@greatwait/contracts 0.3.1 → 0.3.3

package/dist/project-notifications.js

@@ -1,6 +1,6 @@
 import { z } from "./zod.js";
 import { environmentKindSchema } from "./authority.js";
-import { callbackSigningKeyIdSchema, occurrenceIdSchema, projectIdSchema, scheduleIdSchema, } from "./identifiers.js";
+import { callbackSigningKeyIdSchema, endpointIdSchema, occurrenceIdSchema, projectIdSchema, scheduleIdSchema, } from "./identifiers.js";
 import { memberIdSchema } from "./members.js";
 import { timestampSchema } from "./time.js";
 import { pageRequestSchema, requiredIdempotencyRequestHeaderSchema, } from "./protocol.js";
@@ -23,13 +23,26 @@ export const notificationEmailSettingsSchema = z.strictObject({
     scheduleKinds: z.enum(["both", "one-shot", "recurring"]),
 });
 export const statusWebhookEventSchema = z.enum(["failed"]);
+const statusWebhookEventsSchema = z
+    .array(statusWebhookEventSchema)
+    .min(1)
+    .max(1)
+    .refine((events) => new Set(events).size === events.length, "events must be unique");
+/**
+ * The earlier configuration: a bare URL. Still accepted (W9-84): the endpoint
+ * at that URL is found or created, as endpoints.ensure does, and linked.
+ */
 export const statusWebhookConfigurationSchema = z.strictObject({
     url: z.string().url().max(2_048),
-    events: z
-        .array(statusWebhookEventSchema)
-        .min(1)
-        .max(1)
-        .refine((events) => new Set(events).size === events.length, "events must be unique"),
+    events: statusWebhookEventsSchema,
+});
+/**
+ * The status webhook's destination (W9-84): a callback endpoint in this
+ * project and environment, whose URL, headers and signing keys apply.
+ */
+export const statusWebhookEndpointConfigurationSchema = z.strictObject({
+    endpoint: endpointIdSchema,
+    events: statusWebhookEventsSchema,
 });
 export const projectNotificationSettingsSchema = z.strictObject({
     project: projectIdSchema,
@@ -38,6 +51,9 @@ export const projectNotificationSettingsSchema = z.strictObject({
     email: notificationEmailSettingsSchema,
     statusWebhook: statusWebhookConfigurationSchema
         .extend({
+        /** The destination endpoint; absent only for a URL saved before W9-84 without a key. */
+        endpoint: endpointIdSchema.optional(),
+        /** The key that signs: the endpoint's next key while one is staged, else its current one. */
         signingKey: z.strictObject({ id: callbackSigningKeyIdSchema }).optional(),
         revision: z.number().int().positive(),
     })
@@ -47,7 +63,13 @@ export const projectNotificationSettingsUpdateRequestSchema = z
     .strictObject({
     expectedRevision: z.number().int().positive(),
     email: notificationEmailSettingsSchema.optional(),
-    statusWebhook: statusWebhookConfigurationSchema.nullable().optional(),
+    statusWebhook: z
+        .union([
+        statusWebhookEndpointConfigurationSchema,
+        statusWebhookConfigurationSchema,
+    ])
+        .nullable()
+        .optional(),
 })
     .refine((request) => request.email !== undefined || request.statusWebhook !== undefined, "choose settings to change");
 export const statusSigningKeyRequestSchema = z.strictObject({
@@ -57,6 +79,11 @@ export const statusSigningKeyCreatedSchema = z.strictObject({
     settings: projectNotificationSettingsSchema,
     keyId: callbackSigningKeyIdSchema,
     secret: z.string().min(1),
+    /**
+     * Kept for compatibility (W9-84). The secret is the destination endpoint's,
+     * so a signed-in member can also reveal it on the endpoint's page, as for
+     * every endpoint secret; `shownOnce` no longer means this is the only copy.
