@fabricorg/webhook-delivery 0.1.3 → 0.2.0

package/dist/index.d.cts

@@ -9,7 +9,7 @@ import { FabricModule } from "@fabricorg/platform";
  * arrays are frozen, so no caller can widen a set at runtime.
  */
 /** Reasons an admission port may give for `deny`. */
-export declare const WEBHOOK_ADMISSION_DENIAL_CODES: readonly ["actor_not_permitted", "scope_not_permitted", "event_type_not_permitted", "classification_not_permitted", "policy_denied"];
+export declare const WEBHOOK_ADMISSION_DENIAL_CODES: readonly ["actor_not_permitted", "scope_not_permitted", "event_type_not_permitted", "classification_not_permitted", "policy_denied", "event_erased"];
 /** A reason code carried by an admission `deny` decision and stored on its denial record. */
 type WebhookAdmissionDenialCode = (typeof WEBHOOK_ADMISSION_DENIAL_CODES)[number];
 /** Reasons a delivery authorization port may give for `revoked`. */
@@ -150,7 +150,7 @@ type WebhookDeliveryErrorCode = (typeof WEBHOOK_DELIVERY_ERROR_CODES)[number];
  *   active subscription that was paused and resumed after the intent's
  *   eligibility revision; dispatch would cancel it (decision 3).
  * - `not_found`, `stale`, `not_dead_letter`, `past_replay_horizon`: the
- *   delivery store refused a requeue or enrichment (decision 10, R5).
+ *   delivery store refused a requeue, enrichment or replay range (decision 10, R5).
  * - `not_enrichable`, `actor_present`, `actor_suppressed`: enrichment of a
  *   completed job, or of a job whose actor is not `legacy` (decision 5).
  *   `actor_withheld`, `actor_not_found`, `actor_unavailable`: the
@@ -163,10 +163,18 @@ type WebhookDeliveryErrorCode = (typeof WEBHOOK_DELIVERY_ERROR_CODES)[number];
  *   intent requeue whose evidence predates `subscriptionId` and whose intent
  *   can no longer be read, so the applied requeue has no event (README,
  *   "Atomicity and re-runs").
+ * - `replay_not_supported`: replay was not explicitly enabled; operator
+ *   authorization is not asked. `invocation_required`: replay lacks a trusted
+ *   action invocation ID to key its immutable acceptance receipt.
+ * - `replay_range_invalid`: the historical range is empty or reversed.
+ *   `replay_range_in_future`: its exclusive upper bound exceeds the store clock.
+ * - `replay_limit_exceeded`: fixed membership exceeds the configured cap;
+ *   no receipt or partial work is accepted. `replay_request_conflict`: an
+ *   invocation ID was reused with different action parameters or action ID.
  * - `action_failed`: anything else, such as a failing clock; nothing it
  *   threw is read.
  */
-export declare const WEBHOOK_ACTION_REFUSAL_CODES: readonly ["admission_not_enforced", "scope_invalid", "actor_invalid", "secret_ref_invalid", "secret_ref_unverified", "secret_ref_unchanged", "destination_refused", "destination_unresolved", "subscription_not_found", "subscription_exists", "subscription_deleted", "subscription_not_active", "paused_since_intent", "invalid_transition", "revision_conflict", "version_conflict", "not_found", "stale", "not_dead_letter", "past_replay_horizon", "not_enrichable", "actor_present", "actor_suppressed", "actor_withheld", "actor_not_found", "actor_unavailable", "store_unavailable", "store_outcome_unknown", "action_failed"];
+export declare const WEBHOOK_ACTION_REFUSAL_CODES: readonly ["replay_not_supported", "invocation_required", "replay_range_invalid", "replay_range_in_future", "replay_limit_exceeded", "replay_request_conflict", "admission_not_enforced", "scope_invalid", "actor_invalid", "secret_ref_invalid", "secret_ref_unverified", "secret_ref_unchanged", "destination_refused", "destination_unresolved", "subscription_not_found", "subscription_exists", "subscription_deleted", "subscription_not_active", "paused_since_intent", "invalid_transition", "revision_conflict", "version_conflict", "not_found", "stale", "not_dead_letter", "past_replay_horizon", "not_enrichable", "actor_present", "actor_suppressed", "actor_withheld", "actor_not_found", "actor_unavailable", "store_unavailable", "store_outcome_unknown", "action_failed"];
 /** Why a governed action refused. */
 type WebhookActionRefusalCode = (typeof WEBHOOK_ACTION_REFUSAL_CODES)[number];
 /**
@@ -250,6 +258,150 @@ export declare class WebhookGovernedActionError extends Error {
   constructor(code: WebhookGovernedActionErrorCode, field: string);
 }
 //#endregion
+//#region src/action-parameters.d.ts
+/** The governed actions, by the name after the module namespace (`<namespace>.<name>`). */
+export declare const WEBHOOK_DELIVERY_ACTION_NAMES: readonly ["create_subscription", "update_subscription", "pause_subscription", "resume_subscription", "delete_subscription", "rotate_secret_staged", "rotate_secret_emergency", "requeue_delivery_intent", "requeue_fan_out_job", "enrich_fan_out_job_actor", "replay_events"];
+/** One governed action name. */
+type WebhookDeliveryActionName = (typeof WEBHOOK_DELIVERY_ACTION_NAMES)[number];
+/**
+ * Why parameters were refused. `parameters_invalid`: not a plain-data
+ * object, a field missing or malformed, or an id breaking the store
+ * identifier rule. `unknown_parameter`: a key the action does not declare
+ * (named in no message). `secret_ref_invalid`: a `secretRef` that is not a
+ * secret reference. `destination_invalid`: a destination URL breaking the
+ * URL rules (README, "URL rules"). `event_type_pattern_invalid`: a pattern
+ * outside the pattern grammar. `update_ambiguous`: an update naming both or
+ * neither of patterns and destination.
