@fabricorg/webhook-delivery 0.1.1 → 0.1.3

package/dist/index.d.cts

@@ -1,30 +1,205 @@
-import { W as WebhookConfigErrorCode, a as WebhookDeliveryErrorCode, b as WebhookFanOutErrorCode, c as WebhookGovernedActionErrorCode, d as WebhookProjectionErrorCode, e as WebhookStoreErrorCode, f as WebhookDeliveryStore, g as WebhookClock, h as WebhookFanOutJobDraft, i as WebhookCallOptions, j as WebhookInsertResult, k as WebhookClaimRequest, l as WebhookFanOutJob, m as WebhookFencedWrite, n as WebhookDiagnosticCode, o as WebhookScope, p as WebhookRequeueRequest, q as WebhookRequeueResult, r as WebhookActorEnrichmentRequest, s as WebhookActorEnrichmentResult, t as WebhookDeliveryIntent, u as WebhookFanOutJobFence, v as WebhookFencedInsertResult, w as WebhookAdmissionDenialRecord, x as WebhookDeliveryLeaseCheck, y as WebhookDeliveryAttemptRecord, z as WebhookDeliveryAttemptStart, A as WebhookAttemptBeginResult, B as WebhookDeliveryAttemptFinish, C as WebhookDeliveryAttemptLogEntry, D as WebhookRequeueEvidence, E as WebhookTombstone, F as WebhookPurgeResult, G as WebhookSubscriptionStore, H as WebhookSubscriptionWriter, I as WebhookEligibilityRevision, J as WebhookSubscriptionSnapshot, K as WebhookDeliveryConfigurationInput, L as WebhookSubscriptionWriteResult, M as WebhookSubscriptionTransitionInput, N as WebhookConfigurationWriteResult, O as WebhookRandomSource, P as WebhookRetryDelay, Q as WebhookAttemptOutcome, R as WebhookAttemptReasonCode, S as WebhookTransportResult, T as WebhookPayloadPolicy, U as WebhookJobActor, V as WebhookEventMetadata, X as WebhookSourceEnvelope, Y as WebhookJsonObject, Z as WebhookScopePredicate, _ as WebhookDeliveryBodyV1, $ as WebhookAdmissionDecision, a0 as WebhookDeliveryAuthorizationDecision, a1 as WebhookAdmissionDenialCode, a2 as WebhookEventAdmission, a3 as WebhookDeliveryAuthorization, a4 as WebhookSigner, a5 as WebhookDestinationResolver, a6 as WebhookTransport } from './destination-joCBtgvY.cjs';
-export { a7 as DEFAULT_WEBHOOK_LOOKUP_TIMEOUT_MS, a8 as WEBHOOK_ACTION_REFUSAL_CODES, a9 as WEBHOOK_ADMISSION_DENIAL_CODES, aa as WEBHOOK_ATTEMPT_OUTCOMES, ab as WEBHOOK_ATTEMPT_REASON_CODES, ac as WEBHOOK_CONFIG_ERROR_CODES, ad as WEBHOOK_DELIVERY_ERROR_CODES, ae as WEBHOOK_DESTINATION_MAX_ADDRESSES, af as WEBHOOK_DESTINATION_MAX_URL_LENGTH, ag as WEBHOOK_DIAGNOSTIC_CODES, ah as WEBHOOK_FAN_OUT_ERROR_CODES, ai as WEBHOOK_GOVERNED_ACTION_ERROR_CODES, aj as WEBHOOK_INPUT_ERROR_CODES, ak as WEBHOOK_PROJECTION_ERROR_CODES, al as WEBHOOK_REVOCATION_CODES, am as WEBHOOK_STORE_ERROR_CODES, an as WebhookActionRefusalCode, ao as WebhookAdmissionInput, ap as WebhookDeliveryAttemptInFlight, aq as WebhookDeliveryAuthorizationInput, ar as WebhookDeliveryConfiguration, as as WebhookDeliveryIntentStatus, at as WebhookDestinationResolution, au as WebhookDestinationResolverOptions, av as WebhookDestinationUrlCheck, aw as WebhookDnsLookup, ax as WebhookEventTypePolicy, ay as WebhookFanOutJobStatus, az as WebhookInputErrorCode, aA as WebhookJsonValue, aB as WebhookLease, aC as WebhookResolvedAddress, aD as WebhookRevocationCode, aE as WebhookScopeInput, aF as WebhookSignRequest, aG as WebhookSignatureScheme, aH as WebhookSubscriptionStatus, aI as WebhookSubscriptionWriteRefusal, aJ as WebhookTransportRequest, aK as WebhookVettedDestination, aL as checkWebhookDestinationUrl, aM as createWebhookDestinationResolver } from './destination-joCBtgvY.cjs';
-import { EnterpriseEventPublisher } from '@fabricorg/platform-host';
-import { FabricModule } from '@fabricorg/platform';
-
+import { EnterpriseEventEnvelope, EnterpriseEventPublisher, EventPayloadClassification } from "@fabricorg/platform-host";
+import { FabricModule } from "@fabricorg/platform";
+//#region src/codes.d.ts
+/**
+ * Fixed code sets. Stored diagnostics, denial reasons and attempt outcomes are
+ * typed as one of these codes rather than a free string or a port's error
+ * message (ADR 0018 decision 2), so a thrown error has no field through which
+ * to carry payload, secret or response-body text into a durable record. The
+ * arrays are frozen, so no caller can widen a set at runtime.
+ */
+/** Reasons an admission port may give for `deny`. */
+export declare const WEBHOOK_ADMISSION_DENIAL_CODES: readonly ["actor_not_permitted", "scope_not_permitted", "event_type_not_permitted", "classification_not_permitted", "policy_denied"];
+/** A reason code carried by an admission `deny` decision and stored on its denial record. */
+type WebhookAdmissionDenialCode = (typeof WEBHOOK_ADMISSION_DENIAL_CODES)[number];
+/** Reasons a delivery authorization port may give for `revoked`. */
+export declare const WEBHOOK_REVOCATION_CODES: readonly ["grant_expired", "scope_revoked", "registration_inactive"];
+/** A reason code carried by a delivery authorization `revoked` decision. */
+type WebhookRevocationCode = (typeof WEBHOOK_REVOCATION_CODES)[number];
+/**
+ * Diagnostics stored on a fan-out job or delivery intent when a port failed,
+ * timed out or a coordination check refused the work. A port exception is
+ * stored as the code for that port, not as its message.
+ *
+ * Three are written only by the fan-out cycle: `eligibility_unsettled` when
+ * it defers a job until its event's eligibility is settled (README,
+ * "Fan-out"), `intent_build_failed` when it could not render a body or
+ * create a delivery id for an admitted subscription, and `job_unreadable`
+ * when it dead-letters a claimed job whose identity and lease it could read
+ * but whose body it could not.
+ *
+ * Three are written only by the delivery cycle (README, "Delivery"):
+ * `intent_unreadable` when it dead-letters a claimed intent whose identity
+ * and lease it could read but whose body it could not,
+ * `subscription_not_in_scope` when the intent's subscription does not exist
+ * in the intent's tenant and space, or the store's answer names another
+ * one, and `transport_not_sent` when the transport returned `not_sent` for
+ * a request it never started.
+ */
+export declare const WEBHOOK_DIAGNOSTIC_CODES: readonly ["admission_unavailable", "authorization_unavailable", "subscription_store_unavailable", "delivery_store_unavailable", "signer_unavailable", "resolver_unavailable", "port_timeout", "scope_predicate_failed", "configuration_conflict", "lease_lost", "intent_not_pending", "processing_deadline_exceeded", "eligibility_unsettled", "intent_build_failed", "job_unreadable", "intent_unreadable", "subscription_not_in_scope", "transport_not_sent"];
+/** A stored diagnostic code for a port failure or refused coordination check. */
+type WebhookDiagnosticCode = (typeof WEBHOOK_DIAGNOSTIC_CODES)[number];
+/**
+ * What a delivery attempt's observation means for its intent (ADR 0018
+ * decision 10). `not_sent` is never a classification: the delivery cycle
+ * records it, with the reason `not_sent`, on an attempt it began under the
+ * intent's lease and handed to the transport, when the transport answered
+ * that it never started the request (its deadline had passed or its signal
+ * had aborted while the request was queued). Such an attempt spends no budget.
+ */
+export declare const WEBHOOK_ATTEMPT_OUTCOMES: readonly ["delivered", "retryable", "dead_letter", "cancelled", "not_sent"];
+/**
+ * The classified result of one attempt. A 401 or 403 is `retryable` like any
+ * other row of that kind; its `http_401` / `http_403` reason and the
+ * classification's `receiverActionLikely` flag let the caller surface it to
+ * operators before the retry budget is exhausted.
+ */
+type WebhookAttemptOutcome = (typeof WEBHOOK_ATTEMPT_OUTCOMES)[number];
+/** The row of decision 10's table an observation matched. */
+export declare const WEBHOOK_ATTEMPT_REASON_CODES: readonly ["http_2xx", "network_error", "timeout", "dns_failure", "http_408", "http_425", "http_429", "http_5xx", "signer_unavailable", "http_401", "http_403", "http_1xx", "http_3xx", "http_410", "http_4xx", "invalid_url", "private_address", "authorization_revoked", "subscription_paused", "subscription_deleted", "not_sent"];
+/** The reason code recorded with an attempt outcome. */
+type WebhookAttemptReasonCode = (typeof WEBHOOK_ATTEMPT_REASON_CODES)[number];
+/** Codes on {@link WebhookDeliveryConfigError}. */
+export declare const WEBHOOK_CONFIG_ERROR_CODES: readonly ["limit_not_positive_finite", "limit_not_integer", "limit_out_of_range", "retry_schedule_empty", "limit_unreadable"];
+/** Why a configured limit was rejected. */
+type WebhookConfigErrorCode = (typeof WEBHOOK_CONFIG_ERROR_CODES)[number];
+/** Codes on {@link WebhookProjectionError}. */
+export declare const WEBHOOK_PROJECTION_ERROR_CODES: readonly ["invalid_envelope", "payload_field_not_json", "fact_field_not_json", "accessor_property", "inspection_failed", "scope_mismatch"];
+/** Why an envelope could not be projected. */
+type WebhookProjectionErrorCode = (typeof WEBHOOK_PROJECTION_ERROR_CODES)[number];
+/**
+ * Codes on the `TypeError` and `RangeError` instances this package throws
+ * for malformed call input (headers, classification, retry, admission).
+ * Each code has one constant message; neither repeats the input.
+ */
+export declare const WEBHOOK_INPUT_ERROR_CODES: readonly ["input_unreadable", "observation_unknown", "status_out_of_range", "signature_malformed", "timestamp_invalid", "event_id_invalid", "delivery_id_invalid", "attempt_invalid", "raw_body_not_string", "random_source_missing", "random_sample_invalid", "random_source_failed", "denial_code_unknown"];
+/** Why call input was refused. */
+type WebhookInputErrorCode = (typeof WEBHOOK_INPUT_ERROR_CODES)[number];
+/**
+ * Codes on {@link WebhookStoreError}: a store call that was malformed, broke
+ * a store invariant, or was no longer wanted when the store reached its
+ * write. Refusals the caller is expected to handle (a lost lease, an
+ * existing key, a replay past the horizon, a requeue of a record that is not
+ * dead-lettered) are results, not errors.
+ */
+export declare const WEBHOOK_STORE_ERROR_CODES: readonly ["input_invalid", "record_mismatch", "delivery_id_conflict", "call_aborted", "deadline_passed", "clock_invalid", "store_failed"];
+/** Why a store call was refused. */
+type WebhookStoreErrorCode = (typeof WEBHOOK_STORE_ERROR_CODES)[number];
+/**
+ * Codes on {@link WebhookFanOutError}: why the fan-out publisher, the
+ * composite publisher or the fan-out cycle refused or failed. A publisher
+ * rejection makes the Host relay retry and, once its budget is spent,
+ * dead-letter the outbox record, so a failed publish stays visible there.
+ *
+ * - `event_past_replay_horizon`: `insertFanOutJob` answered `past_horizon`.
+ *   The event is older than the replay horizon (R5), so no job can be stored
+ *   and the publish fails rather than counting as delivered.
+ * - `fan_out_store_failed` / `fan_out_store_timeout`: the publisher's job
+ *   insert or the cycle's claim threw, or did not settle within
+ *   `portTimeoutMs`. Store failures later in a cycle reschedule the job
+ *   with a diagnostic instead.
+ * - `publish_aborted`: the caller's signal aborted before the store answered.
+ * - `sink_failed`: a required sink of a composite publisher rejected with an
+ *   error this package did not create.
+ * - `sink_timeout`: a required sink of a composite publisher did not settle
+ *   within the composite's `sinkTimeoutMs`.
+ * - `clock_invalid`: the injected clock threw or returned an invalid time.
+ * - `options_invalid`: an option is missing or has the wrong shape.
+ */
+export declare const WEBHOOK_FAN_OUT_ERROR_CODES: readonly ["event_past_replay_horizon", "fan_out_store_failed", "fan_out_store_timeout", "publish_aborted", "sink_failed", "sink_timeout", "clock_invalid", "options_invalid"];
+/** Why a fan-out publish or cycle failed. */
+type WebhookFanOutErrorCode = (typeof WEBHOOK_FAN_OUT_ERROR_CODES)[number];
+/**
+ * Codes on {@link WebhookDeliveryError}: why the delivery cycle could not
+ * run. Everything that goes wrong while one claimed intent is processed is
+ * settled on that intent with a fixed code instead (README, "Delivery").
+ *
+ * - `delivery_store_failed` / `delivery_store_timeout`: the claim threw or
+ *   answered something unreadable, or did not settle within `portTimeoutMs`.
+ * - `clock_invalid`: the injected clock threw or returned an invalid time.
+ * - `options_invalid`: an option or port is missing or has the wrong shape.
+ */
+export declare const WEBHOOK_DELIVERY_ERROR_CODES: readonly ["delivery_store_failed", "delivery_store_timeout", "clock_invalid", "options_invalid"];
+/** Why a delivery cycle failed. */
+type WebhookDeliveryErrorCode = (typeof WEBHOOK_DELIVERY_ERROR_CODES)[number];
+/**
+ * Why a governed action (PR 9; README, "Governed actions") refused. At
+ * submission, the action's admission check refuses with
+ * `webhook_action_refused:<code>` (or `webhook_parameters_refused:<code>:<field>`
+ * with a code from `WEBHOOK_ACTION_PARAMETER_CODES`) and Host records nothing.
+ * At execution, the action fails with Host's `error` set to
+ * `webhook_action_refused:<code>`, writes nothing more and emits no event.
+ *
+ * - `admission_not_enforced`: the handler ran without Host's record that the
+ *   submission was admitted (`ActionContext.admittedAt`), as under a Host
+ *   older than 7.3.0, which ignores `admitSubmission`. Nothing is written.
+ * - `scope_invalid` / `actor_invalid`: Host's trusted context names a tenant,
+ *   space or actor that breaks the store identifier rule.
+ * - `secret_ref_invalid`: the application's secret store says the reference
+ *   names no secret of this tenant. `secret_ref_unverified`: the check threw,
+ *   timed out or answered something unreadable.
+ * - `secret_ref_unchanged`: a rotation named the reference already in use.
+ * - `destination_refused`: the resolver refused the URL (`invalid_url`,
+ *   `private_address`). `destination_unresolved`: it answered `dns_failure`,
+ *   threw or timed out. Neither writes anything.
+ * - `subscription_not_found`, `subscription_exists`, `subscription_deleted`,
+ *   `invalid_transition`, `revision_conflict`, `version_conflict`: the
+ *   subscription store refused the write, or the action's own read found
+ *   the same. `subscription_not_active`: an intent requeue for a paused or
+ *   deleted subscription. `paused_since_intent`: an intent requeue for an
+ *   active subscription that was paused and resumed after the intent's
+ *   eligibility revision; dispatch would cancel it (decision 3).
+ * - `not_found`, `stale`, `not_dead_letter`, `past_replay_horizon`: the
+ *   delivery store refused a requeue or enrichment (decision 10, R5).
+ * - `not_enrichable`, `actor_present`, `actor_suppressed`: enrichment of a
+ *   completed job, or of a job whose actor is not `legacy` (decision 5).
+ *   `actor_withheld`, `actor_not_found`, `actor_unavailable`: the
+ *   application's actor reader withheld the actor, found no such event, or
+ *   threw, timed out or answered something unreadable.
+ * - `store_unavailable`: a read threw, timed out or answered something
+ *   unreadable; nothing was written. `store_outcome_unknown`: a write threw,
+ *   timed out or answered something unreadable, so it may have applied
+ *   (README, "A store write that timed out is unknown"); also a re-run of an
+ *   intent requeue whose evidence predates `subscriptionId` and whose intent
+ *   can no longer be read, so the applied requeue has no event (README,
+ *   "Atomicity and re-runs").
+ * - `action_failed`: anything else, such as a failing clock; nothing it
+ *   threw is read.
+ */
+export declare const WEBHOOK_ACTION_REFUSAL_CODES: readonly ["admission_not_enforced", "scope_invalid", "actor_invalid", "secret_ref_invalid", "secret_ref_unverified", "secret_ref_unchanged", "destination_refused", "destination_unresolved", "subscription_not_found", "subscription_exists", "subscription_deleted", "subscription_not_active", "paused_since_intent", "invalid_transition", "revision_conflict", "version_conflict", "not_found", "stale", "not_dead_letter", "past_replay_horizon", "not_enrichable", "actor_present", "actor_suppressed", "actor_withheld", "actor_not_found", "actor_unavailable", "store_unavailable", "store_outcome_unknown", "action_failed"];
+/** Why a governed action refused. */
+type WebhookActionRefusalCode = (typeof WEBHOOK_ACTION_REFUSAL_CODES)[number];
+/**
+ * Codes on {@link WebhookGovernedActionError}: `options_invalid`, a module
+ * option or port is missing or has the wrong shape.
+ */
+export declare const WEBHOOK_GOVERNED_ACTION_ERROR_CODES: readonly ["options_invalid"];
+/** Why the governed-action module could not be built. */
+type WebhookGovernedActionErrorCode = (typeof WEBHOOK_GOVERNED_ACTION_ERROR_CODES)[number];
+//#endregion
+//#region src/errors.d.ts
 /**
  * A configured limit was not usable: zero, negative, `NaN`, infinite, not an
  * integer where a count is required, outside its documented range, or not
  * readable as plain data. The message is constant for the code; `field`
  * names the limit, for example `deliveryRetryDelaysMs[2]`.
  */
-declare class WebhookDeliveryConfigError extends Error {
-    readonly code: WebhookConfigErrorCode;
-    /** The limit that was rejected, for example `deliveryRetryDelaysMs[2]`. */
-    readonly field: string;
-    constructor(code: WebhookConfigErrorCode, field: string);
+export declare class WebhookDeliveryConfigError extends Error {
+  readonly code: WebhookConfigErrorCode;
+  /** The limit that was rejected, for example `deliveryRetryDelaysMs[2]`. */
+  readonly field: string;
+  constructor(code: WebhookConfigErrorCode, field: string);
 }
 /**
  * An envelope, job or subscription could not be projected. The message is
  * constant for the code. `field` names an envelope or job field, an option,
  * or a field name from the caller's own allowlist; never a value.
  */
-declare class WebhookProjectionError extends Error {
-    readonly code: WebhookProjectionErrorCode;
-    /** The envelope, job, option or allowlisted payload field at fault. */
-    readonly field: string;
-    constructor(code: WebhookProjectionErrorCode, field: string);
+export declare class WebhookProjectionError extends Error {
+  readonly code: WebhookProjectionErrorCode;
+  /** The envelope, job, option or allowlisted payload field at fault. */
+  readonly field: string;
+  constructor(code: WebhookProjectionErrorCode, field: string);
 }
 /**
  * A store call was refused: its input was malformed or not plain data
@@ -34,11 +209,11 @@ declare class WebhookProjectionError extends Error {
  * store's clock failed (`clock_invalid`). Nothing was written. The message
  * is constant for the code; `field` names an input field, never a value.
  */
-declare class WebhookStoreError extends Error {
-    readonly code: WebhookStoreErrorCode;
-    /** The input field at fault, for example `intent.eventId`. */
-    readonly field: string;
-    constructor(code: WebhookStoreErrorCode, field: string);
+export declare class WebhookStoreError extends Error {
+  readonly code: WebhookStoreErrorCode;
+  /** The input field at fault, for example `intent.eventId`. */
+  readonly field: string;
+  constructor(code: WebhookStoreErrorCode, field: string);
 }
 /**
  * The fan-out publisher, the composite publisher or the fan-out cycle refused
@@ -46,49 +221,1222 @@ declare class WebhookStoreError extends Error {
  * code; `field` names an option, a store method or a sink name from the
  * application's own configuration, never an event value.
  */
-declare class WebhookFanOutError extends Error {
-    readonly code: WebhookFanOutErrorCode;
-    /** The option, store method or sink at fault, for example `insertFanOutJob`. */
-    readonly field: string;
-    constructor(code: WebhookFanOutErrorCode, field: string);
+export declare class WebhookFanOutError extends Error {
+  readonly code: WebhookFanOutErrorCode;
+  /** The option, store method or sink at fault, for example `insertFanOutJob`. */
+  readonly field: string;
+  constructor(code: WebhookFanOutErrorCode, field: string);
 }
 /**
  * The delivery cycle could not run (`WEBHOOK_DELIVERY_ERROR_CODES`). The
  * message is constant for the code; `field` names an option or a store
  * method, never a value.
  */
-declare class WebhookDeliveryError extends Error {
-    readonly code: WebhookDeliveryErrorCode;
-    /** The option or store method at fault, for example `claimDeliveryIntents`. */
-    readonly field: string;
-    constructor(code: WebhookDeliveryErrorCode, field: string);
+export declare class WebhookDeliveryError extends Error {
+  readonly code: WebhookDeliveryErrorCode;
+  /** The option or store method at fault, for example `claimDeliveryIntents`. */
+  readonly field: string;
+  constructor(code: WebhookDeliveryErrorCode, field: string);
 }
 /**
  * The governed-action module could not be built
  * (`WEBHOOK_GOVERNED_ACTION_ERROR_CODES`). The message is constant for the
  * code; `field` names an option, never a value.
  */
-declare class WebhookGovernedActionError extends Error {
-    readonly code: WebhookGovernedActionErrorCode;
-    /** The option at fault, for example `secretReferences.verify`. */
-    readonly field: string;
-    constructor(code: WebhookGovernedActionErrorCode, field: string);
+export declare class WebhookGovernedActionError extends Error {
+  readonly code: WebhookGovernedActionErrorCode;
+  /** The option at fault, for example `secretReferences.verify`. */
+  readonly field: string;
+  constructor(code: WebhookGovernedActionErrorCode, field: string);
+}
+//#endregion
+//#region src/types.d.ts
+/** A JSON value. Every record this package defines is built from these. */
+type WebhookJsonValue = null | boolean | number | string | readonly WebhookJsonValue[] | {
+  readonly [key: string]: WebhookJsonValue;
+};
+/** A JSON object. */
+type WebhookJsonObject = {
+  readonly [key: string]: WebhookJsonValue;
+};
+/** The Host envelope this package consumes, re-exported for adapters. */
+type WebhookSourceEnvelope = EnterpriseEventEnvelope;
+/**
+ * The envelope metadata a fan-out job keeps: everything that identifies,
+ * orders and classifies the event, and nothing from its payload, trace
+ * context or provenance. Timestamps are ISO-8601 strings so the record is
+ * serializable.
