@crvouga/mockingbird-service-junction 0.4.0 → 0.6.0

package/dist/{chunk-CR35KYXY.js → chunk-TG2EOH3J.js}

@@ -2,7 +2,7 @@ import {
   IDENTITY_MODES,
   createRuntime,
   pullCorpus
-} from "./chunk-ICINEQ7D.js";
+} from "./chunk-MS774AJA.js";
 import {
   defaultCorpus
 } from "./chunk-C2UGIPPM.js";
@@ -513,4 +513,4 @@ export {
   createServer2 as createServer,
   serveTarget
 };
-//# sourceMappingURL=chunk-CR35KYXY.js.map
+//# sourceMappingURL=chunk-TG2EOH3J.js.map

package/dist/cli.js

@@ -4,7 +4,7 @@ import {
   runCli,
   serveCommand,
   serveTarget
-} from "./chunk-CR35KYXY.js";
+} from "./chunk-TG2EOH3J.js";
 import {
   DEFAULT_JUNCTION_BASE_URL,
   createRuntime,
@@ -12,7 +12,7 @@ import {
   isSandboxKey,
   pullCorpus,
   verifyAgainstReal
-} from "./chunk-ICINEQ7D.js";
+} from "./chunk-MS774AJA.js";
 import {
   defaultCorpus
 } from "./chunk-C2UGIPPM.js";

package/dist/index.d.ts

@@ -73,6 +73,10 @@ type Rng = {
     int(min: number, max: number): number;
     /** Restart the stream from its seed. */
     reset(): void;
+    /** Serializable engine state used by deterministic checkpoints. */
+    state(): number;
+    /** Restore a state previously returned by {@link state}. */
+    setState(state: number): void;
     seed: number;
 };
 
@@ -229,28 +233,6 @@ type Journal = {
     clear(namespace?: string): void;
 };
 
-/**
- * A point-in-time copy of everything a service namespace holds.
- *
- * All service state lives in the two core tables keyed by namespace, so a snapshot
- * is generic: any service gets per-test rollback without knowing its own schema.
- * Restoring is much cheaper than rebuilding a namespace from a corpus.
- */
-type NamespaceSnapshot = {
-    namespace: string;
-    records: {
-        collection: string;
-        id: string;
-        seq: number;
-        value: string;
-    }[];
-    sequences: {
-        name: string;
-        kind: string;
-        value: number;
-    }[];
-};
-
 /** Credential → namespace mapping behind `PUT /__admin/credentials`. */
 type CredentialRegistry = {
     set(credential: string, namespace: string): void;
@@ -263,6 +245,86 @@ type CredentialRegistry = {
     }[];
 };
 
