@greatwait/contracts 0.1.0-alpha.1

package/dist/operations.d.ts

@@ -0,0 +1,3985 @@
+import { z } from "zod";
+import type { PrincipalKind, Scope } from "./authority.js";
+import type { ProblemCode } from "./problems.js";
+/**
+ * The operation registry: one declaration per public operation, and the single
+ * source every artifact is generated from.
+ *
+ * OpenAPI, the typed client, the MCP tool registry, and the contract mock are
+ * all projections of this list. Nothing downstream may hand-write a wire
+ * shape, because a hand-written shape is a shape that drifts — which is
+ * exactly what the legacy scheduler's separately-maintained client and docs
+ * did.
+ *
+ * The list grows one story at a time and each new operation gets every
+ * artifact for free. W0-02 settled conventions rather than resources and W0-03
+ * settled the generation pipeline; W1-08 added the first `/v1` operations,
+ * W1-04 the credential lifecycle, and W1-06 the first paged collection —
+ * which is what put `query` on this interface, since a page is asked for on
+ * the URL rather than in a body.
+ */
+/** Where an operation is served. The mock implements all of them. */
+export type OperationSurface = "api" | "mock";
+/**
+ * What an operation is on the MCP surface.
+ *
+ * Architecture section 9 defines "complete MCP" as *every supported REST
+ * capability is either an MCP tool or an intentionally read-only MCP resource*.
+ * This is that sentence made declarable, and it is **required** on every
+ * operation so the compiler refuses one that has not decided — which is W1-07's
+ * criterion 4 at the earliest point it can be enforced. The parity gate then
+ * publishes the decisions as a table and refuses the ones that contradict the
+ * operation's own declarations.
+ *
+ * Deriving it instead was considered and rejected for the reason `creates` is
+ * declared: "should an agent be able to call this" is not a function of a
+ * method, a path or a schema. `credentials.create` is the case that proves it —
+ * a `POST` like any other, and structurally uncallable by any principal MCP can
+ * carry.
+ */
+export type McpDisposition = {
+    /**
+     * Published as a read-only MCP resource rather than a tool.
+     *
+     * For an operation that takes no arguments and reports a fact about the
+     * service. A resource is fetched by URI and cannot be given parameters, so
+     * the parity gate refuses this disposition on anything that mutates,
+     * declares scopes, takes a body, or has a path parameter.
+     */
+    readonly kind: "resource";
+    /** The URI a client reads it by. Opaque, stable, and ours to choose. */
+    readonly uri: string;
+} | {
+    /**
+     * MCP's `destructiveHint`: whether a successful call can undo or discard
+     * something that already existed.
+     *
+     * Declared rather than inferred from `mutates`, because an agent host
+     * gates confirmation on it and the two are genuinely different questions.
+     * Creating a schedule and cancelling one both mutate; only the second
+     * takes something away. MCP defines the hint as meaningful only when the
+     * tool is not read-only, so the parity gate refuses `true` on a read.
+     */
+    readonly destructive: boolean;
+    /** Callable by an agent. */
+    readonly kind: "tool";
+    /**
+     * MCP's `openWorldHint`: whether the call can interact with an entity
+     * outside Greatwait. This cannot be inferred from the HTTP path —
+     * endpoint verification is a Greatwait API operation whose effect is an
+     * outbound request to a customer-controlled receiver.
+     */
+    readonly openWorld: boolean;
+} | {
+    /** Why an agent cannot reach it. Required, and the gate refuses an empty
+     *  one: an exclusion nobody can explain is an exclusion nobody can review. */
+    readonly reason: string;
+    /** Deliberately absent from the MCP surface. */
+    readonly kind: "unavailable";
+};
+export interface OperationDefinition {
+    /**
+     * Whether a success brings into existence a resource that did not exist
+     * before the call. This is what 201 means, and until W2-02 it was inferred
+     * from `POST` + `mutates`, which happened to agree because every mutating
+     * POST on the surface did create something.
+     *
+     * `schedules.pause` is the first that does not. Inferring 201 for it would
+     * publish "Created" for a call that creates nothing — and the inference could
+     * not be fixed by looking harder at the other fields, because "did this bring
+     * something into being" is not derivable from a method, a path or a schema.
+     * So it is declared, in the same category as `mutates` and `idempotent`, and
+     * `successStatusFor` reads it instead of guessing.
+     */
+    readonly creates: boolean;
+    readonly description: string;
+    /**
+     * A response example, validated against `response` when artifacts are
+     * generated. Required, because an example is the part of a specification
+     * people actually read — and an unvalidated one is worse than none, since it
+     * teaches a shape the service will reject.
+     */
+    readonly example: unknown;
+    /** Stable machine name, also the MCP tool name and the SDK method name. */
+    readonly id: string;
+    /**
+     * Whether repeating the identical request is safe. Read operations are
+     * trivially so; writes must carry an idempotency key to qualify.
+     */
+    readonly idempotent: boolean;
+    /**
+     * What this operation is on the MCP surface. Required, so an operation added
+     * to this registry cannot reach REST without the question being answered.
+     */
+    readonly mcp: McpDisposition;
+    readonly method: "DELETE" | "GET" | "PATCH" | "POST" | "PUT";
+    /** Whether the operation changes state, for MCP annotations and approvals. */
+    readonly mutates: boolean;
+    /** Path template with `{name}` parameters. */
+    readonly path: string;
+    /**
+     * Which kinds of principal this operation accepts. Empty means it needs none.
+     *
+     * **Required, for the reason `mcp` is: an operation cannot reach REST without
+     * the question being answered.** Until this field existed the published
+     * document derived its security requirement from `scopes` alone, which says
+     * what a caller must hold and not what kind of caller may hold it. That is how
+     * `credentials.create` came to advertise API-credential authentication for a
+     * route that refuses an API credential on sight — a published claim that was
+     * simply false, and that no gate could see because the fact it contradicted
+     * was written nowhere.
+     *
+     * The rule the current list follows, so a reader does not have to infer it:
+     *
+     * - **Every `/v1` GET accepts a signed-in member**, alongside keys and tokens.
+     *   The dashboard is a normal client of the public API, not a privileged one.
+     * - **The schedule lifecycle writes accept one too**, since W4-03: create,
+     *   replace, pause, resume, cancel, archive, and redeliver. Until then no
+     *   `/v1` write did, on the grounds that writing from a browser needs
+     *   conditional-request and idempotency handling no browser surface existed
+     *   for — and that shipping an authorization path nothing exercises is worse
+     *   than shipping none. W4-03 is that surface, and
+     *   `apps/dashboard/src/workspace-mutations.test.ts` holds the two sets equal:
+     *   a write declared here and reachable by no dashboard control fails, and so
+     *   does a dashboard control for a write that does not declare it.
+     * - **The endpoint writes accept one too, since W4-02's first cut**: create,
+     *   update, verify, rotateSigningKey and disable. The reason is the same one
+     *   W4-03 gave — a browser surface now exercises them, and three of the five
+     *   publish the `If-Match` that makes a write from a page somebody has been
+     *   looking at refusable rather than silently last-writer-wins.
+     * - **The credential writes accept one too, since W4-02's second cut**:
+     *   rotate and revoke, joining `credentials.create`, which was session-only
+     *   from the start. Acting on a credential *somebody else issued* additionally
+     *   needs `credentials:administer`, which is the one scope the `member` role
+     *   does not hold — see `policy.ts`.
+     * - **Every other `/v1` write still refuses a session**, which is the half of
+     *   the old rule that survives. Test sinks are the remaining surface nobody
+     *   has built, and the case that pins each refused write lives in
+     *   `apps/api/src/v1-session-authority.worker.test.ts`.
+     * - **`credentials.create` is the exception in the other direction**: a write
+     *   that accepts *only* a session, and predates all of this.
+     * - **`projects.list` is session-only**, because a key's authority already
+     *   *is* one project: for a key the answer is either a one-row list of no
+     *   value or an invitation to widen.
+     */
+    readonly principals: readonly PrincipalKind[];
+    /**
+     * How a session request states the project and environment it acts in.
+     *
+     * A key and a token carry their authority tuple intrinsically. A session
+     * carries only the member's organization, so something else has to say which
+     * project — and it is not the same something for every operation:
+     *
+     * - `"headers"` — the two `SESSION_AUTHORITY_HEADERS`. Every operation that
+     *   acts on resources inside one project.
+     * - `"request-body"` — the request already names them as fields.
+     *   `credentials.create` is the only one, and it predates this field.
+     * - `"organization"` — the operation is answered from the member's
+     *   organization and names no project at all. `projects.list` is this, and it
+     *   has to be: it is the call a browser makes *because* it does not know a
+     *   project yet. Publishing a required project header on it would describe a
+     *   call nobody can make.
+     * - `"member"` — the operation is answered from the signed-in **person**, and
+     *   the resource is theirs rather than a project's. The grant operations are
+     *   this: a member's connected applications span every project in their
+     *   organization, because a person connects an application and not a project.
+     *   A project header would narrow an answer that is not project-shaped, and
+     *   there is nothing for it to narrow.
+     *
+     *   **It is a distinct value rather than a second use of `"organization"`,
+     *   and the difference is load-bearing.** The rule
+     *   `operations.test.ts` holds — a session *write* answered from the
+     *   organization is a write to an unspecified place — is about writes that
+     *   have to choose a project and did not. A write against the member's own
+     *   resource chooses nothing: the resource is identified by who is asking and
+     *   by the path. Collapsing the two would have meant either weakening that
+     *   rule or granting `grants.revoke` an exemption, and an exemption is what
+     *   the rule replaced.
+     *
+     * Present exactly when `principals` includes `session`; `operations.test.ts`
+     * holds that biconditional, because either half alone is a silent defect —
+     * an absent value makes the generator publish a call that cannot be made, and
+     * a stray one describes authentication for a credential kind the operation
+     * refuses.
+     */
+    readonly sessionAuthority?: "headers" | "member" | "organization" | "request-body";
+    /**
+     * Scopes this operation needs only for *some* calls.
+     *
+     * **Published because an operation that can refuse for a scope it never
+     * mentions is a document that lies.** `scopes` is what every call needs and
+     * `authorizeOperation` requires all of it; a scope required by the shape of
+     * the *target* rather than of the request cannot go there, because declaring
+     * it would refuse the ordinary call too. `credentials.rotate` is the case:
+     * anybody holding `credentials:write` may rotate their own credential, and
+     * rotating one somebody else issued additionally needs
+     * `credentials:administer`.
+     *
+     * Leaving it undeclared had two costs, and the second is the one that bites.
+     * An integrator reading the document could not learn why a 403 arrived. And
+     * `grantableScopes` derives what an OAuth client may ask for from the scopes
+     * operations declare, so a scope named nowhere is a scope no grant can carry
+     * — which would have made the whole restriction unreachable through OAuth and
+     * the role-narrowing rules unobservable, since nothing else a member is
+     * refused would be grantable.
+     */
+    readonly conditionalScopes?: readonly Scope[];
+    /** Problem codes this operation may return, beyond the universal ones. */
+    readonly problems: readonly ProblemCode[];
+    /**
+     * Query parameters, as one object schema whose properties are the parameters.
+     *
+     * An object rather than a list of declarations because the shapes that matter
+     * already exist as schemas — `pageRequestSchema` is the paging contract, and
+     * an operation that pages references it instead of restating a cursor and a
+     * bound. Every projection derives the parameter list from the schema's own
+     * JSON Schema, so which parameters are required, what they accept and what
+     * they default to are stated once and published everywhere.
+     *
+     * Values arrive as strings on a URL. `parsePageRequest` is where that
+     * coercion lives for paging, so REST and MCP cannot disagree about what
+     * `limit=abc` means.
+     */
+    readonly query?: z.ZodTypeAny;
+    readonly request?: z.ZodTypeAny;
+    /**
+     * Request headers this operation reads, as one object schema whose properties
+     * are the header names — `query`'s shape, for `query`'s reason.
+     *
+     * A header is as much part of a request as a field is, and the two failures
+     * are the same one: a route that reads `If-Match` while the document does not
+     * publish it teaches integrators that conditional writes are unavailable, and
+     * a document that publishes one no route reads teaches them their preconditions
+     * are being honoured when they are not. Both are invisible until a lost update
+     * makes them visible.
+     *
+     * Header names are HTTP's, not ours. `If-Match` and `ETag` are RFC 9110's;
+     * `Idempotency-Key` is the spelling the ecosystem settled on. They are
+     * case-insensitive on the wire, and the canonical casing here is what the
+     * document publishes and what the generated client sends.
+     */
+    readonly requestHeaders?: z.ZodTypeAny;
+    /**
+     * Response headers this operation sets on success, same shape.
+     *
+     * Published because an `ETag` a client is expected to send back in `If-Match`
+     * is a value that operation *promises*, and a promise no artifact carries is
+     * one the next reader has to discover by experiment.
+     */
+    readonly responseHeaders?: z.ZodTypeAny;
+    /** A request example, validated against `request`. Required whenever the
+     *  operation takes a body. */
+    readonly requestExample?: unknown;
+    readonly response: z.ZodTypeAny;
+    /** Empty means the operation needs no principal. */
+    readonly scopes: readonly Scope[];
+    readonly summary: string;
+    readonly surfaces: readonly OperationSurface[];
+}
+/**
+ * Deterministic behaviors the contract mock can be asked to produce.
+ *
+ * These are the failure modes an integrator must be able to rehearse before
+ * going live, and they are part of the contract rather than mock trivia: a
+ * customer tunes their receiver against exactly these categories.
+ */
+export declare const MOCK_BEHAVIORS: readonly ["ambiguous", "redelivery", "refusal", "retry", "success", "timeout"];
+export declare const mockBehaviorSchema: z.ZodEnum<{
+    success: "success";
+    redelivery: "redelivery";
+    ambiguous: "ambiguous";
+    refusal: "refusal";
+    timeout: "timeout";
+    retry: "retry";
+}>;
+export type MockBehavior = z.infer<typeof mockBehaviorSchema>;
+/**
+ * A mock scenario. `now` pins the clock so a test that depends on time is
+ * reproducible: without it, "what does a stale signature look like" is a test
+ * that passes until it doesn't.
