@greatwait/contracts 0.3.0 → 0.3.2

package/dist/scheduling.js

@@ -3,11 +3,13 @@ import { executionSelectionSchema, normalizeExecutionSelection, } from "./execut
 import { httpRequestSchema, publicHttpRequestSchema } from "./http-request.js";
 import { FIXED_INTERVAL_MIN_SECONDS, FIXED_INTERVAL_MAX_SECONDS, MAX_INLINE_PAYLOAD_BYTES, } from "./configuration-bounds.js";
 import { z } from "./zod.js";
+import { SERVICE_MODE_POLICY } from "./operational-config.js";
+import { REQUESTED_LATENCY_CLASSES, oneOffSpacingMs, resolveService, } from "./service-mode.js";
 import { externalIdentifierSchema, scheduleTagsSchema, } from "./host-correlation.js";
 import { attemptIdSchema, deliveryIdSchema, endpointIdSchema, occurrenceIdSchema, scheduleIdSchema, } from "./identifiers.js";
 import { CALLBACK_ATTEMPT_DIAGNOSTICS } from "./delivery.js";
 import { callbackUrlSchema, signingSecretNoticeSchema } from "./endpoints.js";
-import { pageRequestSchema, pageSchema, versionSchema, } from "./protocol.js";
+import { pageRequestSchema, pageSchema, projectedFreshnessSchema, versionSchema, } from "./protocol.js";
 import { callbackTriggerSchema, } from "./signatures.js";
 import { durationSecondsSchema, timeZoneSchema, timestampSchema } from "./time.js";
 /**
@@ -51,18 +53,18 @@ export const SCHEDULE_STATUSES = [
     "cancelled",
     "completed",
 ];
-export const scheduleStatusSchema = z.enum(SCHEDULE_STATUSES);
+export const scheduleStatusSchema = /* @__PURE__ */ (() => z.enum(SCHEDULE_STATUSES))();
 /** A recurring schedule pauses after this many failed runs; "never" disables it. */
 export const DEFAULT_AUTO_PAUSE_AFTER_FAILURES = 5;
-export const autoPauseAfterFailuresSchema = z
+export const autoPauseAfterFailuresSchema = /* @__PURE__ */ (() => z
     .union([z.number().int().min(1).max(100), z.literal("never")])
-    .describe('Consecutive failed runs before automatic pause: 1–100 or "never". Defaults to 5 on create; omission on replace preserves the setting. One-shot schedules are unaffected.');
-export const autoPauseReasonSchema = z.object({
+    .describe('Consecutive failed runs before automatic pause: 1–100 or "never". Defaults to 5 on create; omission on replace preserves the setting. One-shot schedules are unaffected.'))();
+export const autoPauseReasonSchema = /* @__PURE__ */ (() => z.object({
     failedRuns: z.number().int().positive(),
     status: z.number().int().min(100).max(599).optional(),
     diagnostic: z.string().max(500),
     pausedAt: timestampSchema,
-});
+}))();
 /**
  * The statuses a schedule never leaves, and from which it never fires again on
  * its own.
@@ -103,7 +105,14 @@ export function isTerminalScheduleStatus(status) {
  * anything to anybody. `realtime` gets preference without starving `bulk`.
  */
 export const LATENCY_CLASSES = ["realtime", "bulk"];
-export const latencyClassSchema = z.enum(LATENCY_CLASSES);
+export const latencyClassSchema = /* @__PURE__ */ (() => z.enum(LATENCY_CLASSES))();
+/**
+ * The service mode a request asks for (W12-02, FXO-3171): `auto`, or one of
+ * the concrete classes. Omission means `auto`. A read reports the concrete
+ * class an occurrence resolved to as `latencyClass`, and what was asked for as
+ * `requestedLatencyClass`; see `service-mode.ts` for the resolution.
+ */
+export const requestedLatencyClassSchema = /* @__PURE__ */ (() => z.enum(REQUESTED_LATENCY_CLASSES))();
 /**
  * What happens when an occurrence reaches its first attempt after its planned
  * instant.
@@ -118,7 +127,7 @@ export const latencyClassSchema = z.enum(LATENCY_CLASSES);
  * it started under.
  */
 export const LATENESS_POLICIES = ["skipAhead", "catchUp"];
-export const latenessPolicySchema = z.enum(LATENESS_POLICIES);
+export const latenessPolicySchema = /* @__PURE__ */ (() => z.enum(LATENESS_POLICIES))();
 /** The inherited one-shot staleness window: twenty-four hours. */
 export const DEFAULT_ONE_SHOT_MAX_STALENESS_SECONDS = 86_400;
 /**
@@ -129,7 +138,7 @@ export const DEFAULT_ONE_SHOT_MAX_STALENESS_SECONDS = 86_400;
  * staleness bound uses the recurrence's own default: twenty-four hours for a
  * one-shot, and one recurrence interval for a recurring schedule.
