@greatwait/contracts 0.1.0-alpha.5 → 0.1.0-alpha.7

package/dist/scheduling.js

@@ -1,7 +1,9 @@
+import { httpRequestSchema, publicHttpRequestSchema } from "./http-request.js";
 import { FIXED_INTERVAL_MIN_SECONDS, FIXED_INTERVAL_MAX_SECONDS, MAX_INLINE_PAYLOAD_BYTES, } from "./configuration-bounds.js";
 import { z } from "./zod.js";
 import { attemptIdSchema, deliveryIdSchema, endpointIdSchema, occurrenceIdSchema, scheduleIdSchema, } from "./identifiers.js";
 import { CALLBACK_ATTEMPT_DIAGNOSTICS } from "./delivery.js";
+import { callbackUrlSchema, signingSecretNoticeSchema } from "./endpoints.js";
 import { pageRequestSchema, pageSchema, versionSchema, } from "./protocol.js";
 import { callbackTriggerSchema, } from "./signatures.js";
 import { durationSecondsSchema, timeZoneSchema, timestampSchema } from "./time.js";
@@ -47,6 +49,17 @@ export const SCHEDULE_STATUSES = [
     "completed",
 ];
 export const scheduleStatusSchema = z.enum(SCHEDULE_STATUSES);
+/** A recurring schedule pauses after this many failed runs; "never" disables it. */
+export const DEFAULT_AUTO_PAUSE_AFTER_FAILURES = 5;
+export const autoPauseAfterFailuresSchema = z
+    .union([z.number().int().min(1).max(100), z.literal("never")])
+    .describe('Consecutive failed runs before automatic pause: 1–100 or "never". Defaults to 5 on create; omission on replace preserves the setting. One-shot schedules are unaffected.');
+export const autoPauseReasonSchema = z.object({
+    failedRuns: z.number().int().positive(),
+    status: z.number().int().min(100).max(599).optional(),
+    diagnostic: z.string().max(500),
+    pausedAt: timestampSchema,
+});
 /**
  * The statuses a schedule never leaves, and from which it never fires again on
  * its own.
@@ -818,6 +831,10 @@ export const scheduleNameSchema = z
     .min(1, "must not be blank")
     .max(SCHEDULE_NAME_MAX_LENGTH, `must be at most ${String(SCHEDULE_NAME_MAX_LENGTH)} characters`);
 export const scheduleSchema = z.object({
+    autoPauseAfterFailures: autoPauseAfterFailuresSchema.optional(),
+    consecutiveFailedRuns: z.number().int().nonnegative().optional(),
+    autoPauseReason: autoPauseReasonSchema.nullable().optional(),
+    http: publicHttpRequestSchema.optional(),
     /**
      * When the schedule was filed away, and absent until it is.
      *
@@ -1062,6 +1079,30 @@ export const attemptFailureSnippetSchema = z.object({
     text: z.string().max(ATTEMPT_FAILURE_SNIPPET_MAX_LENGTH),
     truncated: z.boolean(),
 });
+/** Stored diagnostic content, available only under the attempt's verified authority. */
+export const attemptCapturedBodySchema = z.object({
+    contentType: z.string(),
+    encoding: z.enum(["utf8", "base64"]),
+    // Up to 10 KiB received bytes; credential masking can expand the representation.
+    content: z.string().max(131_072),
+    capturedBytes: z.int().min(1).max(10_240),
+    originalBytes: z.int().nonnegative().optional(),
+    truncated: z.boolean(),
+    redacted: z.boolean().optional(),
+    incomplete: z.boolean().optional(),
+});
+export const attemptResponseSchema = z.object({
+    statusText: z.string(),
+    headers: z.array(z.object({ name: z.string(), value: z.string() })),
+    bodyState: z.enum(["captured", "empty", "expired", "not_captured"]),
+    body: attemptCapturedBodySchema.optional(),
+});
+export const attemptRequestSchema = z.object({
+    method: z.enum(["GET", "POST", "PUT"]),
+    url: z.string(),
+    headers: z.array(z.object({ name: z.string(), value: z.string() })),
+    body: z.string(),
+});
 export const attemptSchema = z
     .object({
     attemptNumber: z.number().int().positive(),
