@greatwait/contracts 0.1.0-alpha.1

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+export { ANY_ID_PATTERN, ID_ALPHABET, ID_PREFIXES, apiCredentialEventIdSchema, apiCredentialIdSchema, attemptIdSchema, authorizationRequestIdSchema, callbackSigningKeyIdSchema, deliveryIdSchema, endpointIdSchema, environmentIdSchema, eventIdSchema, idPattern, idSchema, newId, oauthClientIdSchema, oauthGrantEventIdSchema, oauthGrantIdSchema, occurrenceIdSchema, organizationIdSchema, projectIdSchema, resourceOf, scheduleIdSchema, testSinkDeliveryIdSchema, testSinkIdSchema, type ApiCredentialEventId, type ApiCredentialId, type AttemptId, type AuthorizationRequestId, type CallbackSigningKeyId, type DeliveryId, type EndpointId, type EnvironmentId, type IdResource, type OAuthClientId, type OAuthGrantEventId, type OAuthGrantId, type OccurrenceId, type OrganizationId, type RandomBytes, type ProjectId, type ScheduleId, type TestSinkDeliveryId, type TestSinkId, } from "./identifiers.js";
+export { durationSecondsSchema, timeZoneSchema, timestampSchema, toTimestamp, type DurationSeconds, type TimeZone, type Timestamp, } from "./time.js";
+export { ENVIRONMENT_KINDS_IN_ORDER, PRINCIPAL_KINDS, SCOPES, SESSION_AUTHORITY_HEADERS, authoritySchema, decideAccess, decideEnvironmentIntent, effectiveScopes, problemCodeForRefusal, environmentKindSchema, principalKindSchema, principalSchema, scopeSchema, type AccessDecision, type AccessRefusal, type AccessRequest, type Authority, type EnvironmentIntentDecision, type EnvironmentKind, type Principal, type PrincipalKind, type Scope, } from "./authority.js";
+export { PROBLEM_CATEGORIES, PROBLEM_CODES, fieldErrorSchema, isRetryable, problem, problemCategorySchema, problemCodeSchema, problemSchema, type FieldError, type Problem, type ProblemCategory, type ProblemCode, type ProblemOptions, } from "./problems.js";
+export { CONCURRENCY_HEADERS, PAGE_SIZE, canonicalRequest, classifyIdempotency, conditionalRequestHeaderSchema, decodeCursor, encodeCursor, etagSchema, freshnessSchema, projectedFreshnessSchema, fromETag, idempotencyKeySchema, idempotencyReplayResponseHeaderSchema, idempotencyRequestHeaderSchema, idempotencyReceiptSchema, idempotencyScopeSchema, pageRequestSchema, pageSchema, parsePageRequest, replayedResponseHeaderSchema, requiredIdempotencyRequestHeaderSchema, requestFingerprint, toETag, versionResponseHeaderSchema, versionSchema, type Freshness, type ProjectedFreshness, type IdempotencyKey, type IdempotencyOutcome, type IdempotencyReceipt, type IdempotencyScope, type PagePosition, type PageRequest, type PageRequestParse, type Version, } from "./protocol.js";
+export { CALLBACK_CONTENT_TYPE, CALLBACK_DELIVERY_PROTOCOL, CALLBACK_DELIVERY_PROTOCOL_VERSION, CALLBACK_ENVELOPE_VERSION, CALLBACK_ENVELOPE_VERSION_2026_07_01, CALLBACK_ENVELOPE_VERSION_2026_08_08, CALLBACK_ENVELOPE_VERSION_CHANGE, CALLBACK_ENVELOPE_VERSIONS, CALLBACK_HEADERS, SIGNATURE_SCHEME, SIGNATURE_TOLERANCE_SECONDS, callbackDeferredCompletionSchema, callbackDeliveryTestVectors, callbackEnvelopeSchema, callbackEnvelopeTrigger, callbackHeadersSchema, callbackRun, callbackTriggerSchema, classifyOutcome, classifyStatus, formatSignature, extractCanonicalEnvelopeIds, isTimestampFresh, signatureHeaderSchema, serializeCallbackEnvelope, signingInput, trySigningInput, type AttemptOutcome, type CallbackDeferredCompletion, type CallbackDeliveryTestVector, type CallbackEnvelope, type CallbackRun, type CallbackTrigger, type ResponseClass, } from "./signatures.js";
