qurl-python 0.3.0__tar.gz → 0.4.0__tar.gz

{qurl_python-0.3.0 → qurl_python-0.4.0}/.github/workflows/claude-code-review.yml

@@ -161,7 +161,7 @@ jobs:
         # step, so the verify step never runs and the PR gets a bare
         # `cancelled` check with no comment and nothing saying why.
         timeout-minutes: 10
-        uses: anthropics/claude-code-action@e5ad3c7725bc2459721893f88879fef9dbcf97b0 # v1.0.202
+        uses: anthropics/claude-code-action@12dd8d74c712f5f3669365b2369b558c495b1104 # v1.0.238
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ github.token }}
@@ -223,7 +223,9 @@ jobs:
           # Use only the action's GitHub MCP subprocess for reads and the final
           # comment. It receives the repository token but not the Anthropic key.
           # Local, network, delegation, and GitHub file-write tools stay denied.
-          claude_args: '--model claude-opus-5 --disallowed-tools "Bash,Read,Glob,Grep,LS,Task,Edit,Write,MultiEdit,NotebookEdit,WebFetch,WebSearch,mcp__github_file_ops__commit_files,mcp__github_file_ops__delete_files,mcp__github__create_or_update_file,mcp__github__push_files,mcp__github__delete_file" --allowed-tools "mcp__github__get_pull_request,mcp__github__get_pull_request_diff,mcp__github__get_pull_request_files,mcp__github__get_pull_request_review_comments,mcp__github__get_pull_request_reviews,mcp__github__get_pull_request_status,mcp__github__get_file_contents,mcp__github__search_code,mcp__github__get_issue,mcp__github__get_issue_comments,mcp__github__search_issues,mcp__github__search_pull_requests,mcp__github__list_issues,mcp__github__list_pull_requests,mcp__github__add_issue_comment"'
+          # Review model setting: Opus 5.5 at medium effort. Keep the model and
+          # effort identical in claude.yml; change both together.
+          claude_args: '--model claude-opus-5-5 --effort medium --disallowed-tools "Bash,Read,Glob,Grep,LS,Task,Edit,Write,MultiEdit,NotebookEdit,WebFetch,WebSearch,mcp__github_file_ops__commit_files,mcp__github_file_ops__delete_files,mcp__github__create_or_update_file,mcp__github__push_files,mcp__github__delete_file" --allowed-tools "mcp__github__get_pull_request,mcp__github__get_pull_request_diff,mcp__github__get_pull_request_files,mcp__github__get_pull_request_review_comments,mcp__github__get_pull_request_reviews,mcp__github__get_pull_request_status,mcp__github__get_file_contents,mcp__github__search_code,mcp__github__get_issue,mcp__github__get_issue_comments,mcp__github__search_issues,mcp__github__search_pull_requests,mcp__github__list_issues,mcp__github__list_pull_requests,mcp__github__add_issue_comment"'
 
