@greatwait/contracts 0.1.0-alpha.3 → 0.1.0-alpha.4

package/dist/organization-lifecycle.d.ts

@@ -0,0 +1,34 @@
+import { z } from "./zod.js";
+export declare const organizationLifecycleSchema: import("zod").ZodObject<{
+    organizationId: import("zod").ZodString;
+    generation: import("zod").ZodNumber;
+    phase: import("zod").ZodEnum<{
+        active: "active";
+        closing: "closing";
+        closed: "closed";
+        restoring: "restoring";
+        purging: "purging";
+        erased: "erased";
+    }>;
+    requestedAt: import("zod").ZodNullable<import("zod").ZodString>;
+    reversibleUntil: import("zod").ZodNullable<import("zod").ZodString>;
+    purgeDeadline: import("zod").ZodNullable<import("zod").ZodString>;
+    immediate: import("zod").ZodBoolean;
+    converged: import("zod").ZodBoolean;
+}, import("zod/v4/core").$strict>;
+export declare const organizationClosureRequestSchema: import("zod").ZodObject<{
+    expectedGeneration: import("zod").ZodNumber;
+    immediate: import("zod").ZodBoolean;
+    confirmation: import("zod").ZodLiteral<"delete organization">;
+}, import("zod/v4/core").$strict>;
+export declare const organizationRestoreRequestSchema: import("zod").ZodObject<{
+    expectedGeneration: import("zod").ZodNumber;
+}, import("zod/v4/core").$strict>;
+export type OrganizationLifecycle = z.infer<typeof organizationLifecycleSchema>;
+export declare const ORGANIZATION_LIFECYCLE_OPERATIONS: readonly [import("./operations.js").OperationDefinition & {
+    readonly id: "organizations.lifecycle";
+}, import("./operations.js").OperationDefinition & {
+    readonly id: "organizations.close";
+}, import("./operations.js").OperationDefinition & {
+    readonly id: "organizations.restore";
+}];

package/dist/organization-lifecycle.js

@@ -0,0 +1,122 @@
+import { organizationIdSchema } from "./identifiers.js";
+import { API_UNUSED_RESPONSE_SCHEMA, defineOperations, } from "./operation-definitions.js";
+import { timestampSchema } from "./time.js";
+import { z } from "./zod.js";
+export const organizationLifecycleSchema = z.strictObject({
+    organizationId: organizationIdSchema,
+    generation: z.number().int().nonnegative(),
+    phase: z.enum([
+        "active",
+        "closing",
+        "closed",
+        "restoring",
+        "purging",
+        "erased",
+    ]),
+    requestedAt: timestampSchema.nullable(),
+    reversibleUntil: timestampSchema.nullable(),
+    purgeDeadline: timestampSchema.nullable(),
+    immediate: z.boolean(),
+    converged: z.boolean(),
+});
+export const organizationClosureRequestSchema = z.strictObject({
+    expectedGeneration: z.number().int().nonnegative(),
+    immediate: z.boolean(),
+    confirmation: z.literal("delete organization"),
+});
+export const organizationRestoreRequestSchema = z.strictObject({
+    expectedGeneration: z.number().int().positive(),
+});
+const example = {
+    organizationId: "org_01h8xyz9k2m4n6p8r0t2v4w6y8",
+    generation: 1,
+    phase: "closed",
+    requestedAt: "2026-09-12T12:00:00.000Z",
+    reversibleUntil: "2026-09-19T12:00:00.000Z",
+    purgeDeadline: "2026-10-12T12:00:00.000Z",
+    immediate: false,
+    converged: true,
+};
+const common = {
+    creates: false,
+    idempotent: true,
+    mcp: {
+        kind: "unavailable",
+        reason: "Organization closure and recovery require a signed-in administrator; delegated credentials cannot acquire organization-wide authority.",
+    },
+    principals: ["session"],
+    problems: [
+        "invalid_request",
+        "not_found",
+        "state_conflict",
+        "version_conflict",
+    ],
+    response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+        ? API_UNUSED_RESPONSE_SCHEMA
+        : organizationLifecycleSchema,
+    scopes: ["projects:administer"],
+    sessionAuthority: "organization",
+    surfaces: ["api", "mock"],
+    example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+        ? {}
+        : example,
+};
+export const ORGANIZATION_LIFECYCLE_OPERATIONS = defineOperations([
+    {
+        ...common,
+        id: "organizations.lifecycle",
+        problems: ["not_found", "service_unavailable"],
+        method: "GET",
+        mutates: false,
+        path: "/v1/organization/lifecycle",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read organization closure progress",
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Reads the signed-in administrator's organization closure generation and progress, including the reversible window. It remains available during closure so the administrator can request recovery.",
+    },
+    {
+        ...common,
+        id: "organizations.close",
+        method: "POST",
+        mutates: true,
+        path: "/v1/organization/close",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Close the organization and request erasure",
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Stops customer access, execution and new purchases across the organization. Ordinary closure can be reversed for seven days; immediate erasure skips that window. Non-financial erasure completes within thirty days unless suspended by an operator legal hold. Financial records remain under the configured retention policy. An interrupted request resumes under the same generation; closure is acknowledged only after every configured scheduling shard is fenced.",
+        request: organizationClosureRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                expectedGeneration: 0,
+                immediate: false,
+                confirmation: "delete organization",
+            },
+    },
+    {
+        ...common,
+        id: "organizations.restore",
+        method: "POST",
+        mutates: true,
+        path: "/v1/organization/restore",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Cancel organization erasure during its reversible window",
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Restores access after every configured scheduling shard acknowledges the new generation. Immediate erasure and expired reversible windows cannot be restored. Recovery preserves each schedule's pause and lateness policy and does not reauthorize automatic top-up.",
+        request: organizationRestoreRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { expectedGeneration: 1 },
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { ...example, generation: 2, phase: "active" },
+    },
+]);

