vairified 0.7.0 → 0.8.0

package/dist/index.d.ts

@@ -466,6 +466,240 @@ interface AttributionResultWire {
         readonly outcome: AttributionOutcome;
     }[];
 }
+/**
+ * A value the API documents today, without closing the set.
+ *
+ * `'a' | 'b' | (string & {})` keeps editor autocomplete for the known values
+ * while still accepting one we have not seen. That matters more here than
+ * anywhere else in this SDK: webhook payloads are produced by a service that
+ * ships independently of this package, so a closed union is wrong the moment
+ * the backend adds a value — and it fails at the worst possible time, in a
+ * partner's live handler rather than at their compile step.
+ *
+ * Worked example: `connection.revoked` carried exactly one `reason` for its
+ * whole life, and a second (`player_disconnected`) landed while this very file
+ * was being written. A closed union would have shipped broken.
+ *
+ * @category Webhooks
+ */
+type OpenEnum<Known extends string> = Known | (string & {});
+/** One sport's VAIR Pro standing, as carried by a `member.status` event. */
+interface MemberStatusEventSportWire {
+    /**
+     * Whether the member is an **active** VAIR Pro (certified rater) **in this
+     * sport** — the field to check before letting someone rate.
+     *
+     * :rotating_light: **`false` means "holds one, awaiting approval", not
+     * "may rate".** Treat only `true` as permission. A member certified in
+     * pickleball is not thereby certified in padel.
+     */
+    readonly isVairPro?: boolean;
+    /** Documented alias of {@link isVairPro}, matching `GET /partner/member`. */
+    readonly isRater?: boolean;
+    readonly isVairProStatus?: OpenEnum<'ACTIVE' | 'PENDING'>;
+}
+/**
+ * The `data` block of a `member.status` event.
+ *
+ * :warning: `sports` is **absent, not empty**, for a member who did not grant
+ * `user:rating:read`. Absence means "we were not permitted to tell you", which
+ * is a different claim from "holds no certifications" — check for the key
+ * before concluding anything about a member's rater standing.
+ *
+ * :warning: A sport appears only while the member holds a **current**
+ * certification in it. Expired and revoked certifications are not reported, so
+ * a lapsed rater is indistinguishable here from someone who was never
+ * certified. Do not use this map to answer "have they ever been a rater?".
+ */
+interface MemberStatusEventDataWire {
+    readonly memberId: number;
+    readonly isVairPlus: boolean;
+    readonly isAmbassador: boolean;
+    readonly sports?: Record<string, MemberStatusEventSportWire> | null;
+    /**
+     * VAIR Pro standing **collapsed across every sport**: `ACTIVE` if any sport's
+     * certification is active, else `PENDING` if any is pending, else `null`.
+     *
+     * :rotating_light: **This cannot answer "may this person rate my padel
+     * event".** It is `ACTIVE` when the member is certified in *any* sport, so
+     * using it as a per-sport permission grants a pickleball rater authority over
+     * padel. Read {@link MemberStatusEventDataWire.sports} where the sport
+     * matters; this field exists for partners who consumed it before `sports`
+     * did, and for the GoHighLevel contact sync that mirrors it.
+     */
+    readonly vairProStatus: OpenEnum<'ACTIVE' | 'PENDING'> | null;
+    readonly vairifiedRatingStatus: OpenEnum<'NONE' | 'PENDING_PAYMENT' | 'PAID' | 'COMPLETED'>;
+    readonly changedAt: string;
+    /**
+     * Monotonic ordering token, compared only against other values for the SAME
+     * member. **Not currently emitted by the API** — treat an absent value as
+     * "cannot be ordered", never as zero, and order by `changedAt` until it
+     * appears.
+     */
+    readonly sequence?: string;
+}
+/** The `data` block of a `connection.revoked` event. */
+interface ConnectionRevokedEventDataWire {
+    readonly memberId: number | null;
+    readonly reason: OpenEnum<'player_deleted' | 'player_disconnected'>;
+    readonly revokedAt: string;
+}
+/** Fields every webhook event carries, whatever its type. */
+interface WebhookEventEnvelopeWire {
+    readonly event: string;
+    /** Stable event id. **Deduplicate on this** — delivery is at-least-once. */
+    readonly eventId: string;
+    readonly timestamp: string;
+}
+interface MemberStatusEventWire extends WebhookEventEnvelopeWire {
+    readonly event: 'member.status';
+    readonly data: MemberStatusEventDataWire;
+}
+interface ConnectionRevokedEventWire extends WebhookEventEnvelopeWire {
+    readonly event: 'connection.revoked';
+    readonly data: ConnectionRevokedEventDataWire;
+}
+/**
+ * The `data` block of a `rating.updated` delivery.
