@greatwait/contracts 0.1.0-alpha.3 → 0.1.0-alpha.5

package/dist/endpoints.js

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "./zod.js";
 import { environmentKindSchema } from "./authority.js";
 import { evaluateCallbackUrl } from "./callback-safety.js";
 import { callbackSigningKeyIdSchema, endpointIdSchema, projectIdSchema, } from "./identifiers.js";
@@ -12,15 +12,22 @@ import { timestampSchema } from "./time.js";
  * a caller can use to widen that tuple: `project` and `environmentKind` are
  * display metadata, while every lookup is scoped by the verified principal.
  */
-export const CALLBACK_ENDPOINT_STATUSES = [
-    "pending",
-    "verified",
-    "disabled",
-];
+/**
+ * An endpoint is usable the moment it exists (W4-12). `active` is every
+ * endpoint that is not disabled; `disabled` stops delivery until
+ * `endpoints.enable` turns it back on. There is no state in between and
+ * nothing to prove.
+ */
+export const CALLBACK_ENDPOINT_STATUSES = ["active", "disabled"];
 export const callbackEndpointStatusSchema = z.enum(CALLBACK_ENDPOINT_STATUSES);
-export const CALLBACK_VERIFICATION_FAILURES = [
+/**
+ * Why an address could not be resolved or reached: the classification the
+ * DNS inspection at create and update, and the delivery egress, share. It
+ * was the verification-failure vocabulary until W4-12 removed verification;
+ * what remains is what those two paths can still observe.
+ */
+export const CALLBACK_EGRESS_FAILURES = [
     "address_forbidden",
-    "challenge_failed",
     "connection_failed",
     "dns_unresolved",
     "rate_limited",
@@ -29,51 +36,74 @@ export const CALLBACK_VERIFICATION_FAILURES = [
     "timed_out",
     "unexpected_status",
 ];
-export const callbackVerificationFailureSchema = z.enum(CALLBACK_VERIFICATION_FAILURES);
+export const callbackEgressFailureSchema = z.enum(CALLBACK_EGRESS_FAILURES);
 /**
- * A safety ceiling on retained endpoint records, independent of later
- * commercial plan limits. Disabled records remain readable for audit and count
- * toward it; changing that lifetime semantic needs a product decision.
+ * @deprecated The former retained endpoint count ceiling. W0-15 removes count
+ * enforcement after the operator's decision; DNS/mutation admission and paged
+ * reads protect bounded work. Retained for source compatibility with old clients.
  */
 export const CALLBACK_ENDPOINT_LIMIT_PER_ENVIRONMENT = 50;
-/** Verification egress is admitted through both buckets before DNS or fetch. */
-export const CALLBACK_VERIFICATION_RATE_LIMITS = {
-    destinationPerMinute: 5,
-    projectPerMinute: 20,
+/**
+ * DNS inspection at create and update is admitted through both buckets
+ * before the first lookup, so an address a caller retypes cannot make this
+ * service resolve names without bound.
+ */
+export const CALLBACK_ADMISSION_RATE_LIMITS = {
+    destinationPerMinute: 15,
+    projectPerMinute: 60,
     windowSeconds: 60,
 };
-/** Total bytes a verification response may return before it is refused. */
-export const CALLBACK_VERIFICATION_RESPONSE_BYTES = 1_024;
-/** Total DNS + connect + response bound for one verification attempt. */
-export const CALLBACK_VERIFICATION_TIMEOUT_MILLISECONDS = 5_000;
 /** Longest period during which a receiver may accept current and next keys. */
 export const CALLBACK_SIGNING_KEY_ROTATION_OVERLAP_SECONDS = 86_400;
 export const callbackSigningKeysSchema = z.object({
     current: callbackSigningKeyIdSchema,
     next: z
         .object({
+        /** When a person confirmed their server accepts this next key. */
+        acknowledgedAt: timestampSchema.optional(),
         id: callbackSigningKeyIdSchema,
         overlapEndsAt: timestampSchema,
     })
         .optional(),
 });
+/**
+ * An endpoint's name: unique within its project and environment, compared
+ * exactly (W4-14, FXO-2255).
