@greatwait/contracts 0.1.0-alpha.1

package/dist/signatures.d.ts

@@ -0,0 +1,704 @@
+import { z } from "zod";
+import { type OccurrenceId, type ScheduleId } from "./identifiers.js";
+/**
+ * Callback authenticity.
+ *
+ * The signature covers the timestamp, the delivery id, and the exact raw
+ * request-body bytes. A receiver verifies before parsing, in constant time.
+ *
+ * This is the most consequential break from the legacy scheduler, which signed
+ * `scheduleId.owner.tenant.timestampMs` and never touched the body: a signature
+ * that does not cover the body authenticates only the envelope, so an attacker
+ * who can replay a captured header set may substitute any payload. W6-03
+ * migrates the autoscaler onto this contract through a separate v2 endpoint so
+ * the old and new verifiers never weaken each other.
+ *
+ * The `Callback-*` header namespace is intentionally independent of the display
+ * brand. Renaming the product must not force receivers to change verification
+ * code.
+ */
+export declare const CALLBACK_HEADERS: {
+    readonly deliveryId: "Callback-Delivery-Id";
+    readonly keyId: "Callback-Key-Id";
+    readonly occurrenceId: "Callback-Occurrence-Id";
+    readonly signature: "Callback-Signature";
+    readonly timestamp: "Callback-Timestamp";
+};
+/** Only `v1` exists. A new scheme is added alongside, never in place of. */
+export declare const SIGNATURE_SCHEME: "v1";
+/** How far a receiver's clock may differ before a signature is stale. */
+export declare const SIGNATURE_TOLERANCE_SECONDS = 300;
+/** Version of the complete delivery-authentication protocol artifact. */
+export declare const CALLBACK_DELIVERY_PROTOCOL_VERSION = "2026-08-23";
+/** The media type sent on every occurrence delivery. */
+export declare const CALLBACK_CONTENT_TYPE = "application/json";
+export declare const signatureHeaderSchema: z.ZodString;
+/**
+ * The exact bytes that are signed: `<timestamp>.<delivery-id>.` followed by the
+ * raw body, with no re-serialization anywhere in the path. Re-encoding JSON
+ * before signing or verifying is the classic way to break this.
+ *
+ * Both prefix fields are validated here rather than trusted, and that is a
+ * security property, not tidiness. The delimiter `.` also occurs inside every
+ * contract timestamp, so without validation the encoding is not injective:
+ * `("2026-07-28T15:00:00", "000Z.dlv_…", body)` produces the same bytes as
+ * `("2026-07-28T15:00:00.000Z", "dlv_…", body)`, and an attacker holding one
+ * legitimate signature could move bytes across the delimiter — shortening the
+ * body and lengthening the delivery-id header — and still verify.
+ *
+ * Validating makes both fields fixed-width, so the prefix is a constant 56
+ * bytes and the encoding is injective. A verifier that computes the MAC before
+ * validating its headers is the natural implementation and would be
+ * vulnerable; making that impossible here means no receiver has to know.
+ *
+ * **Throws** on a malformed timestamp or delivery id. That is right on the
+ * signing side — refusing to sign something we cannot encode unambiguously —
+ * but a receiver verifying attacker-controlled headers wants a boolean, not an
+ * exception: use `trySigningInput`, or an uncaught throw turns a
+ * malformed-header probe into a 500.
+ */
+export declare function signingInput(timestamp: string, deliveryId: string, rawBody: Uint8Array): Uint8Array;
+/**
+ * `signingInput` for untrusted input: returns `undefined` instead of throwing
+ * when the prefix fields are malformed, which is what a receiver verifying
+ * headers off the wire needs.
+ */
+export declare function trySigningInput(timestamp: string, deliveryId: string, rawBody: Uint8Array): Uint8Array | undefined;
+export declare function formatSignature(hexMac: string): string;
+/**
+ * Whether a signed timestamp is close enough to now. Replay protection beyond
+ * this window is the receiver's, keyed on the delivery id.
+ */
+export declare function isTimestampFresh(timestamp: string, nowMs: number, toleranceSeconds?: number): boolean;
+/**
+ * Why this delivery exists.
+ *
+ * `automatic` is everything the system decided for itself: a first attempt, and
+ * every retry after an ambiguous or failed one. Nobody asked for it, it may
+ * duplicate work already done, and a receiver must therefore treat it as at
+ * most one execution of the occurrence.
+ *
+ * `redelivery` is a person pressing the button, scoped by
+ * `occurrences:redeliver` and named against the retained attempt they chose to
+ * follow. It is a *request for the work to happen again*, and a receiver that
+ * suppresses it as a duplicate is answering a deliberate instruction with
+ * silence.
+ *
+ * The two were indistinguishable on the wire until this field existed, so the
+ * only rule safe against the first was applied to both. That is the defect
+ * W3-08 exists to remove, and the reason the field is inside the signed bytes
+ * rather than in a header: a receiver that would re-run work on the strength of
+ * an unauthenticated hint has handed anyone who can reach its endpoint a
+ * duplicate-execution button.
+ */
+export declare const callbackTriggerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"automatic">;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"redelivery">;
+    sourceAttemptId: z.ZodString;
+}, z.core.$strip>], "kind">;
+export type CallbackTrigger = z.infer<typeof callbackTriggerSchema>;
+/**
+ * The envelope version this service emits.
+ *
+ * Dated and independent of the contract version. It moved on 2026-08-08 because
+ * the envelope gained `trigger`, and again on 2026-08-23 because `completion`
+ * stopped being optional: every delivery now carries a completion URL, a
+ * per-dispatch credential and an absolute deadline, whatever the schedule asked
+ * for. `assess` classifies both moves as `breaking` — see
+ * `CALLBACK_ENVELOPE_VERSION_CHANGE`.
+ *
+ * **A required field is why this is a version rather than an addition.** Under
+ * `2026-08-08` an absent `completion` means "this schedule did not ask for
+ * one"; under `2026-08-23` it means the envelope is malformed. A receiver that
+ * could not tell those apart would have to treat "no completion material" as
+ * both a normal delivery and a broken one.
+ */
+export declare const CALLBACK_ENVELOPE_VERSION: "2026-08-23";
+/** The first published envelope version, which this service no longer emits. */
+export declare const CALLBACK_ENVELOPE_VERSION_2026_07_01: "2026-07-01";
+/**
+ * The second published version, which this service no longer emits.
+ *
+ * Still accepted inbound, and its known-answer vectors are still published:
+ * a receiver deployed before the sender moved keeps verifying deliveries that
+ * were signed under it.
+ */
+export declare const CALLBACK_ENVELOPE_VERSION_2026_08_08: "2026-08-08";
+/**
+ * Every envelope version a receiver may be handed, oldest first.