+ *
+ * :rotating_light: **This is NOT {@link PartnerRatingUpdateWire}.** That type is
+ * the shape `GET /partner/rating-updates` returns when you *poll*, and it still
+ * carries the old per-sport diff (`previousRating` / `newRating`). The webhook
+ * has sent a **full multi-sport snapshot** since Vairified#899, and the two have
+ * not matched since. Reusing the poll type here is a mistake this SDK made once
+ * and the reason this docstring exists.
+ *
+ * :warning: **Two variants, distinguished by {@link ratingDataWithheld}.** An app
+ * holding `user:webhook:subscribe` but not `user:rating:read` is told *that* a
+ * member's rating changed and not *what it changed to* — `sports` is **absent**,
+ * not empty, and `ratingDataWithheld` is `true`.
+ */
+/**
+ * One sport's rating standing inside a `rating.updated` snapshot.
+ *
+ * :rotating_light: **Deliberately NOT {@link SportRatingWire}.** That type is the
+ * POLLING shape: it declares `rating`, `abbr` and `ratingSplits` required and
+ * closes `isVairProStatus` to two values. Reusing it here would let a partner
+ * write an exhaustive switch the compiler accepts and the API then outgrows, and
+ * would contradict the Python SDK, which types every field optional. Everything
+ * here is open and optional for the same reason the enums are.
+ */
+interface RatingUpdatedSportWire {
+    readonly rating?: number;
+    readonly abbr?: string;
+    readonly ratingSplits?: Readonly<Record<string, RatingSplitWire>>;
+    readonly isVairified?: boolean;
+    readonly isRater?: boolean;
+    readonly isVairPro?: boolean;
+    readonly isVairProStatus?: OpenEnum<'ACTIVE' | 'PENDING'>;
+}
+interface RatingUpdatedEventDataWire {
+    readonly memberId: number;
+    /**
+     * The member's complete rating standing, keyed by sport code, at the moment
+     * the computation finished — a **snapshot**, not a diff.
+     *
+     * :rotating_light: **Absent when the partner lacks `user:rating:read`.** Absence
+     * means "we were not permitted to tell you", which is not the same claim as
+     * "no ratings". Check {@link ratingDataWithheld}.
+     */
+    readonly sports?: Readonly<Record<string, RatingUpdatedSportWire>> | null;
+    /** When the rating computation that produced this state completed (ISO 8601). */
+    readonly changedAt: string;
+    /**
+     * Monotonic ordering token. **Use it to discard stale deliveries.**
+     *
+     * :rotating_light: Because the payload is a **snapshot** rather than a diff, it
+     * is order-dependent in a way the old diff payload was not. Deliveries run
+     * concurrently with independent retry backoff, so two events for one member
+     * **can arrive out of order** — and applying the older one last leaves you
+     * holding a rating the member no longer has.
+     *
+     * :rotating_light: **Compare it as an INTEGER, never as a string.** It is an
+     * unpadded decimal, so a string comparison is lexicographic and
+     * `'10000000' > '9999999'` is `false`. At every power-of-ten crossing a
+     * string-comparing receiver would discard every later delivery for that
+     * member, permanently, and their rating would freeze at the stale value —
+     * which is the exact failure this field exists to prevent. Use
+     * `BigInt(a) > BigInt(b)`.
+     *
+     * So: keep the highest `sequence` you have applied **per member**, compared as
+     * an integer, and discard any delivery whose value is lower. Compare it only against other values
+     * **for the same member** — it is drawn from a platform-wide counter, so gaps
+     * carry no meaning and values are not comparable across members. Sent as a
+     * string because the value exceeds the safe integer range in some languages.
+     *
+     * Unlike `member.status`, where this field is declared but not yet emitted,
+     * `rating.updated` carries it on **every** delivery, on both variants.
+     */
+    readonly sequence: string;
+    /**
+     * Present and `true` only on the notification variant — the partner was not
+     * granted `user:rating:read`, so {@link sports} is absent by design rather
+     * than because nothing changed.