+     */
     shownOnce: z.literal(true),
 });
 /** Safe notification payload: no customer request or response content. */
@@ -144,6 +171,8 @@ export const PROJECT_NOTIFICATION_OPERATIONS = defineOperations([
             "revision_conflict",
             "idempotency_key_reused",
             "rate_limited",
+            "scope_missing",
+            "state_conflict",
         ],
         requestHeaders: requiredIdempotencyRequestHeaderSchema,
         request: projectNotificationSettingsUpdateRequestSchema,
@@ -161,7 +190,7 @@ export const PROJECT_NOTIFICATION_OPERATIONS = defineOperations([
             : "Update delivery notification settings",
         description: globals.GREATWAIT_RUNTIME_CONTRACTS_ONLY
             ? ""
-            : "An admin updates this project's environment preferences at an expected revision. Selected recipients must be current organization members; arbitrary email addresses are not accepted. Null disables the status webhook. Changing URL or filters never reveals a signing secret. Mint the first key through the secure signing-key operation before webhook delivery starts. Failed means final unsuccessful settlement. Redelivery never repeats it. Failed-event webhook calls and their retries are free. Every failed occurrence is emailed separately; no summary window suppresses failures.",
+            : "An admin updates this project's environment preferences at an expected revision. Selected recipients must be current organization members; arbitrary email addresses are not accepted. The status webhook names its destination as `endpoint`, an enabled callback endpoint in this project and environment, which needs `endpoints:read`: failure events go to its URL with its headers, signed with its key, and delivery starts at once. A `url` instead is the earlier form: the endpoint at that address is found or created (the endpoints.ensure rules; creating needs `endpoints:write`) and linked. Without the scope a form needs, the request is refused as `scope_missing`. Null disables the status webhook. No signing secret is returned; a signed-in member reveals it on the endpoint's page. Failed means final unsuccessful settlement. Redelivery never repeats it. Failed-event webhook calls and their retries are free. Every failed occurrence is emailed separately; no summary window suppresses failures.",
     },
     {
         ...common,
@@ -172,14 +201,15 @@ export const PROJECT_NOTIFICATION_OPERATIONS = defineOperations([
         mutates: true,
         mcp: {
             kind: "unavailable",
-            reason: "Minting or rotating returns a one-time signing secret. MCP has no negotiated secure-result channel that keeps it out of ordinary tool history. Configure preferences with projectnotifications_update, then use the dashboard or an authenticated REST/SDK/CLI client for the secret.",
+            reason: "Rotating returns a signing secret, and MCP has no negotiated secure-result channel that keeps it out of ordinary tool history. Choose the status webhook's endpoint with projectnotifications_update; reveal or rotate that endpoint's key on its page in the dashboard, or with endpoints.rotateSigningKey through an authenticated REST/SDK/CLI client.",
         },
-        scopes: ["projects:administer"],
+        scopes: ["projects:administer", "endpoints:write"],
         problems: [
             ...common.problems,
             "revision_conflict",
             "state_conflict",
             "capability_not_configured",
+            "scope_missing",
         ],
         request: statusSigningKeyRequestSchema,
         requestExample: globals.GREATWAIT_RUNTIME_WITHOUT_EXAMPLES
@@ -197,6 +227,7 @@ export const PROJECT_NOTIFICATION_OPERATIONS = defineOperations([
                     statusWebhook: {
                         url: "https://hooks.example.com/status",
                         events: ["failed"],
+                        endpoint: "ep_01h8xyz9k2m4n6p8r0t2v4w6y8",
                         revision: 2,
                         signingKey: { id: "csk_01h8xyz9k2m4n6p8r0t2v4w6y8" },
                     },
@@ -207,10 +238,10 @@ export const PROJECT_NOTIFICATION_OPERATIONS = defineOperations([
             },
         summary: globals.GREATWAIT_API_REQUEST_REGISTRY
             ? ""
-            : "Mint or rotate the status webhook signing key",
+            : "Rotate the status webhook endpoint's signing key",
         description: globals.GREATWAIT_RUNTIME_CONTRACTS_ONLY
             ? ""
-            : "An admin mints the first key or replaces the current key for an already configured status webhook at an expected revision. The secret appears only in this successful response and cannot be read back. A lost response requires a fresh revision read and another rotation. Queued deliveries using the replaced signing key are suppressed. The request is not automatically replayable; stale retries are refused. The signature covers the exact emitted body bytes.",
+            : "The earlier form, kept for existing clients: at an expected revision, rotate the signing key of the configured status webhook's endpoint exactly as endpoints.rotateSigningKey does with its default overlap. The key is the endpoint's and is shared with every schedule using it, so this also needs `endpoints:write`; without it the request is refused as `scope_missing`. A webhook saved as a bare URL is first linked to the endpoint at that address. New deliveries are signed with the new key at once, and receivers keep accepting the previous key until the overlap ends. The secret appears in this successful response and, like every endpoint secret, is also revealable by a signed-in member on the endpoint's page; `shownOnce` is kept for compatibility. The request is not automatically replayable; stale retries are refused. The signature covers the exact emitted body bytes.",
     },
     {
         ...common,

package/dist/protocol.d.ts

@@ -39,6 +39,18 @@ export type PageRequest = z.infer<typeof pageRequestSchema>;
  */
 export declare const SCHEDULE_ORDERS: readonly ["created", "due"];
 export type ScheduleOrder = (typeof SCHEDULE_ORDERS)[number];
+/**
+ * Which way a schedules listing walks its order (W9-80, FXO-3446).