  */
-export const scheduleLatenessRequestSchema = z
+export const scheduleLatenessRequestSchema = /* @__PURE__ */ (() => z
     .object({
     maxStalenessSeconds: durationSecondsSchema
         .positive("must be at least 1 second")
@@ -137,7 +146,7 @@ export const scheduleLatenessRequestSchema = z
         .optional(),
     policy: latenessPolicySchema.optional(),
 })
-    .strict();
+    .strict())();
 /**
  * Lateness settings as a schedule reads back.
  *
@@ -145,9 +154,9 @@ export const scheduleLatenessRequestSchema = z
  * remains optional because it records a per-schedule override, not a duplicated
  * copy of a default that can be derived from the recurrence.
  */
-export const scheduleLatenessSchema = scheduleLatenessRequestSchema.extend({
+export const scheduleLatenessSchema = /* @__PURE__ */ (() => scheduleLatenessRequestSchema.extend({
     policy: latenessPolicySchema,
-});
+}))();
 /* -------------------------------------------------------------------------- */
 /* Delivery duration                                                          */
 /* -------------------------------------------------------------------------- */
@@ -256,12 +265,12 @@ export const RESPONSE_DELIVERY_MAX_DURATION_SECONDS = 1_800;
  * a relation between two fields), and above
  * {@link FREE_DELIVERY_DURATION_SECONDS} it needs a plan that allows it.
  */
-export const deliveryDurationSecondsSchema = z
+export const deliveryDurationSecondsSchema = /* @__PURE__ */ (() => z
     .number()
     .int("must be a whole number of seconds")
     .positive("must be at least 1 second")
     .max(MAX_DELIVERY_DURATION_SECONDS, `must be at most ${String(MAX_DELIVERY_DURATION_SECONDS)} seconds`)
-    .describe("How long the receiver may take to answer, in seconds");
+    .describe("How long the receiver may take to answer, in seconds"))();
 /** Whether a duration is past the point where it needs a plan that allows it. */
 export function isLongRunningDuration(seconds) {
     return seconds > FREE_DELIVERY_DURATION_SECONDS;
@@ -291,7 +300,7 @@ export function isLongRunningDuration(seconds) {
  * untouched, and so is what a rung costs.
  */
 export const DELIVERY_COMPLETION_MODES = ["response", "callback"];
-export const deliveryCompletionModeSchema = z.enum(DELIVERY_COMPLETION_MODES);
+export const deliveryCompletionModeSchema = /* @__PURE__ */ (() => z.enum(DELIVERY_COMPLETION_MODES))();
 /**
  * What to do when a recurring schedule comes due and its previous run has not
  * finished.
@@ -313,7 +322,7 @@ export const deliveryCompletionModeSchema = z.enum(DELIVERY_COMPLETION_MODES);
  * - `queue` — run it when the previous one finishes.
  */
 export const DELIVERY_OVERLAP_POLICIES = ["skip", "queue"];
-export const deliveryOverlapPolicySchema = z.enum(DELIVERY_OVERLAP_POLICIES);
+export const deliveryOverlapPolicySchema = /* @__PURE__ */ (() => z.enum(DELIVERY_OVERLAP_POLICIES))();
 export const DEFAULT_DELIVERY_OVERLAP_POLICY = "skip";
 /**
  * A definition generation. Starts at 1 and increases on every replacement.
@@ -324,10 +333,7 @@ export const DEFAULT_DELIVERY_OVERLAP_POLICY = "skip";
  * would make pausing and resuming a schedule invalidate occurrences that are
  * still perfectly valid.
  */
-export const generationSchema = z
-    .number()
-    .int("must be a whole number")
-    .positive("must be at least 1");
+export const generationSchema = /* @__PURE__ */ (() => z.number().int("must be a whole number").positive("must be at least 1"))();
 /**
  * A customer-supplied fairness key.
  *
@@ -339,11 +345,11 @@ export const generationSchema = z
  * another Durable Object namespace.
  */
 export const PARTITION_KEY_MAX_LENGTH = 64;
-export const partitionKeySchema = z
+export const partitionKeySchema = /* @__PURE__ */ (() => z
     .string()
     .min(1, "must not be empty")
     .max(PARTITION_KEY_MAX_LENGTH, `must be at most ${String(PARTITION_KEY_MAX_LENGTH)} characters`)
-    .regex(/^[A-Za-z0-9._:-]+$/u, "must use only letters, digits, dot, underscore, colon, or hyphen");
+    .regex(/^[A-Za-z0-9._:-]+$/u, "must use only letters, digits, dot, underscore, colon, or hyphen"))();
 /* -------------------------------------------------------------------------- */
 /* Occurrence state                                                           */
 /* -------------------------------------------------------------------------- */
@@ -369,11 +375,11 @@ export { OCCURRENCE_STATES, occurrenceStateSchema, } from "./occurrence-states.j
  * the same thing. The date range is half-open, like every other time window in
  * this contract, so adjacent requests neither overlap nor leave a gap.
