@opengeni/contracts 3.1.0-canary.1 → 3.1.2

package/src/atlassian.ts

@@ -1,3 +1,4 @@
+import { defineSchema } from "./define-schema";
 import { z } from "zod";
 import { ConnectionMetadata } from "./index";
 import { ConnectorDocumentDestination } from "./connector-destinations";
@@ -19,139 +20,165 @@ export const ATLASSIAN_REQUIRED_SCOPES = [
   "read:comment:confluence",
 ] as const;
 
-export const AtlassianSourceKind = z.enum(["jira_project", "confluence_space"]);
+export const AtlassianSourceKind = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["jira_project", "confluence_space"]),
+);
 export type AtlassianSourceKind = z.infer<typeof AtlassianSourceKind>;
 
-export const AtlassianSyncCadence = z.enum(["manual", "hourly", "daily"]);
+export const AtlassianSyncCadence = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["manual", "hourly", "daily"]),
+);
 export type AtlassianSyncCadence = z.infer<typeof AtlassianSyncCadence>;
 
-export const AtlassianReadPolicy = z.enum(["allow", "ask", "block"]);
+export const AtlassianReadPolicy = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["allow", "ask", "block"]),
+);
 export type AtlassianReadPolicy = z.infer<typeof AtlassianReadPolicy>;
 
-export const AtlassianConnectionLifecycle = z.object({
-  state: z.enum([
-    "active",
-    "paused",
-    "token_revoked",
-    "app_removed",
-    "disconnected",
-    "reconnect_required",
-    "reconsent_required",
-  ]),
-  recoverable: z.boolean(),
-  observedAt: z.string().datetime(),
-});
+export const AtlassianConnectionLifecycle = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    state: z.enum([
+      "active",
+      "paused",
+      "token_revoked",
+      "app_removed",
+      "disconnected",
+      "reconnect_required",
+      "reconsent_required",
+    ]),
+    recoverable: z.boolean(),
+    observedAt: z.string().datetime(),
+  }),
+);
 export type AtlassianConnectionLifecycle = z.infer<typeof AtlassianConnectionLifecycle>;
 
-export const AtlassianSelectedSource = z.object({
-  id: z.string().min(1).max(300),
-  cloudId: z.string().min(1).max(256),
-  siteName: z.string().min(1).max(512),
-  siteUrl: z.string().url(),
-  resourceId: z.string().min(1).max(256),
-  key: z.string().min(1).max(128),
-  name: z.string().min(1).max(512),
-  kind: AtlassianSourceKind,
-  destination: ConnectorDocumentDestination.optional(),
-  syncCadence: AtlassianSyncCadence,
-  syncEnabled: z.boolean(),
-  configGeneration: z.number().int().positive(),
-  readPolicy: AtlassianReadPolicy,
-  selectedAt: z.string().datetime(),
-});
+export const AtlassianSelectedSource = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    id: z.string().min(1).max(300),
+    cloudId: z.string().min(1).max(256),
+    siteName: z.string().min(1).max(512),
+    siteUrl: z.string().url(),
+    resourceId: z.string().min(1).max(256),
+    key: z.string().min(1).max(128),
+    name: z.string().min(1).max(512),
+    kind: AtlassianSourceKind,
+    destination: ConnectorDocumentDestination.optional(),
+    syncCadence: AtlassianSyncCadence,
+    syncEnabled: z.boolean(),
+    configGeneration: z.number().int().positive(),
+    readPolicy: AtlassianReadPolicy,
+    selectedAt: z.string().datetime(),
+  }),
+);
 export type AtlassianSelectedSource = z.infer<typeof AtlassianSelectedSource>;
 