+ *
+ * `asc` is what every listing has always done and keeps by default, so a
+ * client that never heard of this parameter sees nothing change. `desc` is
+ * newest-created first under `created` (the newest schedule is one row away
+ * rather than a whole book away) and latest-due first under `due`. A cursor is
+ * a position in one direction only: one issued walking `desc` is refused under
+ * `asc`, and the other way round.
+ */
+export declare const SCHEDULE_DIRECTIONS: readonly ["asc", "desc"];
+export type ScheduleDirection = (typeof SCHEDULE_DIRECTIONS)[number];
 /**
  * A schedules listing: the page, optionally one endpoint, and how to order it.
  *
@@ -58,6 +70,10 @@ export declare const scheduleListRequestSchema: import("zod").ZodObject<{
         due: "due";
         created: "created";
     }>>;
+    direction: import("zod").ZodDefault<import("zod").ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
     external_identifier: import("zod").ZodOptional<import("zod").ZodString>;
     tag: import("zod").ZodOptional<import("zod").ZodString>;
     status: import("zod").ZodOptional<import("zod").ZodEnum<{
@@ -245,6 +261,18 @@ export type ScheduleListRequestParse = {
     readonly ok: false;
     readonly errors: readonly FieldError[];
 };
+/**
+ * Any listing request whose fields are page parameters plus string filters,
+ * read from a query string under the same rules as {@link parsePageRequest}
+ * (W9-80: the endpoints listing's filters).
+ */
+export declare function parseListingRequest<TSchema extends z.ZodTypeAny>(query: URLSearchParams, schema: TSchema): {
+    readonly ok: true;
+    readonly page: z.infer<TSchema>;
+} | {
+    readonly ok: false;
+    readonly errors: readonly FieldError[];
+};
 /** A schedules listing request: the page, and the endpoint filter if given. */
 export declare function parseScheduleListRequest(query: URLSearchParams): ScheduleListRequestParse;
 export type HistoryPageRequestParse = {

package/dist/protocol.js

@@ -43,6 +43,17 @@ export const pageRequestSchema = /* @__PURE__ */ (() => z.object({
  * creation instant.
  */
 export const SCHEDULE_ORDERS = ["created", "due"];
+/**
+ * Which way a schedules listing walks its order (W9-80, FXO-3446).
+ *
+ * `asc` is what every listing has always done and keeps by default, so a
+ * client that never heard of this parameter sees nothing change. `desc` is
+ * newest-created first under `created` (the newest schedule is one row away
+ * rather than a whole book away) and latest-due first under `due`. A cursor is
+ * a position in one direction only: one issued walking `desc` is refused under
+ * `asc`, and the other way round.
+ */
+export const SCHEDULE_DIRECTIONS = ["asc", "desc"];
 /**
  * A schedules listing: the page, optionally one endpoint, and how to order it.