+ */
+export declare const mockScenarioRequestSchema: z.ZodObject<{
+    behavior: z.ZodEnum<{
+        success: "success";
+        redelivery: "redelivery";
+        ambiguous: "ambiguous";
+        refusal: "refusal";
+        timeout: "timeout";
+        retry: "retry";
+    }>;
+    now: z.ZodOptional<z.ZodString>;
+    failuresBeforeSuccess: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type MockScenarioRequest = z.infer<typeof mockScenarioRequestSchema>;
+export declare const mockScenarioResponseSchema: z.ZodObject<{
+    behavior: z.ZodEnum<{
+        success: "success";
+        redelivery: "redelivery";
+        ambiguous: "ambiguous";
+        refusal: "refusal";
+        timeout: "timeout";
+        retry: "retry";
+    }>;
+    now: z.ZodString;
+    scenarioId: z.ZodString;
+}, z.core.$strip>;
+export type MockScenarioResponse = z.infer<typeof mockScenarioResponseSchema>;
+export declare const fixtureListSchema: z.ZodObject<{
+    fixtures: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        description: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type FixtureList = z.infer<typeof fixtureListSchema>;
+export declare const OPERATIONS: readonly [{
+    readonly creates: false;
+    readonly description: "Reports the service, environment, and build the request reached. Unauthenticated: it carries no customer data and is used by canaries and deployment smoke checks.";
+    readonly example: {
+        readonly buildSha: "9f2c1ab";
+        readonly environment: "development";
+        readonly service: "@greatwait/api";
+    };
+    readonly id: "meta.version";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly kind: "resource";
+        readonly uri: "greatwait://meta/version";
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/__greatwait/version";
+    readonly principals: readonly [];
+    readonly problems: readonly [];
+    readonly response: z.ZodObject<{
+        buildSha: z.ZodString;
+        environment: z.ZodString;
+        service: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly [];
+    readonly summary: "Read the deployed version";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Reports the workspace layer this service occupies and the layers it may depend on. Exists so the architecture boundary is observable at runtime, not only at build time.";
+    readonly example: {
+        readonly dependsOn: readonly ["application", "contract", "platform"];
+        readonly layer: "adapter";
+        readonly service: "@greatwait/api";
+    };
+    readonly id: "meta.scaffold";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly kind: "resource";
+        readonly uri: "greatwait://meta/scaffold";
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/_scaffold";
+    readonly principals: readonly [];
+    readonly problems: readonly [];
+    readonly response: z.ZodObject<{
+        dependsOn: z.ZodArray<z.ZodEnum<{
+            contract: "contract";
+            platform: "platform";
+            domain: "domain";
+            application: "application";
+            adapter: "adapter";
+            "test-support": "test-support";
+        }>>;
+        layer: z.ZodEnum<{
+            contract: "contract";
+            platform: "platform";
+            domain: "domain";
+            application: "application";
+            adapter: "adapter";
+            "test-support": "test-support";
+        }>;
+        service: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly [];
+    readonly summary: "Read the workspace scaffold";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Lists the committed contract fixtures the mock can serve. Mock-only: the API has no fixtures.";
+    readonly example: {
+        readonly fixtures: readonly [{
+            readonly description: "The workspace scaffold every service reports.";
+            readonly id: "workspace-scaffold";
+        }];
+    };
+    readonly id: "mock.listFixtures";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly kind: "unavailable";
+        readonly reason: "The contract mock's control plane. An agent handed this would call it against the real service.";
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/_contract/fixtures";
+    readonly principals: readonly [];
+    readonly problems: readonly [];
+    readonly response: z.ZodObject<{
+        fixtures: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            description: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    readonly scopes: readonly [];
+    readonly summary: "List contract fixtures";
+    readonly surfaces: readonly ["mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Serves one committed fixture, byte-identical on every call. Returns a not_found problem for an unknown identifier.";
+    readonly example: {
+        readonly dependsOn: readonly ["application", "contract", "platform"];
+        readonly layer: "adapter";
+        readonly service: "@greatwait/contract-mock";
+    };
+    readonly id: "mock.getFixture";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly kind: "unavailable";
+        readonly reason: "The contract mock's control plane. An agent handed this would call it against the real service.";
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/_contract/fixtures/{fixtureId}";
+    readonly principals: readonly [];
+    readonly problems: readonly ["not_found"];
+    readonly response: z.ZodObject<{
+        dependsOn: z.ZodArray<z.ZodEnum<{
+            contract: "contract";
+            platform: "platform";
+            domain: "domain";
+            application: "application";
+            adapter: "adapter";
+            "test-support": "test-support";
+        }>>;
+        layer: z.ZodEnum<{
+            contract: "contract";
+            platform: "platform";
+            domain: "domain";
+            application: "application";
+            adapter: "adapter";
+            "test-support": "test-support";
+        }>;
+        service: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly [];
+    readonly summary: "Read a contract fixture";
+    readonly surfaces: readonly ["mock"];
+}, {
+    readonly creates: true;
+    readonly description: "Creates a reusable callback endpoint in the caller's project and environment. The destination must be HTTPS on effective port 443, contain no URL credentials or fragment, and resolve only to public unicast addresses. The endpoint begins pending. Whether delivery waits for its secret-bound ownership challenge is a deployment policy: where the challenge is not required, which is the default, a pending endpoint is delivered to and answering the challenge only records the instant it proved possession; where it is required, attaching a pending endpoint to a schedule is refused endpoint_unverified until the challenge succeeds. A disabled endpoint is never delivered to under either policy, and a schedule write naming one answers not_found, because disabling is terminal rather than a state to recover from. The per-endpoint secret is returned in this response and nowhere else. The 50-record safety ceiling includes disabled endpoints because they remain readable for audit.";
+    readonly example: {
+        readonly createdAt: "2026-08-05T15:00:00.000Z";
+        readonly environmentKind: "test";
+        readonly id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly keyId: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly secret: "ptsk_test_<the-one-time-endpoint-secret-here>";
+        readonly shownOnce: true;
+        readonly signingKeys: {
+            readonly current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        };
+        readonly status: "pending";
+        readonly updatedAt: "2026-08-05T15:00:00.000Z";
+        readonly url: "https://hooks.example.com/greatwait";
+        readonly version: 1;
+    };
+    readonly id: "endpoints.create";
+    readonly idempotent: false;
+    readonly mcp: {
+        readonly kind: "unavailable";
+        readonly reason: "Creation returns a one-time endpoint signing secret, and MCP has no negotiated secure-result channel that can keep it out of ordinary tool history.";
+    };
+    readonly method: "POST";
+    readonly mutates: true;
+    readonly path: "/v1/endpoints";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "plan_limit_reached", "rate_limited"];
+    readonly request: z.ZodObject<{
+        url: z.ZodString;
+    }, z.core.$strip>;
+    readonly requestExample: {
+        readonly url: "https://hooks.example.com/greatwait";
+    };
+    readonly response: z.ZodObject<{
+        createdAt: z.ZodString;
+        disabledAt: z.ZodOptional<z.ZodString>;
+        environmentKind: z.ZodEnum<{
+            test: "test";
+            live: "live";
+        }>;
+        id: z.ZodString;
+        lastVerificationAttemptAt: z.ZodOptional<z.ZodString>;
+        lastVerificationFailure: z.ZodOptional<z.ZodEnum<{
+            rate_limited: "rate_limited";
+            address_forbidden: "address_forbidden";
+            challenge_failed: "challenge_failed";
+            connection_failed: "connection_failed";
+            dns_unresolved: "dns_unresolved";
+            redirect_refused: "redirect_refused";
+            response_too_large: "response_too_large";
+            timed_out: "timed_out";
+            unexpected_status: "unexpected_status";
+        }>>;
+        project: z.ZodString;
+        signingKeys: z.ZodObject<{
+            current: z.ZodString;
+            next: z.ZodOptional<z.ZodObject<{
+                id: z.ZodString;
+                overlapEndsAt: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        status: z.ZodEnum<{
+            verified: "verified";
+            pending: "pending";
+            disabled: "disabled";
+        }>;
+        updatedAt: z.ZodString;
+        url: z.ZodString;
+        verifiedAt: z.ZodOptional<z.ZodString>;
+        version: z.ZodNumber;
+        keyId: z.ZodString;
+        secret: z.ZodString;
+        shownOnce: z.ZodLiteral<true>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["endpoints:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Create a callback endpoint";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Lists the caller's callback endpoints for exactly its own project and environment. The result is authoritative and metadata-only: no signing secret or sealed key material has a field in this shape.";
+    readonly example: {
+        readonly data: readonly [{
+            readonly createdAt: "2026-08-05T15:00:00.000Z";
+            readonly environmentKind: "test";
+            readonly id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly signingKeys: {
+                readonly current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            };
+            readonly status: "verified";
+            readonly updatedAt: "2026-08-05T15:01:00.000Z";
+            readonly url: "https://hooks.example.com/greatwait";
+            readonly verifiedAt: "2026-08-05T15:01:00.000Z";
+            readonly version: 2;
+        }];
+        readonly freshness: {
+            readonly kind: "authoritative";
+        };
+    };
+    readonly id: "endpoints.list";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/endpoints";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request"];
+    readonly query: z.ZodObject<{
+        cursor: z.ZodOptional<z.ZodString>;
+        limit: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        data: z.ZodArray<z.ZodObject<{
+            createdAt: z.ZodString;
+            disabledAt: z.ZodOptional<z.ZodString>;
+            environmentKind: z.ZodEnum<{
+                test: "test";
+                live: "live";
+            }>;
+            id: z.ZodString;
+            lastVerificationAttemptAt: z.ZodOptional<z.ZodString>;
+            lastVerificationFailure: z.ZodOptional<z.ZodEnum<{
+                rate_limited: "rate_limited";
+                address_forbidden: "address_forbidden";
+                challenge_failed: "challenge_failed";
+                connection_failed: "connection_failed";
+                dns_unresolved: "dns_unresolved";
+                redirect_refused: "redirect_refused";
+                response_too_large: "response_too_large";
+                timed_out: "timed_out";
+                unexpected_status: "unexpected_status";
+            }>>;
+            project: z.ZodString;
+            signingKeys: z.ZodObject<{
+                current: z.ZodString;
+                next: z.ZodOptional<z.ZodObject<{
+                    id: z.ZodString;
+                    overlapEndsAt: z.ZodString;
+                }, z.core.$strip>>;
+            }, z.core.$strip>;
+            status: z.ZodEnum<{
+                verified: "verified";
+                pending: "pending";
+                disabled: "disabled";
+            }>;
+            updatedAt: z.ZodString;
+            url: z.ZodString;
+            verifiedAt: z.ZodOptional<z.ZodString>;
+            version: z.ZodNumber;
+        }, z.core.$strip>>;
+        freshness: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"authoritative">;
+        }, z.core.$strip>, z.ZodObject<{
+            asOf: z.ZodString;
+            kind: z.ZodLiteral<"projected">;
+            lagSeconds: z.ZodNumber;
+        }, z.core.$strip>], "kind">;
+        nextCursor: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["endpoints:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "List callback endpoints";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Reads one callback endpoint from the caller's own project and environment. A well-formed identifier belonging to another authority is indistinguishable from an absent endpoint, and the response never contains secret material.";
+    readonly example: {
+        readonly createdAt: "2026-08-05T15:00:00.000Z";
+        readonly environmentKind: "test";
+        readonly id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly signingKeys: {
+            readonly current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        };
+        readonly status: "verified";
+        readonly updatedAt: "2026-08-05T15:01:00.000Z";
+        readonly url: "https://hooks.example.com/greatwait";
+        readonly verifiedAt: "2026-08-05T15:01:00.000Z";
+        readonly version: 2;
+    };
+    readonly id: "endpoints.read";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/endpoints/{endpointId}";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found"];
+    readonly response: z.ZodObject<{
+        createdAt: z.ZodString;
+        disabledAt: z.ZodOptional<z.ZodString>;
+        environmentKind: z.ZodEnum<{
+            test: "test";
+            live: "live";
+        }>;
+        id: z.ZodString;
+        lastVerificationAttemptAt: z.ZodOptional<z.ZodString>;
+        lastVerificationFailure: z.ZodOptional<z.ZodEnum<{
+            rate_limited: "rate_limited";
+            address_forbidden: "address_forbidden";
+            challenge_failed: "challenge_failed";
+            connection_failed: "connection_failed";
+            dns_unresolved: "dns_unresolved";
+            redirect_refused: "redirect_refused";
+            response_too_large: "response_too_large";
+            timed_out: "timed_out";
+            unexpected_status: "unexpected_status";
+        }>>;
+        project: z.ZodString;
+        signingKeys: z.ZodObject<{
+            current: z.ZodString;
+            next: z.ZodOptional<z.ZodObject<{
+                id: z.ZodString;
+                overlapEndsAt: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        status: z.ZodEnum<{
+            verified: "verified";
+            pending: "pending";
+            disabled: "disabled";
+        }>;
+        updatedAt: z.ZodString;
+        url: z.ZodString;
+        verifiedAt: z.ZodOptional<z.ZodString>;
+        version: z.ZodNumber;
+    }, z.core.$strip>;
+    readonly responseHeaders: z.ZodObject<{
+        ETag: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["endpoints:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Read a callback endpoint";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Replaces an endpoint's destination after applying the complete URL and DNS policy. A changed destination resets verification to pending; the endpoint cannot be used again until ownership of the new URL is proved. Disabled endpoints cannot be updated. Send If-Match with the version the endpoint was read at to be refused rather than overwrite a destination somebody else changed in the meantime.";
+    readonly example: {
+        readonly createdAt: "2026-08-05T15:00:00.000Z";
+        readonly environmentKind: "test";
+        readonly id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly signingKeys: {
+            readonly current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        };
+        readonly status: "pending";
+        readonly updatedAt: "2026-08-05T16:00:00.000Z";
+        readonly url: "https://hooks.example.com/replacement";
+        readonly version: 3;
+    };
+    readonly id: "endpoints.update";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: true;
+        readonly kind: "tool";
+        readonly openWorld: true;
+    };
+    readonly method: "PUT";
+    readonly mutates: true;
+    readonly path: "/v1/endpoints/{endpointId}";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found", "rate_limited", "state_conflict", "version_conflict"];
+    readonly request: z.ZodObject<{
+        url: z.ZodString;
+    }, z.core.$strip>;
+    readonly requestExample: {
+        readonly url: "https://hooks.example.com/replacement";
+    };
+    readonly requestHeaders: z.ZodObject<{
+        "If-Match": z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        createdAt: z.ZodString;
+        disabledAt: z.ZodOptional<z.ZodString>;
+        environmentKind: z.ZodEnum<{
+            test: "test";
+            live: "live";
+        }>;
+        id: z.ZodString;
+        lastVerificationAttemptAt: z.ZodOptional<z.ZodString>;
+        lastVerificationFailure: z.ZodOptional<z.ZodEnum<{
+            rate_limited: "rate_limited";
+            address_forbidden: "address_forbidden";
+            challenge_failed: "challenge_failed";
+            connection_failed: "connection_failed";
+            dns_unresolved: "dns_unresolved";
+            redirect_refused: "redirect_refused";
+            response_too_large: "response_too_large";
+            timed_out: "timed_out";
+            unexpected_status: "unexpected_status";
+        }>>;
+        project: z.ZodString;
+        signingKeys: z.ZodObject<{
+            current: z.ZodString;
+            next: z.ZodOptional<z.ZodObject<{
+                id: z.ZodString;
+                overlapEndsAt: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        status: z.ZodEnum<{
+            verified: "verified";
+            pending: "pending";
+            disabled: "disabled";
+        }>;
+        updatedAt: z.ZodString;
+        url: z.ZodString;
+        verifiedAt: z.ZodOptional<z.ZodString>;
+        version: z.ZodNumber;
+    }, z.core.$strip>;
+    readonly responseHeaders: z.ZodObject<{
+        ETag: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["endpoints:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Update a callback endpoint";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Re-resolves the endpoint immediately before sending one bounded ownership challenge with redirects disabled. The receiver proves possession of the one-time endpoint secret in its response. A successful challenge marks the endpoint verified; a failed challenge records only a safe failure category. Send If-Match with the version the endpoint was read at to be refused rather than challenge a destination somebody else has since changed.";
+    readonly example: {
+        readonly createdAt: "2026-08-05T15:00:00.000Z";
+        readonly environmentKind: "test";
+        readonly id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly lastVerificationAttemptAt: "2026-08-05T15:01:00.000Z";
+        readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly signingKeys: {
+            readonly current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        };
+        readonly status: "verified";
+        readonly updatedAt: "2026-08-05T15:01:00.000Z";
+        readonly url: "https://hooks.example.com/greatwait";
+        readonly verifiedAt: "2026-08-05T15:01:00.000Z";
+        readonly version: 2;
+    };
+    readonly id: "endpoints.verify";
+    readonly idempotent: false;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: true;
+    };
+    readonly method: "POST";
+    readonly mutates: true;
+    readonly path: "/v1/endpoints/{endpointId}/verify";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found", "rate_limited", "state_conflict", "version_conflict"];
+    readonly requestHeaders: z.ZodObject<{
+        "If-Match": z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        createdAt: z.ZodString;
+        disabledAt: z.ZodOptional<z.ZodString>;
+        environmentKind: z.ZodEnum<{
+            test: "test";
+            live: "live";
+        }>;
+        id: z.ZodString;
+        lastVerificationAttemptAt: z.ZodOptional<z.ZodString>;
+        lastVerificationFailure: z.ZodOptional<z.ZodEnum<{
+            rate_limited: "rate_limited";
+            address_forbidden: "address_forbidden";
+            challenge_failed: "challenge_failed";
+            connection_failed: "connection_failed";
+            dns_unresolved: "dns_unresolved";
+            redirect_refused: "redirect_refused";
+            response_too_large: "response_too_large";
+            timed_out: "timed_out";
+            unexpected_status: "unexpected_status";
+        }>>;
+        project: z.ZodString;
+        signingKeys: z.ZodObject<{
+            current: z.ZodString;
+            next: z.ZodOptional<z.ZodObject<{
+                id: z.ZodString;
+                overlapEndsAt: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        status: z.ZodEnum<{
+            verified: "verified";
+            pending: "pending";
+            disabled: "disabled";
+        }>;
+        updatedAt: z.ZodString;
+        url: z.ZodString;
+        verifiedAt: z.ZodOptional<z.ZodString>;
+        version: z.ZodNumber;
+    }, z.core.$strip>;
+    readonly responseHeaders: z.ZodObject<{
+        ETag: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["endpoints:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Verify callback endpoint ownership";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: true;
