@greatwait/contracts 0.1.0-alpha.2 → 0.1.0-alpha.4

package/dist/identity.js

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "./zod.js";
 /**
  * External identity, and what it projects into.
  *
@@ -52,13 +52,13 @@ export const externalMembershipIdSchema = z
     .string()
     .regex(/^orgmem_[A-Za-z0-9]{1,64}$/u, 'must be a Clerk membership identifier: "orgmem_" followed by alphanumerics');
 /**
- * Product roles, projected from Clerk's `org:admin` and `org:member`.
+ * Product roles, projected from Clerk's organization roles.
  *
  * Named without the `org:` prefix because these are ours: W1-03 builds the
  * role-to-scope matrix on them, and binding that matrix to a vendor's string
  * format would make changing identity providers a contract change.
  */
-export const MEMBERSHIP_ROLES = ["admin", "member"];
+export const MEMBERSHIP_ROLES = ["admin", "billing", "member"];
 export const membershipRoleSchema = z.enum(MEMBERSHIP_ROLES);
 /**
  * Whether a membership currently grants anything.
@@ -79,7 +79,8 @@ export function grantsAccess(status) {
  * `reconcileMembership`.
  */
 const ROLE_RANK = {
-    admin: 1,
+    admin: 2,
+    billing: 1,
     member: 0,
 };
 const STATUS_RANK = {

package/dist/index.d.ts

@@ -1,8 +1,10 @@
+export { DATA_EXPORT_STATES, dataExportIdSchema, newDataExportId, dataExportStateSchema, dataExportCreateRequestSchema, dataExportSchema, dataExportPartRequestSchema, dataExportPartSchema, dataExportCancelledSchema, type DataExport, type DataExportPart, } from "./data-export.js";
+export { organizationLifecycleSchema, organizationClosureRequestSchema, organizationRestoreRequestSchema, type OrganizationLifecycle, } from "./organization-lifecycle.js";
 export { ANY_ID_PATTERN, ID_ALPHABET, ID_PREFIXES, apiCredentialEventIdSchema, apiCredentialIdSchema, attemptIdSchema, authorizationRequestIdSchema, callbackSigningKeyIdSchema, deliveryIdSchema, endpointIdSchema, environmentIdSchema, eventIdSchema, idPattern, idSchema, newId, oauthClientIdSchema, oauthGrantEventIdSchema, oauthGrantIdSchema, occurrenceIdSchema, organizationIdSchema, projectIdSchema, resourceOf, scheduleIdSchema, testSinkDeliveryIdSchema, testSinkIdSchema, type ApiCredentialEventId, type ApiCredentialId, type AttemptId, type AuthorizationRequestId, type CallbackSigningKeyId, type DeliveryId, type EndpointId, type EnvironmentId, type IdResource, type OAuthClientId, type OAuthGrantEventId, type OAuthGrantId, type OccurrenceId, type OrganizationId, type RandomBytes, type ProjectId, type ScheduleId, type TestSinkDeliveryId, type TestSinkId, } from "./identifiers.js";
 export { durationSecondsSchema, timeZoneSchema, timestampSchema, toTimestamp, type DurationSeconds, type TimeZone, type Timestamp, } from "./time.js";
-export { ENVIRONMENT_KINDS_IN_ORDER, PRINCIPAL_KINDS, SCOPES, SESSION_AUTHORITY_HEADERS, authoritySchema, decideAccess, decideEnvironmentIntent, effectiveScopes, problemCodeForRefusal, environmentKindSchema, principalKindSchema, principalSchema, scopeSchema, type AccessDecision, type AccessRefusal, type AccessRequest, type Authority, type EnvironmentIntentDecision, type EnvironmentKind, type Principal, type PrincipalKind, type Scope, } from "./authority.js";
+export { ENVIRONMENT_KINDS_IN_ORDER, PRINCIPAL_KINDS, SCOPES, SESSION_AUTHORITY_HEADERS, authoritySchema, credentialContextSchema, decideAccess, decideEnvironmentIntent, effectiveScopes, problemCodeForRefusal, environmentKindSchema, principalKindSchema, principalSchema, scopeSchema, type AccessDecision, type AccessRefusal, type AccessRequest, type Authority, type CredentialContext, type EnvironmentIntentDecision, type EnvironmentKind, type Principal, type PrincipalKind, type Scope, } from "./authority.js";
 export { PROBLEM_CATEGORIES, PROBLEM_CODES, fieldErrorSchema, isRetryable, problem, problemCategorySchema, problemCodeSchema, problemSchema, type FieldError, type Problem, type ProblemCategory, type ProblemCode, type ProblemOptions, } from "./problems.js";
-export { CONCURRENCY_HEADERS, PAGE_SIZE, canonicalRequest, classifyIdempotency, conditionalRequestHeaderSchema, decodeCursor, encodeCursor, etagSchema, freshnessSchema, projectedFreshnessSchema, fromETag, idempotencyKeySchema, idempotencyReplayResponseHeaderSchema, idempotencyRequestHeaderSchema, idempotencyReceiptSchema, idempotencyScopeSchema, pageRequestSchema, pageSchema, parsePageRequest, replayedResponseHeaderSchema, requiredIdempotencyRequestHeaderSchema, requestFingerprint, toETag, versionResponseHeaderSchema, versionSchema, type Freshness, type ProjectedFreshness, type IdempotencyKey, type IdempotencyOutcome, type IdempotencyReceipt, type IdempotencyScope, type PagePosition, type PageRequest, type PageRequestParse, type Version, } from "./protocol.js";
+export { CONCURRENCY_HEADERS, PAGE_SIZE, canonicalRequest, classifyIdempotency, conditionalRequestHeaderSchema, decodeCursor, encodeCursor, etagSchema, freshnessSchema, projectedFreshnessSchema, requiredConditionalRequestHeaderSchema, fromETag, idempotencyKeySchema, idempotencyReplayResponseHeaderSchema, idempotencyRequestHeaderSchema, idempotencyReceiptSchema, idempotencyScopeSchema, HISTORY_ORDERS, historyPageRequestSchema, pageRequestSchema, scheduleListRequestSchema, parseHistoryPageRequest, pageSchema, parsePageRequest, parseScheduleListRequest, replayedResponseHeaderSchema, requiredIdempotencyRequestHeaderSchema, requestFingerprint, toETag, versionResponseHeaderSchema, versionSchema, type Freshness, type CursorBinding, type ProjectedFreshness, type IdempotencyKey, type IdempotencyOutcome, type IdempotencyReceipt, type IdempotencyScope, type PagePosition, type PageRequest, SCHEDULE_ORDERS, type ScheduleListRequest, type ScheduleListRequestParse, type ScheduleOrder, type HistoryOrder, type HistoryPageRequest, type HistoryPageRequestParse, type PageRequestParse, type Version, } from "./protocol.js";
 export { CALLBACK_CONTENT_TYPE, CALLBACK_DELIVERY_PROTOCOL, CALLBACK_DELIVERY_PROTOCOL_VERSION, CALLBACK_ENVELOPE_VERSION, CALLBACK_ENVELOPE_VERSION_2026_07_01, CALLBACK_ENVELOPE_VERSION_2026_08_08, CALLBACK_ENVELOPE_VERSION_CHANGE, CALLBACK_ENVELOPE_VERSIONS, CALLBACK_HEADERS, SIGNATURE_SCHEME, SIGNATURE_TOLERANCE_SECONDS, callbackDeferredCompletionSchema, callbackDeliveryTestVectors, callbackEnvelopeSchema, callbackEnvelopeTrigger, callbackHeadersSchema, callbackRun, callbackTriggerSchema, classifyOutcome, classifyStatus, formatSignature, extractCanonicalEnvelopeIds, isTimestampFresh, signatureHeaderSchema, serializeCallbackEnvelope, signingInput, trySigningInput, type AttemptOutcome, type CallbackDeferredCompletion, type CallbackDeliveryTestVector, type CallbackEnvelope, type CallbackRun, type CallbackTrigger, type ResponseClass, } from "./signatures.js";
 export { CREDENTIAL_PREFIX_LENGTH, CREDENTIAL_PREFIX_PATTERN, CREDENTIAL_ROTATION_OVERLAP_SECONDS, CREDENTIAL_SECRET_LENGTH, CREDENTIAL_SECRET_PATTERN, NEVER_REDACTED, REDACTED_FIELDS_EXACT, REDACTED_FIELD_FRAGMENTS, credentialCreatedSchema, credentialMetadataSchema, credentialPageSchema, credentialRequestSchema, credentialRevokedSchema, credentialRotatedSchema, credentialRotationRequestSchema, redact, type CredentialCreated, type CredentialMetadata, type CredentialPage, type CredentialRequest, type CredentialRevokedResponse, type CredentialRotated, type CredentialRotationRequest, } from "./secrets.js";