package/dist/partition.d.ts

@@ -540,6 +540,12 @@ export interface ListOccurrencesQuery {
     readonly after?: OccurrencePagePosition;
     readonly authority: Authority;
     readonly limit: number;
+    /**
+     * Which end to walk from; oldest when absent. A cursor belongs to the order
+     * it was issued under. Spelled out rather than imported so this module keeps
+     * carrying no runtime import of the contract barrel.
+     */
+    readonly order?: "newest" | "oldest";
     readonly scheduleId: string;
 }
 export type ListOccurrencesOutcome = PartitionRefused | {
@@ -621,6 +627,8 @@ export interface ScheduleWriteCommand {
 }
 /** Replace a schedule's definition, starting a new generation. */
 export interface ReplaceScheduleCommand extends ScheduleWriteCommand {
+    /** A new name; absent keeps the stored one (W4-14). */
+    readonly name?: string;
     /**
      * The replacement's delivery settings.
      *
@@ -740,6 +748,24 @@ export type ForecastOutcome = PartitionRefused | {
      */
     readonly asOfMs?: number;
     readonly buckets: readonly ForecastPartitionBucket[];
+    /**
+     * The instant this answer actually reached, when it is not the one asked
+     * for.
+     *
+     * **A plan horizon shortens a forecast rather than refusing it**, which
+     * is the right trade — a plan that buys six hours is telling a customer
+     * how far it can see, and answering "no forecast at all" because they
+     * asked for a day would be a worse reading of the same purchase. What
+     * was missing is the other half: the published window said twenty-four
+     * hours and the last eighteen of them were empty, so a caller sizing
+     * capacity read "nothing planned" where the truth was "not projected",
+     * and under-read by three quarters. The dashboard drew it as eighteen
+     * hours of zero bars.
+     *
+     * Absent when the answer covered the whole window, which is every source
+     * with no horizon over it.
+     */
+    readonly coveredToMs?: number;
     readonly truncated: boolean;
 };
 /**