  */
-export const projectOccurrenceListRequestSchema = pageRequestSchema
+export const projectOccurrenceListRequestSchema = /* @__PURE__ */ (() => pageRequestSchema
     .extend(executionSelectionSchema.shape)
     .refine((request) => request.from === undefined ||
     request.to === undefined ||
-    Date.parse(request.from) < Date.parse(request.to), { message: "must be later than from", path: ["to"] });
+    Date.parse(request.from) < Date.parse(request.to), { message: "must be later than from", path: ["to"] }))();
 const PROJECT_OCCURRENCE_LIST_PARAMETERS = [
     "cursor",
     "limit",
@@ -468,9 +474,9 @@ export const ATTEMPT_STATES = [
     "terminal_failure",
     "ambiguous",
 ];
-export const attemptStateSchema = z.enum(ATTEMPT_STATES);
+export const attemptStateSchema = /* @__PURE__ */ (() => z.enum(ATTEMPT_STATES))();
 /** Safe diagnostic codes produced by the W3-03 delivery classifier. */
-export const attemptDiagnosticSchema = z.enum(CALLBACK_ATTEMPT_DIAGNOSTICS);
+export const attemptDiagnosticSchema = /* @__PURE__ */ (() => z.enum(CALLBACK_ATTEMPT_DIAGNOSTICS))();
 /**
  * Bounded next-action hints for an attempt timeline.
  *
@@ -499,7 +505,7 @@ export const ATTEMPT_REMEDIATIONS = [
 export const ATTEMPT_RESPONSE_HEADER_MAX_LENGTH = 256;
 /** How much of a failed receiver's body is published, in characters. */
 export const ATTEMPT_FAILURE_SNIPPET_MAX_LENGTH = 4_096;
-export const attemptRemediationSchema = z.enum(ATTEMPT_REMEDIATIONS);
+export const attemptRemediationSchema = /* @__PURE__ */ (() => z.enum(ATTEMPT_REMEDIATIONS))();
 /** Derive the one safe next-action code a public attempt may expose. */
 export function remediationForAttempt(diagnostic) {
     switch (diagnostic) {
@@ -615,13 +621,11 @@ export const SCHEDULING_BOUNDS = {
      * was the copied scheduler's `MAX_INTERVAL_SECONDS`, carried over on the
      * belief that "a Durable Object alarm is not arbitrarily far in the future".
      * Cloudflare documents no maximum distance for `setAlarm()`, and the belief
-     * predates the PostgreSQL authority besides: the durable fact is a row, and
-     * the alarm is only what wakes a bucket to read it.
+     * predates the PostgreSQL authority besides: the durable fact is a row.
      *
-     * What makes a distant alarm safe is not the alarm. `TimerBucketRepairer`
-     * asks PostgreSQL for occurrences whose instant has passed and re-signals
-     * their bucket, on committed truth, never asking whether an alarm was armed
-     * — so an alarm that is somehow lost costs lateness rather than the run.
+     * Since W13-03 there is no alarm at all. The Node runtime polls
+     * `core.occurrence` for rows whose `due_at` has passed, so a year-distant
+     * occurrence is the same row read on the same poll as a minute-distant one.
      *
      * Widening a bound is additive by `classifyChange` and narrowing it is
      * breaking, so this direction is the safe one to move in.
@@ -692,17 +696,15 @@ export const SCHEDULING_BOUNDS = {
      */
     payloadBytes: MAX_INLINE_PAYLOAD_BYTES,
     /**
-     * How soon a one-shot has to be for `realtime` to be the class it gets by
-     * default, in seconds.
-     *
-     * Two minutes, which is the copied `validate.ts`'s own threshold kept rather
-     * than a number invented beside it: upstream classifies an `at` or a `delay`
-     * inside 120 seconds as realtime and everything else as bulk, on the
-     * reasoning that a wait that short is a human waiting on a screen. A caller
-     * who disagrees says so — `latencyClass` on the request is what makes this a
-     * default rather than a rule.
+     * How soon a one-shot has to be for `auto` to resolve it to `realtime`, in
+     * seconds, exclusive: a one-shot planned less than a minute after it was
+     * accepted is realtime, and one planned exactly a minute out is bulk
+     * (W12-02, FXO-3171; owner decision 2026-10-14). The single owner is
+     * `SERVICE_MODE_POLICY.autoRealtimeBelowMs`. A caller who disagrees says so
+     * — `latencyClass` on the request is what makes this a default rather than a
+     * rule.
      */
-    realtimeOneShotSeconds: 120,
+    realtimeOneShotSeconds: SERVICE_MODE_POLICY.autoRealtimeBelowMs / 1000,
 };
 /* -------------------------------------------------------------------------- */
 /* Recurrence                                                                 */
@@ -735,12 +737,12 @@ export const CRON_EXPRESSION_MAX_LENGTH = 120;
  * fire on a second boundary is refused by the partition, because a minute is
  * the granularity both arms of recurrence promise.
  */
-export const cronExpressionSchema = z
+export const cronExpressionSchema = /* @__PURE__ */ (() => z
     .string()
     .min(1, "must not be empty")
     .max(CRON_EXPRESSION_MAX_LENGTH, `must be at most ${String(CRON_EXPRESSION_MAX_LENGTH)} characters`)
     .refine((expression) => expression.startsWith("@") ||
-    [5, 6].includes(expression.trim().split(/\s+/u).length), { message: "must be five cron fields, six fields, or an @-nickname" });
+    [5, 6].includes(expression.trim().split(/\s+/u).length), { message: "must be five cron fields, six fields, or an @-nickname" }))();
 /**
  * How a schedule recurs, as a caller reads it back.
