@opengeni/contracts 3.1.0-canary.2 → 3.1.2

package/dist/{chunk-YBW5JSA3.js → chunk-ZDCRWCGZ.js}

@@ -1,3 +1,7 @@
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
 // src/connector-attachments.ts
 import { z } from "zod";
 var CONNECTOR_ATTACHMENT_TRANSFER_VERSION = 1;
@@ -74,15 +78,17 @@ function privateUrlCredentialValues(value) {
 function publicMetadataContainsCredential(publicValue, credential) {
   return publicValue.includes(credential);
 }
-var ConnectorAttachmentProviderIdentity = z.object({
-  provider: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES).regex(PROVIDER_PATTERN),
-  kind: z.literal("attachment"),
-  value: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES).min(1).refine((value) => !CONTROL_CHARACTER_PATTERN.test(value), {
-    message: "must not contain control characters"
-  }).refine((value) => !isHttpUrl(value) && !containsHttpUrlReference(value), {
-    message: "must be an opaque provider attachment identity, not a URL"
-  })
-}).strict();
+var ConnectorAttachmentProviderIdentity = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    provider: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES).regex(PROVIDER_PATTERN),
+    kind: z.literal("attachment"),
+    value: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES).min(1).refine((value) => !CONTROL_CHARACTER_PATTERN.test(value), {
+      message: "must not contain control characters"
+    }).refine((value) => !isHttpUrl(value) && !containsHttpUrlReference(value), {
+      message: "must be an opaque provider attachment identity, not a URL"
+    })
+  }).strict()
+);
 var ConnectorAttachmentFileName = boundedString(
   CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES
 ).min(1).refine(
@@ -94,79 +100,87 @@ var ConnectorAttachmentMediaType = boundedString(
 ).regex(MEDIA_TYPE_PATTERN).refine((value) => !containsHttpUrlReference(value), {
   message: "must not contain an HTTP URL reference"
 });
-var ConnectorAttachmentSha256 = z.string().regex(SHA256_PATTERN);
-var ConnectorAttachmentPrivateSource = z.object({
-  url: boundedString(CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES).superRefine(
-    (value, context) => {
-      let parsed;
-      try {
-        parsed = new URL(value);
-      } catch {
-        context.addIssue({
-          code: "custom",
-          message: "must be an absolute URL"
-        });
-        return;
-      }
-      if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-        context.addIssue({ code: "custom", message: "must use http or https" });
+var ConnectorAttachmentSha256 = /* @__PURE__ */ defineSchema(
+  () => z.string().regex(SHA256_PATTERN)
+);
+var ConnectorAttachmentPrivateSource = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    url: boundedString(CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES).superRefine(
+      (value, context) => {
+        let parsed;
+        try {
+          parsed = new URL(value);
+        } catch {
+          context.addIssue({
+            code: "custom",
+            message: "must be an absolute URL"
+          });
+          return;
+        }
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+          context.addIssue({ code: "custom", message: "must use http or https" });
+        }
+        if (parsed.username || parsed.password) {
+          context.addIssue({
+            code: "custom",
+            message: "must not contain URL userinfo"
+          });
+        }
+        if (parsed.hash) {
+          context.addIssue({
+            code: "custom",
+            message: "must not contain a URL fragment"
+          });
+        }
       }
-      if (parsed.username || parsed.password) {
+    ),
+    expiresAt: z.iso.datetime({ offset: true })
+  }).strict()
+);
+var ConnectorAttachmentTransfer = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    providerAttachmentId: ConnectorAttachmentProviderIdentity,
+    fileName: ConnectorAttachmentFileName,
+    mediaType: ConnectorAttachmentMediaType,
+    byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),
+    contentSha256: ConnectorAttachmentSha256,
+    source: ConnectorAttachmentPrivateSource
+  }).strict().superRefine((attachment, context) => {
+    const publicValues = [
+      attachment.providerAttachmentId.value,
+      attachment.fileName,
+      attachment.mediaType
+    ];
+    for (const credential of privateUrlCredentialValues(attachment.source.url)) {
+      if (publicValues.some((value) => publicMetadataContainsCredential(value, credential))) {
         context.addIssue({
           code: "custom",
-          message: "must not contain URL userinfo"
+          message: "private source credentials must not appear in public attachment metadata"
         });
+        return;
       }
-      if (parsed.hash) {
+    }
+  })
+);