 export { MAX_PARTITION_SHARDS, PROJECTION_DRAIN_LIMIT, SINGLE_SHARD, partitionInstanceName, partitionShardCount, partitionShardFor, partitionShardForIdempotencyKey, type CreateScheduleCommand, type CreateScheduleOutcome, type AttemptPagePosition, type DrainProjectionsOutcome, type DrainProjectionsQuery, type ForecastOutcome, type ForecastPartitionBucket, type ForecastQuery, type IdempotencyDisposition, type ListSchedulesOutcome, type ListSchedulesQuery, type ListAttemptsOutcome, type ListAttemptsQuery, type ListOccurrencesOutcome, type ListOccurrencesQuery, type OccurrencePagePosition, type PartitionOutcome, type PartitionRefusal, type PartitionRefused, type PartitionRpc, type ProjectionIntent, type ReadScheduleQuery, type ReadAttemptOutcome, type ReadAttemptQuery, type ReadOccurrenceOutcome, type ReadOccurrenceQuery, type RedeliverOccurrenceCommand, type RedeliverOccurrenceOutcome, type ReplaceScheduleCommand, type RetainedProjections, type ScheduleDefinition, type ScheduleWriteCommand, type ScheduleWriteOutcome, type SettleProjectionsCommand, type SettleProjectionsOutcome, } from "./partition.js";
@@ -10,17 +12,20 @@ export { EVENT_TYPES, eventEnvelopeSchema, eventTypeSchema, genericEventSchema,
 export { MEMBERSHIP_ROLES, MEMBERSHIP_STATUSES, externalMembershipIdSchema, externalOrganizationIdSchema, externalUserIdSchema, grantsAccess, leastRole, leastStatus, membershipChangeSchema, membershipRoleSchema, membershipSchema, membershipStatusSchema, organizationTombstoneSchema, sessionMembershipSchema, type ExternalMembershipId, type ExternalOrganizationId, type ExternalUserId, type Membership, type MembershipChange, type MembershipRole, type MembershipStatus, type OrganizationTombstone, type SessionMembership, } from "./identity.js";
 export { CHANGE_KINDS, CHANGE_OPERATIONS, CHANGE_SUBJECTS, CONTRACT_VERSION, assess, changeKindSchema, classifyChange, contractVersionSchema, type ChangeKind, type ChangeOperation, type ChangeSubject, type CompatibilityVerdict, type ContractChange, } from "./compatibility.js";
 export { WORKSPACE_LAYERS, scaffoldProblemSchema, scaffoldVersionSchema, toolDescriptorSchema, toolListSchema, workspaceIdentitySchema, workspaceLayerSchema, workspaceScaffoldSchema, type ScaffoldProblem, type ScaffoldVersion, type ToolDescriptor, type ToolList, type WorkspaceIdentity, type WorkspaceLayer, type WorkspaceScaffold, } from "./workspace.js";
-export { MOCK_BEHAVIORS, MOCK_HEADERS, OPERATIONS, UNIVERSAL_PROBLEMS, AUTHENTICATED_PROBLEMS, findOperation, fixtureListSchema, mockBehaviorSchema, mockScenarioRequestSchema, mockScenarioResponseSchema, operationsFor, problemsFor, requestSchemaFor, responseSchemaFor, successStatusFor, type FixtureList, type McpDisposition, type MockBehavior, type MockScenarioRequest, type MockScenarioResponse, type OperationDefinition, type OperationId, type OperationSurface, } from "./operations.js";
-export { PROJECT_LIST_LIMIT, PROJECT_STATUSES, environmentSchema, organizationSchema, projectCreateRequestSchema, projectListSchema, projectNameSchema, projectSchema, projectStatusSchema, projectSummarySchema, provisionedProjectSchema, type Environment, type Organization, type Project, type ProjectCreateRequest, type ProjectList, type ProjectStatus, type ProjectSummary, type ProvisionedProject, } from "./tenancy.js";
-export { ATTEMPT_DURATION_MAX_MS, ATTEMPT_FAILURE_SNIPPET_MAX_LENGTH, ATTEMPT_REMEDIATIONS, ATTEMPT_RESPONSE_HEADER_MAX_LENGTH, ATTEMPT_STATES, CRON_EXPRESSION_MAX_LENGTH, LATENCY_CLASSES, OCCURRENCE_STATES, PARTITION_KEY_MAX_LENGTH, RECURRENCE_REQUEST_FIELDS, SCHEDULE_STATUSES, SCHEDULING_BOUNDS, TERMINAL_OCCURRENCE_STATES, attemptFailureSnippetSchema, attemptResponseHeaderSchema, attemptSchema, attemptDiagnosticSchema, attemptPageSchema, attemptRemediationSchema, attemptStateForResponse, attemptStateSchema, attemptTriggerSchema, attemptViewSchema, cronExpressionSchema, DELIVERY_COMPLETION_MODES, DELIVERY_DURATION_TIERS, DELIVERY_OVERLAP_POLICIES, DEFAULT_DELIVERY_DURATION_SECONDS, DEFAULT_DELIVERY_OVERLAP_POLICY, FREE_DELIVERY_DURATION_SECONDS, isLongRunningDuration, deliveryCompletionModeSchema, deliveryDurationSecondsSchema, deliveryOverlapPolicySchema, type DeliveryCompletionMode, type DeliveryOverlapPolicy, deriveDeliverySettings, deriveLatencyClass, generationSchema, isTerminalOccurrenceState, latencyClassSchema, occurrenceSchema, occurrencePageSchema, occurrenceStateSchema, occurrenceViewSchema, partitionKeySchema, remediationForAttempt, recurrenceSchema, schedulePageSchema, scheduleRequestSchema, scheduleSchema, scheduleStatusSchema, scheduleViewSchema, type Attempt, type AttemptFailureSnippet, type AttemptResponseHeader, type AttemptDiagnostic, type AttemptPage, type AttemptRemediation, type AttemptState, type AttemptTrigger, type AttemptView, type CronExpression, type Generation, type DeliverySettings, type LatencyClass, type Occurrence, type OccurrencePage, type OccurrenceState, type OccurrenceView, type PartitionKey, type Recurrence, type Schedule, type SchedulePage, type ScheduleRequest, type ScheduleStatus, type ScheduleView, } from "./scheduling.js";
+export { MOCK_BEHAVIORS, MOCK_HEADERS, OPERATIONS, UNIVERSAL_PROBLEMS, AUTHENTICATED_PROBLEMS, SCOPED_PROBLEMS, findOperation, fixtureListSchema, mockBehaviorSchema, mockScenarioRequestSchema, mockScenarioResponseSchema, operationsFor, problemsFor, requestSchemaFor, responseSchemaFor, successStatusFor, type FixtureList, type McpDisposition, type MockBehavior, type MockScenarioRequest, type MockScenarioResponse, type OperationDefinition, type OperationId, type OperationSurface, } from "./operations.js";
+export { PROJECT_LIST_LIMIT, PROJECT_STATUSES, environmentSchema, organizationSchema, projectCreateRequestSchema, projectArchiveRequestSchema, projectDeletedSchema, projectDeletionCountsSchema, projectListSchema, projectNameKey, projectNameSchema, projectSchema, projectStatusSchema, projectSummarySchema, projectUpdateRequestSchema, provisionedProjectSchema, type Environment, type Organization, type Project, type ProjectCreateRequest, type ProjectArchiveRequest, type ProjectDeleted, type ProjectDeletionCounts, type ProjectList, type ProjectStatus, type ProjectSummary, type ProjectUpdateRequest, type ProvisionedProject, } from "./tenancy.js";
+export { ATTEMPT_DURATION_MAX_MS, ATTEMPT_FAILURE_SNIPPET_MAX_LENGTH, ATTEMPT_REMEDIATIONS, ATTEMPT_RESPONSE_HEADER_MAX_LENGTH, ATTEMPT_STATES, CRON_EXPRESSION_MAX_LENGTH, LATENCY_CLASSES, OCCURRENCE_STATES, PARTITION_KEY_MAX_LENGTH, RECURRENCE_REQUEST_FIELDS, SCHEDULE_STATUSES, SCHEDULING_BOUNDS, TERMINAL_OCCURRENCE_STATES, attemptFailureSnippetSchema, attemptResponseHeaderSchema, attemptSchema, attemptDiagnosticSchema, attemptPageSchema, attemptRemediationSchema, attemptStateForResponse, attemptStateSchema, attemptTriggerSchema, attemptViewSchema, cronExpressionSchema, DELIVERY_COMPLETION_MODES, DELIVERY_DURATION_TIERS, MAX_DELIVERY_DURATION_SECONDS, RESPONSE_DELIVERY_MAX_DURATION_SECONDS, DELIVERY_OVERLAP_POLICIES, DEFAULT_DELIVERY_DURATION_SECONDS, DEFAULT_DELIVERY_OVERLAP_POLICY, FREE_DELIVERY_DURATION_SECONDS, DEFAULT_ONE_SHOT_MAX_STALENESS_SECONDS, LATENESS_POLICIES, isLongRunningDuration, deliveryCompletionModeSchema, deliveryDurationSecondsSchema, deliveryOverlapPolicySchema, type DeliveryCompletionMode, type