+ *
+ * Generated on save when nobody types one — the whole URL — because an
+ * endpoint appears in a dropdown, and two identical rows in a dropdown are
+ * two rows nobody can choose between. So a second endpoint at an address one
+ * already has is refused unless it is given a name of its own. **Case
+ * matters**: two webhook URLs differing only in the case of a token are two
+ * endpoints and both save unnamed; the cost, accepted knowingly, is that
+ * "Prod receiver" and "prod receiver" are both allowed. Deliberately unlike a
+ * project's name, which ignores case and spacing.
+ */
+export const callbackEndpointNameSchema = z
+    .string()
+    .trim()
+    .min(1, "must not be blank")
+    .max(2_048, "must be at most 2048 characters");
 /**
  * A metadata-only endpoint shape. The sealed signing secret has no public
- * field, so list/get/update/verify/disable cannot accidentally recover it.
+ * field, so list/get/update/disable/enable cannot accidentally recover it.
  */
 export const callbackEndpointSchema = z.object({
     createdAt: timestampSchema,
     disabledAt: timestampSchema.optional(),
     environmentKind: environmentKindSchema,
     id: endpointIdSchema,
-    lastVerificationAttemptAt: timestampSchema.optional(),
-    lastVerificationFailure: callbackVerificationFailureSchema.optional(),
+    /**
+     * The endpoint's name. Every endpoint written since W4-14 has one — its
+     * URL when none was given — and it is optional on the wire only so a row
+     * from before the column parses rather than fails.
+     */
+    name: callbackEndpointNameSchema.optional(),
     project: projectIdSchema,
     signingKeys: callbackSigningKeysSchema,
     status: callbackEndpointStatusSchema,
     updatedAt: timestampSchema,
     url: z.string().url(),
-    verifiedAt: timestampSchema.optional(),
     version: z.number().int().positive(),
 });
 export const callbackEndpointPageSchema = pageSchema(callbackEndpointSchema);
@@ -97,6 +127,27 @@ export const callbackEndpointRotatedSchema = z.object({
     secret: z.string().min(1),
     shownOnce: z.literal(true),
 });
+/** One signing key and the secret behind it, as a signed-in person may see it. */
+export const callbackEndpointSigningSecretSchema = z.object({
+    keyId: callbackSigningKeyIdSchema,
+    secret: z.string().min(1),
+});
+/**
+ * What `endpoints.revealSigningSecret` answers (FXO-2244).
+ *
+ * The same value `endpoints.create` and `endpoints.rotateSigningKey` hand out
+ * once, readable again by a signed-in member. Mirrors `signingKeys`: during a
+ * rotation both keys are here, with the instant the overlap ends, because a
+ * receiver being moved to the new key needs both until then.
+ */
+export const callbackEndpointSigningSecretsSchema = z.object({
+    current: callbackEndpointSigningSecretSchema,
+    /** The endpoint these belong to, so an answer names what it is about. */
+    id: endpointIdSchema,
+    next: callbackEndpointSigningSecretSchema
+        .extend({ overlapEndsAt: timestampSchema })
+        .optional(),
+});
 function callbackUrlSchema() {
     return z
         .string()
@@ -113,67 +164,12 @@ function callbackUrlSchema() {
     });
 }
 export const callbackEndpointRequestSchema = z.object({
+    /**
+     * A name for people (W4-14, FXO-2255). Omitted on a create, the endpoint
+     * takes its whole URL as its name; omitted on an update, the stored name
+     * stays. Unique within the project and environment, compared exactly: a
+     * name another endpoint holds is refused as `state_conflict`.
+     */
+    name: callbackEndpointNameSchema.optional(),
     url: callbackUrlSchema(),
 });
-export const CALLBACK_VERIFICATION_PROTOCOL_VERSION = "2026-08-05";
-export const CALLBACK_VERIFICATION_TYPE = "callback.endpoint.verification";
-/**
- * Exact verification bytes sent to the receiver. The receiver validates the
- * request signature and proves possession of the one-time secret by returning
- * an HMAC of `challenge` in `Callback-Verification-Response`.
