@xtandard/webhooks 0.1.0

package/dist/create-fetch-handler-CmooujQo.cjs

@@ -0,0 +1,1771 @@
+const require_keys = require("./keys-FiKpaVHX.cjs");
+const require_core = require("./core-ZGhH6Vs2.cjs");
+const require_contract = require("./contract-Bf1qguwt.cjs");
+const require_dispatcher = require("./dispatcher-B0xTEHt1.cjs");
+let node_fs = require("node:fs");
+let node_url = require("node:url");
+let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
+//#region src/portal.ts
+/**
+* Portal tokens — the credential behind the embeddable consumer portal.
+*
+* A portal token is a compact HMAC-signed grant scoping its bearer to exactly
+* **one application** for a limited time. The host mints tokens server-side
+* with {@link createPortalToken} (the portal secret never reaches a browser)
+* and hands them to its frontend; the panel handler verifies them with
+* {@link verifyPortalToken} and force-scopes authorization to the token's
+* application (see the `portal` panel option).
+*
+* Wire format:
+*
+* ```txt
+* whpt_<base64url(JSON { app, exp })>.<base64url(HMAC-SHA256(secret, payloadPart))>
+* ```
+*
+* Zero dependencies (Web Crypto only). Unlike Standard Webhooks signing
+* secrets, the portal secret is an **arbitrary string** — it is fed to the
+* HMAC as raw UTF-8 bytes, not base64-decoded.
+*
+* @module
+*/
+/** Prefix of every portal token. */
+const PORTAL_TOKEN_PREFIX = "whpt_";
+const DEFAULT_EXPIRES_IN = "7d";
+/**
+* Thrown by {@link verifyPortalToken} for any invalid token — malformed,
+* bad signature, or expired. Maps to HTTP 401 at the API layer.
+*/
+var PortalTokenError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "PortalTokenError";
+	}
+};
+const base64urlEncode = (bytes) => {
+	let binary = "";
+	for (const b of bytes) binary += String.fromCharCode(b);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+const base64urlDecode = (value) => {
+	const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+	const binary = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+};
+/** HMAC-SHA256 keyed by the raw UTF-8 bytes of the (arbitrary-string) secret. */
+async function hmac(secret, content) {
+	const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const digest = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(content));
+	return new Uint8Array(digest);
+}
+/** Constant-time byte comparison (XOR accumulate — no early exit on content). */
+function timingSafeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+	return diff === 0;
+}
+/**
+* Mint a portal token granting access to `applicationKey` until `expiresIn`
+* elapses (default 7 days). Call this **server-side** — anyone holding the
+* portal secret can mint tokens for any application.
+*
+* @example
+* ```ts
+* import { createPortalToken } from "@xtandard/webhooks";
+*
+* // In the host app's session-guarded route:
+* const token = await createPortalToken(process.env.PORTAL_SECRET!, "acme", {
+*   expiresIn: "1h",
+* });
+* // Hand `token` to the frontend for <WebhooksPortal token={token} />.
+* ```
+*/
+async function createPortalToken(secret, applicationKey, options = {}) {
+	const expiresInMs = require_core.durationToMs(options.expiresIn ?? DEFAULT_EXPIRES_IN);
+	const claims = {
+		app: applicationKey,
+		exp: Date.now() + expiresInMs
+	};
+	const payloadPart = base64urlEncode(new TextEncoder().encode(JSON.stringify(claims)));
+	return `${PORTAL_TOKEN_PREFIX}${payloadPart}.${base64urlEncode(await hmac(secret, payloadPart))}`;
+}
+/**
+* Verify a portal token: format, signature (constant time), then expiry.
+* Returns the granted application key on success; throws
+* {@link PortalTokenError} otherwise.
