@greatwait/contracts 0.1.0-alpha.5 → 0.1.0-alpha.6

package/dist/authority.d.ts

@@ -50,8 +50,9 @@ export type Authority = z.infer<typeof authoritySchema>;
  * client is permitted, and what the granting member's current role allows.
  * Nothing here can exceed a human's own access.
  */
-export declare const SCOPES: readonly ["credentials:administer", "billing:write", "credentials:read", "credentials:write", "endpoints:read", "endpoints:write", "forecast:read", "grants:read", "grants:write", "occurrences:read", "occurrences:redeliver", "projects:administer", "projects:read", "projects:write", "schedules:read", "schedules:write", "usage:read"];
+export declare const SCOPES: readonly ["members:manage", "credentials:administer", "billing:write", "credentials:read", "credentials:write", "endpoints:read", "endpoints:write", "forecast:read", "grants:read", "grants:write", "occurrences:read", "occurrences:redeliver", "projects:administer", "projects:read", "projects:write", "schedules:read", "schedules:write", "usage:read"];
 export declare const scopeSchema: import("zod").ZodEnum<{
+    "members:manage": "members:manage";
     "credentials:administer": "credentials:administer";
     "billing:write": "billing:write";
     "credentials:read": "credentials:read";
@@ -114,6 +115,7 @@ export declare const principalSchema: import("zod").ZodObject<{
         project: import("zod").ZodString;
     }, import("zod/v4/core").$strip>;
     scopes: import("zod").ZodArray<import("zod").ZodEnum<{
+        "members:manage": "members:manage";
         "credentials:administer": "credentials:administer";
         "billing:write": "billing:write";
         "credentials:read": "credentials:read";
@@ -258,6 +260,7 @@ export declare const credentialContextSchema: import("zod").ZodObject<{
     }>;
     project: import("zod").ZodString;
     scopes: import("zod").ZodArray<import("zod").ZodEnum<{
+        "members:manage": "members:manage";
         "credentials:administer": "credentials:administer";
         "billing:write": "billing:write";
         "credentials:read": "credentials:read";

package/dist/authority.js

@@ -43,6 +43,7 @@ export const authoritySchema = z.object({
  * Nothing here can exceed a human's own access.
  */
 export const SCOPES = [
+    "members:manage",
     /**
      * Act on a credential somebody else issued.
      *

package/dist/data-export.d.ts

@@ -58,6 +58,8 @@ export type DataExportPart = z.infer<typeof dataExportPartSchema>;
 /** Additive operation declarations, merged into the canonical registry by the API wiring. */
 export declare const DATA_EXPORT_OPERATIONS: readonly [import("./operations.js").OperationDefinition & {
     readonly id: "exports.create";
+} & {
+    readonly request: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
 }, import("./operations.js").OperationDefinition & {
     readonly id: "exports.read";
 }, import("./operations.js").OperationDefinition & {

package/dist/delivery.d.ts

@@ -21,6 +21,31 @@ export interface EncryptedSchedulePayload {
     readonly keyId: string;
     readonly nonce: string;
 }
+/** Encrypted custom HTTP settings, internal only; never a public read shape. */
+export type StoredHttpHeader = {
+    readonly name: string;
+    readonly secret: false;
+    readonly value: string;
+    readonly valueBytes: number;
+} | {
+    readonly name: string;
+    readonly secret: true;
+    readonly envelope: EncryptedSchedulePayload;
+    readonly valueBytes: number;
+    readonly ownerKind: "endpoint" | "schedule";
+    readonly ownerId: string;
+} | {
+    readonly name: string;
+    readonly suppressed: true;
+};
+export interface StoredHttpRequest {
+    readonly method: "POST" | "PUT" | "GET";
+    readonly bodyMode: "envelope" | "json" | "none";
+    readonly headers: readonly StoredHttpHeader[];
+    readonly encryptedTemplate?: EncryptedSchedulePayload;
+}
+export declare const HTTP_HEADER_AAD_VERSION: "greatwait.http-header.v1";
+export declare const HTTP_TEMPLATE_AAD_VERSION: "greatwait.http-template.v1";
 /**
  * One immutable delivery attempt, minted by the Scheduler Partition from its
  * verified authority. No member of this tuple comes from callback request
@@ -46,6 +71,7 @@ export interface CallbackAttemptDispatch {
     /** Monotonic partition fence for duplicate/late dispatch and report RPCs. */
     readonly dispatchEpoch: number;
     readonly encryptedPayloadEnvelope: EncryptedSchedulePayload;
+    readonly http?: StoredHttpRequest;
     readonly endpointId: EndpointId;
     readonly latencyClass: "realtime" | "bulk";
     /**

