@whooshbang/contract-mock 1.0.0-rc.16

package/dist/core.js

@@ -0,0 +1,3459 @@
+import { Hono } from "hono";
+import { classifyWebhookDeliveryOutcome, contractValidationErrors, MAX_WEBHOOK_DELIVERY_ATTEMPTS, validateAccountProjection, validateApiCredential, validateApiCredentialCollection, validateApiCredentialRotation, validateApiCredentialSecretReveal, validateCreateApiCredentialRequest, validateCreateCustomerEndpointRequest, validateCreateMachineClientRequest, validateCreateMessageRequest, validateCreateProjectRequest, validateCreateSubscriptionLinkRequest, validateCustomerEndpoint, validateCustomerEndpointAttemptCollection, validateCustomerEndpointCollection, validateCustomerEndpointMutationResult, validateInteractionEvent, validateInteractionSummary, validateMachineClient, validateMachineCredential, validateMachineEventAckRequest, validateMachineEventAckResponse, validateMachineEventPollResponse, validateMessage, validateWhooshBangEvent, validateProblem, validateProject, validateProjectCollection, validateProviderCapabilitiesCollection, validateRegisterMachineCredentialRequest, validateRotateApiCredentialRequest, validateRotateCustomerEndpointRequest, validateSubscriptionLink, verifyMachineCredentialToken, } from "@whooshbang/contracts";
+import { getScenarioDefinition } from "./scenarios.js";
+import { parseInteractionControlInput } from "./interaction-control.js";
+const CONTRACT_VERSION = "1.0.0-rc.13";
+const SCENARIO_VERSION = "contract-mock-scenarios.v1";
+const MAX_REQUEST_BYTES = 64 * 1024;
+const MAX_PROVIDER_ATTEMPTS = 8;
+const INTERACTION_POLL_DEFAULT_WAIT_SECONDS = 30;
+const INTERACTION_POLL_MAX_WAIT_SECONDS = 30;
+const INTERACTION_POLL_MAX_CONCURRENCY = 5;
+const INTERACTION_POLL_RECHECK_MILLISECONDS = 500;
+const MACHINE_SCOPE_SUMMARY = [
+    "machine-messages:write",
+    "machine-messages:read",
+    "machine-events:read",
+    "machine-events:ack",
+];
+const CURRENT_SIGNING_SECRET = "whsec_AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=";
+const PREVIOUS_SIGNING_SECRET = "whsec_ICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj8=";
+function containsAsciiControl(value) {
+    for (const character of value) {
+        const codePoint = character.codePointAt(0);
+        if (codePoint !== undefined && (codePoint <= 0x1f || codePoint === 0x7f)) {
+            return true;
+        }
+    }
+    return false;
+}
+function codePointLength(value) {
+    return Array.from(value).length;
+}
+const projectScopes = [
+    "subscriptions:write",
+    "subscriptions:read",
+    "messages:write",
+    "messages:read",
+    "machine-clients:write",
+    "machine-clients:read",
+    "capabilities:read",
+];
+const accountScopes = ["projects:write", "projects:read"];
+/** Every scope an OAuth grant may carry: account-level, then project-level. */
+const oauthScopes = [...accountScopes, ...projectScopes];
+/**
+ * The synthetic project and environment identifiers the fixture project
+ * credentials authenticate against.
+ *
+ * Environment-scoped paths need an environment identifier that the bearer
+ * token alone does not carry, so consumers building customer-endpoint URLs
+ * read it from here rather than guessing.
+ */
+export const CONTRACT_MOCK_FIXTURE_ENVIRONMENTS = Object.freeze({
+    liveEnvironmentId: "environment_project_synthetic_live",
+    projectId: "project_synthetic",
+    testEnvironmentId: "environment_project_synthetic_test",
+});
+export const CONTRACT_MOCK_FIXTURE_CREDENTIALS = Object.freeze({
+    grant: "oauth-grant-token",
+    humanSession: "human-session-token",
+    otherGrant: "oauth-grant-other-token",
+    liveProject: "project-live-token",
+    machineA: "machine-a-token",
+    machineB: "machine-b-token",
+    otherHumanSession: "human-other-session-token",
+    projectA: "project-a-token",
+    projectB: "project-b-token",
+    projectTest: "project-test-token",
+    readOnly: "project-read-only-token",
+});
+function defaultCredentials() {
+    return [
+        {
+            accountId: "account_synthetic",
+            kind: "human",
+            role: "admin",
+            token: CONTRACT_MOCK_FIXTURE_CREDENTIALS.humanSession,
+        },
+        {
+            accountId: "account_other",
+            kind: "human",
+            role: "admin",
+            token: CONTRACT_MOCK_FIXTURE_CREDENTIALS.otherHumanSession,
+        },
+        {
+            accountId: "account_synthetic",
+            kind: "grant",
+            scopes: oauthScopes,
+            token: CONTRACT_MOCK_FIXTURE_CREDENTIALS.grant,
+        },
+        {
+            accountId: "account_other",
+            kind: "grant",
+            scopes: oauthScopes,
+            token: CONTRACT_MOCK_FIXTURE_CREDENTIALS.otherGrant,
+        },
+        {
+            accountId: "account_synthetic",
+            environment: "test",
+            kind: "project",
+            projectId: "project_synthetic",
+            scopes: projectScopes,
+            token: CONTRACT_MOCK_FIXTURE_CREDENTIALS.projectTest,
+        },
+        {
+            accountId: "account_synthetic",
+            environment: "live",
+            kind: "project",
+            projectId: "project_synthetic",
+            scopes: projectScopes,
+            token: CONTRACT_MOCK_FIXTURE_CREDENTIALS.liveProject,
+        },
+        {
+            accountId: "account_a",
+            environment: "test",
+            kind: "project",
+            projectId: "project_a",
+            scopes: projectScopes,
+            token: CONTRACT_MOCK_FIXTURE_CREDENTIALS.projectA,
+        },
+        {
+            accountId: "account_b",
+            environment: "test",
+            kind: "project",
+            projectId: "project_b",
+            scopes: projectScopes,
+            token: CONTRACT_MOCK_FIXTURE_CREDENTIALS.projectB,
+        },
+        {
+            accountId: "account_synthetic",
+            environment: "test",
+            kind: "project",
+            projectId: "project_synthetic",
+            scopes: ["subscriptions:read", "messages:read"],
+            token: CONTRACT_MOCK_FIXTURE_CREDENTIALS.readOnly,
+        },
+        {
+            accountId: "account_synthetic",
+            bindingId: "binding_synthetic_relay",
+            credentialId: "mcred_AAECAwQFBgcICQoLDA0ODw",
+            environment: "test",
+            kind: "machine",
+            machineClientId: "machine_client_synthetic_001",
+            machineId: "machine_synthetic_a",
+            notifierId: "default",
+            projectId: "project_synthetic",
+            scopes: MACHINE_SCOPE_SUMMARY,
+            status: "active",
+            subscriberId: "agent_relay_operator",
+            token: CONTRACT_MOCK_FIXTURE_CREDENTIALS.machineA,
+        },
+        {
+            accountId: "account_synthetic",
+            bindingId: "binding_synthetic_relay_b",
+            credentialId: "mcred_AQEBAQEBAQEBAQEBAQEBAQ",
+            environment: "test",
+            kind: "machine",
+            machineClientId: "machine_client_synthetic_002",
+            machineId: "machine_synthetic_b",
+            notifierId: "default",
+            projectId: "project_synthetic",
+            scopes: MACHINE_SCOPE_SUMMARY,
+            status: "active",
+            subscriberId: "agent_relay_operator_b",
+            token: CONTRACT_MOCK_FIXTURE_CREDENTIALS.machineB,
+        },
+    ];
+}
+function requireFixtureIdentifier(value, field) {
+    if (typeof value !== "string" ||
+        codePointLength(value) === 0 ||
+        codePointLength(value) > 128 ||
+        containsAsciiControl(value)) {
+        throw new TypeError(`Fixture credential ${field} is invalid.`);
+    }
+    return value;
+}
+function snapshotFixtureScopes(value, allowed) {
+    if (!Array.isArray(value)) {
+        throw new TypeError("Fixture credential scopes are invalid.");
+    }
+    const scopes = [];
+    for (const candidate of value) {
+        const scope = allowed.find((allowedScope) => allowedScope === candidate);
+        if (scope === undefined) {
+            throw new TypeError("Fixture credential scopes are invalid.");
+        }
+        scopes.push(scope);
+    }
+    return Object.freeze(scopes);
+}
+function snapshotFixtureCredentials(value) {
+    if (!Array.isArray(value)) {
+        throw new TypeError("Fixture credentials must be an array.");
+    }
+    const tokens = new Set();
+    const snapshot = [];
+    for (const candidate of value) {
+        if (typeof candidate !== "object" ||
+            candidate === null ||
+            Array.isArray(candidate)) {
+            throw new TypeError("A fixture credential is invalid.");
+        }
+        const record = candidate;
+        const token = record.token;
+        if (typeof token !== "string" ||
+            token.length === 0 ||
+            token.length > 4096 ||
+            !/^[\u0021-\u007e]+$/u.test(token)) {
+            throw new TypeError("A fixture credential token is invalid.");
+        }
+        if (tokens.has(token)) {
+            throw new TypeError("Fixture credential tokens must be unique.");
+        }
+        tokens.add(token);
+        const accountId = requireFixtureIdentifier(record.accountId, "accountId");
+        if (record.kind === "human") {
+            if (record.role !== "admin" && record.role !== "member") {
+                throw new TypeError("Fixture human credential role is invalid.");
+            }
+            snapshot.push(Object.freeze({
+                accountId,
+                kind: "human",
+                role: record.role,
+                token,
+            }));
+            continue;
+        }
+        if (record.kind === "grant") {
+            snapshot.push(Object.freeze({
+                accountId,
+                kind: "grant",
+                scopes: snapshotFixtureScopes(record.scopes, oauthScopes),
+                token,
+            }));
+            continue;
+        }
+        const projectId = requireFixtureIdentifier(record.projectId, "projectId");
+        if (record.environment !== "test" && record.environment !== "live") {
+            throw new TypeError("Fixture credential environment is invalid.");
+        }
+        const environment = record.environment;
+        if (record.kind === "project") {
+            snapshot.push(Object.freeze({
+                accountId,
+                environment,
+                kind: "project",
+                projectId,
+                scopes: snapshotFixtureScopes(record.scopes, projectScopes),
+                token,
+            }));
+            continue;
+        }
+        if (record.kind !== "machine") {
+            throw new TypeError("Fixture credential kind is invalid.");
+        }
+        if (record.status !== "active" && record.status !== "revoked") {
+            throw new TypeError("Fixture machine credential status is invalid.");
+        }
+        const credentialId = record.credentialId === undefined
+            ? undefined
+            : requireFixtureIdentifier(record.credentialId, "credentialId");
+        snapshot.push(Object.freeze({
+            accountId,
+            bindingId: requireFixtureIdentifier(record.bindingId, "bindingId"),
+            ...(credentialId === undefined ? {} : { credentialId }),
+            environment,
+            kind: "machine",
+            machineClientId: requireFixtureIdentifier(record.machineClientId, "machineClientId"),
+            machineId: requireFixtureIdentifier(record.machineId, "machineId"),
+            notifierId: requireFixtureIdentifier(record.notifierId, "notifierId"),
+            projectId,
+            scopes: snapshotFixtureScopes(record.scopes, MACHINE_SCOPE_SUMMARY),
+            status: record.status,
+            subscriberId: requireFixtureIdentifier(record.subscriberId, "subscriberId"),
+            token,
+        }));
+    }
+    return Object.freeze(snapshot);
+}
+/**
+ * Resolves the environment identifier a project credential authenticates for.
+ *
+ * A fixture credential may declare one explicitly; otherwise it is derived
+ * from the project and environment kind so every credential has a stable,
+ * inspectable environment path segment.
+ */
+function credentialEnvironmentId(credential) {
+    return (credential.environmentId ??
+        `environment_${credential.projectId}_${credential.environment}`);
+}
+/**
+ * Mints a deterministic Standard Webhooks secret.
+ *
+ * The mock is reproducible by design, so the bytes come from the endpoint
+ * sequence and secret version rather than a random source. These are local
+ * fixtures and must never be treated as production signing material.