+*
+* @example
+* ```ts
+* import { verifyPortalToken } from "@xtandard/webhooks";
+*
+* const { applicationKey } = await verifyPortalToken(secret, token);
+* ```
+*/
+async function verifyPortalToken(secret, token) {
+	if (!token.startsWith("whpt_")) throw new PortalTokenError("Invalid portal token: missing whpt_ prefix");
+	const parts = token.slice(5).split(".");
+	if (parts.length !== 2 || !parts[0] || !parts[1]) throw new PortalTokenError("Invalid portal token: malformed");
+	const [payloadPart, signaturePart] = parts;
+	let candidate;
+	try {
+		candidate = base64urlDecode(signaturePart);
+	} catch {
+		throw new PortalTokenError("Invalid portal token: malformed signature");
+	}
+	if (!timingSafeEqual(await hmac(secret, payloadPart), candidate)) throw new PortalTokenError("Invalid portal token: signature mismatch");
+	let claims;
+	try {
+		claims = JSON.parse(new TextDecoder().decode(base64urlDecode(payloadPart)));
+	} catch {
+		throw new PortalTokenError("Invalid portal token: malformed payload");
+	}
+	if (typeof claims.app !== "string" || claims.app.length === 0) throw new PortalTokenError("Invalid portal token: missing application");
+	if (typeof claims.exp !== "number" || !Number.isFinite(claims.exp)) throw new PortalTokenError("Invalid portal token: missing expiry");
+	if (Date.now() >= claims.exp) throw new PortalTokenError("Portal token has expired");
+	return { applicationKey: claims.app };
+}
+//#endregion
+//#region src/server/base-path.ts
+/**
+* Base-path helpers. The panel can be mounted under any prefix (`/webhooks`,
+* `/admin/webhooks`, ...). These normalize the configured base path and strip it
+* from incoming request paths so routing is prefix-agnostic.
+*
+* @module
+*/
+/** Normalize a base path to either `""` (root) or `/segment` with no trailing slash. */
+function normalizeBasePath(basePath) {
+	if (!basePath || basePath === "/") return "";
+	let p = basePath.trim();
+	if (!p.startsWith("/")) p = "/" + p;
+	if (p.endsWith("/")) p = p.slice(0, -1);
+	return p;
+}
+/**
+* Strip the (normalized) base path from a pathname. Returns a path that always
+* starts with `/`. If the pathname does not start with the base path it is
+* returned unchanged (the host framework may already have stripped the mount).
+*/
+function stripBasePath(pathname, basePath) {
+	if (basePath === "") return pathname || "/";
+	if (pathname === basePath) return "/";
+	if (pathname.startsWith(basePath + "/")) return pathname.slice(basePath.length) || "/";
+	return pathname || "/";
+}
+//#endregion
+//#region src/server/cors.ts
+const DEFAULT_METHODS = "GET,HEAD,PUT,POST,DELETE,PATCH,OPTIONS";
+/**
+* Resolve the value for `Access-Control-Allow-Origin` for this request, or
+* `null` when the origin is not allowed (no CORS headers → the browser blocks).
