@greatwait/contracts 0.1.0-alpha.4 → 0.1.0-alpha.6

package/README.md

@@ -1,6 +1,6 @@
 # @greatwait/contracts
 
-The public contracts for [Greatwait](https://greatwait.dev): the schemas every
+The public contracts for [GreatWait](https://greatwait.dev): the schemas every
 response is parsed with, the stable refusal catalog, the operation registry, and
 the generated OpenAPI documents.
 

package/dist/authority.d.ts

@@ -50,8 +50,9 @@ export type Authority = z.infer<typeof authoritySchema>;
  * client is permitted, and what the granting member's current role allows.
  * Nothing here can exceed a human's own access.
  */
-export declare const SCOPES: readonly ["credentials:administer", "billing:write", "credentials:read", "credentials:write", "endpoints:read", "endpoints:write", "forecast:read", "grants:read", "grants:write", "occurrences:read", "occurrences:redeliver", "projects:administer", "projects:read", "projects:write", "schedules:read", "schedules:write", "usage:read"];
+export declare const SCOPES: readonly ["members:manage", "credentials:administer", "billing:write", "credentials:read", "credentials:write", "endpoints:read", "endpoints:write", "forecast:read", "grants:read", "grants:write", "occurrences:read", "occurrences:redeliver", "projects:administer", "projects:read", "projects:write", "schedules:read", "schedules:write", "usage:read"];
 export declare const scopeSchema: import("zod").ZodEnum<{
+    "members:manage": "members:manage";
     "credentials:administer": "credentials:administer";
     "billing:write": "billing:write";
     "credentials:read": "credentials:read";
@@ -114,6 +115,7 @@ export declare const principalSchema: import("zod").ZodObject<{
         project: import("zod").ZodString;
     }, import("zod/v4/core").$strip>;
     scopes: import("zod").ZodArray<import("zod").ZodEnum<{
+        "members:manage": "members:manage";
         "credentials:administer": "credentials:administer";
         "billing:write": "billing:write";
         "credentials:read": "credentials:read";
@@ -258,6 +260,7 @@ export declare const credentialContextSchema: import("zod").ZodObject<{
     }>;
     project: import("zod").ZodString;
     scopes: import("zod").ZodArray<import("zod").ZodEnum<{
+        "members:manage": "members:manage";
         "credentials:administer": "credentials:administer";
         "billing:write": "billing:write";
         "credentials:read": "credentials:read";

package/dist/authority.js

@@ -43,6 +43,7 @@ export const authoritySchema = z.object({
  * Nothing here can exceed a human's own access.
  */
 export const SCOPES = [
+    "members:manage",
     /**
      * Act on a credential somebody else issued.
      *

