@marktiderman/genesis-forms 0.8.0 → 0.9.1

package/dist/destinations.d.cts

@@ -1,4 +1,4 @@
-import { J as Json, F as FormDefinition, a as FieldBlock, C as Condition } from './types-jqDKcmP4.cjs';
+import { J as Json, F as FormDefinition, a as FieldBlock, C as Condition } from './types-C0pUfew3.cjs';
 
 /**
  * The contract every destination keeps. A destination sends one checked
@@ -103,6 +103,12 @@ interface DeliveryFailure {
     retryAfterSeconds?: number;
     /** The HTTP status that refused it, if one did. */
     status?: number;
+    /**
+     * The receiver asked to be switched off (a webhook answered 410 Gone, as
+     * Standard Webhooks specifies): disable the destination rather than keep
+     * sending to it. Always with `retryable: false`.
+     */
+    disable?: true;
     /** Safe to store and log: a status and a short reason, never secrets, answers or contact details. */
     error: string;
 }
@@ -129,10 +135,13 @@ declare class DeliveryError extends Error {
     readonly retryable: boolean;
     readonly retryAfterSeconds: number | undefined;
     readonly status: number | undefined;
+    /** The receiver asked to be switched off (`DeliveryFailure.disable`); never retryable. */
+    readonly disable: boolean;
     constructor(message: string, options?: {
         retryable?: boolean | undefined;
         retryAfterSeconds?: number | undefined;
         status?: number | undefined;
+        disable?: boolean | undefined;
     });
 }
 /** Every outbound request gives up after this long, unless the destination is given another `timeoutMs`. */
@@ -467,15 +476,17 @@ interface WebhookConfig {
 }
 interface WebhookDestinationOptions extends HttpDeps {
     /**
-     * The signing secret: base64 of at least 16 random bytes, usually with
-     * the `whsec_` prefix Standard Webhooks tools issue (`whsec_` plus base64
-     * of 24 to 64 bytes is what the spec recommends). The prefix is optional;
-     * the rest is always base64-decoded, as every Standard Webhooks library
-     * does, so a receiver verifies with the same string. A secret that is not
-     * base64 fails permanently. Or a function that finds the one for a
-     * destination's config. Never put it in config.
+     * The signing secret: base64 of at least 24 random bytes (the spec
+     * recommends 24 to 64), usually with the `whsec_` prefix Standard Webhooks
+     * tools issue. The prefix is optional; the rest is always base64-decoded,
+     * as every Standard Webhooks library does, so a receiver verifies with the
+     * same string. A secret that is not base64, or is shorter, fails
+     * permanently. Several secrets (new and old, during a rotation) sign with
+     * each, space-separated in `webhook-signature`, so the receiver verifies
+     * with either. Or a function that finds them for a destination's config.
+     * Never put it in config.
      */
-    secret: string | OptionResolver<string>;
+    secret: string | readonly string[] | OptionResolver<string | readonly string[]>;
     /** Allow `http:` URLs. Default false. */
     allowInsecureUrls?: boolean | undefined;
     /** Allow localhost and private, loopback and link-local address literals. Default false. */
@@ -502,7 +513,10 @@ interface WebhookDestinationOptions extends HttpDeps {
 /** The JSON body a webhook receives. */
 interface WebhookPayload {
     type: string;
-    /** ISO time the delivery was sent. */
+    /**
+     * ISO time the event happened: the submission's `submittedAt`, or the send
+     * time when it has none. The `webhook-timestamp` header is the send time.
+     */
     timestamp: string;
     data: {
         form: {
@@ -524,17 +538,26 @@ interface WebhookPayload {
         row: Record<string, Json>;
     };
 }
+/** The shortest signing secret, decoded: Standard Webhooks recommends 24 to 64 bytes. */
+declare const MIN_WEBHOOK_SECRET_BYTES = 24;
 /**
  * A new signing secret: `whsec_` and standard base64 of 32 random bytes, the
  * form Standard Webhooks libraries read. Show it to the receiver once; keep it
  * out of config.