+*/
+function resolveOrigin(cors, requestOrigin) {
+	const { origin } = cors;
+	if (origin === "*") return cors.credentials ? requestOrigin ?? null : "*";
+	if (requestOrigin === null) return null;
+	return (typeof origin === "string" ? origin === requestOrigin : Array.isArray(origin) ? origin.includes(requestOrigin) : origin(requestOrigin)) ? requestOrigin : null;
+}
+/** Attach `Access-Control-*` headers to `response` for an allowed cross-origin request. */
+function applyCorsHeaders(request, response, cors) {
+	const allowOrigin = resolveOrigin(cors, request.headers.get("origin"));
+	if (allowOrigin === null) return response;
+	response.headers.set("access-control-allow-origin", allowOrigin);
+	if (cors.credentials) response.headers.set("access-control-allow-credentials", "true");
+	if (allowOrigin !== "*") response.headers.append("vary", "Origin");
+	return response;
+}
+/** Build the `204` response for a CORS preflight (`OPTIONS`). */
+function preflightResponse(request, cors) {
+	const response = new Response(null, { status: 204 });
+	applyCorsHeaders(request, response, cors);
+	response.headers.set("access-control-allow-methods", (cors.methods ?? []).join(",") || DEFAULT_METHODS);
+	const requestedHeaders = request.headers.get("access-control-request-headers");
+	response.headers.set("access-control-allow-headers", cors.headers?.join(",") || requestedHeaders || "Content-Type, Authorization");
+	if (cors.maxAge !== void 0) response.headers.set("access-control-max-age", String(cors.maxAge));
+	return response;
+}
+//#endregion
+//#region src/server/openapi.ts
+const schemas = {
+	Application: {
+		type: "object",
+		required: ["key"],
+		properties: {
+			key: {
+				type: "string",
+				pattern: "^[a-zA-Z0-9._-]+$"
+			},
+			name: { type: "string" },
+			metadata: {},
+			createdAt: {
+				type: "string",
+				format: "date-time"
+			},
+			updatedAt: {
+				type: "string",
+				format: "date-time"
+			}
+		}
+	},
+	EventType: {
+		type: "object",
+		required: ["name"],
+		properties: {
+			name: {
+				type: "string",
+				pattern: "^[a-zA-Z0-9._-]+$"
+			},
+			description: { type: "string" },
+			groupName: { type: "string" },
+			schema: { description: "JSON Schema documenting the payload." },
+			deprecated: { type: "boolean" },
+			createdAt: {
+				type: "string",
+				format: "date-time"
+			},
+			updatedAt: {
+				type: "string",
+				format: "date-time"
+			}
+		}
+	},
+	EndpointSecret: {
+		type: "object",
+		required: ["secret", "createdAt"],
+		properties: {
+			secret: {
+				type: "string",
+				description: "\"whsec_\" + base64 key material."
+			},
+			createdAt: {
+				type: "string",
+				format: "date-time"
+			},
+			expiresAt: {
+				type: "string",
+				format: "date-time",
+				description: "Set on rotation; the secret stops signing after this instant."
+			}
+		}
+	},
+	Endpoint: {
+		type: "object",
+		required: ["id", "url"],
+		description: "Read routes strip `secrets`; only the create/rotate responses and the dedicated /secret route carry them.",
+		properties: {
+			id: { type: "string" },
+			url: { type: "string" },
+			description: { type: "string" },
+			eventTypes: {
+				type: "array",
+				items: { type: "string" },
+				description: "Subscribed event types; empty/absent = all."
+			},
+			disabled: { type: "boolean" },
+			disabledReason: {
+				type: "string",
+				enum: ["manual", "auto"]
+			},
+			headers: {
+				type: "object",
+				additionalProperties: { type: "string" }
+			},
+			secrets: {
+				type: "array",
+				items: { $ref: "#/components/schemas/EndpointSecret" }
+			},
+			metadata: {},
+			createdAt: {
+				type: "string",
+				format: "date-time"
+			},
+			updatedAt: {
+				type: "string",
+				format: "date-time"
+			},
+			firstFailingAt: {
+				type: "string",
+				format: "date-time",
+				nullable: true
+			}
+		}
+	},
+	Message: {
+		type: "object",
+		required: [
+			"id",
+			"eventType",
+			"payload",
+			"timestamp",
+			"createdAt"
+		],
+		properties: {
+			id: {
+				type: "string",
+				description: "Sent as the webhook-id header."
+			},
+			eventType: { type: "string" },
+			payload: {},
+			timestamp: {
+				type: "string",
+				format: "date-time"
+			},
+			idempotencyKey: { type: "string" },
+			envelope: {
+				type: "string",
+				description: "The serialized wire envelope."