+    readonly description: "Creates the next endpoint signing key and selects it immediately for new deliveries while retaining the current key in the receiver acceptance set for a bounded overlap. The overlap defaults to and cannot exceed 24 hours. A second rotation is refused until the current overlap ends. The new secret is returned once and has no recovery operation, so a call whose answer was never read may have rotated a key nobody holds: read the endpoint and compare its signing keys before repeating one. Send If-Match with the version the endpoint was read at to be refused rather than rotate an endpoint that has changed since.";
+    readonly example: {
+        readonly endpoint: {
+            readonly createdAt: "2026-08-05T15:00:00.000Z";
+            readonly environmentKind: "test";
+            readonly id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly signingKeys: {
+                readonly current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+                readonly next: {
+                    readonly id: "csk_11h8xyz9k2m4n6p8r0t2v4w6y8";
+                    readonly overlapEndsAt: "2026-08-06T15:05:00.000Z";
+                };
+            };
+            readonly status: "verified";
+            readonly updatedAt: "2026-08-05T15:05:00.000Z";
+            readonly url: "https://hooks.example.com/greatwait";
+            readonly verifiedAt: "2026-08-05T15:01:00.000Z";
+            readonly version: 3;
+        };
+        readonly keyId: "csk_11h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly secret: "ptsk_test_<the-next-one-time-endpoint-secret-here>";
+        readonly shownOnce: true;
+    };
+    readonly id: "endpoints.rotateSigningKey";
+    readonly idempotent: false;
+    readonly mcp: {
+        readonly kind: "unavailable";
+        readonly reason: "Rotation returns a one-time endpoint signing secret, and MCP has no negotiated secure-result channel that can keep it out of ordinary tool history.";
+    };
+    readonly method: "POST";
+    readonly mutates: true;
+    readonly path: "/v1/endpoints/{endpointId}/signing-keys/rotate";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found", "state_conflict", "version_conflict"];
+    readonly request: z.ZodObject<{
+        overlapSeconds: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+    readonly requestExample: {
+        readonly overlapSeconds: 3600;
+    };
+    readonly requestHeaders: z.ZodObject<{
+        "If-Match": z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        endpoint: z.ZodObject<{
+            createdAt: z.ZodString;
+            disabledAt: z.ZodOptional<z.ZodString>;
+            environmentKind: z.ZodEnum<{
+                test: "test";
+                live: "live";
+            }>;
+            id: z.ZodString;
+            lastVerificationAttemptAt: z.ZodOptional<z.ZodString>;
+            lastVerificationFailure: z.ZodOptional<z.ZodEnum<{
+                rate_limited: "rate_limited";
+                address_forbidden: "address_forbidden";
+                challenge_failed: "challenge_failed";
+                connection_failed: "connection_failed";
+                dns_unresolved: "dns_unresolved";
+                redirect_refused: "redirect_refused";
+                response_too_large: "response_too_large";
+                timed_out: "timed_out";
+                unexpected_status: "unexpected_status";
+            }>>;
+            project: z.ZodString;
+            signingKeys: z.ZodObject<{
+                current: z.ZodString;
+                next: z.ZodOptional<z.ZodObject<{
+                    id: z.ZodString;
+                    overlapEndsAt: z.ZodString;
+                }, z.core.$strip>>;
+            }, z.core.$strip>;
+            status: z.ZodEnum<{
+                verified: "verified";
+                pending: "pending";
+                disabled: "disabled";
+            }>;
+            updatedAt: z.ZodString;
+            url: z.ZodString;
+            verifiedAt: z.ZodOptional<z.ZodString>;
+            version: z.ZodNumber;
+        }, z.core.$strip>;
+        keyId: z.ZodString;
+        secret: z.ZodString;
+        shownOnce: z.ZodLiteral<true>;
+    }, z.core.$strip>;
+    readonly responseHeaders: z.ZodObject<{
+        ETag: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["endpoints:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Rotate a callback endpoint signing key";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Disables an endpoint immediately and permanently: there is no operation that re-enables one. It stays readable for audit but is no longer eligible for update, verification or callback send admission, and schedules pointed at it deliver nothing. Repeating the disable is idempotent and does not write a second audit event, which is why it takes no precondition — the outcome does not depend on what else has changed.";
+    readonly example: {
+        readonly createdAt: "2026-08-05T15:00:00.000Z";
+        readonly disabledAt: "2026-08-05T17:00:00.000Z";
+        readonly environmentKind: "test";
+        readonly id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly signingKeys: {
+            readonly current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        };
+        readonly status: "disabled";
+        readonly updatedAt: "2026-08-05T17:00:00.000Z";
+        readonly url: "https://hooks.example.com/greatwait";
+        readonly verifiedAt: "2026-08-05T15:01:00.000Z";
+        readonly version: 3;
+    };
+    readonly id: "endpoints.disable";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: true;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "DELETE";
+    readonly mutates: true;
+    readonly path: "/v1/endpoints/{endpointId}";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found"];
+    readonly response: z.ZodObject<{
+        createdAt: z.ZodString;
+        disabledAt: z.ZodOptional<z.ZodString>;
+        environmentKind: z.ZodEnum<{
+            test: "test";
+            live: "live";
+        }>;
+        id: z.ZodString;
+        lastVerificationAttemptAt: z.ZodOptional<z.ZodString>;
+        lastVerificationFailure: z.ZodOptional<z.ZodEnum<{
+            rate_limited: "rate_limited";
+            address_forbidden: "address_forbidden";
+            challenge_failed: "challenge_failed";
+            connection_failed: "connection_failed";
+            dns_unresolved: "dns_unresolved";
+            redirect_refused: "redirect_refused";
+            response_too_large: "response_too_large";
+            timed_out: "timed_out";
+            unexpected_status: "unexpected_status";
+        }>>;
+        project: z.ZodString;
+        signingKeys: z.ZodObject<{
+            current: z.ZodString;
+            next: z.ZodOptional<z.ZodObject<{
+                id: z.ZodString;
+                overlapEndsAt: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        status: z.ZodEnum<{
+            verified: "verified";
+            pending: "pending";
+            disabled: "disabled";
+        }>;
+        updatedAt: z.ZodString;
+        url: z.ZodString;
+        verifiedAt: z.ZodOptional<z.ZodString>;
+        version: z.ZodNumber;
+    }, z.core.$strip>;
+    readonly responseHeaders: z.ZodObject<{
+        ETag: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["endpoints:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Disable a callback endpoint";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: true;
+    readonly description: "Creates a deterministic receiver for one callback endpoint so failures can be rehearsed before they happen in production. Test environments only: a live principal has no such operation, and there is no request field that could widen the organization, project, or environment the sink belongs to. The sink verifies deliveries with the bound endpoint's own signing keys, so key rotation and a wrong key behave here exactly as they would at the customer's receiver. It receives and never sends: no field names a destination and no configuration makes it forward a delivery. Point the endpoint at the returned url and verify it, and every attempt lands here.";
+    readonly example: {
+        readonly createdAt: "2026-08-07T15:00:00.000Z";
+        readonly deliveryCount: 0;
+        readonly endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly environmentKind: "test";
+        readonly id: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly program: {
+            readonly behavior: "success";
+        };
+        readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly updatedAt: "2026-08-07T15:00:00.000Z";
+        readonly url: "https://sink.greatwait.dev/__greatwait/test-sinks/tsk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+    };
+    readonly id: "testsinks.create";
+    readonly idempotent: false;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "POST";
+    readonly mutates: true;
+    readonly path: "/v1/test-sinks";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found", "plan_limit_reached", "state_conflict"];
+    readonly request: z.ZodObject<{
+        endpoint: z.ZodString;
+        program: z.ZodOptional<z.ZodObject<{
+            behavior: z.ZodEnum<{
+                rate_limited: "rate_limited";
+                success: "success";
+                server_error: "server_error";
+                client_error: "client_error";
+                defer_abandon: "defer_abandon";
+                defer_fail: "defer_fail";
+                defer_succeed: "defer_succeed";
+                delay: "delay";
+                disconnect: "disconnect";
+                duplicate: "duplicate";
+                invalid_signature: "invalid_signature";
+                timeout: "timeout";
+            }>;
+            completionDelayMs: z.ZodOptional<z.ZodNumber>;
+            delayMs: z.ZodOptional<z.ZodNumber>;
+            forDeliveries: z.ZodOptional<z.ZodNumber>;
+            retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+            status: z.ZodOptional<z.ZodNumber>;
+            then: z.ZodOptional<z.ZodEnum<{
+                rate_limited: "rate_limited";
+                success: "success";
+                server_error: "server_error";
+                client_error: "client_error";
+                defer_abandon: "defer_abandon";
+                defer_fail: "defer_fail";
+                defer_succeed: "defer_succeed";
+                delay: "delay";
+                disconnect: "disconnect";
+                duplicate: "duplicate";
+                invalid_signature: "invalid_signature";
+                timeout: "timeout";
+            }>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    readonly requestExample: {
+        readonly endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly program: {
+            readonly behavior: "server_error";
+            readonly forDeliveries: 2;
+            readonly then: "success";
+        };
+    };
+    readonly response: z.ZodObject<{
+        createdAt: z.ZodString;
+        deliveryCount: z.ZodNumber;
+        endpoint: z.ZodString;
+        environmentKind: z.ZodLiteral<"test">;
+        id: z.ZodString;
+        program: z.ZodObject<{
+            behavior: z.ZodEnum<{
+                rate_limited: "rate_limited";
+                success: "success";
+                server_error: "server_error";
+                client_error: "client_error";
+                defer_abandon: "defer_abandon";
+                defer_fail: "defer_fail";
+                defer_succeed: "defer_succeed";
+                delay: "delay";
+                disconnect: "disconnect";
+                duplicate: "duplicate";
+                invalid_signature: "invalid_signature";
+                timeout: "timeout";
+            }>;
+            completionDelayMs: z.ZodOptional<z.ZodNumber>;
+            delayMs: z.ZodOptional<z.ZodNumber>;
+            forDeliveries: z.ZodOptional<z.ZodNumber>;
+            retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+            status: z.ZodOptional<z.ZodNumber>;
+            then: z.ZodOptional<z.ZodEnum<{
+                rate_limited: "rate_limited";
+                success: "success";
+                server_error: "server_error";
+                client_error: "client_error";
+                defer_abandon: "defer_abandon";
+                defer_fail: "defer_fail";
+                defer_succeed: "defer_succeed";
+                delay: "delay";
+                disconnect: "disconnect";
+                duplicate: "duplicate";
+                invalid_signature: "invalid_signature";
+                timeout: "timeout";
+            }>>;
+        }, z.core.$strip>;
+        project: z.ZodString;
+        updatedAt: z.ZodString;
+        url: z.ZodURL;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["endpoints:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Create a test sink";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Lists the caller's test sinks for exactly its own project and test environment. A live principal receives an empty-handed refusal rather than another environment's sinks.";
+    readonly example: {
+        readonly data: readonly [{
+            readonly createdAt: "2026-08-07T15:00:00.000Z";
+            readonly deliveryCount: 3;
+            readonly endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly environmentKind: "test";
+            readonly id: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly program: {
+                readonly behavior: "success";
+            };
+            readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly updatedAt: "2026-08-07T15:02:00.000Z";
+            readonly url: "https://sink.greatwait.dev/__greatwait/test-sinks/tsk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        }];
+        readonly freshness: {
+            readonly kind: "authoritative";
+        };
+    };
+    readonly id: "testsinks.list";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/test-sinks";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "state_conflict"];
+    readonly query: z.ZodObject<{
+        cursor: z.ZodOptional<z.ZodString>;
+        limit: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        data: z.ZodArray<z.ZodObject<{
+            createdAt: z.ZodString;
+            deliveryCount: z.ZodNumber;
+            endpoint: z.ZodString;
+            environmentKind: z.ZodLiteral<"test">;
+            id: z.ZodString;
+            program: z.ZodObject<{
+                behavior: z.ZodEnum<{
+                    rate_limited: "rate_limited";
+                    success: "success";
+                    server_error: "server_error";
+                    client_error: "client_error";
+                    defer_abandon: "defer_abandon";
+                    defer_fail: "defer_fail";
+                    defer_succeed: "defer_succeed";
+                    delay: "delay";
+                    disconnect: "disconnect";
+                    duplicate: "duplicate";
+                    invalid_signature: "invalid_signature";
+                    timeout: "timeout";
+                }>;
+                completionDelayMs: z.ZodOptional<z.ZodNumber>;
+                delayMs: z.ZodOptional<z.ZodNumber>;
+                forDeliveries: z.ZodOptional<z.ZodNumber>;
+                retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+                status: z.ZodOptional<z.ZodNumber>;
+                then: z.ZodOptional<z.ZodEnum<{
+                    rate_limited: "rate_limited";
+                    success: "success";
+                    server_error: "server_error";
+                    client_error: "client_error";
+                    defer_abandon: "defer_abandon";
+                    defer_fail: "defer_fail";
+                    defer_succeed: "defer_succeed";
+                    delay: "delay";
+                    disconnect: "disconnect";
+                    duplicate: "duplicate";
+                    invalid_signature: "invalid_signature";
+                    timeout: "timeout";
+                }>>;
+            }, z.core.$strip>;
+            project: z.ZodString;
+            updatedAt: z.ZodString;
+            url: z.ZodURL;
+        }, z.core.$strip>>;
+        freshness: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"authoritative">;
+        }, z.core.$strip>, z.ZodObject<{
+            asOf: z.ZodString;
+            kind: z.ZodLiteral<"projected">;
+            lagSeconds: z.ZodNumber;
+        }, z.core.$strip>], "kind">;
+        nextCursor: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["endpoints:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "List test sinks";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Reads one test sink from the caller's own project and test environment, including how many deliveries it has taken. A well-formed identifier belonging to another authority is indistinguishable from an absent sink.";
+    readonly example: {
+        readonly createdAt: "2026-08-07T15:00:00.000Z";
+        readonly deliveryCount: 3;
+        readonly endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly environmentKind: "test";
+        readonly id: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly program: {
+            readonly behavior: "rate_limited";
+            readonly retryAfterSeconds: 5;
+        };
+        readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly updatedAt: "2026-08-07T15:02:00.000Z";
+        readonly url: "https://sink.greatwait.dev/__greatwait/test-sinks/tsk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+    };
+    readonly id: "testsinks.read";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/test-sinks/{sinkId}";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found", "state_conflict"];
+    readonly response: z.ZodObject<{
+        createdAt: z.ZodString;
+        deliveryCount: z.ZodNumber;
+        endpoint: z.ZodString;
+        environmentKind: z.ZodLiteral<"test">;
+        id: z.ZodString;
+        program: z.ZodObject<{
+            behavior: z.ZodEnum<{
+                rate_limited: "rate_limited";
+                success: "success";
+                server_error: "server_error";
+                client_error: "client_error";
+                defer_abandon: "defer_abandon";
+                defer_fail: "defer_fail";
+                defer_succeed: "defer_succeed";
+                delay: "delay";
+                disconnect: "disconnect";
+                duplicate: "duplicate";
+                invalid_signature: "invalid_signature";
+                timeout: "timeout";
+            }>;
+            completionDelayMs: z.ZodOptional<z.ZodNumber>;
+            delayMs: z.ZodOptional<z.ZodNumber>;
+            forDeliveries: z.ZodOptional<z.ZodNumber>;
+            retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+            status: z.ZodOptional<z.ZodNumber>;
+            then: z.ZodOptional<z.ZodEnum<{
+                rate_limited: "rate_limited";
+                success: "success";
+                server_error: "server_error";
+                client_error: "client_error";
+                defer_abandon: "defer_abandon";
+                defer_fail: "defer_fail";
+                defer_succeed: "defer_succeed";
+                delay: "delay";
+                disconnect: "disconnect";
+                duplicate: "duplicate";
+                invalid_signature: "invalid_signature";
+                timeout: "timeout";
+            }>>;
+        }, z.core.$strip>;
+        project: z.ZodString;
+        updatedAt: z.ZodString;
+        url: z.ZodURL;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["endpoints:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Read a test sink";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Replaces a sink's behavior program. The program is resolved against the number of deliveries the sink has already taken, so `forDeliveries` counts from the next delivery rather than from the sink's creation. Repeating the identical program is idempotent and changes nothing an integrator can observe.";
+    readonly example: {
+        readonly createdAt: "2026-08-07T15:00:00.000Z";
+        readonly deliveryCount: 3;
+        readonly endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly environmentKind: "test";
+        readonly id: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly program: {
+            readonly behavior: "timeout";
+        };
+        readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly updatedAt: "2026-08-07T15:03:00.000Z";
+        readonly url: "https://sink.greatwait.dev/__greatwait/test-sinks/tsk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+    };
+    readonly id: "testsinks.configure";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "PUT";
+    readonly mutates: true;
+    readonly path: "/v1/test-sinks/{sinkId}/program";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found", "state_conflict"];
+    readonly request: z.ZodObject<{
+        behavior: z.ZodEnum<{
+            rate_limited: "rate_limited";
+            success: "success";
+            server_error: "server_error";
+            client_error: "client_error";
+            defer_abandon: "defer_abandon";
+            defer_fail: "defer_fail";
+            defer_succeed: "defer_succeed";
+            delay: "delay";
+            disconnect: "disconnect";
+            duplicate: "duplicate";
+            invalid_signature: "invalid_signature";
+            timeout: "timeout";
+        }>;
+        completionDelayMs: z.ZodOptional<z.ZodNumber>;
+        delayMs: z.ZodOptional<z.ZodNumber>;
+        forDeliveries: z.ZodOptional<z.ZodNumber>;
+        retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+        status: z.ZodOptional<z.ZodNumber>;
+        then: z.ZodOptional<z.ZodEnum<{
+            rate_limited: "rate_limited";
+            success: "success";
+            server_error: "server_error";
+            client_error: "client_error";
+            defer_abandon: "defer_abandon";
+            defer_fail: "defer_fail";
+            defer_succeed: "defer_succeed";
+            delay: "delay";
+            disconnect: "disconnect";
+            duplicate: "duplicate";
+            invalid_signature: "invalid_signature";
+            timeout: "timeout";
+        }>>;
+    }, z.core.$strip>;
+    readonly requestExample: {
+        readonly behavior: "timeout";
+    };
+    readonly response: z.ZodObject<{
