@greatwait/contracts 0.3.0 → 0.3.2

package/dist/attempt-diagnostics.d.ts

@@ -2,7 +2,7 @@ import type { Attempt, AttemptResponse } from "./scheduling.js";
 /** Render customer-controlled text without terminal escapes, controls or bidi overrides. */
 export declare function sanitizedDiagnosticText(value: string): string;
 export declare function responseBodySentence(state: AttemptResponse["bodyState"], noServerResponse?: boolean): string;
-export declare function requestCaptureSentence(state: Attempt["requestState"], inProgress?: boolean): string;
+export declare function requestCaptureSentence(state: Attempt["requestState"], inProgress?: boolean, unavailable?: Attempt["requestUnavailable"]): string;
 export declare function attemptStatusGuidance(status: number | undefined): string | undefined;
 /** A safe text preview, independently of the exact retained/download bytes. */
 export declare function diagnosticBodyText(body: NonNullable<AttemptResponse["body"]>): string | undefined;

package/dist/attempt-diagnostics.js

@@ -26,7 +26,19 @@ export function responseBodySentence(state, noServerResponse = false) {
             return "What the server answered:";
     }
 }
-export function requestCaptureSentence(state, inProgress = false) {
+export function requestCaptureSentence(state, inProgress = false, unavailable) {
+    switch (unavailable) {
+        case "schedule_changed":
+            return "This schedule was edited after this run, so the request it sent can't be shown.";
+        case "endpoint_changed":
+            return "This run's endpoint was edited after it ran, so the request it sent can't be shown.";
+        case "endpoint_deleted":
+            return "This run's endpoint has been deleted, so the request it sent can't be shown.";
+        case "payload_deleted":
+            return "This schedule's payload has been deleted, so the request this run sent can't be shown.";
+        case undefined:
+            break;
+    }
     return state === "expired"
         ? "The request body has expired. Request evidence is kept for at most 3 days and never beyond payload retention."
         : inProgress

package/dist/attempt-search.d.ts

@@ -107,6 +107,7 @@ export declare const projectAttemptSearchResultSchema: import("zod").ZodObject<{
         id: import("zod").ZodString;
         plannedFor: import("zod").ZodString;
         schedule: import("zod").ZodString;
+        scheduleName: import("zod").ZodOptional<import("zod").ZodString>;
         sequence: import("zod").ZodNumber;
         settledAt: import("zod").ZodOptional<import("zod").ZodString>;
         state: import("zod").ZodEnum<{
@@ -191,6 +192,7 @@ export declare const projectAttemptPageSchema: import("zod").ZodObject<{
             id: import("zod").ZodString;
             plannedFor: import("zod").ZodString;
             schedule: import("zod").ZodString;
+            scheduleName: import("zod").ZodOptional<import("zod").ZodString>;
             sequence: import("zod").ZodNumber;
             settledAt: import("zod").ZodOptional<import("zod").ZodString>;
             state: import("zod").ZodEnum<{