DeliveryOverlapPolicy, deriveDeliverySettings, deriveLatencyClass, deriveLatenessSettings, defaultLatenessPolicyForRecurrence, generationSchema, isTerminalOccurrenceState, latencyClassSchema, latenessPolicySchema, occurrenceSchema, occurrencePageSchema, parseProjectOccurrenceListRequest, projectOccurrenceCursorBinding, projectOccurrenceListRequestSchema, projectOccurrencePageSchema, occurrenceStateSchema, occurrenceViewSchema, partitionKeySchema, remediationForAttempt, recurrenceSchema, scheduleNameSchema, scheduleLatenessRequestSchema, scheduleLatenessSchema, schedulePageSchema, scheduleRequestSchema, scheduleSchema, scheduleStatusSchema, scheduleViewSchema, type Attempt, type AttemptFailureSnippet, type AttemptResponseHeader, type AttemptDiagnostic, type AttemptPage, type AttemptRemediation, type AttemptState, type AttemptTrigger, type AttemptView, type CronExpression, type Generation, type DeliverySettings, type LatencyClass, type LatenessPolicy, type LatenessSettings, type Occurrence, type OccurrencePage, type ProjectOccurrenceListRequest, type ProjectOccurrenceListRequestParse, type ProjectOccurrencePage, type OccurrenceState, type OccurrenceView, type PartitionKey, type Recurrence, type Schedule, type ScheduleLatenessRequest, type SchedulePage, type ScheduleRequest, type ScheduleStatus, type ScheduleView, } from "./scheduling.js";
 export { portableAttemptRecordSchema, portableEncryptedPayloadRecordSchema, portableOccurrenceRecordSchema, portableReceiptRecordSchema, portableScheduleRecordSchema, portableSchedulingRecordSetSchema, type PortableAttemptRecord, type PortableEncryptedPayloadRecord, type PortableOccurrenceRecord, type PortableReceiptRecord, type PortableScheduleRecord, type PortableSchedulingRecordSet, } from "./scheduling-records.js";
 export { ROLE_SCOPE_CEILINGS, capScopesToRole, ceilingForRole, credentialScopes, grantableScopes, policyMatrix, roleAllows, roleCanPerform, type PolicyMatrixRow, } from "./policy.js";
 export { ACCESS_TOKEN_PATTERN, ACCESS_TOKEN_TTL_SECONDS, AUTHORIZATION_CODE_PATTERN, AUTHORIZATION_CODE_TTL_SECONDS, AUTHORIZATION_REQUEST_TTL_SECONDS, MAX_REDIRECT_URIS, OAUTH_ERRORS, OAUTH_ERROR_STATUS, OAUTH_GRANT_STATUSES, OAUTH_GRANT_TYPES, OAUTH_RESPONSE_TYPES, OAUTH_REVOCATION_REASONS, OAUTH_ROUTES, OAUTH_SECRET_PATTERN, OAUTH_TOKEN_NAMESPACE_LENGTH, OAUTH_TOKEN_SECRET_LENGTH, PKCE_CHALLENGE_PATTERN, PKCE_METHODS, PKCE_VERIFIER_PATTERN, REFRESH_TOKEN_PATTERN, REFRESH_TOKEN_TTL_SECONDS, TOKEN_ENDPOINT_AUTH_METHODS, authorizationParametersSchema, authorizationServerMetadataSchema, bearerChallenge, clientRegistrationRequestSchema, clientRegistrationSchema, consentDecisionSchema, consentOutcomeSchema, consentPromptSchema, formatScopeString, isLoopbackRedirect, oauthError, oauthErrorCodeSchema, oauthErrorSchema, oauthGrantListSchema, oauthGrantRevokedSchema, oauthGrantSchema, oauthGrantStatusSchema, oauthGrantTypeSchema, oauthRevocationReasonSchema, parseScopeString, pkceMethodSchema, protectedResourceMetadataSchema, redirectUriSchema, revocationRequestSchema, tokenRequestSchema, tokenResponseSchema, type AuthorizationParameters, type AuthorizationServerMetadata, type ClientRegistration, type ClientRegistrationRequest, type ConsentDecision, type ConsentOutcome, type ConsentPrompt, type OAuthErrorBody, type OAuthErrorCode, type OAuthGrant, type OAuthGrantList, type OAuthGrantRevoked, type OAuthGrantStatus, type OAuthGrantType, type OAuthRevocationReason, type ProtectedResourceMetadata, type RevocationRequest, type TokenRequest, type TokenResponse, } from "./oauth.js";
 export { CALLBACK_ENVELOPE_HEADROOM_BYTES, CALLBACK_RECEIVER_MAX_BODY_BYTES, } from "./callback-receiver.js";
-export { CALLBACK_OWNERSHIP_POLICIES, DEFAULT_CALLBACK_OWNERSHIP_POLICY, readCallbackOwnershipPolicy, sendableStatuses, type CallbackOwnershipPolicy, } from "./callback-ownership.js";
 export { CALLBACK_ENDPOINT_SECRET_PATTERN, CALLBACK_URL_REJECTION_REASONS, evaluateCallbackUrl, isPublicCallbackAddress, type CallbackUrlRejectionReason, } from "./callback-safety.js";
-export { CALLBACK_ENDPOINT_LIMIT_PER_ENVIRONMENT, CALLBACK_ENDPOINT_STATUSES, CALLBACK_SIGNING_KEY_ROTATION_OVERLAP_SECONDS, CALLBACK_VERIFICATION_FAILURES, CALLBACK_VERIFICATION_HEADERS, CALLBACK_VERIFICATION_PROTOCOL, CALLBACK_VERIFICATION_PROTOCOL_VERSION, CALLBACK_VERIFICATION_RATE_LIMITS, CALLBACK_VERIFICATION_RESPONSE_BYTES, CALLBACK_VERIFICATION_TIMEOUT_MILLISECONDS, CALLBACK_VERIFICATION_TYPE, callbackEndpointCreatedSchema, callbackEndpointPageSchema, callbackEndpointRequestSchema, callbackEndpointRotatedSchema, callbackEndpointSchema, callbackEndpointStatusSchema, callbackSigningKeyRotationRequestSchema, callbackSigningKeysSchema, callbackVerificationChallengeSchema, callbackVerificationFailureSchema, type CallbackEndpoint, type CallbackEndpointCreated, type CallbackEndpointPage, type CallbackEndpointRequest, type CallbackEndpointRotated, type CallbackEndpointStatus, type CallbackSigningKeyRotationRequest, type CallbackSigningKeys, type CallbackVerificationChallenge, type CallbackVerificationFailure, } from "./endpoints.js";
+export { CALLBACK_ENDPOINT_LIMIT_PER_ENVIRONMENT, CALLBACK_ENDPOINT_STATUSES, CALLBACK_SIGNING_KEY_ROTATION_OVERLAP_SECONDS, CALLBACK_EGRESS_FAILURES, CALLBACK_ADMISSION_RATE_LIMITS, callbackEndpointCreatedSchema, callbackEndpointNameSchema, callbackEndpointPageSchema, callbackEndpointRequestSchema, callbackEndpointRotatedSchema, callbackEndpointSchema, callbackEndpointSigningSecretsSchema, callbackEndpointStatusSchema, callbackSigningKeyRotationRequestSchema, callbackSigningKeysSchema, callbackEgressFailureSchema, type CallbackEndpoint, type CallbackEndpointCreated, type CallbackEndpointPage, type CallbackEndpointRequest, type CallbackEndpointRotated, type CallbackEndpointSigningSecrets, type CallbackEndpointStatus, type CallbackSigningKeyRotationRequest, type CallbackSigningKeys, type CallbackEgressFailure, } from "./endpoints.js";
+export { compactInterval, cronWords, generatedEndpointName, generatedScheduleName, periodWords, targetDomain, } from "./naming.js";
 export { FORECAST_BOUNDS, FORECAST_BREAKDOWNS, FORECAST_COMPATIBILITY, FORECAST_RULES, FORECAST_WINDOW_VERSION, decideForecastAnswer, forecastBreakdownSchema, forecastBucketSchema, forecastBucketStartMs, forecastLatencyCountsSchema, forecastRequestSchema, forecastSchema, forecastViolations, forecastWindowBucketSchema, forecastWindowViolations, forecastWindowsSchema, mergeForecastBuckets, parseForecastRequest, resolveForecastWindow, topPartitionKeys, type Forecast, type ForecastAnswerDecision, type ForecastAnswerRefusal, type ForecastBreakdown, type ForecastBucket, type ForecastMergedBucket, type ForecastShardAnswer, type ForecastLatencyCounts, type ForecastRequest, type ForecastRequestParse, type ForecastWindow, type ForecastWindowBucket, type ForecastWindowRefusal, type ForecastWindowResolution, type ForecastWindows, } from "./forecast.js";
-export { CURL_JOURNEY_TOOLS, FIRST_VALUE_JOURNEY, FIRST_VALUE_PREREQUISITES, FIRST_VALUE_STEPS, FIRST_VALUE_VARIABLES, JOURNEY_CONDITIONS, MINIMUM_CURL_VERSION, journeyCapturedVariables, journeyReferences, journeyStepSchema, journeyVariable, journeyVariableSchema, resolveJourneyReferences, type FirstValueJourney, type JourneyCapture, type JourneyCondition, type JourneyExpectation, type JourneyPoll, type JourneyPrerequisite, type JourneyRecovery, type JourneyStep, type JourneyVariable, } from "./first-value-journey.js";
