@slates/proto 1.0.0-rc.27 → 1.0.0-rc.29

package/dist/index.module.js

@@ -211,9 +211,16 @@ var slatesTriggerGroupInvocation = z8.union([
   }),
   z8.object({
     type: z8.literal("webhook"),
+    supportsExpansion: z8.boolean().optional(),
+    supportsRenewal: z8.boolean().optional(),
+    reconcileIntervalSeconds: z8.number().int().min(900).optional(),
     registration: z8.union([
       z8.object({
-        mode: z8.literal("auto")
+        mode: z8.literal("auto"),
+        deliveryConfig: z8.object({
+          userConfigSchema: z8.record(z8.string(), z8.any()),
+          fullConfigSchema: z8.record(z8.string(), z8.any())
+        }).optional()
       }),
       z8.object({
         mode: z8.literal("manual"),
@@ -228,6 +235,7 @@ var slatesTriggerGroup = z8.object({
   name: z8.string(),
   description: z8.string().optional(),
   metadata: z8.record(z8.string(), z8.any()).optional(),
+  selectionSchema: z8.record(z8.string(), z8.any()).optional(),
   invocation: slatesTriggerGroupInvocation
 });
 var slatesWebhookTargetOwnership = z8.enum(["single_user", "multi_user"]);
@@ -780,9 +788,24 @@ var slatesMessageHubLiveInvocationSetNotification = z14.object({
     baseUrl: z14.string()
   })
 });
+var slatesRuntimeInfo = z14.object({
+  metorial: z14.object({
+    apiUrl: z14.string().url().max(2048),
+    region: z14.string().max(64).nullish(),
+    environment: z14.string().max(64).nullish()
+  }).optional()
+});
+var slatesMessageHubRuntimeInfoSetNotification = z14.object({
+  jsonrpc: z14.literal("2.0"),
+  method: z14.literal("slates/hub.runtime_info.set"),
+  params: z14.object({
+    runtimeInfo: slatesRuntimeInfo
+  })
+});
 var slatesHubNotificationsByMethod = {
   "slates/hub.capabilities.set": slatesMessageHubCapabilitiesSetNotification,
-  "slates/hub.live_invocation.set": slatesMessageHubLiveInvocationSetNotification
+  "slates/hub.live_invocation.set": slatesMessageHubLiveInvocationSetNotification,
+  "slates/hub.runtime_info.set": slatesMessageHubRuntimeInfoSetNotification
 };
 var slatesMessageProviderCapabilitiesGetRequest = z14.object({
   jsonrpc: z14.literal("2.0"),
@@ -797,7 +820,8 @@ var slatesMessageProviderCapabilitiesGetResponse = z14.object({
     capabilities: z14.object({
       hub: z14.object({
         capabilitiesNotification: z14.boolean().optional(),
-        liveInvocation: z14.boolean().optional()
+        liveInvocation: z14.boolean().optional(),
+        runtimeInfo: z14.boolean().optional()
       }).optional(),
       provider: z14.object({
         triggerGroups: z14.boolean().optional(),
@@ -972,11 +996,36 @@ var slatesTriggerGroupWebhookEvent = z18.object({
 var slatesTriggerGroupWebhookSkipped = z18.object({
   reason: z18.string()
 });
+var slatesTriggerGroupRoutingKeys = z18.array(z18.string().min(1).max(512)).max(16);
+var slatesTriggerGroupWebhookRequest = {
+  url: z18.string(),
+  method: z18.string(),
+  headers: z18.record(z18.string(), z18.string()),
+  body: z18.object({
+    encoding: z18.literal("base64"),
+    content: z18.string()
+  }).nullable()
+};
 var slatesTriggerGroupPollEvent = z18.object({
   payload: z18.record(z18.string(), z18.any()),
   idempotencyKey: z18.string().optional(),
   triggerIds: z18.array(z18.string())
 });
+var slatesTriggerGroupWebhookRegistrationResult = z18.object({
+  webhookRegistrationIdentifier: z18.string(),
+  webhookRegistrationPayload: z18.any(),
+  expiresAt: z18.iso.datetime({ offset: true }).nullable().optional(),
+  renewAfter: z18.iso.datetime({ offset: true }).nullable().optional(),
+  routingKeys: slatesTriggerGroupRoutingKeys.optional()
+});
+var slatesTriggerGroupWebhookDeliveryAuthentication = z18.object({
+  routingKeys: slatesTriggerGroupRoutingKeys,