-export const AtlassianConnectionMetadata = z.object({
-  credentialRole: z.literal(ATLASSIAN_CREDENTIAL_ROLE),
-  credentialLabel: z.literal(ATLASSIAN_CREDENTIAL_LABEL),
-  atlassianAccountId: z.string().min(1).max(256),
-  displayName: z.string().min(1).max(512),
-  email: z.string().email().nullable().optional(),
-  sites: z
-    .array(
-      z.object({
-        cloudId: z.string().min(1).max(256),
-        name: z.string().min(1).max(512),
-        url: z.string().url(),
-        products: z.array(z.enum(["jira", "confluence"])).max(2),
-      }),
-    )
-    .min(1)
-    .max(50),
-  verifiedAt: z.string().datetime(),
-  accessMode: z.literal("readonly"),
-  lifecycle: AtlassianConnectionLifecycle.optional(),
-  documentDestination: ConnectorDocumentDestination.optional(),
-  selectedSources: z.array(AtlassianSelectedSource).max(100).default([]),
-});
+export const AtlassianConnectionMetadata = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    credentialRole: z.literal(ATLASSIAN_CREDENTIAL_ROLE),
+    credentialLabel: z.literal(ATLASSIAN_CREDENTIAL_LABEL),
+    atlassianAccountId: z.string().min(1).max(256),
+    displayName: z.string().min(1).max(512),
+    email: z.string().email().nullable().optional(),
+    sites: z
+      .array(
+        z.object({
+          cloudId: z.string().min(1).max(256),
+          name: z.string().min(1).max(512),
+          url: z.string().url(),
+          products: z.array(z.enum(["jira", "confluence"])).max(2),
+        }),
+      )
+      .min(1)
+      .max(50),
+    verifiedAt: z.string().datetime(),
+    accessMode: z.literal("readonly"),
+    lifecycle: AtlassianConnectionLifecycle.optional(),
+    documentDestination: ConnectorDocumentDestination.optional(),
+    selectedSources: z.array(AtlassianSelectedSource).max(100).default([]),
+  }),
+);
 export type AtlassianConnectionMetadata = z.infer<typeof AtlassianConnectionMetadata>;
 
-export const AtlassianOAuthStartRequest = z.object({
-  connectionId: z.string().uuid().optional(),
-});
+export const AtlassianOAuthStartRequest = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    connectionId: z.string().uuid().optional(),
+  }),
+);
 export type AtlassianOAuthStartRequest = z.infer<typeof AtlassianOAuthStartRequest>;
 
-export const AtlassianOAuthStartResponse = z.object({
-  authorizationUrl: z.string().url(),
-  expiresAt: z.string().datetime(),
-});
+export const AtlassianOAuthStartResponse = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    authorizationUrl: z.string().url(),
+    expiresAt: z.string().datetime(),
+  }),
+);
 export type AtlassianOAuthStartResponse = z.infer<typeof AtlassianOAuthStartResponse>;
 
-export const AtlassianBrowseItem = z.object({
-  id: z.string().min(1).max(300),
-  cloudId: z.string().min(1).max(256),
-  siteName: z.string().min(1).max(512),
-  siteUrl: z.string().url(),
-  resourceId: z.string().min(1).max(256),
-  key: z.string().min(1).max(128),
-  name: z.string().min(1).max(512),
-  kind: AtlassianSourceKind,
-  description: z.string().max(2_000).nullable(),
-  webUrl: z.string().url(),
-});
+export const AtlassianBrowseItem = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    id: z.string().min(1).max(300),
+    cloudId: z.string().min(1).max(256),
+    siteName: z.string().min(1).max(512),
+    siteUrl: z.string().url(),
+    resourceId: z.string().min(1).max(256),
+    key: z.string().min(1).max(128),
+    name: z.string().min(1).max(512),
+    kind: AtlassianSourceKind,
+    description: z.string().max(2_000).nullable(),
+    webUrl: z.string().url(),
+  }),
+);
 export type AtlassianBrowseItem = z.infer<typeof AtlassianBrowseItem>;
 
-export const AtlassianBrowseResponse = z.object({
-  connection: z.lazy(() => ConnectionMetadata),
-  items: z.array(AtlassianBrowseItem).max(200),
-});
+export const AtlassianBrowseResponse = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    connection: z.lazy(() => ConnectionMetadata),
+    items: z.array(AtlassianBrowseItem).max(200),
+  }),
+);
 export type AtlassianBrowseResponse = z.infer<typeof AtlassianBrowseResponse>;
 