package/dist/delivery.js

@@ -7,6 +7,8 @@
  * decryption oracle.
  */
 export const SCHEDULE_PAYLOAD_AAD_VERSION = "greatwait.schedule-payload.v1";
+export const HTTP_HEADER_AAD_VERSION = "greatwait.http-header.v1";
+export const HTTP_TEMPLATE_AAD_VERSION = "greatwait.http-template.v1";
 /**
  * What a receiver says about work it acknowledged and then finished.
  *

package/dist/endpoints.d.ts

@@ -83,6 +83,19 @@ export declare const callbackEndpointNameSchema: import("zod").ZodString;
  * field, so list/get/update/disable/enable cannot accidentally recover it.
  */
 export declare const callbackEndpointSchema: import("zod").ZodObject<{
+    headers: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        secret: import("zod").ZodLiteral<false>;
+        value: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        secret: import("zod").ZodLiteral<true>;
+        configured: import("zod").ZodLiteral<true>;
+        value: import("zod").ZodOptional<import("zod").ZodNever>;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        suppressed: import("zod").ZodLiteral<true>;
+    }, import("zod/v4/core").$strict>]>>>;
     createdAt: import("zod").ZodString;
     disabledAt: import("zod").ZodOptional<import("zod").ZodString>;
     environmentKind: import("zod").ZodEnum<{
@@ -111,6 +124,19 @@ export declare const callbackEndpointSchema: import("zod").ZodObject<{
 export type CallbackEndpoint = z.infer<typeof callbackEndpointSchema>;
 export declare const callbackEndpointPageSchema: import("zod").ZodObject<{
     data: import("zod").ZodArray<import("zod").ZodObject<{
+        headers: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
+            name: import("zod").ZodString;
+            secret: import("zod").ZodLiteral<false>;
+            value: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+            name: import("zod").ZodString;
+            secret: import("zod").ZodLiteral<true>;
+            configured: import("zod").ZodLiteral<true>;
+            value: import("zod").ZodOptional<import("zod").ZodNever>;
+        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+            name: import("zod").ZodString;
+            suppressed: import("zod").ZodLiteral<true>;
+        }, import("zod/v4/core").$strict>]>>>;
         createdAt: import("zod").ZodString;
         disabledAt: import("zod").ZodOptional<import("zod").ZodString>;
         environmentKind: import("zod").ZodEnum<{
@@ -148,6 +174,19 @@ export declare const callbackEndpointPageSchema: import("zod").ZodObject<{
 export type CallbackEndpointPage = z.infer<typeof callbackEndpointPageSchema>;
 /** The one response that carries the per-endpoint secret. */
 export declare const callbackEndpointCreatedSchema: import("zod").ZodObject<{
+    headers: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        secret: import("zod").ZodLiteral<false>;
+        value: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        secret: import("zod").ZodLiteral<true>;
+        configured: import("zod").ZodLiteral<true>;
+        value: import("zod").ZodOptional<import("zod").ZodNever>;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        suppressed: import("zod").ZodLiteral<true>;
+    }, import("zod/v4/core").$strict>]>>>;
     createdAt: import("zod").ZodString;
     disabledAt: import("zod").ZodOptional<import("zod").ZodString>;
     environmentKind: import("zod").ZodEnum<{
@@ -183,6 +222,19 @@ export declare const callbackSigningKeyRotationRequestSchema: import("zod").ZodO
 export type CallbackSigningKeyRotationRequest = z.infer<typeof callbackSigningKeyRotationRequestSchema>;
 export declare const callbackEndpointRotatedSchema: import("zod").ZodObject<{
     endpoint: import("zod").ZodObject<{
+        headers: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
+            name: import("zod").ZodString;
+            secret: import("zod").ZodLiteral<false>;
+            value: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+            name: import("zod").ZodString;
+            secret: import("zod").ZodLiteral<true>;
+            configured: import("zod").ZodLiteral<true>;
+            value: import("zod").ZodOptional<import("zod").ZodNever>;
+        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+            name: import("zod").ZodString;
+            suppressed: import("zod").ZodLiteral<true>;
+        }, import("zod/v4/core").$strict>]>>>;
         createdAt: import("zod").ZodString;
         disabledAt: import("zod").ZodOptional<import("zod").ZodString>;
         environmentKind: import("zod").ZodEnum<{
@@ -239,7 +291,123 @@ export declare const callbackEndpointSigningSecretsSchema: import("zod").ZodObje
     }, import("zod/v4/core").$strip>>;
 }, import("zod/v4/core").$strip>;
 export type CallbackEndpointSigningSecrets = z.infer<typeof callbackEndpointSigningSecretsSchema>;
+/**
+ * Where an endpoint's signing secret is, for a result that does not carry it
+ * (W9-44, FXO-2907).
+ *
+ * `endpoints.ensure`, and a schedule write that names a `url` instead of an
+ * endpoint, may bring an endpoint into existence without handing its secret