+ */
+function syntheticEndpointSecret(sequence, version) {
+    const bytes = new Uint8Array(32);
+    for (let index = 0; index < bytes.length; index += 1) {
+        bytes[index] = (index * 7 + sequence * 31 + version * 131) % 256;
+    }
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return `whsec_${btoa(binary)}`;
+}
+function createDefaultIdGenerator() {
+    const counters = new Map();
+    return (kind) => {
+        const next = (counters.get(kind) ?? 0) + 1;
+        counters.set(kind, next);
+        return `${kind}_mock_${String(next).padStart(3, "0")}`;
+    };
+}
+function clone(value) {
+    return structuredClone(value);
+}
+function timestamp(options) {
+    const date = options.clock?.now() ?? new Date("2026-07-25T17:45:00.000Z");
+    if (Number.isNaN(date.getTime())) {
+        throw new RangeError("Contract mock clock returned an invalid Date.");
+    }
+    return date.toISOString();
+}
+function timestampAfter(options, seconds) {
+    const now = Date.parse(timestamp(options));
+    return new Date(now + seconds * 1000).toISOString();
+}
+function timestampAfterValue(value, seconds) {
+    return new Date(Date.parse(value) + seconds * 1000).toISOString();
+}
+function base64Url(bytes) {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary)
+        .replaceAll("+", "-")
+        .replaceAll("/", "_")
+        .replace(/=+$/u, "");
+}
+function deterministicApiCredentialMaterial(state) {
+    state.apiCredentialSequence += 1;
+    const identity = new Uint8Array(16);
+    new DataView(identity.buffer).setUint32(identity.byteLength - 4, state.apiCredentialSequence);
+    const secret = new Uint8Array(32);
+    for (let index = 0; index < secret.byteLength; index += 1) {
+        secret[index] = (state.apiCredentialSequence * 31 + index) % 256;
+    }
+    const id = `pcred_${base64Url(identity)}`;
+    return {
+        id,
+        prefix: `wb_pc1.${id.slice(0, 14)}`,
+        token: `wb_pc1.${id}.${base64Url(secret)}`,
+    };
+}
+function refreshApiCredentialStatus(record, state) {
+    const scheduled = record.credential.scheduled_revocation_at;
+    if (record.credential.status !== "active" ||
+        scheduled === undefined ||
+        Date.parse(scheduled) > Date.parse(state.now())) {
+        return;
+    }
+    const metadata = { ...record.credential };
+    delete metadata.scheduled_revocation_at;
+    record.credential = {
+        ...metadata,
+        revoked_at: scheduled,
+        status: "revoked",
+    };
+}
+function credentialPageOffset(cursor) {
+    if (cursor === null) {
+        return 0;
+    }
+    const match = /^api_credential_cursor_([1-9]\d*)$/u.exec(cursor);
+    if (match?.[1] === undefined) {
+        return undefined;
+    }
+    const offset = Number(match[1]);
+    return Number.isSafeInteger(offset) ? offset : undefined;
+}
+function projectEnvironmentForHuman(state, identity, projectId, environmentId) {
+    const project = state.projects.get(projectId);
+    if (project === undefined ||
+        project.account_id !== identity.credential.accountId) {
+        return undefined;
+    }
+    return project.environments.find((environment) => environment.id === environmentId);
+}
+function createApiCredentialMaterial(request, projectId, environment, identity, state) {
+    const material = deterministicApiCredentialMaterial(state);
+    const credential = {
+        created_at: state.now(),
+        created_by: `member_${identity.credential.accountId}`,
+        environment: environment.kind,
+        environment_id: environment.id,
+        id: material.id,
+        label: request.label,
+        prefix: material.prefix,
+        project_id: projectId,
+        scopes: [...request.scopes],
+        status: "active",
+    };
+    const reveal = {
+        credential,
+        secret: material.token,
+    };
+    if (!validateApiCredentialSecretReveal(reveal)) {
+        throw new Error("Internal contract-mock credential response violation.");
+    }
+    state.apiCredentials.set(credential.id, {
+        credential,
+    });
+    state.credentialsByToken.set(material.token, {
+        accountId: identity.credential.accountId,
+        credentialId: credential.id,
+        environment: credential.environment,
+        kind: "project",
+        projectId,
+        scopes: credential.scopes,
+        token: material.token,
+    });
+    return reveal;
+}
+function bindingKey(projectId, environment, subscriberId, notifierId) {
+    return `${projectId}\u0000${environment}\u0000${subscriberId}\u0000${notifierId}`;
+}
+function idempotencyKey(identity, operation, key) {
+    const credential = identity.credential;
+    if (credential.kind === "human" || credential.kind === "grant") {
+        return `${credential.accountId}\u0000${operation}\u0000${key}`;
+    }
+    return `${credential.projectId}\u0000${credential.environment}\u0000${operation}\u0000${key}`;
+}
+function acknowledgementKey(machineClientId, eventId) {
+    return `${machineClientId}\u0000${eventId}`;
+}
+function stableValue(value) {
+    if (Array.isArray(value)) {
+        return value.map(stableValue);
+    }
+    if (typeof value === "object" && value !== null) {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, child]) => [key, stableValue(child)]));
+    }
+    return value;
+}
+function fingerprint(value) {
+    return JSON.stringify(stableValue(value));
+}
+function problem(code, status, diagnosticId, overrides = {}) {
+    const defaults = {
+        authentication_required: {
+            detail: "Provide a bearer credential.",
+            retryable: false,
+            title: "Authentication required",
+        },
+        cancellation_too_late: {
+            detail: "The operation can no longer be cancelled.",
+            retryable: false,
+            title: "Cancellation too late",
+        },
+        credential_invalid: {
+            detail: "The bearer credential is malformed, invalid, or revoked.",
+            retryable: false,
+            title: "Credential invalid",
+        },
+        environment_mismatch: {
+            detail: "The credential cannot address a binding in another environment.",
+            retryable: false,
+            title: "Environment mismatch",
+        },
+        endpoint_rotation_conflict: {
+            detail: "A prior signing-secret overlap is still active. Retry after that overlap expires.",
+            retryable: true,
+            title: "Endpoint rotation conflict",
+        },
+        idempotency_conflict: {
+            detail: "The key was already accepted with materially different validated input.",
+            retryable: false,
+            title: "Idempotency conflict",
+        },
+        idempotency_key_required: {
+            detail: "Provide an Idempotency-Key containing 8 to 255 visible ASCII characters.",
+            retryable: false,
+            title: "Idempotency key required",
+        },
+        provider_outcome_unknown: {
+            detail: "The provider may have accepted the operation; no automatic retry is scheduled.",
+            retryable: false,
+            title: "Provider outcome unknown",
+        },
+        provider_retryable: {
+            detail: "The provider call failed before acceptance and may be retried by the service.",
+            retryable: true,
+            title: "Provider retryable failure",
+        },
+        provider_terminal: {
+            detail: "The provider rejected the operation and no automatic retry is scheduled.",
+            retryable: false,
+            title: "Provider terminal failure",
+        },
+        project_slug_conflict: {
+            detail: "A project with this slug already exists in the account.",
+            retryable: false,
+            title: "Project slug conflict",
+        },
+        rate_limited: {
+            detail: "The project or operation rate limit was exceeded.",
+            retryable: true,
+            title: "Rate limited",
+        },
+        request_invalid: {
+            detail: "One or more request fields are invalid.",
+            retryable: false,
+            title: "Request invalid",
+        },
+        replay_unavailable: {
+            detail: "The customer event cannot be replayed in its current state.",
+            retryable: false,
+            title: "Replay unavailable",
+        },
+        resource_expired: {
+            detail: "The resource is no longer available.",
+            retryable: false,
+            title: "Resource expired",
+        },
+        resource_not_found: {
+            detail: "The resource was not found.",
+            retryable: false,
+            title: "Resource not found",
+        },
+        scope_forbidden: {
+            detail: "The credential does not grant the required operation scope.",
+            retryable: false,
+            title: "Scope forbidden",
+        },
+        subscriber_unbound: {
+            detail: "No authorized channel binding is available for this subscriber and notifier.",
+            retryable: false,
+            title: "Subscriber unbound",
+        },
+    };
+    const base = defaults[code];
+    const value = {
+        code,
+        detail: overrides.detail ?? base.detail,
+        diagnostic_id: diagnosticId,
+        retryable: overrides.retryable ?? base.retryable,
+        status,
+        title: overrides.title ?? base.title,
+        type: `https://whooshbang.flowxo.com/problems/${code}`,
+        ...(overrides.retry_at === undefined
+            ? {}
+            : { retry_at: overrides.retry_at }),
+        ...(overrides.field_errors === undefined
+            ? {}
+            : { field_errors: overrides.field_errors }),
+    };
+    if (!validateProblem(value)) {
+        throw new Error("Internal contract-mock Problem Details violation.");
+    }
+    return value;
+}
+function problemResponse(value, additionalHeaders = {}) {
+    return new Response(JSON.stringify(value), {
+        headers: {
+            "content-type": "application/problem+json",
+            "whooshbang-diagnostic-id": value.diagnostic_id,
+            ...additionalHeaders,
+        },
+        status: value.status,
+    });
+}
+function bodyDiagnosticId(value) {
+    return typeof value === "object" &&
+        value !== null &&
+        "diagnostic_id" in value &&
+        typeof value.diagnostic_id === "string"
+        ? value.diagnostic_id
+        : undefined;
+}
+function assertDiagnosticId(value) {
+    if (value.length < 8 ||
+        value.length > 128 ||
+        !/^[A-Za-z0-9_-]+$/u.test(value)) {
+        throw new Error("Internal contract-mock diagnostic ID violation.");
+    }
+    return value;
+}
+function validatedResponse(value, validator, status, state, diagnosticId) {
+    if (!validator(value)) {
+        const errors = contractValidationErrors(validator);
+        throw new Error(`Internal contract-mock response violation: ${JSON.stringify(errors)}`);
+    }
+    const responseDiagnosticId = assertDiagnosticId(diagnosticId ?? bodyDiagnosticId(value) ?? state.idGenerator("diagnostic"));
+    return new Response(JSON.stringify(value), {
+        headers: {
+            "content-type": "application/json",
+            "whooshbang-diagnostic-id": responseDiagnosticId,
+        },
+        status,
+    });
+}
+async function readJson(request, validator, diagnosticId) {
+    const mediaType = request.headers
+        .get("content-type")
+        ?.split(";", 1)[0]
+        ?.trim()
+        .toLowerCase() ?? "";
+    if (mediaType !== "application/json") {
+        return {
+            response: problemResponse(problem("request_invalid", 400, diagnosticId)),
+        };
+    }
+    const declaredLength = request.headers.get("content-length");
+    if (declaredLength !== null &&
+        (!/^(?:0|[1-9]\d*)$/u.test(declaredLength) ||
+            !Number.isSafeInteger(Number(declaredLength)) ||
+            Number(declaredLength) > MAX_REQUEST_BYTES)) {
+        return {
+            response: problemResponse(problem("request_invalid", 400, diagnosticId)),
+        };
+    }
+    const reader = request.body?.getReader();
+    const chunks = [];
+    let length = 0;
+    if (reader !== undefined) {
+        try {
+            for (;;) {
+                const result = await reader.read();
+                if (result.done) {
+                    break;
+                }
+                length += result.value.byteLength;
+                if (length > MAX_REQUEST_BYTES) {
+                    await reader.cancel();
+                    return {
+                        response: problemResponse(problem("request_invalid", 400, diagnosticId)),
+                    };
+                }
+                chunks.push(result.value);
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+    }
+    const bytes = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        return {
+            response: problemResponse(problem("request_invalid", 400, diagnosticId)),
+        };
+    }
+    if (!validator(value)) {
+        const errors = contractValidationErrors(validator);
+        const fieldErrors = errors.slice(0, 20).map((error) => ({
+            code: error.keyword,
+            detail: error.message ?? "The field is invalid.",
+            field: error.instancePath === "" ? "/" : error.instancePath,
+        }));
+        return {
+            response: problemResponse(problem("request_invalid", 400, diagnosticId, {
+                field_errors: fieldErrors,
+            })),
+        };
+    }
+    return { ok: true, value };
+}
+function isAuthFailure(value) {
+    return "response" in value;
+}
+function authenticate(request, state, acceptedKind) {
+    const requestId = state.idGenerator("request");
+    const authorization = request.headers.get("authorization");
+    if (authorization === null) {
+        return {
+            response: problemResponse(problem("authentication_required", 401, state.idGenerator("diagnostic"))),
+        };
+    }
+    const match = /^Bearer ([\u0021-\u007e]{1,4096})$/u.exec(authorization);
+    if (match?.[1] === undefined) {
+        return {
+            response: problemResponse(problem("credential_invalid", 401, state.idGenerator("diagnostic"))),
+        };
+    }
+    const credential = state.credentialsByToken.get(match[1]);
+    const linkedMachineClient = credential?.kind === "machine"
+        ? state.machineClients.get(credential.machineClientId)?.client
+        : undefined;
+    const linkedMachineCredential = credential?.kind === "machine" && credential.credentialId !== undefined
+        ? state.machineCredentials.get(credential.credentialId)?.credential
+        : undefined;
+    const linkedApiCredential = credential?.kind === "project" && credential.credentialId !== undefined
+        ? state.apiCredentials.get(credential.credentialId)
+        : undefined;
+    if (linkedApiCredential !== undefined) {
+        refreshApiCredentialStatus(linkedApiCredential, state);
+    }
+    if (credential === undefined ||
+        (credential.kind === "project" &&
+            credential.credentialId !== undefined &&
+            (linkedApiCredential === undefined ||
+                linkedApiCredential.credential.status === "revoked")) ||
+        (credential.kind === "machine" &&
+            (credential.status === "revoked" ||
+                linkedMachineClient?.status === "revoked" ||
+                linkedMachineCredential?.status === "revoked")) ||
+        (acceptedKind === "either" && credential.kind === "grant") ||
+        (acceptedKind === "account" &&
+            credential.kind !== "human" &&
+            credential.kind !== "grant") ||
+        (acceptedKind !== "either" &&
+            acceptedKind !== "account" &&
+            credential.kind !== acceptedKind)) {
+        return {
+            response: problemResponse(problem("credential_invalid", 401, state.idGenerator("diagnostic"))),
+        };
+    }
+    if (linkedApiCredential !== undefined) {
+        linkedApiCredential.credential = {
+            ...linkedApiCredential.credential,
+            last_used_at: state.now(),
+        };
+    }
+    return { credential, requestId };
+}
+function requireHumanSession(request, state) {
+    const result = authenticate(request, state, "human");
+    if (isAuthFailure(result)) {
+        return result;
+    }
+    if (result.credential.kind !== "human") {
+        return {
+            response: problemResponse(problem("credential_invalid", 401, state.idGenerator("diagnostic"))),
+        };
+    }
+    return {
+        credential: result.credential,
+        requestId: result.requestId,
+    };
+}
+/**
+ * Authenticates an account-scoped request under either authority that can
+ * carry one: a human session, or an OAuth grant holding the account-level
+ * scope the operation needs.
+ *
+ * A project credential is refused structurally rather than by a scope check —
+ * it has no account-level scope to hold, because it lives inside one project.
+ */
+function requireAccountAuthority(request, state, scope) {
+    const result = authenticate(request, state, "account");
+    if (isAuthFailure(result)) {
+        return result;
+    }
+    if (result.credential.kind === "grant") {
+        if (scope !== undefined && !result.credential.scopes.includes(scope)) {
+            return {
+                response: problemResponse(problem("scope_forbidden", 403, state.idGenerator("diagnostic"))),
+            };
+        }
+        return { credential: result.credential, requestId: result.requestId };
+    }
+    if (result.credential.kind !== "human") {
+        return {
+            response: problemResponse(problem("credential_invalid", 401, state.idGenerator("diagnostic"))),
+        };
+    }
+    return { credential: result.credential, requestId: result.requestId };
+}
+/**
+ * The environment-scoped resources the published contract lets a grant reach.
+ *
+ * `customer-endpoints` already carries project and environment in its own
+ * path, so it is served where it is; the rest are the environment-scoped forms
+ * of operations a credential reaches at the flat path.
+ */
+const GRANT_REACHABLE_RESOURCES = new Set([
+    "capabilities",
+    "customer-endpoints",
+    "interactions",
+    "machine-clients",
+    "messages",
+    "subscription-links",
+]);
+function presentedGrant(request, state) {
+    const token = /^Bearer ([\u0021-\u007e]{1,4096})$/u.exec(request.headers.get("authorization") ?? "")?.[1];
+    const credential = token === undefined ? undefined : state.credentialsByToken.get(token);
+    return credential?.kind === "grant" ? credential : undefined;
+}
+/**
+ * Derives the project authority one grant has inside one named environment.
+ *
+ * The derived token is deterministic and cached, so repeating a call reuses
+ * the same authority rather than growing the credential table per request. It
+ * carries only the project-level half of the grant's scopes: an account scope
+ * cannot be exercised through a project-scoped path.
+ *
+ * It is derived from the grant's own token, so anyone who could construct it
+ * already holds that grant and already reaches this project environment; it
+ * grants nothing the caller did not have. A deployment would derive the same
+ * authority from a verified token instead of a fixture one.