+var ConnectorAttachmentTransferEnvelope = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    version: z.literal(CONNECTOR_ATTACHMENT_TRANSFER_VERSION),
+    attachments: z.array(ConnectorAttachmentTransfer).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT)
+  }).strict().superRefine((envelope, context) => {
+    const identities = /* @__PURE__ */ new Set();
+    for (const [index, attachment] of envelope.attachments.entries()) {
+      const identity = `${attachment.providerAttachmentId.provider}\0${attachment.providerAttachmentId.value}`;
+      if (identities.has(identity)) {
         context.addIssue({
           code: "custom",
-          message: "must not contain a URL fragment"
+          message: "provider attachment identities must be unique",
+          path: ["attachments", index, "providerAttachmentId"]
         });
       }
+      identities.add(identity);
     }
-  ),
-  expiresAt: z.iso.datetime({ offset: true })
-}).strict();
-var ConnectorAttachmentTransfer = z.object({
-  providerAttachmentId: ConnectorAttachmentProviderIdentity,
-  fileName: ConnectorAttachmentFileName,
-  mediaType: ConnectorAttachmentMediaType,
-  byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),
-  contentSha256: ConnectorAttachmentSha256,
-  source: ConnectorAttachmentPrivateSource
-}).strict().superRefine((attachment, context) => {
-  const publicValues = [
-    attachment.providerAttachmentId.value,
-    attachment.fileName,
-    attachment.mediaType
-  ];
-  for (const credential of privateUrlCredentialValues(attachment.source.url)) {
-    if (publicValues.some((value) => publicMetadataContainsCredential(value, credential))) {
-      context.addIssue({
-        code: "custom",
-        message: "private source credentials must not appear in public attachment metadata"
-      });
-      return;
-    }
-  }
-});
-var ConnectorAttachmentTransferEnvelope = z.object({
-  version: z.literal(CONNECTOR_ATTACHMENT_TRANSFER_VERSION),
-  attachments: z.array(ConnectorAttachmentTransfer).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT)
-}).strict().superRefine((envelope, context) => {
-  const identities = /* @__PURE__ */ new Set();
-  for (const [index, attachment] of envelope.attachments.entries()) {
-    const identity = `${attachment.providerAttachmentId.provider}\0${attachment.providerAttachmentId.value}`;
-    if (identities.has(identity)) {
-      context.addIssue({
-        code: "custom",
-        message: "provider attachment identities must be unique",
-        path: ["attachments", index, "providerAttachmentId"]
-      });
-    }
-    identities.add(identity);
-  }
-});
+  })
+);
 var ConnectorAttachmentSandboxPath = boundedString(
   CONNECTOR_ATTACHMENT_SANDBOX_PATH_MAX_UTF8_BYTES
 ).min(1).refine(
@@ -184,34 +198,38 @@ var ConnectorAttachmentSandboxPath = boundedString(
   },
   { message: "must be a confined connector attachment sandbox path" }
 );
-var ConnectorAttachmentReceipt = z.object({
-  providerAttachmentId: ConnectorAttachmentProviderIdentity,
-  fileName: ConnectorAttachmentFileName,
-  mediaType: ConnectorAttachmentMediaType,
-  byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),
-  contentSha256: ConnectorAttachmentSha256,
-  sandboxPath: ConnectorAttachmentSandboxPath
-}).strict().superRefine((receipt, context) => {
-  const segments = receipt.sandboxPath.split("/");
-  if (segments[2] !== receipt.providerAttachmentId.provider) {
-    context.addIssue({
-      code: "custom",
-      message: "sandbox path provider must match the provider attachment identity",
-      path: ["sandboxPath"]
-    });
-  }
-  if (segments[4] !== receipt.fileName) {
-    context.addIssue({
-      code: "custom",
-      message: "sandbox path filename must match the attachment filename",
-      path: ["sandboxPath"]
-    });
-  }
-});
-var ConnectorAttachmentReceiptEnvelope = z.object({
-  version: z.literal(CONNECTOR_ATTACHMENT_RECEIPT_VERSION),
-  attachments: z.array(ConnectorAttachmentReceipt).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT)
-}).strict();
+var ConnectorAttachmentReceipt = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    providerAttachmentId: ConnectorAttachmentProviderIdentity,
+    fileName: ConnectorAttachmentFileName,
+    mediaType: ConnectorAttachmentMediaType,
+    byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),
+    contentSha256: ConnectorAttachmentSha256,
+    sandboxPath: ConnectorAttachmentSandboxPath
+  }).strict().superRefine((receipt, context) => {
+    const segments = receipt.sandboxPath.split("/");
+    if (segments[2] !== receipt.providerAttachmentId.provider) {
+      context.addIssue({
+        code: "custom",
+        message: "sandbox path provider must match the provider attachment identity",
+        path: ["sandboxPath"]
+      });
+    }