+export { CURL_JOURNEY_TOOLS, FIRST_VALUE_JOURNEY, FIRST_VALUE_PREREQUISITES, FIRST_VALUE_STEPS, FIRST_VALUE_VARIABLES, JOURNEY_ACTIVATION_DURATIONS, JOURNEY_ACTIVATION_OUTCOMES, JOURNEY_CONDITIONS, MINIMUM_CURL_VERSION, WEBSITE_JOURNEY_STEPS, WEBSITE_JOURNEY_STEP_KEYS, journeyActivationDuration, journeyCapturedVariables, journeyPathVariables, journeyPoll, journeyPrerequisite, journeyReferences, journeyStepSchema, journeyStepVariables, journeyVariable, journeyVariableName, journeyVariableSchema, parseWebsiteActivationEvent, pathParameterNames, resolveJourneyReferences, websiteActivationEventSchema, websiteJourneySteps, type FirstValueJourney, type JourneyActivationDuration, type JourneyActivationOutcome, type JourneyCapture, type JourneyCondition, type JourneyExpectation, type JourneyPoll, type JourneyPrerequisite, type JourneyRecovery, type JourneyStep, type JourneyVariable, type WebsiteActivationEvent, } from "./first-value-journey.js";
 export { BILLABLE_TERMINAL_STATES, USAGE_BOUNDS, USAGE_WINDOW_REASONS, billableTerminalStateSchema, parseUsageRequest, resolveUsageWindow, usageDaySchema, usageRequestSchema, usageSchema, utcMidnightMs, type BillableTerminalStateName, type ResolvedUsageWindow, type UsageDayView, type UsageRequest, type UsageRequestParse, type UsageView, type UsageWindowRefusal, } from "./usage.js";
+export { BILLING_ACTIVATION_MODES, BILLING_AMOUNT_SCALE, BILLING_BLOCK_REASONS, BILLING_CURRENCY, BILLING_ENTRY_KINDS, BILLING_PAYMENT_KINDS, BILLING_PAYMENT_STATES, BILLING_NOTICE_KINDS, billingAutoTopUpApplyRequestSchema, billingAutoTopUpConfigurationSchema, billingAutoTopUpPreviewRequestSchema, billingAutoTopUpPreviewSchema, billingAutoTopUpRuleSchema, billingBudgetPolicySchema, billingBudgetUpdateRequestHeadersSchema, billingBudgetUpdateRequestSchema, billingBudgetUpdateResponseSchema, billingCeilingUpdateRequestSchema, billingFundingQuoteRequestSchema, billingFundingQuoteSchema, billingFundingViewSchema, billingNoticePageSchema, billingNoticeRecoveryPathSchema, billingNoticeSchema, billingNotificationSettingsSchema, billingNotificationSettingsUpdateRequestSchema, billingLedgerEntrySchema, billingLedgerPageSchema, billingLedgerRequestSchema, billingPaymentOperationSchema, billingPeriodSummarySchema, billingPurchaseRequestSchema, billingRefundRequestCreateSchema, billingRefundResolutionRequestSchema, billingRefundRequestViewSchema, billingSummarySchema, exactCentMoneySchema, manualFundingCreditSchema, microdollarAmountSchema, nonnegativeMicrodollarAmountSchema, type BillingAutoTopUpApplyRequest, type BillingAutoTopUpConfiguration, type BillingAutoTopUpPreview, type BillingAutoTopUpPreviewRequest, type BillingAutoTopUpRule, type BillingCeilingUpdateRequest, type BillingFundingQuote, type BillingFundingQuoteRequest, type BillingFundingView, type BillingNotice, type BillingNoticePage, type BillingNotificationSettings, type BillingNotificationSettingsUpdateRequest, type BillingLedgerEntryView, type BillingLedgerPage, type BillingLedgerRequest, type BillingBudgetUpdateRequest, type BillingBudgetUpdateResponse, type BillingPaymentOperation, type BillingPurchaseRequest, type BillingRefundRequestCreate, type BillingRefundResolutionRequest, type BillingRefundRequestView, type BillingSummaryView, } from "./billing.js";
+export { DELIVERY_TIMING_TARGETS_MS, DELIVERY_TIMING_VERDICTS, deliveryTimingSummarySchema, timingThresholdSummarySchema, type DeliveryTimingSummaryView, type TimingThresholdView, } from "./timing.js";
 export { CALLBACK_RECEIVER_DISPOSITIONS, CALLBACK_RECEIVER_PROTOCOL, CALLBACK_RECEIVER_STATUS, TEST_SINK_BEHAVIORS, TEST_SINK_BEHAVIOR_FACTS, TEST_SINK_BOUNDS, TEST_SINK_CLIENT_ERROR_STATUSES, TEST_SINK_DISPOSITIONS, TEST_SINK_PROTOCOL_VERSION, TEST_SINK_SERVER_ERROR_STATUSES, callbackReceiverAcknowledgementSchema, callbackReceiverDispositionSchema, resolveTestSinkAction, testSinkBehaviorSchema, testSinkCreateRequestSchema, testSinkDeliveryBodySchema, testSinkDispositionSchema, testSinkDeliveryPageSchema, testSinkDeliverySchema, testSinkPageSchema, testSinkProgramSchema, testSinkSchema, type CallbackReceiverAcknowledgement, type CallbackReceiverDisposition, type TestSink, type TestSinkAction, type TestSinkBehavior, type TestSinkCreateRequest, type TestSinkDelivery, type TestSinkDeliveryBody, type TestSinkDeliveryPage, type TestSinkDisposition, type TestSinkPage, type TestSinkProgram, } from "./test-sink.js";
+export { PROJECT_BILLING_ACTIONS, projectBillingQuoteRequestSchema, projectBillingQuoteSchema, projectBillingChangeRequestSchema, projectBillingStateSchema, billingPortalSchema, type ProjectBillingQuoteRequest, type ProjectBillingQuote, type ProjectBillingChangeRequest, type ProjectBillingState, } from "./billing.js";

package/dist/index.js

@@ -1,8 +1,10 @@
+export { DATA_EXPORT_STATES, dataExportIdSchema, newDataExportId, dataExportStateSchema, dataExportCreateRequestSchema, dataExportSchema, dataExportPartRequestSchema, dataExportPartSchema, dataExportCancelledSchema, } from "./data-export.js";
+export { organizationLifecycleSchema, organizationClosureRequestSchema, organizationRestoreRequestSchema, } from "./organization-lifecycle.js";
 export { ANY_ID_PATTERN, ID_ALPHABET, ID_PREFIXES, apiCredentialEventIdSchema, apiCredentialIdSchema, attemptIdSchema, authorizationRequestIdSchema, callbackSigningKeyIdSchema, deliveryIdSchema, endpointIdSchema, environmentIdSchema, eventIdSchema, idPattern, idSchema, newId, oauthClientIdSchema, oauthGrantEventIdSchema, oauthGrantIdSchema, occurrenceIdSchema, organizationIdSchema, projectIdSchema, resourceOf, scheduleIdSchema, testSinkDeliveryIdSchema, testSinkIdSchema, } from "./identifiers.js";
 export { durationSecondsSchema, timeZoneSchema, timestampSchema, toTimestamp, } from "./time.js";
-export { ENVIRONMENT_KINDS_IN_ORDER, PRINCIPAL_KINDS, SCOPES, SESSION_AUTHORITY_HEADERS, authoritySchema, decideAccess, decideEnvironmentIntent, effectiveScopes, problemCodeForRefusal, environmentKindSchema, principalKindSchema, principalSchema, scopeSchema, } from "./authority.js";
+export { ENVIRONMENT_KINDS_IN_ORDER, PRINCIPAL_KINDS, SCOPES, SESSION_AUTHORITY_HEADERS, authoritySchema, credentialContextSchema, decideAccess, decideEnvironmentIntent, effectiveScopes, problemCodeForRefusal, environmentKindSchema, principalKindSchema, principalSchema, scopeSchema, } from "./authority.js";
 export { PROBLEM_CATEGORIES, PROBLEM_CODES, fieldErrorSchema, isRetryable, problem, problemCategorySchema, problemCodeSchema, problemSchema, } from "./problems.js";
-export { CONCURRENCY_HEADERS, PAGE_SIZE, canonicalRequest, classifyIdempotency, conditionalRequestHeaderSchema, decodeCursor, encodeCursor, etagSchema, freshnessSchema, projectedFreshnessSchema, fromETag, idempotencyKeySchema, idempotencyReplayResponseHeaderSchema, idempotencyRequestHeaderSchema, idempotencyReceiptSchema, idempotencyScopeSchema, pageRequestSchema, pageSchema, parsePageRequest, replayedResponseHeaderSchema, requiredIdempotencyRequestHeaderSchema, requestFingerprint, toETag, versionResponseHeaderSchema, versionSchema, } from "./protocol.js";
+export { CONCURRENCY_HEADERS, PAGE_SIZE, canonicalRequest, classifyIdempotency, conditionalRequestHeaderSchema, decodeCursor, encodeCursor, etagSchema, freshnessSchema, projectedFreshnessSchema, requiredConditionalRequestHeaderSchema, fromETag, idempotencyKeySchema, idempotencyReplayResponseHeaderSchema, idempotencyRequestHeaderSchema, idempotencyReceiptSchema, idempotencyScopeSchema, HISTORY_ORDERS, historyPageRequestSchema, pageRequestSchema, scheduleListRequestSchema, parseHistoryPageRequest, pageSchema, parsePageRequest, parseScheduleListRequest, replayedResponseHeaderSchema, requiredIdempotencyRequestHeaderSchema, requestFingerprint, toETag, versionResponseHeaderSchema, versionSchema, SCHEDULE_ORDERS, } from "./protocol.js";
