@dudousxd/nestjs-notifications-webhook 0.6.0 → 0.7.0

package/dist/index.d.cts

@@ -1,31 +1,29 @@
 import * as _dudousxd_nestjs_notifications_core from '@dudousxd/nestjs-notifications-core';
 import { BaseChannel, Notifiable, Notification, DeliveryContext, ChannelContext } from '@dudousxd/nestjs-notifications-core';
+import { OutboxInbox } from '@nestjs/outbox';
+import { HttpWebhookTransportOptions, WebhookTransport, Webhooks, WebhookMessage as WebhookMessage$1 } from '@nestjs/webhooks';
 import { DynamicModule } from '@nestjs/common';
 
-/** The HTTP method used for a webhook request. */
-type WebhookMethod = 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'GET';
 /** The resolved request description produced by {@link WebhookMessage.toRequest}. */
 interface WebhookRequest {
     /** Target URL, when set on the message; otherwise resolved by the channel. */
     url?: string | undefined;
-    method: WebhookMethod;
     headers: Record<string, string>;
-    /** The JSON body to send (a plain object). */
+    /** The JSON body to POST (a plain object). */
     body: Record<string, unknown>;
 }
 /**
- * A fluent builder for a webhook request.
+ * A fluent builder for a direct webhook request (always a `POST` with a JSON body).
  *
  * ```ts
  * new WebhookMessage()
  *   .url('https://example.com/hooks/orders')
- *   .header('X-Signature', sign(payload))
+ *   .header('X-App', 'shop')
  *   .payload({ event: 'order.paid', id: 42 });
  * ```
  */
 declare class WebhookMessage {
     private _url?;
-    private _method;
     private _headers;
     private _payload;
     /** Set the target URL (overrides the route and configured default). */
@@ -36,84 +34,134 @@ declare class WebhookMessage {
     header(key: string, value: string): this;
     /** Merge multiple request headers. */
     headers(obj: Record<string, string>): this;
-    /** Set the HTTP method (default `POST`). */
-    method(m: WebhookMethod): this;
     get urlValue(): string | undefined;
-    get methodValue(): WebhookMethod;
     get headerValues(): Record<string, string>;
     get payloadValue(): Record<string, unknown>;
     /** Serialize to a {@link WebhookRequest}. */
     toRequest(): WebhookRequest;
 }
+/**
+ * A webhook event for subscription delivery: `@nestjs/webhooks` fans it out to every endpoint of
+ * the tenant subscribed to `type`, signs it (Standard Webhooks), retries and logs each delivery.
+ * Return one from `toWebhook(ctx)` instead of a {@link WebhookMessage}.
+ *
+ * ```ts
+ * toWebhook() { return new WebhookEvent('invoice.paid', { id: this.invoice.id }); }
+ * ```
+ */
+declare class WebhookEvent<D = unknown> {
+    /** Full-stop delimited: `invoice.paid`. In `WebhooksModule`'s `eventTypes` when that is set. */
+    readonly type: string;
+    /** JSON-serializable data, sent as the body's `data`. */
+    readonly data: D;
+    constructor(
+    /** Full-stop delimited: `invoice.paid`. In `WebhooksModule`'s `eventTypes` when that is set. */
+    type: string, 
+    /** JSON-serializable data, sent as the body's `data`. */
+    data: D);
+}
 