package/dist/billing.d.ts

@@ -13,6 +13,15 @@ export declare const nonnegativeMicrodollarAmountSchema: import("zod").ZodString
 export declare const BILLING_ACTIVATION_MODES: readonly ["disabled", "shadow", "enforced"];
 export declare const BILLING_BLOCK_REASONS: readonly ["billing-state-missing", "billing-account-closed", "project-ineligible", "insufficient-credit", "execution-cap-reached"];
 export declare const BILLING_ENTRY_KINDS: readonly ["credit_granted", "credit_reversed", "attempt_debited", "attempt_released", "shadow_attempt_debited", "shadow_attempt_released", "late_evidence_waived", "policy_installed", "budget_policy_updated", "budget_threshold_reached", "budget_exhausted", "budget_recovered", "automatic_charge_ceiling_updated", "payment_reserved", "payment_submitted", "payment_pending", "payment_paid", "payment_failed", "payment_canceled", "payment_authentication_required", "payment_action_required", "payment_refunded", "payment_disputed", "payment_reversed", "payment_dispute_restored", "refund_requested", "payment_refund_canceled", "automatic_top_up_cap_reached", "automatic_charge_threshold_reached", "automatic_charge_threshold_recovered", "low_credit_reached", "low_credit_recovered", "notification_settings_updated", "service_blocked", "service_restored"];
+/**
+ * Why a ledger entry that looks like money moved none.
+ *
+ * `provider-details-attached`: the payment provider reported details of a
+ * payment the ledger already recorded — its charge, receipt, hosted page or
+ * tax. The entry repeats the payment's kind and shows a zero amount, so one
+ * purchase never reads as two.
+ */
+export declare const BILLING_LEDGER_ENTRY_NOTES: readonly ["provider-details-attached"];
 export declare const BILLING_PAYMENT_KINDS: readonly ["manual", "automatic"];
 export declare const BILLING_PAYMENT_STATES: readonly ["pending", "paid", "failed", "authentication-required", "action-required", "canceled", "refunded", "reversed", "disputed"];
 declare const nonnegativeExactMoneySchema: import("zod").ZodObject<{
@@ -97,6 +106,7 @@ export declare const billingFundingQuoteSchema: import("zod").ZodObject<{
     taxStatus: import("zod").ZodLiteral<"calculated-at-checkout">;
 }, import("zod/v4/core").$strict>;
 export declare const billingPurchaseRequestSchema: import("zod").ZodObject<{
+    automaticTopUp: import("zod").ZodOptional<import("zod").ZodBoolean>;
     confirmed: import("zod").ZodLiteral<true>;
     expectedRevision: import("zod").ZodNumber;
     quote: import("zod").ZodString;
@@ -475,7 +485,12 @@ export interface BillingNotificationSettings {
 }
 export interface BillingNotificationSettingsUpdateRequest {
     readonly expectedRevision: number;
-    readonly lowCreditThreshold: z.infer<typeof exactCentMoneySchema>;
+    /**
+     * A chosen threshold; `null` to warn at one fifth of the most recent credit
+     * purchase or grant again, which is the default; omitted to leave the
+     * threshold exactly as it is, chosen or not.
+     */
+    readonly lowCreditThreshold?: z.infer<typeof exactCentMoneySchema> | null | undefined;
     readonly noncriticalEmail: boolean;
 }
 export declare const billingNoticeRecoveryPathSchema: import("zod").ZodEnum<{
@@ -838,6 +853,9 @@ export declare const billingLedgerEntrySchema: import("zod").ZodObject<{
         service_blocked: "service_blocked";
         service_restored: "service_restored";
     }>;
+    note: import("zod").ZodOptional<import("zod").ZodEnum<{
+        "provider-details-attached": "provider-details-attached";
+    }>>;
     period: import("zod").ZodOptional<import("zod").ZodString>;
     recordedAt: import("zod").ZodString;
     reference: import("zod").ZodObject<{
@@ -898,6 +916,9 @@ export declare const billingLedgerPageSchema: import("zod").ZodObject<{
             service_blocked: "service_blocked";
             service_restored: "service_restored";
         }>;
+        note: import("zod").ZodOptional<import("zod").ZodEnum<{
+            "provider-details-attached": "provider-details-attached";
+        }>>;
         period: import("zod").ZodOptional<import("zod").ZodString>;
         recordedAt: import("zod").ZodString;
         reference: import("zod").ZodObject<{
@@ -994,8 +1015,217 @@ export declare const projectBillingStateSchema: import("zod").ZodObject<{
 export declare const billingPortalSchema: import("zod").ZodObject<{
     url: import("zod").ZodString;
 }, import("zod/v4/core").$strip>;
+/**
+ * The organization's saved payment method (W9-09, widened by W9-14): the one
+ * method automatic top-ups and project subscriptions charge. It is the Stripe
+ * customer's default payment method, read by authenticated provider call and
+ * never stored by GreatWait beyond the provider's own identifier.
+ *
+ * `method` says what it is. A card keeps its brand and last four digits; Link
+ * carries the email it is registered to when the provider reports one; any
+ * other type the provider's checkout offered (Cash App Pay, Amazon Pay,
+ * Klarna) carries the provider's type name. Every variant carries `label`,