- */
-export const callbackVerificationChallengeSchema = z.object({
-    challenge: z.string().regex(/^cvc_[A-Za-z0-9_-]{43}$/u),
-    endpointId: endpointIdSchema,
-    type: z.literal(CALLBACK_VERIFICATION_TYPE),
-    version: z.literal(CALLBACK_VERIFICATION_PROTOCOL_VERSION),
-});
-export const CALLBACK_VERIFICATION_HEADERS = {
-    challenge: "Callback-Verification-Challenge",
-    requestSignature: "Callback-Verification-Signature",
-    responseSignature: "Callback-Verification-Response",
-};
-/**
- * Machine-readable receiver contract for endpoint ownership verification.
- *
- * This is deliberately separate from W3-02's occurrence-delivery signature:
- * the request proves control of a receiver before the endpoint may be used,
- * while a delivery signature authenticates an occurrence body later. The
- * generator publishes this object beside OpenAPI and the JSON Schema.
- */
-export const CALLBACK_VERIFICATION_PROTOCOL = {
-    purpose: "Prove that the receiver possesses the one-time endpoint secret before Greatwait marks the endpoint verified.",
-    request: {
-        bodyEncoding: "UTF-8 bytes of the compact JSON object in schema property order: challenge, endpointId, type, version.",
-        contentType: "application/json",
-        method: "POST",
-        redirectPolicy: "manual; every 3xx response is refused",
-        signature: {
-            algorithm: "HMAC-SHA-256",
-            format: "v1=<64 lowercase hexadecimal characters>",
-            header: CALLBACK_VERIFICATION_HEADERS.requestSignature,
-            input: "the exact request body bytes",
-            key: "the one-time endpoint secret returned by REST endpoint creation",
-        },
-    },
-    response: {
-        body: "ignored after enforcing the 1024-byte response limit; return an empty body",
-        proof: {
-            algorithm: "HMAC-SHA-256",
-            format: "v1=<64 lowercase hexadecimal characters>",
-            header: CALLBACK_VERIFICATION_HEADERS.responseSignature,
-            input: "the UTF-8 bytes of the challenge string",
-            key: "the same endpoint secret",
-        },
-        status: "any 2xx status",
-    },
-    testVector: {
-        challenge: "cvc_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
-        endpointId: "ep_00000000000000000000000000",
-        exactBodyBase64: "eyJjaGFsbGVuZ2UiOiJjdmNfQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQSIsImVuZHBvaW50SWQiOiJlcF8wMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsInR5cGUiOiJjYWxsYmFjay5lbmRwb2ludC52ZXJpZmljYXRpb24iLCJ2ZXJzaW9uIjoiMjAyNi0wOC0wNSJ9",
-        requestSignature: "v1=0d24c7fed4d752411b88025a9923627b329e0eb9d53978a6ebcf92c0678c731e",
-        responseSignature: "v1=efc690a23f1870930ff3388313162c0e06406902a7a4d3f9273ffe0abcef86bd",
-        secret: "verification-vector-secret",
-    },
-    version: CALLBACK_VERIFICATION_PROTOCOL_VERSION,
-};

package/dist/events.d.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "./zod.js";
 /**
  * Product events.
  *
@@ -11,7 +11,7 @@ import { z } from "zod";
  * collapsing them is how "why is this event from the future" bugs start.
