@whooshbang/contracts 2.0.0-rc.8 → 2.1.0

package/openapi/generated/whooshbang-v1.bundle.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.1",
   "info": {
     "title": "WhooshBang API",
-    "version": "2.0.0-rc.8",
+    "version": "2.1.0",
     "description": "The V1 contract for human organization/project administration, project-scoped\nsubscription links, and asynchronous text messages. A Clerk session selects\none organization for administration. A project credential selects one organization,\nproject, and `test` or `live` environment for product operations; request\nbodies cannot override either authenticated scope.\n\nA person's OAuth grant selects one organization and carries scopes, but no\nproject. It names the project and environment it acts in through the URL\npath, on the environment-scoped form of each operation; the service checks\nthat path against the granting person's membership on every call. The flat\nforms remain credential-only and are unchanged.\n\nResource identifiers are opaque and are not authorization. Reads outside the\ncredential scope return the same `404` shape as absent resources. Provider\ncredentials, raw Telegram identity, and protected provider responses are\nnever part of this API.\n",
     "termsOfService": "https://flowxo.com/terms",
     "contact": {
@@ -84,12 +84,350 @@
       "name": "Subscriber groups",
       "description": "Environment-scoped static groups and monotonic membership generations."
     },
+    {
+      "name": "Operators",
+      "description": "Current teammates, personal notification preferences and membership-derived service email."
+    },
     {
       "name": "Group broadcasts",
       "description": "Durable group acceptance and aggregate projection over ordinary child messages."
     }
   ],
   "paths": {
+    "/v1/projects/{project_id}/environments/{environment_id}/whoami": {
+      "get": {
+        "operationId": "whoAmI",
+        "summary": "Identify the authenticated caller",
+        "description": "Personal login identifies me without a recipient question. Shared or service credentials report their actual principal and require an explicit recipient. No account owner or credential creator is inferred.",
+        "tags": ["Operators"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerCredential": [] },
+          { "bearerOrganizationCredential": [] },
+          { "bearerGrant": ["messages:read"] },
+          { "machineCredential": [] }
+        ],
+        "x-required-scopes": ["messages:read"],
+        "parameters": [
+          { "$ref": "#/components/parameters/ProjectId" },
+          { "$ref": "#/components/parameters/EnvironmentId" }
+        ],
+        "responses": {
+          "200": {
+            "description": "Actual principal and safe authorized messaging context.",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/WhoAmI" }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" }
+        }
+      }
+    },
+    "/v1/projects/{project_id}/environments/{environment_id}/operators": {
+      "get": {
+        "operationId": "listOperators",
+        "summary": "listOperators",
+        "description": "Membership-derived operator messaging. Only the authenticated human can manage personal preferences.",
+        "tags": ["Operators"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerCredential": [] },
+          { "bearerGrant": ["messages:read"] }
+        ],
+        "x-required-scopes": ["messages:read"],
+        "parameters": [
+          { "$ref": "#/components/parameters/ProjectId" },
+          { "$ref": "#/components/parameters/EnvironmentId" },
+          { "$ref": "#/components/parameters/ListAfterCursor" },
+          { "$ref": "#/components/parameters/ListPageLimit" },
+          { "$ref": "#/components/parameters/PageNumber" }
+        ],
+        "responses": {
+          "200": {
+            "description": "Authorized result.",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/OperatorCollection" }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" }
+        }
+      }
+    },
+    "/v1/projects/{project_id}/environments/{environment_id}/operators/resolve": {
+      "get": {
+        "operationId": "resolveOperator",
+        "summary": "resolveOperator",
+        "description": "Membership-derived operator messaging. Only the authenticated human can manage personal preferences.",
+        "tags": ["Operators"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerCredential": [] },
+          { "bearerGrant": ["messages:read"] }
+        ],
+        "x-required-scopes": ["messages:read"],
+        "parameters": [
+          { "$ref": "#/components/parameters/ProjectId" },
+          { "$ref": "#/components/parameters/EnvironmentId" },
+          {
+            "name": "recipient",
+            "in": "query",
+            "required": true,
+            "schema": { "type": "string", "minLength": 1, "maxLength": 128 }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Authorized result.",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/OperatorResolution" }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" }
+        }
+      }
+    },
+    "/v1/projects/{project_id}/environments/{environment_id}/operator-messages": {
+      "post": {
+        "operationId": "sendOperatorMessage",
+        "summary": "sendOperatorMessage",
+        "description": "Message a current teammate by name or operator ID. Personal callers may omit recipient or use me. Shared credentials must name a recipient. Runtime machine credentials report recipient_required for omitted or me; named operator sends are forbidden because runtime authority remains subscriber-bound.",
+        "tags": ["Operators"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerCredential": [] },
+          { "bearerOrganizationCredential": [] },
+          { "machineCredential": [] },
+          { "bearerGrant": ["messages:write"] }
+        ],
+        "x-required-scopes": ["messages:write"],
+        "parameters": [
+          { "$ref": "#/components/parameters/ProjectId" },
+          { "$ref": "#/components/parameters/EnvironmentId" },
+          { "$ref": "#/components/parameters/IdempotencyKey" }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateOperatorMessageRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Authorized result.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OperatorMessageResult"
+                }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" }
+        }
+      }
+    },
+    "/v1/projects/{project_id}/environments/{environment_id}/operators/broadcasts": {
+      "post": {
+        "operationId": "broadcastOperators",
+        "summary": "broadcastOperators",
+        "description": "Membership-derived operator messaging. Only the authenticated human can manage personal preferences.",
+        "tags": ["Operators"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerCredential": [] },
+          { "bearerGrant": ["messages:write"] }
+        ],
+        "x-required-scopes": ["messages:write"],
+        "parameters": [
+          { "$ref": "#/components/parameters/ProjectId" },
+          { "$ref": "#/components/parameters/EnvironmentId" },
+          { "$ref": "#/components/parameters/IdempotencyKey" }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateGroupBroadcastRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Authorized result.",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/OperatorBroadcast" }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" }
+        }
+      }
+    },
+    "/v1/projects/{project_id}/environments/{environment_id}/operators/broadcasts/{broadcast_id}": {
+      "get": {
+        "operationId": "getOperatorBroadcast",
+        "summary": "getOperatorBroadcast",
+        "description": "Membership-derived operator messaging. Only the authenticated human can manage personal preferences.",
+        "tags": ["Operators"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerCredential": [] },
+          { "bearerGrant": ["messages:read"] }
+        ],
+        "x-required-scopes": ["messages:read"],
+        "parameters": [
+          { "$ref": "#/components/parameters/ProjectId" },
+          { "$ref": "#/components/parameters/EnvironmentId" },
+          {
+            "name": "broadcast_id",
+            "in": "path",
+            "required": true,
+            "schema": { "type": "string" }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Authorized result.",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/OperatorBroadcast" }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" }
+        }
+      }
+    },
+    "/v1/projects/{project_id}/environments/{environment_id}/notification-preferences": {
+      "get": {
+        "operationId": "getOperatorPreferences",
+        "summary": "getOperatorPreferences",
+        "description": "Membership-derived operator messaging. Only the authenticated human can manage personal preferences.",
+        "tags": ["Operators"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerCredential": [] },
+          { "bearerGrant": ["messages:read"] }
+        ],
+        "x-required-scopes": ["messages:read"],
+        "parameters": [
+          { "$ref": "#/components/parameters/ProjectId" },
+          { "$ref": "#/components/parameters/EnvironmentId" }
+        ],
+        "responses": {
+          "200": {
+            "description": "Authorized result.",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/OperatorPreferences" }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" }
+        }
+      }
+    },
+    "/v1/projects/{project_id}/environments/{environment_id}/notification-preferences/preferred-binding": {
+      "put": {
+        "operationId": "setOperatorPreferredBinding",
+        "summary": "setOperatorPreferredBinding",
+        "description": "Membership-derived operator messaging. Only the authenticated human can manage personal preferences.",
+        "tags": ["Operators"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerCredential": [] },
+          { "bearerGrant": ["messages:write"] }
+        ],
+        "x-required-scopes": ["messages:write"],
+        "parameters": [
+          { "$ref": "#/components/parameters/ProjectId" },
+          { "$ref": "#/components/parameters/EnvironmentId" }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SetPreferredBindingRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Authorized result.",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/OperatorPreferences" }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" }
+        }
+      }
+    },
+    "/v1/projects/{project_id}/environments/{environment_id}/notification-preferences/connect": {
+      "post": {
+        "operationId": "connectOperatorChannel",
+        "summary": "connectOperatorChannel",
+        "description": "Membership-derived operator messaging. Only the authenticated human can manage personal preferences.",
+        "tags": ["Operators"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerCredential": [] },
+          { "bearerGrant": ["messages:write"] }
+        ],
+        "x-required-scopes": ["messages:write"],
+        "parameters": [
+          { "$ref": "#/components/parameters/ProjectId" },
+          { "$ref": "#/components/parameters/EnvironmentId" },
+          { "$ref": "#/components/parameters/IdempotencyKey" }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/OperatorConnectRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Authorized result.",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/SubscriptionLink" }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" }
+        }
+      }
+    },
     "/v1/billing/project-slots": {
       "get": {
         "operationId": "getBillingProjectSlots",
@@ -10716,25 +11054,269 @@
       }
     },
     "schemas": {
-      "ListPageSize": {
-        "type": "integer",
-        "minimum": 1,
-        "maximum": 100,
-        "description": "The page size that produced `items`, echoed so a caller that sent no `limit` can still divide `total` into pages without knowing the server default."
-      },
-      "MessageState": {
-        "type": "string",
-        "enum": [
-          "accepted",
-          "dispatch_pending",
-          "queued",
-          "sending",
-          "provider_accepted",
-          "retry_wait",
-          "terminal_failed",
-          "outcome_unknown",
-          "cancelled",
-          "expired"
+      "WhoAmI": {
+        "type": "object",
+        "description": "Current principal, authorized context, safe channel readiness and deterministic personal me identity. Contains no email or provider destination.",
+        "required": ["principal", "context", "capabilities", "detail"],
+        "properties": {
+          "principal": {
+            "type": "object",
+            "description": "The credential actually authenticated for this request; service identity never implies its creator is the recipient.",
+            "required": ["type", "id"],
+            "properties": {
+              "type": {
+                "enum": [
+                  "personal_session",
+                  "personal_mcp",
+                  "project_credential",
+                  "organization_credential",
+                  "machine_client"
+                ]
+              },
+              "id": { "type": "string", "minLength": 1, "maxLength": 128 }
+            },
+            "additionalProperties": false
+          },
+          "context": {
+            "type": "object",
+            "description": "Explicit authorized account and project context. No context is guessed across tenants.",
+            "required": [
+              "organization_id",
+              "project_id",
+              "environment_id",
+              "environment"
+            ],
+            "properties": {
+              "organization_id": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 128
+              },
+              "project_id": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 128
+              },
+              "environment_id": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 128
+              },
+              "environment": { "enum": ["test", "live"] }
+            },
+            "additionalProperties": false
+          },
+          "capabilities": {
+            "type": "object",
+            "description": "Current messaging permissions; quota, binding readiness and provider gates still apply per send.",
+            "required": [
+              "can_message_self",
+              "can_message_teammates",
+              "can_broadcast_operators"
+            ],
+            "properties": {
+              "can_message_self": { "type": "boolean" },
+              "can_message_teammates": { "type": "boolean" },
+              "can_broadcast_operators": { "type": "boolean" }
+            },
+            "additionalProperties": false
+          },
+          "user": {
+            "type": "object",
+            "description": "Verified authenticated human identity. Absent for shared/service credentials.",
+            "required": ["id", "name"],
+            "properties": {
+              "id": { "type": "string", "minLength": 1, "maxLength": 128 },
+              "name": { "type": "string", "minLength": 1, "maxLength": 256 }
+            },
+            "additionalProperties": false
+          },
+          "me": { "$ref": "#/components/schemas/Operator" },
+          "detail": { "type": "string", "minLength": 1, "maxLength": 1024 }
+        },
+        "additionalProperties": false
+      },
+      "Operator": {
+        "type": "object",
+        "description": "A safe, membership-derived operator in the authorized project. No email, provider identifiers or credentials are exposed.",
+        "required": ["id", "name", "role", "readiness", "preferences_url"],