+    if (segments[4] !== receipt.fileName) {
+      context.addIssue({
+        code: "custom",
+        message: "sandbox path filename must match the attachment filename",
+        path: ["sandboxPath"]
+      });
+    }
+  })
+);
+var ConnectorAttachmentReceiptEnvelope = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    version: z.literal(CONNECTOR_ATTACHMENT_RECEIPT_VERSION),
+    attachments: z.array(ConnectorAttachmentReceipt).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT)
+  }).strict()
+);
 function parseConnectorAttachmentTransferEnvelope(value, options = {}) {
   const envelope = ConnectorAttachmentTransferEnvelope.parse(value);
   const nowMs = options.nowMs ?? Date.now();
@@ -248,4 +266,4 @@ export {
   ConnectorAttachmentReceiptEnvelope,
   parseConnectorAttachmentTransferEnvelope
 };
-//# sourceMappingURL=chunk-YBW5JSA3.js.map
+//# sourceMappingURL=chunk-ZDCRWCGZ.js.map

package/dist/chunk-ZDCRWCGZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/connector-attachments.ts"],"sourcesContent":["import { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\nexport const CONNECTOR_ATTACHMENT_TRANSFER_VERSION = 1 as const;\nexport const CONNECTOR_ATTACHMENT_RECEIPT_VERSION = 1 as const;\nexport const CONNECTOR_ATTACHMENT_TRANSFER_META_KEY =\n  \"opengeni/connector-attachment-transfers\" as const;\nexport const CONNECTOR_ATTACHMENT_RECEIPT_META_KEY =\n  \"opengeni/connector-attachment-receipts\" as const;\nexport const CONNECTOR_ATTACHMENT_MAX_COUNT = 16;\n// Must remain byte-for-byte aligned with Channel A's exact workspace importer.\nexport const CONNECTOR_ATTACHMENT_MAX_BYTES = 5_000_000_000;\nexport const CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES = 255;\nexport const CONNECTOR_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES = 256;\nexport const CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES = 128;\nexport const CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES = 512;\nexport const CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES = 8 * 1024;\nexport const CONNECTOR_ATTACHMENT_SANDBOX_PATH_MAX_UTF8_BYTES = 2 * 1024;\n\nconst PROVIDER_PATTERN = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/u;\nconst SHA256_PATTERN = /^[0-9a-f]{64}$/u;\nconst MEDIA_TYPE_PATTERN =\n  /^[a-z0-9!#$&^_.+-]+\\/[a-z0-9!#$&^_.+-]+(?:\\s*;\\s*[a-z0-9!#$&^_.+-]+=(?:[a-z0-9!#$&^_.+-]+|\"[^\"\\r\\n]*\"))*$/iu;\nconst CONTROL_CHARACTER_PATTERN = /[\\u0000-\\u001f\\u007f]/u;\nconst HTTP_URL_REFERENCE_PATTERN = /(?:https?:)?\\/\\/[^\\s]/iu;\nconst PORTABLE_FILENAME_FORBIDDEN_PATTERN = /[<>:\"|?*]/u;\nconst PORTABLE_FILENAME_RESERVED_PATTERN = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\\.|$)/iu;\nconst textEncoder = new TextEncoder();\n\nfunction utf8Bytes(value: string): number {\n  return textEncoder.encode(value).byteLength;\n}\n\nfunction boundedString(maxUtf8Bytes: number) {\n  return z.string().refine((value) => utf8Bytes(value) <= maxUtf8Bytes, {\n    message: `must be at most ${maxUtf8Bytes} UTF-8 bytes`,\n  });\n}\n\nfunction isHttpUrl(value: string): boolean {\n  try {\n    const parsed = new URL(value);\n    return parsed.protocol === \"http:\" || parsed.protocol === \"https:\";\n  } catch {\n    return false;\n  }\n}\n\nfunction containsHttpUrlReference(value: string): boolean {\n  return HTTP_URL_REFERENCE_PATTERN.test(value);\n}\n\nfunction isPrivateUrlCredentialQueryName(value: string): boolean {\n  const normalized = value.toLowerCase().replace(/[^a-z0-9]/gu, \"\");\n  return (\n    normalized === \"sig\" ||\n    normalized === \"auth\" ||\n    normalized.endsWith(\"signature\") ||\n    normalized.endsWith(\"token\") ||\n    normalized.endsWith(\"credential\") ||\n    normalized.endsWith(\"secret\") ||\n    normalized.endsWith(\"password\") ||\n    normalized.endsWith(\"passcode\") ||\n    normalized.endsWith(\"authorization\") ||\n    normalized.endsWith(\"apikey\") ||\n    normalized.endsWith(\"accesskey\") ||\n    normalized.endsWith(\"securitytoken\") ||\n    normalized.endsWith(\"sas\") ||\n    normalized === \"googleaccessid\"\n  );\n}\n\nfunction privateUrlCredentialValues(value: string): string[] {\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    return [];\n  }\n  const credentials = new Set<string>();\n  for (const [name, credential] of parsed.searchParams) {\n    if (credential && isPrivateUrlCredentialQueryName(name)) credentials.add(credential);\n  }\n  for (const pair of parsed.search.slice(1).split(\"&\")) {\n    if (!pair) continue;\n    const separator = pair.indexOf(\"=\");\n    const rawName = separator === -1 ? pair : pair.slice(0, separator);\n    const rawCredential = separator === -1 ? \"\" : pair.slice(separator + 1);\n    let decodedName: string;\n    try {\n      decodedName = decodeURIComponent(rawName.replace(/\\+/gu, \" \"));\n    } catch {\n      continue;\n    }\n    if (rawCredential && isPrivateUrlCredentialQueryName(decodedName)) {\n      credentials.add(rawCredential);\n    }\n  }\n  return [...credentials];\n}\n\nfunction publicMetadataContainsCredential(publicValue: string, credential: string): boolean {\n  return publicValue.includes(credential);\n}\n\nexport const ConnectorAttachmentProviderIdentity = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      provider: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES).regex(PROVIDER_PATTERN),\n      kind: z.literal(\"attachment\"),\n      value: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES)\n        .min(1)\n        .refine((value) => !CONTROL_CHARACTER_PATTERN.test(value), {\n          message: \"must not contain control characters\",\n        })\n        .refine((value) => !isHttpUrl(value) && !containsHttpUrlReference(value), {\n          message: \"must be an opaque provider attachment identity, not a URL\",\n        }),\n    })\n    .strict(),\n);\nexport type ConnectorAttachmentProviderIdentity = z.infer<\n  typeof ConnectorAttachmentProviderIdentity\n>;\n\nexport const ConnectorAttachmentFileName = boundedString(\n  CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES,\n)\n  .min(1)\n  .refine(\n    (value) =>\n      value !== \".\" &&\n      value !== \"..\" &&\n      value === value.trim() &&\n      !value.includes(\"/\") &&\n      !value.includes(\"\\\\\") &&\n      !CONTROL_CHARACTER_PATTERN.test(value) &&\n      !PORTABLE_FILENAME_FORBIDDEN_PATTERN.test(value) &&\n      !/[ .]$/u.test(value) &&\n      !PORTABLE_FILENAME_RESERVED_PATTERN.test(value),\n    { message: \"must be a safe leaf filename\" },\n  );\n\nexport const ConnectorAttachmentMediaType = boundedString(\n  CONNECTOR_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES,\n)\n  .regex(MEDIA_TYPE_PATTERN)\n  .refine((value) => !containsHttpUrlReference(value), {\n    message: \"must not contain an HTTP URL reference\",\n  });\n\nexport const ConnectorAttachmentSha256 = /* @__PURE__ */ defineSchema(() =>\n  z.string().regex(SHA256_PATTERN),\n);\n\nexport const ConnectorAttachmentPrivateSource = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      url: boundedString(CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES).superRefine(\n        (value, context) => {\n          let parsed: URL;\n          try {\n            parsed = new URL(value);\n          } catch {\n            context.addIssue({\n              code: \"custom\",\n              message: \"must be an absolute URL\",\n            });\n            return;\n          }\n          if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n            context.addIssue({ code: \"custom\", message: \"must use http or https\" });\n          }\n          if (parsed.username || parsed.password) {\n            context.addIssue({\n              code: \"custom\",\n              message: \"must not contain URL userinfo\",\n            });\n          }\n          if (parsed.hash) {\n            context.addIssue({\n              code: \"custom\",\n              message: \"must not contain a URL fragment\",\n            });\n          }\n        },\n      ),\n      expiresAt: z.iso.datetime({ offset: true }),\n    })\n    .strict(),\n);\nexport type ConnectorAttachmentPrivateSource = z.infer<typeof ConnectorAttachmentPrivateSource>;\n\nexport const ConnectorAttachmentTransfer = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      providerAttachmentId: ConnectorAttachmentProviderIdentity,\n      fileName: ConnectorAttachmentFileName,\n      mediaType: ConnectorAttachmentMediaType,\n      byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),\n      contentSha256: ConnectorAttachmentSha256,\n      source: ConnectorAttachmentPrivateSource,\n    })\n    .strict()\n    .superRefine((attachment, context) => {\n      const publicValues = [\n        attachment.providerAttachmentId.value,\n        attachment.fileName,\n        attachment.mediaType,\n      ];\n      for (const credential of privateUrlCredentialValues(attachment.source.url)) {\n        if (publicValues.some((value) => publicMetadataContainsCredential(value, credential))) {\n          context.addIssue({\n            code: \"custom\",\n            message: \"private source credentials must not appear in public attachment metadata\",\n          });\n          return;\n        }\n      }\n    }),\n);\nexport type ConnectorAttachmentTransfer = z.infer<typeof ConnectorAttachmentTransfer>;\n\nexport const ConnectorAttachmentTransferEnvelope = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      version: z.literal(CONNECTOR_ATTACHMENT_TRANSFER_VERSION),\n      attachments: z.array(ConnectorAttachmentTransfer).