+/** A stable identifier for a point in a {@link Timeline}. */
+type CheckpointId = string;
+/** An immutable node in a timeline's checkpoint DAG. */
+type Checkpoint<T> = Readonly<{
+    id: CheckpointId;
+    branch: string;
+    parent: CheckpointId | null;
+    /** Logical time supplied by the timeline's injected clock. */
+    at: number;
+    value: T;
+}>;
+type TimelineOptions = {
+    /** Logical clock used to stamp checkpoints. Defaults to a deterministic counter. */
+    now?: () => number;
+    /** Maximum retained checkpoints. Branch heads are never collected. Default 1,000. */
+    maxCheckpoints?: number;
+    /** Customize deterministic checkpoint IDs. */
+    id?: (sequence: number) => CheckpointId;
+};
+type CommitOptions = {
+    branch?: string;
+    /** Parent checkpoint. Defaults to the selected branch's current head. */
+    parent?: CheckpointId | null;
+};
+type ForkOptions = {
+    /** Checkpoint to fork from. Defaults to the main branch's head. */
+    from?: CheckpointId;
+};
+/**
+ * Small, storage-agnostic checkpoint DAG shared by service runtimes. Its values may be immutable
+ * records, namespace images, or copy-on-write SQL engine snapshots.
+ *
+ * Values are retained by reference. Engines can therefore use persistent/COW snapshots while
+ * simpler services can use immutable values. IDs and GC order are deterministic, and all IO
+ * (the logical clock) is injected.
+ */
+declare class Timeline<T> {
+    readonly maxCheckpoints: number;
+    private readonly now;
+    private readonly makeId;
+    private readonly nodes;
+    private readonly heads;
+    /** Unreferenced nodes in the exact order they became collectible. */
+    private readonly evictable;
+    /** Branch heads plus explicit retainers. Absent means zero. */
+    private readonly references;
+    private readonly explicitPins;
+    private sequence;
+    constructor(options?: TimelineOptions);
+    /** Capture a new immutable value and move `branch` to it. */
+    commit(value: T, options?: CommitOptions): Checkpoint<T>;
+    /** Create a branch pointer without copying its checkpoint value. */
+    fork(branch: string, options?: ForkOptions): Checkpoint<T> | undefined;
+    /** Move a branch pointer to an existing checkpoint. */
+    checkout(branch: string, id: CheckpointId): Checkpoint<T>;
+    get(id: CheckpointId): Checkpoint<T>;
+    head(branch?: string): Checkpoint<T> | undefined;
+    hasBranch(branch: string): boolean;
+    branches(): Readonly<Record<string, CheckpointId>>;
+    checkpoints(): readonly Checkpoint<T>[];
+    /** Number of retained checkpoints without allocating an array. */
+    get size(): number;
+    /** Pin a checkpoint independently of branch heads (used by compatibility snapshot handles). */
+    retain(id: CheckpointId): Checkpoint<T>;
+    /** Release one explicit pin. Branch heads remain pinned until moved or deleted. */
+    release(id: CheckpointId): boolean;
+    deleteBranch(branch: string): boolean;
+    /**
+     * Deterministically discard oldest unpinned checkpoints. Collection is O(number removed):
+     * commits never scan pinned nodes or the retained history. Parents are metadata rather than a
+     * storage dependency, so a retained node remains usable after pruning.
+     */
+    gc(max?: number): CheckpointId[];
+    private collect;
+    private moveHead;
+    private addReference;
+    private removeReference;
+    private assertBranch;
+}
+
 /**
  * Anything that can answer a Fetch `Request` with a `Response`.
  *
@@ -273,6 +335,28 @@ interface FetchAPI$1 {
     fetch(request: Request): Promise<Response>;
 }
 
+/**
+ * A point-in-time copy of everything a service namespace holds.
+ *
+ * All service state lives in the two core tables keyed by namespace, so a snapshot
+ * is generic: any service gets per-test rollback without knowing its own schema.
+ * Restoring is much cheaper than rebuilding a namespace from a corpus.
+ */
+type NamespaceSnapshot = {
+    namespace: string;
+    records: {
+        collection: string;
+        id: string;
+        seq: number;
+        value: string;
+    }[];
+    sequences: {
+        name: string;
+        kind: string;
+        value: number;
+    }[];
+};
+
 type WebhookEndpoint$1 = {
     /** Stable id; generated when omitted. */
     id?: string;
@@ -293,6 +377,7 @@ type WebhookMessage = {
     body: string;
     contentType: string;
     tags: Record<string, string>;
+    headers?: Record<string, string>;
     /** Wall-clock ISO-8601 time of publication. */
     publishedAt: string;
 };
@@ -302,6 +387,8 @@ type WebhookAttempt$1 = {
     status: number | null;
     error: string | null;
     durationMs: number;
+    /** Exact receiver response body, when one was returned. */
+    responseBody?: string | null;
 };
 type WebhookDelivery$1 = {
     id: string;
@@ -329,6 +416,8 @@ type PublishInput = {
     /** Form parameters, when the vendor posts `application/x-www-form-urlencoded`. */
     form?: Record<string, string>;
     tags?: Record<string, string>;
+    /** Message-specific delivery headers, captured as part of durable message state. */
+    headers?: Record<string, string>;
     /** Message id; generated when omitted. */
     id?: string;
 };
@@ -353,6 +442,12 @@ type WebhookHub = {
 type ServiceInstance = FetchAPI$1 & {
     reset(): Promise<void>;
 };
+type ServiceTimelineState = Readonly<{
+    snapshot: NamespaceSnapshot;
+    clock: Readonly<ReturnType<Clock["state"]>>;
+    rngState: number;
+}>;
+type ServiceCheckpoint = Checkpoint<ServiceTimelineState>;
 type ServiceRuntime<T extends ServiceInstance> = FetchAPI$1 & {
     readonly name: string;
     readonly sqlite: SqliteClient$1;
@@ -374,6 +469,20 @@ type ServiceRuntime<T extends ServiceInstance> = FetchAPI$1 & {
     reset(namespace?: string): Promise<void>;
     snapshot(namespace?: string): NamespaceSnapshot;
     restore(snapshot: NamespaceSnapshot, namespace?: string): void;
+    /** Capture the current branch. Mutating HTTP calls do this automatically. */
+    checkpoint(namespace?: string, branch?: string): ServiceCheckpoint;
+    /** Create an isolated branch, optionally from a historical checkpoint. */
+    branch(name: string, options?: {
+        namespace?: string;
+        at?: string;
+    }): ServiceCheckpoint;
+    /** Restore a branch, clock, and PRNG to a checkpoint. */
+    checkout(checkpoint: string, options?: {
+        namespace?: string;
+        branch?: string;
+    }): void;
+    /** Inspect the retained history for a namespace. */
+    timeline(namespace?: string): Timeline<ServiceTimelineState>;
 };
 