  */
 declare function newWebhookSecret(): string;
-/** The `webhook-signature` value for a message: `v1,<base64>`. */
-declare function signWebhook(secret: string, id: string, timestamp: number, body: string): Promise<string>;
+/**
+ * The `webhook-signature` value for a message: `v1,<base64>`, or one such
+ * signature per secret, space-separated, when given several (a rotation).
+ */
+declare function signWebhook(secret: string | readonly string[], id: string, timestamp: number, body: string): Promise<string>;
 interface VerifyWebhookInput {
-    /** The same secret the sender signs with (base64, optionally `whsec_`-prefixed). */
-    secret: string;
+    /**
+     * The same secret the sender signs with (base64, optionally
+     * `whsec_`-prefixed), or several (new and old, during a rotation): any one
+     * matching signature passes.
+     */
+    secret: string | readonly string[];
     /** The request's headers: a `Headers` or a plain object. */
     headers: Headers | Record<string, string | string[] | undefined>;
     /** The raw body, exactly as received. */
@@ -682,12 +705,25 @@ declare function googleOAuthAccessToken(client: GoogleOAuthClient, refreshToken:
  * problem, never the key.
  */
 declare function secretKeyBytes(key: string | Uint8Array): Uint8Array<ArrayBuffer>;
+/** Options for `deriveSecretKey`. */
+interface DeriveSecretKeyOptions {
+    /**
+     * The HKDF salt: bytes, or text taken as its UTF-8 bytes. Default empty,
+     * which is what every key derived before this option existed used, so
+     * leave it out to open those. For new keys a fixed, app-wide random value
+     * (say 32 bytes from `openssl rand -base64 32`, kept as config) is
+     * recommended (RFC 5869). It need not be secret, but must never change
+     * once anything is sealed with it.
+     */
+    salt?: string | Uint8Array | undefined;
+}
 /**
  * An AES-GCM key for one purpose, derived from the app secret with HKDF-SHA-256
- * (empty salt, `info` naming the purpose). Use a different `info` for each
- * kind of secret; keep it fixed once anything is sealed with it.
+ * (`info` naming the purpose; the salt empty unless `options.salt` is given).
+ * Use a different `info` for each kind of secret; keep it, and the salt,
+ * fixed once anything is sealed with them.
  */
-declare function deriveSecretKey(key: string | Uint8Array, info: string): Promise<WebCryptoKey>;
+declare function deriveSecretKey(key: string | Uint8Array, info: string, options?: DeriveSecretKeyOptions): Promise<WebCryptoKey>;
 /** Encrypts `plaintext` bound to `aad` (the row it belongs to): `v1.<iv>.<ciphertext>`. */
 declare function sealSecret(key: WebCryptoKey, plaintext: string, aad: string): Promise<string>;
 /**
@@ -697,28 +733,6 @@ declare function sealSecret(key: WebCryptoKey, plaintext: string, aad: string):
  */
 declare function openSecret(key: WebCryptoKey, sealed: string, aad: string): Promise<string>;
 
-/**
- * The outbox runner: claim a batch of due deliveries, send each to its
- * destination, and record what happened. The store is the app's (a SQL
- * outbox, a queue, a KV list): it hands over claimed deliveries and takes
- * back outcomes, and decides how claims and leases work. The runner owns the
- * rest: the destination's condition (`config.when`), batching deliveries to
- * one destination into one request where the destination can, keeping its
- * state, and turning each result into an outcome with a retry time.
- *
- * Outcomes:
- * - `sent`: delivered (or already there, on a redelivery).
- * - `filtered`: the submission doesn't match the destination's condition; nothing was sent, nothing to retry.
- * - `skipped`: the destination deliberately sent nothing (`notSent`); never retried.
- * - `retry`: a retryable failure. With the service's own Retry-After it is
- *   deferred without counting an attempt (`counted: false`); otherwise it backs
- *   off by attempt (`counted: true`), until `maxAttempts`.
- * - `failed`: permanent, an unknown kind, or out of attempts.