@@ -1106,13 +1147,15 @@ export const attemptSchema = z
     /** Stable next-action code paired with a diagnostic when one is known. */
     remediation: attemptRemediationSchema.optional(),
     /**
-     * What a failing receiver said, where the plan retains it.
-     *
-     * Absent on a success, on an in-flight attempt, on a response whose media
-     * type is not text or JSON, and on a plan whose retention does not include
-     * one. Its absence is never evidence about the delivery.
+     * Compatibility text prefix, up to 4 KiB, derived from the retained
+     * response when its media type is supported by legacy clients. Use
+     * response for all headers, media types and the full 10 KiB capture.
+     * Absence is never evidence about the delivery outcome.
      */
     failureSnippet: attemptFailureSnippetSchema.optional(),
+    response: attemptResponseSchema.optional(),
+    request: attemptRequestSchema.optional(),
+    requestState: z.enum(["captured", "expired", "not_captured"]).optional(),
     /** The fixed diagnostic-header allowlist, when a response carried any. */
     responseHeaders: z.array(attemptResponseHeaderSchema).max(8).optional(),
     /** Absent when no response was received at all. */
@@ -1194,6 +1237,15 @@ export const scheduleViewSchema = z.object({
     occurrence: occurrenceSchema,
     schedule: scheduleSchema,
 });
+/**
+ * What a schedule create or replace answers: the schedule view, and — when the
+ * request named its destination by `url` — where that endpoint's signing
+ * secret is (W9-44). Present only then, because only then can the caller have
+ * an endpoint whose secret it never held.
+ */
+export const scheduleWrittenViewSchema = scheduleViewSchema.extend({
+    endpointSigningSecret: signingSecretNoticeSchema.optional(),
+});
 /**
  * The four ways a caller may say when a schedule happens.
  *
@@ -1225,6 +1277,8 @@ export const RECURRENCE_REQUEST_FIELDS = [
  */
 export const scheduleRequestSchema = z
     .object({
+    autoPauseAfterFailures: autoPauseAfterFailuresSchema.optional(),
+    http: httpRequestSchema.optional(),
     /** The instant the first occurrence is planned for. */
     at: timestampSchema.optional(),
     /**
@@ -1313,6 +1367,15 @@ export const scheduleRequestSchema = z
      * valid only when the stored schedule already has an endpoint.
      */
     endpoint: endpointIdSchema.optional(),
+    /**
+     * A callback destination named by its address instead of by an endpoint
+     * id (W9-44, FXO-2907). The service uses the project's existing endpoint
+     * at exactly this address, or creates one silently and returns no signing
+     * secret — the response's `endpointSigningSecret` says where a person
+     * reveals it. Reusing needs only `schedules:write`; creating also needs
+     * `endpoints:write`. Give this or `endpoint`, not both.
+     */
+    url: callbackUrlSchema().optional(),
     /**
      * How promptly this schedule's occurrences expect to be served.
      *
@@ -1400,6 +1463,15 @@ export const scheduleRequestSchema = z
             });
         }
     }
+    if (request.url !== undefined && request.endpoint !== undefined) {
+        for (const path of ["endpoint", "url"]) {
+            context.addIssue({
+                code: "custom",
+                message: "give `endpoint` or `url`, not both; `url` finds or creates the endpoint at that address",
+                path: [path],
+            });
+        }
+    }
     if (request.timeZone !== undefined && request.cron === undefined) {
         context.addIssue({
             code: "custom",

