@oxyhq/crowdsource-contracts 0.1.0

package/dist/webhooks.d.ts

@@ -0,0 +1,604 @@
+/**
+ * Outbound webhooks (§10.6–§10.9) and the signature contract (§10.8).
+ *
+ * §10.11 asks for two behaviours that pull in opposite directions: unknown
+ * EVENTS must be ignored safely, and unknown FIELDS must not break clients.
+ * This module gives each its own schema rather than compromising on one.
+ *
+ *   * `WebhookEventEnvelopeSchema` validates only what every event has —
+ *     identity, type, timing, tenant — and leaves `data` opaque. A receiver
+ *     verifies the signature, records the event id for idempotency, and ignores
+ *     what it does not recognise, without a schema update ever being the reason
+ *     a delivery fails.
+ *   * `KnownWebhookEventSchema` is the discriminated union of the eight events
+ *     §10.6 defines, for the branch that actually handles one.
+ *
+ * Everything here is `.loose()`. These payloads travel from CrowdSource to a
+ * tenant, so an unknown field is a newer server, not an attack; stripping it
+ * would silently discard data from a receiver that persists `event.data` for
+ * later processing — which is precisely what §10.8's "respond 2xx quickly and
+ * queue the processing" tells receivers to do.
+ */
+import { z } from 'zod';
+/** §10.6. */
+export declare const WEBHOOK_EVENT_TYPES: readonly ["report.received", "case.created", "case.escalated", "case.decided", "decision.corrected", "appeal.created", "appeal.decided", "case.closed"];
+export declare const WebhookEventTypeSchema: z.ZodEnum<{
+    "report.received": "report.received";
+    "case.created": "case.created";
+    "case.escalated": "case.escalated";
+    "case.decided": "case.decided";
+    "decision.corrected": "decision.corrected";
+    "appeal.created": "appeal.created";
+    "appeal.decided": "appeal.decided";
+    "case.closed": "case.closed";
+}>;
+export type WebhookEventType = z.infer<typeof WebhookEventTypeSchema>;
+/**
+ * Any event type, including ones this version of the contract does not know.
+ *
+ * Shape-checked but not enumerated, so that "unknown events must be ignored
+ * safely" is something a receiver can DO rather than something it is told about
+ * after its parse has already thrown.
+ */
+export declare const AnyWebhookEventTypeSchema: z.ZodString;
+/**
+ * The envelope every delivery shares (§10.7), with `data` left opaque.
+ *
+ * Parse with this first. `id` is the idempotency key §10.8 requires receivers
+ * to store; `type` decides whether there is anything to do.
+ */
+export declare const WebhookEventEnvelopeSchema: z.ZodObject<{
+    type: z.ZodString;
+    data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    id: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    organizationId: z.ZodString;
+    applicationId: z.ZodString;
+}, z.core.$loose>;
+export type WebhookEventEnvelope = z.infer<typeof WebhookEventEnvelopeSchema>;
+/**
+ * The eight events of §10.6, discriminated on `type`.
+ *
+ * Only `case.decided` has its payload specified in the plan (§10.7). The other
+ * seven carry the case they are about and whatever identifies the object that
+ * moved; they are loose, so filling them in later is additive and needs no
+ * version bump (§10.11).