- *
- * It never throws for a delivery's failure, and never logs answers, contact
- * details or secrets: only ids, kinds and the destinations' safe messages.
- */
-
 /** One claimed delivery, as the app's store hands it over. */
 interface ClaimedDelivery {
     /** The delivery's id: stable across its retries (the email idempotency key, the webhook-id). */
@@ -772,6 +786,8 @@ type DeliveryOutcome = {
     status: "failed";
     error: string;
     httpStatus?: number;
+    /** The receiver asked to be switched off (a webhook's 410 Gone): disable the destination. */
+    disable?: true;
 };
 interface ClaimRequest<Filter> {
     /** Most deliveries to claim. */
@@ -834,11 +850,17 @@ interface DeliveryRunner<Filter = undefined> {
     /** One claim, its sends and their records. Never rejects for a delivery's failure; a failing `claim` rejects. */
     run(options?: RunOptions<Filter>): Promise<DeliveryReport>;
 }
-declare const DEFAULT_MAX_ATTEMPTS = 8;
-declare const DEFAULT_MAX_DEFERRALS = 24;
-declare const DEFAULT_BATCH_SIZE = 25;
-/** 1 minute, doubling each attempt, at most 6 hours: 1m, 2m, 4m … 6h. */
-declare function defaultBackoff(attempt: number): number;
+declare const DEFAULT_MAX_ATTEMPTS: number;
+declare const DEFAULT_MAX_DEFERRALS: number;
+declare const DEFAULT_BATCH_SIZE: number;
+/**
+ * 5 minutes, quadrupling each attempt, at most 24 hours: 5m, 20m, 80m, 5h20m,
+ * 21h20m, then 24h. Across the default 8 attempts that is about 3 days, as
+ * Standard Webhooks suggests. Each wait is jittered by up to ±20%, so
+ * deliveries that failed together (a receiver's outage) don't all come back
+ * at once. `random` (default `Math.random`) is for tests.
+ */
+declare const defaultBackoff: (attempt: number, random?: () => number) => number;
 /** Turns a destination's result into an outcome for a delivery on its `attempt`. */
 declare function deliveryOutcome(result: DeliveryResult, attempt: number, options?: {
     now?: number | undefined;
@@ -850,4 +872,4 @@ declare function deliveryOutcome(result: DeliveryResult, attempt: number, option
 }): DeliveryOutcome;
 declare function createDeliveryRunner<Filter = undefined>(options: DeliveryRunnerOptions<Filter>): DeliveryRunner<Filter>;
 
-export { type Cell, type ClaimRequest, type ClaimedDelivery, DEDUPE_WINDOW, DEFAULT_BATCH_SIZE, DEFAULT_MAX_ATTEMPTS, DEFAULT_MAX_DEFERRALS, DEFAULT_SHEET_NAME, DRIVE_FILE_SCOPE, DeliveryError, type DeliveryFailure, type DeliveryItem, type DeliveryOptions, type DeliveryOutcome, type DeliveryReport, type DeliveryResult, type DeliveryRunner, type DeliveryRunnerOptions, type DeliverySubmission, type Destination, type DestinationConfig, type EmailConfig, type EmailContent, type EmailDestinationOptions, type EmailMessage, type EmailProvider, type EmailRenderInput, GOOGLE_TOKEN_URL, type GoogleOAuthClient, type GoogleOAuthTokenOptions, type GoogleServiceAccount, type GoogleTokenOptions, HEADER_SCAN_ROWS, type HookKind, HookUrlError, type HttpDeps, MAX_CONDITION_DEPTH, MAX_HOOK_URL_LENGTH, MAX_RECIPIENTS, type OptionResolver, REQUEST_TIMEOUT_MS, RESEND_API, type RefreshedGoogleToken, type ResendOptions, type ResolveContext, type ResolveHost, type ResponseRow, type RowOptions, type RunOptions, SENSITIVE_MASK, SHEETS_API, SHEETS_SCOPE, SLACK_HOSTS, SLACK_VALUE_LIMIT, type SheetConfig, type SheetState, type SheetsDestinationOptions, type SlackDestinationOptions, type SlackMessageInput, type SlackMessageOptions, type VerifyWebhookInput, type WebCryptoKey, type WebhookConfig, type WebhookDestinationOptions, type