@greatwait/contracts 0.1.0-alpha.5 → 0.1.0-alpha.7

package/dist/operations.js

@@ -1,10 +1,11 @@
 import { effectiveCustomerLimitsSchema } from "./effective-limits.js";
 import { z } from "./zod.js";
+import { MEMBER_OPERATIONS } from "./members.js";
 import { DATA_EXPORT_OPERATIONS } from "./data-export.js";
 import { ORGANIZATION_LIFECYCLE_OPERATIONS } from "./organization-lifecycle.js";
 import { API_UNUSED_RESPONSE_SCHEMA } from "./operation-definitions.js";
 import { credentialContextSchema } from "./authority.js";
-import { callbackEndpointCreatedSchema, callbackEndpointPageSchema, callbackEndpointRequestSchema, callbackEndpointRotatedSchema, callbackEndpointSchema, callbackEndpointSigningSecretsSchema, callbackSigningKeyRotationRequestSchema, } from "./endpoints.js";
+import { callbackEndpointCreatedSchema, callbackEndpointEnsuredSchema, callbackEndpointPageSchema, callbackEndpointRequestSchema, callbackEndpointRotatedSchema, callbackEndpointSchema, callbackEndpointSigningSecretsSchema, callbackSigningKeyRotationRequestSchema, } from "./endpoints.js";
 import { FORECAST_WINDOW_VERSION, forecastRequestSchema, forecastSchema, forecastRequestHeadersSchema, forecastWindowsSchema, } from "./forecast.js";
 import { usageRequestSchema, usageSchema } from "./usage.js";
 import { deliveryTimingSummarySchema } from "./timing.js";
@@ -12,7 +13,7 @@ import { billingAutoTopUpApplyRequestSchema, billingAutoTopUpPreviewRequestSchem
 import { conditionalRequestHeaderSchema, idempotencyReplayResponseHeaderSchema, idempotencyRequestHeaderSchema, historyPageRequestSchema, pageRequestSchema, scheduleListRequestSchema, replayedResponseHeaderSchema, requiredConditionalRequestHeaderSchema, requiredIdempotencyRequestHeaderSchema, versionResponseHeaderSchema, } from "./protocol.js";
 import { oauthGrantListSchema, oauthGrantRevokedSchema } from "./oauth.js";
 import { credentialCreatedSchema, credentialPageSchema, credentialRequestSchema, credentialRevokedSchema, credentialRotatedSchema, credentialRotationRequestSchema, } from "./secrets.js";
-import { attemptPageSchema, attemptViewSchema, occurrencePageSchema, projectOccurrenceListRequestSchema, projectOccurrencePageSchema, occurrenceViewSchema, schedulePageSchema, scheduleRequestSchema, scheduleViewSchema, } from "./scheduling.js";
+import { attemptPageSchema, attemptViewSchema, occurrencePageSchema, projectOccurrenceListRequestSchema, projectOccurrencePageSchema, occurrenceViewSchema, schedulePageSchema, scheduleRequestSchema, scheduleViewSchema, scheduleWrittenViewSchema, } from "./scheduling.js";
 import { testSinkCreateRequestSchema, testSinkDeliveryBodySchema, testSinkDeliveryPageSchema, testSinkPageSchema, testSinkProgramSchema, testSinkSchema, } from "./test-sink.js";
 import { projectArchiveRequestSchema, projectCreateRequestSchema, projectDeletedSchema, projectListSchema, projectSummarySchema, projectUpdateRequestSchema, } from "./tenancy.js";
 import { mcpConnectionSchema } from "./mcp.js";
@@ -525,6 +526,7 @@ export const OPERATIONS = [
         surfaces: ["api", "mock"],
     },
     ...DATA_EXPORT_OPERATIONS,
+    ...MEMBER_OPERATIONS,
     ...ORGANIZATION_LIFECYCLE_OPERATIONS,
     {
         creates: false,
@@ -659,7 +661,7 @@ export const OPERATIONS = [
         creates: true,
         description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
             ? ""
-            : "Creates a reusable callback endpoint in the caller's project and environment. The destination must be HTTPS on effective port 443, contain no URL credentials or fragment, and resolve only to public unicast addresses. The endpoint is active and usable the moment it exists; there is nothing to verify. A disabled endpoint is never delivered to, and a schedule write naming one answers not_found, because disabling is terminal rather than a state to recover from. The per-endpoint secret is returned to this call and to no other call an API credential or an OAuth token can make; a signed-in member can read it again through endpoints.revealSigningSecret. There is no endpoint-count ceiling. Disabled endpoints remain readable for audit; request and DNS inspection admission bound creation work and reads are paged.",
