@particle-academy/fancy-connector-core 0.12.0 → 0.13.0

package/dist/index.d.ts

@@ -1474,6 +1474,58 @@ declare function idempotencyKeyFor(ctx: unknown, nodeId: string, options?: Idemp
  */
 declare const NO_IDEMPOTENCY_KEY_WARNING: string;
 
+/**
+ * RS256 JWT verification against keys the HOST supplies.
+ *
+ * Gmail's Pub/Sub push carries an OIDC token, and a Gmail add-on's requests
+ * carry a Google-signed one; both are RS256 JWS compact tokens. This verifies
+ * one. It NEVER fetches a key set: nothing in this package contacts a URL of
+ * its own, so the host fetches and caches the provider's JWKS and passes the
+ * keys in. The PHP twin is `Jwt::verify`, and both runtimes read
+ * `fixtures/jwt/cases.json`, led by RFC 7515 Appendix A.2.
+ *
+ * Every rule fails CLOSED, and each is a known way JWT verification goes wrong:
+ * - RS256 only. `none` and `HS256` are refused BY NAME before anything else;
+ *   HS256 keyed with the public key is the classic confusion attack.
+ * - A `kid` must name a supplied key. An unknown kid is refused, never
+ *   "try every key".
+ * - `exp` is REQUIRED: a token that never expires is refused. `nbf` is honoured.
+ *   Both allow `leeway` seconds of clock skew (default 60).
+ * - The audience is REQUIRED. A caller that deliberately checks none must pass
+ *   `audience: null`, so forgetting it cannot happen by omission.
+ * - The issuer is matched when one is given.
+ */
+/** An RSA public key as a JWKS lists it. Extra members are ignored. */
+type Jwk = {
+    kty: string;
+    n?: string;
+    e?: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+};
+type JwtVerification = {
+    ok: true;
+    header: Record<string, unknown>;
+    claims: Record<string, unknown>;
+} | {
+    ok: false;
+    reason: string;
+};
+type VerifyJwtOptions = {
+    keys: readonly Jwk[];
+    /** REQUIRED: the expected `aud` (any of a list), or `null` to check none ON PURPOSE. */
+    audience: string | readonly string[] | null;
+    issuer?: string | readonly string[];
+    /** Seconds since the epoch. Injected so tests are not clock-dependent. */
+    now?: number;
+    /** Allowed clock skew for exp and nbf, in seconds. */
+    leeway?: number;
+};
+/** The algorithms accepted. Closed, and shipped as data. */
+declare const JWT_ALGORITHMS: readonly ["RS256"];
+declare function verifyJwt(token: string, options: VerifyJwtOptions): Promise<JwtVerification>;
+
 /**
  * A subscription that EXPIRES, and when the host must act on it.
  *
@@ -2319,105 +2371,15 @@ declare function decodeFormFieldJson(raw: Uint8Array | string, field: string): u
  * then calls `decodeDelivery` with the declaration, then starts the run.
  * Shipped as data too, for a host mirroring the union across a JSON boundary.
  */
-declare const DELIVERY_DECODE_KINDS: readonly ["form-field-json"];
+declare const DELIVERY_DECODE_KINDS: readonly ["form-field-json", "pubsub-push"];
 type DeliveryDecode = {
-    kind: (typeof DELIVERY_DECODE_KINDS)[number];
+    kind: "form-field-json";
     field: string;
+} | {
+    kind: "pubsub-push";
 };
 declare function decodeDelivery(decode: DeliveryDecode, raw: Uint8Array | string): unknown;
 
-/**
- * Dry-verify — proving the transport with a credential that cannot work.
- *
- * ## The discipline, and why it beats a fake server
- *
- * A connector written from documentation can be wrong in three ways that look
- * identical until a real credential arrives:
- *
- * 1. the URL is wrong,
- * 2. the request shape is wrong,
- * 3. the error handling never runs.
- *
- * **All three are invisible to a test with a fake server**, because a fake
- * server agrees with whatever the code does. That is the single most important
- * thing this module encodes: a green unit suite against a mock proves the code
- * is consistent with itself.
- *
- * So a probe calls the REAL API with a deliberately invalid credential and
- * requires an **auth-shaped refusal**. That proves the host resolved, the path
- * exists, the method was accepted, and a failure was recognised as a failure.