+ */
+export declare const KnownWebhookEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"report.received">;
+    data: z.ZodObject<{
+        reportId: z.ZodString;
+        caseId: z.ZodString;
+        status: z.ZodEnum<{
+            received: "received";
+            merged: "merged";
+            invalid: "invalid";
+            withdrawn: "withdrawn";
+            closed: "closed";
+        }>;
+        merged: z.ZodBoolean;
+    }, z.core.$loose>;
+    id: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    organizationId: z.ZodString;
+    applicationId: z.ZodString;
+}, z.core.$loose>, z.ZodObject<{
+    type: z.ZodLiteral<"case.created">;
+    data: z.ZodObject<{
+        caseId: z.ZodString;
+    }, z.core.$loose>;
+    id: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    organizationId: z.ZodString;
+    applicationId: z.ZodString;
+}, z.core.$loose>, z.ZodObject<{
+    type: z.ZodLiteral<"case.escalated">;
+    data: z.ZodObject<{
+        caseId: z.ZodString;
+    }, z.core.$loose>;
+    id: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    organizationId: z.ZodString;
+    applicationId: z.ZodString;
+}, z.core.$loose>, z.ZodObject<{
+    type: z.ZodLiteral<"case.decided">;
+    data: z.ZodObject<{
+        caseId: z.ZodString;
+        decision: z.ZodObject<{
+            id: z.ZodString;
+            caseId: z.ZodString;
+            revision: z.ZodNumber;
+            status: z.ZodEnum<{
+                provisional: "provisional";
+                final: "final";
+                superseded: "superseded";
+                corrected: "corrected";
+            }>;
+            outcome: z.ZodEnum<{
+                violation: "violation";
+                no_violation: "no_violation";
+                insufficient_context: "insufficient_context";
+                content_unavailable: "content_unavailable";
+                inconclusive: "inconclusive";
+                duplicate: "duplicate";
+                escalated: "escalated";
+            }>;
+            contextSufficiency: z.ZodEnum<{
+                sufficient: "sufficient";
+                insufficient: "insufficient";
+            }>;
+            confidence: z.ZodNumber;
+            findings: z.ZodArray<z.ZodObject<{
+                code: z.ZodEnum<{
+                    "integrity.spam": "integrity.spam";
+                    "integrity.scam": "integrity.scam";
+                    "integrity.fraud": "integrity.fraud";
+                    "integrity.impersonation": "integrity.impersonation";
+                    "integrity.coordinated_manipulation": "integrity.coordinated_manipulation";
+                    "harassment.insult": "harassment.insult";
+                    "harassment.targeted_abuse": "harassment.targeted_abuse";
+                    "harassment.sexual_harassment": "harassment.sexual_harassment";
+                    "harassment.doxxing": "harassment.doxxing";
+                    "harassment.credible_threat": "harassment.credible_threat";
+                    "hate.dehumanization": "hate.dehumanization";
+                    "hate.slur": "hate.slur";
+                    "hate.incitement": "hate.incitement";
+                    "hate.protected_targeting": "hate.protected_targeting";
+                    "violence.graphic": "violence.graphic";
+                    "violence.threat": "violence.threat";
+                    "violence.instruction": "violence.instruction";
+                    "violence.celebration": "violence.celebration";
+                    "sexual_content.nudity": "sexual_content.nudity";
+                    "sexual_content.explicit_activity": "sexual_content.explicit_activity";
+                    "sexual_content.non_consensual": "sexual_content.non_consensual";
+                    "sexual_content.exploitation": "sexual_content.exploitation";
+                    "child_safety.sexualization": "child_safety.sexualization";
+                    "child_safety.grooming": "child_safety.grooming";
+                    "child_safety.exploitation": "child_safety.exploitation";
+                    "self_harm.promotion": "self_harm.promotion";
+                    "self_harm.instruction": "self_harm.instruction";
+                    "self_harm.imminent_risk": "self_harm.imminent_risk";
+                    "privacy.personal_information": "privacy.personal_information";
+                    "privacy.intimate_media": "privacy.intimate_media";
+                    "privacy.location_exposure": "privacy.location_exposure";