+            : "Creates a reusable callback endpoint in the caller's project and environment. The destination must be HTTPS on effective port 443, contain no URL credentials or fragment, and resolve only to public unicast addresses. The endpoint is active and usable the moment it exists; there is nothing to verify. A disabled endpoint is never delivered to, and a schedule write naming one answers not_found, because disabling is terminal rather than a state to recover from. The per-endpoint secret is returned to this call and to no other call an API credential or an OAuth token can make; a signed-in member can read it again through endpoints.revealSigningSecret. There is no endpoint-count ceiling. Disabled endpoints remain readable for audit; request and DNS inspection admission bound creation work and reads are paged. Optional `headers` set reusable defaults. Ordinary values remain readable; `secret: true` encrypts a write-only value that is never returned. Header edits use explicit `set`, `keep`, and `remove` actions.",
         example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
             ? {}
             : {
@@ -680,7 +682,7 @@ export const OPERATIONS = [
         idempotent: false,
         mcp: {
             kind: "unavailable",
-            reason: "Creation returns a one-time endpoint signing secret, and MCP has no negotiated secure-result channel that can keep it out of ordinary tool history.",
+            reason: "Creation returns a one-time endpoint signing secret, and MCP has no negotiated secure-result channel that can keep it out of ordinary tool history. Agents use endpoints_ensure, or schedules_create with a `url`, which create an endpoint without returning its secret.",
         },
         method: "POST",
         mutates: true,
@@ -707,6 +709,67 @@ export const OPERATIONS = [
             : "Create a callback endpoint",
         surfaces: ["api", "mock"],
     },
+    {
+        // Sometimes brings an endpoint into being and sometimes finds one, and a
+        // single success status has to be true of both, so it answers 200 and
+        // says which in `created`. `schedules.pause` set the precedent for a
+        // mutating POST that is not a 201.
+        creates: false,
+        description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Finds or creates the callback endpoint at a URL in the caller's project and environment, without returning its signing secret. With no `name`, an existing endpoint that is not disabled at exactly this address is returned unchanged, preferring the one named after its URL; with a `name`, the endpoint must also carry that name. Otherwise one is created under the same rules as endpoints.create — HTTPS on effective port 443, no URL credentials or fragment, resolving only to public unicast addresses — and `created` is true. Optional `headers` apply only to an endpoint this call creates. Sent when the endpoint already exists, they are accepted if they are exactly its ordinary headers — what a retry of the creating call sends — and otherwise refused as `state_conflict` naming it; endpoints.update changes them. A secret value cannot be compared, so a call carrying one is refused for an endpoint that already exists. The result is metadata only: `signingSecret` says that the secret is not returned and where a signed-in member reveals it (`revealUrl`, the endpoint's dashboard page). Every callback is signed with that secret whether or not the receiver checks it. This is the endpoint operation agents use over MCP; endpoints.create, which returns the secret once, is withheld there.",
+        example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                created: true,
+                createdAt: "2026-08-05T15:00:00.000Z",
+                environmentKind: "test",
+                id: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                name: "https://hooks.example.com/greatwait",
+                project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                signingKeys: { current: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8" },
+                signingSecret: {
+                    guidance: "GreatWait signs every callback to this endpoint. The signing secret is never returned here; a signed-in member of the project reveals it on the endpoint's page in the GreatWait dashboard, and your receiver uses it to verify that a callback came from GreatWait.",
+                    returned: false,
+                    revealUrl: "https://app.greatwait.dev/o/org_2example0organization0id/p/proj_01h8xyz9k2m4n6p8r0t2v4w6y8/test/settings/endpoints/ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                },
+                status: "active",
+                updatedAt: "2026-08-05T15:00:00.000Z",
+                url: "https://hooks.example.com/greatwait",
+                version: 1,
+            },
+        id: "endpoints.ensure",
+        // Repeating it returns the same endpoint: the second call finds what the
+        // first created. That is the property this field states, with no key.