+ */
+interface WebhookEventMetadata {
+  readonly eventId: string;
+  readonly eventType: string;
+  readonly eventSchemaVersion: number;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly subjectType: string;
+  readonly subjectId: string;
+  /** The tenant/space ledger cursor. Delivery order is not guaranteed. */
+  readonly sequence: number;
+  readonly actionInvocationId?: string;
+  readonly correlationId: string;
+  readonly causationId?: string;
+  readonly occurredAt: string;
+  /** Stamped by Host's clock; selects the eligibility revision (decision 3). */
+  readonly recordedAt: string;
+  readonly producerModuleVersion: string;
+  readonly payloadClassification: EventPayloadClassification;
+  /** Present only when the producing action declared it. */
+  readonly consistency?: "authoritative-now" | "provisional-until-reconciled";
+}
+/**
+ * The actor a job carries for admission, or why it carries none (decision 5).
+ * `suppressed`: Host's `includeActor` hook excluded it. `legacy`: the envelope
+ * predates the actor field. Admission that needs an actor treats both
+ * absences as `unavailable`. The actor is never rendered into a v1 body.
+ */
+type WebhookJobActor = {
+  readonly state: "present";
+  readonly actorId: string;
+  readonly actorType: string;
+} | {
+  readonly state: "absent";
+  readonly reason: "suppressed" | "legacy";
+};
+/**
+ * What the application allows to leave for one event type (decision 9).
+ * Field names are top-level payload keys. An event type with no entry goes
+ * out metadata-only.
+ */
+interface WebhookEventTypePolicy {
+  /** Payload fields that may be persisted on the job and rendered into the body. */
+  readonly fields: readonly string[];
+  /**
+   * Payload fields admission and scope predicates need. They are persisted on
+   * the job as facts and are never rendered into the body unless also listed
+   * in `fields`.
+   */
+  readonly facts?: readonly string[];
+  /** A `restricted` event is metadata-only, and keeps no payload or facts, unless this is `true`. */
+  readonly includeRestricted?: boolean;
+  /** A scoped type egresses its payload only when the injected scope predicate returns `true`. */
+  readonly scoped?: boolean;
+}
+/** Egress policy keyed by event type. Only own properties are consulted. */
+type WebhookPayloadPolicy = {
+  readonly [eventType: string]: WebhookEventTypePolicy;
+};
+/**
+ * The persistence projection of one envelope (decision 2): what the fan-out
+ * publisher inserts, keyed by `eventId`. It holds metadata, the allowlisted
+ * payload fields and the declared facts only.
+ */
+interface WebhookFanOutJobDraft {
+  readonly eventId: string;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly event: WebhookEventMetadata;
+  /** Allowlisted payload fields, or `null` when the event is metadata-only. */
+  readonly payload: WebhookJsonObject | null;
+  /** `true` exactly when `payload` is not `null`. */
+  readonly payloadProjected: boolean;
+  /** Declared admission and scope facts; empty when none are declared or allowed. */
+  readonly facts: WebhookJsonObject;
+  readonly actor: WebhookJobActor;
+}
+/** A fenced lease. A write carrying an older `fence` than the record's is refused. */
+interface WebhookLease {
+  readonly owner: string;
+  readonly fence: number;
+  readonly expiresAt: string;
+}
+/** Fan-out job lifecycle. */
+type WebhookFanOutJobStatus = "pending" | "completed" | "dead_letter";
+/** A stored fan-out job. */
+interface WebhookFanOutJob extends WebhookFanOutJobDraft {
+  readonly status: WebhookFanOutJobStatus;
+  readonly attemptCount: number;
+  readonly availableAt: string;
+  /** Persisted at creation; deferrals and reclaims count toward it (R4). */
+  readonly processingDeadline: string;
+  readonly createdAt: string;
+  readonly completedAt?: string;
+  readonly lastDiagnostic?: WebhookDiagnosticCode;
+  /**
+   * The record's fence: the dead-letter generation a requeue must name.
+   * Each claim and each applied requeue advances it, so a requeue built
+   * from an earlier read is refused as `stale` (decision 10).
+   */
+  readonly fence: number;
+  readonly lease?: WebhookLease;
+}
+/** Subscription lifecycle state recorded on each eligibility revision and configuration read. */
+type WebhookSubscriptionStatus = "active" | "paused" | "deleted";
+/**
+ * An immutable eligibility revision (decision 3). Create, pattern change,
+ * pause and resume each write one. The interval is half-open:
+ * `effectiveFrom <= recordedAt < effectiveUntil`, with `null` meaning open.
+ */
+interface WebhookEligibilityRevision {
+  readonly subscriptionId: string;
+  readonly revision: number;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly status: WebhookSubscriptionStatus;
+  readonly eventTypePatterns: readonly string[];
+  readonly effectiveFrom: string;
+  readonly effectiveUntil: string | null;
+}
+/** The only signature scheme in v1 (decision 7). */
+type WebhookSignatureScheme = "v1";
+/**
+ * One version of a subscription's delivery configuration. Intents store no
+ * destination; attempts record the version they used. The secret is a
+ * reference resolved by the signer within the subscription's tenant, never
+ * key material (decision 8).
+ */
+interface WebhookDeliveryConfiguration {
+  readonly subscriptionId: string;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly version: number;
+  readonly destinationUrl: string;
+  readonly signatureScheme: WebhookSignatureScheme;
+  readonly secretRef: string;
+}
+/** What the dispatch check reads for one subscription. */
+interface WebhookSubscriptionSnapshot {
+  readonly subscriptionId: string;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly status: WebhookSubscriptionStatus;
+  /**
+   * The eligibility revision at which the subscription entered `status`: 1
+   * when it has never been paused, otherwise its latest pause, resume or
+   * delete revision (a pattern change keeps the status, so it does not
+   * move this). Read in the same atomic step as `status`. While the
+   * subscription is active, an intent bound to a lower revision belongs to
+   * an interval a pause ended, and dispatch cancels it (decision 3;
+   * README, "Pause and resume are enforced at dispatch").
+   */
+  readonly statusSinceRevision: number;
+  readonly configuration: WebhookDeliveryConfiguration;
+}
+/** Delivery intent lifecycle. */
+type WebhookDeliveryIntentStatus = "pending" | "delivered" | "dead_letter" | "cancelled";
+/** One intent per (subscriptionId, eventId), holding the rendered body (decision 9). */
+interface WebhookDeliveryIntent {
+  readonly deliveryId: string;
+  readonly subscriptionId: string;
+  readonly eventId: string;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly eligibilityRevision: number;
+  /**
+   * The event's `recordedAt`, copied by the store from the parent fan-out
+   * job when the intent is inserted. It anchors the replay horizon (R5).
+   */
+  readonly eventRecordedAt: string;
+  /** The rendered `fabric.webhook-delivery.v1` body, signed byte-for-byte per attempt. */
+  readonly body: string;
+  readonly status: WebhookDeliveryIntentStatus;
+  readonly attemptCount: number;
+  readonly availableAt: string;
+  readonly processingDeadline: string;
+  readonly createdAt: string;
+  readonly lastOutcome?: {
+    readonly outcome: WebhookAttemptOutcome;
+    readonly reason: WebhookAttemptReasonCode;
+  };
+  readonly lastDiagnostic?: WebhookDiagnosticCode;
+  /**
+   * The record's fence: the dead-letter generation a requeue must name.
+   * Each claim and each applied requeue advances it, so a requeue built
+   * from an earlier read is refused as `stale` (decision 10).
+   */
+  readonly fence: number;
+  readonly lease?: WebhookLease;
+}
+/** A recorded admission denial; it satisfies completeness for its (subscription, event). */
+interface WebhookAdmissionDenialRecord {
+  readonly subscriptionId: string;
+  readonly eventId: string;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly eligibilityRevision: number;
+  readonly code: WebhookAdmissionDenialCode;
+  readonly recordedAt: string;
+}
+/**
+ * An attempt log entry with its outcome. Response bodies are never
+ * persisted. An entry appended whole by `appendAttempt` has no `fence`; one
+ * begun by `beginAttempt` and finished by `finishAttempt` carries the
+ * intent's lease fence it was begun under.
+ */
+interface WebhookDeliveryAttemptRecord {
+  readonly deliveryId: string;
+  readonly subscriptionId: string;
+  readonly eventId: string;
+  readonly attempt: number;
+  readonly configurationVersion: number;
+  readonly startedAt: string;
+  readonly finishedAt: string;
+  readonly outcome: WebhookAttemptOutcome;
+  readonly reason: WebhookAttemptReasonCode;
+  readonly httpStatus?: number;
+  /** The intent lease fence the attempt was begun under; absent for an entry appended whole. */
+  readonly fence?: number;
+}
+/**
+ * What `beginAttempt` records, under the intent's lease, immediately before
+ * the request is handed to the transport (README, "Delivery": the
+ * irrevocable point). The configuration version is the one the request is
+ * signed and addressed with.
+ */
+interface WebhookDeliveryAttemptStart {
+  readonly deliveryId: string;
+  readonly subscriptionId: string;
+  readonly eventId: string;
+  readonly attempt: number;
+  readonly configurationVersion: number;
+  readonly startedAt: string;
+}
+/** What `finishAttempt` appends to a begun attempt once the transport answered. */
+interface WebhookDeliveryAttemptFinish {
+  readonly finishedAt: string;
+  readonly outcome: WebhookAttemptOutcome;
+  readonly reason: WebhookAttemptReasonCode;
+  readonly httpStatus?: number;
+}
+/**
+ * A begun attempt with no outcome recorded: it was handed to the transport,
+ * or its worker stopped between `beginAttempt` and the handoff, and no
+ * outcome has been appended since. The request may have reached the
+ * receiver.
+ */
+interface WebhookDeliveryAttemptInFlight extends WebhookDeliveryAttemptStart {
+  readonly fence: number;
+  readonly outcome: "in_flight";
+}
+/** One entry of an intent's attempt log, in the order its first write was made. */
+type WebhookDeliveryAttemptLogEntry = WebhookDeliveryAttemptRecord | WebhookDeliveryAttemptInFlight;
+/**
+ * The uniqueness marker for one (subscriptionId, eventId). The store writes
+ * it in the same step as the intent or denial it stands for and removes it
+ * with that record, when a purge finds the event older than the replay
+ * horizon (R5). `retainUntil` is the event's `recordedAt` plus the store's
+ * horizon: until then any insert for the pair is `already_present`, and
+ * after it every insert for the pair is `past_horizon`, so a replay cannot
+ * re-deliver whether or not a purge has run (the "cleanup racing" cases in
+ * `tests/store-contract.ts`).
+ */
+interface WebhookTombstone {
+  readonly kind: "intent" | "denial";
+  readonly subscriptionId: string;
+  readonly eventId: string;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly retainUntil: string;
+}
+/** A governed compare-and-set requeue from dead letter back to pending (decision 10). */
+interface WebhookRequeueRequest {
+  readonly expectedStatus: "dead_letter";
+  /**
+   * The `fence` of the dead-lettered record as the operator read it. The
+   * requeue applies only while the record still has that fence; otherwise
+   * it is refused as `stale`. Two requeues built from one read therefore
+   * apply at most once, and a request read before the record was requeued,
+   * re-run and dead-lettered again does not apply to the new dead letter.
+   */
+  readonly expectedFence: number;
+  readonly requestedBy: string;
+  readonly requestedAt: Date;
+  /**
+   * The requeued record's new processing deadline (R4). The record becomes
+   * available at `requestedAt` with its attempt budget restored; without a
+   * new deadline a requeued record past its old one could not be retried.
+   */
+  readonly processingDeadline: Date;
+  /**
+   * The governed invocation that authorized the requeue, for audit. It is
+   * also the request's identity: a later request under the same id, for the
+   * same target and record in the same scope, is a re-run of this one, and
+   * the store answers it with this request's evidence and `replayed: true`
+   * instead of applying it (ports, "Re-runs of one invocation").
+   */
+  readonly actionInvocationId?: string;
+}
+/**
+ * A governed actor enrichment of a `legacy` fan-out job (decision 5, PR 9).
+ * Like {@link WebhookRequeueRequest} it is a compare-and-set on the job's
+ * fence as the operator read it, and it restores the budget with a new
+ * processing deadline. `actor` is what the application's reader found on the
+ * canonical event for the job's tenant, space and `eventId`.
+ */
+interface WebhookActorEnrichmentRequest {
+  /** The job's `fence` as the operator read it; a mismatch is refused as `stale`. */
+  readonly expectedFence: number;
+  readonly actor: {
+    readonly actorId: string;
+    readonly actorType: string;
+  };
+  readonly requestedBy: string;
+  readonly requestedAt: Date;
+  /** The repaired job's new processing deadline (R4). It becomes available at `requestedAt`. */
+  readonly processingDeadline: Date;
+  /** The governed invocation that authorized the enrichment, for audit, and the request's identity, as for {@link WebhookRequeueRequest.actionInvocationId}. */
+  readonly actionInvocationId?: string;
+}
+/**
+ * Append-only evidence of one applied requeue or actor enrichment
+ * (decisions 5 and 10). The store writes it in the same step as the
+ * transition, and no store method updates or removes it, a purge included
+ * (the memory store keeps it for its lifetime, the PostgreSQL store until
+ * someone deletes rows from `webhook_requeue_evidence` directly);
+ * the `prior*` fields keep the state the requeue replaced, so a later
+ * requeue cannot erase an earlier failure. Contract cases: "job requeue is a
+ * compare-and-set …", "actor enrichment repairs a legacy job …" and "purge
+ * removes only terminal records …".
+ */
+interface WebhookRequeueEvidence {
+  /** `fan_out_job_actor`: an actor enrichment (PR 9), which also requeues the job. */
+  readonly target: "fan_out_job" | "delivery_intent" | "fan_out_job_actor";
+  readonly eventId: string;
+  /** Present when `target` is `delivery_intent`. */
+  readonly deliveryId?: string;
+  /**
+   * Present when `target` is `delivery_intent`: the intent's subscription,
+   * so a re-run of the requeue can report it after the intent is purged.
+   * Evidence written before this field existed lacks it.
+   */
+  readonly subscriptionId?: string;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly requestedBy: string;
+  readonly requestedAt: string;
+  readonly actionInvocationId?: string;
+  /** The store's clock when the requeue was applied. */
+  readonly appliedAt: string;
+  readonly priorAttemptCount: number;
+  readonly priorAvailableAt: string;
+  readonly priorProcessingDeadline: string;
+  /** The record's fence when it was requeued (the request's `expectedFence`); the requeue advances it by one. */
+  readonly priorFence: number;
+  readonly priorLastDiagnostic?: WebhookDiagnosticCode;
+  readonly priorLastOutcome?: {
+    readonly outcome: WebhookAttemptOutcome;
+    readonly reason: WebhookAttemptReasonCode;
+  };
+  readonly processingDeadline: string;
+  /** Present when `target` is `fan_out_job_actor`: the actor the enrichment set. The prior actor was `legacy`. */
+  readonly actor?: {
+    readonly actorId: string;
+    readonly actorType: string;
+  };
+}
+/** A delivery configuration as a writer supplies it; the store assigns `version`. */
+interface WebhookDeliveryConfigurationInput {
+  readonly destinationUrl: string;
+  readonly signatureScheme: WebhookSignatureScheme;
+  /** A reference the signer resolves within the subscription's tenant, never key material (decision 8). */
+  readonly secretRef: string;
+}
+/** The v1 wire body (decision 7). Field order is the serialized order. */
+interface WebhookDeliveryBodyV1 {
+  readonly format: "fabric.webhook-delivery.v1";
+  readonly eventId: string;
+  readonly type: string;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly correlationId: string;
+  readonly occurredAt: string;
+  readonly event: {
+    readonly type: string;
+    readonly schemaVersion: number;
+    readonly subjectType: string;
+    readonly subjectId: string;
+    readonly sequence: number;
+    readonly recordedAt: string;
+    readonly actionInvocationId?: string;
+    readonly consistency?: "provisional-until-reconciled";
+    readonly payload: WebhookJsonObject | null;
+    readonly payloadProjected: boolean;
+  };
+  readonly delivery: {
+    readonly deliveryId: string;
+    readonly subscriptionId: string;
+  };
+}
+//#endregion
+//#region src/ports.d.ts
+/** Bounds every awaited port call. */
+interface WebhookCallOptions {
+  /** The absolute time after which the call's result is ignored. */
+  readonly deadline: Date;
+  /** Aborted when the caller stops waiting; implementations should stop work. */
+  readonly signal: AbortSignal;
+}
+/** Tenant and space scope every store read is confined to (decision 9). */
+interface WebhookScope {
+  readonly tenantId: string;
+  readonly spaceId: string;
+}
+/**
+ * Tenant- and space-scoped reads of eligibility revisions and delivery
+ * configuration (decision 3). The fan-out and delivery cycles depend on this
+ * read port only; writes are on {@link WebhookSubscriptionWriter}.
+ */
+interface WebhookSubscriptionStore {
+  /**
+   * Eligibility revisions in the scope whose half-open interval contains
+   * `recordedAt`, at most one per subscription, in `subscriptionId` order.
+   * Paused and deleted revisions are returned with their status; the caller
+   * decides eligibility.
+   */
+  listEligibilityRevisions(input: WebhookScope & {
+    readonly recordedAt: string;
+  }, options: WebhookCallOptions): Promise<readonly WebhookEligibilityRevision[]>;
+  /**
+   * The subscription's current status, the revision that status began at
+   * (`statusSinceRevision`, read in the same atomic step as the status) and
+   * its current delivery configuration, or `null` when it does not exist in
+   * this scope. The dispatch check calls it as close to transport handoff
+   * as it can.
+   */
+  readSubscription(input: WebhookScope & {
+    readonly subscriptionId: string;
+  }, options: WebhookCallOptions): Promise<WebhookSubscriptionSnapshot | null>;
+  /**
+   * Every eligibility revision of one subscription, oldest first, or an
+   * empty list when it does not exist in this scope. Revisions are never
+   * removed (R5: eligibility history outlives the replay horizon).
+   */
+  listEligibilityHistory(input: WebhookScope & {
+    readonly subscriptionId: string;
+  }, options: WebhookCallOptions): Promise<readonly WebhookEligibilityRevision[]>;
+}
+/**
+ * Why a subscription write was refused. `not_found`: no such subscription in
+ * this scope. `already_exists`: create named an existing one. `deleted`: the
+ * subscription is deleted, which is terminal. `invalid_transition`: pause of
+ * a paused subscription, or resume of an active one. `revision_conflict` /
+ * `version_conflict`: the caller's expected revision or configuration
+ * version is not the current one.
+ */
+type WebhookSubscriptionWriteRefusal = "not_found" | "already_exists" | "deleted" | "invalid_transition" | "revision_conflict";
+/** The result of a subscription write that appends an eligibility revision. */
+type WebhookSubscriptionWriteResult = {
+  readonly applied: true;
+  readonly revision: WebhookEligibilityRevision;
+  readonly configuration: WebhookDeliveryConfiguration;
+} | {
+  readonly applied: false;
+  readonly refusal: WebhookSubscriptionWriteRefusal;
+  readonly currentRevision?: number;
+};
+/** The result of a delivery configuration replacement. */
+type WebhookConfigurationWriteResult = {
+  readonly applied: true;
+  readonly configuration: WebhookDeliveryConfiguration;
+} | {
+  readonly applied: false;
+  readonly refusal: "not_found" | "deleted" | "version_conflict";
+  readonly currentVersion?: number;
+};
+/** Names one subscription for a transition, optionally guarded by its current revision. */
+type WebhookSubscriptionTransitionInput = WebhookScope & {
+  readonly subscriptionId: string;
+  /** When set, the write is refused as `revision_conflict` unless this is the current revision. */
+  readonly expectedRevision?: number;
+};
+/**
+ * Subscription writes (decision 3), for the governed actions (PR 9). Create,
+ * pattern change, pause, resume and delete each append one immutable
+ * eligibility revision, effective from the store's clock; configuration
+ * replacement appends one delivery configuration version. The store checks
+ * each transition against its own current state, not the caller's.
+ *
+ * Pause and delete do not touch the delivery store; the two stores need not
+ * share a database, so nothing here is atomic with intent state. The
+ * governed action calls {@link WebhookDeliveryStore.cancelPendingIntents}
+ * with the same scope and `subscriptionId` after the revision is written,
+ * passing that revision's number as `beforeRevision`, so a cancel delayed
+ * past a later resume cannot cancel intents bound to the resumed revision;
+ * resume makes the same call with its own revision. These calls are
+ * cleanups. What stops delivery, whether they failed, timed out or raced a
+ * late fan-out insert, is the delivery cycle's pre-handoff
+ * `readSubscription` check: it cancels the intent unsent while the
+ * subscription is paused or deleted, and while it is active with a
+ * {@link WebhookSubscriptionSnapshot.statusSinceRevision} above the
+ * intent's `eligibilityRevision`, i.e. resumed after a pause that ended the
+ * intent's interval (decision 3, R2; README, "Pause and resume are enforced
+ * at dispatch"). So resume never resurrects an intent of an interval a
+ * pause ended: a cancelled intent is terminal, and one still pending, or
+ * requeued from dead letter, is cancelled at dispatch.
+ */
+interface WebhookSubscriptionWriter {
+  /** Create an active subscription with revision 1 and configuration version 1. */
+  createSubscription(input: WebhookScope & {
+    readonly subscriptionId: string;
+    readonly eventTypePatterns: readonly string[];
+    readonly configuration: WebhookDeliveryConfigurationInput;
+  }, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
+  /** Append a revision with new patterns and the current status. Refused once deleted. */
+  changeEventTypePatterns(input: WebhookSubscriptionTransitionInput & {
+    readonly eventTypePatterns: readonly string[];
+  }, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
+  /** Active to paused. See the interface note for cancelling pending intents. */
+  pauseSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
+  /** Paused to active. Cancelled intents stay cancelled, and intents bound to revisions before the resume are not delivered (see the interface note). */
+  resumeSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
+  /** Active or paused to deleted, which is terminal. History is kept. */
+  deleteSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
+  /** Append a delivery configuration version. Refused once deleted. */
+  replaceDeliveryConfiguration(input: WebhookScope & {
+    readonly subscriptionId: string;
+    readonly configuration: WebhookDeliveryConfigurationInput;
+    /** When set, the write is refused as `version_conflict` unless this is the current version. */
+    readonly expectedVersion?: number;
+  }, options: WebhookCallOptions): Promise<WebhookConfigurationWriteResult>;
+}
+/** A claim request for either queue. */
+interface WebhookClaimRequest {
+  readonly workerId: string;
+  readonly leaseDurationMs: number;
+  readonly limit: number;
+  readonly now: Date;
+}
+/** Identifies a leased record; a write whose fence is stale is refused. */
+interface WebhookFencedWrite {
+  readonly owner: string;
+  readonly fence: number;
+  readonly now: Date;
+}
+/**
+ * The result of an insert-if-absent. `already_present`: a job for the
+ * `eventId` exists. `past_horizon`: the event's `recordedAt` is older than
+ * the replay horizon (R5), so nothing was written, whether or not a job for
+ * it was ever stored or has been purged.
+ */
+interface WebhookInsertResult {
+  readonly outcome: "inserted" | "already_present" | "past_horizon";
+}
+/**
+ * The fan-out job lease an intent or denial insert is made under. The job is
+ * keyed by `eventId`; `fence` is the job's lease token, which a reclaim and
+ * actor enrichment both advance.
+ */
+interface WebhookFanOutJobFence {
+  readonly eventId: string;
+  readonly owner: string;
+  readonly fence: number;
+}
+/**
+ * The result of an insert made under a fan-out job's lease. `lease_lost`:
+ * the job's current owner or fence no longer matches, and nothing was
+ * written. `past_horizon`: the event is older than the replay horizon (R5),
+ * and nothing was written. `already_present`: an intent, denial or tombstone
+ * already exists for (subscriptionId, eventId). Checked in that order.
+ */
+interface WebhookFencedInsertResult {
+  readonly outcome: "inserted" | "already_present" | "lease_lost" | "past_horizon";
+}
+/**
+ * The result of a compare-and-set requeue, checked in this order.
+ * `not_found`: no such record in this scope. `stale`: the record's fence is
+ * no longer the request's `expectedFence`, because it was claimed or
+ * requeued since the operator read it (including when it has since been
+ * dead-lettered again). `not_dead_letter`: the record is not dead-lettered
+ * (a pending, completed, delivered or cancelled record is never requeued).
