@greatwait/contracts 0.1.0-alpha.3 → 0.1.0-alpha.4

package/dist/oauth.d.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "./zod.js";
 import { type Scope } from "./authority.js";
 /**
  * The delegated-authorization vocabulary: OAuth 2.1 as this product speaks it.
@@ -71,7 +71,7 @@ export declare const OAUTH_ROUTES: {
  * a dead token.
  */
 export declare const OAUTH_ERRORS: readonly ["access_denied", "invalid_client", "invalid_client_metadata", "invalid_grant", "invalid_redirect_uri", "invalid_request", "invalid_scope", "invalid_target", "server_error", "temporarily_unavailable", "unauthorized_client", "unsupported_grant_type", "unsupported_response_type"];
-export declare const oauthErrorCodeSchema: z.ZodEnum<{
+export declare const oauthErrorCodeSchema: import("zod").ZodEnum<{
     invalid_request: "invalid_request";
     access_denied: "access_denied";
     invalid_client: "invalid_client";
@@ -96,8 +96,8 @@ export type OAuthErrorCode = z.infer<typeof oauthErrorCodeSchema>;
  * human-readable string broke when the wording changed. Anything a client needs
  * to act on belongs in `error`.
  */
-export declare const oauthErrorSchema: z.ZodObject<{
-    error: z.ZodEnum<{
+export declare const oauthErrorSchema: import("zod").ZodObject<{
+    error: import("zod").ZodEnum<{
         invalid_request: "invalid_request";
         access_denied: "access_denied";
         invalid_client: "invalid_client";
@@ -112,9 +112,9 @@ export declare const oauthErrorSchema: z.ZodObject<{
         unsupported_grant_type: "unsupported_grant_type";
         unsupported_response_type: "unsupported_response_type";
     }>;
-    error_description: z.ZodOptional<z.ZodString>;
-    error_uri: z.ZodOptional<z.ZodURL>;
-}, z.core.$strip>;
+    error_description: import("zod").ZodOptional<import("zod").ZodString>;
+    error_uri: import("zod").ZodOptional<import("zod").ZodURL>;
+}, import("zod/v4/core").$strip>;
 export type OAuthErrorBody = z.infer<typeof oauthErrorSchema>;
 /**
  * HTTP status for each error, so a route cannot pair a code with the wrong one.
@@ -145,7 +145,7 @@ export declare function oauthError(error: OAuthErrorCode, description?: string):
  * is and what `capScopesToRole` has no role to cap against.
  */
 export declare const OAUTH_GRANT_TYPES: readonly ["authorization_code", "refresh_token"];
-export declare const oauthGrantTypeSchema: z.ZodEnum<{
+export declare const oauthGrantTypeSchema: import("zod").ZodEnum<{
     authorization_code: "authorization_code";
     refresh_token: "refresh_token";
 }>;
@@ -162,7 +162,7 @@ export declare const OAUTH_RESPONSE_TYPES: readonly ["code"];
  * downgraded to it.
  */
 export declare const PKCE_METHODS: readonly ["S256"];
-export declare const pkceMethodSchema: z.ZodEnum<{
+export declare const pkceMethodSchema: import("zod").ZodEnum<{
     S256: "S256";
 }>;
 /**
@@ -254,7 +254,7 @@ export declare const REFRESH_TOKEN_PATTERN: RegExp;
 export declare const AUTHORIZATION_CODE_PATTERN: RegExp;
 /** Any of the three, for the one place that has to tell ours from anything else. */
 export declare const OAUTH_SECRET_PATTERN: RegExp;
-export declare const redirectUriSchema: z.ZodString;
+export declare const redirectUriSchema: import("zod").ZodString;
 /** Whether a redirect URI names a loopback listener. Exported for the store. */
 export declare function isLoopbackRedirect(value: string): boolean;
 /** The most redirect URIs one client may register. */
@@ -288,26 +288,26 @@ export declare const MAX_REDIRECT_URIS = 8;
  * and `data:` are the ones that execute, and `http:` is the one an intermediary
  * can rewrite — on the page where what the human sees *is* the decision.