- *
- * ## What counts as a pass, precisely
- *
- * An auth-shaped refusal is `401`, `403`, or a `404` on a provider that answers
- * 404 for an unknown credential-in-the-path (a Discord webhook does exactly
- * this). The provider declares which, because guessing here would let a genuine
- * "this endpoint moved" 404 read as success — the one outcome a probe exists to
- * catch.
- *
- * ## Offline is SKIPPED, never failed
- *
- * A check that goes red on a train gets ignored, and then it is worth nothing
- * when it goes red for real. Unreachable is reported as skipped with the reason,
- * and the assertions that need no network still run.
- *
- * ## And nothing is ever sent
- *
- * Every probe is a READ. A probe that wrote something would be a send, and sends
- * are the host's to gate.
- */
-
-type ProbeOutcome = "pass" | "fail" | "skip";
-type ProbeResult = {
-    connector: string;
-    outcome: ProbeOutcome;
-    /** What happened, in the provider's own words where possible. */
-    detail: string;
-    status?: number;
-    kind?: FailureKind;
-};
-type ProbeSpec = {
-    /** Which connector this probes. */
-    connector: string;
-    /**
-     * The read-only request, fully formed, carrying a credential that cannot be
-     * valid. Built by the connector so the probe exercises the connector's own URL
-     * and auth placement rather than a second copy of them.
-     */
-    request: () => Promise<{
-        status: number;
-        body: string;
-    }>;
-    /**
-     * Statuses that count as an auth-shaped refusal for THIS provider.
-     *
-     * Declared rather than assumed. Discord answers `404` for an unknown webhook
-     * id, and on a provider that does not, a 404 means the endpoint moved — the
-     * exact drift a probe is for.
-     */
-    authStatuses: number[];
-    /** Why those statuses, for whoever reads a failure at 3am. */
-    why: string;
-};
-/**
- * Run one probe.
- *
- * Never throws. A probe that threw would take the suite down with it, and the
- * suite's whole value is that it runs everywhere including on a laptop with no
- * network.
- */
-declare function probe(spec: ProbeSpec): Promise<ProbeResult>;
-type ProbeReport = {
-    results: ProbeResult[];
-    passed: number;
-    failed: number;
-    skipped: number;
-    /** True when nothing failed. Skips do not fail a report. */
-    ok: boolean;
-};
-/** Run a set of probes and summarise. Sequential: probes hit real providers. */
-declare function runProbes(specs: ProbeSpec[]): Promise<ProbeReport>;
-
 /**
  * Verifying an inbound provider webhook.
  *
@@ -2633,6 +2595,195 @@ declare function handshakeResponse(handshake: ChallengeHandshake | undefined, qu
  */
 declare function header(headers: Record<string, string | string[] | undefined>, name: string): string | undefined;
 
+/**
+ * A delivery authenticated by an OIDC BEARER TOKEN rather than a signature over
+ * its body: Google Cloud Pub/Sub push, which carries Gmail's `users.watch`
+ * notifications, sends `Authorization: Bearer <JWT>` signed by Google.
+ *
+ * The PHP twin is `OidcDelivery::verify`; both read
+ * `fixtures/oidc-delivery/cases.json`. The token itself is checked by
+ * `verifyJwt`, so every JWT rule there applies here unchanged.
+ *
+ * What this adds, and why each piece fails closed:
+ *
+ * - **The audience is REQUIRED.** Google signs a token for any push
+ *   subscription anyone creates; without the audience, every Google-signed
+ *   token in the world verifies.
+ * - **The principal is REQUIRED, and it is the check people skip.** A
+ *   stranger can create a push subscription in their OWN project, aimed at
+ *   your public URL, with your URL as its audience: Google signs that token
+ *   correctly. Only the service account (`email`) says it was yours.
+ *   Its verified flag (`email_verified`) must be the literal `true`.
+ * - **The keys are the host's.** Nothing here fetches Google's JWKS: the host
+ *   fetches and caches it and passes the keys in.
+ *
+ * A host's own configuration is checked before the delivery is read, so a
+ * misconfigured trigger refuses every push rather than accepting any of them.