+        idempotent: true,
+        // Additive, and open-world for the reason endpoints.update is: deliveries
+        // go to the customer's receiver afterwards.
+        mcp: { destructive: false, kind: "tool", openWorld: true },
+        method: "POST",
+        mutates: true,
+        path: "/v1/endpoints/ensure",
+        principals: ["api-credential", "oauth", "session"],
+        problems: [
+            "state_conflict",
+            "invalid_request",
+            "plan_limit_reached",
+            "rate_limited",
+        ],
+        request: callbackEndpointRequestSchema,
+        requestExample: globalThis
+            .GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { url: "https://hooks.example.com/greatwait" },
+        response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : callbackEndpointEnsuredSchema,
+        scopes: ["endpoints:write"],
+        sessionAuthority: "headers",
+        summary: globalThis.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Find or create a callback endpoint by URL",
+        surfaces: ["api", "mock"],
+    },
     {
         creates: false,
         description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
@@ -796,7 +859,7 @@ export const OPERATIONS = [
         creates: false,
         description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
             ? ""
-            : "Replaces an endpoint's destination after applying the complete URL and DNS policy, and renames it when a name is given. Deliveries go to the new destination from the next one on. Disabled endpoints cannot be updated. Send If-Match with the version the endpoint was read at to be refused rather than overwrite a destination somebody else changed in the meantime.",
+            : "Replaces an endpoint's destination after applying the complete URL and DNS policy, and renames it when a name is given. Optional `headers` patch endpoint defaults with `set`, `keep`, or `remove`; omitted headers preserve them. A secret value can be retained, replaced (including an empty string), or removed, but cannot be revealed. Header and destination edits apply to newly admitted attempts, including retries; recovery of the same admitted attempt keeps its snapshot. Disabled endpoints cannot be updated. Send If-Match with the version the endpoint was read at to be refused rather than overwrite a destination somebody else changed in the meantime.",
         example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
             ? {}
             : {
@@ -2088,7 +2151,7 @@ export const OPERATIONS = [
         creates: true,
         description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
             ? ""
-            : "Creates a schedule and returns it together with its first planned occurrence. Give exactly one of `at`, `delaySeconds`, `everySeconds` and `cron`. An optional `partitionKey` selects a fairness lane inside this project and environment; it is fixed after create. Add a verified `endpoint` to deliver each occurrence there; optional JSON `data` is encrypted before PostgreSQL persistence, placed in the signed callback, and returned as given by a schedule read. `at` and `delaySeconds` fire once; a delay is converted to an absolute instant when the request is accepted, so a schedule created either way reads back the same afterwards. `everySeconds` is a fixed duration and its first occurrence falls one interval after acceptance — it stays the same length across a daylight-saving change, and takes no timezone for that reason. `cron` is a wall clock: it is read against the IANA `timeZone` sent with it, `UTC` when none is, and the first occurrence is the first instant the expression names after acceptance. Where the clocks go forward and the wall time named does not exist that day, the occurrence falls at the first instant after the gap; where they go back and it happens twice, it falls once, at the earlier of the two. A recurring schedule is materialized one occurrence at a time: the next one is planned once the current one is due, so a read always shows one occurrence still to come. `lateness.policy` decides what happens when an occurrence reaches its first attempt after its planned instant: `skipAhead` never carries a recurring arrival across its next scheduled instant (and a shorter custom window may retire it earlier), while `catchUp` admits one arrival within `maxStalenessSeconds` even after later recurrence instants passed. A one-shot has no next recurrence, so either explicit policy uses its window and the default is `catchUp` with 24 hours; recurring schedules default to `skipAhead`, and a `catchUp` without an override has a one-interval window. A retry already in progress is exempt because it arrived and failed; its retry and give-up policy still decide the outcome. The organization, project and environment come from the verified principal; a body cannot name them, and the endpoint must belong to the same tuple, so a credential issued for one project can only ever create schedules in that project. Send an `Idempotency-Key` to make a retry safe: the identical request returns the schedule that key already created, marked `Idempotency-Replayed: true`, and creates nothing further; the same key with a different request is refused `idempotency_key_reused`. A replay reports the schedule **as it stands now**, not a frozen copy of the first response — if it was paused in between, the replay says so.",