+ */
+export declare const WEBHOOK_ACTION_PARAMETER_CODES: readonly ["parameters_invalid", "unknown_parameter", "secret_ref_invalid", "destination_invalid", "event_type_pattern_invalid", "update_ambiguous"];
+/** Why an action's parameters were refused. */
+type WebhookActionParameterCode = (typeof WEBHOOK_ACTION_PARAMETER_CODES)[number];
+/** `<namespace>.create_subscription` */
+interface WebhookCreateSubscriptionParameters {
+  readonly subscriptionId: string;
+  readonly eventTypePatterns: readonly string[];
+  readonly destinationUrl: string;
+  /** A secret reference, not key material or ciphertext (`isWebhookSecretReference`, then the verifier). */
+  readonly secretRef: string;
+  /** Only `v1` exists (decision 7); the default. */
+  readonly signatureScheme?: "v1";
+}
+/** `<namespace>.update_subscription`: exactly one of the two changes per invocation. */
+type WebhookUpdateSubscriptionParameters = {
+  readonly subscriptionId: string;
+  readonly eventTypePatterns: readonly string[];
+  readonly expectedRevision?: number;
+} | {
+  readonly subscriptionId: string;
+  readonly destinationUrl: string;
+  readonly expectedVersion?: number;
+};
+/** `<namespace>.pause_subscription`, `resume_subscription` and `delete_subscription`. */
+interface WebhookSubscriptionTransitionParameters {
+  readonly subscriptionId: string;
+  readonly expectedRevision?: number;
+}
+/** `<namespace>.rotate_secret_staged` */
+interface WebhookStagedRotationParameters {
+  readonly subscriptionId: string;
+  /** The next secret's reference, not key material or ciphertext (`isWebhookSecretReference`, then the verifier). */
+  readonly secretRef: string;
+  /** The configuration version the operator read; the rotation applies only on it. */
+  readonly expectedVersion: number;
+  /** The operator's statement that the receiver already accepts the next secret (decision 8). */
+  readonly receiverAcceptsNextSecret: true;
+}
+/** `<namespace>.rotate_secret_emergency` */
+interface WebhookEmergencyRotationParameters {
+  readonly subscriptionId: string;
+  readonly secretRef: string;
+  readonly expectedVersion?: number;
+}
+/** `<namespace>.requeue_delivery_intent` */
+interface WebhookIntentRequeueParameters {
+  readonly deliveryId: string;
+  /** The intent's `fence` as the operator read it. */
+  readonly expectedFence: number;
+}
+/** `<namespace>.requeue_fan_out_job` and `enrich_fan_out_job_actor`. */
+interface WebhookJobParameters {
+  readonly eventId: string;
+  /** The job's `fence` as the operator read it. */
+  readonly expectedFence: number;
+}
+/** Explicit historical range; from inclusive, to exclusive. */
+interface WebhookReplayEventsParameters {
+  readonly subscriptionId: string;
+  readonly eventTypePatterns?: readonly string[];
+  readonly from: string;
+  readonly to: string;
+}
+/** The parameters of each action, by name. */
+interface WebhookDeliveryActionParameters {
+  readonly replay_events: WebhookReplayEventsParameters;
+  readonly create_subscription: WebhookCreateSubscriptionParameters;
+  readonly update_subscription: WebhookUpdateSubscriptionParameters;
+  readonly pause_subscription: WebhookSubscriptionTransitionParameters;
+  readonly resume_subscription: WebhookSubscriptionTransitionParameters;
+  readonly delete_subscription: WebhookSubscriptionTransitionParameters;
+  readonly rotate_secret_staged: WebhookStagedRotationParameters;
+  readonly rotate_secret_emergency: WebhookEmergencyRotationParameters;
+  readonly requeue_delivery_intent: WebhookIntentRequeueParameters;
+  readonly requeue_fan_out_job: WebhookJobParameters;
+  readonly enrich_fan_out_job_actor: WebhookJobParameters;
+}
+/** What reading one action's parameters found. */
+type WebhookActionParameterRead<N extends WebhookDeliveryActionName> = {
+  readonly ok: true;
+  readonly value: WebhookDeliveryActionParameters[N];
+} | {
+  readonly ok: false;
+  readonly code: WebhookActionParameterCode;
+  readonly field: string;
+};
+/** The longest secret reference accepted. */
+export declare const WEBHOOK_SECRET_REF_MAX_LENGTH = 256;
+/** The longest run of characters between two separators (`:`, `/`, `@`, `#`) in a secret reference. */
+export declare const WEBHOOK_SECRET_REF_MAX_SEGMENT = 64;
+/**
+ * Whether `value` has the shape of a secret reference (ADR 0018 decision 8):
+ * a lower-case scheme and `:` (`kms:`, `vault:`, `arn:`, `secret:` …), then
+ * only `A–Z a–z 0–9 . _ ~ : / @ # -`, at most
+ * {@link WEBHOOK_SECRET_REF_MAX_LENGTH} characters, with no run longer than
+ * {@link WEBHOOK_SECRET_REF_MAX_SEGMENT} between separators.
+ *
+ * That refuses raw key bytes and their usual encodings: hex, base64 and
+ * `whsec_…` values (no scheme), padded or standard base64 (`=`, `+`), PEM
+ * armour and anything with whitespace or control characters, and long
+ * encoded runs such as wrapped ciphertext. It cannot recognise key material
+ * deliberately shaped like a reference (`x:` followed by 64 hex digits
+ * passes), which is why the actions also require the application's
+ * `secretReferences.verify` port to confirm the reference resolves in the
+ * tenant's secret store.
+ */
+export declare function isWebhookSecretReference(value: unknown): value is string;
+/** The most patterns one subscription takes. */
+export declare const WEBHOOK_MAX_EVENT_TYPE_PATTERNS = 64;
+/**
+ * Whether `value` is an event type pattern the matcher understands: `*`,
+ * `prefix.*`, or an exact type, built from `A–Z a–z 0–9 _ : -` segments
+ * joined by `.`, at most 256 characters. A `*` anywhere else is refused,
+ * since the matcher would treat it as a literal.
+ */
+export declare function isWebhookEventTypePattern(value: unknown): value is string;
+/**
+ * Read one action's parameters. Never throws: the only thrown value whose
+ * properties are read is the package's own `Refusal` (recognized by
+ * `Refusal.is`, which runs none of a value's code); anything else thrown
+ * while the input is read (an accessor, a Proxy trap, a look-alike refusal)
+ * is dropped unread and reported as `parameters_invalid`. The code and field
+ * returned are each checked against their fixed set (`fixedRefusal`). Tests:
+ * "forged refusals: …".
