+): UseMutationResult<
+  OauthCreateDeviceAuthorizationMutationData,
+  OauthCreateDeviceAuthorizationMutationError,
+  OauthCreateDeviceAuthorizationMutationVariables
+> {
+  const client = useGreenSecurityContext();
+  return useMutation({
+    ...buildOauthCreateDeviceAuthorizationMutation(client, options),
+    ...options,
+  });
+}
+
+export function mutationKeyOauthCreateDeviceAuthorization(): MutationKey {
+  return [
+    "@greensecurity/javascript-sdk",
+    "oauth",
+    "createDeviceAuthorization",
+  ];
+}
+
+export function buildOauthCreateDeviceAuthorizationMutation(
+  client$: GreenSecurityCore,
+  hookOptions?: RequestOptions,
+): {
+  mutationKey: MutationKey;
+  mutationFn: (
+    variables: OauthCreateDeviceAuthorizationMutationVariables,
+  ) => Promise<OauthCreateDeviceAuthorizationMutationData>;
+} {
+  return {
+    mutationKey: mutationKeyOauthCreateDeviceAuthorization(),
+    mutationFn: function oauthCreateDeviceAuthorizationMutationFn({
+      request,
+      options,
+    }): Promise<OauthCreateDeviceAuthorizationMutationData> {
+      const mergedOptions = {
+        ...hookOptions,
+        ...options,
+        fetchOptions: {
+          ...hookOptions?.fetchOptions,
+          ...options?.fetchOptions,
+          signal: combineSignals(
+            hookOptions?.fetchOptions?.signal,
+            options?.fetchOptions?.signal,
+          ),
+        },
+      };
+      return unwrapAsync(oauthCreateDeviceAuthorization(
+        client$,
+        request,
+        mergedOptions,
+      ));
+    },
+  };
+}

package/src/react-query/oauthCreateToken.ts

@@ -0,0 +1,157 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import {
+  MutationKey,
+  useMutation,
+  UseMutationResult,
+} from "@tanstack/react-query";
+import { GreenSecurityCore } from "../core.js";
+import { oauthCreateToken } from "../funcs/oauthCreateToken.js";
+import { combineSignals } from "../lib/primitives.js";
+import { RequestOptions } from "../lib/sdks.js";
+import * as components from "../models/components/index.js";
+import { GreenSecurityError } from "../models/errors/greensecurityerror.js";
+import {
+  ConnectionError,
+  InvalidRequestError,
+  RequestAbortedError,
+  RequestTimeoutError,
+  UnexpectedClientError,
+} from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import { unwrapAsync } from "../types/fp.js";
+import { useGreenSecurityContext } from "./_context.js";
+import { MutationHookOptions } from "./_types.js";
+
+export type OauthCreateTokenMutationVariables = {
+  request: components.OAuthTokenRequest;
+  options?: RequestOptions;
+};
+
+export type OauthCreateTokenMutationData = components.TokenResponse;
+
+export type OauthCreateTokenMutationError =
+  | errors.OAuthError
+  | GreenSecurityError
+  | ResponseValidationError
+  | ConnectionError
+  | RequestAbortedError
+  | RequestTimeoutError
+  | InvalidRequestError
+  | UnexpectedClientError
+  | SDKValidationError;
+
+/**
+ * Issue an access, app or developer token
+ *
+ * @remarks
+ * The OAuth 2.0 token endpoint. It issues four kinds of short-lived token, chosen by
+ * `grant_type`:
+ *
+ * | Grant | Authenticate with | Issues |
+ * | --- | --- | --- |
+ * | `urn:ietf:params:oauth:grant-type:token-exchange` | The user's session token, as `subject_token` | An app user token (`gsu_`) or an app installation token (`gsi_`), 15 minutes |
+ * | `client_credentials` with `activation_id` | The app service account's `client_id` and `client_secret`, or its permanent token as `Authorization: Bearer` | An app installation token (`gsi_`), 15 minutes |
+ * | `client_credentials` without `activation_id` | An API service account's `client_id` and `client_secret`, or its permanent token as `Authorization: Bearer` | A plain API access token, 15 minutes |
+ * | `refresh_token` (service account) | The service account's `client_id` and `client_secret`, and a `refresh_token` | A plain API access token, 15 minutes, and a new refresh token |
+ * | `refresh_token` (apps CLI) | A `gsdr_` refresh token and `client_id=greensecurity-apps-cli`, no secret | A new developer CLI token (`gsd_`), 15 minutes, and a new `gsdr_` refresh token |
+ * | `urn:ietf:params:oauth:grant-type:device_code` | The `device_code` from `POST /oauth/device_authorization` | A developer CLI token (`gsd_`), 15 minutes, and a `gsdr_` refresh token |
+ *
+ * Token exchange is what the Green Security app does when it opens an app's views: the user
+ * must be covered by an activation of the app named in `audience`. `client_credentials` with
+ * `activation_id` is for the app's own backend. Without `activation_id`, `client_credentials`
+ * and a service account's `refresh_token` are the API service account flows: the response is
+ * a plain access token with no `issued_token_type` and no `activation_id` (see
+ * `TokenResponse`). An app token can never be used to obtain another token.