package/dist/attempt-search.js

@@ -3,9 +3,9 @@ import { pageRequestSchema, pageSchema } from "./protocol.js";
 import { endpointIdSchema, scheduleIdSchema } from "./identifiers.js";
 import { externalIdentifierSchema, scheduleTagSchema, scheduleTagsSchema, } from "./host-correlation.js";
 import { timestampSchema } from "./time.js";
-import { attemptSchema, attemptStateSchema, attemptDiagnosticSchema, occurrenceSchema, scheduleNameSchema, } from "./scheduling.js";
+import { attemptSearchSummaryShape, attemptStateSchema, attemptDiagnosticSchema, occurrenceSchema, scheduleNameSchema, } from "./scheduling.js";
 /** Actual attempt start, never occurrence planned time. Boundaries are [start, end). */
-export const projectAttemptSearchRequestSchema = pageRequestSchema
+export const projectAttemptSearchRequestSchema = /* @__PURE__ */ (() => pageRequestSchema
     .extend({
     startedFrom: timestampSchema,
     startedBefore: timestampSchema,
@@ -21,7 +21,7 @@ export const projectAttemptSearchRequestSchema = pageRequestSchema
     .refine((value) => Date.parse(value.startedFrom) < Date.parse(value.startedBefore), {
     message: "must be later than startedFrom",
     path: ["startedBefore"],
-});
+}))();
 export function normalizeAttemptSelection(request) {
     return Object.fromEntries(Object.entries(request).filter(([key, value]) => key !== "cursor" && key !== "limit" && value !== undefined));
 }
@@ -68,19 +68,19 @@ export function parseProjectAttemptSearchRequest(query) {
         };
 }
 /** Safe search summary: content and secret-bearing HTTP evidence is detail-only. */
-export const projectAttemptSearchResultSchema = z.object({
+export const projectAttemptSearchResultSchema = /* @__PURE__ */ (() => z.object({
     attempt: z.object({
-        id: attemptSchema.shape.id,
-        attemptNumber: attemptSchema.shape.attemptNumber,
-        occurrence: attemptSchema.shape.occurrence,
-        startedAt: attemptSchema.shape.startedAt,
-        state: attemptSchema.shape.state,
-        classifiedAt: attemptSchema.shape.classifiedAt,
-        durationMs: attemptSchema.shape.durationMs,
-        responseStatus: attemptSchema.shape.responseStatus,
-        diagnostic: attemptSchema.shape.diagnostic,
-        remediation: attemptSchema.shape.remediation,
-        trigger: attemptSchema.shape.trigger,
+        id: attemptSearchSummaryShape.id,
+        attemptNumber: attemptSearchSummaryShape.attemptNumber,
+        occurrence: attemptSearchSummaryShape.occurrence,
+        startedAt: attemptSearchSummaryShape.startedAt,
+        state: attemptSearchSummaryShape.state,
+        classifiedAt: attemptSearchSummaryShape.classifiedAt,
+        durationMs: attemptSearchSummaryShape.durationMs,
+        responseStatus: attemptSearchSummaryShape.responseStatus,
+        diagnostic: attemptSearchSummaryShape.diagnostic,
+        remediation: attemptSearchSummaryShape.remediation,
+        trigger: attemptSearchSummaryShape.trigger,
     }),
     occurrence: occurrenceSchema,
     schedule: z.object({
@@ -90,9 +90,12 @@ export const projectAttemptSearchResultSchema = z.object({
         external_identifier: externalIdentifierSchema.optional(),
         tags: scheduleTagsSchema.optional(),
     }),
-});
-export const projectAttemptPageSchema = pageSchema(projectAttemptSearchResultSchema).extend({
+}))();
+export const projectAttemptPageSchema = /* @__PURE__ */ (() => pageSchema(projectAttemptSearchResultSchema).extend({
     freshness: z.object({ kind: z.literal("authoritative") }),
     /** Normal plan horizons; older live/retained records may still be returned. */
-    retention: z.object({ from: timestampSchema, detailsFrom: timestampSchema }),
-});
+    retention: z.object({
+        from: timestampSchema,
+        detailsFrom: timestampSchema,
+    }),
+}))();