+ * the sentence-ready name the dashboard, command line and MCP all show, so no
+ * client needs its own table of provider types. `method` is null when nothing
+ * is saved.
+ *
+ * `card` is the pre-W9-14 field, kept so a client written against it keeps
+ * working: it is set exactly when `method.type` is `card`, and null otherwise
+ * — including when a non-card method is saved, which such a client reads as
+ * "no card".
+ */
+export declare const billingPaymentMethodSchema: import("zod").ZodObject<{
+    card: import("zod").ZodNullable<import("zod").ZodObject<{
+        brand: import("zod").ZodString;
+        last4: import("zod").ZodString;
+        expMonth: import("zod").ZodNumber;
+        expYear: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strict>>;
+    method: import("zod").ZodNullable<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+        brand: import("zod").ZodString;
+        last4: import("zod").ZodString;
+        expMonth: import("zod").ZodNumber;
+        expYear: import("zod").ZodNumber;
+        type: import("zod").ZodLiteral<"card">;
+        label: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        type: import("zod").ZodLiteral<"link">;
+        label: import("zod").ZodString;
+        email: import("zod").ZodNullable<import("zod").ZodString>;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        type: import("zod").ZodLiteral<"other">;
+        label: import("zod").ZodString;
+        providerType: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>], "type">>;
+}, import("zod/v4/core").$strict>;
+/**
+ * Where hosted card setup returns. Optional: the configured dashboard billing
+ * page is the default, and a supplied address must share its origin, so the
+ * operation cannot be used to send a customer to a page GreatWait does not own.
+ */
+export declare const billingPaymentMethodSetupRequestSchema: import("zod").ZodObject<{
+    returnUrl: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strict>;
+/** The hosted card-setup Checkout session a browser returned from. */
+export declare const billingPaymentMethodConfirmRequestSchema: import("zod").ZodObject<{
+    checkoutSession: import("zod").ZodString;
+}, import("zod/v4/core").$strict>;
+/**
+ * Removing the card on file (W9-09). The literal `true` is the caller's
+ * acknowledgement of what removal does: project subscriptions stop renewing,
+ * paid projects run to the end of the period already paid for and then stop,
+ * and automatic top-up turns off.
+ */
+export declare const billingPaymentMethodRemoveRequestSchema: import("zod").ZodObject<{
+    confirmed: import("zod").ZodLiteral<true>;
+}, import("zod/v4/core").$strict>;
+/**
+ * One project subscription charge (W9-09): a provider invoice for the
+ * organization's project subscription, listed beside execution-credit
+ * payments so a customer who was charged for a project sees the charge and its
+ * receipt. `amount` is the invoice total, tax included. `receiptUrl` is the
+ * provider-hosted invoice page when there is one.
+ */
+export declare const billingInvoiceSchema: import("zod").ZodObject<{
+    id: import("zod").ZodString;
+    createdAt: import("zod").ZodString;
+    amount: import("zod").ZodObject<{
+        currency: import("zod").ZodLiteral<"USD">;
+        microdollars: import("zod").ZodString;
+        scale: import("zod").ZodLiteral<6>;
+    }, import("zod/v4/core").$strip>;
+    state: import("zod").ZodEnum<{
+        void: "void";
+        paid: "paid";
+        open: "open";
+        uncollectible: "uncollectible";
+    }>;
+    receiptUrl: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strict>;
+/** Execution-credit payment history, with a bounded continuation. */
+export declare const billingPaymentHistoryPageSchema: import("zod").ZodObject<{
+    data: import("zod").ZodArray<import("zod").ZodObject<{
+        createdAt: import("zod").ZodString;
+        credit: import("zod").ZodObject<{
+            currency: import("zod").ZodLiteral<"USD">;
+            microdollars: import("zod").ZodString;
+            scale: import("zod").ZodLiteral<6>;
+        }, import("zod/v4/core").$strip>;
+        gross: import("zod").ZodNullable<import("zod").ZodObject<{
+            currency: import("zod").ZodLiteral<"USD">;
+            microdollars: import("zod").ZodString;
+            scale: import("zod").ZodLiteral<6>;
+        }, import("zod/v4/core").$strip>>;
+        id: import("zod").ZodString;
+        kind: import("zod").ZodEnum<{
+            manual: "manual";
+            automatic: "automatic";
+        }>;
+        paymentUrl: import("zod").ZodOptional<import("zod").ZodString>;
+        reason: import("zod").ZodOptional<import("zod").ZodString>;
+        receiptUrl: import("zod").ZodOptional<import("zod").ZodString>;
+        state: import("zod").ZodEnum<{
+            pending: "pending";
+            paid: "paid";
+            failed: "failed";
+            "authentication-required": "authentication-required";
+            "action-required": "action-required";
+            canceled: "canceled";
