@whooshbang/contracts 2.0.0-rc.7 → 2.0.0

package/openapi/generated/whooshbang-v1.bundle.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.1",
   "info": {
     "title": "WhooshBang API",
-    "version": "2.0.0-rc.7",
+    "version": "2.0.0",
     "description": "The V1 contract for human organization/project administration, project-scoped\nsubscription links, and asynchronous text messages. A Clerk session selects\none organization for administration. A project credential selects one organization,\nproject, and `test` or `live` environment for product operations; request\nbodies cannot override either authenticated scope.\n\nA person's OAuth grant selects one organization and carries scopes, but no\nproject. It names the project and environment it acts in through the URL\npath, on the environment-scoped form of each operation; the service checks\nthat path against the granting person's membership on every call. The flat\nforms remain credential-only and are unchanged.\n\nResource identifiers are opaque and are not authorization. Reads outside the\ncredential scope return the same `404` shape as absent resources. Provider\ncredentials, raw Telegram identity, and protected provider responses are\nnever part of this API.\n",
     "termsOfService": "https://flowxo.com/terms",
     "contact": {
@@ -24,6 +24,10 @@
       "name": "Organization",
       "description": "The current Clerk organization projected as a WhooshBang organization."
     },
+    {
+      "name": "Teammates",
+      "description": "The people in an organization, their roles and the projects each can see."
+    },
     {
       "name": "Projects",
       "description": "Organization-scoped applications with transactionally bootstrapped test/live environments."
@@ -269,8 +273,8 @@
     "/v1/billing/subscription-changes": {
       "post": {
         "operationId": "createSubscriptionChange",
+        "description": "Quote a new recurring selection without charging. Upgrades keep renewal and charge the new plan or additional add-on units for the remaining period, without unused-time credits or offsets. Paid dropped extras remain available through their original expiry and do not renew. Requires an administrator in the current organization. Without a current plan or add-on the change starts one. Confirmation matches the saved exact cash amount and charges the default card. Uncertain outcomes recover the same owned change.",
         "summary": "Quote an approved recurring change",
-        "description": "Requires an administrator in the current organization. A quote does not charge. Without a current plan or add-on the change starts one. Confirmation matches the saved exact cash amount and charges the default card. Uncertain outcomes recover the same owned change.",
         "tags": ["Organization"],
         "security": [{ "clerkSession": [] }, { "bearerGrant": [] }],
         "x-required-scopes": ["billing:write"],
@@ -311,8 +315,7 @@
     "/v1/billing/subscription-changes/{changeId}": {
       "get": {
         "operationId": "getSubscriptionChange",
-        "summary": "Recover an owned recurring change",
-        "description": "Requires an administrator in the current organization. A quote does not charge. Without a current plan or add-on the change starts one. Confirmation matches the saved exact cash amount and charges the default card. Uncertain outcomes recover the same owned change.",
+        "summary": "Recover an owned recurring change Requires an administrator in the current organization. Without a current plan or add-on the change starts one. Confirmation matches the saved exact cash amount and charges the default card. Uncertain outcomes recover the same owned change.",
         "tags": ["Organization"],
         "security": [{ "clerkSession": [] }, { "bearerGrant": [] }],
         "x-required-scopes": ["billing:read"],
@@ -355,8 +358,7 @@
     "/v1/billing/subscription-changes/{changeId}/confirm": {
       "post": {
         "operationId": "confirmSubscriptionChange",
-        "summary": "Confirm the quoted card charge or scheduled reduction",
-        "description": "Requires an administrator in the current organization. A quote does not charge. Without a current plan or add-on the change starts one. Confirmation matches the saved exact cash amount and charges the default card. Uncertain outcomes recover the same owned change.",
+        "summary": "Confirm the quoted card charge or scheduled reduction Requires an administrator in the current organization. Without a current plan or add-on the change starts one. Confirmation matches the saved exact cash amount and charges the default card. Uncertain outcomes recover the same owned change.",
         "tags": ["Organization"],
         "security": [{ "clerkSession": [] }, { "bearerGrant": [] }],
         "x-required-scopes": ["billing:write"],
@@ -912,6 +914,217 @@
         }
       }
     },
+    "/v1/organization/teammates": {
+      "get": {
+        "operationId": "listTeammates",
+        "summary": "List the organization's teammates and open invitations",
