@fabricorg/webhook-delivery 0.1.1 → 0.1.3

package/dist/destination-joCBtgvY.d.cts

@@ -1,1444 +0,0 @@
-import { EventPayloadClassification, EnterpriseEventEnvelope } from '@fabricorg/platform-host';
-
-/**
- * Fixed code sets. Stored diagnostics, denial reasons and attempt outcomes are
- * typed as one of these codes rather than a free string or a port's error
- * message (ADR 0018 decision 2), so a thrown error has no field through which
- * to carry payload, secret or response-body text into a durable record. The
- * arrays are frozen, so no caller can widen a set at runtime.
- */
-/** Reasons an admission port may give for `deny`. */
-declare const WEBHOOK_ADMISSION_DENIAL_CODES: readonly ["actor_not_permitted", "scope_not_permitted", "event_type_not_permitted", "classification_not_permitted", "policy_denied"];
-/** A reason code carried by an admission `deny` decision and stored on its denial record. */
-type WebhookAdmissionDenialCode = (typeof WEBHOOK_ADMISSION_DENIAL_CODES)[number];
-/** Reasons a delivery authorization port may give for `revoked`. */
-declare const WEBHOOK_REVOCATION_CODES: readonly ["grant_expired", "scope_revoked", "registration_inactive"];
-/** A reason code carried by a delivery authorization `revoked` decision. */
-type WebhookRevocationCode = (typeof WEBHOOK_REVOCATION_CODES)[number];
-/**
- * Diagnostics stored on a fan-out job or delivery intent when a port failed,
- * timed out or a coordination check refused the work. A port exception is
- * stored as the code for that port, not as its message.
- *
- * Three are written only by the fan-out cycle: `eligibility_unsettled` when
- * it defers a job until its event's eligibility is settled (README,
- * "Fan-out"), `intent_build_failed` when it could not render a body or
- * create a delivery id for an admitted subscription, and `job_unreadable`
- * when it dead-letters a claimed job whose identity and lease it could read
- * but whose body it could not.
- *
- * Three are written only by the delivery cycle (README, "Delivery"):
- * `intent_unreadable` when it dead-letters a claimed intent whose identity
- * and lease it could read but whose body it could not,
- * `subscription_not_in_scope` when the intent's subscription does not exist
- * in the intent's tenant and space, or the store's answer names another
- * one, and `transport_not_sent` when the transport returned `not_sent` for
- * a request it never started.
- */
-declare const WEBHOOK_DIAGNOSTIC_CODES: readonly ["admission_unavailable", "authorization_unavailable", "subscription_store_unavailable", "delivery_store_unavailable", "signer_unavailable", "resolver_unavailable", "port_timeout", "scope_predicate_failed", "configuration_conflict", "lease_lost", "intent_not_pending", "processing_deadline_exceeded", "eligibility_unsettled", "intent_build_failed", "job_unreadable", "intent_unreadable", "subscription_not_in_scope", "transport_not_sent"];
-/** A stored diagnostic code for a port failure or refused coordination check. */
-type WebhookDiagnosticCode = (typeof WEBHOOK_DIAGNOSTIC_CODES)[number];
-/**
- * What a delivery attempt's observation means for its intent (ADR 0018
- * decision 10). `not_sent` is never a classification: the delivery cycle
- * records it, with the reason `not_sent`, on an attempt it began under the
- * intent's lease and handed to the transport, when the transport answered
- * that it never started the request (its deadline had passed or its signal
- * had aborted while the request was queued). Such an attempt spends no budget.
- */
-declare const WEBHOOK_ATTEMPT_OUTCOMES: readonly ["delivered", "retryable", "dead_letter", "cancelled", "not_sent"];
-/**
- * The classified result of one attempt. A 401 or 403 is `retryable` like any
- * other row of that kind; its `http_401` / `http_403` reason and the
- * classification's `receiverActionLikely` flag let the caller surface it to
- * operators before the retry budget is exhausted.
- */
-type WebhookAttemptOutcome = (typeof WEBHOOK_ATTEMPT_OUTCOMES)[number];
-/** The row of decision 10's table an observation matched. */
-declare const WEBHOOK_ATTEMPT_REASON_CODES: readonly ["http_2xx", "network_error", "timeout", "dns_failure", "http_408", "http_425", "http_429", "http_5xx", "signer_unavailable", "http_401", "http_403", "http_1xx", "http_3xx", "http_410", "http_4xx", "invalid_url", "private_address", "authorization_revoked", "subscription_paused", "subscription_deleted", "not_sent"];
-/** The reason code recorded with an attempt outcome. */
-type WebhookAttemptReasonCode = (typeof WEBHOOK_ATTEMPT_REASON_CODES)[number];
-/** Codes on {@link WebhookDeliveryConfigError}. */
-declare const WEBHOOK_CONFIG_ERROR_CODES: readonly ["limit_not_positive_finite", "limit_not_integer", "limit_out_of_range", "retry_schedule_empty", "limit_unreadable"];
-/** Why a configured limit was rejected. */
-type WebhookConfigErrorCode = (typeof WEBHOOK_CONFIG_ERROR_CODES)[number];
-/** Codes on {@link WebhookProjectionError}. */
-declare const WEBHOOK_PROJECTION_ERROR_CODES: readonly ["invalid_envelope", "payload_field_not_json", "fact_field_not_json", "accessor_property", "inspection_failed", "scope_mismatch"];
-/** Why an envelope could not be projected. */
-type WebhookProjectionErrorCode = (typeof WEBHOOK_PROJECTION_ERROR_CODES)[number];
-/**
- * Codes on the `TypeError` and `RangeError` instances this package throws
- * for malformed call input (headers, classification, retry, admission).
- * Each code has one constant message; neither repeats the input.
- */
-declare const WEBHOOK_INPUT_ERROR_CODES: readonly ["input_unreadable", "observation_unknown", "status_out_of_range", "signature_malformed", "timestamp_invalid", "event_id_invalid", "delivery_id_invalid", "attempt_invalid", "raw_body_not_string", "random_source_missing", "random_sample_invalid", "random_source_failed", "denial_code_unknown"];
-/** Why call input was refused. */
-type WebhookInputErrorCode = (typeof WEBHOOK_INPUT_ERROR_CODES)[number];
-/**
- * Codes on {@link WebhookStoreError}: a store call that was malformed, broke
- * a store invariant, or was no longer wanted when the store reached its
- * write. Refusals the caller is expected to handle (a lost lease, an
- * existing key, a replay past the horizon, a requeue of a record that is not
- * dead-lettered) are results, not errors.
- */
-declare const WEBHOOK_STORE_ERROR_CODES: readonly ["input_invalid", "record_mismatch", "delivery_id_conflict", "call_aborted", "deadline_passed", "clock_invalid", "store_failed"];
-/** Why a store call was refused. */
-type WebhookStoreErrorCode = (typeof WEBHOOK_STORE_ERROR_CODES)[number];
-/**
- * Codes on {@link WebhookFanOutError}: why the fan-out publisher, the
- * composite publisher or the fan-out cycle refused or failed. A publisher
- * rejection makes the Host relay retry and, once its budget is spent,
- * dead-letter the outbox record, so a failed publish stays visible there.
- *
- * - `event_past_replay_horizon`: `insertFanOutJob` answered `past_horizon`.
- *   The event is older than the replay horizon (R5), so no job can be stored
- *   and the publish fails rather than counting as delivered.
- * - `fan_out_store_failed` / `fan_out_store_timeout`: the publisher's job
- *   insert or the cycle's claim threw, or did not settle within
- *   `portTimeoutMs`. Store failures later in a cycle reschedule the job
- *   with a diagnostic instead.
- * - `publish_aborted`: the caller's signal aborted before the store answered.
- * - `sink_failed`: a required sink of a composite publisher rejected with an
- *   error this package did not create.
- * - `sink_timeout`: a required sink of a composite publisher did not settle
- *   within the composite's `sinkTimeoutMs`.
- * - `clock_invalid`: the injected clock threw or returned an invalid time.
- * - `options_invalid`: an option is missing or has the wrong shape.
- */
-declare const WEBHOOK_FAN_OUT_ERROR_CODES: readonly ["event_past_replay_horizon", "fan_out_store_failed", "fan_out_store_timeout", "publish_aborted", "sink_failed", "sink_timeout", "clock_invalid", "options_invalid"];
-/** Why a fan-out publish or cycle failed. */
-type WebhookFanOutErrorCode = (typeof WEBHOOK_FAN_OUT_ERROR_CODES)[number];
-/**
- * Codes on {@link WebhookDeliveryError}: why the delivery cycle could not
- * run. Everything that goes wrong while one claimed intent is processed is
- * settled on that intent with a fixed code instead (README, "Delivery").
- *
- * - `delivery_store_failed` / `delivery_store_timeout`: the claim threw or
- *   answered something unreadable, or did not settle within `portTimeoutMs`.
- * - `clock_invalid`: the injected clock threw or returned an invalid time.
- * - `options_invalid`: an option or port is missing or has the wrong shape.
- */
-declare const WEBHOOK_DELIVERY_ERROR_CODES: readonly ["delivery_store_failed", "delivery_store_timeout", "clock_invalid", "options_invalid"];
-/** Why a delivery cycle failed. */
-type WebhookDeliveryErrorCode = (typeof WEBHOOK_DELIVERY_ERROR_CODES)[number];
-/**
- * Why a governed action (PR 9; README, "Governed actions") refused. At
- * submission, the action's admission check refuses with
- * `webhook_action_refused:<code>` (or `webhook_parameters_refused:<code>:<field>`
- * with a code from `WEBHOOK_ACTION_PARAMETER_CODES`) and Host records nothing.