+        "properties": {
+          "id": { "type": "string", "minLength": 1, "maxLength": 128 },
+          "name": { "type": "string", "minLength": 1, "maxLength": 256 },
+          "role": { "enum": ["admin", "member", "messenger"] },
+          "readiness": { "enum": ["ready", "channel_unavailable"] },
+          "preferred_channel": { "$ref": "#/components/schemas/Channel" },
+          "preferences_url": { "type": "string", "format": "uri" }
+        },
+        "additionalProperties": false
+      },
+      "OperatorCollection": {
+        "type": "object",
+        "description": "Read-only predefined operators audience, filtered to current account and project membership.",
+        "required": ["group", "items", "total"],
+        "properties": {
+          "group": { "const": "operators" },
+          "items": {
+            "type": "array",
+            "items": { "$ref": "#/components/schemas/Operator" }
+          },
+          "total": { "$ref": "#/components/schemas/ListTotal" },
+          "next_cursor": { "type": "string", "minLength": 1, "maxLength": 128 },
+          "page": { "$ref": "#/components/schemas/ListPageNumber" },
+          "page_size": { "$ref": "#/components/schemas/ListPageSize" }
+        },
+        "additionalProperties": false
+      },
+      "OperatorResolution": {
+        "type": "object",
+        "description": "Exact normalized name or stable operator identity. Duplicate names are never guessed.",
+        "required": ["outcome", "choices"],
+        "properties": {
+          "outcome": { "enum": ["resolved", "ambiguous", "not_found"] },
+          "choices": {
+            "type": "array",
+            "items": { "$ref": "#/components/schemas/Operator" }
+          }
+        },
+        "additionalProperties": false
+      },
+      "CreateOperatorMessageRequest": {
+        "type": "object",
+        "description": "Send to a teammate by exact name or operator ID, or use me. Omitted recipient means the verified authenticated human only. Shared and service credentials must name a recipient. Preferred channel, service-email billing and marketing restrictions still apply.",
+        "required": ["content"],
+        "properties": {
+          "recipient": { "type": "string", "minLength": 1, "maxLength": 128 },
+          "content": { "$ref": "#/components/schemas/MessageContent" },
+          "expires_at": {
+            "$ref": "#/components/schemas/Timestamp",
+            "description": "Optional server-authoritative expiry no more than 24 hours after acceptance."
+          },
+          "correlation_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "metadata": { "$ref": "#/components/schemas/Metadata" },
+          "interaction": { "$ref": "#/components/schemas/InteractionRequest" },
+          "purpose": {
+            "enum": ["service", "marketing"],
+            "default": "service",
+            "description": "Omitted means service. Marketing refuses service-only bindings before charging and at every delayed dispatch."
+          }
+        },
+        "additionalProperties": false
+      },
+      "OperatorMessageResult": {
+        "type": "object",
+        "description": "Readable acceptance or refusal. Accepted means queued, never proof of provider delivery.",
+        "required": ["outcome", "choices", "detail"],
+        "properties": {
+          "outcome": {
+            "enum": [
+              "accepted",
+              "ambiguous",
+              "not_found",
+              "recipient_required",
+              "channel_unavailable"
+            ]
+          },
+          "choices": {
+            "type": "array",
+            "items": { "$ref": "#/components/schemas/Operator" }
+          },
+          "detail": { "type": "string", "minLength": 1, "maxLength": 1024 },
+          "message": { "$ref": "#/components/schemas/Message" },
+          "preferences_url": { "type": "string", "format": "uri" }
+        },
+        "additionalProperties": false
+      },
+      "OperatorBroadcastRecipient": {
+        "type": "object",
+        "description": "Per-person broadcast result. Sent requires provider acceptance; skipped includes removed membership or an unavailable destination.",
+        "required": ["operator_id", "outcome"],
+        "properties": {
+          "operator_id": { "type": "string", "minLength": 1, "maxLength": 128 },
+          "name": { "type": "string" },
+          "outcome": { "enum": ["pending", "sent", "skipped", "failed"] },
+          "message_id": { "type": "string", "minLength": 1, "maxLength": 128 },
+          "reason": { "type": "string" }
+        },
+        "additionalProperties": false
+      },
+      "OperatorBroadcast": {
+        "type": "object",
+        "description": "Durable operators broadcast using ordinary child messages and charging. Read again for provider outcomes.",
+        "required": ["broadcast", "recipients"],
+        "properties": {
+          "broadcast": { "$ref": "#/components/schemas/GroupBroadcast" },
+          "recipients": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/OperatorBroadcastRecipient"
+            }
+          }
+        },
+        "additionalProperties": false
+      },
+      "OperatorPreferences": {
+        "type": "object",
+        "description": "The authenticated person’s own destinations and preferred channel in this project. Shared credentials cannot manage a human’s preferences.",
+        "required": ["operator", "settings", "connections"],
+        "properties": {
+          "operator": { "$ref": "#/components/schemas/Operator" },
+          "settings": {
+            "$ref": "#/components/schemas/SubscriberChannelSettings"
+          },
+          "connections": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "description": "An available personal connection route.",
+              "required": ["id", "channel", "name"],
+              "properties": {
+                "id": { "type": "string", "minLength": 1, "maxLength": 128 },
+                "channel": { "$ref": "#/components/schemas/Channel" },
+                "name": { "type": "string" }
+              },
+              "additionalProperties": false
+            }
+          }
+        },
+        "additionalProperties": false
+      },
+      "OperatorConnectRequest": {
+        "type": "object",
+        "description": "Connect the signed-in person’s own destination through a configured channel. This never changes another person’s channels.",
+        "required": ["connection_id", "channel"],
+        "properties": {
+          "connection_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "channel": { "enum": ["telegram", "slack"] }
+        },
+        "additionalProperties": false
+      },
+      "ListPageSize": {
+        "type": "integer",
+        "minimum": 1,
+        "maximum": 100,
+        "description": "The page size that produced `items`, echoed so a caller that sent no `limit` can still divide `total` into pages without knowing the server default."
+      },
+      "MessageState": {
+        "type": "string",
+        "enum": [
+          "accepted",
+          "dispatch_pending",
+          "queued",
+          "sending",
+          "provider_accepted",
+          "retry_wait",
+          "terminal_failed",
+          "outcome_unknown",
+          "cancelled",
+          "expired"
         ]
       },
       "Timestamp": {
@@ -17647,6 +18229,11 @@
         },
         "additionalProperties": false
       },
+      "Channel": {
+        "type": "string",
+        "enum": ["telegram", "slack", "email"],
+        "description": "A provider-neutral delivery channel. Adding a member makes it representable; it does not claim that every deployment has registered an executable adapter."
+      },
       "ProblemCode": {
         "type": "string",
         "enum": [
@@ -17854,409 +18441,499 @@
           }
         ]
       },
-      "Channel": {
-        "type": "string",
-        "enum": ["telegram", "slack", "email"],
-        "description": "A provider-neutral delivery channel. Adding a member makes it representable; it does not claim that every deployment has registered an executable adapter."
-      },
       "ListTotal": {
         "type": "integer",
         "minimum": 0,
         "description": "How many records the list holds in total, not only on this page. Counted while the page was read, so a write landing between the count and the page can leave it a record or two out of step with `items`. That is noise on an inspection surface; it never changes which records a page addresses."
       },
-      "EmailAddress": {
-        "type": "string",
-        "minLength": 3,
-        "maxLength": 254,
-        "pattern": "^(?=[^@]{1,64}@)(?!\\.)(?![^@]*\\.@)(?![^@]*\\.\\.)[A-Za-z0-9!#$%&'*+/=?^_`{|}~.-]+@(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$",
-        "description": "Exactly one mailbox: an unquoted ASCII dot-atom local part plus a canonical lower-case IDNA domain. The comparison key preserves local-part bytes and case and lower-cases only the domain; dot, plus-tag, alias and provider equivalence are never inferred."
-      },
-      "OrganizationRole": {
-        "type": "string",
-        "enum": ["admin", "member", "messenger"],
-        "description": "The person's WhooshBang role in the organization. `admin` does everything, including billing, API keys and teammates. `member` runs the projects they were given: channels, subscribers, messages and project settings. `messenger` sends messages and reads replies in the projects they were given. Clients must tolerate roles added later."
-      },
-      "OrganizationMembershipSummary": {
+      "StructuredTextSection": {
         "type": "object",
-        "required": ["role"],
+        "required": ["text"],
         "properties": {
-          "role": { "$ref": "#/components/schemas/OrganizationRole" }
+          "heading": {
+            "description": "An optional semantic heading for this section.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200,
+            "x-max-utf8-bytes": 800
+          },
+          "text": {
+            "description": "The section body, also represented in the complete fallback text.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 1000,
+            "x-max-utf8-bytes": 4000
+          }
         },
         "additionalProperties": false
       },
-      "OrganizationClosureProviderAction": {
+      "DocumentSectionBlock": {
+        "description": "One prose section in an ordered portable document.",
         "type": "object",
-        "description": "One provider-owned resource the customer must retire outside WhooshBang after organization closure. It contains safe identifiers only, never provider credentials.",
-        "required": ["provider", "action", "connection_id"],
+        "required": ["type", "text"],
         "properties": {
-          "provider": {
-            "$ref": "#/components/schemas/ChannelConnectionProvider"
-          },
-          "action": {
+          "type": { "const": "section" },
+          "heading": {
+            "description": "An optional semantic heading for this section.",
             "type": "string",
-            "enum": ["revoke_bot_token", "delete_provider_application"]
+            "minLength": 1,
+            "maxLength": 200,
+            "x-max-utf8-bytes": 800
           },
-          "connection_id": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+          "text": {
+            "description": "The section prose.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 1000,
+            "x-max-utf8-bytes": 4000
+          }
         },
         "additionalProperties": false
       },
-      "TeammateStatus": {
-        "type": "string",
-        "enum": ["active", "invited"],
-        "description": "`active` has joined. `invited` has an invitation they have not accepted."
-      },
-      "TeammateProjectAccess": {
+      "DocumentFact": {
         "type": "object",
-        "description": "Which projects the teammate can see. An admin sees every project, including ones created later.",
-        "required": ["all", "project_ids"],
+        "required": ["label", "value"],
         "properties": {
-          "all": { "type": "boolean" },
-          "project_ids": {
-            "type": "array",
-            "maxItems": 1000,
-            "uniqueItems": true,
-            "items": { "$ref": "#/components/schemas/OpaqueIdentifier" },
-            "description": "The projects given to this teammate. Empty when `all` is true."
-          }
-        },
-        "additionalProperties": false
-      },
-      "ProviderInstallationStatus": {
-        "type": "string",
-        "enum": [
-          "pending",
-          "active",
-          "reauthorization_required",
-          "revoked",
-          "invalid"
-        ],
-        "description": "The safe customer-facing lifecycle of a provider installation. Credential and provider-native state stay private."
+          "label": {
+            "description": "The semantic label for this fact.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200,
+            "x-max-utf8-bytes": 800
+          },
+          "value": {
+            "description": "The semantic value for this fact.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 1000,
+            "x-max-utf8-bytes": 4000
+          }
+        },
+        "additionalProperties": false
       },
-      "ProviderAuthorizationSetup": {
-        "description": "A credential-free provider authorization handoff for one exact connection. The URL is short-lived and safe to render, but never contains a provider credential, team identifier or raw authorization code; actual OAuth state and callback handling remain service-private.",
-        "oneOf": [
-          {
-            "type": "object",
-            "required": ["status", "authorization_url", "expires_at"],
-            "properties": {
-              "status": { "const": "awaiting_authorization" },
-              "authorization_url": {
-                "type": "string",
-                "format": "uri",
-                "pattern": "^https://[^\\s]+$",
-                "maxLength": 2048,
-                "description": "The short-lived HTTPS authorization handoff for this connection. It carries opaque state, not provider credentials or a raw authorization code."
-              },
-              "expires_at": { "$ref": "#/components/schemas/Timestamp" }
-            },
-            "additionalProperties": false
+      "DocumentFactsBlock": {
+        "description": "One ordered group of semantic label/value facts.",
+        "type": "object",
+        "required": ["type", "items"],
+        "properties": {
+          "type": { "const": "facts" },
+          "items": {
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 24,
+            "items": { "$ref": "#/components/schemas/DocumentFact" }
+          }
+        },
+        "additionalProperties": false
+      },
+      "DocumentTableCell": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 500,
+        "x-max-utf8-bytes": 2000
+      },
+      "DocumentTableRow": {
+        "type": "array",
+        "minItems": 2,
+        "maxItems": 8,
+        "items": { "$ref": "#/components/schemas/DocumentTableCell" }
+      },
+      "DocumentTableBlock": {
+        "description": "One small semantic table. Every row must have exactly one cell for each column.",
+        "type": "object",
+        "required": ["type", "heading", "columns", "rows"],
+        "properties": {
+          "type": { "const": "table" },
+          "heading": {
+            "description": "The semantic heading for this table.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200,
+            "x-max-utf8-bytes": 800
           },
-          {
-            "type": "object",