 export { CALLBACK_CONTENT_TYPE, CALLBACK_DELIVERY_PROTOCOL, CALLBACK_DELIVERY_PROTOCOL_VERSION, CALLBACK_ENVELOPE_VERSION, CALLBACK_ENVELOPE_VERSION_2026_07_01, CALLBACK_ENVELOPE_VERSION_2026_08_08, CALLBACK_ENVELOPE_VERSION_CHANGE, CALLBACK_ENVELOPE_VERSIONS, CALLBACK_HEADERS, SIGNATURE_SCHEME, SIGNATURE_TOLERANCE_SECONDS, callbackDeferredCompletionSchema, callbackDeliveryTestVectors, callbackEnvelopeSchema, callbackEnvelopeTrigger, callbackHeadersSchema, callbackRun, callbackTriggerSchema, classifyOutcome, classifyStatus, formatSignature, extractCanonicalEnvelopeIds, isTimestampFresh, signatureHeaderSchema, serializeCallbackEnvelope, signingInput, trySigningInput, } from "./signatures.js";
 export { CREDENTIAL_PREFIX_LENGTH, CREDENTIAL_PREFIX_PATTERN, CREDENTIAL_ROTATION_OVERLAP_SECONDS, CREDENTIAL_SECRET_LENGTH, CREDENTIAL_SECRET_PATTERN, NEVER_REDACTED, REDACTED_FIELDS_EXACT, REDACTED_FIELD_FRAGMENTS, credentialCreatedSchema, credentialMetadataSchema, credentialPageSchema, credentialRequestSchema, credentialRevokedSchema, credentialRotatedSchema, credentialRotationRequestSchema, redact, } from "./secrets.js";
 export { MAX_PARTITION_SHARDS, PROJECTION_DRAIN_LIMIT, SINGLE_SHARD, partitionInstanceName, partitionShardCount, partitionShardFor, partitionShardForIdempotencyKey, } from "./partition.js";
@@ -10,17 +12,20 @@ export { EVENT_TYPES, eventEnvelopeSchema, eventTypeSchema, genericEventSchema,
 export { MEMBERSHIP_ROLES, MEMBERSHIP_STATUSES, externalMembershipIdSchema, externalOrganizationIdSchema, externalUserIdSchema, grantsAccess, leastRole, leastStatus, membershipChangeSchema, membershipRoleSchema, membershipSchema, membershipStatusSchema, organizationTombstoneSchema, sessionMembershipSchema, } from "./identity.js";
 export { CHANGE_KINDS, CHANGE_OPERATIONS, CHANGE_SUBJECTS, CONTRACT_VERSION, assess, changeKindSchema, classifyChange, contractVersionSchema, } from "./compatibility.js";
 export { WORKSPACE_LAYERS, scaffoldProblemSchema, scaffoldVersionSchema, toolDescriptorSchema, toolListSchema, workspaceIdentitySchema, workspaceLayerSchema, workspaceScaffoldSchema, } from "./workspace.js";
-export { MOCK_BEHAVIORS, MOCK_HEADERS, OPERATIONS, UNIVERSAL_PROBLEMS, AUTHENTICATED_PROBLEMS, findOperation, fixtureListSchema, mockBehaviorSchema, mockScenarioRequestSchema, mockScenarioResponseSchema, operationsFor, problemsFor, requestSchemaFor, responseSchemaFor, successStatusFor, } from "./operations.js";
-export { PROJECT_LIST_LIMIT, PROJECT_STATUSES, environmentSchema, organizationSchema, projectCreateRequestSchema, projectListSchema, projectNameSchema, projectSchema, projectStatusSchema, projectSummarySchema, provisionedProjectSchema, } from "./tenancy.js";
-export { ATTEMPT_DURATION_MAX_MS, ATTEMPT_FAILURE_SNIPPET_MAX_LENGTH, ATTEMPT_REMEDIATIONS, ATTEMPT_RESPONSE_HEADER_MAX_LENGTH, ATTEMPT_STATES, CRON_EXPRESSION_MAX_LENGTH, LATENCY_CLASSES, OCCURRENCE_STATES, PARTITION_KEY_MAX_LENGTH, RECURRENCE_REQUEST_FIELDS, SCHEDULE_STATUSES, SCHEDULING_BOUNDS, TERMINAL_OCCURRENCE_STATES, attemptFailureSnippetSchema, attemptResponseHeaderSchema, attemptSchema, attemptDiagnosticSchema, attemptPageSchema, attemptRemediationSchema, attemptStateForResponse, attemptStateSchema, attemptTriggerSchema, attemptViewSchema, cronExpressionSchema, DELIVERY_COMPLETION_MODES, DELIVERY_DURATION_TIERS, DELIVERY_OVERLAP_POLICIES, DEFAULT_DELIVERY_DURATION_SECONDS, DEFAULT_DELIVERY_OVERLAP_POLICY, FREE_DELIVERY_DURATION_SECONDS, isLongRunningDuration, deliveryCompletionModeSchema, deliveryDurationSecondsSchema, deliveryOverlapPolicySchema, deriveDeliverySettings, deriveLatencyClass, generationSchema, isTerminalOccurrenceState, latencyClassSchema, occurrenceSchema, occurrencePageSchema, occurrenceStateSchema, occurrenceViewSchema, partitionKeySchema, remediationForAttempt, recurrenceSchema, schedulePageSchema, scheduleRequestSchema, scheduleSchema, scheduleStatusSchema, scheduleViewSchema, } from "./scheduling.js";
+export { MOCK_BEHAVIORS, MOCK_HEADERS, OPERATIONS, UNIVERSAL_PROBLEMS, AUTHENTICATED_PROBLEMS, SCOPED_PROBLEMS, findOperation, fixtureListSchema, mockBehaviorSchema, mockScenarioRequestSchema, mockScenarioResponseSchema, operationsFor, problemsFor, requestSchemaFor, responseSchemaFor, successStatusFor, } from "./operations.js";
+export { PROJECT_LIST_LIMIT, PROJECT_STATUSES, environmentSchema, organizationSchema, projectCreateRequestSchema, projectArchiveRequestSchema, projectDeletedSchema, projectDeletionCountsSchema, projectListSchema, projectNameKey, projectNameSchema, projectSchema, projectStatusSchema, projectSummarySchema, projectUpdateRequestSchema, provisionedProjectSchema, } from "./tenancy.js";
+export { ATTEMPT_DURATION_MAX_MS, ATTEMPT_FAILURE_SNIPPET_MAX_LENGTH, ATTEMPT_REMEDIATIONS, ATTEMPT_RESPONSE_HEADER_MAX_LENGTH, ATTEMPT_STATES, CRON_EXPRESSION_MAX_LENGTH, LATENCY_CLASSES, OCCURRENCE_STATES, PARTITION_KEY_MAX_LENGTH, RECURRENCE_REQUEST_FIELDS, SCHEDULE_STATUSES, SCHEDULING_BOUNDS, TERMINAL_OCCURRENCE_STATES, attemptFailureSnippetSchema, attemptResponseHeaderSchema, attemptSchema, attemptDiagnosticSchema, attemptPageSchema, attemptRemediationSchema, attemptStateForResponse, attemptStateSchema, attemptTriggerSchema, attemptViewSchema, cronExpressionSchema, DELIVERY_COMPLETION_MODES, DELIVERY_DURATION_TIERS, MAX_DELIVERY_DURATION_SECONDS, RESPONSE_DELIVERY_MAX_DURATION_SECONDS, DELIVERY_OVERLAP_POLICIES, DEFAULT_DELIVERY_DURATION_SECONDS, DEFAULT_DELIVERY_OVERLAP_POLICY, FREE_DELIVERY_DURATION_SECONDS, DEFAULT_ONE_SHOT_MAX_STALENESS_SECONDS, LATENESS_POLICIES, isLongRunningDuration, deliveryCompletionModeSchema, deliveryDurationSecondsSchema, deliveryOverlapPolicySchema, deriveDeliverySettings, deriveLatencyClass, deriveLatenessSettings, defaultLatenessPolicyForRecurrence, generationSchema, isTerminalOccurrenceState, latencyClassSchema, latenessPolicySchema, occurrenceSchema, occurrencePageSchema, parseProjectOccurrenceListRequest, projectOccurrenceCursorBinding, projectOccurrenceListRequestSchema, projectOccurrencePageSchema, occurrenceStateSchema, occurrenceViewSchema, partitionKeySchema, remediationForAttempt, recurrenceSchema, scheduleNameSchema, scheduleLatenessRequestSchema, scheduleLatenessSchema, schedulePageSchema, scheduleRequestSchema, scheduleSchema, scheduleStatusSchema, scheduleViewSchema, } from "./scheduling.js";
 export { portableAttemptRecordSchema, portableEncryptedPayloadRecordSchema, portableOccurrenceRecordSchema, portableReceiptRecordSchema, portableScheduleRecordSchema, portableSchedulingRecordSetSchema, } from "./scheduling-records.js";
 export { ROLE_SCOPE_CEILINGS, capScopesToRole, ceilingForRole, credentialScopes, grantableScopes, policyMatrix, roleAllows, roleCanPerform, } from "./policy.js";