+            : "Creates a schedule and returns it together with its first planned occurrence. Give exactly one of `at`, `delaySeconds`, `everySeconds` and `cron`. An optional `partitionKey` selects a fairness lane inside this project and environment; it is fixed after create. Add a verified `endpoint` to deliver each occurrence there. Instead of `endpoint`, give a `url`: the service uses this project and environment's existing endpoint at exactly that address, or creates one silently. Its signing secret is never returned; the response's `endpointSigningSecret` says where a signed-in member reveals it. Reusing an endpoint needs only `schedules:write`; creating one also needs `endpoints:write`, and without it the request is refused as `scope_missing`. Optional JSON `data` is encrypted before PostgreSQL persistence, placed in the signed callback, and returned as given by a schedule read. Optional `http` selects POST (default), PUT, or bodyless GET and schedule header overrides. Omitted HTTP settings preserve the signed structured envelope; `body: { mode: 'json', value: ... }` sends that JSON directly without interpolation. Ordinary headers remain readable and secret values are encrypted and write-only. Schedule headers override endpoint defaults case-insensitively, with `suppress` to omit an inherited header and `remove` to resume inheritance. Product signing, content and transport headers are reserved. Raw JSON and GET carry asynchronous completion details in reserved Callback-Completion headers. `at` and `delaySeconds` fire once; a delay is converted to an absolute instant when the request is accepted, so a schedule created either way reads back the same afterwards. `everySeconds` is a fixed duration and its first occurrence falls one interval after acceptance — it stays the same length across a daylight-saving change, and takes no timezone for that reason. `cron` is a wall clock: it is read against the IANA `timeZone` sent with it, `UTC` when none is, and the first occurrence is the first instant the expression names after acceptance. Where the clocks go forward and the wall time named does not exist that day, the occurrence falls at the first instant after the gap; where they go back and it happens twice, it falls once, at the earlier of the two. A recurring schedule is materialized one occurrence at a time: the next one is planned once the current one is due, so a read always shows one occurrence still to come. `lateness.policy` decides what happens when an occurrence reaches its first attempt after its planned instant: `skipAhead` never carries a recurring arrival across its next scheduled instant (and a shorter custom window may retire it earlier), while `catchUp` admits one arrival within `maxStalenessSeconds` even after later recurrence instants passed. A one-shot has no next recurrence, so either explicit policy uses its window and the default is `catchUp` with 24 hours; recurring schedules default to `skipAhead`, and a `catchUp` without an override has a one-interval window. A retry already in progress is exempt because it arrived and failed; its retry and give-up policy still decide the outcome. The organization, project and environment come from the verified principal; a body cannot name them, and the endpoint must belong to the same tuple, so a credential issued for one project can only ever create schedules in that project. Send an `Idempotency-Key` to make a retry safe: the identical request returns the schedule that key already created, marked `Idempotency-Replayed: true`, and creates nothing further; the same key with a different request is refused `idempotency_key_reused`. A replay reports the schedule **as it stands now**, not a frozen copy of the first response — if it was paused in between, the replay says so.",
         example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
             ? {}
             : {
@@ -2131,6 +2194,9 @@ export const OPERATIONS = [
         method: "POST",
         mutates: true,
         path: "/v1/schedules",
+        // Creating the endpoint a `url` names is an endpoint write (W9-44).