+        createdAt: z.ZodString;
+        deliveryCount: z.ZodNumber;
+        endpoint: z.ZodString;
+        environmentKind: z.ZodLiteral<"test">;
+        id: z.ZodString;
+        program: z.ZodObject<{
+            behavior: z.ZodEnum<{
+                rate_limited: "rate_limited";
+                success: "success";
+                server_error: "server_error";
+                client_error: "client_error";
+                defer_abandon: "defer_abandon";
+                defer_fail: "defer_fail";
+                defer_succeed: "defer_succeed";
+                delay: "delay";
+                disconnect: "disconnect";
+                duplicate: "duplicate";
+                invalid_signature: "invalid_signature";
+                timeout: "timeout";
+            }>;
+            completionDelayMs: z.ZodOptional<z.ZodNumber>;
+            delayMs: z.ZodOptional<z.ZodNumber>;
+            forDeliveries: z.ZodOptional<z.ZodNumber>;
+            retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+            status: z.ZodOptional<z.ZodNumber>;
+            then: z.ZodOptional<z.ZodEnum<{
+                rate_limited: "rate_limited";
+                success: "success";
+                server_error: "server_error";
+                client_error: "client_error";
+                defer_abandon: "defer_abandon";
+                defer_fail: "defer_fail";
+                defer_succeed: "defer_succeed";
+                delay: "delay";
+                disconnect: "disconnect";
+                duplicate: "duplicate";
+                invalid_signature: "invalid_signature";
+                timeout: "timeout";
+            }>>;
+        }, z.core.$strip>;
+        project: z.ZodString;
+        updatedAt: z.ZodString;
+        url: z.ZodURL;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["endpoints:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Set a test sink behavior program";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Lists what the sink received, most recent first with the record identifier breaking a tie, bounded by the retained-delivery ceiling. Metadata only: the identifiers, the signing key that authenticated the delivery, how the receiver disposed of it, and what it answered. The delivered body is not in this shape.";
+    readonly example: {
+        readonly data: readonly [{
+            readonly behavior: "success";
+            readonly delivery: "dlv_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly disposition: "processed";
+            readonly id: "tsd_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly keyId: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly occurrenceId: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly receivedAt: "2026-08-07T15:02:00.000Z";
+            readonly respondedWith: 200;
+            readonly scheduleId: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly sink: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        }];
+        readonly freshness: {
+            readonly kind: "authoritative";
+        };
+    };
+    readonly id: "sinkdeliveries.list";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/test-sinks/{sinkId}/deliveries";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found", "state_conflict"];
+    readonly query: z.ZodObject<{
+        cursor: z.ZodOptional<z.ZodString>;
+        limit: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        data: z.ZodArray<z.ZodObject<{
+            behavior: z.ZodEnum<{
+                rate_limited: "rate_limited";
+                success: "success";
+                server_error: "server_error";
+                client_error: "client_error";
+                defer_abandon: "defer_abandon";
+                defer_fail: "defer_fail";
+                defer_succeed: "defer_succeed";
+                delay: "delay";
+                disconnect: "disconnect";
+                duplicate: "duplicate";
+                invalid_signature: "invalid_signature";
+                timeout: "timeout";
+            }>;
+            disposition: z.ZodEnum<{
+                duplicate: "duplicate";
+                invalid_signature: "invalid_signature";
+                body_too_large: "body_too_large";
+                handler_failed: "handler_failed";
+                in_flight: "in_flight";
+                invalid_envelope: "invalid_envelope";
+                invalid_headers: "invalid_headers";
+                processed: "processed";
+                replay: "replay";
+                stale_timestamp: "stale_timestamp";
+                connection_dropped: "connection_dropped";
+            }>;
+            delivery: z.ZodString;
+            id: z.ZodString;
+            keyId: z.ZodOptional<z.ZodString>;
+            occurrenceId: z.ZodOptional<z.ZodString>;
+            receivedAt: z.ZodString;
+            respondedWith: z.ZodOptional<z.ZodNumber>;
+            scheduleId: z.ZodOptional<z.ZodString>;
+            sink: z.ZodString;
+        }, z.core.$strip>>;
+        freshness: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"authoritative">;
+        }, z.core.$strip>, z.ZodObject<{
+            asOf: z.ZodString;
+            kind: z.ZodLiteral<"projected">;
+            lagSeconds: z.ZodNumber;
+        }, z.core.$strip>], "kind">;
+        nextCursor: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["endpoints:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "List test sink deliveries";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Reads one recorded delivery including the exact bytes that arrived, truncated at the published cap with the original length stated. This is the one place a callback body is readable, and it is narrow on purpose: a test environment only, the creating authority only, a single record rather than a listing, and never a log. The signature is included because a MAC is not secret and comparing it against a locally computed one is how a body-mutation bug is found; no signing key appears in this shape.";
+    readonly example: {
+        readonly behavior: "success";
+        readonly body: "{\"version\":\"2026-08-08\",\"type\":\"schedule.occurrence\",\"scheduleId\":\"sch_01h8xyz9k2m4n6p8r0t2v4w6y8\",\"occurrenceId\":\"occ_01h8xyz9k2m4n6p8r0t2v4w6y8\",\"plannedFor\":\"2026-08-07T15:00:00.000Z\",\"attempt\":1,\"trigger\":{\"kind\":\"automatic\"},\"data\":{}}";
+        readonly bodyTruncated: false;
+        readonly delivery: "dlv_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly disposition: "processed";
+        readonly id: "tsd_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly keyId: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly occurrenceId: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly receivedAt: "2026-08-07T15:02:00.000Z";
+        readonly receivedBytes: 240;
+        readonly respondedWith: 200;
+        readonly scheduleId: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly signature: "v1=11135fdfc0bc5d49ebcc9d3a0d8df1116179097cefe961c6eca281339e5cfab3";
+        readonly sink: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+    };
+    readonly id: "sinkdeliveries.read";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly kind: "unavailable";
+        readonly reason: "The only operation that returns a delivered callback body. An agent handed it would put customer payload into ordinary tool history, which is the disclosure the narrow exception was written to avoid.";
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/test-sinks/{sinkId}/deliveries/{deliveryRecordId}";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found", "state_conflict"];
+    readonly response: z.ZodObject<{
+        behavior: z.ZodEnum<{
+            rate_limited: "rate_limited";
+            success: "success";
+            server_error: "server_error";
+            client_error: "client_error";
+            defer_abandon: "defer_abandon";
+            defer_fail: "defer_fail";
+            defer_succeed: "defer_succeed";
+            delay: "delay";
+            disconnect: "disconnect";
+            duplicate: "duplicate";
+            invalid_signature: "invalid_signature";
+            timeout: "timeout";
+        }>;
+        disposition: z.ZodEnum<{
+            duplicate: "duplicate";
+            invalid_signature: "invalid_signature";
+            body_too_large: "body_too_large";
+            handler_failed: "handler_failed";
+            in_flight: "in_flight";
+            invalid_envelope: "invalid_envelope";
+            invalid_headers: "invalid_headers";
+            processed: "processed";
+            replay: "replay";
+            stale_timestamp: "stale_timestamp";
+            connection_dropped: "connection_dropped";
+        }>;
+        delivery: z.ZodString;
+        id: z.ZodString;
+        keyId: z.ZodOptional<z.ZodString>;
+        occurrenceId: z.ZodOptional<z.ZodString>;
+        receivedAt: z.ZodString;
+        respondedWith: z.ZodOptional<z.ZodNumber>;
+        scheduleId: z.ZodOptional<z.ZodString>;
+        sink: z.ZodString;
+        body: z.ZodString;
+        bodyTruncated: z.ZodBoolean;
+        receivedBytes: z.ZodNumber;
+        signature: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["endpoints:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Read a test sink delivery";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Deletes a sink and every delivery it recorded. The bound callback endpoint is untouched and keeps its signing keys; deliveries sent afterwards find nothing at the url and fail the way an unreachable receiver does.";
+    readonly example: {
+        readonly createdAt: "2026-08-07T15:00:00.000Z";
+        readonly deliveryCount: 3;
+        readonly endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly environmentKind: "test";
+        readonly id: "tsk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly program: {
+            readonly behavior: "success";
+        };
+        readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly updatedAt: "2026-08-07T15:04:00.000Z";
+        readonly url: "https://sink.greatwait.dev/__greatwait/test-sinks/tsk_01h8xyz9k2m4n6p8r0t2v4w6y8";
+    };
+    readonly id: "testsinks.delete";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: true;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "DELETE";
+    readonly mutates: true;
+    readonly path: "/v1/test-sinks/{sinkId}";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found", "state_conflict"];
+    readonly response: z.ZodObject<{
+        createdAt: z.ZodString;
+        deliveryCount: z.ZodNumber;
+        endpoint: z.ZodString;
+        environmentKind: z.ZodLiteral<"test">;
+        id: z.ZodString;
+        program: z.ZodObject<{
+            behavior: z.ZodEnum<{
+                rate_limited: "rate_limited";
+                success: "success";
+                server_error: "server_error";
+                client_error: "client_error";
+                defer_abandon: "defer_abandon";
+                defer_fail: "defer_fail";
+                defer_succeed: "defer_succeed";
+                delay: "delay";
+                disconnect: "disconnect";
+                duplicate: "duplicate";
+                invalid_signature: "invalid_signature";
+                timeout: "timeout";
+            }>;
+            completionDelayMs: z.ZodOptional<z.ZodNumber>;
+            delayMs: z.ZodOptional<z.ZodNumber>;
+            forDeliveries: z.ZodOptional<z.ZodNumber>;
+            retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+            status: z.ZodOptional<z.ZodNumber>;
+            then: z.ZodOptional<z.ZodEnum<{
+                rate_limited: "rate_limited";
+                success: "success";
+                server_error: "server_error";
+                client_error: "client_error";
+                defer_abandon: "defer_abandon";
+                defer_fail: "defer_fail";
+                defer_succeed: "defer_succeed";
+                delay: "delay";
+                disconnect: "disconnect";
+                duplicate: "duplicate";
+                invalid_signature: "invalid_signature";
+                timeout: "timeout";
+            }>>;
+        }, z.core.$strip>;
+        project: z.ZodString;
+        updatedAt: z.ZodString;
+        url: z.ZodURL;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["endpoints:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Delete a test sink";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: true;
+    readonly description: "Pins the mock's behavior and clock so an integrator can rehearse success, refusal, retry, timeout, ambiguity, and redelivery deterministically. Mock-only, and never evidence that the real runtime behaves this way.";
+    readonly example: {
+        readonly behavior: "retry";
+        readonly now: "2026-01-01T00:00:00.000Z";
+        readonly scenarioId: "scenario-1";
+    };
+    readonly id: "mock.setScenario";
+    readonly idempotent: false;
+    readonly mcp: {
+        readonly kind: "unavailable";
+        readonly reason: "The contract mock's control plane. An agent handed this would call it against the real service.";
+    };
+    readonly method: "POST";
+    readonly mutates: true;
+    readonly path: "/_contract/scenarios";
+    readonly principals: readonly [];
+    readonly problems: readonly ["invalid_request"];
+    readonly request: z.ZodObject<{
+        behavior: z.ZodEnum<{
+            success: "success";
+            redelivery: "redelivery";
+            ambiguous: "ambiguous";
+            refusal: "refusal";
+            timeout: "timeout";
+            retry: "retry";
+        }>;
+        now: z.ZodOptional<z.ZodString>;
+        failuresBeforeSuccess: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+    readonly requestExample: {
+        readonly behavior: "retry";
+        readonly failuresBeforeSuccess: 2;
+    };
+    readonly response: z.ZodObject<{
+        behavior: z.ZodEnum<{
+            success: "success";
+            redelivery: "redelivery";
+            ambiguous: "ambiguous";
+            refusal: "refusal";
+            timeout: "timeout";
+            retry: "retry";
+        }>;
+        now: z.ZodString;
+        scenarioId: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly [];
+    readonly summary: "Set the mock scenario";
+    readonly surfaces: readonly ["mock"];
+}, {
+    readonly creates: true;
+    readonly description: "Issues an API credential bound to one project and environment, with scopes capped by the issuing member's current role. The full secret is in this response and in no other, is not recoverable afterwards, and there is deliberately no reveal endpoint. The value is the sixteen-character display prefix followed immediately by thirty-two more characters; the example below is a visible placeholder rather than that shape, because a realistic credential in a committed file is one the repository's own secret scanner refuses.";
+    readonly example: {
+        readonly createdAt: "2026-07-28T15:00:00.000Z";
+        readonly displayPrefix: "pt_test_a1b2c3d4";
+        readonly environmentKind: "test";
+        readonly id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly scopes: readonly ["schedules:write"];
+        readonly secret: "pt_test_a1b2c3d4<the-32-character-secret-half-here>";
+        readonly shownOnce: true;
+    };
+    readonly id: "credentials.create";
+    readonly idempotent: false;
+    readonly mcp: {
+        readonly kind: "unavailable";
+        readonly reason: "Issuance is authenticated by a signed-in member. MCP carries API credentials and OAuth tokens, and `POST /v1/credentials` refuses both.";
+    };
+    readonly method: "POST";
+    readonly mutates: true;
+    readonly path: "/v1/credentials";
+    readonly principals: readonly ["session"];
+    readonly problems: readonly ["invalid_request", "not_found"];
+    readonly request: z.ZodObject<{
+        environmentKind: z.ZodEnum<{
+            test: "test";
+            live: "live";
+        }>;
+        project: z.ZodString;
+        scopes: z.ZodArray<z.ZodEnum<{
+            "credentials:administer": "credentials:administer";
+            "credentials:read": "credentials:read";
+            "credentials:write": "credentials:write";
+            "endpoints:read": "endpoints:read";
+            "endpoints:write": "endpoints:write";
+            "forecast:read": "forecast:read";
+            "grants:read": "grants:read";
+            "grants:write": "grants:write";
+            "occurrences:read": "occurrences:read";
+            "occurrences:redeliver": "occurrences:redeliver";
+            "projects:read": "projects:read";
+            "projects:write": "projects:write";
+            "schedules:read": "schedules:read";
+            "schedules:write": "schedules:write";
+            "usage:read": "usage:read";
+        }>>;
+    }, z.core.$strip>;
+    readonly requestExample: {
+        readonly environmentKind: "test";
+        readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly scopes: readonly ["schedules:write"];
+    };
+    readonly response: z.ZodObject<{
+        createdAt: z.ZodString;
+        displayPrefix: z.ZodString;
+        environmentKind: z.ZodEnum<{
+            test: "test";
+            live: "live";
+        }>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        id: z.ZodString;
+        issuedBy: z.ZodOptional<z.ZodString>;
+        lastUsedAt: z.ZodOptional<z.ZodString>;
+        project: z.ZodString;
+        revokedAt: z.ZodOptional<z.ZodString>;
+        supersededBy: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodArray<z.ZodEnum<{
+            "credentials:administer": "credentials:administer";
+            "credentials:read": "credentials:read";
+            "credentials:write": "credentials:write";
+            "endpoints:read": "endpoints:read";
+            "endpoints:write": "endpoints:write";
+            "forecast:read": "forecast:read";
+            "grants:read": "grants:read";
+            "grants:write": "grants:write";
+            "occurrences:read": "occurrences:read";
+            "occurrences:redeliver": "occurrences:redeliver";
+            "projects:read": "projects:read";
+            "projects:write": "projects:write";
+            "schedules:read": "schedules:read";
+            "schedules:write": "schedules:write";
+            "usage:read": "usage:read";
+        }>>;
+        secret: z.ZodString;
+        shownOnce: z.ZodLiteral<true>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["credentials:write"];
+    readonly sessionAuthority: "request-body";
+    readonly summary: "Issue an API credential";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Lists the credentials issued for the caller's own project and environment, oldest first, one page at a time. The authority tuple comes from the verified principal, so there is no parameter that could name another project — a listing is the caller's own book or nothing. Revoked and rotated credentials stay in the listing and carry the fields that say so; a credential nobody can see is a credential nobody can audit. `limit` is bounded by the contract and `cursor` is the opaque value the previous page returned. No page carries a secret: the item is the read shape, which has no field one could be put in.";
+    readonly example: {
+        readonly data: readonly [{
+            readonly createdAt: "2026-07-28T15:00:00.000Z";
+            readonly displayPrefix: "pt_test_a1b2c3d4";
+            readonly environmentKind: "test";
+            readonly id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly lastUsedAt: "2026-07-28T15:04:00.000Z";
+            readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly scopes: readonly ["schedules:write"];
+        }];
+        readonly freshness: {
+            readonly kind: "authoritative";
+        };
+        readonly nextCursor: "eyJhIjoxNzg1MjUwODAwMDAwLCJpIjoiYWtfMDFoOHh5ejlrMm00bjZwOHIwdDJ2NHc2eTgiLCJrIjoiOTUxMzU0NmYifQ";
+    };
+    readonly id: "credentials.list";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/credentials";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request"];
+    readonly query: z.ZodObject<{
+        cursor: z.ZodOptional<z.ZodString>;
+        limit: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        data: z.ZodArray<z.ZodObject<{
+            createdAt: z.ZodString;
+            displayPrefix: z.ZodString;
+            environmentKind: z.ZodEnum<{
+                test: "test";
+                live: "live";
+            }>;
+            expiresAt: z.ZodOptional<z.ZodString>;
+            id: z.ZodString;
+            issuedBy: z.ZodOptional<z.ZodString>;
+            lastUsedAt: z.ZodOptional<z.ZodString>;
+            project: z.ZodString;
+            revokedAt: z.ZodOptional<z.ZodString>;
+            supersededBy: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodArray<z.ZodEnum<{
+                "credentials:administer": "credentials:administer";
+                "credentials:read": "credentials:read";
+                "credentials:write": "credentials:write";
+                "endpoints:read": "endpoints:read";
+                "endpoints:write": "endpoints:write";
+                "forecast:read": "forecast:read";
+                "grants:read": "grants:read";
+                "grants:write": "grants:write";
+                "occurrences:read": "occurrences:read";
+                "occurrences:redeliver": "occurrences:redeliver";
+                "projects:read": "projects:read";
+                "projects:write": "projects:write";
+                "schedules:read": "schedules:read";
+                "schedules:write": "schedules:write";
+                "usage:read": "usage:read";
+            }>>;
+        }, z.core.$strip>>;
+        freshness: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"authoritative">;
+        }, z.core.$strip>, z.ZodObject<{
+            asOf: z.ZodString;
+            kind: z.ZodLiteral<"projected">;
+            lagSeconds: z.ZodNumber;
+        }, z.core.$strip>], "kind">;
+        nextCursor: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["credentials:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "List API credentials";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Lists the projects in the signed-in member's organization that they may act in, with the environment kinds each one has. This is what a browser asks before it can address anything else: an API credential and an OAuth token each carry one project intrinsically, but a member belongs to an organization and chooses. Archived and deleted projects are omitted, because a member cannot act in one. The result is a display aid rather than an authorization control — naming a project on a later request re-resolves it against the member's own organization, and a project that is not theirs answers exactly as one that does not exist.";