       - name: Verify terminal Claude review
         if: success() && steps.claude-review.outcome == 'success'
@@ -270,7 +272,7 @@ jobs:
           # restoreConfigFromBase() fetches the base branch through it. Asserting the
           # LOCAL_ORIGIN pin survived therefore tested the action's version, not
           # Claude's behavior, and failed closed on every real PR. Still
-          # present at v1.0.210, so bumping does not fix it.
+          # present at v1.0.238, so bumping does not fix it.
           #
           # The property that pin bought still has to hold: origin may only ever
           # address THIS repository, so no credential-bearing remote can point
@@ -286,20 +288,30 @@ jobs:
           # matters on GHES. A future action version that drops the ".git" suffix,
           # adds a port, or normalizes the path differently fails CLOSED here - safe,
           # but it breaks every run until the action_origin construction below is
-          # updated. The failure prints the observed and expected destinations, so
-          # start there.
+          # updated. The failure prints the observed host and the expected
+          # destination, so start there. An origin outside the allowlists prints
+          # neither.
+          # The authority is everything up to the first "/", and userinfo is everything
+          # in it before the LAST "@". Host and userinfo are then held to allowlists,
+          # because a URL client ends the host at "#", "?" or "\" as well: without that,
+          # https://evil.example#@github.com/o/r.git parses here as host github.com
+          # while git connects to evil.example. A shape outside the allowlists (an IPv6
+          # literal host, userinfo with other punctuation, no scheme at all) makes the
+          # function fail, and the caller fails closed.
           origin_destination() {
-            local url="$1" scheme rest authority path
-            if [[ "${url}" == *://* ]]; then
-              scheme="${url%%://*}"
-              rest="${url#*://}"
-              authority="${rest%%/*}"
-              path="${rest#"${authority}"}"
-              authority="${authority##*@}"
-              printf '%s://%s%s' "${scheme}" "${authority}" "${path}"
-              return
+            local url="$1" scheme rest authority host userinfo
+            [[ "${url}" == *://* ]] || return 1
+            scheme="${url%%://*}"
+            rest="${url#*://}"
+            authority="${rest%%/*}"
+            host="${authority##*@}"
+            if [[ "${authority}" == *@* ]]; then
+              userinfo="${authority%@*}"
+              [[ "${userinfo}" =~ ^[A-Za-z0-9._~%:_-]+$ ]] || return 1
             fi
-            printf '%s' "${url}"
+            [[ "${scheme}" =~ ^[A-Za-z][A-Za-z0-9+.-]*$ &&
+               "${host}" =~ ^[A-Za-z0-9.-]+(:[0-9]+)?$ ]] || return 1
+            printf '%s://%s%s' "${scheme}" "${host}" "${rest#"${authority}"}"
           }
 
           if [[ -z "${GITHUB_SERVER_URL:-}" || -z "${GITHUB_REPOSITORY:-}" ||
@@ -332,33 +344,20 @@ jobs:
             exit 1
           fi
           for origin_candidate in "${origin_urls[0]}" "${origin_push_urls[0]}"; do
-            # Never echo origin_candidate itself - it carries the token. Only the
-            # userinfo-stripped destination is safe to print.
-            origin_dest="$(origin_destination "${origin_candidate}")"
-            # After a correct strip the authority holds no "@", so a userinfo-position
-            # credential can only survive in the PATH: that is the mis-split signal -
-            # userinfo holding an unencoded "/" leaves the "@" past the first path
-            # separator, where "${authority##*@}" never reaches it. Test the path
-            # specifically rather than the whole string, so scp-style remotes
-            # (git@host:o/r.git, no scheme, credential is a key not userinfo) still
-            # print their real destination. This only redacts userinfo-position
-            # credentials; a secret elsewhere in the URL would still print, which
-            # needs the secret to be known already. A schemeless remote
-            # (tok@host:o/r.git) also prints verbatim: that is deliberate, so
-            # scp-style remotes keep their diagnostic value, and Actions secret
-            # masking covers registered secrets.
-            safe_dest="${origin_dest}"
-            if [[ "${origin_dest}" == *://* ]]; then
-              dest_rest="${origin_dest#*://}"
-              dest_authority="${dest_rest%%/*}"
-              if [[ "${dest_rest#"${dest_authority}"}" == *@* ]]; then
-                safe_dest='<redacted: destination path retained userinfo>'
-              fi
+            # Never echo origin_candidate itself - it may carry the token.
+            if [[ "${origin_candidate}" == "${LOCAL_ORIGIN}" ]]; then
+              continue
             fi
-            if [[ "${origin_candidate}" != "${LOCAL_ORIGIN}" ]] &&
-               [[ "${origin_dest,,}" != "${action_origin,,}" ]] &&
+            if ! origin_dest="$(origin_destination "${origin_candidate}")"; then
+              echo "::error::The review origin is neither '${LOCAL_ORIGIN}' nor a recognizable URL of this repository; failing closed."
+              exit 1
+            fi
+            if [[ "${origin_dest,,}" != "${action_origin,,}" ]] &&
                [[ "${origin_dest,,}" != "${action_origin_bare,,}" ]]; then
-              echo "::error::The review origin moved off this repository; failing closed. Got '${safe_dest}', expected '${action_origin}' (with or without .git) or '${LOCAL_ORIGIN}'."
+              # Print only scheme and host: the path of a hostile URL can carry anything,
+              # including the token.
+              origin_host="${origin_dest#*://}"
+              echo "::error::The review origin moved off this repository; failing closed. Got host '${origin_dest%%://*}://${origin_host%%/*}', expected '${action_origin}' (with or without .git) or '${LOCAL_ORIGIN}'."
               exit 1
             fi
           done

