@greatwait/contracts 0.1.0-alpha.6 → 0.1.0-alpha.7

package/dist/test-sink.d.ts

@@ -55,8 +55,8 @@ import { type CallbackCompletionOutcome } from "./delivery.js";
  */
 export declare const TEST_SINK_BEHAVIORS: readonly ["client_error", "defer_abandon", "defer_fail", "defer_succeed", "delay", "disconnect", "duplicate", "invalid_signature", "rate_limited", "server_error", "success", "timeout"];
 export declare const testSinkBehaviorSchema: import("zod").ZodEnum<{
-    rate_limited: "rate_limited";
     success: "success";
+    rate_limited: "rate_limited";
     server_error: "server_error";
     client_error: "client_error";
     defer_abandon: "defer_abandon";
@@ -118,14 +118,9 @@ export declare const TEST_SINK_BOUNDS: {
 /**
  * Selected 4xx a sink may answer with.
  *
- * **They are no longer all terminal to the sender, and which are is not this
- * file's decision.** FXO-1596 moved the refusals — a receiver declining *this
- * delivery now* rather than objecting to the message — onto the receiver's
- * ordinary five-failure budget. `TEST_SINK_REFUSAL_STATUSES` below is the
- * subset of this list that the sender will retry, and `test-sink.test.ts`
- * holds it equal to what `classifyStatus` actually says, so a status moved in
- * `CALLBACK_REFUSAL_STATUSES` and not here fails a test rather than teaching an
- * integrator the wrong lesson.
+ * The sender settles these selected statuses on the first attempt. W9-42
+ * stops retrying 401/403/404/405 to avoid billing for a broken configuration.
+ * The broader classification is owned by CALLBACK_REFUSAL_STATUSES.
  *
  * Nothing is removed from what a caller may request: every status here was
  * accepted before and still is.
@@ -134,11 +129,9 @@ export declare const TEST_SINK_CLIENT_ERROR_STATUSES: readonly [400, 401, 403, 4
 /**
  * The statuses above that the sender retries rather than settling on.
  *
- * Exists so an integrator simulating a rotated credential (401) or a WAF rule
- * (403) can see five attempts arrive, and one simulating a malformed body (400)
- * or a duplicate (409) can see exactly one.
+ * Every selected client-error status is terminal under W9-42.
  */
-export declare const TEST_SINK_REFUSAL_STATUSES: readonly [401, 403, 404];
+export declare const TEST_SINK_REFUSAL_STATUSES: readonly [];
 /** Selected 5xx a sink may answer with. Each is retryable to the sender. */
 export declare const TEST_SINK_SERVER_ERROR_STATUSES: readonly [500, 502, 503, 504];
 /**
@@ -156,8 +149,8 @@ export declare const TEST_SINK_SERVER_ERROR_STATUSES: readonly [500, 502, 503, 5
  */
 export declare const testSinkProgramSchema: import("zod").ZodObject<{
     behavior: import("zod").ZodEnum<{
-        rate_limited: "rate_limited";
         success: "success";
+        rate_limited: "rate_limited";
         server_error: "server_error";
         client_error: "client_error";
         defer_abandon: "defer_abandon";
@@ -175,8 +168,8 @@ export declare const testSinkProgramSchema: import("zod").ZodObject<{
     retryAfterSeconds: import("zod").ZodOptional<import("zod").ZodNumber>;
     status: import("zod").ZodOptional<import("zod").ZodNumber>;
     then: import("zod").ZodOptional<import("zod").ZodEnum<{
-        rate_limited: "rate_limited";
         success: "success";
+        rate_limited: "rate_limited";
         server_error: "server_error";
         client_error: "client_error";
         defer_abandon: "defer_abandon";
@@ -213,7 +206,7 @@ export declare const TEST_SINK_BEHAVIOR_FACTS: {
         readonly deferredReport: undefined;
         readonly receiverActed: false;
         readonly senderOutcome: "terminal";
-        readonly summary: "Answers a selected 4xx. The sender records a customer refusal, and retries it only when the status is one the receiver may recover from — 401, 403 and 404, listed as `clientErrorStatusesRetried`. The default, 422, is not one of those, so it settles on the first attempt.";
+        readonly summary: "Answers a selected 4xx. Every selected status settles the run on the first attempt, including 401, 403 and 404. Fix the destination, then redeliver manually.";
     };
     readonly defer_abandon: {
         readonly defaultStatus: 202;
@@ -261,8 +254,8 @@ export declare const TEST_SINK_BEHAVIOR_FACTS: {
         readonly defaultStatus: 401;
         readonly deferredReport: undefined;
         readonly receiverActed: false;
-        readonly senderOutcome: "retryable";