+    readonly example: {
+        readonly data: readonly [{
+            readonly environmentKinds: readonly ["test", "live"];
+            readonly id: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly name: "Billing reminders";
+        }];
+    };
+    readonly id: "projects.list";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly kind: "unavailable";
+        readonly reason: "Enumerating an organization's projects is a signed-in member's question. MCP carries API credentials and OAuth tokens, whose authority already is one project, and this operation accepts neither.";
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/projects";
+    readonly principals: readonly ["session"];
+    readonly problems: readonly [];
+    readonly response: z.ZodObject<{
+        data: z.ZodArray<z.ZodObject<{
+            environmentKinds: z.ZodArray<z.ZodEnum<{
+                test: "test";
+                live: "live";
+            }>>;
+            id: z.ZodString;
+            name: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["projects:read"];
+    readonly sessionAuthority: "organization";
+    readonly summary: "List the member's projects";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: true;
+    readonly description: "Creates a project in the signed-in member's organization, with both of its environments. This is the first call a new customer makes: an organization has no project until somebody makes one, and every other operation on this surface acts inside one. The `test` and `live` environments are provisioned with it in a single transaction rather than asked for, so a project is never observable in a half-provisioned state. The organization comes from the verified session and is never read from the request — a member who belongs to one organization cannot create a project in another. `PROJECT_LIST_LIMIT` bounds how many an organization may hold, and it is the same ceiling the listing publishes: a create that would take an organization past a list it can no longer return is refused rather than silently truncating a later read.";
+    readonly example: {
+        readonly environmentKinds: readonly ["test", "live"];
+        readonly id: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly name: "Billing reminders";
+    };
+    readonly id: "projects.create";
+    readonly idempotent: false;
+    readonly mcp: {
+        readonly kind: "unavailable";
+        readonly reason: "Creating a project is a signed-in member's act. MCP carries API credentials and OAuth tokens, whose authority already is one project — so this operation accepts neither, and an agent that somehow created one could not act in it.";
+    };
+    readonly method: "POST";
+    readonly mutates: true;
+    readonly path: "/v1/projects";
+    readonly principals: readonly ["session"];
+    readonly problems: readonly ["invalid_request", "plan_limit_reached"];
+    readonly request: z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$strip>;
+    readonly requestExample: {
+        readonly name: "Billing reminders";
+    };
+    readonly response: z.ZodObject<{
+        environmentKinds: z.ZodArray<z.ZodEnum<{
+            test: "test";
+            live: "live";
+        }>>;
+        id: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["projects:write"];
+    readonly sessionAuthority: "organization";
+    readonly summary: "Create a project";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Lists the applications this member has connected to their own account, newest first, across every project in their organization — because a person connects an application, not a project. Revoked connections stay in the listing with the instant and the reason they ended: a connection nobody can see is one nobody can audit. This is a signed-in member's view of their own delegations. An application holding a grant cannot read it, which is why the operation accepts no API credential and no access token, and why it is on no agent's tool list.";
+    readonly example: {
+        readonly data: readonly [{
+            readonly client: {
+                readonly id: "oc_01h8xyz9k2m4n6p8r0t2v4w6y8";
+                readonly name: "Flow XO";
+            };
+            readonly createdAt: "2026-08-14T11:00:00.000Z";
+            readonly environmentKind: "test";
+            readonly id: "og_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly lastUsedAt: "2026-08-15T09:12:00.000Z";
+            readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly scopes: readonly ["schedules:read", "schedules:write"];
+            readonly status: "active";
+        }];
+    };
+    readonly id: "grants.list";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly kind: "unavailable";
+        readonly reason: "A member's own connected applications. MCP carries API credentials and OAuth tokens, and an application holding a grant must not be able to enumerate its rivals — still less disconnect them — so this operation accepts neither.";
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/grants";
+    readonly principals: readonly ["session"];
+    readonly problems: readonly [];
+    readonly response: z.ZodObject<{
+        data: z.ZodArray<z.ZodObject<{
+            client: z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+            }, z.core.$strip>;
+            createdAt: z.ZodString;
+            environmentKind: z.ZodEnum<{
+                test: "test";
+                live: "live";
+            }>;
+            id: z.ZodString;
+            lastUsedAt: z.ZodOptional<z.ZodString>;
+            project: z.ZodString;
+            revocationReason: z.ZodOptional<z.ZodEnum<{
+                "authorization-code-replayed": "authorization-code-replayed";
+                "client-revoked": "client-revoked";
+                "member-revoked": "member-revoked";
+                "refresh-token-replayed": "refresh-token-replayed";
+            }>>;
+            revokedAt: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodArray<z.ZodEnum<{
+                "credentials:administer": "credentials:administer";
+                "credentials:read": "credentials:read";
+                "credentials:write": "credentials:write";
+                "endpoints:read": "endpoints:read";
+                "endpoints:write": "endpoints:write";
+                "forecast:read": "forecast:read";
+                "grants:read": "grants:read";
+                "grants:write": "grants:write";
+                "occurrences:read": "occurrences:read";
+                "occurrences:redeliver": "occurrences:redeliver";
+                "projects:read": "projects:read";
+                "projects:write": "projects:write";
+                "schedules:read": "schedules:read";
+                "schedules:write": "schedules:write";
+                "usage:read": "usage:read";
+            }>>;
+            status: z.ZodEnum<{
+                active: "active";
+                revoked: "revoked";
+            }>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["grants:read"];
+    readonly sessionAuthority: "member";
+    readonly summary: "List the member's connected applications";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Disconnects one application, ending every token that grant ever issued — the access tokens and the refresh token together. The grant stays readable afterwards with the instant and the reason it ended. Only the member who granted it can disconnect it, and a grant belonging to somebody else answers exactly as one that does not exist.";
+    readonly example: {
+        readonly grant: {
+            readonly client: {
+                readonly id: "oc_01h8xyz9k2m4n6p8r0t2v4w6y8";
+                readonly name: "Flow XO";
+            };
+            readonly createdAt: "2026-08-14T11:00:00.000Z";
+            readonly environmentKind: "test";
+            readonly id: "og_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly revocationReason: "member-revoked";
+            readonly revokedAt: "2026-08-15T10:00:00.000Z";
+            readonly scopes: readonly ["schedules:read", "schedules:write"];
+            readonly status: "revoked";
+        };
+    };
+    readonly id: "grants.revoke";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly kind: "unavailable";
+        readonly reason: "Disconnecting an application is the member's own act. MCP carries API credentials and OAuth tokens, and an application able to disconnect a grant could disconnect the ones belonging to every other application the member has connected.";
+    };
+    readonly method: "DELETE";
+    readonly mutates: true;
+    readonly path: "/v1/grants/{grantId}";
+    readonly principals: readonly ["session"];
+    readonly problems: readonly ["not_found"];
+    readonly response: z.ZodObject<{
+        grant: z.ZodObject<{
+            client: z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+            }, z.core.$strip>;
+            createdAt: z.ZodString;
+            environmentKind: z.ZodEnum<{
+                test: "test";
+                live: "live";
+            }>;
+            id: z.ZodString;
+            lastUsedAt: z.ZodOptional<z.ZodString>;
+            project: z.ZodString;
+            revocationReason: z.ZodOptional<z.ZodEnum<{
+                "authorization-code-replayed": "authorization-code-replayed";
+                "client-revoked": "client-revoked";
+                "member-revoked": "member-revoked";
+                "refresh-token-replayed": "refresh-token-replayed";
+            }>>;
+            revokedAt: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodArray<z.ZodEnum<{
+                "credentials:administer": "credentials:administer";
+                "credentials:read": "credentials:read";
+                "credentials:write": "credentials:write";
+                "endpoints:read": "endpoints:read";
+                "endpoints:write": "endpoints:write";
+                "forecast:read": "forecast:read";
+                "grants:read": "grants:read";
+                "grants:write": "grants:write";
+                "occurrences:read": "occurrences:read";
+                "occurrences:redeliver": "occurrences:redeliver";
+                "projects:read": "projects:read";
+                "projects:write": "projects:write";
+                "schedules:read": "schedules:read";
+                "schedules:write": "schedules:write";
+                "usage:read": "usage:read";
+            }>>;
+            status: z.ZodEnum<{
+                active: "active";
+                revoked: "revoked";
+            }>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["grants:write"];
+    readonly sessionAuthority: "member";
+    readonly summary: "Disconnect an application";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: true;
+    readonly description: "Replaces a credential with a new one and gives the original a deadline, so consumers can pick up the new secret before the old stops working. The replacement is a new credential with its own identifier and the same authority and scopes; the original keeps working until it expires, then refuses with `credential_expired` rather than `credential_revoked`. `overlapSeconds` may only shorten the window — the default is also the maximum — and zero retires the original immediately. The new secret is in this response and in no other.";
+    readonly example: {
+        readonly credential: {
+            readonly createdAt: "2026-07-28T15:00:00.000Z";
+            readonly displayPrefix: "pt_test_e5f6g7h8";
+            readonly environmentKind: "test";
+            readonly id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y9";
+            readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly scopes: readonly ["schedules:write"];
+            readonly secret: "pt_test_e5f6g7h8<the-32-character-secret-half-here>";
+            readonly shownOnce: true;
+        };
+        readonly retired: {
+            readonly createdAt: "2026-07-28T15:00:00.000Z";
+            readonly displayPrefix: "pt_test_a1b2c3d4";
+            readonly environmentKind: "test";
+            readonly expiresAt: "2026-07-29T15:00:00.000Z";
+            readonly id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly scopes: readonly ["schedules:write"];
+            readonly supersededBy: "ak_01h8xyz9k2m4n6p8r0t2v4w6y9";
+        };
+    };
+    readonly id: "credentials.rotate";
+    readonly mcp: {
+        readonly destructive: true;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly idempotent: false;
+    readonly method: "POST";
+    readonly mutates: true;
+    readonly path: "/v1/credentials/{credentialId}/rotate";
+    readonly conditionalScopes: readonly ["credentials:administer"];
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found", "scope_missing"];
+    readonly request: z.ZodObject<{
+        overlapSeconds: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+    readonly requestExample: {
+        readonly overlapSeconds: 3600;
+    };
+    readonly response: z.ZodObject<{
+        credential: z.ZodObject<{
+            createdAt: z.ZodString;
+            displayPrefix: z.ZodString;
+            environmentKind: z.ZodEnum<{
+                test: "test";
+                live: "live";
+            }>;
+            expiresAt: z.ZodOptional<z.ZodString>;
+            id: z.ZodString;
+            issuedBy: z.ZodOptional<z.ZodString>;
+            lastUsedAt: z.ZodOptional<z.ZodString>;
+            project: z.ZodString;
+            revokedAt: z.ZodOptional<z.ZodString>;
+            supersededBy: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodArray<z.ZodEnum<{
+                "credentials:administer": "credentials:administer";
+                "credentials:read": "credentials:read";
+                "credentials:write": "credentials:write";
+                "endpoints:read": "endpoints:read";
+                "endpoints:write": "endpoints:write";
+                "forecast:read": "forecast:read";
+                "grants:read": "grants:read";
+                "grants:write": "grants:write";
+                "occurrences:read": "occurrences:read";
+                "occurrences:redeliver": "occurrences:redeliver";
+                "projects:read": "projects:read";
+                "projects:write": "projects:write";
+                "schedules:read": "schedules:read";
+                "schedules:write": "schedules:write";
+                "usage:read": "usage:read";
+            }>>;
+            secret: z.ZodString;
+            shownOnce: z.ZodLiteral<true>;
+        }, z.core.$strip>;
+        retired: z.ZodObject<{
+            createdAt: z.ZodString;
+            displayPrefix: z.ZodString;
+            environmentKind: z.ZodEnum<{
+                test: "test";
+                live: "live";
+            }>;
+            expiresAt: z.ZodOptional<z.ZodString>;
+            id: z.ZodString;
+            issuedBy: z.ZodOptional<z.ZodString>;
+            lastUsedAt: z.ZodOptional<z.ZodString>;
+            project: z.ZodString;
+            revokedAt: z.ZodOptional<z.ZodString>;
+            supersededBy: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodArray<z.ZodEnum<{
+                "credentials:administer": "credentials:administer";
+                "credentials:read": "credentials:read";
+                "credentials:write": "credentials:write";
+                "endpoints:read": "endpoints:read";
+                "endpoints:write": "endpoints:write";
+                "forecast:read": "forecast:read";
+                "grants:read": "grants:read";
+                "grants:write": "grants:write";
+                "occurrences:read": "occurrences:read";
+                "occurrences:redeliver": "occurrences:redeliver";
+                "projects:read": "projects:read";
+                "projects:write": "projects:write";
+                "schedules:read": "schedules:read";
+                "schedules:write": "schedules:write";
+                "usage:read": "usage:read";
+            }>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["credentials:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Rotate an API credential";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Revokes a credential immediately, with no overlap. The credential stops verifying on the next request and refuses with `credential_revoked`. The row survives its revocation so the credential's history remains answerable, and revoking a credential that is already revoked reports the original revocation rather than moving it. A credential belonging to another project is indistinguishable from one that does not exist.";
+    readonly example: {
+        readonly credential: {
+            readonly createdAt: "2026-07-28T15:00:00.000Z";
+            readonly displayPrefix: "pt_test_a1b2c3d4";
+            readonly environmentKind: "test";
+            readonly id: "ak_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly revokedAt: "2026-07-28T16:00:00.000Z";
+            readonly scopes: readonly ["schedules:write"];
+        };
+    };
+    readonly id: "credentials.revoke";
+    readonly mcp: {
+        readonly destructive: true;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly idempotent: true;
+    readonly method: "DELETE";
+    readonly mutates: true;
+    readonly path: "/v1/credentials/{credentialId}";
+    readonly conditionalScopes: readonly ["credentials:administer"];
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found", "scope_missing"];
+    readonly response: z.ZodObject<{
+        credential: z.ZodObject<{
+            createdAt: z.ZodString;
+            displayPrefix: z.ZodString;
+            environmentKind: z.ZodEnum<{
+                test: "test";
+                live: "live";
+            }>;
+            expiresAt: z.ZodOptional<z.ZodString>;
+            id: z.ZodString;
+            issuedBy: z.ZodOptional<z.ZodString>;
+            lastUsedAt: z.ZodOptional<z.ZodString>;
+            project: z.ZodString;
+            revokedAt: z.ZodOptional<z.ZodString>;
+            supersededBy: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodArray<z.ZodEnum<{
+                "credentials:administer": "credentials:administer";
+                "credentials:read": "credentials:read";
+                "credentials:write": "credentials:write";
+                "endpoints:read": "endpoints:read";
+                "endpoints:write": "endpoints:write";
+                "forecast:read": "forecast:read";
+                "grants:read": "grants:read";
+                "grants:write": "grants:write";
+                "occurrences:read": "occurrences:read";
+                "occurrences:redeliver": "occurrences:redeliver";
+                "projects:read": "projects:read";
+                "projects:write": "projects:write";
+                "schedules:read": "schedules:read";
+                "schedules:write": "schedules:write";
+                "usage:read": "usage:read";
+            }>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["credentials:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Revoke an API credential";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: true;
+    readonly description: "Creates a schedule and returns it together with its first planned occurrence. Give exactly one of `at`, `delaySeconds`, `everySeconds` and `cron`. An optional `partitionKey` selects a fairness lane inside this project and environment; it is fixed after create. Add a verified `endpoint` to deliver each occurrence there; optional JSON `data` is encrypted before PostgreSQL persistence and is placed in the signed callback, never returned by schedule reads. `at` and `delaySeconds` fire once; a delay is converted to an absolute instant when the request is accepted, so a schedule created either way reads back the same afterwards. `everySeconds` is a fixed duration and its first occurrence falls one interval after acceptance — it stays the same length across a daylight-saving change, and takes no timezone for that reason. `cron` is a wall clock: it is read against the IANA `timeZone` sent with it, `UTC` when none is, and the first occurrence is the first instant the expression names after acceptance. Where the clocks go forward and the wall time named does not exist that day, the occurrence falls at the first instant after the gap; where they go back and it happens twice, it falls once, at the earlier of the two. A recurring schedule is materialized one occurrence at a time: the next one is planned once the current one is due, so a read always shows one occurrence still to come. The organization, project and environment come from the verified principal; a body cannot name them, and the endpoint must belong to the same tuple, so a credential issued for one project can only ever create schedules in that project. Send an `Idempotency-Key` to make a retry safe: the identical request returns the schedule that key already created, marked `Idempotency-Replayed: true`, and creates nothing further; the same key with a different request is refused `idempotency_key_reused`. A replay reports the schedule **as it stands now**, not a frozen copy of the first response — if it was paused in between, the replay says so.";
+    readonly example: {
+        readonly occurrence: {
+            readonly attemptCount: 0;
+            readonly generation: 1;
+            readonly id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly plannedFor: "2026-07-28T15:00:00.000Z";
+            readonly schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly sequence: 1;
+            readonly state: "planned";
+        };
+        readonly schedule: {
+            readonly createdAt: "2026-07-28T14:59:00.000Z";
+            readonly endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly generation: 1;
+            readonly id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly latencyClass: "realtime";
+            readonly partitionKey: "campaign.spring";
+            readonly recurrence: {
+                readonly kind: "at";
+            };
+            readonly status: "active";
+            readonly updatedAt: "2026-07-28T14:59:00.000Z";