+/**
+ * The outbox inbox consumer under which subscription deliveries record the `webhook-id`s they
+ * dispatched, so a retried notification doesn't dispatch the same event twice.
+ */
+declare const WEBHOOK_DISPATCH_CONSUMER = "aviary.notifications.webhook-dispatch";
 /** Channel handle: use as `@Webhook()` on a payload method, or as a token in `via()`. */
 declare const Webhook: _dudousxd_nestjs_notifications_core.ChannelHandle;
-/** Resolved runtime options for the webhook channel. */
+/** Opens a transaction for subscription delivery, e.g. `(work) => db.transaction(work)`. */
+type WebhookTransactionRunner = <T>(work: (tx: unknown) => Promise<T>) => Promise<T>;
+/** Resolved runtime options for direct-URL delivery. */
 interface WebhookChannelOptions {
     /** Default URL used when neither the message nor the route supplies one. */
     url?: string;
     /** Default headers merged into every request. */
     headers?: Record<string, string>;
+    /** Signing secret. Unset: requests are not signed. */
+    secret?: string;
     /**
-     * HMAC-SHA256 secret. When set, the request is signed: the header (default
-     * `X-Signature-256`) is set to `sha256=<hex digest of the raw JSON body>`, so the receiver
-     * can verify authenticity. Per-tenant secrets work via `resolveOptions`.
+     * `'sha256'` (default): `<signatureHeader>: sha256=<hex HMAC of the body>`.
+     * `'standard'`: Standard Webhooks headers, verifiable with `@nestjs/webhooks`'
+     * `@VerifyWebhook()` and a `scheme: 'standard'` receiver; `secret` is then `whsec_…`.
      */
-    secret?: string;
-    /** Header name for the signature. Default `X-Signature-256`. */
+    signing?: 'sha256' | 'standard';
+    /** Header for the `'sha256'` signature. Default `X-Signature-256`. */
     signatureHeader?: string;
-    /** Abort a request that takes longer than this (ms). Unset = no timeout. */
+    /** Abort a request that takes longer than this (ms). Default 15000. */
     timeoutMs?: number;
     /**
-     * Redirect handling. Default `'follow'` (the `fetch` default). Use `'error'` when webhook URLs
-     * are user-supplied, so a 3xx can't bounce the (possibly signed) request somewhere else.
+     * The SSRF policy of `@nestjs/webhooks`' `HttpWebhookTransport` (https only, every resolved
+     * address checked and pinned, redirects never followed): `allowHttp`, `allowPrivateNetworks`,
+     * `allowedAddresses`, `ca`, `maxResponseSize`, `lookup`.
+     */
+    delivery?: HttpWebhookTransportOptions;
+    /**
+     * A `@nestjs/webhooks` transport instance to send through instead (a proxy, mTLS, or
+     * `InMemoryWebhookTransport` in tests). Takes precedence over `delivery`.
      */
-    redirect?: 'follow' | 'error' | 'manual';
+    transport?: WebhookTransport;
 }
 /**
- * Implement this on a notification to define its webhook payload. Returning a plain
- * object is treated as the JSON body to POST; return a {@link WebhookMessage} for full
- * control over the url, method and headers.
+ * Implement this on a notification to define its webhook payload: a plain object (the JSON body),
+ * a {@link WebhookMessage} (url, headers, body), or a {@link WebhookEvent} for subscription
+ * delivery through `@nestjs/webhooks`.
  */
 interface WebhookNotification extends Notification {
-    toWebhook(ctx: ChannelContext): WebhookMessage | Record<string, unknown>;
+    toWebhook(ctx: ChannelContext): WebhookMessage | WebhookEvent | Record<string, unknown>;
 }
 /** Resolves per-tenant {@link WebhookChannelOptions} from a tenant id. */
 type WebhookOptionsResolver = (tenant: string) => WebhookChannelOptions;
+/** What a direct delivery returns (the channel response). */
+interface WebhookDeliveryResult {
+    /** The `webhook-id` (Standard signing) or a generated id. */
+    id: string;
+    statusCode: number;
+}
 /**
- * Delivers a notification by sending an HTTP request (JSON body) to a webhook endpoint.
- * The target URL comes from the {@link WebhookMessage}, else from
- * `routeNotificationFor('webhook')` (a URL string), else from the configured default.
+ * What a subscription delivery returns when its `webhook-id` was already dispatched by an earlier
+ * attempt of the same delivery: nothing was dispatched this time.
+ */
+interface WebhookAlreadyDispatched {
+    id: string;
+    duplicate: true;
+}
+/**
+ * Delivers a notification as a webhook, two ways:
+ *
+ * - **Direct**: a signed `POST` of the JSON body to one URL (the message's, else the
+ *   `routeNotificationFor('webhook')` URL, else the configured default), through `@nestjs/webhooks`'
+ *   SSRF-guarded `HttpWebhookTransport`. A non-2xx answer fails the delivery.
+ * - **Subscriptions**: a {@link WebhookEvent} is handed to `Webhooks.dispatch()`, which fans it
+ *   out to the endpoints subscribed to its type (for the delivery's tenant), with retries and a
+ *   delivery log. Needs `WebhooksModule` + `OutboxModule` and the `transaction` option. A
+ *   delivery with an `idempotencyKey` (the outbox dispatcher's message id) records its
+ *   `webhook-id` in the outbox inbox in the same transaction as the dispatch, so a retry of it
+ *   dispatches nothing and returns {@link WebhookAlreadyDispatched}.
  */
 declare class WebhookChannel extends BaseChannel {
     private readonly options;
     private readonly resolveOptions?;
+    private readonly transaction?;
+    private readonly webhooks?;
+    private readonly inbox?;
     readonly channel = "webhook";
-    constructor(options: WebhookChannelOptions, resolveOptions?: WebhookOptionsResolver | undefined);
-    send(notifiable: Notifiable, notification: Notification, context?: DeliveryContext): Promise<void>;
+    private readonly transports;
+    constructor(options: WebhookChannelOptions, resolveOptions?: WebhookOptionsResolver | undefined, transaction?: WebhookTransactionRunner | undefined, webhooks?: Webhooks | undefined, inbox?: OutboxInbox | undefined);
+    send(notifiable: Notifiable, notification: Notification, context?: DeliveryContext): Promise<WebhookDeliveryResult | WebhookMessage$1 | WebhookAlreadyDispatched>;
+    private dispatch;
+    private transportFor;
 }
 