  */
 export declare const EVENT_TYPES: readonly ["endpoint.verified", "occurrence.attempt.recorded", "occurrence.due", "occurrence.succeeded", "occurrence.terminal_failed", "schedule.cancelled", "schedule.completed", "schedule.created", "schedule.replaced"];
-export declare const eventTypeSchema: z.ZodEnum<{
+export declare const eventTypeSchema: import("zod").ZodEnum<{
     "endpoint.verified": "endpoint.verified";
     "occurrence.attempt.recorded": "occurrence.attempt.recorded";
     "occurrence.due": "occurrence.due";
@@ -23,13 +23,13 @@ export declare const eventTypeSchema: z.ZodEnum<{
     "schedule.replaced": "schedule.replaced";
 }>;
 export type EventType = z.infer<typeof eventTypeSchema>;
-export declare function eventEnvelopeSchema<TData extends z.ZodTypeAny>(data: TData): z.ZodObject<{
+export declare function eventEnvelopeSchema<TData extends z.ZodTypeAny>(data: TData): import("zod").ZodObject<{
     data: TData;
-    id: z.ZodString;
-    occurredAt: z.ZodString;
-    recordedAt: z.ZodString;
-    schemaVersion: z.ZodNumber;
-    type: z.ZodEnum<{
+    id: import("zod").ZodString;
+    occurredAt: import("zod").ZodString;
+    recordedAt: import("zod").ZodString;
+    schemaVersion: import("zod").ZodNumber;
+    type: import("zod").ZodEnum<{
         "endpoint.verified": "endpoint.verified";
         "occurrence.attempt.recorded": "occurrence.attempt.recorded";
         "occurrence.due": "occurrence.due";
@@ -40,14 +40,14 @@ export declare function eventEnvelopeSchema<TData extends z.ZodTypeAny>(data: TD
         "schedule.created": "schedule.created";
         "schedule.replaced": "schedule.replaced";
     }>;
-}, z.core.$strip>;
-export declare const genericEventSchema: z.ZodObject<{
-    data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    id: z.ZodString;
-    occurredAt: z.ZodString;
-    recordedAt: z.ZodString;
-    schemaVersion: z.ZodNumber;
-    type: z.ZodEnum<{
+}, import("zod/v4/core").$strip>;
+export declare const genericEventSchema: import("zod").ZodObject<{
+    data: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
+    id: import("zod").ZodString;
+    occurredAt: import("zod").ZodString;
+    recordedAt: import("zod").ZodString;
+    schemaVersion: import("zod").ZodNumber;
+    type: import("zod").ZodEnum<{
         "endpoint.verified": "endpoint.verified";
         "occurrence.attempt.recorded": "occurrence.attempt.recorded";
         "occurrence.due": "occurrence.due";
@@ -58,5 +58,5 @@ export declare const genericEventSchema: z.ZodObject<{
         "schedule.created": "schedule.created";
         "schedule.replaced": "schedule.replaced";
     }>;
-}, z.core.$strip>;
+}, import("zod/v4/core").$strip>;
 export type GenericEvent = z.infer<typeof genericEventSchema>;

package/dist/events.js

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "./zod.js";
 import { eventIdSchema } from "./identifiers.js";
 import { timestampSchema } from "./time.js";
 /**

package/dist/first-value-journey.d.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "./zod.js";
 import type { ProblemCode } from "./problems.js";
 /**
  * The one bounded sequence that takes a developer from a credential to an
@@ -6,7 +6,7 @@ import type { ProblemCode } from "./problems.js";
  *
  * **Declared once, here, because W9-03 is not the only story that has to tell
  * it.** The curl quickstart, the JavaScript quickstart, the website journey
- * W9-01 owns, the DocsAlot pages W9-04 publishes, and the command-line
+ * W9-01 owns, the documentation pages W9-04 publishes, and the command-line
  * ergonomics W10 owns are all the *same* sequence rendered for a different
  * reader. Written separately they diverge silently — the legacy scheduler's
  * hand-maintained client and documentation are the worked example, and the
@@ -195,47 +195,47 @@ export interface JourneyStep {
  * carrying a real one would be a leak that no reviewer reads carefully enough
  * to catch, so the refusal is here rather than in a convention.
  */
-export declare const journeyVariableSchema: z.ZodObject<{
-    defaultExpression: z.ZodOptional<z.ZodObject<{
-        javascript: z.ZodString;
-        shell: z.ZodString;
-    }, z.core.$strip>>;
-    detail: z.ZodString;
-    name: z.ZodString;
-    placeholder: z.ZodString;
-    secret: z.ZodBoolean;
-    title: z.ZodString;
-}, z.core.$strip>;
-export declare const journeyStepSchema: z.ZodObject<{
-    capture: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        from: z.ZodString;
-        header: z.ZodOptional<z.ZodBoolean>;
-        secret: z.ZodOptional<z.ZodBoolean>;
-        variable: z.ZodString;
-    }, z.core.$strip>>>;
-    expect: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        equals: z.ZodString;
-        message: z.ZodString;
-        subject: z.ZodString;
-    }, z.core.$strip>>>;
-    key: z.ZodString;
-    observe: z.ZodString;
-    operationId: z.ZodString;
-    poll: z.ZodOptional<z.ZodObject<{
-        describe: z.ZodString;
-        intervalSeconds: z.ZodNumber;
-        timeoutSeconds: z.ZodNumber;
-    }, z.core.$strip>>;