  */
-export declare const httpsUriSchema: z.ZodURL;
-export declare const clientRegistrationRequestSchema: z.ZodObject<{
-    client_name: z.ZodString;
-    client_uri: z.ZodOptional<z.ZodURL>;
-    grant_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+export declare const httpsUriSchema: import("zod").ZodURL;
+export declare const clientRegistrationRequestSchema: import("zod").ZodObject<{
+    client_name: import("zod").ZodString;
+    client_uri: import("zod").ZodOptional<import("zod").ZodURL>;
+    grant_types: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<{
         authorization_code: "authorization_code";
         refresh_token: "refresh_token";
     }>>>;
-    logo_uri: z.ZodOptional<z.ZodURL>;
-    policy_uri: z.ZodOptional<z.ZodURL>;
-    redirect_uris: z.ZodArray<z.ZodString>;
-    response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+    logo_uri: import("zod").ZodOptional<import("zod").ZodURL>;
+    policy_uri: import("zod").ZodOptional<import("zod").ZodURL>;
+    redirect_uris: import("zod").ZodArray<import("zod").ZodString>;
+    response_types: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<{
         code: "code";
     }>>>;
-    scope: z.ZodOptional<z.ZodString>;
-    token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
+    scope: import("zod").ZodOptional<import("zod").ZodString>;
+    token_endpoint_auth_method: import("zod").ZodOptional<import("zod").ZodEnum<{
         none: "none";
     }>>;
-    tos_uri: z.ZodOptional<z.ZodURL>;
-}, z.core.$strip>;
+    tos_uri: import("zod").ZodOptional<import("zod").ZodURL>;
+}, import("zod/v4/core").$strip>;
 export type ClientRegistrationRequest = z.infer<typeof clientRegistrationRequestSchema>;
 /**
  * What registration answers with, RFC 7591 §3.2.1.
@@ -316,27 +316,27 @@ export type ClientRegistrationRequest = z.infer<typeof clientRegistrationRequest
  * the latter is required *when a secret is issued*, and emitting it as `0`
  * alongside no secret is how a client concludes it has a non-expiring one.
  */
-export declare const clientRegistrationSchema: z.ZodObject<{
-    client_id: z.ZodString;
-    client_id_issued_at: z.ZodNumber;
-    client_name: z.ZodString;
-    client_uri: z.ZodOptional<z.ZodString>;
-    grant_types: z.ZodArray<z.ZodEnum<{
+export declare const clientRegistrationSchema: import("zod").ZodObject<{
+    client_id: import("zod").ZodString;
+    client_id_issued_at: import("zod").ZodNumber;
+    client_name: import("zod").ZodString;
+    client_uri: import("zod").ZodOptional<import("zod").ZodString>;
+    grant_types: import("zod").ZodArray<import("zod").ZodEnum<{
         authorization_code: "authorization_code";
         refresh_token: "refresh_token";
     }>>;
-    logo_uri: z.ZodOptional<z.ZodString>;
-    policy_uri: z.ZodOptional<z.ZodString>;
-    redirect_uris: z.ZodArray<z.ZodString>;
-    response_types: z.ZodArray<z.ZodEnum<{
+    logo_uri: import("zod").ZodOptional<import("zod").ZodString>;
+    policy_uri: import("zod").ZodOptional<import("zod").ZodString>;
+    redirect_uris: import("zod").ZodArray<import("zod").ZodString>;
+    response_types: import("zod").ZodArray<import("zod").ZodEnum<{
         code: "code";
     }>>;
-    scope: z.ZodString;
-    token_endpoint_auth_method: z.ZodEnum<{
+    scope: import("zod").ZodString;
+    token_endpoint_auth_method: import("zod").ZodEnum<{
         none: "none";
     }>;
-    tos_uri: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
+    tos_uri: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 export type ClientRegistration = z.infer<typeof clientRegistrationSchema>;
 /**
  * Scopes on the wire are one space-delimited string, RFC 6749 §3.3.