+            readonly version: 1;
+        };
+    };
+    readonly id: "schedules.create";
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: true;
+    };
+    readonly idempotent: false;
+    readonly method: "POST";
+    readonly mutates: true;
+    readonly path: "/v1/schedules";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["endpoint_unverified", "idempotency_key_reused", "invalid_request", "not_found", "plan_limit_reached", "service_unavailable"];
+    readonly request: z.ZodObject<{
+        at: z.ZodOptional<z.ZodString>;
+        cron: z.ZodOptional<z.ZodString>;
+        data: z.ZodOptional<z.ZodJSONSchema>;
+        delaySeconds: z.ZodOptional<z.ZodNumber>;
+        delivery: z.ZodOptional<z.ZodObject<{
+            onOverlap: z.ZodOptional<z.ZodEnum<{
+                skip: "skip";
+                queue: "queue";
+            }>>;
+            completion: z.ZodOptional<z.ZodEnum<{
+                response: "response";
+                callback: "callback";
+            }>>;
+            maxDurationSeconds: z.ZodOptional<z.ZodLiteral<5 | 300 | 86400 | 30 | 900 | 1800 | 3600 | 43200>>;
+        }, z.core.$strict>>;
+        everySeconds: z.ZodOptional<z.ZodNumber>;
+        endpoint: z.ZodOptional<z.ZodString>;
+        latencyClass: z.ZodOptional<z.ZodEnum<{
+            realtime: "realtime";
+            bulk: "bulk";
+        }>>;
+        partitionKey: z.ZodOptional<z.ZodString>;
+        timeZone: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    }, z.core.$strict>;
+    readonly requestExample: {
+        readonly cron: "0 9 * * 1-5";
+        readonly data: {
+            readonly report: "daily";
+        };
+        readonly endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly partitionKey: "campaign.spring";
+        readonly timeZone: "Europe/London";
+    };
+    readonly requestHeaders: z.ZodObject<{
+        "Idempotency-Key": z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        occurrence: z.ZodObject<{
+            attemptCount: z.ZodNumber;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            plannedFor: z.ZodString;
+            schedule: z.ZodString;
+            sequence: z.ZodNumber;
+            settledAt: z.ZodOptional<z.ZodString>;
+            state: z.ZodEnum<{
+                succeeded: "succeeded";
+                ambiguous: "ambiguous";
+                cancelled: "cancelled";
+                planned: "planned";
+                due: "due";
+                dispatching: "dispatching";
+                retry_wait: "retry_wait";
+                terminal_failed: "terminal_failed";
+                skipped_stale: "skipped_stale";
+            }>;
+        }, z.core.$strip>;
+        schedule: z.ZodObject<{
+            archivedAt: z.ZodOptional<z.ZodString>;
+            createdAt: z.ZodString;
+            delivery: z.ZodOptional<z.ZodObject<{
+                completion: z.ZodEnum<{
+                    response: "response";
+                    callback: "callback";
+                }>;
+                maxDurationSeconds: z.ZodNumber;
+                onOverlap: z.ZodEnum<{
+                    skip: "skip";
+                    queue: "queue";
+                }>;
+            }, z.core.$strip>>;
+            endpoint: z.ZodOptional<z.ZodString>;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            latencyClass: z.ZodEnum<{
+                realtime: "realtime";
+                bulk: "bulk";
+            }>;
+            partitionKey: z.ZodOptional<z.ZodString>;
+            recurrence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"at">;
+            }, z.core.$strip>, z.ZodObject<{
+                everySeconds: z.ZodNumber;
+                kind: z.ZodLiteral<"every">;
+            }, z.core.$strip>, z.ZodObject<{
+                cron: z.ZodString;
+                kind: z.ZodLiteral<"cron">;
+                timeZone: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+            }, z.core.$strip>], "kind">;
+            status: z.ZodEnum<{
+                paused: "paused";
+                active: "active";
+                cancelled: "cancelled";
+                completed: "completed";
+            }>;
+            updatedAt: z.ZodString;
+            version: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly responseHeaders: z.ZodObject<{
+        ETag: z.ZodString;
+        "Idempotency-Replayed": z.ZodOptional<z.ZodLiteral<"true">>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["schedules:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Create a schedule";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Reads one schedule and its next occurrence from the partition that owns it. A schedule belonging to another organization, project or environment answers not_found rather than a refusal that would confirm it exists. The response carries the schedule's version as a strong ETag; send it back in `If-Match` to make a later write conditional on nothing having changed in between.";
+    readonly example: {
+        readonly occurrence: {
+            readonly attemptCount: 0;
+            readonly generation: 1;
+            readonly id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly plannedFor: "2026-07-28T15:00:00.000Z";
+            readonly schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly sequence: 1;
+            readonly state: "planned";
+        };
+        readonly schedule: {
+            readonly createdAt: "2026-07-28T14:59:00.000Z";
+            readonly endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly generation: 1;
+            readonly id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly latencyClass: "realtime";
+            readonly partitionKey: "campaign.spring";
+            readonly recurrence: {
+                readonly kind: "at";
+            };
+            readonly status: "active";
+            readonly updatedAt: "2026-07-28T14:59:00.000Z";
+            readonly version: 1;
+        };
+    };
+    readonly id: "schedules.read";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/schedules/{scheduleId}";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found"];
+    readonly response: z.ZodObject<{
+        occurrence: z.ZodObject<{
+            attemptCount: z.ZodNumber;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            plannedFor: z.ZodString;
+            schedule: z.ZodString;
+            sequence: z.ZodNumber;
+            settledAt: z.ZodOptional<z.ZodString>;
+            state: z.ZodEnum<{
+                succeeded: "succeeded";
+                ambiguous: "ambiguous";
+                cancelled: "cancelled";
+                planned: "planned";
+                due: "due";
+                dispatching: "dispatching";
+                retry_wait: "retry_wait";
+                terminal_failed: "terminal_failed";
+                skipped_stale: "skipped_stale";
+            }>;
+        }, z.core.$strip>;
+        schedule: z.ZodObject<{
+            archivedAt: z.ZodOptional<z.ZodString>;
+            createdAt: z.ZodString;
+            delivery: z.ZodOptional<z.ZodObject<{
+                completion: z.ZodEnum<{
+                    response: "response";
+                    callback: "callback";
+                }>;
+                maxDurationSeconds: z.ZodNumber;
+                onOverlap: z.ZodEnum<{
+                    skip: "skip";
+                    queue: "queue";
+                }>;
+            }, z.core.$strip>>;
+            endpoint: z.ZodOptional<z.ZodString>;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            latencyClass: z.ZodEnum<{
+                realtime: "realtime";
+                bulk: "bulk";
+            }>;
+            partitionKey: z.ZodOptional<z.ZodString>;
+            recurrence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"at">;
+            }, z.core.$strip>, z.ZodObject<{
+                everySeconds: z.ZodNumber;
+                kind: z.ZodLiteral<"every">;
+            }, z.core.$strip>, z.ZodObject<{
+                cron: z.ZodString;
+                kind: z.ZodLiteral<"cron">;
+                timeZone: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+            }, z.core.$strip>], "kind">;
+            status: z.ZodEnum<{
+                paused: "paused";
+                active: "active";
+                cancelled: "cancelled";
+                completed: "completed";
+            }>;
+            updatedAt: z.ZodString;
+            version: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly responseHeaders: z.ZodObject<{
+        ETag: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["schedules:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Read a schedule";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Lists the caller's own schedules, oldest first, one page at a time. Archived schedules are left out: archiving is how a schedule leaves the working set, and a listing that still carried them would make the operation pointless. Items are schedules rather than schedules-with-occurrences, because a cross-partition listing is served from a projection that holds a summary; read a schedule to get its authoritative next occurrence. Every page states whether it is authoritative or projected.";
+    readonly example: {
+        readonly data: readonly [{
+            readonly createdAt: "2026-07-28T14:59:00.000Z";
+            readonly endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly generation: 1;
+            readonly id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly latencyClass: "realtime";
+            readonly recurrence: {
+                readonly kind: "at";
+            };
+            readonly status: "active";
+            readonly updatedAt: "2026-07-28T14:59:00.000Z";
+            readonly version: 1;
+        }];
+        readonly freshness: {
+            readonly asOf: "2026-07-28T15:00:00.000Z";
+            readonly kind: "projected";
+            readonly lagSeconds: 0;
+        };
+        readonly nextCursor: "eyJhIjoxNzg1MjUwODAwMDAwLCJpIjoic2NoXzAxaDh4eXo5azJtNG42cDhyMHQydjR3Nnk4IiwiayI6Ijk1MTM1NDZmIn0";
+    };
+    readonly id: "schedules.list";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/schedules";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request"];
+    readonly query: z.ZodObject<{
+        cursor: z.ZodOptional<z.ZodString>;
+        limit: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        data: z.ZodArray<z.ZodObject<{
+            archivedAt: z.ZodOptional<z.ZodString>;
+            createdAt: z.ZodString;
+            delivery: z.ZodOptional<z.ZodObject<{
+                completion: z.ZodEnum<{
+                    response: "response";
+                    callback: "callback";
+                }>;
+                maxDurationSeconds: z.ZodNumber;
+                onOverlap: z.ZodEnum<{
+                    skip: "skip";
+                    queue: "queue";
+                }>;
+            }, z.core.$strip>>;
+            endpoint: z.ZodOptional<z.ZodString>;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            latencyClass: z.ZodEnum<{
+                realtime: "realtime";
+                bulk: "bulk";
+            }>;
+            partitionKey: z.ZodOptional<z.ZodString>;
+            recurrence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"at">;
+            }, z.core.$strip>, z.ZodObject<{
+                everySeconds: z.ZodNumber;
+                kind: z.ZodLiteral<"every">;
+            }, z.core.$strip>, z.ZodObject<{
+                cron: z.ZodString;
+                kind: z.ZodLiteral<"cron">;
+                timeZone: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+            }, z.core.$strip>], "kind">;
+            status: z.ZodEnum<{
+                paused: "paused";
+                active: "active";
+                cancelled: "cancelled";
+                completed: "completed";
+            }>;
+            updatedAt: z.ZodString;
+            version: z.ZodNumber;
+        }, z.core.$strip>>;
+        freshness: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"authoritative">;
+        }, z.core.$strip>, z.ZodObject<{
+            asOf: z.ZodString;
+            kind: z.ZodLiteral<"projected">;
+            lagSeconds: z.ZodNumber;
+        }, z.core.$strip>], "kind">;
+        nextCursor: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["schedules:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "List schedules";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Counts the occurrences this project and environment expect to fire, in epoch-aligned time buckets, with a latency-class split on every bucket and an optional customer partition-key breakdown. A recurring series contributes every instant it fires inside the window rather than only its next one, and `nextFireCount` reports how many of a bucket's occurrences are a schedule's next firing. The answer states its own freshness and is refused rather than shortened when a partition cannot complete it. It carries counts only: no schedule identifier, callback destination, payload or endpoint detail has a field in the response.";
+    readonly example: {
+        readonly buckets: readonly [{
+            readonly byLatencyClass: {
+                readonly bulk: 12;
+                readonly realtime: 3;
+            };
+            readonly byPartitionKey: {
+                readonly "campaign.spring": 9;
+                readonly "campaign.winter": 4;
+            };
+            readonly count: 15;
+            readonly nextFireCount: 4;
+            readonly otherPartitionKeyCount: 2;
+            readonly start: "2026-07-28T15:00:00.000Z";
+        }];
+        readonly freshness: {
+            readonly asOf: "2026-07-28T14:58:30.000Z";
+            readonly kind: "projected";
+            readonly lagSeconds: 90;
+        };
+        readonly window: {
+            readonly bucketSeconds: 1800;
+            readonly from: "2026-07-28T15:00:00.000Z";
+            readonly to: "2026-07-29T15:00:00.000Z";
+        };
+    };
+    readonly id: "forecast.read";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/forecast";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request"];
+    readonly query: z.ZodObject<{
+        breakdown: z.ZodDefault<z.ZodEnum<{
+            none: "none";
+            partitionKey: "partitionKey";
+        }>>;
+        bucketSeconds: z.ZodDefault<z.ZodNumber>;
+        from: z.ZodOptional<z.ZodString>;
+        to: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        buckets: z.ZodArray<z.ZodObject<{
+            byLatencyClass: z.ZodObject<{
+                bulk: z.ZodNumber;
+                realtime: z.ZodNumber;
+            }, z.core.$strip>;
+            byPartitionKey: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+            count: z.ZodNumber;
+            nextFireCount: z.ZodNumber;
+            otherPartitionKeyCount: z.ZodOptional<z.ZodNumber>;
+            start: z.ZodString;
+        }, z.core.$strip>>;
+        freshness: z.ZodObject<{
+            asOf: z.ZodString;
+            kind: z.ZodLiteral<"projected">;
+            lagSeconds: z.ZodNumber;
+        }, z.core.$strip>;
+        window: z.ZodObject<{
+            bucketSeconds: z.ZodNumber;
+            from: z.ZodString;
+            to: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["forecast:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Forecast upcoming occurrences";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "What this project was charged for, by UTC day, from the authoritative scheduling model. One terminal occurrence is one billable unit however many attempts it took, so a schedule that failed four times and succeeded on the fifth appears here once; the attempts it cost are on that occurrence's own attempt history. Days with no billable occurrence are absent rather than zero, and the window states which days the answer covers. `from` and `to` are snapped outward to UTC midnight, so an answer always covers whole days.";
+    readonly example: {
+        readonly days: readonly [{
+            readonly billableOccurrences: 42;
+            readonly byTerminalState: {
+                readonly succeeded: 40;
+                readonly terminal_failed: 2;
+            };
+            readonly start: "2026-07-28T00:00:00.000Z";
+        }];
+        readonly freshness: {
+            readonly kind: "authoritative";
+        };
+        readonly totalBillableOccurrences: 42;
+        readonly window: {
+            readonly from: "2026-07-28T00:00:00.000Z";
+            readonly to: "2026-07-29T00:00:00.000Z";
+        };
+    };
+    readonly id: "usage.read";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/usage";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request"];
+    readonly query: z.ZodObject<{
+        from: z.ZodOptional<z.ZodString>;
+        to: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    readonly response: z.ZodObject<{
+        days: z.ZodArray<z.ZodObject<{
+            billableOccurrences: z.ZodNumber;
+            byTerminalState: z.ZodRecord<z.ZodEnum<{
+                succeeded: "succeeded";
+                cancelled: "cancelled";
+                terminal_failed: "terminal_failed";
+                skipped_stale: "skipped_stale";
+            }> & z.core.$partial, z.ZodNumber>;
+            start: z.ZodString;
+        }, z.core.$strip>>;
+        freshness: z.ZodObject<{
+            kind: z.ZodLiteral<"authoritative">;
+        }, z.core.$strip>;
+        totalBillableOccurrences: z.ZodNumber;
+        window: z.ZodObject<{
+            from: z.ZodString;
+            to: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["usage:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Read billable usage by day";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "The same forecast in the window shape the legacy scheduler's autoscaler already parses, published under a dated version so a consumer can pin it. It exists for one migration and is expected to be withdrawn once that migration completes; `forecast.read` is the shape this product publishes. `byTenant` is the customer partition-key breakdown under its legacy name, and `count` is always the bucket total rather than the named subtotal.";
+    readonly example: {
+        readonly bucketSeconds: 600;
+        readonly buckets: readonly [{
+            readonly byTenant: {
+                readonly "campaign.spring": 9;
+                readonly "campaign.winter": 4;
+            };
+            readonly count: 15;
+            readonly nextFireCount: 4;
+            readonly otherCount: 2;
+            readonly start: "2026-07-28T15:00:00.000Z";
+        }];
+        readonly freshness: {
+            readonly asOf: "2026-07-28T14:58:30.000Z";
+            readonly kind: "projected";
+            readonly lagSeconds: 90;
+        };
+        readonly version: "2026-08-09";
+    };
+    readonly id: "forecast.windows";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly kind: "unavailable";
+        readonly reason: "A transitional shape for the autoscaler migration, scheduled for withdrawal once W6-02 has cut over. forecast.read is the same data in the shape this product publishes, and it is the tool an agent should reach for.";
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/forecast/windows";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request"];
+    readonly query: z.ZodObject<{
+        breakdown: z.ZodDefault<z.ZodEnum<{
+            none: "none";
+            partitionKey: "partitionKey";
+        }>>;
+        bucketSeconds: z.ZodDefault<z.ZodNumber>;
+        from: z.ZodOptional<z.ZodString>;
+        to: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        bucketSeconds: z.ZodNumber;
+        buckets: z.ZodArray<z.ZodObject<{
+            byTenant: z.ZodRecord<z.ZodString, z.ZodNumber>;
+            count: z.ZodNumber;
+            nextFireCount: z.ZodNumber;
+            otherCount: z.ZodNumber;
+            start: z.ZodString;
+        }, z.core.$strip>>;
+        freshness: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"authoritative">;
+        }, z.core.$strip>, z.ZodObject<{
+            asOf: z.ZodString;
+            kind: z.ZodLiteral<"projected">;
+            lagSeconds: z.ZodNumber;
+        }, z.core.$strip>], "kind">;
+        version: z.ZodLiteral<"2026-08-09">;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["forecast:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Forecast in the transitional window shape";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Lists the retained occurrences of one schedule from its authoritative Scheduler Partition, ordered by durable creation instant and occurrence identifier so tied timestamps never duplicate or omit a row. The cursor is opaque and scoped to the verified principal's organization, project and environment. Each item is metadata only: callback payloads, destinations, response bodies and signing material have no field in the response.";
+    readonly example: {
+        readonly data: readonly [{
+            readonly attemptCount: 1;
+            readonly generation: 1;
+            readonly id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly plannedFor: "2026-07-28T15:00:00.000Z";
+            readonly schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly sequence: 1;
+            readonly state: "retry_wait";
+        }];
+        readonly freshness: {
+            readonly kind: "authoritative";
+        };
+        readonly nextCursor: "eyJhIjoxNzg1MjUwODAwMDAwLCJpIjoib2NjXzAxaDh4eXo5azJtNG42cDhyMHQydjR3Nnk4IiwiayI6Ijk1MTM1NDZmIn0";
+    };
+    readonly id: "occurrences.list";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/schedules/{scheduleId}/occurrences";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found"];
+    readonly query: z.ZodObject<{
+        cursor: z.ZodOptional<z.ZodString>;
+        limit: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        data: z.ZodArray<z.ZodObject<{
+            attemptCount: z.ZodNumber;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            plannedFor: z.ZodString;
+            schedule: z.ZodString;
+            sequence: z.ZodNumber;
+            settledAt: z.ZodOptional<z.ZodString>;
+            state: z.ZodEnum<{
+                succeeded: "succeeded";
+                ambiguous: "ambiguous";
+                cancelled: "cancelled";
+                planned: "planned";
+                due: "due";