- * At execution, the action fails with Host's `error` set to
- * `webhook_action_refused:<code>`, writes nothing more and emits no event.
- *
- * - `admission_not_enforced`: the handler ran without Host's record that the
- *   submission was admitted (`ActionContext.admittedAt`), as under a Host
- *   older than 7.3.0, which ignores `admitSubmission`. Nothing is written.
- * - `scope_invalid` / `actor_invalid`: Host's trusted context names a tenant,
- *   space or actor that breaks the store identifier rule.
- * - `secret_ref_invalid`: the application's secret store says the reference
- *   names no secret of this tenant. `secret_ref_unverified`: the check threw,
- *   timed out or answered something unreadable.
- * - `secret_ref_unchanged`: a rotation named the reference already in use.
- * - `destination_refused`: the resolver refused the URL (`invalid_url`,
- *   `private_address`). `destination_unresolved`: it answered `dns_failure`,
- *   threw or timed out. Neither writes anything.
- * - `subscription_not_found`, `subscription_exists`, `subscription_deleted`,
- *   `invalid_transition`, `revision_conflict`, `version_conflict`: the
- *   subscription store refused the write, or the action's own read found
- *   the same. `subscription_not_active`: an intent requeue for a paused or
- *   deleted subscription. `paused_since_intent`: an intent requeue for an
- *   active subscription that was paused and resumed after the intent's
- *   eligibility revision; dispatch would cancel it (decision 3).
- * - `not_found`, `stale`, `not_dead_letter`, `past_replay_horizon`: the
- *   delivery store refused a requeue or enrichment (decision 10, R5).
- * - `not_enrichable`, `actor_present`, `actor_suppressed`: enrichment of a
- *   completed job, or of a job whose actor is not `legacy` (decision 5).
- *   `actor_withheld`, `actor_not_found`, `actor_unavailable`: the
- *   application's actor reader withheld the actor, found no such event, or
- *   threw, timed out or answered something unreadable.
- * - `store_unavailable`: a read threw, timed out or answered something
- *   unreadable; nothing was written. `store_outcome_unknown`: a write threw,
- *   timed out or answered something unreadable, so it may have applied
- *   (README, "A store write that timed out is unknown"); also a re-run of an
- *   intent requeue whose evidence predates `subscriptionId` and whose intent
- *   can no longer be read, so the applied requeue has no event (README,
- *   "Atomicity and re-runs").
- * - `action_failed`: anything else, such as a failing clock; nothing it
- *   threw is read.
- */
-declare const WEBHOOK_ACTION_REFUSAL_CODES: readonly ["admission_not_enforced", "scope_invalid", "actor_invalid", "secret_ref_invalid", "secret_ref_unverified", "secret_ref_unchanged", "destination_refused", "destination_unresolved", "subscription_not_found", "subscription_exists", "subscription_deleted", "subscription_not_active", "paused_since_intent", "invalid_transition", "revision_conflict", "version_conflict", "not_found", "stale", "not_dead_letter", "past_replay_horizon", "not_enrichable", "actor_present", "actor_suppressed", "actor_withheld", "actor_not_found", "actor_unavailable", "store_unavailable", "store_outcome_unknown", "action_failed"];
-/** Why a governed action refused. */
-type WebhookActionRefusalCode = (typeof WEBHOOK_ACTION_REFUSAL_CODES)[number];
-/**
- * Codes on {@link WebhookGovernedActionError}: `options_invalid`, a module
- * option or port is missing or has the wrong shape.
- */
-declare const WEBHOOK_GOVERNED_ACTION_ERROR_CODES: readonly ["options_invalid"];
-/** Why the governed-action module could not be built. */
-type WebhookGovernedActionErrorCode = (typeof WEBHOOK_GOVERNED_ACTION_ERROR_CODES)[number];
-
-/** A JSON value. Every record this package defines is built from these. */
-type WebhookJsonValue = null | boolean | number | string | readonly WebhookJsonValue[] | {
-    readonly [key: string]: WebhookJsonValue;
-};
-/** A JSON object. */
-type WebhookJsonObject = {
-    readonly [key: string]: WebhookJsonValue;
-};
-/** The Host envelope this package consumes, re-exported for adapters. */
-type WebhookSourceEnvelope = EnterpriseEventEnvelope;
-/**
- * The envelope metadata a fan-out job keeps: everything that identifies,
- * orders and classifies the event, and nothing from its payload, trace
- * context or provenance. Timestamps are ISO-8601 strings so the record is
- * serializable.
- */
-interface WebhookEventMetadata {
-    readonly eventId: string;
-    readonly eventType: string;
-    readonly eventSchemaVersion: number;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly subjectType: string;
-    readonly subjectId: string;
-    /** The tenant/space ledger cursor. Delivery order is not guaranteed. */
-    readonly sequence: number;
-    readonly actionInvocationId?: string;
-    readonly correlationId: string;
-    readonly causationId?: string;
-    readonly occurredAt: string;
-    /** Stamped by Host's clock; selects the eligibility revision (decision 3). */
-    readonly recordedAt: string;
-    readonly producerModuleVersion: string;
-    readonly payloadClassification: EventPayloadClassification;
-    /** Present only when the producing action declared it. */
-    readonly consistency?: "authoritative-now" | "provisional-until-reconciled";
-}
-/**
- * The actor a job carries for admission, or why it carries none (decision 5).
- * `suppressed`: Host's `includeActor` hook excluded it. `legacy`: the envelope
- * predates the actor field. Admission that needs an actor treats both
- * absences as `unavailable`. The actor is never rendered into a v1 body.
- */
-type WebhookJobActor = {
-    readonly state: "present";
-    readonly actorId: string;
-    readonly actorType: string;
-} | {
-    readonly state: "absent";
-    readonly reason: "suppressed" | "legacy";
-};
-/**
- * What the application allows to leave for one event type (decision 9).
- * Field names are top-level payload keys. An event type with no entry goes
- * out metadata-only.
- */
-interface WebhookEventTypePolicy {
-    /** Payload fields that may be persisted on the job and rendered into the body. */
-    readonly fields: readonly string[];
-    /**
-     * Payload fields admission and scope predicates need. They are persisted on
-     * the job as facts and are never rendered into the body unless also listed
-     * in `fields`.
-     */
-    readonly facts?: readonly string[];
-    /** A `restricted` event is metadata-only, and keeps no payload or facts, unless this is `true`. */
-    readonly includeRestricted?: boolean;
-    /** A scoped type egresses its payload only when the injected scope predicate returns `true`. */
-    readonly scoped?: boolean;
-}
-/** Egress policy keyed by event type. Only own properties are consulted. */
-type WebhookPayloadPolicy = {
-    readonly [eventType: string]: WebhookEventTypePolicy;
-};
-/**
- * The persistence projection of one envelope (decision 2): what the fan-out
- * publisher inserts, keyed by `eventId`. It holds metadata, the allowlisted
- * payload fields and the declared facts only.
- */
-interface WebhookFanOutJobDraft {
-    readonly eventId: string;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly event: WebhookEventMetadata;
-    /** Allowlisted payload fields, or `null` when the event is metadata-only. */
-    readonly payload: WebhookJsonObject | null;
-    /** `true` exactly when `payload` is not `null`. */
-    readonly payloadProjected: boolean;
-    /** Declared admission and scope facts; empty when none are declared or allowed. */
-    readonly facts: WebhookJsonObject;
-    readonly actor: WebhookJobActor;
-}
-/** A fenced lease. A write carrying an older `fence` than the record's is refused. */
-interface WebhookLease {
-    readonly owner: string;
-    readonly fence: number;
-    readonly expiresAt: string;
-}
-/** Fan-out job lifecycle. */
-type WebhookFanOutJobStatus = "pending" | "completed" | "dead_letter";
-/** A stored fan-out job. */
-interface WebhookFanOutJob extends WebhookFanOutJobDraft {
-    readonly status: WebhookFanOutJobStatus;
-    readonly attemptCount: number;
-    readonly availableAt: string;
-    /** Persisted at creation; deferrals and reclaims count toward it (R4). */
-    readonly processingDeadline: string;
-    readonly createdAt: string;
-    readonly completedAt?: string;
-    readonly lastDiagnostic?: WebhookDiagnosticCode;
-    /**
-     * The record's fence: the dead-letter generation a requeue must name.
-     * Each claim and each applied requeue advances it, so a requeue built
-     * from an earlier read is refused as `stale` (decision 10).
-     */
-    readonly fence: number;
-    readonly lease?: WebhookLease;
-}
-/** Subscription lifecycle state recorded on each eligibility revision and configuration read. */
-type WebhookSubscriptionStatus = "active" | "paused" | "deleted";
-/**
- * An immutable eligibility revision (decision 3). Create, pattern change,
- * pause and resume each write one. The interval is half-open:
- * `effectiveFrom <= recordedAt < effectiveUntil`, with `null` meaning open.
- */
-interface WebhookEligibilityRevision {
-    readonly subscriptionId: string;
-    readonly revision: number;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly status: WebhookSubscriptionStatus;
-    readonly eventTypePatterns: readonly string[];
-    readonly effectiveFrom: string;
-    readonly effectiveUntil: string | null;
-}
-/** The only signature scheme in v1 (decision 7). */
-type WebhookSignatureScheme = "v1";
-/**
- * One version of a subscription's delivery configuration. Intents store no
- * destination; attempts record the version they used. The secret is a
- * reference resolved by the signer within the subscription's tenant, never
- * key material (decision 8).