{qurl_python-0.3.0 → qurl_python-0.4.0}/.github/workflows/claude.yml

@@ -328,7 +328,7 @@ jobs:
         if: success()
         # v1.0.180 keeps interactive commands on the same fail-closed runner as
         # automatic review and avoids the v1.0.140/141 issue-comment crash.
-        uses: anthropics/claude-code-action@e5ad3c7725bc2459721893f88879fef9dbcf97b0 # v1.0.202
+        uses: anthropics/claude-code-action@12dd8d74c712f5f3669365b2369b558c495b1104 # v1.0.238
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           # Omit github_token so the action uses its OIDC/GitHub App token path.
@@ -341,12 +341,13 @@ jobs:
           # Keep comment-triggered analysis on the same proven model as the
           # automatic PR review. The action's implicit default may select the
           # 1M-context variant, which this repository credential cannot start.
-          # scripts/check-claude-model-lockstep.py enforces this coupling.
+          # Nothing in this repository enforces this coupling: change the model and
+          # effort here and in claude-code-review.yml together.
           # Do not add extra allowed tools by default: the action's base GitHub
           # tools are sufficient here. The automatic review workflow uses a
           # narrow GitHub MCP allowlist because its explicit prompt needs PR
           # inspection.
-          claude_args: '--model claude-opus-5'
+          claude_args: '--model claude-opus-5-5 --effort medium'
 
       - name: Verify reviewed pull request head
         if: success() && steps.claude.outcome == 'success'
@@ -394,7 +395,7 @@ jobs:
           # restoreConfigFromBase() fetches the base branch through it. Asserting the
           # LOCAL_ORIGIN pin survived therefore tested the action's version, not
           # Claude's behavior, and failed closed on every real PR (#268). Still
-          # present at v1.0.210, so bumping does not fix it.
+          # present at v1.0.238, so bumping does not fix it.
           #
           # The property that pin bought still has to hold: origin may only ever
           # address THIS repository, so no credential-bearing remote can point
@@ -410,20 +411,30 @@ jobs:
           # matters on GHES. A future action version that drops the ".git" suffix,
           # adds a port, or normalizes the path differently fails CLOSED here - safe,
           # but it breaks every run until the action_origin construction below is
-          # updated. The failure prints the observed and expected destinations, so
-          # start there.
+          # updated. The failure prints the observed host and the expected
+          # destination, so start there. An origin outside the allowlists prints
+          # neither.
+          # The authority is everything up to the first "/", and userinfo is everything
+          # in it before the LAST "@". Host and userinfo are then held to allowlists,
+          # because a URL client ends the host at "#", "?" or "\" as well: without that,
+          # https://evil.example#@github.com/o/r.git parses here as host github.com
+          # while git connects to evil.example. A shape outside the allowlists (an IPv6
+          # literal host, userinfo with other punctuation, no scheme at all) makes the
+          # function fail, and the caller fails closed.
           origin_destination() {
-            local url="$1" scheme rest authority path
-            if [[ "${url}" == *://* ]]; then
-              scheme="${url%%://*}"
-              rest="${url#*://}"
-              authority="${rest%%/*}"
-              path="${rest#"${authority}"}"
-              authority="${authority##*@}"
-              printf '%s://%s%s' "${scheme}" "${authority}" "${path}"
-              return
+            local url="$1" scheme rest authority host userinfo
+            [[ "${url}" == *://* ]] || return 1
+            scheme="${url%%://*}"
+            rest="${url#*://}"
+            authority="${rest%%/*}"
+            host="${authority##*@}"
+            if [[ "${authority}" == *@* ]]; then
+              userinfo="${authority%@*}"
+              [[ "${userinfo}" =~ ^[A-Za-z0-9._~%:_-]+$ ]] || return 1
             fi
-            printf '%s' "${url}"
+            [[ "${scheme}" =~ ^[A-Za-z][A-Za-z0-9+.-]*$ &&
+               "${host}" =~ ^[A-Za-z0-9.-]+(:[0-9]+)?$ ]] || return 1
+            printf '%s://%s%s' "${scheme}" "${host}" "${rest#"${authority}"}"
           }
 