+            refunded: "refunded";
+            reversed: "reversed";
+            disputed: "disputed";
+        }>;
+        tax: import("zod").ZodNullable<import("zod").ZodObject<{
+            currency: import("zod").ZodLiteral<"USD">;
+            microdollars: import("zod").ZodString;
+            scale: import("zod").ZodLiteral<6>;
+        }, import("zod/v4/core").$strip>>;
+        taxStatus: import("zod").ZodEnum<{
+            confirmed: "confirmed";
+            "calculated-at-checkout": "calculated-at-checkout";
+        }>;
+        updatedAt: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>>;
+    freshness: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+        kind: import("zod").ZodLiteral<"authoritative">;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        asOf: import("zod").ZodString;
+        kind: import("zod").ZodLiteral<"projected">;
+        lagSeconds: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strip>], "kind">;
+    nextCursor: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strict>;
+export type BillingPaymentHistoryPage = z.infer<typeof billingPaymentHistoryPageSchema>;
+/** Project subscription history; an empty filtered page may still have a cursor. */
+export declare const billingInvoiceHistoryPageSchema: import("zod").ZodObject<{
+    data: import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        createdAt: import("zod").ZodString;
+        amount: import("zod").ZodObject<{
+            currency: import("zod").ZodLiteral<"USD">;
+            microdollars: import("zod").ZodString;
+            scale: import("zod").ZodLiteral<6>;
+        }, import("zod/v4/core").$strip>;
+        state: import("zod").ZodEnum<{
+            void: "void";
+            paid: "paid";
+            open: "open";
+            uncollectible: "uncollectible";
+        }>;
+        receiptUrl: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strict>>;
+    freshness: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+        kind: import("zod").ZodLiteral<"authoritative">;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        asOf: import("zod").ZodString;
+        kind: import("zod").ZodLiteral<"projected">;
+        lagSeconds: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strip>], "kind">;
+    nextCursor: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strict>;
+export type BillingInvoiceHistoryPage = z.infer<typeof billingInvoiceHistoryPageSchema>;
+/** Project subscription charges, most recent first, at most 24. */
+export declare const billingInvoiceListSchema: import("zod").ZodObject<{
+    data: import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        createdAt: import("zod").ZodString;
+        amount: import("zod").ZodObject<{
+            currency: import("zod").ZodLiteral<"USD">;
+            microdollars: import("zod").ZodString;
+            scale: import("zod").ZodLiteral<6>;
+        }, import("zod/v4/core").$strip>;
+        state: import("zod").ZodEnum<{
+            void: "void";
+            paid: "paid";
+            open: "open";
+            uncollectible: "uncollectible";
+        }>;
+        receiptUrl: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strict>>;
+}, import("zod/v4/core").$strict>;
+/**
+ * The stable title of the refusal a card-dependent change receives when the
+ * organization has no card on file (W9-09): enabling or resuming automatic
+ * top-up, and quoting or confirming a paid project addition.
+ *
+ * **Why a title and not a new problem code.** The published CLI and SDK parse
+ * error bodies with this package's `problemSchema`, whose `code` is a closed
+ * enum, so a code an installed client does not know turns a precise refusal into
+ * "failed with status 409" with no problem at all. The refusal is therefore
+ * `state_conflict` — which is what it is: the request is well formed and would
+ * succeed once a card is saved — and this exact title is the discriminator.
+ * Detect it as `code === "state_conflict" && title ===
+ * BILLING_PAYMENT_METHOD_REQUIRED_TITLE`.
+ */
+export declare const BILLING_PAYMENT_METHOD_REQUIRED_TITLE: "A card on file is required";
 export type ProjectBillingQuoteRequest = z.infer<typeof projectBillingQuoteRequestSchema>;
 export type ProjectBillingQuote = z.infer<typeof projectBillingQuoteSchema>;
 export type ProjectBillingChangeRequest = z.infer<typeof projectBillingChangeRequestSchema>;
 export type ProjectBillingState = z.infer<typeof projectBillingStateSchema>;
+export type BillingPaymentMethod = z.infer<typeof billingPaymentMethodSchema>;
+export type BillingInvoice = z.infer<typeof billingInvoiceSchema>;
+export type BillingInvoiceList = z.infer<typeof billingInvoiceListSchema>;
+export type BillingPaymentMethodSetupRequest = z.infer<typeof billingPaymentMethodSetupRequestSchema>;
+export type BillingPaymentMethodConfirmRequest = z.infer<typeof billingPaymentMethodConfirmRequestSchema>;
+export type BillingPaymentMethodRemoveRequest = z.infer<typeof billingPaymentMethodRemoveRequestSchema>;
 export {};