@@ -367,20 +367,20 @@ export declare function formatScopeString(scopes: readonly Scope[]): string;
  * identifier rather than merely recorded: a token minted for one audience and
  * accepted by another is the confused-deputy problem RFC 8707 exists to close.
  */
-export declare const authorizationParametersSchema: z.ZodObject<{
-    client_id: z.ZodString;
-    code_challenge: z.ZodString;
-    code_challenge_method: z.ZodEnum<{
+export declare const authorizationParametersSchema: import("zod").ZodObject<{
+    client_id: import("zod").ZodString;
+    code_challenge: import("zod").ZodString;
+    code_challenge_method: import("zod").ZodEnum<{
         S256: "S256";
     }>;
-    redirect_uri: z.ZodString;
-    resource: z.ZodOptional<z.ZodString>;
-    response_type: z.ZodEnum<{
+    redirect_uri: import("zod").ZodString;
+    resource: import("zod").ZodOptional<import("zod").ZodString>;
+    response_type: import("zod").ZodEnum<{
         code: "code";
     }>;
-    scope: z.ZodOptional<z.ZodString>;
-    state: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
+    scope: import("zod").ZodOptional<import("zod").ZodString>;
+    state: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 export type AuthorizationParameters = z.infer<typeof authorizationParametersSchema>;
 /**
  * What the consent screen is given to render.
@@ -394,27 +394,28 @@ export type AuthorizationParameters = z.infer<typeof authorizationParametersSche
  * asked for `credentials:write` and holds `member` sees the reduced list, which
  * is the honest thing to show and is also what will be recorded.
  */
-export declare const consentPromptSchema: z.ZodObject<{
-    client: z.ZodObject<{
-        id: z.ZodString;
-        logoUri: z.ZodOptional<z.ZodString>;
-        name: z.ZodString;
-        policyUri: z.ZodOptional<z.ZodString>;
-        termsUri: z.ZodOptional<z.ZodString>;
-        uri: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>;
-    environmentKinds: z.ZodArray<z.ZodEnum<{
+export declare const consentPromptSchema: import("zod").ZodObject<{
+    client: import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        logoUri: import("zod").ZodOptional<import("zod").ZodString>;
+        name: import("zod").ZodString;
+        policyUri: import("zod").ZodOptional<import("zod").ZodString>;
+        termsUri: import("zod").ZodOptional<import("zod").ZodString>;
+        uri: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    environmentKinds: import("zod").ZodArray<import("zod").ZodEnum<{
         test: "test";
         live: "live";
     }>>;
-    expiresAt: z.ZodString;
-    redirectUri: z.ZodString;
-    projects: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        name: z.ZodString;
-    }, z.core.$strip>>;
-    scopes: z.ZodArray<z.ZodEnum<{
+    expiresAt: import("zod").ZodString;
+    redirectUri: import("zod").ZodString;
+    projects: import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        name: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>>;
+    scopes: import("zod").ZodArray<import("zod").ZodEnum<{
         "credentials:administer": "credentials:administer";
+        "billing:write": "billing:write";
         "credentials:read": "credentials:read";
         "credentials:write": "credentials:write";
         "endpoints:read": "endpoints:read";
@@ -424,13 +425,14 @@ export declare const consentPromptSchema: z.ZodObject<{
         "grants:write": "grants:write";
         "occurrences:read": "occurrences:read";
         "occurrences:redeliver": "occurrences:redeliver";
+        "projects:administer": "projects:administer";
         "projects:read": "projects:read";
         "projects:write": "projects:write";
         "schedules:read": "schedules:read";
         "schedules:write": "schedules:write";
         "usage:read": "usage:read";
     }>>;
-}, z.core.$strip>;
+}, import("zod/v4/core").$strip>;
 export type ConsentPrompt = z.infer<typeof consentPromptSchema>;
 /**
  * The member's decision.
