@greatwait/contracts 0.1.0-alpha.6 → 0.1.0-alpha.8

package/dist/operations.js

@@ -1,6 +1,7 @@
 import { effectiveCustomerLimitsSchema } from "./effective-limits.js";
 import { z } from "./zod.js";
 import { MEMBER_OPERATIONS } from "./members.js";
+import { PROJECT_NOTIFICATION_OPERATIONS } from "./project-notifications.js";
 import { DATA_EXPORT_OPERATIONS } from "./data-export.js";
 import { ORGANIZATION_LIFECYCLE_OPERATIONS } from "./organization-lifecycle.js";
 import { API_UNUSED_RESPONSE_SCHEMA } from "./operation-definitions.js";
@@ -527,6 +528,7 @@ export const OPERATIONS = [
     },
     ...DATA_EXPORT_OPERATIONS,
     ...MEMBER_OPERATIONS,
+    ...PROJECT_NOTIFICATION_OPERATIONS,
     ...ORGANIZATION_LIFECYCLE_OPERATIONS,
     {
         creates: false,
@@ -2492,7 +2494,7 @@ export const OPERATIONS = [
         creates: true,
         description: globalThis.GREATWAIT_RUNTIME_CONTRACTS_ONLY
             ? ""
-            : "Confirms one exact manual execution-credit quote and creates or replays its durable payment operation. Billing-owner authority and explicit agent approval apply; the Idempotency-Key preserves one payment identity across retries. Manual funding stays outside the automatic-charge ceiling. A browser redirect never grants credit: only authenticated provider reconciliation can move the operation to paid and grant its exact execution credit once, while the operation reports provider-confirmed tax and gross when known.",
+            : "Confirms one exact manual execution-credit quote and creates or replays its durable payment operation. Billing-owner authority and explicit agent approval apply; the Idempotency-Key preserves one payment identity across retries. Manual funding stays outside the automatic-charge ceiling. A browser redirect never grants credit: only authenticated provider reconciliation can move the operation to paid and grant its exact execution credit once, while the operation reports provider-confirmed tax and gross when known. With savePaymentMethod, the payment method used becomes the organization's saved payment method once the payment is confirmed, unless one is already saved.",
         environments: ["live"],
         id: "billing.purchase",
         idempotent: true,

package/dist/policy.d.ts

@@ -47,10 +47,11 @@ export declare function grantableScopes(): readonly Scope[];
  * that will be refused `authentication_required` on the only route it names,
  * for ever, and nothing about the key says so.
  *
- * `projects:read` remains excluded because enumerating an organization is a
- * signed-in member's question. Project writes are different: a key's authority
- * already names exactly the project that rename/archive/delete may affect, so
- * those scopes become usable when their operations do.
+ * Listing an organization's projects stays a signed-in member's question, and
+ * that operation refuses a key. `projects:read` is usable by a key all the same
+ * since W9-54, because reading its own project's notification settings declares
+ * it. A key's authority already names exactly the one project those reads,
+ * and rename/archive/delete, may affect.
  */
 export declare function credentialScopes(): readonly Scope[];
 /** One row of the generated policy matrix. */

package/dist/policy.js

@@ -136,10 +136,11 @@ export function grantableScopes() {
  * that will be refused `authentication_required` on the only route it names,
  * for ever, and nothing about the key says so.
  *
- * `projects:read` remains excluded because enumerating an organization is a
- * signed-in member's question. Project writes are different: a key's authority
- * already names exactly the project that rename/archive/delete may affect, so
- * those scopes become usable when their operations do.
+ * Listing an organization's projects stays a signed-in member's question, and
+ * that operation refuses a key. `projects:read` is usable by a key all the same
+ * since W9-54, because reading its own project's notification settings declares
+ * it. A key's authority already names exactly the one project those reads,
+ * and rename/archive/delete, may affect.