+ * `past_horizon`: the event is older than the replay horizon (decision 10).
+ */
+type WebhookRequeueResult = {
+  readonly applied: true;
+  readonly evidence: WebhookRequeueEvidence;
+  /** Present when the request's `actionInvocationId` had already applied it: `evidence` is that application's, and nothing changed now. */
+  readonly replayed?: true;
+} | {
+  readonly applied: false;
+  readonly refusal: "not_found" | "stale" | "not_dead_letter" | "past_horizon";
+};
+/**
+ * The result of an actor enrichment (decision 5), checked in this order.
+ * `not_found`: no such job in this scope. `stale`: the job's fence is no
+ * longer the request's `expectedFence`. `not_enrichable`: the job is
+ * `completed`, which is final (README, "Completeness boundary").
+ * `actor_present`: the job already carries an actor. `actor_suppressed`:
+ * Host's `includeActor` hook withheld the actor, which enrichment never
+ * overrides. `past_horizon`: the event is older than the replay horizon.
+ */
+type WebhookActorEnrichmentResult = {
+  readonly applied: true;
+  readonly evidence: WebhookRequeueEvidence;
+  /** As on {@link WebhookRequeueResult}. */
+  readonly replayed?: true;
+} | {
+  readonly applied: false;
+  readonly refusal: "not_found" | "stale" | "not_enrichable" | "actor_present" | "actor_suppressed" | "past_horizon";
+};
+/**
+ * What a purge removed. `cutoff` is the store's clock minus the horizon;
+ * only records whose event `recordedAt` is earlier were removed. `more` is
+ * `true` when the limit stopped the purge before every such record went.
+ */
+interface WebhookPurgeResult {
+  readonly cutoff: string;
+  readonly removed: {
+    readonly fanOutJobs: number;
+    readonly deliveryIntents: number;
+    readonly admissionDenials: number;
+  };
+  readonly more: boolean;
+}
+/**
+ * What `beginAttempt` answered. `receipt` is the only proof that the caller
+ * began the attempt; it is needed to record the attempt's outcome.
+ */
+type WebhookAttemptBeginResult = {
+  readonly begun: true;
+  readonly receipt: string;
+} | {
+  readonly begun: false;
+};
+/**
+ * What a pre-handoff lease check found. `valid` only when the intent is
+ * still `pending`, leased to this owner at this fence, in this scope, and
+ * the lease has not expired at `now`.
+ */
+type WebhookDeliveryLeaseCheck = {
+  readonly valid: true;
+} | {
+  readonly valid: false;
+  readonly reason: "lease_lost" | "intent_not_pending" | "not_found";
+};
+/**
+ * Durable state for both stages (decisions 2, 3 and 10): fan-out jobs keyed
+ * by `eventId`, intents keyed by (subscriptionId, eventId), fenced leases,
+ * retry scheduling, dead letter, compare-and-set requeue, an append-only
+ * attempt log and tombstones. Fenced writes (job completion, reschedule,
+ * dead letter and lease renewal; intent and denial inserts under a parent
+ * job's fence; `appendAttempt`, `beginAttempt`, `settleDeliveryIntent` and
+ * `renewDeliveryIntentLease`) resolve
+ * `false`, or `lease_lost` for an insert, without changing anything, when
+ * the caller no longer holds the lease: the record is not `pending`, its
+ * lease owner or fence differs, or its lease has expired. Expiry is judged
+ * on the store's own clock, read inside the atomic step (after every lock
+ * is held, in PostgreSQL), never on the caller's `now`, so a write delayed
+ * past its lease is refused even before another worker reclaims the record
+ * (contract case "every fenced write decides lease expiry on the store's
+ * clock …"; changed in PR 8, before which the fence alone decided).
+ * `finishAttempt` is not fenced. Memory and PostgreSQL implementations
+ * share one contract suite (`tests/store-contract.ts`).
+ *
+ * **Replay horizon (R5).** The store is built with a horizon `H` and reads
+ * its own clock. Every record keyed by an event is anchored at that event's
+ * `recordedAt`. Let `floor` be the later of `now - H` and the highest
+ * `cutoff` any purge has used. A fan-out job, intent or denial insert, a
+ * job or intent requeue, and an actor enrichment (PR 9), is refused as
+ * `past_horizon` when its anchor is
+ * earlier than `floor`; {@link WebhookDeliveryStore.purgeExpiredRecords}
+ * removes only terminal records whose anchor is earlier than its `cutoff`.
+ * The comparison and the write are one atomic step (one transaction, or one
+ * synchronous step in memory), so a purge and a replay of the same key
+ * cannot interleave between them. Whichever runs first, a replay of a
+ * purged key is refused and a record inside the horizon is never removed.
+ * The floor can fall when the store's clock steps backwards, but never below
+ * the highest cutoff a purge has used, which is all a purged key needs: it
+ * stays refused even if the clock steps backwards after the purge. The
+ * race and floor cases in `tests/store-contract.ts` check the outcome of
+ * each whole-operation order, forced through the `beforeAtomicStep` seam;
+ * they cannot interpose inside the atomic step, so each implementation
+ * proves its check-to-write atomicity separately (README, "Contract suite").
+ */
+interface WebhookDeliveryStore {
+  /**
+   * Insert a pending job, available at `createdAt`, unless one exists for
+   * `eventId` or the event is past the replay horizon.
+   */
+  insertFanOutJob(job: WebhookFanOutJobDraft & {
+    readonly processingDeadline: string;
+    readonly createdAt: string;
+  }, options: WebhookCallOptions): Promise<WebhookInsertResult>;
+  /**
+   * Lease up to `limit` pending jobs whose `availableAt` has passed and that
+   * are unleased or whose lease has expired, oldest `availableAt` first.
+   * Each claim advances the job's fence. Claiming spends no attempt.
+   */
+  claimFanOutJobs(request: WebhookClaimRequest, options: WebhookCallOptions): Promise<readonly WebhookFanOutJob[]>;
+  /** Mark a job complete once each eligible revision has an intent or recorded denial. */
+  completeFanOutJob(input: WebhookFencedWrite & {
+    readonly eventId: string;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  /** Return a job to pending at `availableAt`, spending one attempt. */
+  rescheduleFanOutJob(input: WebhookFencedWrite & {
+    readonly eventId: string;
+    readonly availableAt: Date;
+    readonly diagnostic: WebhookDiagnosticCode;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  /**
+   * Extend the lease the caller holds on a job, so a worker that is still
+   * making progress keeps it (PR 8). Fenced like the other job writes:
+   * resolves `true` only when the job is `pending`, leased to `owner` at
+   * `fence`, and the lease has not expired on the store's clock read after
+   * its locks; otherwise `false`, writing nothing. On `true` the lease's
+   * expiry becomes the later of its current expiry and the earlier of
+   * `now + leaseDurationMs` and the job's processing deadline: a renewal
+   * never shortens a lease and never extends it past the processing
+   * deadline (contract case "a lease renewal extends only a lease the
+   * caller holds …"). The fence, attempt count and availability are
+   * unchanged.
+   */
+  renewFanOutJobLease(input: WebhookFencedWrite & {
+    readonly eventId: string;
+    readonly leaseDurationMs: number;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  /** Move an exhausted job to dead letter. */
+  deadLetterFanOutJob(input: WebhookFencedWrite & {
+    readonly eventId: string;
+    readonly diagnostic: WebhookDiagnosticCode;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  /**
+   * Compare-and-set a dead-lettered job back to pending with a restored
+   * budget and a new processing deadline, appending requeue evidence in the
+   * same step. The compare is on the fence (`request.expectedFence`) as
+   * well as the status, and the requeue advances the fence, so one read
+   * yields at most one applied requeue. The fence check, the status and
+   * horizon checks, the transition and the evidence are one atomic step.
+   * Refused past the replay horizon.
+   *
+   * **Re-runs of one invocation.** When the request carries an
+   * `actionInvocationId`, the atomic step first looks for evidence this
+   * scope holds under that id for the same target and record. If there is
+   * some, the call answers `{ applied: true, replayed: true, evidence }`
+   * with that evidence and changes nothing, before any other check: the
+   * record may since have moved on, been claimed or been purged. So
+   * requests of one governed invocation that reach this step, overlapping
+   * or one after the other, apply once and each reports that application,
+   * while a request under another id is checked as usual. An attempt that
+   * a check before this step refused never reaches it (README, "Atomicity
+   * and re-runs"). Contract cases "a request repeated
+   * under its actionInvocationId …" (three).
+   */
+  requeueFanOutJob(input: WebhookScope & {
+    readonly eventId: string;
+    readonly request: WebhookRequeueRequest;
+  }, options: WebhookCallOptions): Promise<WebhookRequeueResult>;
+  /**
+   * Repair a `legacy` job's actor (decision 5, PR 9): set the actor the
+   * application read from the canonical event, return the job to pending
+   * with a restored budget and a new processing deadline, advance its fence
+   * and clear its lease, and append evidence with `target:
+   * "fan_out_job_actor"`. The job may be `pending` (leased or not) or
+   * `dead_letter`; a `completed` job is refused. Advancing the fence is what
+   * stops a worker that leased the job before the repair: its later fenced
+   * writes (intent and denial inserts, completion, reschedule, dead letter,
+   * renewal) answer `lease_lost` or `false`. The scope, fence, status,
+   * actor-state and horizon checks, the transition and the evidence are one
+   * atomic step, so a `suppressed` or `present` actor is refused by the store
+   * itself, whatever the caller read before. A request of an invocation that
+   * already applied is answered as for {@link WebhookDeliveryStore.requeueFanOutJob}
+   * ("Re-runs of one invocation").
+   */
+  enrichFanOutJobActor(input: WebhookScope & {
+    readonly eventId: string;
+    readonly request: WebhookActorEnrichmentRequest;
+  }, options: WebhookCallOptions): Promise<WebhookActorEnrichmentResult>;
+  /** The job for `eventId` in this scope, or `null`. */
+  readFanOutJob(input: WebhookScope & {
+    readonly eventId: string;
+  }, options: WebhookCallOptions): Promise<WebhookFanOutJob | null>;
+  /**
+   * Insert an intent unless an intent, denial or tombstone exists for
+   * (subscriptionId, eventId), on behalf of the fan-out job `parent`. The
+   * store copies the parent job's event `recordedAt` onto the intent.
+   *
+   * Atomicity requirement: the check that `parent.eventId`'s job is still
+   * leased to `parent.owner` at `parent.fence`, the replay-horizon check,
+   * the uniqueness check and the insert are one atomic step (one
+   * transaction, or one conditional write). A worker whose lease was
+   * reclaimed, or whose job fence actor enrichment advanced, gets
+   * `lease_lost` and writes nothing, even if it lost the lease between its
+   * last read and this call. The intent's `eventId`, `tenantId` and
+   * `spaceId` must match the job's (`record_mismatch` otherwise), and its
+   * `deliveryId` must not belong to another pair (`delivery_id_conflict`).
+   */
+  insertDeliveryIntent(intent: Omit<WebhookDeliveryIntent, "status" | "attemptCount" | "lastOutcome" | "lastDiagnostic" | "lease" | "eventRecordedAt" | "fence">, parent: WebhookFanOutJobFence, options: WebhookCallOptions): Promise<WebhookFencedInsertResult>;
+  /**
+   * Record an admission denial unless an intent, denial or tombstone exists
+   * for (subscriptionId, eventId), on behalf of the fan-out job `parent`.
+   * Same atomicity requirement as {@link WebhookDeliveryStore.insertDeliveryIntent}:
+   * the parent fence check, the horizon check and the insert are one atomic step.
+   */
+  recordAdmissionDenial(record: WebhookAdmissionDenialRecord, parent: WebhookFanOutJobFence, options: WebhookCallOptions): Promise<WebhookFencedInsertResult>;
+  /**
+   * Lease up to `limit` pending intents whose `availableAt` has passed and
+   * that are unleased or whose lease has expired, oldest `availableAt` first.
+   * Each claim advances the intent's fence. Claiming spends no attempt.
+   */
+  claimDeliveryIntents(request: WebhookClaimRequest, options: WebhookCallOptions): Promise<readonly WebhookDeliveryIntent[]>;
+  /**
+   * Extend the lease the caller holds on an intent (PR 8), with the rule
+   * of {@link WebhookDeliveryStore.renewFanOutJobLease}: fenced, decided
+   * on the store's clock after its locks, never shortening the lease and
+   * never extending it past the intent's processing deadline. The fence,
+   * attempt count and availability are unchanged.
+   */
+  renewDeliveryIntentLease(input: WebhookFencedWrite & {
+    readonly deliveryId: string;
+    readonly leaseDurationMs: number;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  /**
+   * Read-only check that the intent is still `pending` and leased to
+   * `owner` at `fence` in this tenant and space, with a lease that has not
+   * expired at `now`, so a caller learns that its intent was cancelled,
+   * settled or re-leased even when the subscription itself is active
+   * again. The delivery cycle does not call it: its last check before the
+   * handoff is {@link WebhookDeliveryStore.beginAttempt}, which makes the
+   * same check and records the attempt in one atomic step.
+   *
+   * Requirements: it changes nothing (no settlement, no lease renewal); it
+   * reads the committed current row, not a cached or replica copy, so it
+   * observes every settle, cancel, requeue or reclaim that committed before
+   * it ran; it is bounded by `options`. A change committed after it returns
+   * may still race with the handoff (R2).
+   */
+  checkDeliveryLease(input: WebhookScope & {
+    readonly deliveryId: string;
+    readonly owner: string;
+    readonly fence: number;
+    readonly now: Date;
+  }, options: WebhookCallOptions): Promise<WebhookDeliveryLeaseCheck>;
+  /**
+   * Append one complete attempt to the log, fenced by the intent's lease.
+   * The delivery cycle uses it for attempts that end before the transport
+   * is reached (a signer failure, a refused destination). Never updates or
+   * removes an earlier entry; a purge keeps the log. The attempt's
+   * `subscriptionId` and `eventId` must match the intent's.
+   */
+  appendAttempt(input: WebhookFencedWrite & {
+    readonly attempt: WebhookDeliveryAttemptRecord;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  /**
+   * Record, as one atomic step, that the lease holder is about to hand
+   * `attempt` to the transport: the delivery cycle's last check before the
+   * irrevocable point (R2). Resolves `{ begun: true, receipt }` and appends
+   * an in-flight entry keyed by (`deliveryId`, `fence`) only when the
+   * intent is `pending`, leased to `owner` at `fence`, its lease has not
+   * expired on the store's clock, and no attempt has been begun under this
+   * fence yet. Otherwise it resolves `{ begun: false }` and writes nothing.
+   * It does not change the intent. The attempt's `subscriptionId` and
+   * `eventId` must match the intent's (`record_mismatch` otherwise).
+   *
+   * `receipt` is an unguessable token (32 random bytes) created for this
+   * attempt and returned only here. The store keeps its SHA-256 digest,
+   * never the token, and no read returns either; only the worker that
+   * began the attempt can record its outcome ({@link WebhookDeliveryStore.finishAttempt}).
+   * The delivery cycle keeps it in a local variable only.
+   *
+   * The delivery cycle calls it before every handoff and hands off only on
+   * a well-formed `begun: true` answer (src/delivery-cycle.ts), so every
+   * request it hands to the transport has an attempt entry, even when its
+   * worker loses the lease before it can settle the intent (README, "Delivery").
+   */
+  beginAttempt(input: WebhookFencedWrite & {
+    readonly attempt: WebhookDeliveryAttemptStart;
+  }, options: WebhookCallOptions): Promise<WebhookAttemptBeginResult>;
+  /**
+   * Append the outcome of the attempt begun under (`deliveryId`, `fence`)
+   * in this scope, presenting the `receipt` its `beginAttempt` returned.
+   * Not fenced: a worker whose lease was reclaimed after the handoff can
+   * still record what its request observed. Bound to the receipt instead:
+   * a worker that did not begin that attempt cannot record its outcome,
+   * whether or not it holds the lease now. It reads and changes nothing of
+   * the intent, so no worker can move the intent's state through it
+   * (contract cases "a worker reclaimed after its handoff still finishes
+   * its attempt …" and "only the worker that began an attempt can record
+   * its outcome …"). Resolves `true` when it appended the outcome; `false`,
+   * writing nothing, when no attempt was begun under that key in this
+   * scope, the receipt does not match, or its outcome is already recorded
+   * (the first outcome stands).
+   */
+  finishAttempt(input: WebhookScope & {
+    readonly deliveryId: string;
+    readonly fence: number;
+    readonly receipt: string;
+    readonly finish: WebhookDeliveryAttemptFinish;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  /**
+   * Settle an intent after an attempt or a refused check, clearing its
+   * lease. `release` returns it to pending unsent without spending budget;
+   * `retry` spends one attempt; `delivered`, `dead_letter` and `cancelled`
+   * are terminal and leave the attempt count as it was.
+   */
+  settleDeliveryIntent(input: WebhookFencedWrite & {
+    readonly deliveryId: string;
+    readonly settlement: {
+      readonly kind: "delivered";
+    } | {
+      readonly kind: "retry";
+      readonly availableAt: Date;
+      readonly outcome: WebhookAttemptOutcome;
+      readonly reason: WebhookAttemptReasonCode;
+    } | {
+      readonly kind: "release";
+      readonly availableAt: Date;
+      readonly diagnostic: WebhookDiagnosticCode;
+    } | {
+      readonly kind: "dead_letter";
+      readonly reason: WebhookAttemptReasonCode | WebhookDiagnosticCode;
+    } | {
+      readonly kind: "cancelled";
+      readonly reason: WebhookAttemptReasonCode;
+    };
+  }, options: WebhookCallOptions): Promise<boolean>;
+  /**
+   * Cancel the pending intents of a subscription in this scope, leased or
+   * not, that are bound to an eligibility revision earlier than
+   * `beforeRevision`, as a pause or delete does. Returns the count. Pass the
+   * revision the pause or delete wrote: then only intents for events the
+   * pause ended are cancelled, and an intent bound to a later revision (one
+   * written after a resume) is left alone even when this call is delayed
+   * past the resume. A cancelled intent is terminal; its lease holder's
+   * later fenced writes and lease checks fail. The governed actions call
+   * it as a cleanup; dispatch does not depend on it (see
+   * {@link WebhookSubscriptionWriter}).
+   */
+  cancelPendingIntents(input: WebhookScope & {
+    readonly subscriptionId: string;
+    readonly reason: "subscription_paused" | "subscription_deleted";
+    /** Only intents whose `eligibilityRevision` is lower than this are cancelled. */
+    readonly beforeRevision: number;
+    readonly now: Date;
+  }, options: WebhookCallOptions): Promise<number>;
+  /**
+   * Compare-and-set a dead-lettered intent back to pending, with the same
+   * fence compare-and-set, atomicity and re-run recognition as
+   * {@link WebhookDeliveryStore.requeueFanOutJob}; the evidence names the
+   * intent's `subscriptionId`. Refused past the replay horizon.
+   */
+  requeueDeliveryIntent(input: WebhookScope & {
+    readonly deliveryId: string;
+    readonly request: WebhookRequeueRequest;
+  }, options: WebhookCallOptions): Promise<WebhookRequeueResult>;
+  /** The intent in this scope, or `null`. */
+  readDeliveryIntent(input: WebhookScope & {
+    readonly deliveryId: string;
+  }, options: WebhookCallOptions): Promise<WebhookDeliveryIntent | null>;
+  /**
+   * The attempt log of one intent in this scope, in the order each entry
+   * was first written: entries appended whole, begun attempts with their
+   * outcome once one is recorded, and begun attempts still `in_flight`.
+   */
+  listDeliveryAttempts(input: WebhookScope & {
+    readonly deliveryId: string;
+  }, options: WebhookCallOptions): Promise<readonly WebhookDeliveryAttemptLogEntry[]>;
+  /** Requeue evidence for one event's job and intents in this scope, in append order. */
+  listRequeueEvidence(input: WebhookScope & {
+    readonly eventId: string;
+  }, options: WebhookCallOptions): Promise<readonly WebhookRequeueEvidence[]>;
+  /**
+   * Requeue and enrichment evidence appended under one governed
+   * `actionInvocationId` in this scope, in append order, whether or not the
+   * records it names still exist. The governed actions read it before they
+   * read the record, so a re-run reports what its invocation applied.
+   */
+  listInvocationRequeueEvidence(input: WebhookScope & {
+    readonly actionInvocationId: string;
+  }, options: WebhookCallOptions): Promise<readonly WebhookRequeueEvidence[]>;
+  /** Read the tombstone for (subscriptionId, eventId), if one is retained. */
+  readTombstone(input: WebhookScope & {
+    readonly subscriptionId: string;
+    readonly eventId: string;
+  }, options: WebhookCallOptions): Promise<WebhookTombstone | null>;
+  /**
+   * Remove up to `limit` terminal records whose event is older than the
+   * replay horizon at the store's clock: completed and dead-lettered jobs,
+   * delivered, dead-lettered and cancelled intents, and denials, each with
+   * its tombstone. Pending records are never removed, so live work is not
+   * lost; the cycles are to move them to a terminal state through their
+   * processing deadlines (R4). The attempt log and requeue evidence are audit records
+   * and are kept. The purge's cutoff raises the store's horizon floor in
+   * the same step, so no later insert or requeue can recreate what it
+   * removed. Oldest anchor first.
+   */
+  purgeExpiredRecords(input: {
+    readonly limit: number;
+  }, options: WebhookCallOptions): Promise<WebhookPurgeResult>;
+}
+/** What a signer signs: the timestamp and the exact body bytes (decision 7). */
+interface WebhookSignRequest {
+  readonly scheme: WebhookSignatureScheme;
+  /** Resolved by the signer within `tenantId`; the package never holds key material. */
+  readonly secretRef: string;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly timestampSeconds: number;
+  readonly rawBody: string;
+}
+/**
+ * Signs one attempt at send time. For `v1` it returns the `X-Fabric-Signature`
+ * value `v1=<hex hmac-sha256(secret, "<timestampSeconds>.<rawBody>")>`. A
+ * throw is classified `signer_unavailable` and retried.
+ */
+interface WebhookSigner {
+  sign(request: WebhookSignRequest, options: WebhookCallOptions): Promise<string>;
+}
+/** One resolved address of a destination host. */
+interface WebhookResolvedAddress {
+  readonly address: string;
+  readonly family: 4 | 6;
 }
-
+/** A destination that passed the URL rules and whose every resolved answer is public. */
+interface WebhookVettedDestination {
+  readonly url: string;
+  /** Kept for SNI and certificate hostname verification. */
+  readonly hostname: string;
+  readonly port: 443;
+  /** The vetted addresses the transport posts to without re-resolving. */
+  readonly addresses: readonly WebhookResolvedAddress[];
+}
+/** The outcome of resolving a destination. Rejections carry a fixed code, never the URL's parts. */
+type WebhookDestinationResolution = {
+  readonly ok: true;
+  readonly destination: WebhookVettedDestination;
+} | {
+  readonly ok: false;
+  readonly code: "invalid_url" | "private_address" | "dns_failure";
+};
+/**
+ * Validates a destination (`https:`, port 443 only, no userinfo) and resolves
+ * it, requiring every answer to be public. Called at configuration change,
+ * requeue and dispatch.
+ */
+interface WebhookDestinationResolver {
+  resolve(url: string, options: WebhookCallOptions): Promise<WebhookDestinationResolution>;
+}
+/** One HTTP request handed to the transport. */
+interface WebhookTransportRequest {
+  readonly destination: WebhookVettedDestination;
+  readonly method: "POST";
+  readonly headers: Readonly<Record<string, string>>;
+  readonly body: string;
+}
+/**
+ * What the transport observed. `not_sent` means the request never started
+ * (deadline already passed, or the signal aborted while queued) and the
+ * dispatcher releases the intent without spending budget. `timeout` covers a
+ * deadline or abort after the request started. Response bodies are not
+ * returned.