 export { ACCESS_TOKEN_PATTERN, ACCESS_TOKEN_TTL_SECONDS, AUTHORIZATION_CODE_PATTERN, AUTHORIZATION_CODE_TTL_SECONDS, AUTHORIZATION_REQUEST_TTL_SECONDS, MAX_REDIRECT_URIS, OAUTH_ERRORS, OAUTH_ERROR_STATUS, OAUTH_GRANT_STATUSES, OAUTH_GRANT_TYPES, OAUTH_RESPONSE_TYPES, OAUTH_REVOCATION_REASONS, OAUTH_ROUTES, OAUTH_SECRET_PATTERN, OAUTH_TOKEN_NAMESPACE_LENGTH, OAUTH_TOKEN_SECRET_LENGTH, PKCE_CHALLENGE_PATTERN, PKCE_METHODS, PKCE_VERIFIER_PATTERN, REFRESH_TOKEN_PATTERN, REFRESH_TOKEN_TTL_SECONDS, TOKEN_ENDPOINT_AUTH_METHODS, authorizationParametersSchema, authorizationServerMetadataSchema, bearerChallenge, clientRegistrationRequestSchema, clientRegistrationSchema, consentDecisionSchema, consentOutcomeSchema, consentPromptSchema, formatScopeString, isLoopbackRedirect, oauthError, oauthErrorCodeSchema, oauthErrorSchema, oauthGrantListSchema, oauthGrantRevokedSchema, oauthGrantSchema, oauthGrantStatusSchema, oauthGrantTypeSchema, oauthRevocationReasonSchema, parseScopeString, pkceMethodSchema, protectedResourceMetadataSchema, redirectUriSchema, revocationRequestSchema, tokenRequestSchema, tokenResponseSchema, } from "./oauth.js";
 export { CALLBACK_ENVELOPE_HEADROOM_BYTES, CALLBACK_RECEIVER_MAX_BODY_BYTES, } from "./callback-receiver.js";
-export { CALLBACK_OWNERSHIP_POLICIES, DEFAULT_CALLBACK_OWNERSHIP_POLICY, readCallbackOwnershipPolicy, sendableStatuses, } from "./callback-ownership.js";
 export { CALLBACK_ENDPOINT_SECRET_PATTERN, CALLBACK_URL_REJECTION_REASONS, evaluateCallbackUrl, isPublicCallbackAddress, } from "./callback-safety.js";
-export { CALLBACK_ENDPOINT_LIMIT_PER_ENVIRONMENT, CALLBACK_ENDPOINT_STATUSES, CALLBACK_SIGNING_KEY_ROTATION_OVERLAP_SECONDS, CALLBACK_VERIFICATION_FAILURES, CALLBACK_VERIFICATION_HEADERS, CALLBACK_VERIFICATION_PROTOCOL, CALLBACK_VERIFICATION_PROTOCOL_VERSION, CALLBACK_VERIFICATION_RATE_LIMITS, CALLBACK_VERIFICATION_RESPONSE_BYTES, CALLBACK_VERIFICATION_TIMEOUT_MILLISECONDS, CALLBACK_VERIFICATION_TYPE, callbackEndpointCreatedSchema, callbackEndpointPageSchema, callbackEndpointRequestSchema, callbackEndpointRotatedSchema, callbackEndpointSchema, callbackEndpointStatusSchema, callbackSigningKeyRotationRequestSchema, callbackSigningKeysSchema, callbackVerificationChallengeSchema, callbackVerificationFailureSchema, } from "./endpoints.js";
+export { CALLBACK_ENDPOINT_LIMIT_PER_ENVIRONMENT, CALLBACK_ENDPOINT_STATUSES, CALLBACK_SIGNING_KEY_ROTATION_OVERLAP_SECONDS, CALLBACK_EGRESS_FAILURES, CALLBACK_ADMISSION_RATE_LIMITS, callbackEndpointCreatedSchema, callbackEndpointNameSchema, callbackEndpointPageSchema, callbackEndpointRequestSchema, callbackEndpointRotatedSchema, callbackEndpointSchema, callbackEndpointSigningSecretsSchema, callbackEndpointStatusSchema, callbackSigningKeyRotationRequestSchema, callbackSigningKeysSchema, callbackEgressFailureSchema, } from "./endpoints.js";
+export { compactInterval, cronWords, generatedEndpointName, generatedScheduleName, periodWords, targetDomain, } from "./naming.js";
 export { FORECAST_BOUNDS, FORECAST_BREAKDOWNS, FORECAST_COMPATIBILITY, FORECAST_RULES, FORECAST_WINDOW_VERSION, decideForecastAnswer, forecastBreakdownSchema, forecastBucketSchema, forecastBucketStartMs, forecastLatencyCountsSchema, forecastRequestSchema, forecastSchema, forecastViolations, forecastWindowBucketSchema, forecastWindowViolations, forecastWindowsSchema, mergeForecastBuckets, parseForecastRequest, resolveForecastWindow, topPartitionKeys, } from "./forecast.js";
-export { CURL_JOURNEY_TOOLS, FIRST_VALUE_JOURNEY, FIRST_VALUE_PREREQUISITES, FIRST_VALUE_STEPS, FIRST_VALUE_VARIABLES, JOURNEY_CONDITIONS, MINIMUM_CURL_VERSION, journeyCapturedVariables, journeyReferences, journeyStepSchema, journeyVariable, journeyVariableSchema, resolveJourneyReferences, } from "./first-value-journey.js";
+export { CURL_JOURNEY_TOOLS, FIRST_VALUE_JOURNEY, FIRST_VALUE_PREREQUISITES, FIRST_VALUE_STEPS, FIRST_VALUE_VARIABLES, JOURNEY_ACTIVATION_DURATIONS, JOURNEY_ACTIVATION_OUTCOMES, JOURNEY_CONDITIONS, MINIMUM_CURL_VERSION, WEBSITE_JOURNEY_STEPS, WEBSITE_JOURNEY_STEP_KEYS, journeyActivationDuration, journeyCapturedVariables, journeyPathVariables, journeyPoll, journeyPrerequisite, journeyReferences, journeyStepSchema, journeyStepVariables, journeyVariable, journeyVariableName, journeyVariableSchema, parseWebsiteActivationEvent, pathParameterNames, resolveJourneyReferences, websiteActivationEventSchema, websiteJourneySteps, } from "./first-value-journey.js";
 export { BILLABLE_TERMINAL_STATES, USAGE_BOUNDS, USAGE_WINDOW_REASONS, billableTerminalStateSchema, parseUsageRequest, resolveUsageWindow, usageDaySchema, usageRequestSchema, usageSchema, utcMidnightMs, } from "./usage.js";
+export { BILLING_ACTIVATION_MODES, BILLING_AMOUNT_SCALE, BILLING_BLOCK_REASONS, BILLING_CURRENCY, BILLING_ENTRY_KINDS, BILLING_PAYMENT_KINDS, BILLING_PAYMENT_STATES, BILLING_NOTICE_KINDS, billingAutoTopUpApplyRequestSchema, billingAutoTopUpConfigurationSchema, billingAutoTopUpPreviewRequestSchema, billingAutoTopUpPreviewSchema, billingAutoTopUpRuleSchema, billingBudgetPolicySchema, billingBudgetUpdateRequestHeadersSchema, billingBudgetUpdateRequestSchema, billingBudgetUpdateResponseSchema, billingCeilingUpdateRequestSchema, billingFundingQuoteRequestSchema, billingFundingQuoteSchema, billingFundingViewSchema, billingNoticePageSchema, billingNoticeRecoveryPathSchema, billingNoticeSchema, billingNotificationSettingsSchema, billingNotificationSettingsUpdateRequestSchema, billingLedgerEntrySchema, billingLedgerPageSchema, billingLedgerRequestSchema, billingPaymentOperationSchema, billingPeriodSummarySchema, billingPurchaseRequestSchema, billingRefundRequestCreateSchema, billingRefundResolutionRequestSchema, billingRefundRequestViewSchema, billingSummarySchema, exactCentMoneySchema, manualFundingCreditSchema, microdollarAmountSchema, nonnegativeMicrodollarAmountSchema, } from "./billing.js";
+export { DELIVERY_TIMING_TARGETS_MS, DELIVERY_TIMING_VERDICTS, deliveryTimingSummarySchema, timingThresholdSummarySchema, } from "./timing.js";
 export { CALLBACK_RECEIVER_DISPOSITIONS, CALLBACK_RECEIVER_PROTOCOL, CALLBACK_RECEIVER_STATUS, TEST_SINK_BEHAVIORS, TEST_SINK_BEHAVIOR_FACTS, TEST_SINK_BOUNDS, TEST_SINK_CLIENT_ERROR_STATUSES, TEST_SINK_DISPOSITIONS, TEST_SINK_PROTOCOL_VERSION, TEST_SINK_SERVER_ERROR_STATUSES, callbackReceiverAcknowledgementSchema, callbackReceiverDispositionSchema, resolveTestSinkAction, testSinkBehaviorSchema, testSinkCreateRequestSchema, testSinkDeliveryBodySchema, testSinkDispositionSchema, testSinkDeliveryPageSchema, testSinkDeliverySchema, testSinkPageSchema, testSinkProgramSchema, testSinkSchema, } from "./test-sink.js";
+export { PROJECT_BILLING_ACTIONS, projectBillingQuoteRequestSchema, projectBillingQuoteSchema, projectBillingChangeRequestSchema, projectBillingStateSchema, billingPortalSchema, } from "./billing.js";

package/dist/mcp.d.ts

@@ -0,0 +1,201 @@
+import { z } from "./zod.js";
+/**
+ * Where the remote MCP surface lives, and what it tells an agent about itself.
+ *
+ * Stated once for the same reason `OAUTH_ROUTES` is: two readers must agree.
+ * The router serves these paths and the protected-resource metadata document
+ * advertises them, and a path that drifts from its advertisement is not a 404 —
+ * it is a client that cannot authenticate and cannot say why.
+ *
+ * Outside `/v1`, following the convention `CLERK_WEBHOOK_PATH` and
+ * `OAUTH_ROUTES` set. The `/v1` surface is the operation registry, every entry
+ * of which is projected into OpenAPI, the SDK, an MCP tool and the contract
+ * mock; the MCP endpoint is the transport those tools are served over, and a
+ * transport that appeared in its own tool list would be a tool an agent could
+ * point at itself.