+ *
+ * All are accepted on the way in and only the newest is sent, which is what
+ * makes a receiver deployable ahead of the sender. A receiver upgraded first
+ * keeps verifying the deliveries already in flight; one upgraded afterwards
+ * answers `invalid_envelope` to everything, because a version literal it has
+ * never heard of is exactly the case the field exists to catch.
+ */
+export declare const CALLBACK_ENVELOPE_VERSIONS: readonly ["2026-07-01", "2026-08-08", "2026-08-23"];
+/**
+ * Where a `callback` receiver reports that it finished, and with what.
+ *
+ * **Present only on a delivery whose schedule asked for `completion:
+ * "callback"`**, which is what makes adding it to an existing envelope version
+ * safe rather than a break. A receiver sees this field for the first time on a
+ * delivery its own customer deliberately reconfigured; no receiver that has not
+ * opted in can be handed one. That is a different situation from `trigger`,
+ * which appeared on *every* delivery and moved the version to `2026-08-08` in
+ * consequence.
+ *
+ * The token authenticates the report and nothing else. It is minted per dispatch
+ * and names one attempt at one dispatch epoch, so a report replayed against a
+ * later attempt is refused by the same fence that refuses a late executor
+ * result.
+ */
+export declare const callbackCompletionSchema: z.ZodObject<{
+    token: z.ZodString;
+    url: z.ZodURL;
+}, z.core.$strip>;
+export type CallbackCompletion = z.infer<typeof callbackCompletionSchema>;
+/**
+ * The completion material every `2026-08-23` delivery carries.
+ *
+ * The same URL and credential, plus the one thing a receiver could not
+ * previously know: **when Greatwait stops waiting.** Without it a receiver
+ * deciding whether to accept the work has to infer the deadline from the
+ * schedule's configured duration, which it cannot see, and a receiver that
+ * reports one second late looks identical to one that never reported at all.
+ *
+ * `deadline` is the schedule's own allowance measured from this attempt, in
+ * the wire's one timestamp representation. It is the maximum: a receiver may
+ * ask for an earlier instant in its acknowledgement and may not ask for a
+ * later one.
+ */
+export declare const callbackDeferredCompletionSchema: z.ZodObject<{
+    deadline: z.ZodString;
+    token: z.ZodString;
+    url: z.ZodURL;
+}, z.core.$strip>;
+export type CallbackDeferredCompletion = z.infer<typeof callbackDeferredCompletionSchema>;
+/**
+ * The report body, whose vocabulary lives in the Zod-free `delivery` module so
+ * the scheduler's completion route can read it without importing Zod.
+ */
+export declare const callbackCompletionReportSchema: z.ZodObject<{
+    outcome: z.ZodDefault<z.ZodEnum<{
+        succeeded: "succeeded";
+        failed: "failed";
+    }>>;
+}, z.core.$strip>;
+export type CallbackCompletionReport = z.infer<typeof callbackCompletionReportSchema>;
+/**
+ * The versioned JSON envelope delivered to a customer endpoint.
+ *
+ * A union rather than one object with an optional field, and the difference is
+ * the whole point of a version: under `2026-07-01` a missing `trigger` means
+ * "this sender cannot tell you", and under `2026-08-08` it is a malformed
+ * envelope. Collapsing the two would leave a receiver unable to know whether
+ * silence about a redelivery is an answer or an absence.
+ */
+export declare const callbackEnvelopeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    version: z.ZodLiteral<"2026-07-01">;
+    attempt: z.ZodNumber;
+    data: z.ZodUnknown;
+    occurrenceId: z.ZodString;
+    plannedFor: z.ZodString;
+    scheduleId: z.ZodString;
+    type: z.ZodLiteral<"schedule.occurrence">;
+}, z.core.$strip>, z.ZodObject<{
+    completion: z.ZodOptional<z.ZodObject<{
+        token: z.ZodString;
+        url: z.ZodURL;
+    }, z.core.$strip>>;
+    trigger: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"automatic">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"redelivery">;
+        sourceAttemptId: z.ZodString;
+    }, z.core.$strip>], "kind">;
+    version: z.ZodLiteral<"2026-08-08">;
+    attempt: z.ZodNumber;
+    data: z.ZodUnknown;
+    occurrenceId: z.ZodString;
+    plannedFor: z.ZodString;
+    scheduleId: z.ZodString;
+    type: z.ZodLiteral<"schedule.occurrence">;
+}, z.core.$strip>, z.ZodObject<{
+    completion: z.ZodObject<{
+        deadline: z.ZodString;
+        token: z.ZodString;
+        url: z.ZodURL;
+    }, z.core.$strip>;
+    trigger: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"automatic">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"redelivery">;
+        sourceAttemptId: z.ZodString;
+    }, z.core.$strip>], "kind">;
+    version: z.ZodLiteral<"2026-08-23">;
+    attempt: z.ZodNumber;
+    data: z.ZodUnknown;
+    occurrenceId: z.ZodString;
+    plannedFor: z.ZodString;
+    scheduleId: z.ZodString;
+    type: z.ZodLiteral<"schedule.occurrence">;
+}, z.core.$strip>], "version">;
+export type CallbackEnvelope = z.infer<typeof callbackEnvelopeSchema>;
+/**
+ * What caused a delivery, for an envelope of any published version.
+ *
+ * A `2026-07-01` envelope carries no trigger and reads as `automatic`, which is
+ * the conservative answer rather than a neutral one: it keeps duplicate
+ * suppression in force for a sender that cannot say a redelivery was ordered.
+ * Every receiver-side decision goes through this function so that default lives
+ * in one place instead of being re-decided at each call site.
+ */
+export declare function callbackEnvelopeTrigger(envelope: CallbackEnvelope): CallbackTrigger;
+/**
+ * The unit of work a receiver performs at most once.
+ *
+ * Not the occurrence: the occurrence *and what asked for it*. Every automatic
+ * delivery of one occurrence is one unit, so a retry can never duplicate work.
+ * Each ordered redelivery is its own unit, numbered by `attempt` — the
+ * occurrence's own counter, which only ever goes up and which every copy of one
+ * redelivery shares.
+ *
+ * **The number is what makes a repeat recognisable with constant memory, and
+ * that is the whole reason it is the identity.** A receiver keeps the highest
+ * redelivery it has finished and refuses anything at or below it, so a copy
+ * delayed in a proxy, a queue or an abandoned connection is still recognised
+ * however long it takes to arrive and however many redeliveries have completed
+ * since. External review on 2026-08-08 showed why the alternative fails: keyed
+ * on *which attempt the person followed*, a receiver remembering only the last
+ * one finished cannot tell a stale copy of an older instruction from a new one,
+ * and runs a customer's work twice. Remembering every instruction instead would
+ * hold the promise, at the price of a table that grows forever in every
+ * customer's receiver, in every language.
+ *
+ * `sourceAttemptId` stays on the wire because it says which attempt a person
+ * chose to follow, which is worth showing them. It is no longer what decides
+ * whether the work runs.