+ */
+type WebhookTransportResult = {
+  readonly kind: "response";
+  readonly status: number;
+  readonly retryAfter?: string | null;
+} | {
+  readonly kind: "network_error" | "timeout" | "dns_failure" | "invalid_url" | "private_address";
+} | {
+  readonly kind: "not_sent";
+  readonly reason: "deadline_expired" | "aborted";
+};
+/**
+ * Posts to the vetted address without re-resolving, verifies certificate and
+ * hostname, refuses redirects and bounds the response. It must reject a
+ * handoff whose deadline has passed and never start a request whose signal
+ * aborted while queued (R3).
+ */
+interface WebhookTransport {
+  send(request: WebhookTransportRequest, options: WebhookCallOptions): Promise<WebhookTransportResult>;
+}
+/** What admission decides about one (subscription revision, event). */
+interface WebhookAdmissionInput {
+  readonly subscriptionId: string;
+  readonly eligibilityRevision: number;
+  readonly event: WebhookEventMetadata;
+  readonly facts: WebhookJsonObject;
+  readonly actor: WebhookJobActor;
+}
+/**
+ * Tri-state admission (decision 4). `unavailable` retries the job without
+ * writing an intent; so does a throw or a timeout.
+ */
+type WebhookAdmissionDecision = {
+  readonly decision: "allow";
+} | {
+  readonly decision: "deny";
+  readonly code: WebhookAdmissionDenialCode;
+} | {
+  readonly decision: "unavailable";
+};
+/** Decides whether an event may be delivered to a subscription at fan-out. */
+interface WebhookEventAdmission {
+  admit(input: WebhookAdmissionInput, options: WebhookCallOptions): Promise<WebhookAdmissionDecision>;
+}
+/** The attempt a delivery authorization check is about. */
+interface WebhookDeliveryAuthorizationInput {
+  readonly subscriptionId: string;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly eventId: string;
+  readonly deliveryId: string;
+  readonly configurationVersion: number;
+  readonly attempt: number;
+}
+/**
+ * Per-attempt authorization (decision 4). `revoked` cancels the intent;
+ * `unavailable`, a throw or a timeout defers it without spending budget.
+ */
+type WebhookDeliveryAuthorizationDecision = {
+  readonly decision: "authorized";
+} | {
+  readonly decision: "revoked";
+  readonly code: WebhookRevocationCode;
+} | {
+  readonly decision: "unavailable";
+};
+/** Re-checks grant expiry, scope revocation and registration status before each attempt. */
+interface WebhookDeliveryAuthorization {
+  authorize(input: WebhookDeliveryAuthorizationInput, options: WebhookCallOptions): Promise<WebhookDeliveryAuthorizationDecision>;
+}
+/** The injected clock. */
+interface WebhookClock {
+  now(): Date;
+}
+/**
+ * Delay in milliseconds before the next attempt, given the 1-based number of
+ * the attempt that just failed. See `createWebhookRetryDelay`.
+ */
+type WebhookRetryDelay = (attempt: number) => number;
+/** A random source returning a number in `[0, 1)`, injected so jitter is testable. */
+type WebhookRandomSource = () => number;
+/** What a scope predicate sees when deciding whether a scoped type may egress its payload. */
+interface WebhookScopeInput {
+  readonly subscriptionId: string;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly event: WebhookEventMetadata;
+  readonly facts: WebhookJsonObject;
+}
+/**
+ * Synchronous scope predicate for scoped event types (decision 9). Only a
+ * literal `true` lets the payload out; `false`, any other value, a throw or a
+ * missing predicate renders metadata-only.
+ */
+type WebhookScopePredicate = (input: WebhookScopeInput) => boolean;
+//#endregion
+//#region src/memory-delivery-store.d.ts
 /** Options for {@link MemoryWebhookDeliveryStore}. */
 interface MemoryWebhookDeliveryStoreOptions {
-    /** The store's clock: it timestamps requeue evidence and decides the replay horizon. */
-    readonly clock: WebhookClock;
-    /** The replay horizon in milliseconds; see `WebhookDeliveryLimits.replayHorizonMs`. */
-    readonly replayHorizonMs: number;
-    /**
-     * Test seam. Awaited at each call's I/O boundary, after its input is read
-     * and before its atomic step, with the method name. A contract test uses
-     * it to hold one call there while another runs to completion, forcing an
-     * interleaving. A throw or rejection fails the call as `store_failed`,
-     * with nothing written. Leave it unset outside tests.
-     */
-    readonly beforeAtomicStep?: (operation: string) => Promise<void> | void;
+  /** The store's clock: it timestamps requeue evidence and decides the replay horizon. */
+  readonly clock: WebhookClock;
+  /** The replay horizon in milliseconds; see `WebhookDeliveryLimits.replayHorizonMs`. */
+  readonly replayHorizonMs: number;
+  /**
+   * Test seam. Awaited at each call's I/O boundary, after its input is read
+   * and before its atomic step, with the method name. A contract test uses
+   * it to hold one call there while another runs to completion, forcing an
+   * interleaving. A throw or rejection fails the call as `store_failed`,
+   * with nothing written. Leave it unset outside tests.
+   */
+  readonly beforeAtomicStep?: (operation: string) => Promise<void> | void;
 }
 /**
  * An in-memory {@link WebhookDeliveryStore}. Construct one per test or local
@@ -98,107 +1446,108 @@ interface MemoryWebhookDeliveryStoreOptions {
  * positive whole number of milliseconds within `WEBHOOK_MAX_REPLAY_HORIZON_MS`.
  * @throws {WebhookStoreError} `clock_invalid` when `clock` has no `now` function.
  */
-declare class MemoryWebhookDeliveryStore implements WebhookDeliveryStore {
-    #private;
-    constructor(options: MemoryWebhookDeliveryStoreOptions);
-    /** The replay horizon this store enforces, in milliseconds. */
-    get replayHorizonMs(): number;
-    insertFanOutJob(job: WebhookFanOutJobDraft & {
-        readonly processingDeadline: string;
-        readonly createdAt: string;
-    }, options: WebhookCallOptions): Promise<WebhookInsertResult>;
-    claimFanOutJobs(request: WebhookClaimRequest, options: WebhookCallOptions): Promise<readonly WebhookFanOutJob[]>;
-    completeFanOutJob(input: WebhookFencedWrite & {
-        readonly eventId: string;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    rescheduleFanOutJob(input: WebhookFencedWrite & {
-        readonly eventId: string;
-        readonly availableAt: Date;
-        readonly diagnostic: WebhookDiagnosticCode;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    renewFanOutJobLease(input: WebhookFencedWrite & {
-        readonly eventId: string;
-        readonly leaseDurationMs: number;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    deadLetterFanOutJob(input: WebhookFencedWrite & {
-        readonly eventId: string;
-        readonly diagnostic: WebhookDiagnosticCode;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    requeueFanOutJob(input: WebhookScope & {
-        readonly eventId: string;
-        readonly request: WebhookRequeueRequest;
-    }, options: WebhookCallOptions): Promise<WebhookRequeueResult>;
-    enrichFanOutJobActor(input: WebhookScope & {
-        readonly eventId: string;
-        readonly request: WebhookActorEnrichmentRequest;
-    }, options: WebhookCallOptions): Promise<WebhookActorEnrichmentResult>;
-    readFanOutJob(input: WebhookScope & {
-        readonly eventId: string;
-    }, options: WebhookCallOptions): Promise<WebhookFanOutJob | null>;
-    insertDeliveryIntent(intent: Omit<WebhookDeliveryIntent, "status" | "attemptCount" | "lastOutcome" | "lastDiagnostic" | "lease" | "eventRecordedAt" | "fence">, parent: WebhookFanOutJobFence, options: WebhookCallOptions): Promise<WebhookFencedInsertResult>;
-    recordAdmissionDenial(record: WebhookAdmissionDenialRecord, parent: WebhookFanOutJobFence, options: WebhookCallOptions): Promise<WebhookFencedInsertResult>;
-    claimDeliveryIntents(request: WebhookClaimRequest, options: WebhookCallOptions): Promise<readonly WebhookDeliveryIntent[]>;
-    renewDeliveryIntentLease(input: WebhookFencedWrite & {
-        readonly deliveryId: string;
-        readonly leaseDurationMs: number;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    checkDeliveryLease(input: WebhookScope & {
-        readonly deliveryId: string;
-        readonly owner: string;
-        readonly fence: number;
-        readonly now: Date;
-    }, options: WebhookCallOptions): Promise<WebhookDeliveryLeaseCheck>;
-    appendAttempt(input: WebhookFencedWrite & {
-        readonly attempt: WebhookDeliveryAttemptRecord;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    beginAttempt(input: WebhookFencedWrite & {
-        readonly attempt: WebhookDeliveryAttemptStart;
-    }, options: WebhookCallOptions): Promise<WebhookAttemptBeginResult>;
-    finishAttempt(input: WebhookScope & {
-        readonly deliveryId: string;
-        readonly fence: number;
-        readonly receipt: string;
-        readonly finish: WebhookDeliveryAttemptFinish;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    settleDeliveryIntent(input: Parameters<WebhookDeliveryStore["settleDeliveryIntent"]>[0], options: WebhookCallOptions): Promise<boolean>;
-    cancelPendingIntents(input: Parameters<WebhookDeliveryStore["cancelPendingIntents"]>[0], options: WebhookCallOptions): Promise<number>;
-    requeueDeliveryIntent(input: WebhookScope & {
-        readonly deliveryId: string;
-        readonly request: WebhookRequeueRequest;
-    }, options: WebhookCallOptions): Promise<WebhookRequeueResult>;
-    readDeliveryIntent(input: WebhookScope & {
-        readonly deliveryId: string;
-    }, options: WebhookCallOptions): Promise<WebhookDeliveryIntent | null>;
-    listDeliveryAttempts(input: WebhookScope & {
-        readonly deliveryId: string;
-    }, options: WebhookCallOptions): Promise<readonly WebhookDeliveryAttemptLogEntry[]>;
-    listRequeueEvidence(input: WebhookScope & {
-        readonly eventId: string;
-    }, options: WebhookCallOptions): Promise<readonly WebhookRequeueEvidence[]>;
-    listInvocationRequeueEvidence(input: WebhookScope & {
-        readonly actionInvocationId: string;
-    }, options: WebhookCallOptions): Promise<readonly WebhookRequeueEvidence[]>;
-    readTombstone(input: WebhookScope & {
-        readonly subscriptionId: string;
-        readonly eventId: string;
-    }, options: WebhookCallOptions): Promise<WebhookTombstone | null>;
-    purgeExpiredRecords(input: {
-        readonly limit: number;
-    }, options: WebhookCallOptions): Promise<WebhookPurgeResult>;
-}
-
+export declare class MemoryWebhookDeliveryStore implements WebhookDeliveryStore {
+  #private;
+  constructor(options: MemoryWebhookDeliveryStoreOptions);
+  /** The replay horizon this store enforces, in milliseconds. */
+  get replayHorizonMs(): number;
+  insertFanOutJob(job: WebhookFanOutJobDraft & {
+    readonly processingDeadline: string;
+    readonly createdAt: string;
+  }, options: WebhookCallOptions): Promise<WebhookInsertResult>;
+  claimFanOutJobs(request: WebhookClaimRequest, options: WebhookCallOptions): Promise<readonly WebhookFanOutJob[]>;
+  completeFanOutJob(input: WebhookFencedWrite & {
+    readonly eventId: string;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  rescheduleFanOutJob(input: WebhookFencedWrite & {
+    readonly eventId: string;
+    readonly availableAt: Date;
+    readonly diagnostic: WebhookDiagnosticCode;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  renewFanOutJobLease(input: WebhookFencedWrite & {
+    readonly eventId: string;
+    readonly leaseDurationMs: number;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  deadLetterFanOutJob(input: WebhookFencedWrite & {
+    readonly eventId: string;
+    readonly diagnostic: WebhookDiagnosticCode;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  requeueFanOutJob(input: WebhookScope & {
+    readonly eventId: string;
+    readonly request: WebhookRequeueRequest;
+  }, options: WebhookCallOptions): Promise<WebhookRequeueResult>;
+  enrichFanOutJobActor(input: WebhookScope & {
+    readonly eventId: string;
+    readonly request: WebhookActorEnrichmentRequest;
+  }, options: WebhookCallOptions): Promise<WebhookActorEnrichmentResult>;
+  readFanOutJob(input: WebhookScope & {
+    readonly eventId: string;
+  }, options: WebhookCallOptions): Promise<WebhookFanOutJob | null>;
+  insertDeliveryIntent(intent: Omit<WebhookDeliveryIntent, "status" | "attemptCount" | "lastOutcome" | "lastDiagnostic" | "lease" | "eventRecordedAt" | "fence">, parent: WebhookFanOutJobFence, options: WebhookCallOptions): Promise<WebhookFencedInsertResult>;
+  recordAdmissionDenial(record: WebhookAdmissionDenialRecord, parent: WebhookFanOutJobFence, options: WebhookCallOptions): Promise<WebhookFencedInsertResult>;
+  claimDeliveryIntents(request: WebhookClaimRequest, options: WebhookCallOptions): Promise<readonly WebhookDeliveryIntent[]>;
+  renewDeliveryIntentLease(input: WebhookFencedWrite & {
+    readonly deliveryId: string;
+    readonly leaseDurationMs: number;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  checkDeliveryLease(input: WebhookScope & {
+    readonly deliveryId: string;
+    readonly owner: string;
+    readonly fence: number;
+    readonly now: Date;
+  }, options: WebhookCallOptions): Promise<WebhookDeliveryLeaseCheck>;
+  appendAttempt(input: WebhookFencedWrite & {
+    readonly attempt: WebhookDeliveryAttemptRecord;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  beginAttempt(input: WebhookFencedWrite & {
+    readonly attempt: WebhookDeliveryAttemptStart;
+  }, options: WebhookCallOptions): Promise<WebhookAttemptBeginResult>;
+  finishAttempt(input: WebhookScope & {
+    readonly deliveryId: string;
+    readonly fence: number;
+    readonly receipt: string;
+    readonly finish: WebhookDeliveryAttemptFinish;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  settleDeliveryIntent(input: Parameters<WebhookDeliveryStore["settleDeliveryIntent"]>[0], options: WebhookCallOptions): Promise<boolean>;
+  cancelPendingIntents(input: Parameters<WebhookDeliveryStore["cancelPendingIntents"]>[0], options: WebhookCallOptions): Promise<number>;
+  requeueDeliveryIntent(input: WebhookScope & {
+    readonly deliveryId: string;
+    readonly request: WebhookRequeueRequest;
+  }, options: WebhookCallOptions): Promise<WebhookRequeueResult>;
+  readDeliveryIntent(input: WebhookScope & {
+    readonly deliveryId: string;
+  }, options: WebhookCallOptions): Promise<WebhookDeliveryIntent | null>;
+  listDeliveryAttempts(input: WebhookScope & {
+    readonly deliveryId: string;
+  }, options: WebhookCallOptions): Promise<readonly WebhookDeliveryAttemptLogEntry[]>;
+  listRequeueEvidence(input: WebhookScope & {
+    readonly eventId: string;
+  }, options: WebhookCallOptions): Promise<readonly WebhookRequeueEvidence[]>;
+  listInvocationRequeueEvidence(input: WebhookScope & {
+    readonly actionInvocationId: string;
+  }, options: WebhookCallOptions): Promise<readonly WebhookRequeueEvidence[]>;
+  readTombstone(input: WebhookScope & {
+    readonly subscriptionId: string;
+    readonly eventId: string;
+  }, options: WebhookCallOptions): Promise<WebhookTombstone | null>;
+  purgeExpiredRecords(input: {
+    readonly limit: number;
+  }, options: WebhookCallOptions): Promise<WebhookPurgeResult>;
+}
+//#endregion
+//#region src/memory-subscription-store.d.ts
 /** Options for {@link MemoryWebhookSubscriptionStore}. */
 interface MemoryWebhookSubscriptionStoreOptions {
-    /** The store's clock: every revision takes effect at its time (decision 3). */
-    readonly clock: WebhookClock;
-    /**
-     * Test seam. Awaited at each call's I/O boundary, after its input is read
-     * and before its atomic step, with the method name. A contract test uses
-     * it to hold one call there while another runs to completion, forcing an
-     * interleaving. A throw or rejection fails the call as `store_failed`,
-     * with nothing written. Leave it unset outside tests.
-     */
-    readonly beforeAtomicStep?: (operation: string) => Promise<void> | void;
+  /** The store's clock: every revision takes effect at its time (decision 3). */
+  readonly clock: WebhookClock;
+  /**
+   * Test seam. Awaited at each call's I/O boundary, after its input is read
+   * and before its atomic step, with the method name. A contract test uses
+   * it to hold one call there while another runs to completion, forcing an
+   * interleaving. A throw or rejection fails the call as `store_failed`,
+   * with nothing written. Leave it unset outside tests.
+   */
+  readonly beforeAtomicStep?: (operation: string) => Promise<void> | void;
 }
 /**
  * An in-memory {@link WebhookSubscriptionStore} and {@link WebhookSubscriptionWriter}.
@@ -207,85 +1556,87 @@ interface MemoryWebhookSubscriptionStoreOptions {
  *
  * @throws {WebhookStoreError} `clock_invalid` when `clock` has no `now` function.
  */
-declare class MemoryWebhookSubscriptionStore implements WebhookSubscriptionStore, WebhookSubscriptionWriter {
-    #private;
-    constructor(options: MemoryWebhookSubscriptionStoreOptions);
-    listEligibilityRevisions(input: WebhookScope & {
-        readonly recordedAt: string;
-    }, options: WebhookCallOptions): Promise<readonly WebhookEligibilityRevision[]>;
-    readSubscription(input: WebhookScope & {
-        readonly subscriptionId: string;
-    }, options: WebhookCallOptions): Promise<WebhookSubscriptionSnapshot | null>;
-    listEligibilityHistory(input: WebhookScope & {
-        readonly subscriptionId: string;
-    }, options: WebhookCallOptions): Promise<readonly WebhookEligibilityRevision[]>;
-    createSubscription(input: WebhookScope & {
-        readonly subscriptionId: string;
-        readonly eventTypePatterns: readonly string[];
-        readonly configuration: WebhookDeliveryConfigurationInput;
-    }, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
-    changeEventTypePatterns(input: WebhookSubscriptionTransitionInput & {
-        readonly eventTypePatterns: readonly string[];
-    }, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
-    pauseSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
-    resumeSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
-    deleteSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
-    replaceDeliveryConfiguration(input: WebhookScope & {
-        readonly subscriptionId: string;
-        readonly configuration: WebhookDeliveryConfigurationInput;
-        readonly expectedVersion?: number;
-    }, options: WebhookCallOptions): Promise<WebhookConfigurationWriteResult>;
-}
-
+export declare class MemoryWebhookSubscriptionStore implements WebhookSubscriptionStore, WebhookSubscriptionWriter {
+  #private;
+  constructor(options: MemoryWebhookSubscriptionStoreOptions);
+  listEligibilityRevisions(input: WebhookScope & {
+    readonly recordedAt: string;
+  }, options: WebhookCallOptions): Promise<readonly WebhookEligibilityRevision[]>;
+  readSubscription(input: WebhookScope & {
+    readonly subscriptionId: string;
+  }, options: WebhookCallOptions): Promise<WebhookSubscriptionSnapshot | null>;
+  listEligibilityHistory(input: WebhookScope & {
+    readonly subscriptionId: string;
+  }, options: WebhookCallOptions): Promise<readonly WebhookEligibilityRevision[]>;
+  createSubscription(input: WebhookScope & {
+    readonly subscriptionId: string;
+    readonly eventTypePatterns: readonly string[];
+    readonly configuration: WebhookDeliveryConfigurationInput;
+  }, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
+  changeEventTypePatterns(input: WebhookSubscriptionTransitionInput & {
+    readonly eventTypePatterns: readonly string[];
+  }, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
+  pauseSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
+  resumeSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
+  deleteSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
+  replaceDeliveryConfiguration(input: WebhookScope & {
+    readonly subscriptionId: string;
+    readonly configuration: WebhookDeliveryConfigurationInput;
+    readonly expectedVersion?: number;
+  }, options: WebhookCallOptions): Promise<WebhookConfigurationWriteResult>;
+}
+//#endregion
+//#region src/postgres-sql.d.ts
 /** The rows a query returned. */
 interface WebhookPostgresResult<Row = Record<string, unknown>> {
-    rows: Row[];
+  rows: Row[];
 }
 /** Anything that runs one parameterized statement. */
 interface WebhookPostgresQueryable {
-    query<Row = Record<string, unknown>>(sql: string, values?: unknown[]): Promise<WebhookPostgresResult<Row>>;
+  query<Row = Record<string, unknown>>(sql: string, values?: unknown[]): Promise<WebhookPostgresResult<Row>>;
 }
 /** One checked-out connection. `release(true)` discards it instead of returning it to the pool. */
 interface WebhookPostgresConnection extends WebhookPostgresQueryable {
-    release(destroy?: boolean): void;
+  release(destroy?: boolean): void;
 }
 /** A connection pool: `pg.Pool`, or a Lakebase-compatible client with the same two methods. */
 interface WebhookPostgresPool extends WebhookPostgresQueryable {
-    connect(): Promise<WebhookPostgresConnection>;
+  connect(): Promise<WebhookPostgresConnection>;
 }
 /** Where the store pauses inside a transaction, for the serialization tests only. */
 type WebhookTransactionCheckpointStage = "locked" | "written";
-
+//#endregion
+//#region src/postgres-delivery-store.d.ts
 /** Options for {@link PostgresWebhookDeliveryStore}. */
 interface PostgresWebhookDeliveryStoreOptions {
-    /** The connection pool, for example a `pg.Pool`. The store never ends it. */
-    readonly pool: WebhookPostgresPool;
-    /** The store's clock: it timestamps requeue evidence and decides the replay horizon. */
-    readonly clock: WebhookClock;
-    /** The replay horizon in milliseconds; see `WebhookDeliveryLimits.replayHorizonMs`. */
-    readonly replayHorizonMs: number;
-    /**
-     * The schema the tables live in, default `fabric_webhook_delivery`.
-     * Lower-case letters, digits and underscores only. The horizon floor is
-     * per schema: two stores on one schema share one floor.
-     */
-    readonly schema?: string;
-    /**
-     * Test seam, with the memory store's meaning: awaited once per call,
-     * with the method name, after the input is read and before a connection
-     * is taken. Leave it unset outside tests.
-     */
-    readonly beforeAtomicStep?: (operation: string) => Promise<void> | void;
-    /**
-     * Test seam for the serialization tests. Awaited inside the transaction
-     * of each horizon-checked method and of the purge: at `locked`, after the
-     * horizon lock, the purge-cutoff read and the record locks, and before
-     * the clock is read or anything is written; and at `written`, after the
-     * write and before the commit (a call that returns a refusal does not
-     * reach it). A throw or rejection rolls the transaction back and fails
-     * the call as `store_failed`. Leave it unset outside tests.
-     */
-    readonly transactionCheckpoint?: (operation: string, stage: WebhookTransactionCheckpointStage) => Promise<void> | void;
+  /** The connection pool, for example a `pg.Pool`. The store never ends it. */
+  readonly pool: WebhookPostgresPool;
+  /** The store's clock: it timestamps requeue evidence and decides the replay horizon. */
+  readonly clock: WebhookClock;
+  /** The replay horizon in milliseconds; see `WebhookDeliveryLimits.replayHorizonMs`. */
+  readonly replayHorizonMs: number;
+  /**
+   * The schema the tables live in, default `fabric_webhook_delivery`.
+   * Lower-case letters, digits and underscores only. The horizon floor is
+   * per schema: two stores on one schema share one floor.
+   */
+  readonly schema?: string;
+  /**
+   * Test seam, with the memory store's meaning: awaited once per call,
+   * with the method name, after the input is read and before a connection
+   * is taken. Leave it unset outside tests.