package/dist/policy.d.ts

@@ -47,10 +47,10 @@ export declare function grantableScopes(): readonly Scope[];
  * that will be refused `authentication_required` on the only route it names,
  * for ever, and nothing about the key says so.
  *
- * `projects:read` was the first such scope and `projects:write` is the second —
- * both belong to operations that accept only a signed-in member, because a
- * key's authority already *is* one project. Deriving the list rather than
- * naming them is what keeps a third from arriving unnoticed.
+ * `projects:read` remains excluded because enumerating an organization is a
+ * signed-in member's question. Project writes are different: a key's authority
+ * already names exactly the project that rename/archive/delete may affect, so
+ * those scopes become usable when their operations do.
  */
 export declare function credentialScopes(): readonly Scope[];
 /** One row of the generated policy matrix. */

package/dist/policy.js

@@ -50,9 +50,13 @@ function allOperations() {
  * Clerk's and this product does not do it, so this is the whole of what `admin`
  * means here.
  */
-const MEMBER_SCOPES = SCOPES.filter((scope) => scope !== "credentials:administer");
+const MEMBER_SCOPES = SCOPES.filter((scope) => scope !== "billing:write" &&
+    scope !== "credentials:administer" &&
+    scope !== "projects:administer");
+const BILLING_SCOPES = SCOPES.filter((scope) => scope !== "credentials:administer" && scope !== "projects:administer");
 export const ROLE_SCOPE_CEILINGS = {
     admin: SCOPES,
+    billing: BILLING_SCOPES,
     member: MEMBER_SCOPES,
 };
 /** Everything a role may hold, expanded so a write implies its read. */
@@ -129,10 +133,10 @@ export function grantableScopes() {
  * that will be refused `authentication_required` on the only route it names,
  * for ever, and nothing about the key says so.
  *
- * `projects:read` was the first such scope and `projects:write` is the second —
- * both belong to operations that accept only a signed-in member, because a
- * key's authority already *is* one project. Deriving the list rather than
- * naming them is what keeps a third from arriving unnoticed.
+ * `projects:read` remains excluded because enumerating an organization is a
+ * signed-in member's question. Project writes are different: a key's authority
+ * already names exactly the project that rename/archive/delete may affect, so
+ * those scopes become usable when their operations do.
  */
 export function credentialScopes() {
     const usable = new Set(allOperations()