+ *
+ * Published here, and used by both the shipped middleware and the test sink,
+ * because a receiver and the reference receiver computing this differently is
+ * indistinguishable from a receiver with an idempotency bug.
+ */
+export type CallbackRun = {
+    readonly kind: "automatic";
+} | {
+    readonly kind: "redelivery";
+    readonly ordinal: number;
+};
+export declare function callbackRun(envelope: CallbackEnvelope): CallbackRun;
+/**
+ * Serialize one callback envelope exactly once in the frozen wire order.
+ *
+ * The returned bytes are both the bytes HMAC signs and the bytes `fetch`
+ * sends. `data` is checked as JSON before stringification so values such as
+ * `undefined`, `NaN`, `bigint`, a `Date`, or a cycle cannot be silently omitted
+ * or rewritten into a body different from the caller's input.
+ */
+export declare function serializeCallbackEnvelope(envelope: CallbackEnvelope): Uint8Array;
+/**
+ * Read the two leading envelope identifiers without parsing attacker-controlled
+ * JSON. This lets receiver middleware reject a mutated occurrence header after
+ * authenticating the exact bytes but before `JSON.parse` or an application
+ * handler sees them.
+ */
+export declare function extractCanonicalEnvelopeIds(rawBody: Uint8Array): {
+    readonly occurrenceId: OccurrenceId;
+    readonly scheduleId: ScheduleId;
+} | undefined;
+export declare const callbackHeadersSchema: z.ZodObject<{
+    "Callback-Delivery-Id": z.ZodString;
+    "Callback-Key-Id": z.ZodString;
+    "Callback-Occurrence-Id": z.ZodString;
+    "Callback-Signature": z.ZodString;
+    "Callback-Timestamp": z.ZodString;
+}, z.core.$strip>;
+/**
+ * Language-neutral known-answer contract for one complete delivery request.
+ * The secret is synthetic and deliberately not shaped like a credential.
+ */
+export declare const CALLBACK_DELIVERY_PROTOCOL: {
+    readonly envelope: {
+        /**
+         * The frozen wire order, and `completion` sits inside it.
+         *
+         * **This list is what a receiver outside JavaScript implements against**,
+         * so a field that reached the wire without reaching this array would make
+         * every callback delivery fail signature verification for exactly the
+         * integrators who cannot read the serializer. From `2026-08-23` every
+         * delivery carries `completion`; under `2026-08-08` it was optional, and
+         * the order was fixed anyway, because a position decided at emit time is a
+         * position nobody else can reproduce.
+         */
+        readonly propertyOrder: readonly ["version", "type", "scheduleId", "occurrenceId", "plannedFor", "attempt", "completion", "trigger", "data"];
+        /**
+         * The order **inside** `completion`, which is frozen for the same reason.
+         *
+         * `deadline` is appended rather than inserted, so a receiver that already
+         * reconstructs the `2026-08-08` object adds a key instead of re-deriving
+         * an order. Under `2026-08-08` the same object is the first two entries
+         * and nothing else.
+         */
+        readonly completionPropertyOrder: readonly ["token", "url", "deadline"];
+        /**
+         * The order under `2026-08-08`, whose `completion` is optional and carries
+         * no `deadline`. The top-level list is the same; what differs is inside.
+         */
+        readonly propertyOrder_2026_08_08: readonly ["version", "type", "scheduleId", "occurrenceId", "plannedFor", "attempt", "completion", "trigger", "data"];
+        /** The order under `2026-07-01`, which carries no trigger. */
+        readonly propertyOrder_2026_07_01: readonly ["version", "type", "scheduleId", "occurrenceId", "plannedFor", "attempt", "data"];
+        readonly serialization: "compact UTF-8 JSON with the stated top-level property order";
+        readonly trigger: {
+            readonly automatic: "A first attempt or a retry the system chose. Nobody asked for it, it may repeat work already done, and a receiver must run the occurrence at most once.";
+            readonly default: "An envelope with no trigger field is automatic. Only 2026-07-01 can omit it.";
+            readonly propertyOrder: readonly ["kind", "sourceAttemptId"];
+            readonly ordinal: "attempt. It only ever increases within an occurrence and every copy of one redelivery carries the same value, so a receiver recognises a repeat by keeping the highest it has run to completion rather than by keeping them all.";
+            readonly redelivery: "A person ordered this delivery under the occurrences:redeliver scope. sourceAttemptId names the retained attempt they chose to follow and is there to show them, not to decide whether the work runs — attempt is what decides that. It is a request for the work to happen again, and a receiver that suppresses it as a duplicate answers a deliberate instruction with silence.";
+            readonly requirement: "run the handler again for a redelivery whose attempt is above the highest this receiver has run to completion for the occurrence, keep suppressing every automatic delivery of a completed occurrence, and suppress every redelivery at or below that high-water mark";
+        };
+        readonly version: "2026-08-23";
+        /**
+         * Every version a receiver may be handed. A sender emits only the last;
+         * accepting the whole list is what lets a receiver deploy first.
+         */
+        readonly versions: readonly ["2026-07-01", "2026-08-08", "2026-08-23"];
+    };
+    readonly headers: {
+        readonly contentType: "application/json";
+        readonly required: readonly ["Content-Type", "Callback-Delivery-Id", "Callback-Occurrence-Id", "Callback-Timestamp", "Callback-Key-Id", "Callback-Signature"];
+    };
+    readonly replay: {
+        readonly identity: "Callback-Delivery-Id";
+        readonly requirement: "atomically reject a previously accepted delivery id before parsing";
+    };
+    readonly signature: {
+        readonly algorithm: "HMAC-SHA-256";
+        readonly format: "v1=<64 lowercase hexadecimal characters>";
+        readonly input: "ASCII <Callback-Timestamp>.<Callback-Delivery-Id>. followed by the exact raw request body bytes";
+        readonly scheme: "v1";
+        readonly timestampToleranceSeconds: 300;
+    };
+    /**
+     * The retired `2026-07-01` envelope, kept as a known answer.
+     *
+     * A receiver is still held to verifying it, because a sender mid-rollout may
+     * have signed it before the version moved. Its MAC is the one published on
+     * 2026-07-28 and is deliberately not recomputed.