+ */
+function admitGrantProjectAuthority(state, grant, projectId, environment) {
+    const token = `grant.${grant.token}.${projectId}.${environment.id}`;
+    if (!state.credentialsByToken.has(token)) {
+        state.credentialsByToken.set(token, Object.freeze({
+            accountId: grant.accountId,
+            environment: environment.kind,
+            environmentId: environment.id,
+            kind: "project",
+            projectId,
+            scopes: Object.freeze(projectScopes.filter((scope) => grant.scopes.includes(scope))),
+            token,
+        }));
+    }
+    return token;
+}
+function requireProjectScope(request, state, scope) {
+    const result = authenticate(request, state, "either");
+    if (isAuthFailure(result)) {
+        return result;
+    }
+    if (result.credential.kind !== "project" ||
+        !result.credential.scopes.includes(scope)) {
+        return {
+            response: problemResponse(problem("scope_forbidden", 403, state.idGenerator("diagnostic"))),
+        };
+    }
+    return {
+        credential: result.credential,
+        requestId: result.requestId,
+    };
+}
+function requireProductCredential(request, state) {
+    const result = authenticate(request, state, "either");
+    if (isAuthFailure(result)) {
+        return result;
+    }
+    if (result.credential.kind === "human" ||
+        result.credential.kind === "grant") {
+        return {
+            response: problemResponse(problem("credential_invalid", 401, state.idGenerator("diagnostic"))),
+        };
+    }
+    return {
+        credential: result.credential,
+        requestId: result.requestId,
+    };
+}
+function requireMachineScope(request, state, scope) {
+    const result = authenticate(request, state, "machine");
+    if (isAuthFailure(result)) {
+        return result;
+    }
+    if (result.credential.kind !== "machine" ||
+        !result.credential.scopes.includes(scope)) {
+        return {
+            response: problemResponse(problem("scope_forbidden", 403, state.idGenerator("diagnostic"))),
+        };
+    }
+    return {
+        credential: result.credential,
+        requestId: result.requestId,
+    };
+}
+function recordDiagnostic(state, identity, operation, details = {}) {
+    const scope = identity.credential.kind === "human" || identity.credential.kind === "grant"
+        ? {}
+        : {
+            environment: identity.credential.environment,
+            projectId: identity.credential.projectId,
+        };
+    state.diagnostics.push({
+        operation,
+        requestId: identity.requestId,
+        scenario: state.scenario,
+        ...scope,
+        ...details,
+    });
+}
+function normalizeLinkRequest(request) {
+    return {
+        ...request,
+        expires_in_seconds: request.expires_in_seconds ?? 900,
+        notifier_id: request.notifier_id ?? "default",
+    };
+}
+function normalizeMessageRequest(request) {
+    return {
+        ...request,
+        notifier_id: request.notifier_id ?? "default",
+    };
+}
+function messageTemporalInputIsValid(request, acceptedAt) {
+    const acceptedAtMilliseconds = Date.parse(acceptedAt);
+    const latestMilliseconds = acceptedAtMilliseconds + 24 * 60 * 60 * 1000;
+    if (request.expires_at !== undefined) {
+        const expiresAtMilliseconds = Date.parse(request.expires_at);
+        if (expiresAtMilliseconds <= acceptedAtMilliseconds ||
+            expiresAtMilliseconds > latestMilliseconds) {
+            return false;
+        }
+    }
+    if (request.interaction !== undefined) {
+        const interactionExpiresAtMilliseconds = Date.parse(request.interaction.expires_at);
+        if (interactionExpiresAtMilliseconds < acceptedAtMilliseconds + 30 * 1000 ||
+            interactionExpiresAtMilliseconds > latestMilliseconds) {
+            return false;
+        }
+    }
+    return true;
+}
+function interactionAnswer(interaction) {
+    if (interaction.type === "confirm") {
+        return true;
+    }
+    if (interaction.type === "select") {
+        return interaction.options[0].value;
+    }
+    return "synthetic pre-existing answer";
+}
+function createInteractionSummary(interaction, id, scenario, now) {
+    const base = {
+        ...(interaction.correlation_id === undefined
+            ? {}
+            : { correlation_id: interaction.correlation_id }),
+        expires_at: interaction.expires_at,
+        id,
+        type: interaction.type,
+    };
+    if (scenario === "interaction-duplicate") {
+        return {
+            ...base,
+            answer: interactionAnswer(interaction),
+            answer_retained: true,
+            answered_at: now,
+            state: "answered",
+        };
+    }
+    if (scenario === "interaction-stale") {
+        return { ...base, state: "cancelled" };
+    }
+    return { ...base, state: "open" };
+}
+function hasOtherEnvironmentBinding(state, credential, subscriberId, notifierId) {
+    return [...state.bindings.values()].some(({ binding }) => binding.project_id === credential.projectId &&
+        binding.environment !== credential.environment &&
+        binding.subscriber_id === subscriberId &&
+        binding.notifier_id === notifierId);
+}
+function transitionMessage(record, state, options, nextState) {
+    const previousState = record.message.state;
+    if (previousState === nextState) {
+        return;
+    }
+    record.message = {
+        ...record.message,
+        state: nextState,
+        updated_at: timestamp(options),
+    };
+    state.diagnostics.push({
+        environment: record.message.environment,
+        operation: "processMessage",
+        projectId: record.message.project_id,
+        requestId: record.requestId,
+        resourceId: record.message.id,
+        scenario: state.scenario,
+        stateTransition: `${previousState}->${nextState}`,
+    });
+}
+function requireIdempotency(request, state) {
+    const key = request.headers.get("idempotency-key");
+    if (key === null ||
+        key.length < 8 ||
+        key.length > 255 ||
+        !/^[\u0021-\u007e]+$/u.test(key)) {
+        return {
+            response: problemResponse(problem("idempotency_key_required", 400, state.idGenerator("diagnostic"))),
+        };
+    }
+    return { key };
+}
+function idempotentReplay(state, identity, operation, key, requestFingerprint) {
+    const mapKey = idempotencyKey(identity, operation, key);
+    const stored = state.idempotency.get(mapKey);
+    if (stored === undefined) {
+        return undefined;
+    }
+    if (stored.fingerprint !== requestFingerprint) {
+        state.logicalOperations.push({
+            idempotencyResult: "conflict",
+            operation,
+        });
+        recordDiagnostic(state, identity, operation, {
+            idempotencyResult: "conflict",
+        });
+        return problemResponse(problem("idempotency_conflict", 409, state.idGenerator("diagnostic")));
+    }
+    state.logicalOperations.push({
+        idempotencyResult: "replayed",
+        operation,
+        ...(typeof stored.body === "object" &&
+            stored.body !== null &&
+            "id" in stored.body &&
+            typeof stored.body.id === "string"
+            ? { resourceId: stored.body.id }
+            : {}),
+    });
+    recordDiagnostic(state, identity, operation, {
+        idempotencyResult: "replayed",
+    });
+    return new Response(JSON.stringify(stored.body), {
+        headers: {
+            "content-type": "application/json",
+            "whooshbang-diagnostic-id": stored.diagnosticId,
+        },
+        status: stored.status,
+    });
+}
+function storeIdempotentResponse(state, identity, operation, key, requestFingerprint, status, body, resourceId, stateTransition) {
+    const diagnosticId = assertDiagnosticId(bodyDiagnosticId(body) ?? state.idGenerator("diagnostic"));
+    state.idempotency.set(idempotencyKey(identity, operation, key), {
+        body: clone(body),
+        diagnosticId,
+        fingerprint: requestFingerprint,
+        status,
+    });
+    state.logicalOperations.push({
+        idempotencyResult: "new",
+        operation,
+        ...(resourceId === undefined ? {} : { resourceId }),
+    });
+    recordDiagnostic(state, identity, operation, {
+        idempotencyResult: "new",
+        ...(resourceId === undefined ? {} : { resourceId }),
+        ...(stateTransition === undefined ? {} : { stateTransition }),
+    });
+    return diagnosticId;
+}
+function ownerMatches(credential, resource) {
+    return (credential.projectId === resource.project_id &&
+        credential.environment === resource.environment);
+}
+function originatingMachineClientId(state, record) {
+    if (record.machineClientId === undefined) {
+        return undefined;
+    }
+    const client = state.machineClients.get(record.machineClientId)?.client;
+    if (client === undefined ||
+        client.status === "revoked" ||
+        client.project_id !== record.message.project_id ||
+        client.environment !== record.message.environment ||
+        client.subscriber_id !== record.message.subscriber_id ||
+        client.notifier_id !== record.message.notifier_id ||
+        client.binding_id !== record.message.binding.id) {
+        return undefined;
+    }
+    return record.machineClientId;
+}
+function createBinding(projectId, environment, subscriberId, notifierId, id) {
+    return {
+        channel: "telegram",
+        environment,
+        id,
+        notifier_id: notifierId,
+        project_id: projectId,
+        status: "active",
+        subscriber_id: subscriberId,
+    };
+}
+function confirmEvent(cursor, suffix) {
+    return {
+        answer_retained: true,
+        channel_context: {
+            binding_id: "binding_synthetic_relay",
+            channel: "telegram",
+            conversation_kind: "private_chat",
+            display_name: "Synthetic operator",
+        },
+        correlation_id: `request_confirm_${suffix}`,
+        cursor,
+        expires_at: "2026-07-25T18:00:00Z",
+        id: `event_interaction_confirm_${suffix}`,
+        interaction_id: `interaction_synthetic_confirm_${suffix}`,
+        message_id: `msg_interactive_confirm_${suffix}`,
+        occurred_at: "2026-07-25T17:47:00Z",
+        response: { type: "confirm", value: true },
+        schema: "whooshbang.interaction-event.v1",
+        type: "interaction.received",
+    };
+}
+function selectEvent(cursor, suffix) {
+    return {
+        answer_retained: true,
+        channel_context: {
+            binding_id: "binding_synthetic_relay",
+            channel: "telegram",
+            conversation_kind: "private_chat",
+            display_name: "Synthetic operator",
+        },
+        correlation_id: `request_select_${suffix}`,
+        cursor,
+        expires_at: "2026-07-25T18:00:00Z",
+        id: `event_interaction_select_${suffix}`,
+        interaction_id: `interaction_synthetic_select_${suffix}`,
+        message_id: `msg_interactive_select_${suffix}`,
+        occurred_at: "2026-07-25T17:48:00Z",
+        response: { type: "select", value: "staging" },
+        schema: "whooshbang.interaction-event.v1",
+        type: "interaction.received",
+    };
+}
+function seedEvents(kind) {
+    if (kind === "none") {
+        return [];
+    }
+    const first = {
+        event: confirmEvent("mcur_synthetic_001", "001"),
+        machineClientId: "machine_client_synthetic_001",
+    };
+    if (kind === "confirm") {
+        return [first];
+    }
+    const second = {
+        event: selectEvent("mcur_synthetic_002", "001"),
+        machineClientId: "machine_client_synthetic_001",
+        ...(kind === "poison" ? { quarantinable: true } : {}),
+    };
+    return kind === "poison" ? [second] : [first, second];
+}
+function injectedMachineEvents(options) {
+    if (options.machineEventDeliveryScript === undefined) {
+        return [];
+    }
+    const runtimeSeeds = options.machineEventDeliveryScript();
+    if (!Array.isArray(runtimeSeeds)) {
+        throw new TypeError("machineEventDeliveryScript must synchronously return a fixture array.");
+    }
+    return runtimeSeeds.map((runtimeSeed) => {
+        if (typeof runtimeSeed !== "object" ||
+            runtimeSeed === null ||
+            Array.isArray(runtimeSeed)) {
+            throw new TypeError("A machine-event seed is invalid.");
+        }
+        const seed = runtimeSeed;
+        if (Object.keys(seed).some((key) => ![
+            "event",
+            "machineClientId",
+            "quarantinable",
+            "signatureValid",
+            "streamIdentityValid",
+        ].includes(key)) ||
+            !validateInteractionEvent(seed.event) ||
+            typeof seed.machineClientId !== "string" ||
+            codePointLength(seed.machineClientId) === 0 ||
+            codePointLength(seed.machineClientId) > 128 ||
+            containsAsciiControl(seed.machineClientId) ||
+            (seed.quarantinable !== undefined &&
+                typeof seed.quarantinable !== "boolean") ||
+            (seed.signatureValid !== undefined &&
+                typeof seed.signatureValid !== "boolean") ||
+            (seed.streamIdentityValid !== undefined &&
+                typeof seed.streamIdentityValid !== "boolean")) {
+            throw new TypeError("A machine-event seed is invalid.");
+        }
+        return {
+            event: clone(seed.event),
+            machineClientId: seed.machineClientId,
+            ...(seed.quarantinable === undefined
+                ? {}
+                : { quarantinable: seed.quarantinable }),
+            ...(seed.signatureValid === undefined
+                ? {}
+                : { signatureValid: seed.signatureValid }),
+            ...(seed.streamIdentityValid === undefined
+                ? {}
+                : { streamIdentityValid: seed.streamIdentityValid }),
+        };
+    });
+}
+function initialState(options, scenarioName) {
+    const scenario = getScenarioDefinition(scenarioName);
+    const idGenerator = options.idGenerator ?? createDefaultIdGenerator();
+    const credentials = options.credentials ?? defaultCredentials();
+    const state = {
+        accounts: new Map(),
+        apiCredentials: new Map(),
+        apiCredentialSequence: 0,
+        acknowledgements: new Map(),
+        bindings: new Map(),
+        credentialsByToken: new Map(credentials.map((credential) => [credential.token, credential])),
+        cursorCommits: [],
+        customerEndpoints: new Map(),
+        customerEndpointSequence: 0,
+        diagnostics: [],
+        idempotency: new Map(),
+        idGenerator,
+        links: new Map(),
+        logicalEvents: [],
+        logicalOperations: [],
+        machineClients: new Map(),
+        machineCredentials: new Map(),
+        machineEvents: seedEvents(scenario.seedMachineEvents),
+        messages: new Map(),
+        now: () => timestamp(options),
+        providerAttempts: [],
+        providerOutcomes: [...scenario.providerOutcomes],
+        projects: new Map(),
+        scenario: scenarioName,
+        webhookAttempts: [],
+        webhookResponses: [...scenario.webhookResponses],
+    };
+    let accountFixtureIndex = 0;
+    for (const credential of credentials) {
+        if (credential.kind !== "human" ||
+            state.accounts.has(credential.accountId)) {
+            continue;
+        }
+        accountFixtureIndex += 1;
+        const account = {
+            created_at: timestamp(options),
+            diagnostic_id: `diagnostic_mock_account_${String(accountFixtureIndex).padStart(3, "0")}`,
+            id: credential.accountId,
+            membership: { role: credential.role },
+            name: `Synthetic account ${String(accountFixtureIndex)}`,
+            status: "active",
+            updated_at: timestamp(options),
+        };
+        if (!validateAccountProjection(account)) {
+            throw new TypeError("A human fixture credential has an invalid account.");
+        }
+        state.accounts.set(account.id, { account });
+    }
+    // Every fixture project credential names a project that has to exist as a
+    // record too, because an account-scoped caller reaches a project through
+    // `GET /v1/projects` and its environments rather than through a credential.
+    for (const credential of credentials) {
+        if (credential.kind !== "project" ||
+            state.projects.has(credential.projectId)) {
+            continue;
+        }
+        const project = fixtureProject(credential.projectId, credential.accountId, options);
+        state.projects.set(project.id, project);
+    }
+    for (const subscriberId of scenario.boundSubscribers) {
+        const binding = createBinding("project_synthetic", "test", subscriberId, "default", subscriberId === "agent_relay_operator"
+            ? "binding_synthetic_relay"
+            : `binding_${subscriberId}`);
+        state.bindings.set(bindingKey(binding.project_id, binding.environment, binding.subscriber_id, binding.notifier_id), { binding });
+    }
+    const machineClient = {
+        binding_id: "binding_synthetic_relay",
+        created_at: timestamp(options),
+        environment: "test",
+        id: "machine_client_synthetic_001",
+        machine_id: "machine_synthetic_a",
+        notifier_id: "default",
+        project_id: "project_synthetic",
+        scope_summary: [...MACHINE_SCOPE_SUMMARY],
+        status: "active",
+        subscriber_id: "agent_relay_operator",
+        updated_at: timestamp(options),
+    };
+    state.machineClients.set(machineClient.id, { client: machineClient });
+    for (const credential of credentials) {
+        if (credential.kind === "machine" &&
+            credential.credentialId !== undefined) {
+            state.machineCredentials.set(credential.credentialId, {
+                credential: {
+                    created_at: timestamp(options),
+                    credential_id: credential.credentialId,
+                    machine_client_id: credential.machineClientId,
+                    scope_summary: [...MACHINE_SCOPE_SUMMARY],
+                    status: credential.status,
+                    ...(credential.status === "revoked"
+                        ? { revoked_at: timestamp(options) }
+                        : {}),
+                },
+                secretDigest: "sha256:0000000000000000000000000000000000000000000000000000000000000000",
+            });
+        }
+    }
+    if (scenario.preload !== "none") {
+        const binding = state.bindings.get(bindingKey("project_synthetic", "test", "customer_123", "default"))?.binding ??