package/dist/secrets.d.ts

@@ -47,6 +47,7 @@ export declare const credentialMetadataSchema: import("zod").ZodObject<{
     revokedAt: import("zod").ZodOptional<import("zod").ZodString>;
     supersededBy: import("zod").ZodOptional<import("zod").ZodString>;
     scopes: import("zod").ZodArray<import("zod").ZodEnum<{
+        "members:manage": "members:manage";
         "credentials:administer": "credentials:administer";
         "billing:write": "billing:write";
         "credentials:read": "credentials:read";
@@ -95,6 +96,7 @@ export declare const credentialPageSchema: import("zod").ZodObject<{
         revokedAt: import("zod").ZodOptional<import("zod").ZodString>;
         supersededBy: import("zod").ZodOptional<import("zod").ZodString>;
         scopes: import("zod").ZodArray<import("zod").ZodEnum<{
+            "members:manage": "members:manage";
             "credentials:administer": "credentials:administer";
             "billing:write": "billing:write";
             "credentials:read": "credentials:read";
@@ -143,6 +145,7 @@ export declare const credentialCreatedSchema: import("zod").ZodObject<{
     revokedAt: import("zod").ZodOptional<import("zod").ZodString>;
     supersededBy: import("zod").ZodOptional<import("zod").ZodString>;
     scopes: import("zod").ZodArray<import("zod").ZodEnum<{
+        "members:manage": "members:manage";
         "credentials:administer": "credentials:administer";
         "billing:write": "billing:write";
         "credentials:read": "credentials:read";
@@ -181,6 +184,7 @@ export declare const credentialRequestSchema: import("zod").ZodObject<{
     }>;
     project: import("zod").ZodString;
     scopes: import("zod").ZodArray<import("zod").ZodEnum<{
+        "members:manage": "members:manage";
         "credentials:administer": "credentials:administer";
         "billing:write": "billing:write";
         "credentials:read": "credentials:read";
@@ -250,6 +254,7 @@ export declare const credentialRotatedSchema: import("zod").ZodObject<{
         revokedAt: import("zod").ZodOptional<import("zod").ZodString>;
         supersededBy: import("zod").ZodOptional<import("zod").ZodString>;
         scopes: import("zod").ZodArray<import("zod").ZodEnum<{
+            "members:manage": "members:manage";
             "credentials:administer": "credentials:administer";
             "billing:write": "billing:write";
             "credentials:read": "credentials:read";
@@ -286,6 +291,7 @@ export declare const credentialRotatedSchema: import("zod").ZodObject<{
         revokedAt: import("zod").ZodOptional<import("zod").ZodString>;
         supersededBy: import("zod").ZodOptional<import("zod").ZodString>;
         scopes: import("zod").ZodArray<import("zod").ZodEnum<{
+            "members:manage": "members:manage";
             "credentials:administer": "credentials:administer";
             "billing:write": "billing:write";
             "credentials:read": "credentials:read";
@@ -333,6 +339,7 @@ export declare const credentialRevokedSchema: import("zod").ZodObject<{
         revokedAt: import("zod").ZodOptional<import("zod").ZodString>;
         supersededBy: import("zod").ZodOptional<import("zod").ZodString>;
         scopes: import("zod").ZodArray<import("zod").ZodEnum<{
+            "members:manage": "members:manage";
             "credentials:administer": "credentials:administer";
             "billing:write": "billing:write";
             "credentials:read": "credentials:read";

package/dist/signatures.d.ts

@@ -182,8 +182,8 @@ export type CallbackDeferredCompletion = z.infer<typeof callbackDeferredCompleti
  */
 export declare const callbackCompletionReportSchema: import("zod").ZodObject<{
     outcome: import("zod").ZodDefault<import("zod").ZodEnum<{
-        failed: "failed";
         succeeded: "succeeded";
+        failed: "failed";
     }>>;
 }, import("zod/v4/core").$strip>;
 export type CallbackCompletionReport = z.infer<typeof callbackCompletionReportSchema>;

package/dist/tenancy.d.ts

@@ -177,7 +177,7 @@ export declare const projectDeletionCountsSchema: import("zod").ZodObject<{
 }, import("zod/v4/core").$strip>;
 export type ProjectDeletionCounts = z.infer<typeof projectDeletionCountsSchema>;
 /**
- * Every active or archived project in the member's organization.
+ * Every active or archived project the member can access. Administrators see all.
  *
  * **Unpaged, with a stated ceiling, because the store beneath it is.**
  * `listProjects` reads an organization's projects in one go; declaring a page

package/dist/tenancy.js

@@ -149,7 +149,7 @@ export const projectSummarySchema = z.object({
 });
 export const projectDeletionCountsSchema = projectSummarySchema.shape.deletionCounts;
 /**
- * Every active or archived project in the member's organization.
+ * Every active or archived project the member can access. Administrators see all.
  *
  * **Unpaged, with a stated ceiling, because the store beneath it is.**
  * `listProjects` reads an organization's projects in one go; declaring a page