-interface WebhookChannelModuleOptions {
-    /** Default URL used when neither the message nor the route supplies one. */
-    url?: string;
-    /** Default headers merged into every request. */
-    headers?: Record<string, string>;
-    /**
-     * HMAC-SHA256 signing secret. When set, every request carries
-     * `<signatureHeader>: sha256=<hex digest of the JSON body>`.
-     */
-    secret?: string;
-    /** Header name for the signature. Default `X-Signature-256`. */
-    signatureHeader?: string;
-    /** Abort a request that takes longer than this (ms). Unset = no timeout. */
-    timeoutMs?: number;
-    /** Redirect handling: `'follow'` (default), `'error'` or `'manual'`. */
-    redirect?: 'follow' | 'error' | 'manual';
+interface WebhookChannelModuleOptions extends WebhookChannelOptions {
     /**
      * Optional per-tenant options resolver. When a notification is delivered with a
      * `context.tenant`, the returned options are used instead of the defaults.
      */
     resolveOptions?: WebhookOptionsResolver;
+    /**
+     * Opens a transaction for subscription delivery ({@link WebhookEvent}): `@nestjs/webhooks`
+     * writes the event to the outbox through it, e.g. `(work) => db.transaction(work)`.
+     */
+    transaction?: WebhookTransactionRunner;
     /** Register globally so the channel is discoverable app-wide. Default true. */
     global?: boolean;
 }
@@ -121,16 +169,27 @@ interface WebhookChannelModuleOptions {
  * Registers the webhook channel.
  *
  * ```ts
- * WebhookChannelModule.forRoot({ url: 'https://example.com/hooks/notifications' });
+ * WebhookChannelModule.forRoot({ url: 'https://example.com/hooks', secret: 'whsec_…', signing: 'standard' });
  * ```
  */
 declare class WebhookChannelModule {
     static forRoot(options?: WebhookChannelModuleOptions): DynamicModule;
 }
 