           if [[ -z "${GITHUB_SERVER_URL:-}" || -z "${GITHUB_REPOSITORY:-}" ||
@@ -456,33 +467,20 @@ jobs:
             exit 1
           fi
           for origin_candidate in "${origin_urls[0]}" "${origin_push_urls[0]}"; do
-            # Never echo origin_candidate itself - it carries the token. Only the
-            # userinfo-stripped destination is safe to print.
-            origin_dest="$(origin_destination "${origin_candidate}")"
-            # After a correct strip the authority holds no "@", so a userinfo-position
-            # credential can only survive in the PATH: that is the mis-split signal -
-            # userinfo holding an unencoded "/" leaves the "@" past the first path
-            # separator, where "${authority##*@}" never reaches it. Test the path
-            # specifically rather than the whole string, so scp-style remotes
-            # (git@host:o/r.git, no scheme, credential is a key not userinfo) still
-            # print their real destination. This only redacts userinfo-position
-            # credentials; a secret elsewhere in the URL would still print, which
-            # needs the secret to be known already. A schemeless remote
-            # (tok@host:o/r.git) also prints verbatim: that is deliberate, so
-            # scp-style remotes keep their diagnostic value, and Actions secret
-            # masking covers registered secrets.
-            safe_dest="${origin_dest}"
-            if [[ "${origin_dest}" == *://* ]]; then
-              dest_rest="${origin_dest#*://}"
-              dest_authority="${dest_rest%%/*}"
-              if [[ "${dest_rest#"${dest_authority}"}" == *@* ]]; then
-                safe_dest='<redacted: destination path retained userinfo>'
-              fi
+            # Never echo origin_candidate itself - it may carry the token.
+            if [[ "${origin_candidate}" == "${LOCAL_ORIGIN}" ]]; then
+              continue
             fi
-            if [[ "${origin_candidate}" != "${LOCAL_ORIGIN}" ]] &&
-               [[ "${origin_dest,,}" != "${action_origin,,}" ]] &&
+            if ! origin_dest="$(origin_destination "${origin_candidate}")"; then
+              echo "::error::The local origin is neither '${LOCAL_ORIGIN}' nor a recognizable URL of this repository; failing closed."
+              exit 1
+            fi
+            if [[ "${origin_dest,,}" != "${action_origin,,}" ]] &&
                [[ "${origin_dest,,}" != "${action_origin_bare,,}" ]]; then
-              echo "::error::The local origin moved off this repository; failing closed. Got '${safe_dest}', expected '${action_origin}' (with or without .git) or '${LOCAL_ORIGIN}'."
+              # Print only scheme and host: the path of a hostile URL can carry anything,
+              # including the token.
+              origin_host="${origin_dest#*://}"
+              echo "::error::The local origin moved off this repository; failing closed. Got host '${origin_dest%%://*}://${origin_host%%/*}', expected '${action_origin}' (with or without .git) or '${LOCAL_ORIGIN}'."
               exit 1
             fi
           done

qurl_python-0.4.0/.release-please-manifest.json

@@ -0,0 +1 @@
+{".":"0.4.0"}

{qurl_python-0.3.0 → qurl_python-0.4.0}/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [0.4.0](https://github.com/layervai/qurl-python/compare/v0.3.0...v0.4.0) (2026-10-08)
+
+
+### ⚠ BREAKING CHANGES
+
+* preserve canonical resource quotas and monthly usage ([#157](https://github.com/layervai/qurl-python/issues/157))
+
+### Bug Fixes
+
+* preserve canonical resource quotas and monthly usage ([#157](https://github.com/layervai/qurl-python/issues/157)) ([e017e78](https://github.com/layervai/qurl-python/commit/e017e7807c5012a93de387ec73a57043d1028806))
+
 ## [0.3.0](https://github.com/layervai/qurl-python/compare/v0.2.2...v0.3.0) (2026-09-08)
 