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT),\n    })\n    .strict()\n    .superRefine((envelope, context) => {\n      const identities = new Set<string>();\n      for (const [index, attachment] of envelope.attachments.entries()) {\n        const identity = `${attachment.providerAttachmentId.provider}\\0${attachment.providerAttachmentId.value}`;\n        if (identities.has(identity)) {\n          context.addIssue({\n            code: \"custom\",\n            message: \"provider attachment identities must be unique\",\n            path: [\"attachments\", index, \"providerAttachmentId\"],\n          });\n        }\n        identities.add(identity);\n      }\n    }),\n);\nexport type ConnectorAttachmentTransferEnvelope = z.infer<\n  typeof ConnectorAttachmentTransferEnvelope\n>;\n\nexport const ConnectorAttachmentSandboxPath = boundedString(\n  CONNECTOR_ATTACHMENT_SANDBOX_PATH_MAX_UTF8_BYTES,\n)\n  .min(1)\n  .refine(\n    (value) => {\n      if (\n        value !== value.trim() ||\n        value.startsWith(\"/\") ||\n        /^[A-Za-z]:[\\\\/]/u.test(value) ||\n        value.includes(\"\\\\\") ||\n        CONTROL_CHARACTER_PATTERN.test(value)\n      ) {\n        return false;\n      }\n      const segments = value.split(\"/\");\n      if (\n        segments.length !== 5 ||\n        segments[0] !== \".opengeni\" ||\n        segments[1] !== \"connector-attachments\" ||\n        !PROVIDER_PATTERN.test(segments[2] ?? \"\") ||\n        !/^[0-9a-f]{32}$/u.test(segments[3] ?? \"\") ||\n        !ConnectorAttachmentFileName.safeParse(segments[4]).success\n      ) {\n        return false;\n      }\n      return segments.every(\n        (segment) =>\n          segment.length > 0 &&\n          segment !== \".\" &&\n          segment !== \"..\" &&\n          !PORTABLE_FILENAME_FORBIDDEN_PATTERN.test(segment) &&\n          !/[ .]$/u.test(segment) &&\n          !PORTABLE_FILENAME_RESERVED_PATTERN.test(segment),\n      );\n    },\n    { message: \"must be a confined connector attachment sandbox path\" },\n  );\n\nexport const ConnectorAttachmentReceipt = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      providerAttachmentId: ConnectorAttachmentProviderIdentity,\n      fileName: ConnectorAttachmentFileName,\n      mediaType: ConnectorAttachmentMediaType,\n      byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),\n      contentSha256: ConnectorAttachmentSha256,\n      sandboxPath: ConnectorAttachmentSandboxPath,\n    })\n    .strict()\n    .superRefine((receipt, context) => {\n      const segments = receipt.sandboxPath.split(\"/\");\n      if (segments[2] !== receipt.providerAttachmentId.provider) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"sandbox path provider must match the provider attachment identity\",\n          path: [\"sandboxPath\"],\n        });\n      }\n      if (segments[4] !== receipt.fileName) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"sandbox path filename must match the attachment filename\",\n          path: [\"sandboxPath\"],\n        });\n      }\n    }),\n);\nexport type ConnectorAttachmentReceipt = z.infer<typeof ConnectorAttachmentReceipt>;\n\nexport const ConnectorAttachmentReceiptEnvelope = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      version: z.literal(CONNECTOR_ATTACHMENT_RECEIPT_VERSION),\n      attachments: z.array(ConnectorAttachmentReceipt).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT),\n    })\n    .strict(),\n);\nexport type ConnectorAttachmentReceiptEnvelope = z.infer<typeof ConnectorAttachmentReceiptEnvelope>;\n\nexport function parseConnectorAttachmentTransferEnvelope(\n  value: unknown,\n  options: { nowMs?: number } = {},\n): ConnectorAttachmentTransferEnvelope {\n  const envelope = ConnectorAttachmentTransferEnvelope.parse(value);\n  const nowMs = options.nowMs ?? Date.now();\n  for (const attachment of envelope.attachments) {\n    if (Date.parse(attachment.source.expiresAt) <= nowMs) {\n      throw new Error(\"connector attachment source is expired\");\n    }\n  }\n  return envelope;\n}\n"],"mappings":";;;;;AACA,SAAS,SAAS;AAEX,IAAM,wCAAwC;AAC9C,IAAM,uCAAuC;AAC7C,IAAM,yCACX;AACK,IAAM,wCACX;AACK,IAAM,iCAAiC;AAEvC,IAAM,iCAAiC;AACvC,IAAM,+CAA+C;AACrD,IAAM,iDAAiD;AACvD,IAAM,+CAA+C;AACrD,IAAM,kDAAkD;AACxD,IAAM,iDAAiD,IAAI;AAC3D,IAAM,mDAAmD,IAAI;AAEpE,IAAM,mBAAmB;AACzB,IAAM,iBAAiB;AACvB,IAAM,qBACJ;AACF,IAAM,4BAA4B;AAClC,IAAM,6BAA6B;AACnC,IAAM,sCAAsC;AAC5C,IAAM,qCAAqC;AAC3C,IAAM,cAAc,IAAI,YAAY;AAEpC,SAAS,UAAU,OAAuB;AACxC,SAAO,YAAY,OAAO,KAAK,EAAE;AACnC;AAEA,SAAS,cAAc,cAAsB;AAC3C,SAAO,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,UAAU,KAAK,KAAK,cAAc;AAAA,IACpE,SAAS,mBAAmB,YAAY;AAAA,EAC1C,CAAC;AACH;AAEA,SAAS,UAAU,OAAwB;AACzC,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,KAAK;AAC5B,WAAO,OAAO,aAAa,WAAW,OAAO,aAAa;AAAA,EAC5D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,yBAAyB,OAAwB;AACxD,SAAO