+ *
+ * The apps CLI logs in with the device grant and then renews its 15-minute developer token
+ * with the public-client `refresh_token` grant. Refresh tokens rotate and are single-use;
+ * presenting a spent one revokes the whole login, except for a retry within 30 seconds whose
+ * replacement is still unused. A login lasts at most 90 days from its device authorization.
+ * See `OAuthCliRefreshTokenGrant`.
+ *
+ * Every grant takes an optional `scope`, which can only narrow the token: it gets what was
+ * requested intersected with what the client is allowed, and if that is empty the request
+ * fails with `invalid_scope`. A refreshed token is never wider than the one it replaces.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`, and every parameter
+ * must be in the body: one sent in the query string is refused with `invalid_request`. Errors
+ * follow RFC 6749 and use `OAuthError` rather than the usual error envelope, including a
+ * body that fails validation (`400` `invalid_request`, never `422`). For the device grant,
+ * `authorization_pending` and `slow_down` mean "poll again later", not failure.
+ *
+ * Only `client_credentials` reads `Authorization`, and only when the body carries neither
+ * `client_id` nor `client_secret`. It accepts only the service account's permanent token
+ * there: a short-lived token (including one this endpoint issued), a narrowed token or an app
+ * token (`gsu_`, `gsi_`, `gsd_`) is answered `401` `invalid_client`, so a token can never be
+ * renewed or widened by presenting it. The other grants ignore the header.
+ *
+ * A narrowed `subject_token` is refused with `invalid_grant`, and a locked service account
+ * gets `401` `invalid_client` on `client_credentials` and `refresh_token`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** No named permission.
+ */
+export function useOauthCreateTokenMutation(
+  options?: MutationHookOptions<
+    OauthCreateTokenMutationData,
+    OauthCreateTokenMutationError,
+    OauthCreateTokenMutationVariables
+  >,
+): UseMutationResult<
+  OauthCreateTokenMutationData,
+  OauthCreateTokenMutationError,
+  OauthCreateTokenMutationVariables
+> {
+  const client = useGreenSecurityContext();
+  return useMutation({
+    ...buildOauthCreateTokenMutation(client, options),
+    ...options,
+  });
+}
+
+export function mutationKeyOauthCreateToken(): MutationKey {
+  return ["@greensecurity/javascript-sdk", "oauth", "createToken"];
+}
+
+export function buildOauthCreateTokenMutation(
+  client$: GreenSecurityCore,
+  hookOptions?: RequestOptions,
+): {
+  mutationKey: MutationKey;
+  mutationFn: (
+    variables: OauthCreateTokenMutationVariables,
+  ) => Promise<OauthCreateTokenMutationData>;
+} {
+  return {
+    mutationKey: mutationKeyOauthCreateToken(),
+    mutationFn: function oauthCreateTokenMutationFn({
+      request,
+      options,
+    }): Promise<OauthCreateTokenMutationData> {
+      const mergedOptions = {
+        ...hookOptions,
+        ...options,
+        fetchOptions: {
+          ...hookOptions?.fetchOptions,
+          ...options?.fetchOptions,
+          signal: combineSignals(
+            hookOptions?.fetchOptions?.signal,
+            options?.fetchOptions?.signal,
+          ),
+        },
+      };
+      return unwrapAsync(oauthCreateToken(
+        client$,
+        request,
+        mergedOptions,
+      ));
+    },
+  };
+}