+                    "commerce.prohibited_item": "commerce.prohibited_item";
+                    "commerce.counterfeit": "commerce.counterfeit";
+                    "commerce.misleading_listing": "commerce.misleading_listing";
+                    "commerce.unsafe_product": "commerce.unsafe_product";
+                    "platform_abuse.ban_evasion": "platform_abuse.ban_evasion";
+                    "platform_abuse.report_abuse": "platform_abuse.report_abuse";
+                    "platform_abuse.automation_abuse": "platform_abuse.automation_abuse";
+                    "other.policy_specific": "other.policy_specific";
+                    "other.unclassifiable": "other.unclassifiable";
+                }>;
+                resourceIds: z.ZodArray<z.ZodString>;
+                severity: z.ZodEnum<{
+                    low: "low";
+                    medium: "medium";
+                    high: "high";
+                    critical: "critical";
+                }>;
+                context: z.ZodOptional<z.ZodEnum<{
+                    artistic: "artistic";
+                    educational: "educational";
+                    documentary: "documentary";
+                    newsworthy: "newsworthy";
+                    satire: "satire";
+                    counter_speech: "counter_speech";
+                    medical: "medical";
+                    consensual: "consensual";
+                    fictional: "fictional";
+                }>>;
+                scope: z.ZodEnum<{
+                    application_local: "application_local";
+                    oxy_network: "oxy_network";
+                    identity_integrity: "identity_integrity";
+                }>;
+                attribution: z.ZodOptional<z.ZodEnum<{
+                    author: "author";
+                    reporter: "reporter";
+                    reviewer: "reviewer";
+                }>>;
+                policyRuleIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$loose>>;
+            recommendedActions: z.ZodArray<z.ZodObject<{
+                action: z.ZodEnum<{
+                    remove_or_restrict: "remove_or_restrict";
+                    allow_with_label: "allow_with_label";
+                    remove: "remove";
+                    hide: "hide";
+                    label: "label";
+                    age_gate: "age_gate";
+                    reduce_distribution: "reduce_distribution";
+                    freeze_transaction: "freeze_transaction";
+                    suspend_user: "suspend_user";
+                    request_changes: "request_changes";
+                    allow: "allow";
+                    restore: "restore";
+                    no_action: "no_action";
+                    request_more_context: "request_more_context";
+                    hold: "hold";
+                    local_manual_review: "local_manual_review";
+                    keep_restricted_temporarily: "keep_restricted_temporarily";
+                    escalate: "escalate";
+                    no_global_effect: "no_global_effect";
+                    specialist_queue: "specialist_queue";
+                    legal_queue: "legal_queue";
+                    safety_queue: "safety_queue";
+                }>;
+                targetResourceIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$loose>>;
+            jury: z.ZodObject<{
+                size: z.ZodNumber;
+                decisiveVotes: z.ZodNumber;
+                winningVotes: z.ZodNumber;
+                agreement: z.ZodNumber;
+                specialistPresent: z.ZodBoolean;
+            }, z.core.$loose>;
+            policyVersions: z.ZodObject<{
+                taxonomy: z.ZodString;
+                application: z.ZodString;
+                oxyConduct: z.ZodString;
+            }, z.core.$loose>;
+            supersedesDecisionId: z.ZodOptional<z.ZodString>;
+            publishedAt: z.ZodISODateTime;
+        }, z.core.$loose>;
+    }, z.core.$loose>;
+    id: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    organizationId: z.ZodString;
+    applicationId: z.ZodString;
+}, z.core.$loose>, z.ZodObject<{
+    type: z.ZodLiteral<"decision.corrected">;
+    data: z.ZodObject<{
+        caseId: z.ZodString;
+        decision: z.ZodObject<{
+            id: z.ZodString;
+            caseId: z.ZodString;
+            revision: z.ZodNumber;
+            status: z.ZodEnum<{
+                provisional: "provisional";
+                final: "final";
+                superseded: "superseded";
+                corrected: "corrected";