+			},
+			createdAt: {
+				type: "string",
+				format: "date-time"
+			}
+		}
+	},
+	Delivery: {
+		type: "object",
+		required: [
+			"id",
+			"applicationKey",
+			"messageId",
+			"endpointId",
+			"status",
+			"attemptCount"
+		],
+		properties: {
+			id: { type: "string" },
+			applicationKey: { type: "string" },
+			messageId: { type: "string" },
+			endpointId: { type: "string" },
+			status: {
+				type: "string",
+				enum: [
+					"pending",
+					"delivering",
+					"succeeded",
+					"failed"
+				]
+			},
+			attemptCount: { type: "integer" },
+			nextAttemptAt: {
+				type: "string",
+				format: "date-time",
+				nullable: true
+			},
+			leaseUntil: {
+				type: "string",
+				format: "date-time",
+				nullable: true
+			},
+			createdAt: {
+				type: "string",
+				format: "date-time"
+			},
+			updatedAt: {
+				type: "string",
+				format: "date-time"
+			}
+		}
+	},
+	DeliveryAttempt: {
+		type: "object",
+		required: [
+			"id",
+			"deliveryId",
+			"attemptNumber",
+			"at",
+			"durationMs",
+			"ok",
+			"trigger"
+		],
+		properties: {
+			id: { type: "string" },
+			deliveryId: { type: "string" },
+			attemptNumber: { type: "integer" },
+			at: {
+				type: "string",
+				format: "date-time"
+			},
+			durationMs: { type: "number" },
+			ok: { type: "boolean" },
+			httpStatus: { type: "integer" },
+			error: { type: "string" },
+			responseBody: { type: "string" },
+			trigger: {
+				type: "string",
+				enum: [
+					"schedule",
+					"manual",
+					"test"
+				]
+			}
+		}
+	},
+	PublishResult: {
+		type: "object",
+		required: [
+			"message",
+			"deliveries",
+			"deduplicated"
+		],
+		properties: {
+			message: { $ref: "#/components/schemas/Message" },
+			deliveries: {
+				type: "array",
+				items: { $ref: "#/components/schemas/Delivery" }
+			},
+			deduplicated: {
+				type: "boolean",
+				description: "True when the idempotency key matched an existing message."
+			}
+		}
+	},
+	RecoverResult: {
+		type: "object",
+		required: ["deliveryIds"],
+		properties: { deliveryIds: {
+			type: "array",
+			items: { type: "string" }
+		} }
+	},
+	AuditEntry: {
+		type: "object",
+		required: ["action", "at"],
+		properties: {
+			action: { type: "string" },
+			at: {
+				type: "string",
+				format: "date-time"
+			},
+			by: {
+				type: "object",
+				nullable: true
+			},
+			applicationKey: { type: "string" },
+			subjectId: { type: "string" },
+			message: { type: "string" }
+		}
+	},
+	Config: {
+		type: "object",
+		properties: {
+			title: { type: "string" },
+			basePath: { type: "string" },
+			readonly: { type: "boolean" },
+			authenticated: { type: "boolean" },
+			principal: {
+				type: "object",
+				nullable: true
+			},
+			portal: {
+				type: "boolean",
+				description: "True when the request carried a valid portal token."
+			},
+			logoUrl: { type: "string" }
+		}
+	},
+	Error: {
+		type: "object",
+		required: ["error"],
+		properties: {
+			error: { type: "string" },
+			code: { type: "string" },
+			errors: {
+				type: "array",
+				items: { type: "object" }
+			}
+		}
+	}
+};
+const APP = {
+	name: "app",
+	in: "path",
+	required: true,
+	schema: { type: "string" }
+};
+const ID = {
+	name: "id",
+	in: "path",
+	required: true,
+	schema: { type: "string" }
+};
+const jsonBody = (schema, required = true) => ({
+	required,
+	content: { "application/json": { schema } }
+});
+const jsonRes = (desc, schema) => ({
+	description: desc,
+	content: { "application/json": { schema } }
+});
+const ref = (name) => ({ $ref: `#/components/schemas/${name}` });
+const errorRes = (desc) => jsonRes(desc, ref("Error"));
+const okRef = (name, desc = name) => jsonRes(desc, ref(name));
+const arrayOf = (name) => ({
+	type: "array",
+	items: ref(name)
+});
+/** Build the OpenAPI 3.1 document for the admin API. Pure — safe to call anywhere. */
+function buildOpenApiDocument(options = {}) {
+	const base = options.basePath && options.basePath !== "/" ? options.basePath : "";
+	const endpointPath = "/api/applications/{app}/endpoints/{id}";
+	return {
+		openapi: "3.1.0",
+		info: {
+			title: options.title ?? "@xtandard/webhooks Admin API",
+			version: options.version ?? "0.1.0",
+			description: "Admin/control-plane API for @xtandard/webhooks: applications, the global event-type catalog, endpoints (with Standard Webhooks signing secrets), message publishing, and delivery observability. Portal tokens (Authorization: Bearer whpt_…) hit the same surface scoped to one application."