-            "required": ["status", "expires_at"],
-            "properties": {
-              "status": { "const": "provisioning" },
-              "expires_at": { "$ref": "#/components/schemas/Timestamp" }
-            },
-            "additionalProperties": false
+          "columns": {
+            "description": "The ordered column headings.",
+            "type": "array",
+            "minItems": 2,
+            "maxItems": 8,
+            "items": { "$ref": "#/components/schemas/DocumentTableCell" }
           },
-          {
-            "type": "object",
-            "required": ["status", "expires_at", "failure"],
-            "properties": {
-              "status": { "const": "failed" },
-              "expires_at": { "$ref": "#/components/schemas/Timestamp" },
-              "failure": { "$ref": "#/components/schemas/ProviderFailure" }
-            },
-            "additionalProperties": false
+          "rows": {
+            "description": "The ordered table rows.",
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 20,
+            "items": { "$ref": "#/components/schemas/DocumentTableRow" }
+          }
+        },
+        "x-rows-match-columns": true,
+        "additionalProperties": false
+      },
+      "DocumentDetailsBlock": {
+        "description": "One supporting disclosure in an ordered portable document.",
+        "type": "object",
+        "required": ["type", "summary", "text"],
+        "properties": {
+          "type": { "const": "details" },
+          "summary": {
+            "description": "The always-visible semantic summary.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200,
+            "x-max-utf8-bytes": 800
           },
-          {
-            "type": "object",
-            "required": ["status", "expires_at"],
-            "properties": {
-              "status": { "const": "expired" },
-              "expires_at": { "$ref": "#/components/schemas/Timestamp" }
-            },
-            "additionalProperties": false
+          "text": {
+            "description": "The supporting prose.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 2000,
+            "x-max-utf8-bytes": 8000
           }
+        },
+        "additionalProperties": false
+      },
+      "DocumentBlock": {
+        "oneOf": [
+          { "$ref": "#/components/schemas/DocumentSectionBlock" },
+          { "$ref": "#/components/schemas/DocumentFactsBlock" },
+          { "$ref": "#/components/schemas/DocumentTableBlock" },
+          { "$ref": "#/components/schemas/DocumentDetailsBlock" }
         ]
       },
-      "EmailDomainName": {
+      "DocumentContent": {
+        "description": "An authoritative ordered portable notification document that every delivery adapter renders faithfully.",
+        "type": "object",
+        "required": ["type", "blocks"],
+        "properties": {
+          "type": { "const": "document" },
+          "title": {
+            "description": "An optional semantic document title. The adapter chooses its native presentation.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200,
+            "x-max-utf8-bytes": 800
+          },
+          "blocks": {
+            "description": "The complete portable document in exact authored order.",
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 24,
+            "items": { "$ref": "#/components/schemas/DocumentBlock" }
+          },
+          "image": { "$ref": "#/components/schemas/NotificationImage" }
+        },
+        "additionalProperties": false
+      },
+      "MessageContent": {
+        "oneOf": [
+          { "$ref": "#/components/schemas/TextContent" },
+          { "$ref": "#/components/schemas/DocumentContent" }
+        ]
+      },
+      "MetadataValue": {
+        "oneOf": [
+          { "type": "string" },
+          { "type": "number" },
+          { "type": "boolean" },
+          { "type": "null" }
+        ]
+      },
+      "Metadata": {
+        "type": "object",
+        "description": "Bounded customer correlation data. Do not include secrets or personal data.",
+        "maxProperties": 20,
+        "propertyNames": { "minLength": 1, "maxLength": 64 },
+        "additionalProperties": {
+          "$ref": "#/components/schemas/MetadataValue"
+        },
+        "x-max-json-bytes": 4096
+      },
+      "InteractionPrompt": {
         "type": "string",
-        "minLength": 4,
-        "maxLength": 253,
-        "pattern": "^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.){2,}[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$",
-        "description": "A canonical lower-case IDNA ASCII customer sending domain with its trailing dot removed. It must be a dedicated subdomain below the registrable domain; runtime validation uses the public suffix list so a registrable root such as example.co.uk is still rejected. URLs, ports, wildcards and mailbox addresses are invalid."
+        "minLength": 1,
+        "maxLength": 1000
       },
-      "EmailDomainLifecycle": {
+      "Timestamp-2": {
         "type": "string",
-        "enum": [
-          "requested",
-          "creating",
-          "dns_required",
-          "verifying",
-          "testing",
-          "active",
-          "provider_action_required",
-          "dns_failed",
-          "oauth_required",
-          "held",
-          "deleting",
-          "deleted"
-        ],
-        "description": "The provider-neutral domain lifecycle. Sending and receiving capabilities are reported separately because they verify on different clocks."
+        "format": "date-time",
+        "pattern": "^[0-9]{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01])T(?:[01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](?:\\.[0-9]+)?(?:Z|[+-](?:[01][0-9]|2[0-3]):[0-5][0-9])$"
       },
-      "EmailDomainCapabilityState": {
+      "InteractionCorrelationId": {
         "type": "string",
-        "enum": ["pending", "verified", "failed", "unsupported"]
+        "minLength": 8,
+        "maxLength": 128,
+        "pattern": "^[^\\u0000-\\u001F\\u007F]+$",
+        "description": "Caller-owned opaque correlation returned as data, never treated as execution authority."
       },
-      "EmailDomainCapabilities": {
+      "ConfirmInteractionRequest": {
+        "type": "object",
+        "required": ["type", "prompt", "expires_at"],
+        "properties": {
+          "type": { "const": "confirm" },
+          "prompt": { "$ref": "#/components/schemas/InteractionPrompt" },
+          "confirm_label": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 40
+          },
+          "deny_label": { "type": "string", "minLength": 1, "maxLength": 40 },
+          "expires_at": {
+            "$ref": "#/components/schemas/Timestamp-2",
+            "description": "Must be 30 seconds through 24 hours after server acceptance."
+          },
+          "correlation_id": {
+            "$ref": "#/components/schemas/InteractionCorrelationId"
+          }
+        },
+        "additionalProperties": false
+      },
+      "InteractionOption": {
+        "type": "object",
+        "required": ["value", "label"],
+        "properties": {
+          "value": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128,
+            "pattern": "^[^\\u0000-\\u001F\\u007F]+$",
+            "description": "Opaque customer data. It is never interpreted as a command."
+          },
+          "label": { "type": "string", "minLength": 1, "maxLength": 120 },
+          "intent": {
+            "type": "string",
+            "enum": ["accept", "destructive", "informational", "neutral"],
+            "default": "neutral",
+            "description": "What choosing this option does, so a channel can present it accordingly. Describes consequence rather than appearance: a channel renders `accept` green where it can, `destructive` red, `informational` prominent, and `neutral` plainly. A channel that cannot colour a control ignores this and the option still renders. Omitted means `neutral`."
+          }
+        },
+        "additionalProperties": false
+      },
+      "SelectInteractionRequest": {
+        "type": "object",
+        "required": ["type", "prompt", "options", "expires_at"],
+        "properties": {
+          "type": { "const": "select" },
+          "prompt": { "$ref": "#/components/schemas/InteractionPrompt" },
+          "options": {
+            "type": "array",
+            "minItems": 2,
+            "maxItems": 6,
+            "items": { "$ref": "#/components/schemas/InteractionOption" },
+            "x-unique-property": "value"
+          },
+          "expires_at": {
+            "$ref": "#/components/schemas/Timestamp-2",
+            "description": "Must be 30 seconds through 24 hours after server acceptance."
+          },
+          "correlation_id": {
+            "$ref": "#/components/schemas/InteractionCorrelationId"
+          }
+        },
+        "additionalProperties": false
+      },
+      "InputInteractionRequest": {
+        "type": "object",
+        "required": ["type", "prompt", "expires_at"],
+        "properties": {
+          "type": { "const": "input" },
+          "prompt": { "$ref": "#/components/schemas/InteractionPrompt" },
+          "expires_at": {
+            "$ref": "#/components/schemas/Timestamp-2",
+            "description": "Must be 30 seconds through 24 hours after server acceptance."
+          },
+          "correlation_id": {
+            "$ref": "#/components/schemas/InteractionCorrelationId"
+          }
+        },
+        "additionalProperties": false
+      },
+      "HighestProvenProviderState": {
+        "type": "string",
+        "enum": ["none", "provider_accepted"],
+        "description": "The strongest provider assertion the service can prove; it is not an end-device delivery receipt."
+      },
+      "ClassifiedError": {
+        "type": "object",
+        "description": "A stable, safe error classification with no provider response or credential material.",
+        "required": ["code", "retryable"],
+        "properties": {
+          "code": { "$ref": "#/components/schemas/ProblemCode" },
+          "retryable": { "type": "boolean" },
+          "detail": { "type": "string", "minLength": 1, "maxLength": 1024 },
+          "diagnostic_id": { "$ref": "#/components/schemas/DiagnosticId" }
+        },
+        "additionalProperties": false
+      },
+      "Environment": {
+        "type": "string",
+        "enum": ["test", "live"],
+        "description": "The single environment selected by the authenticated credential."
+      },
+      "EmailAddress": {
+        "type": "string",
+        "minLength": 3,
+        "maxLength": 254,
+        "pattern": "^(?=[^@]{1,64}@)(?!\\.)(?![^@]*\\.@)(?![^@]*\\.\\.)[A-Za-z0-9!#$%&'*+/=?^_`{|}~.-]+@(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$",
+        "description": "Exactly one mailbox: an unquoted ASCII dot-atom local part plus a canonical lower-case IDNA domain. The comparison key preserves local-part bytes and case and lower-cases only the domain; dot, plus-tag, alias and provider equivalence are never inferred."
+      },
+      "BroadcastMessageProvenance": {
+        "type": "object",
+        "description": "Provenance carried by an ordinary message created during group expansion. The broadcast, message subscriber_id, and exact historical membership generation form the child uniqueness boundary.",
+        "required": ["broadcast_id", "group_id", "membership_generation"],
+        "properties": {
+          "broadcast_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+          "group_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+          "membership_generation": { "type": "integer", "minimum": 1 }
+        },
+        "additionalProperties": false
+      },
+      "MessageDeliveryTarget": {
+        "type": "string",
+        "enum": ["connection", "simulator"],
+        "description": "The effective provider boundary selected for a message. Connection delivery uses the exact authorized environment connection; simulator delivery never calls a provider."
+      },
+      "TrimmedInputAnswer": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 4000,
+        "pattern": "^\\S(?:[\\s\\S]*\\S)?$",
+        "description": "Untrusted input text after leading and trailing whitespace is removed."
+      },
+      "OpaqueIdentifier-2": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 128,
+        "pattern": "^[^\\u0000-\\u001F\\u007F]+$",
+        "description": "An opaque identifier whose internal encoding is not a public promise."
+      },
+      "InteractionState": {
+        "type": "string",
+        "enum": ["open", "answered", "expired", "cancelled", "retired"]
+      },
+      "DeveloperKey": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 63,
+        "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+        "description": "A stable, lowercase developer key used by registered return destinations and subscriber groups."
+      },
+      "BroadcastAggregate": {
         "type": "object",
+        "description": "A projection over expansion and ordinary child-message states, not an independent delivery state machine.",
         "required": [
-          "sending",
-          "receiving",
-          "delivery",
-          "link_interactions",
-          "free_text_reply"
+          "audience",
+          "expanded",
+          "pending",
+          "provider_accepted",
+          "delivered",
+          "skipped",
+          "failed",
+          "cancelled",
+          "expired"
         ],
         "properties": {
-          "sending": {
-            "$ref": "#/components/schemas/EmailDomainCapabilityState"
-          },
-          "receiving": {
-            "$ref": "#/components/schemas/EmailDomainCapabilityState"
-          },
-          "delivery": { "type": "boolean" },
-          "link_interactions": { "type": "boolean" },
-          "free_text_reply": {
-            "type": "boolean",
-            "description": "False when free-text replies cannot be lowered: receiving may not be verified yet, or the provider team may have message-content storage disabled. Delivery and link-based interaction remain independently available; no undocumented eligibility or storage-state endpoint is assumed."
-          }
+          "audience": { "type": "integer", "minimum": 0 },
+          "expanded": { "type": "integer", "minimum": 0 },
+          "pending": { "type": "integer", "minimum": 0 },
+          "provider_accepted": { "type": "integer", "minimum": 0 },
+          "delivered": { "type": "integer", "minimum": 0 },
+          "skipped": { "type": "integer", "minimum": 0 },
+          "failed": { "type": "integer", "minimum": 0 },
+          "cancelled": { "type": "integer", "minimum": 0 },
+          "expired": { "type": "integer", "minimum": 0 }
         },
         "additionalProperties": false
       },
-      "EmailDnsRecord": {
-        "description": "One exact neutral DNS record. `name` is preserved exactly as the provider returns it and is relative to the registrable domain (for example `send.notify`, not `send.notify.example.com`).",
+      "EmailBindingConsent": {
+        "description": "How consent for this exact subscriber, notifier and connection was established. A customer assertion never becomes recipient-observed verification. Complaint, unsubscribe and suppression override either arm.",
         "oneOf": [
           {
             "type": "object",
-            "required": ["type", "name", "value", "priority", "status"],
+            "required": ["kind", "observed_at"],
             "properties": {
-              "type": { "const": "MX" },
-              "name": {
-                "type": "string",
-                "minLength": 1,
-                "maxLength": 253,
-                "pattern": "^[^\u0000-\u001f-Ÿ