package/dist/test-sink.d.ts

@@ -55,8 +55,8 @@ import { type CallbackCompletionOutcome } from "./delivery.js";
  */
 export declare const TEST_SINK_BEHAVIORS: readonly ["client_error", "defer_abandon", "defer_fail", "defer_succeed", "delay", "disconnect", "duplicate", "invalid_signature", "rate_limited", "server_error", "success", "timeout"];
 export declare const testSinkBehaviorSchema: import("zod").ZodEnum<{
-    rate_limited: "rate_limited";
     success: "success";
+    rate_limited: "rate_limited";
     server_error: "server_error";
     client_error: "client_error";
     defer_abandon: "defer_abandon";
@@ -118,14 +118,9 @@ export declare const TEST_SINK_BOUNDS: {
 /**
  * Selected 4xx a sink may answer with.
  *
- * **They are no longer all terminal to the sender, and which are is not this
- * file's decision.** FXO-1596 moved the refusals — a receiver declining *this
- * delivery now* rather than objecting to the message — onto the receiver's
- * ordinary five-failure budget. `TEST_SINK_REFUSAL_STATUSES` below is the
- * subset of this list that the sender will retry, and `test-sink.test.ts`
- * holds it equal to what `classifyStatus` actually says, so a status moved in
- * `CALLBACK_REFUSAL_STATUSES` and not here fails a test rather than teaching an
- * integrator the wrong lesson.
+ * The sender settles these selected statuses on the first attempt. W9-42
+ * stops retrying 401/403/404/405 to avoid billing for a broken configuration.
+ * The broader classification is owned by CALLBACK_REFUSAL_STATUSES.
  *
  * Nothing is removed from what a caller may request: every status here was
  * accepted before and still is.
@@ -134,11 +129,9 @@ export declare const TEST_SINK_CLIENT_ERROR_STATUSES: readonly [400, 401, 403, 4
 /**
  * The statuses above that the sender retries rather than settling on.
  *
- * Exists so an integrator simulating a rotated credential (401) or a WAF rule
- * (403) can see five attempts arrive, and one simulating a malformed body (400)
- * or a duplicate (409) can see exactly one.
+ * Every selected client-error status is terminal under W9-42.
  */
-export declare const TEST_SINK_REFUSAL_STATUSES: readonly [401, 403, 404];
+export declare const TEST_SINK_REFUSAL_STATUSES: readonly [];
 /** Selected 5xx a sink may answer with. Each is retryable to the sender. */
 export declare const TEST_SINK_SERVER_ERROR_STATUSES: readonly [500, 502, 503, 504];
 /**
@@ -156,8 +149,8 @@ export declare const TEST_SINK_SERVER_ERROR_STATUSES: readonly [500, 502, 503, 5
  */
 export declare const testSinkProgramSchema: import("zod").ZodObject<{
     behavior: import("zod").ZodEnum<{
-        rate_limited: "rate_limited";
         success: "success";
+        rate_limited: "rate_limited";
         server_error: "server_error";
         client_error: "client_error";
         defer_abandon: "defer_abandon";
@@ -175,8 +168,8 @@ export declare const testSinkProgramSchema: import("zod").ZodObject<{
     retryAfterSeconds: import("zod").ZodOptional<import("zod").ZodNumber>;
     status: import("zod").ZodOptional<import("zod").ZodNumber>;
     then: import("zod").ZodOptional<import("zod").ZodEnum<{
-        rate_limited: "rate_limited";
         success: "success";
+        rate_limited: "rate_limited";
         server_error: "server_error";
         client_error: "client_error";
         defer_abandon: "defer_abandon";
@@ -213,7 +206,7 @@ export declare const TEST_SINK_BEHAVIOR_FACTS: {
         readonly deferredReport: undefined;
         readonly receiverActed: false;
         readonly senderOutcome: "terminal";
-        readonly summary: "Answers a selected 4xx. The sender records a customer refusal, and retries it only when the status is one the receiver may recover from — 401, 403 and 404, listed as `clientErrorStatusesRetried`. The default, 422, is not one of those, so it settles on the first attempt.";
+        readonly summary: "Answers a selected 4xx. Every selected status settles the run on the first attempt, including 401, 403 and 404. Fix the destination, then redeliver manually.";
     };
     readonly defer_abandon: {
         readonly defaultStatus: 202;
@@ -261,8 +254,8 @@ export declare const TEST_SINK_BEHAVIOR_FACTS: {
         readonly defaultStatus: 401;
         readonly deferredReport: undefined;
         readonly receiverActed: false;
-        readonly senderOutcome: "retryable";