+            createBinding("project_synthetic", "test", "customer_123", "default", "binding_customer_123");
+        const cancellationTooLate = scenario.preload === "cancellation-too-late";
+        const message = {
+            accepted_at: timestamp(options),
+            binding,
+            delivery: {
+                attempt_count: cancellationTooLate ? 1 : 0,
+                highest_proven_provider_state: "none",
+                retry_scheduled: false,
+            },
+            diagnostic_id: state.idGenerator("diagnostic"),
+            environment: "test",
+            expires_at: timestampAfter(options, 24 * 60 * 60),
+            id: cancellationTooLate ? "msg_cancel_too_late" : "msg_cancel_pending",
+            notifier_id: "default",
+            project_id: "project_synthetic",
+            state: cancellationTooLate ? "sending" : "accepted",
+            subscriber_id: "customer_123",
+            updated_at: timestamp(options),
+        };
+        state.messages.set(message.id, {
+            message,
+            ownerAccountId: "account_synthetic",
+            providerInFlight: false,
+            providerProcessed: cancellationTooLate,
+            requestId: state.idGenerator("request"),
+        });
+    }
+    state.machineEvents.push(...injectedMachineEvents(options));
+    return state;
+}
+function scenarioRateLimit(state, options, operation) {
+    const scenario = getScenarioDefinition(state.scenario);
+    if (scenario.rateLimitedOperation !== operation) {
+        return undefined;
+    }
+    return rateLimitedResponse(state, options);
+}
+function rateLimitedResponse(state, options) {
+    return problemResponse(problem("rate_limited", 429, state.idGenerator("diagnostic"), {
+        retry_at: timestampAfter(options, 60),
+    }), { "retry-after": "60" });
+}
+function decodeSigningSecret(value) {
+    if (!value.startsWith("whsec_")) {
+        throw new RangeError("Contract mock signing secret is malformed.");
+    }
+    const decoded = atob(value.slice("whsec_".length));
+    const bytes = Uint8Array.from(decoded, (character) => character.charCodeAt(0));
+    if (bytes.byteLength < 24 || bytes.byteLength > 64) {
+        throw new RangeError("Contract mock signing secret is malformed.");
+    }
+    return bytes;
+}
+async function signWebhook(secret, eventId, timestampSeconds, rawBody) {
+    const prefix = new TextEncoder().encode(`${eventId}.${timestampSeconds}.`);
+    const input = new Uint8Array(prefix.byteLength + rawBody.byteLength);
+    input.set(prefix);
+    input.set(rawBody, prefix.byteLength);
+    const key = await globalThis.crypto.subtle.importKey("raw", new Uint8Array([...decodeSigningSecret(secret)]), { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
+    const digest = new Uint8Array(await globalThis.crypto.subtle.sign("HMAC", key, new Uint8Array([...input])));
+    let binary = "";
+    for (const byte of digest) {
+        binary += String.fromCharCode(byte);
+    }
+    return `v1,${btoa(binary)}`;
+}
+async function deliverWebhook(event, state, options) {
+    if (!validateWhooshBangEvent(event)) {
+        throw new Error("Internal contract-mock event violation.");
+    }
+    const body = JSON.stringify(event);
+    const rawBody = new TextEncoder().encode(body);
+    const firstAttemptAtSeconds = Math.floor(Date.parse(timestamp(options)) / 1000);
+    const secrets = [
+        options.currentSigningSecret ?? CURRENT_SIGNING_SECRET,
+        options.previousSigningSecret ?? PREVIOUS_SIGNING_SECRET,
+    ];
+    for (let attempt = 1; attempt <= MAX_WEBHOOK_DELIVERY_ATTEMPTS; attempt += 1) {
+        const attemptTimestampSeconds = Math.max(firstAttemptAtSeconds + attempt - 1, Math.floor(Date.parse(timestamp(options)) / 1000));
+        const signatures = await Promise.all(secrets.map((secret) => signWebhook(secret, event.id, attemptTimestampSeconds, rawBody)));
+        let status;
+        let outcome;
+        if (options.webhookReceiver !== undefined) {
+            try {
+                const response = await options.webhookReceiver(new Request("https://receiver.example.test/webhooks/notifications", {
+                    body,
+                    headers: {
+                        "content-type": "application/json",
+                        "webhook-attempt": String(attempt),
+                        "webhook-id": event.id,
+                        "webhook-signature": signatures.join(" "),
+                        "webhook-timestamp": String(attemptTimestampSeconds),
+                    },
+                    method: "POST",
+                }));
+                status = response.status;
+                const retryAfter = response.headers.get("retry-after");
+                outcome = {
+                    kind: "http",
+                    status,
+                    ...(retryAfter === null ? {} : { retryAfter }),
+                };
+            }
+            catch {
+                outcome = { kind: "network_failure" };
+            }
+        }
+        else {
+            const scripted = state.webhookResponses.shift() ?? 204;
+            if (scripted === "network_failure") {
+                outcome = { kind: "network_failure" };
+            }
+            else {
+                status = scripted;
+                outcome = { kind: "http", status };
+            }
+        }
+        const classification = classifyWebhookDeliveryOutcome({
+            attempt,
+            firstAttemptAtEpochSeconds: firstAttemptAtSeconds,
+            nowEpochSeconds: attemptTimestampSeconds,
+            outcome,
+        });
+        state.webhookAttempts.push({
+            action: classification.action,
+            attempt,
+            eventId: event.id,
+            reason: classification.reason,
+            ...("retryAfterSeconds" in classification
+                ? { retryAfterSeconds: classification.retryAfterSeconds }
+                : {}),
+            signatureCount: signatures.length,
+            ...(status === undefined ? {} : { status }),
+            timestamp: attemptTimestampSeconds,
+        });
+        if (classification.action !== "retry") {
+            return;
+        }
+    }
+}
+function addLogicalEvent(state, event, resourceId) {
+    state.logicalEvents.push({
+        eventId: event.id,
+        ...(resourceId === undefined ? {} : { resourceId }),
+        type: event.type,
+    });
+}
+async function activateLink(record, state, options, identity) {
+    if (record.link.status !== "pending") {
+        return;
+    }
+    const binding = createBinding(record.link.project_id, record.link.environment, record.link.subscriber_id, record.link.notifier_id, state.idGenerator("binding"));
+    state.bindings.set(bindingKey(binding.project_id, binding.environment, binding.subscriber_id, binding.notifier_id), { binding });
+    record.link = {
+        ...record.link,
+        binding,
+        status: "activated",
+        updated_at: timestamp(options),
+    };
+    delete record.link.authorization_url;
+    const event = {
+        account_id: record.ownerAccountId,
+        created_at: timestamp(options),
+        data: {
+            activated_at: timestamp(options),
+            binding_id: binding.id,
+            channel: "telegram",
+            notifier_id: binding.notifier_id,
+            state: "activated",
+            subscriber_id: binding.subscriber_id,
+            subscription_link_id: record.link.id,
+        },
+        environment: record.link.environment,
+        id: `evt_${state.idGenerator("event")}`,
+        project_id: record.link.project_id,
+        schema: "whooshbang.event.v1",
+        type: "subscription.activated",
+    };
+    addLogicalEvent(state, event, record.link.id);
+    recordDiagnostic(state, identity, "activateSubscriptionLink", {
+        resourceId: record.link.id,
+        stateTransition: "pending->activated",
+    });
+    await deliverWebhook(event, state, options);
+}
+async function nextProviderOutcome(state, options, messageId, attempt) {
+    if (options.providerOutcomeScript !== undefined) {
+        return options.providerOutcomeScript({
+            attempt,
+            messageId,
+            scenario: state.scenario,
+        });
+    }
+    return state.providerOutcomes.shift() ?? { kind: "accepted" };
+}
+async function processMessage(record, state, options) {
+    if (record.providerInFlight ||
+        record.providerProcessed ||
+        record.message.state === "cancelled") {
+        return;
+    }
+    record.providerInFlight = true;
+    try {
+        await processMessageWithProviderOwnership(record, state, options);
+    }
+    finally {
+        record.providerInFlight = false;
+    }
+}
+async function processMessageWithProviderOwnership(record, state, options) {
+    if (record.providerProcessed || record.message.state === "cancelled") {
+        return;
+    }
+    let attempt = record.message.delivery.attempt_count;
+    while (attempt < MAX_PROVIDER_ATTEMPTS) {
+        if (record.message.state === "accepted") {
+            transitionMessage(record, state, options, "dispatch_pending");
+        }
+        if (record.message.state === "dispatch_pending" ||
+            record.message.state === "retry_wait") {
+            transitionMessage(record, state, options, "queued");
+        }
+        if (record.message.state === "queued") {
+            transitionMessage(record, state, options, "sending");
+        }
+        if (record.message.state !== "sending") {
+            return;
+        }
+        attempt += 1;
+        const priorDelivery = record.message.delivery;
+        record.message = {
+            ...record.message,
+            delivery: {
+                attempt_count: attempt,
+                ...(priorDelivery.classified_error === undefined
+                    ? {}
+                    : { classified_error: priorDelivery.classified_error }),
+                highest_proven_provider_state: priorDelivery.highest_proven_provider_state,
+                retry_scheduled: false,
+            },
+        };
+        const outcome = await nextProviderOutcome(state, options, record.message.id, attempt);
+        state.providerAttempts.push({
+            at: timestamp(options),
+            attempt,
+            messageId: record.message.id,
+            outcome: outcome.kind,
+        });
+        if (outcome.kind === "accepted") {
+            record.message = {
+                ...record.message,
+                delivery: {
+                    attempt_count: attempt,
+                    highest_proven_provider_state: "provider_accepted",
+                    retry_scheduled: false,
+                },
+            };
+            transitionMessage(record, state, options, "provider_accepted");
+            record.providerProcessed = true;
+            const event = {
+                account_id: record.ownerAccountId,
+                created_at: timestamp(options),
+                data: {
+                    accepted_at: timestamp(options),
+                    ...(record.message.correlation_id === undefined
+                        ? {}
+                        : { correlation_id: record.message.correlation_id }),
+                    message_id: record.message.id,
+                    state: "provider_accepted",
+                },
+                environment: record.message.environment,
+                id: `evt_${state.idGenerator("event")}`,
+                project_id: record.message.project_id,
+                schema: "whooshbang.event.v1",
+                type: "message.provider_accepted",
+            };
+            addLogicalEvent(state, event, record.message.id);
+            await deliverWebhook(event, state, options);
+            return;
+        }
+        if (outcome.kind === "ambiguous") {
+            record.message = {
+                ...record.message,
+                delivery: {
+                    attempt_count: attempt,
+                    classified_error: {
+                        code: "provider_outcome_unknown",
+                        detail: "The provider may have accepted the request, but no trustworthy result is available.",
+                        diagnostic_id: state.idGenerator("diagnostic"),
+                        retryable: false,
+                    },
+                    highest_proven_provider_state: "none",
+                    retry_scheduled: false,
+                },
+                outcome_guidance: "Delivery may have been accepted by the provider. No automatic retry is scheduled; create a new message explicitly if another attempt is appropriate.",
+            };
+            transitionMessage(record, state, options, "outcome_unknown");
+            record.providerProcessed = true;
+            return;
+        }
+        if (outcome.kind === "terminal") {
+            record.message = {
+                ...record.message,
+                delivery: {
+                    attempt_count: attempt,
+                    classified_error: {
+                        code: "provider_terminal",
+                        detail: "The provider rejected the operation.",
+                        diagnostic_id: state.idGenerator("diagnostic"),
+                        retryable: false,
+                    },
+                    highest_proven_provider_state: "none",
+                    retry_scheduled: false,
+                },
+            };
+            transitionMessage(record, state, options, "terminal_failed");
+            record.providerProcessed = true;
+            const event = {
+                account_id: record.ownerAccountId,
+                created_at: timestamp(options),
+                data: {
+                    failed_at: timestamp(options),
+                    failure_code: "provider_terminal",
+                    message_id: record.message.id,
+                    retryable: false,
+                    state: "terminal_failed",
+                },
+                environment: record.message.environment,
+                id: `evt_${state.idGenerator("event")}`,
+                project_id: record.message.project_id,
+                schema: "whooshbang.event.v1",
+                type: "message.failed",
+            };
+            addLogicalEvent(state, event, record.message.id);
+            await deliverWebhook(event, state, options);
+            return;
+        }
+        const retryAt = timestampAfter(options, outcome.retryAfterSeconds ?? 60);
+        record.message = {
+            ...record.message,
+            delivery: {
+                attempt_count: attempt,
+                classified_error: {
+                    code: "provider_retryable",
+                    detail: "The provider failed before acceptance.",
+                    diagnostic_id: state.idGenerator("diagnostic"),
+                    retryable: true,
+                },
+                highest_proven_provider_state: "none",
+                retry_at: retryAt,
+                retry_scheduled: true,
+            },
+        };
+        transitionMessage(record, state, options, "retry_wait");
+        if (attempt >= MAX_PROVIDER_ATTEMPTS ||
+            (options.providerOutcomeScript === undefined &&
+                state.providerOutcomes.length === 0)) {
+            return;
+        }
+    }
+}
+function inspectState(state) {
+    return clone({
+        accounts: [...state.accounts.values()].map((record) => record.account),
+        apiCredentials: [...state.apiCredentials.values()].map((record) => record.credential),
+        contractVersion: CONTRACT_VERSION,
+        cursorCommits: state.cursorCommits,
+        customerEndpoints: [...state.customerEndpoints.values()].map((record) => record.endpoint),
+        diagnostics: state.diagnostics,
+        links: [...state.links.values()].map((record) => record.link),
+        logicalEvents: state.logicalEvents,
+        logicalOperations: state.logicalOperations,
+        machineClients: [...state.machineClients.values()].map((record) => record.client),
+        machineCredentials: [...state.machineCredentials.values()].map((record) => record.credential),
+        messages: [...state.messages.values()].map((record) => record.message),
+        providerAttempts: state.providerAttempts,
+        projects: [...state.projects.values()],
+        scenario: state.scenario,
+        scenarioVersion: SCENARIO_VERSION,
+        webhookAttempts: state.webhookAttempts,
+    });
+}
+function notFound(state) {
+    return problemResponse(problem("resource_not_found", 404, state.idGenerator("diagnostic")));
+}
+function requestInvalid(state) {
+    return problemResponse(problem("request_invalid", 400, state.idGenerator("diagnostic")));
+}
+function projectPageOffset(cursor) {
+    if (cursor === null) {
+        return 0;
+    }
+    const match = /^project_cursor_([1-9]\d*)$/u.exec(cursor);
+    if (match?.[1] === undefined) {
+        return undefined;
+    }
+    const offset = Number(match[1]);
+    return Number.isSafeInteger(offset) ? offset : undefined;
+}
+/**
+ * The project record behind a fixture project credential.
+ *
+ * Its environment identifiers are the ones `credentialEnvironmentId` derives,
+ * so the record and the credential agree about which environment a path
+ * segment names.
+ */
+function fixtureProject(projectId, accountId, options) {
+    const now = timestamp(options);
+    const environment = (kind) => ({
+        default_notifier: {
+            display_name: "Default",
+            environment_id: `environment_${projectId}_${kind}`,
+            id: "default",
+            is_default: true,
+            status: "active",
+        },
+        id: `environment_${projectId}_${kind}`,
+        kind,
+        project_id: projectId,
+        status: "active",
+    });
+    const project = {
+        account_id: accountId,
+        created_at: now,
+        diagnostic_id: `diagnostic_mock_${projectId}`,
+        environments: [environment("test"), environment("live")],
+        id: projectId,
+        name: `Synthetic ${projectId}`,
+        slug: projectId.replaceAll("_", "-"),
+        status: "active",
+        updated_at: now,
+    };
+    if (!validateProject(project)) {
+        throw new TypeError("A fixture project credential names an invalid project.");
+    }
+    return project;
+}
+function createProjectResource(request, accountId, state, options) {
+    const projectId = state.idGenerator("project");
+    const testEnvironmentId = state.idGenerator("environment");
+    const liveEnvironmentId = state.idGenerator("environment");
+    const now = timestamp(options);
+    const project = {
+        account_id: accountId,
+        created_at: now,
+        diagnostic_id: state.idGenerator("diagnostic"),
+        environments: [
+            {
+                default_notifier: {
+                    display_name: "Default",
+                    environment_id: testEnvironmentId,
+                    id: state.idGenerator("notifier"),
+                    is_default: true,
+                    status: "active",
+                },
+                id: testEnvironmentId,
+                kind: "test",
+                project_id: projectId,
+                status: "active",
+            },
+            {
+                default_notifier: {
+                    display_name: "Default",
+                    environment_id: liveEnvironmentId,
+                    id: state.idGenerator("notifier"),
+                    is_default: true,
+                    status: "active",
+                },
+                id: liveEnvironmentId,
+                kind: "live",
+                project_id: projectId,
+                status: "active",
+            },
+        ],
+        id: projectId,
+        name: request.name,
+        slug: request.slug,
+        status: "active",
+        updated_at: now,
+    };
+    if (!validateProject(project)) {
+        throw new Error("Internal contract-mock project response violation.");
+    }
+    return project;
+}
+const machineBearerPattern = /^Bearer (wb_mc1\.(mcred_[A-Za-z0-9_-]{21}[AQgw])\.[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048])$/u;
+/**
+ * Admits a machine bearer the caller generated locally.
+ *
+ * The service only ever received the secret's digest, so proving the bearer
+ * means hashing it here and comparing. Verified tokens join the in-memory
+ * credential table; revocation still runs through the registered credential
+ * and its machine client, so a revoked credential stops authenticating.