+ */
+
+declare const OIDC_JWT_SCHEME_KIND: "oidc-jwt";
+type OidcJwtScheme = {
+    kind: typeof OIDC_JWT_SCHEME_KIND;
+    /** The header carrying `Bearer <token>`. */
+    header: string;
+    /** Accepted `iss` values. Google documents two spellings. */
+    issuers: readonly string[];
+    /** The claim naming WHO the token was minted for: Google push uses `email`. */
+    principalClaim: string;
+    /** A claim that must be the literal `true` beside it: `email_verified`. */
+    verifiedClaim?: string;
+};
+/** What the HOST configured for this trigger. Never in the package. */
+type OidcExpectation = {
+    keys: readonly Jwk[];
+    /** The audience the subscription was created with. */
+    audience: string | null;
+    /** The service account the subscription pushes as. */
+    principal: string | null;
+};
+declare function isOidcJwtScheme(scheme: unknown): scheme is OidcJwtScheme;
+declare function verifyOidcDelivery(options: {
+    headers: Record<string, string | string[] | undefined>;
+    scheme: OidcJwtScheme;
+    expected: OidcExpectation | undefined;
+    /** Seconds since the epoch. */
+    now?: number;
+}): Promise<WebhookVerification>;
+
+/**
+ * Dry-verify — proving the transport with a credential that cannot work.
+ *
+ * ## The discipline, and why it beats a fake server
+ *
+ * A connector written from documentation can be wrong in three ways that look
+ * identical until a real credential arrives:
+ *
+ * 1. the URL is wrong,
+ * 2. the request shape is wrong,
+ * 3. the error handling never runs.
+ *
+ * **All three are invisible to a test with a fake server**, because a fake
+ * server agrees with whatever the code does. That is the single most important
+ * thing this module encodes: a green unit suite against a mock proves the code
+ * is consistent with itself.
+ *
+ * So a probe calls the REAL API with a deliberately invalid credential and
+ * requires an **auth-shaped refusal**. That proves the host resolved, the path
+ * exists, the method was accepted, and a failure was recognised as a failure.
+ *
+ * ## What counts as a pass, precisely
+ *
+ * An auth-shaped refusal is `401`, `403`, or a `404` on a provider that answers
+ * 404 for an unknown credential-in-the-path (a Discord webhook does exactly
+ * this). The provider declares which, because guessing here would let a genuine
+ * "this endpoint moved" 404 read as success — the one outcome a probe exists to
+ * catch.
+ *
+ * ## Offline is SKIPPED, never failed
+ *
+ * A check that goes red on a train gets ignored, and then it is worth nothing
+ * when it goes red for real. Unreachable is reported as skipped with the reason,
+ * and the assertions that need no network still run.
+ *
+ * ## And nothing is ever sent
+ *
+ * Every probe is a READ. A probe that wrote something would be a send, and sends
+ * are the host's to gate.
+ */
+
+type ProbeOutcome = "pass" | "fail" | "skip";
+type ProbeResult = {
+    connector: string;
+    outcome: ProbeOutcome;
+    /** What happened, in the provider's own words where possible. */
+    detail: string;
+    status?: number;
+    kind?: FailureKind;
+};
+type ProbeSpec = {
+    /** Which connector this probes. */
+    connector: string;
+    /**
+     * The read-only request, fully formed, carrying a credential that cannot be
+     * valid. Built by the connector so the probe exercises the connector's own URL
+     * and auth placement rather than a second copy of them.
+     */
+    request: () => Promise<{
+        status: number;
+        body: string;
+    }>;
+    /**
+     * Statuses that count as an auth-shaped refusal for THIS provider.
+     *
+     * Declared rather than assumed. Discord answers `404` for an unknown webhook
+     * id, and on a provider that does not, a 404 means the endpoint moved — the
+     * exact drift a probe is for.
+     */
+    authStatuses: number[];
+    /** Why those statuses, for whoever reads a failure at 3am. */
+    why: string;
+};
+/**
+ * Run one probe.
+ *
+ * Never throws. A probe that threw would take the suite down with it, and the
+ * suite's whole value is that it runs everywhere including on a laptop with no
+ * network.
+ */
+declare function probe(spec: ProbeSpec): Promise<ProbeResult>;
+type ProbeReport = {
+    results: ProbeResult[];
+    passed: number;
+    failed: number;
+    skipped: number;
+    /** True when nothing failed. Skips do not fail a report. */
+    ok: boolean;
+};
+/** Run a set of probes and summarise. Sequential: probes hit real providers. */
+declare function runProbes(specs: ProbeSpec[]): Promise<ProbeReport>;
+
+/**
+ * A Google Cloud Pub/Sub PUSH body, decoded to the message it carries: the
+ * payload TRANSFORM Gmail's `users.watch` notifications need. Pub/Sub wraps
+ * each message in an envelope and base64-encodes its `data`.