-/** DI token for the resolved {@link WebhookChannelOptions} (default url, headers). */
+/**
+ * Standard Webhooks headers (`webhook-id`, `webhook-timestamp`, `webhook-signature: v1,…`) for
+ * `body`, verifiable by a `@nestjs/webhooks` receiver with `scheme: 'standard'` (`@VerifyWebhook`).
+ * `secret` is `whsec_` + base64 (the prefix is optional).
+ */
+declare function standardWebhookHeaders(secret: string, id: string, body: string, now?: Date): Record<string, string>;
+/** The legacy `sha256=<hex HMAC of the body>` signature (GitHub-style). */
+declare function sha256Signature(secret: string, body: string): string;
+
+/** DI token for the resolved {@link WebhookChannelOptions}. */
 declare const WEBHOOK_OPTIONS: unique symbol;
 /** DI token for the optional per-tenant {@link WebhookChannelOptions} resolver. */
 declare const WEBHOOK_OPTIONS_RESOLVER: unique symbol;
+/** DI token for the transaction opener used by subscription delivery. */
+declare const WEBHOOK_TRANSACTION: unique symbol;
 
-export { WEBHOOK_OPTIONS, WEBHOOK_OPTIONS_RESOLVER, Webhook, WebhookChannel, WebhookChannelModule, type WebhookChannelModuleOptions, type WebhookChannelOptions, WebhookMessage, type WebhookMethod, type WebhookNotification, type WebhookOptionsResolver, type WebhookRequest };
+export { WEBHOOK_DISPATCH_CONSUMER, WEBHOOK_OPTIONS, WEBHOOK_OPTIONS_RESOLVER, WEBHOOK_TRANSACTION, Webhook, type WebhookAlreadyDispatched, WebhookChannel, WebhookChannelModule, type WebhookChannelModuleOptions, type WebhookChannelOptions, type WebhookDeliveryResult, WebhookEvent, WebhookMessage, type WebhookNotification, type WebhookOptionsResolver, type WebhookRequest, type WebhookTransactionRunner, sha256Signature, standardWebhookHeaders };

package/dist/index.d.ts

@@ -1,31 +1,29 @@
 import * as _dudousxd_nestjs_notifications_core from '@dudousxd/nestjs-notifications-core';
 import { BaseChannel, Notifiable, Notification, DeliveryContext, ChannelContext } from '@dudousxd/nestjs-notifications-core';
+import { OutboxInbox } from '@nestjs/outbox';
+import { HttpWebhookTransportOptions, WebhookTransport, Webhooks, WebhookMessage as WebhookMessage$1 } from '@nestjs/webhooks';
 import { DynamicModule } from '@nestjs/common';
 
-/** The HTTP method used for a webhook request. */
-type WebhookMethod = 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'GET';
 /** The resolved request description produced by {@link WebhookMessage.toRequest}. */
 interface WebhookRequest {
     /** Target URL, when set on the message; otherwise resolved by the channel. */
     url?: string | undefined;
-    method: WebhookMethod;
     headers: Record<string, string>;
-    /** The JSON body to send (a plain object). */
+    /** The JSON body to POST (a plain object). */
     body: Record<string, unknown>;
 }
 /**
- * A fluent builder for a webhook request.
+ * A fluent builder for a direct webhook request (always a `POST` with a JSON body).
  *
  * ```ts
  * new WebhookMessage()
  *   .url('https://example.com/hooks/orders')
- *   .header('X-Signature', sign(payload))
+ *   .header('X-App', 'shop')
  *   .payload({ event: 'order.paid', id: 42 });
  * ```
  */
 declare class WebhookMessage {
     private _url?;
-    private _method;
     private _headers;
     private _payload;
     /** Set the target URL (overrides the route and configured default). */
@@ -36,84 +34,134 @@ declare class WebhookMessage {
     header(key: string, value: string): this;
     /** Merge multiple request headers. */
     headers(obj: Record<string, string>): this;
-    /** Set the HTTP method (default `POST`). */
-    method(m: WebhookMethod): this;
     get urlValue(): string | undefined;
-    get methodValue(): WebhookMethod;
     get headerValues(): Record<string, string>;
     get payloadValue(): Record<string, unknown>;
     /** Serialize to a {@link WebhookRequest}. */
     toRequest(): WebhookRequest;
 }
+/**
+ * A webhook event for subscription delivery: `@nestjs/webhooks` fans it out to every endpoint of
+ * the tenant subscribed to `type`, signs it (Standard Webhooks), retries and logs each delivery.
+ * Return one from `toWebhook(ctx)` instead of a {@link WebhookMessage}.
+ *
+ * ```ts
+ * toWebhook() { return new WebhookEvent('invoice.paid', { id: this.invoice.id }); }
+ * ```
+ */
+declare class WebhookEvent<D = unknown> {
+    /** Full-stop delimited: `invoice.paid`. In `WebhooksModule`'s `eventTypes` when that is set. */
+    readonly type: string;
+    /** JSON-serializable data, sent as the body's `data`. */
+    readonly data: D;
+    constructor(
+    /** Full-stop delimited: `invoice.paid`. In `WebhooksModule`'s `eventTypes` when that is set. */
+    type: string, 
+    /** JSON-serializable data, sent as the body's `data`. */
+    data: D);
+}
 