@@ -445,15 +447,16 @@ export type ConsentPrompt = z.infer<typeof consentPromptSchema>;
  * outright and which is no less forbidden because the request arrived through a
  * browser.
  */
-export declare const consentDecisionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    decision: z.ZodLiteral<"approve">;
-    environmentKind: z.ZodEnum<{
+export declare const consentDecisionSchema: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+    decision: import("zod").ZodLiteral<"approve">;
+    environmentKind: import("zod").ZodEnum<{
         test: "test";
         live: "live";
     }>;
-    project: z.ZodString;
-    scopes: z.ZodArray<z.ZodEnum<{
+    project: import("zod").ZodString;
+    scopes: import("zod").ZodArray<import("zod").ZodEnum<{
         "credentials:administer": "credentials:administer";
+        "billing:write": "billing:write";
         "credentials:read": "credentials:read";
         "credentials:write": "credentials:write";
         "endpoints:read": "endpoints:read";
@@ -463,15 +466,16 @@ export declare const consentDecisionSchema: z.ZodDiscriminatedUnion<[z.ZodObject
         "grants:write": "grants:write";
         "occurrences:read": "occurrences:read";
         "occurrences:redeliver": "occurrences:redeliver";
+        "projects:administer": "projects:administer";
         "projects:read": "projects:read";
         "projects:write": "projects:write";
         "schedules:read": "schedules:read";
         "schedules:write": "schedules:write";
         "usage:read": "usage:read";
     }>>;
-}, z.core.$strip>, z.ZodObject<{
-    decision: z.ZodLiteral<"deny">;
-}, z.core.$strip>], "decision">;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    decision: import("zod").ZodLiteral<"deny">;
+}, import("zod/v4/core").$strip>], "decision">;
 export type ConsentDecision = z.infer<typeof consentDecisionSchema>;
 /**
  * Where to send the browser next.
@@ -481,18 +485,18 @@ export type ConsentDecision = z.infer<typeof consentDecisionSchema>;
  * to `fetch` would be followed by the client, delivering the code to the
  * consent screen's own JavaScript instead of to the client's redirect URI.
  */
-export declare const consentOutcomeSchema: z.ZodObject<{
-    redirectTo: z.ZodString;
-}, z.core.$strip>;
+export declare const consentOutcomeSchema: import("zod").ZodObject<{
+    redirectTo: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 export type ConsentOutcome = z.infer<typeof consentOutcomeSchema>;
 /** RFC 6749 §5.1. `expires_in` is seconds, and relative, as the standard says. */
-export declare const tokenResponseSchema: z.ZodObject<{
-    access_token: z.ZodString;
-    expires_in: z.ZodNumber;
-    refresh_token: z.ZodString;
-    scope: z.ZodString;
-    token_type: z.ZodLiteral<"Bearer">;
-}, z.core.$strip>;
+export declare const tokenResponseSchema: import("zod").ZodObject<{
+    access_token: import("zod").ZodString;
+    expires_in: import("zod").ZodNumber;
+    refresh_token: import("zod").ZodString;
+    scope: import("zod").ZodString;
+    token_type: import("zod").ZodLiteral<"Bearer">;
+}, import("zod/v4/core").$strip>;
 export type TokenResponse = z.infer<typeof tokenResponseSchema>;
 /**
  * The token request, form-encoded per RFC 6749 §4.1.3 and §6.
@@ -502,30 +506,30 @@ export type TokenResponse = z.infer<typeof tokenResponseSchema>;
  * refused by the shape rather than by a check somebody has to remember, which is
  * what makes "PKCE is mandatory" a property of the contract.
