@adcp/sdk 14.0.0-rc.37 → 14.0.0-rc.39

package/dist/lib/server/notification-subscriptions/types.d.ts

@@ -208,6 +208,16 @@ export type NotificationDeliveryAuthorizer = (input: Readonly<NotificationDelive
 } | {
     authorized: false;
 }>;
+/**
+ * One resolved delivery target. Together with the event's `emissionId` these
+ * three fields are exactly the inputs to the per-subscriber delivery identity,
+ * so pinning them pins the idempotency key the subscriber sees.
+ */
+export interface NotificationRecipientRef {
+    scope: NotificationSubscriptionScope;
+    subscriberId: string;
+    destinationGeneration: string;
+}
 export interface NotificationEvent {
     /** Application-stable identity for this delivery event; reuse on crash retry, rotate on re-emission. */
     emissionId: string;
@@ -221,7 +231,69 @@ export interface NotificationEvent {
     /** Required for account-anchored events. */
     accountId?: string;
     payload: Record<string, unknown>;
+    /**
+     * Durably freezes the recipient set before any external send.
+     *
+     * The runtime resolves its candidates, hands them to this callback, and then
+     * delivers to exactly the intersection of those candidates and what the
+     * callback returns. An emitter that persists the first resolved set and
+     * replays it verbatim therefore keeps every `delivery_id` — and so every
+     * subscriber-visible idempotency key — stable across an ambiguous retry: a
+     * subscription replaced or revoked after the first send is skipped rather
+     * than addressed under a new destination generation, so a replay can never
+     * add a second logical delivery of the same notification.
+     *
+     * Called at most once per `emit`, before the first attempt. It is a
+     * durability barrier owned by the emitting subsystem, not an adopter policy
+     * hook, so it is deliberately not bounded by `adopterCallbackTimeoutMs`: the
+     * runtime cannot safely abandon a write that may still commit. Implementations
+     * must enforce their own transaction-level deadline. Throwing aborts the
+     * emission before anything is sent.
+     */
+    freezeRecipients?: (candidates: readonly NotificationRecipientRef[]) => MaybePromise<readonly NotificationRecipientRef[]>;
 }
+/** Durable record that one recipient is about to receive an external POST. */
+export interface NotificationDeliveryAttemptCheckpointInput {
+    scope: Readonly<NotificationSubscriptionScope>;
+    eventAnchor: NotificationEventAnchor;
+    accountId?: string;
+    subscriberId: string;
+    destinationGeneration: string;
+    eventType: string;
+    notificationId: string;
+    signal: AbortSignal;
+}
+/**
+ * Durably records that a delivery is about to be attempted, awaited on the
+ * allow path of live delivery authority immediately before every external POST.
+ *
+ * It is keyed on the durable attempt context rather than on a per-emission
+ * closure precisely so that recovered outbox attempts participate: an emission
+ * snapshot cannot carry a function, so a per-emission barrier would be silently
+ * skipped by the very path — a restarted outbox worker — where an ambiguous send
+ * is most likely.
+ *
+ * This is what makes a frozen recipient set safely revisable. Suppression fails
+ * closed before this point, so a recipient with no checkpoint provably never
+ * received a POST and may be replaced; a recipient with one is pinned forever,
+ * because a crash after it is an ambiguous send. Rejecting suppresses that
+ * delivery as retryable with no external attempt.
+ */
+export type NotificationDeliveryAttemptCheckpoint = (input: Readonly<NotificationDeliveryAttemptCheckpointInput>) => MaybePromise<void>;