  *
@@ -58,6 +69,10 @@ export const SCHEDULE_ORDERS = ["created", "due"];
 export const scheduleListRequestSchema = /* @__PURE__ */ (() => pageRequestSchema.extend({
     ...scheduleSelectionSchema.shape,
     order: z.enum(SCHEDULE_ORDERS).default("created"),
+    direction: z
+        .enum(SCHEDULE_DIRECTIONS)
+        .default("asc")
+        .describe("asc (default) walks the order oldest-created or soonest-due first; desc walks it newest-created or latest-due first. A cursor continues only in the direction that issued it."),
 }))();
 /**
  * Which end of a history a page walks from.
@@ -287,6 +302,14 @@ function parametersOf(schema) {
 export function parsePageRequest(query) {
     return parseListing(query, pageRequestSchema);
 }
+/**
+ * Any listing request whose fields are page parameters plus string filters,
+ * read from a query string under the same rules as {@link parsePageRequest}
+ * (W9-80: the endpoints listing's filters).
+ */
+export function parseListingRequest(query, schema) {
+    return parseListing(query, schema);
+}
 /** A schedules listing request: the page, and the endpoint filter if given. */
 export function parseScheduleListRequest(query) {
     return parseListing(query, scheduleListRequestSchema);

package/dist/scheduling-records.d.ts

@@ -34,11 +34,21 @@ export declare const portableScheduleRecordSchema: import("zod").ZodObject<{
             name: import("zod").ZodString;
             suppressed: import("zod").ZodLiteral<true>;
         }, import("zod/v4/core").$strict>]>>;
-        encryptedTemplate: import("zod").ZodOptional<import("zod").ZodObject<{
+        encryptedTemplate: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
             keyId: import("zod").ZodLiteral<"v1">;
             nonce: import("zod").ZodString;
             ciphertext: import("zod").ZodString;
-        }, import("zod/v4/core").$strict>>;
+        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+            keyId: import("zod").ZodLiteral<"v1">;
+            nonce: import("zod").ZodString;
+            ciphertext: import("zod").ZodString;
+            version: import("zod").ZodLiteral<2>;
+            codec: import("zod").ZodEnum<{
+                identity: "identity";
+                gzip: "gzip";
+            }>;
+            originalBytes: import("zod").ZodNumber;
+        }, import("zod/v4/core").$strict>]>>;
     }, import("zod/v4/core").$strict>>;
     httpTemplateRetentionDueAt: import("zod").ZodOptional<import("zod").ZodString>;
     authority: import("zod").ZodObject<{
@@ -106,9 +116,14 @@ export declare const portableScheduleRecordSchema: import("zod").ZodObject<{
     generation: import("zod").ZodNumber;
     id: import("zod").ZodString;
     latencyClass: import("zod").ZodEnum<{
-        realtime: "realtime";
         bulk: "bulk";
+        realtime: "realtime";
     }>;
+    requestedLatencyClass: import("zod").ZodOptional<import("zod").ZodEnum<{
+        bulk: "bulk";
+        realtime: "realtime";
+        auto: "auto";
+    }>>;
     lateness: import("zod").ZodObject<{
         maxStalenessSeconds: import("zod").ZodOptional<import("zod").ZodNumber>;
         policy: import("zod").ZodEnum<{
@@ -169,6 +184,7 @@ export declare const portableOccurrenceRecordSchema: import("zod").ZodObject<{
     id: import("zod").ZodString;
     plannedFor: import("zod").ZodString;
     schedule: import("zod").ZodString;
+    scheduleName: import("zod").ZodOptional<import("zod").ZodString>;
     sequence: import("zod").ZodNumber;
     settledAt: import("zod").ZodOptional<import("zod").ZodString>;
     state: import("zod").ZodEnum<{
@@ -269,6 +285,12 @@ export declare const portableAttemptRecordSchema: import("zod").ZodObject<{
         expired: "expired";
         not_captured: "not_captured";
     }>>;
+    requestUnavailable: import("zod").ZodOptional<import("zod").ZodEnum<{
+        schedule_changed: "schedule_changed";
+        endpoint_changed: "endpoint_changed";
+        endpoint_deleted: "endpoint_deleted";
+        payload_deleted: "payload_deleted";
+    }>>;
     responseHeaders: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
         name: import("zod").ZodString;