 /** Options every provider constructor accepts. */
@@ -882,6 +991,11 @@ type WebhookEndpoint = {
     /** Added to every delivery, e.g. a routing scope for a shared receiver. */
     headers?: Record<string, string>;
     fetch?: (request: Request) => Promise<Response>;
+    /** Injectable wall clock for signatures and delivery records. */
+    now?: () => number;
+    /** Injectable scheduler for timeouts and retry delays. */
+    schedule?: (callback: () => void, delayMs: number) => unknown;
+    cancel?: (handle: unknown) => void;
 };
 type WebhookAttempt = {
     attempt: number;

package/dist/index.js

@@ -50,7 +50,7 @@ import {
   supportedOperationIds,
   verifyAgainstReal,
   verifySvix
-} from "./chunk-ICINEQ7D.js";
+} from "./chunk-MS774AJA.js";
 import {
   SEALED_CORPUS_VERSION,
   SUPPORTED_SEALED_CORPUS_VERSIONS,

package/dist/server.d.ts

@@ -74,6 +74,10 @@ type Rng$1 = {
     int(min: number, max: number): number;
     /** Restart the stream from its seed. */
     reset(): void;
+    /** Serializable engine state used by deterministic checkpoints. */
+    state(): number;
+    /** Restore a state previously returned by {@link state}. */
+    setState(state: number): void;
     seed: number;
 };
 
@@ -230,28 +234,6 @@ type Journal$1 = {
     clear(namespace?: string): void;
 };
 
-/**
- * A point-in-time copy of everything a service namespace holds.
- *
- * All service state lives in the two core tables keyed by namespace, so a snapshot
- * is generic: any service gets per-test rollback without knowing its own schema.
- * Restoring is much cheaper than rebuilding a namespace from a corpus.
- */
-type NamespaceSnapshot$1 = {
-    namespace: string;
-    records: {
-        collection: string;
-        id: string;
-        seq: number;
-        value: string;
-    }[];
-    sequences: {
-        name: string;
-        kind: string;
-        value: number;
-    }[];
-};
-
 /** Credential → namespace mapping behind `PUT /__admin/credentials`. */
 type CredentialRegistry$1 = {
     set(credential: string, namespace: string): void;
@@ -264,6 +246,86 @@ type CredentialRegistry$1 = {
     }[];
 };
 