+/**
+ * Whether a live-authority suppression is a deliberate decision not to deliver
+ * or an operational failure that says nothing about the subscriber.
+ *
+ * `terminal` — the subscriber must not receive this event: it is gone, inactive,
+ * not subscribed to the type, or the adopter denied it. Settle the emission.
+ *
+ * `retryable` — the runtime could not establish authority: a store read failed,
+ * an authorization or credential callback threw or timed out, or the
+ * subscription generation moved while the emission was in flight. Nothing was
+ * sent (`attempts: 0`), so the owner must release and retry rather than record
+ * the notification as delivered.
+ */
+export type NotificationSuppressionDisposition = 'terminal' | 'retryable';
 export interface NotificationSubscriptionView {
     subscriber_id: string;
     url: string;
@@ -264,8 +336,14 @@ export type NotificationFanoutDelivery = NotificationFanoutDeliveryBase & ({
     failure?: never;
 } | {
     result?: never;
+    /**
+     * `delivery_binding_retired` is terminal: the delivery identity is
+     * retired or past its retry horizon and can never succeed. Anything
+     * else is an operational failure worth retrying.
+     */
     failure: {
-        reason: 'delivery_runtime_error';
+        reason: 'delivery_runtime_error' | 'delivery_binding_retired';
+        terminal?: boolean;
     };
 });
 export interface NotificationFanoutResult {
@@ -279,6 +357,14 @@ export interface PersistentNotificationRuntimeOptions {
     proofAdapter: NotificationProofAdapter;
     credentialAdapter?: NotificationCredentialBindingAdapter;
     authorizeDelivery: NotificationDeliveryAuthorizer;
+    /**
+     * Durable pre-POST checkpoint. Required by any emission owner that freezes a
+     * recipient set and needs to know whether a recipient was ever addressed;
+     * `PersistentNotificationRuntime.hasDeliveryAttemptCheckpoint` reports whether
+     * it is wired so such an owner can fail closed at startup instead of silently
+     * losing the guarantee.
+     */
+    checkpointDeliveryAttempt?: NotificationDeliveryAttemptCheckpoint;
     /** Defaults to DNS resolution plus the SDK's strict webhook SSRF policy. */
     validateDestination?: NotificationDestinationValidator;
     /** Build the emitter with the supplied mandatory per-attempt authorizer. */
@@ -317,6 +403,23 @@ export interface PersistentNotificationRuntime {
     readonly store: NotificationSubscriptionStore;
     readonly emitter: RecoverableWebhookEmitter;
     readonly authorizeWebhookAttempt: WebhookAttemptAuthorizer;
+    /**
+     * True when a durable pre-POST attempt checkpoint is wired.
+     *
+     * Optional so a custom implementation written against an earlier release
+     * still satisfies this interface structurally. An emission owner that needs
+     * the checkpoint treats an absent flag as "not proven" and fails closed.
+     */
+    readonly hasDeliveryAttemptCheckpoint?: boolean;
+    /**
+     * The checkpoint this runtime actually invokes, exposed so an emission owner
+     * can verify by identity that its own checkpoint is the one that runs.
+     * Declaring the capability is not the same as wiring the right function:
+     * two correctly-built checkpoints pointing at different stores each look
+     * valid in isolation, and the mismatch only shows up as deliveries that
+     * checkpoint nothing.
+     */
+    readonly deliveryAttemptCheckpoint?: NotificationDeliveryAttemptCheckpoint;
     replace(scope: Readonly<NotificationSubscriptionScope>, configs: readonly NotificationSubscriptionConfigInput[], options?: {
         expectedGeneration?: string;
         dryRun?: boolean;