+        conditionalScopes: ["endpoints:write"],
+        conditionalScopesWhen: "the request names a `url` this project and environment has no endpoint at yet",
         principals: ["api-credential", "oauth", "session"],
         problems: [
             "idempotency_key_reused",
@@ -2144,6 +2210,8 @@ export const OPERATIONS = [
             // the schedule they asked for. How many schedules an organization holds
             // is not bounded (FXO-2556).
             "plan_limit_reached",
+            "rate_limited",
+            "scope_missing",
             "service_unavailable",
             // A schedule against a disabled endpoint. Refused rather than accepted
             // and never fired, and refused by its state rather than as `not_found`,
@@ -2165,7 +2233,7 @@ export const OPERATIONS = [
         requestHeaders: idempotencyRequestHeaderSchema,
         response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
             ? API_UNUSED_RESPONSE_SCHEMA
-            : scheduleViewSchema,
+            : scheduleWrittenViewSchema,
         ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
             ? {}
             : { responseHeaders: replayedResponseHeaderSchema }),
@@ -2180,7 +2248,7 @@ export const OPERATIONS = [
         creates: false,
         description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
             ? ""
-            : "Reads one schedule and its next occurrence from the partition that owns it. A schedule belonging to another organization, project or environment answers not_found rather than a refusal that would confirm it exists. The response carries the schedule's version as a strong ETag; send it back in `If-Match` to make a later write conditional on nothing having changed in between. The response carries the schedule's `data` when it has one, exactly as it was given; the listing leaves it off.",
+            : "Reads one schedule and its next occurrence from the partition that owns it. A schedule belonging to another organization, project or environment answers not_found rather than a refusal that would confirm it exists. The response carries the schedule's version as a strong ETag; send it back in `If-Match` to make a later write conditional on nothing having changed in between. The response carries the schedule's `data` when it has one, exactly as it was given; the listing leaves it off. Detail reads also include the custom JSON body; listings and mutation responses omit its content. HTTP settings expose ordinary values and configured secret markers, never secret values.",
         example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
             ? {}
             : {
@@ -3614,7 +3682,7 @@ export const OPERATIONS = [
         creates: false,
         description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
             ? ""
-            : "Replaces a schedule's definition, starting a new generation. Takes the same four ways of saying when as a create, so a one-shot can be replaced by a recurring definition and the other way round. An omitted callback endpoint/data pair preserves the stored callback; sending `data` alone replaces the encrypted data for the current endpoint, and sending `endpoint` selects a verified endpoint in the same authority tuple. The occurrence planned under the old definition is settled `skipped_stale` and can never fire unless it was already in flight, in which case its immutable attempt is allowed to settle honestly; a fresh occurrence is planned under the new definition, and the old definition's series stops advancing. `lateness` is resolved afresh against the replacement recurrence: omit it for that kind's default, or state `skipAhead`, `catchUp`, and an optional `maxStalenessSeconds` override. The policy applies only before an occurrence's first attempt; a retry already in progress remains on its retry and give-up ladder. Send `If-Match` with the version you read to make this conditional; without it the replace is unconditional and the last writer wins. A cancelled or completed schedule cannot be replaced. `partitionKey` is fixed when the schedule is created: omit it to preserve the stored value or echo that exact value in a GET → modify → PUT flow. Adding, changing, or clearing it is refused as `invalid_request` with `/partitionKey` identified. `latencyClass` remains derived from the replacement recurrence when the caller omits it.",
+            : "Replaces a schedule's definition, starting a new generation. Takes the same four ways of saying when as a create, so a one-shot can be replaced by a recurring definition and the other way round. An omitted callback endpoint/data pair preserves the stored callback; sending `data` alone replaces the encrypted data for the current endpoint, and sending `endpoint` selects a verified endpoint in the same authority tuple. Sending `url` instead selects the endpoint at that address in the same tuple, creating one silently when there is none; creating needs `endpoints:write` as well, and the response's `endpointSigningSecret` says where its signing secret is revealed. Omitted `http` preserves HTTP settings. Its headers are a patch: `set` replaces a value, `keep` retains a configured value, `suppress` omits an endpoint default, and `remove` resumes inheritance. Explicit GET with no body clears a saved custom template; POST/PUT with `body: { mode: 'envelope' }` restores the structured callback. The occurrence planned under the old definition is settled `skipped_stale` and can never fire unless it was already in flight, in which case its immutable attempt is allowed to settle honestly; a fresh occurrence is planned under the new definition, and the old definition's series stops advancing. `lateness` is resolved afresh against the replacement recurrence: omit it for that kind's default, or state `skipAhead`, `catchUp`, and an optional `maxStalenessSeconds` override. The policy applies only before an occurrence's first attempt; a retry already in progress remains on its retry and give-up ladder. Send `If-Match` with the version you read to make this conditional; without it the replace is unconditional and the last writer wins. A cancelled or completed schedule cannot be replaced. `partitionKey` is fixed when the schedule is created: omit it to preserve the stored value or echo that exact value in a GET → modify → PUT flow. Adding, changing, or clearing it is refused as `invalid_request` with `/partitionKey` identified. `latencyClass` remains derived from the replacement recurrence when the caller omits it.",
         example: globalThis.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
             ? {}
             : {
@@ -3650,6 +3718,9 @@ export const OPERATIONS = [
         method: "PUT",
         mutates: true,
         path: "/v1/schedules/{scheduleId}",
+        // Creating the endpoint a `url` names is an endpoint write (W9-44).