+ * to the caller. An agent working over MCP is the reason: anything a tool
+ * returns lands in ordinary tool history, so the secret is never in the
+ * result. What is in it is where a person finds the secret — the endpoint's
+ * own page, where a signed-in member reveals it — so the agent can pass that
+ * on rather than leave the person to discover that deliveries are signed.
+ *
+ * `returned` is the literal `false` rather than an absent field because a
+ * reader deciding whether it holds a secret should be told so, not left to
+ * infer it from what is missing.
+ */
+export declare const signingSecretNoticeSchema: import("zod").ZodObject<{
+    guidance: import("zod").ZodString;
+    returned: import("zod").ZodLiteral<false>;
+    revealUrl: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
+export type SigningSecretNotice = z.infer<typeof signingSecretNoticeSchema>;
+/**
+ * The dashboard path of one endpoint's page, beneath the project and
+ * environment it belongs to. The dashboard's router serves it; a test there
+ * holds the two to the same shape.
+ */
+export declare function endpointDashboardPath(target: {
+    readonly endpoint: string;
+    readonly environmentKind: string;
+    /**
+     * The organization **as the dashboard addresses it**: the sign-in
+     * provider's organization, not GreatWait's `org_…` identifier.
+     */
+    readonly organization: string;
+    readonly project: string;
+}): string;
+/**
+ * The notice a secretless endpoint result carries. `dashboardOrigin` is the
+ * deployment's dashboard; without one the notice still says where to look.
+ */
+export declare function signingSecretNotice(target: Parameters<typeof endpointDashboardPath>[0], dashboardOrigin: string | undefined): SigningSecretNotice;
+/**
+ * What `endpoints.ensure` answers: the endpoint at the requested address,
+ * whether this call created it, and where its signing secret is.
+ *
+ * Metadata only, like every endpoint read. There is no `secret` field to fill
+ * by mistake; the shape is what keeps it out of an agent's history.
+ */
+export declare const callbackEndpointEnsuredSchema: import("zod").ZodObject<{
+    headers: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        secret: import("zod").ZodLiteral<false>;
+        value: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        secret: import("zod").ZodLiteral<true>;
+        configured: import("zod").ZodLiteral<true>;
+        value: import("zod").ZodOptional<import("zod").ZodNever>;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        suppressed: import("zod").ZodLiteral<true>;
+    }, import("zod/v4/core").$strict>]>>>;
+    createdAt: import("zod").ZodString;
+    disabledAt: import("zod").ZodOptional<import("zod").ZodString>;
+    environmentKind: import("zod").ZodEnum<{
+        test: "test";
+        live: "live";
+    }>;
+    id: import("zod").ZodString;
+    name: import("zod").ZodOptional<import("zod").ZodString>;
+    project: import("zod").ZodString;
+    signingKeys: import("zod").ZodObject<{
+        current: import("zod").ZodString;
+        next: import("zod").ZodOptional<import("zod").ZodObject<{
+            acknowledgedAt: import("zod").ZodOptional<import("zod").ZodString>;
+            id: import("zod").ZodString;
+            overlapEndsAt: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>>;
+    }, import("zod/v4/core").$strip>;
+    status: import("zod").ZodEnum<{
+        disabled: "disabled";
+        active: "active";
+    }>;
+    updatedAt: import("zod").ZodString;
+    url: import("zod").ZodString;
+    version: import("zod").ZodNumber;
+    created: import("zod").ZodBoolean;
+    signingSecret: import("zod").ZodObject<{
+        guidance: import("zod").ZodString;
+        returned: import("zod").ZodLiteral<false>;
+        revealUrl: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>;
+export type CallbackEndpointEnsured = z.infer<typeof callbackEndpointEnsuredSchema>;
+/**
+ * A callback destination as a caller types it: HTTPS on port 443, no
+ * credentials or fragment, a public name or address. The DNS half of the
+ * policy runs when an endpoint is created at it.
+ */
+export declare function callbackUrlSchema(): import("zod").ZodString;
 export declare const callbackEndpointRequestSchema: import("zod").ZodObject<{
+    headers: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+        action: import("zod").ZodLiteral<"set">;
+        name: import("zod").ZodString;
+        value: import("zod").ZodString;
+        secret: import("zod").ZodOptional<import("zod").ZodBoolean>;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        action: import("zod").ZodLiteral<"keep">;
+        name: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        action: import("zod").ZodLiteral<"remove">;
+        name: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        action: import("zod").ZodLiteral<"suppress">;
+        name: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>], "action">>>;
     name: import("zod").ZodOptional<import("zod").ZodString>;
     url: import("zod").ZodString;
 }, import("zod/v4/core").$strip>;