- */
-interface WebhookDeliveryConfiguration {
-    readonly subscriptionId: string;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly version: number;
-    readonly destinationUrl: string;
-    readonly signatureScheme: WebhookSignatureScheme;
-    readonly secretRef: string;
-}
-/** What the dispatch check reads for one subscription. */
-interface WebhookSubscriptionSnapshot {
-    readonly subscriptionId: string;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly status: WebhookSubscriptionStatus;
-    /**
-     * The eligibility revision at which the subscription entered `status`: 1
-     * when it has never been paused, otherwise its latest pause, resume or
-     * delete revision (a pattern change keeps the status, so it does not
-     * move this). Read in the same atomic step as `status`. While the
-     * subscription is active, an intent bound to a lower revision belongs to
-     * an interval a pause ended, and dispatch cancels it (decision 3;
-     * README, "Pause and resume are enforced at dispatch").
-     */
-    readonly statusSinceRevision: number;
-    readonly configuration: WebhookDeliveryConfiguration;
-}
-/** Delivery intent lifecycle. */
-type WebhookDeliveryIntentStatus = "pending" | "delivered" | "dead_letter" | "cancelled";
-/** One intent per (subscriptionId, eventId), holding the rendered body (decision 9). */
-interface WebhookDeliveryIntent {
-    readonly deliveryId: string;
-    readonly subscriptionId: string;
-    readonly eventId: string;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly eligibilityRevision: number;
-    /**
-     * The event's `recordedAt`, copied by the store from the parent fan-out
-     * job when the intent is inserted. It anchors the replay horizon (R5).
-     */
-    readonly eventRecordedAt: string;
-    /** The rendered `fabric.webhook-delivery.v1` body, signed byte-for-byte per attempt. */
-    readonly body: string;
-    readonly status: WebhookDeliveryIntentStatus;
-    readonly attemptCount: number;
-    readonly availableAt: string;
-    readonly processingDeadline: string;
-    readonly createdAt: string;
-    readonly lastOutcome?: {
-        readonly outcome: WebhookAttemptOutcome;
-        readonly reason: WebhookAttemptReasonCode;
-    };
-    readonly lastDiagnostic?: WebhookDiagnosticCode;
-    /**
-     * The record's fence: the dead-letter generation a requeue must name.
-     * Each claim and each applied requeue advances it, so a requeue built
-     * from an earlier read is refused as `stale` (decision 10).
-     */
-    readonly fence: number;
-    readonly lease?: WebhookLease;
-}
-/** A recorded admission denial; it satisfies completeness for its (subscription, event). */
-interface WebhookAdmissionDenialRecord {
-    readonly subscriptionId: string;
-    readonly eventId: string;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly eligibilityRevision: number;
-    readonly code: WebhookAdmissionDenialCode;
-    readonly recordedAt: string;
-}
-/**
- * An attempt log entry with its outcome. Response bodies are never
- * persisted. An entry appended whole by `appendAttempt` has no `fence`; one
- * begun by `beginAttempt` and finished by `finishAttempt` carries the
- * intent's lease fence it was begun under.
- */
-interface WebhookDeliveryAttemptRecord {
-    readonly deliveryId: string;
-    readonly subscriptionId: string;
-    readonly eventId: string;
-    readonly attempt: number;
-    readonly configurationVersion: number;
-    readonly startedAt: string;
-    readonly finishedAt: string;
-    readonly outcome: WebhookAttemptOutcome;
-    readonly reason: WebhookAttemptReasonCode;
-    readonly httpStatus?: number;
-    /** The intent lease fence the attempt was begun under; absent for an entry appended whole. */
-    readonly fence?: number;
-}
-/**
- * What `beginAttempt` records, under the intent's lease, immediately before
- * the request is handed to the transport (README, "Delivery": the
- * irrevocable point). The configuration version is the one the request is
- * signed and addressed with.
- */
-interface WebhookDeliveryAttemptStart {
-    readonly deliveryId: string;
-    readonly subscriptionId: string;
-    readonly eventId: string;
-    readonly attempt: number;
-    readonly configurationVersion: number;
-    readonly startedAt: string;
-}
-/** What `finishAttempt` appends to a begun attempt once the transport answered. */
-interface WebhookDeliveryAttemptFinish {
-    readonly finishedAt: string;
-    readonly outcome: WebhookAttemptOutcome;
-    readonly reason: WebhookAttemptReasonCode;
-    readonly httpStatus?: number;
-}
-/**
- * A begun attempt with no outcome recorded: it was handed to the transport,
- * or its worker stopped between `beginAttempt` and the handoff, and no
- * outcome has been appended since. The request may have reached the
- * receiver.
- */
-interface WebhookDeliveryAttemptInFlight extends WebhookDeliveryAttemptStart {
-    readonly fence: number;
-    readonly outcome: "in_flight";
-}
-/** One entry of an intent's attempt log, in the order its first write was made. */
-type WebhookDeliveryAttemptLogEntry = WebhookDeliveryAttemptRecord | WebhookDeliveryAttemptInFlight;
-/**
- * The uniqueness marker for one (subscriptionId, eventId). The store writes
- * it in the same step as the intent or denial it stands for and removes it
- * with that record, when a purge finds the event older than the replay
- * horizon (R5). `retainUntil` is the event's `recordedAt` plus the store's
- * horizon: until then any insert for the pair is `already_present`, and
- * after it every insert for the pair is `past_horizon`, so a replay cannot
- * re-deliver whether or not a purge has run (the "cleanup racing" cases in
- * `tests/store-contract.ts`).
- */
-interface WebhookTombstone {
-    readonly kind: "intent" | "denial";
-    readonly subscriptionId: string;
-    readonly eventId: string;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly retainUntil: string;
-}
-/** A governed compare-and-set requeue from dead letter back to pending (decision 10). */
-interface WebhookRequeueRequest {
-    readonly expectedStatus: "dead_letter";
-    /**
-     * The `fence` of the dead-lettered record as the operator read it. The
-     * requeue applies only while the record still has that fence; otherwise
-     * it is refused as `stale`. Two requeues built from one read therefore
-     * apply at most once, and a request read before the record was requeued,
-     * re-run and dead-lettered again does not apply to the new dead letter.
-     */
-    readonly expectedFence: number;
-    readonly requestedBy: string;
-    readonly requestedAt: Date;
-    /**
-     * The requeued record's new processing deadline (R4). The record becomes
-     * available at `requestedAt` with its attempt budget restored; without a
-     * new deadline a requeued record past its old one could not be retried.
-     */
-    readonly processingDeadline: Date;
-    /**
-     * The governed invocation that authorized the requeue, for audit. It is
-     * also the request's identity: a later request under the same id, for the
-     * same target and record in the same scope, is a re-run of this one, and
-     * the store answers it with this request's evidence and `replayed: true`
-     * instead of applying it (ports, "Re-runs of one invocation").
-     */
-    readonly actionInvocationId?: string;
-}
-/**
- * A governed actor enrichment of a `legacy` fan-out job (decision 5, PR 9).
- * Like {@link WebhookRequeueRequest} it is a compare-and-set on the job's
- * fence as the operator read it, and it restores the budget with a new
- * processing deadline. `actor` is what the application's reader found on the
- * canonical event for the job's tenant, space and `eventId`.
- */
-interface WebhookActorEnrichmentRequest {
-    /** The job's `fence` as the operator read it; a mismatch is refused as `stale`. */
-    readonly expectedFence: number;
-    readonly actor: {
-        readonly actorId: string;
-        readonly actorType: string;
-    };
-    readonly requestedBy: string;
-    readonly requestedAt: Date;
-    /** The repaired job's new processing deadline (R4). It becomes available at `requestedAt`. */
-    readonly processingDeadline: Date;
-    /** The governed invocation that authorized the enrichment, for audit, and the request's identity, as for {@link WebhookRequeueRequest.actionInvocationId}. */
-    readonly actionInvocationId?: string;
-}
-/**
- * Append-only evidence of one applied requeue or actor enrichment
- * (decisions 5 and 10). The store writes it in the same step as the
- * transition, and no store method updates or removes it, a purge included
- * (the memory store keeps it for its lifetime, the PostgreSQL store until
- * someone deletes rows from `webhook_requeue_evidence` directly);
- * the `prior*` fields keep the state the requeue replaced, so a later
- * requeue cannot erase an earlier failure. Contract cases: "job requeue is a
- * compare-and-set …", "actor enrichment repairs a legacy job …" and "purge
- * removes only terminal records …".
- */
-interface WebhookRequeueEvidence {
-    /** `fan_out_job_actor`: an actor enrichment (PR 9), which also requeues the job. */
-    readonly target: "fan_out_job" | "delivery_intent" | "fan_out_job_actor";
-    readonly eventId: string;
-    /** Present when `target` is `delivery_intent`. */
-    readonly deliveryId?: string;
-    /**
-     * Present when `target` is `delivery_intent`: the intent's subscription,
-     * so a re-run of the requeue can report it after the intent is purged.
-     * Evidence written before this field existed lacks it.