+export { CREDENTIAL_PREFIX_LENGTH, CREDENTIAL_PREFIX_PATTERN, CREDENTIAL_ROTATION_OVERLAP_SECONDS, CREDENTIAL_SECRET_LENGTH, CREDENTIAL_SECRET_PATTERN, NEVER_REDACTED, REDACTED_FIELDS_EXACT, REDACTED_FIELD_FRAGMENTS, credentialCreatedSchema, credentialMetadataSchema, credentialPageSchema, credentialRequestSchema, credentialRevokedSchema, credentialRotatedSchema, credentialRotationRequestSchema, redact, type CredentialCreated, type CredentialMetadata, type CredentialPage, type CredentialRequest, type CredentialRevokedResponse, type CredentialRotated, type CredentialRotationRequest, } from "./secrets.js";
+export { MAX_PARTITION_SHARDS, PROJECTION_DRAIN_LIMIT, SINGLE_SHARD, partitionInstanceName, partitionShardCount, partitionShardFor, partitionShardForIdempotencyKey, type CreateScheduleCommand, type CreateScheduleOutcome, type AttemptPagePosition, type DrainProjectionsOutcome, type DrainProjectionsQuery, type ForecastOutcome, type ForecastPartitionBucket, type ForecastQuery, type IdempotencyDisposition, type ListSchedulesOutcome, type ListSchedulesQuery, type ListAttemptsOutcome, type ListAttemptsQuery, type ListOccurrencesOutcome, type ListOccurrencesQuery, type OccurrencePagePosition, type PartitionOutcome, type PartitionRefusal, type PartitionRefused, type PartitionRpc, type ProjectionIntent, type ReadScheduleQuery, type ReadAttemptOutcome, type ReadAttemptQuery, type ReadOccurrenceOutcome, type ReadOccurrenceQuery, type RedeliverOccurrenceCommand, type RedeliverOccurrenceOutcome, type ReplaceScheduleCommand, type RetainedProjections, type ScheduleDefinition, type ScheduleWriteCommand, type ScheduleWriteOutcome, type SettleProjectionsCommand, type SettleProjectionsOutcome, } from "./partition.js";
+export { EVENT_TYPES, eventEnvelopeSchema, eventTypeSchema, genericEventSchema, type EventType, type GenericEvent, } from "./events.js";
+export { MEMBERSHIP_ROLES, MEMBERSHIP_STATUSES, externalMembershipIdSchema, externalOrganizationIdSchema, externalUserIdSchema, grantsAccess, leastRole, leastStatus, membershipChangeSchema, membershipRoleSchema, membershipSchema, membershipStatusSchema, organizationTombstoneSchema, sessionMembershipSchema, type ExternalMembershipId, type ExternalOrganizationId, type ExternalUserId, type Membership, type MembershipChange, type MembershipRole, type MembershipStatus, type OrganizationTombstone, type SessionMembership, } from "./identity.js";
+export { CLERK_WEBHOOK_PATH, SVIX_HEADERS, WEBHOOK_SIGNATURE_SCHEME, WEBHOOK_TOLERANCE_SECONDS, isWebhookTimestampFresh, svixHeadersSchema, svixIdSchema, svixSignatureHeaderSchema, svixTimestampSchema, tryWebhookSigningInput, webhookSignatureCandidates, webhookSigningInput, } from "./webhooks.js";
+export { CHANGE_KINDS, CHANGE_OPERATIONS, CHANGE_SUBJECTS, CONTRACT_VERSION, assess, changeKindSchema, classifyChange, contractVersionSchema, type ChangeKind, type ChangeOperation, type ChangeSubject, type CompatibilityVerdict, type ContractChange, } from "./compatibility.js";
+export { WORKSPACE_LAYERS, scaffoldProblemSchema, scaffoldVersionSchema, toolDescriptorSchema, toolListSchema, workspaceIdentitySchema, workspaceLayerSchema, workspaceScaffoldSchema, type ScaffoldProblem, type ScaffoldVersion, type ToolDescriptor, type ToolList, type WorkspaceIdentity, type WorkspaceLayer, type WorkspaceScaffold, } from "./workspace.js";
+export { MOCK_BEHAVIORS, MOCK_HEADERS, OPERATIONS, UNIVERSAL_PROBLEMS, AUTHENTICATED_PROBLEMS, findOperation, fixtureListSchema, mockBehaviorSchema, mockScenarioRequestSchema, mockScenarioResponseSchema, operationsFor, problemsFor, requestSchemaFor, responseSchemaFor, successStatusFor, type FixtureList, type McpDisposition, type MockBehavior, type MockScenarioRequest, type MockScenarioResponse, type OperationDefinition, type OperationId, type OperationSurface, } from "./operations.js";
+export { PROJECT_LIST_LIMIT, PROJECT_STATUSES, environmentSchema, organizationSchema, projectCreateRequestSchema, projectListSchema, projectNameSchema, projectSchema, projectStatusSchema, projectSummarySchema, provisionedProjectSchema, type Environment, type Organization, type Project, type ProjectCreateRequest, type ProjectList, type ProjectStatus, type ProjectSummary, type ProvisionedProject, } from "./tenancy.js";