WebhookPayload, answerCell, checkHookHost, checkWebhookUrl, clearGoogleOAuthTokenCache, clearGoogleTokenCache, columnLetter, conditionOf, createDeliveryRunner, defaultBackoff, deliveryFailure, deliveryOutcome, deriveSecretKey, emailBody, emailDestination, escapeFormula, escapeHtml, escapeSlack, googleAccessToken, googleOAuthAccessToken, headerSafe, hookHost, httpError, idempotencyKey, isCondition, isPrivateHost, isPublicAddress, isRetryableStatus, isSafeAddress, isSafeFrom, mergeHeader, newWebhookSecret, openSecret, parseHookUrl, passesCondition, refreshGoogleAccessToken, renderEmail, resendProvider, responseRow, retryAfterSeconds, rowFor, sealSecret, secretKeyBytes, sheetsDestination, signJwt, signWebhook, slackDestination, slackMessage, verifyWebhook, visibleInputs, webhookDestination, webhookPayload };
+export { type Cell, type ClaimRequest, type ClaimedDelivery, DEDUPE_WINDOW, DEFAULT_BATCH_SIZE, DEFAULT_MAX_ATTEMPTS, DEFAULT_MAX_DEFERRALS, DEFAULT_SHEET_NAME, DRIVE_FILE_SCOPE, DeliveryError, type DeliveryFailure, type DeliveryItem, type DeliveryOptions, type DeliveryOutcome, type DeliveryReport, type DeliveryResult, type DeliveryRunner, type DeliveryRunnerOptions, type DeliverySubmission, type DeriveSecretKeyOptions, type Destination, type DestinationConfig, type EmailConfig, type EmailContent, type EmailDestinationOptions, type EmailMessage, type EmailProvider, type EmailRenderInput, GOOGLE_TOKEN_URL, type GoogleOAuthClient, type GoogleOAuthTokenOptions, type GoogleServiceAccount, type GoogleTokenOptions, HEADER_SCAN_ROWS, type HookKind, HookUrlError, type HttpDeps, MAX_CONDITION_DEPTH, MAX_HOOK_URL_LENGTH, MAX_RECIPIENTS, MIN_WEBHOOK_SECRET_BYTES, type OptionResolver, REQUEST_TIMEOUT_MS, RESEND_API, type RefreshedGoogleToken, type ResendOptions, type ResolveContext, type ResolveHost, type ResponseRow, type RowOptions, type RunOptions, SENSITIVE_MASK, SHEETS_API, SHEETS_SCOPE, SLACK_HOSTS, SLACK_VALUE_LIMIT, type SheetConfig, type SheetState, type SheetsDestinationOptions, type SlackDestinationOptions, type SlackMessageInput, type SlackMessageOptions, type VerifyWebhookInput, type WebCryptoKey, type WebhookConfig, type WebhookDestinationOptions, type WebhookPayload, answerCell, checkHookHost, checkWebhookUrl, clearGoogleOAuthTokenCache, clearGoogleTokenCache, columnLetter, conditionOf, createDeliveryRunner, defaultBackoff, deliveryFailure, deliveryOutcome, deriveSecretKey, emailBody, emailDestination, escapeFormula, escapeHtml, escapeSlack, googleAccessToken, googleOAuthAccessToken, headerSafe, hookHost, httpError, idempotencyKey, isCondition, isPrivateHost, isPublicAddress, isRetryableStatus, isSafeAddress, isSafeFrom, mergeHeader, newWebhookSecret, openSecret, parseHookUrl, passesCondition, refreshGoogleAccessToken, renderEmail, resendProvider, responseRow, retryAfterSeconds, rowFor, sealSecret, secretKeyBytes, sheetsDestination, signJwt, signWebhook, slackDestination, slackMessage, verifyWebhook, visibleInputs, webhookDestination, webhookPayload };

package/dist/destinations.d.ts

@@ -1,4 +1,4 @@
-import { J as Json, F as FormDefinition, a as FieldBlock, C as Condition } from './types-jqDKcmP4.js';
+import { J as Json, F as FormDefinition, a as FieldBlock, C as Condition } from './types-C0pUfew3.js';
 
 /**
  * The contract every destination keeps. A destination sends one checked
@@ -103,6 +103,12 @@ interface DeliveryFailure {
     retryAfterSeconds?: number;
     /** The HTTP status that refused it, if one did. */
     status?: number;
+    /**
+     * The receiver asked to be switched off (a webhook answered 410 Gone, as
+     * Standard Webhooks specifies): disable the destination rather than keep
+     * sending to it. Always with `retryable: false`.