         value: import("zod").ZodString;
@@ -349,11 +371,21 @@ export declare const portableAttemptRecordSchema: import("zod").ZodObject<{
             name: import("zod").ZodString;
             suppressed: import("zod").ZodLiteral<true>;
         }, import("zod/v4/core").$strict>]>>;
-        encryptedTemplate: import("zod").ZodOptional<import("zod").ZodObject<{
+        encryptedTemplate: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
             keyId: import("zod").ZodLiteral<"v1">;
             nonce: import("zod").ZodString;
             ciphertext: import("zod").ZodString;
-        }, import("zod/v4/core").$strict>>;
+        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+            keyId: import("zod").ZodLiteral<"v1">;
+            nonce: import("zod").ZodString;
+            ciphertext: import("zod").ZodString;
+            version: import("zod").ZodLiteral<2>;
+            codec: import("zod").ZodEnum<{
+                identity: "identity";
+                gzip: "gzip";
+            }>;
+            originalBytes: import("zod").ZodNumber;
+        }, import("zod/v4/core").$strict>]>>;
     }, import("zod/v4/core").$strict>>;
     httpPayloadRetentionDueAt: import("zod").ZodOptional<import("zod").ZodString>;
     authority: import("zod").ZodObject<{
@@ -371,7 +403,10 @@ export declare const portableAttemptRecordSchema: import("zod").ZodObject<{
 }, import("zod/v4/core").$strict>;
 export type PortableAttemptRecord = z.infer<typeof portableAttemptRecordSchema>;
 export declare const portableEncryptedPayloadRecordSchema: import("zod").ZodObject<{
-    aadVersion: import("zod").ZodLiteral<"greatwait.schedule-payload.v1">;
+    aadVersion: import("zod").ZodEnum<{
+        "greatwait.schedule-payload.v1": "greatwait.schedule-payload.v1";
+        "greatwait.schedule-payload.v2": "greatwait.schedule-payload.v2";
+    }>;
     authority: import("zod").ZodObject<{
         environment: import("zod").ZodString;
         environmentKind: import("zod").ZodEnum<{
@@ -381,11 +416,21 @@ export declare const portableEncryptedPayloadRecordSchema: import("zod").ZodObje
         organization: import("zod").ZodString;
         project: import("zod").ZodString;
     }, import("zod/v4/core").$strict>;
-    envelope: import("zod").ZodObject<{
+    envelope: import("zod").ZodUnion<readonly [import("zod").ZodObject<{
         ciphertext: import("zod").ZodString;
         keyId: import("zod").ZodString;
         nonce: import("zod").ZodString;
-    }, import("zod/v4/core").$strict>;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        ciphertext: import("zod").ZodString;
+        keyId: import("zod").ZodString;
+        nonce: import("zod").ZodString;
+        version: import("zod").ZodLiteral<2>;
+        codec: import("zod").ZodEnum<{
+            identity: "identity";
+            gzip: "gzip";
+        }>;
+        originalBytes: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strict>]>;
     plaintextBytes: import("zod").ZodNumber;
     retentionDueAt: import("zod").ZodOptional<import("zod").ZodString>;
     schedule: import("zod").ZodString;
@@ -457,6 +502,12 @@ export declare const portableSchedulingRecordSetSchema: import("zod").ZodObject<
             expired: "expired";
             not_captured: "not_captured";
         }>>;
+        requestUnavailable: import("zod").ZodOptional<import("zod").ZodEnum<{
+            schedule_changed: "schedule_changed";
+            endpoint_changed: "endpoint_changed";
+            endpoint_deleted: "endpoint_deleted";
+            payload_deleted: "payload_deleted";
+        }>>;
         responseHeaders: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
             name: import("zod").ZodString;
             value: import("zod").ZodString;
@@ -537,11 +588,21 @@ export declare const portableSchedulingRecordSetSchema: import("zod").ZodObject<
                 name: import("zod").ZodString;
                 suppressed: import("zod").ZodLiteral<true>;
             }, import("zod/v4/core").$strict>]>>;
-            encryptedTemplate: import("zod").ZodOptional<import("zod").ZodObject<{
+            encryptedTemplate: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