+        "description": "Returns every person in the organization with their role, the projects\nthey can see and whether they have joined, plus every invitation not yet\naccepted. Any teammate may read it; only an admin may change it.\n",
+        "tags": ["Teammates"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerGrant": ["teammates:read"] }
+        ],
+        "x-required-scopes": ["teammates:read"],
+        "x-organization-membership": "required",
+        "parameters": [
+          { "$ref": "#/components/parameters/ListAfterCursor" },
+          { "$ref": "#/components/parameters/ListPageLimit" },
+          { "$ref": "#/components/parameters/PageNumber" }
+        ],
+        "responses": {
+          "200": {
+            "description": "The organization's teammates.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/TeammateCollection" }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "429": { "$ref": "#/components/responses/RateLimited" }
+        }
+      },
+      "post": {
+        "operationId": "inviteTeammate",
+        "summary": "Invite a teammate",
+        "description": "Emails one invitation carrying the chosen role and, for a member or\nmessenger, the projects they will see. Nothing else is needed after they\naccept. Inviting an address that is already invited or already a\nteammate is refused rather than repeated.\n",
+        "tags": ["Teammates"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerGrant": ["teammates:write"] }
+        ],
+        "x-required-scopes": ["teammates:write"],
+        "x-organization-membership": "required",
+        "x-required-membership-role": "admin",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": { "$ref": "#/components/schemas/InviteTeammateRequest" }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "The invitation.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/Teammate" }
+              }
+            }
+          },
+          "400": { "$ref": "#/components/responses/BadRequest" },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "429": { "$ref": "#/components/responses/RateLimited" }
+        }
+      }
+    },
+    "/v1/organization/teammates/{teammate_id}": {
+      "parameters": [
+        {
+          "name": "teammate_id",
+          "in": "path",
+          "required": true,
+          "schema": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+        }
+      ],
+      "delete": {
+        "operationId": "removeTeammate",
+        "summary": "Remove a teammate or revoke an invitation",
+        "description": "Removes an active teammate from the organization, or revokes an\ninvitation. Removal applies to their next request, including requests\nfrom MCP connections they authorized. The last admin cannot be removed.\n",
+        "tags": ["Teammates"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerGrant": ["teammates:write"] }
+        ],
+        "x-required-scopes": ["teammates:write"],
+        "x-organization-membership": "required",
+        "x-required-membership-role": "admin",
+        "responses": {
+          "204": {
+            "description": "The teammate was removed or the invitation revoked.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" },
+          "429": { "$ref": "#/components/responses/RateLimited" }
+        }
+      }
+    },
+    "/v1/organization/teammates/{teammate_id}/access": {
+      "parameters": [
+        {
+          "name": "teammate_id",
+          "in": "path",
+          "required": true,
+          "schema": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+        }
+      ],
+      "put": {
+        "operationId": "setTeammateAccess",
+        "summary": "Change a teammate's role and projects",
+        "description": "Replaces the role and, for a member or messenger, the projects of an\nactive teammate or an open invitation. Narrowed access applies to their\nnext request. The last admin cannot be demoted.\n",
+        "tags": ["Teammates"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerGrant": ["teammates:write"] }
+        ],
+        "x-required-scopes": ["teammates:write"],
+        "x-organization-membership": "required",
+        "x-required-membership-role": "admin",
+        "x-repeat-semantics": {
+          "same_target": "idempotent",
+          "secret_returned": false
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": { "$ref": "#/components/schemas/TeammateAccessRequest" }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The teammate with their new access.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/Teammate" }
+              }
+            }
+          },
+          "400": { "$ref": "#/components/responses/BadRequest" },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" },
+          "429": { "$ref": "#/components/responses/RateLimited" }
+        }
+      }
+    },
+    "/v1/organization/teammates/{teammate_id}/resend": {
+      "parameters": [
+        {
+          "name": "teammate_id",
+          "in": "path",
+          "required": true,