+export { ATTEMPT_DURATION_MAX_MS, ATTEMPT_FAILURE_SNIPPET_MAX_LENGTH, ATTEMPT_REMEDIATIONS, ATTEMPT_RESPONSE_HEADER_MAX_LENGTH, ATTEMPT_STATES, CRON_EXPRESSION_MAX_LENGTH, LATENCY_CLASSES, OCCURRENCE_STATES, PARTITION_KEY_MAX_LENGTH, RECURRENCE_REQUEST_FIELDS, SCHEDULE_STATUSES, SCHEDULING_BOUNDS, TERMINAL_OCCURRENCE_STATES, attemptFailureSnippetSchema, attemptResponseHeaderSchema, attemptSchema, attemptDiagnosticSchema, attemptPageSchema, attemptRemediationSchema, attemptStateForResponse, attemptStateSchema, attemptTriggerSchema, attemptViewSchema, cronExpressionSchema, DELIVERY_COMPLETION_MODES, DELIVERY_DURATION_TIERS, DELIVERY_OVERLAP_POLICIES, DEFAULT_DELIVERY_DURATION_SECONDS, DEFAULT_DELIVERY_OVERLAP_POLICY, FREE_DELIVERY_DURATION_SECONDS, isLongRunningDuration, deliveryCompletionModeSchema, deliveryDurationSecondsSchema, deliveryOverlapPolicySchema, type DeliveryCompletionMode, type DeliveryOverlapPolicy, deriveDeliverySettings, deriveLatencyClass, generationSchema, isTerminalOccurrenceState, latencyClassSchema, occurrenceSchema, occurrencePageSchema, occurrenceStateSchema, occurrenceViewSchema, partitionKeySchema, remediationForAttempt, recurrenceSchema, schedulePageSchema, scheduleRequestSchema, scheduleSchema, scheduleStatusSchema, scheduleViewSchema, type Attempt, type AttemptFailureSnippet, type AttemptResponseHeader, type AttemptDiagnostic, type AttemptPage, type AttemptRemediation, type AttemptState, type AttemptTrigger, type AttemptView, type CronExpression, type Generation, type DeliverySettings, type LatencyClass, type Occurrence, type OccurrencePage, type OccurrenceState, type OccurrenceView, type PartitionKey, type Recurrence, type Schedule, type SchedulePage, type ScheduleRequest, type ScheduleStatus, type ScheduleView, } from "./scheduling.js";
+export { portableAttemptRecordSchema, portableEncryptedPayloadRecordSchema, portableOccurrenceRecordSchema, portableReceiptRecordSchema, portableScheduleRecordSchema, portableSchedulingRecordSetSchema, type PortableAttemptRecord, type PortableEncryptedPayloadRecord, type PortableOccurrenceRecord, type PortableReceiptRecord, type PortableScheduleRecord, type PortableSchedulingRecordSet, } from "./scheduling-records.js";
+export { ROLE_SCOPE_CEILINGS, capScopesToRole, ceilingForRole, credentialScopes, grantableScopes, policyMatrix, roleAllows, roleCanPerform, type PolicyMatrixRow, } from "./policy.js";
+export { ACCESS_TOKEN_PATTERN, ACCESS_TOKEN_TTL_SECONDS, AUTHORIZATION_CODE_PATTERN, AUTHORIZATION_CODE_TTL_SECONDS, AUTHORIZATION_REQUEST_TTL_SECONDS, MAX_REDIRECT_URIS, OAUTH_ERRORS, OAUTH_ERROR_STATUS, OAUTH_GRANT_STATUSES, OAUTH_GRANT_TYPES, OAUTH_RESPONSE_TYPES, OAUTH_REVOCATION_REASONS, OAUTH_ROUTES, OAUTH_SECRET_PATTERN, OAUTH_TOKEN_NAMESPACE_LENGTH, OAUTH_TOKEN_SECRET_LENGTH, PKCE_CHALLENGE_PATTERN, PKCE_METHODS, PKCE_VERIFIER_PATTERN, REFRESH_TOKEN_PATTERN, REFRESH_TOKEN_TTL_SECONDS, TOKEN_ENDPOINT_AUTH_METHODS, authorizationParametersSchema, authorizationServerMetadataSchema, bearerChallenge, clientRegistrationRequestSchema, clientRegistrationSchema, consentDecisionSchema, consentOutcomeSchema, consentPromptSchema, formatScopeString, isLoopbackRedirect, oauthError, oauthErrorCodeSchema, oauthErrorSchema, oauthGrantListSchema, oauthGrantRevokedSchema, oauthGrantSchema, oauthGrantStatusSchema, oauthGrantTypeSchema, oauthRevocationReasonSchema, parseScopeString, pkceMethodSchema, protectedResourceMetadataSchema, redirectUriSchema, revocationRequestSchema, tokenRequestSchema, tokenResponseSchema, type AuthorizationParameters, type AuthorizationServerMetadata, type ClientRegistration, type ClientRegistrationRequest, type ConsentDecision, type ConsentOutcome, type ConsentPrompt, type OAuthErrorBody, type OAuthErrorCode, type OAuthGrant, type OAuthGrantList, type OAuthGrantRevoked, type OAuthGrantStatus, type OAuthGrantType, type OAuthRevocationReason, type ProtectedResourceMetadata, type RevocationRequest, type TokenRequest, type TokenResponse, } from "./oauth.js";