+ */
+async function admitRegisteredMachineBearer(request, state) {
+    const match = machineBearerPattern.exec(request.headers.get("authorization") ?? "");
+    const token = match?.[1];
+    const credentialId = match?.[2];
+    if (token === undefined ||
+        credentialId === undefined ||
+        state.credentialsByToken.has(token)) {
+        return;
+    }
+    const registered = state.machineCredentials.get(credentialId);
+    const client = registered === undefined
+        ? undefined
+        : state.machineClients.get(registered.credential.machine_client_id)
+            ?.client;
+    if (registered === undefined || client === undefined) {
+        return;
+    }
+    const owner = [...state.credentialsByToken.values()].find((candidate) => (candidate.kind === "project" || candidate.kind === "machine") &&
+        candidate.projectId === client.project_id &&
+        candidate.environment === client.environment);
+    if (owner === undefined) {
+        return;
+    }
+    const digest = /^sha256:[a-f0-9]{64}$/u.exec(registered.secretDigest)?.[0];
+    if (digest === undefined) {
+        return;
+    }
+    const verified = await verifyMachineCredentialToken(token, {
+        credentialId,
+        secretSha256: digest,
+    });
+    if (!verified) {
+        return;
+    }
+    state.credentialsByToken.set(token, {
+        accountId: owner.accountId,
+        bindingId: client.binding_id,
+        credentialId,
+        environment: client.environment,
+        kind: "machine",
+        machineClientId: client.id,
+        machineId: client.machine_id,
+        notifierId: client.notifier_id,
+        projectId: client.project_id,
+        scopes: [...MACHINE_SCOPE_SUMMARY],
+        status: "active",
+        subscriberId: client.subscriber_id,
+        token,
+    });
+}
+function addPublicRoutes(app, getState, options) {
+    app.use("/v1/*", async (context, next) => {
+        await admitRegisteredMachineBearer(context.req.raw, getState());
+        await next();
+    });
+    /**
+     * Serves the environment-scoped operations to an account-scoped grant.
+     *
+     * The path names the project and environment that a credential would carry
+     * in its own record, so this resolves that pair against the grant's account,
+     * derives the same authority a credential would have produced, and lets the
+     * ordinary handler run. A project outside the account is refused as absent,
+     * exactly as one that does not exist, so a caller learns nothing about who
+     * else has projects.
+     *
+     * Test versus live is read off the environment record and never off the
+     * request: a path may name an environment, but only the project decides
+     * which kind it is.
+     */
+    app.use("/v1/projects/:projectId/environments/:environmentId/*", async (context, next) => {
+        const state = getState();
+        const presented = presentedGrant(context.req.raw, state);
+        if (presented === undefined) {
+            await next();
+            return;
+        }
+        const url = new URL(context.req.raw.url);
+        const segments = url.pathname.split("/").slice(1);
+        const resource = segments[5];
+        if (resource === undefined || !GRANT_REACHABLE_RESOURCES.has(resource)) {
+            // Credential administration is a human's job; a grant is refused there
+            // by the route's own authority check rather than admitted here.
+            await next();
+            return;
+        }
+        const projectId = context.req.param("projectId");
+        const environmentId = context.req.param("environmentId");
+        const project = state.projects.get(projectId);
+        const environment = project?.environments.find((candidate) => candidate.id === environmentId);
+        if (project === undefined ||
+            project.account_id !== presented.accountId ||
+            environment === undefined ||
+            environment.status !== "active") {
+            return notFound(state);
+        }
+        const token = admitGrantProjectAuthority(state, presented, project.id, environment);
+        url.pathname =
+            resource === "customer-endpoints"
+                ? url.pathname
+                : `/v1/${segments.slice(5).join("/")}`;
+        const headers = new Headers(context.req.raw.headers);
+        headers.set("authorization", `Bearer ${token}`);
+        return app.fetch(new Request(url, {
+            ...(context.req.raw.method === "GET" ||
+                context.req.raw.method === "HEAD"
+                ? {}
+                : { body: await context.req.raw.arrayBuffer() }),
+            headers,
+            method: context.req.raw.method,
+        }));
+    });
+    let heldInteractionPolls = 0;
+    const parsePollWait = (request) => {
+        const values = new URL(request.url).searchParams.getAll("wait");
+        if (values.length === 0)
+            return INTERACTION_POLL_DEFAULT_WAIT_SECONDS;
+        if (values.length !== 1 || !/^(?:0|[1-9]\d*)$/u.test(values[0] ?? "")) {
+            return null;
+        }
+        const wait = Number(values[0]);
+        return Number.isSafeInteger(wait) &&
+            wait >= 0 &&
+            wait <= INTERACTION_POLL_MAX_WAIT_SECONDS
+            ? wait
+            : null;
+    };
+    const defaultPollWait = (delayMilliseconds, signal) => new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(new DOMException("The request was aborted.", "AbortError"));
+            return;
+        }
+        const onAbort = () => {
+            clearTimeout(timeout);
+            reject(new DOMException("The request was aborted.", "AbortError"));
+        };
+        const timeout = setTimeout(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }, delayMilliseconds);
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+    const waitForInteraction = async (read, waitSeconds, signal) => {
+        let record = read();
+        if (record === undefined ||
+            record.message.interaction === undefined ||
+            record.message.interaction.state !== "open" ||
+            waitSeconds === 0) {
+            return record;
+        }
+        if (heldInteractionPolls >= INTERACTION_POLL_MAX_CONCURRENCY) {
+            return "capacity";
+        }
+        heldInteractionPolls += 1;
+        let remainingMilliseconds = waitSeconds * 1000;
+        try {
+            while (remainingMilliseconds > 0) {
+                const delay = Math.min(INTERACTION_POLL_RECHECK_MILLISECONDS, remainingMilliseconds);
+                await (options.interactionPollWait ?? defaultPollWait)(delay, signal);
+                remainingMilliseconds -= delay;
+                record = read();
+                if (record === undefined ||
+                    record.message.interaction === undefined ||
+                    record.message.interaction.state !== "open") {
+                    return record;
+                }
+            }
+            return read();
+        }
+        finally {
+            heldInteractionPolls -= 1;
+        }
+    };
+    app.get("/v1/account", (context) => {
+        const state = getState();
+        // The contract requires no scope here: the account projection is who the
+        // authorizing person already is.
+        const identity = requireAccountAuthority(context.req.raw, state);
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const record = state.accounts.get(identity.credential.accountId);
+        if (record === undefined) {
+            return problemResponse(problem("scope_forbidden", 403, state.idGenerator("diagnostic")));
+        }
+        const account = {
+            ...record.account,
+            // A grant carries no role of its own: it reports the membership the
+            // account already records for the person who authorized it.
+            membership: identity.credential.kind === "human"
+                ? { role: identity.credential.role }
+                : record.account.membership,
+            diagnostic_id: state.idGenerator("diagnostic"),
+        };
+        recordDiagnostic(state, identity, "getAccount");
+        return validatedResponse(account, validateAccountProjection, 200, state, account.diagnostic_id);
+    });
+    app.get("/v1/projects", (context) => {
+        const state = getState();
+        const identity = requireAccountAuthority(context.req.raw, state, "projects:read");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const url = new URL(context.req.url);
+        if (url.searchParams.getAll("after").length > 1 ||
+            url.searchParams.getAll("limit").length > 1) {
+            return requestInvalid(state);
+        }
+        const offset = projectPageOffset(url.searchParams.get("after"));
+        const rawLimit = url.searchParams.get("limit");
+        if (offset === undefined ||
+            (rawLimit !== null &&
+                (!/^(?:[1-9]|[1-9]\d|100)$/u.test(rawLimit) ||
+                    !Number.isSafeInteger(Number(rawLimit))))) {
+            return requestInvalid(state);
+        }
+        const limit = rawLimit === null ? 50 : Number(rawLimit);
+        const projects = [...state.projects.values()]
+            .filter((project) => project.account_id === identity.credential.accountId)
+            .sort((left, right) => left.created_at.localeCompare(right.created_at) ||
+            left.id.localeCompare(right.id));
+        if (offset > projects.length) {
+            return requestInvalid(state);
+        }
+        const items = projects.slice(offset, offset + limit);
+        const nextOffset = offset + items.length;
+        const collection = {
+            items,
+            ...(nextOffset < projects.length
+                ? { next_cursor: `project_cursor_${String(nextOffset)}` }
+                : {}),
+        };
+        recordDiagnostic(state, identity, "listProjects");
+        return validatedResponse(collection, validateProjectCollection, 200, state);
+    });
+    app.post("/v1/projects", async (context) => {
+        const state = getState();
+        const identity = requireAccountAuthority(context.req.raw, state, "projects:write");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const idempotency = requireIdempotency(context.req.raw, state);
+        if ("response" in idempotency) {
+            return idempotency.response;
+        }
+        const parsed = await readJson(context.req.raw, validateCreateProjectRequest, state.idGenerator("diagnostic"));
+        if ("response" in parsed) {
+            return parsed.response;
+        }
+        const requestFingerprint = fingerprint(parsed.value);
+        const replay = idempotentReplay(state, identity, "createProject", idempotency.key, requestFingerprint);
+        if (replay !== undefined) {
+            return replay;
+        }
+        const slugExists = [...state.projects.values()].some((project) => project.account_id === identity.credential.accountId &&
+            project.slug === parsed.value.slug);
+        if (slugExists) {
+            return problemResponse(problem("project_slug_conflict", 409, state.idGenerator("diagnostic")));
+        }
+        const project = createProjectResource(parsed.value, identity.credential.accountId, state, options);
+        state.projects.set(project.id, project);
+        const diagnosticId = storeIdempotentResponse(state, identity, "createProject", idempotency.key, requestFingerprint, 201, project, project.id, "absent->active");
+        return validatedResponse(project, validateProject, 201, state, diagnosticId);
+    });
+    app.get("/v1/projects/:projectId", (context) => {
+        const state = getState();
+        const identity = requireAccountAuthority(context.req.raw, state, "projects:read");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const projectId = context.req.param("projectId");
+        if (projectId.length === 0 ||
+            projectId.length > 128 ||
+            containsAsciiControl(projectId)) {
+            return requestInvalid(state);
+        }
+        const project = state.projects.get(projectId);
+        if (project === undefined ||
+            project.account_id !== identity.credential.accountId) {
+            return notFound(state);
+        }
+        recordDiagnostic(state, identity, "getProject", {
+            resourceId: project.id,
+        });
+        return validatedResponse(project, validateProject, 200, state);
+    });
+    app.get("/v1/projects/:projectId/environments/:environmentId/credentials", (context) => {
+        const state = getState();
+        const identity = requireHumanSession(context.req.raw, state);
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const projectId = context.req.param("projectId");
+        const environmentId = context.req.param("environmentId");
+        const environment = projectEnvironmentForHuman(state, identity, projectId, environmentId);
+        if (environment === undefined) {
+            return notFound(state);
+        }
+        const url = new URL(context.req.url);
+        if (url.searchParams.getAll("after").length > 1 ||
+            url.searchParams.getAll("limit").length > 1) {
+            return requestInvalid(state);
+        }
+        const offset = credentialPageOffset(url.searchParams.get("after"));
+        const rawLimit = url.searchParams.get("limit");
+        if (offset === undefined ||
+            (rawLimit !== null &&
+                (!/^(?:[1-9]|[1-9]\d|100)$/u.test(rawLimit) ||
+                    !Number.isSafeInteger(Number(rawLimit))))) {
+            return requestInvalid(state);
+        }
+        const limit = rawLimit === null ? 50 : Number(rawLimit);
+        const credentials = [...state.apiCredentials.values()]
+            .filter((record) => {
+            refreshApiCredentialStatus(record, state);
+            return (record.credential.project_id === projectId &&
+                record.credential.environment_id === environmentId);
+        })
+            .map(({ credential }) => credential)
+            .sort((left, right) => left.created_at.localeCompare(right.created_at) ||
+            left.id.localeCompare(right.id));
+        if (offset > credentials.length) {
+            return requestInvalid(state);
+        }
+        const items = credentials.slice(offset, offset + limit);
+        const nextOffset = offset + items.length;
+        const collection = {
+            items,
+            ...(nextOffset < credentials.length
+                ? { next_cursor: `api_credential_cursor_${String(nextOffset)}` }
+                : {}),
+        };
+        recordDiagnostic(state, identity, "listApiCredentials");
+        return validatedResponse(collection, validateApiCredentialCollection, 200, state);
+    });
+    app.post("/v1/projects/:projectId/environments/:environmentId/credentials", async (context) => {
+        const state = getState();
+        const identity = requireHumanSession(context.req.raw, state);
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const projectId = context.req.param("projectId");
+        const environmentId = context.req.param("environmentId");
+        const environment = projectEnvironmentForHuman(state, identity, projectId, environmentId);
+        if (environment === undefined) {
+            return notFound(state);
+        }
+        const parsed = await readJson(context.req.raw, validateCreateApiCredentialRequest, state.idGenerator("diagnostic"));
+        if ("response" in parsed) {
+            return parsed.response;
+        }
+        const reveal = createApiCredentialMaterial(parsed.value, projectId, environment, identity, state);
+        recordDiagnostic(state, identity, "createApiCredential", {
+            resourceId: reveal.credential.id,
+            stateTransition: "absent->active",
+        });
+        return validatedResponse(reveal, validateApiCredentialSecretReveal, 201, state);
+    });
+    app.post("/v1/projects/:projectId/environments/:environmentId/credentials/:credentialId/rotate", async (context) => {
+        const state = getState();
+        const identity = requireHumanSession(context.req.raw, state);
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const projectId = context.req.param("projectId");
+        const environmentId = context.req.param("environmentId");
+        const environment = projectEnvironmentForHuman(state, identity, projectId, environmentId);
+        if (environment === undefined) {
+            return notFound(state);
+        }
+        const parsed = await readJson(context.req.raw, validateRotateApiCredentialRequest, state.idGenerator("diagnostic"));
+        if ("response" in parsed) {
+            return parsed.response;
+        }
+        const credentialId = context.req.param("credentialId");
+        const record = state.apiCredentials.get(credentialId);
+        if (record !== undefined) {
+            refreshApiCredentialStatus(record, state);
+        }
+        if (record === undefined ||
+            record.credential.project_id !== projectId ||
+            record.credential.environment_id !== environmentId ||
+            record.credential.status !== "active") {
+            return notFound(state);
+        }
+        const reveal = createApiCredentialMaterial({
+            label: record.credential.label,
+            scopes: record.credential.scopes,
+        }, projectId, environment, identity, state);
+        const now = state.now();
+        const activeMetadata = { ...record.credential };
+        delete activeMetadata.revoked_at;
+        delete activeMetadata.scheduled_revocation_at;
+        record.credential =
+            parsed.value.overlap_seconds === 0
+                ? {
+                    ...activeMetadata,
+                    revoked_at: now,
+                    status: "revoked",
+                }
+                : {
+                    ...activeMetadata,
+                    scheduled_revocation_at: timestampAfterValue(now, parsed.value.overlap_seconds),
+                    status: "active",
+                };
+        const rotation = {
+            credential: reveal,
+            replaced_credential: record.credential,
+        };
+        recordDiagnostic(state, identity, "rotateApiCredential", {
+            resourceId: reveal.credential.id,
+            stateTransition: parsed.value.overlap_seconds === 0
+                ? "active->revoked"
+                : "active->revocation_scheduled",
+        });
+        return validatedResponse(rotation, validateApiCredentialRotation, 201, state);
+    });
+    app.post("/v1/projects/:projectId/environments/:environmentId/credentials/:credentialId/revoke", (context) => {
+        const state = getState();
+        const identity = requireHumanSession(context.req.raw, state);
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const projectId = context.req.param("projectId");
+        const environmentId = context.req.param("environmentId");
+        if (projectEnvironmentForHuman(state, identity, projectId, environmentId) === undefined) {
+            return notFound(state);
+        }
+        const credentialId = context.req.param("credentialId");