  *
@@ -757,7 +759,7 @@ export const cronExpressionSchema = z
  * on that arm rather than optional, so a read always says which wall clock a
  * cron schedule is on instead of leaving the caller to assume UTC.
  */
-export const recurrenceSchema = z.discriminatedUnion("kind", [
+export const recurrenceSchema = /* @__PURE__ */ (() => z.discriminatedUnion("kind", [
     /**
      * A one-shot, which carries no instant of its own.
      *
@@ -779,7 +781,7 @@ export const recurrenceSchema = z.discriminatedUnion("kind", [
         kind: z.literal("cron"),
         timeZone: timeZoneSchema,
     }),
-]);
+]))();
 /** The customer-safe default for a schedule's recurrence kind. */
 export function defaultLatenessPolicyForRecurrence(kind) {
     return kind === "at" ? "catchUp" : "skipAhead";
@@ -807,12 +809,12 @@ export function defaultLatenessPolicyForRecurrence(kind) {
  */
 /** The most a schedule's name may hold; the generated one is cut to fit it. */
 export const SCHEDULE_NAME_MAX_LENGTH = 120;
-export const scheduleNameSchema = z
+export const scheduleNameSchema = /* @__PURE__ */ (() => z
     .string()
     .trim()
     .min(1, "must not be blank")
-    .max(SCHEDULE_NAME_MAX_LENGTH, `must be at most ${String(SCHEDULE_NAME_MAX_LENGTH)} characters`);
-export const scheduleSchema = z.object({
+    .max(SCHEDULE_NAME_MAX_LENGTH, `must be at most ${String(SCHEDULE_NAME_MAX_LENGTH)} characters`))();
+export const scheduleSchema = /* @__PURE__ */ (() => z.object({
     autoPauseAfterFailures: autoPauseAfterFailuresSchema.optional(),
     consecutiveFailedRuns: z.number().int().nonnegative().optional(),
     autoPauseReason: autoPauseReasonSchema.nullable().optional(),
@@ -884,7 +886,18 @@ export const scheduleSchema = z.object({
     endpointUrl: z.string().url().optional(),
     generation: generationSchema,
     id: scheduleIdSchema,
+    /**
+     * The concrete class this schedule's occurrences are served and charged
+     * as: what `auto` resolved to, or the class the caller named.
+     */
     latencyClass: latencyClassSchema,
+    /**
+     * The mode the caller asked for (W12-02): `auto` when the request named
+     * none. Absent on a schedule accepted before the mode was recorded; its
+     * `latencyClass` is what it was accepted as, and a replacement that leaves
+     * its timing alone keeps it.
+     */
+    requestedLatencyClass: requestedLatencyClassSchema.optional(),
     /**
      * What this schedule does with an occurrence that reaches its first attempt
      * late. Present on every schedule so a caller never has to duplicate the
@@ -937,7 +950,7 @@ export const scheduleSchema = z.object({
     status: scheduleStatusSchema,
     updatedAt: timestampSchema,
     version: versionSchema,
-});
+}))();
 /**
  * A page of schedules.
  *
@@ -948,7 +961,77 @@ export const scheduleSchema = z.object({
  * listing back through every partition it spans. Detail is where the occurrence
  * is authoritative, and detail is one call away.
  */
-export const schedulePageSchema = pageSchema(scheduleSchema);
+export const schedulePageSchema = /* @__PURE__ */ (() => pageSchema(scheduleSchema))();
+/** Local days a schedule summary covers, today included (W9-80, FXO-3446). */
+export const SCHEDULE_SUMMARY_DAYS = 30;
+/** Auto-paused schedules a summary names beside their count. */
+export const SCHEDULE_SUMMARY_PAUSED_SAMPLE = 5;
+/** The oldest a served schedule summary may be, in seconds. */
+export const SCHEDULE_SUMMARY_MAX_AGE_SECONDS = 300;
+const localDateSchema = /* @__PURE__ */ (() => z
+    .string()
+    .regex(/^\d{4}-\d{2}-\d{2}$/u, "must be a calendar date, YYYY-MM-DD"))();
+/** A schedule summary request: the reader's time zone for the day buckets. */
+export const scheduleSummaryRequestSchema = /* @__PURE__ */ (() => z.object({
+    timeZone: timeZoneSchema
+        .default("UTC")
+        .describe("IANA time zone the per-day buckets are counted in; defaults to UTC."),
+}))();
+/**
+ * Whole-project schedule counts for the caller's project and environment
+ * (W9-80, FXO-3446).
+ *
+ * **Exact as of `freshness.asOf`, and at most five minutes old.** The counts
+ * read every retained, unarchived schedule in one statement, which is too
+ * costly to repeat on every view of a large project, so an answer is computed
+ * on read and reused for up to {@link SCHEDULE_SUMMARY_MAX_AGE_SECONDS}
+ * seconds per project, environment and time zone. `freshness` is always
+ * `projected`: `asOf` is when the counts were taken and `lagSeconds` how long
+ * ago that was, so a client can say "as of 2 minutes ago" rather than present
+ * the numbers as live. Counts cover retained schedules only: retention removes
+ * cancelled schedules and one-offs that ran once their history horizon passes.