package/dist/authority.js

@@ -26,13 +26,13 @@ import { environmentIdSchema, organizationIdSchema, projectIdSchema, } from "./i
  * third if one is ever added.
  */
 export const ENVIRONMENT_KINDS_IN_ORDER = ["test", "live"];
-export const environmentKindSchema = z.enum(ENVIRONMENT_KINDS_IN_ORDER);
-export const authoritySchema = z.object({
+export const environmentKindSchema = /* @__PURE__ */ (() => z.enum(ENVIRONMENT_KINDS_IN_ORDER))();
+export const authoritySchema = /* @__PURE__ */ (() => z.object({
     environment: environmentIdSchema,
     environmentKind: environmentKindSchema,
     organization: organizationIdSchema,
     project: projectIdSchema,
-});
+}))();
 /**
  * The initial scope vocabulary. Scopes are `resource:action`, lower case, and
  * additive — a new scope is a compatible change, removing or narrowing one is
@@ -126,7 +126,7 @@ export const SCOPES = [
      */
     "usage:read",
 ];
-export const scopeSchema = z.enum(SCOPES);
+export const scopeSchema = /* @__PURE__ */ (() => z.enum(SCOPES))();
 /** Read scopes implied by the matching write scope. */
 const IMPLIED_BY_WRITE = {
     "credentials:write": "credentials:read",
@@ -170,13 +170,13 @@ export function effectiveScopes(granted) {
  *   gives for one that does not exist.
  */
 export const PRINCIPAL_KINDS = ["api-credential", "oauth", "session"];
-export const principalKindSchema = z.enum(PRINCIPAL_KINDS);
-export const principalSchema = z.object({
+export const principalKindSchema = /* @__PURE__ */ (() => z.enum(PRINCIPAL_KINDS))();
+export const principalSchema = /* @__PURE__ */ (() => z.object({
     authority: authoritySchema,
     scopes: z.array(scopeSchema).min(1),
     /** How the principal was established, for audit and refusal messages. */
     via: principalKindSchema,
-});
+}))();
 /**
  * Whether a principal may act on an already-resolved resource.
  *
@@ -298,10 +298,10 @@ export const SESSION_AUTHORITY_HEADERS = {
  * know whether a scope is implied can apply the same published expansion the
  * service does.
  */
-export const credentialContextSchema = z.object({
+export const credentialContextSchema = /* @__PURE__ */ (() => z.object({
     environmentKind: environmentKindSchema,
     /** How this credential authenticated. Never `session`: see the operation. */
     principal: z.enum(["api-credential", "oauth"]),
     project: projectIdSchema,
     scopes: z.array(scopeSchema).min(1),
-});
+}))();

package/dist/billing.d.ts

@@ -502,6 +502,40 @@ export declare const billingNoticeRecoveryPathSchema: import("zod").ZodUnion<rea
 }>, import("zod").ZodString]>;
 export declare const billingNoticeSchema: z.ZodType<BillingNotice>;
 export declare const billingNoticePageSchema: z.ZodType<BillingNoticePage>;
+/**
+ * A billing-notice listing (W9-79): the page, and optionally one state. With
+ * `state=active` the page holds only notices still open, so a reader counting
+ * them is not cut short by a run of resolved ones newer than they are.
+ */
+export declare const billingNoticeListRequestSchema: import("zod").ZodObject<{
+    cursor: import("zod").ZodOptional<import("zod").ZodString>;
+    limit: import("zod").ZodDefault<import("zod").ZodNumber>;
+    state: import("zod").ZodOptional<import("zod").ZodEnum<{
+        active: "active";
+        resolved: "resolved";
+    }>>;
+}, import("zod/v4/core").$strip>;
+export type BillingNoticeListRequest = z.infer<typeof billingNoticeListRequestSchema>;
+/** The notice kinds a delivery failure writes (W9-54) and dismiss resolves. */
+export declare const DELIVERY_FAILURE_NOTICE_KINDS: readonly ["delivery-failed", "schedule-auto-paused"];
+/**
+ * Dismiss this project's delivery-failure notices (W9-79): every active one
+ * in the principal's project and environment that occurred at or before
+ * `through`, for every member at once. `through` is the newest notice the
+ * caller saw, so a failure that arrives after it stays.
+ */
+export interface BillingNoticeDismissRequest {
+    readonly through: string;
+}
+export declare const billingNoticeDismissRequestSchema: z.ZodType<BillingNoticeDismissRequest>;
+export interface BillingNoticeDismissResult {
+    /** How many notices this request resolved; 0 when none were still open. */
+    readonly dismissed: number;
+    readonly freshness: {
+        readonly kind: "authoritative";
+    };
+}
+export declare const billingNoticeDismissResultSchema: z.ZodType<BillingNoticeDismissResult>;
 export declare const billingNotificationSettingsSchema: z.ZodType<BillingNotificationSettings>;
 export declare const billingNotificationSettingsUpdateRequestSchema: z.ZodType<BillingNotificationSettingsUpdateRequest>;
 export declare const billingRefundRequestCreateSchema: import("zod").ZodObject<{
@@ -665,6 +699,18 @@ export declare const billingSummarySchema: import("zod").ZodObject<{
             enforced: "enforced";
         }>;
     }, import("zod/v4/core").$strip>;
+    attemptPrice: import("zod").ZodOptional<import("zod").ZodObject<{
+        bulk: import("zod").ZodObject<{
+            currency: import("zod").ZodLiteral<"USD">;
+            microdollars: import("zod").ZodString;
+            scale: import("zod").ZodLiteral<6>;
+        }, import("zod/v4/core").$strip>;
+        realtime: import("zod").ZodObject<{
+            currency: import("zod").ZodLiteral<"USD">;
+            microdollars: import("zod").ZodString;
+            scale: import("zod").ZodLiteral<6>;
+        }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>>;
     blockingReasons: import("zod").ZodArray<import("zod").ZodEnum<{
         "billing-state-missing": "billing-state-missing";
         "billing-account-closed": "billing-account-closed";