-    purpose: z.ZodString;
-    query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    recovery: z.ZodArray<z.ZodObject<{
-        nextMove: z.ZodString;
-        when: z.ZodString;
-    }, z.core.$strip>>;
-    request: z.ZodOptional<z.ZodUnknown>;
-    requestHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    title: z.ZodString;
-}, z.core.$strip>;
+export declare const journeyVariableSchema: import("zod").ZodObject<{
+    defaultExpression: import("zod").ZodOptional<import("zod").ZodObject<{
+        javascript: import("zod").ZodString;
+        shell: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>>;
+    detail: import("zod").ZodString;
+    name: import("zod").ZodString;
+    placeholder: import("zod").ZodString;
+    secret: import("zod").ZodBoolean;
+    title: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
+export declare const journeyStepSchema: import("zod").ZodObject<{
+    capture: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
+        from: import("zod").ZodString;
+        header: import("zod").ZodOptional<import("zod").ZodBoolean>;
+        secret: import("zod").ZodOptional<import("zod").ZodBoolean>;
+        variable: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>>>;
+    expect: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
+        equals: import("zod").ZodString;
+        message: import("zod").ZodString;
+        subject: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>>>;
+    key: import("zod").ZodString;
+    observe: import("zod").ZodString;
+    operationId: import("zod").ZodString;
+    poll: import("zod").ZodOptional<import("zod").ZodObject<{
+        describe: import("zod").ZodString;
+        intervalSeconds: import("zod").ZodNumber;
+        timeoutSeconds: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strip>>;
+    purpose: import("zod").ZodString;
+    query: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodString>>;
+    recovery: import("zod").ZodArray<import("zod").ZodObject<{
+        nextMove: import("zod").ZodString;
+        when: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>>;
+    request: import("zod").ZodOptional<import("zod").ZodUnknown>;
+    requestHeaders: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodString>>;
+    title: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
 /**
  * The lowest curl that runs the generated commands.
  *
@@ -320,11 +320,6 @@ export declare function journeyCapturedVariables(): readonly string[];
  * sentence of its own. What the browser prints is what the curl page prints,
  * because it is the same declaration rendered twice.
  *
- * **`verified` maps to nothing, deliberately.** The ownership challenge is
- * optional and off by default since W4-09, so the journey does not perform it;
- * a deployment that turns it on gets the step from
- * `endpoints.verify`'s own snippet. Mapping it to a journey step that does not
- * exist would be worse than mapping it to none.
  */
 export declare const WEBSITE_JOURNEY_STEP_KEYS: Readonly<Record<string, readonly string[]>>;
 /** The journey steps a website step renders, resolved against the sequence. */
@@ -370,7 +365,7 @@ export declare function journeyActivationDuration(elapsedMs: number): JourneyAct
 export declare const JOURNEY_ACTIVATION_OUTCOMES: readonly ["reached", "refused", "timed_out", "failed"];
 export type JourneyActivationOutcome = (typeof JOURNEY_ACTIVATION_OUTCOMES)[number];
 /** The website steps an activation fact may name. */
-export declare const WEBSITE_JOURNEY_STEPS: readonly ["destination", "verified", "scheduled", "delivered"];
+export declare const WEBSITE_JOURNEY_STEPS: readonly ["destination", "scheduled", "delivered"];
 /**
  * What is recorded when somebody moves through the website journey, and the
  * only thing that is.
@@ -388,27 +383,26 @@ export declare const WEBSITE_JOURNEY_STEPS: readonly ["destination", "verified",
  * The MCP schema learned that from a test and this one inherits the lesson
  * rather than rediscovering it.
  */
-export declare const websiteActivationEventSchema: z.ZodObject<{
-    duration: z.ZodEnum<{
+export declare const websiteActivationEventSchema: import("zod").ZodObject<{
+    duration: import("zod").ZodEnum<{
         under_1m: "under_1m";
         under_5m: "under_5m";
         under_15m: "under_15m";
         over_15m: "over_15m";
     }>;
-    outcome: z.ZodEnum<{
+    outcome: import("zod").ZodEnum<{
         failed: "failed";
         timed_out: "timed_out";
         refused: "refused";
         reached: "reached";
     }>;
-    step: z.ZodEnum<{
-        verified: "verified";
+    step: import("zod").ZodEnum<{
         delivered: "delivered";
         destination: "destination";
         scheduled: "scheduled";
     }>;
-    type: z.ZodLiteral<"website.journey_step">;
-}, z.core.$strict>;
+    type: import("zod").ZodLiteral<"website.journey_step">;
+}, import("zod/v4/core").$strict>;
 export type WebsiteActivationEvent = z.infer<typeof websiteActivationEventSchema>;
 /**
  * Parses an activation fact before it leaves the browser.