+/** A stable identifier for a point in a {@link Timeline}. */
+type CheckpointId$1 = string;
+/** An immutable node in a timeline's checkpoint DAG. */
+type Checkpoint$1<T> = Readonly<{
+    id: CheckpointId$1;
+    branch: string;
+    parent: CheckpointId$1 | null;
+    /** Logical time supplied by the timeline's injected clock. */
+    at: number;
+    value: T;
+}>;
+type TimelineOptions$1 = {
+    /** Logical clock used to stamp checkpoints. Defaults to a deterministic counter. */
+    now?: () => number;
+    /** Maximum retained checkpoints. Branch heads are never collected. Default 1,000. */
+    maxCheckpoints?: number;
+    /** Customize deterministic checkpoint IDs. */
+    id?: (sequence: number) => CheckpointId$1;
+};
+type CommitOptions$1 = {
+    branch?: string;
+    /** Parent checkpoint. Defaults to the selected branch's current head. */
+    parent?: CheckpointId$1 | null;
+};
+type ForkOptions$1 = {
+    /** Checkpoint to fork from. Defaults to the main branch's head. */
+    from?: CheckpointId$1;
+};
+/**
+ * Small, storage-agnostic checkpoint DAG shared by service runtimes. Its values may be immutable
+ * records, namespace images, or copy-on-write SQL engine snapshots.
+ *
+ * Values are retained by reference. Engines can therefore use persistent/COW snapshots while
+ * simpler services can use immutable values. IDs and GC order are deterministic, and all IO
+ * (the logical clock) is injected.
+ */
+declare class Timeline$1<T> {
+    readonly maxCheckpoints: number;
+    private readonly now;
+    private readonly makeId;
+    private readonly nodes;
+    private readonly heads;
+    /** Unreferenced nodes in the exact order they became collectible. */
+    private readonly evictable;
+    /** Branch heads plus explicit retainers. Absent means zero. */
+    private readonly references;
+    private readonly explicitPins;
+    private sequence;
+    constructor(options?: TimelineOptions$1);
+    /** Capture a new immutable value and move `branch` to it. */
+    commit(value: T, options?: CommitOptions$1): Checkpoint$1<T>;
+    /** Create a branch pointer without copying its checkpoint value. */
+    fork(branch: string, options?: ForkOptions$1): Checkpoint$1<T> | undefined;
+    /** Move a branch pointer to an existing checkpoint. */
+    checkout(branch: string, id: CheckpointId$1): Checkpoint$1<T>;
+    get(id: CheckpointId$1): Checkpoint$1<T>;
+    head(branch?: string): Checkpoint$1<T> | undefined;
+    hasBranch(branch: string): boolean;
+    branches(): Readonly<Record<string, CheckpointId$1>>;
+    checkpoints(): readonly Checkpoint$1<T>[];
+    /** Number of retained checkpoints without allocating an array. */
+    get size(): number;
+    /** Pin a checkpoint independently of branch heads (used by compatibility snapshot handles). */
+    retain(id: CheckpointId$1): Checkpoint$1<T>;
+    /** Release one explicit pin. Branch heads remain pinned until moved or deleted. */
+    release(id: CheckpointId$1): boolean;
+    deleteBranch(branch: string): boolean;
+    /**
+     * Deterministically discard oldest unpinned checkpoints. Collection is O(number removed):
+     * commits never scan pinned nodes or the retained history. Parents are metadata rather than a
+     * storage dependency, so a retained node remains usable after pruning.
+     */
+    gc(max?: number): CheckpointId$1[];
+    private collect;
+    private moveHead;
+    private addReference;
+    private removeReference;
+    private assertBranch;
+}
+
 /**
  * Anything that can answer a Fetch `Request` with a `Response`.
  *
@@ -274,6 +336,28 @@ interface FetchAPI$2 {
     fetch(request: Request): Promise<Response>;
 }
 