+ */
+export declare const MCP_ROUTES: {
+    /**
+     * The single Streamable HTTP endpoint. POST only; `GET` and `DELETE` answer
+     * `405`, because this endpoint opens no standalone event stream and mints no
+     * session to terminate.
+     *
+     * Served at this path **and** at the same path with a trailing slash, without
+     * a redirect between them. A `301`/`302` on a POST is rewritten by the fetch
+     * standard into a GET with the body dropped, so a client configured with the
+     * other spelling would have its opening request silently become the GET this
+     * endpoint refuses — and read that as "no MCP server here".
+     */
+    readonly endpoint: "/mcp";
+    /**
+     * RFC 9728 metadata for the MCP endpoint specifically.
+     *
+     * Served *beside* the origin's own document rather than instead of it. RFC
+     * 9728 §3.1 places the metadata for a resource with a path component at
+     * `/.well-known/oauth-protected-resource` followed by that path, so a client
+     * that treats `https://host/mcp` as the resource it is authorizing for
+     * constructs exactly this URL — and one that follows the `resource_metadata`
+     * link out of the `401` is sent here too. Both arrive at a document naming
+     * the same authorization server.
+     */
+    readonly protectedResourceMetadata: "/.well-known/oauth-protected-resource/mcp";
+};
+/**
+ * What the server tells a model about itself, once, before any tool call.
+ *
+ * MCP calls this `instructions` and hands it to the model as context. It is
+ * kept short and factual: an agent that has read the tool descriptions knows
+ * what each one does, and what it cannot work out from them is the shape of the
+ * authority it is acting under — which is the one thing that decides whether an
+ * instruction like "create this in production" is even expressible.
+ */
+export declare const MCP_INSTRUCTIONS: string;
+/**
+ * What a signed-in member is told about a key they have just issued, so that a
+ * connection test can tell "the server refused you" from "the server does not
+ * know this key" from "this key sees fewer tools than you meant it to".
+ *
+ * **Why the endpoint returns the tool names rather than a count.** The
+ * connection test drives `tools/list` through the official MCP client with the
+ * transient secret, and then has to decide whether what came back is about the
+ * credential the member means. A count cannot answer that: two credentials with
+ * different scopes routinely authorize the same number of tools. The names can,
+ * and they are already public — they are the operation ids with underscores,
+ * published in the parity table and in every client's own listing.
+ *
+ * That comparison is what binds the secret in the browser to the credential the
+ * session named. The session's half is the tenant check on the way in: the
+ * route refuses a credential whose authority is not this session's project and
+ * environment, so a member cannot ask this question about another tenant's key.
+ */
+export declare const MCP_CONNECTION_STATES: readonly ["usable", "revoked", "expired"];
+export type McpConnectionState = (typeof MCP_CONNECTION_STATES)[number];
+/**
+ * The steps a connection test performs, in order, and the only steps it has.
+ *
+ * Closed because the result is reported as an activation fact, and an open list
+ * of step names is a free-text field with a schema in front of it.
+ */
+export declare const MCP_CONNECTION_CHECKS: readonly ["initialize", "tools", "authority"];
+export type McpConnectionCheck = (typeof MCP_CONNECTION_CHECKS)[number];
+/** What a step did. Binary, plus the case where an earlier step stopped it. */
+export declare const MCP_CONNECTION_OUTCOMES: readonly ["passed", "failed", "skipped"];
+export type McpConnectionOutcome = (typeof MCP_CONNECTION_OUTCOMES)[number];
+/**
+ * The bounded answer a connection test starts from.
+ *
+ * Every field is either an address this deployment publishes or a fact about a
+ * credential the caller's own session may already read from the credential
+ * listing. Nothing here is new disclosure, and nothing here is the secret: the
+ * transient value never travels to this route, and the route has nothing it
+ * could echo.
+ */
+export declare const mcpConnectionSchema: import("zod").ZodObject<{
+    discovery: import("zod").ZodString;
+    displayPrefix: import("zod").ZodString;
+    endpoint: import("zod").ZodString;
+    id: import("zod").ZodString;
+    scopes: import("zod").ZodArray<import("zod").ZodEnum<{
+        "credentials:administer": "credentials:administer";
+        "billing:write": "billing:write";
+        "credentials:read": "credentials:read";
+        "credentials:write": "credentials:write";
+        "endpoints:read": "endpoints:read";
+        "endpoints:write": "endpoints:write";
+        "forecast:read": "forecast:read";
+        "grants:read": "grants:read";
+        "grants:write": "grants:write";
+        "occurrences:read": "occurrences:read";
+        "occurrences:redeliver": "occurrences:redeliver";
+        "projects:administer": "projects:administer";
+        "projects:read": "projects:read";
+        "projects:write": "projects:write";
+        "schedules:read": "schedules:read";
+        "schedules:write": "schedules:write";
+        "usage:read": "usage:read";
+    }>>;
+    state: import("zod").ZodEnum<{
+        revoked: "revoked";
+        usable: "usable";
+        expired: "expired";
+    }>;
+    tools: import("zod").ZodArray<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
+export type McpConnection = z.infer<typeof mcpConnectionSchema>;
+/**
+ * Why a connection test stopped, from a closed list.
+ *
+ * **Closed because the alternative leaks.** The natural implementation of a
+ * diagnostic is to show what the server said, and what the server said is a
+ * string this product did not write — a proxy's error page, a transport
+ * library's message, a response body. Any of those can carry a URL, a header, or
+ * a fragment of the credential that produced them. A reason from this list
+ * carries none of that and is enough to act on, which is the whole bargain.
+ */
+export declare const MCP_CONNECTION_FAILURES: readonly ["unauthorized", "unreachable", "protocol", "mismatch"];
+export type McpConnectionFailure = (typeof MCP_CONNECTION_FAILURES)[number];
+/**
+ * How long something took, coarsely.
+ *
+ * A duration recorded to the millisecond is a fingerprint: repeated across a
+ * small population it distinguishes one member's connection from another's. The
+ * question an activation fact answers is "was this fast enough to feel like it
+ * worked", and a bucket answers it.
+ */
+export declare const MCP_ACTIVATION_DURATIONS: readonly ["under_1s", "under_5s", "under_30s", "over_30s"];
+export type McpActivationDuration = (typeof MCP_ACTIVATION_DURATIONS)[number];
+/** The bucket a measured duration falls in. */
+export declare function activationDuration(elapsedMs: number): McpActivationDuration;
+/**
+ * What is recorded when somebody connects a client, and the only thing that is.
+ *
+ * **Every field is drawn from a closed set, and that is the point rather than a
+ * convenience.** There is no free-text field, no identifier, no address and no
+ * measurement finer than a bucket, so an event of this shape cannot carry an
+ * account, an organization, a project, an OAuth URL, a token, a destination or a
+ * payload however carelessly it is constructed. The project specification asks
+ * for activation evidence containing "durations and coarse outcomes, never
+ * callback bodies, secrets, tenant identifiers, or customer payloads"; a schema
+ * that admits only those is how that becomes a property instead of a promise.
+ *
+ * `client` is validated against the catalog rather than typed as a string, so a
+ * client nobody has walked cannot appear in activation data as though it had.
+ *
+ * **Strict, not merely typed, and a test is why.** An ordinary object schema
+ * *strips* a field it does not know, which would have made an emitter that added
+ * `project` look like it was recording one while the field silently vanished.
+ * Stripping is safe and dishonest: the caller believes something is being
+ * recorded that is not, and nothing ever tells them. "Closed" has to mean the
+ * schema refuses what it does not recognise, so the mistake surfaces where it
+ * was made.
+ */
+export declare const mcpActivationEventSchema: import("zod").ZodObject<{
+    authKind: import("zod").ZodEnum<{
+        oauth: "oauth";
+        "api-key": "api-key";
+    }>;
+    checks: import("zod").ZodRecord<import("zod").ZodEnum<{
+        authority: "authority";
+        initialize: "initialize";
+        tools: "tools";
+    }>, import("zod").ZodEnum<{
+        failed: "failed";
+        passed: "passed";
+        skipped: "skipped";
+    }>>;
+    client: import("zod").ZodString;
+    duration: import("zod").ZodEnum<{
+        under_1s: "under_1s";
+        under_5s: "under_5s";
+        under_30s: "under_30s";
+        over_30s: "over_30s";
+    }>;
+    failure: import("zod").ZodOptional<import("zod").ZodEnum<{
+        unauthorized: "unauthorized";
+        unreachable: "unreachable";
+        protocol: "protocol";
+        mismatch: "mismatch";
+    }>>;
+    type: import("zod").ZodLiteral<"mcp.connection_test">;
+}, import("zod/v4/core").$strict>;
+export type McpActivationEvent = z.infer<typeof mcpActivationEventSchema>;

package/dist/mcp.js

@@ -0,0 +1,214 @@
+import { z } from "./zod.js";
+import { scopeSchema } from "./authority.js";
+import { apiCredentialIdSchema } from "./identifiers.js";
+import { CREDENTIAL_PREFIX_PATTERN } from "./secrets.js";
+/**
+ * Where the remote MCP surface lives, and what it tells an agent about itself.
+ *
+ * Stated once for the same reason `OAUTH_ROUTES` is: two readers must agree.
+ * The router serves these paths and the protected-resource metadata document
+ * advertises them, and a path that drifts from its advertisement is not a 404 —
+ * it is a client that cannot authenticate and cannot say why.