]+$"
-              },
-              "value": {
-                "type": "string",
-                "minLength": 1,
-                "maxLength": 2048,
-                "pattern": "^[^\u0000-\u001f-Ÿ

]+$"
-              },
-              "priority": { "type": "integer", "minimum": 0, "maximum": 65535 },
-              "status": {
-                "enum": [
-                  "not_started",
-                  "pending",
-                  "verified",
-                  "failed",
-                  "temporary_failure"
-                ]
-              }
+              "kind": { "const": "recipient_observed" },
+              "observed_at": { "$ref": "#/components/schemas/Timestamp" }
             },
             "additionalProperties": false
           },
           {
             "type": "object",
-            "required": ["type", "name", "value", "status"],
+            "required": ["kind", "consented_at", "source"],
             "properties": {
-              "type": { "enum": ["TXT", "CNAME"] },
-              "name": {
+              "kind": { "const": "asserted_prior_consent" },
+              "consented_at": { "$ref": "#/components/schemas/Timestamp" },
+              "source": {
                 "type": "string",
                 "minLength": 1,
-                "maxLength": 253,
-                "pattern": "^[^\u0000-\u001f-Ÿ

]+$"
+                "maxLength": 100,
+                "pattern": "^[^\u0000-\u001f-Ÿ

]+$",
+                "description": "A bounded customer description of where consent was collected. The authenticated asserting actor is recorded by the service, never accepted from this object."
               },
-              "value": {
-                "type": "string",
-                "minLength": 1,
-                "maxLength": 2048,
-                "pattern": "^[^\u0000-\u001f-Ÿ

]+$"
+              "asserted_at": { "$ref": "#/components/schemas/Timestamp" },
+              "asserted_by": {
+                "type": "object",
+                "required": ["kind", "id"],
+                "properties": "^[^\u0000-\u001f-Ÿ

]+$"{
+                  "kind": { "enum": ["credential", "grant", "session"] },
+                  "id": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+                },
+                "additionalProperties": false
               },
-              "status": {
-                "enum": [
-                  "not_started",
-                  "pending",
-                  "verified",
-                  "failed",
-                  "temporary_failure"
-                ]
-              }
+              "domain_id": { "$ref": "#/components/schemas/OpaqueIdentifier" }
             },
             "additionalProperties": false
           }
         ]
       },
-      "EmailDomainGuide": {
+      "RecipientChannelSummary": {
         "type": "object",
-        "required": ["state"],
+        "description": "Safe state for one configured channel. Provider identities, credentials, callback state, and other subscribers are absent.",
+        "required": ["channel", "state", "preferred"],
         "properties": {
+          "channel": { "$ref": "#/components/schemas/Channel" },
           "state": {
-            "enum": [
-              "detecting",
-              "guided",
-              "domain_connect_available",
-              "complete",
-              "unavailable"
-            ]
-          },
-          "dns_provider": {
             "type": "string",
-            "minLength": 1,
-            "maxLength": 100,
-            "pattern": "^[^\u0000-\u001f-Ÿ