+ */
+export const scheduleSummarySchema = /* @__PURE__ */ (() => z.object({
+    counts: z.object({
+        active: z.number().int().nonnegative(),
+        paused: z.number().int().nonnegative(),
+        completed: z.number().int().nonnegative(),
+        cancelled: z.number().int().nonnegative(),
+    }),
+    /**
+     * Paused schedules whose newest run paused them after repeated failures,
+     * and up to five of them (id, name and why), most recently paused first.
+     * Read a schedule, or list `status=paused`, for the rest.
+     */
+    pausedAfterFailures: z.object({
+        count: z.number().int().nonnegative(),
+        schedules: z
+            .array(z.object({
+            id: scheduleIdSchema,
+            name: z.string().optional(),
+            autoPauseReason: autoPauseReasonSchema,
+        }))
+            .max(SCHEDULE_SUMMARY_PAUSED_SAMPLE),
+    }),
+    /**
+     * One entry per local day of the window, oldest first, zero days
+     * included: schedules created that day, and schedules that finished that
+     * day (completed by their final run, or cancelled).
+     */
+    days: z
+        .array(z.object({
+        date: localDateSchema,
+        created: z.number().int().nonnegative(),
+        finished: z.number().int().nonnegative(),
+    }))
+        .length(SCHEDULE_SUMMARY_DAYS),
+    window: z.object({
+        from: localDateSchema,
+        to: localDateSchema,
+        timeZone: timeZoneSchema,
+    }),
+    freshness: projectedFreshnessSchema,
+}))();
 function hasCompleteTimingEvidence(value) {
     return ((value.firstAttemptStartedAt === undefined) ===
         (value.firstAttemptLatenessMs === undefined) &&
@@ -973,7 +1056,12 @@ const timingEvidenceShape = {
         .optional(),
     timingEligibilityReason: z.string().min(1).max(128).optional(),
     /** Policy pinned when trusted first-attempt timing evidence is recorded. */
-    timingPolicyVersion: z.string().min(1).max(64).optional(),
+    timingPolicyVersion: z
+        .string()
+        .min(1)
+        .max(64)
+        .optional()
+        .describe("Timing policy pinned with trusted first-outbound evidence. Banded occurrences use timing-v2-service-bands (realtime 1000ms, short bulk 10000ms, bulk 60000ms from plannedFor); legacy occurrences without a band retain their recorded policy, including payg-v1, and 5000ms/15000ms thresholds. Absent timing evidence means unknown."),
 };
 /**
  * One concrete occurrence of a schedule.
@@ -983,7 +1071,7 @@ const timingEvidenceShape = {
  * numbering starts again. Together `(schedule, generation, sequence)` is what
  * makes an occurrence identifiable without depending on when it was written.
  */
-export const occurrenceSchema = z
+export const occurrenceSchema = /* @__PURE__ */ (() => z
     .object({
     attemptCount: z.number().int().nonnegative(),
     ...timingEvidenceShape,
@@ -992,6 +1080,13 @@ export const occurrenceSchema = z
     /** When the occurrence was planned to fire. Never earlier than this. */
     plannedFor: timestampSchema,
     schedule: scheduleIdSchema,
+    /**
+     * The schedule's name, on the project executions listing
+     * (`executions.list`) only, read from the same schedule rows that page
+     * already joins — so a list of runs can say whose they are without a
+     * schedule read per row (W9-80). Absent elsewhere.
+     */
+    scheduleName: z.string().optional(),
     sequence: z.number().int().positive(),
     /** Present exactly when the occurrence is in a terminal state. */
     settledAt: timestampSchema.optional(),
@@ -1014,7 +1109,7 @@ export const occurrenceSchema = z
     .refine(hasConsistentTimingEligibility, {
     message: "timingEligibilityReason is required for a blocked population and absent otherwise",
     path: ["timingEligibilityReason"],
-});
+}))();
 /**
  * One delivery attempt against one occurrence.
  *
@@ -1039,11 +1134,11 @@ export const occurrenceSchema = z
  * can look up in their own logs. Cookies, `Authorization` and
  * `WWW-Authenticate` have no representation here at all.
  */
-export const attemptResponseHeaderSchema = z.object({
+export const attemptResponseHeaderSchema = /* @__PURE__ */ (() => z.object({
     /** Lowercase, from the published allowlist. */
     name: z.string().min(1).max(64),
     value: z.string().max(ATTEMPT_RESPONSE_HEADER_MAX_LENGTH),
-});
+}))();
 /**
  * What a failing receiver said, bounded and access-controlled.
  *
@@ -1057,14 +1152,14 @@ export const attemptResponseHeaderSchema = z.object({
  * that is exactly the bound and a body that was cut at the bound are different
  * facts and only one of them should show a customer an ellipsis.