package/dist/billing.js

@@ -65,6 +65,17 @@ export const BILLING_ENTRY_KINDS = [
     "service_blocked",
     "service_restored",
 ];
+/**
+ * Why a ledger entry that looks like money moved none.
+ *
+ * `provider-details-attached`: the payment provider reported details of a
+ * payment the ledger already recorded — its charge, receipt, hosted page or
+ * tax. The entry repeats the payment's kind and shows a zero amount, so one
+ * purchase never reads as two.
+ */
+export const BILLING_LEDGER_ENTRY_NOTES = [
+    "provider-details-attached",
+];
 export const BILLING_PAYMENT_KINDS = ["manual", "automatic"];
 export const BILLING_PAYMENT_STATES = [
     "pending",
@@ -188,6 +199,12 @@ export const billingFundingQuoteSchema = z
     .strict();
 export const billingPurchaseRequestSchema = z
     .object({
+    automaticTopUp: z
+        .boolean()
+        .meta({
+        description: "true: the customer also asks to top up automatically when credit runs low. The hosted payment then saves the payment method for later off-session charges (it offers every method the account enables except Klarna, which cannot be charged that way), and once the provider confirms this payment paid, automatic top-up is enabled with the default rule (add USD 10.00 when available credit falls below USD 2.00, at most USD 50.00 of automatic charges a month) using that payment method. A rule that is already ready is left unchanged; an enabled rule waiting for a payment method keeps its own amounts and gains this one. Omitted or false: the purchase does exactly what it always did. An unpaid, expired or cancelled payment enables nothing.",
+    })
+        .optional(),
     confirmed: z.literal(true),
     expectedRevision: z.number().int().nonnegative(),
     quote: z.string().min(1).max(128),
@@ -476,7 +493,7 @@ export const billingNotificationSettingsSchema = z
 export const billingNotificationSettingsUpdateRequestSchema = z
     .object({
     expectedRevision: z.number().int().nonnegative(),
-    lowCreditThreshold: positiveExactCentMoneySchema,
+    lowCreditThreshold: positiveExactCentMoneySchema.nullable().optional(),
     noncriticalEmail: z.boolean(),
 })
     .strict();
@@ -615,6 +632,12 @@ export const billingLedgerEntrySchema = z.object({
         scale: z.literal(BILLING_AMOUNT_SCALE),
     }),
     kind: z.enum(BILLING_ENTRY_KINDS),
+    note: z
+        .enum(BILLING_LEDGER_ENTRY_NOTES)
+        .meta({
+        description: "Present when an entry moved no money despite its kind. provider-details-attached: the provider reported details of a payment already recorded; the amount is zero.",
+    })
+        .optional(),
     period: timestampSchema.optional(),
     recordedAt: timestampSchema,
     reference: z.object({
@@ -682,3 +705,129 @@ export const projectBillingStateSchema = z.object({
     })),
 });
 export const billingPortalSchema = z.object({ url: z.string().url() });
+const savedCardSchema = z
+    .object({
+    brand: z.string().min(1).max(32),
+    last4: z.string().regex(/^\d{4}$/u),
+    expMonth: z.number().int().min(1).max(12),
+    expYear: z.number().int().min(2000).max(2200),
+})
+    .strict();
+/** How a saved payment method is named to a person, on every surface alike. */
+const paymentMethodLabelSchema = z.string().min(1).max(200);
+/**
+ * The organization's saved payment method (W9-09, widened by W9-14): the one
+ * method automatic top-ups and project subscriptions charge. It is the Stripe
+ * customer's default payment method, read by authenticated provider call and
+ * never stored by GreatWait beyond the provider's own identifier.
+ *
+ * `method` says what it is. A card keeps its brand and last four digits; Link
+ * carries the email it is registered to when the provider reports one; any
+ * other type the provider's checkout offered (Cash App Pay, Amazon Pay,
+ * Klarna) carries the provider's type name. Every variant carries `label`,
+ * the sentence-ready name the dashboard, command line and MCP all show, so no
+ * client needs its own table of provider types. `method` is null when nothing
+ * is saved.
+ *
+ * `card` is the pre-W9-14 field, kept so a client written against it keeps