-     */
-    readonly subscriptionId?: string;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly requestedBy: string;
-    readonly requestedAt: string;
-    readonly actionInvocationId?: string;
-    /** The store's clock when the requeue was applied. */
-    readonly appliedAt: string;
-    readonly priorAttemptCount: number;
-    readonly priorAvailableAt: string;
-    readonly priorProcessingDeadline: string;
-    /** The record's fence when it was requeued (the request's `expectedFence`); the requeue advances it by one. */
-    readonly priorFence: number;
-    readonly priorLastDiagnostic?: WebhookDiagnosticCode;
-    readonly priorLastOutcome?: {
-        readonly outcome: WebhookAttemptOutcome;
-        readonly reason: WebhookAttemptReasonCode;
-    };
-    readonly processingDeadline: string;
-    /** Present when `target` is `fan_out_job_actor`: the actor the enrichment set. The prior actor was `legacy`. */
-    readonly actor?: {
-        readonly actorId: string;
-        readonly actorType: string;
-    };
-}
-/** A delivery configuration as a writer supplies it; the store assigns `version`. */
-interface WebhookDeliveryConfigurationInput {
-    readonly destinationUrl: string;
-    readonly signatureScheme: WebhookSignatureScheme;
-    /** A reference the signer resolves within the subscription's tenant, never key material (decision 8). */
-    readonly secretRef: string;
-}
-/** The v1 wire body (decision 7). Field order is the serialized order. */
-interface WebhookDeliveryBodyV1 {
-    readonly format: "fabric.webhook-delivery.v1";
-    readonly eventId: string;
-    readonly type: string;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly correlationId: string;
-    readonly occurredAt: string;
-    readonly event: {
-        readonly type: string;
-        readonly schemaVersion: number;
-        readonly subjectType: string;
-        readonly subjectId: string;
-        readonly sequence: number;
-        readonly recordedAt: string;
-        readonly actionInvocationId?: string;
-        readonly consistency?: "provisional-until-reconciled";
-        readonly payload: WebhookJsonObject | null;
-        readonly payloadProjected: boolean;
-    };
-    readonly delivery: {
-        readonly deliveryId: string;
-        readonly subscriptionId: string;
-    };
-}
-
-/**
- * Port interfaces (ADR 0018 decision 6). An application passes
- * implementations to an instance built at its composition root; this package
- * keeps no module-scope registry of them (ADR 0008). Every awaited call takes
- * an absolute `deadline` and an `AbortSignal` so a caller can bound it (R4).
- *
- * Ports are trusted application code, like the fan-out sinks (package README,
- * "Trust model"). An async call returns an ordinary promise or thenable. A
- * promise whose `constructor` access throws is outside this contract: no
- * JavaScript code can attach a handler to it (`then`, `await` and
- * `Promise.resolve` all read `constructor` first), so a rejection it carries
- * can surface as unhandled.
- */
-
-/** Bounds every awaited port call. */
-interface WebhookCallOptions {
-    /** The absolute time after which the call's result is ignored. */
-    readonly deadline: Date;
-    /** Aborted when the caller stops waiting; implementations should stop work. */
-    readonly signal: AbortSignal;
-}
-/** Tenant and space scope every store read is confined to (decision 9). */
-interface WebhookScope {
-    readonly tenantId: string;
-    readonly spaceId: string;
-}
-/**
- * Tenant- and space-scoped reads of eligibility revisions and delivery
- * configuration (decision 3). The fan-out and delivery cycles depend on this
- * read port only; writes are on {@link WebhookSubscriptionWriter}.
- */
-interface WebhookSubscriptionStore {
-    /**
-     * Eligibility revisions in the scope whose half-open interval contains
-     * `recordedAt`, at most one per subscription, in `subscriptionId` order.
-     * Paused and deleted revisions are returned with their status; the caller
-     * decides eligibility.
-     */
-    listEligibilityRevisions(input: WebhookScope & {
-        readonly recordedAt: string;
-    }, options: WebhookCallOptions): Promise<readonly WebhookEligibilityRevision[]>;
-    /**
-     * The subscription's current status, the revision that status began at
-     * (`statusSinceRevision`, read in the same atomic step as the status) and
-     * its current delivery configuration, or `null` when it does not exist in
-     * this scope. The dispatch check calls it as close to transport handoff
-     * as it can.
-     */
-    readSubscription(input: WebhookScope & {
-        readonly subscriptionId: string;
-    }, options: WebhookCallOptions): Promise<WebhookSubscriptionSnapshot | null>;
-    /**
-     * Every eligibility revision of one subscription, oldest first, or an
-     * empty list when it does not exist in this scope. Revisions are never
-     * removed (R5: eligibility history outlives the replay horizon).
-     */
-    listEligibilityHistory(input: WebhookScope & {
-        readonly subscriptionId: string;
-    }, options: WebhookCallOptions): Promise<readonly WebhookEligibilityRevision[]>;
-}
-/**
- * Why a subscription write was refused. `not_found`: no such subscription in
- * this scope. `already_exists`: create named an existing one. `deleted`: the
- * subscription is deleted, which is terminal. `invalid_transition`: pause of
- * a paused subscription, or resume of an active one. `revision_conflict` /
- * `version_conflict`: the caller's expected revision or configuration
- * version is not the current one.
- */
-type WebhookSubscriptionWriteRefusal = "not_found" | "already_exists" | "deleted" | "invalid_transition" | "revision_conflict";
-/** The result of a subscription write that appends an eligibility revision. */
-type WebhookSubscriptionWriteResult = {
-    readonly applied: true;
-    readonly revision: WebhookEligibilityRevision;
-    readonly configuration: WebhookDeliveryConfiguration;
-} | {
-    readonly applied: false;
-    readonly refusal: WebhookSubscriptionWriteRefusal;
-    readonly currentRevision?: number;
-};
-/** The result of a delivery configuration replacement. */
-type WebhookConfigurationWriteResult = {
-    readonly applied: true;
-    readonly configuration: WebhookDeliveryConfiguration;
-} | {
-    readonly applied: false;
-    readonly refusal: "not_found" | "deleted" | "version_conflict";
-    readonly currentVersion?: number;
-};
-/** Names one subscription for a transition, optionally guarded by its current revision. */
-type WebhookSubscriptionTransitionInput = WebhookScope & {
-    readonly subscriptionId: string;
-    /** When set, the write is refused as `revision_conflict` unless this is the current revision. */
-    readonly expectedRevision?: number;
-};
-/**
- * Subscription writes (decision 3), for the governed actions (PR 9). Create,
- * pattern change, pause, resume and delete each append one immutable
- * eligibility revision, effective from the store's clock; configuration
- * replacement appends one delivery configuration version. The store checks
- * each transition against its own current state, not the caller's.
- *
- * Pause and delete do not touch the delivery store; the two stores need not
- * share a database, so nothing here is atomic with intent state. The
- * governed action calls {@link WebhookDeliveryStore.cancelPendingIntents}
- * with the same scope and `subscriptionId` after the revision is written,
- * passing that revision's number as `beforeRevision`, so a cancel delayed
- * past a later resume cannot cancel intents bound to the resumed revision;
- * resume makes the same call with its own revision. These calls are
- * cleanups. What stops delivery, whether they failed, timed out or raced a
- * late fan-out insert, is the delivery cycle's pre-handoff
- * `readSubscription` check: it cancels the intent unsent while the
- * subscription is paused or deleted, and while it is active with a
- * {@link WebhookSubscriptionSnapshot.statusSinceRevision} above the
- * intent's `eligibilityRevision`, i.e. resumed after a pause that ended the
- * intent's interval (decision 3, R2; README, "Pause and resume are enforced
- * at dispatch"). So resume never resurrects an intent of an interval a
- * pause ended: a cancelled intent is terminal, and one still pending, or
- * requeued from dead letter, is cancelled at dispatch.
- */
-interface WebhookSubscriptionWriter {
-    /** Create an active subscription with revision 1 and configuration version 1. */
-    createSubscription(input: WebhookScope & {
-        readonly subscriptionId: string;
-        readonly eventTypePatterns: readonly string[];
-        readonly configuration: WebhookDeliveryConfigurationInput;
-    }, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
-    /** Append a revision with new patterns and the current status. Refused once deleted. */
-    changeEventTypePatterns(input: WebhookSubscriptionTransitionInput & {
-        readonly eventTypePatterns: readonly string[];
-    }, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
-    /** Active to paused. See the interface note for cancelling pending intents. */
-    pauseSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
-    /** Paused to active. Cancelled intents stay cancelled, and intents bound to revisions before the resume are not delivered (see the interface note). */
-    resumeSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
-    /** Active or paused to deleted, which is terminal. History is kept. */
-    deleteSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
-    /** Append a delivery configuration version. Refused once deleted. */
-    replaceDeliveryConfiguration(input: WebhookScope & {
-        readonly subscriptionId: string;
-        readonly configuration: WebhookDeliveryConfigurationInput;
-        /** When set, the write is refused as `version_conflict` unless this is the current version. */
-        readonly expectedVersion?: number;
-    }, options: WebhookCallOptions): Promise<WebhookConfigurationWriteResult>;
-}
-/** A claim request for either queue. */
-interface WebhookClaimRequest {
-    readonly workerId: string;
-    readonly leaseDurationMs: number;
-    readonly limit: number;
-    readonly now: Date;
-}
-/** Identifies a leased record; a write whose fence is stale is refused. */
-interface WebhookFencedWrite {
-    readonly owner: string;
-    readonly fence: number;
-    readonly now: Date;
-}
-/**
- * The result of an insert-if-absent. `already_present`: a job for the
- * `eventId` exists. `past_horizon`: the event's `recordedAt` is older than
- * the replay horizon (R5), so nothing was written, whether or not a job for
- * it was ever stored or has been purged.