+          "schema": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+        }
+      ],
+      "post": {
+        "operationId": "resendTeammateInvitation",
+        "summary": "Resend an invitation",
+        "description": "Replaces an open invitation with a fresh one carrying the same role and\nprojects, and emails it again. The earlier link stops working.\n",
+        "tags": ["Teammates"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerGrant": ["teammates:write"] }
+        ],
+        "x-required-scopes": ["teammates:write"],
+        "x-organization-membership": "required",
+        "x-required-membership-role": "admin",
+        "responses": {
+          "200": {
+            "description": "The renewed invitation.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/Teammate" }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" },
+          "429": { "$ref": "#/components/responses/RateLimited" }
+        }
+      }
+    },
     "/v1/provider-installations": {
       "get": {
         "operationId": "listProviderInstallations",
@@ -11999,23 +12212,23 @@
           "project_capacity": {
             "type": "integer",
             "minimum": 1,
-            "maximum": 10025
+            "maximum": 2147483647
           },
           "requested_project_ids": {
             "type": "array",
             "items": { "$ref": "#/components/schemas/OpaqueIdentifier" },
             "uniqueItems": true,
-            "maxItems": 10025
+            "maxItems": 2147483647
           },
           "active_project_ids": {
             "type": "array",
             "items": { "$ref": "#/components/schemas/OpaqueIdentifier" },
             "uniqueItems": true,
-            "maxItems": 10025
+            "maxItems": 2147483647
           }
         },
         "additionalProperties": false,
-        "description": "Reusable account project slots. After a downgrade the oldest requested projects retain active slots. Unassigned projects retain data, accepted delivery and answers; new live sends require an active slot."
+        "description": "Reusable account project slots. After a downgrade the oldest requested projects retain active slots. Unassigned projects retain data, accepted delivery and answers; new live sends require an active slot. Paid capacity includes all unexpired project purchases, so retained dropped extras can exceed the maximum renewing selection."
       },
       "AssignBillingProjectSlotsRequest": {
         "type": "object",
@@ -12158,6 +12371,10 @@
               }
             ],
             "description": "A recurring charge the default card did not pay. Paid access continues until the paid boundary; another attempt follows at next_attempt_at, or none when null. Update the card to settle it."
+          },
+          "recurring_selection": {
+            "$ref": "#/components/schemas/SubscriptionSelection",
+            "description": "Selection that will renew; paid project capacity can also include dropped extras until their original expiry. Optional for compatibility with older servers."
           }
         },
         "additionalProperties": false
@@ -12243,7 +12460,8 @@
                 "maxLength": 40
               },
               { "type": "null" }
-            ]
+            ],
+            "description": "Compatibility field: new upgrades return 0.000000; starts and boundary changes return null. Historical quotes can retain their recorded unused-time credit. No new automatic unused-time refunds or offsets."
           },
           "effective_at": {
             "anyOf": [
@@ -12800,6 +13018,122 @@
         },
         "additionalProperties": false
       },
+      "Teammate": {
+        "type": "object",
+        "description": "One person in the organization, or one invitation to it. Identity-provider identifiers are not public fields.",
+        "required": [
+          "id",
+          "status",
+          "role",
+          "name",
+          "email",
+          "projects",
+          "is_current_user",
+          "created_at"
+        ],
+        "properties": {
+          "id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+          "status": { "$ref": "#/components/schemas/TeammateStatus" },
+          "role": { "$ref": "#/components/schemas/OrganizationRole" },
+          "name": {
+            "anyOf": [
+              { "type": "null" },
+              { "type": "string", "minLength": 1, "maxLength": 200 }
+            ],
+            "description": "The person's name, when they have given one. Null for an invitation."
+          },
+          "email": {
+            "anyOf": [
+              { "type": "null" },
+              { "type": "string", "minLength": 1, "maxLength": 320 }
+            ],
+            "description": "The address the person signs in with, or the address invited."
+          },
+          "projects": { "$ref": "#/components/schemas/TeammateProjectAccess" },
+          "is_current_user": {
+            "type": "boolean",
+            "description": "Whether this is the person making the request."