+  rejected: z18.object({ status: z18.number().int().min(400).max(599) }).nullable().optional()
+});
+var slatesTriggerGroupWebhookExpansionResult = z18.object({
+  events: z18.array(slatesTriggerGroupPollEvent.omit({ triggerIds: true })),
+  updatedState: z18.any().nullable().optional()
+});
 var slatesMessageTriggerGroupsListRequest = z18.object({
   jsonrpc: z18.literal("2.0"),
   method: z18.literal("slates/trigger_groups.list"),
@@ -1011,7 +1060,8 @@ var slatesMessageTriggerGroupWebhookTargetsListRequest = z18.object({
   id: z18.string(),
   params: z18.object({
     triggerGroupId: z18.string(),
-    pageToken: z18.any().nullable().optional()
+    pageToken: z18.any().nullable().optional(),
+    selection: z18.record(z18.string(), z18.any()).optional()
   })
 });
 var slatesMessageTriggerGroupWebhookTargetsListResponse = z18.object({
@@ -1031,17 +1081,38 @@ var slatesMessageTriggerGroupWebhookRegisterRequest = z18.object({
     triggerGroupId: z18.string(),
     webhookTargetIdentifier: z18.string(),
     webhookTargetPayload: z18.any(),
-    webhookUrl: z18.string()
+    webhookUrl: z18.string(),
+    operationId: z18.string().min(1).optional(),
+    selection: z18.record(z18.string(), z18.any()).optional(),
+    deliveryConfig: z18.any().optional()
   })
 });
 var slatesMessageTriggerGroupWebhookRegisterResponse = z18.object({
   jsonrpc: z18.literal("2.0"),
   id: z18.string(),
-  result: withRequestTraces({
+  result: withRequestTraces(slatesTriggerGroupWebhookRegistrationResult.shape)
+});
+var slatesMessageTriggerGroupWebhookRenewRequest = z18.object({
+  jsonrpc: z18.literal("2.0"),
+  method: z18.literal("slates/trigger_group.webhook.renew"),
+  id: z18.string(),
+  params: z18.object({
+    triggerGroupId: z18.string(),
     webhookRegistrationIdentifier: z18.string(),
-    webhookRegistrationPayload: z18.any()
+    webhookRegistrationPayload: z18.any(),
+    webhookUrl: z18.string(),
+    webhookTargetIdentifier: z18.string(),
+    webhookTargetPayload: z18.any(),
+    operationId: z18.string().min(1),
+    selection: z18.record(z18.string(), z18.any()).optional(),
+    deliveryConfig: z18.any().optional()
   })
 });
+var slatesMessageTriggerGroupWebhookRenewResponse = z18.object({
+  jsonrpc: z18.literal("2.0"),
+  id: z18.string(),
+  result: withRequestTraces(slatesTriggerGroupWebhookRegistrationResult.shape)
+});
 var slatesMessageTriggerGroupWebhookUnregisterRequest = z18.object({
   jsonrpc: z18.literal("2.0"),
   method: z18.literal("slates/trigger_group.webhook.unregister"),
@@ -1098,13 +1169,7 @@ var slatesMessageTriggerGroupWebhookProcessRequest = z18.object({
   id: z18.string(),
   params: z18.object({
     triggerGroupId: z18.string(),
-    url: z18.string(),
-    method: z18.string(),
-    headers: z18.record(z18.string(), z18.string()),
-    body: z18.object({
-      encoding: z18.literal("base64"),
-      content: z18.string()
-    }).nullable(),
+    ...slatesTriggerGroupWebhookRequest,
     webhookRegistrationPayload: z18.any()
   })
 });
@@ -1113,10 +1178,47 @@ var slatesMessageTriggerGroupWebhookProcessResponse = z18.object({
   id: z18.string(),
   result: withRequestTraces({
     events: z18.array(slatesTriggerGroupWebhookEvent),
+    requiresExpansion: z18.boolean().optional(),
     response: slatesWebhookHttpResponse.nullable().optional(),
     skipped: slatesTriggerGroupWebhookSkipped.nullable().optional()
   })
 });
+var slatesMessageTriggerGroupWebhookDeliveryAuthenticateRequest = z18.object({
+  jsonrpc: z18.literal("2.0"),
+  method: z18.literal("slates/trigger_group.webhook.delivery_authenticate"),
+  id: z18.string(),
+  params: z18.object({
+    triggerGroupId: z18.string(),
+    ...slatesTriggerGroupWebhookRequest,
+    deliveryConfig: z18.any()
+  })
+});