package/dist/lib/server/webhook-emitter.d.mts

@@ -146,11 +146,26 @@ export type WebhookAuthentication = {
     secret: string;
 } | null;
 export interface WebhookRetryOptions {
-    /** Max delivery attempts (≥1). Default 5. */
+    /**
+     * Max delivery attempts (≥1). Default 5.
+     *
+     * A finite value floors to a whole attempt and clamps up to 1. A non-finite
+     * value falls back to the default, because an attempt bound has nothing to
+     * saturate to the way a delay does: `NaN` would make the delivery loop run
+     * zero attempts and re-queue itself forever without ever posting, and
+     * `Infinity` would leave it unbounded.
+     */
     maxAttempts?: number;
-    /** Initial backoff in ms. Default 1000. */
+    /**
+     * Initial backoff in ms. Default 1000.
+     *
+     * Normalized to a whole millisecond from 0 through 604800000 (seven days),
+     * the range every durable recovery backend accepts for a retry-after. A
+     * fractional value floors, a value above the ceiling saturates to it, and
+     * `Infinity` saturates rather than collapsing to an immediate retry.
+     */
     initialDelayMs?: number;
-    /** Cap per-attempt backoff. Default 60000. */
+    /** Cap per-attempt backoff. Default 60000. Normalized like `initialDelayMs`. */
     maxDelayMs?: number;
     /** Jitter factor ∈ [0,1]: 0 = none, 0.5 = ±50%. Default 0.25. */
     jitter?: number;
@@ -304,8 +319,16 @@ export interface WebhookEmitAttempt {
     url: string;
     /** Durable non-secret context supplied by the emission owner. */
     attemptAuthorizationContext?: Record<string, unknown>;
+    /**
+     * True when this attempt replays a durable outbox snapshot rather than a live
+     * emission. A recovered attempt is pinned to the snapshot it was taken from,
+     * so authority that has since moved on can never become valid for it.
+     */
+    recovered?: boolean;
 }
-export type WebhookAttemptSuppressionReason = 'authorization_denied' | 'authorization_error' | 'subscription_missing' | 'subscription_inactive' | 'subscription_stale' | 'event_not_allowed' | 'credential_unavailable';
+export type WebhookAttemptSuppressionReason = 
+/** A durable pre-POST attempt checkpoint could not be written. */
+'attempt_checkpoint_unavailable' | 'authorization_denied' | 'authorization_error' | 'subscription_missing' | 'subscription_inactive' | 'subscription_stale' | 'event_not_allowed' | 'credential_unavailable';
 export type WebhookAttemptAuthorizationDecision = {
     decision: 'allow';
     /** Optional just-in-time override; `null` explicitly selects RFC 9421. */
@@ -313,6 +336,13 @@ export type WebhookAttemptAuthorizationDecision = {
 } | {
     decision: 'suppress';
     reason: WebhookAttemptSuppressionReason;
+    /**
+     * True when authority could not be established rather than deliberately
+     * withheld. The delivery stays pending for the outbox worker instead of
+     * being terminalized, so a transient store, authorization or credential
+     * failure does not destroy the only durable record of the send.
+     */
+    retryable?: boolean;
 };
 export type WebhookAttemptAuthorizer = (info: Readonly<WebhookEmitAttempt>) => Promise<WebhookAttemptAuthorizationDecision> | WebhookAttemptAuthorizationDecision;
 export interface WebhookEmitAttemptResult extends WebhookEmitAttempt {
@@ -332,9 +362,14 @@ export interface WebhookEmitResult {
     final_status?: number;
     /** Sanitized per-attempt failure classifications; nested provider/backend messages are never copied here. */
     errors: string[];
-    /** Present when live delivery authority failed closed before an external attempt. */
+    /**
+     * Present when live delivery authority failed closed before an external
+     * attempt. `retryable` marks authority that could not be established, which
+     * leaves the delivery pending for the outbox worker.
+     */
     suppression?: {
         reason: WebhookAttemptSuppressionReason;
+        retryable?: boolean;
     };
 }
 export interface WebhookEmitter {