+   */
+  readonly beforeAtomicStep?: (operation: string) => Promise<void> | void;
+  /**
+   * Test seam for the serialization tests. Awaited inside the transaction
+   * of each horizon-checked method and of the purge: at `locked`, after the
+   * horizon lock, the purge-cutoff read and the record locks, and before
+   * the clock is read or anything is written; and at `written`, after the
+   * write and before the commit (a call that returns a refusal does not
+   * reach it). A throw or rejection rolls the transaction back and fails
+   * the call as `store_failed`. Leave it unset outside tests.
+   */
+  readonly transactionCheckpoint?: (operation: string, stage: WebhookTransactionCheckpointStage) => Promise<void> | void;
 }
 /**
  * A PostgreSQL {@link WebhookDeliveryStore}. Call {@link ensureSchema} once
@@ -296,112 +1647,113 @@ interface PostgresWebhookDeliveryStoreOptions {
  * @throws {WebhookStoreError} `clock_invalid` when `clock` has no `now`
  * function; `input_invalid` when `pool`, `schema` or a test seam is not usable.
  */
-declare class PostgresWebhookDeliveryStore implements WebhookDeliveryStore {
-    #private;
-    constructor(options: PostgresWebhookDeliveryStoreOptions);
-    /** The replay horizon this store enforces, in milliseconds. */
-    get replayHorizonMs(): number;
-    /**
-     * Create the schema and tables, or check that the applied migrations are
-     * unchanged. Safe to call concurrently and repeatedly: an advisory lock
-     * serializes callers and each migration is recorded once
-     * (`applyWebhookMigrations` in src/postgres-sql.ts).
-     */
-    ensureSchema(): Promise<void>;
-    insertFanOutJob(job: WebhookFanOutJobDraft & {
-        readonly processingDeadline: string;
-        readonly createdAt: string;
-    }, options: WebhookCallOptions): Promise<WebhookInsertResult>;
-    claimFanOutJobs(request: WebhookClaimRequest, options: WebhookCallOptions): Promise<readonly WebhookFanOutJob[]>;
-    completeFanOutJob(input: WebhookFencedWrite & {
-        readonly eventId: string;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    rescheduleFanOutJob(input: WebhookFencedWrite & {
-        readonly eventId: string;
-        readonly availableAt: Date;
-        readonly diagnostic: WebhookDiagnosticCode;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    renewFanOutJobLease(input: WebhookFencedWrite & {
-        readonly eventId: string;
-        readonly leaseDurationMs: number;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    deadLetterFanOutJob(input: WebhookFencedWrite & {
-        readonly eventId: string;
-        readonly diagnostic: WebhookDiagnosticCode;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    requeueFanOutJob(input: WebhookScope & {
-        readonly eventId: string;
-        readonly request: WebhookRequeueRequest;
-    }, options: WebhookCallOptions): Promise<WebhookRequeueResult>;
-    enrichFanOutJobActor(input: WebhookScope & {
-        readonly eventId: string;
-        readonly request: WebhookActorEnrichmentRequest;
-    }, options: WebhookCallOptions): Promise<WebhookActorEnrichmentResult>;
-    readFanOutJob(input: WebhookScope & {
-        readonly eventId: string;
-    }, options: WebhookCallOptions): Promise<WebhookFanOutJob | null>;
-    insertDeliveryIntent(intent: Omit<WebhookDeliveryIntent, "status" | "attemptCount" | "lastOutcome" | "lastDiagnostic" | "lease" | "eventRecordedAt" | "fence">, parent: WebhookFanOutJobFence, options: WebhookCallOptions): Promise<WebhookFencedInsertResult>;
-    recordAdmissionDenial(record: WebhookAdmissionDenialRecord, parent: WebhookFanOutJobFence, options: WebhookCallOptions): Promise<WebhookFencedInsertResult>;
-    claimDeliveryIntents(request: WebhookClaimRequest, options: WebhookCallOptions): Promise<readonly WebhookDeliveryIntent[]>;
-    renewDeliveryIntentLease(input: WebhookFencedWrite & {
-        readonly deliveryId: string;
-        readonly leaseDurationMs: number;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    checkDeliveryLease(input: WebhookScope & {
-        readonly deliveryId: string;
-        readonly owner: string;
-        readonly fence: number;
-        readonly now: Date;
-    }, options: WebhookCallOptions): Promise<WebhookDeliveryLeaseCheck>;
-    appendAttempt(input: WebhookFencedWrite & {
-        readonly attempt: WebhookDeliveryAttemptRecord;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    beginAttempt(input: WebhookFencedWrite & {
-        readonly attempt: WebhookDeliveryAttemptStart;
-    }, options: WebhookCallOptions): Promise<WebhookAttemptBeginResult>;
-    finishAttempt(input: WebhookScope & {
-        readonly deliveryId: string;
-        readonly fence: number;
-        readonly receipt: string;
-        readonly finish: WebhookDeliveryAttemptFinish;
-    }, options: WebhookCallOptions): Promise<boolean>;
-    settleDeliveryIntent(input: Parameters<WebhookDeliveryStore["settleDeliveryIntent"]>[0], options: WebhookCallOptions): Promise<boolean>;
-    cancelPendingIntents(input: Parameters<WebhookDeliveryStore["cancelPendingIntents"]>[0], options: WebhookCallOptions): Promise<number>;
-    requeueDeliveryIntent(input: WebhookScope & {
-        readonly deliveryId: string;
-        readonly request: WebhookRequeueRequest;
-    }, options: WebhookCallOptions): Promise<WebhookRequeueResult>;
-    readDeliveryIntent(input: WebhookScope & {
-        readonly deliveryId: string;
-    }, options: WebhookCallOptions): Promise<WebhookDeliveryIntent | null>;
-    listDeliveryAttempts(input: WebhookScope & {
-        readonly deliveryId: string;
-    }, options: WebhookCallOptions): Promise<readonly WebhookDeliveryAttemptLogEntry[]>;
-    listRequeueEvidence(input: WebhookScope & {
-        readonly eventId: string;
-    }, options: WebhookCallOptions): Promise<readonly WebhookRequeueEvidence[]>;
-    listInvocationRequeueEvidence(input: WebhookScope & {
-        readonly actionInvocationId: string;
-    }, options: WebhookCallOptions): Promise<readonly WebhookRequeueEvidence[]>;
-    readTombstone(input: WebhookScope & {
-        readonly subscriptionId: string;
-        readonly eventId: string;
-    }, options: WebhookCallOptions): Promise<WebhookTombstone | null>;
-    purgeExpiredRecords(input: {
-        readonly limit: number;
-    }, options: WebhookCallOptions): Promise<WebhookPurgeResult>;
-}
-
+export declare class PostgresWebhookDeliveryStore implements WebhookDeliveryStore {
+  #private;
+  constructor(options: PostgresWebhookDeliveryStoreOptions);
+  /** The replay horizon this store enforces, in milliseconds. */
+  get replayHorizonMs(): number;
+  /**
+   * Create the schema and tables, or check that the applied migrations are
+   * unchanged. Safe to call concurrently and repeatedly: an advisory lock
+   * serializes callers and each migration is recorded once
+   * (`applyWebhookMigrations` in src/postgres-sql.ts).
+   */
+  ensureSchema(): Promise<void>;
+  insertFanOutJob(job: WebhookFanOutJobDraft & {
+    readonly processingDeadline: string;
+    readonly createdAt: string;
+  }, options: WebhookCallOptions): Promise<WebhookInsertResult>;
+  claimFanOutJobs(request: WebhookClaimRequest, options: WebhookCallOptions): Promise<readonly WebhookFanOutJob[]>;
+  completeFanOutJob(input: WebhookFencedWrite & {
+    readonly eventId: string;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  rescheduleFanOutJob(input: WebhookFencedWrite & {
+    readonly eventId: string;
+    readonly availableAt: Date;
+    readonly diagnostic: WebhookDiagnosticCode;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  renewFanOutJobLease(input: WebhookFencedWrite & {
+    readonly eventId: string;
+    readonly leaseDurationMs: number;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  deadLetterFanOutJob(input: WebhookFencedWrite & {
+    readonly eventId: string;
+    readonly diagnostic: WebhookDiagnosticCode;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  requeueFanOutJob(input: WebhookScope & {
+    readonly eventId: string;
+    readonly request: WebhookRequeueRequest;
+  }, options: WebhookCallOptions): Promise<WebhookRequeueResult>;
+  enrichFanOutJobActor(input: WebhookScope & {
+    readonly eventId: string;
+    readonly request: WebhookActorEnrichmentRequest;
+  }, options: WebhookCallOptions): Promise<WebhookActorEnrichmentResult>;
+  readFanOutJob(input: WebhookScope & {
+    readonly eventId: string;
+  }, options: WebhookCallOptions): Promise<WebhookFanOutJob | null>;
+  insertDeliveryIntent(intent: Omit<WebhookDeliveryIntent, "status" | "attemptCount" | "lastOutcome" | "lastDiagnostic" | "lease" | "eventRecordedAt" | "fence">, parent: WebhookFanOutJobFence, options: WebhookCallOptions): Promise<WebhookFencedInsertResult>;
+  recordAdmissionDenial(record: WebhookAdmissionDenialRecord, parent: WebhookFanOutJobFence, options: WebhookCallOptions): Promise<WebhookFencedInsertResult>;
+  claimDeliveryIntents(request: WebhookClaimRequest, options: WebhookCallOptions): Promise<readonly WebhookDeliveryIntent[]>;
+  renewDeliveryIntentLease(input: WebhookFencedWrite & {
+    readonly deliveryId: string;
+    readonly leaseDurationMs: number;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  checkDeliveryLease(input: WebhookScope & {
+    readonly deliveryId: string;
+    readonly owner: string;
+    readonly fence: number;
+    readonly now: Date;
+  }, options: WebhookCallOptions): Promise<WebhookDeliveryLeaseCheck>;
+  appendAttempt(input: WebhookFencedWrite & {
+    readonly attempt: WebhookDeliveryAttemptRecord;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  beginAttempt(input: WebhookFencedWrite & {
+    readonly attempt: WebhookDeliveryAttemptStart;
+  }, options: WebhookCallOptions): Promise<WebhookAttemptBeginResult>;
+  finishAttempt(input: WebhookScope & {
+    readonly deliveryId: string;
+    readonly fence: number;
+    readonly receipt: string;
+    readonly finish: WebhookDeliveryAttemptFinish;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  settleDeliveryIntent(input: Parameters<WebhookDeliveryStore["settleDeliveryIntent"]>[0], options: WebhookCallOptions): Promise<boolean>;
+  cancelPendingIntents(input: Parameters<WebhookDeliveryStore["cancelPendingIntents"]>[0], options: WebhookCallOptions): Promise<number>;
+  requeueDeliveryIntent(input: WebhookScope & {
+    readonly deliveryId: string;
+    readonly request: WebhookRequeueRequest;
+  }, options: WebhookCallOptions): Promise<WebhookRequeueResult>;
+  readDeliveryIntent(input: WebhookScope & {
+    readonly deliveryId: string;
+  }, options: WebhookCallOptions): Promise<WebhookDeliveryIntent | null>;
+  listDeliveryAttempts(input: WebhookScope & {
+    readonly deliveryId: string;
+  }, options: WebhookCallOptions): Promise<readonly WebhookDeliveryAttemptLogEntry[]>;
+  listRequeueEvidence(input: WebhookScope & {
+    readonly eventId: string;
+  }, options: WebhookCallOptions): Promise<readonly WebhookRequeueEvidence[]>;
+  listInvocationRequeueEvidence(input: WebhookScope & {
+    readonly actionInvocationId: string;
+  }, options: WebhookCallOptions): Promise<readonly WebhookRequeueEvidence[]>;
+  readTombstone(input: WebhookScope & {
+    readonly subscriptionId: string;
+    readonly eventId: string;
+  }, options: WebhookCallOptions): Promise<WebhookTombstone | null>;
+  purgeExpiredRecords(input: {
+    readonly limit: number;
+  }, options: WebhookCallOptions): Promise<WebhookPurgeResult>;
+}
+//#endregion
+//#region src/postgres-subscription-store.d.ts
 /** Options for {@link PostgresWebhookSubscriptionStore}. */
 interface PostgresWebhookSubscriptionStoreOptions {
-    /** The connection pool, for example a `pg.Pool`. The store never ends it. */
-    readonly pool: WebhookPostgresPool;
-    /** The store's clock: every revision takes effect at its time (decision 3). */
-    readonly clock: WebhookClock;
-    /** The schema the tables live in, default `fabric_webhook_delivery`. It may be the delivery store's schema. */
-    readonly schema?: string;
-    /** Test seam, with the memory store's meaning. Leave it unset outside tests. */
-    readonly beforeAtomicStep?: (operation: string) => Promise<void> | void;
+  /** The connection pool, for example a `pg.Pool`. The store never ends it. */
+  readonly pool: WebhookPostgresPool;
+  /** The store's clock: every revision takes effect at its time (decision 3). */
+  readonly clock: WebhookClock;
+  /** The schema the tables live in, default `fabric_webhook_delivery`. It may be the delivery store's schema. */
+  readonly schema?: string;
+  /** Test seam, with the memory store's meaning. Leave it unset outside tests. */
+  readonly beforeAtomicStep?: (operation: string) => Promise<void> | void;
 }
 /**
  * A PostgreSQL {@link WebhookSubscriptionStore} and {@link WebhookSubscriptionWriter}.
@@ -412,86 +1764,87 @@ interface PostgresWebhookSubscriptionStoreOptions {
  * @throws {WebhookStoreError} `clock_invalid` when `clock` has no `now`
  * function; `input_invalid` when `pool`, `schema` or the test seam is not usable.
  */
-declare class PostgresWebhookSubscriptionStore implements WebhookSubscriptionStore, WebhookSubscriptionWriter {
-    #private;
-    constructor(options: PostgresWebhookSubscriptionStoreOptions);
-    /** Create the schema and tables, or check the applied migrations. Safe to call concurrently and repeatedly. */
-    ensureSchema(): Promise<void>;
-    listEligibilityRevisions(input: WebhookScope & {
-        readonly recordedAt: string;
-    }, options: WebhookCallOptions): Promise<readonly WebhookEligibilityRevision[]>;
-    readSubscription(input: WebhookScope & {
-        readonly subscriptionId: string;
-    }, options: WebhookCallOptions): Promise<WebhookSubscriptionSnapshot | null>;
-    listEligibilityHistory(input: WebhookScope & {
-        readonly subscriptionId: string;
-    }, options: WebhookCallOptions): Promise<readonly WebhookEligibilityRevision[]>;
-    createSubscription(input: WebhookScope & {
-        readonly subscriptionId: string;
-        readonly eventTypePatterns: readonly string[];
-        readonly configuration: WebhookDeliveryConfigurationInput;
-    }, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
-    changeEventTypePatterns(input: WebhookSubscriptionTransitionInput & {
-        readonly eventTypePatterns: readonly string[];
-    }, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
-    pauseSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
-    resumeSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
-    deleteSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
-    replaceDeliveryConfiguration(input: WebhookScope & {
-        readonly subscriptionId: string;
-        readonly configuration: WebhookDeliveryConfigurationInput;
-        readonly expectedVersion?: number;
-    }, options: WebhookCallOptions): Promise<WebhookConfigurationWriteResult>;
-}
-
+export declare class PostgresWebhookSubscriptionStore implements WebhookSubscriptionStore, WebhookSubscriptionWriter {
+  #private;
+  constructor(options: PostgresWebhookSubscriptionStoreOptions);
+  /** Create the schema and tables, or check the applied migrations. Safe to call concurrently and repeatedly. */
+  ensureSchema(): Promise<void>;
+  listEligibilityRevisions(input: WebhookScope & {
+    readonly recordedAt: string;
+  }, options: WebhookCallOptions): Promise<readonly WebhookEligibilityRevision[]>;
+  readSubscription(input: WebhookScope & {
+    readonly subscriptionId: string;
+  }, options: WebhookCallOptions): Promise<WebhookSubscriptionSnapshot | null>;
+  listEligibilityHistory(input: WebhookScope & {
+    readonly subscriptionId: string;
+  }, options: WebhookCallOptions): Promise<readonly WebhookEligibilityRevision[]>;
+  createSubscription(input: WebhookScope & {
+    readonly subscriptionId: string;
+    readonly eventTypePatterns: readonly string[];
+    readonly configuration: WebhookDeliveryConfigurationInput;
+  }, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
+  changeEventTypePatterns(input: WebhookSubscriptionTransitionInput & {
+    readonly eventTypePatterns: readonly string[];
+  }, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
+  pauseSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
+  resumeSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
+  deleteSubscription(input: WebhookSubscriptionTransitionInput, options: WebhookCallOptions): Promise<WebhookSubscriptionWriteResult>;
+  replaceDeliveryConfiguration(input: WebhookScope & {
+    readonly subscriptionId: string;
+    readonly configuration: WebhookDeliveryConfigurationInput;
+    readonly expectedVersion?: number;
+  }, options: WebhookCallOptions): Promise<WebhookConfigurationWriteResult>;
+}
+//#endregion
+//#region src/limits.d.ts
 /**
  * Every bound the delivery lifecycle relies on (R4). All values are
  * milliseconds or counts and must be positive and finite;
  * {@link resolveWebhookDeliveryLimits} enforces that.
  */
 interface WebhookDeliveryLimits {
-    /** Attempts per delivery intent before dead letter, including the first. */
-    readonly maxDeliveryAttempts: number;
-    /** Delays before attempts 2, 3, ...; the last entry repeats if attempts outnumber it. */
-    readonly deliveryRetryDelaysMs: readonly number[];
-    /** Processing deadline persisted on an intent at creation. */
-    readonly deliveryDeadlineMs: number;
-    /** Attempts per fan-out job before dead letter. */
-    readonly maxFanOutAttempts: number;
-    /** Fan-out retry delays; the last entry repeats. */
-    readonly fanOutRetryDelaysMs: readonly number[];
-    /** Processing deadline persisted on a fan-out job at creation. */
-    readonly fanOutDeadlineMs: number;
-    /** Bound on one transport call, from handoff to settled response. */
-    readonly attemptTimeoutMs: number;
-    /** Bound on every other awaited port call, stores included. */
-    readonly portTimeoutMs: number;
-    /** Jitter added to a retry delay, as a fraction of it, in `(0, 1]`. */
-    readonly retryJitterRatio: number;
-    /** The longest `Retry-After` honoured; longer requests are clamped to it. */
-    readonly maxRetryAfterMs: number;
-    /**
-     * The replay horizon (R5): how long after an event's `recordedAt` the
-     * delivery store accepts a fan-out job, intent or denial for it, accepts a
-     * requeue of one, and keeps its records and tombstones. A replay older
-     * than this is rejected as `past_horizon`. It must be a whole number of
-     * milliseconds no shorter than `fanOutDeadlineMs + deliveryDeadlineMs`,
-     * and should be much longer: it also has to cover the Host relay budget,
-     * how long a Host outbox dead letter may wait for requeue, and how long an
-     * operator may take to requeue a webhook dead letter. Pass the same value
-     * to the delivery store.
-     */
-    readonly replayHorizonMs: number;
+  /** Attempts per delivery intent before dead letter, including the first. */
+  readonly maxDeliveryAttempts: number;
+  /** Delays before attempts 2, 3, ...; the last entry repeats if attempts outnumber it. */
+  readonly deliveryRetryDelaysMs: readonly number[];
+  /** Processing deadline persisted on an intent at creation. */
+  readonly deliveryDeadlineMs: number;
+  /** Attempts per fan-out job before dead letter. */
+  readonly maxFanOutAttempts: number;
+  /** Fan-out retry delays; the last entry repeats. */
+  readonly fanOutRetryDelaysMs: readonly number[];
+  /** Processing deadline persisted on a fan-out job at creation. */
+  readonly fanOutDeadlineMs: number;
+  /** Bound on one transport call, from handoff to settled response. */
+  readonly attemptTimeoutMs: number;
+  /** Bound on every other awaited port call, stores included. */
+  readonly portTimeoutMs: number;
+  /** Jitter added to a retry delay, as a fraction of it, in `(0, 1]`. */
+  readonly retryJitterRatio: number;
+  /** The longest `Retry-After` honoured; longer requests are clamped to it. */
+  readonly maxRetryAfterMs: number;
+  /**
+   * The replay horizon (R5): how long after an event's `recordedAt` the
+   * delivery store accepts a fan-out job, intent or denial for it, accepts a
+   * requeue of one, and keeps its records and tombstones. A replay older
+   * than this is rejected as `past_horizon`. It must be a whole number of
+   * milliseconds no shorter than `fanOutDeadlineMs + deliveryDeadlineMs`,
+   * and should be much longer: it also has to cover the Host relay budget,
+   * how long a Host outbox dead letter may wait for requeue, and how long an
+   * operator may take to requeue a webhook dead letter. Pass the same value
+   * to the delivery store.
+   */
+  readonly replayHorizonMs: number;
 }
 /** The largest millisecond offset a JavaScript `Date` represents, so `now - horizon` stays a valid time. */
-declare const WEBHOOK_MAX_REPLAY_HORIZON_MS = 8640000000000000;
+export declare const WEBHOOK_MAX_REPLAY_HORIZON_MS = 8640000000000000;
 /** The largest delay a JavaScript timer accepts without overflowing. */
-declare const WEBHOOK_MAX_TIMER_MS = 2147483647;
+export declare const WEBHOOK_MAX_TIMER_MS = 2147483647;
 /**
  * Defaults. Delivery: eight attempts with AutoRefi's first seven delays
  * (1m, 5m, 15m, 1h, 6h, 12h, 24h), per ADR 0018 decision 10.
  */
-declare const DEFAULT_WEBHOOK_DELIVERY_LIMITS: WebhookDeliveryLimits;
+export declare const DEFAULT_WEBHOOK_DELIVERY_LIMITS: WebhookDeliveryLimits;
 /**
  * Merge overrides onto {@link DEFAULT_WEBHOOK_DELIVERY_LIMITS} and validate
  * every limit. An override left `undefined` keeps the default. The
@@ -504,16 +1857,17 @@ declare const DEFAULT_WEBHOOK_DELIVERY_LIMITS: WebhookDeliveryLimits;
  * `NaN`, infinite, fractional where a count is required, out of range, or
  * cannot be read as plain data (`limit_unreadable`).
  */
-declare function resolveWebhookDeliveryLimits(overrides?: Partial<WebhookDeliveryLimits>): WebhookDeliveryLimits;
-
+export declare function resolveWebhookDeliveryLimits(overrides?: Partial<WebhookDeliveryLimits>): WebhookDeliveryLimits;
+//#endregion
+//#region src/retry.d.ts
 /** Options for {@link createWebhookRetryDelay}. */
 interface WebhookRetryDelayOptions {
-    /** Base delays before attempts 2, 3, ...; defaults to the delivery schedule. The last entry repeats. */
-    readonly delaysMs?: readonly number[];
-    /** Jitter as a fraction of the base delay, in `(0, 1]`; defaults to 0.1. */
-    readonly jitterRatio?: number;
-    /** Random source in `[0, 1)`. Required so jitter is never hidden process state. */
-    readonly random: WebhookRandomSource;
+  /** Base delays before attempts 2, 3, ...; defaults to the delivery schedule. The last entry repeats. */
+  readonly delaysMs?: readonly number[];
+  /** Jitter as a fraction of the base delay, in `(0, 1]`; defaults to 0.1. */
+  readonly jitterRatio?: number;
+  /** Random source in `[0, 1)`. Required so jitter is never hidden process state. */
+  readonly random: WebhookRandomSource;
 }
 /**
  * Build the retry delay port. For the 1-based number of the attempt that just
@@ -531,8 +1885,9 @@ interface WebhookRetryDelayOptions {
  * and `TypeError` `random_source_failed` when the random source throws; the
  * source's exception is dropped unread.