]+$"
+            "enum": ["available", "connected", "paused"]
           },
-          "instructions_url": {
+          "binding_id": {
+            "$ref": "#/components/schemas/OpaqueIdentifier",
+            "description": "The exact binding owned by this session's subscriber. Present only for connected or paused state."
+          },
+          "preferred": { "type": "boolean" },
+          "connection_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+          "masked_address": {
             "type": "string",
-            "format": "uri",
-            "pattern": "^https://[^\\s]+$",
-            "maxLength": 2048,
-            "description": "A short-lived secret-free instruction link for a DNS administrator. It contains no WhooshBang session or provider OAuth material."
-          }
-        },
-        "allOf": [
-          {
-            "if": {
-              "properties": {
-                "state": {
-                  "enum": ["guided", "domain_connect_available", "complete"]
-                }
-              },
-              "required": ["state"]
-            },
-            "then": {
-              "properties": { "dns_provider": true },
-              "required": ["dns_provider"]
-            },
-            "else": { "properties": { "dns_provider": false } }
-          }
-        ],
-        "additionalProperties": false
-      },
-      "EmailSubjectPolicy": {
-        "type": "object",
-        "description": "The fixed subject rendering contract. Notification title wins; otherwise localized copy equivalent to `Notification from {notifier display name}` is used. Whitespace is normalized and the final value is capped at 200 Unicode code points.",
-        "required": ["fallback", "maximum_code_points", "normalize_whitespace"],
-        "properties": {
-          "fallback": { "const": "localized_notifier_name" },
-          "maximum_code_points": { "const": 200 },
-          "normalize_whitespace": { "const": true }
-        },
-        "additionalProperties": false
-      },
-      "EmailDeliveryPolicy": {
-        "type": "object",
-        "description": "Privacy-safe email defaults. Return-Path and Message-ID remain provider-owned, arbitrary headers are unsupported, and every ordinary message carries a visible management route plus safe one-click unsubscribe semantics when custom headers are available. A GET never mutates consent; the matching POST resolves the exact binding.",
-        "required": [
-          "open_tracking",
-          "click_tracking",
-          "tls",
-          "unsubscribe",
-          "subject"
-        ],
-        "properties": {
-          "open_tracking": { "const": false },
-          "click_tracking": { "const": false },
-          "tls": {
-            "enum": ["opportunistic", "enforced"],
-            "default": "opportunistic"
+            "minLength": 3,
+            "maxLength": 254,
+            "description": "Masked recipient address. Never the full mailbox."
           },
-          "unsubscribe": { "const": "visible_and_one_click_where_supported" },
-          "subject": { "$ref": "#/components/schemas/EmailSubjectPolicy" }
-        },
-        "additionalProperties": false
-      },
-      "OrganizationCredentialPrefix": {
-        "type": "string",
-        "pattern": "^wb_oc1\\.ocred_[A-Za-z0-9_-]{8}$",
-        "description": "A safe display prefix containing the organization-credential format marker and first eight base64url identity characters, never secret bytes."
-      },
-      "OrganizationCredentialScope": {
-        "type": "string",
-        "enum": [
-          "organization:read",
-          "projects:write",
-          "projects:read",
-          "messages:write",
-          "messages:read",
-          "subscriptions:write",
-          "subscriptions:read",
-          "machine-clients:write",
-          "machine-clients:read",
-          "capabilities:read",
-          "connections:write",
-          "connections:read"
-        ],
-        "description": "One organization-credential capability. `organization:read` is the organization's project directory — listing the organization's projects and reading one — and is the only scope here a project credential can never carry; it authorizes nothing below the organization. Every other name is the project-credential vocabulary unchanged, and is exercised only on the environment-scoped routes, where the project and environment come from the path and the credential's authority is the intersection of these scopes with the project-credential vocabulary. An organization credential is therefore never wider than a project credential would have been for the same project environment."
-      },
-      "OrganizationCredentialScopeSet": {
-        "type": "array",
-        "minItems": 1,
-        "maxItems": 12,
-        "uniqueItems": true,
-        "items": { "$ref": "#/components/schemas/OrganizationCredentialScope" }
-      },
-      "OrganizationCredentialSecret": {
-        "type": "string",
-        "pattern": "^wb_oc1\\.ocred_[A-Za-z0-9_-]{21}[AQgw]\\.[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$",
-        "description": "The exact one-time runtime bearer syntax. The final segment is canonical unpadded base64url for exactly 32 random secret bytes."
-      },
-      "Environment": {
-        "type": "string",
-        "enum": ["test", "live"],
-        "description": "The single environment selected by the authenticated credential."
-      },
-      "RecipientCopyOverrideValue": {
-        "type": "string",
-        "minLength": 1,
-        "maxLength": 500,
-        "description": "Customer-authored plain text with optional plain template placeholders. The service enforces key-specific length and rejects invisible controls. Rendering escapes text; changing labels does not change recipient control actions."
-      },
-      "ApiCredentialPrefix": {
-        "type": "string",
-        "pattern": "^wb_pc1\\.pcred_[A-Za-z0-9_-]{8}$",
-        "description": "A safe display prefix containing the credential format marker and first eight base64url identity characters, never secret bytes."
-      },
-      "ApiCredentialScope": {
-        "type": "string",
-        "enum": [
-          "projects:write",
-          "projects:read",
-          "messages:write",
-          "messages:read",
-          "subscriptions:write",
-          "subscriptions:read",
-          "machine-clients:write",
-          "machine-clients:read",
-          "capabilities:read",
-          "connections:write",
-          "connections:read"
+          "consent": { "$ref": "#/components/schemas/EmailBindingConsent" }
+        },
+        "allOf": [
+          {
+            "if": {
+              "properties": { "state": { "enum": ["connected", "paused"] } },
+              "required": ["state"]
+            },
+            "then": {
+              "required": ["binding_id"],
+              "properties": { "binding_id": {} }
+            }
+          },
+          {
+            "if": {
+              "properties": { "state": { "const": "available" } },
+              "required": ["state"]
+            },
+            "then": {
+              "properties": {
+                "binding_id": false,
+                "preferred": { "const": false }
+              }
+            }
+          }
         ],
-        "description": "One project-credential capability. Environment authority always comes from the credential record, never a scope or request field. `projects:write` configures the credential's own project and environment; it never creates a project, which remains an organization authority. The project-wide singletons — brand, default locale, logo and recipient copy — are what a live recipient sees, so writing them requires a live credential; a test credential may read them and may write its own environment's policy."
-      },
-      "ApiCredentialScopeSet": {
-        "type": "array",
-        "minItems": 1,
-        "maxItems": 11,
-        "uniqueItems": true,
-        "items": { "$ref": "#/components/schemas/ApiCredentialScope" }
-      },
-      "ApiCredentialSecret": {
-        "type": "string",
-        "pattern": "^wb_pc1\\.pcred_[A-Za-z0-9_-]{21}[AQgw]\\.[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$",
-        "description": "The exact one-time runtime bearer syntax. The final segment is canonical unpadded base64url for exactly 32 random secret bytes."
+        "additionalProperties": false
       },
       "ConnectionIdentity": {
         "type": "object",
@@ -18290,18 +18967,6 @@
         ],
         "additionalProperties": false
       },
-      "ClassifiedError": {
-        "type": "object",
-        "description": "A stable, safe error classification with no provider response or credential material.",
-        "required": ["code", "retryable"],
-        "properties": {
-          "code": { "$ref": "#/components/schemas/ProblemCode" },
-          "retryable": { "type": "boolean" },
-          "detail": { "type": "string", "minLength": 1, "maxLength": 1024 },
-          "diagnostic_id": { "$ref": "#/components/schemas/DiagnosticId" }
-        },
-        "additionalProperties": false
-      },
       "EmailVerificationSummary": {
         "type": "object",
         "required": ["status", "masked_address", "expires_at"],
@@ -18317,353 +18982,395 @@
         },
         "additionalProperties": false
       },
-      "MessageTarget": {
-        "type": "object",
-        "required": ["subscriber_id"],
-        "properties": {
-          "subscriber_id": { "$ref": "#/components/schemas/OpaqueIdentifier" }
-        },
-        "additionalProperties": false
-      },
-      "MessageDeliveryTarget": {
+      "OrganizationRole": {
         "type": "string",
-        "enum": ["connection", "simulator"],
-        "description": "The effective provider boundary selected for a message. Connection delivery uses the exact authorized environment connection; simulator delivery never calls a provider."
+        "enum": ["admin", "member", "messenger"],
+        "description": "The person's WhooshBang role in the organization. `admin` does everything, including billing, API keys and teammates. `member` runs the projects they were given: channels, subscribers, messages and project settings. `messenger` sends messages and reads replies in the projects they were given. Clients must tolerate roles added later."
       },
-      "StructuredTextSection": {
+      "OrganizationMembershipSummary": {
         "type": "object",
-        "required": ["text"],
+        "required": ["role"],
         "properties": {
-          "heading": {
-            "description": "An optional semantic heading for this section.",
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 200,
-            "x-max-utf8-bytes": 800
-          },
-          "text": {
-            "description": "The section body, also represented in the complete fallback text.",
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 1000,
-            "x-max-utf8-bytes": 4000
-          }
+          "role": { "$ref": "#/components/schemas/OrganizationRole" }
         },
         "additionalProperties": false
       },
-      "DocumentSectionBlock": {
-        "description": "One prose section in an ordered portable document.",
+      "OrganizationClosureProviderAction": {
         "type": "object",
-        "required": ["type", "text"],
+        "description": "One provider-owned resource the customer must retire outside WhooshBang after organization closure. It contains safe identifiers only, never provider credentials.",
+        "required": ["provider", "action", "connection_id"],
         "properties": {
-          "type": { "const": "section" },
-          "heading": {
-            "description": "An optional semantic heading for this section.",
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 200,
-            "x-max-utf8-bytes": 800
+          "provider": {
+            "$ref": "#/components/schemas/ChannelConnectionProvider"
           },
-          "text": {
-            "description": "The section prose.",
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 1000,
-            "x-max-utf8-bytes": 4000
-          }
-        },
-        "additionalProperties": false
-      },
-      "DocumentFact": {
-        "type": "object",
-        "required": ["label", "value"],
-        "properties": {
-          "label": {
-            "description": "The semantic label for this fact.",
+          "action": {
             "type": "string",