+          },
+          "created_at": {
+            "$ref": "#/components/schemas/Timestamp",
+            "description": "When they joined, or when the invitation was sent."
+          },
+          "expires_at": {
+            "$ref": "#/components/schemas/Timestamp",
+            "description": "When an invitation stops working. Absent for an active teammate."
+          }
+        },
+        "additionalProperties": false
+      },
+      "TeammateCollection": {
+        "type": "object",
+        "description": "Everybody in the organization and every open invitation, people first.",
+        "required": ["items", "total"],
+        "properties": {
+          "items": {
+            "type": "array",
+            "maxItems": 100,
+            "items": { "$ref": "#/components/schemas/Teammate" }
+          },
+          "next_cursor": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "pattern": "^[A-Za-z0-9_-]+$"
+          },
+          "page": { "$ref": "#/components/schemas/ListPageNumber" },
+          "page_size": { "$ref": "#/components/schemas/ListPageSize" },
+          "total": { "$ref": "#/components/schemas/ListTotal" }
+        },
+        "additionalProperties": false
+      },
+      "TeammateAccessRequest": {
+        "type": "object",
+        "description": "A role and, except for an admin, at least one project. An admin sees every project and takes no list.",
+        "required": ["role"],
+        "properties": {
+          "role": { "$ref": "#/components/schemas/OrganizationRole" },
+          "project_ids": {
+            "type": "array",
+            "maxItems": 1000,
+            "uniqueItems": true,
+            "items": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+          }
+        },
+        "if": { "properties": { "role": { "const": "admin" } } },
+        "then": {
+          "properties": { "project_ids": { "type": "array", "maxItems": 0 } }
+        },
+        "else": {
+          "required": ["project_ids"],
+          "properties": { "project_ids": { "type": "array", "minItems": 1 } }
+        },
+        "additionalProperties": false
+      },
+      "InviteTeammateRequest": {
+        "type": "object",
+        "description": "Invites one person by email with their role and projects in one step.",
+        "required": ["email", "role"],
+        "properties": {
+          "email": { "$ref": "#/components/schemas/EmailAddress" },
+          "role": { "$ref": "#/components/schemas/OrganizationRole" },
+          "project_ids": {
+            "type": "array",
+            "maxItems": 1000,
+            "uniqueItems": true,
+            "items": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+          }
+        },
+        "if": { "properties": { "role": { "const": "admin" } } },
+        "then": {
+          "properties": { "project_ids": { "type": "array", "maxItems": 0 } }
+        },
+        "else": {
+          "required": ["project_ids"],
+          "properties": { "project_ids": { "type": "array", "minItems": 1 } }
+        },
+        "additionalProperties": false
+      },
       "UpdateProjectRequest": {
         "type": "object",
         "description": "Sets the project privacy policy. Moving from standard to minimal erases stored identifying profile data; moving to private also erases recipient language. Increasing collection does not restore erased data.",
@@ -14210,6 +14544,149 @@
             },
             "additionalProperties": false,
             "description": "Address-free asserted consent captured on a message. The snapshot survives binding deletion; it never claims recipient verification."
+          },
+          {
+            "type": "object",
+            "required": [
+              "id",
+              "project_id",
+              "environment",
+              "subscriber_id",
+              "notifier_id",
+              "channel",
+              "connection_id",
+              "status",
+              "address",
+              "basis",
+              "service"
+            ],
+            "properties": {
+              "id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+              "project_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+              "environment": { "$ref": "#/components/schemas/Environment" },
+              "subscriber_id": {
+                "$ref": "#/components/schemas/OpaqueIdentifier"
+              },
+              "notifier_id": {
+                "$ref": "#/components/schemas/OpaqueIdentifier"
+              },
+              "channel": { "const": "email" },
+              "connection_id": {
+                "$ref": "#/components/schemas/OpaqueIdentifier"
+              },
+              "status": { "enum": ["active", "paused", "revoked"] },
+              "address": {
+                "$ref": "#/components/schemas/EmailAddress",
+                "description": "The application-verified email destination enrolled for service notices."