+            }>;
+            outcome: z.ZodEnum<{
+                violation: "violation";
+                no_violation: "no_violation";
+                insufficient_context: "insufficient_context";
+                content_unavailable: "content_unavailable";
+                inconclusive: "inconclusive";
+                duplicate: "duplicate";
+                escalated: "escalated";
+            }>;
+            contextSufficiency: z.ZodEnum<{
+                sufficient: "sufficient";
+                insufficient: "insufficient";
+            }>;
+            confidence: z.ZodNumber;
+            findings: z.ZodArray<z.ZodObject<{
+                code: z.ZodEnum<{
+                    "integrity.spam": "integrity.spam";
+                    "integrity.scam": "integrity.scam";
+                    "integrity.fraud": "integrity.fraud";
+                    "integrity.impersonation": "integrity.impersonation";
+                    "integrity.coordinated_manipulation": "integrity.coordinated_manipulation";
+                    "harassment.insult": "harassment.insult";
+                    "harassment.targeted_abuse": "harassment.targeted_abuse";
+                    "harassment.sexual_harassment": "harassment.sexual_harassment";
+                    "harassment.doxxing": "harassment.doxxing";
+                    "harassment.credible_threat": "harassment.credible_threat";
+                    "hate.dehumanization": "hate.dehumanization";
+                    "hate.slur": "hate.slur";
+                    "hate.incitement": "hate.incitement";
+                    "hate.protected_targeting": "hate.protected_targeting";
+                    "violence.graphic": "violence.graphic";
+                    "violence.threat": "violence.threat";
+                    "violence.instruction": "violence.instruction";
+                    "violence.celebration": "violence.celebration";
+                    "sexual_content.nudity": "sexual_content.nudity";
+                    "sexual_content.explicit_activity": "sexual_content.explicit_activity";
+                    "sexual_content.non_consensual": "sexual_content.non_consensual";
+                    "sexual_content.exploitation": "sexual_content.exploitation";
+                    "child_safety.sexualization": "child_safety.sexualization";
+                    "child_safety.grooming": "child_safety.grooming";
+                    "child_safety.exploitation": "child_safety.exploitation";
+                    "self_harm.promotion": "self_harm.promotion";
+                    "self_harm.instruction": "self_harm.instruction";
+                    "self_harm.imminent_risk": "self_harm.imminent_risk";
+                    "privacy.personal_information": "privacy.personal_information";
+                    "privacy.intimate_media": "privacy.intimate_media";
+                    "privacy.location_exposure": "privacy.location_exposure";
+                    "commerce.prohibited_item": "commerce.prohibited_item";
+                    "commerce.counterfeit": "commerce.counterfeit";
+                    "commerce.misleading_listing": "commerce.misleading_listing";
+                    "commerce.unsafe_product": "commerce.unsafe_product";
+                    "platform_abuse.ban_evasion": "platform_abuse.ban_evasion";
+                    "platform_abuse.report_abuse": "platform_abuse.report_abuse";
+                    "platform_abuse.automation_abuse": "platform_abuse.automation_abuse";
+                    "other.policy_specific": "other.policy_specific";
+                    "other.unclassifiable": "other.unclassifiable";
+                }>;
+                resourceIds: z.ZodArray<z.ZodString>;
+                severity: z.ZodEnum<{
+                    low: "low";
+                    medium: "medium";
+                    high: "high";
+                    critical: "critical";
+                }>;
+                context: z.ZodOptional<z.ZodEnum<{
+                    artistic: "artistic";
+                    educational: "educational";
+                    documentary: "documentary";
+                    newsworthy: "newsworthy";
+                    satire: "satire";
+                    counter_speech: "counter_speech";
+                    medical: "medical";
+                    consensual: "consensual";
+                    fictional: "fictional";
+                }>>;
+                scope: z.ZodEnum<{
+                    application_local: "application_local";
+                    oxy_network: "oxy_network";