+ */
+export declare function readWebhookActionParameters<N extends WebhookDeliveryActionName>(name: N, input: unknown): WebhookActionParameterRead<N>;
+/** The default module namespace. */
+export declare const DEFAULT_WEBHOOK_DELIVERY_NAMESPACE = "webhook-delivery";
+//#endregion
 //#region src/types.d.ts
 /** A JSON value. Every record this package defines is built from these. */
 type WebhookJsonValue = null | boolean | number | string | readonly WebhookJsonValue[] | {
@@ -341,6 +493,8 @@ interface WebhookFanOutJobDraft {
   readonly payloadProjected: boolean;
   /** Declared admission and scope facts; empty when none are declared or allowed. */
   readonly facts: WebhookJsonObject;
+  /** Store-owned erasure marker; undecided subscriptions must fail closed. */
+  readonly erased?: boolean;
   readonly actor: WebhookJobActor;
 }
 /** A fenced lease. A write carrying an older `fence` than the record's is refused. */
@@ -525,8 +679,9 @@ type WebhookDeliveryAttemptLogEntry = WebhookDeliveryAttemptRecord | WebhookDeli
  * with that record, when a purge finds the event older than the replay
  * horizon (R5). `retainUntil` is the event's `recordedAt` plus the store's
  * horizon: until then any insert for the pair is `already_present`, and
- * after it every insert for the pair is `past_horizon`, so a replay cannot
- * re-deliver whether or not a purge has run (the "cleanup racing" cases in
+ * after it every insert for the pair is `past_horizon`, so governed replay
+ * cannot create a second intent whether or not a purge has run. Dispatch
+ * remains at-least-once (the "cleanup racing" cases in
  * `tests/store-contract.ts`).
  */
 interface WebhookTombstone {
@@ -862,7 +1017,9 @@ type WebhookRequeueResult = {
  * The result of an actor enrichment (decision 5), checked in this order.
  * `not_found`: no such job in this scope. `stale`: the job's fence is no
  * longer the request's `expectedFence`. `not_enrichable`: the job is
- * `completed`, which is final (README, "Completeness boundary").
+ * `completed`, which remains final for ordinary fan-out's historical selection
+ * (README, "Completeness boundary"); a governed replay request does not reopen
+ * or enrich that completed source job.
  * `actor_present`: the job already carries an actor. `actor_suppressed`:
  * Host's `includeActor` hook withheld the actor, which enrichment never
  * overrides. `past_horizon`: the event is older than the replay horizon.
@@ -911,6 +1068,11 @@ type WebhookDeliveryLeaseCheck = {
   readonly valid: false;
   readonly reason: "lease_lost" | "intent_not_pending" | "not_found";
 };
+interface WebhookRedactionResult {
+  readonly jobsRedacted: number;
+  readonly intentsRedacted: number;
+  readonly markersRecorded: number;
+}
 /**
  * Durable state for both stages (decisions 2, 3 and 10): fan-out jobs keyed
  * by `eventId`, intents keyed by (subscriptionId, eventId), fenced leases,
@@ -951,6 +1113,19 @@ type WebhookDeliveryLeaseCheck = {
  * proves its check-to-write atomicity separately (README, "Contract suite").
  */
 interface WebhookDeliveryStore {
+  /**
+   * In one atomic step, scrub jobs and intents scoped to tenant and space for
+   * 1–100 distinct event identifiers. Durable markers scrub late inserts.
+   * Repeated calls repair rows written by older versions, counting and fencing
+   * only rows whose content changes; a no-op leaves fences and leases alone.
+   * Erased jobs deny undecided subscriptions with `event_erased`.
+   * Changed jobs and pending intents advance fences and clear leases.
+   * An attempt begun before this step can still send its old body afterward;
+   * its settlement loses the advanced fence and metadata-only delivery retries.
+   */
+  redactEventRecords(input: WebhookScope & {
+    readonly eventIds: readonly string[];
+  }, options: WebhookCallOptions): Promise<WebhookRedactionResult>;
   /**
    * Insert a pending job, available at `createdAt`, unless one exists for
    * `eventId` or the event is past the replay horizon.
@@ -1422,6 +1597,153 @@ interface WebhookScopeInput {
  */
 type WebhookScopePredicate = (input: WebhookScopeInput) => boolean;
 //#endregion
+//#region src/replay.d.ts
+/** Opt-in current-head read; revision and active interval must share one snapshot. */
+interface WebhookReplaySubscriptionReader {
+  readReplaySubscription(input: WebhookScope & {
+    readonly subscriptionId: string;
+  }, options: WebhookCallOptions): Promise<{
+    readonly revision: WebhookEligibilityRevision;
+    readonly statusSinceRevision: number;
+  } | null>;
+}
+interface WebhookReplayKey extends WebhookScope {
+  readonly actionInvocationId: string;
+}
+interface WebhookReplayJobKey extends WebhookReplayKey {
+  readonly eventId: string;
+}
+interface WebhookReplayRequestInput extends WebhookReplayKey {
+  readonly actionId: string;
+  readonly requestedBy: {
+    readonly actorId: string;
+    readonly actorType: string;
+  };
+  readonly parameters: WebhookReplayEventsParameters;
+  readonly observedRevision: WebhookEligibilityRevision;
+  readonly observedStatusSinceRevision: number;
+  readonly maxEvents: number;
+  readonly processingLifetimeMs: number;
+}
+interface WebhookReplayReceipt extends WebhookReplayKey {
+  readonly actionId: string;
+  readonly requestedBy: {
+    readonly actorId: string;
+    readonly actorType: string;
+  };
+  readonly parameters: WebhookReplayEventsParameters;
+  readonly observedRevision: WebhookEligibilityRevision;
+  readonly observedStatusSinceRevision: number;
+  readonly acceptedAt: string;
+  readonly processingDeadline: string;
+  readonly selected: readonly {
+    readonly eventId: string;
+    readonly recordedAt: string;
+  }[];
+  readonly count: number;
+}
+type WebhookReplayRefusal = "replay_range_invalid" | "replay_range_in_future" | "replay_limit_exceeded" | "replay_request_conflict" | "past_replay_horizon";
+type WebhookReplayRequestResult = {
+  readonly applied: true;
+  readonly receipt: WebhookReplayReceipt;
+  readonly replayed?: true;
+} | {
+  readonly applied: false;
+  readonly code: WebhookReplayRefusal;
+};
+type WebhookReplaySkipReason = "subscription_not_found" | "subscription_not_active" | "active_interval_ended" | "patterns_no_longer_match";
+type WebhookReplayOutcome = {
+  readonly kind: "intent";
+  readonly deliveryId: string;
+} | {
+  readonly kind: "denial";
+  readonly code: WebhookAdmissionDenialCode;
+} | {
+  readonly kind: "already_decided";
+} | {
+  readonly kind: "skipped";
+  readonly reason: WebhookReplaySkipReason;
+} | {