-            "minLength": 1,
-            "maxLength": 200,
-            "x-max-utf8-bytes": 800
+            "enum": ["revoke_bot_token", "delete_provider_application"]
           },
-          "value": {
-            "description": "The semantic value for this fact.",
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 1000,
-            "x-max-utf8-bytes": 4000
-          }
-        },
-        "additionalProperties": false
-      },
-      "DocumentFactsBlock": {
-        "description": "One ordered group of semantic label/value facts.",
-        "type": "object",
-        "required": ["type", "items"],
-        "properties": {
-          "type": { "const": "facts" },
-          "items": {
-            "type": "array",
-            "minItems": 1,
-            "maxItems": 24,
-            "items": { "$ref": "#/components/schemas/DocumentFact" }
-          }
+          "connection_id": { "$ref": "#/components/schemas/OpaqueIdentifier" }
         },
         "additionalProperties": false
       },
-      "DocumentTableCell": {
+      "TeammateStatus": {
         "type": "string",
-        "minLength": 1,
-        "maxLength": 500,
-        "x-max-utf8-bytes": 2000
-      },
-      "DocumentTableRow": {
-        "type": "array",
-        "minItems": 2,
-        "maxItems": 8,
-        "items": { "$ref": "#/components/schemas/DocumentTableCell" }
+        "enum": ["active", "invited"],
+        "description": "`active` has joined. `invited` has an invitation they have not accepted."
       },
-      "DocumentTableBlock": {
-        "description": "One small semantic table. Every row must have exactly one cell for each column.",
+      "TeammateProjectAccess": {
         "type": "object",
-        "required": ["type", "heading", "columns", "rows"],
+        "description": "Which projects the teammate can see. An admin sees every project, including ones created later.",
+        "required": ["all", "project_ids"],
         "properties": {
-          "type": { "const": "table" },
-          "heading": {
-            "description": "The semantic heading for this table.",
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 200,
-            "x-max-utf8-bytes": 800
-          },
-          "columns": {
-            "description": "The ordered column headings.",
-            "type": "array",
-            "minItems": 2,
-            "maxItems": 8,
-            "items": { "$ref": "#/components/schemas/DocumentTableCell" }
-          },
-          "rows": {
-            "description": "The ordered table rows.",
+          "all": { "type": "boolean" },
+          "project_ids": {
             "type": "array",
-            "minItems": 1,
-            "maxItems": 20,
-            "items": { "$ref": "#/components/schemas/DocumentTableRow" }
+            "maxItems": 1000,
+            "uniqueItems": true,
+            "items": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+            "description": "The projects given to this teammate. Empty when `all` is true."
           }
         },
-        "x-rows-match-columns": true,
         "additionalProperties": false
       },
-      "DocumentDetailsBlock": {
-        "description": "One supporting disclosure in an ordered portable document.",
-        "type": "object",
-        "required": ["type", "summary", "text"],
-        "properties": {
-          "type": { "const": "details" },
-          "summary": {
-            "description": "The always-visible semantic summary.",
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 200,
-            "x-max-utf8-bytes": 800
-          },
-          "text": {
-            "description": "The supporting prose.",
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 2000,
-            "x-max-utf8-bytes": 8000
-          }
-        },
-        "additionalProperties": false
+      "ProviderInstallationStatus": {
+        "type": "string",
+        "enum": [
+          "pending",
+          "active",
+          "reauthorization_required",
+          "revoked",
+          "invalid"
+        ],
+        "description": "The safe customer-facing lifecycle of a provider installation. Credential and provider-native state stay private."
       },
-      "DocumentBlock": {
+      "ProviderAuthorizationSetup": {
+        "description": "A credential-free provider authorization handoff for one exact connection. The URL is short-lived and safe to render, but never contains a provider credential, team identifier or raw authorization code; actual OAuth state and callback handling remain service-private.",
         "oneOf": [
-          { "$ref": "#/components/schemas/DocumentSectionBlock" },
-          { "$ref": "#/components/schemas/DocumentFactsBlock" },
-          { "$ref": "#/components/schemas/DocumentTableBlock" },
-          { "$ref": "#/components/schemas/DocumentDetailsBlock" }
-        ]
-      },
-      "DocumentContent": {
-        "description": "An authoritative ordered portable notification document that every delivery adapter renders faithfully.",
-        "type": "object",
-        "required": ["type", "blocks"],
-        "properties": {
-          "type": { "const": "document" },
-          "title": {
-            "description": "An optional semantic document title. The adapter chooses its native presentation.",
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 200,
-            "x-max-utf8-bytes": 800
+          {
+            "type": "object",
+            "required": ["status", "authorization_url", "expires_at"],
+            "properties": {
+              "status": { "const": "awaiting_authorization" },
+              "authorization_url": {
+                "type": "string",
+                "format": "uri",
+                "pattern": "^https://[^\\s]+$",
+                "maxLength": 2048,
+                "description": "The short-lived HTTPS authorization handoff for this connection. It carries opaque state, not provider credentials or a raw authorization code."
+              },
+              "expires_at": { "$ref": "#/components/schemas/Timestamp" }
+            },
+            "additionalProperties": false
           },
-          "blocks": {
-            "description": "The complete portable document in exact authored order.",
-            "type": "array",
-            "minItems": 1,
-            "maxItems": 24,
-            "items": { "$ref": "#/components/schemas/DocumentBlock" }
+          {
+            "type": "object",
+            "required": ["status", "expires_at"],
+            "properties": {
+              "status": { "const": "provisioning" },
+              "expires_at": { "$ref": "#/components/schemas/Timestamp" }
+            },
+            "additionalProperties": false
           },
-          "image": { "$ref": "#/components/schemas/NotificationImage" }
-        },
-        "additionalProperties": false
-      },
-      "MessageContent": {
-        "oneOf": [
-          { "$ref": "#/components/schemas/TextContent" },
-          { "$ref": "#/components/schemas/DocumentContent" }
-        ]
-      },
-      "MetadataValue": {
-        "oneOf": [
-          { "type": "string" },
-          { "type": "number" },
-          { "type": "boolean" },
-          { "type": "null" }
+          {
+            "type": "object",
+            "required": ["status", "expires_at", "failure"],
+            "properties": {
+              "status": { "const": "failed" },
+              "expires_at": { "$ref": "#/components/schemas/Timestamp" },
+              "failure": { "$ref": "#/components/schemas/ProviderFailure" }
+            },
+            "additionalProperties": false
+          },
+          {
+            "type": "object",
+            "required": ["status", "expires_at"],
+            "properties": {
+              "status": { "const": "expired" },
+              "expires_at": { "$ref": "#/components/schemas/Timestamp" }
+            },
+            "additionalProperties": false
+          }
         ]
       },
-      "Metadata": {
-        "type": "object",
-        "description": "Bounded customer correlation data. Do not include secrets or personal data.",
-        "maxProperties": 20,
-        "propertyNames": { "minLength": 1, "maxLength": 64 },
-        "additionalProperties": {
-          "$ref": "#/components/schemas/MetadataValue"
-        },
-        "x-max-json-bytes": 4096
-      },
-      "InteractionPrompt": {
+      "EmailDomainName": {
         "type": "string",
-        "minLength": 1,
-        "maxLength": 1000
+        "minLength": 4,
+        "maxLength": 253,
+        "pattern": "^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.){2,}[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$",
+        "description": "A canonical lower-case IDNA ASCII customer sending domain with its trailing dot removed. It must be a dedicated subdomain below the registrable domain; runtime validation uses the public suffix list so a registrable root such as example.co.uk is still rejected. URLs, ports, wildcards and mailbox addresses are invalid."
       },
-      "Timestamp-2": {
+      "EmailDomainLifecycle": {
         "type": "string",
-        "format": "date-time",
-        "pattern": "^[0-9]{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01])T(?:[01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](?:\\.[0-9]+)?(?:Z|[+-](?:[01][0-9]|2[0-3]):[0-5][0-9])$"
+        "enum": [
+          "requested",
+          "creating",
+          "dns_required",
+          "verifying",
+          "testing",
+          "active",
+          "provider_action_required",
+          "dns_failed",
+          "oauth_required",
+          "held",
+          "deleting",
+          "deleted"
+        ],
+        "description": "The provider-neutral domain lifecycle. Sending and receiving capabilities are reported separately because they verify on different clocks."
       },
-      "InteractionCorrelationId": {
+      "EmailDomainCapabilityState": {
         "type": "string",
-        "minLength": 8,
-        "maxLength": 128,
-        "pattern": "^[^\\u0000-\\u001F\\u007F]+$",
-        "description": "Caller-owned opaque correlation returned as data, never treated as execution authority."
+        "enum": ["pending", "verified", "failed", "unsupported"]
       },
-      "ConfirmInteractionRequest": {
+      "EmailDomainCapabilities": {
         "type": "object",
-        "required": ["type", "prompt", "expires_at"],
+        "required": [
+          "sending",
+          "receiving",
+          "delivery",
+          "link_interactions",
+          "free_text_reply"
+        ],
         "properties": {
-          "type": { "const": "confirm" },
-          "prompt": { "$ref": "#/components/schemas/InteractionPrompt" },
-          "confirm_label": {
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 40
+          "sending": {
+            "$ref": "#/components/schemas/EmailDomainCapabilityState"
           },
-          "deny_label": { "type": "string", "minLength": 1, "maxLength": 40 },
-          "expires_at": {
-            "$ref": "#/components/schemas/Timestamp-2",
-            "description": "Must be 30 seconds through 24 hours after server acceptance."
+          "receiving": {
+            "$ref": "#/components/schemas/EmailDomainCapabilityState"
           },
-          "correlation_id": {
-            "$ref": "#/components/schemas/InteractionCorrelationId"
+          "delivery": { "type": "boolean" },
+          "link_interactions": { "type": "boolean" },
+          "free_text_reply": {
+            "type": "boolean",
+            "description": "False when free-text replies cannot be lowered: receiving may not be verified yet, or the provider team may have message-content storage disabled. Delivery and link-based interaction remain independently available; no undocumented eligibility or storage-state endpoint is assumed."
           }
         },
         "additionalProperties": false
       },
-      "InteractionOption": {
+      "EmailDnsRecord": {
+        "description": "One exact neutral DNS record. `name` is preserved exactly as the provider returns it and is relative to the registrable domain (for example `send.notify`, not `send.notify.example.com`).",
+        "oneOf": [
+          {
+            "type": "object",
+            "required": ["type", "name", "value", "priority", "status"],
+            "properties": {
+              "type": { "const": "MX" },
+              "name": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 253,
+                "pattern": "^[^\u0000-\u001f-Ÿ