- */
-interface WebhookInsertResult {
-    readonly outcome: "inserted" | "already_present" | "past_horizon";
-}
-/**
- * The fan-out job lease an intent or denial insert is made under. The job is
- * keyed by `eventId`; `fence` is the job's lease token, which a reclaim and
- * actor enrichment both advance.
- */
-interface WebhookFanOutJobFence {
-    readonly eventId: string;
-    readonly owner: string;
-    readonly fence: number;
-}
-/**
- * The result of an insert made under a fan-out job's lease. `lease_lost`:
- * the job's current owner or fence no longer matches, and nothing was
- * written. `past_horizon`: the event is older than the replay horizon (R5),
- * and nothing was written. `already_present`: an intent, denial or tombstone
- * already exists for (subscriptionId, eventId). Checked in that order.
- */
-interface WebhookFencedInsertResult {
-    readonly outcome: "inserted" | "already_present" | "lease_lost" | "past_horizon";
-}
-/**
- * The result of a compare-and-set requeue, checked in this order.
- * `not_found`: no such record in this scope. `stale`: the record's fence is
- * no longer the request's `expectedFence`, because it was claimed or
- * requeued since the operator read it (including when it has since been
- * dead-lettered again). `not_dead_letter`: the record is not dead-lettered
- * (a pending, completed, delivered or cancelled record is never requeued).
- * `past_horizon`: the event is older than the replay horizon (decision 10).
- */
-type WebhookRequeueResult = {
-    readonly applied: true;
-    readonly evidence: WebhookRequeueEvidence;
-    /** Present when the request's `actionInvocationId` had already applied it: `evidence` is that application's, and nothing changed now. */
-    readonly replayed?: true;
-} | {
-    readonly applied: false;
-    readonly refusal: "not_found" | "stale" | "not_dead_letter" | "past_horizon";
-};
-/**
- * The result of an actor enrichment (decision 5), checked in this order.
- * `not_found`: no such job in this scope. `stale`: the job's fence is no
- * longer the request's `expectedFence`. `not_enrichable`: the job is
- * `completed`, which is final (README, "Completeness boundary").
- * `actor_present`: the job already carries an actor. `actor_suppressed`:
- * Host's `includeActor` hook withheld the actor, which enrichment never
- * overrides. `past_horizon`: the event is older than the replay horizon.
- */
-type WebhookActorEnrichmentResult = {
-    readonly applied: true;
-    readonly evidence: WebhookRequeueEvidence;
-    /** As on {@link WebhookRequeueResult}. */
-    readonly replayed?: true;
-} | {
-    readonly applied: false;
-    readonly refusal: "not_found" | "stale" | "not_enrichable" | "actor_present" | "actor_suppressed" | "past_horizon";
-};
-/**
- * What a purge removed. `cutoff` is the store's clock minus the horizon;
- * only records whose event `recordedAt` is earlier were removed. `more` is
- * `true` when the limit stopped the purge before every such record went.
- */
-interface WebhookPurgeResult {
-    readonly cutoff: string;
-    readonly removed: {
-        readonly fanOutJobs: number;
-        readonly deliveryIntents: number;
-        readonly admissionDenials: number;
-    };
-    readonly more: boolean;
-}
-/**
- * What `beginAttempt` answered. `receipt` is the only proof that the caller
- * began the attempt; it is needed to record the attempt's outcome.
- */
-type WebhookAttemptBeginResult = {
-    readonly begun: true;
-    readonly receipt: string;
-} | {
-    readonly begun: false;
-};
-/**
- * What a pre-handoff lease check found. `valid` only when the intent is
- * still `pending`, leased to this owner at this fence, in this scope, and
- * the lease has not expired at `now`.
- */
-type WebhookDeliveryLeaseCheck = {
-    readonly valid: true;
-} | {
-    readonly valid: false;
-    readonly reason: "lease_lost" | "intent_not_pending" | "not_found";
-};
-/**
- * Durable state for both stages (decisions 2, 3 and 10): fan-out jobs keyed
- * by `eventId`, intents keyed by (subscriptionId, eventId), fenced leases,
- * retry scheduling, dead letter, compare-and-set requeue, an append-only
- * attempt log and tombstones. Fenced writes (job completion, reschedule,
- * dead letter and lease renewal; intent and denial inserts under a parent
- * job's fence; `appendAttempt`, `beginAttempt`, `settleDeliveryIntent` and
- * `renewDeliveryIntentLease`) resolve
- * `false`, or `lease_lost` for an insert, without changing anything, when
- * the caller no longer holds the lease: the record is not `pending`, its
- * lease owner or fence differs, or its lease has expired. Expiry is judged
- * on the store's own clock, read inside the atomic step (after every lock
- * is held, in PostgreSQL), never on the caller's `now`, so a write delayed
- * past its lease is refused even before another worker reclaims the record
- * (contract case "every fenced write decides lease expiry on the store's
- * clock …"; changed in PR 8, before which the fence alone decided).
- * `finishAttempt` is not fenced. Memory and PostgreSQL implementations
- * share one contract suite (`tests/store-contract.ts`).
- *
- * **Replay horizon (R5).** The store is built with a horizon `H` and reads
- * its own clock. Every record keyed by an event is anchored at that event's
- * `recordedAt`. Let `floor` be the later of `now - H` and the highest
- * `cutoff` any purge has used. A fan-out job, intent or denial insert, a
- * job or intent requeue, and an actor enrichment (PR 9), is refused as
- * `past_horizon` when its anchor is
- * earlier than `floor`; {@link WebhookDeliveryStore.purgeExpiredRecords}
- * removes only terminal records whose anchor is earlier than its `cutoff`.
- * The comparison and the write are one atomic step (one transaction, or one
- * synchronous step in memory), so a purge and a replay of the same key
- * cannot interleave between them. Whichever runs first, a replay of a
- * purged key is refused and a record inside the horizon is never removed.
- * The floor can fall when the store's clock steps backwards, but never below
- * the highest cutoff a purge has used, which is all a purged key needs: it
- * stays refused even if the clock steps backwards after the purge. The
- * race and floor cases in `tests/store-contract.ts` check the outcome of
- * each whole-operation order, forced through the `beforeAtomicStep` seam;
- * they cannot interpose inside the atomic step, so each implementation
- * proves its check-to-write atomicity separately (README, "Contract suite").
- */
-interface WebhookDeliveryStore {
-    /**
-     * Insert a pending job, available at `createdAt`, unless one exists for
-     * `eventId` or the event is past the replay horizon.
-     */
-    insertFanOutJob(job: WebhookFanOutJobDraft & {
-        readonly processingDeadline: string;
-        readonly createdAt: string;
-    }, options: WebhookCallOptions): Promise<WebhookInsertResult>;
-    /**
-     * Lease up to `limit` pending jobs whose `availableAt` has passed and that
-     * are unleased or whose lease has expired, oldest `availableAt` first.
-     * Each claim advances the job's fence. Claiming spends no attempt.
-     */
-    claimFanOutJobs(request: WebhookClaimRequest, options: WebhookCallOptions): Promise<readonly WebhookFanOutJob[]>;
-    /** Mark a job complete once each eligible revision has an intent or recorded denial. */
-    completeFanOutJob(input: WebhookFencedWrite & {
-        readonly eventId: string;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    /** Return a job to pending at `availableAt`, spending one attempt. */
-    rescheduleFanOutJob(input: WebhookFencedWrite & {
-        readonly eventId: string;
-        readonly availableAt: Date;
-        readonly diagnostic: WebhookDiagnosticCode;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    /**
-     * Extend the lease the caller holds on a job, so a worker that is still
-     * making progress keeps it (PR 8). Fenced like the other job writes:
-     * resolves `true` only when the job is `pending`, leased to `owner` at
-     * `fence`, and the lease has not expired on the store's clock read after
-     * its locks; otherwise `false`, writing nothing. On `true` the lease's
-     * expiry becomes the later of its current expiry and the earlier of
-     * `now + leaseDurationMs` and the job's processing deadline: a renewal
-     * never shortens a lease and never extends it past the processing
-     * deadline (contract case "a lease renewal extends only a lease the
-     * caller holds …"). The fence, attempt count and availability are
-     * unchanged.
-     */
-    renewFanOutJobLease(input: WebhookFencedWrite & {
-        readonly eventId: string;
-        readonly leaseDurationMs: number;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    /** Move an exhausted job to dead letter. */
-    deadLetterFanOutJob(input: WebhookFencedWrite & {
-        readonly eventId: string;
-        readonly diagnostic: WebhookDiagnosticCode;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    /**
-     * Compare-and-set a dead-lettered job back to pending with a restored
-     * budget and a new processing deadline, appending requeue evidence in the
-     * same step. The compare is on the fence (`request.expectedFence`) as
-     * well as the status, and the requeue advances the fence, so one read
-     * yields at most one applied requeue. The fence check, the status and
-     * horizon checks, the transition and the evidence are one atomic step.
-     * Refused past the replay horizon.
-     *
-     * **Re-runs of one invocation.** When the request carries an
-     * `actionInvocationId`, the atomic step first looks for evidence this
-     * scope holds under that id for the same target and record. If there is
-     * some, the call answers `{ applied: true, replayed: true, evidence }`
-     * with that evidence and changes nothing, before any other check: the
-     * record may since have moved on, been claimed or been purged. So
-     * requests of one governed invocation that reach this step, overlapping
-     * or one after the other, apply once and each reports that application,
-     * while a request under another id is checked as usual. An attempt that
-     * a check before this step refused never reaches it (README, "Atomicity
-     * and re-runs"). Contract cases "a request repeated
-     * under its actionInvocationId …" (three).