package/dist/problems.d.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "./zod.js";
 /**
  * Refusals.
  *
@@ -13,7 +13,7 @@ import { z } from "zod";
  * being a breaking change; clients must never branch on them.
  */
 export declare const PROBLEM_CATEGORIES: readonly ["authentication", "authorization", "conflict", "invalid-request", "not-found", "rate-limited", "unavailable"];
-export declare const problemCategorySchema: z.ZodEnum<{
+export declare const problemCategorySchema: import("zod").ZodEnum<{
     authentication: "authentication";
     authorization: "authorization";
     conflict: "conflict";
@@ -40,10 +40,6 @@ export declare const PROBLEM_CODES: {
         readonly category: "authentication";
         readonly status: 401;
     };
-    readonly endpoint_unverified: {
-        readonly category: "invalid-request";
-        readonly status: 422;
-    };
     readonly idempotency_key_reused: {
         readonly category: "conflict";
         readonly status: 409;
@@ -64,10 +60,18 @@ export declare const PROBLEM_CODES: {
         readonly category: "conflict";
         readonly status: 409;
     };
+    readonly project_archived: {
+        readonly category: "conflict";
+        readonly status: 409;
+    };
     readonly rate_limited: {
         readonly category: "rate-limited";
         readonly status: 429;
     };
+    readonly revision_conflict: {
+        readonly category: "conflict";
+        readonly status: 409;
+    };
     readonly scope_missing: {
         readonly category: "authorization";
         readonly status: 403;
@@ -90,17 +94,18 @@ export declare const PROBLEM_CODES: {
     };
 };
 export type ProblemCode = keyof typeof PROBLEM_CODES;
-export declare const problemCodeSchema: z.ZodEnum<{
+export declare const problemCodeSchema: import("zod").ZodEnum<{
     authentication_required: "authentication_required";
     credential_expired: "credential_expired";
     credential_revoked: "credential_revoked";
-    endpoint_unverified: "endpoint_unverified";
     idempotency_key_reused: "idempotency_key_reused";
     invalid_request: "invalid_request";
     not_found: "not_found";
     payload_too_large: "payload_too_large";
     plan_limit_reached: "plan_limit_reached";
+    project_archived: "project_archived";
     rate_limited: "rate_limited";
+    revision_conflict: "revision_conflict";
     scope_missing: "scope_missing";
     service_unavailable: "service_unavailable";
     state_conflict: "state_conflict";
@@ -109,40 +114,41 @@ export declare const problemCodeSchema: z.ZodEnum<{
 }>;
 /** Whether repeating the identical request could succeed later. */
 export declare function isRetryable(code: ProblemCode): boolean;
-export declare const fieldErrorSchema: z.ZodObject<{
-    pointer: z.ZodString;
-    reason: z.ZodString;
-}, z.core.$strip>;
+export declare const fieldErrorSchema: import("zod").ZodObject<{
+    pointer: import("zod").ZodString;
+    reason: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 export type FieldError = z.infer<typeof fieldErrorSchema>;
-export declare const problemSchema: z.ZodObject<{
-    code: z.ZodEnum<{
+export declare const problemSchema: import("zod").ZodObject<{
+    code: import("zod").ZodEnum<{
         authentication_required: "authentication_required";
         credential_expired: "credential_expired";
         credential_revoked: "credential_revoked";
-        endpoint_unverified: "endpoint_unverified";
         idempotency_key_reused: "idempotency_key_reused";
         invalid_request: "invalid_request";
         not_found: "not_found";
         payload_too_large: "payload_too_large";
         plan_limit_reached: "plan_limit_reached";
+        project_archived: "project_archived";
         rate_limited: "rate_limited";
+        revision_conflict: "revision_conflict";
         scope_missing: "scope_missing";
         service_unavailable: "service_unavailable";
         state_conflict: "state_conflict";
         test_to_live_escalation: "test_to_live_escalation";
         version_conflict: "version_conflict";
     }>;
-    detail: z.ZodOptional<z.ZodString>;
-    errors: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        pointer: z.ZodString;
-        reason: z.ZodString;
-    }, z.core.$strip>>>;
-    retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
-    status: z.ZodNumber;
-    title: z.ZodString;
-    traceId: z.ZodOptional<z.ZodString>;
-    type: z.ZodLiteral<"about:blank">;
-}, z.core.$strip>;
+    detail: import("zod").ZodOptional<import("zod").ZodString>;
+    errors: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
+        pointer: import("zod").ZodString;
+        reason: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>>>;
+    retryAfterSeconds: import("zod").ZodOptional<import("zod").ZodNumber>;
+    status: import("zod").ZodNumber;
+    title: import("zod").ZodString;
+    traceId: import("zod").ZodOptional<import("zod").ZodString>;
+    type: import("zod").ZodLiteral<"about:blank">;
+}, import("zod/v4/core").$strip>;
 export type Problem = z.infer<typeof problemSchema>;
 export interface ProblemOptions {
     readonly detail?: string;

package/dist/problems.js

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "./zod.js";
 /**
  * Refusals.
  *
@@ -36,13 +36,17 @@ export const PROBLEM_CODES = {
     // versus find out who revoked it.
     credential_expired: { category: "authentication", status: 401 },
     credential_revoked: { category: "authentication", status: 401 },
-    endpoint_unverified: { category: "invalid-request", status: 422 },
     idempotency_key_reused: { category: "conflict", status: 409 },
     invalid_request: { category: "invalid-request", status: 400 },
     not_found: { category: "not-found", status: 404 },
     payload_too_large: { category: "invalid-request", status: 413 },
     plan_limit_reached: { category: "conflict", status: 409 },
+    // The target belongs to the caller, but its whole project is parked. This is
+    // deliberately distinct from `not_found`: foreign projects still receive
+    // that opaque answer, while an owner needs the move that restores their own.
+    project_archived: { category: "conflict", status: 409 },
     rate_limited: { category: "rate-limited", status: 429 },
+    revision_conflict: { category: "conflict", status: 409 },
     scope_missing: { category: "authorization", status: 403 },
     service_unavailable: { category: "unavailable", status: 503 },
     // The resource is in a state that does not permit what was asked — resuming a