+/**
+ * A point-in-time copy of everything a service namespace holds.
+ *
+ * All service state lives in the two core tables keyed by namespace, so a snapshot
+ * is generic: any service gets per-test rollback without knowing its own schema.
+ * Restoring is much cheaper than rebuilding a namespace from a corpus.
+ */
+type NamespaceSnapshot$1 = {
+    namespace: string;
+    records: {
+        collection: string;
+        id: string;
+        seq: number;
+        value: string;
+    }[];
+    sequences: {
+        name: string;
+        kind: string;
+        value: number;
+    }[];
+};
+
 type WebhookEndpoint$2 = {
     /** Stable id; generated when omitted. */
     id?: string;
@@ -294,6 +378,7 @@ type WebhookMessage$1 = {
     body: string;
     contentType: string;
     tags: Record<string, string>;
+    headers?: Record<string, string>;
     /** Wall-clock ISO-8601 time of publication. */
     publishedAt: string;
 };
@@ -303,6 +388,8 @@ type WebhookAttempt$2 = {
     status: number | null;
     error: string | null;
     durationMs: number;
+    /** Exact receiver response body, when one was returned. */
+    responseBody?: string | null;
 };
 type WebhookDelivery$2 = {
     id: string;
@@ -330,6 +417,8 @@ type PublishInput$1 = {
     /** Form parameters, when the vendor posts `application/x-www-form-urlencoded`. */
     form?: Record<string, string>;
     tags?: Record<string, string>;
+    /** Message-specific delivery headers, captured as part of durable message state. */
+    headers?: Record<string, string>;
     /** Message id; generated when omitted. */
     id?: string;
 };
@@ -354,6 +443,12 @@ type WebhookHub$1 = {
 type ServiceInstance$1 = FetchAPI$2 & {
     reset(): Promise<void>;
 };
+type ServiceTimelineState$1 = Readonly<{
+    snapshot: NamespaceSnapshot$1;
+    clock: Readonly<ReturnType<Clock$1["state"]>>;
+    rngState: number;
+}>;
+type ServiceCheckpoint$1 = Checkpoint$1<ServiceTimelineState$1>;
 type ServiceRuntime$1<T extends ServiceInstance$1> = FetchAPI$2 & {
     readonly name: string;
     readonly sqlite: SqliteClient$2;
@@ -375,6 +470,20 @@ type ServiceRuntime$1<T extends ServiceInstance$1> = FetchAPI$2 & {
     reset(namespace?: string): Promise<void>;
     snapshot(namespace?: string): NamespaceSnapshot$1;
     restore(snapshot: NamespaceSnapshot$1, namespace?: string): void;
+    /** Capture the current branch. Mutating HTTP calls do this automatically. */
+    checkpoint(namespace?: string, branch?: string): ServiceCheckpoint$1;
+    /** Create an isolated branch, optionally from a historical checkpoint. */
+    branch(name: string, options?: {
+        namespace?: string;
+        at?: string;
+    }): ServiceCheckpoint$1;
+    /** Restore a branch, clock, and PRNG to a checkpoint. */
+    checkout(checkpoint: string, options?: {
+        namespace?: string;
+        branch?: string;
+    }): void;
+    /** Inspect the retained history for a namespace. */
+    timeline(namespace?: string): Timeline$1<ServiceTimelineState$1>;
 };
 
 type CliOption = {
@@ -487,6 +596,10 @@ type Rng = {
     int(min: number, max: number): number;
     /** Restart the stream from its seed. */
     reset(): void;
+    /** Serializable engine state used by deterministic checkpoints. */
+    state(): number;
+    /** Restore a state previously returned by {@link state}. */
+    setState(state: number): void;
     seed: number;
 };
 
@@ -643,28 +756,6 @@ type Journal = {
     clear(namespace?: string): void;
 };
 