package/dist/lib/server/webhook-emitter.d.ts

@@ -146,11 +146,26 @@ export type WebhookAuthentication = {
     secret: string;
 } | null;
 export interface WebhookRetryOptions {
-    /** Max delivery attempts (≥1). Default 5. */
+    /**
+     * Max delivery attempts (≥1). Default 5.
+     *
+     * A finite value floors to a whole attempt and clamps up to 1. A non-finite
+     * value falls back to the default, because an attempt bound has nothing to
+     * saturate to the way a delay does: `NaN` would make the delivery loop run
+     * zero attempts and re-queue itself forever without ever posting, and
+     * `Infinity` would leave it unbounded.
+     */
     maxAttempts?: number;
-    /** Initial backoff in ms. Default 1000. */
+    /**
+     * Initial backoff in ms. Default 1000.
+     *
+     * Normalized to a whole millisecond from 0 through 604800000 (seven days),
+     * the range every durable recovery backend accepts for a retry-after. A
+     * fractional value floors, a value above the ceiling saturates to it, and
+     * `Infinity` saturates rather than collapsing to an immediate retry.
+     */
     initialDelayMs?: number;
-    /** Cap per-attempt backoff. Default 60000. */
+    /** Cap per-attempt backoff. Default 60000. Normalized like `initialDelayMs`. */
     maxDelayMs?: number;
     /** Jitter factor ∈ [0,1]: 0 = none, 0.5 = ±50%. Default 0.25. */
     jitter?: number;
@@ -304,8 +319,16 @@ export interface WebhookEmitAttempt {
     url: string;
     /** Durable non-secret context supplied by the emission owner. */
     attemptAuthorizationContext?: Record<string, unknown>;
+    /**
+     * True when this attempt replays a durable outbox snapshot rather than a live
+     * emission. A recovered attempt is pinned to the snapshot it was taken from,
+     * so authority that has since moved on can never become valid for it.
+     */
+    recovered?: boolean;
 }
-export type WebhookAttemptSuppressionReason = 'authorization_denied' | 'authorization_error' | 'subscription_missing' | 'subscription_inactive' | 'subscription_stale' | 'event_not_allowed' | 'credential_unavailable';
+export type WebhookAttemptSuppressionReason = 
+/** A durable pre-POST attempt checkpoint could not be written. */
+'attempt_checkpoint_unavailable' | 'authorization_denied' | 'authorization_error' | 'subscription_missing' | 'subscription_inactive' | 'subscription_stale' | 'event_not_allowed' | 'credential_unavailable';
 export type WebhookAttemptAuthorizationDecision = {
     decision: 'allow';
     /** Optional just-in-time override; `null` explicitly selects RFC 9421. */
@@ -313,6 +336,13 @@ export type WebhookAttemptAuthorizationDecision = {
 } | {
     decision: 'suppress';
     reason: WebhookAttemptSuppressionReason;
+    /**
+     * True when authority could not be established rather than deliberately
+     * withheld. The delivery stays pending for the outbox worker instead of
+     * being terminalized, so a transient store, authorization or credential
+     * failure does not destroy the only durable record of the send.
+     */
+    retryable?: boolean;
 };
 export type WebhookAttemptAuthorizer = (info: Readonly<WebhookEmitAttempt>) => Promise<WebhookAttemptAuthorizationDecision> | WebhookAttemptAuthorizationDecision;
 export interface WebhookEmitAttemptResult extends WebhookEmitAttempt {
@@ -332,9 +362,14 @@ export interface WebhookEmitResult {
     final_status?: number;
     /** Sanitized per-attempt failure classifications; nested provider/backend messages are never copied here. */
     errors: string[];
-    /** Present when live delivery authority failed closed before an external attempt. */
+    /**
+     * Present when live delivery authority failed closed before an external
+     * attempt. `retryable` marks authority that could not be established, which
+     * leaves the delivery pending for the outbox worker.
+     */
     suppression?: {
         reason: WebhookAttemptSuppressionReason;
+        retryable?: boolean;
     };
 }
 export interface WebhookEmitter {