+  readonly kind: "past_replay_horizon";
+} | {
+  readonly kind: "dead_lettered";
+  readonly diagnostic: WebhookDiagnosticCode | "source_missing";
+};
+interface WebhookReplayItem extends WebhookReplayJobKey {
+  /** Fixed acceptance-time active interval and bounded pattern lists, independent of membership size. */
+  readonly observedStatusSinceRevision: number;
+  readonly eventTypePatterns: readonly string[];
+  readonly observedEventTypePatterns: readonly string[];
+  readonly subscriptionId: string;
+  readonly recordedAt: string;
+  readonly processingDeadline: string;
+  readonly availableAt: string;
+  readonly attemptCount: number;
+  readonly fence: number;
+  readonly lease?: WebhookLease;
+  readonly outcome?: WebhookReplayOutcome;
+  readonly evaluatedRevision?: number;
+  readonly settledAt?: string;
+}
+type WebhookReplaySettlement = {
+  readonly kind: "intent";
+  readonly sourceFence: number;
+  readonly evaluatedRevision: number;
+  readonly deliveryId: string;
+  readonly body: string;
+  readonly deliveryLifetimeMs: number;
+} | {
+  readonly kind: "denial";
+  readonly sourceFence: number;
+  readonly evaluatedRevision: number;
+  readonly code: WebhookAdmissionDenialCode;
+} | {
+  readonly kind: "already_decided";
+} | {
+  readonly kind: "skip";
+  readonly reason: WebhookReplaySkipReason;
+  readonly evaluatedRevision?: number;
+} | {
+  readonly kind: "retry";
+  readonly availableAt: string;
+  readonly diagnostic: WebhookDiagnosticCode;
+} | {
+  readonly kind: "dead_letter";
+  readonly diagnostic: WebhookDiagnosticCode | "source_missing";
+};
+type WebhookReplaySettlementResult = "settled" | "rescheduled" | "lease_lost" | "source_changed" | "pair_not_decided";
+/** Separate capability: existing custom delivery ports do not implement replay implicitly. */
+interface WebhookReplayStore {
+  readReplayRequest(input: WebhookReplayKey, options: WebhookCallOptions): Promise<WebhookReplayReceipt | null>;
+  createReplayRequest(input: WebhookReplayRequestInput, options: WebhookCallOptions): Promise<WebhookReplayRequestResult>;
+  claimReplayJobs(request: WebhookClaimRequest, options: WebhookCallOptions): Promise<readonly WebhookReplayItem[]>;
+  renewReplayJobLease(input: WebhookReplayJobKey & WebhookFencedWrite & {
+    readonly leaseDurationMs: number;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  settleReplayJob(input: WebhookReplayJobKey & WebhookFencedWrite & {
+    readonly settlement: WebhookReplaySettlement;
+  }, options: WebhookCallOptions): Promise<WebhookReplaySettlementResult>;
+  listReplayItems(input: WebhookReplayKey & {
+    readonly afterEventId?: string;
+    readonly limit: number;
+  }, options: WebhookCallOptions): Promise<{
+    readonly items: readonly WebhookReplayItem[];
+    readonly more: boolean;
+  }>;
+}
+interface WebhookReplayOptions {
+  readonly store: WebhookReplayStore;
+  readonly subscriptions: WebhookReplaySubscriptionReader;
+  /** Default 10,000. Requests above the cap are refused atomically. */
+  readonly maxEvents?: number;
+  /** Default one hour; persisted at acceptance and unchanged on reclaim. */
+  readonly processingLifetimeMs?: number;
+}
+export declare const DEFAULT_WEBHOOK_REPLAY: Readonly<{
+  maxEvents: 10000;
+  processingLifetimeMs: 3600000;
+}>;
+//#endregion
 //#region src/memory-delivery-store.d.ts
 /** Options for {@link MemoryWebhookDeliveryStore}. */
 interface MemoryWebhookDeliveryStoreOptions {
@@ -1446,11 +1768,14 @@ interface MemoryWebhookDeliveryStoreOptions {
  * positive whole number of milliseconds within `WEBHOOK_MAX_REPLAY_HORIZON_MS`.
  * @throws {WebhookStoreError} `clock_invalid` when `clock` has no `now` function.
  */
-export declare class MemoryWebhookDeliveryStore implements WebhookDeliveryStore {
+export declare class MemoryWebhookDeliveryStore implements WebhookDeliveryStore, WebhookReplayStore {
   #private;
   constructor(options: MemoryWebhookDeliveryStoreOptions);
   /** The replay horizon this store enforces, in milliseconds. */
   get replayHorizonMs(): number;
+  redactEventRecords(input: WebhookScope & {
+    readonly eventIds: readonly string[];
+  }, options: WebhookCallOptions): Promise<WebhookRedactionResult>;
   insertFanOutJob(job: WebhookFanOutJobDraft & {
     readonly processingDeadline: string;
     readonly createdAt: string;
@@ -1530,6 +1855,22 @@ export declare class MemoryWebhookDeliveryStore implements WebhookDeliveryStore
     readonly subscriptionId: string;
     readonly eventId: string;
   }, options: WebhookCallOptions): Promise<WebhookTombstone | null>;
+  readReplayRequest(input: WebhookReplayKey, options: WebhookCallOptions): Promise<WebhookReplayReceipt | null>;
+  createReplayRequest(input: WebhookReplayRequestInput, options: WebhookCallOptions): Promise<WebhookReplayRequestResult>;
+  claimReplayJobs(request: WebhookClaimRequest, options: WebhookCallOptions): Promise<readonly WebhookReplayItem[]>;
+  renewReplayJobLease(input: WebhookReplayJobKey & WebhookFencedWrite & {
+    readonly leaseDurationMs: number;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  settleReplayJob(input: WebhookReplayJobKey & WebhookFencedWrite & {
+    readonly settlement: WebhookReplaySettlement;
+  }, options: WebhookCallOptions): Promise<WebhookReplaySettlementResult>;
+  listReplayItems(input: WebhookReplayKey & {
+    readonly afterEventId?: string;
+    readonly limit: number;
+  }, options: WebhookCallOptions): Promise<{
+    readonly items: readonly WebhookReplayItem[];
+    readonly more: boolean;
+  }>;
   purgeExpiredRecords(input: {
     readonly limit: number;
   }, options: WebhookCallOptions): Promise<WebhookPurgeResult>;
@@ -1565,6 +1906,12 @@ export declare class MemoryWebhookSubscriptionStore implements WebhookSubscripti
   readSubscription(input: WebhookScope & {
     readonly subscriptionId: string;
   }, options: WebhookCallOptions): Promise<WebhookSubscriptionSnapshot | null>;
+  readReplaySubscription(input: WebhookScope & {
+    readonly subscriptionId: string;
+  }, options: WebhookCallOptions): Promise<{
+    readonly revision: WebhookEligibilityRevision;
+    readonly statusSinceRevision: number;
+  } | null>;
   listEligibilityHistory(input: WebhookScope & {
     readonly subscriptionId: string;
   }, options: WebhookCallOptions): Promise<readonly WebhookEligibilityRevision[]>;
@@ -1647,7 +1994,7 @@ interface PostgresWebhookDeliveryStoreOptions {
  * @throws {WebhookStoreError} `clock_invalid` when `clock` has no `now`
  * function; `input_invalid` when `pool`, `schema` or a test seam is not usable.