package/dist/endpoints.js

@@ -1,3 +1,4 @@
+import { endpointHeaderChangesSchema, publicHttpHeaderSchema, } from "./http-request.js";
 import { z } from "./zod.js";
 import { environmentKindSchema } from "./authority.js";
 import { evaluateCallbackUrl } from "./callback-safety.js";
@@ -89,6 +90,7 @@ export const callbackEndpointNameSchema = z
  * field, so list/get/update/disable/enable cannot accidentally recover it.
  */
 export const callbackEndpointSchema = z.object({
+    headers: z.array(publicHttpHeaderSchema).optional(),
     createdAt: timestampSchema,
     disabledAt: timestampSchema.optional(),
     environmentKind: environmentKindSchema,
@@ -148,7 +150,75 @@ export const callbackEndpointSigningSecretsSchema = z.object({
         .extend({ overlapEndsAt: timestampSchema })
         .optional(),
 });
-function callbackUrlSchema() {
+/**
+ * Where an endpoint's signing secret is, for a result that does not carry it
+ * (W9-44, FXO-2907).
+ *
+ * `endpoints.ensure`, and a schedule write that names a `url` instead of an
+ * endpoint, may bring an endpoint into existence without handing its secret
+ * to the caller. An agent working over MCP is the reason: anything a tool
+ * returns lands in ordinary tool history, so the secret is never in the
+ * result. What is in it is where a person finds the secret — the endpoint's
+ * own page, where a signed-in member reveals it — so the agent can pass that
+ * on rather than leave the person to discover that deliveries are signed.
+ *
+ * `returned` is the literal `false` rather than an absent field because a
+ * reader deciding whether it holds a secret should be told so, not left to
+ * infer it from what is missing.
+ */
+export const signingSecretNoticeSchema = z.object({
+    /** One sentence an agent can relay to the person it is working for. */
+    guidance: z.string().min(1),
+    /** Never `true`: these results do not carry the secret. */
+    returned: z.literal(false),
+    /**
+     * The endpoint's page in the GreatWait dashboard, where a signed-in member
+     * reveals the secret. Absent only where this deployment has no dashboard.
+     */
+    revealUrl: z.string().url().optional(),
+});
+/**
+ * The dashboard path of one endpoint's page, beneath the project and
+ * environment it belongs to. The dashboard's router serves it; a test there
+ * holds the two to the same shape.
+ */
+export function endpointDashboardPath(target) {
+    return `/o/${encodeURIComponent(target.organization)}/p/${encodeURIComponent(target.project)}/${encodeURIComponent(target.environmentKind)}/settings/endpoints/${encodeURIComponent(target.endpoint)}`;
+}
+/**
+ * The notice a secretless endpoint result carries. `dashboardOrigin` is the
+ * deployment's dashboard; without one the notice still says where to look.
+ */
+export function signingSecretNotice(target, dashboardOrigin) {
+    return {
+        guidance: "GreatWait signs every callback to this endpoint. The signing secret is never returned here; a signed-in member of the project reveals it on the endpoint's page in the GreatWait dashboard, and your receiver uses it to verify that a callback came from GreatWait.",
+        returned: false,
+        ...(dashboardOrigin === undefined
+            ? {}
+            : {
+                revealUrl: new URL(endpointDashboardPath(target), dashboardOrigin)
+                    .href,
+            }),
+    };
+}
+/**
+ * What `endpoints.ensure` answers: the endpoint at the requested address,
+ * whether this call created it, and where its signing secret is.
+ *
+ * Metadata only, like every endpoint read. There is no `secret` field to fill
+ * by mistake; the shape is what keeps it out of an agent's history.
+ */
+export const callbackEndpointEnsuredSchema = callbackEndpointSchema.extend({
+    /** Whether this call created the endpoint, or found one already there. */
+    created: z.boolean(),
+    signingSecret: signingSecretNoticeSchema,
+});
+/**
+ * A callback destination as a caller types it: HTTPS on port 443, no
+ * credentials or fragment, a public name or address. The DNS half of the
+ * policy runs when an endpoint is created at it.
+ */
+export function callbackUrlSchema() {
     return z
         .string()
         .url()
@@ -164,6 +234,7 @@ function callbackUrlSchema() {
     });
 }
 export const callbackEndpointRequestSchema = z.object({
+    headers: endpointHeaderChangesSchema.optional(),
     /**
      * A name for people (W4-14, FXO-2255). Omitted on a create, the endpoint
      * takes its whole URL as its name; omitted on an update, the stored name