+export { MCP_INSTRUCTIONS, MCP_ROUTES } from "./mcp.js";
+export { CALLBACK_OWNERSHIP_POLICIES, DEFAULT_CALLBACK_OWNERSHIP_POLICY, readCallbackOwnershipPolicy, sendableStatuses, type CallbackOwnershipPolicy, } from "./callback-ownership.js";
+export { CALLBACK_ENDPOINT_SECRET_PATTERN, CALLBACK_URL_REJECTION_REASONS, evaluateCallbackUrl, isPublicCallbackAddress, type CallbackUrlRejectionReason, } from "./callback-safety.js";
+export { CALLBACK_ENDPOINT_LIMIT_PER_ENVIRONMENT, CALLBACK_ENDPOINT_STATUSES, CALLBACK_SIGNING_KEY_ROTATION_OVERLAP_SECONDS, CALLBACK_VERIFICATION_FAILURES, CALLBACK_VERIFICATION_HEADERS, CALLBACK_VERIFICATION_PROTOCOL, CALLBACK_VERIFICATION_PROTOCOL_VERSION, CALLBACK_VERIFICATION_RATE_LIMITS, CALLBACK_VERIFICATION_RESPONSE_BYTES, CALLBACK_VERIFICATION_TIMEOUT_MILLISECONDS, CALLBACK_VERIFICATION_TYPE, callbackEndpointCreatedSchema, callbackEndpointPageSchema, callbackEndpointRequestSchema, callbackEndpointRotatedSchema, callbackEndpointSchema, callbackEndpointStatusSchema, callbackSigningKeyRotationRequestSchema, callbackSigningKeysSchema, callbackVerificationChallengeSchema, callbackVerificationFailureSchema, type CallbackEndpoint, type CallbackEndpointCreated, type CallbackEndpointPage, type CallbackEndpointRequest, type CallbackEndpointRotated, type CallbackEndpointStatus, type CallbackSigningKeyRotationRequest, type CallbackSigningKeys, type CallbackVerificationChallenge, type CallbackVerificationFailure, } from "./endpoints.js";
+export { FORECAST_BOUNDS, FORECAST_BREAKDOWNS, FORECAST_COMPATIBILITY, FORECAST_RULES, FORECAST_WINDOW_VERSION, decideForecastAnswer, forecastBreakdownSchema, forecastBucketSchema, forecastBucketStartMs, forecastLatencyCountsSchema, forecastRequestSchema, forecastSchema, forecastViolations, forecastWindowBucketSchema, forecastWindowViolations, forecastWindowsSchema, mergeForecastBuckets, parseForecastRequest, resolveForecastWindow, topPartitionKeys, type Forecast, type ForecastAnswerDecision, type ForecastAnswerRefusal, type ForecastBreakdown, type ForecastBucket, type ForecastMergedBucket, type ForecastShardAnswer, type ForecastLatencyCounts, type ForecastRequest, type ForecastRequestParse, type ForecastWindow, type ForecastWindowBucket, type ForecastWindowRefusal, type ForecastWindowResolution, type ForecastWindows, } from "./forecast.js";
+export { CURL_JOURNEY_TOOLS, FIRST_VALUE_JOURNEY, FIRST_VALUE_PREREQUISITES, FIRST_VALUE_STEPS, FIRST_VALUE_VARIABLES, JOURNEY_CONDITIONS, MINIMUM_CURL_VERSION, journeyCapturedVariables, journeyReferences, journeyStepSchema, journeyVariable, journeyVariableSchema, resolveJourneyReferences, type FirstValueJourney, type JourneyCapture, type JourneyCondition, type JourneyExpectation, type JourneyPoll, type JourneyPrerequisite, type JourneyRecovery, type JourneyStep, type JourneyVariable, } from "./first-value-journey.js";
+export { BILLABLE_TERMINAL_STATES, USAGE_BOUNDS, USAGE_WINDOW_REASONS, billableTerminalStateSchema, parseUsageRequest, resolveUsageWindow, usageDaySchema, usageRequestSchema, usageSchema, utcMidnightMs, type BillableTerminalStateName, type ResolvedUsageWindow, type UsageDayView, type UsageRequest, type UsageRequestParse, type UsageView, type UsageWindowRefusal, } from "./usage.js";