+     */
+    readonly ratingDataWithheld?: boolean;
+}
+interface RatingUpdatedEventWire extends WebhookEventEnvelopeWire {
+    readonly event: 'rating.updated';
+    readonly data: RatingUpdatedEventDataWire;
+}
+/** The club an event belongs to, when it has one. */
+interface EventCreatedClubWire {
+    readonly name: string;
+    readonly city: string | null;
+    readonly state: string | null;
+}
+/**
+ * The `data` block of an `event.created` delivery.
+ *
+ * :warning: **`data.eventId` is a NUMBER and is not the envelope's `eventId`.**
+ * The envelope's is the delivery's own string id, used for deduplication; this
+ * one is the event's public number, the id a partner uses to refer to the event
+ * itself. They shadow each other by name and share nothing else.
+ *
+ * This is the only **app-scoped** event — it concerns no particular member, so
+ * it carries no `memberId`.
+ */
+interface EventCreatedEventDataWire {
+    readonly eventId: number;
+    readonly name: string;
+    readonly type: string;
+    readonly status: string;
+    readonly sport: string;
+    readonly startDate: string | null;
+    readonly endDate: string | null;
+    readonly club: EventCreatedClubWire | null;
+    readonly hostName: string | null;
+    readonly winScore: number | null;
+    readonly winBy: number | null;
+    readonly isPrivate: boolean;
+    readonly maxSpots: number | null;
+    readonly maxTeams: number | null;
+    readonly createdBy: string | null;
+    readonly createdAt: string;
+}
+interface EventCreatedEventWire extends WebhookEventEnvelopeWire {
+    readonly event: 'event.created';
+    readonly data: EventCreatedEventDataWire;
+}
+/**
+ * Any event this SDK version does not model richly.
+ *
+ * Verification succeeds and `data` is handed over untouched. This is
+ * deliberate: the signature is checked *before* the body is typed, so an
+ * unrecognised event that reaches your handler is an authenticated one. If
+ * this threw instead, every partner would break the day the API adds an event.
+ */
+interface UnknownWebhookEventWire extends WebhookEventEnvelopeWire {
+    readonly data: unknown;
+}
+/**
+ * A verified webhook event. Narrow on `event` to reach the typed members.
+ *
+ * @category Webhooks
+ */
+type VerifiedWebhookEvent = MemberStatusEventWire | ConnectionRevokedEventWire | RatingUpdatedEventWire | EventCreatedEventWire | UnknownWebhookEventWire;
 
 /**
  * {@link LeaderboardResource} — read-only leaderboard queries.
@@ -889,9 +1123,14 @@ declare class MembersByEmailResult {
 /**
  * A single rating change notification.
  *
- * Returned by {@link MembersResource.ratingUpdates} (polling) and
- * delivered via webhook callbacks to partners that have registered a
- * webhook URL and have subscribers.
+ * Returned by {@link MembersResource.ratingUpdates} — the **polling** endpoint,
+ * and only that.
+ *
+ * :rotating_light: **This is NOT the `rating.updated` webhook payload.** It was,
+ * once; the webhook has sent a full multi-sport snapshot since Vairified#899
+ * and the two shapes have not matched since. The webhook's is
+ * {@link RatingUpdatedEventDataWire}, reachable through `verifyWebhook`. This
+ * sentence used to claim otherwise, and a later change believed it.
  *
  * @category Members
  */
@@ -1679,5 +1918,245 @@ declare class OAuthError extends VairifiedError {
     readonly errorCode?: string;
     constructor(message?: string, errorCode?: string, response?: unknown);
 }
+/**
+ * Why a webhook was refused. Lets a handler distinguish "someone is forging
+ * requests" from "our clock drifted" without parsing an error message.
+ *
+ * @category Errors
+ */
+type WebhookRejectionReason = 
+/**
+ * No usable signing secret was supplied to {@link verifyWebhook}.
+ *
+ * This is **your** configuration, not an attack — almost always an unset
+ * environment variable. It is separate from {@link signature_mismatch} on
+ * purpose: reporting a missing secret as a mismatch sends people hunting an
+ * attacker when the fix is one env var.
+ */
+'no_secret_configured'
+/**
+ * A caller-supplied option was not usable — a non-finite tolerance, a
+ * negative window, a non-finite clock.
+ *
+ * Separate from {@link timestamp_out_of_tolerance} deliberately: that one
+ * means "this delivery's clock disagrees with yours", and reporting a typo in
+ * your own configuration under it sends people hunting clock skew on a
+ * healthy box. Same reasoning as {@link no_secret_configured}.