-     */
-    requeueFanOutJob(input: WebhookScope & {
-        readonly eventId: string;
-        readonly request: WebhookRequeueRequest;
-    }, options: WebhookCallOptions): Promise<WebhookRequeueResult>;
-    /**
-     * Repair a `legacy` job's actor (decision 5, PR 9): set the actor the
-     * application read from the canonical event, return the job to pending
-     * with a restored budget and a new processing deadline, advance its fence
-     * and clear its lease, and append evidence with `target:
-     * "fan_out_job_actor"`. The job may be `pending` (leased or not) or
-     * `dead_letter`; a `completed` job is refused. Advancing the fence is what
-     * stops a worker that leased the job before the repair: its later fenced
-     * writes (intent and denial inserts, completion, reschedule, dead letter,
-     * renewal) answer `lease_lost` or `false`. The scope, fence, status,
-     * actor-state and horizon checks, the transition and the evidence are one
-     * atomic step, so a `suppressed` or `present` actor is refused by the store
-     * itself, whatever the caller read before. A request of an invocation that
-     * already applied is answered as for {@link WebhookDeliveryStore.requeueFanOutJob}
-     * ("Re-runs of one invocation").
-     */
-    enrichFanOutJobActor(input: WebhookScope & {
-        readonly eventId: string;
-        readonly request: WebhookActorEnrichmentRequest;
-    }, options: WebhookCallOptions): Promise<WebhookActorEnrichmentResult>;
-    /** The job for `eventId` in this scope, or `null`. */
-    readFanOutJob(input: WebhookScope & {
-        readonly eventId: string;
-    }, options: WebhookCallOptions): Promise<WebhookFanOutJob | null>;
-    /**
-     * Insert an intent unless an intent, denial or tombstone exists for
-     * (subscriptionId, eventId), on behalf of the fan-out job `parent`. The
-     * store copies the parent job's event `recordedAt` onto the intent.
-     *
-     * Atomicity requirement: the check that `parent.eventId`'s job is still
-     * leased to `parent.owner` at `parent.fence`, the replay-horizon check,
-     * the uniqueness check and the insert are one atomic step (one
-     * transaction, or one conditional write). A worker whose lease was
-     * reclaimed, or whose job fence actor enrichment advanced, gets
-     * `lease_lost` and writes nothing, even if it lost the lease between its
-     * last read and this call. The intent's `eventId`, `tenantId` and
-     * `spaceId` must match the job's (`record_mismatch` otherwise), and its
-     * `deliveryId` must not belong to another pair (`delivery_id_conflict`).
-     */
-    insertDeliveryIntent(intent: Omit<WebhookDeliveryIntent, "status" | "attemptCount" | "lastOutcome" | "lastDiagnostic" | "lease" | "eventRecordedAt" | "fence">, parent: WebhookFanOutJobFence, options: WebhookCallOptions): Promise<WebhookFencedInsertResult>;
-    /**
-     * Record an admission denial unless an intent, denial or tombstone exists
-     * for (subscriptionId, eventId), on behalf of the fan-out job `parent`.
-     * Same atomicity requirement as {@link WebhookDeliveryStore.insertDeliveryIntent}:
-     * the parent fence check, the horizon check and the insert are one atomic step.
-     */
-    recordAdmissionDenial(record: WebhookAdmissionDenialRecord, parent: WebhookFanOutJobFence, options: WebhookCallOptions): Promise<WebhookFencedInsertResult>;
-    /**
-     * Lease up to `limit` pending intents whose `availableAt` has passed and
-     * that are unleased or whose lease has expired, oldest `availableAt` first.
-     * Each claim advances the intent's fence. Claiming spends no attempt.
-     */
-    claimDeliveryIntents(request: WebhookClaimRequest, options: WebhookCallOptions): Promise<readonly WebhookDeliveryIntent[]>;
-    /**
-     * Extend the lease the caller holds on an intent (PR 8), with the rule
-     * of {@link WebhookDeliveryStore.renewFanOutJobLease}: fenced, decided
-     * on the store's clock after its locks, never shortening the lease and
-     * never extending it past the intent's processing deadline. The fence,
-     * attempt count and availability are unchanged.
-     */
-    renewDeliveryIntentLease(input: WebhookFencedWrite & {
-        readonly deliveryId: string;
-        readonly leaseDurationMs: number;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    /**
-     * Read-only check that the intent is still `pending` and leased to
-     * `owner` at `fence` in this tenant and space, with a lease that has not
-     * expired at `now`, so a caller learns that its intent was cancelled,
-     * settled or re-leased even when the subscription itself is active
-     * again. The delivery cycle does not call it: its last check before the
-     * handoff is {@link WebhookDeliveryStore.beginAttempt}, which makes the
-     * same check and records the attempt in one atomic step.
-     *
-     * Requirements: it changes nothing (no settlement, no lease renewal); it
-     * reads the committed current row, not a cached or replica copy, so it
-     * observes every settle, cancel, requeue or reclaim that committed before
-     * it ran; it is bounded by `options`. A change committed after it returns
-     * may still race with the handoff (R2).
-     */
-    checkDeliveryLease(input: WebhookScope & {
-        readonly deliveryId: string;
-        readonly owner: string;
-        readonly fence: number;
-        readonly now: Date;
-    }, options: WebhookCallOptions): Promise<WebhookDeliveryLeaseCheck>;
-    /**
-     * Append one complete attempt to the log, fenced by the intent's lease.
-     * The delivery cycle uses it for attempts that end before the transport
-     * is reached (a signer failure, a refused destination). Never updates or
-     * removes an earlier entry; a purge keeps the log. The attempt's
-     * `subscriptionId` and `eventId` must match the intent's.
-     */
-    appendAttempt(input: WebhookFencedWrite & {
-        readonly attempt: WebhookDeliveryAttemptRecord;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    /**
-     * Record, as one atomic step, that the lease holder is about to hand
-     * `attempt` to the transport: the delivery cycle's last check before the
-     * irrevocable point (R2). Resolves `{ begun: true, receipt }` and appends
-     * an in-flight entry keyed by (`deliveryId`, `fence`) only when the
-     * intent is `pending`, leased to `owner` at `fence`, its lease has not
-     * expired on the store's clock, and no attempt has been begun under this
-     * fence yet. Otherwise it resolves `{ begun: false }` and writes nothing.
-     * It does not change the intent. The attempt's `subscriptionId` and
-     * `eventId` must match the intent's (`record_mismatch` otherwise).
-     *
-     * `receipt` is an unguessable token (32 random bytes) created for this
-     * attempt and returned only here. The store keeps its SHA-256 digest,
-     * never the token, and no read returns either; only the worker that
-     * began the attempt can record its outcome ({@link WebhookDeliveryStore.finishAttempt}).
-     * The delivery cycle keeps it in a local variable only.
-     *
-     * The delivery cycle calls it before every handoff and hands off only on
-     * a well-formed `begun: true` answer (src/delivery-cycle.ts), so every
-     * request it hands to the transport has an attempt entry, even when its
-     * worker loses the lease before it can settle the intent (README, "Delivery").
-     */
-    beginAttempt(input: WebhookFencedWrite & {
-        readonly attempt: WebhookDeliveryAttemptStart;
-    }, options: WebhookCallOptions): Promise<WebhookAttemptBeginResult>;
-    /**
-     * Append the outcome of the attempt begun under (`deliveryId`, `fence`)
-     * in this scope, presenting the `receipt` its `beginAttempt` returned.
-     * Not fenced: a worker whose lease was reclaimed after the handoff can
-     * still record what its request observed. Bound to the receipt instead:
-     * a worker that did not begin that attempt cannot record its outcome,
-     * whether or not it holds the lease now. It reads and changes nothing of
-     * the intent, so no worker can move the intent's state through it
-     * (contract cases "a worker reclaimed after its handoff still finishes
-     * its attempt …" and "only the worker that began an attempt can record
-     * its outcome …"). Resolves `true` when it appended the outcome; `false`,
-     * writing nothing, when no attempt was begun under that key in this
-     * scope, the receipt does not match, or its outcome is already recorded
-     * (the first outcome stands).
-     */
-    finishAttempt(input: WebhookScope & {
-        readonly deliveryId: string;
-        readonly fence: number;
-        readonly receipt: string;
-        readonly finish: WebhookDeliveryAttemptFinish;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    /**
-     * Settle an intent after an attempt or a refused check, clearing its
-     * lease. `release` returns it to pending unsent without spending budget;
-     * `retry` spends one attempt; `delivered`, `dead_letter` and `cancelled`
-     * are terminal and leave the attempt count as it was.
-     */
-    settleDeliveryIntent(input: WebhookFencedWrite & {
-        readonly deliveryId: string;
-        readonly settlement: {
-            readonly kind: "delivered";
-        } | {
-            readonly kind: "retry";
-            readonly availableAt: Date;
-            readonly outcome: WebhookAttemptOutcome;
-            readonly reason: WebhookAttemptReasonCode;
-        } | {
-            readonly kind: "release";
-            readonly availableAt: Date;
-            readonly diagnostic: WebhookDiagnosticCode;
-        } | {
-            readonly kind: "dead_letter";
-            readonly reason: WebhookAttemptReasonCode | WebhookDiagnosticCode;
-        } | {
-            readonly kind: "cancelled";
-            readonly reason: WebhookAttemptReasonCode;
-        };
-    }, options: WebhookCallOptions): Promise<boolean>;
-    /**
-     * Cancel the pending intents of a subscription in this scope, leased or
-     * not, that are bound to an eligibility revision earlier than
-     * `beforeRevision`, as a pause or delete does. Returns the count. Pass the
-     * revision the pause or delete wrote: then only intents for events the
-     * pause ended are cancelled, and an intent bound to a later revision (one
-     * written after a resume) is left alone even when this call is delayed
-     * past the resume. A cancelled intent is terminal; its lease holder's
-     * later fenced writes and lease checks fail. The governed actions call
-     * it as a cleanup; dispatch does not depend on it (see
-     * {@link WebhookSubscriptionWriter}).