-        readonly summary: "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The sender retries on the receiver's ordinary budget, because the usual cause is a credential the receiver is about to redeploy.";
+        readonly senderOutcome: "terminal";
+        readonly summary: "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The run stops after one attempt; fix the key and redeliver manually.";
     };
     readonly rate_limited: {
         readonly defaultStatus: 429;
@@ -439,16 +432,9 @@ export type TestSinkDisposition = z.infer<typeof testSinkDispositionSchema>;
  *   the network for six minutes is not, and every attempt re-signs with a fresh
  *   timestamp, so the transient case self-heals and the permanent case exhausts
  *   the attempt bound honestly.
- * - `invalid_signature`, `invalid_headers` — 401, **retryable since
- *   FXO-1596**, and this entry used to say the opposite. The reasoning it
- *   replaces was that retrying with the same key cannot succeed and a retryable
- *   answer would spend the give-up budget hiding a misconfiguration. That is
- *   true of a mismatch in *our* signing and false of the population that
- *   actually reaches a 401: a receiver holding a credential it has rotated,
- *   expired, or not yet deployed. Those recover on the receiver's next release,
- *   and the delivery after it carries a fresh signature. The misconfiguration
- *   is not hidden either — five identical 401s settle the occurrence 82 seconds
- *   later with the same `inspect_receiver` advice, five rows instead of one.
+ * - `invalid_signature`, `invalid_headers` — 401, terminal since W9-42.
+ *   Repeating a broken credential spends paid attempts without fixing it.
+ *   Correct the key or receiver configuration, then redeliver manually.
  * - `invalid_envelope` — 400, terminal. The bytes authenticated and did not
  *   parse, so the sender and receiver disagree about the contract.
  * - `body_too_large` — 413, terminal, and matched to the `payload_too_large`
@@ -500,8 +486,8 @@ export declare const testSinkSchema: import("zod").ZodObject<{
     id: import("zod").ZodString;
     program: import("zod").ZodObject<{
         behavior: import("zod").ZodEnum<{
-            rate_limited: "rate_limited";
             success: "success";
+            rate_limited: "rate_limited";
             server_error: "server_error";
             client_error: "client_error";
             defer_abandon: "defer_abandon";
@@ -519,8 +505,8 @@ export declare const testSinkSchema: import("zod").ZodObject<{
         retryAfterSeconds: import("zod").ZodOptional<import("zod").ZodNumber>;
         status: import("zod").ZodOptional<import("zod").ZodNumber>;
         then: import("zod").ZodOptional<import("zod").ZodEnum<{
-            rate_limited: "rate_limited";
             success: "success";
+            rate_limited: "rate_limited";
             server_error: "server_error";
             client_error: "client_error";
             defer_abandon: "defer_abandon";
@@ -547,8 +533,8 @@ export declare const testSinkPageSchema: import("zod").ZodObject<{
         id: import("zod").ZodString;
         program: import("zod").ZodObject<{
             behavior: import("zod").ZodEnum<{
-                rate_limited: "rate_limited";
                 success: "success";
+                rate_limited: "rate_limited";
                 server_error: "server_error";
                 client_error: "client_error";
                 defer_abandon: "defer_abandon";
@@ -566,8 +552,8 @@ export declare const testSinkPageSchema: import("zod").ZodObject<{
             retryAfterSeconds: import("zod").ZodOptional<import("zod").ZodNumber>;
             status: import("zod").ZodOptional<import("zod").ZodNumber>;
             then: import("zod").ZodOptional<import("zod").ZodEnum<{
-                rate_limited: "rate_limited";
                 success: "success";
+                rate_limited: "rate_limited";
                 server_error: "server_error";
                 client_error: "client_error";
                 defer_abandon: "defer_abandon";
@@ -598,8 +584,8 @@ export declare const testSinkCreateRequestSchema: import("zod").ZodObject<{
     endpoint: import("zod").ZodString;
     program: import("zod").ZodOptional<import("zod").ZodObject<{
         behavior: import("zod").ZodEnum<{
-            rate_limited: "rate_limited";
             success: "success";
+            rate_limited: "rate_limited";
             server_error: "server_error";
             client_error: "client_error";