package/dist/billing.js

@@ -485,6 +485,26 @@ export const billingNoticeSchema = z
 export const billingNoticePageSchema = pageSchema(billingNoticeSchema).extend({
     freshness: z.object({ kind: z.literal("authoritative") }),
 });
+/**
+ * A billing-notice listing (W9-79): the page, and optionally one state. With
+ * `state=active` the page holds only notices still open, so a reader counting
+ * them is not cut short by a run of resolved ones newer than they are.
+ */
+export const billingNoticeListRequestSchema = pageRequestSchema.extend({
+    state: z.enum(["active", "resolved"]).optional(),
+});
+/** The notice kinds a delivery failure writes (W9-54) and dismiss resolves. */
+export const DELIVERY_FAILURE_NOTICE_KINDS = [
+    "delivery-failed",
+    "schedule-auto-paused",
+];
+export const billingNoticeDismissRequestSchema = z.object({ through: timestampSchema }).strict();
+export const billingNoticeDismissResultSchema = z
+    .object({
+    dismissed: z.number().int().nonnegative(),
+    freshness: z.object({ kind: z.literal("authoritative") }).strict(),
+})
+    .strict();
 export const billingNotificationSettingsSchema = z
     .object({
     criticalEmail: z.literal(true),
@@ -616,6 +636,15 @@ export const billingSummarySchema = z
         boundary: timestampSchema,
         mode: z.enum(BILLING_ACTIVATION_MODES),
     }),
+    attemptPrice: z
+        .object({
+        bulk: nonnegativeExactMoneySchema,
+        realtime: nonnegativeExactMoneySchema,
+    })
+        .meta({
+        description: "What one billable delivery attempt costs under priceVersion, by latency class: the same tariff the usage meter charges. Retries and failed attempts that reach the receiver are billable; attempts answered with 429 and attempts this service could not start are not.",
+    })
+        .optional(),
     blockingReasons: z.array(z.enum(BILLING_BLOCK_REASONS)),
     budgetPolicy: billingBudgetPolicySchema,
     closedAt: timestampSchema.optional(),

package/dist/callback-safety.js

@@ -146,8 +146,12 @@ const FORBIDDEN_NAME_SUFFIXES = [
  * **The apex joined it at W9-05**, when the marketing site started serving
  * `greatwait.dev` itself rather than only forwarding it. It is an address this
  * product answers on as itself, so it is refused on the same argument.
+ *
+ * **W13-03 nests the stage** (`api.staging.greatwait.dev`), so a runtime label
+ * may carry one further label before the zone. The sink keeps its absence:
+ * `sink.staging.greatwait.dev` begins with no runtime label and is accepted.
  */
-const GREATWAIT_RUNTIME_NAME = /^(?:greatwait-(?:api|app|docs|scheduler|contract-mock|postgres-runtime)(?:-[a-z0-9-]+)?\.flowxo\.com|(?:api|app|docs|scheduler|contract-mock|postgres-runtime)(?:-[a-z0-9-]+)?\.greatwait\.dev|greatwait\.dev)$/u;
+const GREATWAIT_RUNTIME_NAME = /^(?:greatwait-(?:api|app|docs|scheduler|contract-mock|postgres-runtime)(?:-[a-z0-9-]+)?\.flowxo\.com|(?:api|app|docs|scheduler|contract-mock|postgres-runtime)(?:-[a-z0-9-]+)?(?:\.[a-z0-9-]+)?\.greatwait\.dev|greatwait\.dev)$/u;
 const GREATWAIT_PROVIDER_NAME = /^greatwait-(?:api|app|docs|marketing|scheduler|contract-mock|postgres-runtime)(?:-[a-z0-9-]+)?(?:\..+)?\.(?:workers|pages)\.dev$/u;
 const GREATWAIT_WORKER_NAME = /^greatwait-(?:api|app|docs|marketing|scheduler|contract-mock|postgres-runtime)(?:-[a-z0-9-]+)?$/u;
 /** Evaluate the URL-only half of the callback destination policy. */