package/dist/http-request.d.ts

@@ -0,0 +1,193 @@
+import { z } from "./zod.js";
+export declare const HTTP_HEADER_BOUNDS: {
+    readonly count: 32;
+    readonly nameBytes: 128;
+    readonly valueBytes: 8192;
+    readonly totalBytes: 16384;
+};
+export declare const HTTP_METHODS: readonly ["POST", "PUT", "GET"];
+/** Platform-owned authentication, content and transport fields cannot be overridden. */
+export declare function reservedHttpHeaderReason(name: string): string | undefined;
+export declare const httpHeaderNameSchema: import("zod").ZodString;
+export declare const httpHeaderValueSchema: import("zod").ZodString;
+export declare const headerChangeSchema: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+    action: import("zod").ZodLiteral<"set">;
+    name: import("zod").ZodString;
+    value: import("zod").ZodString;
+    secret: import("zod").ZodOptional<import("zod").ZodBoolean>;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    action: import("zod").ZodLiteral<"keep">;
+    name: import("zod").ZodString;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    action: import("zod").ZodLiteral<"remove">;
+    name: import("zod").ZodString;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    action: import("zod").ZodLiteral<"suppress">;
+    name: import("zod").ZodString;
+}, import("zod/v4/core").$strict>], "action">;
+export type HeaderChange = z.infer<typeof headerChangeSchema>;
+export declare const headerChangesSchema: import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+    action: import("zod").ZodLiteral<"set">;
+    name: import("zod").ZodString;
+    value: import("zod").ZodString;
+    secret: import("zod").ZodOptional<import("zod").ZodBoolean>;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    action: import("zod").ZodLiteral<"keep">;
+    name: import("zod").ZodString;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    action: import("zod").ZodLiteral<"remove">;
+    name: import("zod").ZodString;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    action: import("zod").ZodLiteral<"suppress">;
+    name: import("zod").ZodString;
+}, import("zod/v4/core").$strict>], "action">>;
+export declare const endpointHeaderChangesSchema: import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+    action: import("zod").ZodLiteral<"set">;
+    name: import("zod").ZodString;
+    value: import("zod").ZodString;
+    secret: import("zod").ZodOptional<import("zod").ZodBoolean>;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    action: import("zod").ZodLiteral<"keep">;
+    name: import("zod").ZodString;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    action: import("zod").ZodLiteral<"remove">;
+    name: import("zod").ZodString;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    action: import("zod").ZodLiteral<"suppress">;
+    name: import("zod").ZodString;
+}, import("zod/v4/core").$strict>], "action">>;
+export declare const publicHttpHeaderSchema: import("zod").ZodUnion<readonly [import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    secret: import("zod").ZodLiteral<false>;
+    value: import("zod").ZodString;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    secret: import("zod").ZodLiteral<true>;
+    configured: import("zod").ZodLiteral<true>;
+    value: import("zod").ZodOptional<import("zod").ZodNever>;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    suppressed: import("zod").ZodLiteral<true>;
+}, import("zod/v4/core").$strict>]>;
+export type PublicHttpHeader = z.infer<typeof publicHttpHeaderSchema>;
+export declare const httpRequestSchema: import("zod").ZodObject<{
+    method: import("zod").ZodOptional<import("zod").ZodEnum<{
+        POST: "POST";
+        PUT: "PUT";
+        GET: "GET";
+    }>>;
+    body: import("zod").ZodOptional<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+        mode: import("zod").ZodLiteral<"envelope">;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        mode: import("zod").ZodLiteral<"json">;
+        value: import("zod").ZodJSONSchema;
+    }, import("zod/v4/core").$strict>], "mode">>;
+    headers: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+        action: import("zod").ZodLiteral<"set">;
+        name: import("zod").ZodString;