-export const SaveAtlassianSourcesRequest = z.object({
-  sources: z
-    .array(
-      AtlassianBrowseItem.pick({
-        id: true,
-        cloudId: true,
-        siteName: true,
-        siteUrl: true,
-        resourceId: true,
-        key: true,
-        name: true,
-        kind: true,
-      }),
-    )
-    .max(100),
-  destination: z.object({
-    authorityKind: z.enum(["organization", "workspace", "personal"]),
-    collectionId: z.string().uuid().nullable().default(null),
+export const SaveAtlassianSourcesRequest = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    sources: z
+      .array(
+        AtlassianBrowseItem.pick({
+          id: true,
+          cloudId: true,
+          siteName: true,
+          siteUrl: true,
+          resourceId: true,
+          key: true,
+          name: true,
+          kind: true,
+        }),
+      )
+      .max(100),
+    destination: z.object({
+      authorityKind: z.enum(["organization", "workspace", "personal"]),
+      collectionId: z.string().uuid().nullable().default(null),
+    }),
+    syncCadence: AtlassianSyncCadence,
+    syncEnabled: z.boolean(),
+    readPolicy: AtlassianReadPolicy.default("allow"),
   }),
-  syncCadence: AtlassianSyncCadence,
-  syncEnabled: z.boolean(),
-  readPolicy: AtlassianReadPolicy.default("allow"),
-});
+);
 export type SaveAtlassianSourcesRequest = z.infer<typeof SaveAtlassianSourcesRequest>;
 
-export const AtlassianLifecycleActionRequest = z.object({
-  action: z.enum(["pause", "resume"]),
-  expectedVersion: z.number().int().positive(),
-});
+export const AtlassianLifecycleActionRequest = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    action: z.enum(["pause", "resume"]),
+    expectedVersion: z.number().int().positive(),
+  }),
+);
 export type AtlassianLifecycleActionRequest = z.infer<typeof AtlassianLifecycleActionRequest>;
 
-export const AtlassianDisconnectRequest = z.object({
-  expectedVersion: z.number().int().positive(),
-  idempotencyKey: z.string().uuid(),
-});
+export const AtlassianDisconnectRequest = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    expectedVersion: z.number().int().positive(),
+    idempotencyKey: z.string().uuid(),
+  }),
+);
 export type AtlassianDisconnectRequest = z.infer<typeof AtlassianDisconnectRequest>;
 
 export function atlassianScopesAllowRead(scopes: readonly string[]): boolean {

package/src/browser-storage.ts

@@ -0,0 +1,10 @@
+/** Persisted discriminator; null identity alone never implies ephemeral storage. */
+export const EPHEMERAL_CHROMIUM_DRIVER_ID = "opengeni.cdp.ephemeral-context.v1" as const;
+
+export function browserSessionStorageMode(session: {
+  driverId: string;
+}): "private_profile" | "ephemeral_context" {
+  return session.driverId === EPHEMERAL_CHROMIUM_DRIVER_ID
+    ? "ephemeral_context"
+    : "private_profile";
+}

package/src/bundled-skills.ts

@@ -1,22 +1,31 @@
+import { defineSchema } from "./define-schema";
 import { z } from "zod";
 
-export const BundledSkillId = z.enum([
-  "builtin:opengeni-visualize",
-  "builtin:document-parsing",
-  "builtin:opengeni-skills",
-  "builtin:opengeni-projects",
-  "builtin:opengeni-documents",
-  "builtin:opengeni-spreadsheets",
-  "builtin:opengeni-presentations",
-  "builtin:opengeni-sites",
-  "builtin:opengeni-video-generation",
-]);
+export const BundledSkillId = /* @__PURE__ */ defineSchema(() =>
+  z.enum([
+    "builtin:opengeni-help",
+    "builtin:opengeni-client",
+    "builtin:opengeni-visualize",
+    "builtin:document-parsing",
+    "builtin:opengeni-skills",
+    "builtin:opengeni-projects",
+    "builtin:opengeni-schedules",
+    "builtin:opengeni-documents",
+    "builtin:opengeni-spreadsheets",
+    "builtin:opengeni-presentations",
+    "builtin:opengeni-sites",
+    "builtin:opengeni-video-generation",
+    "builtin:opengeni-secrets",
+  ]),
+);
 export type BundledSkillId = z.infer<typeof BundledSkillId>;
-export const BundledSkillSelection = z
-  .array(BundledSkillId)
-  .max(BundledSkillId.options.length)
-  .refine((ids) => new Set(ids).size === ids.length, "bundled Skill ids must be unique")
-  .transform((ids) => [...ids].sort());
+export const BundledSkillSelection = /* @__PURE__ */ defineSchema(() =>
+  z
+    .array(BundledSkillId)
+    .max(BundledSkillId.options.length)
+    .refine((ids) => new Set(ids).size === ids.length, "bundled Skill ids must be unique")
+    .transform((ids) => [...ids].sort()),
+);
 