-        readonly summary: "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The sender retries on the receiver's ordinary budget, because the usual cause is a credential the receiver is about to redeploy.";
+        readonly senderOutcome: "terminal";
+        readonly summary: "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The run stops after one attempt; fix the key and redeliver manually.";
     };
     readonly rate_limited: {
         readonly defaultStatus: 429;
@@ -439,16 +432,9 @@ export type TestSinkDisposition = z.infer<typeof testSinkDispositionSchema>;
  *   the network for six minutes is not, and every attempt re-signs with a fresh
  *   timestamp, so the transient case self-heals and the permanent case exhausts
  *   the attempt bound honestly.
- * - `invalid_signature`, `invalid_headers` — 401, **retryable since
- *   FXO-1596**, and this entry used to say the opposite. The reasoning it
- *   replaces was that retrying with the same key cannot succeed and a retryable
- *   answer would spend the give-up budget hiding a misconfiguration. That is
- *   true of a mismatch in *our* signing and false of the population that
- *   actually reaches a 401: a receiver holding a credential it has rotated,
- *   expired, or not yet deployed. Those recover on the receiver's next release,
- *   and the delivery after it carries a fresh signature. The misconfiguration
- *   is not hidden either — five identical 401s settle the occurrence 82 seconds
- *   later with the same `inspect_receiver` advice, five rows instead of one.
+ * - `invalid_signature`, `invalid_headers` — 401, terminal since W9-42.
+ *   Repeating a broken credential spends paid attempts without fixing it.
+ *   Correct the key or receiver configuration, then redeliver manually.
  * - `invalid_envelope` — 400, terminal. The bytes authenticated and did not
  *   parse, so the sender and receiver disagree about the contract.
  * - `body_too_large` — 413, terminal, and matched to the `payload_too_large`
@@ -500,8 +486,8 @@ export declare const testSinkSchema: import("zod").ZodObject<{
     id: import("zod").ZodString;
     program: import("zod").ZodObject<{
         behavior: import("zod").ZodEnum<{
-            rate_limited: "rate_limited";
             success: "success";
+            rate_limited: "rate_limited";
             server_error: "server_error";
             client_error: "client_error";
             defer_abandon: "defer_abandon";
@@ -519,8 +505,8 @@ export declare const testSinkSchema: import("zod").ZodObject<{
         retryAfterSeconds: import("zod").ZodOptional<import("zod").ZodNumber>;
         status: import("zod").ZodOptional<import("zod").ZodNumber>;
         then: import("zod").ZodOptional<import("zod").ZodEnum<{
-            rate_limited: "rate_limited";
             success: "success";
+            rate_limited: "rate_limited";
             server_error: "server_error";
             client_error: "client_error";
             defer_abandon: "defer_abandon";
@@ -547,8 +533,8 @@ export declare const testSinkPageSchema: import("zod").ZodObject<{
         id: import("zod").ZodString;
         program: import("zod").ZodObject<{
             behavior: import("zod").ZodEnum<{
-                rate_limited: "rate_limited";
                 success: "success";
+                rate_limited: "rate_limited";
                 server_error: "server_error";
                 client_error: "client_error";
                 defer_abandon: "defer_abandon";
@@ -566,8 +552,8 @@ export declare const testSinkPageSchema: import("zod").ZodObject<{
             retryAfterSeconds: import("zod").ZodOptional<import("zod").ZodNumber>;
             status: import("zod").ZodOptional<import("zod").ZodNumber>;
             then: import("zod").ZodOptional<import("zod").ZodEnum<{
-                rate_limited: "rate_limited";
                 success: "success";
+                rate_limited: "rate_limited";
                 server_error: "server_error";
                 client_error: "client_error";
                 defer_abandon: "defer_abandon";
@@ -598,8 +584,8 @@ export declare const testSinkCreateRequestSchema: import("zod").ZodObject<{
     endpoint: import("zod").ZodString;
     program: import("zod").ZodOptional<import("zod").ZodObject<{
         behavior: import("zod").ZodEnum<{
-            rate_limited: "rate_limited";
             success: "success";
+            rate_limited: "rate_limited";
             server_error: "server_error";
             client_error: "client_error";
             defer_abandon: "defer_abandon";