             defer_abandon: "defer_abandon";
@@ -617,8 +603,8 @@ export declare const testSinkCreateRequestSchema: import("zod").ZodObject<{
         retryAfterSeconds: import("zod").ZodOptional<import("zod").ZodNumber>;
         status: import("zod").ZodOptional<import("zod").ZodNumber>;
         then: import("zod").ZodOptional<import("zod").ZodEnum<{
-            rate_limited: "rate_limited";
             success: "success";
+            rate_limited: "rate_limited";
             server_error: "server_error";
             client_error: "client_error";
             defer_abandon: "defer_abandon";
@@ -642,8 +628,8 @@ export type TestSinkCreateRequest = z.infer<typeof testSinkCreateRequestSchema>;
  */
 export declare const testSinkDeliverySchema: import("zod").ZodObject<{
     behavior: import("zod").ZodEnum<{
-        rate_limited: "rate_limited";
         success: "success";
+        rate_limited: "rate_limited";
         server_error: "server_error";
         client_error: "client_error";
         defer_abandon: "defer_abandon";
@@ -681,8 +667,8 @@ export type TestSinkDelivery = z.infer<typeof testSinkDeliverySchema>;
 export declare const testSinkDeliveryPageSchema: import("zod").ZodObject<{
     data: import("zod").ZodArray<import("zod").ZodObject<{
         behavior: import("zod").ZodEnum<{
-            rate_limited: "rate_limited";
             success: "success";
+            rate_limited: "rate_limited";
             server_error: "server_error";
             client_error: "client_error";
             defer_abandon: "defer_abandon";
@@ -747,8 +733,8 @@ export type TestSinkDeliveryPage = z.infer<typeof testSinkDeliveryPageSchema>;
  */
 export declare const testSinkDeliveryBodySchema: import("zod").ZodObject<{
     behavior: import("zod").ZodEnum<{
-        rate_limited: "rate_limited";
         success: "success";
+        rate_limited: "rate_limited";
         server_error: "server_error";
         client_error: "client_error";
         defer_abandon: "defer_abandon";
@@ -874,7 +860,7 @@ export declare const CALLBACK_RECEIVER_PROTOCOL: {
                 readonly deferredReport: undefined;
                 readonly receiverActed: false;
                 readonly senderOutcome: "terminal";
-                readonly summary: "Answers a selected 4xx. The sender records a customer refusal, and retries it only when the status is one the receiver may recover from — 401, 403 and 404, listed as `clientErrorStatusesRetried`. The default, 422, is not one of those, so it settles on the first attempt.";
+                readonly summary: "Answers a selected 4xx. Every selected status settles the run on the first attempt, including 401, 403 and 404. Fix the destination, then redeliver manually.";
             };
             readonly defer_abandon: {
                 readonly defaultStatus: 202;
@@ -922,8 +908,8 @@ export declare const CALLBACK_RECEIVER_PROTOCOL: {
                 readonly defaultStatus: 401;
                 readonly deferredReport: undefined;
                 readonly receiverActed: false;
-                readonly senderOutcome: "retryable";
-                readonly summary: "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The sender retries on the receiver's ordinary budget, because the usual cause is a credential the receiver is about to redeploy.";
+                readonly senderOutcome: "terminal";
+                readonly summary: "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The run stops after one attempt; fix the key and redeliver manually.";
             };
             readonly rate_limited: {
                 readonly defaultStatus: 429;
@@ -993,7 +979,7 @@ export declare const CALLBACK_RECEIVER_PROTOCOL: {
             readonly maxRetainedBodyBytes: 4096;
         };
         readonly clientErrorStatuses: readonly [400, 401, 403, 404, 409, 410, 422];
-        readonly clientErrorStatusesRetried: readonly [401, 403, 404];
+        readonly clientErrorStatusesRetried: readonly [];
         readonly deferral: {
             readonly acknowledgement: string;
             readonly note: "A deferring behavior answers this exact body with this status, then reports with the bearer credential from the delivery's own signed envelope — to the one completion address the stage is configured with, which the envelope's own URL must match. A delivery whose envelope carries no completion material, or names a different address, cannot defer, and the sink answers it as an ordinary success instead.";