-     */
-    cancelPendingIntents(input: WebhookScope & {
-        readonly subscriptionId: string;
-        readonly reason: "subscription_paused" | "subscription_deleted";
-        /** Only intents whose `eligibilityRevision` is lower than this are cancelled. */
-        readonly beforeRevision: number;
-        readonly now: Date;
-    }, options: WebhookCallOptions): Promise<number>;
-    /**
-     * Compare-and-set a dead-lettered intent back to pending, with the same
-     * fence compare-and-set, atomicity and re-run recognition as
-     * {@link WebhookDeliveryStore.requeueFanOutJob}; the evidence names the
-     * intent's `subscriptionId`. Refused past the replay horizon.
-     */
-    requeueDeliveryIntent(input: WebhookScope & {
-        readonly deliveryId: string;
-        readonly request: WebhookRequeueRequest;
-    }, options: WebhookCallOptions): Promise<WebhookRequeueResult>;
-    /** The intent in this scope, or `null`. */
-    readDeliveryIntent(input: WebhookScope & {
-        readonly deliveryId: string;
-    }, options: WebhookCallOptions): Promise<WebhookDeliveryIntent | null>;
-    /**
-     * The attempt log of one intent in this scope, in the order each entry
-     * was first written: entries appended whole, begun attempts with their
-     * outcome once one is recorded, and begun attempts still `in_flight`.
-     */
-    listDeliveryAttempts(input: WebhookScope & {
-        readonly deliveryId: string;
-    }, options: WebhookCallOptions): Promise<readonly WebhookDeliveryAttemptLogEntry[]>;
-    /** Requeue evidence for one event's job and intents in this scope, in append order. */
-    listRequeueEvidence(input: WebhookScope & {
-        readonly eventId: string;
-    }, options: WebhookCallOptions): Promise<readonly WebhookRequeueEvidence[]>;
-    /**
-     * Requeue and enrichment evidence appended under one governed
-     * `actionInvocationId` in this scope, in append order, whether or not the
-     * records it names still exist. The governed actions read it before they
-     * read the record, so a re-run reports what its invocation applied.
-     */
-    listInvocationRequeueEvidence(input: WebhookScope & {
-        readonly actionInvocationId: string;
-    }, options: WebhookCallOptions): Promise<readonly WebhookRequeueEvidence[]>;
-    /** Read the tombstone for (subscriptionId, eventId), if one is retained. */
-    readTombstone(input: WebhookScope & {
-        readonly subscriptionId: string;
-        readonly eventId: string;
-    }, options: WebhookCallOptions): Promise<WebhookTombstone | null>;
-    /**
-     * Remove up to `limit` terminal records whose event is older than the
-     * replay horizon at the store's clock: completed and dead-lettered jobs,
-     * delivered, dead-lettered and cancelled intents, and denials, each with
-     * its tombstone. Pending records are never removed, so live work is not
-     * lost; the cycles are to move them to a terminal state through their
-     * processing deadlines (R4). The attempt log and requeue evidence are audit records
-     * and are kept. The purge's cutoff raises the store's horizon floor in
-     * the same step, so no later insert or requeue can recreate what it
-     * removed. Oldest anchor first.
-     */
-    purgeExpiredRecords(input: {
-        readonly limit: number;
-    }, options: WebhookCallOptions): Promise<WebhookPurgeResult>;
-}
-/** What a signer signs: the timestamp and the exact body bytes (decision 7). */
-interface WebhookSignRequest {
-    readonly scheme: WebhookSignatureScheme;
-    /** Resolved by the signer within `tenantId`; the package never holds key material. */
-    readonly secretRef: string;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly timestampSeconds: number;
-    readonly rawBody: string;
-}
-/**
- * Signs one attempt at send time. For `v1` it returns the `X-Fabric-Signature`
- * value `v1=<hex hmac-sha256(secret, "<timestampSeconds>.<rawBody>")>`. A
- * throw is classified `signer_unavailable` and retried.
- */
-interface WebhookSigner {
-    sign(request: WebhookSignRequest, options: WebhookCallOptions): Promise<string>;
-}
-/** One resolved address of a destination host. */
-interface WebhookResolvedAddress {
-    readonly address: string;
-    readonly family: 4 | 6;
-}
-/** A destination that passed the URL rules and whose every resolved answer is public. */
-interface WebhookVettedDestination {
-    readonly url: string;
-    /** Kept for SNI and certificate hostname verification. */
-    readonly hostname: string;
-    readonly port: 443;
-    /** The vetted addresses the transport posts to without re-resolving. */
-    readonly addresses: readonly WebhookResolvedAddress[];
-}
-/** The outcome of resolving a destination. Rejections carry a fixed code, never the URL's parts. */
-type WebhookDestinationResolution = {
-    readonly ok: true;
-    readonly destination: WebhookVettedDestination;
-} | {
-    readonly ok: false;
-    readonly code: "invalid_url" | "private_address" | "dns_failure";
-};
-/**
- * Validates a destination (`https:`, port 443 only, no userinfo) and resolves
- * it, requiring every answer to be public. Called at configuration change,
- * requeue and dispatch.
- */
-interface WebhookDestinationResolver {
-    resolve(url: string, options: WebhookCallOptions): Promise<WebhookDestinationResolution>;
-}
-/** One HTTP request handed to the transport. */
-interface WebhookTransportRequest {
-    readonly destination: WebhookVettedDestination;
-    readonly method: "POST";
-    readonly headers: Readonly<Record<string, string>>;
-    readonly body: string;
-}
-/**
- * What the transport observed. `not_sent` means the request never started
- * (deadline already passed, or the signal aborted while queued) and the
- * dispatcher releases the intent without spending budget. `timeout` covers a
- * deadline or abort after the request started. Response bodies are not
- * returned.
- */
-type WebhookTransportResult = {
-    readonly kind: "response";
-    readonly status: number;
-    readonly retryAfter?: string | null;
-} | {
-    readonly kind: "network_error" | "timeout" | "dns_failure" | "invalid_url" | "private_address";
-} | {
-    readonly kind: "not_sent";
-    readonly reason: "deadline_expired" | "aborted";
-};
-/**
- * Posts to the vetted address without re-resolving, verifies certificate and
- * hostname, refuses redirects and bounds the response. It must reject a
- * handoff whose deadline has passed and never start a request whose signal
- * aborted while queued (R3).
- */
-interface WebhookTransport {
-    send(request: WebhookTransportRequest, options: WebhookCallOptions): Promise<WebhookTransportResult>;
-}
-/** What admission decides about one (subscription revision, event). */
-interface WebhookAdmissionInput {
-    readonly subscriptionId: string;
-    readonly eligibilityRevision: number;
-    readonly event: WebhookEventMetadata;
-    readonly facts: WebhookJsonObject;
-    readonly actor: WebhookJobActor;
-}
-/**
- * Tri-state admission (decision 4). `unavailable` retries the job without
- * writing an intent; so does a throw or a timeout.
- */
-type WebhookAdmissionDecision = {
-    readonly decision: "allow";
-} | {
-    readonly decision: "deny";
-    readonly code: WebhookAdmissionDenialCode;
-} | {
-    readonly decision: "unavailable";
-};
-/** Decides whether an event may be delivered to a subscription at fan-out. */
-interface WebhookEventAdmission {
-    admit(input: WebhookAdmissionInput, options: WebhookCallOptions): Promise<WebhookAdmissionDecision>;
-}
-/** The attempt a delivery authorization check is about. */
-interface WebhookDeliveryAuthorizationInput {
-    readonly subscriptionId: string;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly eventId: string;
-    readonly deliveryId: string;
-    readonly configurationVersion: number;
-    readonly attempt: number;
-}
-/**
- * Per-attempt authorization (decision 4). `revoked` cancels the intent;
- * `unavailable`, a throw or a timeout defers it without spending budget.
- */
-type WebhookDeliveryAuthorizationDecision = {
-    readonly decision: "authorized";
-} | {
-    readonly decision: "revoked";
-    readonly code: WebhookRevocationCode;
-} | {
-    readonly decision: "unavailable";
-};
-/** Re-checks grant expiry, scope revocation and registration status before each attempt. */
-interface WebhookDeliveryAuthorization {
-    authorize(input: WebhookDeliveryAuthorizationInput, options: WebhookCallOptions): Promise<WebhookDeliveryAuthorizationDecision>;
-}
-/** The injected clock. */
-interface WebhookClock {
-    now(): Date;
-}
-/**
- * Delay in milliseconds before the next attempt, given the 1-based number of
- * the attempt that just failed. See `createWebhookRetryDelay`.
- */
-type WebhookRetryDelay = (attempt: number) => number;
-/** A random source returning a number in `[0, 1)`, injected so jitter is testable. */
-type WebhookRandomSource = () => number;
-/** What a scope predicate sees when deciding whether a scoped type may egress its payload. */
-interface WebhookScopeInput {
-    readonly subscriptionId: string;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly event: WebhookEventMetadata;
-    readonly facts: WebhookJsonObject;
-}
-/**
- * Synchronous scope predicate for scoped event types (decision 9). Only a
- * literal `true` lets the payload out; `false`, any other value, a throw or a
- * missing predicate renders metadata-only.