+     */
+    readonly legacyTestVector: {
+        readonly envelope: {
+            readonly attempt: 1;
+            readonly data: {};
+            readonly occurrenceId: "occ_0123456789abcdefghjkmnpqrs";
+            readonly plannedFor: "2026-07-28T15:00:00.000Z";
+            readonly scheduleId: "sch_0123456789abcdefghjkmnpqrs";
+            readonly type: "schedule.occurrence";
+            readonly version: "2026-07-01";
+        };
+        readonly exactBodyBase64: "eyJ2ZXJzaW9uIjoiMjAyNi0wNy0wMSIsInR5cGUiOiJzY2hlZHVsZS5vY2N1cnJlbmNlIiwic2NoZWR1bGVJZCI6InNjaF8wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycyIsIm9jY3VycmVuY2VJZCI6Im9jY18wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycyIsInBsYW5uZWRGb3IiOiIyMDI2LTA3LTI4VDE1OjAwOjAwLjAwMFoiLCJhdHRlbXB0IjoxLCJkYXRhIjp7fX0=";
+        readonly exactBodyUtf8: "{\"version\":\"2026-07-01\",\"type\":\"schedule.occurrence\",\"scheduleId\":\"sch_0123456789abcdefghjkmnpqrs\",\"occurrenceId\":\"occ_0123456789abcdefghjkmnpqrs\",\"plannedFor\":\"2026-07-28T15:00:00.000Z\",\"attempt\":1,\"data\":{}}";
+        readonly headers: {
+            readonly "Callback-Delivery-Id": "dlv_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Key-Id": "csk_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Occurrence-Id": "occ_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Signature": "v1=11135fdfc0bc5d49ebcc9d3a0d8df1116179097cefe961c6eca281339e5cfab3";
+            readonly "Callback-Timestamp": "2026-07-28T15:00:00.000Z";
+            readonly "Content-Type": "application/json";
+        };
+        readonly secret: "greatwait-signature-vector-key-not-a-credential";
+        readonly signingInputBase64: "MjAyNi0wNy0yOFQxNTowMDowMC4wMDBaLmRsdl8wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycy57InZlcnNpb24iOiIyMDI2LTA3LTAxIiwidHlwZSI6InNjaGVkdWxlLm9jY3VycmVuY2UiLCJzY2hlZHVsZUlkIjoic2NoXzAxMjM0NTY3ODlhYmNkZWZnaGprbW5wcXJzIiwib2NjdXJyZW5jZUlkIjoib2NjXzAxMjM0NTY3ODlhYmNkZWZnaGprbW5wcXJzIiwicGxhbm5lZEZvciI6IjIwMjYtMDctMjhUMTU6MDA6MDAuMDAwWiIsImF0dGVtcHQiOjEsImRhdGEiOnt9fQ==";
+        readonly signingInputUtf8: "2026-07-28T15:00:00.000Z.dlv_0123456789abcdefghjkmnpqrs.{\"version\":\"2026-07-01\",\"type\":\"schedule.occurrence\",\"scheduleId\":\"sch_0123456789abcdefghjkmnpqrs\",\"occurrenceId\":\"occ_0123456789abcdefghjkmnpqrs\",\"plannedFor\":\"2026-07-28T15:00:00.000Z\",\"attempt\":1,\"data\":{}}";
+    };
+    /**
+     * The retired `2026-08-08` envelope **without** `completion`, kept as a known
+     * answer.
+     *
+     * It is the vector `testVector` was until 2026-08-23, moved here rather than
+     * recomputed. Under `2026-08-08` an absent `completion` was the ordinary
+     * case, so this is the shape most deliveries signed under that version had,
+     * and a receiver still verifying them needs its published answer to stay put.
+     */
+    readonly triggerTestVector: {
+        readonly envelope: {
+            readonly attempt: 1;
+            readonly data: {};
+            readonly occurrenceId: "occ_0123456789abcdefghjkmnpqrs";
+            readonly plannedFor: "2026-07-28T15:00:00.000Z";
+            readonly scheduleId: "sch_0123456789abcdefghjkmnpqrs";
+            readonly trigger: {
+                readonly kind: "automatic";
+            };
+            readonly type: "schedule.occurrence";
+            readonly version: "2026-08-08";
+        };
+        readonly exactBodyBase64: "eyJ2ZXJzaW9uIjoiMjAyNi0wOC0wOCIsInR5cGUiOiJzY2hlZHVsZS5vY2N1cnJlbmNlIiwic2NoZWR1bGVJZCI6InNjaF8wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycyIsIm9jY3VycmVuY2VJZCI6Im9jY18wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycyIsInBsYW5uZWRGb3IiOiIyMDI2LTA3LTI4VDE1OjAwOjAwLjAwMFoiLCJhdHRlbXB0IjoxLCJ0cmlnZ2VyIjp7ImtpbmQiOiJhdXRvbWF0aWMifSwiZGF0YSI6e319";
+        readonly exactBodyUtf8: "{\"version\":\"2026-08-08\",\"type\":\"schedule.occurrence\",\"scheduleId\":\"sch_0123456789abcdefghjkmnpqrs\",\"occurrenceId\":\"occ_0123456789abcdefghjkmnpqrs\",\"plannedFor\":\"2026-07-28T15:00:00.000Z\",\"attempt\":1,\"trigger\":{\"kind\":\"automatic\"},\"data\":{}}";
+        readonly headers: {
+            readonly "Callback-Delivery-Id": "dlv_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Key-Id": "csk_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Occurrence-Id": "occ_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Signature": "v1=bd96c6d68a5c0521c18600d92913ce4dcf32036f2c930d0f9db9de55da9280e7";
+            readonly "Callback-Timestamp": "2026-07-28T15:00:00.000Z";
+            readonly "Content-Type": "application/json";
+        };
+        readonly secret: "greatwait-signature-vector-key-not-a-credential";
+        readonly signingInputBase64: "MjAyNi0wNy0yOFQxNTowMDowMC4wMDBaLmRsdl8wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycy57InZlcnNpb24iOiIyMDI2LTA4LTA4IiwidHlwZSI6InNjaGVkdWxlLm9jY3VycmVuY2UiLCJzY2hlZHVsZUlkIjoic2NoXzAxMjM0NTY3ODlhYmNkZWZnaGprbW5wcXJzIiwib2NjdXJyZW5jZUlkIjoib2NjXzAxMjM0NTY3ODlhYmNkZWZnaGprbW5wcXJzIiwicGxhbm5lZEZvciI6IjIwMjYtMDctMjhUMTU6MDA6MDAuMDAwWiIsImF0dGVtcHQiOjEsInRyaWdnZXIiOnsia2luZCI6ImF1dG9tYXRpYyJ9LCJkYXRhIjp7fX0=";
+        readonly signingInputUtf8: "2026-07-28T15:00:00.000Z.dlv_0123456789abcdefghjkmnpqrs.{\"version\":\"2026-08-08\",\"type\":\"schedule.occurrence\",\"scheduleId\":\"sch_0123456789abcdefghjkmnpqrs\",\"occurrenceId\":\"occ_0123456789abcdefghjkmnpqrs\",\"plannedFor\":\"2026-07-28T15:00:00.000Z\",\"attempt\":1,\"trigger\":{\"kind\":\"automatic\"},\"data\":{}}";
+    };
+    /**
+     * The retired `2026-08-08` envelope **with** `completion`, kept as a known
+     * answer.
+     *
+     * Under that version the field was optional and appeared only on a schedule
+     * configured for `callback` completion, and it carried no `deadline`. This is
+     * the published answer for that shape, byte for byte and MAC unchanged: a
+     * receiver mid-rollout is still handed it, and recomputing this vector is
+     * exactly the move that would hide a change to `signingInput`.