 

{qurl_python-0.3.0 → qurl_python-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: qurl-python
-Version: 0.3.0
+Version: 0.4.0
 Summary: Python SDK for the qURL™ API — secure, time-limited access links. Quantum URL is how you enter the hidden layer of the internet.
 Project-URL: Homepage, https://github.com/layervai/qurl-python
 Project-URL: Repository, https://github.com/layervai/qurl-python
@@ -332,10 +332,31 @@ All error classes inherit from `QURLError`, so `except QURLError` catches everyt
 ```python
 quota = client.get_quota()
 print(f"Plan: {quota.plan}")
-print(f"Active qURLs: {quota.usage.active_qurls}")
-print(f"Rate limit: {quota.rate_limits.create_per_minute}/min")
+usage = quota.usage
+active = usage.active_resources if usage is not None else None
+if active is None and usage is not None:
+    active = usage.active_qurls
+print("Active protected resources:", active if active is not None else "unavailable")
+if quota.rate_limits is not None:
+    print(f"Rate limit: {quota.rate_limits.create_per_minute}/min")
 ```
 
+Use `max_active_resources`, `active_resources`, and `active_resources_percent`
+for resource quotas. `max_data_transfer_bytes` is the monthly byte allowance;
+`data_transfer_bytes` is measured usage, available on both quota usage and
+current-period responses. This usage always covers the current UTC calendar
+month, independently of a paid account's billing period. Missing or null values
+remain `None`, distinct from a reported zero. The [service OpenAPI spec](https://github.com/layervai/qurl-service/blob/01d7c47361b5f72f890428f1a53bd04e8d7f67cc/api/openapi.yaml#L5796)
+defines `-1` as unlimited for `max_active_resources` and its legacy alias
+`max_active_qurls`, as well as `max_data_transfer_bytes`.
+
+**Migration:** the deprecated `max_active_qurls` and `active_qurls` fields still
+represent protected resources. Missing values now return `None` instead of
+`0`; check `is not None` before arithmetic or displaying a count. Canonical
+and legacy fields preserve their own wire values, so an older response that
+omits canonical fields leaves those fields `None`. Prefer the canonical fields
+when available.
+
 JWT-authenticated dashboard endpoints are also available for usage, customer
 settings, billing sessions, invoices, and API-key management. API-key auth
 continues to work for normal qURL, resource, domain, webhook, connector, and

{qurl_python-0.3.0 → qurl_python-0.4.0}/README.md

@@ -298,10 +298,31 @@ All error classes inherit from `QURLError`, so `except QURLError` catches everyt
 ```python
 quota = client.get_quota()
 print(f"Plan: {quota.plan}")
-print(f"Active qURLs: {quota.usage.active_qurls}")
-print(f"Rate limit: {quota.rate_limits.create_per_minute}/min")
+usage = quota.usage
+active = usage.active_resources if usage is not None else None
+if active is None and usage is not None:
+    active = usage.active_qurls
+print("Active protected resources:", active if active is not None else "unavailable")
+if quota.rate_limits is not None:
+    print(f"Rate limit: {quota.rate_limits.create_per_minute}/min")
 ```
 
+Use `max_active_resources`, `active_resources`, and `active_resources_percent`
+for resource quotas. `max_data_transfer_bytes` is the monthly byte allowance;
+`data_transfer_bytes` is measured usage, available on both quota usage and
+current-period responses. This usage always covers the current UTC calendar
+month, independently of a paid account's billing period. Missing or null values
+remain `None`, distinct from a reported zero. The [service OpenAPI spec](https://github.com/layervai/qurl-service/blob/01d7c47361b5f72f890428f1a53bd04e8d7f67cc/api/openapi.yaml#L5796)
+defines `-1` as unlimited for `max_active_resources` and its legacy alias
+`max_active_qurls`, as well as `max_data_transfer_bytes`.
+
+**Migration:** the deprecated `max_active_qurls` and `active_qurls` fields still
+represent protected resources. Missing values now return `None` instead of
+`0`; check `is not None` before arithmetic or displaying a count. Canonical
+and legacy fields preserve their own wire values, so an older response that
+omits canonical fields leaves those fields `None`. Prefer the canonical fields
+when available.
+
 JWT-authenticated dashboard endpoints are also available for usage, customer
 settings, billing sessions, invoices, and API-key management. API-key auth
 continues to work for normal qURL, resource, domain, webhook, connector, and