- */
-type WebhookScopePredicate = (input: WebhookScopeInput) => boolean;
-
-/** The longest destination URL accepted, in UTF-16 code units. */
-declare const WEBHOOK_DESTINATION_MAX_URL_LENGTH = 2048;
-/** The most addresses one lookup may return; a longer answer is refused as `dns_failure`. */
-declare const WEBHOOK_DESTINATION_MAX_ADDRESSES = 32;
-/** The default bound on one DNS lookup. */
-declare const DEFAULT_WEBHOOK_LOOKUP_TIMEOUT_MS = 5000;
-/** The result of checking a destination URL's rules, before any DNS lookup. */
-type WebhookDestinationUrlCheck = {
-    readonly ok: true;
-    /** `https://<host><path><query>`: normalized by WHATWG URL parsing, fragment dropped. */
-    readonly url: string;
-    /** The host without IPv6 brackets: the SNI name and certificate identity. */
-    readonly hostname: string;
-    /** Set when the host is an IP literal; it is the only address the destination may use. */
-    readonly literal?: WebhookResolvedAddress;
-} | {
-    readonly ok: false;
-    readonly code: "invalid_url" | "private_address";
-};
-/**
- * Check a destination URL against decision 6's rules without resolving it.
- * `invalid_url` when it is not a string of at most
- * {@link WEBHOOK_DESTINATION_MAX_URL_LENGTH} characters with no ASCII
- * control character or space, does not start with `https://` and a host
- * character (WHATWG would find a host in `https:host` or `https:///host`),
- * does not parse, is not `https:`, names a port
- * other than 443 (an explicit `:443` is the default and accepted), carries
- * userinfo, or has an empty host or one ending in `.`. `private_address` when
- * the host is `localhost` or a `.localhost` name, or an IP literal that is not
- * public ({@link isPublicWebhookAddress}). A public IP literal passes and is
- * returned as `literal`. IPv4 literals in decimal, hex, octal or shorthand
- * form are normalized to dotted-quad by URL parsing before they are checked.
- * Never throws.
- */
-declare function checkWebhookDestinationUrl(url: string): WebhookDestinationUrlCheck;
-/**
- * Looks up a hostname's addresses. It is passed `{ deadline, signal }`; the
- * resolver aborts `signal` when it stops waiting, and ignores any answer that
- * arrives after that. Each answer is `{ address, family }` with a textual IPv4
- * or IPv6 address. `createNodeWebhookDnsLookup()` at
- * `@fabricorg/webhook-delivery/node` is one implementation.
- */
-type WebhookDnsLookup = (hostname: string, options: WebhookCallOptions) => Promise<readonly WebhookResolvedAddress[]>;
-/** Options for {@link createWebhookDestinationResolver}. */
-interface WebhookDestinationResolverOptions {
-    readonly lookup: WebhookDnsLookup;
-    /** The longest one lookup may take; default {@link DEFAULT_WEBHOOK_LOOKUP_TIMEOUT_MS}. The call's own deadline also applies. */
-    readonly lookupTimeoutMs?: number;
-    /** The clock the call's deadline is compared with; the system clock by default. */
-    readonly clock?: WebhookClock;
-}
-/**
- * A {@link WebhookDestinationResolver} that applies
- * {@link checkWebhookDestinationUrl}, then resolves the host through the
- * injected lookup and requires every answer to be public. The vetted
- * destination it returns carries the addresses the transport must connect
- * to; the transport never resolves the name again, so a later answer (a DNS
- * rebinding) cannot change where the request goes.
- *
- * A URL that passes the rules resolves to `dns_failure`, never a pass, when
- * the call's signal has aborted, its deadline has passed or the clock cannot
- * be read (no lookup is made; this applies to IP literals too), when the
- * lookup throws, rejects, or has not answered within `lookupTimeoutMs` or by
- * the deadline (its signal is then aborted and a late answer ignored), when
- * an answer arrives but, once read, the signal has aborted, the clock cannot
- * be read or that lookup deadline has passed, or when its answer is empty,
- * longer than {@link WEBHOOK_DESTINATION_MAX_ADDRESSES}, or not a list of
- * `{ address, family }` records whose family matches the address. It is
- * `private_address` when any answer is a well-formed address that is not
- * public, whatever the others are. A public IP-literal host is returned
- * without a lookup.
- *
- * @throws {TypeError} `input_unreadable` at construction when `lookup` is not
- * a function or `clock` has no `now` function, and from `resolve` (as a
- * rejected promise) when `{ deadline, signal }` is not a real `Date` and
- * `AbortSignal`.
- * @throws {WebhookDeliveryConfigError} when `lookupTimeoutMs` is not positive,
- * finite and at most `WEBHOOK_MAX_TIMER_MS`.
- */
-declare function createWebhookDestinationResolver(options: WebhookDestinationResolverOptions): WebhookDestinationResolver;
-
-export { type WebhookAdmissionDecision as $, type WebhookAttemptBeginResult as A, type WebhookDeliveryAttemptFinish as B, type WebhookDeliveryAttemptLogEntry as C, type WebhookRequeueEvidence as D, type WebhookTombstone as E, type WebhookPurgeResult as F, type WebhookSubscriptionStore as G, type WebhookSubscriptionWriter as H, type WebhookEligibilityRevision as I, type WebhookSubscriptionSnapshot as J, type WebhookDeliveryConfigurationInput as K, type WebhookSubscriptionWriteResult as L, type WebhookSubscriptionTransitionInput as M, type WebhookConfigurationWriteResult as N, type WebhookRandomSource as O, type WebhookRetryDelay as P, type WebhookAttemptOutcome as Q, type WebhookAttemptReasonCode as R, type WebhookTransportResult as S, type WebhookPayloadPolicy as T, type WebhookJobActor as U, type WebhookEventMetadata as V, type WebhookConfigErrorCode as W, type WebhookSourceEnvelope as X, type WebhookJsonObject as Y, type WebhookScopePredicate as Z, type WebhookDeliveryBodyV1 as _, type WebhookDeliveryErrorCode as a, type WebhookDeliveryAuthorizationDecision as a0, type WebhookAdmissionDenialCode as a1, type WebhookEventAdmission as a2, type WebhookDeliveryAuthorization as a3, type WebhookSigner as a4, type WebhookDestinationResolver as a5, type WebhookTransport as a6, DEFAULT_WEBHOOK_LOOKUP_TIMEOUT_MS as a7, WEBHOOK_ACTION_REFUSAL_CODES as a8, WEBHOOK_ADMISSION_DENIAL_CODES as a9, type WebhookJsonValue as aA, type WebhookLease as aB, type WebhookResolvedAddress as aC, type WebhookRevocationCode as aD, type WebhookScopeInput as aE, type WebhookSignRequest as aF, type WebhookSignatureScheme as aG, type WebhookSubscriptionStatus as aH, type WebhookSubscriptionWriteRefusal as aI, type WebhookTransportRequest as aJ, type WebhookVettedDestination as aK, checkWebhookDestinationUrl as aL, createWebhookDestinationResolver as aM, WEBHOOK_ATTEMPT_OUTCOMES as aa, WEBHOOK_ATTEMPT_REASON_CODES as ab, WEBHOOK_CONFIG_ERROR_CODES as ac, WEBHOOK_DELIVERY_ERROR_CODES as ad, WEBHOOK_DESTINATION_MAX_ADDRESSES as ae, WEBHOOK_DESTINATION_MAX_URL_LENGTH as af, WEBHOOK_DIAGNOSTIC_CODES as ag, WEBHOOK_FAN_OUT_ERROR_CODES as ah, WEBHOOK_GOVERNED_ACTION_ERROR_CODES as ai, WEBHOOK_INPUT_ERROR_CODES as aj, WEBHOOK_PROJECTION_ERROR_CODES as ak, WEBHOOK_REVOCATION_CODES as al, WEBHOOK_STORE_ERROR_CODES as am, type WebhookActionRefusalCode as an, type WebhookAdmissionInput as ao, type WebhookDeliveryAttemptInFlight as ap, type WebhookDeliveryAuthorizationInput as aq, type WebhookDeliveryConfiguration as ar, type WebhookDeliveryIntentStatus as as, type WebhookDestinationResolution as at, type WebhookDestinationResolverOptions as au, type WebhookDestinationUrlCheck as av, type WebhookDnsLookup as aw, type WebhookEventTypePolicy as ax, type WebhookFanOutJobStatus as ay, type WebhookInputErrorCode as az, type WebhookFanOutErrorCode as b, type WebhookGovernedActionErrorCode as c, type WebhookProjectionErrorCode as d, type WebhookStoreErrorCode as e, type WebhookDeliveryStore as f, type WebhookClock as g, type WebhookFanOutJobDraft as h, type WebhookCallOptions as i, type WebhookInsertResult as j, type WebhookClaimRequest as k, type WebhookFanOutJob as l, type WebhookFencedWrite as m, type WebhookDiagnosticCode as n, type WebhookScope as o, type WebhookRequeueRequest as p, type WebhookRequeueResult as q, type WebhookActorEnrichmentRequest as r, type WebhookActorEnrichmentResult as s, type WebhookDeliveryIntent as t, type WebhookFanOutJobFence as u, type WebhookFencedInsertResult as v, type WebhookAdmissionDenialRecord as w, type WebhookDeliveryLeaseCheck as x, type WebhookDeliveryAttemptRecord as y, type WebhookDeliveryAttemptStart as z };