@@ -617,8 +603,8 @@ export declare const testSinkCreateRequestSchema: import("zod").ZodObject<{
         retryAfterSeconds: import("zod").ZodOptional<import("zod").ZodNumber>;
         status: import("zod").ZodOptional<import("zod").ZodNumber>;
         then: import("zod").ZodOptional<import("zod").ZodEnum<{
-            rate_limited: "rate_limited";
             success: "success";
+            rate_limited: "rate_limited";
             server_error: "server_error";
             client_error: "client_error";
             defer_abandon: "defer_abandon";
@@ -642,8 +628,8 @@ export type TestSinkCreateRequest = z.infer<typeof testSinkCreateRequestSchema>;
  */
 export declare const testSinkDeliverySchema: import("zod").ZodObject<{
     behavior: import("zod").ZodEnum<{
-        rate_limited: "rate_limited";
         success: "success";
+        rate_limited: "rate_limited";
         server_error: "server_error";
         client_error: "client_error";
         defer_abandon: "defer_abandon";
@@ -681,8 +667,8 @@ export type TestSinkDelivery = z.infer<typeof testSinkDeliverySchema>;
 export declare const testSinkDeliveryPageSchema: import("zod").ZodObject<{
     data: import("zod").ZodArray<import("zod").ZodObject<{
         behavior: import("zod").ZodEnum<{
-            rate_limited: "rate_limited";
             success: "success";
+            rate_limited: "rate_limited";
             server_error: "server_error";
             client_error: "client_error";
             defer_abandon: "defer_abandon";
@@ -747,8 +733,8 @@ export type TestSinkDeliveryPage = z.infer<typeof testSinkDeliveryPageSchema>;
  */
 export declare const testSinkDeliveryBodySchema: import("zod").ZodObject<{
     behavior: import("zod").ZodEnum<{
-        rate_limited: "rate_limited";
         success: "success";
+        rate_limited: "rate_limited";
         server_error: "server_error";
         client_error: "client_error";
         defer_abandon: "defer_abandon";
@@ -874,7 +860,7 @@ export declare const CALLBACK_RECEIVER_PROTOCOL: {
                 readonly deferredReport: undefined;
                 readonly receiverActed: false;
                 readonly senderOutcome: "terminal";
-                readonly summary: "Answers a selected 4xx. The sender records a customer refusal, and retries it only when the status is one the receiver may recover from — 401, 403 and 404, listed as `clientErrorStatusesRetried`. The default, 422, is not one of those, so it settles on the first attempt.";
+                readonly summary: "Answers a selected 4xx. Every selected status settles the run on the first attempt, including 401, 403 and 404. Fix the destination, then redeliver manually.";
             };
             readonly defer_abandon: {
                 readonly defaultStatus: 202;
@@ -922,8 +908,8 @@ export declare const CALLBACK_RECEIVER_PROTOCOL: {
                 readonly defaultStatus: 401;
                 readonly deferredReport: undefined;
                 readonly receiverActed: false;
-                readonly senderOutcome: "retryable";
-                readonly summary: "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The sender retries on the receiver's ordinary budget, because the usual cause is a credential the receiver is about to redeploy.";
+                readonly senderOutcome: "terminal";
+                readonly summary: "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The run stops after one attempt; fix the key and redeliver manually.";
             };
             readonly rate_limited: {
                 readonly defaultStatus: 429;
@@ -993,7 +979,7 @@ export declare const CALLBACK_RECEIVER_PROTOCOL: {
             readonly maxRetainedBodyBytes: 4096;
         };
         readonly clientErrorStatuses: readonly [400, 401, 403, 404, 409, 410, 422];
-        readonly clientErrorStatusesRetried: readonly [401, 403, 404];
+        readonly clientErrorStatusesRetried: readonly [];
         readonly deferral: {
             readonly acknowledgement: string;
             readonly note: "A deferring behavior answers this exact body with this status, then reports with the bearer credential from the delivery's own signed envelope — to the one completion address the stage is configured with, which the envelope's own URL must match. A delivery whose envelope carries no completion material, or names a different address, cannot defer, and the sink answers it as an ordinary success instead.";