+export { CALLBACK_RECEIVER_DISPOSITIONS, CALLBACK_RECEIVER_PROTOCOL, CALLBACK_RECEIVER_STATUS, TEST_SINK_BEHAVIORS, TEST_SINK_BEHAVIOR_FACTS, TEST_SINK_BOUNDS, TEST_SINK_CLIENT_ERROR_STATUSES, TEST_SINK_DISPOSITIONS, TEST_SINK_PROTOCOL_VERSION, TEST_SINK_SERVER_ERROR_STATUSES, callbackReceiverAcknowledgementSchema, callbackReceiverDispositionSchema, resolveTestSinkAction, testSinkBehaviorSchema, testSinkCreateRequestSchema, testSinkDeliveryBodySchema, testSinkDispositionSchema, testSinkDeliveryPageSchema, testSinkDeliverySchema, testSinkPageSchema, testSinkProgramSchema, testSinkSchema, type CallbackReceiverAcknowledgement, type CallbackReceiverDisposition, type TestSink, type TestSinkAction, type TestSinkBehavior, type TestSinkCreateRequest, type TestSinkDelivery, type TestSinkDeliveryBody, type TestSinkDeliveryPage, type TestSinkDisposition, type TestSinkPage, type TestSinkProgram, } from "./test-sink.js";

package/dist/index.js

@@ -0,0 +1,27 @@
+export { ANY_ID_PATTERN, ID_ALPHABET, ID_PREFIXES, apiCredentialEventIdSchema, apiCredentialIdSchema, attemptIdSchema, authorizationRequestIdSchema, callbackSigningKeyIdSchema, deliveryIdSchema, endpointIdSchema, environmentIdSchema, eventIdSchema, idPattern, idSchema, newId, oauthClientIdSchema, oauthGrantEventIdSchema, oauthGrantIdSchema, occurrenceIdSchema, organizationIdSchema, projectIdSchema, resourceOf, scheduleIdSchema, testSinkDeliveryIdSchema, testSinkIdSchema, } from "./identifiers.js";
+export { durationSecondsSchema, timeZoneSchema, timestampSchema, toTimestamp, } from "./time.js";
+export { ENVIRONMENT_KINDS_IN_ORDER, PRINCIPAL_KINDS, SCOPES, SESSION_AUTHORITY_HEADERS, authoritySchema, decideAccess, decideEnvironmentIntent, effectiveScopes, problemCodeForRefusal, environmentKindSchema, principalKindSchema, principalSchema, scopeSchema, } from "./authority.js";
+export { PROBLEM_CATEGORIES, PROBLEM_CODES, fieldErrorSchema, isRetryable, problem, problemCategorySchema, problemCodeSchema, problemSchema, } from "./problems.js";
+export { CONCURRENCY_HEADERS, PAGE_SIZE, canonicalRequest, classifyIdempotency, conditionalRequestHeaderSchema, decodeCursor, encodeCursor, etagSchema, freshnessSchema, projectedFreshnessSchema, fromETag, idempotencyKeySchema, idempotencyReplayResponseHeaderSchema, idempotencyRequestHeaderSchema, idempotencyReceiptSchema, idempotencyScopeSchema, pageRequestSchema, pageSchema, parsePageRequest, replayedResponseHeaderSchema, requiredIdempotencyRequestHeaderSchema, requestFingerprint, toETag, versionResponseHeaderSchema, versionSchema, } from "./protocol.js";
+export { CALLBACK_CONTENT_TYPE, CALLBACK_DELIVERY_PROTOCOL, CALLBACK_DELIVERY_PROTOCOL_VERSION, CALLBACK_ENVELOPE_VERSION, CALLBACK_ENVELOPE_VERSION_2026_07_01, CALLBACK_ENVELOPE_VERSION_2026_08_08, CALLBACK_ENVELOPE_VERSION_CHANGE, CALLBACK_ENVELOPE_VERSIONS, CALLBACK_HEADERS, SIGNATURE_SCHEME, SIGNATURE_TOLERANCE_SECONDS, callbackDeferredCompletionSchema, callbackDeliveryTestVectors, callbackEnvelopeSchema, callbackEnvelopeTrigger, callbackHeadersSchema, callbackRun, callbackTriggerSchema, classifyOutcome, classifyStatus, formatSignature, extractCanonicalEnvelopeIds, isTimestampFresh, signatureHeaderSchema, serializeCallbackEnvelope, signingInput, trySigningInput, } from "./signatures.js";
+export { CREDENTIAL_PREFIX_LENGTH, CREDENTIAL_PREFIX_PATTERN, CREDENTIAL_ROTATION_OVERLAP_SECONDS, CREDENTIAL_SECRET_LENGTH, CREDENTIAL_SECRET_PATTERN, NEVER_REDACTED, REDACTED_FIELDS_EXACT, REDACTED_FIELD_FRAGMENTS, credentialCreatedSchema, credentialMetadataSchema, credentialPageSchema, credentialRequestSchema, credentialRevokedSchema, credentialRotatedSchema, credentialRotationRequestSchema, redact, } from "./secrets.js";
+export { MAX_PARTITION_SHARDS, PROJECTION_DRAIN_LIMIT, SINGLE_SHARD, partitionInstanceName, partitionShardCount, partitionShardFor, partitionShardForIdempotencyKey, } from "./partition.js";
+export { EVENT_TYPES, eventEnvelopeSchema, eventTypeSchema, genericEventSchema, } from "./events.js";