  */
-export const attemptFailureSnippetSchema = z.object({
+export const attemptFailureSnippetSchema = /* @__PURE__ */ (() => z.object({
     /** The media type it was captured from. Not customer content. */
     contentType: z.string().min(1).max(128),
     text: z.string().max(ATTEMPT_FAILURE_SNIPPET_MAX_LENGTH),
     truncated: z.boolean(),
-});
+}))();
 /** Stored diagnostic content, available only under the attempt's verified authority. */
-export const attemptCapturedBodySchema = z.object({
+export const attemptCapturedBodySchema = /* @__PURE__ */ (() => z.object({
     contentType: z.string(),
     encoding: z.enum(["utf8", "base64"]),
     // Up to 10 KiB received bytes; credential masking can expand the representation.
@@ -1074,27 +1169,46 @@ export const attemptCapturedBodySchema = z.object({
     truncated: z.boolean(),
     redacted: z.boolean().optional(),
     incomplete: z.boolean().optional(),
-});
-export const attemptResponseSchema = z.object({
+}))();
+export const attemptResponseSchema = /* @__PURE__ */ (() => z.object({
     statusText: z.string(),
     headers: z.array(z.object({ name: z.string(), value: z.string() })),
     bodyState: z.enum(["captured", "empty", "expired", "not_captured"]),
     body: attemptCapturedBodySchema.optional(),
-});
-export const attemptRequestSchema = z.object({
+}))();
+export const attemptRequestSchema = /* @__PURE__ */ (() => z.object({
     method: z.enum(["GET", "POST", "PUT"]),
     url: z.string(),
     headers: z.array(z.object({ name: z.string(), value: z.string() })),
     body: z.string(),
-});
-export const attemptSchema = z
-    .object({
+}))();
+/** Shared validators for attempt search summaries and full attempt details. */
+export const attemptSearchSummaryShape = /* @__PURE__ */ (() => ({
     attemptNumber: z.number().int().positive(),
-    /** Present exactly when the attempt has been classified. */
     classifiedAt: timestampSchema.optional(),
+    diagnostic: attemptDiagnosticSchema.optional(),
+    durationMs: z
+        .number()
+        .int()
+        .nonnegative()
+        .max(ATTEMPT_DURATION_MAX_MS)
+        .optional(),
+    id: attemptIdSchema,
+    occurrence: occurrenceIdSchema,
+    remediation: attemptRemediationSchema.optional(),
+    responseStatus: z.number().int().min(100).max(599).optional(),
+    startedAt: timestampSchema,
+    state: attemptStateSchema.optional(),
+    trigger: attemptTriggerSchema,
+}))();
+export const attemptSchema = /* @__PURE__ */ (() => z
+    .object({
+    attemptNumber: attemptSearchSummaryShape.attemptNumber,
+    /** Present exactly when the attempt has been classified. */
+    classifiedAt: attemptSearchSummaryShape.classifiedAt,
     delivery: deliveryIdSchema,
     /** Safe classifier code; absent when durable evidence predates diagnostics. */
-    diagnostic: attemptDiagnosticSchema.optional(),
+    diagnostic: attemptSearchSummaryShape.diagnostic,
     /**
      * Instrumented re-drives of the same dispatching occurrence under a new
      * dispatch epoch. Includes deliberate admission deferrals; this is not a
@@ -1102,14 +1216,9 @@ export const attemptSchema = z
      */
     dispatchRecoveries: z.int().nonnegative().optional(),
     /** Executor-observed elapsed time; absent when no durable timing survived. */
-    durationMs: z
-        .number()
-        .int()
-        .nonnegative()
-        .max(ATTEMPT_DURATION_MAX_MS)
-        .optional(),
+    durationMs: attemptSearchSummaryShape.durationMs,
     ...timingEvidenceShape,
-    id: attemptIdSchema,
+    id: attemptSearchSummaryShape.id,
     /**
      * Instrumented send authorizations granted after a later local alarm
      * replayed the original wake receipt. Preserves the attempt and delivery
@@ -1118,7 +1227,7 @@ export const attemptSchema = z
      * older responses.
      */
     localReceiptRecoveries: z.int().nonnegative().optional(),
-    occurrence: occurrenceIdSchema,
+    occurrence: attemptSearchSummaryShape.occurrence,
     /**
      * How many times the watchdog took this attempt's send back and sent it
      * again: the send was authorized, and its outcome was never recorded
@@ -1129,7 +1238,7 @@ export const attemptSchema = z
      */
     rescues: z.int().positive().optional(),
     /** Stable next-action code paired with a diagnostic when one is known. */
-    remediation: attemptRemediationSchema.optional(),
+    remediation: attemptSearchSummaryShape.remediation,
     /**
      * Compatibility text prefix, up to 4 KiB, derived from the retained
      * response when its media type is supported by legacy clients. Use
@@ -1140,13 +1249,29 @@ export const attemptSchema = z
     response: attemptResponseSchema.optional(),
     request: attemptRequestSchema.optional(),
     requestState: z.enum(["captured", "expired", "not_captured"]).optional(),
+    /**
+     * Why a successful attempt's request cannot be shown, when
+     * `requestState` is `not_captured` for that reason. A successful
+     * attempt's request is rebuilt from the schedule's payload and its
+     * endpoint, so it is shown only while neither has changed since the run
+     * and the payload still exists; it is never shown from a later version.