-/**
- * A point-in-time copy of everything a service namespace holds.
- *
- * All service state lives in the two core tables keyed by namespace, so a snapshot
- * is generic: any service gets per-test rollback without knowing its own schema.
- * Restoring is much cheaper than rebuilding a namespace from a corpus.
- */
-type NamespaceSnapshot = {
-    namespace: string;
-    records: {
-        collection: string;
-        id: string;
-        seq: number;
-        value: string;
-    }[];
-    sequences: {
-        name: string;
-        kind: string;
-        value: number;
-    }[];
-};
-
 /** Credential → namespace mapping behind `PUT /__admin/credentials`. */
 type CredentialRegistry = {
     set(credential: string, namespace: string): void;
@@ -677,6 +768,86 @@ type CredentialRegistry = {
     }[];
 };
 
+/** A stable identifier for a point in a {@link Timeline}. */
+type CheckpointId = string;
+/** An immutable node in a timeline's checkpoint DAG. */
+type Checkpoint<T> = Readonly<{
+    id: CheckpointId;
+    branch: string;
+    parent: CheckpointId | null;
+    /** Logical time supplied by the timeline's injected clock. */
+    at: number;
+    value: T;
+}>;
+type TimelineOptions = {
+    /** Logical clock used to stamp checkpoints. Defaults to a deterministic counter. */
+    now?: () => number;
+    /** Maximum retained checkpoints. Branch heads are never collected. Default 1,000. */
+    maxCheckpoints?: number;
+    /** Customize deterministic checkpoint IDs. */
+    id?: (sequence: number) => CheckpointId;
+};
+type CommitOptions = {
+    branch?: string;
+    /** Parent checkpoint. Defaults to the selected branch's current head. */
+    parent?: CheckpointId | null;
+};
+type ForkOptions = {
+    /** Checkpoint to fork from. Defaults to the main branch's head. */
+    from?: CheckpointId;
+};
+/**
+ * Small, storage-agnostic checkpoint DAG shared by service runtimes. Its values may be immutable
+ * records, namespace images, or copy-on-write SQL engine snapshots.
+ *
+ * Values are retained by reference. Engines can therefore use persistent/COW snapshots while
+ * simpler services can use immutable values. IDs and GC order are deterministic, and all IO
+ * (the logical clock) is injected.
+ */
+declare class Timeline<T> {
+    readonly maxCheckpoints: number;
+    private readonly now;
+    private readonly makeId;
+    private readonly nodes;
+    private readonly heads;
+    /** Unreferenced nodes in the exact order they became collectible. */
+    private readonly evictable;
+    /** Branch heads plus explicit retainers. Absent means zero. */
+    private readonly references;
+    private readonly explicitPins;
+    private sequence;
+    constructor(options?: TimelineOptions);
+    /** Capture a new immutable value and move `branch` to it. */
+    commit(value: T, options?: CommitOptions): Checkpoint<T>;
+    /** Create a branch pointer without copying its checkpoint value. */
+    fork(branch: string, options?: ForkOptions): Checkpoint<T> | undefined;
+    /** Move a branch pointer to an existing checkpoint. */
+    checkout(branch: string, id: CheckpointId): Checkpoint<T>;
+    get(id: CheckpointId): Checkpoint<T>;
+    head(branch?: string): Checkpoint<T> | undefined;
+    hasBranch(branch: string): boolean;
+    branches(): Readonly<Record<string, CheckpointId>>;
+    checkpoints(): readonly Checkpoint<T>[];
+    /** Number of retained checkpoints without allocating an array. */
+    get size(): number;
+    /** Pin a checkpoint independently of branch heads (used by compatibility snapshot handles). */
+    retain(id: CheckpointId): Checkpoint<T>;
+    /** Release one explicit pin. Branch heads remain pinned until moved or deleted. */
+    release(id: CheckpointId): boolean;
+    deleteBranch(branch: string): boolean;
+    /**
+     * Deterministically discard oldest unpinned checkpoints. Collection is O(number removed):
+     * commits never scan pinned nodes or the retained history. Parents are metadata rather than a
+     * storage dependency, so a retained node remains usable after pruning.
+     */
+    gc(max?: number): CheckpointId[];
+    private collect;
+    private moveHead;
+    private addReference;
+    private removeReference;
+    private assertBranch;
+}
+
 /**
  * Anything that can answer a Fetch `Request` with a `Response`.
  *
@@ -687,6 +858,28 @@ interface FetchAPI$1 {
     fetch(request: Request): Promise<Response>;
 }
 