 /** Undefined is defaults/inheritance; an explicit empty list disables bundles. */
 export function resolveBundledSkillSelection(
@@ -29,6 +38,19 @@ export function resolveBundledSkillSelection(
   return selected === undefined ? undefined : BundledSkillSelection.parse(selected);
 }
 
+/**
+ * Freeze the defaults a session's agent configuration implies. An agent that
+ * starts from `capabilities: "none"` carries no bundled Opengeni guides unless
+ * the request lists them; an explicit list (including `[]`) is kept exactly,
+ * and `"all"` or legacy (null) configurations keep the bundled defaults.
+ */
+export function bundledSkillSelectionForAgentConfig(
+  selection: BundledSkillId[] | undefined,
+  agentConfig: { from: "all" | "none" } | null | undefined,
+): BundledSkillId[] | undefined {
+  return selection === undefined && agentConfig?.from === "none" ? [] : selection;
+}
+
 // Immutable session configuration, following the existing create-identity
 // metadata convention. Callers cannot set this through arbitrary metadata.
 const BUNDLED_SKILL_SELECTION_KEY = "_opengeni_bundled_skill_ids_v1";
@@ -41,9 +63,30 @@ export function withBundledSkillSelectionMetadata(
   if (ids !== undefined) next[BUNDLED_SKILL_SELECTION_KEY] = BundledSkillSelection.parse(ids);
   return next;
 }
+/**
+ * Stored-data read. Ids are permanent, but a row written by a newer (or
+ * rolled-back-from) release can hold an id this build lacks. Such ids are
+ * dropped rather than failing the session read; dropping only narrows the
+ * stored selection and never turns it back into defaults. Input stays strict,
+ * and a value that is not a list of id strings still fails.
+ */
+const StoredBundledSkillSelection = /* @__PURE__ */ defineSchema(() => z.array(z.string()));
+const knownBundledSkillIds: ReadonlySet<string> = new Set(BundledSkillId.options);
+/**
+ * Exact stored selection for keyed create replay identity. Unlike the
+ * tolerant read, it keeps ids this build does not know: a retry must match
+ * what was stored, not the narrowed projection of it.
+ */
+export function storedBundledSkillSelectionIdentity(metadata: Record<string, unknown>): unknown {
+  return metadata[BUNDLED_SKILL_SELECTION_KEY];
+}
 export function bundledSkillSelectionFromMetadata(
   metadata: Record<string, unknown>,
 ): BundledSkillId[] | undefined {
   const value = metadata[BUNDLED_SKILL_SELECTION_KEY];
-  return value === undefined ? undefined : BundledSkillSelection.parse(value);
+  if (value === undefined) return undefined;
+  const known = StoredBundledSkillSelection.parse(value).filter((id): id is BundledSkillId =>
+    knownBundledSkillIds.has(id),
+  );
+  return [...new Set(known)].sort();
 }

package/src/canonical-human-identities.ts

@@ -1,59 +1,53 @@
+import { defineSchema } from "./define-schema";
 import { z } from "zod";
 
-export const CanonicalHumanIdentityStatus = z.enum([
-  "active",
-  "recovery_required",
-  "disputed",
-  "disabled",
-]);
+export const CanonicalHumanIdentityStatus = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["active", "recovery_required", "disputed", "disabled"]),
+);
 export type CanonicalHumanIdentityStatus = z.infer<typeof CanonicalHumanIdentityStatus>;
 
-export const CanonicalHumanLoginBindingStatus = z.enum([
-  "active",
-  "recovery_pending",
-  "stale",
-  "disputed",
-  "revoked",
-]);
+export const CanonicalHumanLoginBindingStatus = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["active", "recovery_pending", "stale", "disputed", "revoked"]),
+);
 export type CanonicalHumanLoginBindingStatus = z.infer<typeof CanonicalHumanLoginBindingStatus>;
 