+     * Absent otherwise.
+     */
+    requestUnavailable: z
+        .enum([
+        "schedule_changed",
+        "endpoint_changed",
+        "endpoint_deleted",
+        "payload_deleted",
+    ])
+        .optional(),
     /** The fixed diagnostic-header allowlist, when a response carried any. */
     responseHeaders: z.array(attemptResponseHeaderSchema).max(8).optional(),
     /** Absent when no response was received at all. */
-    responseStatus: z.number().int().min(100).max(599).optional(),
-    startedAt: timestampSchema,
-    state: attemptStateSchema.optional(),
-    trigger: attemptTriggerSchema,
+    responseStatus: attemptSearchSummaryShape.responseStatus,
+    startedAt: attemptSearchSummaryShape.startedAt,
+    state: attemptSearchSummaryShape.state,
+    trigger: attemptSearchSummaryShape.trigger,
 })
     // Classification and its timestamp arrive together or not at all — the same
     // pairing the partition's CHECK constraint enforces. Independently optional
@@ -1185,30 +1310,30 @@ export const attemptSchema = z
     .refine(hasConsistentTimingEligibility, {
     message: "timingEligibilityReason is required for a blocked population and absent otherwise",
     path: ["timingEligibilityReason"],
-});
+}))();
 /** An authoritative page over one schedule's retained occurrences. */
-export const occurrencePageSchema = pageSchema(occurrenceSchema).extend({
+export const occurrencePageSchema = /* @__PURE__ */ (() => pageSchema(occurrenceSchema).extend({
     freshness: z.object({ kind: z.literal("authoritative") }),
-});
+}))();
 /** A project-wide occurrence page and its plan's normal history boundary. */
-export const projectOccurrencePageSchema = pageSchema(occurrenceSchema).extend({
+export const projectOccurrencePageSchema = /* @__PURE__ */ (() => pageSchema(occurrenceSchema).extend({
     freshness: z.object({ kind: z.literal("authoritative") }),
     retention: z.object({ from: timestampSchema }),
-});
+}))();
 /** An authoritative occurrence detail response. */
-export const occurrenceViewSchema = z.object({
+export const occurrenceViewSchema = /* @__PURE__ */ (() => z.object({
     freshness: z.object({ kind: z.literal("authoritative") }),
     occurrence: occurrenceSchema,
-});
+}))();
 /** An authoritative page over one retained occurrence's immutable attempts. */
-export const attemptPageSchema = pageSchema(attemptSchema).extend({
+export const attemptPageSchema = /* @__PURE__ */ (() => pageSchema(attemptSchema).extend({
     freshness: z.object({ kind: z.literal("authoritative") }),
-});
+}))();
 /** An authoritative attempt detail or redelivery response. */
-export const attemptViewSchema = z.object({
+export const attemptViewSchema = /* @__PURE__ */ (() => z.object({
     attempt: attemptSchema,
     freshness: z.object({ kind: z.literal("authoritative") }),
-});
+}))();
 /**
  * A schedule together with the occurrence that is next to happen.
  *
@@ -1217,19 +1342,19 @@ export const attemptViewSchema = z.object({
  * that has to make a second request to answer it will cache the first answer and
  * be wrong.
  */
-export const scheduleViewSchema = z.object({
+export const scheduleViewSchema = /* @__PURE__ */ (() => z.object({
     occurrence: occurrenceSchema,
     schedule: scheduleSchema,
-});
+}))();
 /**
  * What a schedule create or replace answers: the schedule view, and — when the
  * request named its destination by `url` — where that endpoint's signing
  * secret is (W9-44). Present only then, because only then can the caller have
  * an endpoint whose secret it never held.
  */
-export const scheduleWrittenViewSchema = scheduleViewSchema.extend({
+export const scheduleWrittenViewSchema = /* @__PURE__ */ (() => scheduleViewSchema.extend({
     endpointSigningSecret: signingSecretNoticeSchema.optional(),
-});
+}))();
 /**
  * The four ways a caller may say when a schedule happens.
  *
@@ -1259,7 +1384,7 @@ export const RECURRENCE_REQUEST_FIELDS = [
  * `ambiguous_schedule`, and a scheduler that silently picks one of two instants
  * a customer named is the worst kind of helpful.
  */
-export const scheduleRequestSchema = z
+export const scheduleRequestSchema = /* @__PURE__ */ (() => z
     .object({
     autoPauseAfterFailures: autoPauseAfterFailuresSchema.optional(),
     http: httpRequestSchema.optional(),
@@ -1361,20 +1486,27 @@ export const scheduleRequestSchema = z
      */
     url: callbackUrlSchema().optional(),
     /**
-     * How promptly this schedule's occurrences expect to be served.
+     * How promptly this schedule's occurrences expect to be served: `auto`,
+     * `bulk` or `realtime` (W12-02, FXO-3171).