package/dist/test-sink.js

@@ -125,14 +125,9 @@ export const TEST_SINK_BOUNDS = {
 /**
  * Selected 4xx a sink may answer with.
  *
- * **They are no longer all terminal to the sender, and which are is not this
- * file's decision.** FXO-1596 moved the refusals — a receiver declining *this
- * delivery now* rather than objecting to the message — onto the receiver's
- * ordinary five-failure budget. `TEST_SINK_REFUSAL_STATUSES` below is the
- * subset of this list that the sender will retry, and `test-sink.test.ts`
- * holds it equal to what `classifyStatus` actually says, so a status moved in
- * `CALLBACK_REFUSAL_STATUSES` and not here fails a test rather than teaching an
- * integrator the wrong lesson.
+ * The sender settles these selected statuses on the first attempt. W9-42
+ * stops retrying 401/403/404/405 to avoid billing for a broken configuration.
+ * The broader classification is owned by CALLBACK_REFUSAL_STATUSES.
  *
  * Nothing is removed from what a caller may request: every status here was
  * accepted before and still is.
@@ -143,11 +138,9 @@ export const TEST_SINK_CLIENT_ERROR_STATUSES = [
 /**
  * The statuses above that the sender retries rather than settling on.
  *
- * Exists so an integrator simulating a rotated credential (401) or a WAF rule
- * (403) can see five attempts arrive, and one simulating a malformed body (400)
- * or a duplicate (409) can see exactly one.
+ * Every selected client-error status is terminal under W9-42.
  */
-export const TEST_SINK_REFUSAL_STATUSES = [401, 403, 404];
+export const TEST_SINK_REFUSAL_STATUSES = [];
 /** Selected 5xx a sink may answer with. Each is retryable to the sender. */
 export const TEST_SINK_SERVER_ERROR_STATUSES = [500, 502, 503, 504];
 /**
@@ -275,7 +268,7 @@ export const TEST_SINK_BEHAVIOR_FACTS = {
         deferredReport: undefined,
         receiverActed: false,
         senderOutcome: "terminal",
-        summary: "Answers a selected 4xx. The sender records a customer refusal, and retries it only when the status is one the receiver may recover from — 401, 403 and 404, listed as `clientErrorStatusesRetried`. The default, 422, is not one of those, so it settles on the first attempt.",
+        summary: "Answers a selected 4xx. Every selected status settles the run on the first attempt, including 401, 403 and 404. Fix the destination, then redeliver manually.",
     },
     defer_abandon: {
         defaultStatus: CALLBACK_DEFERRAL_STATUS,
@@ -327,14 +320,9 @@ export const TEST_SINK_BEHAVIOR_FACTS = {
         defaultStatus: 401,
         deferredReport: undefined,
         receiverActed: false,
-        // Retryable since FXO-1596, and the reversal is deliberate. The reasoning
-        // it replaces was that a key mismatch cannot self-heal the way a stale
-        // timestamp does — true of a mismatch caused by our own signing, and wrong
-        // about the population that actually occurs, which is a receiver holding a
-        // credential it has rotated or not yet deployed. That fixes itself on their
-        // next release, and the delivery that follows carries a fresh signature.
-        senderOutcome: "retryable",
-        summary: "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The sender retries on the receiver's ordinary budget, because the usual cause is a credential the receiver is about to redeploy.",
+        // W9-42 stops a broken credential after one billed attempt.
+        senderOutcome: "terminal",
+        summary: "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The run stops after one attempt; fix the key and redeliver manually.",
     },
     rate_limited: {
         defaultStatus: 429,
@@ -514,16 +502,9 @@ export const testSinkDispositionSchema = z.enum(TEST_SINK_DISPOSITIONS);
  *   the network for six minutes is not, and every attempt re-signs with a fresh
  *   timestamp, so the transient case self-heals and the permanent case exhausts
  *   the attempt bound honestly.
- * - `invalid_signature`, `invalid_headers` — 401, **retryable since
- *   FXO-1596**, and this entry used to say the opposite. The reasoning it
- *   replaces was that retrying with the same key cannot succeed and a retryable
- *   answer would spend the give-up budget hiding a misconfiguration. That is
- *   true of a mismatch in *our* signing and false of the population that
- *   actually reaches a 401: a receiver holding a credential it has rotated,
- *   expired, or not yet deployed. Those recover on the receiver's next release,
- *   and the delivery after it carries a fresh signature. The misconfiguration
- *   is not hidden either — five identical 401s settle the occurrence 82 seconds
- *   later with the same `inspect_receiver` advice, five rows instead of one.
+ * - `invalid_signature`, `invalid_headers` — 401, terminal since W9-42.
+ *   Repeating a broken credential spends paid attempts without fixing it.
+ *   Correct the key or receiver configuration, then redeliver manually.
  * - `invalid_envelope` — 400, terminal. The bytes authenticated and did not
  *   parse, so the sender and receiver disagree about the contract.
  * - `body_too_large` — 413, terminal, and matched to the `payload_too_large`