{qurl_python-0.3.0 → qurl_python-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "qurl-python"
-version = "0.3.0"
+version = "0.4.0"
 description = "Python SDK for the qURL™ API — secure, time-limited access links. Quantum URL is how you enter the hidden layer of the internet."
 readme = "README.md"
 license = "MIT"

{qurl_python-0.3.0 → qurl_python-0.4.0}/src/layerv_qurl/_utils.py

@@ -989,8 +989,10 @@ def _parse_rate_limits(data: dict[str, Any] | None) -> RateLimits | None:
         create_per_hour=data.get("create_per_hour", 0),
         list_per_minute=data.get("list_per_minute", 0),
         resolve_per_minute=data.get("resolve_per_minute", 0),
-        max_active_qurls=data.get("max_active_qurls", 0),
+        max_active_qurls=data.get("max_active_qurls"),
         max_expiry_seconds=data.get("max_expiry_seconds", 0),
+        max_active_resources=data.get("max_active_resources"),
+        max_data_transfer_bytes=data.get("max_data_transfer_bytes"),
     )
 
 
@@ -999,11 +1001,14 @@ def _parse_usage_block(data: dict[str, Any] | None) -> Usage | None:
         return None
     return Usage(
         qurls_created=data.get("qurls_created", 0),
-        active_qurls=data.get("active_qurls", 0),
+        active_qurls=data.get("active_qurls"),
         # Nullable per the API spec — the field is null when
         # max_active_qurls is unlimited.
         active_qurls_percent=data.get("active_qurls_percent"),
         total_accesses=data.get("total_accesses", 0),
+        active_resources=data.get("active_resources"),
+        active_resources_percent=data.get("active_resources_percent"),
+        data_transfer_bytes=data.get("data_transfer_bytes"),
     )
 
 
@@ -1289,8 +1294,10 @@ def parse_current_period_usage(data: dict[str, Any]) -> CurrentPeriodUsage:
         period_start=_parse_dt(data.get("period_start")),
         period_end=_parse_dt(data.get("period_end")),
         qurls_created=data.get("qurls_created", 0),
-        active_qurls=data.get("active_qurls", 0),
+        active_qurls=data.get("active_qurls"),
         cost_estimate=_parse_usage_cost(data.get("cost_estimate")),
+        active_resources=data.get("active_resources"),
+        data_transfer_bytes=data.get("data_transfer_bytes"),
     )
 
 

{qurl_python-0.3.0 → qurl_python-0.4.0}/src/layerv_qurl/types.py

@@ -211,14 +211,18 @@ class ListOutput:
 
 @dataclass
 class RateLimits:
-    """Rate limit configuration."""
+    """Rate limits and plan allowances."""
 
     create_per_minute: int = 0
     create_per_hour: int = 0
     list_per_minute: int = 0
     resolve_per_minute: int = 0
-    max_active_qurls: int = 0
+    # Deprecated alias for max_active_resources, not a qURL-count cap.
+    max_active_qurls: int | None = None
     max_expiry_seconds: int = 0
+    # Missing/null limits remain unknown; -1 is the unlimited sentinel.
+    max_active_resources: int | None = None
+    max_data_transfer_bytes: int | None = None
 
 
 @dataclass
@@ -226,10 +230,15 @@ class Usage:
     """Usage statistics."""
 
     qurls_created: int = 0
-    active_qurls: int = 0
+    # Deprecated alias for active_resources, not a count of qURLs.
+    active_qurls: int | None = None
     # Changed from float=0.0 — callers must None-check before arithmetic.
     active_qurls_percent: float | None = None
     total_accesses: int = 0
+    active_resources: int | None = None
+    active_resources_percent: float | None = None
+    # Measured bytes this UTC calendar month; None is distinct from zero.
+    data_transfer_bytes: int | None = None
 