package/dist/lib/server/webhook-emitter.js

@@ -190,7 +190,8 @@ function createWebhookEmitter(options) {
             idempotency_key,
             attempt,
             url,
-            ...attemptAuthorizationContext === void 0 ? {} : { attemptAuthorizationContext: structuredClone(attemptAuthorizationContext) }
+            ...attemptAuthorizationContext === void 0 ? {} : { attemptAuthorizationContext: structuredClone(attemptAuthorizationContext) },
+            ...recoveredClaim ? { recovered: true } : {}
           };
           let attemptAuthentication = authentication;
           if (options.authorizeAttempt) {
@@ -202,15 +203,17 @@ function createWebhookEmitter(options) {
               authorization = { decision: "suppress", reason: "authorization_error" };
             }
             if (authorization.decision === "suppress") {
+              const retryableSuppression = authorization.retryable === true;
               await recoveryHeartbeat?.stop();
               const heartbeatError2 = recoveryHeartbeat?.lossMessage();
               if (heartbeatError2) errors.push(heartbeatError2);
               if (!recoveredClaim) {
                 if (recoveryClaim) {
-                  if (!heartbeatError2 && !await recoveryClaim.settle("terminal")) {
+                  const settled = retryableSuppression ? await recoveryClaim.release(backoffDelay(attempt, retries)) : await recoveryClaim.settle("terminal");
+                  if (!heartbeatError2 && !settled) {
                     errors.push("suppressed delivery could not settle its recovery lease");
                   }
-                } else {
+                } else if (!retryableSuppression) {
                   await options.deliveryRecovery?.settle(deliveryKey, "terminal");
                 }
               }
@@ -219,9 +222,9 @@ function createWebhookEmitter(options) {
                 idempotency_key,
                 attempts,
                 delivered: false,
-                terminal: true,
+                terminal: !retryableSuppression,
                 errors,
-                suppression: { reason: authorization.reason }
+                suppression: { reason: authorization.reason, ...retryableSuppression ? { retryable: true } : {} }
               };
             }
             if ("authentication" in authorization) {
@@ -331,6 +334,7 @@ function assertAttemptAuthorizationDecision(value) {
     return;
   }
   if (decision.decision !== "suppress" || ![
+    "attempt_checkpoint_unavailable",
     "authorization_denied",
     "authorization_error",
     "subscription_missing",
@@ -580,16 +584,23 @@ function isTerminalStatus(status, wwwAuthenticate) {
 }
 function backoffDelay(attempt, retries) {
   const base = Math.min(retries.initialDelayMs * Math.pow(2, attempt - 1), retries.maxDelayMs);
-  if (retries.jitter <= 0) return base;
-  const jitterWindow = base * retries.jitter;
-  const offset = Math.random() * jitterWindow * 2 - jitterWindow;
-  return Math.max(0, Math.floor(base + offset));
+  const jittered = retries.jitter <= 0 ? base : base + (Math.random() * base * retries.jitter * 2 - base * retries.jitter);
+  return clampRetryAfterMs(jittered);
 }
+function clampRetryAfterMs(value) {
+  if (Number.isNaN(value)) return 0;
+  if (value === Number.POSITIVE_INFINITY) return MAX_RETRY_AFTER_MS;
+  if (value === Number.NEGATIVE_INFINITY) return 0;
+  return Math.min(MAX_RETRY_AFTER_MS, Math.max(0, Math.floor(value)));
+}
+const MAX_RETRY_AFTER_MS = 6048e5;
+const DEFAULT_MAX_ATTEMPTS = 5;
 function resolveRetries(opts) {
+  const configuredMaxAttempts = opts?.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
   return {
-    maxAttempts: Math.max(1, opts?.maxAttempts ?? 5),
-    initialDelayMs: Math.max(0, opts?.initialDelayMs ?? 1e3),
-    maxDelayMs: Math.max(0, opts?.maxDelayMs ?? 6e4),
+    maxAttempts: Number.isFinite(configuredMaxAttempts) ? Math.max(1, Math.floor(configuredMaxAttempts)) : DEFAULT_MAX_ATTEMPTS,
+    initialDelayMs: clampRetryAfterMs(opts?.initialDelayMs ?? 1e3),
+    maxDelayMs: clampRetryAfterMs(opts?.maxDelayMs ?? 6e4),
     jitter: Math.max(0, Math.min(1, opts?.jitter ?? 0.25))
   };
 }