  */
 export function credentialScopes() {
     const usable = new Set(allOperations()

package/dist/project-notifications.d.ts

@@ -0,0 +1,238 @@
+import { z } from "./zod.js";
+/** Per-project/environment preferences. Billing-safety notices are separate. */
+export declare const notificationEmailRecipientsSchema: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+    kind: import("zod").ZodLiteral<"admins">;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    kind: import("zod").ZodLiteral<"members">;
+    memberIds: import("zod").ZodArray<import("zod").ZodString>;
+}, import("zod/v4/core").$strict>], "kind">;
+export declare const notificationEmailSettingsSchema: import("zod").ZodObject<{
+    enabled: import("zod").ZodBoolean;
+    recipients: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+        kind: import("zod").ZodLiteral<"admins">;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        kind: import("zod").ZodLiteral<"members">;
+        memberIds: import("zod").ZodArray<import("zod").ZodString>;
+    }, import("zod/v4/core").$strict>], "kind">;
+    scheduleKinds: import("zod").ZodEnum<{
+        both: "both";
+        "one-shot": "one-shot";
+        recurring: "recurring";
+    }>;
+}, import("zod/v4/core").$strict>;
+export declare const statusWebhookEventSchema: import("zod").ZodEnum<{
+    failed: "failed";
+}>;
+export type StatusWebhookEvent = z.infer<typeof statusWebhookEventSchema>;
+export declare const statusWebhookConfigurationSchema: import("zod").ZodObject<{
+    url: import("zod").ZodString;
+    events: import("zod").ZodArray<import("zod").ZodEnum<{
+        failed: "failed";
+    }>>;
+}, import("zod/v4/core").$strict>;
+export declare const projectNotificationSettingsSchema: import("zod").ZodObject<{
+    project: import("zod").ZodString;
+    environmentKind: import("zod").ZodEnum<{
+        test: "test";
+        live: "live";
+    }>;
+    revision: import("zod").ZodNumber;
+    email: import("zod").ZodObject<{
+        enabled: import("zod").ZodBoolean;
+        recipients: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+            kind: import("zod").ZodLiteral<"admins">;
+        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+            kind: import("zod").ZodLiteral<"members">;
+            memberIds: import("zod").ZodArray<import("zod").ZodString>;
+        }, import("zod/v4/core").$strict>], "kind">;
+        scheduleKinds: import("zod").ZodEnum<{
+            both: "both";
+            "one-shot": "one-shot";
+            recurring: "recurring";
+        }>;
+    }, import("zod/v4/core").$strict>;
+    statusWebhook: import("zod").ZodOptional<import("zod").ZodObject<{
+        url: import("zod").ZodString;
+        events: import("zod").ZodArray<import("zod").ZodEnum<{
+            failed: "failed";
+        }>>;
+        signingKey: import("zod").ZodOptional<import("zod").ZodObject<{
+            id: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>>;
+        revision: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strict>>;
+}, import("zod/v4/core").$strict>;
+export type ProjectNotificationSettings = z.infer<typeof projectNotificationSettingsSchema>;
+export declare const projectNotificationSettingsUpdateRequestSchema: import("zod").ZodObject<{
+    expectedRevision: import("zod").ZodNumber;
+    email: import("zod").ZodOptional<import("zod").ZodObject<{
+        enabled: import("zod").ZodBoolean;
+        recipients: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+            kind: import("zod").ZodLiteral<"admins">;
+        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+            kind: import("zod").ZodLiteral<"members">;
+            memberIds: import("zod").ZodArray<import("zod").ZodString>;
+        }, import("zod/v4/core").$strict>], "kind">;
+        scheduleKinds: import("zod").ZodEnum<{
+            both: "both";
+            "one-shot": "one-shot";
+            recurring: "recurring";
+        }>;
+    }, import("zod/v4/core").$strict>>;
+    statusWebhook: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodObject<{
+        url: import("zod").ZodString;
+        events: import("zod").ZodArray<import("zod").ZodEnum<{
+            failed: "failed";
+        }>>;
+    }, import("zod/v4/core").$strict>>>;
+}, import("zod/v4/core").$strict>;
+export type ProjectNotificationSettingsUpdateRequest = z.infer<typeof projectNotificationSettingsUpdateRequestSchema>;
+export declare const statusSigningKeyRequestSchema: import("zod").ZodObject<{