+var slatesMessageTriggerGroupWebhookDeliveryAuthenticateResponse = z18.object({
+  jsonrpc: z18.literal("2.0"),
+  id: z18.string(),
+  result: withRequestTraces(slatesTriggerGroupWebhookDeliveryAuthentication.shape)
+});
+var slatesMessageTriggerGroupWebhookExpandRequest = z18.object({
+  jsonrpc: z18.literal("2.0"),
+  method: z18.literal("slates/trigger_group.webhook.expand"),
+  id: z18.string(),
+  params: z18.object({
+    triggerGroupId: z18.string(),
+    payload: z18.record(z18.string(), z18.any()).nullable(),
+    state: z18.any().nullable().optional(),
+    selection: z18.record(z18.string(), z18.any()).optional(),
+    deliveryId: z18.string().min(1),
+    webhookRegistrationPayload: z18.any()
+  })
+});
+var slatesMessageTriggerGroupWebhookExpandResponse = z18.object({
+  jsonrpc: z18.literal("2.0"),
+  id: z18.string(),
+  result: withRequestTraces({
+    events: z18.array(slatesTriggerGroupPollEvent),
+    updatedState: z18.any().nullable().optional()
+  })
+});
 var slatesMessageTriggerGroupRoutingMatchersGetRequest = z18.object({
   jsonrpc: z18.literal("2.0"),
   method: z18.literal("slates/trigger_group.routing_matchers.get"),
@@ -1138,7 +1240,8 @@ var slatesMessageTriggerGroupPollingPollRequest = z18.object({
   id: z18.string(),
   params: z18.object({
     triggerGroupId: z18.string(),
-    state: z18.any().nullable()
+    state: z18.any().nullable(),
+    selection: z18.record(z18.string(), z18.any()).optional()
   })
 });
 var slatesMessageTriggerGroupPollingPollResponse = z18.object({
@@ -1200,10 +1303,13 @@ var slatesTriggerGroupResponsesByMethod = {
   "slates/trigger_group.get": slatesMessageTriggerGroupGetResponse,
   "slates/trigger_group.webhook.targets_list": slatesMessageTriggerGroupWebhookTargetsListResponse,
   "slates/trigger_group.webhook.register": slatesMessageTriggerGroupWebhookRegisterResponse,
+  "slates/trigger_group.webhook.renew": slatesMessageTriggerGroupWebhookRenewResponse,
+  "slates/trigger_group.webhook.expand": slatesMessageTriggerGroupWebhookExpandResponse,
   "slates/trigger_group.webhook.unregister": slatesMessageTriggerGroupWebhookUnregisterResponse,
   "slates/trigger_group.webhook.manual_setup": slatesMessageTriggerGroupWebhookManualSetupResponse,
   "slates/trigger_group.webhook.manual_finish": slatesMessageTriggerGroupWebhookManualFinishResponse,
   "slates/trigger_group.webhook.process": slatesMessageTriggerGroupWebhookProcessResponse,
+  "slates/trigger_group.webhook.delivery_authenticate": slatesMessageTriggerGroupWebhookDeliveryAuthenticateResponse,
   "slates/trigger_group.routing_matchers.get": slatesMessageTriggerGroupRoutingMatchersGetResponse,
   "slates/trigger_group.polling.poll": slatesMessageTriggerGroupPollingPollResponse,
   "slates/trigger_group.gateway.connect": slatesMessageTriggerGroupGatewayConnectResponse,
@@ -1214,10 +1320,13 @@ var slatesTriggerGroupRequestsByMethod = {
   "slates/trigger_group.get": slatesMessageTriggerGroupGetRequest,
   "slates/trigger_group.webhook.targets_list": slatesMessageTriggerGroupWebhookTargetsListRequest,
   "slates/trigger_group.webhook.register": slatesMessageTriggerGroupWebhookRegisterRequest,
+  "slates/trigger_group.webhook.renew": slatesMessageTriggerGroupWebhookRenewRequest,
+  "slates/trigger_group.webhook.expand": slatesMessageTriggerGroupWebhookExpandRequest,
   "slates/trigger_group.webhook.unregister": slatesMessageTriggerGroupWebhookUnregisterRequest,
   "slates/trigger_group.webhook.manual_setup": slatesMessageTriggerGroupWebhookManualSetupRequest,
   "slates/trigger_group.webhook.manual_finish": slatesMessageTriggerGroupWebhookManualFinishRequest,
   "slates/trigger_group.webhook.process": slatesMessageTriggerGroupWebhookProcessRequest,