,2BAA2B,KAAK,KAAK;AAC9C;AAEA,SAAS,gCAAgC,OAAwB;AAC/D,QAAM,aAAa,MAAM,YAAY,EAAE,QAAQ,eAAe,EAAE;AAChE,SACE,eAAe,SACf,eAAe,UACf,WAAW,SAAS,WAAW,KAC/B,WAAW,SAAS,OAAO,KAC3B,WAAW,SAAS,YAAY,KAChC,WAAW,SAAS,QAAQ,KAC5B,WAAW,SAAS,UAAU,KAC9B,WAAW,SAAS,UAAU,KAC9B,WAAW,SAAS,eAAe,KACnC,WAAW,SAAS,QAAQ,KAC5B,WAAW,SAAS,WAAW,KAC/B,WAAW,SAAS,eAAe,KACnC,WAAW,SAAS,KAAK,KACzB,eAAe;AAEnB;AAEA,SAAS,2BAA2B,OAAyB;AAC3D,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,CAAC,MAAM,UAAU,KAAK,OAAO,cAAc;AACpD,QAAI,cAAc,gCAAgC,IAAI,EAAG,aAAY,IAAI,UAAU;AAAA,EACrF;AACA,aAAW,QAAQ,OAAO,OAAO,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG;AACpD,QAAI,CAAC,KAAM;AACX,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,UAAM,UAAU,cAAc,KAAK,OAAO,KAAK,MAAM,GAAG,SAAS;AACjE,UAAM,gBAAgB,cAAc,KAAK,KAAK,KAAK,MAAM,YAAY,CAAC;AACtE,QAAI;AACJ,QAAI;AACF,oBAAc,mBAAmB,QAAQ,QAAQ,QAAQ,GAAG,CAAC;AAAA,IAC/D,QAAQ;AACN;AAAA,IACF;AACA,QAAI,iBAAiB,gCAAgC,WAAW,GAAG;AACjE,kBAAY,IAAI,aAAa;AAAA,IAC/B;AAAA,EACF;AACA,SAAO,CAAC,GAAG,WAAW;AACxB;AAEA,SAAS,iCAAiC,aAAqB,YAA6B;AAC1F,SAAO,YAAY,SAAS,UAAU;AACxC;AAEO,IAAM,sCAAsD;AAAA,EAAa,MAC9E,EACG,OAAO;AAAA,IACN,UAAU,cAAc,4CAA4C,EAAE,MAAM,gBAAgB;AAAA,IAC5F,MAAM,EAAE,QAAQ,YAAY;AAAA,IAC5B,OAAO,cAAc,+CAA+C,EACjE,IAAI,CAAC,EACL,OAAO,CAAC,UAAU,CAAC,0BAA0B,KAAK,KAAK,GAAG;AAAA,MACzD,SAAS;AAAA,IACX,CAAC,EACA,OAAO,CAAC,UAAU,CAAC,UAAU,KAAK,KAAK,CAAC,yBAAyB,KAAK,GAAG;AAAA,MACxE,SAAS;AAAA,IACX,CAAC;AAAA,EACL,CAAC,EACA,OAAO;AACZ;AAKO,IAAM,8BAA8B;AAAA,EACzC;AACF,EACG,IAAI,CAAC,EACL;AAAA,EACC,CAAC,UACC,UAAU,OACV,UAAU,QACV,UAAU,MAAM,KAAK,KACrB,CAAC,MAAM,SAAS,GAAG,KACnB,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,0BAA0B,KAAK,KAAK,KACrC,CAAC,oCAAoC,KAAK,KAAK,KAC/C,CAAC,SAAS,KAAK,KAAK,KACpB,CAAC,mCAAmC,KAAK,KAAK;AAAA,EAChD,EAAE,SAAS,+BAA+B;AAC5C;AAEK,IAAM,+BAA+B;AAAA,EAC1C;AACF,EACG,MAAM,kBAAkB,EACxB,OAAO,CAAC,UAAU,CAAC,yBAAyB,KAAK,GAAG;AAAA,EACnD,SAAS;AACX,CAAC;AAEI,IAAM,4BAA4C;AAAA,EAAa,MACpE,EAAE,OAAO,EAAE,MAAM,cAAc;AACjC;AAEO,IAAM,mCAAmD;AAAA,EAAa,MAC3E,EACG,OAAO;AAAA,IACN,KAAK,cAAc,8CAA8C,EAAE;AAAA,MACjE,CAAC,OAAO,YAAY;AAClB,YAAI;AACJ,YAAI;AACF,mBAAS,IAAI,IAAI,KAAK;AAAA,QACxB,QAAQ;AACN,kBAAQ,SAAS;AAAA,YACf,MAAM;AAAA,YACN,SAAS;AAAA,UACX,CAAC;AACD;AAAA,QACF;AACA,YAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,kBAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yBAAyB,CAAC;AAAA,QACxE;AACA,YAAI,OAAO,YAAY,OAAO,UAAU;AACtC,kBAAQ,SAAS;AAAA,YACf,MAAM;AAAA,YACN,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AACA,YAAI,OAAO,MAAM;AACf,kBAAQ,SAAS;AAAA,YACf,MAAM;AAAA,YACN,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,IACA,WAAW,EAAE,IAAI,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC5C,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,8BAA8C;AAAA,EAAa,MACtE,EACG,OAAO;AAAA,IACN,sBAAsB;AAAA,IACtB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,8BAA8B;AAAA,IACpE,eAAe;AAAA,IACf,QAAQ;AAAA,EACV,CAAC,EACA,OAAO,EACP,YAAY,CAAC,YAAY,YAAY;AACpC,UAAM,eAAe;AAAA,MACnB,WAAW,qBAAqB;AAAA,MAChC,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AACA,eAAW,cAAc,2BAA2B,WAAW,OAAO,GAAG,GAAG;AAC1E,UAAI,aAAa,KAAK,CAAC,UAAU,iCAAiC,OAAO,UAAU,CAAC,GAAG;AACrF,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,QACX,CAAC;AACD;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACL;AAGO,IAAM,sCAAsD;AAAA,EAAa,MAC9E,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,qCAAqC;AAAA,IACxD,aAAa,EAAE,MAAM,2BAA2B,EAAE,IAAI,CAAC,EAAE,IAAI,8BAA8B;AAAA,EAC7F,CAAC,EACA,OAAO,EACP,YAAY,CAAC,UAAU,YAAY;AAClC,UAAM,aAAa,oBAAI,IAAY;AACnC,eAAW,CAAC,OAAO,UAAU,KAAK,SAAS,YAAY,QAAQ,GAAG;AAChE,YAAM,WAAW,GAAG,WAAW,qBAAqB,QAAQ,KAAK,WAAW,qBAAqB,KAAK;AACtG,UAAI,WAAW,IAAI,QAAQ,GAAG;AAC5B,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM,CAAC,eAAe,OAAO,sBAAsB;AAAA,QACrD,CAAC;AAAA,MACH;AACA,iBAAW,IAAI,QAAQ;AAAA,IACzB;AAAA,EACF,CAAC;AACL;AAKO,IAAM,iCAAiC;AAAA,EAC5C;AACF,EACG,IAAI,CAAC,EACL;AAAA,EACC,CAAC,UAAU;AACT,QACE,UAAU,MAAM,KAAK,KACrB,MAAM,WAAW,GAAG,KACpB,mBAAmB,KAAK,KAAK,KAC7B,MAAM,SAAS,IAAI,KACnB,0BAA0B,KAAK,KAAK,GACpC;AACA,aAAO;AAAA,IACT;AACA,UAAM,WAAW,MAAM,MAAM,GAAG;AAChC,QACE,SAAS,WAAW,KACpB,SAAS,CAAC,MAAM,eAChB,SAAS,CAAC,MAAM,2BAChB,CAAC,iBAAiB,KAAK,SAAS,CAAC,KAAK,EAAE,KACxC,CAAC,kBAAkB,KAAK,SAAS,CAAC,KAAK,EAAE,KACzC,CAAC,4BAA4B,UAAU,SAAS,CAAC,CAAC,EAAE,SACpD;AACA,aAAO;AAAA,IACT;AACA,WAAO,SAAS;AAAA,MACd,CAAC,YACC,QAAQ,SAAS,KACjB,YAAY,OACZ,YAAY,QACZ,CAAC,oCAAoC,KAAK,OAAO,KACjD,CAAC,SAAS,KAAK,OAAO,KACtB,CAAC,mCAAmC,KAAK,OAAO;AAAA,IACpD;AAAA,EACF;AAAA,EACA,EAAE,SAAS,uDAAuD;AACpE;AAEK,IAAM,6BAA6C;AAAA,EAAa,MACrE,EACG,OAAO;AAAA,IACN,sBAAsB;AAAA,IACtB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,8BAA8B;AAAA,IACpE,eAAe;AAAA,IACf,aAAa;AAAA,EACf,CAAC,EACA,OAAO,EACP,YAAY,CAAC,SAAS,YAAY;AACjC,UAAM,WAAW,QAAQ,YAAY,MAAM,GAAG;AAC9C,QAAI,SAAS,CAAC,MAAM,QAAQ,qBAAqB,UAAU;AACzD,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM,CAAC,aAAa;AAAA,MACtB,CAAC;AAAA,IACH;AACA,QAAI,SAAS,CAAC,MAAM,QAAQ,UAAU;AACpC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM,CAAC,aAAa;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACL;AAGO,IAAM,qCAAqD;AAAA,EAAa,MAC7E,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,oCAAoC;AAAA,IACvD,aAAa,EAAE,MAAM,0BAA0B,EAAE,IAAI,CAAC,EAAE,IAAI,8BAA8B;AAAA,EAC5F,CAAC,EACA,OAAO;AACZ;AAGO,SAAS,yCACd,OACA,UAA8B,CAAC,GACM;AACrC,QAAM,WAAW,oCAAoC,MAAM,KAAK;AAChE,QAAM,QAAQ,QAAQ,SAAS,KAAK,IAAI;AACxC,aAAW,cAAc,SAAS,aAAa;AAC7C,QAAI,KAAK,MAAM,WAAW,OAAO,SAAS,KAAK,OAAO;AACpD,YAAM,IAAI,MAAM,wCAAwC;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/claude-provider-account-authority.d.ts