+/**
+ * The outbox inbox consumer under which subscription deliveries record the `webhook-id`s they
+ * dispatched, so a retried notification doesn't dispatch the same event twice.
+ */
+declare const WEBHOOK_DISPATCH_CONSUMER = "aviary.notifications.webhook-dispatch";
 /** Channel handle: use as `@Webhook()` on a payload method, or as a token in `via()`. */
 declare const Webhook: _dudousxd_nestjs_notifications_core.ChannelHandle;
-/** Resolved runtime options for the webhook channel. */
+/** Opens a transaction for subscription delivery, e.g. `(work) => db.transaction(work)`. */
+type WebhookTransactionRunner = <T>(work: (tx: unknown) => Promise<T>) => Promise<T>;
+/** Resolved runtime options for direct-URL delivery. */
 interface WebhookChannelOptions {
     /** Default URL used when neither the message nor the route supplies one. */
     url?: string;
     /** Default headers merged into every request. */
     headers?: Record<string, string>;
+    /** Signing secret. Unset: requests are not signed. */
+    secret?: string;
     /**
-     * HMAC-SHA256 secret. When set, the request is signed: the header (default
-     * `X-Signature-256`) is set to `sha256=<hex digest of the raw JSON body>`, so the receiver
-     * can verify authenticity. Per-tenant secrets work via `resolveOptions`.
+     * `'sha256'` (default): `<signatureHeader>: sha256=<hex HMAC of the body>`.
+     * `'standard'`: Standard Webhooks headers, verifiable with `@nestjs/webhooks`'
+     * `@VerifyWebhook()` and a `scheme: 'standard'` receiver; `secret` is then `whsec_…`.
      */
-    secret?: string;
-    /** Header name for the signature. Default `X-Signature-256`. */
+    signing?: 'sha256' | 'standard';
+    /** Header for the `'sha256'` signature. Default `X-Signature-256`. */
     signatureHeader?: string;
-    /** Abort a request that takes longer than this (ms). Unset = no timeout. */
+    /** Abort a request that takes longer than this (ms). Default 15000. */
     timeoutMs?: number;
     /**
-     * Redirect handling. Default `'follow'` (the `fetch` default). Use `'error'` when webhook URLs
-     * are user-supplied, so a 3xx can't bounce the (possibly signed) request somewhere else.
+     * The SSRF policy of `@nestjs/webhooks`' `HttpWebhookTransport` (https only, every resolved
+     * address checked and pinned, redirects never followed): `allowHttp`, `allowPrivateNetworks`,
+     * `allowedAddresses`, `ca`, `maxResponseSize`, `lookup`.
+     */
+    delivery?: HttpWebhookTransportOptions;
+    /**
+     * A `@nestjs/webhooks` transport instance to send through instead (a proxy, mTLS, or
+     * `InMemoryWebhookTransport` in tests). Takes precedence over `delivery`.
      */
-    redirect?: 'follow' | 'error' | 'manual';
+    transport?: WebhookTransport;
 }
 /**
- * Implement this on a notification to define its webhook payload. Returning a plain
- * object is treated as the JSON body to POST; return a {@link WebhookMessage} for full
- * control over the url, method and headers.
+ * Implement this on a notification to define its webhook payload: a plain object (the JSON body),
+ * a {@link WebhookMessage} (url, headers, body), or a {@link WebhookEvent} for subscription
+ * delivery through `@nestjs/webhooks`.
  */
 interface WebhookNotification extends Notification {
-    toWebhook(ctx: ChannelContext): WebhookMessage | Record<string, unknown>;
+    toWebhook(ctx: ChannelContext): WebhookMessage | WebhookEvent | Record<string, unknown>;
 }
 /** Resolves per-tenant {@link WebhookChannelOptions} from a tenant id. */
 type WebhookOptionsResolver = (tenant: string) => WebhookChannelOptions;
+/** What a direct delivery returns (the channel response). */
+interface WebhookDeliveryResult {
+    /** The `webhook-id` (Standard signing) or a generated id. */
+    id: string;
+    statusCode: number;
+}
 /**
- * Delivers a notification by sending an HTTP request (JSON body) to a webhook endpoint.
- * The target URL comes from the {@link WebhookMessage}, else from
- * `routeNotificationFor('webhook')` (a URL string), else from the configured default.
+ * What a subscription delivery returns when its `webhook-id` was already dispatched by an earlier
+ * attempt of the same delivery: nothing was dispatched this time.
+ */
+interface WebhookAlreadyDispatched {
+    id: string;
+    duplicate: true;
+}
+/**
+ * Delivers a notification as a webhook, two ways:
+ *
+ * - **Direct**: a signed `POST` of the JSON body to one URL (the message's, else the
+ *   `routeNotificationFor('webhook')` URL, else the configured default), through `@nestjs/webhooks`'
+ *   SSRF-guarded `HttpWebhookTransport`. A non-2xx answer fails the delivery.
+ * - **Subscriptions**: a {@link WebhookEvent} is handed to `Webhooks.dispatch()`, which fans it
+ *   out to the endpoints subscribed to its type (for the delivery's tenant), with retries and a
+ *   delivery log. Needs `WebhooksModule` + `OutboxModule` and the `transaction` option. A
+ *   delivery with an `idempotencyKey` (the outbox dispatcher's message id) records its
+ *   `webhook-id` in the outbox inbox in the same transaction as the dispatch, so a retry of it
+ *   dispatches nothing and returns {@link WebhookAlreadyDispatched}.
  */
 declare class WebhookChannel extends BaseChannel {
     private readonly options;
     private readonly resolveOptions?;
+    private readonly transaction?;
+    private readonly webhooks?;
+    private readonly inbox?;
     readonly channel = "webhook";
-    constructor(options: WebhookChannelOptions, resolveOptions?: WebhookOptionsResolver | undefined);
-    send(notifiable: Notifiable, notification: Notification, context?: DeliveryContext): Promise<void>;
+    private readonly transports;
+    constructor(options: WebhookChannelOptions, resolveOptions?: WebhookOptionsResolver | undefined, transaction?: WebhookTransactionRunner | undefined, webhooks?: Webhooks | undefined, inbox?: OutboxInbox | undefined);
+    send(notifiable: Notifiable, notification: Notification, context?: DeliveryContext): Promise<WebhookDeliveryResult | WebhookMessage$1 | WebhookAlreadyDispatched>;
+    private dispatch;
+    private transportFor;
 }
 