  */
-export declare const tokenRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    client_id: z.ZodString;
-    code: z.ZodString;
-    code_verifier: z.ZodString;
-    grant_type: z.ZodLiteral<"authorization_code">;
-    redirect_uri: z.ZodString;
-    resource: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>, z.ZodObject<{
-    client_id: z.ZodString;
-    grant_type: z.ZodLiteral<"refresh_token">;
-    refresh_token: z.ZodString;
-    resource: z.ZodOptional<z.ZodString>;
-    scope: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>], "grant_type">;
+export declare const tokenRequestSchema: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+    client_id: import("zod").ZodString;
+    code: import("zod").ZodString;
+    code_verifier: import("zod").ZodString;
+    grant_type: import("zod").ZodLiteral<"authorization_code">;
+    redirect_uri: import("zod").ZodString;
+    resource: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    client_id: import("zod").ZodString;
+    grant_type: import("zod").ZodLiteral<"refresh_token">;
+    refresh_token: import("zod").ZodString;
+    resource: import("zod").ZodOptional<import("zod").ZodString>;
+    scope: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>], "grant_type">;
 export type TokenRequest = z.infer<typeof tokenRequestSchema>;
 /** RFC 7009 §2.1. The hint is advisory and this server ignores it. */
-export declare const revocationRequestSchema: z.ZodObject<{
-    client_id: z.ZodString;
-    token: z.ZodString;
-    token_type_hint: z.ZodOptional<z.ZodEnum<{
+export declare const revocationRequestSchema: import("zod").ZodObject<{
+    client_id: import("zod").ZodString;
+    token: import("zod").ZodString;
+    token_type_hint: import("zod").ZodOptional<import("zod").ZodEnum<{
         refresh_token: "refresh_token";
         access_token: "access_token";
     }>>;
-}, z.core.$strip>;
+}, import("zod/v4/core").$strip>;
 export type RevocationRequest = z.infer<typeof revocationRequestSchema>;
 /**
  * What became of a grant.
@@ -537,7 +541,7 @@ export type RevocationRequest = z.infer<typeof revocationRequestSchema>;
  * would say somebody decided something when nobody did.
  */
 export declare const OAUTH_GRANT_STATUSES: readonly ["active", "revoked"];
-export declare const oauthGrantStatusSchema: z.ZodEnum<{
+export declare const oauthGrantStatusSchema: import("zod").ZodEnum<{
     active: "active";
     revoked: "revoked";
 }>;
@@ -552,7 +556,7 @@ export type OAuthGrantStatus = z.infer<typeof oauthGrantStatusSchema>;
  * that cannot tell them apart cannot answer either question.
  */
 export declare const OAUTH_REVOCATION_REASONS: readonly ["authorization-code-replayed", "client-revoked", "member-revoked", "refresh-token-replayed"];
-export declare const oauthRevocationReasonSchema: z.ZodEnum<{
+export declare const oauthRevocationReasonSchema: import("zod").ZodEnum<{
     "authorization-code-replayed": "authorization-code-replayed";
     "client-revoked": "client-revoked";
     "member-revoked": "member-revoked";
@@ -566,28 +570,29 @@ export type OAuthRevocationReason = z.infer<typeof oauthRevocationReasonSchema>;
  * needs: enough to recognise which application this is and decide whether to
  * keep it, and nothing that would let a reader of the list use it.