+export { MEMBERSHIP_ROLES, MEMBERSHIP_STATUSES, externalMembershipIdSchema, externalOrganizationIdSchema, externalUserIdSchema, grantsAccess, leastRole, leastStatus, membershipChangeSchema, membershipRoleSchema, membershipSchema, membershipStatusSchema, organizationTombstoneSchema, sessionMembershipSchema, } from "./identity.js";
+export { CLERK_WEBHOOK_PATH, SVIX_HEADERS, WEBHOOK_SIGNATURE_SCHEME, WEBHOOK_TOLERANCE_SECONDS, isWebhookTimestampFresh, svixHeadersSchema, svixIdSchema, svixSignatureHeaderSchema, svixTimestampSchema, tryWebhookSigningInput, webhookSignatureCandidates, webhookSigningInput, } from "./webhooks.js";
+export { CHANGE_KINDS, CHANGE_OPERATIONS, CHANGE_SUBJECTS, CONTRACT_VERSION, assess, changeKindSchema, classifyChange, contractVersionSchema, } from "./compatibility.js";
+export { WORKSPACE_LAYERS, scaffoldProblemSchema, scaffoldVersionSchema, toolDescriptorSchema, toolListSchema, workspaceIdentitySchema, workspaceLayerSchema, workspaceScaffoldSchema, } from "./workspace.js";
+export { MOCK_BEHAVIORS, MOCK_HEADERS, OPERATIONS, UNIVERSAL_PROBLEMS, AUTHENTICATED_PROBLEMS, findOperation, fixtureListSchema, mockBehaviorSchema, mockScenarioRequestSchema, mockScenarioResponseSchema, operationsFor, problemsFor, requestSchemaFor, responseSchemaFor, successStatusFor, } from "./operations.js";
+export { PROJECT_LIST_LIMIT, PROJECT_STATUSES, environmentSchema, organizationSchema, projectCreateRequestSchema, projectListSchema, projectNameSchema, projectSchema, projectStatusSchema, projectSummarySchema, provisionedProjectSchema, } from "./tenancy.js";
+export { ATTEMPT_DURATION_MAX_MS, ATTEMPT_FAILURE_SNIPPET_MAX_LENGTH, ATTEMPT_REMEDIATIONS, ATTEMPT_RESPONSE_HEADER_MAX_LENGTH, ATTEMPT_STATES, CRON_EXPRESSION_MAX_LENGTH, LATENCY_CLASSES, OCCURRENCE_STATES, PARTITION_KEY_MAX_LENGTH, RECURRENCE_REQUEST_FIELDS, SCHEDULE_STATUSES, SCHEDULING_BOUNDS, TERMINAL_OCCURRENCE_STATES, attemptFailureSnippetSchema, attemptResponseHeaderSchema, attemptSchema, attemptDiagnosticSchema, attemptPageSchema, attemptRemediationSchema, attemptStateForResponse, attemptStateSchema, attemptTriggerSchema, attemptViewSchema, cronExpressionSchema, DELIVERY_COMPLETION_MODES, DELIVERY_DURATION_TIERS, DELIVERY_OVERLAP_POLICIES, DEFAULT_DELIVERY_DURATION_SECONDS, DEFAULT_DELIVERY_OVERLAP_POLICY, FREE_DELIVERY_DURATION_SECONDS, isLongRunningDuration, deliveryCompletionModeSchema, deliveryDurationSecondsSchema, deliveryOverlapPolicySchema, deriveDeliverySettings, deriveLatencyClass, generationSchema, isTerminalOccurrenceState, latencyClassSchema, occurrenceSchema, occurrencePageSchema, occurrenceStateSchema, occurrenceViewSchema, partitionKeySchema, remediationForAttempt, recurrenceSchema, schedulePageSchema, scheduleRequestSchema, scheduleSchema, scheduleStatusSchema, scheduleViewSchema, } from "./scheduling.js";
+export { portableAttemptRecordSchema, portableEncryptedPayloadRecordSchema, portableOccurrenceRecordSchema, portableReceiptRecordSchema, portableScheduleRecordSchema, portableSchedulingRecordSetSchema, } from "./scheduling-records.js";
+export { ROLE_SCOPE_CEILINGS, capScopesToRole, ceilingForRole, credentialScopes, grantableScopes, policyMatrix, roleAllows, roleCanPerform, } from "./policy.js";