+                dispatching: "dispatching";
+                retry_wait: "retry_wait";
+                terminal_failed: "terminal_failed";
+                skipped_stale: "skipped_stale";
+            }>;
+        }, z.core.$strip>>;
+        nextCursor: z.ZodOptional<z.ZodString>;
+        freshness: z.ZodObject<{
+            kind: z.ZodLiteral<"authoritative">;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["occurrences:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "List retained occurrences";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Reads one retained occurrence from the Scheduler Partition that owns its schedule. The response explicitly states that it is authoritative; a stale D1 directory or schedule projection is used only to find the partition and never as occurrence truth. An identifier outside the verified principal's organization, project or environment is indistinguishable from an absent occurrence.";
+    readonly example: {
+        readonly freshness: {
+            readonly kind: "authoritative";
+        };
+        readonly occurrence: {
+            readonly attemptCount: 2;
+            readonly generation: 1;
+            readonly id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly plannedFor: "2026-07-28T15:00:00.000Z";
+            readonly schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly sequence: 1;
+            readonly settledAt: "2026-07-28T15:02:00.000Z";
+            readonly state: "terminal_failed";
+        };
+    };
+    readonly id: "occurrences.read";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/schedules/{scheduleId}/occurrences/{occurrenceId}";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found"];
+    readonly response: z.ZodObject<{
+        freshness: z.ZodObject<{
+            kind: z.ZodLiteral<"authoritative">;
+        }, z.core.$strip>;
+        occurrence: z.ZodObject<{
+            attemptCount: z.ZodNumber;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            plannedFor: z.ZodString;
+            schedule: z.ZodString;
+            sequence: z.ZodNumber;
+            settledAt: z.ZodOptional<z.ZodString>;
+            state: z.ZodEnum<{
+                succeeded: "succeeded";
+                ambiguous: "ambiguous";
+                cancelled: "cancelled";
+                planned: "planned";
+                due: "due";
+                dispatching: "dispatching";
+                retry_wait: "retry_wait";
+                terminal_failed: "terminal_failed";
+                skipped_stale: "skipped_stale";
+            }>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["occurrences:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Read an occurrence";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Lists the immutable attempts retained under one occurrence, ordered by start instant and attempt identifier so equal timestamps have a stable position. The owning Scheduler Partition is authoritative and every page says so. Results expose only bounded outcome, response-status, duration, diagnostic, remediation and redelivery-cause metadata; callback payloads, response bodies, destinations, signing material, secrets and transport traces are structurally absent.";
+    readonly example: {
+        readonly data: readonly [{
+            readonly attemptNumber: 1;
+            readonly classifiedAt: "2026-07-28T15:00:00.071Z";
+            readonly delivery: "dlv_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly diagnostic: "http_retryable";
+            readonly durationMs: 71;
+            readonly id: "att_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly occurrence: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly remediation: "review_retry_policy";
+            readonly responseStatus: 503;
+            readonly startedAt: "2026-07-28T15:00:00.000Z";
+            readonly state: "retryable_failure";
+            readonly trigger: {
+                readonly kind: "automatic";
+            };
+        }];
+        readonly freshness: {
+            readonly kind: "authoritative";
+        };
+        readonly nextCursor: "eyJhIjoxNzg1MjUwODAwMDAwLCJpIjoiYXR0XzAxaDh4eXo5azJtNG42cDhyMHQydjR3Nnk4IiwiayI6Ijk1MTM1NDZmIn0";
+    };
+    readonly id: "attempts.list";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/schedules/{scheduleId}/occurrences/{occurrenceId}/attempts";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found"];
+    readonly query: z.ZodObject<{
+        cursor: z.ZodOptional<z.ZodString>;
+        limit: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        data: z.ZodArray<z.ZodObject<{
+            attemptNumber: z.ZodNumber;
+            classifiedAt: z.ZodOptional<z.ZodString>;
+            delivery: z.ZodString;
+            diagnostic: z.ZodOptional<z.ZodEnum<{
+                rate_limited: "rate_limited";
+                completion_timed_out: "completion_timed_out";
+                delivered: "delivered";
+                duplicate_inflight: "duplicate_inflight";
+                endpoint_unavailable: "endpoint_unavailable";
+                endpoint_unsafe: "endpoint_unsafe";
+                http_refused: "http_refused";
+                http_retryable: "http_retryable";
+                http_terminal: "http_terminal";
+                identity_conflict: "identity_conflict";
+                network_ambiguous: "network_ambiguous";
+                payload_unavailable: "payload_unavailable";
+            }>>;
+            durationMs: z.ZodOptional<z.ZodNumber>;
+            id: z.ZodString;
+            occurrence: z.ZodString;
+            remediation: z.ZodOptional<z.ZodEnum<{
+                none: "none";
+                review_retry_policy: "review_retry_policy";
+                inspect_receiver: "inspect_receiver";
+                verify_endpoint: "verify_endpoint";
+                replace_payload: "replace_payload";
+                contact_support: "contact_support";
+                review_before_redelivery: "review_before_redelivery";
+            }>>;
+            failureSnippet: z.ZodOptional<z.ZodObject<{
+                contentType: z.ZodString;
+                text: z.ZodString;
+                truncated: z.ZodBoolean;
+            }, z.core.$strip>>;
+            responseHeaders: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                value: z.ZodString;
+            }, z.core.$strip>>>;
+            responseStatus: z.ZodOptional<z.ZodNumber>;
+            startedAt: z.ZodString;
+            state: z.ZodOptional<z.ZodEnum<{
+                succeeded: "succeeded";
+                ambiguous: "ambiguous";
+                retryable_failure: "retryable_failure";
+                terminal_failure: "terminal_failure";
+            }>>;
+            trigger: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"automatic">;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"redelivery">;
+                sourceAttemptId: z.ZodString;
+            }, z.core.$strip>], "kind">;
+        }, z.core.$strip>>;
+        nextCursor: z.ZodOptional<z.ZodString>;
+        freshness: z.ZodObject<{
+            kind: z.ZodLiteral<"authoritative">;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["occurrences:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "List delivery attempts";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Reads one immutable delivery attempt from its occurrence's authoritative Scheduler Partition. Ambiguous means the receiver may have acted and is never rewritten into certainty without durable result evidence. The bounded response omits callback payloads, response bodies, destinations, signing material, secrets and raw transport failures by construction.";
+    readonly example: {
+        readonly attempt: {
+            readonly attemptNumber: 2;
+            readonly classifiedAt: "2026-07-28T15:02:00.000Z";
+            readonly delivery: "dlv_11h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly diagnostic: "network_ambiguous";
+            readonly durationMs: 10000;
+            readonly id: "att_11h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly occurrence: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly remediation: "review_before_redelivery";
+            readonly startedAt: "2026-07-28T15:01:50.000Z";
+            readonly state: "ambiguous";
+            readonly trigger: {
+                readonly kind: "automatic";
+            };
+        };
+        readonly freshness: {
+            readonly kind: "authoritative";
+        };
+    };
+    readonly id: "attempts.read";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "GET";
+    readonly mutates: false;
+    readonly path: "/v1/schedules/{scheduleId}/occurrences/{occurrenceId}/attempts/{attemptId}";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found"];
+    readonly response: z.ZodObject<{
+        attempt: z.ZodObject<{
+            attemptNumber: z.ZodNumber;
+            classifiedAt: z.ZodOptional<z.ZodString>;
+            delivery: z.ZodString;
+            diagnostic: z.ZodOptional<z.ZodEnum<{
+                rate_limited: "rate_limited";
+                completion_timed_out: "completion_timed_out";
+                delivered: "delivered";
+                duplicate_inflight: "duplicate_inflight";
+                endpoint_unavailable: "endpoint_unavailable";
+                endpoint_unsafe: "endpoint_unsafe";
+                http_refused: "http_refused";
+                http_retryable: "http_retryable";
+                http_terminal: "http_terminal";
+                identity_conflict: "identity_conflict";
+                network_ambiguous: "network_ambiguous";
+                payload_unavailable: "payload_unavailable";
+            }>>;
+            durationMs: z.ZodOptional<z.ZodNumber>;
+            id: z.ZodString;
+            occurrence: z.ZodString;
+            remediation: z.ZodOptional<z.ZodEnum<{
+                none: "none";
+                review_retry_policy: "review_retry_policy";
+                inspect_receiver: "inspect_receiver";
+                verify_endpoint: "verify_endpoint";
+                replace_payload: "replace_payload";
+                contact_support: "contact_support";
+                review_before_redelivery: "review_before_redelivery";
+            }>>;
+            failureSnippet: z.ZodOptional<z.ZodObject<{
+                contentType: z.ZodString;
+                text: z.ZodString;
+                truncated: z.ZodBoolean;
+            }, z.core.$strip>>;
+            responseHeaders: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                value: z.ZodString;
+            }, z.core.$strip>>>;
+            responseStatus: z.ZodOptional<z.ZodNumber>;
+            startedAt: z.ZodString;
+            state: z.ZodOptional<z.ZodEnum<{
+                succeeded: "succeeded";
+                ambiguous: "ambiguous";
+                retryable_failure: "retryable_failure";
+                terminal_failure: "terminal_failure";
+            }>>;
+            trigger: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"automatic">;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"redelivery">;
+                sourceAttemptId: z.ZodString;
+            }, z.core.$strip>], "kind">;
+        }, z.core.$strip>;
+        freshness: z.ZodObject<{
+            kind: z.ZodLiteral<"authoritative">;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["occurrences:read"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Read a delivery attempt";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: true;
+    readonly description: "Creates one new immutable attempt under the same retained terminal occurrence and dispatches it through the ordinary delivery boundary. The required Idempotency-Key makes an identical replay converge on the same attempt and conflicting reuse is refused. The new attempt names the retained attempt that caused the redelivery; no earlier identity or outcome is changed. MCP marks this outbound mutation for explicit approval even though it is non-destructive.";
+    readonly example: {
+        readonly attempt: {
+            readonly attemptNumber: 3;
+            readonly delivery: "dlv_21h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly id: "att_21h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly occurrence: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly startedAt: "2026-07-28T15:05:00.000Z";
+            readonly trigger: {
+                readonly kind: "redelivery";
+                readonly sourceAttemptId: "att_11h8xyz9k2m4n6p8r0t2v4w6y8";
+            };
+        };
+        readonly freshness: {
+            readonly kind: "authoritative";
+        };
+    };
+    readonly id: "occurrences.redeliver";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: true;
+    };
+    readonly method: "POST";
+    readonly mutates: true;
+    readonly path: "/v1/schedules/{scheduleId}/occurrences/{occurrenceId}/redeliver";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["idempotency_key_reused", "invalid_request", "not_found", "service_unavailable", "state_conflict"];
+    readonly requestHeaders: z.ZodObject<{
+        "Idempotency-Key": z.ZodString;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        attempt: z.ZodObject<{
+            attemptNumber: z.ZodNumber;
+            classifiedAt: z.ZodOptional<z.ZodString>;
+            delivery: z.ZodString;
+            diagnostic: z.ZodOptional<z.ZodEnum<{
+                rate_limited: "rate_limited";
+                completion_timed_out: "completion_timed_out";
+                delivered: "delivered";
+                duplicate_inflight: "duplicate_inflight";
+                endpoint_unavailable: "endpoint_unavailable";
+                endpoint_unsafe: "endpoint_unsafe";
+                http_refused: "http_refused";
+                http_retryable: "http_retryable";
+                http_terminal: "http_terminal";
+                identity_conflict: "identity_conflict";
+                network_ambiguous: "network_ambiguous";
+                payload_unavailable: "payload_unavailable";
+            }>>;
+            durationMs: z.ZodOptional<z.ZodNumber>;
+            id: z.ZodString;
+            occurrence: z.ZodString;
+            remediation: z.ZodOptional<z.ZodEnum<{
+                none: "none";
+                review_retry_policy: "review_retry_policy";
+                inspect_receiver: "inspect_receiver";
+                verify_endpoint: "verify_endpoint";
+                replace_payload: "replace_payload";
+                contact_support: "contact_support";
+                review_before_redelivery: "review_before_redelivery";
+            }>>;
+            failureSnippet: z.ZodOptional<z.ZodObject<{
+                contentType: z.ZodString;
+                text: z.ZodString;
+                truncated: z.ZodBoolean;
+            }, z.core.$strip>>;
+            responseHeaders: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                value: z.ZodString;
+            }, z.core.$strip>>>;
+            responseStatus: z.ZodOptional<z.ZodNumber>;
+            startedAt: z.ZodString;
+            state: z.ZodOptional<z.ZodEnum<{
+                succeeded: "succeeded";
+                ambiguous: "ambiguous";
+                retryable_failure: "retryable_failure";
+                terminal_failure: "terminal_failure";
+            }>>;
+            trigger: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"automatic">;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"redelivery">;
+                sourceAttemptId: z.ZodString;
+            }, z.core.$strip>], "kind">;
+        }, z.core.$strip>;
+        freshness: z.ZodObject<{
+            kind: z.ZodLiteral<"authoritative">;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly responseHeaders: z.ZodObject<{
+        "Idempotency-Replayed": z.ZodOptional<z.ZodLiteral<"true">>;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["occurrences:redeliver"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Redeliver an occurrence";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Replaces a schedule's definition, starting a new generation. Takes the same four ways of saying when as a create, so a one-shot can be replaced by a recurring definition and the other way round. An omitted callback endpoint/data pair preserves the stored callback; sending `data` alone replaces the encrypted data for the current endpoint, and sending `endpoint` selects a verified endpoint in the same authority tuple. The occurrence planned under the old definition is settled `skipped_stale` and can never fire unless it was already in flight, in which case its immutable attempt is allowed to settle honestly; a fresh occurrence is planned under the new definition, and the old definition's series stops advancing. Send `If-Match` with the version you read to make this conditional; without it the replace is unconditional and the last writer wins. A cancelled or completed schedule cannot be replaced. `partitionKey` is fixed when the schedule is created: omit it to preserve the stored value or echo that exact value in a GET → modify → PUT flow. Adding, changing, or clearing it is refused as `invalid_request` with `/partitionKey` identified. `latencyClass` remains derived from the replacement recurrence when the caller omits it.";
+    readonly example: {
+        readonly occurrence: {
+            readonly attemptCount: 0;
+            readonly generation: 2;
+            readonly id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y9";
+            readonly plannedFor: "2026-07-28T16:00:00.000Z";
+            readonly schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly sequence: 1;
+            readonly state: "planned";
+        };
+        readonly schedule: {
+            readonly createdAt: "2026-07-28T14:59:00.000Z";
+            readonly endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly generation: 2;
+            readonly id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly latencyClass: "realtime";
+            readonly partitionKey: "campaign.spring";
+            readonly recurrence: {
+                readonly kind: "at";
+            };
+            readonly status: "active";
+            readonly updatedAt: "2026-07-28T15:10:00.000Z";
+            readonly version: 2;
+        };
+    };
+    readonly id: "schedules.replace";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: true;
+        readonly kind: "tool";
+        readonly openWorld: true;
+    };
+    readonly method: "PUT";
+    readonly mutates: true;
+    readonly path: "/v1/schedules/{scheduleId}";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["endpoint_unverified", "invalid_request", "not_found", "plan_limit_reached", "service_unavailable", "state_conflict", "version_conflict"];
+    readonly request: z.ZodObject<{
+        at: z.ZodOptional<z.ZodString>;
+        cron: z.ZodOptional<z.ZodString>;
+        data: z.ZodOptional<z.ZodJSONSchema>;
+        delaySeconds: z.ZodOptional<z.ZodNumber>;
+        delivery: z.ZodOptional<z.ZodObject<{
+            onOverlap: z.ZodOptional<z.ZodEnum<{
+                skip: "skip";
+                queue: "queue";
+            }>>;
+            completion: z.ZodOptional<z.ZodEnum<{
+                response: "response";
+                callback: "callback";
+            }>>;
+            maxDurationSeconds: z.ZodOptional<z.ZodLiteral<5 | 300 | 86400 | 30 | 900 | 1800 | 3600 | 43200>>;
+        }, z.core.$strict>>;
+        everySeconds: z.ZodOptional<z.ZodNumber>;
+        endpoint: z.ZodOptional<z.ZodString>;
+        latencyClass: z.ZodOptional<z.ZodEnum<{
+            realtime: "realtime";
+            bulk: "bulk";
+        }>>;
+        partitionKey: z.ZodOptional<z.ZodString>;
+        timeZone: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    }, z.core.$strict>;
+    readonly requestExample: {
+        readonly data: {
+            readonly report: "weekly";
+        };
+        readonly everySeconds: 86400;
+        readonly endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8";
+        readonly partitionKey: "campaign.spring";
+    };
+    readonly requestHeaders: z.ZodObject<{
+        "If-Match": z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        occurrence: z.ZodObject<{
+            attemptCount: z.ZodNumber;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            plannedFor: z.ZodString;
+            schedule: z.ZodString;
+            sequence: z.ZodNumber;
+            settledAt: z.ZodOptional<z.ZodString>;
+            state: z.ZodEnum<{
+                succeeded: "succeeded";
+                ambiguous: "ambiguous";
+                cancelled: "cancelled";
+                planned: "planned";
+                due: "due";
+                dispatching: "dispatching";
+                retry_wait: "retry_wait";
+                terminal_failed: "terminal_failed";
+                skipped_stale: "skipped_stale";
+            }>;
+        }, z.core.$strip>;
+        schedule: z.ZodObject<{
+            archivedAt: z.ZodOptional<z.ZodString>;
+            createdAt: z.ZodString;
+            delivery: z.ZodOptional<z.ZodObject<{
+                completion: z.ZodEnum<{
+                    response: "response";
+                    callback: "callback";
+                }>;
+                maxDurationSeconds: z.ZodNumber;
+                onOverlap: z.ZodEnum<{
+                    skip: "skip";
+                    queue: "queue";
+                }>;
+            }, z.core.$strip>>;
+            endpoint: z.ZodOptional<z.ZodString>;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            latencyClass: z.ZodEnum<{
+                realtime: "realtime";
+                bulk: "bulk";
+            }>;
+            partitionKey: z.ZodOptional<z.ZodString>;
+            recurrence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"at">;
+            }, z.core.$strip>, z.ZodObject<{
+                everySeconds: z.ZodNumber;
+                kind: z.ZodLiteral<"every">;
+            }, z.core.$strip>, z.ZodObject<{
+                cron: z.ZodString;
+                kind: z.ZodLiteral<"cron">;
+                timeZone: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+            }, z.core.$strip>], "kind">;
+            status: z.ZodEnum<{
+                paused: "paused";
+                active: "active";
+                cancelled: "cancelled";
+                completed: "completed";
+            }>;