+ */
+ | 'invalid_option'
+/** No `X-Vairified-Signature` header at all. */
+ | 'missing_signature'
+/** Present but unparseable, or missing its `t` / `v1` parts. */
+ | 'malformed_signature'
+/** Outside the tolerance window, in either direction. */
+ | 'timestamp_out_of_tolerance'
+/** Parsed fine; no supplied secret produces this digest. */
+ | 'signature_mismatch'
+/** Verified, but the body is not JSON, or is not a webhook envelope. */
+ | 'malformed_body';
+/**
+ * Thrown when a webhook delivery cannot be trusted.
+ *
+ * :rotating_light: **The message never contains the signing secret, the
+ * received digest, or the computed one.** Writing either digest into an error
+ * puts a valid HMAC of the partner's own payload into their application logs,
+ * where it is an oracle for anyone who can read them. Use {@link reason} to
+ * branch; there is deliberately nothing finer-grained to log.
+ *
+ * @category Errors
+ */
+declare class WebhookSignatureError extends VairifiedError {
+    readonly reason: WebhookRejectionReason;
+    constructor(reason: WebhookRejectionReason, message: string);
+}
+
+/**
+ * Webhook signature verification.
+ *
+ * Standalone on purpose — a webhook receiver is an inbound HTTP handler. It
+ * usually holds no API key, may never call the Partner API, and should not
+ * have to construct a client just to check a signature.
+ *
+ * @module
+ */
+
+/**
+ * How far apart the delivery's timestamp and your clock may be, in seconds.
+ *
+ * Five minutes, matching the scheme this signature format follows. The window
+ * is what stops a captured delivery being replayed indefinitely — without it a
+ * valid signature stays valid forever.
+ */
+declare const DEFAULT_TOLERANCE_SECONDS = 300;
+/** Options for {@link verifyWebhook}. */
+interface VerifyWebhookOptions {
+    /**
+     * Clock-skew allowance in seconds. Applied in **both** directions: a
+     * delivery dated too far in the future is refused exactly as a stale one is.
+     * A one-sided check would accept a forged future timestamp forever, which is
+     * the replay hole the window exists to close.
+     *
+     * @defaultValue {@link DEFAULT_TOLERANCE_SECONDS}
+     */
+    toleranceSeconds?: number;
+    /**
+     * Current time in **seconds** since the epoch. Injectable for tests; you
+     * should not need it in production.
+     */
+    nowSeconds?: number;
+}
+/**
+ * Verify a webhook delivery and return it typed.
+ *
+ * @param rawBody - The **exact bytes** of the request body. This is the part
+ *   people get wrong: the signature covers what was sent, so a body that has
+ *   been parsed and re-serialised (`express.json()`, FastAPI's parsed body)
+ *   produces different bytes and every signature fails. Capture the raw body.
+ * @param signatureHeader - The `X-Vairified-Signature` header value.
+ * @param secret - Your webhook signing secret, or **several**. Pass both the
+ *   old and the new around a rotation: deliveries already queued were signed
+ *   with the old secret and keep arriving for hours afterwards, so a verifier
+ *   that knows only the new one discards them.
+ * @param options - See {@link VerifyWebhookOptions}.
+ * @returns The verified event. Narrow on `event` to reach the typed members.
+ * @throws {@link WebhookSignatureError} for every refusal; read `reason`.
+ *
+ * @remarks
+ * :rotating_light: **Deduplicate on the BODY's `eventId`, never on the
+ * `X-Vairified-Event-Id` header.** Delivery is at-least-once, so a retry can
+ * present the same event twice — but that header is **outside the signature**.
+ * An attacker who captures one delivery can replay it inside the tolerance
+ * window with a fresh header value, and header-based deduplication will let it
+ * through every time. The body's `eventId` is covered by the HMAC; the header
+ * is a convenience for routing, not an identity you can trust.
+ *
+ * Replay inside the window is otherwise unprevented by design: the timestamp
+ * tolerance is the only replay control this function applies, so your own
+ * deduplication is what stops a captured delivery being applied twice.