+export { ACCESS_TOKEN_PATTERN, ACCESS_TOKEN_TTL_SECONDS, AUTHORIZATION_CODE_PATTERN, AUTHORIZATION_CODE_TTL_SECONDS, AUTHORIZATION_REQUEST_TTL_SECONDS, MAX_REDIRECT_URIS, OAUTH_ERRORS, OAUTH_ERROR_STATUS, OAUTH_GRANT_STATUSES, OAUTH_GRANT_TYPES, OAUTH_RESPONSE_TYPES, OAUTH_REVOCATION_REASONS, OAUTH_ROUTES, OAUTH_SECRET_PATTERN, OAUTH_TOKEN_NAMESPACE_LENGTH, OAUTH_TOKEN_SECRET_LENGTH, PKCE_CHALLENGE_PATTERN, PKCE_METHODS, PKCE_VERIFIER_PATTERN, REFRESH_TOKEN_PATTERN, REFRESH_TOKEN_TTL_SECONDS, TOKEN_ENDPOINT_AUTH_METHODS, authorizationParametersSchema, authorizationServerMetadataSchema, bearerChallenge, clientRegistrationRequestSchema, clientRegistrationSchema, consentDecisionSchema, consentOutcomeSchema, consentPromptSchema, formatScopeString, isLoopbackRedirect, oauthError, oauthErrorCodeSchema, oauthErrorSchema, oauthGrantListSchema, oauthGrantRevokedSchema, oauthGrantSchema, oauthGrantStatusSchema, oauthGrantTypeSchema, oauthRevocationReasonSchema, parseScopeString, pkceMethodSchema, protectedResourceMetadataSchema, redirectUriSchema, revocationRequestSchema, tokenRequestSchema, tokenResponseSchema, } from "./oauth.js";
+export { MCP_INSTRUCTIONS, MCP_ROUTES } from "./mcp.js";
+export { CALLBACK_OWNERSHIP_POLICIES, DEFAULT_CALLBACK_OWNERSHIP_POLICY, readCallbackOwnershipPolicy, sendableStatuses, } from "./callback-ownership.js";
+export { CALLBACK_ENDPOINT_SECRET_PATTERN, CALLBACK_URL_REJECTION_REASONS, evaluateCallbackUrl, isPublicCallbackAddress, } from "./callback-safety.js";
+export { CALLBACK_ENDPOINT_LIMIT_PER_ENVIRONMENT, CALLBACK_ENDPOINT_STATUSES, CALLBACK_SIGNING_KEY_ROTATION_OVERLAP_SECONDS, CALLBACK_VERIFICATION_FAILURES, CALLBACK_VERIFICATION_HEADERS, CALLBACK_VERIFICATION_PROTOCOL, CALLBACK_VERIFICATION_PROTOCOL_VERSION, CALLBACK_VERIFICATION_RATE_LIMITS, CALLBACK_VERIFICATION_RESPONSE_BYTES, CALLBACK_VERIFICATION_TIMEOUT_MILLISECONDS, CALLBACK_VERIFICATION_TYPE, callbackEndpointCreatedSchema, callbackEndpointPageSchema, callbackEndpointRequestSchema, callbackEndpointRotatedSchema, callbackEndpointSchema, callbackEndpointStatusSchema, callbackSigningKeyRotationRequestSchema, callbackSigningKeysSchema, callbackVerificationChallengeSchema, callbackVerificationFailureSchema, } from "./endpoints.js";
+export { FORECAST_BOUNDS, FORECAST_BREAKDOWNS, FORECAST_COMPATIBILITY, FORECAST_RULES, FORECAST_WINDOW_VERSION, decideForecastAnswer, forecastBreakdownSchema, forecastBucketSchema, forecastBucketStartMs, forecastLatencyCountsSchema, forecastRequestSchema, forecastSchema, forecastViolations, forecastWindowBucketSchema, forecastWindowViolations, forecastWindowsSchema, mergeForecastBuckets, parseForecastRequest, resolveForecastWindow, topPartitionKeys, } from "./forecast.js";
+export { CURL_JOURNEY_TOOLS, FIRST_VALUE_JOURNEY, FIRST_VALUE_PREREQUISITES, FIRST_VALUE_STEPS, FIRST_VALUE_VARIABLES, JOURNEY_CONDITIONS, MINIMUM_CURL_VERSION, journeyCapturedVariables, journeyReferences, journeyStepSchema, journeyVariable, journeyVariableSchema, resolveJourneyReferences, } from "./first-value-journey.js";
+export { BILLABLE_TERMINAL_STATES, USAGE_BOUNDS, USAGE_WINDOW_REASONS, billableTerminalStateSchema, parseUsageRequest, resolveUsageWindow, usageDaySchema, usageRequestSchema, usageSchema, utcMidnightMs, } from "./usage.js";
+export { CALLBACK_RECEIVER_DISPOSITIONS, CALLBACK_RECEIVER_PROTOCOL, CALLBACK_RECEIVER_STATUS, TEST_SINK_BEHAVIORS, TEST_SINK_BEHAVIOR_FACTS, TEST_SINK_BOUNDS, TEST_SINK_CLIENT_ERROR_STATUSES, TEST_SINK_DISPOSITIONS, TEST_SINK_PROTOCOL_VERSION, TEST_SINK_SERVER_ERROR_STATUSES, callbackReceiverAcknowledgementSchema, callbackReceiverDispositionSchema, resolveTestSinkAction, testSinkBehaviorSchema, testSinkCreateRequestSchema, testSinkDeliveryBodySchema, testSinkDispositionSchema, testSinkDeliveryPageSchema, testSinkDeliverySchema, testSinkPageSchema, testSinkProgramSchema, testSinkSchema, } from "./test-sink.js";

package/dist/mcp.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Where the remote MCP surface lives, and what it tells an agent about itself.
+ *
+ * Stated once for the same reason `OAUTH_ROUTES` is: two readers must agree.
+ * The router serves these paths and the protected-resource metadata document
+ * advertises them, and a path that drifts from its advertisement is not a 404 —
+ * it is a client that cannot authenticate and cannot say why.