]+$"
+              },
+              "value": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 2048,
+                "pattern": "^[^\u0000-\u001f-Ÿ

]+$"
+              },
+              "priority": { "type": "integer", "minimum": 0, "maximum": 65535 },
+              "status": {
+                "enum": [
+                  "not_started",
+                  "pending",
+                  "verified",
+                  "failed",
+                  "temporary_failure"
+                ]
+              }
+            },
+            "additionalProperties": false
+          },
+          {
+            "type": "object",
+            "required": ["type", "name", "value", "status"],
+            "properties": {
+              "type": { "enum": ["TXT", "CNAME"] },
+              "name": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 253,
+                "pattern": "^[^\u0000-\u001f-Ÿ

]+$"
+              },
+              "value": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 2048,
+                "pattern": "^[^\u0000-\u001f-Ÿ

]+$"
+              },
+              "status": {
+                "enum": [
+                  "not_started",
+                  "pending",
+                  "verified",
+                  "failed",
+                  "temporary_failure"
+                ]
+              }
+            },
+            "additionalProperties": false
+          }
+        ]
+      },
+      "EmailDomainGuide": {
         "type": "object",
-        "required": ["value", "label"],
+        "required": ["state"],
         "properties": {
-          "value": {
+          "state": {
+            "enum": [
+              "detecting",
+              "guided",
+              "domain_connect_available",
+              "complete",
+              "unavailable"
+            ]
+          },
+          "dns_provider": {
             "type": "string",
             "minLength": 1,
-            "maxLength": 128,
-            "pattern": "^[^\\u0000-\\u001F\\u007F-\u001f-Ÿ

]+$",
-            "description": "Opaque customer data. It is never interpreted as a command."
+            "maxLength": 100,
+            "pattern": "^[^\u0000-\u001f-Ÿ