package/dist/lib/server/webhook-emitter.mjs

@@ -171,7 +171,8 @@ function createWebhookEmitter(options) {
             idempotency_key,
             attempt,
             url,
-            ...attemptAuthorizationContext === void 0 ? {} : { attemptAuthorizationContext: structuredClone(attemptAuthorizationContext) }
+            ...attemptAuthorizationContext === void 0 ? {} : { attemptAuthorizationContext: structuredClone(attemptAuthorizationContext) },
+            ...recoveredClaim ? { recovered: true } : {}
           };
           let attemptAuthentication = authentication;
           if (options.authorizeAttempt) {
@@ -183,15 +184,17 @@ function createWebhookEmitter(options) {
               authorization = { decision: "suppress", reason: "authorization_error" };
             }
             if (authorization.decision === "suppress") {
+              const retryableSuppression = authorization.retryable === true;
               await recoveryHeartbeat?.stop();
               const heartbeatError2 = recoveryHeartbeat?.lossMessage();
               if (heartbeatError2) errors.push(heartbeatError2);
               if (!recoveredClaim) {
                 if (recoveryClaim) {
-                  if (!heartbeatError2 && !await recoveryClaim.settle("terminal")) {
+                  const settled = retryableSuppression ? await recoveryClaim.release(backoffDelay(attempt, retries)) : await recoveryClaim.settle("terminal");
+                  if (!heartbeatError2 && !settled) {
                     errors.push("suppressed delivery could not settle its recovery lease");
                   }
-                } else {
+                } else if (!retryableSuppression) {
                   await options.deliveryRecovery?.settle(deliveryKey, "terminal");
                 }
               }
@@ -200,9 +203,9 @@ function createWebhookEmitter(options) {
                 idempotency_key,
                 attempts,
                 delivered: false,
-                terminal: true,
+                terminal: !retryableSuppression,
                 errors,
-                suppression: { reason: authorization.reason }
+                suppression: { reason: authorization.reason, ...retryableSuppression ? { retryable: true } : {} }
               };
             }
             if ("authentication" in authorization) {
@@ -312,6 +315,7 @@ function assertAttemptAuthorizationDecision(value) {
     return;
   }
   if (decision.decision !== "suppress" || ![
+    "attempt_checkpoint_unavailable",
     "authorization_denied",
     "authorization_error",
     "subscription_missing",
@@ -561,16 +565,23 @@ function isTerminalStatus(status, wwwAuthenticate) {
 }
 function backoffDelay(attempt, retries) {
   const base = Math.min(retries.initialDelayMs * Math.pow(2, attempt - 1), retries.maxDelayMs);
-  if (retries.jitter <= 0) return base;
-  const jitterWindow = base * retries.jitter;
-  const offset = Math.random() * jitterWindow * 2 - jitterWindow;
-  return Math.max(0, Math.floor(base + offset));
+  const jittered = retries.jitter <= 0 ? base : base + (Math.random() * base * retries.jitter * 2 - base * retries.jitter);
+  return clampRetryAfterMs(jittered);
 }
+function clampRetryAfterMs(value) {
+  if (Number.isNaN(value)) return 0;
+  if (value === Number.POSITIVE_INFINITY) return MAX_RETRY_AFTER_MS;
+  if (value === Number.NEGATIVE_INFINITY) return 0;
+  return Math.min(MAX_RETRY_AFTER_MS, Math.max(0, Math.floor(value)));
+}
+const MAX_RETRY_AFTER_MS = 6048e5;
+const DEFAULT_MAX_ATTEMPTS = 5;
 function resolveRetries(opts) {
+  const configuredMaxAttempts = opts?.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
   return {
-    maxAttempts: Math.max(1, opts?.maxAttempts ?? 5),
-    initialDelayMs: Math.max(0, opts?.initialDelayMs ?? 1e3),
-    maxDelayMs: Math.max(0, opts?.maxDelayMs ?? 6e4),
+    maxAttempts: Number.isFinite(configuredMaxAttempts) ? Math.max(1, Math.floor(configuredMaxAttempts)) : DEFAULT_MAX_ATTEMPTS,
+    initialDelayMs: clampRetryAfterMs(opts?.initialDelayMs ?? 1e3),
+    maxDelayMs: clampRetryAfterMs(opts?.maxDelayMs ?? 6e4),
     jitter: Math.max(0, Math.min(1, opts?.jitter ?? 0.25))
   };
 }