+     *
+     * The token is synthetic and shaped like ours without being one. A real token
+     * names an attempt at a dispatch epoch and expires; this is a vector.
+     */
+    readonly completionTestVector: {
+        readonly envelope: {
+            readonly attempt: 1;
+            readonly completion: {
+                readonly token: "v1.example-claim-not-a-real-token.example-mac";
+                readonly url: "https://greatwait-scheduler.example/callbacks/completion";
+            };
+            readonly data: {};
+            readonly occurrenceId: "occ_0123456789abcdefghjkmnpqrs";
+            readonly plannedFor: "2026-07-28T15:00:00.000Z";
+            readonly scheduleId: "sch_0123456789abcdefghjkmnpqrs";
+            readonly trigger: {
+                readonly kind: "automatic";
+            };
+            readonly type: "schedule.occurrence";
+            readonly version: "2026-08-08";
+        };
+        readonly exactBodyBase64: "eyJ2ZXJzaW9uIjoiMjAyNi0wOC0wOCIsInR5cGUiOiJzY2hlZHVsZS5vY2N1cnJlbmNlIiwic2NoZWR1bGVJZCI6InNjaF8wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycyIsIm9jY3VycmVuY2VJZCI6Im9jY18wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycyIsInBsYW5uZWRGb3IiOiIyMDI2LTA3LTI4VDE1OjAwOjAwLjAwMFoiLCJhdHRlbXB0IjoxLCJjb21wbGV0aW9uIjp7InRva2VuIjoidjEuZXhhbXBsZS1jbGFpbS1ub3QtYS1yZWFsLXRva2VuLmV4YW1wbGUtbWFjIiwidXJsIjoiaHR0cHM6Ly9ncmVhdHdhaXQtc2NoZWR1bGVyLmV4YW1wbGUvY2FsbGJhY2tzL2NvbXBsZXRpb24ifSwidHJpZ2dlciI6eyJraW5kIjoiYXV0b21hdGljIn0sImRhdGEiOnt9fQ==";
+        readonly exactBodyUtf8: "{\"version\":\"2026-08-08\",\"type\":\"schedule.occurrence\",\"scheduleId\":\"sch_0123456789abcdefghjkmnpqrs\",\"occurrenceId\":\"occ_0123456789abcdefghjkmnpqrs\",\"plannedFor\":\"2026-07-28T15:00:00.000Z\",\"attempt\":1,\"completion\":{\"token\":\"v1.example-claim-not-a-real-token.example-mac\",\"url\":\"https://greatwait-scheduler.example/callbacks/completion\"},\"trigger\":{\"kind\":\"automatic\"},\"data\":{}}";
+        readonly headers: {
+            readonly "Callback-Delivery-Id": "dlv_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Key-Id": "csk_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Occurrence-Id": "occ_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Signature": "v1=38c6d854051087ed408a5f6252d90375859f305aeb0bca1c3f3a5bb63135e138";
+            readonly "Callback-Timestamp": "2026-07-28T15:00:00.000Z";
+            readonly "Content-Type": "application/json";
+        };
+        readonly secret: "greatwait-signature-vector-key-not-a-credential";
+        readonly signingInputBase64: "MjAyNi0wNy0yOFQxNTowMDowMC4wMDBaLmRsdl8wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycy57InZlcnNpb24iOiIyMDI2LTA4LTA4IiwidHlwZSI6InNjaGVkdWxlLm9jY3VycmVuY2UiLCJzY2hlZHVsZUlkIjoic2NoXzAxMjM0NTY3ODlhYmNkZWZnaGprbW5wcXJzIiwib2NjdXJyZW5jZUlkIjoib2NjXzAxMjM0NTY3ODlhYmNkZWZnaGprbW5wcXJzIiwicGxhbm5lZEZvciI6IjIwMjYtMDctMjhUMTU6MDA6MDAuMDAwWiIsImF0dGVtcHQiOjEsImNvbXBsZXRpb24iOnsidG9rZW4iOiJ2MS5leGFtcGxlLWNsYWltLW5vdC1hLXJlYWwtdG9rZW4uZXhhbXBsZS1tYWMiLCJ1cmwiOiJodHRwczovL2dyZWF0d2FpdC1zY2hlZHVsZXIuZXhhbXBsZS9jYWxsYmFja3MvY29tcGxldGlvbiJ9LCJ0cmlnZ2VyIjp7ImtpbmQiOiJhdXRvbWF0aWMifSwiZGF0YSI6e319";
+        readonly signingInputUtf8: "2026-07-28T15:00:00.000Z.dlv_0123456789abcdefghjkmnpqrs.{\"version\":\"2026-08-08\",\"type\":\"schedule.occurrence\",\"scheduleId\":\"sch_0123456789abcdefghjkmnpqrs\",\"occurrenceId\":\"occ_0123456789abcdefghjkmnpqrs\",\"plannedFor\":\"2026-07-28T15:00:00.000Z\",\"attempt\":1,\"completion\":{\"token\":\"v1.example-claim-not-a-real-token.example-mac\",\"url\":\"https://greatwait-scheduler.example/callbacks/completion\"},\"trigger\":{\"kind\":\"automatic\"},\"data\":{}}";
+    };
+    /**
+     * A redelivery, which is the only vector that discriminates this change.
+     *
+     * The two automatic vectors would still pass an implementation that dropped
+     * `trigger` on the floor and hard-coded `{"kind":"automatic"}`; this one
+     * cannot, because both the kind and the source attempt are inside the signed
+     * bytes.