  */
-declare function createWebhookRetryDelay(options: WebhookRetryDelayOptions): WebhookRetryDelay;
-
+export declare function createWebhookRetryDelay(options: WebhookRetryDelayOptions): WebhookRetryDelay;
+//#endregion
+//#region src/classify.d.ts
 /**
  * Everything decision 10's table classifies: a transport observation that
  * reached the network, or a check that stopped the attempt. A transport
@@ -540,35 +1895,35 @@ declare function createWebhookRetryDelay(options: WebhookRetryDelayOptions): Web
  * without spending budget.
  */
 type WebhookDeliveryObservation = Exclude<WebhookTransportResult, {
-    readonly kind: "not_sent";
+  readonly kind: "not_sent";
 }> | {
-    readonly kind: "signer_unavailable" | "authorization_revoked" | "subscription_paused" | "subscription_deleted";
+  readonly kind: "signer_unavailable" | "authorization_revoked" | "subscription_paused" | "subscription_deleted";
 };
 /** The classified attempt. */
 interface WebhookDeliveryClassification {
-    readonly outcome: WebhookAttemptOutcome;
-    readonly reason: WebhookAttemptReasonCode;
-    /** The HTTP status, when a response was received. */
-    readonly httpStatus?: number;
-    /**
-     * For a 429 with a parseable `Retry-After`: the requested delay, clamped
-     * to `[0, maxRetryAfterMs]`. The dispatcher is expected to schedule the
-     * later of this and the retry schedule's delay.
-     */
-    readonly retryAfterMs?: number;
-    /**
-     * `true` for 401 and 403: still `retryable`, but usually needing the
-     * receiver to act, so the caller surfaces it to operators before the retry
-     * budget is exhausted.
-     */
-    readonly receiverActionLikely?: true;
+  readonly outcome: WebhookAttemptOutcome;
+  readonly reason: WebhookAttemptReasonCode;
+  /** The HTTP status, when a response was received. */
+  readonly httpStatus?: number;
+  /**
+   * For a 429 with a parseable `Retry-After`: the requested delay, clamped
+   * to `[0, maxRetryAfterMs]`. The dispatcher is expected to schedule the
+   * later of this and the retry schedule's delay.
+   */
+  readonly retryAfterMs?: number;
+  /**
+   * `true` for 401 and 403: still `retryable`, but usually needing the
+   * receiver to act, so the caller surfaces it to operators before the retry
+   * budget is exhausted.
+   */
+  readonly receiverActionLikely?: true;
 }
 /** Inputs the classifier needs beyond the observation. */
 interface WebhookClassifyOptions {
-    /** Used to turn an HTTP-date `Retry-After` into a delay. */
-    readonly now: Date;
-    /** Upper bound on an honoured `Retry-After`. */
-    readonly maxRetryAfterMs: number;
+  /** Used to turn an HTTP-date `Retry-After` into a delay. */
+  readonly now: Date;
+  /** Upper bound on an honoured `Retry-After`. */
+  readonly maxRetryAfterMs: number;
 }
 /**
  * Classify one attempt by ADR 0018 decision 10:
@@ -591,7 +1946,7 @@ interface WebhookClassifyOptions {
  * message is constant and never repeats the input.
  * @throws {WebhookDeliveryConfigError} when `maxRetryAfterMs` is not positive and finite.
  */
-declare function classifyWebhookDeliveryObservation(observation: WebhookDeliveryObservation, options: WebhookClassifyOptions): WebhookDeliveryClassification;
+export declare function classifyWebhookDeliveryObservation(observation: WebhookDeliveryObservation, options: WebhookClassifyOptions): WebhookDeliveryClassification;
 /**
  * Parse `Retry-After` as delta-seconds or an IMF-fixdate HTTP-date and clamp
  * it to `[0, maxRetryAfterMs]`. An absent or unparseable value returns
@@ -601,17 +1956,18 @@ declare function classifyWebhookDeliveryObservation(observation: WebhookDelivery
  * @throws {WebhookDeliveryConfigError} when `maxRetryAfterMs` is not positive and finite.
  * @throws {TypeError} `input_unreadable` for options that cannot be read.
  */
-declare function parseRetryAfterMs(value: string | null | undefined, options: WebhookClassifyOptions): number | undefined;
-
+export declare function parseRetryAfterMs(value: string | null | undefined, options: WebhookClassifyOptions): number | undefined;
+//#endregion
+//#region src/persistence-projection.d.ts
 /** Inputs to {@link projectWebhookFanOutJob}. */
 interface WebhookPersistenceProjectionOptions {
-    /** The application's per-event-type egress allowlist and declared facts. */
-    readonly policy: WebhookPayloadPolicy;
-    /**
-     * The actor Host passed with the envelope, or why it is absent. Defaults to
-     * `{ state: "absent", reason: "legacy" }`.
-     */
-    readonly actor?: WebhookJobActor;
+  /** The application's per-event-type egress allowlist and declared facts. */
+  readonly policy: WebhookPayloadPolicy;
+  /**
+   * The actor Host passed with the envelope, or why it is absent. Defaults to
+   * `{ state: "absent", reason: "legacy" }`.
+   */
+  readonly actor?: WebhookJobActor;
 }
 /**
  * The persistence projection (ADR 0018 decision 2). Host copies
@@ -634,7 +1990,7 @@ interface WebhookPersistenceProjectionOptions {
  * inspected. The message is constant for the code; no error keeps an input
  * value or an input-raised error.
  */
-declare function projectWebhookFanOutJob(envelope: WebhookSourceEnvelope, options: WebhookPersistenceProjectionOptions): WebhookFanOutJobDraft;
+export declare function projectWebhookFanOutJob(envelope: WebhookSourceEnvelope, options: WebhookPersistenceProjectionOptions): WebhookFanOutJobDraft;
 /**
  * Envelope metadata as a serializable record: identifiers, ordering,
  * classification and consistency. Dates become ISO-8601 strings computed
@@ -644,36 +2000,37 @@ declare function projectWebhookFanOutJob(envelope: WebhookSourceEnvelope, option
  * @throws {WebhookProjectionError} for a missing identifier, an invalid
  * date, an accessor property or a value that cannot be inspected.
  */
-declare function projectWebhookEventMetadata(envelope: unknown): WebhookEventMetadata;
-
+export declare function projectWebhookEventMetadata(envelope: unknown): WebhookEventMetadata;
+//#endregion
+//#region src/egress.d.ts
 /** The v1 body's `format` value. Receivers read it from the raw body. */
-declare const WEBHOOK_DELIVERY_FORMAT_V1: "fabric.webhook-delivery.v1";
+export declare const WEBHOOK_DELIVERY_FORMAT_V1: "fabric.webhook-delivery.v1";
 /** The subscription a body is rendered for. */
 interface WebhookEgressSubscription {
-    readonly subscriptionId: string;
-    readonly tenantId: string;
-    readonly spaceId: string;
+  readonly subscriptionId: string;
+  readonly tenantId: string;
+  readonly spaceId: string;
 }
 /** Inputs to {@link projectWebhookEgressPayload}. */
 interface WebhookEgressProjectionInput {
-    /** The fan-out job; only what the persistence projection kept can leave. */
-    readonly job: WebhookFanOutJobDraft;
-    readonly subscription: WebhookEgressSubscription;
-    /** The current allowlist; it is re-applied, so a narrowed entry takes effect. */
-    readonly policy: WebhookPayloadPolicy;
-    /** Consulted only for event types whose entry sets `scoped`. */
-    readonly scopePredicate?: WebhookScopePredicate;
+  /** The fan-out job; only what the persistence projection kept can leave. */
+  readonly job: WebhookFanOutJobDraft;
+  readonly subscription: WebhookEgressSubscription;
+  /** The current allowlist; it is re-applied, so a narrowed entry takes effect. */
+  readonly policy: WebhookPayloadPolicy;
+  /** Consulted only for event types whose entry sets `scoped`. */
+  readonly scopePredicate?: WebhookScopePredicate;
 }
 /** The payload that may leave for one subscription, and why it is metadata-only when it is. */
 interface WebhookEgressPayload {
-    readonly payload: WebhookJsonObject | null;
-    readonly payloadProjected: boolean;
-    /**
-     * Why the payload was withheld: no allowlist entry, nothing persisted, a
-     * restricted event without opt-in, or a scoped type whose predicate was
-     * missing, threw, or did not return `true`.
-     */
-    readonly withheld?: "no_allowlist_entry" | "not_persisted" | "restricted" | "scope_predicate_missing" | "scope_predicate_failed" | "scope_predicate_false";
+  readonly payload: WebhookJsonObject | null;
+  readonly payloadProjected: boolean;
+  /**
+   * Why the payload was withheld: no allowlist entry, nothing persisted, a
+   * restricted event without opt-in, or a scoped type whose predicate was
+   * missing, threw, or did not return `true`.
+   */
+  readonly withheld?: "no_allowlist_entry" | "not_persisted" | "restricted" | "scope_predicate_missing" | "scope_predicate_failed" | "scope_predicate_false";
 }
 /**
  * The egress projection (ADR 0018 decision 9). The payload leaves only when
@@ -690,16 +2047,16 @@ interface WebhookEgressPayload {
  * names another tenant or space than the job; other codes when the job or
  * subscription cannot be read safely.
  */
-declare function projectWebhookEgressPayload(input: WebhookEgressProjectionInput): WebhookEgressPayload;
+export declare function projectWebhookEgressPayload(input: WebhookEgressProjectionInput): WebhookEgressPayload;
 /** Inputs to {@link renderWebhookDeliveryBodyV1}. */
 interface WebhookRenderInput extends WebhookEgressProjectionInput {
-    readonly deliveryId: string;
+  readonly deliveryId: string;
 }
 /** A rendered v1 body: the object and the exact string that is stored, signed and sent. */
 interface WebhookRenderedBody {
-    readonly body: WebhookDeliveryBodyV1;
-    readonly rawBody: string;
-    readonly withheld?: WebhookEgressPayload["withheld"];
+  readonly body: WebhookDeliveryBodyV1;
+  readonly rawBody: string;
+  readonly withheld?: WebhookEgressPayload["withheld"];
 }
 /**
  * Render the `fabric.webhook-delivery.v1` body (ADR 0018 decision 7) in the
@@ -710,16 +2067,17 @@ interface WebhookRenderedBody {
  * and `rawBody` is serialized by the package from that snapshot, so no
  * `toJSON`, getter or prototype member of any object takes part.
  */
-declare function renderWebhookDeliveryBodyV1(input: WebhookRenderInput): WebhookRenderedBody;
-
+export declare function renderWebhookDeliveryBodyV1(input: WebhookRenderInput): WebhookRenderedBody;
+//#endregion
+//#region src/headers.d.ts
 /** Header names of a v1 delivery (ADR 0018 decision 7). Only the signature and timestamp are signed. */
-declare const WEBHOOK_HEADERS: Readonly<{
-    readonly signature: "X-Fabric-Signature";
-    readonly timestamp: "X-Fabric-Timestamp";
-    readonly eventId: "X-Fabric-Event-Id";
-    readonly deliveryId: "X-Fabric-Delivery-Id";
-    readonly attempt: "X-Fabric-Delivery-Attempt";
-    readonly contentType: "Content-Type";
+export declare const WEBHOOK_HEADERS: Readonly<{
+  readonly signature: "X-Fabric-Signature";
+  readonly timestamp: "X-Fabric-Timestamp";
+  readonly eventId: "X-Fabric-Event-Id";
+  readonly deliveryId: "X-Fabric-Delivery-Id";
+  readonly attempt: "X-Fabric-Delivery-Attempt";
+  readonly contentType: "Content-Type";
 }>;
 /**
  * The exact string a `v1` signer MACs: `"<timestampSeconds>.<rawBody>"`. The
@@ -729,16 +2087,16 @@ declare const WEBHOOK_HEADERS: Readonly<{
  * non-negative whole number of seconds.
  * @throws {TypeError} `raw_body_not_string` when the body is not a string.
  */
-declare function webhookSignedContentV1(timestampSeconds: number, rawBody: string): string;
+export declare function webhookSignedContentV1(timestampSeconds: number, rawBody: string): string;
 /** Inputs to {@link buildWebhookRequestHeaders}. */
 interface WebhookRequestHeaderInput {
-    /** The signer's `v1=<64 lowercase hex>` value. */
-    readonly signature: string;
-    readonly timestampSeconds: number;
-    readonly eventId: string;
-    readonly deliveryId: string;
-    /** 1-based attempt number. */
-    readonly attempt: number;
+  /** The signer's `v1=<64 lowercase hex>` value. */
+  readonly signature: string;
+  readonly timestampSeconds: number;
+  readonly eventId: string;
+  readonly deliveryId: string;
+  /** 1-based attempt number. */
+  readonly attempt: number;
 }
 /**
  * Build the headers of one attempt. A signature that is not a well-formed
@@ -752,8 +2110,9 @@ interface WebhookRequestHeaderInput {
  * `WEBHOOK_INPUT_ERROR_CODES` for a malformed signature, timestamp,
  * identifier or attempt, or an input that cannot be read.
  */
-declare function buildWebhookRequestHeaders(input: WebhookRequestHeaderInput): Readonly<Record<string, string>>;
-
+export declare function buildWebhookRequestHeaders(input: WebhookRequestHeaderInput): Readonly<Record<string, string>>;
+//#endregion
+//#region src/address.d.ts
 /**
  * `true` when `address` is a well-formed IPv4 (canonical dotted-quad) or
  * IPv6 address that a webhook may be sent to: not loopback, private,
@@ -764,18 +2123,101 @@ declare function buildWebhookRequestHeaders(input: WebhookRequestHeaderInput): R
  * every embedded IPv4 address is public. Anything that does not parse is
  * `false`. The README lists every refused block.
  */
-declare function isPublicWebhookAddress(address: string): boolean;
-
+export declare function isPublicWebhookAddress(address: string): boolean;
+//#endregion
+//#region src/destination.d.ts
+/** The longest destination URL accepted, in UTF-16 code units. */
+export declare const WEBHOOK_DESTINATION_MAX_URL_LENGTH = 2048;
+/** The most addresses one lookup may return; a longer answer is refused as `dns_failure`. */
+export declare const WEBHOOK_DESTINATION_MAX_ADDRESSES = 32;
+/** The default bound on one DNS lookup. */
+export declare const DEFAULT_WEBHOOK_LOOKUP_TIMEOUT_MS = 5000;
+/** The result of checking a destination URL's rules, before any DNS lookup. */
+type WebhookDestinationUrlCheck = {
+  readonly ok: true;
+  /** `https://<host><path><query>`: normalized by WHATWG URL parsing, fragment dropped. */
+  readonly url: string;
+  /** The host without IPv6 brackets: the SNI name and certificate identity. */
+  readonly hostname: string;
+  /** Set when the host is an IP literal; it is the only address the destination may use. */
+  readonly literal?: WebhookResolvedAddress;
+} | {
+  readonly ok: false;
+  readonly code: "invalid_url" | "private_address";
+};
+/**
+ * Check a destination URL against decision 6's rules without resolving it.
+ * `invalid_url` when it is not a string of at most
+ * {@link WEBHOOK_DESTINATION_MAX_URL_LENGTH} characters with no ASCII
+ * control character or space, does not start with `https://` and a host
+ * character (WHATWG would find a host in `https:host` or `https:///host`),
+ * does not parse, is not `https:`, names a port
+ * other than 443 (an explicit `:443` is the default and accepted), carries
+ * userinfo, or has an empty host or one ending in `.`. `private_address` when
+ * the host is `localhost` or a `.localhost` name, or an IP literal that is not
+ * public ({@link isPublicWebhookAddress}). A public IP literal passes and is
+ * returned as `literal`. IPv4 literals in decimal, hex, octal or shorthand
+ * form are normalized to dotted-quad by URL parsing before they are checked.
+ * Never throws.
+ */
+export declare function checkWebhookDestinationUrl(url: string): WebhookDestinationUrlCheck;
+/**
+ * Looks up a hostname's addresses. It is passed `{ deadline, signal }`; the
+ * resolver aborts `signal` when it stops waiting, and ignores any answer that
+ * arrives after that. Each answer is `{ address, family }` with a textual IPv4
+ * or IPv6 address. `createNodeWebhookDnsLookup()` at
+ * `@fabricorg/webhook-delivery/node` is one implementation.
+ */
+type WebhookDnsLookup = (hostname: string, options: WebhookCallOptions) => Promise<readonly WebhookResolvedAddress[]>;
+/** Options for {@link createWebhookDestinationResolver}. */
+interface WebhookDestinationResolverOptions {
+  readonly lookup: WebhookDnsLookup;
+  /** The longest one lookup may take; default {@link DEFAULT_WEBHOOK_LOOKUP_TIMEOUT_MS}. The call's own deadline also applies. */
+  readonly lookupTimeoutMs?: number;
+  /** The clock the call's deadline is compared with; the system clock by default. */
+  readonly clock?: WebhookClock;
+}
+/**
+ * A {@link WebhookDestinationResolver} that applies
+ * {@link checkWebhookDestinationUrl}, then resolves the host through the
+ * injected lookup and requires every answer to be public. The vetted
+ * destination it returns carries the addresses the transport must connect
+ * to; the transport never resolves the name again, so a later answer (a DNS
+ * rebinding) cannot change where the request goes.
+ *
+ * A URL that passes the rules resolves to `dns_failure`, never a pass, when
+ * the call's signal has aborted, its deadline has passed or the clock cannot
+ * be read (no lookup is made; this applies to IP literals too), when the
+ * lookup throws, rejects, or has not answered within `lookupTimeoutMs` or by
+ * the deadline (its signal is then aborted and a late answer ignored), when
+ * an answer arrives but, once read, the signal has aborted, the clock cannot
+ * be read or that lookup deadline has passed, or when its answer is empty,
+ * longer than {@link WEBHOOK_DESTINATION_MAX_ADDRESSES}, or not a list of
+ * `{ address, family }` records whose family matches the address. It is
+ * `private_address` when any answer is a well-formed address that is not
+ * public, whatever the others are. A public IP-literal host is returned
+ * without a lookup.
+ *
+ * @throws {TypeError} `input_unreadable` at construction when `lookup` is not
+ * a function or `clock` has no `now` function, and from `resolve` (as a
+ * rejected promise) when `{ deadline, signal }` is not a real `Date` and
+ * `AbortSignal`.
+ * @throws {WebhookDeliveryConfigError} when `lookupTimeoutMs` is not positive,
+ * finite and at most `WEBHOOK_MAX_TIMER_MS`.
+ */
+export declare function createWebhookDestinationResolver(options: WebhookDestinationResolverOptions): WebhookDestinationResolver;
+//#endregion
+//#region src/decisions.d.ts
 /** Admission allows the event. */
-declare function webhookAdmissionAllow(): WebhookAdmissionDecision;
+export declare function webhookAdmissionAllow(): WebhookAdmissionDecision;
 /**
  * Admission denies the event with a fixed reason code; the denial is recorded.
  *
  * @throws {TypeError} `denial_code_unknown` for a code outside `WEBHOOK_ADMISSION_DENIAL_CODES`.
  */
-declare function webhookAdmissionDeny(code: WebhookAdmissionDenialCode): WebhookAdmissionDecision;
+export declare function webhookAdmissionDeny(code: WebhookAdmissionDenialCode): WebhookAdmissionDecision;
 /** Admission cannot decide now; the job retries without an intent. */
-declare function webhookAdmissionUnavailable(): WebhookAdmissionDecision;
+export declare function webhookAdmissionUnavailable(): WebhookAdmissionDecision;
 /**
  * Read an admission port's answer fail-closed. Anything other than a
  * well-formed `allow`, `deny` with a known code, or `unavailable`, including
@@ -783,32 +2225,33 @@ declare function webhookAdmissionUnavailable(): WebhookAdmissionDecision;
  * answer whose inspection throws, becomes `unavailable`: it never becomes
  * `allow`, an unknown code is never stored, and this function never throws.
  */
-declare function normalizeWebhookAdmissionDecision(value: unknown): WebhookAdmissionDecision;
+export declare function normalizeWebhookAdmissionDecision(value: unknown): WebhookAdmissionDecision;
 /**
  * Read a delivery authorization port's answer fail-closed. Anything other
  * than a well-formed `authorized`, `revoked` with a known code, or
  * `unavailable`, including an unreadable answer, becomes `unavailable`,
  * which defers the intent unsent. This function never throws.
  */
-declare function normalizeWebhookDeliveryAuthorizationDecision(value: unknown): WebhookDeliveryAuthorizationDecision;
-
+export declare function normalizeWebhookDeliveryAuthorizationDecision(value: unknown): WebhookDeliveryAuthorizationDecision;
+//#endregion
+//#region src/fan-out-publisher.d.ts
 /** Options for {@link createWebhookFanOutPublisher}. */
 interface WebhookFanOutPublisherOptions {
-    /** Where jobs are inserted. Only `insertFanOutJob` is called. */
-    readonly store: Pick<WebhookDeliveryStore, "insertFanOutJob">;
-    /** Stamps the job's `createdAt` and processing deadline, and bounds the store call. */
-    readonly clock: {
-        now(): Date;
-    };
-    /** The persistence projection's allowlist and declared facts (decision 9). */
-    readonly policy: WebhookPayloadPolicy;
-    /**
-     * Overrides of {@link WebhookDeliveryLimits}; every limit is validated as
-     * positive and finite at construction (R4). The publisher uses
-     * `fanOutDeadlineMs` (the job's processing deadline) and `portTimeoutMs`
-     * (the bound on the insert).
-     */
-    readonly limits?: Partial<WebhookDeliveryLimits>;
+  /** Where jobs are inserted. Only `insertFanOutJob` is called. */
+  readonly store: Pick<WebhookDeliveryStore, "insertFanOutJob">;
+  /** Stamps the job's `createdAt` and processing deadline, and bounds the store call. */
+  readonly clock: {
+    now(): Date;
+  };
+  /** The persistence projection's allowlist and declared facts (decision 9). */
+  readonly policy: WebhookPayloadPolicy;
+  /**
+   * Overrides of {@link WebhookDeliveryLimits}; every limit is validated as
+   * positive and finite at construction (R4). The publisher uses
+   * `fanOutDeadlineMs` (the job's processing deadline) and `portTimeoutMs`
+   * (the bound on the insert).
+   */
+  readonly limits?: Partial<WebhookDeliveryLimits>;
 }
 /**
  * Build the stage-one publisher: an `EnterpriseEventPublisher` to hand to
@@ -840,37 +2283,37 @@ interface WebhookFanOutPublisherOptions {
  * @throws {WebhookFanOutError} `options_invalid` at construction, for a
  * missing or unreadable store, clock or options object.
  */
-declare function createWebhookFanOutPublisher(options: WebhookFanOutPublisherOptions): EnterpriseEventPublisher;
+export declare function createWebhookFanOutPublisher(options: WebhookFanOutPublisherOptions): EnterpriseEventPublisher;
 /** One sink of a composite publisher. */
 interface WebhookCompositeSink {
-    /** Names the sink in a `sink_failed` or `sink_timeout` error: 1 to 64 printable ASCII characters, unique in the composite. */
-    readonly name: string;
-    readonly publisher: EnterpriseEventPublisher;
-    /**
-     * Only `true` passes `actorId` and `actorType` to this sink, with the
-     * relay's `actorDisclosure` unchanged. Any other value gives the sink a
-     * copy of the envelope without those keys, and reports an `included`
-     * disclosure to it as `suppressed` (decision 5).
-     */
-    readonly includeActor?: boolean;
-    /**
-     * Defaults to `true`. The composite resolves only after every required
-     * sink resolves. A sink with `required: false` is started with the others
-     * but never waited for: its outcome, timeout included, is ignored, so an
-     * event it fails is not retried for it.
-     */
-    readonly required?: boolean;
+  /** Names the sink in a `sink_failed` or `sink_timeout` error: 1 to 64 printable ASCII characters, unique in the composite. */
+  readonly name: string;
+  readonly publisher: EnterpriseEventPublisher;
+  /**
+   * Only `true` passes `actorId` and `actorType` to this sink, with the
+   * relay's `actorDisclosure` unchanged. Any other value gives the sink a
+   * copy of the envelope without those keys, and reports an `included`
+   * disclosure to it as `suppressed` (decision 5).