+ * working: it is set exactly when `method.type` is `card`, and null otherwise
+ * — including when a non-card method is saved, which such a client reads as
+ * "no card".
+ */
+export const billingPaymentMethodSchema = z
+    .object({
+    card: savedCardSchema.nullable(),
+    method: z
+        .discriminatedUnion("type", [
+        savedCardSchema
+            .extend({
+            type: z.literal("card"),
+            label: paymentMethodLabelSchema,
+        })
+            .strict(),
+        z
+            .object({
+            type: z.literal("link"),
+            label: paymentMethodLabelSchema,
+            email: z.string().min(3).max(320).nullable(),
+        })
+            .strict(),
+        z
+            .object({
+            type: z.literal("other"),
+            label: paymentMethodLabelSchema,
+            providerType: z.string().regex(/^[a-z][a-z0-9_]{0,63}$/u),
+        })
+            .strict(),
+    ])
+        .nullable(),
+})
+    .strict();
+/**
+ * Where hosted card setup returns. Optional: the configured dashboard billing
+ * page is the default, and a supplied address must share its origin, so the
+ * operation cannot be used to send a customer to a page GreatWait does not own.
+ */
+export const billingPaymentMethodSetupRequestSchema = z
+    .object({
+    returnUrl: z.string().url().max(2048).optional(),
+})
+    .strict();
+/** The hosted card-setup Checkout session a browser returned from. */
+export const billingPaymentMethodConfirmRequestSchema = z
+    .object({
+    checkoutSession: z
+        .string()
+        .min(4)
+        .max(255)
+        .regex(/^cs_[A-Za-z0-9_]+$/u),
+})
+    .strict();
+/**
+ * Removing the card on file (W9-09). The literal `true` is the caller's
+ * acknowledgement of what removal does: project subscriptions stop renewing,
+ * paid projects run to the end of the period already paid for and then stop,
+ * and automatic top-up turns off.
+ */
+export const billingPaymentMethodRemoveRequestSchema = z
+    .object({ confirmed: z.literal(true) })
+    .strict();
+/**
+ * One project subscription charge (W9-09): a provider invoice for the
+ * organization's project subscription, listed beside execution-credit
+ * payments so a customer who was charged for a project sees the charge and its
+ * receipt. `amount` is the invoice total, tax included. `receiptUrl` is the
+ * provider-hosted invoice page when there is one.
+ */
+export const billingInvoiceSchema = z
+    .object({
+    id: z.string().min(1).max(255),
+    createdAt: timestampSchema,
+    amount: nonnegativeExactMoneySchema,
+    state: z.enum(["paid", "open", "void", "uncollectible"]),
+    receiptUrl: z.string().url().optional(),
+})
+    .strict();
+/** Execution-credit payment history, with a bounded continuation. */
+export const billingPaymentHistoryPageSchema = pageSchema(billingPaymentOperationSchema).strict();
+/** Project subscription history; an empty filtered page may still have a cursor. */
+export const billingInvoiceHistoryPageSchema = pageSchema(billingInvoiceSchema).strict();
+/** Project subscription charges, most recent first, at most 24. */
+export const billingInvoiceListSchema = z
+    .object({ data: z.array(billingInvoiceSchema) })
+    .strict();
+/**
+ * The stable title of the refusal a card-dependent change receives when the
+ * organization has no card on file (W9-09): enabling or resuming automatic
+ * top-up, and quoting or confirming a paid project addition.
+ *
+ * **Why a title and not a new problem code.** The published CLI and SDK parse
+ * error bodies with this package's `problemSchema`, whose `code` is a closed
+ * enum, so a code an installed client does not know turns a precise refusal into
+ * "failed with status 409" with no problem at all. The refusal is therefore
+ * `state_conflict` — which is what it is: the request is well formed and would
+ * succeed once a card is saved — and this exact title is the discriminator.
+ * Detect it as `code === "state_conflict" && title ===
+ * BILLING_PAYMENT_METHOD_REQUIRED_TITLE`.
+ */
+export const BILLING_PAYMENT_METHOD_REQUIRED_TITLE = "A card on file is required";