+     */
+    readonly redeliveryTestVector: {
+        readonly envelope: {
+            readonly attempt: 2;
+            readonly completion: {
+                readonly deadline: "2026-07-28T15:00:05.000Z";
+                readonly token: "v2.example-claim-not-a-real-token.example-mac";
+                readonly url: "https://greatwait-scheduler.example/callbacks/completion";
+            };
+            readonly data: {};
+            readonly occurrenceId: "occ_0123456789abcdefghjkmnpqrs";
+            readonly plannedFor: "2026-07-28T15:00:00.000Z";
+            readonly scheduleId: "sch_0123456789abcdefghjkmnpqrs";
+            readonly trigger: {
+                readonly kind: "redelivery";
+                readonly sourceAttemptId: "att_0123456789abcdefghjkmnpqrs";
+            };
+            readonly type: "schedule.occurrence";
+            readonly version: "2026-08-23";
+        };
+        readonly exactBodyBase64: "eyJ2ZXJzaW9uIjoiMjAyNi0wOC0yMyIsInR5cGUiOiJzY2hlZHVsZS5vY2N1cnJlbmNlIiwic2NoZWR1bGVJZCI6InNjaF8wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycyIsIm9jY3VycmVuY2VJZCI6Im9jY18wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycyIsInBsYW5uZWRGb3IiOiIyMDI2LTA3LTI4VDE1OjAwOjAwLjAwMFoiLCJhdHRlbXB0IjoyLCJjb21wbGV0aW9uIjp7InRva2VuIjoidjIuZXhhbXBsZS1jbGFpbS1ub3QtYS1yZWFsLXRva2VuLmV4YW1wbGUtbWFjIiwidXJsIjoiaHR0cHM6Ly9ncmVhdHdhaXQtc2NoZWR1bGVyLmV4YW1wbGUvY2FsbGJhY2tzL2NvbXBsZXRpb24iLCJkZWFkbGluZSI6IjIwMjYtMDctMjhUMTU6MDA6MDUuMDAwWiJ9LCJ0cmlnZ2VyIjp7ImtpbmQiOiJyZWRlbGl2ZXJ5Iiwic291cmNlQXR0ZW1wdElkIjoiYXR0XzAxMjM0NTY3ODlhYmNkZWZnaGprbW5wcXJzIn0sImRhdGEiOnt9fQ==";
+        readonly exactBodyUtf8: "{\"version\":\"2026-08-23\",\"type\":\"schedule.occurrence\",\"scheduleId\":\"sch_0123456789abcdefghjkmnpqrs\",\"occurrenceId\":\"occ_0123456789abcdefghjkmnpqrs\",\"plannedFor\":\"2026-07-28T15:00:00.000Z\",\"attempt\":2,\"completion\":{\"token\":\"v2.example-claim-not-a-real-token.example-mac\",\"url\":\"https://greatwait-scheduler.example/callbacks/completion\",\"deadline\":\"2026-07-28T15:00:05.000Z\"},\"trigger\":{\"kind\":\"redelivery\",\"sourceAttemptId\":\"att_0123456789abcdefghjkmnpqrs\"},\"data\":{}}";
+        readonly headers: {
+            readonly "Callback-Delivery-Id": "dlv_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Key-Id": "csk_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Occurrence-Id": "occ_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Signature": "v1=9d698aed6d05dcd964f00d6e6796aab238f4f50e6f5cfeb61751fd7850778a04";
+            readonly "Callback-Timestamp": "2026-07-28T15:00:00.000Z";
+            readonly "Content-Type": "application/json";
+        };
+        readonly secret: "greatwait-signature-vector-key-not-a-credential";
+        readonly signingInputBase64: "MjAyNi0wNy0yOFQxNTowMDowMC4wMDBaLmRsdl8wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycy57InZlcnNpb24iOiIyMDI2LTA4LTIzIiwidHlwZSI6InNjaGVkdWxlLm9jY3VycmVuY2UiLCJzY2hlZHVsZUlkIjoic2NoXzAxMjM0NTY3ODlhYmNkZWZnaGprbW5wcXJzIiwib2NjdXJyZW5jZUlkIjoib2NjXzAxMjM0NTY3ODlhYmNkZWZnaGprbW5wcXJzIiwicGxhbm5lZEZvciI6IjIwMjYtMDctMjhUMTU6MDA6MDAuMDAwWiIsImF0dGVtcHQiOjIsImNvbXBsZXRpb24iOnsidG9rZW4iOiJ2Mi5leGFtcGxlLWNsYWltLW5vdC1hLXJlYWwtdG9rZW4uZXhhbXBsZS1tYWMiLCJ1cmwiOiJodHRwczovL2dyZWF0d2FpdC1zY2hlZHVsZXIuZXhhbXBsZS9jYWxsYmFja3MvY29tcGxldGlvbiIsImRlYWRsaW5lIjoiMjAyNi0wNy0yOFQxNTowMDowNS4wMDBaIn0sInRyaWdnZXIiOnsia2luZCI6InJlZGVsaXZlcnkiLCJzb3VyY2VBdHRlbXB0SWQiOiJhdHRfMDEyMzQ1Njc4OWFiY2RlZmdoamttbnBxcnMifSwiZGF0YSI6e319";
+        readonly signingInputUtf8: "2026-07-28T15:00:00.000Z.dlv_0123456789abcdefghjkmnpqrs.{\"version\":\"2026-08-23\",\"type\":\"schedule.occurrence\",\"scheduleId\":\"sch_0123456789abcdefghjkmnpqrs\",\"occurrenceId\":\"occ_0123456789abcdefghjkmnpqrs\",\"plannedFor\":\"2026-07-28T15:00:00.000Z\",\"attempt\":2,\"completion\":{\"token\":\"v2.example-claim-not-a-real-token.example-mac\",\"url\":\"https://greatwait-scheduler.example/callbacks/completion\",\"deadline\":\"2026-07-28T15:00:05.000Z\"},\"trigger\":{\"kind\":\"redelivery\",\"sourceAttemptId\":\"att_0123456789abcdefghjkmnpqrs\"},\"data\":{}}";
+    };
+    /**
+     * The ordinary current-version delivery: automatic, and carrying completion
+     * material because every `2026-08-23` delivery does.