+ *
+ * Outside `/v1`, following the convention `CLERK_WEBHOOK_PATH` and
+ * `OAUTH_ROUTES` set. The `/v1` surface is the operation registry, every entry
+ * of which is projected into OpenAPI, the SDK, an MCP tool and the contract
+ * mock; the MCP endpoint is the transport those tools are served over, and a
+ * transport that appeared in its own tool list would be a tool an agent could
+ * point at itself.
+ */
+export declare const MCP_ROUTES: {
+    /**
+     * The single Streamable HTTP endpoint. POST only; `GET` and `DELETE` answer
+     * `405`, because this endpoint opens no standalone event stream and mints no
+     * session to terminate.
+     *
+     * Served at this path **and** at the same path with a trailing slash, without
+     * a redirect between them. A `301`/`302` on a POST is rewritten by the fetch
+     * standard into a GET with the body dropped, so a client configured with the
+     * other spelling would have its opening request silently become the GET this
+     * endpoint refuses — and read that as "no MCP server here".
+     */
+    readonly endpoint: "/mcp";
+    /**
+     * RFC 9728 metadata for the MCP endpoint specifically.
+     *
+     * Served *beside* the origin's own document rather than instead of it. RFC
+     * 9728 §3.1 places the metadata for a resource with a path component at
+     * `/.well-known/oauth-protected-resource` followed by that path, so a client
+     * that treats `https://host/mcp` as the resource it is authorizing for
+     * constructs exactly this URL — and one that follows the `resource_metadata`
+     * link out of the `401` is sent here too. Both arrive at a document naming
+     * the same authorization server.
+     */
+    readonly protectedResourceMetadata: "/.well-known/oauth-protected-resource/mcp";
+};
+/**
+ * What the server tells a model about itself, once, before any tool call.
+ *
+ * MCP calls this `instructions` and hands it to the model as context. It is
+ * kept short and factual: an agent that has read the tool descriptions knows
+ * what each one does, and what it cannot work out from them is the shape of the
+ * authority it is acting under — which is the one thing that decides whether an
+ * instruction like "create this in production" is even expressible.
+ */
+export declare const MCP_INSTRUCTIONS: string;

package/dist/mcp.js

@@ -0,0 +1,56 @@
+/**
+ * Where the remote MCP surface lives, and what it tells an agent about itself.
+ *
+ * Stated once for the same reason `OAUTH_ROUTES` is: two readers must agree.
+ * The router serves these paths and the protected-resource metadata document
+ * advertises them, and a path that drifts from its advertisement is not a 404 —
+ * it is a client that cannot authenticate and cannot say why.
+ *
+ * Outside `/v1`, following the convention `CLERK_WEBHOOK_PATH` and
+ * `OAUTH_ROUTES` set. The `/v1` surface is the operation registry, every entry
+ * of which is projected into OpenAPI, the SDK, an MCP tool and the contract
+ * mock; the MCP endpoint is the transport those tools are served over, and a
+ * transport that appeared in its own tool list would be a tool an agent could
+ * point at itself.
+ */
+export const MCP_ROUTES = {
+    /**
+     * The single Streamable HTTP endpoint. POST only; `GET` and `DELETE` answer
+     * `405`, because this endpoint opens no standalone event stream and mints no
+     * session to terminate.
+     *
+     * Served at this path **and** at the same path with a trailing slash, without
+     * a redirect between them. A `301`/`302` on a POST is rewritten by the fetch
+     * standard into a GET with the body dropped, so a client configured with the
+     * other spelling would have its opening request silently become the GET this
+     * endpoint refuses — and read that as "no MCP server here".
+     */
+    endpoint: "/mcp",
+    /**
+     * RFC 9728 metadata for the MCP endpoint specifically.
+     *
+     * Served *beside* the origin's own document rather than instead of it. RFC
+     * 9728 §3.1 places the metadata for a resource with a path component at
+     * `/.well-known/oauth-protected-resource` followed by that path, so a client
+     * that treats `https://host/mcp` as the resource it is authorizing for
+     * constructs exactly this URL — and one that follows the `resource_metadata`
+     * link out of the `401` is sent here too. Both arrive at a document naming
+     * the same authorization server.
+     */
+    protectedResourceMetadata: "/.well-known/oauth-protected-resource/mcp",
+};
+/**
+ * What the server tells a model about itself, once, before any tool call.
+ *
+ * MCP calls this `instructions` and hands it to the model as context. It is
+ * kept short and factual: an agent that has read the tool descriptions knows
+ * what each one does, and what it cannot work out from them is the shape of the
+ * authority it is acting under — which is the one thing that decides whether an
+ * instruction like "create this in production" is even expressible.
+ */
+export const MCP_INSTRUCTIONS = [
+    "Greatwait schedules work and delivers it to an endpoint at the time asked for.",
+    "Every tool acts inside one organization, project and environment, fixed by the credential this connection was authorized with; no argument can name another, and there is no tool that moves between them.",
+    "Reads are safe to repeat. Writes are annotated, and the ones marked destructive settle or discard an occurrence that would otherwise have fired.",
+    "A refusal comes back as a problem document with a stable `code`: act on the code, not on the wording.",
+].join(" ");