+ *
+ * :rotating_light: **`await` it.** It is async because it uses Web Crypto, which
+ * has no synchronous HMAC. Forgetting the `await` on a *valid* signature hands
+ * your code a Promise whose `.data` is `undefined` — an entitlement check then
+ * reads falsy and denies a member who paid, silently. On an *invalid* one it is
+ * an unhandled rejection, which on Node >=24 exits the process. This function
+ * never returns a boolean, precisely so that mistake cannot be quiet.
+ *
+ * @example
+ * ```ts
+ * import { verifyWebhook, isMemberStatusEvent, WebhookSignatureError } from 'vairified';
+ *
+ * app.post('/hooks/vair', express.raw({ type: 'application/json' }), async (req, res) => {
+ *   try {
+ *     const event = await verifyWebhook(
+ *       req.body,                                  // a Buffer — the raw bytes
+ *       req.header('X-Vairified-Signature') ?? '',
+ *       [process.env.VAIR_WEBHOOK_SECRET, process.env.VAIR_WEBHOOK_SECRET_PREVIOUS],
+ *     );
+ *     // Narrow with the exported guards — `event.event === '…'` cannot narrow
+ *     // while the unknown-event fallback is part of the union.
+ *     if (isMemberStatusEvent(event)) {
+ *       console.log(event.data.memberId, event.data.isVairPlus);
+ *     }
+ *     res.sendStatus(204);
+ *   } catch (err) {
+ *     if (err instanceof WebhookSignatureError) return res.sendStatus(400);
+ *     throw err;
+ *   }
+ * });
+ * ```
+ *
+ * @category Webhooks
+ */
+declare function verifyWebhook(rawBody: string | Uint8Array, signatureHeader: string | null | undefined, secret: string | undefined | null | readonly (string | undefined | null)[], options?: VerifyWebhookOptions): Promise<VerifiedWebhookEvent>;
+/**
+ * Narrow a verified event to `member.status`.
+ *
+ * @example
+ * ```ts
+ * const event = await verifyWebhook(rawBody, header, secret);
+ * if (isMemberStatusEvent(event)) {
+ *   // `event.data` is fully typed here.
+ *   if (!event.data.isVairPlus) denyEntry(event.data.memberId);
+ * }
+ * ```
+ *
+ * @category Webhooks
+ */
+declare function isMemberStatusEvent(event: VerifiedWebhookEvent): event is MemberStatusEventWire;
+/**
+ * Narrow a verified event to `connection.revoked`.
+ *
+ * :warning: `data.reason` is an open set — `player_deleted` and
+ * `player_disconnected` today, more later. Never branch on it exhaustively.
+ *
+ * @category Webhooks
+ */
+declare function isConnectionRevokedEvent(event: VerifiedWebhookEvent): event is ConnectionRevokedEventWire;
+/**
+ * Narrow a verified event to `rating.updated` — the event that makes up
+ * almost all real traffic.
+ *
+ * :rotating_light: **`data` is NOT the shape {@link MembersResource.ratingUpdates}
+ * returns when polling.** The webhook has carried a full multi-sport snapshot
+ * since Vairified#899 and the two have not matched since — there is no
+ * `previousRating`, `newRating` or `ratingSplits` on it. Reusing a polling
+ * handler here reads fields that will never be present. See
+ * {@link RatingUpdatedEventDataWire}.
+ *
+ * @category Webhooks
+ */
+declare function isRatingUpdatedEvent(event: VerifiedWebhookEvent): event is RatingUpdatedEventWire;
+/**
+ * Narrow a verified event to `event.created`.
+ *
+ * :warning: `data.eventId` is a **number** and is not the envelope's string
+ * `eventId`. Deduplicate on the envelope's; refer to the event by `data`'s.
+ *
+ * @category Webhooks
+ */
+declare function isEventCreatedEvent(event: VerifiedWebhookEvent): event is EventCreatedEventWire;
+/**
+ * Compare two `sequence` values as integers.
+ *
+ * @returns negative if `a` is older, `0` if equal, positive if `a` is newer.
+ * @category Webhooks
+ */
+declare function compareSequence(a: string, b: string): number;
+/**
+ * Whether an incoming `sequence` is newer than the last one you applied **for
+ * that same member**.
+ *
+ * Use it to discard stale deliveries. `rating.updated` carries a full snapshot
+ * rather than a diff, so applying an older one last leaves you holding a rating
+ * the member no longer has.