+     */
+    readonly testVector: {
+        readonly envelope: {
+            readonly attempt: 1;
+            readonly completion: {
+                readonly deadline: "2026-07-28T15:00:05.000Z";
+                readonly token: "v2.example-claim-not-a-real-token.example-mac";
+                readonly url: "https://greatwait-scheduler.example/callbacks/completion";
+            };
+            readonly data: {};
+            readonly occurrenceId: "occ_0123456789abcdefghjkmnpqrs";
+            readonly plannedFor: "2026-07-28T15:00:00.000Z";
+            readonly scheduleId: "sch_0123456789abcdefghjkmnpqrs";
+            readonly trigger: {
+                readonly kind: "automatic";
+            };
+            readonly type: "schedule.occurrence";
+            readonly version: "2026-08-23";
+        };
+        readonly exactBodyBase64: "eyJ2ZXJzaW9uIjoiMjAyNi0wOC0yMyIsInR5cGUiOiJzY2hlZHVsZS5vY2N1cnJlbmNlIiwic2NoZWR1bGVJZCI6InNjaF8wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycyIsIm9jY3VycmVuY2VJZCI6Im9jY18wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycyIsInBsYW5uZWRGb3IiOiIyMDI2LTA3LTI4VDE1OjAwOjAwLjAwMFoiLCJhdHRlbXB0IjoxLCJjb21wbGV0aW9uIjp7InRva2VuIjoidjIuZXhhbXBsZS1jbGFpbS1ub3QtYS1yZWFsLXRva2VuLmV4YW1wbGUtbWFjIiwidXJsIjoiaHR0cHM6Ly9ncmVhdHdhaXQtc2NoZWR1bGVyLmV4YW1wbGUvY2FsbGJhY2tzL2NvbXBsZXRpb24iLCJkZWFkbGluZSI6IjIwMjYtMDctMjhUMTU6MDA6MDUuMDAwWiJ9LCJ0cmlnZ2VyIjp7ImtpbmQiOiJhdXRvbWF0aWMifSwiZGF0YSI6e319";
+        readonly exactBodyUtf8: "{\"version\":\"2026-08-23\",\"type\":\"schedule.occurrence\",\"scheduleId\":\"sch_0123456789abcdefghjkmnpqrs\",\"occurrenceId\":\"occ_0123456789abcdefghjkmnpqrs\",\"plannedFor\":\"2026-07-28T15:00:00.000Z\",\"attempt\":1,\"completion\":{\"token\":\"v2.example-claim-not-a-real-token.example-mac\",\"url\":\"https://greatwait-scheduler.example/callbacks/completion\",\"deadline\":\"2026-07-28T15:00:05.000Z\"},\"trigger\":{\"kind\":\"automatic\"},\"data\":{}}";
+        readonly headers: {
+            readonly "Callback-Delivery-Id": "dlv_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Key-Id": "csk_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Occurrence-Id": "occ_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Signature": "v1=5bf68b786fbac1afa7e3474ae5039ad27900b0185bca43a3e45185d56315a312";
+            readonly "Callback-Timestamp": "2026-07-28T15:00:00.000Z";
+            readonly "Content-Type": "application/json";
+        };
+        readonly secret: "greatwait-signature-vector-key-not-a-credential";
+        readonly signingInputBase64: "MjAyNi0wNy0yOFQxNTowMDowMC4wMDBaLmRsdl8wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycy57InZlcnNpb24iOiIyMDI2LTA4LTIzIiwidHlwZSI6InNjaGVkdWxlLm9jY3VycmVuY2UiLCJzY2hlZHVsZUlkIjoic2NoXzAxMjM0NTY3ODlhYmNkZWZnaGprbW5wcXJzIiwib2NjdXJyZW5jZUlkIjoib2NjXzAxMjM0NTY3ODlhYmNkZWZnaGprbW5wcXJzIiwicGxhbm5lZEZvciI6IjIwMjYtMDctMjhUMTU6MDA6MDAuMDAwWiIsImF0dGVtcHQiOjEsImNvbXBsZXRpb24iOnsidG9rZW4iOiJ2Mi5leGFtcGxlLWNsYWltLW5vdC1hLXJlYWwtdG9rZW4uZXhhbXBsZS1tYWMiLCJ1cmwiOiJodHRwczovL2dyZWF0d2FpdC1zY2hlZHVsZXIuZXhhbXBsZS9jYWxsYmFja3MvY29tcGxldGlvbiIsImRlYWRsaW5lIjoiMjAyNi0wNy0yOFQxNTowMDowNS4wMDBaIn0sInRyaWdnZXIiOnsia2luZCI6ImF1dG9tYXRpYyJ9LCJkYXRhIjp7fX0=";
+        readonly signingInputUtf8: "2026-07-28T15:00:00.000Z.dlv_0123456789abcdefghjkmnpqrs.{\"version\":\"2026-08-23\",\"type\":\"schedule.occurrence\",\"scheduleId\":\"sch_0123456789abcdefghjkmnpqrs\",\"occurrenceId\":\"occ_0123456789abcdefghjkmnpqrs\",\"plannedFor\":\"2026-07-28T15:00:00.000Z\",\"attempt\":1,\"completion\":{\"token\":\"v2.example-claim-not-a-real-token.example-mac\",\"url\":\"https://greatwait-scheduler.example/callbacks/completion\",\"deadline\":\"2026-07-28T15:00:05.000Z\"},\"trigger\":{\"kind\":\"automatic\"},\"data\":{}}";
+    };
+    readonly unicodeTestVector: {
+        readonly envelope: {
+            readonly attempt: 1;
+            readonly completion: {
+                readonly deadline: "2026-07-28T15:00:05.000Z";
+                readonly token: "v2.example-claim-not-a-real-token.example-mac";
+                readonly url: "https://greatwait-scheduler.example/callbacks/completion";
+            };
+            readonly data: {
+                readonly note: "café ☃";
+            };
+            readonly occurrenceId: "occ_0123456789abcdefghjkmnpqrs";
+            readonly plannedFor: "2026-07-28T15:00:00.000Z";
+            readonly scheduleId: "sch_0123456789abcdefghjkmnpqrs";
+            readonly trigger: {
+                readonly kind: "automatic";
+            };
+            readonly type: "schedule.occurrence";
+            readonly version: "2026-08-23";
+        };
+        readonly exactBodyBase64: "eyJ2ZXJzaW9uIjoiMjAyNi0wOC0yMyIsInR5cGUiOiJzY2hlZHVsZS5vY2N1cnJlbmNlIiwic2NoZWR1bGVJZCI6InNjaF8wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycyIsIm9jY3VycmVuY2VJZCI6Im9jY18wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycyIsInBsYW5uZWRGb3IiOiIyMDI2LTA3LTI4VDE1OjAwOjAwLjAwMFoiLCJhdHRlbXB0IjoxLCJjb21wbGV0aW9uIjp7InRva2VuIjoidjIuZXhhbXBsZS1jbGFpbS1ub3QtYS1yZWFsLXRva2VuLmV4YW1wbGUtbWFjIiwidXJsIjoiaHR0cHM6Ly9ncmVhdHdhaXQtc2NoZWR1bGVyLmV4YW1wbGUvY2FsbGJhY2tzL2NvbXBsZXRpb24iLCJkZWFkbGluZSI6IjIwMjYtMDctMjhUMTU6MDA6MDUuMDAwWiJ9LCJ0cmlnZ2VyIjp7ImtpbmQiOiJhdXRvbWF0aWMifSwiZGF0YSI6eyJub3RlIjoiY2Fmw6kg4piDIn19";
+        readonly exactBodyUtf8: "{\"version\":\"2026-08-23\",\"type\":\"schedule.occurrence\",\"scheduleId\":\"sch_0123456789abcdefghjkmnpqrs\",\"occurrenceId\":\"occ_0123456789abcdefghjkmnpqrs\",\"plannedFor\":\"2026-07-28T15:00:00.000Z\",\"attempt\":1,\"completion\":{\"token\":\"v2.example-claim-not-a-real-token.example-mac\",\"url\":\"https://greatwait-scheduler.example/callbacks/completion\",\"deadline\":\"2026-07-28T15:00:05.000Z\"},\"trigger\":{\"kind\":\"automatic\"},\"data\":{\"note\":\"café ☃\"}}";
+        readonly headers: {
+            readonly "Callback-Delivery-Id": "dlv_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Key-Id": "csk_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Occurrence-Id": "occ_0123456789abcdefghjkmnpqrs";