      *
-     * Optional, and omitting it is the ordinary case: the default is derived
-     * from how the schedule recurs (`deriveLatencyClass`). Stating it is for
+     * Omitting it means `auto`, the ordinary case. `auto` makes a one-shot
+     * planned less than a minute after acceptance `realtime` and everything
+     * else `bulk`; a recurrence is classified by the gap between its runs, so
+     * it is `bulk`. Naming `realtime` or `bulk` always gets that class — for
      * the caller whose nightly cron really is a human waiting, or whose
-     * thirty-second one-shot really is a campaign — the derivation is a good
-     * guess about intent and cannot be a correct one.
+     * thirty-second one-shot really is a campaign.
+     *
+     * Bulk work becomes eligible on a 5-second boundary when its runs are
+     * under five minutes apart (or it is due within five minutes) and on a
+     * 50-second boundary otherwise; realtime on a 250-millisecond boundary.
+     * The occurrence's `plannedFor` is unchanged. Each occurrence is charged
+     * as the class it resolved to.
      *
-     * It buys preference, not a promise. `realtime` is served ahead of `bulk`
-     * within the same partition; it does not raise the partition's rate, so a
-     * caller who marks everything `realtime` has re-labelled their work rather
-     * than obtained more of the service.
+     * On a replacement, omission keeps the schedule's mode. Changing the
+     * timing resolves again under that mode; changing anything else keeps
+     * the class and price the schedule was accepted under.
      */
-    latencyClass: latencyClassSchema.optional(),
+    latencyClass: requestedLatencyClassSchema.optional(),
     /**
      * What to do when an occurrence reaches its first attempt late.
      *
@@ -1493,7 +1625,7 @@ export const scheduleRequestSchema = z
             path: ["delivery", "completion"],
         });
     }
-});
+}))();
 /** Resolve the lateness settings a create or replacement request runs under. */
 export function deriveLatenessSettings(request) {
     const recurrenceKind = request.cron !== undefined
@@ -1529,29 +1661,46 @@ export function deriveDeliverySettings(request) {
         onOverlap: request.delivery?.onOverlap ?? DEFAULT_DELIVERY_OVERLAP_POLICY,
     };
 }
+/**
+ * The create request as its idempotency fingerprint reads it (W12-02).
+ *
+ * An omitted `latencyClass` means `auto`, so the two spellings are one request
+ * and must fingerprint alike. They are made alike by writing the default the
+ * way the request has always been able to write it — by omission — so a
+ * receipt issued before `auto` existed still recognizes its own retry.
+ */
+export function fingerprintedScheduleRequest(request) {
+    if (request.latencyClass !== "auto")
+        return request;
+    const { latencyClass: _auto, ...rest } = request;
+    void _auto;
+    return rest;
+}
+/**
+ * The concrete class a create request resolves to at `nowMs`, its acceptance
+ * time. Here so REST, MCP and the dashboard's preview reach the same answer
+ * for the same body; `service-mode.ts` owns the rule.
+ *
+ * A recurrence is classified by the gap between runs, at least a minute for
+ * anything this surface accepts, so `auto` makes it `bulk` without evaluating
+ * a cron expression here. `nowMs` is a parameter so the boundary can be asked
+ * about one millisecond either side of it.
+ */
 export function deriveLatencyClass(request, nowMs) {
-    if (request.latencyClass !== undefined) {
-        return request.latencyClass;
-    }
+    const requested = request.latencyClass ?? "auto";
     if (request.cron !== undefined || request.everySeconds !== undefined) {
-        return "bulk";
-    }
-    const threshold = SCHEDULING_BOUNDS.realtimeOneShotSeconds * 1000;
-    if (request.delaySeconds !== undefined) {
-        return request.delaySeconds * 1000 <= threshold ? "realtime" : "bulk";
-    }
-    if (request.at === undefined) {
-        // No recurrence at all, which the schema refuses before this is reached.
-        // Answered rather than thrown so a caller of this function on an unvalidated
-        // body gets the conservative class instead of an exception.
-        return "bulk";
-    }
-    const atMs = Date.parse(request.at);
-    if (Number.isNaN(atMs)) {
-        return "bulk";
+        return resolveService(requested, request.everySeconds === undefined
+            ? SCHEDULING_BOUNDS.everySecondsMin * 1000
+            : request.everySeconds * 1000).latencyClass;
     }
-    // An instant already in the past is as immediate as an instant gets, so the
-    // comparison is against the delay from now and not against its absolute
-    // value: `at` one second ago is realtime, and `at` a year out is not.
-    return atMs - nowMs <= threshold ? "realtime" : "bulk";
+    const atMs = request.delaySeconds !== undefined
+        ? nowMs + request.delaySeconds * 1000
+        : request.at === undefined
+            ? Number.NaN
+            : Date.parse(request.at);
+    // No instant at all, which the schema refuses before this is reached, is
+    // answered conservatively rather than thrown.
+    return Number.isNaN(atMs)
+        ? resolveService(requested, Infinity).latencyClass
+        : resolveService(requested, oneOffSpacingMs(nowMs, atMs)).latencyClass;
 }