  */
-export declare const oauthGrantSchema: z.ZodObject<{
-    client: z.ZodObject<{
-        id: z.ZodString;
-        name: z.ZodString;
-    }, z.core.$strip>;
-    createdAt: z.ZodString;
-    environmentKind: z.ZodEnum<{
+export declare const oauthGrantSchema: import("zod").ZodObject<{
+    client: import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        name: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    createdAt: import("zod").ZodString;
+    environmentKind: import("zod").ZodEnum<{
         test: "test";
         live: "live";
     }>;
-    id: z.ZodString;
-    lastUsedAt: z.ZodOptional<z.ZodString>;
-    project: z.ZodString;
-    revocationReason: z.ZodOptional<z.ZodEnum<{
+    id: import("zod").ZodString;
+    lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
+    project: import("zod").ZodString;
+    revocationReason: import("zod").ZodOptional<import("zod").ZodEnum<{
         "authorization-code-replayed": "authorization-code-replayed";
         "client-revoked": "client-revoked";
         "member-revoked": "member-revoked";
         "refresh-token-replayed": "refresh-token-replayed";
     }>>;
-    revokedAt: z.ZodOptional<z.ZodString>;
-    scopes: z.ZodArray<z.ZodEnum<{
+    revokedAt: import("zod").ZodOptional<import("zod").ZodString>;
+    scopes: import("zod").ZodArray<import("zod").ZodEnum<{
         "credentials:administer": "credentials:administer";
+        "billing:write": "billing:write";
         "credentials:read": "credentials:read";
         "credentials:write": "credentials:write";
         "endpoints:read": "endpoints:read";
@@ -597,41 +602,43 @@ export declare const oauthGrantSchema: z.ZodObject<{
         "grants:write": "grants:write";
         "occurrences:read": "occurrences:read";
         "occurrences:redeliver": "occurrences:redeliver";
+        "projects:administer": "projects:administer";
         "projects:read": "projects:read";
         "projects:write": "projects:write";
         "schedules:read": "schedules:read";
         "schedules:write": "schedules:write";
         "usage:read": "usage:read";
     }>>;
-    status: z.ZodEnum<{
+    status: import("zod").ZodEnum<{
         active: "active";
         revoked: "revoked";
     }>;
-}, z.core.$strip>;
+}, import("zod/v4/core").$strip>;
 export type OAuthGrant = z.infer<typeof oauthGrantSchema>;
-export declare const oauthGrantListSchema: z.ZodObject<{
-    data: z.ZodArray<z.ZodObject<{
-        client: z.ZodObject<{
-            id: z.ZodString;
-            name: z.ZodString;
-        }, z.core.$strip>;
-        createdAt: z.ZodString;
-        environmentKind: z.ZodEnum<{
+export declare const oauthGrantListSchema: import("zod").ZodObject<{
+    data: import("zod").ZodArray<import("zod").ZodObject<{
+        client: import("zod").ZodObject<{
+            id: import("zod").ZodString;
+            name: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+        createdAt: import("zod").ZodString;
+        environmentKind: import("zod").ZodEnum<{
             test: "test";
             live: "live";
         }>;
-        id: z.ZodString;
-        lastUsedAt: z.ZodOptional<z.ZodString>;
-        project: z.ZodString;
-        revocationReason: z.ZodOptional<z.ZodEnum<{
+        id: import("zod").ZodString;
+        lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
+        project: import("zod").ZodString;
+        revocationReason: import("zod").ZodOptional<import("zod").ZodEnum<{
             "authorization-code-replayed": "authorization-code-replayed";
             "client-revoked": "client-revoked";
             "member-revoked": "member-revoked";
             "refresh-token-replayed": "refresh-token-replayed";
         }>>;
-        revokedAt: z.ZodOptional<z.ZodString>;
-        scopes: z.ZodArray<z.ZodEnum<{
+        revokedAt: import("zod").ZodOptional<import("zod").ZodString>;
+        scopes: import("zod").ZodArray<import("zod").ZodEnum<{
             "credentials:administer": "credentials:administer";
+            "billing:write": "billing:write";
             "credentials:read": "credentials:read";
             "credentials:write": "credentials:write";
             "endpoints:read": "endpoints:read";
@@ -641,18 +648,19 @@ export declare const oauthGrantListSchema: z.ZodObject<{
             "grants:write": "grants:write";
             "occurrences:read": "occurrences:read";
             "occurrences:redeliver": "occurrences:redeliver";
+            "projects:administer": "projects:administer";
             "projects:read": "projects:read";
             "projects:write": "projects:write";
             "schedules:read": "schedules:read";
             "schedules:write": "schedules:write";
             "usage:read": "usage:read";
         }>>;
-        status: z.ZodEnum<{
+        status: import("zod").ZodEnum<{
             active: "active";
             revoked: "revoked";
         }>;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
+    }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>;
 export type OAuthGrantList = z.infer<typeof oauthGrantListSchema>;
 /**
  * What disconnecting answers with.