+		},
+		servers: [{ url: base || "/" }],
+		tags: [
+			{ name: "meta" },
+			{ name: "applications" },
+			{ name: "event-types" },
+			{ name: "endpoints" },
+			{ name: "messages" },
+			{ name: "deliveries" },
+			{ name: "audit" }
+		],
+		security: [{ basicAuth: [] }, { bearerAuth: [] }],
+		paths: {
+			"/config": { get: {
+				tags: ["meta"],
+				security: [],
+				summary: "Bootstrap config (title, basePath, readonly, auth state, portal flag)",
+				responses: { "200": okRef("Config") }
+			} },
+			"/api/openapi.json": { get: {
+				tags: ["meta"],
+				security: [],
+				summary: "This OpenAPI document",
+				responses: { "200": jsonRes("OpenAPI 3.1 document", { type: "object" }) }
+			} },
+			"/api/event-types.json": { get: {
+				tags: ["meta"],
+				security: [],
+				summary: "Public event-type catalog (unauthenticated, CORS-open)",
+				responses: { "200": jsonRes("Event types", arrayOf("EventType")) }
+			} },
+			"/api/applications": {
+				get: {
+					tags: ["applications"],
+					summary: "List applications",
+					responses: { "200": jsonRes("Applications", arrayOf("Application")) }
+				},
+				post: {
+					tags: ["applications"],
+					summary: "Create an application",
+					requestBody: jsonBody(ref("Application")),
+					responses: {
+						"201": okRef("Application", "Created"),
+						"409": errorRes("Key already exists"),
+						"422": errorRes("Validation error")
+					}
+				}
+			},
+			"/api/applications/{app}": {
+				parameters: [APP],
+				get: {
+					tags: ["applications"],
+					summary: "Get an application",
+					responses: {
+						"200": okRef("Application"),
+						"404": errorRes("Not found")
+					}
+				},
+				put: {
+					tags: ["applications"],
+					summary: "Update an application",
+					requestBody: jsonBody({
+						type: "object",
+						properties: {
+							name: { type: "string" },
+							metadata: {}
+						}
+					}),
+					responses: {
+						"200": okRef("Application", "Updated"),
+						"404": errorRes("Not found")
+					}
+				},
+				delete: {
+					tags: ["applications"],
+					summary: "Delete an application and everything under it",
+					responses: {
+						"200": jsonRes("Deleted", { type: "object" }),
+						"404": errorRes("Not found")
+					}
+				}
+			},
+			"/api/event-types": {
+				get: {
+					tags: ["event-types"],
+					summary: "List event types",
+					responses: { "200": jsonRes("Event types", arrayOf("EventType")) }
+				},
+				post: {
+					tags: ["event-types"],
+					summary: "Create (upsert) an event type",
+					requestBody: jsonBody(ref("EventType")),
+					responses: {
+						"201": okRef("EventType", "Created"),
+						"422": errorRes("Validation error")
+					}
+				}
+			},
+			"/api/event-types/{name}": {
+				parameters: [{
+					name: "name",
+					in: "path",
+					required: true,
+					schema: { type: "string" }
+				}],
+				get: {
+					tags: ["event-types"],
+					summary: "Get an event type",
+					responses: {
+						"200": okRef("EventType"),
+						"404": errorRes("Not found")
+					}
+				},
+				put: {
+					tags: ["event-types"],
+					summary: "Update an event type",
+					requestBody: jsonBody(ref("EventType")),
+					responses: {
+						"200": okRef("EventType", "Updated"),