-interface WebhookChannelModuleOptions {
-    /** Default URL used when neither the message nor the route supplies one. */
-    url?: string;
-    /** Default headers merged into every request. */
-    headers?: Record<string, string>;
-    /**
-     * HMAC-SHA256 signing secret. When set, every request carries
-     * `<signatureHeader>: sha256=<hex digest of the JSON body>`.
-     */
-    secret?: string;
-    /** Header name for the signature. Default `X-Signature-256`. */
-    signatureHeader?: string;
-    /** Abort a request that takes longer than this (ms). Unset = no timeout. */
-    timeoutMs?: number;
-    /** Redirect handling: `'follow'` (default), `'error'` or `'manual'`. */
-    redirect?: 'follow' | 'error' | 'manual';
+interface WebhookChannelModuleOptions extends WebhookChannelOptions {
     /**
      * Optional per-tenant options resolver. When a notification is delivered with a
      * `context.tenant`, the returned options are used instead of the defaults.
      */
     resolveOptions?: WebhookOptionsResolver;
+    /**
+     * Opens a transaction for subscription delivery ({@link WebhookEvent}): `@nestjs/webhooks`
+     * writes the event to the outbox through it, e.g. `(work) => db.transaction(work)`.
+     */
+    transaction?: WebhookTransactionRunner;
     /** Register globally so the channel is discoverable app-wide. Default true. */
     global?: boolean;
 }
@@ -121,16 +169,27 @@ interface WebhookChannelModuleOptions {
  * Registers the webhook channel.
  *
  * ```ts
- * WebhookChannelModule.forRoot({ url: 'https://example.com/hooks/notifications' });
+ * WebhookChannelModule.forRoot({ url: 'https://example.com/hooks', secret: 'whsec_…', signing: 'standard' });
  * ```
  */
 declare class WebhookChannelModule {
     static forRoot(options?: WebhookChannelModuleOptions): DynamicModule;
 }
 