  */
-export declare class PostgresWebhookDeliveryStore implements WebhookDeliveryStore {
+export declare class PostgresWebhookDeliveryStore implements WebhookDeliveryStore, WebhookReplayStore {
   #private;
   constructor(options: PostgresWebhookDeliveryStoreOptions);
   /** The replay horizon this store enforces, in milliseconds. */
@@ -1659,6 +2006,9 @@ export declare class PostgresWebhookDeliveryStore implements WebhookDeliveryStor
    * (`applyWebhookMigrations` in src/postgres-sql.ts).
    */
   ensureSchema(): Promise<void>;
+  redactEventRecords(input: WebhookScope & {
+    readonly eventIds: readonly string[];
+  }, options: WebhookCallOptions): Promise<WebhookRedactionResult>;
   insertFanOutJob(job: WebhookFanOutJobDraft & {
     readonly processingDeadline: string;
     readonly createdAt: string;
@@ -1738,6 +2088,22 @@ export declare class PostgresWebhookDeliveryStore implements WebhookDeliveryStor
     readonly subscriptionId: string;
     readonly eventId: string;
   }, options: WebhookCallOptions): Promise<WebhookTombstone | null>;
+  readReplayRequest(input: WebhookReplayKey, options: WebhookCallOptions): Promise<WebhookReplayReceipt | null>;
+  createReplayRequest(input: WebhookReplayRequestInput, options: WebhookCallOptions): Promise<WebhookReplayRequestResult>;
+  claimReplayJobs(request: WebhookClaimRequest, options: WebhookCallOptions): Promise<readonly WebhookReplayItem[]>;
+  renewReplayJobLease(input: WebhookReplayJobKey & WebhookFencedWrite & {
+    readonly leaseDurationMs: number;
+  }, options: WebhookCallOptions): Promise<boolean>;
+  settleReplayJob(input: WebhookReplayJobKey & WebhookFencedWrite & {
+    readonly settlement: WebhookReplaySettlement;
+  }, options: WebhookCallOptions): Promise<WebhookReplaySettlementResult>;
+  listReplayItems(input: WebhookReplayKey & {
+    readonly afterEventId?: string;
+    readonly limit: number;
+  }, options: WebhookCallOptions): Promise<{
+    readonly items: readonly WebhookReplayItem[];
+    readonly more: boolean;
+  }>;
   purgeExpiredRecords(input: {
     readonly limit: number;
   }, options: WebhookCallOptions): Promise<WebhookPurgeResult>;
@@ -1775,6 +2141,12 @@ export declare class PostgresWebhookSubscriptionStore implements WebhookSubscrip
   readSubscription(input: WebhookScope & {
     readonly subscriptionId: string;
   }, options: WebhookCallOptions): Promise<WebhookSubscriptionSnapshot | null>;
+  readReplaySubscription(input: WebhookScope & {
+    readonly subscriptionId: string;
+  }, options: WebhookCallOptions): Promise<{
+    readonly revision: WebhookEligibilityRevision;
+    readonly statusSinceRevision: number;
+  } | null>;
   listEligibilityHistory(input: WebhookScope & {
     readonly subscriptionId: string;
   }, options: WebhookCallOptions): Promise<readonly WebhookEligibilityRevision[]>;
@@ -2265,7 +2637,7 @@ interface WebhookFanOutPublisherOptions {
  * 2. inserts the job with `createdAt` now and a processing deadline
  *    `fanOutDeadlineMs` later, bounded by `portTimeoutMs` and the caller's
  *    signal;
- * 3. resolves on `inserted` or `already_present` (a replay or a bridge
+ * 3. resolves on `inserted` or `already_present` (Host outbox re-publication or a bridge
  *    overlap: the first insert wins, and the stored job is not changed).
  *
  * It rejects, so the Host relay retries the record and eventually
@@ -2358,6 +2730,14 @@ interface WebhookCompositePublisherOptions {
  */
 export declare function createWebhookCompositePublisher(options: WebhookCompositePublisherOptions): EnterpriseEventPublisher;
 //#endregion
+//#region src/cycle-options.d.ts
+/** Defaults for the cycle's own options. */
+export declare const DEFAULT_WEBHOOK_FAN_OUT_CYCLE: Readonly<{
+  batchSize: 25;
+  leaseDurationMs: 60000;
+  eligibilitySettleMs: 5000;
+}>;
+//#endregion
 //#region src/fan-out-cycle.d.ts
 /** What decides whether a subscription revision needs the event's actor identity. */
 interface WebhookActorRequirementInput {
@@ -2450,12 +2830,6 @@ interface WebhookFanOutCycleResult {
   /** Denial inserts the store confirmed, counted like `intentsInserted`. */
   readonly denialsRecorded: number;
 }
-/** Defaults for the cycle's own options. */
-export declare const DEFAULT_WEBHOOK_FAN_OUT_CYCLE: Readonly<{
-  batchSize: 25;
-  leaseDurationMs: 60000;
-  eligibilitySettleMs: 5000;
-}>;
 /**
  * Whether an event type matches one subscription pattern. `*` matches every
  * type; a pattern ending in `.*` matches every type that starts with the
@@ -2626,148 +3000,12 @@ export declare const DEFAULT_WEBHOOK_DELIVERY_CYCLE: Readonly<{
 export declare function runWebhookDeliveryCycle(options: WebhookDeliveryCycleOptions): Promise<WebhookDeliveryCycleResult>;
 //#endregion
 //#region src/action-events.d.ts
-export declare const WEBHOOK_DELIVERY_ACTION_EVENT_TYPES: readonly ["WebhookSubscriptionCreated", "WebhookSubscriptionUpdated", "WebhookSubscriptionPaused", "WebhookSubscriptionResumed", "WebhookSubscriptionDeleted", "WebhookSecretRotated", "WebhookDeliveryIntentRequeued", "WebhookFanOutJobRequeued", "WebhookFanOutJobActorEnriched"];
+export declare const WEBHOOK_DELIVERY_ACTION_EVENT_TYPES: readonly ["WebhookReplayRequested", "WebhookSubscriptionCreated", "WebhookSubscriptionUpdated", "WebhookSubscriptionPaused", "WebhookSubscriptionResumed", "WebhookSubscriptionDeleted", "WebhookSecretRotated", "WebhookDeliveryIntentRequeued", "WebhookFanOutJobRequeued", "WebhookFanOutJobActorEnriched"];
 /** An event type one of the package's governed actions emits. */
 type WebhookDeliveryActionEventType = (typeof WEBHOOK_DELIVERY_ACTION_EVENT_TYPES)[number];
 /** `true` when `eventType` is emitted by one of the package's governed actions. */
 export declare function isWebhookDeliveryActionEventType(eventType: unknown): eventType is WebhookDeliveryActionEventType;
 //#endregion
-//#region src/action-parameters.d.ts
-/** The governed actions, by the name after the module namespace (`<namespace>.<name>`). */
-export declare const WEBHOOK_DELIVERY_ACTION_NAMES: readonly ["create_subscription", "update_subscription", "pause_subscription", "resume_subscription", "delete_subscription", "rotate_secret_staged", "rotate_secret_emergency", "requeue_delivery_intent", "requeue_fan_out_job", "enrich_fan_out_job_actor"];
-/** One governed action name. */
-type WebhookDeliveryActionName = (typeof WEBHOOK_DELIVERY_ACTION_NAMES)[number];
-/**
- * Why parameters were refused. `parameters_invalid`: not a plain-data
- * object, a field missing or malformed, or an id breaking the store
- * identifier rule. `unknown_parameter`: a key the action does not declare
- * (named in no message). `secret_ref_invalid`: a `secretRef` that is not a
- * secret reference. `destination_invalid`: a destination URL breaking the
- * URL rules (README, "URL rules"). `event_type_pattern_invalid`: a pattern
- * outside the pattern grammar. `update_ambiguous`: an update naming both or
- * neither of patterns and destination.