package/dist/test-sink.js

@@ -125,14 +125,9 @@ export const TEST_SINK_BOUNDS = {
 /**
  * Selected 4xx a sink may answer with.
  *
- * **They are no longer all terminal to the sender, and which are is not this
- * file's decision.** FXO-1596 moved the refusals — a receiver declining *this
- * delivery now* rather than objecting to the message — onto the receiver's
- * ordinary five-failure budget. `TEST_SINK_REFUSAL_STATUSES` below is the
- * subset of this list that the sender will retry, and `test-sink.test.ts`
- * holds it equal to what `classifyStatus` actually says, so a status moved in
- * `CALLBACK_REFUSAL_STATUSES` and not here fails a test rather than teaching an
- * integrator the wrong lesson.
+ * The sender settles these selected statuses on the first attempt. W9-42
+ * stops retrying 401/403/404/405 to avoid billing for a broken configuration.
+ * The broader classification is owned by CALLBACK_REFUSAL_STATUSES.
  *
  * Nothing is removed from what a caller may request: every status here was
  * accepted before and still is.
@@ -143,11 +138,9 @@ export const TEST_SINK_CLIENT_ERROR_STATUSES = [
 /**
  * The statuses above that the sender retries rather than settling on.
  *
- * Exists so an integrator simulating a rotated credential (401) or a WAF rule
- * (403) can see five attempts arrive, and one simulating a malformed body (400)
- * or a duplicate (409) can see exactly one.
+ * Every selected client-error status is terminal under W9-42.
  */
-export const TEST_SINK_REFUSAL_STATUSES = [401, 403, 404];
+export const TEST_SINK_REFUSAL_STATUSES = [];
 /** Selected 5xx a sink may answer with. Each is retryable to the sender. */
 export const TEST_SINK_SERVER_ERROR_STATUSES = [500, 502, 503, 504];
 /**
@@ -275,7 +268,7 @@ export const TEST_SINK_BEHAVIOR_FACTS = {
         deferredReport: undefined,
         receiverActed: false,
         senderOutcome: "terminal",
-        summary: "Answers a selected 4xx. The sender records a customer refusal, and retries it only when the status is one the receiver may recover from — 401, 403 and 404, listed as `clientErrorStatusesRetried`. The default, 422, is not one of those, so it settles on the first attempt.",
+        summary: "Answers a selected 4xx. Every selected status settles the run on the first attempt, including 401, 403 and 404. Fix the destination, then redeliver manually.",
     },
     defer_abandon: {
         defaultStatus: CALLBACK_DEFERRAL_STATUS,
@@ -327,14 +320,9 @@ export const TEST_SINK_BEHAVIOR_FACTS = {
         defaultStatus: 401,
         deferredReport: undefined,
         receiverActed: false,
-        // Retryable since FXO-1596, and the reversal is deliberate. The reasoning
-        // it replaces was that a key mismatch cannot self-heal the way a stale
-        // timestamp does — true of a mismatch caused by our own signing, and wrong
-        // about the population that actually occurs, which is a receiver holding a
-        // credential it has rotated or not yet deployed. That fixes itself on their
-        // next release, and the delivery that follows carries a fresh signature.
-        senderOutcome: "retryable",
-        summary: "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The sender retries on the receiver's ordinary budget, because the usual cause is a credential the receiver is about to redeploy.",
+        // W9-42 stops a broken credential after one billed attempt.
+        senderOutcome: "terminal",
+        summary: "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The run stops after one attempt; fix the key and redeliver manually.",
     },
     rate_limited: {
         defaultStatus: 429,
@@ -514,16 +502,9 @@ export const testSinkDispositionSchema = z.enum(TEST_SINK_DISPOSITIONS);
  *   the network for six minutes is not, and every attempt re-signs with a fresh
  *   timestamp, so the transient case self-heals and the permanent case exhausts
  *   the attempt bound honestly.
- * - `invalid_signature`, `invalid_headers` — 401, **retryable since
- *   FXO-1596**, and this entry used to say the opposite. The reasoning it
- *   replaces was that retrying with the same key cannot succeed and a retryable
- *   answer would spend the give-up budget hiding a misconfiguration. That is
- *   true of a mismatch in *our* signing and false of the population that
- *   actually reaches a 401: a receiver holding a credential it has rotated,
- *   expired, or not yet deployed. Those recover on the receiver's next release,
- *   and the delivery after it carries a fresh signature. The misconfiguration
- *   is not hidden either — five identical 401s settle the occurrence 82 seconds
- *   later with the same `inspect_receiver` advice, five rows instead of one.
+ * - `invalid_signature`, `invalid_headers` — 401, terminal since W9-42.
+ *   Repeating a broken credential spends paid attempts without fixing it.
+ *   Correct the key or receiver configuration, then redeliver manually.
  * - `invalid_envelope` — 400, terminal. The bytes authenticated and did not
  *   parse, so the sender and receiver disagree about the contract.
  * - `body_too_large` — 413, terminal, and matched to the `payload_too_large`

package/dist/zod-values.d.ts

@@ -1,3 +1,3 @@
 /** The exact Zod constructors used by delivery-runtime contract modules. */
-export { ZodError, ZodIssueCode, array, boolean, discriminatedUnion, enum, int, json, literal, number, object, partialRecord, record, strictObject, string, toJSONSchema, tuple, union, unknown, url, } from "zod";
-export type { RefinementCtx, ZodType, ZodTypeAny, infer } from "zod";
+export { ZodError, ZodIssueCode, array, boolean, discriminatedUnion, enum, int, json, literal, number, never, object, partialRecord, record, strictObject, string, toJSONSchema, tuple, union, unknown, url, } from "zod";
+export type { RefinementCtx, ZodType, ZodTypeAny, infer, input } from "zod";