@@ -0,0 +1,18 @@
+import type { z } from "zod";
+/** Same opaque pool selection shape; Claude's live authority is revalidated separately. */
+export declare const ClaudeProviderAccountAuthoritySnapshotV1: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    scope: z.ZodLiteral<"organization">;
+}, z.core.$strict>, z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    scope: z.ZodLiteral<"workspace">;
+}, z.core.$strict>, z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    scope: z.ZodLiteral<"user">;
+    authorityGeneration: z.ZodNumber;
+}, z.core.$strict>], "scope">;
+export type ClaudeProviderAccountAuthoritySnapshotV1 = z.infer<typeof ClaudeProviderAccountAuthoritySnapshotV1>;
+export declare const WORKSPACE_CLAUDE_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1: {
+    readonly version: 1;
+    readonly scope: "workspace";
+};

package/dist/claude-subscription-oauth.d.ts

@@ -0,0 +1,42 @@
+import { z } from "zod";
+export declare const ClaudeSubscriptionSetupTokenRequest: z.ZodObject<{
+    token: z.ZodString;
+    scope: z.ZodDefault<z.ZodEnum<{
+        user: "user";
+        workspace: "workspace";
+    }>>;
+    label: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    reconnectAccountId: z.ZodOptional<z.ZodString>;
+    expectedCredentialVersion: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type ClaudeSubscriptionSetupTokenRequest = z.infer<typeof ClaudeSubscriptionSetupTokenRequest>;
+export declare const ClaudeSubscriptionOAuthStartRequest: z.ZodObject<{
+    scope: z.ZodDefault<z.ZodEnum<{
+        user: "user";
+        workspace: "workspace";
+    }>>;
+    reconnectAccountId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type ClaudeSubscriptionOAuthStartRequest = z.infer<typeof ClaudeSubscriptionOAuthStartRequest>;
+export declare const ClaudeSubscriptionOAuthStartResponse: z.ZodObject<{
+    attemptId: z.ZodString;
+    authorizationUrl: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strict>;
+export type ClaudeSubscriptionOAuthStartResponse = z.infer<typeof ClaudeSubscriptionOAuthStartResponse>;
+export declare const ClaudeSubscriptionOAuthCompleteRequest: z.ZodObject<{
+    attemptId: z.ZodString;
+    code: z.ZodString;
+}, z.core.$strict>;
+export type ClaudeSubscriptionOAuthCompleteRequest = z.infer<typeof ClaudeSubscriptionOAuthCompleteRequest>;
+export declare const ClaudeSubscriptionOAuthCompleteResponse: z.ZodObject<{
+    connected: z.ZodLiteral<true>;
+    accountId: z.ZodString;
+    scope: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    credentialVersion: z.ZodNumber;
+}, z.core.$strict>;
+export type ClaudeSubscriptionOAuthCompleteResponse = z.infer<typeof ClaudeSubscriptionOAuthCompleteResponse>;

package/dist/claude-subscription-usage.d.ts

@@ -0,0 +1,159 @@
+import { z } from "zod";
+export declare const ClaudeUsageWindowId: z.ZodEnum<{
+    five_hour: "five_hour";
+    overage: "overage";
+    seven_day: "seven_day";
+    seven_day_opus: "seven_day_opus";
+    seven_day_overage_included: "seven_day_overage_included";
+    seven_day_sonnet: "seven_day_sonnet";
+}>;
+export declare const ClaudeUsageWindow: z.ZodObject<{
+    id: z.ZodEnum<{
+        five_hour: "five_hour";
+        overage: "overage";
+        seven_day: "seven_day";
+        seven_day_opus: "seven_day_opus";
+        seven_day_overage_included: "seven_day_overage_included";
+        seven_day_sonnet: "seven_day_sonnet";
+    }>;
+    usedPercent: z.ZodNullable<z.ZodNumber>;
+    resetsAt: z.ZodNullable<z.ZodString>;
+    status: z.ZodNullable<z.ZodEnum<{
+        allowed: "allowed";
+        allowed_warning: "allowed_warning";
+        rejected: "rejected";
+    }>>;
+    observedAt: z.ZodString;
+    source: z.ZodOptional<z.ZodEnum<{
+        provider: "provider";
+        response_headers: "response_headers";
+    }>>;
+}, z.core.$strict>;
+export type ClaudeUsageWindow = z.infer<typeof ClaudeUsageWindow>;
+/** One response's dispatch authority; never combine statuses from different responses. */
+export declare const ClaudeUsageRequestStatus: z.ZodObject<{
+    status: z.ZodNullable<z.ZodEnum<{
+        allowed: "allowed";