+ *
+ * ONE implementation in two runtimes (`php/src/PubSubPush.php` is the twin),
+ * held to the authored corpus under `fixtures/pubsub-push/`, whose README
+ * names the decision each case pins. It runs AFTER verification: a push is
+ * authenticated by the OIDC token in its `Authorization` header, not by
+ * anything in the body.
+ *
+ * The decisions:
+ *
+ * - `data` may be standard base64 or base64url, padded or not. The Gmail guide
+ *   says one, Pub/Sub's page the other. Anything outside both alphabets, and
+ *   bytes that are not UTF-8, are `bad-encoding`.
+ * - `data` is parsed as JSON, and text that is not JSON is `data-not-json`,
+ *   never the raw string.
+ * - `messageId` / `publishTime` are read camelCase first, snake_case second:
+ *   Google sends both spellings.
+ * - Absent `attributes` is `{}` (Pub/Sub omits an empty map); absent
+ *   `deliveryAttempt` is `null` (it is only sent under a dead-letter policy,
+ *   and an attempt count nobody reported is not attempt one).
+ */
+declare const PUBSUB_PUSH_REASONS: readonly ["not-json", "missing-message", "missing-data", "bad-encoding", "data-not-json"];
+type PubSubPushReason = (typeof PUBSUB_PUSH_REASONS)[number];
+/** Refused BY NAME; `reason` is the same string PHP's exception carries. */
+declare class PubSubPushError extends Error {
+    readonly reason: PubSubPushReason;
+    constructor(reason: PubSubPushReason, message: string);
+}
+type PubSubPushMessage = {
+    subscription: string | null;
+    messageId: string | null;
+    publishTime: string | null;
+    attributes: Record<string, string>;
+    deliveryAttempt: number | null;
+    /** The message's `data`, base64-decoded and parsed as JSON. */
+    data: unknown;
+};
+declare function decodePubSubPush(raw: Uint8Array | string): PubSubPushMessage;
+
 /**
  * How a connector trigger learns that something happened.
  *
@@ -2746,7 +2897,16 @@ type SharedTokenVerificationSpec = {
     /** A challenge the provider makes before it will deliver anything. */
     handshake?: ChallengeHandshake;
 };
-type WebhookVerificationSpec = HmacVerificationSpec | SharedTokenVerificationSpec;
+/**
+ * The provider sends a BEARER TOKEN it signed (Google Cloud Pub/Sub push). The
+ * keys, audience and principal it is checked against are the HOST's, passed
+ * to `verifyDelivery` as an `OidcExpectation`. See `verifyOidcDelivery`.
+ */
+type OidcJwtVerificationSpec = {
+    scheme: OidcJwtScheme;
+};
+type WebhookVerificationSpec = HmacVerificationSpec | SharedTokenVerificationSpec | OidcJwtVerificationSpec;
+declare function isOidcJwtSpec(spec: WebhookVerificationSpec): spec is OidcJwtVerificationSpec;
 declare function isSharedTokenSpec(spec: WebhookVerificationSpec): spec is SharedTokenVerificationSpec;
 type InboundDelivery = {
     /** The body EXACTLY as received. Not re-serialised. See `webhook.ts`. */
@@ -2768,7 +2928,9 @@ type InboundDelivery = {
  * for starting workflows in your account, and defaulting to "allow" would make
  * every misconfiguration into an open door that looks shut.
  */
-declare function verifyDelivery(trigger: TriggerDescriptor, delivery: InboundDelivery, secret: string | undefined, now?: number): Promise<WebhookVerification>;
+declare function verifyDelivery(trigger: TriggerDescriptor, delivery: InboundDelivery, secret: string | undefined, now?: number, 
+/** For an `oidc-jwt` scheme: the keys, audience and principal the host configured. `secret` is not read. */
+oidc?: OidcExpectation): Promise<WebhookVerification>;
 /**
  * The event a trigger node publishes when it runs.