 
 @dataclass
@@ -549,8 +558,12 @@ class CurrentPeriodUsage:
     period_start: datetime | None
     period_end: datetime | None
     qurls_created: int
-    active_qurls: int
+    # Deprecated alias for active_resources, not a count of qURLs.
+    active_qurls: int | None
     cost_estimate: UsageCostEstimate | None = None
+    active_resources: int | None = None
+    # Measured bytes this UTC calendar month, independent of the billing period.
+    data_transfer_bytes: int | None = None
 
 
 @dataclass

{qurl_python-0.3.0 → qurl_python-0.4.0}/tests/test_client.py

@@ -781,6 +781,8 @@ async def test_quota_typed(
     assert result.rate_limits.create_per_minute == 60
     assert result.rate_limits.max_active_qurls == 5000
     assert result.rate_limits.max_expiry_seconds == 604800
+    assert result.rate_limits.max_active_resources is None
+    assert result.rate_limits.max_data_transfer_bytes is None
 
     # Typed Usage
     assert result.usage is not None
@@ -788,6 +790,166 @@ async def test_quota_typed(
     assert result.usage.qurls_created == 10
     assert result.usage.total_accesses == 42
     assert result.usage.active_qurls_percent == 0.1
+    assert result.usage.active_resources is None
+    assert result.usage.active_resources_percent is None
+    assert result.usage.data_transfer_bytes is None
+
+
+@pytest.mark.parametrize("use_async", [False, True], ids=["sync", "async"])
+@pytest.mark.parametrize(
+    ("limits", "usage", "expected"),
+    [
+        pytest.param(
+            {"max_active_resources": 10, "max_data_transfer_bytes": 10_737_418_240},
+            {
+                "active_resources": 8,
+                "active_resources_percent": 80.0,
+                "data_transfer_bytes": 23_456_789,
+            },
+            (10, 10_737_418_240, 8, 80.0, 23_456_789),
+            id="canonical-only",
+        ),
+        pytest.param(
+            {"max_active_resources": 0, "max_data_transfer_bytes": 0},
+            {"active_resources": 0, "active_resources_percent": 0.0, "data_transfer_bytes": 0},
+            (0, 0, 0, 0.0, 0),
+            id="zero",
+        ),
+        pytest.param(
+            {"max_active_resources": -1, "max_data_transfer_bytes": -1},
+            {
+                "active_resources": 87,
+                "active_resources_percent": None,
+                "data_transfer_bytes": 9_007_199_254_740_993,
+            },
+            (-1, -1, 87, None, 9_007_199_254_740_993),
+            id="unlimited-and-large-bytes",
+        ),
+        pytest.param({}, {}, (None, None, None, None, None), id="absent-fields"),
+        pytest.param(
+            {"max_active_resources": None, "max_data_transfer_bytes": None},
+            {
+                "active_resources": None,
+                "active_resources_percent": None,
+                "data_transfer_bytes": None,
+            },
+            (None, None, None, None, None),
+            id="null-fields",
+        ),
+    ],
+)
+@respx.mock
+async def test_quota_preserves_canonical_resources_and_monthly_bytes(
+    client: QURLClient,
+    async_client: AsyncQURLClient,
+    use_async: bool,
+    limits: dict[str, Any],
+    usage: dict[str, Any],
+    expected: tuple[int | None, int | None, int | None, float | None, int | None],
+) -> None:
+    respx.get(f"{BASE_URL}/v1/quota").mock(
+        return_value=httpx.Response(
+            200,
+            json={
+                "data": {
+                    "plan": "free",
+                    "rate_limits": limits,
+                    "usage": usage,
+                }
+            },
+        )
+    )
+
+    result = await async_client.get_quota() if use_async else client.get_quota()
+    assert result.rate_limits is not None
+    assert result.usage is not None
+    assert (
+        result.rate_limits.max_active_resources,
+        result.rate_limits.max_data_transfer_bytes,
+        result.usage.active_resources,
+        result.usage.active_resources_percent,
+        result.usage.data_transfer_bytes,
+    ) == expected
+    # An omitted legacy alias must not invent a zero-resource account.