+        value: import("zod").ZodString;
+        secret: import("zod").ZodOptional<import("zod").ZodBoolean>;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        action: import("zod").ZodLiteral<"keep">;
+        name: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        action: import("zod").ZodLiteral<"remove">;
+        name: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        action: import("zod").ZodLiteral<"suppress">;
+        name: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>], "action">>>;
+}, import("zod/v4/core").$strict>;
+export type HttpRequest = z.infer<typeof httpRequestSchema>;
+export declare const publicHttpRequestSchema: import("zod").ZodObject<{
+    method: import("zod").ZodEnum<{
+        POST: "POST";
+        PUT: "PUT";
+        GET: "GET";
+    }>;
+    body: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+        mode: import("zod").ZodLiteral<"envelope">;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        mode: import("zod").ZodLiteral<"none">;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        mode: import("zod").ZodLiteral<"json">;
+        value: import("zod").ZodOptional<import("zod").ZodJSONSchema>;
+    }, import("zod/v4/core").$strict>], "mode">;
+    headers: import("zod").ZodArray<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        secret: import("zod").ZodLiteral<false>;
+        value: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        secret: import("zod").ZodLiteral<true>;
+        configured: import("zod").ZodLiteral<true>;
+        value: import("zod").ZodOptional<import("zod").ZodNever>;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        suppressed: import("zod").ZodLiteral<true>;
+    }, import("zod/v4/core").$strict>]>>;
+}, import("zod/v4/core").$strict>;
+export type PublicHttpRequest = z.infer<typeof publicHttpRequestSchema>;
+export declare const storedHttpHeaderSchema: import("zod").ZodUnion<readonly [import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    secret: import("zod").ZodLiteral<false>;
+    value: import("zod").ZodString;
+    valueBytes: import("zod").ZodNumber;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    secret: import("zod").ZodLiteral<true>;
+    envelope: import("zod").ZodObject<{
+        keyId: import("zod").ZodLiteral<"v1">;
+        nonce: import("zod").ZodString;
+        ciphertext: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>;
+    valueBytes: import("zod").ZodNumber;
+    ownerKind: import("zod").ZodEnum<{
+        endpoint: "endpoint";
+        schedule: "schedule";
+    }>;
+    ownerId: import("zod").ZodString;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    suppressed: import("zod").ZodLiteral<true>;
+}, import("zod/v4/core").$strict>]>;
+export declare const storedHttpRequestSchema: import("zod").ZodObject<{
+    method: import("zod").ZodEnum<{
+        POST: "POST";
+        PUT: "PUT";
+        GET: "GET";
+    }>;
+    bodyMode: import("zod").ZodEnum<{
+        envelope: "envelope";
+        json: "json";
+        none: "none";
+    }>;
+    headers: import("zod").ZodArray<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        secret: import("zod").ZodLiteral<false>;
+        value: import("zod").ZodString;
+        valueBytes: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        secret: import("zod").ZodLiteral<true>;
+        envelope: import("zod").ZodObject<{
+            keyId: import("zod").ZodLiteral<"v1">;
+            nonce: import("zod").ZodString;
+            ciphertext: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>;
+        valueBytes: import("zod").ZodNumber;
+        ownerKind: import("zod").ZodEnum<{
+            endpoint: "endpoint";
+            schedule: "schedule";
+        }>;
+        ownerId: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        suppressed: import("zod").ZodLiteral<true>;
+    }, import("zod/v4/core").$strict>]>>;
+    encryptedTemplate: import("zod").ZodOptional<import("zod").ZodObject<{
+        keyId: import("zod").ZodLiteral<"v1">;
+        nonce: import("zod").ZodString;
+        ciphertext: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>>;
+}, import("zod/v4/core").$strict>;