+     */
+    disable?: true;
     /** Safe to store and log: a status and a short reason, never secrets, answers or contact details. */
     error: string;
 }
@@ -129,10 +135,13 @@ declare class DeliveryError extends Error {
     readonly retryable: boolean;
     readonly retryAfterSeconds: number | undefined;
     readonly status: number | undefined;
+    /** The receiver asked to be switched off (`DeliveryFailure.disable`); never retryable. */
+    readonly disable: boolean;
     constructor(message: string, options?: {
         retryable?: boolean | undefined;
         retryAfterSeconds?: number | undefined;
         status?: number | undefined;
+        disable?: boolean | undefined;
     });
 }
 /** Every outbound request gives up after this long, unless the destination is given another `timeoutMs`. */
@@ -467,15 +476,17 @@ interface WebhookConfig {
 }
 interface WebhookDestinationOptions extends HttpDeps {
     /**
-     * The signing secret: base64 of at least 16 random bytes, usually with
-     * the `whsec_` prefix Standard Webhooks tools issue (`whsec_` plus base64
-     * of 24 to 64 bytes is what the spec recommends). The prefix is optional;
-     * the rest is always base64-decoded, as every Standard Webhooks library
-     * does, so a receiver verifies with the same string. A secret that is not
-     * base64 fails permanently. Or a function that finds the one for a
-     * destination's config. Never put it in config.
+     * The signing secret: base64 of at least 24 random bytes (the spec
+     * recommends 24 to 64), usually with the `whsec_` prefix Standard Webhooks
+     * tools issue. The prefix is optional; the rest is always base64-decoded,
+     * as every Standard Webhooks library does, so a receiver verifies with the
+     * same string. A secret that is not base64, or is shorter, fails
+     * permanently. Several secrets (new and old, during a rotation) sign with
+     * each, space-separated in `webhook-signature`, so the receiver verifies
+     * with either. Or a function that finds them for a destination's config.
+     * Never put it in config.
      */
-    secret: string | OptionResolver<string>;
+    secret: string | readonly string[] | OptionResolver<string | readonly string[]>;
     /** Allow `http:` URLs. Default false. */
     allowInsecureUrls?: boolean | undefined;
     /** Allow localhost and private, loopback and link-local address literals. Default false. */
@@ -502,7 +513,10 @@ interface WebhookDestinationOptions extends HttpDeps {
 /** The JSON body a webhook receives. */
 interface WebhookPayload {
     type: string;
-    /** ISO time the delivery was sent. */
+    /**
+     * ISO time the event happened: the submission's `submittedAt`, or the send
+     * time when it has none. The `webhook-timestamp` header is the send time.
+     */
     timestamp: string;
     data: {
         form: {
@@ -524,17 +538,26 @@ interface WebhookPayload {
         row: Record<string, Json>;
     };
 }
+/** The shortest signing secret, decoded: Standard Webhooks recommends 24 to 64 bytes. */
+declare const MIN_WEBHOOK_SECRET_BYTES = 24;
 /**
  * A new signing secret: `whsec_` and standard base64 of 32 random bytes, the
  * form Standard Webhooks libraries read. Show it to the receiver once; keep it
  * out of config.