package/dist/configuration.d.ts

@@ -11,8 +11,8 @@ export declare const CONFIGURATION_DEFAULTS: Readonly<{
     attemptDetailRetentionSeconds: 604800;
     forecastHorizonSeconds: number;
     historyRetentionSeconds: 1209600;
-    inlinePayloadBytes: 65536;
-    payloadRetentionSeconds: 259200;
+    inlinePayloadBytes: 8192;
+    payloadRetentionSeconds: 1209600;
     usageWindowDays: 366;
 }>;
 export type DeploymentContext = "local" | "staging" | "production";
@@ -51,6 +51,10 @@ export interface ConfigurationSetting {
     readonly exhaustion: string;
     readonly visibility: "customer";
 }
+/** Bounds and edit authority shared by validation and the descriptive catalog. */
+export type ConfigurationRule = Pick<ConfigurationSetting, "key" | "unit" | "minimum" | "maximum" | "layers">;
+export declare const CONFIGURATION_RULES: readonly ConfigurationRule[];
+/** Descriptive metadata is only initialized by catalog consumers. */
 export declare const CONFIGURATION_CATALOG: readonly ConfigurationSetting[];
 export declare function validateConfigurationValues(value: unknown, scope: ConfigurationScope): ConfigurationValues;
 export interface EffectiveConfiguration {