+/**
+ * A point-in-time copy of everything a service namespace holds.
+ *
+ * All service state lives in the two core tables keyed by namespace, so a snapshot
+ * is generic: any service gets per-test rollback without knowing its own schema.
+ * Restoring is much cheaper than rebuilding a namespace from a corpus.
+ */
+type NamespaceSnapshot = {
+    namespace: string;
+    records: {
+        collection: string;
+        id: string;
+        seq: number;
+        value: string;
+    }[];
+    sequences: {
+        name: string;
+        kind: string;
+        value: number;
+    }[];
+};
+
 type WebhookEndpoint$1 = {
     /** Stable id; generated when omitted. */
     id?: string;
@@ -707,6 +900,7 @@ type WebhookMessage = {
     body: string;
     contentType: string;
     tags: Record<string, string>;
+    headers?: Record<string, string>;
     /** Wall-clock ISO-8601 time of publication. */
     publishedAt: string;
 };
@@ -716,6 +910,8 @@ type WebhookAttempt$1 = {
     status: number | null;
     error: string | null;
     durationMs: number;
+    /** Exact receiver response body, when one was returned. */
+    responseBody?: string | null;
 };
 type WebhookDelivery$1 = {
     id: string;
@@ -743,6 +939,8 @@ type PublishInput = {
     /** Form parameters, when the vendor posts `application/x-www-form-urlencoded`. */
     form?: Record<string, string>;
     tags?: Record<string, string>;
+    /** Message-specific delivery headers, captured as part of durable message state. */
+    headers?: Record<string, string>;
     /** Message id; generated when omitted. */
     id?: string;
 };
@@ -767,6 +965,12 @@ type WebhookHub = {
 type ServiceInstance = FetchAPI$1 & {
     reset(): Promise<void>;
 };
+type ServiceTimelineState = Readonly<{
+    snapshot: NamespaceSnapshot;
+    clock: Readonly<ReturnType<Clock["state"]>>;
+    rngState: number;
+}>;
+type ServiceCheckpoint = Checkpoint<ServiceTimelineState>;
 type ServiceRuntime<T extends ServiceInstance> = FetchAPI$1 & {
     readonly name: string;
     readonly sqlite: SqliteClient$1;
@@ -788,6 +992,20 @@ type ServiceRuntime<T extends ServiceInstance> = FetchAPI$1 & {
     reset(namespace?: string): Promise<void>;
     snapshot(namespace?: string): NamespaceSnapshot;
     restore(snapshot: NamespaceSnapshot, namespace?: string): void;
+    /** Capture the current branch. Mutating HTTP calls do this automatically. */
+    checkpoint(namespace?: string, branch?: string): ServiceCheckpoint;
+    /** Create an isolated branch, optionally from a historical checkpoint. */
+    branch(name: string, options?: {
+        namespace?: string;
+        at?: string;
+    }): ServiceCheckpoint;
+    /** Restore a branch, clock, and PRNG to a checkpoint. */
+    checkout(checkpoint: string, options?: {
+        namespace?: string;
+        branch?: string;
+    }): void;
+    /** Inspect the retained history for a namespace. */
+    timeline(namespace?: string): Timeline<ServiceTimelineState>;
 };
 
 /** Options every provider constructor accepts. */
@@ -1229,6 +1447,11 @@ type WebhookEndpoint = {
     /** Added to every delivery, e.g. a routing scope for a shared receiver. */
     headers?: Record<string, string>;
     fetch?: (request: Request) => Promise<Response>;
+    /** Injectable wall clock for signatures and delivery records. */
+    now?: () => number;
+    /** Injectable scheduler for timeouts and retry delays. */
+    schedule?: (callback: () => void, delayMs: number) => unknown;
+    cancel?: (handle: unknown) => void;
 };
 type WebhookAttempt = {
     attempt: number;