+        allowed_warning: "allowed_warning";
+        rejected: "rejected";
+    }>>;
+    resetsAt: z.ZodNullable<z.ZodString>;
+    representativeClaim: z.ZodNullable<z.ZodEnum<{
+        five_hour: "five_hour";
+        overage: "overage";
+        seven_day: "seven_day";
+        seven_day_opus: "seven_day_opus";
+        seven_day_overage_included: "seven_day_overage_included";
+        seven_day_sonnet: "seven_day_sonnet";
+    }>>;
+    overageStatus: z.ZodNullable<z.ZodEnum<{
+        allowed: "allowed";
+        allowed_warning: "allowed_warning";
+        rejected: "rejected";
+    }>>;
+    overageResetsAt: z.ZodNullable<z.ZodString>;
+    upstreamModelId: z.ZodNullable<z.ZodString>;
+    observedAt: z.ZodString;
+    source: z.ZodOptional<z.ZodEnum<{
+        provider: "provider";
+        response_headers: "response_headers";
+    }>>;
+}, z.core.$strict>;
+export type ClaudeUsageRequestStatus = z.infer<typeof ClaudeUsageRequestStatus>;
+/** Provider observations, never an estimate based on Opengeni token counts. */
+export declare const ClaudeSubscriptionUsage: z.ZodObject<{
+    connected: z.ZodBoolean;
+    credentialVersion: z.ZodNullable<z.ZodNumber>;
+    windows: z.ZodArray<z.ZodObject<{
+        id: z.ZodEnum<{
+            five_hour: "five_hour";
+            overage: "overage";
+            seven_day: "seven_day";
+            seven_day_opus: "seven_day_opus";
+            seven_day_overage_included: "seven_day_overage_included";
+            seven_day_sonnet: "seven_day_sonnet";
+        }>;
+        usedPercent: z.ZodNullable<z.ZodNumber>;
+        resetsAt: z.ZodNullable<z.ZodString>;
+        status: z.ZodNullable<z.ZodEnum<{
+            allowed: "allowed";
+            allowed_warning: "allowed_warning";
+            rejected: "rejected";
+        }>>;
+        observedAt: z.ZodString;
+        source: z.ZodOptional<z.ZodEnum<{
+            provider: "provider";
+            response_headers: "response_headers";
+        }>>;
+    }, z.core.$strict>>;
+    observedAt: z.ZodNullable<z.ZodString>;
+    source: z.ZodNullable<z.ZodEnum<{
+        provider: "provider";
+        response_headers: "response_headers";
+    }>>;
+    refreshStatus: z.ZodEnum<{
+        available: "available";
+        not_checked: "not_checked";
+        reconnect: "reconnect";
+        scope_required: "scope_required";
+        unavailable: "unavailable";
+    }>;
+    refreshCheckedAt: z.ZodNullable<z.ZodString>;
+    requestStatus: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        status: z.ZodNullable<z.ZodEnum<{
+            allowed: "allowed";
+            allowed_warning: "allowed_warning";
+            rejected: "rejected";
+        }>>;
+        resetsAt: z.ZodNullable<z.ZodString>;
+        representativeClaim: z.ZodNullable<z.ZodEnum<{
+            five_hour: "five_hour";
+            overage: "overage";
+            seven_day: "seven_day";
+            seven_day_opus: "seven_day_opus";
+            seven_day_overage_included: "seven_day_overage_included";
+            seven_day_sonnet: "seven_day_sonnet";
+        }>>;
+        overageStatus: z.ZodNullable<z.ZodEnum<{
+            allowed: "allowed";
+            allowed_warning: "allowed_warning";
+            rejected: "rejected";
+        }>>;
+        overageResetsAt: z.ZodNullable<z.ZodString>;
+        upstreamModelId: z.ZodNullable<z.ZodString>;
+        observedAt: z.ZodString;
+        source: z.ZodOptional<z.ZodEnum<{
+            provider: "provider";
+            response_headers: "response_headers";
+        }>>;
+    }, z.core.$strict>>>;
+    requestRestrictions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        status: z.ZodNullable<z.ZodEnum<{
+            allowed: "allowed";
+            allowed_warning: "allowed_warning";
+            rejected: "rejected";
+        }>>;
+        resetsAt: z.ZodNullable<z.ZodString>;
+        representativeClaim: z.ZodNullable<z.ZodEnum<{
+            five_hour: "five_hour";
+            overage: "overage";
+            seven_day: "seven_day";
+            seven_day_opus: "seven_day_opus";
+            seven_day_overage_included: "seven_day_overage_included";
+            seven_day_sonnet: "seven_day_sonnet";
+        }>>;
+        overageStatus: z.ZodNullable<z.ZodEnum<{
+            allowed: "allowed";
+            allowed_warning: "allowed_warning";
+            rejected: "rejected";
+        }>>;
+        overageResetsAt: z.ZodNullable<z.ZodString>;
+        upstreamModelId: z.ZodNullable<z.ZodString>;
+        observedAt: z.ZodString;
+        source: z.ZodOptional<z.ZodEnum<{
+            provider: "provider";
+            response_headers: "response_headers";
+        }>>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type ClaudeSubscriptionUsage = z.infer<typeof ClaudeSubscriptionUsage>;