  */
 declare function newWebhookSecret(): string;
-/** The `webhook-signature` value for a message: `v1,<base64>`. */
-declare function signWebhook(secret: string, id: string, timestamp: number, body: string): Promise<string>;
+/**
+ * The `webhook-signature` value for a message: `v1,<base64>`, or one such
+ * signature per secret, space-separated, when given several (a rotation).
+ */
+declare function signWebhook(secret: string | readonly string[], id: string, timestamp: number, body: string): Promise<string>;
 interface VerifyWebhookInput {
-    /** The same secret the sender signs with (base64, optionally `whsec_`-prefixed). */
-    secret: string;
+    /**
+     * The same secret the sender signs with (base64, optionally
+     * `whsec_`-prefixed), or several (new and old, during a rotation): any one
+     * matching signature passes.
+     */
+    secret: string | readonly string[];
     /** The request's headers: a `Headers` or a plain object. */
     headers: Headers | Record<string, string | string[] | undefined>;
     /** The raw body, exactly as received. */
@@ -682,12 +705,25 @@ declare function googleOAuthAccessToken(client: GoogleOAuthClient, refreshToken:
  * problem, never the key.
  */
 declare function secretKeyBytes(key: string | Uint8Array): Uint8Array<ArrayBuffer>;
+/** Options for `deriveSecretKey`. */
+interface DeriveSecretKeyOptions {
+    /**
+     * The HKDF salt: bytes, or text taken as its UTF-8 bytes. Default empty,
+     * which is what every key derived before this option existed used, so
+     * leave it out to open those. For new keys a fixed, app-wide random value
+     * (say 32 bytes from `openssl rand -base64 32`, kept as config) is
+     * recommended (RFC 5869). It need not be secret, but must never change
+     * once anything is sealed with it.
+     */
+    salt?: string | Uint8Array | undefined;
+}
 /**
  * An AES-GCM key for one purpose, derived from the app secret with HKDF-SHA-256
- * (empty salt, `info` naming the purpose). Use a different `info` for each
- * kind of secret; keep it fixed once anything is sealed with it.
+ * (`info` naming the purpose; the salt empty unless `options.salt` is given).
+ * Use a different `info` for each kind of secret; keep it, and the salt,
+ * fixed once anything is sealed with them.
  */
-declare function deriveSecretKey(key: string | Uint8Array, info: string): Promise<WebCryptoKey>;
+declare function deriveSecretKey(key: string | Uint8Array, info: string, options?: DeriveSecretKeyOptions): Promise<WebCryptoKey>;
 /** Encrypts `plaintext` bound to `aad` (the row it belongs to): `v1.<iv>.<ciphertext>`. */
 declare function sealSecret(key: WebCryptoKey, plaintext: string, aad: string): Promise<string>;
 /**
@@ -697,28 +733,6 @@ declare function sealSecret(key: WebCryptoKey, plaintext: string, aad: string):
  */
 declare function openSecret(key: WebCryptoKey, sealed: string, aad: string): Promise<string>;
 
-/**
- * The outbox runner: claim a batch of due deliveries, send each to its
- * destination, and record what happened. The store is the app's (a SQL
- * outbox, a queue, a KV list): it hands over claimed deliveries and takes
- * back outcomes, and decides how claims and leases work. The runner owns the
- * rest: the destination's condition (`config.when`), batching deliveries to
- * one destination into one request where the destination can, keeping its
- * state, and turning each result into an outcome with a retry time.
- *
- * Outcomes:
- * - `sent`: delivered (or already there, on a redelivery).
- * - `filtered`: the submission doesn't match the destination's condition; nothing was sent, nothing to retry.
- * - `skipped`: the destination deliberately sent nothing (`notSent`); never retried.
- * - `retry`: a retryable failure. With the service's own Retry-After it is
- *   deferred without counting an attempt (`counted: false`); otherwise it backs
- *   off by attempt (`counted: true`), until `maxAttempts`.
- * - `failed`: permanent, an unknown kind, or out of attempts.