package/dist/callback-safety.js

@@ -136,10 +136,20 @@ const FORBIDDEN_NAME_SUFFIXES = [
  * surface this rule exists to deny. The old form stays because the old names
  * keep resolving until their custom domains are detached, and because a DNS
  * record somebody forgets is precisely what this should still refuse.
+ *
+ * **`docs` joined the vocabulary at FXO-2441**, with `docs.greatwait.dev`. It
+ * is a static site with no Worker script behind it, which is an argument for
+ * why aiming a callback there is harmless *today* and no argument at all for
+ * allowing it: the rule is about names this product answers on as itself, and
+ * `scripts/deployables.test.ts` asserts it over the deployment model rather
+ * than over this list, so a hostname added there and not here fails. *
+ * **The apex joined it at W9-05**, when the marketing site started serving
+ * `greatwait.dev` itself rather than only forwarding it. It is an address this
+ * product answers on as itself, so it is refused on the same argument.
  */
-const GREATWAIT_RUNTIME_NAME = /^(?:greatwait-(?:api|app|scheduler|contract-mock|postgres-runtime)(?:-[a-z0-9-]+)?\.flowxo\.com|(?:api|app|scheduler|contract-mock|postgres-runtime)(?:-[a-z0-9-]+)?\.greatwait\.dev)$/u;
-const GREATWAIT_PROVIDER_NAME = /^greatwait-(?:api|app|scheduler|contract-mock|postgres-runtime)(?:-[a-z0-9-]+)?(?:\..+)?\.(?:workers|pages)\.dev$/u;
-const GREATWAIT_WORKER_NAME = /^greatwait-(?:api|app|scheduler|contract-mock|postgres-runtime)(?:-[a-z0-9-]+)?$/u;
+const GREATWAIT_RUNTIME_NAME = /^(?:greatwait-(?:api|app|docs|scheduler|contract-mock|postgres-runtime)(?:-[a-z0-9-]+)?\.flowxo\.com|(?:api|app|docs|scheduler|contract-mock|postgres-runtime)(?:-[a-z0-9-]+)?\.greatwait\.dev|greatwait\.dev)$/u;
+const GREATWAIT_PROVIDER_NAME = /^greatwait-(?:api|app|docs|marketing|scheduler|contract-mock|postgres-runtime)(?:-[a-z0-9-]+)?(?:\..+)?\.(?:workers|pages)\.dev$/u;
+const GREATWAIT_WORKER_NAME = /^greatwait-(?:api|app|docs|marketing|scheduler|contract-mock|postgres-runtime)(?:-[a-z0-9-]+)?$/u;
 /** Evaluate the URL-only half of the callback destination policy. */
 export function evaluateCallbackUrl(value) {
     if (value.trim() !== value) {

package/dist/configuration-bounds.d.ts

@@ -0,0 +1,13 @@
+/** Scalar owners shared by contracts and small runtime bundles. */
+export declare const FIXED_INTERVAL_MIN_SECONDS = 60;
+export declare const FIXED_INTERVAL_MAX_SECONDS: number;
+export declare const MAX_INLINE_PAYLOAD_BYTES = 65536;
+export declare const MAX_FORECAST_HORIZON_SECONDS: number;
+export declare const MAX_HOST_CONNECTIONS = 100000;
+export declare const MAX_USAGE_WINDOW_DAYS = 366;
+export declare const MAX_PARTITION_KEY_CEILING = 10000;
+export declare const PUBLIC_PAGE_SIZE: Readonly<{
+    default: 25;
+    max: 100;
+    min: 1;
+}>;

package/dist/configuration-bounds.js

@@ -0,0 +1,13 @@
+/** Scalar owners shared by contracts and small runtime bundles. */
+export const FIXED_INTERVAL_MIN_SECONDS = 60;
+export const FIXED_INTERVAL_MAX_SECONDS = 365 * 24 * 60 * 60;
+export const MAX_INLINE_PAYLOAD_BYTES = 65_536;
+export const MAX_FORECAST_HORIZON_SECONDS = 25 * 60 * 60;
+export const MAX_HOST_CONNECTIONS = 100_000;
+export const MAX_USAGE_WINDOW_DAYS = 366;
+export const MAX_PARTITION_KEY_CEILING = 10_000;
+export const PUBLIC_PAGE_SIZE = Object.freeze({
+    default: 25,
+    max: 100,
+    min: 1,
+});