                 keyId: import("zod").ZodLiteral<"v1">;
                 nonce: import("zod").ZodString;
                 ciphertext: import("zod").ZodString;
-            }, import("zod/v4/core").$strict>>;
+            }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+                keyId: import("zod").ZodLiteral<"v1">;
+                nonce: import("zod").ZodString;
+                ciphertext: import("zod").ZodString;
+                version: import("zod").ZodLiteral<2>;
+                codec: import("zod").ZodEnum<{
+                    identity: "identity";
+                    gzip: "gzip";
+                }>;
+                originalBytes: import("zod").ZodNumber;
+            }, import("zod/v4/core").$strict>]>>;
         }, import("zod/v4/core").$strict>>;
         httpPayloadRetentionDueAt: import("zod").ZodOptional<import("zod").ZodString>;
         authority: import("zod").ZodObject<{
@@ -562,6 +623,7 @@ export declare const portableSchedulingRecordSetSchema: import("zod").ZodObject<
         id: import("zod").ZodString;
         plannedFor: import("zod").ZodString;
         schedule: import("zod").ZodString;
+        scheduleName: import("zod").ZodOptional<import("zod").ZodString>;
         sequence: import("zod").ZodNumber;
         settledAt: import("zod").ZodOptional<import("zod").ZodString>;
         state: import("zod").ZodEnum<{
@@ -599,7 +661,10 @@ export declare const portableSchedulingRecordSetSchema: import("zod").ZodObject<
         updatedAt: import("zod").ZodString;
     }, import("zod/v4/core").$strict>>;
     payload: import("zod").ZodOptional<import("zod").ZodObject<{
-        aadVersion: import("zod").ZodLiteral<"greatwait.schedule-payload.v1">;
+        aadVersion: import("zod").ZodEnum<{
+            "greatwait.schedule-payload.v1": "greatwait.schedule-payload.v1";
+            "greatwait.schedule-payload.v2": "greatwait.schedule-payload.v2";
+        }>;
         authority: import("zod").ZodObject<{
             environment: import("zod").ZodString;
             environmentKind: import("zod").ZodEnum<{
@@ -609,11 +674,21 @@ export declare const portableSchedulingRecordSetSchema: import("zod").ZodObject<
             organization: import("zod").ZodString;
             project: import("zod").ZodString;
         }, import("zod/v4/core").$strict>;
-        envelope: import("zod").ZodObject<{
+        envelope: import("zod").ZodUnion<readonly [import("zod").ZodObject<{
             ciphertext: import("zod").ZodString;
             keyId: import("zod").ZodString;
             nonce: import("zod").ZodString;
-        }, import("zod/v4/core").$strict>;
+        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+            ciphertext: import("zod").ZodString;
+            keyId: import("zod").ZodString;
+            nonce: import("zod").ZodString;
+            version: import("zod").ZodLiteral<2>;
+            codec: import("zod").ZodEnum<{
+                identity: "identity";
+                gzip: "gzip";
+            }>;
+            originalBytes: import("zod").ZodNumber;
+        }, import("zod/v4/core").$strict>]>;
         plaintextBytes: import("zod").ZodNumber;
         retentionDueAt: import("zod").ZodOptional<import("zod").ZodString>;
         schedule: import("zod").ZodString;
@@ -677,11 +752,21 @@ export declare const portableSchedulingRecordSetSchema: import("zod").ZodObject<
                 name: import("zod").ZodString;
                 suppressed: import("zod").ZodLiteral<true>;
             }, import("zod/v4/core").$strict>]>>;
-            encryptedTemplate: import("zod").ZodOptional<import("zod").ZodObject<{
+            encryptedTemplate: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
+                keyId: import("zod").ZodLiteral<"v1">;
+                nonce: import("zod").ZodString;
+                ciphertext: import("zod").ZodString;
+            }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
                 keyId: import("zod").ZodLiteral<"v1">;
                 nonce: import("zod").ZodString;
                 ciphertext: import("zod").ZodString;
-            }, import("zod/v4/core").$strict>>;