package/dist/lib/storage/interfaces.d.mts

@@ -157,6 +157,12 @@ export interface DeferredTaskState {
     settlementOperationId?: string;
     /** New-format records whose operation index must fence every state transition. */
     settlementOperationRouteRequired?: true;
+    /** Operation-routed direct pause that does not require compatibility-coordinator settlement. */
+    directContinuationRecovery?: true;
+    /** SHA-256 digest of the separate SDK-minted recovery capability. */
+    directContinuationRecoveryKeyDigest?: string;
+    /** SHA-256 digest binding authenticated principal/account scope to trusted seller ID and origin. */
+    directContinuationOwnerBindingDigest?: string;
     /** Require the owning durable coordinator to authorize this token before sending seller continuation input. */
     settlementResumeAuthorizationRequired?: boolean;
     /** Seller work handle bound by the durable mutation owner before the pause. */
@@ -184,7 +190,12 @@ export interface DeferredTaskState {
     /** Epoch milliseconds after which this token must not be resumed. */
     expiresAt: number;
 }
-/** Durable deferred-task storage must generation-fence claim and cleanup. */
+/**
+ * Durable deferred-task storage must generation-fence claim and cleanup.
+ * Implementations MUST round-trip every `DeferredTaskState` field opaquely;
+ * dropping an unknown route-kind or ownership field can strand an in-flight
+ * mutation during a rolling SDK deployment.
+ */
 export interface DeferredTaskStorage extends Storage<DeferredTaskState> {
     /** Atomically create a value only when the key is absent or expired. */
     putIfAbsent(key: string, value: DeferredTaskState, ttl?: number): Promise<boolean>;
@@ -206,7 +217,8 @@ export interface DeferredTaskStorage extends Storage<DeferredTaskState> {
     /**
      * Atomically replace the exact routed generation. With a distinct
      * replacement key this installs a nested generation and moves the route,
-     * retaining the predecessor as a dispatch fence. With the same key it
+     * retaining the predecessor as a dispatch fence. Removing that predecessor
+     * MUST NOT remove a route that already points at the replacement. With the same key it
      * performs an in-place route-fenced state transition (for example, terminal
      * callback checkpointing).
      */