+                    identity_integrity: "identity_integrity";
+                }>;
+                attribution: z.ZodOptional<z.ZodEnum<{
+                    author: "author";
+                    reporter: "reporter";
+                    reviewer: "reviewer";
+                }>>;
+                policyRuleIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$loose>>;
+            recommendedActions: z.ZodArray<z.ZodObject<{
+                action: z.ZodEnum<{
+                    remove_or_restrict: "remove_or_restrict";
+                    allow_with_label: "allow_with_label";
+                    remove: "remove";
+                    hide: "hide";
+                    label: "label";
+                    age_gate: "age_gate";
+                    reduce_distribution: "reduce_distribution";
+                    freeze_transaction: "freeze_transaction";
+                    suspend_user: "suspend_user";
+                    request_changes: "request_changes";
+                    allow: "allow";
+                    restore: "restore";
+                    no_action: "no_action";
+                    request_more_context: "request_more_context";
+                    hold: "hold";
+                    local_manual_review: "local_manual_review";
+                    keep_restricted_temporarily: "keep_restricted_temporarily";
+                    escalate: "escalate";
+                    no_global_effect: "no_global_effect";
+                    specialist_queue: "specialist_queue";
+                    legal_queue: "legal_queue";
+                    safety_queue: "safety_queue";
+                }>;
+                targetResourceIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$loose>>;
+            jury: z.ZodObject<{
+                size: z.ZodNumber;
+                decisiveVotes: z.ZodNumber;
+                winningVotes: z.ZodNumber;
+                agreement: z.ZodNumber;
+                specialistPresent: z.ZodBoolean;
+            }, z.core.$loose>;
+            policyVersions: z.ZodObject<{
+                taxonomy: z.ZodString;
+                application: z.ZodString;
+                oxyConduct: z.ZodString;
+            }, z.core.$loose>;
+            supersedesDecisionId: z.ZodOptional<z.ZodString>;
+            publishedAt: z.ZodISODateTime;
+        }, z.core.$loose>;
+    }, z.core.$loose>;
+    id: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    organizationId: z.ZodString;
+    applicationId: z.ZodString;
+}, z.core.$loose>, z.ZodObject<{
+    type: z.ZodLiteral<"appeal.created">;
+    data: z.ZodObject<{
+        caseId: z.ZodString;
+        appealId: z.ZodString;
+    }, z.core.$loose>;
+    id: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    organizationId: z.ZodString;
+    applicationId: z.ZodString;
+}, z.core.$loose>, z.ZodObject<{
+    type: z.ZodLiteral<"appeal.decided">;
+    data: z.ZodObject<{
+        caseId: z.ZodString;
+        appealId: z.ZodString;
+        decision: z.ZodObject<{
+            id: z.ZodString;
+            caseId: z.ZodString;
+            revision: z.ZodNumber;
+            status: z.ZodEnum<{
+                provisional: "provisional";
+                final: "final";
+                superseded: "superseded";
+                corrected: "corrected";
+            }>;
+            outcome: z.ZodEnum<{
+                violation: "violation";
+                no_violation: "no_violation";
+                insufficient_context: "insufficient_context";
+                content_unavailable: "content_unavailable";
+                inconclusive: "inconclusive";
+                duplicate: "duplicate";
+                escalated: "escalated";
+            }>;
+            contextSufficiency: z.ZodEnum<{
+                sufficient: "sufficient";
+                insufficient: "insufficient";
+            }>;
+            confidence: z.ZodNumber;
+            findings: z.ZodArray<z.ZodObject<{
+                code: z.ZodEnum<{
+                    "integrity.spam": "integrity.spam";
+                    "integrity.scam": "integrity.scam";
+                    "integrity.fraud": "integrity.fraud";
+                    "integrity.impersonation": "integrity.impersonation";
+                    "integrity.coordinated_manipulation": "integrity.coordinated_manipulation";
+                    "harassment.insult": "harassment.insult";
+                    "harassment.targeted_abuse": "harassment.targeted_abuse";
+                    "harassment.sexual_harassment": "harassment.sexual_harassment";