- */
-export declare const WEBHOOK_ACTION_PARAMETER_CODES: readonly ["parameters_invalid", "unknown_parameter", "secret_ref_invalid", "destination_invalid", "event_type_pattern_invalid", "update_ambiguous"];
-/** Why an action's parameters were refused. */
-type WebhookActionParameterCode = (typeof WEBHOOK_ACTION_PARAMETER_CODES)[number];
-/** `<namespace>.create_subscription` */
-interface WebhookCreateSubscriptionParameters {
-  readonly subscriptionId: string;
-  readonly eventTypePatterns: readonly string[];
-  readonly destinationUrl: string;
-  /** A secret reference, not key material or ciphertext (`isWebhookSecretReference`, then the verifier). */
-  readonly secretRef: string;
-  /** Only `v1` exists (decision 7); the default. */
-  readonly signatureScheme?: "v1";
-}
-/** `<namespace>.update_subscription`: exactly one of the two changes per invocation. */
-type WebhookUpdateSubscriptionParameters = {
-  readonly subscriptionId: string;
-  readonly eventTypePatterns: readonly string[];
-  readonly expectedRevision?: number;
-} | {
-  readonly subscriptionId: string;
-  readonly destinationUrl: string;
-  readonly expectedVersion?: number;
-};
-/** `<namespace>.pause_subscription`, `resume_subscription` and `delete_subscription`. */
-interface WebhookSubscriptionTransitionParameters {
-  readonly subscriptionId: string;
-  readonly expectedRevision?: number;
-}
-/** `<namespace>.rotate_secret_staged` */
-interface WebhookStagedRotationParameters {
-  readonly subscriptionId: string;
-  /** The next secret's reference, not key material or ciphertext (`isWebhookSecretReference`, then the verifier). */
-  readonly secretRef: string;
-  /** The configuration version the operator read; the rotation applies only on it. */
-  readonly expectedVersion: number;
-  /** The operator's statement that the receiver already accepts the next secret (decision 8). */
-  readonly receiverAcceptsNextSecret: true;
-}
-/** `<namespace>.rotate_secret_emergency` */
-interface WebhookEmergencyRotationParameters {
-  readonly subscriptionId: string;
-  readonly secretRef: string;
-  readonly expectedVersion?: number;
-}
-/** `<namespace>.requeue_delivery_intent` */
-interface WebhookIntentRequeueParameters {
-  readonly deliveryId: string;
-  /** The intent's `fence` as the operator read it. */
-  readonly expectedFence: number;
-}
-/** `<namespace>.requeue_fan_out_job` and `enrich_fan_out_job_actor`. */
-interface WebhookJobParameters {
-  readonly eventId: string;
-  /** The job's `fence` as the operator read it. */
-  readonly expectedFence: number;
-}
-/** The parameters of each action, by name. */
-interface WebhookDeliveryActionParameters {
-  readonly create_subscription: WebhookCreateSubscriptionParameters;
-  readonly update_subscription: WebhookUpdateSubscriptionParameters;
-  readonly pause_subscription: WebhookSubscriptionTransitionParameters;
-  readonly resume_subscription: WebhookSubscriptionTransitionParameters;
-  readonly delete_subscription: WebhookSubscriptionTransitionParameters;
-  readonly rotate_secret_staged: WebhookStagedRotationParameters;
-  readonly rotate_secret_emergency: WebhookEmergencyRotationParameters;
-  readonly requeue_delivery_intent: WebhookIntentRequeueParameters;
-  readonly requeue_fan_out_job: WebhookJobParameters;
-  readonly enrich_fan_out_job_actor: WebhookJobParameters;
-}
-/** What reading one action's parameters found. */
-type WebhookActionParameterRead<N extends WebhookDeliveryActionName> = {
-  readonly ok: true;
-  readonly value: WebhookDeliveryActionParameters[N];
-} | {
-  readonly ok: false;
-  readonly code: WebhookActionParameterCode;
-  readonly field: string;
-};
-/** The longest secret reference accepted. */
-export declare const WEBHOOK_SECRET_REF_MAX_LENGTH = 256;
-/** The longest run of characters between two separators (`:`, `/`, `@`, `#`) in a secret reference. */
-export declare const WEBHOOK_SECRET_REF_MAX_SEGMENT = 64;
-/**
- * Whether `value` has the shape of a secret reference (ADR 0018 decision 8):
- * a lower-case scheme and `:` (`kms:`, `vault:`, `arn:`, `secret:` …), then
- * only `A–Z a–z 0–9 . _ ~ : / @ # -`, at most
- * {@link WEBHOOK_SECRET_REF_MAX_LENGTH} characters, with no run longer than
- * {@link WEBHOOK_SECRET_REF_MAX_SEGMENT} between separators.
- *
- * That refuses raw key bytes and their usual encodings: hex, base64 and
- * `whsec_…` values (no scheme), padded or standard base64 (`=`, `+`), PEM
- * armour and anything with whitespace or control characters, and long
- * encoded runs such as wrapped ciphertext. It cannot recognise key material
- * deliberately shaped like a reference (`x:` followed by 64 hex digits
- * passes), which is why the actions also require the application's
- * `secretReferences.verify` port to confirm the reference resolves in the
- * tenant's secret store.