package/dist/zod-values.js

@@ -1,2 +1,2 @@
 /** The exact Zod constructors used by delivery-runtime contract modules. */
-export { ZodError, ZodIssueCode, array, boolean, discriminatedUnion, enum, int, json, literal, number, object, partialRecord, record, strictObject, string, toJSONSchema, tuple, union, unknown, url, } from "zod";
+export { ZodError, ZodIssueCode, array, boolean, discriminatedUnion, enum, int, json, literal, number, never, object, partialRecord, record, strictObject, string, toJSONSchema, tuple, union, unknown, url, } from "zod";

package/generated/v1/callback-receiver.json

@@ -56,7 +56,7 @@
         "defaultStatus": 422,
         "receiverActed": false,
         "senderOutcome": "terminal",
-        "summary": "Answers a selected 4xx. The sender records a customer refusal, and retries it only when the status is one the receiver may recover from — 401, 403 and 404, listed as `clientErrorStatusesRetried`. The default, 422, is not one of those, so it settles on the first attempt."
+        "summary": "Answers a selected 4xx. Every selected status settles the run on the first attempt, including 401, 403 and 404. Fix the destination, then redeliver manually."
       },
       "defer_abandon": {
         "defaultStatus": 202,
@@ -99,8 +99,8 @@
       "invalid_signature": {
         "defaultStatus": 401,
         "receiverActed": false,
-        "senderOutcome": "retryable",
-        "summary": "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The sender retries on the receiver's ordinary budget, because the usual cause is a credential the receiver is about to redeploy."
+        "senderOutcome": "terminal",
+        "summary": "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The run stops after one attempt; fix the key and redeliver manually."
       },
       "rate_limited": {
         "defaultStatus": 429,
@@ -136,7 +136,7 @@
       "maxRetainedBodyBytes": 4096
     },
     "clientErrorStatuses": [400, 401, 403, 404, 409, 410, 422],
-    "clientErrorStatusesRetried": [401, 403, 404],
+    "clientErrorStatusesRetried": [],
     "deferral": {
       "acknowledgement": "{\"greatwait\":{\"status\":\"pending\"}}",
       "note": "A deferring behavior answers this exact body with this status, then reports with the bearer credential from the delivery's own signed envelope — to the one completion address the stage is configured with, which the envelope's own URL must match. A delivery whose envelope carries no completion material, or names a different address, cannot defer, and the sink answers it as an ordinary success instead.",

package/generated/v1/examples/endpoints.ensure.request.json

@@ -0,0 +1,3 @@
+{
+  "url": "https://hooks.example.com/greatwait"
+}

package/generated/v1/examples/endpoints.ensure.response.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-08-05T15:00:00.000Z",
+  "environmentKind": "test",
+  "id": "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
+  "name": "https://hooks.example.com/greatwait",
+  "project": "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+  "signingKeys": {
+    "current": "csk_01h8xyz9k2m4n6p8r0t2v4w6y8"
+  },
+  "status": "active",
+  "updatedAt": "2026-08-05T15:00:00.000Z",
+  "url": "https://hooks.example.com/greatwait",
+  "version": 1,
+  "created": true,
+  "signingSecret": {
+    "guidance": "GreatWait signs every callback to this endpoint. The signing secret is never returned here; a signed-in member of the project reveals it on the endpoint's page in the GreatWait dashboard, and your receiver uses it to verify that a callback came from GreatWait.",
+    "returned": false,
+    "revealUrl": "https://app.greatwait.dev/o/org_2example0organization0id/p/proj_01h8xyz9k2m4n6p8r0t2v4w6y8/test/settings/endpoints/ep_01h8xyz9k2m4n6p8r0t2v4w6y8"
+  }
+}

package/generated/v1/examples/invitations.create.request.json

@@ -0,0 +1,5 @@
+{
+  "email": "teammate@example.com",
+  "role": "member",
+  "projects": ["proj_01h8xyz9k2m4n6p8r0t2v4w6y8"]
+}

package/generated/v1/examples/invitations.create.response.json

@@ -0,0 +1,7 @@
+{
+  "id": "inv_0123456789abcdef0123456789",
+  "email": "teammate@example.com",
+  "role": "member",
+  "projects": ["proj_01h8xyz9k2m4n6p8r0t2v4w6y8"],
+  "status": "pending"
+}

package/generated/v1/examples/invitations.list.response.json

@@ -0,0 +1,11 @@
+{
+  "data": [
+    {
+      "id": "inv_0123456789abcdef0123456789",
+      "email": "teammate@example.com",
+      "role": "member",
+      "projects": ["proj_01h8xyz9k2m4n6p8r0t2v4w6y8"],
+      "status": "pending"
+    }
+  ]
+}

package/generated/v1/examples/invitations.resend.request.json

@@ -0,0 +1 @@
+{}