- *
- * It never throws for a delivery's failure, and never logs answers, contact
- * details or secrets: only ids, kinds and the destinations' safe messages.
- */
-
 /** One claimed delivery, as the app's store hands it over. */
 interface ClaimedDelivery {
     /** The delivery's id: stable across its retries (the email idempotency key, the webhook-id). */
@@ -772,6 +786,8 @@ type DeliveryOutcome = {
     status: "failed";
     error: string;
     httpStatus?: number;
+    /** The receiver asked to be switched off (a webhook's 410 Gone): disable the destination. */
+    disable?: true;
 };
 interface ClaimRequest<Filter> {
     /** Most deliveries to claim. */
@@ -834,11 +850,17 @@ interface DeliveryRunner<Filter = undefined> {
     /** One claim, its sends and their records. Never rejects for a delivery's failure; a failing `claim` rejects. */
     run(options?: RunOptions<Filter>): Promise<DeliveryReport>;
 }
-declare const DEFAULT_MAX_ATTEMPTS = 8;
-declare const DEFAULT_MAX_DEFERRALS = 24;
-declare const DEFAULT_BATCH_SIZE = 25;
-/** 1 minute, doubling each attempt, at most 6 hours: 1m, 2m, 4m … 6h. */
-declare function defaultBackoff(attempt: number): number;
+declare const DEFAULT_MAX_ATTEMPTS: number;
+declare const DEFAULT_MAX_DEFERRALS: number;
+declare const DEFAULT_BATCH_SIZE: number;
+/**
+ * 5 minutes, quadrupling each attempt, at most 24 hours: 5m, 20m, 80m, 5h20m,
+ * 21h20m, then 24h. Across the default 8 attempts that is about 3 days, as
+ * Standard Webhooks suggests. Each wait is jittered by up to ±20%, so
+ * deliveries that failed together (a receiver's outage) don't all come back
+ * at once. `random` (default `Math.random`) is for tests.
+ */
+declare const defaultBackoff: (attempt: number, random?: () => number) => number;
 /** Turns a destination's result into an outcome for a delivery on its `attempt`. */
 declare function deliveryOutcome(result: DeliveryResult, attempt: number, options?: {
     now?: number | undefined;
@@ -850,4 +872,4 @@ declare function deliveryOutcome(result: DeliveryResult, attempt: number, option
 }): DeliveryOutcome;
 declare function createDeliveryRunner<Filter = undefined>(options: DeliveryRunnerOptions<Filter>): DeliveryRunner<Filter>;
 
-export { type Cell, type ClaimRequest, type ClaimedDelivery, DEDUPE_WINDOW, DEFAULT_BATCH_SIZE, DEFAULT_MAX_ATTEMPTS, DEFAULT_MAX_DEFERRALS, DEFAULT_SHEET_NAME, DRIVE_FILE_SCOPE, DeliveryError, type DeliveryFailure, type DeliveryItem, type DeliveryOptions, type DeliveryOutcome, type DeliveryReport, type DeliveryResult, type DeliveryRunner, type DeliveryRunnerOptions, type DeliverySubmission, type Destination, type DestinationConfig, type EmailConfig, type EmailContent, type EmailDestinationOptions, type EmailMessage, type EmailProvider, type EmailRenderInput, GOOGLE_TOKEN_URL, type GoogleOAuthClient, type GoogleOAuthTokenOptions, type GoogleServiceAccount, type GoogleTokenOptions, HEADER_SCAN_ROWS, type HookKind, HookUrlError, type HttpDeps, MAX_CONDITION_DEPTH, MAX_HOOK_URL_LENGTH, MAX_RECIPIENTS, type OptionResolver, REQUEST_TIMEOUT_MS, RESEND_API, type RefreshedGoogleToken, type ResendOptions, type ResolveContext, type ResolveHost, type ResponseRow, type RowOptions, type RunOptions, SENSITIVE_MASK, SHEETS_API, SHEETS_SCOPE, SLACK_HOSTS, SLACK_VALUE_LIMIT, type