+              },
+              "basis": { "const": "service" },
+              "service": {
+                "type": "object",
+                "required": [
+                  "relationship_started_at",
+                  "source",
+                  "asserted_at",
+                  "asserted_by",
+                  "domain_id"
+                ],
+                "properties": {
+                  "source": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 100,
+                    "pattern": "^[^\u0000-\u001f-Ÿ

]+$"
+                  },
+                  "asserted_at": { "$ref": "#/components/schemas/Timestamp" },
+                  "asserted_by": {
+                    "type": "object",
+                    "required": ["kind", "id"],
+                    "properties": {
+                      "kind": { "enum": ["credential", "grant", "session"] },
+                      "id": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+                    },
+                    "additionalProperties": false
+                  },
+                  "domain_id": {
+                    "$ref": "#/components/schemas/OpaqueIdentifier"
+                  },
+                  "relationship_started_at": {
+                    "$ref": "#/components/schemas/Timestamp"
+                  }
+                },
+                "additionalProperties": false
+              }
+            },
+            "additionalProperties": false,
+            "description": "Service relationship evidence. No consent claim. Address-free snapshots survive binding deletion."
+          },
+          {
+            "type": "object",
+            "required": [
+              "id",
+              "project_id",
+              "environment",
+              "subscriber_id",
+              "notifier_id",
+              "channel",
+              "connection_id",
+              "status",
+              "basis",
+              "service"
+            ],
+            "properties": {
+              "id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+              "project_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+              "environment": { "$ref": "#/components/schemas/Environment" },
+              "subscriber_id": {
+                "$ref": "#/components/schemas/OpaqueIdentifier"
+              },
+              "notifier_id": {
+                "$ref": "#/components/schemas/OpaqueIdentifier"
+              },
+              "channel": { "const": "email" },
+              "connection_id": {
+                "$ref": "#/components/schemas/OpaqueIdentifier"
+              },
+              "status": { "enum": ["active", "paused", "revoked"] },
+              "basis": { "const": "service" },
+              "service": {
+                "type": "object",
+                "required": [
+                  "relationship_started_at",
+                  "source",
+                  "asserted_at",
+                  "asserted_by",
+                  "domain_id"
+                ],
+                "properties": {
+                  "source": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 100,
+                    "pattern": "^[^\u0000-\u001f-Ÿ

]+$"
+                  },
+                  "asserted_at": { "$ref": "#/components/schemas/Timestamp" },
+                  "asserted_by": {
+                    "type": "object",
+                    "required": ["kind", "id"],
+                    "properties": {
+                      "kind": { "enum": ["credential", "grant", "session"] },
+                      "id": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+                    },
+                    "additionalProperties": false
+                  },
+                  "domain_id": {
+                    "$ref": "#/components/schemas/OpaqueIdentifier"
+                  },
+                  "relationship_started_at": {
+                    "$ref": "#/components/schemas/Timestamp"
+                  }
+                },
+                "additionalProperties": false
+              }
+            },
+            "additionalProperties": false,
+            "description": "Service relationship evidence. No consent claim. Address-free snapshots survive binding deletion."
           }
         ]
       },
@@ -14437,7 +14914,12 @@
             "maxLength": 128
           },
           "metadata": { "$ref": "#/components/schemas/Metadata" },
-          "interaction": { "$ref": "#/components/schemas/InteractionRequest" }
+          "interaction": { "$ref": "#/components/schemas/InteractionRequest" },
+          "purpose": {
+            "enum": ["service", "marketing"],
+            "default": "service",
+            "description": "Omitted means service. Marketing refuses service-only bindings before charging and at every delayed dispatch."
+          }
         },
         "allOf": [
           {
@@ -14564,6 +15046,11 @@
           "outcome_guidance": {
             "type": "string",
             "const": "Delivery may have been accepted by the provider. No automatic retry is scheduled; create a new message explicitly if another attempt is appropriate."
+          },
+          "purpose": {
+            "enum": ["service", "marketing"],
+            "default": "service",
+            "description": "Omitted means service. Marketing refuses service-only bindings before charging and at every delayed dispatch."