- */
-export declare function isWebhookSecretReference(value: unknown): value is string;
-/** The most patterns one subscription takes. */
-export declare const WEBHOOK_MAX_EVENT_TYPE_PATTERNS = 64;
-/**
- * Whether `value` is an event type pattern the matcher understands: `*`,
- * `prefix.*`, or an exact type, built from `A–Z a–z 0–9 _ : -` segments
- * joined by `.`, at most 256 characters. A `*` anywhere else is refused,
- * since the matcher would treat it as a literal.
- */
-export declare function isWebhookEventTypePattern(value: unknown): value is string;
-/**
- * Read one action's parameters. Never throws: the only thrown value whose
- * properties are read is the package's own `Refusal` (recognized by
- * `Refusal.is`, which runs none of a value's code); anything else thrown
- * while the input is read (an accessor, a Proxy trap, a look-alike refusal)
- * is dropped unread and reported as `parameters_invalid`. The code and field
- * returned are each checked against their fixed set (`fixedRefusal`). Tests:
- * "forged refusals: …".
- */
-export declare function readWebhookActionParameters<N extends WebhookDeliveryActionName>(name: N, input: unknown): WebhookActionParameterRead<N>;
-/** The default module namespace. */
-export declare const DEFAULT_WEBHOOK_DELIVERY_NAMESPACE = "webhook-delivery";
-//#endregion
 //#region src/governed-actions.d.ts
 /** What the module's operator policy asks the application about one invocation. */
 interface WebhookOperatorAuthorizationInput {
@@ -2778,6 +3016,12 @@ interface WebhookOperatorAuthorizationInput {
   readonly spaceId: string;
   readonly actorId: string;
   readonly actorType: string;
+  /** Normalized historical range/filter metadata for replay authorization; no event data or secrets. */
+  readonly replay?: {
+    readonly from: string;
+    readonly to: string;
+    readonly eventTypePatterns?: readonly string[];
+  };
   /** The ids the action names, copied from three id fields by `operatorPolicy`; no URL or secret reference. */
   readonly target: {
     readonly subscriptionId?: string;
@@ -2830,6 +3074,7 @@ interface WebhookEventActorReader {
 }
 /** Options for {@link createWebhookDeliveryModule}. */
 interface WebhookDeliveryModuleOptions {
+  readonly replay?: WebhookReplayOptions;
   /** The module namespace; actions are `<namespace>.<name>`. Default `webhook-delivery`. */
   readonly namespace?: string;
   readonly subscriptions: WebhookSubscriptionStore & WebhookSubscriptionWriter;
@@ -2863,4 +3108,16 @@ export declare function webhookOperatorPolicyId(namespace?: string): `${string}.
  */
 export declare function createWebhookDeliveryModule<TDb = unknown>(options: WebhookDeliveryModuleOptions): FabricModule<TDb>;
 //#endregion
-export type { MemoryWebhookDeliveryStoreOptions, MemoryWebhookSubscriptionStoreOptions, PostgresWebhookDeliveryStoreOptions, PostgresWebhookSubscriptionStoreOptions, WebhookActionParameterCode, WebhookActionParameterRead, WebhookActionRefusalCode, WebhookActorEnrichmentRequest, WebhookActorEnrichmentResult, WebhookActorRequirementInput, WebhookAdmissionDecision, WebhookAdmissionDenialCode, WebhookAdmissionDenialRecord, WebhookAdmissionInput, WebhookAttemptBeginResult, WebhookAttemptOutcome, WebhookAttemptReasonCode, WebhookCallOptions, WebhookClaimRequest, WebhookClassifyOptions, WebhookClock, WebhookCompositePublisherOptions, WebhookCompositeSink, WebhookConfigErrorCode, WebhookConfigurationWriteResult, WebhookCreateSubscriptionParameters, WebhookDeliveryActionEventType, WebhookDeliveryActionName, WebhookDeliveryActionParameters, WebhookDeliveryAttemptFinish, WebhookDeliveryAttemptInFlight, WebhookDeliveryAttemptLogEntry, WebhookDeliveryAttemptRecord, WebhookDeliveryAttemptStart, WebhookDeliveryAuthorization, WebhookDeliveryAuthorizationDecision, WebhookDeliveryAuthorizationInput, WebhookDeliveryBodyV1, WebhookDeliveryClassification, WebhookDeliveryConfiguration, WebhookDeliveryConfigurationInput, WebhookDeliveryCycleEvent, WebhookDeliveryCycleOptions, WebhookDeliveryCycleResult, WebhookDeliveryCycleResultKind, WebhookDeliveryErrorCode, WebhookDeliveryIntent, WebhookDeliveryIntentStatus, WebhookDeliveryLeaseCheck, WebhookDeliveryLimits, WebhookDeliveryModuleOptions, WebhookDeliveryObservation, WebhookDeliveryStore, WebhookDestinationResolution, WebhookDestinationResolver, WebhookDestinationResolverOptions, WebhookDestinationUrlCheck, WebhookDiagnosticCode, WebhookDnsLookup, WebhookEgressPayload, WebhookEgressProjectionInput, WebhookEgressSubscription, WebhookEligibilityRevision, WebhookEmergencyRotationParameters, WebhookEventActorReader, WebhookEventActorReading, WebhookEventAdmission, WebhookEventMetadata, WebhookEventTypePolicy, WebhookFanOutCycleOptions, WebhookFanOutCycleResult, WebhookFanOutErrorCode, WebhookFanOutJob, WebhookFanOutJobDraft, WebhookFanOutJobFence, WebhookFanOutJobStatus, WebhookFanOutPublisherOptions, WebhookFencedInsertResult, WebhookFencedWrite, WebhookGovernedActionErrorCode, WebhookInputErrorCode, WebhookInsertResult, WebhookIntentRequeueParameters, WebhookJobActor, WebhookJobParameters, WebhookJsonObject, WebhookJsonValue, WebhookLease, WebhookOperatorAuthorization, WebhookOperatorAuthorizationInput, WebhookPayloadPolicy, WebhookPersistenceProjectionOptions, WebhookPostgresConnection, WebhookPostgresPool, WebhookPostgresQueryable, WebhookPostgresResult, WebhookProjectionErrorCode, WebhookPurgeResult, WebhookRandomSource, WebhookRenderInput, WebhookRenderedBody, WebhookRequestHeaderInput, WebhookRequeueEvidence, WebhookRequeueRequest, WebhookRequeueResult, WebhookResolvedAddress, WebhookRetryDelay, WebhookRetryDelayOptions, WebhookRevocationCode, WebhookScope, WebhookScopeInput, WebhookScopePredicate, WebhookSecretReferenceVerifier, WebhookSignRequest, WebhookSignatureScheme, WebhookSigner, WebhookSourceEnvelope, WebhookStagedRotationParameters, WebhookStoreErrorCode, WebhookSubscriptionSnapshot, WebhookSubscriptionStatus, WebhookSubscriptionStore, WebhookSubscriptionTransitionInput, WebhookSubscriptionTransitionParameters, WebhookSubscriptionWriteRefusal, WebhookSubscriptionWriteResult, WebhookSubscriptionWriter, WebhookTombstone, WebhookTransactionCheckpointStage, WebhookTransport, WebhookTransportRequest, WebhookTransportResult, WebhookUpdateSubscriptionParameters, WebhookVettedDestination };
+//#region src/replay-cycle.d.ts
+interface WebhookReplayCycleOptions extends Omit<WebhookFanOutCycleOptions, "subscriptions" | "eligibilitySettleMs"> {
+  readonly replay: WebhookReplayStore;
+  readonly subscriptions: WebhookReplaySubscriptionReader;
+}
+/** Processes fixed replay membership; dispatch uses the ordinary delivery worker. */
+export declare function runWebhookReplayCycle(options: WebhookReplayCycleOptions): Promise<{
+  readonly claimed: number;
+  readonly settled: number;
+  readonly abandoned: number;
+}>;
+//#endregion
+export type { MemoryWebhookDeliveryStoreOptions, MemoryWebhookSubscriptionStoreOptions, PostgresWebhookDeliveryStoreOptions, PostgresWebhookSubscriptionStoreOptions, WebhookActionParameterCode, WebhookActionParameterRead, WebhookActionRefusalCode, WebhookActorEnrichmentRequest, WebhookActorEnrichmentResult, WebhookActorRequirementInput, WebhookAdmissionDecision, WebhookAdmissionDenialCode, WebhookAdmissionDenialRecord, WebhookAdmissionInput, WebhookAttemptBeginResult, WebhookAttemptOutcome, WebhookAttemptReasonCode, WebhookCallOptions, WebhookClaimRequest, WebhookClassifyOptions, WebhookClock, WebhookCompositePublisherOptions, WebhookCompositeSink, WebhookConfigErrorCode, WebhookConfigurationWriteResult, WebhookCreateSubscriptionParameters, WebhookDeliveryActionEventType, WebhookDeliveryActionName, WebhookDeliveryActionParameters, WebhookDeliveryAttemptFinish, WebhookDeliveryAttemptInFlight, WebhookDeliveryAttemptLogEntry, WebhookDeliveryAttemptRecord, WebhookDeliveryAttemptStart, WebhookDeliveryAuthorization, WebhookDeliveryAuthorizationDecision, WebhookDeliveryAuthorizationInput, WebhookDeliveryBodyV1, WebhookDeliveryClassification, WebhookDeliveryConfiguration, WebhookDeliveryConfigurationInput, WebhookDeliveryCycleEvent, WebhookDeliveryCycleOptions, WebhookDeliveryCycleResult, WebhookDeliveryCycleResultKind, WebhookDeliveryErrorCode, WebhookDeliveryIntent, WebhookDeliveryIntentStatus, WebhookDeliveryLeaseCheck, WebhookDeliveryLimits, WebhookDeliveryModuleOptions, WebhookDeliveryObservation, WebhookDeliveryStore, WebhookDestinationResolution, WebhookDestinationResolver, WebhookDestinationResolverOptions, WebhookDestinationUrlCheck, WebhookDiagnosticCode, WebhookDnsLookup, WebhookEgressPayload, WebhookEgressProjectionInput, WebhookEgressSubscription, WebhookEligibilityRevision, WebhookEmergencyRotationParameters, WebhookEventActorReader, WebhookEventActorReading, WebhookEventAdmission, WebhookEventMetadata, WebhookEventTypePolicy, WebhookFanOutCycleOptions, WebhookFanOutCycleResult, WebhookFanOutErrorCode, WebhookFanOutJob, WebhookFanOutJobDraft, WebhookFanOutJobFence, WebhookFanOutJobStatus, WebhookFanOutPublisherOptions, WebhookFencedInsertResult, WebhookFencedWrite, WebhookGovernedActionErrorCode, WebhookInputErrorCode, WebhookInsertResult, WebhookIntentRequeueParameters, WebhookJobActor, WebhookJobParameters, WebhookJsonObject, WebhookJsonValue, WebhookLease, WebhookOperatorAuthorization, WebhookOperatorAuthorizationInput, WebhookPayloadPolicy, WebhookPersistenceProjectionOptions, WebhookPostgresConnection, WebhookPostgresPool, WebhookPostgresQueryable, WebhookPostgresResult, WebhookProjectionErrorCode, WebhookPurgeResult, WebhookRandomSource, WebhookRedactionResult, WebhookRenderInput, WebhookRenderedBody, WebhookReplayCycleOptions, WebhookReplayEventsParameters, WebhookReplayItem, WebhookReplayJobKey, WebhookReplayKey, WebhookReplayOptions, WebhookReplayOutcome, WebhookReplayReceipt, WebhookReplayRefusal, WebhookReplayRequestInput, WebhookReplayRequestResult, WebhookReplaySettlement, WebhookReplaySettlementResult, WebhookReplaySkipReason, WebhookReplayStore, WebhookReplaySubscriptionReader, WebhookRequestHeaderInput, WebhookRequeueEvidence, WebhookRequeueRequest, WebhookRequeueResult, WebhookResolvedAddress, WebhookRetryDelay, WebhookRetryDelayOptions, WebhookRevocationCode, WebhookScope, WebhookScopeInput, WebhookScopePredicate, WebhookSecretReferenceVerifier, WebhookSignRequest, WebhookSignatureScheme, WebhookSigner, WebhookSourceEnvelope, WebhookStagedRotationParameters, WebhookStoreErrorCode, WebhookSubscriptionSnapshot, WebhookSubscriptionStatus, WebhookSubscriptionStore, WebhookSubscriptionTransitionInput, WebhookSubscriptionTransitionParameters, WebhookSubscriptionWriteRefusal, WebhookSubscriptionWriteResult, WebhookSubscriptionWriter, WebhookTombstone, WebhookTransactionCheckpointStage, WebhookTransport, WebhookTransportRequest, WebhookTransportResult, WebhookUpdateSubscriptionParameters, WebhookVettedDestination };