+  "slates/trigger_group.webhook.delivery_authenticate": slatesMessageTriggerGroupWebhookDeliveryAuthenticateRequest,
   "slates/trigger_group.routing_matchers.get": slatesMessageTriggerGroupRoutingMatchersGetRequest,
   "slates/trigger_group.polling.poll": slatesMessageTriggerGroupPollingPollRequest,
   "slates/trigger_group.gateway.connect": slatesMessageTriggerGroupGatewayConnectRequest,
@@ -1621,6 +1730,7 @@ export {
   slatesMessageHelloNotification,
   slatesMessageHubCapabilitiesSetNotification,
   slatesMessageHubLiveInvocationSetNotification,
+  slatesMessageHubRuntimeInfoSetNotification,
   slatesMessageProviderCapabilitiesGetRequest,
   slatesMessageProviderCapabilitiesGetResponse,
   slatesMessageProviderIdentifyRequest,
@@ -1641,6 +1751,10 @@ export {
   slatesMessageTriggerGroupPollingPollResponse,
   slatesMessageTriggerGroupRoutingMatchersGetRequest,
   slatesMessageTriggerGroupRoutingMatchersGetResponse,
+  slatesMessageTriggerGroupWebhookDeliveryAuthenticateRequest,
+  slatesMessageTriggerGroupWebhookDeliveryAuthenticateResponse,
+  slatesMessageTriggerGroupWebhookExpandRequest,
+  slatesMessageTriggerGroupWebhookExpandResponse,
   slatesMessageTriggerGroupWebhookManualFinishRequest,
   slatesMessageTriggerGroupWebhookManualFinishResponse,
   slatesMessageTriggerGroupWebhookManualSetupRequest,
@@ -1649,6 +1763,8 @@ export {
   slatesMessageTriggerGroupWebhookProcessResponse,
   slatesMessageTriggerGroupWebhookRegisterRequest,
   slatesMessageTriggerGroupWebhookRegisterResponse,
+  slatesMessageTriggerGroupWebhookRenewRequest,
+  slatesMessageTriggerGroupWebhookRenewResponse,
   slatesMessageTriggerGroupWebhookTargetsListRequest,
   slatesMessageTriggerGroupWebhookTargetsListResponse,
   slatesMessageTriggerGroupWebhookUnregisterRequest,
@@ -1661,6 +1777,7 @@ export {
   slatesRequestTraceTextBody,
   slatesRequestsByMethod,
   slatesResponsesByMethod,
+  slatesRuntimeInfo,
   slatesToolCategory,
   slatesToolCategoryRequestsByMethod,
   slatesToolCategoryResponsesByMethod,
@@ -1668,6 +1785,9 @@ export {
   slatesTriggerGroupInvocation,
   slatesTriggerGroupRequestsByMethod,
   slatesTriggerGroupResponsesByMethod,
+  slatesTriggerGroupWebhookDeliveryAuthentication,
+  slatesTriggerGroupWebhookExpansionResult,
+  slatesTriggerGroupWebhookRegistrationResult,
   slatesTriggerGroupWebhookSkipped,
   slatesTriggerRoutingMatcher,
   slatesWebhookHttpResponse,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@slates/proto",
-  "version": "1.0.0-rc.27",
+  "version": "1.0.0-rc.29",
   "publishConfig": {
     "access": "public"
   },

package/src/messages/hub.ts

@@ -36,13 +36,39 @@ export type SlatesMessageHubLiveInvocationSetNotification = z.infer<
   typeof slatesMessageHubLiveInvocationSetNotification
 >;
 
+export let slatesRuntimeInfo = z.object({
+  metorial: z
+    .object({
+      apiUrl: z.string().url().max(2048),
+      region: z.string().max(64).nullish(),
+      environment: z.string().max(64).nullish()
+    })
+    .optional()
+});
+
+export type SlatesRuntimeInfo = z.infer<typeof slatesRuntimeInfo>;
+
+export let slatesMessageHubRuntimeInfoSetNotification = z.object({
+  jsonrpc: z.literal('2.0'),
+  method: z.literal('slates/hub.runtime_info.set'),
+  params: z.object({
+    runtimeInfo: slatesRuntimeInfo
+  })
+});
+
+export type SlatesMessageHubRuntimeInfoSetNotification = z.infer<
+  typeof slatesMessageHubRuntimeInfoSetNotification
+>;
+
 export type SlatesHubNotifications =
   | SlatesMessageHubCapabilitiesSetNotification
-  | SlatesMessageHubLiveInvocationSetNotification;
+  | SlatesMessageHubLiveInvocationSetNotification
+  | SlatesMessageHubRuntimeInfoSetNotification;
 
 export let slatesHubNotificationsByMethod = {
   'slates/hub.capabilities.set': slatesMessageHubCapabilitiesSetNotification,