package/generated/v1/callback-receiver.json

@@ -56,7 +56,7 @@
         "defaultStatus": 422,
         "receiverActed": false,
         "senderOutcome": "terminal",
-        "summary": "Answers a selected 4xx. The sender records a customer refusal, and retries it only when the status is one the receiver may recover from — 401, 403 and 404, listed as `clientErrorStatusesRetried`. The default, 422, is not one of those, so it settles on the first attempt."
+        "summary": "Answers a selected 4xx. Every selected status settles the run on the first attempt, including 401, 403 and 404. Fix the destination, then redeliver manually."
       },
       "defer_abandon": {
         "defaultStatus": 202,
@@ -99,8 +99,8 @@
       "invalid_signature": {
         "defaultStatus": 401,
         "receiverActed": false,
-        "senderOutcome": "retryable",
-        "summary": "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The sender retries on the receiver's ordinary budget, because the usual cause is a credential the receiver is about to redeploy."
+        "senderOutcome": "terminal",
+        "summary": "Rejects the delivery as unauthenticated regardless of whether the signature verified. Exercises the key-mismatch path without forging a signature. The run stops after one attempt; fix the key and redeliver manually."
       },
       "rate_limited": {
         "defaultStatus": 429,
@@ -136,7 +136,7 @@
       "maxRetainedBodyBytes": 4096
     },
     "clientErrorStatuses": [400, 401, 403, 404, 409, 410, 422],
-    "clientErrorStatusesRetried": [401, 403, 404],
+    "clientErrorStatusesRetried": [],
     "deferral": {
       "acknowledgement": "{\"greatwait\":{\"status\":\"pending\"}}",
       "note": "A deferring behavior answers this exact body with this status, then reports with the bearer credential from the delivery's own signed envelope — to the one completion address the stage is configured with, which the envelope's own URL must match. A delivery whose envelope carries no completion material, or names a different address, cannot defer, and the sink answers it as an ordinary success instead.",

package/generated/v1/first-value-journey.json

@@ -2,7 +2,7 @@
   "contractVersion": "2026-08-22",
   "prerequisites": [
     {
-      "action": "Accept your GreatWait invitation, sign in, and create a project in the dashboard.",
+      "action": "Sign up at https://app.greatwait.dev/sign-up and name your organization, or sign in. Then create a project in the dashboard, or pick an existing one.",
       "because": "projects.create accepts only a signed-in member, so a project is created by a person rather than by an API credential.",
       "id": "project",
       "title": "A project"
@@ -14,10 +14,10 @@
       "title": "An API credential"
     },
     {
-      "action": "Have an HTTPS URL of your own that answers POST with a 2xx status, and can be reached from the public internet.",
-      "because": "GreatWait delivers your callback to an address you control. It does not offer a shared receiver to try, and it will not send your payload to a third-party inspection service on your behalf.",
+      "action": "Get a test URL from webhook.site, which shows every request it receives, or use your own app's HTTPS URL. It must answer with a 2xx status and be reachable from the public internet.",
+      "because": "GreatWait calls the URL you give it. Don't send real data to a public tester.",
       "id": "receiver",
-      "title": "An HTTPS receiver you control"
+      "title": "A URL to call"
     }
   ],
   "steps": [

package/generated/v1/manifest.json

@@ -7,7 +7,6 @@
     "docs/quickstarts/curl.md",
     "docs/quickstarts/first-value.mjs",
     "docs/quickstarts/first-value.sh",
-    "docs/quickstarts/http-call.mjs",
     "docs/quickstarts/http-calls.md",
     "docs/quickstarts/javascript.md",
     "docs/quickstarts/mcp-reference.md",