+        conditionalScopes: ["endpoints:write"],
+        conditionalScopesWhen: "the request names a `url` this project and environment has no endpoint at yet",
         principals: ["api-credential", "oauth", "session"],
         problems: [
             "invalid_request",
@@ -3658,6 +3729,8 @@ export const OPERATIONS = [
             // schedule and cannot change `partitionKey`, so neither counted ceiling
             // can move; what it can do is carry a larger body than the plan admits.
             "plan_limit_reached",
+            "rate_limited",
+            "scope_missing",
             "service_unavailable",
             "state_conflict",
             "version_conflict",
@@ -3679,7 +3752,7 @@ export const OPERATIONS = [
         requestHeaders: conditionalRequestHeaderSchema,
         response: globalThis.GREATWAIT_API_REQUEST_REGISTRY
             ? API_UNUSED_RESPONSE_SCHEMA
-            : scheduleViewSchema,
+            : scheduleWrittenViewSchema,
         ...(globalThis.GREATWAIT_API_REQUEST_REGISTRY
             ? {}
             : { responseHeaders: versionResponseHeaderSchema }),

package/dist/organization-lifecycle.d.ts

@@ -29,6 +29,16 @@ export declare const ORGANIZATION_LIFECYCLE_OPERATIONS: readonly [import("./oper
     readonly id: "organizations.lifecycle";
 }, import("./operations.js").OperationDefinition & {
     readonly id: "organizations.close";
+} & {
+    readonly request: import("zod").ZodObject<{
+        expectedGeneration: import("zod").ZodNumber;
+        immediate: import("zod").ZodBoolean;
+        confirmation: import("zod").ZodLiteral<"delete organization">;
+    }, import("zod/v4/core").$strict>;
 }, import("./operations.js").OperationDefinition & {
     readonly id: "organizations.restore";
+} & {
+    readonly request: import("zod").ZodObject<{
+        expectedGeneration: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strict>;
 }];

package/dist/policy.js

@@ -50,10 +50,13 @@ function allOperations() {
  * Clerk's and this product does not do it, so this is the whole of what `admin`
  * means here.
  */
-const MEMBER_SCOPES = SCOPES.filter((scope) => scope !== "billing:write" &&
+const MEMBER_SCOPES = SCOPES.filter((scope) => scope !== "members:manage" &&
+    scope !== "billing:write" &&
+    scope !== "credentials:administer" &&
+    scope !== "projects:administer");
+const BILLING_SCOPES = SCOPES.filter((scope) => scope !== "members:manage" &&
     scope !== "credentials:administer" &&
     scope !== "projects:administer");
-const BILLING_SCOPES = SCOPES.filter((scope) => scope !== "credentials:administer" && scope !== "projects:administer");
 export const ROLE_SCOPE_CEILINGS = {
     admin: SCOPES,
     billing: BILLING_SCOPES,