package/dist/configuration.js

@@ -18,13 +18,16 @@ export const CONFIGURATION_DEFAULTS = Object.freeze({
     attemptDetailRetentionSeconds: 604_800,
     forecastHorizonSeconds: MAX_FORECAST_HORIZON_SECONDS,
     historyRetentionSeconds: 1_209_600,
-    inlinePayloadBytes: MAX_INLINE_PAYLOAD_BYTES,
-    payloadRetentionSeconds: 259_200,
+    inlinePayloadBytes: 8_192,
+    // 14 days, with attempt history (W9-91, operator decision 2026-10-26): a
+    // successful run's sent request is rebuilt from the payload, and
+    // redelivery needs it, for as long as the run is in history.
+    payloadRetentionSeconds: 1_209_600,
     usageWindowDays: MAX_USAGE_WINDOW_DAYS,
 });
 const allowanceLayers = ["default", "global", "organization"];
 const deploymentLayers = ["default", "deployment"];
-export const CONFIGURATION_CATALOG = Object.freeze([
+export const CONFIGURATION_RULES = Object.freeze([
     ...[
         "bulkMaxTargets",
         "bulkExecutionLifetimeSeconds",
@@ -37,72 +40,38 @@ export const CONFIGURATION_CATALOG = Object.freeze([
         "bulkCarrierBatchSize",
     ].map((key) => ({
         key,
-        type: "integer",
         unit: key.endsWith("Seconds") ? "seconds" : "count",
-        default: CONFIGURATION_DEFAULTS[key],
         minimum: 1,
         maximum: BULK_CONFIGURATION_MAXIMA[key],
         layers: allowanceLayers,
-        change: "live",
-        visibility: "customer",
-        rationale: "Owner-approved bounded bulk preparation and execution. Backlog limits do not increase in-flight work or ordinary delivery quotas; result retention is additionally capped by effective history retention.",
-        enforcement: ["bulk-operations"],
-        exhaustion: "Oversized selections refuse; deadlines expire remaining work; durable checkpoints preserve completed effects.",
     })),
     {
         key: "inlinePayloadBytes",
-        type: "integer",
         unit: "bytes",
-        default: CONFIGURATION_DEFAULTS.inlinePayloadBytes,
         minimum: 0,
         maximum: MAX_INLINE_PAYLOAD_BYTES,
         layers: allowanceLayers,
-        change: "live",
-        rationale: "The operator removed the lower storage allowance. Default is the existing public payload envelope; a deliberate override may narrow it. Unbounded bodies would exceed the existing SQL and receiver representations.",
-        enforcement: ["authority-service", "schedule-draft"],
-        exhaustion: "Local validation and authoritative plan-limit-reached",
-        visibility: "customer",
     },
     {
         key: "partitionKeyCeiling",
-        type: "integer",
         unit: "count",
         minimum: 1,
         maximum: MAX_PARTITION_KEY_CEILING,
         layers: allowanceLayers,
-        change: "live",
-        rationale: "No inherited count cap. A deliberate override uses indexed successor seeks bounded to ceiling plus one; its supported bound preserves the existing transaction work envelope.",
-        enforcement: ["authority-service", "postgres-repository"],
-        exhaustion: "New keys refused; existing keys and committed schedules preserved",
-        visibility: "customer",
     },
     {
         key: "forecastHorizonSeconds",
-        type: "integer",
         unit: "seconds",
-        default: CONFIGURATION_DEFAULTS.forecastHorizonSeconds,
         minimum: 60,
         maximum: MAX_FORECAST_HORIZON_SECONDS,
         layers: allowanceLayers,
-        change: "live",
-        rationale: "The operator removed the six-hour allowance. Default is the existing public forecast horizon; explicit work exhaustion cannot masquerade as complete coverage.",
-        enforcement: ["authority-reads"],
-        exhaustion: "Window clipped; exhausted work returns explicit incomplete refusal",
-        visibility: "customer",
     },
     {
         key: "usageWindowDays",
-        type: "integer",
         unit: "days",
-        default: CONFIGURATION_DEFAULTS.usageWindowDays,
         minimum: 1,
         maximum: MAX_USAGE_WINDOW_DAYS,
         layers: allowanceLayers,
-        change: "live",
-        rationale: "The operator removed the 31-day allowance. Default is the existing public usage envelope; it does not extend retention or restore purged data.",
-        enforcement: ["authority-reads"],
-        exhaustion: "Read window constrained to effective policy",
-        visibility: "customer",
     },
     ...[
         "attemptDetailRetentionSeconds",
@@ -110,32 +79,104 @@ export const CONFIGURATION_CATALOG = Object.freeze([
         "payloadRetentionSeconds",
     ].map((key) => ({
         key,
-        type: "integer",
         unit: "seconds",
-        default: CONFIGURATION_DEFAULTS[key],
         minimum: 0,
         maximum: 9_007_199_254_740,
         layers: deploymentLayers,
-        change: "deployment",
-        rationale: "Accepted retention policy, separately governed. Stored schedule durations preserve committed policy; increases cannot restore purged data.",
-        enforcement: ["authority-service", "authority-reads", "retention"],
-        exhaustion: "Read cutoff and bounded purge; no organization override",
-        visibility: "customer",
     })),
     {
         key: "pageLimit",
-        type: "integer",
         unit: "count",
         minimum: PUBLIC_PAGE_SIZE.min,
         maximum: PUBLIC_PAGE_SIZE.max,
         layers: deploymentLayers,
-        change: "deployment",
-        rationale: "Public page protocol maximum; continuation preserves completeness.",
-        enforcement: ["authority-reads"],
-        exhaustion: "Bounded page with continuation",
-        visibility: "customer",