+                    "harassment.doxxing": "harassment.doxxing";
+                    "harassment.credible_threat": "harassment.credible_threat";
+                    "hate.dehumanization": "hate.dehumanization";
+                    "hate.slur": "hate.slur";
+                    "hate.incitement": "hate.incitement";
+                    "hate.protected_targeting": "hate.protected_targeting";
+                    "violence.graphic": "violence.graphic";
+                    "violence.threat": "violence.threat";
+                    "violence.instruction": "violence.instruction";
+                    "violence.celebration": "violence.celebration";
+                    "sexual_content.nudity": "sexual_content.nudity";
+                    "sexual_content.explicit_activity": "sexual_content.explicit_activity";
+                    "sexual_content.non_consensual": "sexual_content.non_consensual";
+                    "sexual_content.exploitation": "sexual_content.exploitation";
+                    "child_safety.sexualization": "child_safety.sexualization";
+                    "child_safety.grooming": "child_safety.grooming";
+                    "child_safety.exploitation": "child_safety.exploitation";
+                    "self_harm.promotion": "self_harm.promotion";
+                    "self_harm.instruction": "self_harm.instruction";
+                    "self_harm.imminent_risk": "self_harm.imminent_risk";
+                    "privacy.personal_information": "privacy.personal_information";
+                    "privacy.intimate_media": "privacy.intimate_media";
+                    "privacy.location_exposure": "privacy.location_exposure";
+                    "commerce.prohibited_item": "commerce.prohibited_item";
+                    "commerce.counterfeit": "commerce.counterfeit";
+                    "commerce.misleading_listing": "commerce.misleading_listing";
+                    "commerce.unsafe_product": "commerce.unsafe_product";
+                    "platform_abuse.ban_evasion": "platform_abuse.ban_evasion";
+                    "platform_abuse.report_abuse": "platform_abuse.report_abuse";
+                    "platform_abuse.automation_abuse": "platform_abuse.automation_abuse";
+                    "other.policy_specific": "other.policy_specific";
+                    "other.unclassifiable": "other.unclassifiable";
+                }>;
+                resourceIds: z.ZodArray<z.ZodString>;
+                severity: z.ZodEnum<{
+                    low: "low";
+                    medium: "medium";
+                    high: "high";
+                    critical: "critical";
+                }>;
+                context: z.ZodOptional<z.ZodEnum<{
+                    artistic: "artistic";
+                    educational: "educational";
+                    documentary: "documentary";
+                    newsworthy: "newsworthy";
+                    satire: "satire";
+                    counter_speech: "counter_speech";
+                    medical: "medical";
+                    consensual: "consensual";
+                    fictional: "fictional";
+                }>>;
+                scope: z.ZodEnum<{
+                    application_local: "application_local";
+                    oxy_network: "oxy_network";
+                    identity_integrity: "identity_integrity";
+                }>;
+                attribution: z.ZodOptional<z.ZodEnum<{
+                    author: "author";
+                    reporter: "reporter";
+                    reviewer: "reviewer";
+                }>>;
+                policyRuleIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$loose>>;
+            recommendedActions: z.ZodArray<z.ZodObject<{
+                action: z.ZodEnum<{
+                    remove_or_restrict: "remove_or_restrict";
+                    allow_with_label: "allow_with_label";
+                    remove: "remove";
+                    hide: "hide";
+                    label: "label";
+                    age_gate: "age_gate";
+                    reduce_distribution: "reduce_distribution";
+                    freeze_transaction: "freeze_transaction";
+                    suspend_user: "suspend_user";
+                    request_changes: "request_changes";
+                    allow: "allow";
+                    restore: "restore";
+                    no_action: "no_action";
+                    request_more_context: "request_more_context";
+                    hold: "hold";