-export const CanonicalHumanRecoveryState = z.enum([
-  "ready",
-  "recovery_required",
-  "lost_factor",
-  "disputed",
-  "disabled",
-]);
+export const CanonicalHumanRecoveryState = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["ready", "recovery_required", "lost_factor", "disputed", "disabled"]),
+);
 export type CanonicalHumanRecoveryState = z.infer<typeof CanonicalHumanRecoveryState>;
 
-export const CanonicalHumanLoginBinding = z.object({
-  id: z.string().uuid(),
-  providerId: z.string().min(1).max(128),
-  providerAccountId: z.string().min(1).max(1024),
-  status: CanonicalHumanLoginBindingStatus,
-  revision: z.number().int().positive(),
-  verifiedAt: z.string().datetime(),
-  lastVerifiedAt: z.string().datetime(),
-  revokedAt: z.string().datetime().nullable(),
-  createdAt: z.string().datetime(),
-  updatedAt: z.string().datetime(),
-});
-export type CanonicalHumanLoginBinding = z.infer<typeof CanonicalHumanLoginBinding>;
-
-export const CanonicalHumanIdentityProjection = z.object({
-  activeIdentity: z.object({
+export const CanonicalHumanLoginBinding = /* @__PURE__ */ defineSchema(() =>
+  z.object({
     id: z.string().uuid(),
-    displayName: z.string().min(1).max(256),
-    status: CanonicalHumanIdentityStatus,
-    identityRevision: z.number().int().positive(),
-    authRevision: z.number().int().positive(),
-    activeLoginBindingId: z.string().uuid().nullable(),
-    recoveryState: CanonicalHumanRecoveryState,
+    providerId: z.string().min(1).max(128),
+    providerAccountId: z.string().min(1).max(1024),
+    status: CanonicalHumanLoginBindingStatus,
+    revision: z.number().int().positive(),
+    verifiedAt: z.string().datetime(),
+    lastVerifiedAt: z.string().datetime(),
+    revokedAt: z.string().datetime().nullable(),
     createdAt: z.string().datetime(),
     updatedAt: z.string().datetime(),
   }),
-  loginBindings: z.array(CanonicalHumanLoginBinding).max(64),
-});
+);
+export type CanonicalHumanLoginBinding = z.infer<typeof CanonicalHumanLoginBinding>;
+
+export const CanonicalHumanIdentityProjection = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    activeIdentity: z.object({
+      id: z.string().uuid(),
+      displayName: z.string().min(1).max(256),
+      status: CanonicalHumanIdentityStatus,
+      identityRevision: z.number().int().positive(),
+      authRevision: z.number().int().positive(),
+      activeLoginBindingId: z.string().uuid().nullable(),
+      recoveryState: CanonicalHumanRecoveryState,
+      createdAt: z.string().datetime(),
+      updatedAt: z.string().datetime(),
+    }),
+    loginBindings: z.array(CanonicalHumanLoginBinding).max(64),
+  }),
+);
 export type CanonicalHumanIdentityProjection = z.infer<typeof CanonicalHumanIdentityProjection>;
 
 const OperationFields = {
@@ -62,32 +56,40 @@ const OperationFields = {
   reason: z.string().trim().min(1).max(512),
 } as const;
 
-export const LinkCanonicalHumanLoginBindingRequest = z.object({
-  ...OperationFields,
-  providerId: z.string().trim().min(1).max(128),
-  providerAccountId: z.string().trim().min(1).max(1024),
-});
+export const LinkCanonicalHumanLoginBindingRequest = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    ...OperationFields,
+    providerId: z.string().trim().min(1).max(128),
+    providerAccountId: z.string().trim().min(1).max(1024),
+  }),
+);
 export type LinkCanonicalHumanLoginBindingRequest = z.infer<
   typeof LinkCanonicalHumanLoginBindingRequest
 >;
 
-export const CanonicalHumanBindingOperationRequest = z.object({
-  ...OperationFields,
-});
+export const CanonicalHumanBindingOperationRequest = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    ...OperationFields,
+  }),
+);
 export type CanonicalHumanBindingOperationRequest = z.infer<
   typeof CanonicalHumanBindingOperationRequest
 >;
 