+            readonly "Callback-Signature": "v1=18a8d1c50ea54bd0a5ec27abe80d1c98e44a7f358ecf8f06615c174075100e72";
+            readonly "Callback-Timestamp": "2026-07-28T15:00:00.000Z";
+            readonly "Content-Type": "application/json";
+        };
+        readonly secret: "greatwait-signature-vector-key-not-a-credential";
+        readonly signingInputBase64: "MjAyNi0wNy0yOFQxNTowMDowMC4wMDBaLmRsdl8wMTIzNDU2Nzg5YWJjZGVmZ2hqa21ucHFycy57InZlcnNpb24iOiIyMDI2LTA4LTIzIiwidHlwZSI6InNjaGVkdWxlLm9jY3VycmVuY2UiLCJzY2hlZHVsZUlkIjoic2NoXzAxMjM0NTY3ODlhYmNkZWZnaGprbW5wcXJzIiwib2NjdXJyZW5jZUlkIjoib2NjXzAxMjM0NTY3ODlhYmNkZWZnaGprbW5wcXJzIiwicGxhbm5lZEZvciI6IjIwMjYtMDctMjhUMTU6MDA6MDAuMDAwWiIsImF0dGVtcHQiOjEsImNvbXBsZXRpb24iOnsidG9rZW4iOiJ2Mi5leGFtcGxlLWNsYWltLW5vdC1hLXJlYWwtdG9rZW4uZXhhbXBsZS1tYWMiLCJ1cmwiOiJodHRwczovL2dyZWF0d2FpdC1zY2hlZHVsZXIuZXhhbXBsZS9jYWxsYmFja3MvY29tcGxldGlvbiIsImRlYWRsaW5lIjoiMjAyNi0wNy0yOFQxNTowMDowNS4wMDBaIn0sInRyaWdnZXIiOnsia2luZCI6ImF1dG9tYXRpYyJ9LCJkYXRhIjp7Im5vdGUiOiJjYWbDqSDimIMifX0=";
+        readonly signingInputUtf8: "2026-07-28T15:00:00.000Z.dlv_0123456789abcdefghjkmnpqrs.{\"version\":\"2026-08-23\",\"type\":\"schedule.occurrence\",\"scheduleId\":\"sch_0123456789abcdefghjkmnpqrs\",\"occurrenceId\":\"occ_0123456789abcdefghjkmnpqrs\",\"plannedFor\":\"2026-07-28T15:00:00.000Z\",\"attempt\":1,\"completion\":{\"token\":\"v2.example-claim-not-a-real-token.example-mac\",\"url\":\"https://greatwait-scheduler.example/callbacks/completion\",\"deadline\":\"2026-07-28T15:00:05.000Z\"},\"trigger\":{\"kind\":\"automatic\"},\"data\":{\"note\":\"café ☃\"}}";
+    };
+    readonly version: "2026-08-23";
+};
+/**
+ * One published known-answer vector, whatever version it is for.
+ *
+ * The shape every vector in {@link CALLBACK_DELIVERY_PROTOCOL} has, named so
+ * the whole set can be enumerated rather than listed.
+ */
+export interface CallbackDeliveryTestVector {
+    readonly envelope: CallbackEnvelope;
+    readonly exactBodyBase64: string;
+    readonly exactBodyUtf8: string;
+    /**
+     * Every header the delivery carries, named rather than indexed.
+     *
+     * A `Record<string, string>` would read back as `string | undefined` under
+     * `noUncheckedIndexedAccess`, which makes every consumer assert a header the
+     * vector is defined to have — and an assertion is exactly what a published
+     * known answer should not need.
+     */
+    readonly headers: {
+        readonly "Callback-Delivery-Id": string;
+        readonly "Callback-Key-Id": string;
+        readonly "Callback-Occurrence-Id": string;
+        readonly "Callback-Signature": string;
+        readonly "Callback-Timestamp": string;
+        readonly "Content-Type": string;
+    };
+    readonly secret: string;
+    readonly signingInputBase64: string;
+    readonly signingInputUtf8: string;
+}
+/**
+ * Every published vector, derived from the protocol rather than listed.
+ *
+ * **A hand-written list is the failure this exists to prevent.** The duplicated
+ * serializer in `@greatwait/delivery` is held byte-for-byte against these, and
+ * the one time it drifted, it drifted on the field whose vector nobody had
+ * added to the list yet. Reading the protocol object means a vector added later
+ * is driven by every suite that already iterates this, with no second edit.
+ *
+ * **Matched by shape rather than by name**, which is not fastidiousness: the
+ * first version of this matched keys ending in `TestVector` and silently
+ * dropped `testVector`, whose lower-case first letter makes that suffix test
+ * false. A filter that quietly returns one fewer than it should is the same
+ * failure as the hand-written list, arrived at differently.
+ */
+export declare function callbackDeliveryTestVectors(): readonly (CallbackDeliveryTestVector & {
+    readonly name: string;
+})[];
+/**
+ * What moving the envelope to `2026-08-08` is, in the vocabulary the
+ * compatibility module classifies.
+ *
+ * Recorded as data rather than asserted in prose because the verdict is an
+ * output: `assess(CALLBACK_ENVELOPE_VERSION_CHANGE)` returns
+ * `{ kind: "breaking", requiresNewContractVersion: true }`, and a fixture holds
+ * it there. "It only added a field, so it is additive" is the reading this
+ * exists to refuse — what a client parses is not the field, it is the version
+ * literal, and that literal *changed*.
+ *
+ * The contract version does not move with it. `CONTRACT_VERSION` versions the
+ * REST surface; the envelope carries its own dated version precisely so a break
+ * in the callback body does not force every API client to re-pin.
+ */
+export declare const CALLBACK_ENVELOPE_VERSION_CHANGE: {
+    readonly operation: "changed";
+    readonly subject: "response-field";
+};
+/**
+ * How a receiver's response is classified. Public and stable: a customer tunes
+ * their endpoint against these categories.
+ */
+export type ResponseClass = "ambiguous" | "retryable" | "success" | "terminal";
+/**
+ * The outcome of one delivery attempt. `no-response` is a first-class case,
+ * not an absent status: a timeout or a dropped connection means the receiver
+ * may or may not have acted, and collapsing that into a status code is how an
+ * occurrence gets silently dropped. The copied engine already produces exactly
+ * this case.
+ */
+export type AttemptOutcome = {
+    readonly kind: "no-response";
+} | {
+    readonly kind: "status";
+    readonly status: number;
+};
+/**
+ * Classifies a status code alone. Use `classifyOutcome` where a request may not
+ * complete.
+ *
+ * **`isCallbackRefusalStatus` is consulted rather than duplicated here.** This
+ * function is the published statement of what a receiver's answer means and
+ * `performGreatwaitAttempt` is what acts on it; before FXO-1596 the two carried
+ * the same status boundary as two independent literals, kept equal by hand.
+ * They are now one list, so a status cannot be retried by the executor while
+ * this function tells the customer it was terminal.
+ */
+export declare function classifyStatus(status: number): ResponseClass;
+export declare function classifyOutcome(outcome: AttemptOutcome): ResponseClass;