+   */
+  readonly includeActor?: boolean;
+  /**
+   * Defaults to `true`. The composite resolves only after every required
+   * sink resolves. A sink with `required: false` is started with the others
+   * but never waited for: its outcome, timeout included, is ignored, so an
+   * event it fails is not retried for it.
+   */
+  readonly required?: boolean;
 }
 /** Options for {@link createWebhookCompositePublisher}. */
 interface WebhookCompositePublisherOptions {
-    /** At least one sink, at most 16, called concurrently. */
-    readonly sinks: readonly WebhookCompositeSink[];
-    /**
-     * How long each sink is given, in ms, before its signal is aborted and
-     * it counts as timed out. A positive whole number up to
-     * `WEBHOOK_MAX_TIMER_MS`; default 10 000, Host's default publish timeout.
-     */
-    readonly sinkTimeoutMs?: number;
+  /** At least one sink, at most 16, called concurrently. */
+  readonly sinks: readonly WebhookCompositeSink[];
+  /**
+   * How long each sink is given, in ms, before its signal is aborted and
+   * it counts as timed out. A positive whole number up to
+   * `WEBHOOK_MAX_TIMER_MS`; default 10 000, Host's default publish timeout.
+   */
+  readonly sinkTimeoutMs?: number;
 }
 /**
  * Build a publisher that hands each event to several sinks, for example the
@@ -913,104 +2356,105 @@ interface WebhookCompositePublisherOptions {
  * @throws {WebhookDeliveryConfigError} at construction for a `sinkTimeoutMs`
  * that is not a positive whole number within the timer range.
  */
-declare function createWebhookCompositePublisher(options: WebhookCompositePublisherOptions): EnterpriseEventPublisher;
-
+export declare function createWebhookCompositePublisher(options: WebhookCompositePublisherOptions): EnterpriseEventPublisher;
+//#endregion
+//#region src/fan-out-cycle.d.ts
 /** What decides whether a subscription revision needs the event's actor identity. */
 interface WebhookActorRequirementInput {
-    readonly subscriptionId: string;
-    readonly eligibilityRevision: number;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly event: WebhookEventMetadata;
+  readonly subscriptionId: string;
+  readonly eligibilityRevision: number;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly event: WebhookEventMetadata;
 }
 /** Options for {@link runWebhookFanOutCycle}. */
 interface WebhookFanOutCycleOptions {
-    readonly deliveries: WebhookDeliveryStore;
-    readonly subscriptions: WebhookSubscriptionStore;
-    readonly admission: WebhookEventAdmission;
-    readonly clock: {
-        now(): Date;
-    };
-    /** The lease owner this worker claims jobs as. */
-    readonly workerId: string;
-    /** The egress allowlist the intent bodies are rendered with (decision 9). */
-    readonly policy: WebhookPayloadPolicy;
-    /** Consulted for scoped event types when rendering a body. */
-    readonly scopePredicate?: WebhookScopePredicate;
-    /**
-     * Whether admission for a revision needs actor identity (decision 5).
-     * Required, so the choice is explicit. `true`, or a function returning
-     * anything but a literal `false` (a throw included), makes a job whose
-     * actor is `suppressed` or `legacy` `unavailable` for that revision
-     * without calling admission: the job retries and finally dead-letters,
-     * and actor enrichment (PR 9) repairs a legacy one.
-     */
-    readonly actorRequired: boolean | ((input: WebhookActorRequirementInput) => boolean);
-    /**
-     * Overrides of {@link WebhookDeliveryLimits}, all validated positive and
-     * finite (R4). Used: `maxFanOutAttempts`, `fanOutRetryDelaysMs`,
-     * `retryJitterRatio`, `portTimeoutMs`, `deliveryDeadlineMs` (each new
-     * intent's processing deadline).
-     */
-    readonly limits?: Partial<WebhookDeliveryLimits>;
-    /** Delay before the next attempt; defaults to `fanOutRetryDelaysMs` with jitter from `random`. */
-    readonly retryDelay?: WebhookRetryDelay;
-    /** Random source for the default retry delay's jitter; required when `retryDelay` is absent. */
-    readonly random?: WebhookRandomSource;
-    /** Jobs claimed per cycle. A positive whole number; default 25. */
-    readonly batchSize?: number;
-    /**
-     * Lease on each claimed job, in ms; renewed while the job is processed
-     * (see "Lease renewal" above). A positive whole number above
-     * `3 * portTimeoutMs`; default 60 000.
-     */
-    readonly leaseDurationMs?: number;
-    /**
-     * How long after `recordedAt`, on this worker's clock, an event's
-     * eligibility is treated as settled (see the completeness boundary
-     * above). It must exceed the skew between this worker's clock and the
-     * subscription store's, plus the longest revision write. A positive whole
-     * number of ms below `fanOutDeadlineMs`; default 5 000.
-     */
-    readonly eligibilitySettleMs?: number;
-    /** Creates each intent's `deliveryId`; defaults to `dlv_` plus a random UUID. */
-    readonly createDeliveryId?: (input: {
-        readonly subscriptionId: string;
-        readonly eventId: string;
-    }) => string;
-    /** Stops the cycle between jobs; the rest of the claimed jobs are reclaimed after their leases expire. */
-    readonly signal?: AbortSignal;
+  readonly deliveries: WebhookDeliveryStore;
+  readonly subscriptions: WebhookSubscriptionStore;
+  readonly admission: WebhookEventAdmission;
+  readonly clock: {
+    now(): Date;
+  };
+  /** The lease owner this worker claims jobs as. */
+  readonly workerId: string;
+  /** The egress allowlist the intent bodies are rendered with (decision 9). */
+  readonly policy: WebhookPayloadPolicy;
+  /** Consulted for scoped event types when rendering a body. */
+  readonly scopePredicate?: WebhookScopePredicate;
+  /**
+   * Whether admission for a revision needs actor identity (decision 5).
+   * Required, so the choice is explicit. `true`, or a function returning
+   * anything but a literal `false` (a throw included), makes a job whose
+   * actor is `suppressed` or `legacy` `unavailable` for that revision
+   * without calling admission: the job retries and finally dead-letters,
+   * and actor enrichment (PR 9) repairs a legacy one.
+   */
+  readonly actorRequired: boolean | ((input: WebhookActorRequirementInput) => boolean);
+  /**
+   * Overrides of {@link WebhookDeliveryLimits}, all validated positive and
+   * finite (R4). Used: `maxFanOutAttempts`, `fanOutRetryDelaysMs`,
+   * `retryJitterRatio`, `portTimeoutMs`, `deliveryDeadlineMs` (each new
+   * intent's processing deadline).
+   */
+  readonly limits?: Partial<WebhookDeliveryLimits>;
+  /** Delay before the next attempt; defaults to `fanOutRetryDelaysMs` with jitter from `random`. */
+  readonly retryDelay?: WebhookRetryDelay;
+  /** Random source for the default retry delay's jitter; required when `retryDelay` is absent. */
+  readonly random?: WebhookRandomSource;
+  /** Jobs claimed per cycle. A positive whole number; default 25. */
+  readonly batchSize?: number;
+  /**
+   * Lease on each claimed job, in ms; renewed while the job is processed
+   * (see "Lease renewal" above). A positive whole number above
+   * `3 * portTimeoutMs`; default 60 000.
+   */
+  readonly leaseDurationMs?: number;
+  /**
+   * How long after `recordedAt`, on this worker's clock, an event's
+   * eligibility is treated as settled (see the completeness boundary
+   * above). It must exceed the skew between this worker's clock and the
+   * subscription store's, plus the longest revision write. A positive whole
+   * number of ms below `fanOutDeadlineMs`; default 5 000.
+   */
+  readonly eligibilitySettleMs?: number;
+  /** Creates each intent's `deliveryId`; defaults to `dlv_` plus a random UUID. */
+  readonly createDeliveryId?: (input: {
+    readonly subscriptionId: string;
+    readonly eventId: string;
+  }) => string;
+  /** Stops the cycle between jobs; the rest of the claimed jobs are reclaimed after their leases expire. */
+  readonly signal?: AbortSignal;
 }
 /** What one cycle did. */
 interface WebhookFanOutCycleResult {
-    readonly claimed: number;
-    /** Jobs marked complete. */
-    readonly completed: number;
-    /** Jobs deferred unprocessed because their eligibility was not yet settled. */
-    readonly deferred: number;
-    /** Jobs returned to pending after an unavailable admission or a failed port. */
-    readonly rescheduled: number;
-    readonly deadLettered: number;
-    /** Jobs this worker stopped on because a fenced write or a lease renewal found its lease gone. */
-    readonly leaseLost: number;
-    /**
-     * Jobs left for lease expiry, with nothing more written: a record whose
-     * identity or lease could not be read, one leased to another owner, or
-     * one whose final fenced write threw or timed out. A final write that
-     * timed out may have committed (README, "Bounds and late results"); the
-     * job is then completed, rescheduled or dead-lettered as that write said.
-     */
-    readonly abandoned: number;
-    /** Intent inserts the store confirmed. One that timed out may have committed and is not counted. */
-    readonly intentsInserted: number;
-    /** Denial inserts the store confirmed, counted like `intentsInserted`. */
-    readonly denialsRecorded: number;
+  readonly claimed: number;
+  /** Jobs marked complete. */
+  readonly completed: number;
+  /** Jobs deferred unprocessed because their eligibility was not yet settled. */
+  readonly deferred: number;
+  /** Jobs returned to pending after an unavailable admission or a failed port. */
+  readonly rescheduled: number;
+  readonly deadLettered: number;
+  /** Jobs this worker stopped on because a fenced write or a lease renewal found its lease gone. */
+  readonly leaseLost: number;
+  /**
+   * Jobs left for lease expiry, with nothing more written: a record whose
+   * identity or lease could not be read, one leased to another owner, or
+   * one whose final fenced write threw or timed out. A final write that
+   * timed out may have committed (README, "Bounds and late results"); the
+   * job is then completed, rescheduled or dead-lettered as that write said.
+   */
+  readonly abandoned: number;
+  /** Intent inserts the store confirmed. One that timed out may have committed and is not counted. */
+  readonly intentsInserted: number;
+  /** Denial inserts the store confirmed, counted like `intentsInserted`. */
+  readonly denialsRecorded: number;
 }
 /** Defaults for the cycle's own options. */
-declare const DEFAULT_WEBHOOK_FAN_OUT_CYCLE: Readonly<{
-    batchSize: 25;
-    leaseDurationMs: 60000;
-    eligibilitySettleMs: 5000;
+export declare const DEFAULT_WEBHOOK_FAN_OUT_CYCLE: Readonly<{
+  batchSize: 25;
+  leaseDurationMs: 60000;
+  eligibilitySettleMs: 5000;
 }>;
 /**
  * Whether an event type matches one subscription pattern. `*` matches every
@@ -1025,7 +2469,7 @@ declare const DEFAULT_WEBHOOK_FAN_OUT_CYCLE: Readonly<{
  * an event type (`isEligible` below calls it), so the exclusion holds for
  * every subscription whatever its patterns.
  */
-declare function matchesWebhookEventTypePattern(pattern: string, eventType: string): boolean;
+export declare function matchesWebhookEventTypePattern(pattern: string, eventType: string): boolean;
 /**
  * Run one fan-out cycle: claim up to `batchSize` pending jobs under a fenced
  * lease and process each in turn. A claimed record whose `eventId`,
@@ -1080,8 +2524,9 @@ declare function matchesWebhookEventTypePattern(pattern: string, eventType: stri
  * option; `fan_out_store_failed` or `fan_out_store_timeout` when the claim
  * fails; `clock_invalid` for a failing clock.
  */
-declare function runWebhookFanOutCycle(options: WebhookFanOutCycleOptions): Promise<WebhookFanOutCycleResult>;
-
+export declare function runWebhookFanOutCycle(options: WebhookFanOutCycleOptions): Promise<WebhookFanOutCycleResult>;
+//#endregion
+//#region src/delivery-cycle.d.ts
 /** One intent's outcome, as reported to {@link WebhookDeliveryCycleOptions.observe}. */
 type WebhookDeliveryCycleResultKind = "delivered" | "retry_scheduled" | "dead_lettered" | "cancelled" | "released" | "lease_lost" | "abandoned";
 /**
@@ -1090,79 +2535,79 @@ type WebhookDeliveryCycleResultKind = "delivered" | "retry_scheduled" | "dead_le
  * destination, secret reference, signature, header, body or port error.
  */
 interface WebhookDeliveryCycleEvent {
-    readonly deliveryId: string;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly subscriptionId?: string;
-    readonly eventId?: string;
-    /** The 1-based attempt number this processing was for. */
-    readonly attempt?: number;
-    /** The configuration version the attempt was prepared with, once read. */
-    readonly configurationVersion?: number;
-    readonly result: WebhookDeliveryCycleResultKind;
-    /** `true` once the request was handed to the transport. */
-    readonly handedOff: boolean;
-    readonly reason?: WebhookAttemptReasonCode;
-    readonly diagnostic?: WebhookDiagnosticCode;
-    readonly httpStatus?: number;
-    /** 401 or 403: still retried, but usually needing the receiver to act (decision 10). */
-    readonly receiverActionLikely?: true;
+  readonly deliveryId: string;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly subscriptionId?: string;
+  readonly eventId?: string;
+  /** The 1-based attempt number this processing was for. */
+  readonly attempt?: number;
+  /** The configuration version the attempt was prepared with, once read. */
+  readonly configurationVersion?: number;
+  readonly result: WebhookDeliveryCycleResultKind;
+  /** `true` once the request was handed to the transport. */
+  readonly handedOff: boolean;
+  readonly reason?: WebhookAttemptReasonCode;
+  readonly diagnostic?: WebhookDiagnosticCode;
+  readonly httpStatus?: number;
+  /** 401 or 403: still retried, but usually needing the receiver to act (decision 10). */
+  readonly receiverActionLikely?: true;
 }
 /** Options for {@link runWebhookDeliveryCycle}. */
 interface WebhookDeliveryCycleOptions {
-    readonly deliveries: WebhookDeliveryStore;
-    readonly subscriptions: WebhookSubscriptionStore;
-    readonly authorization: WebhookDeliveryAuthorization;
-    readonly signer: WebhookSigner;
-    readonly resolver: WebhookDestinationResolver;
-    readonly transport: WebhookTransport;
-    readonly clock: WebhookClock;
-    /** The lease owner this worker claims intents as. */
-    readonly workerId: string;
-    /**
-     * Overrides of {@link WebhookDeliveryLimits}, all validated positive and
-     * finite (R4). Used: `maxDeliveryAttempts`, `deliveryRetryDelaysMs`,
-     * `retryJitterRatio`, `attemptTimeoutMs`, `portTimeoutMs`, `maxRetryAfterMs`.
-     */
-    readonly limits?: Partial<WebhookDeliveryLimits>;
-    /** Delay before the next attempt; defaults to `deliveryRetryDelaysMs` with jitter from `random`. */
-    readonly retryDelay?: WebhookRetryDelay;
-    /** Random source for the default retry delay's jitter; required when `retryDelay` is absent. */
-    readonly random?: WebhookRandomSource;
-    /** Intents claimed per cycle. A positive whole number; default 10. */
-    readonly batchSize?: number;
-    /**
-     * Lease on each claimed intent, in ms. A positive whole number above
-     * `attemptTimeoutMs + 10 * portTimeoutMs` (one whole attempt and the
-     * renewal before it; see `ATTEMPT_PORT_CALLS`); default 120 000.
-     */
-    readonly leaseDurationMs?: number;
-    /** Called once per claimed intent with fixed-code telemetry. A throw is ignored. */
-    readonly observe?: (event: WebhookDeliveryCycleEvent) => void;
-    /** Stops the cycle; intents not yet settled are reclaimed after their leases expire. */
-    readonly signal?: AbortSignal;
+  readonly deliveries: WebhookDeliveryStore;
+  readonly subscriptions: WebhookSubscriptionStore;
+  readonly authorization: WebhookDeliveryAuthorization;
+  readonly signer: WebhookSigner;
+  readonly resolver: WebhookDestinationResolver;
+  readonly transport: WebhookTransport;
+  readonly clock: WebhookClock;
+  /** The lease owner this worker claims intents as. */
+  readonly workerId: string;
+  /**
+   * Overrides of {@link WebhookDeliveryLimits}, all validated positive and
+   * finite (R4). Used: `maxDeliveryAttempts`, `deliveryRetryDelaysMs`,
+   * `retryJitterRatio`, `attemptTimeoutMs`, `portTimeoutMs`, `maxRetryAfterMs`.
+   */
+  readonly limits?: Partial<WebhookDeliveryLimits>;
+  /** Delay before the next attempt; defaults to `deliveryRetryDelaysMs` with jitter from `random`. */
+  readonly retryDelay?: WebhookRetryDelay;
+  /** Random source for the default retry delay's jitter; required when `retryDelay` is absent. */
+  readonly random?: WebhookRandomSource;
+  /** Intents claimed per cycle. A positive whole number; default 10. */
+  readonly batchSize?: number;
+  /**
+   * Lease on each claimed intent, in ms. A positive whole number above
+   * `attemptTimeoutMs + 10 * portTimeoutMs` (one whole attempt and the
+   * renewal before it; see `ATTEMPT_PORT_CALLS`); default 120 000.
+   */
+  readonly leaseDurationMs?: number;
+  /** Called once per claimed intent with fixed-code telemetry. A throw is ignored. */
+  readonly observe?: (event: WebhookDeliveryCycleEvent) => void;
+  /** Stops the cycle; intents not yet settled are reclaimed after their leases expire. */
+  readonly signal?: AbortSignal;
 }
 /** What one cycle did. */
 interface WebhookDeliveryCycleResult {
-    readonly claimed: number;
-    readonly delivered: number;
-    /** Settled for a later attempt, spending one. */
-    readonly retried: number;
-    readonly deadLettered: number;
-    readonly cancelled: number;
-    /** Returned to pending unsent, spending no attempt. */
-    readonly released: number;
-    /** Intents this worker stopped on because a fenced write found its lease gone. */
-    readonly leaseLost: number;
-    /** Intents left for lease expiry: unreadable, another owner's, or whose final write failed. */
-    readonly abandoned: number;
-    /** Requests handed to the transport. */
-    readonly handedOff: number;
+  readonly claimed: number;
+  readonly delivered: number;
+  /** Settled for a later attempt, spending one. */
+  readonly retried: number;
+  readonly deadLettered: number;
+  readonly cancelled: number;
+  /** Returned to pending unsent, spending no attempt. */
+  readonly released: number;
+  /** Intents this worker stopped on because a fenced write found its lease gone. */
+  readonly leaseLost: number;
+  /** Intents left for lease expiry: unreadable, another owner's, or whose final write failed. */
+  readonly abandoned: number;
+  /** Requests handed to the transport. */
+  readonly handedOff: number;
 }
 /** Defaults for the cycle's own options. */
-declare const DEFAULT_WEBHOOK_DELIVERY_CYCLE: Readonly<{
-    batchSize: 10;
-    leaseDurationMs: 120000;
+export declare const DEFAULT_WEBHOOK_DELIVERY_CYCLE: Readonly<{
+  batchSize: 10;
+  leaseDurationMs: 120000;
 }>;
 /**
  * Run one delivery cycle: claim up to `batchSize` pending intents under a
@@ -1178,16 +2623,18 @@ declare const DEFAULT_WEBHOOK_DELIVERY_CYCLE: Readonly<{
  * option; `delivery_store_failed` or `delivery_store_timeout` when the claim
  * fails; `clock_invalid` for a failing clock.
  */
-declare function runWebhookDeliveryCycle(options: WebhookDeliveryCycleOptions): Promise<WebhookDeliveryCycleResult>;
-
-declare const WEBHOOK_DELIVERY_ACTION_EVENT_TYPES: readonly ["WebhookSubscriptionCreated", "WebhookSubscriptionUpdated", "WebhookSubscriptionPaused", "WebhookSubscriptionResumed", "WebhookSubscriptionDeleted", "WebhookSecretRotated", "WebhookDeliveryIntentRequeued", "WebhookFanOutJobRequeued", "WebhookFanOutJobActorEnriched"];
+export declare function runWebhookDeliveryCycle(options: WebhookDeliveryCycleOptions): Promise<WebhookDeliveryCycleResult>;
+//#endregion
+//#region src/action-events.d.ts
+export declare const WEBHOOK_DELIVERY_ACTION_EVENT_TYPES: readonly ["WebhookSubscriptionCreated", "WebhookSubscriptionUpdated", "WebhookSubscriptionPaused", "WebhookSubscriptionResumed", "WebhookSubscriptionDeleted", "WebhookSecretRotated", "WebhookDeliveryIntentRequeued", "WebhookFanOutJobRequeued", "WebhookFanOutJobActorEnriched"];
 /** An event type one of the package's governed actions emits. */
 type WebhookDeliveryActionEventType = (typeof WEBHOOK_DELIVERY_ACTION_EVENT_TYPES)[number];
 /** `true` when `eventType` is emitted by one of the package's governed actions. */
-declare function isWebhookDeliveryActionEventType(eventType: unknown): eventType is WebhookDeliveryActionEventType;
-
+export declare function isWebhookDeliveryActionEventType(eventType: unknown): eventType is WebhookDeliveryActionEventType;
+//#endregion
+//#region src/action-parameters.d.ts
 /** The governed actions, by the name after the module namespace (`<namespace>.<name>`). */
-declare const WEBHOOK_DELIVERY_ACTION_NAMES: readonly ["create_subscription", "update_subscription", "pause_subscription", "resume_subscription", "delete_subscription", "rotate_secret_staged", "rotate_secret_emergency", "requeue_delivery_intent", "requeue_fan_out_job", "enrich_fan_out_job_actor"];
+export declare const WEBHOOK_DELIVERY_ACTION_NAMES: readonly ["create_subscription", "update_subscription", "pause_subscription", "resume_subscription", "delete_subscription", "rotate_secret_staged", "rotate_secret_emergency", "requeue_delivery_intent", "requeue_fan_out_job", "enrich_fan_out_job_actor"];
 /** One governed action name. */
 type WebhookDeliveryActionName = (typeof WEBHOOK_DELIVERY_ACTION_NAMES)[number];
 /**
@@ -1200,88 +2647,88 @@ type WebhookDeliveryActionName = (typeof WEBHOOK_DELIVERY_ACTION_NAMES)[number];
  * outside the pattern grammar. `update_ambiguous`: an update naming both or
  * neither of patterns and destination.