-export const CanonicalHumanIdentityMutationOutcome = z.enum(["applied", "lost_factor", "disputed"]);
+export const CanonicalHumanIdentityMutationOutcome = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["applied", "lost_factor", "disputed"]),
+);
 export type CanonicalHumanIdentityMutationOutcome = z.infer<
   typeof CanonicalHumanIdentityMutationOutcome
 >;
 
-export const CanonicalHumanIdentityMutationResponse = z.object({
-  outcome: CanonicalHumanIdentityMutationOutcome,
-  operationId: z.string().uuid(),
-  identity: CanonicalHumanIdentityProjection,
-});
+export const CanonicalHumanIdentityMutationResponse = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    outcome: CanonicalHumanIdentityMutationOutcome,
+    operationId: z.string().uuid(),
+    identity: CanonicalHumanIdentityProjection,
+  }),
+);
 export type CanonicalHumanIdentityMutationResponse = z.infer<
   typeof CanonicalHumanIdentityMutationResponse
 >;

package/src/claude-provider-account-authority.ts

@@ -0,0 +1,12 @@
+import { XaiProviderAccountAuthoritySnapshotV1 } from "./xai-provider-account-authority";
+import type { z } from "zod";
+
+/** Same opaque pool selection shape; Claude's live authority is revalidated separately. */
+export const ClaudeProviderAccountAuthoritySnapshotV1 = XaiProviderAccountAuthoritySnapshotV1;
+export type ClaudeProviderAccountAuthoritySnapshotV1 = z.infer<
+  typeof ClaudeProviderAccountAuthoritySnapshotV1
+>;
+export const WORKSPACE_CLAUDE_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 = {
+  version: 1,
+  scope: "workspace",
+} as const satisfies ClaudeProviderAccountAuthoritySnapshotV1;

package/src/claude-subscription-oauth.ts

@@ -0,0 +1,73 @@
+import { defineSchema } from "./define-schema";
+import { z } from "zod";
+
+export const ClaudeSubscriptionSetupTokenRequest = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      token: z.string().trim().min(1).max(16384),
+      scope: z.enum(["workspace", "user"]).default("workspace"),
+      label: z.string().trim().max(200).nullable().optional(),
+      reconnectAccountId: z.string().uuid().optional(),
+      expectedCredentialVersion: z.number().int().positive().optional(),
+    })
+    .strict()
+    .refine(
+      (request) =>
+        Boolean(request.reconnectAccountId) === (request.expectedCredentialVersion !== undefined),
+      { message: "Replacing a setup token requires its account and credential version." },
+    ),
+);
+export type ClaudeSubscriptionSetupTokenRequest = z.infer<
+  typeof ClaudeSubscriptionSetupTokenRequest
+>;
+
+export const ClaudeSubscriptionOAuthStartRequest = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      scope: z.enum(["workspace", "user"]).default("workspace"),
+      reconnectAccountId: z.string().uuid().optional(),
+    })
+    .strict(),
+);
+export type ClaudeSubscriptionOAuthStartRequest = z.infer<
+  typeof ClaudeSubscriptionOAuthStartRequest
+>;
+
+export const ClaudeSubscriptionOAuthStartResponse = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      attemptId: z.string().uuid(),
+      authorizationUrl: z.string().url(),
+      expiresAt: z.string().datetime(),
+    })
+    .strict(),
+);
+export type ClaudeSubscriptionOAuthStartResponse = z.infer<
+  typeof ClaudeSubscriptionOAuthStartResponse
+>;
+
+export const ClaudeSubscriptionOAuthCompleteRequest = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      attemptId: z.string().uuid(),
+      code: z.string().trim().min(1).max(4096),
+    })
+    .strict(),
+);
+export type ClaudeSubscriptionOAuthCompleteRequest = z.infer<
+  typeof ClaudeSubscriptionOAuthCompleteRequest
+>;
+
+export const ClaudeSubscriptionOAuthCompleteResponse = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      connected: z.literal(true),
+      accountId: z.string().uuid(),
+      scope: z.enum(["organization", "workspace", "user"]),
+      credentialVersion: z.number().int().positive(),
+    })
+    .strict(),
+);
+export type ClaudeSubscriptionOAuthCompleteResponse = z.infer<
+  typeof ClaudeSubscriptionOAuthCompleteResponse
+>;