-  'slates/hub.live_invocation.set': slatesMessageHubLiveInvocationSetNotification
+  'slates/hub.live_invocation.set': slatesMessageHubLiveInvocationSetNotification,
+  'slates/hub.runtime_info.set': slatesMessageHubRuntimeInfoSetNotification
 };
 
 export let slatesMessageProviderCapabilitiesGetRequest = z.object({
@@ -64,7 +90,8 @@ export let slatesMessageProviderCapabilitiesGetResponse = z.object({
       hub: z
         .object({
           capabilitiesNotification: z.boolean().optional(),
-          liveInvocation: z.boolean().optional()
+          liveInvocation: z.boolean().optional(),
+          runtimeInfo: z.boolean().optional()
         })
         .optional(),
       provider: z

package/src/messages/triggerGroup.test.ts

@@ -0,0 +1,281 @@
+import { describe, expect, it } from 'vitest';
+import { slatesTriggerGroup } from '../types';
+import {
+  slatesMessageTriggerGroupWebhookDeliveryAuthenticateRequest,
+  slatesMessageTriggerGroupWebhookDeliveryAuthenticateResponse,
+  slatesMessageTriggerGroupWebhookExpandRequest,
+  slatesMessageTriggerGroupWebhookExpandResponse,
+  slatesMessageTriggerGroupWebhookProcessRequest,
+  slatesMessageTriggerGroupWebhookRegisterRequest,
+  slatesMessageTriggerGroupWebhookRenewRequest,
+  slatesMessageTriggerGroupWebhookRenewResponse,
+  slatesTriggerGroupRequestsByMethod,
+  slatesTriggerGroupResponsesByMethod,
+  slatesTriggerGroupWebhookRegistrationResult
+} from './triggerGroup';
+
+describe('trigger lifecycle wire contracts', () => {
+  it('registers additive request and response methods', () => {
+    expect(slatesTriggerGroupRequestsByMethod['slates/trigger_group.webhook.expand']).toBe(
+      slatesMessageTriggerGroupWebhookExpandRequest
+    );
+    expect(slatesTriggerGroupResponsesByMethod['slates/trigger_group.webhook.expand']).toBe(
+      slatesMessageTriggerGroupWebhookExpandResponse
+    );
+    expect(slatesTriggerGroupRequestsByMethod['slates/trigger_group.webhook.renew']).toBe(
+      slatesMessageTriggerGroupWebhookRenewRequest
+    );
+    expect(slatesTriggerGroupResponsesByMethod['slates/trigger_group.webhook.renew']).toBe(
+      slatesMessageTriggerGroupWebhookRenewResponse
+    );
+    expect(
+      slatesTriggerGroupRequestsByMethod['slates/trigger_group.webhook.delivery_authenticate']
+    ).toBe(slatesMessageTriggerGroupWebhookDeliveryAuthenticateRequest);
+    expect(
+      slatesTriggerGroupResponsesByMethod['slates/trigger_group.webhook.delivery_authenticate']
+    ).toBe(slatesMessageTriggerGroupWebhookDeliveryAuthenticateResponse);
+  });
+
+  it('preserves state omission versus explicit null across serialized responses', () => {
+    let parse = (result: unknown) =>
+      slatesMessageTriggerGroupWebhookExpandResponse.parse(
+        JSON.parse(JSON.stringify({ jsonrpc: '2.0', id: 'id', result }))
+      ).result;
+    expect(parse({ events: [] })).not.toHaveProperty('updatedState');
+    expect(parse({ events: [], updatedState: null })).toHaveProperty('updatedState', null);
+    expect(parse({ events: [], updatedState: ['cursor', 1] })).toHaveProperty('updatedState', [
+      'cursor',
+      1
+    ]);
+  });
+
+  it('requires stable lifecycle identities while accepting omitted selection', () => {
+    let request = {
+      jsonrpc: '2.0',
+      id: 'id',
+      method: 'slates/trigger_group.webhook.expand',
+      params: {
+        triggerGroupId: 'group',
+        payload: {},
+        deliveryId: 'delivery',
+        webhookRegistrationPayload: {}
+      }
+    };
+    expect(slatesMessageTriggerGroupWebhookExpandRequest.safeParse(request).success).toBe(
+      true
+    );
+    expect(
+      slatesMessageTriggerGroupWebhookExpandRequest.safeParse({
+        ...request,