+    expectedRevision: import("zod").ZodNumber;
+}, import("zod/v4/core").$strict>;
+export declare const statusSigningKeyCreatedSchema: import("zod").ZodObject<{
+    settings: import("zod").ZodObject<{
+        project: import("zod").ZodString;
+        environmentKind: import("zod").ZodEnum<{
+            test: "test";
+            live: "live";
+        }>;
+        revision: import("zod").ZodNumber;
+        email: import("zod").ZodObject<{
+            enabled: import("zod").ZodBoolean;
+            recipients: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+                kind: import("zod").ZodLiteral<"admins">;
+            }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+                kind: import("zod").ZodLiteral<"members">;
+                memberIds: import("zod").ZodArray<import("zod").ZodString>;
+            }, import("zod/v4/core").$strict>], "kind">;
+            scheduleKinds: import("zod").ZodEnum<{
+                both: "both";
+                "one-shot": "one-shot";
+                recurring: "recurring";
+            }>;
+        }, import("zod/v4/core").$strict>;
+        statusWebhook: import("zod").ZodOptional<import("zod").ZodObject<{
+            url: import("zod").ZodString;
+            events: import("zod").ZodArray<import("zod").ZodEnum<{
+                failed: "failed";
+            }>>;
+            signingKey: import("zod").ZodOptional<import("zod").ZodObject<{
+                id: import("zod").ZodString;
+            }, import("zod/v4/core").$strict>>;
+            revision: import("zod").ZodNumber;
+        }, import("zod/v4/core").$strict>>;
+    }, import("zod/v4/core").$strict>;
+    keyId: import("zod").ZodString;
+    secret: import("zod").ZodString;
+    shownOnce: import("zod").ZodLiteral<true>;
+}, import("zod/v4/core").$strict>;
+export type StatusSigningKeyCreated = z.infer<typeof statusSigningKeyCreatedSchema>;
+/** Safe notification payload: no customer request or response content. */
+export declare const statusWebhookPayloadSchema: import("zod").ZodObject<{
+    version: import("zod").ZodLiteral<"2026-10-08">;
+    eventId: import("zod").ZodString;
+    type: import("zod").ZodEnum<{
+        failed: "failed";
+    }>;
+    projectId: import("zod").ZodString;
+    environmentKind: import("zod").ZodEnum<{
+        test: "test";
+        live: "live";
+    }>;
+    scheduleId: import("zod").ZodString;
+    occurrenceId: import("zod").ZodString;
+    occurredAt: import("zod").ZodString;
+    outcomeOrigin: import("zod").ZodEnum<{
+        customer: "customer";
+        platform: "platform";
+    }>;
+    diagnostic: import("zod").ZodOptional<import("zod").ZodString>;
+    statusCode: import("zod").ZodOptional<import("zod").ZodNumber>;
+    pause: import("zod").ZodOptional<import("zod").ZodUnknown>;
+}, import("zod/v4/core").$strip>;
+export type StatusWebhookPayload = z.infer<typeof statusWebhookPayloadSchema>;
+export declare const statusWebhookDeliverySchema: import("zod").ZodObject<{
+    id: import("zod").ZodString;
+    event: import("zod").ZodEnum<{
+        failed: "failed";
+    }>;
+    schedule: import("zod").ZodString;
+    occurrence: import("zod").ZodString;
+    occurredAt: import("zod").ZodString;
+    url: import("zod").ZodString;
+    state: import("zod").ZodEnum<{
+        suppressed: "suppressed";
+        failed: "failed";
+        pending: "pending";
+        delivered: "delivered";
+        delivering: "delivering";
+    }>;
+    attempts: import("zod").ZodNumber;
+    nextAttemptAt: import("zod").ZodOptional<import("zod").ZodString>;
+    lastStatus: import("zod").ZodOptional<import("zod").ZodNumber>;
+    lastError: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strict>;
+export type StatusWebhookDelivery = z.infer<typeof statusWebhookDeliverySchema>;
+export declare const statusWebhookDeliveryPageSchema: import("zod").ZodObject<{
+    data: import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        event: import("zod").ZodEnum<{
+            failed: "failed";
+        }>;
+        schedule: import("zod").ZodString;
+        occurrence: import("zod").ZodString;
+        occurredAt: import("zod").ZodString;
+        url: import("zod").ZodString;
+        state: import("zod").ZodEnum<{
+            suppressed: "suppressed";
+            failed: "failed";
+            pending: "pending";
+            delivered: "delivered";
+            delivering: "delivering";
+        }>;
+        attempts: import("zod").ZodNumber;