+    assert result.rate_limits.max_active_qurls is None
+    assert result.usage.active_qurls is None
+
+
+@pytest.mark.parametrize("use_async", [False, True], ids=["sync", "async"])
+@respx.mock
+async def test_quota_preserves_divergent_canonical_and_legacy_values(
+    client: QURLClient, async_client: AsyncQURLClient, use_async: bool
+) -> None:
+    respx.get(f"{BASE_URL}/v1/quota").mock(
+        return_value=httpx.Response(
+            200,
+            json={
+                "data": {
+                    "rate_limits": {"max_active_resources": 10, "max_active_qurls": 5000},
+                    "usage": {
+                        "active_resources": 8,
+                        "active_qurls": 3,
+                        "active_resources_percent": 80.0,
+                        "active_qurls_percent": 0.06,
+                    },
+                }
+            },
+        )
+    )
+
+    result = await async_client.get_quota() if use_async else client.get_quota()
+    assert result.rate_limits is not None
+    assert result.rate_limits.max_active_resources == 10
+    assert result.rate_limits.max_active_qurls == 5000
+    assert result.usage is not None
+    assert result.usage.active_resources == 8
+    assert result.usage.active_qurls == 3
+    assert result.usage.active_resources_percent == 80.0
+    assert result.usage.active_qurls_percent == 0.06
+
+
+@pytest.mark.parametrize("use_async", [False, True], ids=["sync", "async"])
+@pytest.mark.parametrize("wire_name", ["active_resources", "active_qurls"])
+@pytest.mark.parametrize(
+    ("fields", "expected_count", "expected_bytes"),
+    [
+        pytest.param({"count": 8, "data_transfer_bytes": 23_456_789}, 8, 23_456_789, id="observed"),
+        pytest.param({"count": 0, "data_transfer_bytes": 0}, 0, 0, id="zero"),
+        pytest.param(
+            {"count": 87, "data_transfer_bytes": 9_007_199_254_740_993},
+            87,
+            9_007_199_254_740_993,
+            id="large-bytes",
+        ),
+        pytest.param({}, None, None, id="absent"),
+        pytest.param({"count": None, "data_transfer_bytes": None}, None, None, id="null"),
+    ],
+)
+@respx.mock
+async def test_current_period_preserves_resource_counts_and_monthly_bytes(
+    client: QURLClient,
+    async_client: AsyncQURLClient,
+    use_async: bool,
+    wire_name: str,
+    fields: dict[str, int | None],
+    expected_count: int | None,
+    expected_bytes: int | None,
+) -> None:
+    payload = {k: v for k, v in fields.items() if k != "count"}
+    if "count" in fields:
+        payload[wire_name] = fields["count"]
+    respx.get(f"{BASE_URL}/v1/usage/current-period").mock(
+        return_value=httpx.Response(200, json={"data": payload})
+    )
+
+    result = (
+        await async_client.get_usage_current_period()
+        if use_async
+        else client.get_usage_current_period()
+    )
+    assert result.active_resources == (expected_count if wire_name == "active_resources" else None)
+    assert result.active_qurls == (expected_count if wire_name == "active_qurls" else None)
+    assert result.data_transfer_bytes == expected_bytes
 
 
 @respx.mock
@@ -809,7 +971,7 @@ def test_quota_active_qurls_percent_null(client: QURLClient) -> None:
                     "period_end": "2026-04-01T00:00:00Z",
                     "rate_limits": {
                         "create_per_minute": 1000,
-                        "max_active_qurls": 0,  # unlimited on enterprise
+                        "max_active_qurls": -1,  # unlimited on enterprise
                     },
                     "usage": {
                         "qurls_created": 500,
@@ -4605,7 +4767,7 @@ def test_account_parsers_tolerate_partial_usage_payloads(client: QURLClient) ->
     usage = client.get_usage_current_period()
     assert usage.tier == "unknown"
     assert usage.qurls_created == 0
-    assert usage.active_qurls == 0
+    assert usage.active_qurls is None
     assert usage.cost_estimate is None
 
     respx.get(f"{BASE_URL}/v1/usage/daily").mock(

qurl_python-0.3.0/.release-please-manifest.json

@@ -1 +0,0 @@
-{".":"0.3.0"}