@@ -661,29 +669,30 @@ export type OAuthGrantList = z.infer<typeof oauthGrantListSchema>;
  * gives: a member who clicked disconnect wants to see *which* connection stopped
  * and when, and a 204 makes them ask for that separately.
  */
-export declare const oauthGrantRevokedSchema: z.ZodObject<{
-    grant: z.ZodObject<{
-        client: z.ZodObject<{
-            id: z.ZodString;
-            name: z.ZodString;
-        }, z.core.$strip>;
-        createdAt: z.ZodString;
-        environmentKind: z.ZodEnum<{
+export declare const oauthGrantRevokedSchema: import("zod").ZodObject<{
+    grant: import("zod").ZodObject<{
+        client: import("zod").ZodObject<{
+            id: import("zod").ZodString;
+            name: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+        createdAt: import("zod").ZodString;
+        environmentKind: import("zod").ZodEnum<{
             test: "test";
             live: "live";
         }>;
-        id: z.ZodString;
-        lastUsedAt: z.ZodOptional<z.ZodString>;
-        project: z.ZodString;
-        revocationReason: z.ZodOptional<z.ZodEnum<{
+        id: import("zod").ZodString;
+        lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
+        project: import("zod").ZodString;
+        revocationReason: import("zod").ZodOptional<import("zod").ZodEnum<{
             "authorization-code-replayed": "authorization-code-replayed";
             "client-revoked": "client-revoked";
             "member-revoked": "member-revoked";
             "refresh-token-replayed": "refresh-token-replayed";
         }>>;
-        revokedAt: z.ZodOptional<z.ZodString>;
-        scopes: z.ZodArray<z.ZodEnum<{
+        revokedAt: import("zod").ZodOptional<import("zod").ZodString>;
+        scopes: import("zod").ZodArray<import("zod").ZodEnum<{
             "credentials:administer": "credentials:administer";
+            "billing:write": "billing:write";
             "credentials:read": "credentials:read";
             "credentials:write": "credentials:write";
             "endpoints:read": "endpoints:read";
@@ -693,18 +702,19 @@ export declare const oauthGrantRevokedSchema: z.ZodObject<{
             "grants:write": "grants:write";
             "occurrences:read": "occurrences:read";
             "occurrences:redeliver": "occurrences:redeliver";
+            "projects:administer": "projects:administer";
             "projects:read": "projects:read";
             "projects:write": "projects:write";
             "schedules:read": "schedules:read";
             "schedules:write": "schedules:write";
             "usage:read": "usage:read";
         }>>;
-        status: z.ZodEnum<{
+        status: import("zod").ZodEnum<{
             active: "active";
             revoked: "revoked";
         }>;
-    }, z.core.$strip>;
-}, z.core.$strip>;
+    }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>;
 export type OAuthGrantRevoked = z.infer<typeof oauthGrantRevokedSchema>;
 /**
  * RFC 8414 authorization server metadata.
@@ -715,24 +725,25 @@ export type OAuthGrantRevoked = z.infer<typeof oauthGrantRevokedSchema>;
  * before it tries; and `grant_types_supported` omits everything OAuth 2.1
  * removed, so a client cannot conclude from silence that implicit is available.