  */
-declare const WEBHOOK_ACTION_PARAMETER_CODES: readonly ["parameters_invalid", "unknown_parameter", "secret_ref_invalid", "destination_invalid", "event_type_pattern_invalid", "update_ambiguous"];
+export declare const WEBHOOK_ACTION_PARAMETER_CODES: readonly ["parameters_invalid", "unknown_parameter", "secret_ref_invalid", "destination_invalid", "event_type_pattern_invalid", "update_ambiguous"];
 /** Why an action's parameters were refused. */
 type WebhookActionParameterCode = (typeof WEBHOOK_ACTION_PARAMETER_CODES)[number];
 /** `<namespace>.create_subscription` */
 interface WebhookCreateSubscriptionParameters {
-    readonly subscriptionId: string;
-    readonly eventTypePatterns: readonly string[];
-    readonly destinationUrl: string;
-    /** A secret reference, not key material or ciphertext (`isWebhookSecretReference`, then the verifier). */
-    readonly secretRef: string;
-    /** Only `v1` exists (decision 7); the default. */
-    readonly signatureScheme?: "v1";
+  readonly subscriptionId: string;
+  readonly eventTypePatterns: readonly string[];
+  readonly destinationUrl: string;
+  /** A secret reference, not key material or ciphertext (`isWebhookSecretReference`, then the verifier). */
+  readonly secretRef: string;
+  /** Only `v1` exists (decision 7); the default. */
+  readonly signatureScheme?: "v1";
 }
 /** `<namespace>.update_subscription`: exactly one of the two changes per invocation. */
 type WebhookUpdateSubscriptionParameters = {
-    readonly subscriptionId: string;
-    readonly eventTypePatterns: readonly string[];
-    readonly expectedRevision?: number;
+  readonly subscriptionId: string;
+  readonly eventTypePatterns: readonly string[];
+  readonly expectedRevision?: number;
 } | {
-    readonly subscriptionId: string;
-    readonly destinationUrl: string;
-    readonly expectedVersion?: number;
+  readonly subscriptionId: string;
+  readonly destinationUrl: string;
+  readonly expectedVersion?: number;
 };
 /** `<namespace>.pause_subscription`, `resume_subscription` and `delete_subscription`. */
 interface WebhookSubscriptionTransitionParameters {
-    readonly subscriptionId: string;
-    readonly expectedRevision?: number;
+  readonly subscriptionId: string;
+  readonly expectedRevision?: number;
 }
 /** `<namespace>.rotate_secret_staged` */
 interface WebhookStagedRotationParameters {
-    readonly subscriptionId: string;
-    /** The next secret's reference, not key material or ciphertext (`isWebhookSecretReference`, then the verifier). */
-    readonly secretRef: string;
-    /** The configuration version the operator read; the rotation applies only on it. */
-    readonly expectedVersion: number;
-    /** The operator's statement that the receiver already accepts the next secret (decision 8). */
-    readonly receiverAcceptsNextSecret: true;
+  readonly subscriptionId: string;
+  /** The next secret's reference, not key material or ciphertext (`isWebhookSecretReference`, then the verifier). */
+  readonly secretRef: string;
+  /** The configuration version the operator read; the rotation applies only on it. */
+  readonly expectedVersion: number;
+  /** The operator's statement that the receiver already accepts the next secret (decision 8). */
+  readonly receiverAcceptsNextSecret: true;
 }
 /** `<namespace>.rotate_secret_emergency` */
 interface WebhookEmergencyRotationParameters {
-    readonly subscriptionId: string;
-    readonly secretRef: string;
-    readonly expectedVersion?: number;
+  readonly subscriptionId: string;
+  readonly secretRef: string;
+  readonly expectedVersion?: number;
 }
 /** `<namespace>.requeue_delivery_intent` */
 interface WebhookIntentRequeueParameters {
-    readonly deliveryId: string;
-    /** The intent's `fence` as the operator read it. */
-    readonly expectedFence: number;
+  readonly deliveryId: string;
+  /** The intent's `fence` as the operator read it. */
+  readonly expectedFence: number;
 }
 /** `<namespace>.requeue_fan_out_job` and `enrich_fan_out_job_actor`. */
 interface WebhookJobParameters {
-    readonly eventId: string;
-    /** The job's `fence` as the operator read it. */
-    readonly expectedFence: number;
+  readonly eventId: string;
+  /** The job's `fence` as the operator read it. */
+  readonly expectedFence: number;
 }
 /** The parameters of each action, by name. */
 interface WebhookDeliveryActionParameters {
-    readonly create_subscription: WebhookCreateSubscriptionParameters;
-    readonly update_subscription: WebhookUpdateSubscriptionParameters;
-    readonly pause_subscription: WebhookSubscriptionTransitionParameters;
-    readonly resume_subscription: WebhookSubscriptionTransitionParameters;
-    readonly delete_subscription: WebhookSubscriptionTransitionParameters;
-    readonly rotate_secret_staged: WebhookStagedRotationParameters;
-    readonly rotate_secret_emergency: WebhookEmergencyRotationParameters;
-    readonly requeue_delivery_intent: WebhookIntentRequeueParameters;
-    readonly requeue_fan_out_job: WebhookJobParameters;
-    readonly enrich_fan_out_job_actor: WebhookJobParameters;
+  readonly create_subscription: WebhookCreateSubscriptionParameters;
+  readonly update_subscription: WebhookUpdateSubscriptionParameters;
+  readonly pause_subscription: WebhookSubscriptionTransitionParameters;
+  readonly resume_subscription: WebhookSubscriptionTransitionParameters;
+  readonly delete_subscription: WebhookSubscriptionTransitionParameters;
+  readonly rotate_secret_staged: WebhookStagedRotationParameters;
+  readonly rotate_secret_emergency: WebhookEmergencyRotationParameters;
+  readonly requeue_delivery_intent: WebhookIntentRequeueParameters;
+  readonly requeue_fan_out_job: WebhookJobParameters;
+  readonly enrich_fan_out_job_actor: WebhookJobParameters;
 }
 /** What reading one action's parameters found. */
 type WebhookActionParameterRead<N extends WebhookDeliveryActionName> = {
-    readonly ok: true;
-    readonly value: WebhookDeliveryActionParameters[N];
+  readonly ok: true;
+  readonly value: WebhookDeliveryActionParameters[N];
 } | {
-    readonly ok: false;
-    readonly code: WebhookActionParameterCode;
-    readonly field: string;
+  readonly ok: false;
+  readonly code: WebhookActionParameterCode;
+  readonly field: string;
 };
 /** The longest secret reference accepted. */
-declare const WEBHOOK_SECRET_REF_MAX_LENGTH = 256;
+export declare const WEBHOOK_SECRET_REF_MAX_LENGTH = 256;
 /** The longest run of characters between two separators (`:`, `/`, `@`, `#`) in a secret reference. */
-declare const WEBHOOK_SECRET_REF_MAX_SEGMENT = 64;
+export declare const WEBHOOK_SECRET_REF_MAX_SEGMENT = 64;
 /**
  * Whether `value` has the shape of a secret reference (ADR 0018 decision 8):
  * a lower-case scheme and `:` (`kms:`, `vault:`, `arn:`, `secret:` …), then
@@ -1298,16 +2745,16 @@ declare const WEBHOOK_SECRET_REF_MAX_SEGMENT = 64;
  * `secretReferences.verify` port to confirm the reference resolves in the
  * tenant's secret store.
  */
-declare function isWebhookSecretReference(value: unknown): value is string;
+export declare function isWebhookSecretReference(value: unknown): value is string;
 /** The most patterns one subscription takes. */
-declare const WEBHOOK_MAX_EVENT_TYPE_PATTERNS = 64;
+export declare const WEBHOOK_MAX_EVENT_TYPE_PATTERNS = 64;
 /**
  * Whether `value` is an event type pattern the matcher understands: `*`,
  * `prefix.*`, or an exact type, built from `A–Z a–z 0–9 _ : -` segments
  * joined by `.`, at most 256 characters. A `*` anywhere else is refused,
  * since the matcher would treat it as a literal.
  */
-declare function isWebhookEventTypePattern(value: unknown): value is string;
+export declare function isWebhookEventTypePattern(value: unknown): value is string;
 /**
  * Read one action's parameters. Never throws: the only thrown value whose
  * properties are read is the package's own `Refusal` (recognized by
@@ -1317,25 +2764,26 @@ declare function isWebhookEventTypePattern(value: unknown): value is string;
  * returned are each checked against their fixed set (`fixedRefusal`). Tests:
  * "forged refusals: …".
  */
-declare function readWebhookActionParameters<N extends WebhookDeliveryActionName>(name: N, input: unknown): WebhookActionParameterRead<N>;
+export declare function readWebhookActionParameters<N extends WebhookDeliveryActionName>(name: N, input: unknown): WebhookActionParameterRead<N>;
 /** The default module namespace. */
-declare const DEFAULT_WEBHOOK_DELIVERY_NAMESPACE = "webhook-delivery";
-
+export declare const DEFAULT_WEBHOOK_DELIVERY_NAMESPACE = "webhook-delivery";
+//#endregion
+//#region src/governed-actions.d.ts
 /** What the module's operator policy asks the application about one invocation. */
 interface WebhookOperatorAuthorizationInput {
-    /** `<namespace>.<action name>`. */
-    readonly actionId: string;
-    readonly action: WebhookDeliveryActionName;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly actorId: string;
-    readonly actorType: string;
-    /** The ids the action names, copied from three id fields by `operatorPolicy`; no URL or secret reference. */
-    readonly target: {
-        readonly subscriptionId?: string;
-        readonly deliveryId?: string;
-        readonly eventId?: string;
-    };
+  /** `<namespace>.<action name>`. */
+  readonly actionId: string;
+  readonly action: WebhookDeliveryActionName;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly actorId: string;
+  readonly actorType: string;
+  /** The ids the action names, copied from three id fields by `operatorPolicy`; no URL or secret reference. */
+  readonly target: {
+    readonly subscriptionId?: string;
+    readonly deliveryId?: string;
+    readonly eventId?: string;
+  };
 }
 /**
  * The module policy's question (`<namespace>.operator_authorized.v1`). Only a
@@ -1352,9 +2800,9 @@ type WebhookOperatorAuthorization = (input: WebhookOperatorAuthorizationInput, o
  * `options.signal`, which Host aborts at its admission deadline.
  */
 interface WebhookSecretReferenceVerifier {
-    verify(input: WebhookScope & {
-        readonly secretRef: string;
-    }, options: WebhookCallOptions): Promise<"valid" | "invalid">;
+  verify(input: WebhookScope & {
+    readonly secretRef: string;
+  }, options: WebhookCallOptions): Promise<"valid" | "invalid">;
 }
 /**
  * What the application's actor reader found on the canonical event
@@ -1364,41 +2812,41 @@ interface WebhookSecretReferenceVerifier {
  * tenant and space.
  */
 type WebhookEventActorReading = {
-    readonly state: "found";
-    readonly actorId: string;
-    readonly actorType: string;
+  readonly state: "found";
+  readonly actorId: string;
+  readonly actorType: string;
 } | {
-    readonly state: "withheld";
+  readonly state: "withheld";
 } | {
-    readonly state: "not_found";
+  readonly state: "not_found";
 };
 /** Reads the actor of the canonical event for a legacy job's tenant, space and `eventId` (decision 5). */
 interface WebhookEventActorReader {
-    readEventActor(input: WebhookScope & {
-        readonly eventId: string;
-        readonly eventType: string;
-        readonly payloadClassification: string;
-    }, options: WebhookCallOptions): Promise<WebhookEventActorReading>;
+  readEventActor(input: WebhookScope & {
+    readonly eventId: string;
+    readonly eventType: string;
+    readonly payloadClassification: string;
+  }, options: WebhookCallOptions): Promise<WebhookEventActorReading>;
 }
 /** Options for {@link createWebhookDeliveryModule}. */
 interface WebhookDeliveryModuleOptions {
-    /** The module namespace; actions are `<namespace>.<name>`. Default `webhook-delivery`. */
-    readonly namespace?: string;
-    readonly subscriptions: WebhookSubscriptionStore & WebhookSubscriptionWriter;
-    readonly deliveries: WebhookDeliveryStore;
-    /** Re-validates a destination at configuration change and at intent requeue (decision 6). */
-    readonly resolver: WebhookDestinationResolver;
-    readonly secretReferences: WebhookSecretReferenceVerifier;
-    readonly actorReader: WebhookEventActorReader;
-    readonly authorizeOperatorAction: WebhookOperatorAuthorization;
-    readonly clock: WebhookClock;
-    /** `portTimeoutMs` bounds every port call; `fanOutDeadlineMs` and `deliveryDeadlineMs` set requeued deadlines; `attemptTimeoutMs` enters the staged rotation's retention. */
-    readonly limits?: Partial<WebhookDeliveryLimits>;
-    /** The receivers' signature timestamp tolerance, for a staged rotation's `previousSecretRetainUntil`. Default 300 000 (R6). */
-    readonly verifierToleranceMs?: number;
+  /** The module namespace; actions are `<namespace>.<name>`. Default `webhook-delivery`. */
+  readonly namespace?: string;
+  readonly subscriptions: WebhookSubscriptionStore & WebhookSubscriptionWriter;
+  readonly deliveries: WebhookDeliveryStore;
+  /** Re-validates a destination at configuration change and at intent requeue (decision 6). */
+  readonly resolver: WebhookDestinationResolver;
+  readonly secretReferences: WebhookSecretReferenceVerifier;
+  readonly actorReader: WebhookEventActorReader;
+  readonly authorizeOperatorAction: WebhookOperatorAuthorization;
+  readonly clock: WebhookClock;
+  /** `portTimeoutMs` bounds every port call; `fanOutDeadlineMs` and `deliveryDeadlineMs` set requeued deadlines; `attemptTimeoutMs` enters the staged rotation's retention. */
+  readonly limits?: Partial<WebhookDeliveryLimits>;
+  /** The receivers' signature timestamp tolerance, for a staged rotation's `previousSecretRetainUntil`. Default 300 000 (R6). */
+  readonly verifierToleranceMs?: number;
 }
 /** The module policy's id for a namespace. */
-declare function webhookOperatorPolicyId(namespace?: string): `${string}.v${number}`;
+export declare function webhookOperatorPolicyId(namespace?: string): `${string}.v${number}`;
 /**
  * Build the package's governed operator actions as one `FabricModule`
  * (README, "Governed actions"). Register it with `createModuleRegistry()`
@@ -1413,6 +2861,6 @@ declare function webhookOperatorPolicyId(namespace?: string): `${string}.v${numb
  * @throws {WebhookDeliveryConfigError} when a limit or `verifierToleranceMs`
  * is not a positive whole number.
  */
-declare function createWebhookDeliveryModule<TDb = unknown>(options: WebhookDeliveryModuleOptions): FabricModule<TDb>;
-
-export { DEFAULT_WEBHOOK_DELIVERY_CYCLE, DEFAULT_WEBHOOK_DELIVERY_LIMITS, DEFAULT_WEBHOOK_DELIVERY_NAMESPACE, DEFAULT_WEBHOOK_FAN_OUT_CYCLE, MemoryWebhookDeliveryStore, type MemoryWebhookDeliveryStoreOptions, MemoryWebhookSubscriptionStore, type MemoryWebhookSubscriptionStoreOptions, PostgresWebhookDeliveryStore, type PostgresWebhookDeliveryStoreOptions, PostgresWebhookSubscriptionStore, type PostgresWebhookSubscriptionStoreOptions, WEBHOOK_ACTION_PARAMETER_CODES, WEBHOOK_DELIVERY_ACTION_EVENT_TYPES, WEBHOOK_DELIVERY_ACTION_NAMES, WEBHOOK_DELIVERY_FORMAT_V1, WEBHOOK_HEADERS, WEBHOOK_MAX_EVENT_TYPE_PATTERNS, WEBHOOK_MAX_REPLAY_HORIZON_MS, WEBHOOK_MAX_TIMER_MS, WEBHOOK_SECRET_REF_MAX_LENGTH, WEBHOOK_SECRET_REF_MAX_SEGMENT, type WebhookActionParameterCode, type WebhookActionParameterRead, WebhookActorEnrichmentRequest, WebhookActorEnrichmentResult, type WebhookActorRequirementInput, WebhookAdmissionDecision, WebhookAdmissionDenialCode, WebhookAdmissionDenialRecord, WebhookAttemptBeginResult, WebhookAttemptOutcome, WebhookAttemptReasonCode, WebhookCallOptions, WebhookClaimRequest, type WebhookClassifyOptions, WebhookClock, type WebhookCompositePublisherOptions, type WebhookCompositeSink, WebhookConfigErrorCode, WebhookConfigurationWriteResult, type WebhookCreateSubscriptionParameters, type WebhookDeliveryActionEventType, type WebhookDeliveryActionName, type WebhookDeliveryActionParameters, WebhookDeliveryAttemptFinish, WebhookDeliveryAttemptLogEntry, WebhookDeliveryAttemptRecord, WebhookDeliveryAttemptStart, WebhookDeliveryAuthorization, WebhookDeliveryAuthorizationDecision, WebhookDeliveryBodyV1, type WebhookDeliveryClassification, WebhookDeliveryConfigError, WebhookDeliveryConfigurationInput, type WebhookDeliveryCycleEvent, type WebhookDeliveryCycleOptions, type WebhookDeliveryCycleResult, type WebhookDeliveryCycleResultKind, WebhookDeliveryError, WebhookDeliveryErrorCode, WebhookDeliveryIntent, WebhookDeliveryLeaseCheck, type WebhookDeliveryLimits, type WebhookDeliveryModuleOptions, type WebhookDeliveryObservation, WebhookDeliveryStore, WebhookDestinationResolver, WebhookDiagnosticCode, type WebhookEgressPayload, type WebhookEgressProjectionInput, type WebhookEgressSubscription, WebhookEligibilityRevision, type WebhookEmergencyRotationParameters, type WebhookEventActorReader, type WebhookEventActorReading, WebhookEventAdmission, WebhookEventMetadata, type WebhookFanOutCycleOptions, type WebhookFanOutCycleResult, WebhookFanOutError, WebhookFanOutErrorCode, WebhookFanOutJob, WebhookFanOutJobDraft, WebhookFanOutJobFence, type WebhookFanOutPublisherOptions, WebhookFencedInsertResult, WebhookFencedWrite, WebhookGovernedActionError, WebhookGovernedActionErrorCode, WebhookInsertResult, type WebhookIntentRequeueParameters, WebhookJobActor, type WebhookJobParameters, WebhookJsonObject, type WebhookOperatorAuthorization, type WebhookOperatorAuthorizationInput, WebhookPayloadPolicy, type WebhookPersistenceProjectionOptions, type WebhookPostgresConnection, type WebhookPostgresPool, type WebhookPostgresQueryable, type WebhookPostgresResult, WebhookProjectionError, WebhookProjectionErrorCode, WebhookPurgeResult, WebhookRandomSource, type WebhookRenderInput, type WebhookRenderedBody, type WebhookRequestHeaderInput, WebhookRequeueEvidence, WebhookRequeueRequest, WebhookRequeueResult, WebhookRetryDelay, type WebhookRetryDelayOptions, WebhookScope, WebhookScopePredicate, type WebhookSecretReferenceVerifier, WebhookSigner, WebhookSourceEnvelope, type WebhookStagedRotationParameters, WebhookStoreError, WebhookStoreErrorCode, WebhookSubscriptionSnapshot, WebhookSubscriptionStore, WebhookSubscriptionTransitionInput, type WebhookSubscriptionTransitionParameters, WebhookSubscriptionWriteResult, WebhookSubscriptionWriter, WebhookTombstone, type WebhookTransactionCheckpointStage, WebhookTransport, WebhookTransportResult, type WebhookUpdateSubscriptionParameters, buildWebhookRequestHeaders, classifyWebhookDeliveryObservation, createWebhookCompositePublisher, createWebhookDeliveryModule, createWebhookFanOutPublisher, createWebhookRetryDelay, isPublicWebhookAddress, isWebhookDeliveryActionEventType, isWebhookEventTypePattern, isWebhookSecretReference, matchesWebhookEventTypePattern, normalizeWebhookAdmissionDecision, normalizeWebhookDeliveryAuthorizationDecision, parseRetryAfterMs, projectWebhookEgressPayload, projectWebhookEventMetadata, projectWebhookFanOutJob, readWebhookActionParameters, renderWebhookDeliveryBodyV1, resolveWebhookDeliveryLimits, runWebhookDeliveryCycle, runWebhookFanOutCycle, webhookAdmissionAllow, webhookAdmissionDeny, webhookAdmissionUnavailable, webhookOperatorPolicyId, webhookSignedContentV1 };
+export declare function createWebhookDeliveryModule<TDb = unknown>(options: WebhookDeliveryModuleOptions): FabricModule<TDb>;
+//#endregion
+export type { MemoryWebhookDeliveryStoreOptions, MemoryWebhookSubscriptionStoreOptions, PostgresWebhookDeliveryStoreOptions, PostgresWebhookSubscriptionStoreOptions, WebhookActionParameterCode, WebhookActionParameterRead, WebhookActionRefusalCode, WebhookActorEnrichmentRequest, WebhookActorEnrichmentResult, WebhookActorRequirementInput, WebhookAdmissionDecision, WebhookAdmissionDenialCode, WebhookAdmissionDenialRecord, WebhookAdmissionInput, WebhookAttemptBeginResult, WebhookAttemptOutcome, WebhookAttemptReasonCode, WebhookCallOptions, WebhookClaimRequest, WebhookClassifyOptions, WebhookClock, WebhookCompositePublisherOptions, WebhookCompositeSink, WebhookConfigErrorCode, WebhookConfigurationWriteResult, WebhookCreateSubscriptionParameters, WebhookDeliveryActionEventType, WebhookDeliveryActionName, WebhookDeliveryActionParameters, WebhookDeliveryAttemptFinish, WebhookDeliveryAttemptInFlight, WebhookDeliveryAttemptLogEntry, WebhookDeliveryAttemptRecord, WebhookDeliveryAttemptStart, WebhookDeliveryAuthorization, WebhookDeliveryAuthorizationDecision, WebhookDeliveryAuthorizationInput, WebhookDeliveryBodyV1, WebhookDeliveryClassification, WebhookDeliveryConfiguration, WebhookDeliveryConfigurationInput, WebhookDeliveryCycleEvent, WebhookDeliveryCycleOptions, WebhookDeliveryCycleResult, WebhookDeliveryCycleResultKind, WebhookDeliveryErrorCode, WebhookDeliveryIntent, WebhookDeliveryIntentStatus, WebhookDeliveryLeaseCheck, WebhookDeliveryLimits, WebhookDeliveryModuleOptions, WebhookDeliveryObservation, WebhookDeliveryStore, WebhookDestinationResolution, WebhookDestinationResolver, WebhookDestinationResolverOptions, WebhookDestinationUrlCheck, WebhookDiagnosticCode, WebhookDnsLookup, WebhookEgressPayload, WebhookEgressProjectionInput, WebhookEgressSubscription, WebhookEligibilityRevision, WebhookEmergencyRotationParameters, WebhookEventActorReader, WebhookEventActorReading, WebhookEventAdmission, WebhookEventMetadata, WebhookEventTypePolicy, WebhookFanOutCycleOptions, WebhookFanOutCycleResult, WebhookFanOutErrorCode, WebhookFanOutJob, WebhookFanOutJobDraft, WebhookFanOutJobFence, WebhookFanOutJobStatus, WebhookFanOutPublisherOptions, WebhookFencedInsertResult, WebhookFencedWrite, WebhookGovernedActionErrorCode, WebhookInputErrorCode, WebhookInsertResult, WebhookIntentRequeueParameters, WebhookJobActor, WebhookJobParameters, WebhookJsonObject, WebhookJsonValue, WebhookLease, WebhookOperatorAuthorization, WebhookOperatorAuthorizationInput, WebhookPayloadPolicy, WebhookPersistenceProjectionOptions, WebhookPostgresConnection, WebhookPostgresPool, WebhookPostgresQueryable, WebhookPostgresResult, WebhookProjectionErrorCode, WebhookPurgeResult, WebhookRandomSource, WebhookRenderInput, WebhookRenderedBody, WebhookRequestHeaderInput, WebhookRequeueEvidence, WebhookRequeueRequest, WebhookRequeueResult, WebhookResolvedAddress, WebhookRetryDelay, WebhookRetryDelayOptions, WebhookRevocationCode, WebhookScope, WebhookScopeInput, WebhookScopePredicate, WebhookSecretReferenceVerifier, WebhookSignRequest, WebhookSignatureScheme, WebhookSigner, WebhookSourceEnvelope, WebhookStagedRotationParameters, WebhookStoreErrorCode, WebhookSubscriptionSnapshot, WebhookSubscriptionStatus, WebhookSubscriptionStore, WebhookSubscriptionTransitionInput, WebhookSubscriptionTransitionParameters, WebhookSubscriptionWriteRefusal, WebhookSubscriptionWriteResult, WebhookSubscriptionWriter, WebhookTombstone, WebhookTransactionCheckpointStage, WebhookTransport, WebhookTransportRequest, WebhookTransportResult, WebhookUpdateSubscriptionParameters, WebhookVettedDestination };