+        params: { ...request.params, deliveryId: undefined }
+      }).success
+    ).toBe(false);
+    expect(
+      slatesMessageTriggerGroupWebhookExpandRequest.safeParse({
+        ...request,
+        params: { ...request.params, selection: null }
+      }).success
+    ).toBe(false);
+  });
+
+  it('validates ISO scheduling strings and retains legacy registration output', () => {
+    let registration = {
+      webhookRegistrationIdentifier: 'registration',
+      webhookRegistrationPayload: {}
+    };
+    expect(slatesTriggerGroupWebhookRegistrationResult.parse(registration)).toEqual(
+      registration
+    );
+    for (let value of ['2026-12-01T12:00:00Z', '2026-12-01T12:00:00+01:00', null]) {
+      expect(
+        slatesTriggerGroupWebhookRegistrationResult.safeParse({
+          ...registration,
+          expiresAt: value,
+          renewAfter: value
+        }).success
+      ).toBe(true);
+    }
+    for (let value of ['2026-02-30T12:00:00Z', 'tomorrow', 100, new Date()]) {
+      expect(
+        slatesTriggerGroupWebhookRegistrationResult.safeParse({
+          ...registration,
+          expiresAt: value
+        }).success
+      ).toBe(false);
+    }
+  });
+
+  it('carries bounded routing keys for registrations on a shared delivery channel', () => {
+    let registration = {
+      webhookRegistrationIdentifier: 'registration',
+      webhookRegistrationPayload: {}
+    };
+    expect(
+      slatesTriggerGroupWebhookRegistrationResult.parse({
+        ...registration,
+        routingKeys: ['mailbox:user@example.com']
+      }).routingKeys
+    ).toEqual(['mailbox:user@example.com']);
+    for (let routingKeys of [[''], ['x'.repeat(513)], Array(17).fill('key'), 'key']) {
+      expect(
+        slatesTriggerGroupWebhookRegistrationResult.safeParse({ ...registration, routingKeys })
+          .success
+      ).toBe(false);
+    }
+  });
+
+  it('accepts old group metadata without new capability flags', () => {
+    let group = {
+      id: 'group',
+      name: 'Group',
+      invocation: { type: 'webhook', registration: { mode: 'auto' } }
+    };
+    expect(slatesTriggerGroup.parse(group)).toEqual(group);
+  });
+
+  it('carries an optional delivery config on automatic webhook registration', () => {
+    let config = {
+      userConfigSchema: { type: 'object', properties: { topicName: { type: 'string' } } },
+      fullConfigSchema: { type: 'object', properties: { audience: { type: 'string' } } }
+    };
+    let group = (registration: Record<string, unknown>) => ({
+      id: 'group',
+      name: 'Group',
+      invocation: { type: 'webhook', registration }
+    });
+    let configured = group({ mode: 'auto', deliveryConfig: config });
+    expect(slatesTriggerGroup.parse(configured)).toEqual(configured);
+    let manual = group({ mode: 'manual', ...config });
+    expect(slatesTriggerGroup.parse(manual)).toEqual(manual);
+    for (let invalid of [{}, { userConfigSchema: {} }, { fullConfigSchema: {} }, 'config']) {
+      expect(
+        slatesTriggerGroup.safeParse(group({ mode: 'auto', deliveryConfig: invalid })).success
+      ).toBe(false);
+    }
+  });
+
+  it('passes the saved delivery config to register and renew unchanged', () => {
+    let deliveryConfig = { topic: 'topic', nested: { secret: 'kept' } };
+    let register = {
+      jsonrpc: '2.0',
+      id: 'id',
+      method: 'slates/trigger_group.webhook.register',
+      params: {
+        triggerGroupId: 'group',
+        webhookTargetIdentifier: 'target',
+        webhookTargetPayload: {},
+        webhookUrl: 'https://hooks.example/receive',
+        deliveryConfig
+      }
+    };
+    expect(
+      slatesMessageTriggerGroupWebhookRegisterRequest.parse(register).params.deliveryConfig