+        const record = state.apiCredentials.get(credentialId);
+        if (record !== undefined) {
+            refreshApiCredentialStatus(record, state);
+        }
+        if (record === undefined ||
+            record.credential.project_id !== projectId ||
+            record.credential.environment_id !== environmentId) {
+            return notFound(state);
+        }
+        const previousStatus = record.credential.status;
+        if (previousStatus !== "revoked") {
+            const metadata = { ...record.credential };
+            delete metadata.scheduled_revocation_at;
+            record.credential = {
+                ...metadata,
+                revoked_at: state.now(),
+                status: "revoked",
+            };
+        }
+        recordDiagnostic(state, identity, "revokeApiCredential", {
+            resourceId: record.credential.id,
+            stateTransition: `${previousStatus}->revoked`,
+        });
+        return validatedResponse(record.credential, validateApiCredential, 200, state);
+    });
+    app.post("/v1/subscription-links", async (context) => {
+        const state = getState();
+        const identity = requireProjectScope(context.req.raw, state, "subscriptions:write");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const rateLimit = scenarioRateLimit(state, options, "createSubscriptionLink");
+        if (rateLimit !== undefined) {
+            return rateLimit;
+        }
+        const idempotency = requireIdempotency(context.req.raw, state);
+        if ("response" in idempotency) {
+            return idempotency.response;
+        }
+        const parsed = await readJson(context.req.raw, validateCreateSubscriptionLinkRequest, state.idGenerator("diagnostic"));
+        if ("response" in parsed) {
+            return parsed.response;
+        }
+        const normalized = normalizeLinkRequest(parsed.value);
+        const requestFingerprint = fingerprint(normalized);
+        const replay = idempotentReplay(state, identity, "createSubscriptionLink", idempotency.key, requestFingerprint);
+        if (replay !== undefined) {
+            return replay;
+        }
+        const now = timestamp(options);
+        const link = {
+            authorization_url: `https://subscribe.whooshbang.test/s/${state.idGenerator("subscription_link")}`,
+            channels: normalized.channels,
+            created_at: now,
+            diagnostic_id: state.idGenerator("diagnostic"),
+            environment: identity.credential.environment,
+            expires_at: timestampAfterValue(now, normalized.expires_in_seconds ?? 900),
+            id: state.idGenerator("subscription_link"),
+            notifier_id: normalized.notifier_id ?? "default",
+            project_id: identity.credential.projectId,
+            status: "pending",
+            subscriber_id: normalized.subscriber_id,
+            updated_at: now,
+        };
+        const record = {
+            link,
+            ownerAccountId: identity.credential.accountId,
+        };
+        state.links.set(link.id, record);
+        const responseDiagnosticId = storeIdempotentResponse(state, identity, "createSubscriptionLink", idempotency.key, requestFingerprint, 201, link, link.id, "none->pending");
+        const response = validatedResponse(link, validateSubscriptionLink, 201, state, responseDiagnosticId);
+        if (getScenarioDefinition(state.scenario).activateLinks) {
+            await activateLink(record, state, options, identity);
+        }
+        return response;
+    });
+    app.get("/v1/subscription-links/:subscriptionLinkId", (context) => {
+        const state = getState();
+        const identity = requireProjectScope(context.req.raw, state, "subscriptions:read");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const record = state.links.get(context.req.param("subscriptionLinkId"));
+        if (record === undefined ||
+            !ownerMatches(identity.credential, record.link)) {
+            return notFound(state);
+        }
+        recordDiagnostic(state, identity, "getSubscriptionLink", {
+            resourceId: record.link.id,
+        });
+        return validatedResponse(record.link, validateSubscriptionLink, 200, state);
+    });
+    app.post("/v1/subscription-links/:subscriptionLinkId/cancel", (context) => {
+        const state = getState();
+        const identity = requireProjectScope(context.req.raw, state, "subscriptions:write");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const idempotency = requireIdempotency(context.req.raw, state);
+        if ("response" in idempotency) {
+            return idempotency.response;
+        }
+        const linkId = context.req.param("subscriptionLinkId");
+        const requestFingerprint = fingerprint({ linkId });
+        const replay = idempotentReplay(state, identity, "cancelSubscriptionLink", idempotency.key, requestFingerprint);
+        if (replay !== undefined) {
+            return replay;
+        }
+        const record = state.links.get(linkId);
+        if (record === undefined ||
+            !ownerMatches(identity.credential, record.link)) {
+            return notFound(state);
+        }
+        if (record.link.status !== "pending") {
+            return problemResponse(problem("cancellation_too_late", 409, state.idGenerator("diagnostic")));
+        }
+        record.link = {
+            ...record.link,
+            cancellation_effective: true,
+            status: "cancelled",
+            updated_at: timestamp(options),
+        };
+        delete record.link.authorization_url;
+        storeIdempotentResponse(state, identity, "cancelSubscriptionLink", idempotency.key, requestFingerprint, 200, record.link, record.link.id, "pending->cancelled");
+        return validatedResponse(record.link, validateSubscriptionLink, 200, state);
+    });
+    app.post("/v1/messages", async (context) => {
+        const state = getState();
+        const identity = requireProductCredential(context.req.raw, state);
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const credential = identity.credential;
+        const correctScope = credential.kind === "project"
+            ? credential.scopes.includes("messages:write")
+            : credential.scopes.includes("machine-messages:write");
+        if (!correctScope) {
+            return problemResponse(problem("scope_forbidden", 403, state.idGenerator("diagnostic")));
+        }
+        const rateLimit = scenarioRateLimit(state, options, "createMessage");
+        if (rateLimit !== undefined) {
+            return rateLimit;
+        }
+        const idempotency = requireIdempotency(context.req.raw, state);
+        if ("response" in idempotency) {
+            return idempotency.response;
+        }
+        const parsed = await readJson(context.req.raw, validateCreateMessageRequest, state.idGenerator("diagnostic"));
+        if ("response" in parsed) {
+            return parsed.response;
+        }
+        const normalized = normalizeMessageRequest(parsed.value);
+        if (credential.kind === "machine" &&
+            (normalized.to.subscriber_id !== credential.subscriberId ||
+                normalized.notifier_id !== credential.notifierId)) {
+            return notFound(state);
+        }
+        const requestFingerprint = fingerprint(normalized);
+        const replay = idempotentReplay(state, identity, "createMessage", idempotency.key, requestFingerprint);
+        if (replay !== undefined) {
+            return replay;
+        }
+        const now = timestamp(options);
+        if (!messageTemporalInputIsValid(normalized, now)) {
+            return requestInvalid(state);
+        }
+        const matchingBinding = state.bindings.get(bindingKey(credential.projectId, credential.environment, normalized.to.subscriber_id, normalized.notifier_id ?? "default"))?.binding;
+        if (matchingBinding === undefined) {
+            if (hasOtherEnvironmentBinding(state, credential, normalized.to.subscriber_id, normalized.notifier_id ?? "default")) {
+                return problemResponse(problem("environment_mismatch", 403, state.idGenerator("diagnostic")));
+            }
+            return problemResponse(problem("subscriber_unbound", 422, state.idGenerator("diagnostic")));
+        }
+        const interaction = normalized.interaction === undefined
+            ? undefined
+            : createInteractionSummary(normalized.interaction, state.idGenerator("interaction"), state.scenario, now);
+        const message = {
+            accepted_at: now,
+            binding: matchingBinding,
+            ...(normalized.correlation_id === undefined
+                ? {}
+                : { correlation_id: normalized.correlation_id }),
+            delivery: {
+                attempt_count: 0,
+                highest_proven_provider_state: "none",
+                retry_scheduled: false,
+            },
+            diagnostic_id: state.idGenerator("diagnostic"),
+            environment: credential.environment,
+            expires_at: normalized.expires_at ?? timestampAfterValue(now, 86_400),
+            id: state.idGenerator("message"),
+            ...(interaction === undefined ? {} : { interaction }),
+            ...(normalized.metadata === undefined
+                ? {}
+                : { metadata: normalized.metadata }),
+            notifier_id: normalized.notifier_id ?? "default",
+            project_id: credential.projectId,
+            state: "accepted",
+            subscriber_id: normalized.to.subscriber_id,
+            updated_at: now,
+        };
+        if (!validateMessage(message)) {
+            throw new Error("Internal contract-mock message violation.");
+        }
+        const record = {
+            ...(normalized.interaction === undefined
+                ? {}
+                : { interactionRequest: normalized.interaction }),
+            ...(credential.kind === "machine"
+                ? { machineClientId: credential.machineClientId }
+                : {}),
+            message,
+            ownerAccountId: credential.accountId,
+            providerInFlight: false,
+            providerProcessed: false,
+            requestId: identity.requestId,
+        };
+        state.messages.set(message.id, record);
+        const responseDiagnosticId = storeIdempotentResponse(state, identity, "createMessage", idempotency.key, requestFingerprint, 202, message, message.id, interaction === undefined || interaction.state === "open"
+            ? "none->accepted"
+            : `none->accepted;interaction:none->${interaction.state}`);
+        const response = validatedResponse(message, validateMessage, 202, state, responseDiagnosticId);
+        await processMessage(record, state, options);
+        return response;
+    });
+    app.get("/v1/messages/:messageId", async (context) => {
+        const state = getState();
+        const identity = requireProductCredential(context.req.raw, state);
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const credential = identity.credential;
+        const correctScope = credential.kind === "project"
+            ? credential.scopes.includes("messages:read")
+            : credential.scopes.includes("machine-messages:read");
+        if (!correctScope) {
+            return problemResponse(problem("scope_forbidden", 403, state.idGenerator("diagnostic")));
+        }
+        const wait = parsePollWait(context.req.raw);
+        if (wait === null) {
+            return problemResponse(problem("request_invalid", 400, state.idGenerator("diagnostic")));
+        }
+        const read = () => {
+            const current = getState().messages.get(context.req.param("messageId"));
+            return current !== undefined &&
+                ownerMatches(credential, current.message) &&
+                (credential.kind !== "machine" ||
+                    current.machineClientId === credential.machineClientId)
+                ? current
+                : undefined;
+        };
+        const initial = read();
+        if (initial === undefined) {
+            return notFound(state);
+        }
+        const record = await waitForInteraction(read, wait, context.req.raw.signal);
+        if (record === "capacity")
+            return rateLimitedResponse(state, options);
+        if (record === undefined)
+            return notFound(getState());
+        recordDiagnostic(state, identity, "getMessage", {
+            resourceId: record.message.id,
+        });
+        return validatedResponse(record.message, validateMessage, 200, state);
+    });
+    app.get("/v1/interactions/:interactionId", async (context) => {
+        const state = getState();
+        const identity = requireProductCredential(context.req.raw, state);
+        if (isAuthFailure(identity))
+            return identity.response;
+        const credential = identity.credential;
+        const correctScope = credential.kind === "project"
+            ? credential.scopes.includes("messages:read")
+            : credential.scopes.includes("machine-messages:read");
+        if (!correctScope) {
+            return problemResponse(problem("scope_forbidden", 403, state.idGenerator("diagnostic")));
+        }
+        const wait = parsePollWait(context.req.raw);
+        if (wait === null) {
+            return problemResponse(problem("request_invalid", 400, state.idGenerator("diagnostic")));
+        }
+        const read = () => {
+            for (const candidate of getState().messages.values()) {
+                if (candidate.message.interaction?.id ===
+                    context.req.param("interactionId") &&
+                    ownerMatches(credential, candidate.message) &&
+                    (credential.kind !== "machine" ||
+                        candidate.machineClientId === credential.machineClientId)) {
+                    return candidate;
+                }
+            }
+            return undefined;
+        };
+        if (read() === undefined)
+            return notFound(state);
+        const record = await waitForInteraction(read, wait, context.req.raw.signal);
+        if (record === "capacity")
+            return rateLimitedResponse(state, options);
+        const interaction = record?.message.interaction;
+        if (interaction === undefined)
+            return notFound(getState());
+        recordDiagnostic(getState(), identity, "getInteraction", {
+            resourceId: interaction.id,
+        });
+        return validatedResponse(interaction, validateInteractionSummary, 200, getState());
+    });
+    app.post("/v1/messages/:messageId/cancel", (context) => {
+        const state = getState();
+        const identity = requireProjectScope(context.req.raw, state, "messages:write");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const idempotency = requireIdempotency(context.req.raw, state);
+        if ("response" in idempotency) {
+            return idempotency.response;
+        }
+        const messageId = context.req.param("messageId");
+        const requestFingerprint = fingerprint({ messageId });
+        const replay = idempotentReplay(state, identity, "cancelMessage", idempotency.key, requestFingerprint);
+        if (replay !== undefined) {
+            return replay;
+        }
+        const record = state.messages.get(messageId);
+        if (record === undefined ||
+            !ownerMatches(identity.credential, record.message)) {
+            return notFound(state);
+        }
+        const previousState = record.message.state;
+        const effective = [
+            "accepted",
+            "dispatch_pending",
+            "queued",
+            "retry_wait",
+        ].includes(record.message.state);
+        record.message = {
+            ...record.message,
+            cancellation_effective: effective,
+            ...(effective
+                ? { state: "cancelled", updated_at: timestamp(options) }
+                : {}),
+        };
+        if (effective && record.message.interaction?.state === "open") {
+            record.message.interaction = {
+                ...record.message.interaction,
+                state: "cancelled",
+            };
+        }
+        storeIdempotentResponse(state, identity, "cancelMessage", idempotency.key, requestFingerprint, 200, record.message, record.message.id, `${previousState}->${record.message.state}`);
+        return validatedResponse(record.message, validateMessage, 200, state);
+    });
+    app.post("/v1/machine-clients", async (context) => {
+        const state = getState();
+        const identity = requireProjectScope(context.req.raw, state, "machine-clients:write");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const idempotency = requireIdempotency(context.req.raw, state);
+        if ("response" in idempotency) {
+            return idempotency.response;
+        }
+        const parsed = await readJson(context.req.raw, validateCreateMachineClientRequest, state.idGenerator("diagnostic"));
+        if ("response" in parsed) {
+            return parsed.response;
+        }
+        const request = parsed.value;
+        const requestFingerprint = fingerprint(request);
+        const replay = idempotentReplay(state, identity, "createMachineClient", idempotency.key, requestFingerprint);
+        if (replay !== undefined) {
+            return replay;
+        }
+        const binding = state.bindings.get(bindingKey(identity.credential.projectId, identity.credential.environment, request.subscriber_id, request.notifier_id))?.binding;
+        if (binding === undefined) {
+            if (hasOtherEnvironmentBinding(state, identity.credential, request.subscriber_id, request.notifier_id)) {
+                return problemResponse(problem("environment_mismatch", 403, state.idGenerator("diagnostic")));
+            }
+            return problemResponse(problem("subscriber_unbound", 422, state.idGenerator("diagnostic")));
+        }
+        const now = timestamp(options);
+        const client = {
+            binding_id: binding.id,
+            created_at: now,
+            ...(request.display_name === undefined
+                ? {}
+                : { display_name: request.display_name }),
+            environment: identity.credential.environment,
+            id: state.idGenerator("machine_client"),
+            machine_id: request.machine_id,
+            notifier_id: request.notifier_id,
+            project_id: identity.credential.projectId,
+            scope_summary: [...MACHINE_SCOPE_SUMMARY],
+            status: "provisioning",
+            subscriber_id: request.subscriber_id,
+            updated_at: now,
+        };
+        state.machineClients.set(client.id, { client });
+        const responseDiagnosticId = storeIdempotentResponse(state, identity, "createMachineClient", idempotency.key, requestFingerprint, 201, client, client.id, "none->provisioning");
+        return validatedResponse(client, validateMachineClient, 201, state, responseDiagnosticId);
+    });
+    app.get("/v1/machine-clients/:machineClientId", (context) => {
+        const state = getState();