package/dist/lib/storage/interfaces.d.ts

@@ -157,6 +157,12 @@ export interface DeferredTaskState {
     settlementOperationId?: string;
     /** New-format records whose operation index must fence every state transition. */
     settlementOperationRouteRequired?: true;
+    /** Operation-routed direct pause that does not require compatibility-coordinator settlement. */
+    directContinuationRecovery?: true;
+    /** SHA-256 digest of the separate SDK-minted recovery capability. */
+    directContinuationRecoveryKeyDigest?: string;
+    /** SHA-256 digest binding authenticated principal/account scope to trusted seller ID and origin. */
+    directContinuationOwnerBindingDigest?: string;
     /** Require the owning durable coordinator to authorize this token before sending seller continuation input. */
     settlementResumeAuthorizationRequired?: boolean;
     /** Seller work handle bound by the durable mutation owner before the pause. */
@@ -184,7 +190,12 @@ export interface DeferredTaskState {
     /** Epoch milliseconds after which this token must not be resumed. */
     expiresAt: number;
 }
-/** Durable deferred-task storage must generation-fence claim and cleanup. */
+/**
+ * Durable deferred-task storage must generation-fence claim and cleanup.
+ * Implementations MUST round-trip every `DeferredTaskState` field opaquely;
+ * dropping an unknown route-kind or ownership field can strand an in-flight
+ * mutation during a rolling SDK deployment.
+ */
 export interface DeferredTaskStorage extends Storage<DeferredTaskState> {
     /** Atomically create a value only when the key is absent or expired. */
     putIfAbsent(key: string, value: DeferredTaskState, ttl?: number): Promise<boolean>;
@@ -206,7 +217,8 @@ export interface DeferredTaskStorage extends Storage<DeferredTaskState> {
     /**
      * Atomically replace the exact routed generation. With a distinct
      * replacement key this installs a nested generation and moves the route,
-     * retaining the predecessor as a dispatch fence. With the same key it
+     * retaining the predecessor as a dispatch fence. Removing that predecessor
+     * MUST NOT remove a route that already points at the replacement. With the same key it
      * performs an in-place route-fenced state transition (for example, terminal
      * callback checkpointing).
      */

package/dist/lib/testing/compliance/comply.d.mts

@@ -79,6 +79,15 @@ export interface ComplyOptions extends TestOptions {
      * through to `runStoryboard`; default false.
      */
     allowLiveSideEffects?: StoryboardRunOptions['allowLiveSideEffects'];
+    /**
+     * Request-signing grader knobs for the `signed_requests` storyboard's
+     * synthesized vector steps (transport, skip lists, rate-abuse opt-out).
+     * Passed through to `runStoryboard`. See
+     * `StoryboardRunOptions.request_signing`; the CLI surfaces the same knobs
+     * as `--signing-transport` / `--signing-skip-vectors` /
+     * `--signing-skip-rate-abuse`.
+     */
+    request_signing?: StoryboardRunOptions['request_signing'];
     /** Explicit compliance cache version override. */
     version?: string;
     /** Explicit compliance cache directory override. */
@@ -171,7 +180,4 @@ export declare function computeOverallStatus(summary: ComplianceSummary): Overal
  * Format compliance results for terminal display.
  */
 export declare function formatComplianceResults(result: ComplianceResult): string;
-/**
- * Format compliance results as JSON.
- */
 export declare function formatComplianceResultsJSON(result: ComplianceResult): string;

package/dist/lib/testing/compliance/comply.d.ts

@@ -79,6 +79,15 @@ export interface ComplyOptions extends TestOptions {
      * through to `runStoryboard`; default false.
      */
     allowLiveSideEffects?: StoryboardRunOptions['allowLiveSideEffects'];
+    /**
+     * Request-signing grader knobs for the `signed_requests` storyboard's
+     * synthesized vector steps (transport, skip lists, rate-abuse opt-out).
+     * Passed through to `runStoryboard`. See
+     * `StoryboardRunOptions.request_signing`; the CLI surfaces the same knobs
+     * as `--signing-transport` / `--signing-skip-vectors` /
+     * `--signing-skip-rate-abuse`.
+     */
+    request_signing?: StoryboardRunOptions['request_signing'];
     /** Explicit compliance cache version override. */
     version?: string;
     /** Explicit compliance cache directory override. */
@@ -171,7 +180,4 @@ export declare function computeOverallStatus(summary: ComplianceSummary): Overal
  * Format compliance results for terminal display.
  */
 export declare function formatComplianceResults(result: ComplianceResult): string;
-/**
- * Format compliance results as JSON.
- */
 export declare function formatComplianceResultsJSON(result: ComplianceResult): string;