  *
@@ -2784,4 +2946,4 @@ declare function verifyDelivery(trigger: TriggerDescriptor, delivery: InboundDel
  */
 declare function triggerEvent(trigger: TriggerDescriptor, connection: ResolvedConnection, injected: unknown, config: Record<string, unknown>): unknown;
 
-export { AMBIGUOUS_REFUSAL, type ApiContract, type Attempt, type Attendee, type ByteRange, CANONICAL_METRICS, CONNECTOR_API_VERSION, CONNECTOR_MODES, CREDENTIAL_SCOPES, type CallOptions, type CallResult, type Capabilities, type Catalogue, type ChainLinks, type ChainOutcome, type ChainRef, type ChallengeHandshake, type Citation, type Classified, type ConnectionCredentials, type ConnectionHost, type ConnectionSpec, type Connector, ConnectorAmbiguous, ConnectorApiMismatch, ConnectorAuthError, ConnectorConfigError, ConnectorError, type ConnectorErrorContext, type ConnectorFaker, ConnectorIdempotencyExpiredError, type ConnectorMode, ConnectorModeError, ConnectorRateLimited, type ConnectorRequest, ConnectorRequestError, type ConnectorResult, ConnectorTransient, ConnectorUnreachable, type ContractOperation, type CredentialField, type CredentialScope, DEFAULT_IDEMPOTENCY_WINDOW_SECONDS, DEFAULT_RETRY, DELIVERY_DECODE_KINDS, type DeliveryDeclaration, type DeliveryDecode, type DeliveryMechanism, type DeliveryOutcome, type DeliveryRoute, type DriftFinding, type DriftReport, EXPIRES_AT_UNITS, type ExpiresAtUnit, FAKE_EPOCH, FORM_FIELD_JSON_REASONS, type FailureKind, type FakeRequest, type FakeValues, FormFieldJsonError, type FormFieldJsonReason, type HmacScheme, type HmacVerificationSpec, type HostEnvironment, type IdempotencyOptions, type InboundDelivery, type Invite, type InviteMethod, type JoinTarget, type JoinTargetKind, type LeaseAction, type LeaseDeclaration, type LeaseState, MAX_IDEMPOTENCY_KEY_LENGTH, type MetricDescriptor, type MetricSample, type MimeAttachment, type MimeHeader, type MimeMessage, type MimePart, type ModeInputs, NO_IDEMPOTENCY_KEY_WARNING, PROBLEM_SEVERITIES, type PreparedRequest, type ProbeOutcome, type ProbeReport, type ProbeResult, type ProbeSpec, type Problem, type ProviderAdapter, RENDERER_VERSION, REVIEW_STALE_DAYS, type RecordedShape, type RecurrenceRule, type RenderRules, type RenderedPayload, type RequestedMode, type ResolveOptions, type ResolvedConnection, type RetryPolicy, type RunIdentity, SANDBOX_KINDS, SIGNED_URI_RULES, SUPPORTED_CONNECTOR_API, type SandboxKind, type Segment, type ServiceDescriptor, type SetupStep, type ShapeMismatch, type SharedTokenScheme, type SharedTokenVerificationSpec, type SignedRequestLine, type SignedUriRule, type SpecSource, type SubscriptionLease, type TextUnit, type Transport, type TransportResponse, type TriggerDescriptor, type VerifyResult, type WebhookVerification, type WebhookVerificationSpec, assertConnectorApi, byteRangeOf, callConnector, capabilityProblems, checkAgainstOpenApi, checkAgainstRecordedShape, classifyError, classifyHttp, classifyStatus, classifyThrown, compareShape, connectionsFor, constantTimeEquals, decodeDelivery, decodeFormFieldJson, deliver, fakeRequest, fakeValues, getConnectionHost, graphemes, handshakeResponse, header, hmac, httpFailure, idempotencyKeyFor, isEmptyPayload, isRemote, isSharedTokenScheme, isSharedTokenSpec, isUnconditionallyRetryable, joinTargets, leaseAction, leaseFromResponse, leaseRenewAt, leaseState, linkRanges, measure, nextOccurrence, normaliseSignedUri, parseInvite, parseMime, payloadHash, postChain, probe, providerProblems, providerSandboxIsSelectable, registerConnectionHost, registerTransport, render, reported, resetRateState, resolveConnection, resolveConnectorMode, respectRate, runIdentityFrom, runKeyFrom, runProbes, sandboxIsSelectable, sandboxRefusal, satisfiesMinimum, secretKeyBytes, seedFrom, shapeOf, shouldRetry, sliceByteRange, splitToFit, subscriptionLease, triggerEvent, unchecked, utf8Length, verifyDelivery, verifyHmac, verifySharedToken, withResolvedLimit };