+        const identity = requireProjectScope(context.req.raw, state, "machine-clients:read");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const record = state.machineClients.get(context.req.param("machineClientId"));
+        if (record === undefined ||
+            !ownerMatches(identity.credential, record.client)) {
+            return notFound(state);
+        }
+        recordDiagnostic(state, identity, "getMachineClient", {
+            resourceId: record.client.id,
+        });
+        return validatedResponse(record.client, validateMachineClient, 200, state);
+    });
+    app.post("/v1/machine-clients/:machineClientId/credentials", async (context) => {
+        const state = getState();
+        const identity = requireProjectScope(context.req.raw, state, "machine-clients:write");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const idempotency = requireIdempotency(context.req.raw, state);
+        if ("response" in idempotency) {
+            return idempotency.response;
+        }
+        const parsed = await readJson(context.req.raw, validateRegisterMachineCredentialRequest, state.idGenerator("diagnostic"));
+        if ("response" in parsed) {
+            return parsed.response;
+        }
+        const request = parsed.value;
+        const machineClientId = context.req.param("machineClientId");
+        const requestFingerprint = fingerprint({ machineClientId, request });
+        const replay = idempotentReplay(state, identity, "registerMachineCredential", idempotency.key, requestFingerprint);
+        if (replay !== undefined) {
+            return replay;
+        }
+        const clientRecord = state.machineClients.get(machineClientId);
+        if (clientRecord === undefined ||
+            !ownerMatches(identity.credential, clientRecord.client)) {
+            return notFound(state);
+        }
+        const existing = state.machineCredentials.get(request.credential_id);
+        if (existing !== undefined) {
+            if (existing.secretDigest !== request.secret_sha256 ||
+                existing.credential.machine_client_id !== machineClientId) {
+                return problemResponse(problem("idempotency_conflict", 409, state.idGenerator("diagnostic")));
+            }
+            const responseDiagnosticId = storeIdempotentResponse(state, identity, "registerMachineCredential", idempotency.key, requestFingerprint, 200, existing.credential, request.credential_id, "credential:active->active");
+            return validatedResponse(existing.credential, validateMachineCredential, 200, state, responseDiagnosticId);
+        }
+        const now = timestamp(options);
+        const credential = {
+            created_at: now,
+            credential_id: request.credential_id,
+            machine_client_id: machineClientId,
+            scope_summary: [...MACHINE_SCOPE_SUMMARY],
+            status: "active",
+        };
+        state.machineCredentials.set(request.credential_id, {
+            credential,
+            secretDigest: request.secret_sha256,
+        });
+        if (clientRecord.client.status === "provisioning") {
+            clientRecord.client = {
+                ...clientRecord.client,
+                status: "active",
+                updated_at: now,
+            };
+        }
+        const responseDiagnosticId = storeIdempotentResponse(state, identity, "registerMachineCredential", idempotency.key, requestFingerprint, 201, credential, request.credential_id, "credential:none->active");
+        return validatedResponse(credential, validateMachineCredential, 201, state, responseDiagnosticId);
+    });
+    app.post("/v1/machine-clients/:machineClientId/credentials/:credentialId/revoke", (context) => {
+        const state = getState();
+        const identity = requireProjectScope(context.req.raw, state, "machine-clients:write");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const idempotency = requireIdempotency(context.req.raw, state);
+        if ("response" in idempotency) {
+            return idempotency.response;
+        }
+        const machineClientId = context.req.param("machineClientId");
+        const credentialId = context.req.param("credentialId");
+        const requestFingerprint = fingerprint({ credentialId, machineClientId });
+        const replay = idempotentReplay(state, identity, "revokeMachineCredential", idempotency.key, requestFingerprint);
+        if (replay !== undefined) {
+            return replay;
+        }
+        const clientRecord = state.machineClients.get(machineClientId);
+        const credentialRecord = state.machineCredentials.get(credentialId);
+        if (clientRecord === undefined ||
+            credentialRecord === undefined ||
+            credentialRecord.credential.machine_client_id !== machineClientId ||
+            !ownerMatches(identity.credential, clientRecord.client)) {
+            return notFound(state);
+        }
+        const previousStatus = credentialRecord.credential.status;
+        if (credentialRecord.credential.status !== "revoked") {
+            credentialRecord.credential = {
+                ...credentialRecord.credential,
+                revoked_at: timestamp(options),
+                status: "revoked",
+            };
+        }
+        const responseDiagnosticId = storeIdempotentResponse(state, identity, "revokeMachineCredential", idempotency.key, requestFingerprint, 200, credentialRecord.credential, credentialId, `credential:${previousStatus}->${credentialRecord.credential.status}`);
+        return validatedResponse(credentialRecord.credential, validateMachineCredential, 200, state, responseDiagnosticId);
+    });
+    app.post("/v1/machine-clients/:machineClientId/revoke", (context) => {
+        const state = getState();
+        const identity = requireProjectScope(context.req.raw, state, "machine-clients:write");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const idempotency = requireIdempotency(context.req.raw, state);
+        if ("response" in idempotency) {
+            return idempotency.response;
+        }
+        const machineClientId = context.req.param("machineClientId");
+        const requestFingerprint = fingerprint({ machineClientId });
+        const replay = idempotentReplay(state, identity, "revokeMachineClient", idempotency.key, requestFingerprint);
+        if (replay !== undefined) {
+            return replay;
+        }
+        const record = state.machineClients.get(machineClientId);
+        if (record === undefined ||
+            !ownerMatches(identity.credential, record.client)) {
+            return notFound(state);
+        }
+        const previousStatus = record.client.status;
+        if (record.client.status !== "revoked") {
+            const now = timestamp(options);
+            record.client = {
+                ...record.client,
+                revoked_at: now,
+                status: "revoked",
+                updated_at: now,
+            };
+        }
+        const responseDiagnosticId = storeIdempotentResponse(state, identity, "revokeMachineClient", idempotency.key, requestFingerprint, 200, record.client, machineClientId, `${previousStatus}->${record.client.status}`);
+        return validatedResponse(record.client, validateMachineClient, 200, state, responseDiagnosticId);
+    });
+    app.get("/v1/machine-events", (context) => {
+        const state = getState();
+        const identity = requireMachineScope(context.req.raw, state, "machine-events:read");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const wait = context.req.query("wait");
+        const limit = context.req.query("limit");
+        if ((wait !== undefined &&
+            (!/^\d+$/u.test(wait) || Number(wait) < 0 || Number(wait) > 30)) ||
+            (limit !== undefined &&
+                (!/^\d+$/u.test(limit) || Number(limit) < 1 || Number(limit) > 50))) {
+            return requestInvalid(state);
+        }
+        const streamEvents = state.machineEvents.filter((record) => record.machineClientId === identity.credential.machineClientId);
+        let committedCursor = null;
+        for (const record of streamEvents) {
+            if (state.acknowledgements.has(acknowledgementKey(identity.credential.machineClientId, record.event.id))) {
+                committedCursor = record.event.cursor;
+            }
+            else {
+                break;
+            }
+        }
+        const after = context.req.query("after");
+        if (after !== undefined &&
+            (after.length < 8 ||
+                after.length > 128 ||
+                !/^mcur_[A-Za-z0-9_-]+$/u.test(after))) {
+            return requestInvalid(state);
+        }
+        if ((committedCursor === null && after !== undefined) ||
+            (committedCursor !== null && after !== committedCursor)) {
+            return requestInvalid(state);
+        }
+        const start = committedCursor === null
+            ? 0
+            : streamEvents.findIndex((record) => record.event.cursor === committedCursor) + 1;
+        const take = limit === undefined ? 25 : Number(limit);
+        const response = {
+            committed_cursor: committedCursor,
+            events: streamEvents
+                .slice(start)
+                .filter((record) => !state.acknowledgements.has(acknowledgementKey(identity.credential.machineClientId, record.event.id)))
+                .slice(0, take)
+                .map((record) => record.event),
+            schema: "whooshbang.machine-events.v1",
+            server_time: timestamp(options),
+        };
+        recordDiagnostic(state, identity, "pollMachineEvents");
+        return validatedResponse(response, validateMachineEventPollResponse, 200, state);
+    });
+    app.post("/v1/machine-events/:eventId/ack", async (context) => {
+        const state = getState();
+        const identity = requireMachineScope(context.req.raw, state, "machine-events:ack");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const idempotency = requireIdempotency(context.req.raw, state);
+        if ("response" in idempotency) {
+            return idempotency.response;
+        }
+        const parsed = await readJson(context.req.raw, validateMachineEventAckRequest, state.idGenerator("diagnostic"));
+        if ("response" in parsed) {
+            return parsed.response;
+        }
+        const request = parsed.value;
+        const normalizedReasonCode = request.disposition === "processed"
+            ? undefined
+            : (request.reason_code ?? undefined);
+        const normalizedRequest = request.disposition === "processed"
+            ? {
+                cursor: request.cursor,
+                disposition: request.disposition,
+                reason_code: null,
+            }
+            : request;
+        const eventId = context.req.param("eventId");
+        const requestFingerprint = fingerprint({
+            eventId,
+            request: normalizedRequest,
+        });
+        const storedIdempotency = state.idempotency.get(idempotencyKey(identity, "ackMachineEvent", idempotency.key));
+        if (storedIdempotency !== undefined &&
+            storedIdempotency.fingerprint !== requestFingerprint) {
+            return idempotentReplay(state, identity, "ackMachineEvent", idempotency.key, requestFingerprint);
+        }
+        const streamEvents = state.machineEvents.filter((record) => record.machineClientId === identity.credential.machineClientId);
+        const eventRecord = streamEvents.find((record) => record.event.id === eventId);
+        if (eventRecord === undefined) {
+            return notFound(state);
+        }
+        if (request.cursor !== eventRecord.event.cursor) {
+            return problemResponse(problem("idempotency_conflict", 409, state.idGenerator("diagnostic")));
+        }
+        if (request.disposition === "quarantined" &&
+            (eventRecord.streamIdentityValid === false ||
+                eventRecord.signatureValid === false ||
+                eventRecord.quarantinable !== true)) {
+            return problemResponse(problem("request_invalid", 400, state.idGenerator("diagnostic")));
+        }
+        const ackKey = acknowledgementKey(identity.credential.machineClientId, eventId);
+        const existing = state.acknowledgements.get(ackKey);
+        if (existing !== undefined &&
+            (existing.disposition !== request.disposition ||
+                existing.reasonCode !== normalizedReasonCode)) {
+            return problemResponse(problem("idempotency_conflict", 409, state.idGenerator("diagnostic")));
+        }
+        if (storedIdempotency !== undefined) {
+            void idempotentReplay(state, identity, "ackMachineEvent", idempotency.key, requestFingerprint);
+        }
+        let previousCommitted = null;
+        for (const record of streamEvents) {
+            if (state.acknowledgements.has(acknowledgementKey(identity.credential.machineClientId, record.event.id))) {
+                previousCommitted = record.event.cursor;
+            }
+            else {
+                break;
+            }
+        }
+        if (existing === undefined) {
+            state.acknowledgements.set(ackKey, {
+                disposition: request.disposition,
+                ...(normalizedReasonCode === undefined
+                    ? {}
+                    : { reasonCode: normalizedReasonCode }),
+            });
+        }
+        let committedCursor = null;
+        for (const record of streamEvents) {
+            if (state.acknowledgements.has(acknowledgementKey(identity.credential.machineClientId, record.event.id))) {
+                committedCursor = record.event.cursor;
+            }
+            else {
+                break;
+            }
+        }
+        const response = {
+            acknowledgement_status: existing === undefined ? "recorded" : "existing",
+            advanced: committedCursor !== previousCommitted,
+            committed_cursor: committedCursor,
+            disposition: request.disposition,
+            event_id: eventId,
+            ...(request.disposition === "quarantined" &&
+                request.reason_code !== undefined &&
+                request.reason_code !== null
+                ? { reason_code: request.reason_code }
+                : {}),
+            cursor: request.cursor,
+        };
+        state.cursorCommits.push({
+            committedCursor,
+            disposition: request.disposition,
+            eventId,
+            machineClientId: identity.credential.machineClientId,
+        });
+        const responseDiagnosticId = storedIdempotency?.diagnosticId ??
+            storeIdempotentResponse(state, identity, "ackMachineEvent", idempotency.key, requestFingerprint, 200, response, eventId, `cursor:${previousCommitted ?? "none"}->${committedCursor ?? "none"}`);
+        return validatedResponse(response, validateMachineEventAckResponse, 200, state, responseDiagnosticId);
+    });
+    const customerEndpointRoot = "/v1/projects/:projectId/environments/:environmentId/customer-endpoints";
+    /**
+     * Authenticates an environment-scoped customer-endpoint request.
+     *
+     * A credential for another project or environment is refused as
+     * `resource_not_found`, matching the service: a caller must not learn that
+     * someone else's endpoint exists.
+     */
+    const authorizeCustomerEndpoints = (context, state, scope) => {
+        const identity = requireProjectScope(context.req.raw, state, scope);
+        if (isAuthFailure(identity)) {
+            return identity;
+        }
+        if (context.req.param("projectId") !== identity.credential.projectId ||
+            context.req.param("environmentId") !==
+                credentialEnvironmentId(identity.credential)) {
+            return { response: notFound(state) };
+        }
+        return identity;
+    };
+    /**
+     * Answers an endpoint replay with the endpoint's *current* state.
+     *
+     * The service re-reads the row on the replay path, so a create replayed
+     * after verification reports `active`, not the `unverified` snapshot taken
+     * when the key was first used. Returning the stored snapshot here would
+     * teach consumers a state machine the product does not have.
+     */
+    const liveEndpointReplay = async (replay, state) => {
+        if (replay.status !== 200) {
+            return replay;
+        }
+        const stored = await replay.clone().json();
+        const identity = typeof stored === "object" && stored !== null && "endpoint" in stored
+            ? stored.endpoint.id
+            : undefined;
+        const record = typeof identity === "string"
+            ? state.customerEndpoints.get(identity)
+            : undefined;
+        if (record === undefined) {
+            return replay;
+        }
+        return validatedResponse({ endpoint: record.endpoint }, validateCustomerEndpointMutationResult, 200, state, replay.headers.get("whooshbang-diagnostic-id") ?? undefined);
+    };
+    const ownedEndpoint = (state, identity, endpointId) => {
+        const record = state.customerEndpoints.get(endpointId);
+        return record !== undefined &&
+            record.ownerAccountId === identity.credential.accountId &&
+            record.endpoint.project_id === identity.credential.projectId &&
+            record.endpoint.environment === identity.credential.environment
+            ? record
+            : undefined;
+    };
+    app.get(customerEndpointRoot, (context) => {
+        const state = getState();
+        const identity = authorizeCustomerEndpoints(context, state, "messages:read");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const collection = {
+            items: [...state.customerEndpoints.values()]
+                .filter((record) => ownedEndpoint(state, identity, record.endpoint.id))
+                .map((record) => record.endpoint)
+                .sort((left, right) => left.created_at.localeCompare(right.created_at) ||
+                left.id.localeCompare(right.id))
+                // The contract caps the page at 100. Truncating keeps an unusual
+                // fixture from turning into an internal validation failure.
+                .slice(0, 100),
+        };
+        recordDiagnostic(state, identity, "listCustomerEndpoints");
+        return validatedResponse(collection, validateCustomerEndpointCollection, 200, state);
+    });
+    app.post(customerEndpointRoot, async (context) => {
+        const state = getState();
+        const identity = authorizeCustomerEndpoints(context, state, "messages:write");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const idempotency = requireIdempotency(context.req.raw, state);
+        if ("response" in idempotency) {
+            return idempotency.response;
+        }
+        const parsed = await readJson(context.req.raw, validateCreateCustomerEndpointRequest, state.idGenerator("diagnostic"));
+        if ("response" in parsed) {
+            return parsed.response;
+        }
+        const request = parsed.value;
+        // Sorting matches the service's documented normalization, so the same
+        // event-type set in a different order replays instead of conflicting.