package/dist/first-value-journey.js

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "./zod.js";
 import { findOperation } from "./operations.js";
 /**
  * One thing that can go wrong at a step, and the next move.
@@ -109,20 +109,20 @@ export const CURL_JOURNEY_TOOLS = [
 ];
 export const FIRST_VALUE_PREREQUISITES = [
     {
-        action: "Accept your Greatwait invitation, sign in, and create a project in the dashboard.",
+        action: "Accept your GreatWait invitation, sign in, and create a project in the dashboard.",
         because: "projects.create accepts only a signed-in member, so a project is created by a person rather than by an API credential.",
         id: "project",
         title: "A project",
     },
     {
-        action: "In that project, create an API credential and copy the secret it shows once.",
+        action: "In that project, create an API credential with endpoints:write, occurrences:read, schedules:read and schedules:write, and copy the secret it shows once. The key picker starts with nothing selected and refuses an empty one, so those four are the boxes to tick.",
         because: "credentials.create accepts only a signed-in member: a credential that could mint another credential would make revoking one meaningless.",
         id: "credential",
         title: "An API credential",
     },
     {
         action: "Have an HTTPS URL of your own that answers POST with a 2xx status, and can be reached from the public internet.",
-        because: "Greatwait delivers your callback to an address you control. It does not offer a shared receiver to try, and it will not send your payload to a third-party inspection service on your behalf.",
+        because: "GreatWait delivers your callback to an address you control. It does not offer a shared receiver to try, and it will not send your payload to a third-party inspection service on your behalf.",
         id: "receiver",
         title: "An HTTPS receiver you control",
     },
@@ -190,7 +190,7 @@ export const FIRST_VALUE_STEPS = [
         key: "check-service",
         observe: "The service name and the environment you meant to work in. If the environment is not the one you expect, stop and fix GREATWAIT_API_URL before creating anything.",
         operationId: "meta.version",
-        purpose: "Confirms the origin you are pointed at is a Greatwait API and says which environment it serves. It needs no credential, so it separates 'wrong URL' from 'wrong key'.",
+        purpose: "Confirms the origin you are pointed at is a GreatWait API and says which environment it serves. It needs no credential, so it separates 'wrong URL' from 'wrong key'.",
         recovery: [
             {
                 nextMove: "Something answered, but not this service. Check GREATWAIT_API_URL — a 404 here comes from a proxy in front of the API rather than from the API, so it carries no problem document to read.",
@@ -235,7 +235,7 @@ export const FIRST_VALUE_STEPS = [
             { from: "id", variable: "GREATWAIT_ENDPOINTID" },
             { from: "secret", secret: true, variable: "GREATWAIT_ENDPOINT_SECRET" },
         ],
-        observe: "An endpoint identifier, and a signing secret returned by this call and by no other. Store the secret now: reading the endpoint back later will not show it again.",
+        observe: "An endpoint identifier, and a signing secret. Store it now: this is the only call that returns it, and reading the endpoint back shows a redacted prefix instead. It is not gone if you lose it — a signed-in member can read it again on the endpoint's own page in the dashboard, which is the one caller `endpoints.revealSigningSecret` accepts.",
         operationId: "endpoints.create",
         purpose: "Registers the address every occurrence of this schedule is delivered to, and mints the per-endpoint signing key your receiver verifies callbacks with.",
         recovery: [
@@ -247,6 +247,10 @@ export const FIRST_VALUE_STEPS = [
                 nextMove: "This project is at its destination ceiling. Disable a destination you no longer deliver to; disabled ones still count, because they stay readable for audit.",
                 when: "plan_limit_reached",
             },
+            {
+                nextMove: "An active destination already delivers to this address in this project — usually one a previous run of this journey created. Reuse that destination, disable it first, or give the new one a name of its own.",
+                when: "state_conflict",
+            },
         ],
         request: { url: "{{GREATWAIT_RECEIVER_URL}}" },
         title: "Create the destination",
@@ -262,12 +266,12 @@ export const FIRST_VALUE_STEPS = [