     },
 ]);
+/** Descriptive metadata is only initialized by catalog consumers. */
+export const CONFIGURATION_CATALOG = 
+/* @__PURE__ */ (() => {
+    const metadata = [
+        ...[
+            "bulkMaxTargets",
+            "bulkExecutionLifetimeSeconds",
+            "bulkPreviewLifetimeSeconds",
+            "bulkResultRetentionSeconds",
+            "bulkBatchSize",
+            "bulkWorkerConcurrency",
+            "bulkActiveJobLimit",
+            "bulkWorkBudgetSeconds",
+            "bulkCarrierBatchSize",
+        ].map((key) => ({
+            key,
+            change: "live",
+            visibility: "customer",
+            rationale: "Owner-approved bounded bulk preparation and execution. Backlog limits do not increase in-flight work or ordinary delivery quotas; result retention is additionally capped by effective history retention.",
+            enforcement: ["bulk-operations"],
+            exhaustion: "Oversized selections refuse; deadlines expire remaining work; durable checkpoints preserve completed effects.",
+        })),
+        {
+            key: "inlinePayloadBytes",
+            change: "live",
+            rationale: "The default is 8 KiB for ordinary callbacks. An audited organization override may raise it up to the 64 KiB protocol maximum when a customer needs a larger payload. Unbounded bodies would exceed the existing SQL and receiver representations.",
+            enforcement: ["authority-service", "schedule-draft"],
+            exhaustion: "Local validation and authoritative plan-limit-reached",
+            visibility: "customer",
+        },
+        {
+            key: "partitionKeyCeiling",
+            change: "live",
+            rationale: "No inherited count cap. A deliberate override uses indexed successor seeks bounded to ceiling plus one; its supported bound preserves the existing transaction work envelope.",
+            enforcement: ["authority-service", "postgres-repository"],
+            exhaustion: "New keys refused; existing keys and committed schedules preserved",
+            visibility: "customer",
+        },
+        {
+            key: "forecastHorizonSeconds",
+            change: "live",
+            rationale: "The operator removed the six-hour allowance. Default is the existing public forecast horizon; explicit work exhaustion cannot masquerade as complete coverage.",
+            enforcement: ["authority-reads"],
+            exhaustion: "Window clipped; exhausted work returns explicit incomplete refusal",
+            visibility: "customer",
+        },
+        {
+            key: "usageWindowDays",
+            change: "live",
+            rationale: "The operator removed the 31-day allowance. Default is the existing public usage envelope; it does not extend retention or restore purged data.",
+            enforcement: ["authority-reads"],
+            exhaustion: "Read window constrained to effective policy",
+            visibility: "customer",
+        },
+        ...[
+            "attemptDetailRetentionSeconds",
+            "historyRetentionSeconds",
+            "payloadRetentionSeconds",
+        ].map((key) => ({
+            key,
+            change: "deployment",
+            rationale: "Accepted retention policy, separately governed. Stored schedule durations preserve committed policy; increases cannot restore purged data.",
+            enforcement: ["authority-service", "authority-reads", "retention"],
+            exhaustion: "Read cutoff and bounded purge; no organization override",
+            visibility: "customer",
+        })),
+        {
+            key: "pageLimit",
+            change: "deployment",
+            rationale: "Public page protocol maximum; continuation preserves completeness.",
+            enforcement: ["authority-reads"],
+            exhaustion: "Bounded page with continuation",
+            visibility: "customer",
+        },
+    ];
+    const defaults = CONFIGURATION_DEFAULTS;
+    return Object.freeze(metadata.map((entry) => ({
+        ...CONFIGURATION_RULES.find((rule) => rule.key === entry.key),
+        type: "integer",
+        ...(defaults[entry.key] === undefined
+            ? {}
+            : { default: defaults[entry.key] }),
+        ...entry,
+    })));
+})();
 export function validateConfigurationValues(value, scope) {
     if (value === null || typeof value !== "object" || Array.isArray(value))
         throw new TypeError("configuration values must be an object");
@@ -143,7 +184,7 @@ export function validateConfigurationValues(value, scope) {
         throw new TypeError("unsupported configuration scope");
     const parsed = {};
     for (const [key, candidate] of Object.entries(value)) {
-        const definition = CONFIGURATION_CATALOG.find((entry) => entry.key === key);
+        const definition = CONFIGURATION_RULES.find((entry) => entry.key === key);
         if (definition === undefined || !definition.layers.includes(scope))
             throw new TypeError(`configuration setting ${key} does not support ${scope} edits`);
         if (typeof candidate !== "number" ||
@@ -170,7 +211,7 @@ export function resolveEffectiveConfiguration(input) {
     };
     if (input.baseline !== undefined) {
         for (const [key, candidate] of Object.entries(input.baseline)) {
-            const setting = CONFIGURATION_CATALOG.find((entry) => entry.key === key);
+            const setting = CONFIGURATION_RULES.find((entry) => entry.key === key);
             if (setting === undefined ||
                 typeof candidate !== "number" ||
                 !Number.isSafeInteger(candidate) ||