+    ).toEqual(deliveryConfig);
+    let renew = {
+      ...register,
+      method: 'slates/trigger_group.webhook.renew',
+      params: {
+        ...register.params,
+        webhookRegistrationIdentifier: 'registration',
+        webhookRegistrationPayload: {},
+        operationId: 'operation'
+      }
+    };
+    expect(
+      slatesMessageTriggerGroupWebhookRenewRequest.parse(renew).params.deliveryConfig
+    ).toEqual(deliveryConfig);
+    let { deliveryConfig: _, ...withoutConfig } = register.params;
+    expect(
+      slatesMessageTriggerGroupWebhookRegisterRequest.parse({
+        ...register,
+        params: withoutConfig
+      }).params
+    ).not.toHaveProperty('deliveryConfig');
+  });
+});
+
+describe('webhook delivery authentication wire contract', () => {
+  let request = {
+    jsonrpc: '2.0',
+    id: 'id',
+    method: 'slates/trigger_group.webhook.delivery_authenticate',
+    params: {
+      triggerGroupId: 'group',
+      url: 'https://hooks.example/receive/config',
+      method: 'POST',
+      headers: { authorization: 'Bearer token' },
+      body: { encoding: 'base64', content: 'e30=' },
+      deliveryConfig: { audience: 'https://hooks.example/receive/config' }
+    }
+  };
+  let response = (result: unknown) =>
+    slatesMessageTriggerGroupWebhookDeliveryAuthenticateResponse.safeParse({
+      jsonrpc: '2.0',
+      id: 'id',
+      result
+    });
+
+  it('carries the received request in the shape of webhook processing plus the saved config', () => {
+    expect(slatesMessageTriggerGroupWebhookDeliveryAuthenticateRequest.parse(request)).toEqual(
+      request
+    );
+    let { deliveryConfig: _, ...http } = request.params;
+    expect(
+      slatesMessageTriggerGroupWebhookProcessRequest.safeParse({
+        ...request,
+        method: 'slates/trigger_group.webhook.process',
+        params: { ...http, webhookRegistrationPayload: {} }
+      }).success
+    ).toBe(true);
+    expect(
+      slatesMessageTriggerGroupWebhookDeliveryAuthenticateRequest.safeParse({
+        ...request,
+        params: { ...request.params, body: null }
+      }).success
+    ).toBe(true);
+    for (let change of [
+      { url: undefined },
+      { headers: { count: 1 } },
+      { body: { encoding: 'utf-8', content: '{}' } },
+      { triggerGroupId: undefined }
+    ]) {
+      expect(
+        slatesMessageTriggerGroupWebhookDeliveryAuthenticateRequest.safeParse({
+          ...request,
+          params: { ...request.params, ...change }
+        }).success
+      ).toBe(false);
+    }
+  });
+
+  it('returns routing keys, an unroutable empty list, or a rejection status', () => {
+    for (let result of [
+      { routingKeys: ['mailbox:user@example.com'] },
+      { routingKeys: [] },
+      { routingKeys: ['a', 'b'], rejected: null },
+      { routingKeys: [], rejected: { status: 401 } },
+      { routingKeys: [], rejected: { status: 503 } }
+    ]) {
+      expect(response(result)).toMatchObject({ success: true, data: { result } });
+    }
+  });
+
+  it('bounds routing keys and rejection statuses', () => {
+    for (let result of [
+      {},
+      { rejected: { status: 401 } },
+      { routingKeys: [''] },
+      { routingKeys: ['x'.repeat(513)] },
+      { routingKeys: Array(17).fill('key') },
+      { routingKeys: 'key' },
+      { routingKeys: [], rejected: { status: 200 } },
+      { routingKeys: [], rejected: { status: 399 } },
+      { routingKeys: [], rejected: { status: 600 } },
+      { routingKeys: [], rejected: { status: 401.5 } },
+      { routingKeys: [], rejected: {} }
+    ]) {
+      expect(response(result).success).toBe(false);
+    }
+    expect(response({ routingKeys: Array(16).fill('k'.repeat(512)) }).success).toBe(true);
+  });
+});