]+$"
           },
-          "label": { "type": "string", "minLength": 1, "maxLength": 120 },
-          "intent": {
+          "instructions_url": {
             "type": "string",
-            "enum": ["accept", "destructive", "informational", "neutral"],
-            "default": "neutral",
-            "description": "What choosing this option does, so a channel can present it accordingly. Describes consequence rather than appearance: a channel renders `accept` green where it can, `destructive` red, `informational` prominent, and `neutral` plainly. A channel that cannot colour a control ignores this and the option still renders. Omitted means `neutral`."
+            "format": "uri",
+            "pattern": "^https://[^\\s]+$",
+            "maxLength": 2048,
+            "description": "A short-lived secret-free instruction link for a DNS administrator. It contains no WhooshBang session or provider OAuth material."
           }
         },
+        "allOf": [
+          {
+            "if": {
+              "properties": {
+                "state": {
+                  "enum": ["guided", "domain_connect_available", "complete"]
+                }
+              },
+              "required": ["state"]
+            },
+            "then": {
+              "properties": { "dns_provider": true },
+              "required": ["dns_provider"]
+            },
+            "else": { "properties": { "dns_provider": false } }
+          }
+        ],
         "additionalProperties": false
       },
-      "SelectInteractionRequest": {
-        "type": "object",
-        "required": ["type", "prompt", "options", "expires_at"],
-        "properties": {
-          "type": { "const": "select" },
-          "prompt": { "$ref": "#/components/schemas/InteractionPrompt" },
-          "options": {
-            "type": "array",
-            "minItems": 2,
-            "maxItems": 6,
-            "items": { "$ref": "#/components/schemas/InteractionOption" },
-            "x-unique-property": "value"
-          },
-          "expires_at": {
-            "$ref": "#/components/schemas/Timestamp-2",
-            "description": "Must be 30 seconds through 24 hours after server acceptance."
-          },
-          "correlation_id": {
-            "$ref": "#/components/schemas/InteractionCorrelationId"
-          }
+      "EmailSubjectPolicy": {
+        "type": "object",
+        "description": "The fixed subject rendering contract. Notification title wins; otherwise localized copy equivalent to `Notification from {notifier display name}` is used. Whitespace is normalized and the final value is capped at 200 Unicode code points.",
+        "required": ["fallback", "maximum_code_points", "normalize_whitespace"],
+        "properties": {
+          "fallback": { "const": "localized_notifier_name" },
+          "maximum_code_points": { "const": 200 },
+          "normalize_whitespace": { "const": true }
         },
         "additionalProperties": false
       },
-      "InputInteractionRequest": {
+      "EmailDeliveryPolicy": {
         "type": "object",
-        "required": ["type", "prompt", "expires_at"],
+        "description": "Privacy-safe email defaults. Return-Path and Message-ID remain provider-owned, arbitrary headers are unsupported, and every ordinary message carries a visible management route plus safe one-click unsubscribe semantics when custom headers are available. A GET never mutates consent; the matching POST resolves the exact binding.",
+        "required": [
+          "open_tracking",
+          "click_tracking",
+          "tls",
+          "unsubscribe",
+          "subject"
+        ],
         "properties": {
-          "type": { "const": "input" },
-          "prompt": { "$ref": "#/components/schemas/InteractionPrompt" },
-          "expires_at": {
-            "$ref": "#/components/schemas/Timestamp-2",
-            "description": "Must be 30 seconds through 24 hours after server acceptance."
+          "open_tracking": { "const": false },
+          "click_tracking": { "const": false },
+          "tls": {
+            "enum": ["opportunistic", "enforced"],
+            "default": "opportunistic"
           },
-          "correlation_id": {
-            "$ref": "#/components/schemas/InteractionCorrelationId"
-          }
+          "unsubscribe": { "const": "visible_and_one_click_where_supported" },
+          "subject": { "$ref": "#/components/schemas/EmailSubjectPolicy" }
         },
         "additionalProperties": false
       },
-      "HighestProvenProviderState": {
+      "OrganizationCredentialPrefix": {
         "type": "string",
-        "enum": ["none", "provider_accepted"],
-        "description": "The strongest provider assertion the service can prove; it is not an end-device delivery receipt."
+        "pattern": "^wb_oc1\\.ocred_[A-Za-z0-9_-]{8}$",
+        "description": "A safe display prefix containing the organization-credential format marker and first eight base64url identity characters, never secret bytes."
       },
-      "BroadcastMessageProvenance": {
-        "type": "object",
-        "description": "Provenance carried by an ordinary message created during group expansion. The broadcast, message subscriber_id, and exact historical membership generation form the child uniqueness boundary.",
-        "required": ["broadcast_id", "group_id", "membership_generation"],
-        "properties": {
-          "broadcast_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
-          "group_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
-          "membership_generation": { "type": "integer", "minimum": 1 }
-        },
-        "additionalProperties": false
+      "OrganizationCredentialScope": {
+        "type": "string",
+        "enum": [
+          "organization:read",
+          "projects:write",
+          "projects:read",
+          "messages:write",
+          "messages:read",
+          "subscriptions:write",
+          "subscriptions:read",
+          "machine-clients:write",
+          "machine-clients:read",
+          "capabilities:read",
+          "connections:write",
+          "connections:read"
+        ],
+        "description": "One organization-credential capability. `organization:read` is the organization's project directory — listing the organization's projects and reading one — and is the only scope here a project credential can never carry; it authorizes nothing below the organization. Every other name is the project-credential vocabulary unchanged, and is exercised only on the environment-scoped routes, where the project and environment come from the path and the credential's authority is the intersection of these scopes with the project-credential vocabulary. An organization credential is therefore never wider than a project credential would have been for the same project environment."
       },
-      "TrimmedInputAnswer": {
+      "OrganizationCredentialScopeSet": {
+        "type": "array",
+        "minItems": 1,
+        "maxItems": 12,
+        "uniqueItems": true,
+        "items": { "$ref": "#/components/schemas/OrganizationCredentialScope" }
+      },
+      "OrganizationCredentialSecret": {
         "type": "string",
-        "minLength": 1,
-        "maxLength": 4000,
-        "pattern": "^\\S(?:[\\s\\S]*\\S)?$",
-        "description": "Untrusted input text after leading and trailing whitespace is removed."
+        "pattern": "^wb_oc1\\.ocred_[A-Za-z0-9_-]{21}[AQgw]\\.[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$",
+        "description": "The exact one-time runtime bearer syntax. The final segment is canonical unpadded base64url for exactly 32 random secret bytes."
       },
-      "OpaqueIdentifier-2": {
+      "RecipientCopyOverrideValue": {
         "type": "string",
         "minLength": 1,
-        "maxLength": 128,
-        "pattern": "^[^\\u0000-\\u001F\\u007F]+$",
-        "description": "An opaque identifier whose internal encoding is not a public promise."
+        "maxLength": 500,
+        "description": "Customer-authored plain text with optional plain template placeholders. The service enforces key-specific length and rejects invisible controls. Rendering escapes text; changing labels does not change recipient control actions."
       },
-      "InteractionState": {
+      "ApiCredentialPrefix": {
         "type": "string",
-        "enum": ["open", "answered", "expired", "cancelled", "retired"]
+        "pattern": "^wb_pc1\\.pcred_[A-Za-z0-9_-]{8}$",
+        "description": "A safe display prefix containing the credential format marker and first eight base64url identity characters, never secret bytes."
+      },
+      "ApiCredentialScope": {
+        "type": "string",
+        "enum": [
+          "projects:write",
+          "projects:read",
+          "messages:write",
+          "messages:read",
+          "subscriptions:write",
+          "subscriptions:read",
+          "machine-clients:write",
+          "machine-clients:read",
+          "capabilities:read",
+          "connections:write",
+          "connections:read"
+        ],
+        "description": "One project-credential capability. Environment authority always comes from the credential record, never a scope or request field. `projects:write` configures the credential's own project and environment; it never creates a project, which remains an organization authority. The project-wide singletons — brand, default locale, logo and recipient copy — are what a live recipient sees, so writing them requires a live credential; a test credential may read them and may write its own environment's policy."
+      },
+      "ApiCredentialScopeSet": {
+        "type": "array",
+        "minItems": 1,
+        "maxItems": 11,
+        "uniqueItems": true,
+        "items": { "$ref": "#/components/schemas/ApiCredentialScope" }
+      },
+      "ApiCredentialSecret": {
+        "type": "string",
+        "pattern": "^wb_pc1\\.pcred_[A-Za-z0-9_-]{21}[AQgw]\\.[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$",
+        "description": "The exact one-time runtime bearer syntax. The final segment is canonical unpadded base64url for exactly 32 random secret bytes."
+      },
+      "MessageTarget": {
+        "type": "object",
+        "required": ["subscriber_id"],
+        "properties": {
+          "subscriber_id": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+        },
+        "additionalProperties": false
       },
       "OpaqueIdentifier-3": {
         "type": "string",
@@ -19472,13 +20179,6 @@
         "pattern": "^https?://[^/?#*\\s]+(?::[0-9]{1,5})?/?$",
         "description": "One exact scheme, host, and optional port, in any spelling that means that same origin. A trailing slash, an uppercase host, and an explicitly written default port are accepted and stored in canonical form. Paths, queries, fragments, credentials, and wildcards are forbidden; HTTP is accepted only for localhost or synthetic .test configuration."
       },
-      "DeveloperKey": {
-        "type": "string",
-        "minLength": 1,
-        "maxLength": 63,
-        "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
-        "description": "A stable, lowercase developer key used by registered return destinations and subscriber groups."
-      },
       "RegisteredReturnUrl": {
         "type": "string",
         "format": "uri",
@@ -19496,97 +20196,6 @@
         },
         "additionalProperties": false
       },
-      "EmailBindingConsent": {
-        "description": "How consent for this exact subscriber, notifier and connection was established. A customer assertion never becomes recipient-observed verification. Complaint, unsubscribe and suppression override either arm.",
-        "oneOf": [
-          {
-            "type": "object",
-            "required": ["kind", "observed_at"],
-            "properties": {
-              "kind": { "const": "recipient_observed" },
-              "observed_at": { "$ref": "#/components/schemas/Timestamp" }
-            },
-            "additionalProperties": false
-          },
-          {
-            "type": "object",
-            "required": ["kind", "consented_at", "source"],
-            "properties": {
-              "kind": { "const": "asserted_prior_consent" },
-              "consented_at": { "$ref": "#/components/schemas/Timestamp" },
-              "source": {
-                "type": "string",
-                "minLength": 1,
-                "maxLength": 100,
-                "pattern": "^[^\u0000-\u001f-Ÿ

]+$",
-                "description": "A bounded customer description of where consent was collected. The authenticated asserting actor is recorded by the service, never accepted from this object."
-              },
-              "asserted_at": { "$ref": "#/components/schemas/Timestamp" },
-              "asserted_by": {
-                "type": "object",
-                "required": ["kind", "id"],
-                "properties": {
-                  "kind": { "enum": ["credential", "grant", "session"] },
-                  "id": { "$ref": "#/components/schemas/OpaqueIdentifier" }
-                },
-                "additionalProperties": false
-              },
-              "domain_id": { "$ref": "#/components/schemas/OpaqueIdentifier" }
-            },
-            "additionalProperties": false
-          }
-        ]
-      },
-      "RecipientChannelSummary": {
-        "type": "object",
-        "description": "Safe state for one configured channel. Provider identities, credentials, callback state, and other subscribers are absent.",
-        "required": ["channel", "state", "preferred"],
-        "properties": {
-          "channel": { "$ref": "#/components/schemas/Channel" },
-          "state": {
-            "type": "string",
-            "enum": ["available", "connected", "paused"]
-          },
-          "binding_id": {
-            "$ref": "#/components/schemas/OpaqueIdentifier",
-            "description": "The exact binding owned by this session's subscriber. Present only for connected or paused state."
-          },
-          "preferred": { "type": "boolean" },
-          "connection_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
-          "masked_address": {
-            "type": "string",
-            "minLength": 3,
-            "maxLength": 254,
-            "description": "Masked recipient address. Never the full mailbox."
-          },
-          "consent": { "$ref": "#/components/schemas/EmailBindingConsent" }
-        },
-        "allOf": [
-          {
-            "if": {
-              "properties": { "state": { "enum": ["connected", "paused"] } },
-              "required": ["state"]
-            },
-            "then": {
-              "required": ["binding_id"],
-              "properties": { "binding_id": {} }
-            }
-          },
-          {
-            "if": {
-              "properties": { "state": { "const": "available" } },
-              "required": ["state"]
-            },
-            "then": {
-              "properties": {
-                "binding_id": false,
-                "preferred": { "const": false }
-              }
-            }
-          }
-        ],
-        "additionalProperties": false
-      },
       "RecipientSessionCapabilityPrefix": {
         "type": "string",
         "minLength": 33,
@@ -19645,33 +20254,6 @@
         "pattern": "^(?:UTC|[A-Za-z][A-Za-z0-9._+-]*(?:/[A-Za-z][A-Za-z0-9._+-]*)+)$",
         "description": "A named IANA time-zone identifier. Numeric offsets, abbreviations and display labels are invalid; recognized aliases normalize to the runtime's canonical identifier before persistence. Providers may leave it absent."
       },
-      "BroadcastAggregate": {
-        "type": "object",
-        "description": "A projection over expansion and ordinary child-message states, not an independent delivery state machine.",
-        "required": [
-          "audience",
-          "expanded",
-          "pending",
-          "provider_accepted",
-          "delivered",
-          "skipped",
-          "failed",
-          "cancelled",
-          "expired"
-        ],
-        "properties": {
-          "audience": { "type": "integer", "minimum": 0 },
-          "expanded": { "type": "integer", "minimum": 0 },
-          "pending": { "type": "integer", "minimum": 0 },
-          "provider_accepted": { "type": "integer", "minimum": 0 },
-          "delivered": { "type": "integer", "minimum": 0 },
-          "skipped": { "type": "integer", "minimum": 0 },
-          "failed": { "type": "integer", "minimum": 0 },
-          "cancelled": { "type": "integer", "minimum": 0 },
-          "expired": { "type": "integer", "minimum": 0 }
-        },
-        "additionalProperties": false
-      },
       "SafeExplanation": { "type": "string", "minLength": 1, "maxLength": 500 },
       "InteractionCapability": {
         "type": "object",
@@ -19752,7 +20334,7 @@
       "provider-capabilities-v1.schema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "$id": "https://whooshbang.flowxo.com/schemas/provider-capabilities-v1.schema.json",
-        "x-contract-version": "2.0.0-rc.8",
+        "x-contract-version": "2.1.0",
         "title": "ProviderCapabilitiesV1",
         "description": "Provider-neutral, renderer-facing delivery and interaction capabilities with explicit degradation.",
         "type": "object",
@@ -20472,5 +21054,5 @@
       }
     }
   },
-  "x-contract-version": "2.0.0-rc.8"
+  "x-contract-version": "2.1.0"
 }