+export { AMBIGUOUS_REFUSAL, type ApiContract, type Attempt, type Attendee, type ByteRange, CANONICAL_METRICS, CONNECTOR_API_VERSION, CONNECTOR_MODES, CREDENTIAL_SCOPES, type CallOptions, type CallResult, type Capabilities, type Catalogue, type ChainLinks, type ChainOutcome, type ChainRef, type ChallengeHandshake, type Citation, type Classified, type ConnectionCredentials, type ConnectionHost, type ConnectionSpec, type Connector, ConnectorAmbiguous, ConnectorApiMismatch, ConnectorAuthError, ConnectorConfigError, ConnectorError, type ConnectorErrorContext, type ConnectorFaker, ConnectorIdempotencyExpiredError, type ConnectorMode, ConnectorModeError, ConnectorRateLimited, type ConnectorRequest, ConnectorRequestError, type ConnectorResult, ConnectorTransient, ConnectorUnreachable, type ContractOperation, type CredentialField, type CredentialScope, DEFAULT_IDEMPOTENCY_WINDOW_SECONDS, DEFAULT_RETRY, DELIVERY_DECODE_KINDS, type DeliveryDeclaration, type DeliveryDecode, type DeliveryMechanism, type DeliveryOutcome, type DeliveryRoute, type DriftFinding, type DriftReport, EXPIRES_AT_UNITS, type ExpiresAtUnit, FAKE_EPOCH, FORM_FIELD_JSON_REASONS, type FailureKind, type FakeRequest, type FakeValues, FormFieldJsonError, type FormFieldJsonReason, type HmacScheme, type HmacVerificationSpec, type HostEnvironment, type IdempotencyOptions, type InboundDelivery, type Invite, type InviteMethod, JWT_ALGORITHMS, type JoinTarget, type JoinTargetKind, type Jwk, type JwtVerification, type LeaseAction, type LeaseDeclaration, type LeaseState, MAX_IDEMPOTENCY_KEY_LENGTH, type MetricDescriptor, type MetricSample, type MimeAttachment, type MimeHeader, type MimeMessage, type MimePart, type ModeInputs, NO_IDEMPOTENCY_KEY_WARNING, OIDC_JWT_SCHEME_KIND, type OidcExpectation, type OidcJwtScheme, type OidcJwtVerificationSpec, PROBLEM_SEVERITIES, PUBSUB_PUSH_REASONS, type PreparedRequest, type ProbeOutcome, type ProbeReport, type ProbeResult, type ProbeSpec, type Problem, type ProviderAdapter, PubSubPushError, type PubSubPushMessage, type PubSubPushReason, RENDERER_VERSION, REVIEW_STALE_DAYS, type RecordedShape, type RecurrenceRule, type RenderRules, type RenderedPayload, type RequestedMode, type ResolveOptions, type ResolvedConnection, type RetryPolicy, type RunIdentity, SANDBOX_KINDS, SIGNED_URI_RULES, SUPPORTED_CONNECTOR_API, type SandboxKind, type Segment, type ServiceDescriptor, type SetupStep, type ShapeMismatch, type SharedTokenScheme, type SharedTokenVerificationSpec, type SignedRequestLine, type SignedUriRule, type SpecSource, type SubscriptionLease, type TextUnit, type Transport, type TransportResponse, type TriggerDescriptor, type VerifyJwtOptions, type VerifyResult, type WebhookVerification, type WebhookVerificationSpec, assertConnectorApi, byteRangeOf, callConnector, capabilityProblems, checkAgainstOpenApi, checkAgainstRecordedShape, classifyError, classifyHttp, classifyStatus, classifyThrown, compareShape, connectionsFor, constantTimeEquals, decodeDelivery, decodeFormFieldJson, decodePubSubPush, deliver, fakeRequest, fakeValues, getConnectionHost, graphemes, handshakeResponse, header, hmac, httpFailure, idempotencyKeyFor, isEmptyPayload, isOidcJwtScheme, isOidcJwtSpec, isRemote, isSharedTokenScheme, isSharedTokenSpec, isUnconditionallyRetryable, joinTargets, leaseAction, leaseFromResponse, leaseRenewAt, leaseState, linkRanges, measure, nextOccurrence, normaliseSignedUri, parseInvite, parseMime, payloadHash, postChain, probe, providerProblems, providerSandboxIsSelectable, registerConnectionHost, registerTransport, render, reported, resetRateState, resolveConnection, resolveConnectorMode, respectRate, runIdentityFrom, runKeyFrom, runProbes, sandboxIsSelectable, sandboxRefusal, satisfiesMinimum, secretKeyBytes, seedFrom, shapeOf, shouldRetry, sliceByteRange, splitToFit, subscriptionLease, triggerEvent, unchecked, utf8Length, verifyDelivery, verifyHmac, verifyJwt, verifyOidcDelivery, verifySharedToken, withResolvedLimit };