         purpose: "Creates the one-shot. The delay is converted to an absolute instant when the request is accepted, so the schedule reads back the same afterwards however it was expressed.",
         recovery: [
             {
-                nextMove: "This deployment requires a destination to answer its ownership challenge before anything is delivered there, and yours has not. Answer the challenge with the secret the create call returned, then create the schedule.",
-                when: "endpoint_unverified",
+                nextMove: "The endpoint identifier is not one this credential's project can deliver to — it belongs to another project, or there is no such endpoint. Create a destination in this project, or check the identifier.",
+                when: "not_found",
             },
             {
-                nextMove: "The endpoint identifier is not one this credential's project can deliver to — it belongs to another project, or it has been disabled. Disabling is terminal, so create a new destination rather than trying to re-enable that one.",
-                when: "not_found",
+                nextMove: "The endpoint is disabled. Enable it with `endpoints.enable` and the schedule is accepted as sent, or point the schedule at another destination.",
+                when: "state_conflict",
             },
             {
                 nextMove: "The same idempotency key was used for a different request. Use a new key, or send the byte-identical body the key was first used with.",
@@ -278,7 +282,7 @@ export const FIRST_VALUE_STEPS = [
                 when: "invalid_request",
             },
             {
-                nextMove: "This organization is at a plan ceiling — live schedules, distinct partition keys, or payload size. Nothing was created; reduce the payload or archive a schedule and retry.",
+                nextMove: "This organization is at a plan ceiling — the payload is larger than its plan carries, or the schedule names a new partition key when the organization's keys are full. Nothing was created; send a smaller payload or reuse a partition key that is already live, and retry.",
                 when: "plan_limit_reached",
             },
             {
@@ -375,7 +379,7 @@ export const FIRST_VALUE_STEPS = [
                 when: "attempt-failed",
             },
             {
-                nextMove: "Nothing reached your receiver. Confirm the URL answers a POST from the public internet, and that it is not behind an allowlist Greatwait is not on.",
+                nextMove: "Nothing reached your receiver. Confirm the URL answers a POST from the public internet, and that it is not behind an allowlist GreatWait is not on.",
                 when: "receiver-unreachable",
             },
         ],
@@ -385,7 +389,7 @@ export const FIRST_VALUE_STEPS = [
         key: "clean-up",
         observe: "The endpoint in status `disabled`. Nothing further is delivered to it, and it stays readable so the attempts above keep their context.",
         operationId: "endpoints.disable",
-        purpose: "Stops delivery to the destination you registered for this walkthrough. Disabling is terminal and deliberate: it leaves the history intact rather than deleting evidence of what happened.",
+        purpose: "Stops delivery to the destination you registered for this walkthrough. Disabling is deliberate rather than final: it leaves the history intact rather than deleting evidence of what happened, and `endpoints.enable` turns the destination back on if you want it again.",
         recovery: [
             {
                 nextMove: "Already gone, or never in this project. Nothing to clean up.",
@@ -482,17 +486,11 @@ export function journeyCapturedVariables() {
  * sentence of its own. What the browser prints is what the curl page prints,
  * because it is the same declaration rendered twice.
  *
- * **`verified` maps to nothing, deliberately.** The ownership challenge is
- * optional and off by default since W4-09, so the journey does not perform it;
- * a deployment that turns it on gets the step from
- * `endpoints.verify`'s own snippet. Mapping it to a journey step that does not
- * exist would be worse than mapping it to none.
  */
 export const WEBSITE_JOURNEY_STEP_KEYS = {
     delivered: ["await-occurrence", "read-attempt"],
     destination: ["create-destination"],
     scheduled: ["create-one-shot"],
-    verified: [],
 };
 /** The journey steps a website step renders, resolved against the sequence. */
 export function websiteJourneySteps(step) {
@@ -580,7 +578,6 @@ export const JOURNEY_ACTIVATION_OUTCOMES = [
 /** The website steps an activation fact may name. */
 export const WEBSITE_JOURNEY_STEPS = [
     "destination",
-    "verified",
     "scheduled",
     "delivered",
 ];