  */
-export declare const authorizationServerMetadataSchema: z.ZodObject<{
-    authorization_endpoint: z.ZodURL;
-    code_challenge_methods_supported: z.ZodArray<z.ZodEnum<{
+export declare const authorizationServerMetadataSchema: import("zod").ZodObject<{
+    authorization_endpoint: import("zod").ZodURL;
+    code_challenge_methods_supported: import("zod").ZodArray<import("zod").ZodEnum<{
         S256: "S256";
     }>>;
-    grant_types_supported: z.ZodArray<z.ZodEnum<{
+    grant_types_supported: import("zod").ZodArray<import("zod").ZodEnum<{
         authorization_code: "authorization_code";
         refresh_token: "refresh_token";
     }>>;
-    issuer: z.ZodURL;
-    registration_endpoint: z.ZodURL;
-    response_modes_supported: z.ZodArray<z.ZodLiteral<"query">>;
-    response_types_supported: z.ZodArray<z.ZodEnum<{
+    issuer: import("zod").ZodURL;
+    registration_endpoint: import("zod").ZodURL;
+    response_modes_supported: import("zod").ZodArray<import("zod").ZodLiteral<"query">>;
+    response_types_supported: import("zod").ZodArray<import("zod").ZodEnum<{
         code: "code";
     }>>;
-    revocation_endpoint: z.ZodURL;
-    scopes_supported: z.ZodArray<z.ZodEnum<{
+    revocation_endpoint: import("zod").ZodURL;
+    scopes_supported: import("zod").ZodArray<import("zod").ZodEnum<{
         "credentials:administer": "credentials:administer";
+        "billing:write": "billing:write";
         "credentials:read": "credentials:read";
         "credentials:write": "credentials:write";
         "endpoints:read": "endpoints:read";
@@ -742,17 +753,18 @@ export declare const authorizationServerMetadataSchema: z.ZodObject<{
         "grants:write": "grants:write";
         "occurrences:read": "occurrences:read";
         "occurrences:redeliver": "occurrences:redeliver";
+        "projects:administer": "projects:administer";
         "projects:read": "projects:read";
         "projects:write": "projects:write";
         "schedules:read": "schedules:read";
         "schedules:write": "schedules:write";
         "usage:read": "usage:read";
     }>>;
-    token_endpoint: z.ZodURL;
-    token_endpoint_auth_methods_supported: z.ZodArray<z.ZodEnum<{
+    token_endpoint: import("zod").ZodURL;
+    token_endpoint_auth_methods_supported: import("zod").ZodArray<import("zod").ZodEnum<{
         none: "none";
     }>>;
-}, z.core.$strip>;
+}, import("zod/v4/core").$strip>;
 export type AuthorizationServerMetadata = z.infer<typeof authorizationServerMetadataSchema>;
 /**
  * RFC 9728 protected resource metadata.
@@ -763,12 +775,13 @@ export type AuthorizationServerMetadata = z.infer<typeof authorizationServerMeta
  * server that serves the RFC 8414 document but not this one is discoverable only
  * by clients that already knew where to look.
  */
-export declare const protectedResourceMetadataSchema: z.ZodObject<{
-    authorization_servers: z.ZodArray<z.ZodURL>;
-    bearer_methods_supported: z.ZodArray<z.ZodLiteral<"header">>;
-    resource: z.ZodURL;
-    scopes_supported: z.ZodArray<z.ZodEnum<{
+export declare const protectedResourceMetadataSchema: import("zod").ZodObject<{
+    authorization_servers: import("zod").ZodArray<import("zod").ZodURL>;
+    bearer_methods_supported: import("zod").ZodArray<import("zod").ZodLiteral<"header">>;
+    resource: import("zod").ZodURL;
+    scopes_supported: import("zod").ZodArray<import("zod").ZodEnum<{
         "credentials:administer": "credentials:administer";
+        "billing:write": "billing:write";
         "credentials:read": "credentials:read";
         "credentials:write": "credentials:write";
         "endpoints:read": "endpoints:read";
@@ -778,13 +791,14 @@ export declare const protectedResourceMetadataSchema: z.ZodObject<{
         "grants:write": "grants:write";
         "occurrences:read": "occurrences:read";
         "occurrences:redeliver": "occurrences:redeliver";
+        "projects:administer": "projects:administer";
         "projects:read": "projects:read";
         "projects:write": "projects:write";
         "schedules:read": "schedules:read";
         "schedules:write": "schedules:write";
         "usage:read": "usage:read";
     }>>;
-}, z.core.$strip>;
+}, import("zod/v4/core").$strip>;
 export type ProtectedResourceMetadata = z.infer<typeof protectedResourceMetadataSchema>;
 /**
  * The `WWW-Authenticate` value a protected endpoint returns on 401.