package/dist/delivery.d.ts

@@ -10,17 +10,28 @@ import type { CallbackTrigger as AttemptTrigger } from "./signatures.js";
  * decryption oracle.
  */
 export declare const SCHEDULE_PAYLOAD_AAD_VERSION: "greatwait.schedule-payload.v1";
+export declare const SCHEDULE_PAYLOAD_AAD_VERSION_V2: "greatwait.schedule-payload.v2";
 /**
  * The encrypted customer data carried from its authoritative partition to the
  * network boundary. This is an internal Durable Object RPC shape, not a public
  * schema. Its application-encryption key is deliberately distinct from the key
  * which wraps endpoint signing secrets.
  */
-export interface EncryptedSchedulePayload {
+export interface LegacyEncryptedSchedulePayload {
     readonly ciphertext: string;
     readonly keyId: string;
     readonly nonce: string;
+    readonly version?: never;
 }
+export interface EncodedSchedulePayload {
+    readonly ciphertext: string;
+    readonly keyId: string;
+    readonly nonce: string;
+    readonly version: 2;
+    readonly codec: "identity" | "gzip";
+    readonly originalBytes: number;
+}
+export type EncryptedSchedulePayload = LegacyEncryptedSchedulePayload | EncodedSchedulePayload;
 /** Encrypted custom HTTP settings, internal only; never a public read shape. */
 export type StoredHttpHeader = {
     readonly name: string;
@@ -45,6 +56,7 @@ export interface StoredHttpRequest {
     readonly encryptedTemplate?: EncryptedSchedulePayload;
 }
 export declare const HTTP_HEADER_AAD_VERSION: "greatwait.http-header.v1";
+export { mergeStoredHttpHeaders, validScheduleHttp, validStoredHttpHeaders, } from "./stored-http.js";
 export declare const HTTP_TEMPLATE_AAD_VERSION: "greatwait.http-template.v1";
 /**
  * One immutable delivery attempt, minted by the Scheduler Partition from its

package/dist/delivery.js

@@ -7,7 +7,9 @@
  * decryption oracle.
  */
 export const SCHEDULE_PAYLOAD_AAD_VERSION = "greatwait.schedule-payload.v1";
+export const SCHEDULE_PAYLOAD_AAD_VERSION_V2 = "greatwait.schedule-payload.v2";
 export const HTTP_HEADER_AAD_VERSION = "greatwait.http-header.v1";
+export { mergeStoredHttpHeaders, validScheduleHttp, validStoredHttpHeaders, } from "./stored-http.js";
 export const HTTP_TEMPLATE_AAD_VERSION = "greatwait.http-template.v1";
 /**
  * What a receiver says about work it acknowledged and then finished.

package/dist/effective-limits.d.ts

@@ -10,26 +10,26 @@ export declare const effectiveCustomerLimitsSchema: import("zod").ZodObject<{
         inlinePayloadBytes: import("zod").ZodEnum<{
             organization: "organization";
             default: "default";
-            global: "global";
             deployment: "deployment";
+            global: "global";
         }>;
         partitionKeyCeiling: import("zod").ZodOptional<import("zod").ZodEnum<{
             organization: "organization";
             default: "default";
-            global: "global";
             deployment: "deployment";
+            global: "global";
         }>>;
         forecastHorizonSeconds: import("zod").ZodEnum<{
             organization: "organization";
             default: "default";
-            global: "global";
             deployment: "deployment";
+            global: "global";
         }>;
         usageWindowDays: import("zod").ZodEnum<{
             organization: "organization";
             default: "default";
-            global: "global";
             deployment: "deployment";
+            global: "global";
         }>;
     }, import("zod/v4/core").$strict>;
     revision: import("zod").ZodObject<{