+        nextAttemptAt: import("zod").ZodOptional<import("zod").ZodString>;
+        lastStatus: import("zod").ZodOptional<import("zod").ZodNumber>;
+        lastError: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strict>>;
+    nextCursor: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strict>;
+export type StatusWebhookDeliveryPage = z.infer<typeof statusWebhookDeliveryPageSchema>;
+export declare const PROJECT_NOTIFICATION_OPERATIONS: readonly [import("./operations.js").OperationDefinition & {
+    readonly id: "projectnotifications.read";
+}, import("./operations.js").OperationDefinition & {
+    readonly id: "projectnotifications.update";
+} & {
+    readonly request: import("zod").ZodObject<{
+        expectedRevision: import("zod").ZodNumber;
+        email: import("zod").ZodOptional<import("zod").ZodObject<{
+            enabled: import("zod").ZodBoolean;
+            recipients: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+                kind: import("zod").ZodLiteral<"admins">;
+            }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+                kind: import("zod").ZodLiteral<"members">;
+                memberIds: import("zod").ZodArray<import("zod").ZodString>;
+            }, import("zod/v4/core").$strict>], "kind">;
+            scheduleKinds: import("zod").ZodEnum<{
+                both: "both";
+                "one-shot": "one-shot";
+                recurring: "recurring";
+            }>;
+        }, import("zod/v4/core").$strict>>;
+        statusWebhook: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodObject<{
+            url: import("zod").ZodString;
+            events: import("zod").ZodArray<import("zod").ZodEnum<{
+                failed: "failed";
+            }>>;
+        }, import("zod/v4/core").$strict>>>;
+    }, import("zod/v4/core").$strict>;
+}, import("./operations.js").OperationDefinition & {
+    readonly id: "projectnotifications.rotateSigningKey";
+} & {
+    readonly request: import("zod").ZodObject<{
+        expectedRevision: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strict>;
+}, import("./operations.js").OperationDefinition & {
+    readonly id: "statusdeliveries.list";
+}];

package/dist/project-notifications.js

@@ -0,0 +1,236 @@
+import { z } from "./zod.js";
+import { environmentKindSchema } from "./authority.js";
+import { callbackSigningKeyIdSchema, occurrenceIdSchema, projectIdSchema, scheduleIdSchema, } from "./identifiers.js";
+import { memberIdSchema } from "./members.js";
+import { timestampSchema } from "./time.js";
+import { pageRequestSchema, requiredIdempotencyRequestHeaderSchema, } from "./protocol.js";
+import { API_UNUSED_RESPONSE_SCHEMA, defineOperations, } from "./operation-definitions.js";
+/** Per-project/environment preferences. Billing-safety notices are separate. */
+export const notificationEmailRecipientsSchema = z.discriminatedUnion("kind", [
+    z.strictObject({ kind: z.literal("admins") }),
+    z.strictObject({
+        kind: z.literal("members"),
+        memberIds: z
+            .array(memberIdSchema)
+            .min(1)
+            .max(100)
+            .refine((ids) => new Set(ids).size === ids.length, "members must be unique"),
+    }),
+]);
+export const notificationEmailSettingsSchema = z.strictObject({
+    enabled: z.boolean(),
+    recipients: notificationEmailRecipientsSchema,
+    scheduleKinds: z.enum(["both", "one-shot", "recurring"]),
+});
+export const statusWebhookEventSchema = z.enum(["failed"]);
+export const statusWebhookConfigurationSchema = z.strictObject({
+    url: z.string().url().max(2_048),
+    events: z
+        .array(statusWebhookEventSchema)
+        .min(1)
+        .max(1)
+        .refine((events) => new Set(events).size === events.length, "events must be unique"),
+});
+export const projectNotificationSettingsSchema = z.strictObject({
+    project: projectIdSchema,
+    environmentKind: environmentKindSchema,
+    revision: z.number().int().positive(),
+    email: notificationEmailSettingsSchema,
+    statusWebhook: statusWebhookConfigurationSchema
+        .extend({
+        signingKey: z.strictObject({ id: callbackSigningKeyIdSchema }).optional(),
+        revision: z.number().int().positive(),
+    })
+        .optional(),
+});
+export const projectNotificationSettingsUpdateRequestSchema = z
+    .strictObject({
+    expectedRevision: z.number().int().positive(),
+    email: notificationEmailSettingsSchema.optional(),