+            updatedAt: z.ZodString;
+            version: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly responseHeaders: z.ZodObject<{
+        ETag: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["schedules:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Replace a schedule";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Suspends a schedule without discarding it: its occurrence stays planned, its timer is released, and resume re-arms the original planned instant so elapsed work becomes due rather than being silently moved. A schedule with a dispatching or ambiguous callback is refused until that attempt settles, because pausing cannot strand its watchdog or turn a proven success into an unreachable completed state. Pausing an already paused schedule changes nothing and returns the same version, so a retry is free. A cancelled or completed schedule cannot be paused.";
+    readonly example: {
+        readonly occurrence: {
+            readonly attemptCount: 0;
+            readonly generation: 1;
+            readonly id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly plannedFor: "2026-07-28T15:00:00.000Z";
+            readonly schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly sequence: 1;
+            readonly state: "planned";
+        };
+        readonly schedule: {
+            readonly createdAt: "2026-07-28T14:59:00.000Z";
+            readonly generation: 1;
+            readonly id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly latencyClass: "realtime";
+            readonly recurrence: {
+                readonly kind: "at";
+            };
+            readonly status: "paused";
+            readonly updatedAt: "2026-07-28T15:10:00.000Z";
+            readonly version: 2;
+        };
+    };
+    readonly id: "schedules.pause";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "POST";
+    readonly mutates: true;
+    readonly path: "/v1/schedules/{scheduleId}/pause";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found", "state_conflict", "version_conflict"];
+    readonly requestHeaders: z.ZodObject<{
+        "If-Match": z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        occurrence: z.ZodObject<{
+            attemptCount: z.ZodNumber;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            plannedFor: z.ZodString;
+            schedule: z.ZodString;
+            sequence: z.ZodNumber;
+            settledAt: z.ZodOptional<z.ZodString>;
+            state: z.ZodEnum<{
+                succeeded: "succeeded";
+                ambiguous: "ambiguous";
+                cancelled: "cancelled";
+                planned: "planned";
+                due: "due";
+                dispatching: "dispatching";
+                retry_wait: "retry_wait";
+                terminal_failed: "terminal_failed";
+                skipped_stale: "skipped_stale";
+            }>;
+        }, z.core.$strip>;
+        schedule: z.ZodObject<{
+            archivedAt: z.ZodOptional<z.ZodString>;
+            createdAt: z.ZodString;
+            delivery: z.ZodOptional<z.ZodObject<{
+                completion: z.ZodEnum<{
+                    response: "response";
+                    callback: "callback";
+                }>;
+                maxDurationSeconds: z.ZodNumber;
+                onOverlap: z.ZodEnum<{
+                    skip: "skip";
+                    queue: "queue";
+                }>;
+            }, z.core.$strip>>;
+            endpoint: z.ZodOptional<z.ZodString>;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            latencyClass: z.ZodEnum<{
+                realtime: "realtime";
+                bulk: "bulk";
+            }>;
+            partitionKey: z.ZodOptional<z.ZodString>;
+            recurrence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"at">;
+            }, z.core.$strip>, z.ZodObject<{
+                everySeconds: z.ZodNumber;
+                kind: z.ZodLiteral<"every">;
+            }, z.core.$strip>, z.ZodObject<{
+                cron: z.ZodString;
+                kind: z.ZodLiteral<"cron">;
+                timeZone: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+            }, z.core.$strip>], "kind">;
+            status: z.ZodEnum<{
+                paused: "paused";
+                active: "active";
+                cancelled: "cancelled";
+                completed: "completed";
+            }>;
+            updatedAt: z.ZodString;
+            version: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly responseHeaders: z.ZodObject<{
+        ETag: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["schedules:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Pause a schedule";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Returns a paused schedule to active. An occurrence whose instant passed while the schedule was paused becomes due at once rather than being skipped — a pause defers work, it does not discard it. Resuming an already active schedule changes nothing and returns the same version.";
+    readonly example: {
+        readonly occurrence: {
+            readonly attemptCount: 0;
+            readonly generation: 1;
+            readonly id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly plannedFor: "2026-07-28T15:00:00.000Z";
+            readonly schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly sequence: 1;
+            readonly state: "planned";
+        };
+        readonly schedule: {
+            readonly createdAt: "2026-07-28T14:59:00.000Z";
+            readonly generation: 1;
+            readonly id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly latencyClass: "realtime";
+            readonly recurrence: {
+                readonly kind: "at";
+            };
+            readonly status: "active";
+            readonly updatedAt: "2026-07-28T15:20:00.000Z";
+            readonly version: 3;
+        };
+    };
+    readonly id: "schedules.resume";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "POST";
+    readonly mutates: true;
+    readonly path: "/v1/schedules/{scheduleId}/resume";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found", "state_conflict", "version_conflict"];
+    readonly requestHeaders: z.ZodObject<{
+        "If-Match": z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        occurrence: z.ZodObject<{
+            attemptCount: z.ZodNumber;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            plannedFor: z.ZodString;
+            schedule: z.ZodString;
+            sequence: z.ZodNumber;
+            settledAt: z.ZodOptional<z.ZodString>;
+            state: z.ZodEnum<{
+                succeeded: "succeeded";
+                ambiguous: "ambiguous";
+                cancelled: "cancelled";
+                planned: "planned";
+                due: "due";
+                dispatching: "dispatching";
+                retry_wait: "retry_wait";
+                terminal_failed: "terminal_failed";
+                skipped_stale: "skipped_stale";
+            }>;
+        }, z.core.$strip>;
+        schedule: z.ZodObject<{
+            archivedAt: z.ZodOptional<z.ZodString>;
+            createdAt: z.ZodString;
+            delivery: z.ZodOptional<z.ZodObject<{
+                completion: z.ZodEnum<{
+                    response: "response";
+                    callback: "callback";
+                }>;
+                maxDurationSeconds: z.ZodNumber;
+                onOverlap: z.ZodEnum<{
+                    skip: "skip";
+                    queue: "queue";
+                }>;
+            }, z.core.$strip>>;
+            endpoint: z.ZodOptional<z.ZodString>;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            latencyClass: z.ZodEnum<{
+                realtime: "realtime";
+                bulk: "bulk";
+            }>;
+            partitionKey: z.ZodOptional<z.ZodString>;
+            recurrence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"at">;
+            }, z.core.$strip>, z.ZodObject<{
+                everySeconds: z.ZodNumber;
+                kind: z.ZodLiteral<"every">;
+            }, z.core.$strip>, z.ZodObject<{
+                cron: z.ZodString;
+                kind: z.ZodLiteral<"cron">;
+                timeZone: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+            }, z.core.$strip>], "kind">;
+            status: z.ZodEnum<{
+                paused: "paused";
+                active: "active";
+                cancelled: "cancelled";
+                completed: "completed";
+            }>;
+            updatedAt: z.ZodString;
+            version: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly responseHeaders: z.ZodObject<{
+        ETag: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["schedules:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Resume a schedule";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Cancels a schedule and settles its occurrence `cancelled`, releasing the timer. Terminal: a cancelled schedule cannot be resumed or replaced, and cancelling one that is already cancelled changes nothing and returns the same version. A cancel that races its own occurrence becoming due still wins — the occurrence settles cancelled and no work is delivered — which is why this is a refusal-free retry rather than a race a client has to reason about. The schedule stays readable; archive it to take it out of the listing.";
+    readonly example: {
+        readonly occurrence: {
+            readonly attemptCount: 0;
+            readonly generation: 1;
+            readonly id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly plannedFor: "2026-07-28T15:00:00.000Z";
+            readonly schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly sequence: 1;
+            readonly settledAt: "2026-07-28T15:10:00.000Z";
+            readonly state: "cancelled";
+        };
+        readonly schedule: {
+            readonly createdAt: "2026-07-28T14:59:00.000Z";
+            readonly generation: 1;
+            readonly id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly latencyClass: "realtime";
+            readonly recurrence: {
+                readonly kind: "at";
+            };
+            readonly status: "cancelled";
+            readonly updatedAt: "2026-07-28T15:10:00.000Z";
+            readonly version: 2;
+        };
+    };
+    readonly id: "schedules.cancel";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: true;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "DELETE";
+    readonly mutates: true;
+    readonly path: "/v1/schedules/{scheduleId}";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found", "state_conflict", "version_conflict"];
+    readonly requestHeaders: z.ZodObject<{
+        "If-Match": z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        occurrence: z.ZodObject<{
+            attemptCount: z.ZodNumber;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            plannedFor: z.ZodString;
+            schedule: z.ZodString;
+            sequence: z.ZodNumber;
+            settledAt: z.ZodOptional<z.ZodString>;
+            state: z.ZodEnum<{
+                succeeded: "succeeded";
+                ambiguous: "ambiguous";
+                cancelled: "cancelled";
+                planned: "planned";
+                due: "due";
+                dispatching: "dispatching";
+                retry_wait: "retry_wait";
+                terminal_failed: "terminal_failed";
+                skipped_stale: "skipped_stale";
+            }>;
+        }, z.core.$strip>;
+        schedule: z.ZodObject<{
+            archivedAt: z.ZodOptional<z.ZodString>;
+            createdAt: z.ZodString;
+            delivery: z.ZodOptional<z.ZodObject<{
+                completion: z.ZodEnum<{
+                    response: "response";
+                    callback: "callback";
+                }>;
+                maxDurationSeconds: z.ZodNumber;
+                onOverlap: z.ZodEnum<{
+                    skip: "skip";
+                    queue: "queue";
+                }>;
+            }, z.core.$strip>>;
+            endpoint: z.ZodOptional<z.ZodString>;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            latencyClass: z.ZodEnum<{
+                realtime: "realtime";
+                bulk: "bulk";
+            }>;
+            partitionKey: z.ZodOptional<z.ZodString>;
+            recurrence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"at">;
+            }, z.core.$strip>, z.ZodObject<{
+                everySeconds: z.ZodNumber;
+                kind: z.ZodLiteral<"every">;
+            }, z.core.$strip>, z.ZodObject<{
+                cron: z.ZodString;
+                kind: z.ZodLiteral<"cron">;
+                timeZone: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+            }, z.core.$strip>], "kind">;
+            status: z.ZodEnum<{
+                paused: "paused";
+                active: "active";
+                cancelled: "cancelled";
+                completed: "completed";
+            }>;
+            updatedAt: z.ZodString;
+            version: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly responseHeaders: z.ZodObject<{
+        ETag: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["schedules:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Cancel a schedule";
+    readonly surfaces: readonly ["api", "mock"];
+}, {
+    readonly creates: false;
+    readonly description: "Files a finished schedule away: it leaves the default listing and stays readable by identifier, carrying the instant it was archived. Only a cancelled or completed schedule can be archived — archiving is filing, not stopping, so cancel it first. Archiving an already archived schedule changes nothing and returns the same version.";
+    readonly example: {
+        readonly occurrence: {
+            readonly attemptCount: 0;
+            readonly generation: 1;
+            readonly id: "occ_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly plannedFor: "2026-07-28T15:00:00.000Z";
+            readonly schedule: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly sequence: 1;
+            readonly settledAt: "2026-07-28T15:10:00.000Z";
+            readonly state: "cancelled";
+        };
+        readonly schedule: {
+            readonly archivedAt: "2026-07-28T15:30:00.000Z";
+            readonly createdAt: "2026-07-28T14:59:00.000Z";
+            readonly generation: 1;
+            readonly id: "sch_01h8xyz9k2m4n6p8r0t2v4w6y8";
+            readonly latencyClass: "realtime";
+            readonly recurrence: {
+                readonly kind: "at";
+            };
+            readonly status: "cancelled";
+            readonly updatedAt: "2026-07-28T15:30:00.000Z";
+            readonly version: 3;
+        };
+    };
+    readonly id: "schedules.archive";
+    readonly idempotent: true;
+    readonly mcp: {
+        readonly destructive: false;
+        readonly kind: "tool";
+        readonly openWorld: false;
+    };
+    readonly method: "POST";
+    readonly mutates: true;
+    readonly path: "/v1/schedules/{scheduleId}/archive";
+    readonly principals: readonly ["api-credential", "oauth", "session"];
+    readonly problems: readonly ["invalid_request", "not_found", "state_conflict", "version_conflict"];
+    readonly requestHeaders: z.ZodObject<{
+        "If-Match": z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    readonly response: z.ZodObject<{
+        occurrence: z.ZodObject<{
+            attemptCount: z.ZodNumber;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            plannedFor: z.ZodString;
+            schedule: z.ZodString;
+            sequence: z.ZodNumber;
+            settledAt: z.ZodOptional<z.ZodString>;
+            state: z.ZodEnum<{
+                succeeded: "succeeded";
+                ambiguous: "ambiguous";
+                cancelled: "cancelled";
+                planned: "planned";
+                due: "due";
+                dispatching: "dispatching";
+                retry_wait: "retry_wait";
+                terminal_failed: "terminal_failed";
+                skipped_stale: "skipped_stale";
+            }>;
+        }, z.core.$strip>;
+        schedule: z.ZodObject<{
+            archivedAt: z.ZodOptional<z.ZodString>;
+            createdAt: z.ZodString;
+            delivery: z.ZodOptional<z.ZodObject<{
+                completion: z.ZodEnum<{
+                    response: "response";
+                    callback: "callback";
+                }>;
+                maxDurationSeconds: z.ZodNumber;
+                onOverlap: z.ZodEnum<{
+                    skip: "skip";
+                    queue: "queue";
+                }>;
+            }, z.core.$strip>>;
+            endpoint: z.ZodOptional<z.ZodString>;
+            generation: z.ZodNumber;
+            id: z.ZodString;
+            latencyClass: z.ZodEnum<{
+                realtime: "realtime";
+                bulk: "bulk";
+            }>;
+            partitionKey: z.ZodOptional<z.ZodString>;
+            recurrence: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"at">;
+            }, z.core.$strip>, z.ZodObject<{
+                everySeconds: z.ZodNumber;
+                kind: z.ZodLiteral<"every">;
+            }, z.core.$strip>, z.ZodObject<{
+                cron: z.ZodString;
+                kind: z.ZodLiteral<"cron">;
+                timeZone: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+            }, z.core.$strip>], "kind">;
+            status: z.ZodEnum<{
+                paused: "paused";
+                active: "active";
+                cancelled: "cancelled";
+                completed: "completed";
+            }>;
+            updatedAt: z.ZodString;
+            version: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    readonly responseHeaders: z.ZodObject<{
+        ETag: z.ZodString;
+    }, z.core.$strip>;
+    readonly scopes: readonly ["schedules:write"];
+    readonly sessionAuthority: "headers";
+    readonly summary: "Archive a schedule";
+    readonly surfaces: readonly ["api", "mock"];
+}];
+/**
+ * Every declared operation id, as a literal union.
+ *
+ * This is what lets an adapter key its handlers off a `Record<OperationId, …>`
+ * and get a *compile error* when the registry gains an operation it does not
+ * serve. A hand-maintained list compared in a test is a weaker guarantee: the
+ * list and the implementation can drift together while the test still passes.
+ */
+export type OperationId = (typeof OPERATIONS)[number]["id"];
+/**
+ * Headers the contract mock uses to expose state a body cannot carry.
+ *
+ * Declared here rather than written into the adapter for the same reason every
+ * other wire detail is: a header invented at the edge is a wire shape that
+ * drifts.
+ */
+export declare const MOCK_HEADERS: {
+    /** The instant the mock's pinned clock reports. */
+    readonly now: "X-Greatwait-Now";
+    /** Present when this response is an at-least-once duplicate. */
+    readonly replayed: "X-Greatwait-Replayed";
+};
+export declare function operationsFor(surface: OperationSurface): readonly OperationDefinition[];
+export declare function findOperation(id: string): OperationDefinition | undefined;
+/**
+ * The schema an operation's success body is parsed with, by operation id.
+ *
+ * **Exists so a consumer can parse without naming a schema export.** The typed
+ * client returns `unknown` and tells callers to parse with "that operation's
+ * contract schema", which until W9-03 meant every caller had to map an
+ * operation id onto a symbol by hand — a mapping that is a second statement of
+ * the registry, and one a renamed export breaks silently. The published
+ * quickstarts and anything W10 generates resolve it here instead, so the
+ * operation id is the only name a consumer has to know.
+ *
+ * `undefined` for an id the registry does not carry, rather than a throw: the
+ * caller usually has a better message than this function could write.
+ */
+export declare function responseSchemaFor(id: string): z.ZodTypeAny | undefined;
+/** The schema an operation's request body is validated with, by id. */
+export declare function requestSchemaFor(id: string): z.ZodTypeAny | undefined;
+/**
+ * The status a successful call returns.
+ *
+ * Computed in one place, so the OpenAPI document, the contract mock and the API
+ * adapter cannot disagree about it — which they did for exactly one commit,
+ * when a route returned 201 and the published document said 200. An operation
+ * that **creates** something, **on the product surface**, answers 201;
+ * everything else answers 200.
+ *
+ * The first clause read `method === "POST" && mutates` until W2-02, which added
+ * the first mutating POST that creates nothing — pausing a schedule — and would
+ * have had "201 Created" published for it. `creates` is declared rather than
+ * inferred because no combination of method, path and schema distinguishes
+ * "changed something" from "brought something into being".
+ *
+ * The surface clause is not a per-operation exception, and it is not
+ * cosmetic. Without it the rule reaches `mock.setScenario`, whose 200 is
+ * already published in `openapi.mock.json` and already served from a deployed
+ * host — and `classifyChange` in `compatibility.ts` classifies a changed status
+ * as **breaking**, requiring a new contract version. Tidying the mock's control
+ * plane is not worth a contract version, and shipping the change without one
+ * would make the compatibility module a thing this repository consults and then
+ * ignores. The mock's control plane is not a product operation; that is the
+ * distinction, and it is structural rather than a judgement about any one
+ * operation.
+ */
+export declare function successStatusFor(operation: OperationDefinition): 200 | 201;
+/**
+ * Problems any operation may return regardless of what it does. Kept separate
+ * so an operation's own `problems` list stays about that operation.
+ */
+export declare const UNIVERSAL_PROBLEMS: readonly ProblemCode[];
+/**
+ * Problems an operation returns once authentication applies to it.
+ *
+ * `credential_expired` is here rather than on the operations that rotate,
+ * because expiry is a property of the credential being *presented*, not of what
+ * the caller asked to do. Any authenticated operation can meet a credential
+ * whose rotation window has closed.
+ */
+export declare const AUTHENTICATED_PROBLEMS: readonly ProblemCode[];
+export declare function problemsFor(operation: OperationDefinition): readonly ProblemCode[];