+                version: import("zod").ZodLiteral<2>;
+                codec: import("zod").ZodEnum<{
+                    identity: "identity";
+                    gzip: "gzip";
+                }>;
+                originalBytes: import("zod").ZodNumber;
+            }, import("zod/v4/core").$strict>]>>;
         }, import("zod/v4/core").$strict>>;
         httpTemplateRetentionDueAt: import("zod").ZodOptional<import("zod").ZodString>;
         authority: import("zod").ZodObject<{
@@ -749,9 +834,14 @@ export declare const portableSchedulingRecordSetSchema: import("zod").ZodObject<
         generation: import("zod").ZodNumber;
         id: import("zod").ZodString;
         latencyClass: import("zod").ZodEnum<{
-            realtime: "realtime";
             bulk: "bulk";
+            realtime: "realtime";
         }>;
+        requestedLatencyClass: import("zod").ZodOptional<import("zod").ZodEnum<{
+            bulk: "bulk";
+            realtime: "realtime";
+            auto: "auto";
+        }>>;
         lateness: import("zod").ZodObject<{
             maxStalenessSeconds: import("zod").ZodOptional<import("zod").ZodNumber>;
             policy: import("zod").ZodEnum<{

package/dist/scheduling-records.js

@@ -116,19 +116,35 @@ const base64UrlBytesSchema = z
     .refine((value) => decodeBase64UrlBytes(value) !== undefined, {
     message: "must canonically encode base64url bytes",
 });
+const portableLegacyPayloadEnvelopeSchema = z.strictObject({
+    ciphertext: base64UrlBytesSchema,
+    keyId: z
+        .string()
+        .min(1)
+        .max(128)
+        .regex(/^[A-Za-z0-9._:-]+$/u, "must be a safe key identifier"),
+    nonce: base64UrlBytesSchema.refine((value) => decodeBase64UrlBytes(value)?.length === 12, { message: "must encode exactly 12 bytes" }),
+});
+const portableV2PayloadEnvelopeSchema = portableLegacyPayloadEnvelopeSchema.extend({
+    version: z.literal(2),
+    codec: z.enum(["identity", "gzip"]),
+    originalBytes: z
+        .number()
+        .int()
+        .nonnegative()
+        .max(SCHEDULING_BOUNDS.payloadBytes),
+});
 export const portableEncryptedPayloadRecordSchema = z
     .strictObject({
-    aadVersion: z.literal(SCHEDULE_PAYLOAD_AAD_VERSION),
+    aadVersion: z.enum([
+        SCHEDULE_PAYLOAD_AAD_VERSION,
+        "greatwait.schedule-payload.v2",
+    ]),
     authority: portableAuthoritySchema,
-    envelope: z.strictObject({
-        ciphertext: base64UrlBytesSchema,
-        keyId: z
-            .string()
-            .min(1)
-            .max(128)
-            .regex(/^[A-Za-z0-9._:-]+$/u, "must be a safe key identifier"),
-        nonce: base64UrlBytesSchema.refine((value) => decodeBase64UrlBytes(value)?.length === 12, { message: "must encode exactly 12 bytes" }),
-    }),
+    envelope: z.union([
+        portableLegacyPayloadEnvelopeSchema,
+        portableV2PayloadEnvelopeSchema,
+    ]),
     plaintextBytes: z
         .number()
         .int()
@@ -142,10 +158,18 @@ export const portableEncryptedPayloadRecordSchema = z
     .superRefine((payload, context) => {
     const ciphertext = decodeBase64UrlBytes(payload.envelope.ciphertext);
     if (ciphertext !== undefined &&
-        ciphertext.length !== payload.plaintextBytes + 16) {
+        ("version" in payload.envelope
+            ? payload.aadVersion !== "greatwait.schedule-payload.v2" ||
+                payload.envelope.originalBytes !== payload.plaintextBytes ||
+                ciphertext.length < 16 ||
+                ciphertext.length > payload.plaintextBytes + 16 ||
+                (payload.envelope.codec === "identity" &&
+                    ciphertext.length !== payload.plaintextBytes + 16)
+            : payload.aadVersion !== SCHEDULE_PAYLOAD_AAD_VERSION ||
+                ciphertext.length !== payload.plaintextBytes + 16)) {
         context.addIssue({
             code: "custom",
-            message: "ciphertext must contain the plaintext bytes and a 16-byte AES-GCM tag",
+            message: "ciphertext and authenticated envelope metadata must match the payload version and size",
             path: ["envelope", "ciphertext"],
         });
     }