+ *
+ * ```ts
+ * if (isRatingUpdatedEvent(event)) {
+ *   const last = await store.get(event.data.memberId);
+ *   if (last && !isNewerSequence(event.data.sequence, last)) return; // stale
+ *   await store.put(event.data.memberId, event.data.sequence);
+ * }
+ * ```
+ *
+ * @param incoming - the delivery's `sequence`.
+ * @param lastApplied - the highest you have applied for that member, or
+ *   `null`/`undefined` if you have applied none — in which case this is `true`.
+ * @category Webhooks
+ */
+declare function isNewerSequence(incoming: string, lastApplied?: string | null): boolean;
+/**
+ * The key to deduplicate a delivery on.
+ *
+ * Delivery is at-least-once, so a retry can present the same event twice. This
+ * returns the id **from the signed body**.
+ *
+ * :rotating_light: Calling this is the point. The `X-Vairified-Event-Id` header
+ * carries the same value and is **not covered by the signature**, so an attacker
+ * replaying a captured delivery inside the tolerance window can change it freely
+ * and header-based deduplication lets it through every time.
+ *
+ * @category Webhooks
+ */
+declare function dedupeKey(event: VerifiedWebhookEvent): string;
 
-export { type ApiErrorResponse, AuthenticationError, type AuthorizationResponse, DEFAULT_SCOPES, ENVIRONMENTS, type GameInput, type Gender, type LeaderboardOptions, LeaderboardResource, type MatchBatch, MatchBatchResult, type MatchBatchResultWire, type MatchInput, MatchesResource, Member, MemberEmailMatch, MemberSportMap, type MemberStatusWire, MembersByEmailResult, type MembersByEmailResultWire, MembersResource, NotFoundError, type OAuthConfig, OAuthError, OAuthResource, type OAuthScope, type PartnerMemberEmailMatchWire, type PartnerMemberWire, type PartnerRatingUpdateWire, type PlayerRankOptions, RateLimitError, type RatingSplitWire, RatingUpdate, SCOPES, type SearchFilters, SportRating, type SportRatingWire, type TokenResponse, TournamentImportResult, type TournamentImportResultWire, Vairified, type VairifiedEnvironment, VairifiedError, type VairifiedOptions, ValidationError, WebhookDeliveriesResult, type WebhookDeliveriesResultWire, WebhookDelivery, type WebhookDeliveryWire, WebhooksResource, describeScope, describeScopes, generateState, getAuthorizationUrl, validateScope };
+export { type ApiErrorResponse, AuthenticationError, type AuthorizationResponse, type ConnectionRevokedEventDataWire, type ConnectionRevokedEventWire, DEFAULT_SCOPES, DEFAULT_TOLERANCE_SECONDS, ENVIRONMENTS, type EventCreatedClubWire, type EventCreatedEventDataWire, type EventCreatedEventWire, type GameInput, type Gender, type LeaderboardOptions, LeaderboardResource, type MatchBatch, MatchBatchResult, type MatchBatchResultWire, type MatchInput, MatchesResource, Member, MemberEmailMatch, MemberSportMap, type MemberStatusEventDataWire, type MemberStatusEventSportWire, type MemberStatusEventWire, type MemberStatusWire, MembersByEmailResult, type MembersByEmailResultWire, MembersResource, NotFoundError, type OAuthConfig, OAuthError, OAuthResource, type OAuthScope, type OpenEnum, type PartnerMemberEmailMatchWire, type PartnerMemberWire, type PartnerRatingUpdateWire, type PlayerRankOptions, RateLimitError, type RatingSplitWire, RatingUpdate, type RatingUpdatedEventDataWire, type RatingUpdatedEventWire, type RatingUpdatedSportWire, SCOPES, type SearchFilters, SportRating, type SportRatingWire, type TokenResponse, TournamentImportResult, type TournamentImportResultWire, type UnknownWebhookEventWire, Vairified, type VairifiedEnvironment, VairifiedError, type VairifiedOptions, ValidationError, type VerifiedWebhookEvent, type VerifyWebhookOptions, WebhookDeliveriesResult, type WebhookDeliveriesResultWire, WebhookDelivery, type WebhookDeliveryWire, type WebhookEventEnvelopeWire, type WebhookRejectionReason, WebhookSignatureError, WebhooksResource, compareSequence, dedupeKey, describeScope, describeScopes, generateState, getAuthorizationUrl, isConnectionRevokedEvent, isEventCreatedEvent, isMemberStatusEvent, isNewerSequence, isRatingUpdatedEvent, validateScope, verifyWebhook };