           }
         },
         "allOf": [
@@ -14772,7 +15259,12 @@
                             {
                               "type": "object",
                               "properties": {
-                                "code": { "const": "provider_terminal" },
+                                "code": {
+                                  "enum": [
+                                    "provider_terminal",
+                                    "not_consented_for_marketing"
+                                  ]
+                                },
                                 "retryable": { "const": false }
                               }
                             }
@@ -15267,6 +15759,18 @@
               "code": { "const": "internal_error" },
               "retryable": { "const": true }
             }
+          },
+          {
+            "type": "object",
+            "properties": {
+              "type": {
+                "const": "https://whooshbang.flowxo.com/problems/not_consented_for_marketing"
+              },
+              "title": { "const": "Marketing consent required" },
+              "status": { "const": 422 },
+              "code": { "const": "not_consented_for_marketing" },
+              "retryable": { "const": false }
+            }
           }
         ],
         "additionalProperties": false
@@ -16540,37 +17044,88 @@
         "additionalProperties": false
       },
       "AssertEmailConsentRequest": {
-        "type": "object",
-        "description": "Atomically create or resolve one subscriber and assert existing consent for an exact customer-owned email connection and domain. No verification message is sent. Revocation, suppression, recipient pause, holds and unhealthy authority take precedence. An omitted source is recorded as customer.",
-        "required": [
-          "subscriber_id",
-          "notifier_id",
-          "connection_id",
-          "domain_id",
-          "address",
-          "consented",
-          "consented_at"
-        ],
-        "properties": {
-          "subscriber_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
-          "notifier_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
-          "connection_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
-          "domain_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
-          "address": { "$ref": "#/components/schemas/EmailAddress" },
-          "consented": { "const": true },
-          "consented_at": {
-            "$ref": "#/components/schemas/Timestamp",
-            "description": "When the application obtained consent; must not be in the future."
+        "description": "Assert prior consent or enroll an application-verified user for service email on an exact customer-owned connection. Revocation and sending restrictions always win.",
+        "oneOf": [
+          {
+            "type": "object",
+            "description": "Atomically create or resolve one subscriber and assert existing consent for an exact customer-owned email connection and domain. No verification message is sent. Revocation, suppression, recipient pause, holds and unhealthy authority take precedence. An omitted source is recorded as customer.",
+            "required": [
+              "subscriber_id",
+              "notifier_id",
+              "connection_id",
+              "domain_id",
+              "address",
+              "consented",
+              "consented_at"
+            ],
+            "properties": {
+              "subscriber_id": {
+                "$ref": "#/components/schemas/OpaqueIdentifier"
+              },
+              "notifier_id": {
+                "$ref": "#/components/schemas/OpaqueIdentifier"
+              },
+              "connection_id": {
+                "$ref": "#/components/schemas/OpaqueIdentifier"
+              },
+              "domain_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+              "address": { "$ref": "#/components/schemas/EmailAddress" },
+              "consented": { "const": true },
+              "consented_at": {
+                "$ref": "#/components/schemas/Timestamp",
+                "description": "When the application obtained consent; must not be in the future."
+              },
+              "source": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 100,
+                "pattern": "^[^\u0000-\u001f-Ÿ

]+$",
+                "description": "A bounded customer description of where consent was collected. The authenticated asserting actor is recorded by the service, never accepted from this object."
+              }
+            },
+            "additionalProperties": false
           },
-          "source": {
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 100,
-            "pattern": "^[^\u0000-\u001f-Ÿ

]+$",
-            "description": "A bounded customer description of where consent was collected. The authenticated asserting actor is recorded by the service, never accepted from this object."