package/dist/data-export.d.ts

@@ -58,6 +58,8 @@ export type DataExportPart = z.infer<typeof dataExportPartSchema>;
 /** Additive operation declarations, merged into the canonical registry by the API wiring. */
 export declare const DATA_EXPORT_OPERATIONS: readonly [import("./operations.js").OperationDefinition & {
     readonly id: "exports.create";
+} & {
+    readonly request: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
 }, import("./operations.js").OperationDefinition & {
     readonly id: "exports.read";
 }, import("./operations.js").OperationDefinition & {

package/dist/delivery.d.ts

@@ -21,6 +21,31 @@ export interface EncryptedSchedulePayload {
     readonly keyId: string;
     readonly nonce: string;
 }
+/** Encrypted custom HTTP settings, internal only; never a public read shape. */
+export type StoredHttpHeader = {
+    readonly name: string;
+    readonly secret: false;
+    readonly value: string;
+    readonly valueBytes: number;
+} | {
+    readonly name: string;
+    readonly secret: true;
+    readonly envelope: EncryptedSchedulePayload;
+    readonly valueBytes: number;
+    readonly ownerKind: "endpoint" | "schedule";
+    readonly ownerId: string;
+} | {
+    readonly name: string;
+    readonly suppressed: true;
+};
+export interface StoredHttpRequest {
+    readonly method: "POST" | "PUT" | "GET";
+    readonly bodyMode: "envelope" | "json" | "none";
+    readonly headers: readonly StoredHttpHeader[];
+    readonly encryptedTemplate?: EncryptedSchedulePayload;
+}
+export declare const HTTP_HEADER_AAD_VERSION: "greatwait.http-header.v1";
+export declare const HTTP_TEMPLATE_AAD_VERSION: "greatwait.http-template.v1";
 /**
  * One immutable delivery attempt, minted by the Scheduler Partition from its
  * verified authority. No member of this tuple comes from callback request
@@ -46,6 +71,7 @@ export interface CallbackAttemptDispatch {
     /** Monotonic partition fence for duplicate/late dispatch and report RPCs. */
     readonly dispatchEpoch: number;
     readonly encryptedPayloadEnvelope: EncryptedSchedulePayload;
+    readonly http?: StoredHttpRequest;
     readonly endpointId: EndpointId;
     readonly latencyClass: "realtime" | "bulk";
     /**

package/dist/delivery.js

@@ -7,6 +7,8 @@
  * decryption oracle.
  */
 export const SCHEDULE_PAYLOAD_AAD_VERSION = "greatwait.schedule-payload.v1";
+export const HTTP_HEADER_AAD_VERSION = "greatwait.http-header.v1";
+export const HTTP_TEMPLATE_AAD_VERSION = "greatwait.http-template.v1";
 /**
  * What a receiver says about work it acknowledged and then finished.
  *

package/dist/effective-limits.d.ts

@@ -0,0 +1,40 @@
+import { z } from "./zod.js";
+export declare const effectiveCustomerLimitsSchema: import("zod").ZodObject<{
+    limits: import("zod").ZodObject<{
+        inlinePayloadBytes: import("zod").ZodNumber;
+        partitionKeyCeiling: import("zod").ZodOptional<import("zod").ZodNumber>;
+        forecastHorizonSeconds: import("zod").ZodNumber;
+        usageWindowDays: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strict>;
+    provenance: import("zod").ZodObject<{
+        inlinePayloadBytes: import("zod").ZodEnum<{
+            organization: "organization";
+            default: "default";
+            global: "global";
+            deployment: "deployment";
+        }>;
+        partitionKeyCeiling: import("zod").ZodOptional<import("zod").ZodEnum<{
+            organization: "organization";
+            default: "default";
+            global: "global";
+            deployment: "deployment";
+        }>>;
+        forecastHorizonSeconds: import("zod").ZodEnum<{
+            organization: "organization";
+            default: "default";
+            global: "global";
+            deployment: "deployment";
+        }>;
+        usageWindowDays: import("zod").ZodEnum<{
+            organization: "organization";
+            default: "default";
+            global: "global";
+            deployment: "deployment";
+        }>;
+    }, import("zod/v4/core").$strict>;
+    revision: import("zod").ZodObject<{
+        global: import("zod").ZodNumber;
+        organization: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strict>;
+}, import("zod/v4/core").$strict>;
+export type EffectiveCustomerLimits = z.infer<typeof effectiveCustomerLimitsSchema>;