-/** DI token for the resolved {@link WebhookChannelOptions} (default url, headers). */
+/**
+ * Standard Webhooks headers (`webhook-id`, `webhook-timestamp`, `webhook-signature: v1,…`) for
+ * `body`, verifiable by a `@nestjs/webhooks` receiver with `scheme: 'standard'` (`@VerifyWebhook`).
+ * `secret` is `whsec_` + base64 (the prefix is optional).
+ */
+declare function standardWebhookHeaders(secret: string, id: string, body: string, now?: Date): Record<string, string>;
+/** The legacy `sha256=<hex HMAC of the body>` signature (GitHub-style). */
+declare function sha256Signature(secret: string, body: string): string;
+
+/** DI token for the resolved {@link WebhookChannelOptions}. */
 declare const WEBHOOK_OPTIONS: unique symbol;
 /** DI token for the optional per-tenant {@link WebhookChannelOptions} resolver. */
 declare const WEBHOOK_OPTIONS_RESOLVER: unique symbol;
+/** DI token for the transaction opener used by subscription delivery. */
+declare const WEBHOOK_TRANSACTION: unique symbol;
 
-export { WEBHOOK_OPTIONS, WEBHOOK_OPTIONS_RESOLVER, Webhook, WebhookChannel, WebhookChannelModule, type WebhookChannelModuleOptions, type WebhookChannelOptions, WebhookMessage, type WebhookMethod, type WebhookNotification, type WebhookOptionsResolver, type WebhookRequest };
+export { WEBHOOK_DISPATCH_CONSUMER, WEBHOOK_OPTIONS, WEBHOOK_OPTIONS_RESOLVER, WEBHOOK_TRANSACTION, Webhook, type WebhookAlreadyDispatched, WebhookChannel, WebhookChannelModule, type WebhookChannelModuleOptions, type WebhookChannelOptions, type WebhookDeliveryResult, WebhookEvent, WebhookMessage, type WebhookNotification, type WebhookOptionsResolver, type WebhookRequest, type WebhookTransactionRunner, sha256Signature, standardWebhookHeaders };