+        const eventTypes = [
+            ...request.event_types,
+        ].sort();
+        const normalized = {
+            event_types: eventTypes,
+            local_test: request.local_test === true,
+            url: request.url,
+        };
+        const requestFingerprint = fingerprint(normalized);
+        const replay = idempotentReplay(state, identity, "createCustomerEndpoint", idempotency.key, requestFingerprint);
+        if (replay !== undefined) {
+            return liveEndpointReplay(replay, state);
+        }
+        state.customerEndpointSequence += 1;
+        const now = timestamp(options);
+        const endpoint = {
+            created_at: now,
+            diagnostic_id: state.idGenerator("diagnostic"),
+            environment: identity.credential.environment,
+            environment_id: credentialEnvironmentId(identity.credential),
+            event_types: eventTypes,
+            health: "never_delivered",
+            id: state.idGenerator("customer_endpoint"),
+            project_id: identity.credential.projectId,
+            secret_version: 1,
+            status: "unverified",
+            updated_at: now,
+            verification_status: "pending",
+        };
+        const result = {
+            endpoint,
+            secret: syntheticEndpointSecret(state.customerEndpointSequence, 1),
+        };
+        state.customerEndpoints.set(endpoint.id, {
+            attempts: [],
+            endpoint,
+            ownerAccountId: identity.credential.accountId,
+            secret: result.secret ?? "",
+            sequence: state.customerEndpointSequence,
+        });
+        const responseDiagnosticId = storeIdempotentResponse(state, identity, "createCustomerEndpoint", idempotency.key, requestFingerprint, 200, { endpoint }, endpoint.id, "none->unverified");
+        return validatedResponse(result, validateCustomerEndpointMutationResult, 201, state, responseDiagnosticId);
+    });
+    app.get(`${customerEndpointRoot}/:endpointId`, (context) => {
+        const state = getState();
+        const identity = authorizeCustomerEndpoints(context, state, "messages:read");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const record = ownedEndpoint(state, identity, context.req.param("endpointId"));
+        if (record === undefined) {
+            return notFound(state);
+        }
+        recordDiagnostic(state, identity, "getCustomerEndpoint", {
+            resourceId: record.endpoint.id,
+        });
+        return validatedResponse(record.endpoint, validateCustomerEndpoint, 200, state);
+    });
+    app.post(`${customerEndpointRoot}/:endpointId/verify`, (context) => {
+        const state = getState();
+        const identity = authorizeCustomerEndpoints(context, state, "messages:write");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const record = ownedEndpoint(state, identity, context.req.param("endpointId"));
+        if (record === undefined) {
+            return notFound(state);
+        }
+        if (record.endpoint.status !== "unverified") {
+            recordDiagnostic(state, identity, "verifyCustomerEndpoint", {
+                resourceId: record.endpoint.id,
+            });
+            return validatedResponse(record.endpoint, validateCustomerEndpoint, 200, state);
+        }
+        const now = timestamp(options);
+        record.endpoint = {
+            ...record.endpoint,
+            status: "active",
+            updated_at: now,
+            verification_attempted_at: now,
+            verification_status: "verified",
+            verified_at: now,
+        };
+        recordDiagnostic(state, identity, "verifyCustomerEndpoint", {
+            resourceId: record.endpoint.id,
+            stateTransition: "unverified->active",
+        });
+        return validatedResponse(record.endpoint, validateCustomerEndpoint, 200, state);
+    });
+    app.post(`${customerEndpointRoot}/:endpointId/rotate`, async (context) => {
+        const state = getState();
+        const identity = authorizeCustomerEndpoints(context, state, "messages:write");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const idempotency = requireIdempotency(context.req.raw, state);
+        if ("response" in idempotency) {
+            return idempotency.response;
+        }
+        const parsed = await readJson(context.req.raw, validateRotateCustomerEndpointRequest, state.idGenerator("diagnostic"));
+        if ("response" in parsed) {
+            return parsed.response;
+        }
+        const request = parsed.value;
+        const endpointId = context.req.param("endpointId");
+        const requestFingerprint = fingerprint({ endpointId, request });
+        const replay = idempotentReplay(state, identity, "rotateCustomerEndpoint", idempotency.key, requestFingerprint);
+        if (replay !== undefined) {
+            return liveEndpointReplay(replay, state);
+        }
+        const record = ownedEndpoint(state, identity, endpointId);
+        if (record === undefined) {
+            return notFound(state);
+        }
+        // A rotation already inside its overlap window must not start another:
+        // a third live secret would break the two-secret verification contract.
+        // Once the window closes the previous secret retires and rotating again
+        // is ordinary, which is why the window is checked rather than the flag.
+        const now = timestamp(options);
+        const nowMilliseconds = Date.parse(now);
+        if (record.previousSecret !== undefined &&
+            record.rotationOverlapEndsAt !== undefined &&
+            nowMilliseconds < record.rotationOverlapEndsAt) {
+            return problemResponse(problem("endpoint_rotation_conflict", 409, state.idGenerator("diagnostic")));
+        }
+        const version = record.endpoint.secret_version + 1;
+        record.previousSecret = record.secret;
+        record.rotationOverlapEndsAt =
+            nowMilliseconds + request.overlap_seconds * 1_000;
+        record.secret = syntheticEndpointSecret(record.sequence, version);
+        record.endpoint = {
+            ...record.endpoint,
+            rotated_at: now,
+            secret_version: version,
+            updated_at: now,
+        };
+        const result = {
+            endpoint: record.endpoint,
+            secret: record.secret,
+        };
+        const responseDiagnosticId = storeIdempotentResponse(state, identity, "rotateCustomerEndpoint", idempotency.key, requestFingerprint, 200, { endpoint: record.endpoint }, record.endpoint.id, `secret_version_${String(version)}`);
+        return validatedResponse(result, validateCustomerEndpointMutationResult, 200, state, responseDiagnosticId);
+    });
+    for (const action of ["pause", "resume", "disable"]) {
+        app.post(`${customerEndpointRoot}/:endpointId/${action}`, (context) => {
+            const state = getState();
+            const identity = authorizeCustomerEndpoints(context, state, "messages:write");
+            if (isAuthFailure(identity)) {
+                return identity.response;
+            }
+            const record = ownedEndpoint(state, identity, context.req.param("endpointId"));
+            if (record === undefined) {
+                return notFound(state);
+            }
+            const previous = record.endpoint.status;
+            const next = customerEndpointTransition(previous, action);
+            if (next === undefined) {
+                return requestInvalid(state);
+            }
+            const now = timestamp(options);
+            record.endpoint = {
+                ...record.endpoint,
+                ...(action === "pause" ? { paused_at: now } : {}),
+                ...(action === "disable" ? { disabled_at: now } : {}),
+                status: next,
+                updated_at: now,
+            };
+            recordDiagnostic(state, identity, `${action}CustomerEndpoint`, {
+                resourceId: record.endpoint.id,
+                stateTransition: `${previous}->${next}`,
+            });
+            return validatedResponse(record.endpoint, validateCustomerEndpoint, 200, state);
+        });
+    }
+    app.get(`${customerEndpointRoot}/:endpointId/attempts`, (context) => {
+        const state = getState();
+        const identity = authorizeCustomerEndpoints(context, state, "messages:read");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const record = ownedEndpoint(state, identity, context.req.param("endpointId"));
+        if (record === undefined) {
+            return notFound(state);
+        }
+        const collection = {
+            attempts: [...record.attempts],
+            endpoint_id: record.endpoint.id,
+        };
+        recordDiagnostic(state, identity, "listCustomerEndpointAttempts", {
+            resourceId: record.endpoint.id,
+        });
+        return validatedResponse(collection, validateCustomerEndpointAttemptCollection, 200, state);
+    });
+    app.get("/v1/capabilities", (context) => {
+        const state = getState();
+        const identity = requireProjectScope(context.req.raw, state, "capabilities:read");
+        if (isAuthFailure(identity)) {
+            return identity.response;
+        }
+        const response = {
+            providers: [
+                {
+                    contexts: {
+                        group: {
+                            explanation: "Group use requires an authenticated subscriber binding and exact reply context.",
+                            mode: "conditional",
+                        },
+                        private_chat: { mode: "supported" },
+                        thread: {
+                            explanation: "Thread support depends on the bound Telegram chat context.",
+                            mode: "conditional",
+                        },
+                    },
+                    degradation: { active: false },
+                    edit: { supported: true },
+                    interaction: {
+                        confirm: { mode: "native" },
+                        input: {
+                            explanation: "Input requires an exact provider reply context.",
+                            mode: "conditional",
+                        },
+                        select: { mode: "native" },
+                    },
+                    provider: "telegram",
+                    rate_limit: {
+                        explanation: "Safe provider retry timing is honored when available.",
+                        strategy: "provider_retry_after",
+                    },
+                    receipts: {
+                        delivered: false,
+                        provider_accepted: true,
+                        read: false,
+                    },
+                    schema: "whooshbang.provider-capabilities.v1",
+                    streaming: {
+                        explanation: "Progressive content uses bounded message edits.",
+                        mode: "edit",
+                    },
+                    text: { maximum_bytes: 8192, supported: true },
+                },
+            ],
+            schema: "whooshbang.provider-capabilities-collection.v1",
+        };
+        recordDiagnostic(state, identity, "getCapabilities");
+        return validatedResponse(response, validateProviderCapabilitiesCollection, 200, state);
+    });
+}
+/**
+ * The documented endpoint lifecycle transitions.
+ *
+ * `disabled` is terminal and an unverified endpoint cannot be paused or
+ * resumed, so every other request is a client error rather than a silent
+ * no-op.
+ */
+function customerEndpointTransition(current, action) {
+    if (current === "disabled") {
+        return undefined;
+    }
+    if (action === "disable") {
+        return "disabled";
+    }
+    if (action === "pause") {
+        return current === "active" ? "paused" : undefined;
+    }
+    return current === "paused" ? "active" : undefined;
+}
+function makeInteractionEvent(message, input, state, options) {
+    const interaction = message.interaction;
+    if (interaction === undefined) {
+        throw new RangeError("The selected message has no interaction.");
+    }
+    const trimmedResponse = input.response.type === "input"
+        ? { type: "input", value: input.response.value.trim() }
+        : input.response;
+    const event = {
+        answer_retained: true,
+        channel_context: {
+            binding_id: message.binding.id,
+            channel: "telegram",
+            conversation_kind: "private_chat",
+            display_name: "Synthetic operator",
+        },
+        ...(interaction.correlation_id === undefined
+            ? {}
+            : { correlation_id: interaction.correlation_id }),
+        cursor: `mcur_${state.idGenerator("event")}`,
+        expires_at: interaction.expires_at,
+        id: `event_${state.idGenerator("event")}`,
+        interaction_id: interaction.id,
+        message_id: message.id,
+        occurred_at: timestamp(options),
+        response: trimmedResponse,
+        schema: "whooshbang.interaction-event.v1",
+        type: "interaction.received",
+    };
+    if (!validateInteractionEvent(event)) {
+        throw new Error("Internal contract-mock interaction event violation.");
+    }
+    return event;
+}
+async function submitInteraction(state, options, input) {
+    const record = state.messages.get(input.messageId);
+    if (record?.message.interaction === undefined) {
+        throw new RangeError("Unknown interactive message.");
+    }
+    const requestedOutcome = input.outcome ?? getScenarioDefinition(state.scenario).interactionOutcome;
+    const interaction = record.message.interaction;
+    const typeMatches = input.response.type === interaction.type;
+    const selectedOptionValid = input.response.type !== "select" ||
+        record.interactionRequest?.type !== "select" ||
+        record.interactionRequest.options.some((option) => option.value === input.response.value);
+    const expiredByClock = Date.parse(timestamp(options)) >= Date.parse(interaction.expires_at);
+    const resolvedOutcome = interaction.state === "answered"
+        ? "duplicate"
+        : interaction.state === "cancelled" || interaction.state === "retired"
+            ? "stale"
+            : interaction.state === "expired"
+                ? "expired"
+                : requestedOutcome !== "authorized"
+                    ? requestedOutcome
+                    : !typeMatches || !selectedOptionValid
+                        ? "unauthorized"
+                        : expiredByClock
+                            ? "expired"
+                            : "authorized";
+    if (resolvedOutcome !== "authorized") {
+        if (resolvedOutcome === "expired" && interaction.state === "open") {
+            record.message.interaction = { ...interaction, state: "expired" };
+        }
+        state.diagnostics.push({
+            environment: record.message.environment,
+            operation: "submitInteraction",
+            projectId: record.message.project_id,
+            requestId: state.idGenerator("request"),
+            resourceId: record.message.id,
+            scenario: state.scenario,
+            stateTransition: `interaction:${interaction.state}->${record.message.interaction.state}:${resolvedOutcome}`,
+        });
+        return { eventCreated: false, outcome: resolvedOutcome };
+    }
+    const event = makeInteractionEvent(record.message, input, state, options);
+    if (event.response === undefined) {
+        throw new Error("Internal retained event response is missing.");
+    }
+    const answer = event.response.value;
+    const nextMessage = {
+        ...record.message,
+        interaction: {
+            ...interaction,
+            answer,
+            answer_retained: true,
+            answered_at: event.occurred_at,
+            state: "answered",
+        },
+    };
+    if (!validateMessage(nextMessage)) {
+        throw new Error("Internal contract-mock interaction state violation.");
+    }
+    const customerEvent = {
+        account_id: record.ownerAccountId,
+        created_at: timestamp(options),
+        data: {
+            binding_id: record.message.binding.id,
+            channel: "telegram",
+            ...(interaction.correlation_id === undefined
+                ? {}
+                : { correlation_id: interaction.correlation_id }),
+            expires_at: interaction.expires_at,
+            interaction_id: interaction.id,
+            interaction_type: interaction.type,
+            message_id: record.message.id,
+            occurred_at: event.occurred_at,
+            response: event.response,
+        },
+        environment: record.message.environment,
+        id: `evt_${state.idGenerator("event")}`,
+        project_id: record.message.project_id,
+        schema: "whooshbang.event.v1",
+        type: "interaction.received",
+    };
+    if (!validateWhooshBangEvent(customerEvent)) {
+        throw new Error("Internal contract-mock customer event violation.");
+    }
+    const machineClientId = originatingMachineClientId(state, record);
+    record.message = nextMessage;
+    state.diagnostics.push({
+        environment: record.message.environment,
+        operation: "submitInteraction",
+        projectId: record.message.project_id,
+        requestId: state.idGenerator("request"),
+        resourceId: record.message.id,
+        scenario: state.scenario,
+        stateTransition: "interaction:open->answered",
+    });
+    if (machineClientId !== undefined) {
+        state.machineEvents.push({
+            event,
+            machineClientId,
+        });
+    }
+    addLogicalEvent(state, customerEvent, record.message.id);
+    await deliverWebhook(customerEvent, state, options);
+    return { eventCreated: true, outcome: "authorized" };
+}
+export function createWhooshBangContractMockCore(options = {}) {
+    const runtimeOptions = Object.freeze({
+        ...options,
+        credentials: snapshotFixtureCredentials(options.credentials === undefined
+            ? defaultCredentials()
+            : options.credentials),
+    });
+    let state = initialState(runtimeOptions, runtimeOptions.scenario ?? "nominal");
+    const app = new Hono();
+    addPublicRoutes(app, () => state, runtimeOptions);
+    app.notFound(() => notFound(state));
+    app.onError(() => problemResponse(problem("request_invalid", 400, state.idGenerator("diagnostic"))));
+    const control = {
+        enqueueMachineEvent(seed) {
+            state.machineEvents.push({ ...clone(seed) });
+        },
+        reset(scenario = state.scenario) {
+            state = initialState(runtimeOptions, scenario);
+            return Promise.resolve();
+        },
+        async runPending() {
+            for (const record of state.messages.values()) {
+                await processMessage(record, state, runtimeOptions);
+            }
+        },
+        setProviderOutcomes(outcomes) {
+            state.providerOutcomes = clone([...outcomes]);
+        },
+        setWebhookResponses(responses) {
+            state.webhookResponses = [...responses];
+        },
+        async submitInteraction(input) {
+            return submitInteraction(state, runtimeOptions, parseInteractionControlInput(clone(input)));
+        },
+    };
+    return {
+        app,
+        control,
+        fetch: async (request) => app.fetch(request),
+        inspect: () => inspectState(state),
+    };
+}
+//# sourceMappingURL=core.js.map