+                    local_manual_review: "local_manual_review";
+                    keep_restricted_temporarily: "keep_restricted_temporarily";
+                    escalate: "escalate";
+                    no_global_effect: "no_global_effect";
+                    specialist_queue: "specialist_queue";
+                    legal_queue: "legal_queue";
+                    safety_queue: "safety_queue";
+                }>;
+                targetResourceIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$loose>>;
+            jury: z.ZodObject<{
+                size: z.ZodNumber;
+                decisiveVotes: z.ZodNumber;
+                winningVotes: z.ZodNumber;
+                agreement: z.ZodNumber;
+                specialistPresent: z.ZodBoolean;
+            }, z.core.$loose>;
+            policyVersions: z.ZodObject<{
+                taxonomy: z.ZodString;
+                application: z.ZodString;
+                oxyConduct: z.ZodString;
+            }, z.core.$loose>;
+            supersedesDecisionId: z.ZodOptional<z.ZodString>;
+            publishedAt: z.ZodISODateTime;
+        }, z.core.$loose>;
+    }, z.core.$loose>;
+    id: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    organizationId: z.ZodString;
+    applicationId: z.ZodString;
+}, z.core.$loose>, z.ZodObject<{
+    type: z.ZodLiteral<"case.closed">;
+    data: z.ZodObject<{
+        caseId: z.ZodString;
+    }, z.core.$loose>;
+    id: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    organizationId: z.ZodString;
+    applicationId: z.ZodString;
+}, z.core.$loose>], "type">;
+export type KnownWebhookEvent = z.infer<typeof KnownWebhookEventSchema>;
+/** §10.8 headers, in their canonical casing. HTTP header names are case-insensitive; look them up accordingly. */
+export declare const WEBHOOK_EVENT_ID_HEADER = "X-CrowdSource-Event-Id";
+export declare const WEBHOOK_TIMESTAMP_HEADER = "X-CrowdSource-Timestamp";
+export declare const WEBHOOK_SIGNATURE_HEADER = "X-CrowdSource-Signature";
+/** The signature scheme prefix, as in `v1=<hex>`. */
+export declare const WEBHOOK_SIGNATURE_VERSION = "v1";
+/** §10.8: reject timestamps more than five minutes away from now. */
+export declare const WEBHOOK_TIMESTAMP_TOLERANCE_SECONDS = 300;
+/** Unix seconds, as the header carries them. */
+export declare const WebhookTimestampHeaderSchema: z.ZodString;
+/** `v1=<64 lowercase hex>` — HMAC-SHA256 of the signed payload. */
+export declare const WebhookSignatureHeaderSchema: z.ZodString;
+/**
+ * The exact bytes both sides sign: `timestamp + "." + rawBody` (§10.8).
+ *
+ * This lives in the contract, not in the signer or the verifier, because a
+ * disagreement between those two about what gets signed is invisible until
+ * every delivery starts failing — or, far worse, until a signature validates
+ * over bytes that are not the ones the receiver goes on to parse. There is no
+ * cryptography here and no transport; the HMAC belongs to the backend's signer
+ * and the SDK's middleware.
+ *
+ * `timestamp` is the header value VERBATIM. Re-deriving it from a parsed number
+ * is the mistake this signature exists to catch, and the receiver must verify
+ * over exactly what arrived.
+ */
+export declare function buildWebhookSignedPayload(timestamp: string, rawBody: string): string;
+/**
+ * §10.9's backoff, in seconds after the initial attempt.
+ *
+ * Published behaviour a tenant plans around, so it belongs to the contract
+ * rather than to the delivery worker. After the last one the delivery is
+ * `dead_letter`, the tenant is alerted, and replay is manual.
+ */
+export declare const WEBHOOK_RETRY_SCHEDULE_SECONDS: readonly number[];
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,aAAa;AACb,eAAO,MAAM,mBAAmB,yJAStB,CAAC;AACX,eAAO,MAAM,sBAAsB;;;;;;;;;EAA8B,CAAC;AAClE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,aAI+C,CAAC;AAStF;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;;;;;;;iBAIrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAoE9E;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BASlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,kHAAkH;AAClH,eAAO,MAAM,uBAAuB,2BAA2B,CAAC;AAChE,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAClE,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAElE,qDAAqD;AACrD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,qEAAqE;AACrE,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,gDAAgD;AAChD,eAAO,MAAM,4BAA4B,aAEQ,CAAC;AAElD,mEAAmE;AACnE,eAAO,MAAM,4BAA4B,aAE6C,CAAC;AAEvF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAO1D,CAAC"}