+    statusWebhook: statusWebhookConfigurationSchema.nullable().optional(),
+})
+    .refine((request) => request.email !== undefined || request.statusWebhook !== undefined, "choose settings to change");
+export const statusSigningKeyRequestSchema = z.strictObject({
+    expectedRevision: z.number().int().positive(),
+});
+export const statusSigningKeyCreatedSchema = z.strictObject({
+    settings: projectNotificationSettingsSchema,
+    keyId: callbackSigningKeyIdSchema,
+    secret: z.string().min(1),
+    shownOnce: z.literal(true),
+});
+/** Safe notification payload: no customer request or response content. */
+export const statusWebhookPayloadSchema = z.object({
+    version: z.literal("2026-10-08"),
+    eventId: z.string().min(1).max(255),
+    type: statusWebhookEventSchema,
+    projectId: projectIdSchema,
+    environmentKind: environmentKindSchema,
+    scheduleId: scheduleIdSchema,
+    occurrenceId: occurrenceIdSchema,
+    occurredAt: timestampSchema,
+    outcomeOrigin: z.enum(["platform", "customer"]),
+    diagnostic: z.string().max(512).optional(),
+    statusCode: z.number().int().min(100).max(599).optional(),
+    pause: z.unknown().optional(),
+});
+export const statusWebhookDeliverySchema = z.strictObject({
+    id: z.string().min(1).max(255),
+    event: statusWebhookEventSchema,
+    schedule: scheduleIdSchema,
+    occurrence: occurrenceIdSchema,
+    occurredAt: timestampSchema,
+    url: z.string().url(),
+    state: z.enum(["pending", "delivering", "delivered", "failed", "suppressed"]),
+    attempts: z.number().int().nonnegative(),
+    nextAttemptAt: timestampSchema.optional(),
+    lastStatus: z.number().int().min(100).max(599).optional(),
+    lastError: z.string().max(128).optional(),
+});
+export const statusWebhookDeliveryPageSchema = z.strictObject({
+    data: z.array(statusWebhookDeliverySchema),
+    nextCursor: z.string().min(1).optional(),
+});
+const globals = globalThis;
+const settings = {
+    project: "proj_01h8xyz9k2m4n6p8r0t2v4w6y8",
+    environmentKind: "live",
+    revision: 1,
+    email: {
+        enabled: true,
+        recipients: { kind: "admins" },
+        scheduleKinds: "both",
+    },
+};
+const common = {
+    creates: false,
+    principals: ["api-credential", "oauth", "session"],
+    sessionAuthority: "headers",
+    surfaces: ["api", "mock"],
+    problems: ["invalid_request", "not_found", "service_unavailable"],
+};
+export const PROJECT_NOTIFICATION_OPERATIONS = defineOperations([
+    {
+        ...common,
+        id: "projectnotifications.read",
+        method: "GET",
+        path: "/v1/projects/{projectId}/notification-settings",
+        idempotent: true,
+        mutates: false,
+        mcp: { kind: "tool", destructive: false, openWorld: false },
+        scopes: ["projects:read"],
+        response: globals.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : projectNotificationSettingsSchema,
+        example: globals.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES ? {} : settings,
+        summary: globals.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Read delivery notification settings",
+        description: globals.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Read the verified project and environment's email failure alerts and failure webhook preferences. Defaults are email on to current organization admins and both one-shot and recurring schedules. Every terminal failed occurrence creates a separate email for each eligible recipient. Signing secrets are absent. Manual redelivery does not repeat occurrence lifecycle events.",
+    },
+    {
+        ...common,
+        id: "projectnotifications.update",
+        method: "PATCH",
+        path: "/v1/projects/{projectId}/notification-settings",
+        idempotent: true,
+        mutates: true,
+        mcp: { kind: "tool", destructive: false, openWorld: true },
+        scopes: ["projects:administer"],
+        problems: [
+            ...common.problems,
+            "revision_conflict",
+            "idempotency_key_reused",
+            "rate_limited",
+        ],
+        requestHeaders: requiredIdempotencyRequestHeaderSchema,
+        request: projectNotificationSettingsUpdateRequestSchema,
+        requestExample: globals.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { expectedRevision: 1, email: settings.email },
+        response: globals.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : projectNotificationSettingsSchema,
+        example: globals.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { ...settings, revision: 2 },