SheetConfig, type SheetState, type SheetsDestinationOptions, type SlackDestinationOptions, type SlackMessageInput, type SlackMessageOptions, type VerifyWebhookInput, type WebCryptoKey, type WebhookConfig, type WebhookDestinationOptions, type WebhookPayload, answerCell, checkHookHost, checkWebhookUrl, clearGoogleOAuthTokenCache, clearGoogleTokenCache, columnLetter, conditionOf, createDeliveryRunner, defaultBackoff, deliveryFailure, deliveryOutcome, deriveSecretKey, emailBody, emailDestination, escapeFormula, escapeHtml, escapeSlack, googleAccessToken, googleOAuthAccessToken, headerSafe, hookHost, httpError, idempotencyKey, isCondition, isPrivateHost, isPublicAddress, isRetryableStatus, isSafeAddress, isSafeFrom, mergeHeader, newWebhookSecret, openSecret, parseHookUrl, passesCondition, refreshGoogleAccessToken, renderEmail, resendProvider, responseRow, retryAfterSeconds, rowFor, sealSecret, secretKeyBytes, sheetsDestination, signJwt, signWebhook, slackDestination, slackMessage, verifyWebhook, visibleInputs, webhookDestination, webhookPayload };
+export { type Cell, type ClaimRequest, type ClaimedDelivery, DEDUPE_WINDOW, DEFAULT_BATCH_SIZE, DEFAULT_MAX_ATTEMPTS, DEFAULT_MAX_DEFERRALS, DEFAULT_SHEET_NAME, DRIVE_FILE_SCOPE, DeliveryError, type DeliveryFailure, type DeliveryItem, type DeliveryOptions, type DeliveryOutcome, type DeliveryReport, type DeliveryResult, type DeliveryRunner, type DeliveryRunnerOptions, type DeliverySubmission, type DeriveSecretKeyOptions, type Destination, type DestinationConfig, type EmailConfig, type EmailContent, type EmailDestinationOptions, type EmailMessage, type EmailProvider, type EmailRenderInput, GOOGLE_TOKEN_URL, type GoogleOAuthClient, type GoogleOAuthTokenOptions, type GoogleServiceAccount, type GoogleTokenOptions, HEADER_SCAN_ROWS, type HookKind, HookUrlError, type HttpDeps, MAX_CONDITION_DEPTH, MAX_HOOK_URL_LENGTH, MAX_RECIPIENTS, MIN_WEBHOOK_SECRET_BYTES, type OptionResolver, REQUEST_TIMEOUT_MS, RESEND_API, type RefreshedGoogleToken, type ResendOptions, type ResolveContext, type ResolveHost, type ResponseRow, type RowOptions, type RunOptions, SENSITIVE_MASK, SHEETS_API, SHEETS_SCOPE, SLACK_HOSTS, SLACK_VALUE_LIMIT, type SheetConfig, type SheetState, type SheetsDestinationOptions, type SlackDestinationOptions, type SlackMessageInput, type SlackMessageOptions, type VerifyWebhookInput, type WebCryptoKey, type WebhookConfig, type WebhookDestinationOptions, type WebhookPayload, answerCell, checkHookHost, checkWebhookUrl, clearGoogleOAuthTokenCache, clearGoogleTokenCache, columnLetter, conditionOf, createDeliveryRunner, defaultBackoff, deliveryFailure, deliveryOutcome, deriveSecretKey, emailBody, emailDestination, escapeFormula, escapeHtml, escapeSlack, googleAccessToken, googleOAuthAccessToken, headerSafe, hookHost, httpError, idempotencyKey, isCondition, isPrivateHost, isPublicAddress, isRetryableStatus, isSafeAddress, isSafeFrom, mergeHeader, newWebhookSecret, openSecret, parseHookUrl, passesCondition, refreshGoogleAccessToken, renderEmail, resendProvider, responseRow, retryAfterSeconds, rowFor, sealSecret, secretKeyBytes, sheetsDestination, signJwt, signWebhook, slackDestination, slackMessage, verifyWebhook, visibleInputs, webhookDestination, webhookPayload };