+ *
+ * Outside `/v1`, following the convention `CLERK_WEBHOOK_PATH` and
+ * `OAUTH_ROUTES` set. The `/v1` surface is the operation registry, every entry
+ * of which is projected into OpenAPI, the SDK, an MCP tool and the contract
+ * mock; the MCP endpoint is the transport those tools are served over, and a
+ * transport that appeared in its own tool list would be a tool an agent could
+ * point at itself.
+ */
+export const MCP_ROUTES = {
+    /**
+     * The single Streamable HTTP endpoint. POST only; `GET` and `DELETE` answer
+     * `405`, because this endpoint opens no standalone event stream and mints no
+     * session to terminate.
+     *
+     * Served at this path **and** at the same path with a trailing slash, without
+     * a redirect between them. A `301`/`302` on a POST is rewritten by the fetch
+     * standard into a GET with the body dropped, so a client configured with the
+     * other spelling would have its opening request silently become the GET this
+     * endpoint refuses — and read that as "no MCP server here".
+     */
+    endpoint: "/mcp",
+    /**
+     * RFC 9728 metadata for the MCP endpoint specifically.
+     *
+     * Served *beside* the origin's own document rather than instead of it. RFC
+     * 9728 §3.1 places the metadata for a resource with a path component at
+     * `/.well-known/oauth-protected-resource` followed by that path, so a client
+     * that treats `https://host/mcp` as the resource it is authorizing for
+     * constructs exactly this URL — and one that follows the `resource_metadata`
+     * link out of the `401` is sent here too. Both arrive at a document naming
+     * the same authorization server.
+     */
+    protectedResourceMetadata: "/.well-known/oauth-protected-resource/mcp",
+};
+/**
+ * What the server tells a model about itself, once, before any tool call.
+ *
+ * MCP calls this `instructions` and hands it to the model as context. It is
+ * kept short and factual: an agent that has read the tool descriptions knows
+ * what each one does, and what it cannot work out from them is the shape of the
+ * authority it is acting under — which is the one thing that decides whether an
+ * instruction like "create this in production" is even expressible.
+ */
+export const MCP_INSTRUCTIONS = [
+    "Greatwait schedules work and delivers it to an endpoint at the time asked for.",
+    "Every tool acts inside one organization, project and environment, fixed by the credential this connection was authorized with; no argument can name another, and there is no tool that moves between them.",
+    "Reads are safe to repeat. Writes are annotated, and the ones marked destructive settle or discard an occurrence that would otherwise have fired.",
+    "A refusal comes back as a problem document with a stable `code`: act on the code, not on the wording.",
+].join(" ");
+/**
+ * What a signed-in member is told about a key they have just issued, so that a
+ * connection test can tell "the server refused you" from "the server does not
+ * know this key" from "this key sees fewer tools than you meant it to".
+ *
+ * **Why the endpoint returns the tool names rather than a count.** The
+ * connection test drives `tools/list` through the official MCP client with the
+ * transient secret, and then has to decide whether what came back is about the
+ * credential the member means. A count cannot answer that: two credentials with
+ * different scopes routinely authorize the same number of tools. The names can,
+ * and they are already public — they are the operation ids with underscores,
+ * published in the parity table and in every client's own listing.
+ *
+ * That comparison is what binds the secret in the browser to the credential the
+ * session named. The session's half is the tenant check on the way in: the
+ * route refuses a credential whose authority is not this session's project and
+ * environment, so a member cannot ask this question about another tenant's key.
+ */
+export const MCP_CONNECTION_STATES = ["usable", "revoked", "expired"];
+/**
+ * The steps a connection test performs, in order, and the only steps it has.
+ *
+ * Closed because the result is reported as an activation fact, and an open list
+ * of step names is a free-text field with a schema in front of it.
+ */
+export const MCP_CONNECTION_CHECKS = [
+    /** The client completed the MCP handshake against the endpoint. */
+    "initialize",
+    /** The client listed tools, and the listing was well formed. */
+    "tools",
+    /** The listing was the one this credential's scopes authorize. */
+    "authority",
+];
+/** What a step did. Binary, plus the case where an earlier step stopped it. */
+export const MCP_CONNECTION_OUTCOMES = ["passed", "failed", "skipped"];
+/**
+ * The bounded answer a connection test starts from.
+ *
+ * Every field is either an address this deployment publishes or a fact about a
+ * credential the caller's own session may already read from the credential
+ * listing. Nothing here is new disclosure, and nothing here is the secret: the
+ * transient value never travels to this route, and the route has nothing it
+ * could echo.
+ */
+export const mcpConnectionSchema = z.object({
+    /** The RFC 9728 document for the endpoint, absolute. */
+    discovery: z.string().url(),
+    /** The non-secret leading segment, so a client can check it holds this key. */
+    displayPrefix: z.string().regex(CREDENTIAL_PREFIX_PATTERN),
+    /** The Streamable HTTP endpoint, absolute, ready to paste. */
+    endpoint: z.string().url(),
+    /**
+     * Which credential this describes.
+     *
+     * A document addressed by an identifier echoes it — the rule
+     * `published-examples.worker.test.ts` enforces on every read, and the reason
+     * is a caller holding two of these needing to tell them apart. The display
+     * prefix is a recognition aid rather than an identity, and it is not the value
+     * a later call is addressed by.
+     */
+    id: apiCredentialIdSchema,
+    /** The scopes fixed into this credential when it was issued. */
+    scopes: z.array(scopeSchema),
+    state: z.enum(MCP_CONNECTION_STATES),
+    /**
+     * The MCP tool names these scopes authorize, sorted.
+     *
+     * Computed by the same authorization policy `/mcp` runs when it decides what
+     * to put in `tools/list`, rather than by a second rule that would drift from
+     * it. A connection test compares this against what the official client
+     * actually listed; equal means the secret in the browser is the credential the
+     * session named, and unequal means it is not — which no count could tell them.
+     */
+    tools: z.array(z.string()),
+});
+/**
+ * Why a connection test stopped, from a closed list.
+ *
+ * **Closed because the alternative leaks.** The natural implementation of a
+ * diagnostic is to show what the server said, and what the server said is a
+ * string this product did not write — a proxy's error page, a transport
+ * library's message, a response body. Any of those can carry a URL, a header, or
+ * a fragment of the credential that produced them. A reason from this list
+ * carries none of that and is enough to act on, which is the whole bargain.
+ */
+export const MCP_CONNECTION_FAILURES = [
+    /** The endpoint answered, and refused the credential. */
+    "unauthorized",
+    /** Nothing answered, or what answered was not this endpoint. */
+    "unreachable",
+    /** It answered, but not in a way an MCP client could complete. */
+    "protocol",
+    /** It listed tools, and they are not the ones this credential authorizes. */
+    "mismatch",
+];
+/**
+ * How long something took, coarsely.
+ *
+ * A duration recorded to the millisecond is a fingerprint: repeated across a
+ * small population it distinguishes one member's connection from another's. The
+ * question an activation fact answers is "was this fast enough to feel like it
+ * worked", and a bucket answers it.
+ */
+export const MCP_ACTIVATION_DURATIONS = [
+    "under_1s",
+    "under_5s",
+    "under_30s",
+    "over_30s",
+];
+/** The bucket a measured duration falls in. */
+export function activationDuration(elapsedMs) {
+    if (elapsedMs < 1_000)
+        return "under_1s";
+    if (elapsedMs < 5_000)
+        return "under_5s";
+    if (elapsedMs < 30_000)
+        return "under_30s";
+    return "over_30s";
+}
+/**
+ * What is recorded when somebody connects a client, and the only thing that is.
+ *
+ * **Every field is drawn from a closed set, and that is the point rather than a
+ * convenience.** There is no free-text field, no identifier, no address and no
+ * measurement finer than a bucket, so an event of this shape cannot carry an
+ * account, an organization, a project, an OAuth URL, a token, a destination or a
+ * payload however carelessly it is constructed. The project specification asks
+ * for activation evidence containing "durations and coarse outcomes, never
+ * callback bodies, secrets, tenant identifiers, or customer payloads"; a schema
+ * that admits only those is how that becomes a property instead of a promise.
+ *
+ * `client` is validated against the catalog rather than typed as a string, so a
+ * client nobody has walked cannot appear in activation data as though it had.
+ *
+ * **Strict, not merely typed, and a test is why.** An ordinary object schema
+ * *strips* a field it does not know, which would have made an emitter that added
+ * `project` look like it was recording one while the field silently vanished.
+ * Stripping is safe and dishonest: the caller believes something is being
+ * recorded that is not, and nothing ever tells them. "Closed" has to mean the
+ * schema refuses what it does not recognise, so the mistake surfaces where it
+ * was made.
+ */
+export const mcpActivationEventSchema = z.strictObject({
+    /** Which of the two named authentication modes was used. */
+    authKind: z.enum(["oauth", "api-key"]),
+    /** Every step, and what it did. */
+    checks: z.record(z.enum(MCP_CONNECTION_CHECKS), z.enum(MCP_CONNECTION_OUTCOMES)),
+    /** The catalog id of the client, checked against the catalog by the emitter. */
+    client: z.string().regex(/^[a-z][a-z0-9-]{0,31}$/u),
+    duration: z.enum(MCP_ACTIVATION_DURATIONS),
+    /** Present only when something stopped, and drawn from a closed list. */
+    failure: z.enum(MCP_CONNECTION_FAILURES).optional(),
+    type: z.literal("mcp.connection_test"),
+});