+        summary: globals.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Update delivery notification settings",
+        description: globals.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "An admin updates this project's environment preferences at an expected revision. Selected recipients must be current organization members; arbitrary email addresses are not accepted. Null disables the status webhook. Changing URL or filters never reveals a signing secret. Mint the first key through the secure signing-key operation before webhook delivery starts. Failed means final unsuccessful settlement. Redelivery never repeats it. Failed-event webhook calls and their retries are free. Every failed occurrence is emailed separately; no summary window suppresses failures.",
+    },
+    {
+        ...common,
+        id: "projectnotifications.rotateSigningKey",
+        method: "POST",
+        path: "/v1/projects/{projectId}/notification-settings/status-signing-key",
+        idempotent: false,
+        mutates: true,
+        mcp: {
+            kind: "unavailable",
+            reason: "Minting or rotating returns a one-time signing secret. MCP has no negotiated secure-result channel that keeps it out of ordinary tool history. Configure preferences with projectnotifications_update, then use the dashboard or an authenticated REST/SDK/CLI client for the secret.",
+        },
+        scopes: ["projects:administer"],
+        problems: [
+            ...common.problems,
+            "revision_conflict",
+            "state_conflict",
+            "capability_not_configured",
+        ],
+        request: statusSigningKeyRequestSchema,
+        requestExample: globals.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : { expectedRevision: 1 },
+        response: globals.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : statusSigningKeyCreatedSchema,
+        example: globals.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
+            ? {}
+            : {
+                settings: {
+                    ...settings,
+                    revision: 2,
+                    statusWebhook: {
+                        url: "https://hooks.example.com/status",
+                        events: ["failed"],
+                        revision: 2,
+                        signingKey: { id: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8" },
+                    },
+                },
+                keyId: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8",
+                secret: "ptsk_live_<the-one-time-status-secret>",
+                shownOnce: true,
+            },
+        summary: globals.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "Mint or rotate the status webhook signing key",
+        description: globals.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "An admin mints the first key or replaces the current key for an already configured status webhook at an expected revision. The secret appears only in this successful response and cannot be read back. A lost response requires a fresh revision read and another rotation. Queued deliveries using the replaced signing key are suppressed. The request is not automatically replayable; stale retries are refused. The signature covers the exact emitted body bytes.",
+    },
+    {
+        ...common,
+        id: "statusdeliveries.list",
+        method: "GET",
+        path: "/v1/projects/{projectId}/status-deliveries",
+        idempotent: true,
+        mutates: false,
+        mcp: { kind: "tool", destructive: false, openWorld: false },
+        scopes: ["occurrences:read"],
+        query: pageRequestSchema,
+        response: globals.GREATWAIT_API_REQUEST_REGISTRY
+            ? API_UNUSED_RESPONSE_SCHEMA
+            : statusWebhookDeliveryPageSchema,
+        example: globals.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES ? {} : { data: [] },
+        summary: globals.GREATWAIT_API_REQUEST_REGISTRY
+            ? ""
+            : "List failure webhook deliveries",
+        description: globals.GREATWAIT_RUNTIME_CONTRACTS_ONLY
+            ? ""
+            : "Read the verified project and environment's failure delivery trail, including retry state and actual outbound calls. Failed events and every retry are free. Status delivery failures never create another notification or change the customer's schedule outcome. Customer callback contents and signing secrets are absent.",
+    },
+]);