+          {
+            "type": "object",
+            "description": "Enroll an application-verified user for service email. This is relationship evidence, never consent or WhooshBang mailbox verification. An existing prior-consent binding with the same subscriber, address, notifier, connection and domain is reused with its original evidence and status.",
+            "required": [
+              "subscriber_id": "^[^\u0000-\u001f-Ÿ

]+$",
+              "notifier_id",
+              "connection_id",
+              "domain_id",
+              "address",
+              "basis",
+              "source",
+              "relationship_started_at"
+            ],
+            "properties": {
+              "subscriber_id": {
+                "$ref": "#/components/schemas/OpaqueIdentifier"
+              },
+              "notifier_id": {
+                "$ref": "#/components/schemas/OpaqueIdentifier"
+              },
+              "connection_id": {
+                "$ref": "#/components/schemas/OpaqueIdentifier"
+              },
+              "domain_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+              "address": { "$ref": "#/components/schemas/EmailAddress" },
+              "source": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 100,
+                "pattern": "^[^\u0000-\u001f-Ÿ

]+$",
+                "description": "A bounded customer description of the service relationship. The authenticated asserting actor is recorded by the service, never accepted from this object."
+              },
+              "basis": { "const": "service" },
+              "relationship_started_at": {
+                "$ref": "#/components/schemas/Timestamp",
+                "description": "When the verified user relationship began; must not be in the future."
+              }
+            },
+            "additionalProperties": false
           }
-        },
-        "additionalProperties": false
+        ]
       },
       "CreateSubscriberRequest": {
         "type": "object",
@@ -17043,7 +17598,12 @@
             "maxLength": 128
           },
           "metadata": { "$ref": "#/components/schemas/Metadata" },
-          "interaction": { "$ref": "#/components/schemas/InteractionRequest" }
+          "interaction": { "$ref": "#/components/schemas/InteractionRequest" },
+          "purpose": {
+            "enum": ["service", "marketing"],
+            "default": "service",
+            "description": "Omitted means service. Marketing refuses service-only bindings before charging and at every delayed dispatch."
+          }
         },
         "additionalProperties": false
       },
@@ -17121,7 +17681,8 @@
           "provider_retryable",
           "provider_terminal",
           "provider_outcome_unknown",
-          "internal_error"
+          "internal_error",
+          "not_consented_for_marketing"
         ]
       },
       "ProblemFieldError": {
@@ -17312,8 +17873,8 @@
       },
       "OrganizationRole": {
         "type": "string",
-        "enum": ["admin", "member"],
-        "description": "The stable WhooshBang authorization role projected from the current Clerk organization membership."
+        "enum": ["admin", "member", "messenger"],
+        "description": "The person's WhooshBang role in the organization. `admin` does everything, including billing, API keys and teammates. `member` runs the projects they were given: channels, subscribers, messages and project settings. `messenger` sends messages and reads replies in the projects they were given. Clients must tolerate roles added later."
       },
       "OrganizationMembershipSummary": {
         "type": "object",
@@ -17339,6 +17900,27 @@
         },
         "additionalProperties": false
       },
+      "TeammateStatus": {
+        "type": "string",
+        "enum": ["active", "invited"],
+        "description": "`active` has joined. `invited` has an invitation they have not accepted."
+      },
+      "TeammateProjectAccess": {
+        "type": "object",
+        "description": "Which projects the teammate can see. An admin sees every project, including ones created later.",
+        "required": ["all", "project_ids"],
+        "properties": {
+          "all": { "type": "boolean" },
+          "project_ids": {
+            "type": "array",
+            "maxItems": 1000,
+            "uniqueItems": true,
+            "items": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+            "description": "The projects given to this teammate. Empty when `all` is true."
+          }
+        },
+        "additionalProperties": false
+      },
       "ProviderInstallationStatus": {
         "type": "string",
         "enum": [
@@ -19170,7 +19752,7 @@
       "provider-capabilities-v1.schema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "$id": "https://whooshbang.flowxo.com/schemas/provider-capabilities-v1.schema.json",
-        "x-contract-version": "2.0.0-rc.7",
+        "x-contract-version": "2.0.0",
         "title": "ProviderCapabilitiesV1",
         "description": "Provider-neutral, renderer-facing delivery and interaction capabilities with explicit degradation.",
         "type": "object",
@@ -19890,5 +20472,5 @@
       }
     }
   },
-  "x-contract-version": "2.0.0-rc.7"
+  "x-contract-version": "2.0.0"
 }