+						"422": errorRes("Validation error")
+					}
+				},
+				delete: {
+					tags: ["event-types"],
+					summary: "Delete an event type (endpoints referencing it stop matching)",
+					responses: {
+						"200": jsonRes("Deleted", { type: "object" }),
+						"404": errorRes("Not found")
+					}
+				}
+			},
+			"/api/applications/{app}/endpoints": {
+				parameters: [APP],
+				get: {
+					tags: ["endpoints"],
+					summary: "List endpoints (secrets stripped)",
+					responses: { "200": jsonRes("Endpoints", arrayOf("Endpoint")) }
+				},
+				post: {
+					tags: ["endpoints"],
+					summary: "Create an endpoint — the response includes the signing secret ONCE",
+					requestBody: jsonBody({
+						type: "object",
+						required: ["url"],
+						properties: {
+							url: { type: "string" },
+							description: { type: "string" },
+							eventTypes: {
+								type: "array",
+								items: { type: "string" }
+							},
+							headers: {
+								type: "object",
+								additionalProperties: { type: "string" }
+							},
+							metadata: {},
+							disabled: { type: "boolean" }
+						}
+					}),
+					responses: {
+						"201": okRef("Endpoint", "Created (includes secrets)"),
+						"422": errorRes("Validation error")
+					}
+				}
+			},
+			[endpointPath]: {
+				parameters: [APP, ID],
+				get: {
+					tags: ["endpoints"],
+					summary: "Get an endpoint (secrets stripped)",
+					responses: {
+						"200": okRef("Endpoint"),
+						"404": errorRes("Not found")
+					}
+				},
+				put: {
+					tags: ["endpoints"],
+					summary: "Update an endpoint",
+					requestBody: jsonBody({
+						type: "object",
+						properties: {
+							url: { type: "string" },
+							description: { type: "string" },
+							eventTypes: {
+								type: "array",
+								items: { type: "string" }
+							},
+							headers: {
+								type: "object",
+								additionalProperties: { type: "string" }
+							},
+							metadata: {}
+						}
+					}),
+					responses: {
+						"200": okRef("Endpoint", "Updated"),
+						"404": errorRes("Not found"),
+						"422": errorRes("Validation error")
+					}
+				},
+				delete: {
+					tags: ["endpoints"],
+					summary: "Delete an endpoint",
+					responses: {
+						"200": jsonRes("Deleted", { type: "object" }),
+						"404": errorRes("Not found")
+					}
+				}
+			},
+			[`${endpointPath}/secret`]: {
+				parameters: [APP, ID],
+				get: {
+					tags: ["endpoints"],
+					summary: "Read the endpoint's signing secrets (current first)",
+					responses: {
+						"200": jsonRes("Secrets", arrayOf("EndpointSecret")),
+						"404": errorRes("Not found")
+					}
+				}
+			},
+			[`${endpointPath}/rotate-secret`]: {
+				parameters: [APP, ID],
+				post: {
+					tags: ["endpoints"],
+					summary: "Mint a new secret; the previous one keeps signing through the grace window",
+					responses: {
+						"200": okRef("Endpoint", "Rotated (includes secrets)"),
+						"404": errorRes("Not found")
+					}
+				}
+			},
+			[`${endpointPath}/enable`]: {
+				parameters: [APP, ID],
+				post: {
+					tags: ["endpoints"],
+					summary: "Enable a disabled endpoint (delivery resumes)",
+					responses: {
+						"200": okRef("Endpoint", "Enabled"),
+						"404": errorRes("Not found")
+					}
+				}
+			},
+			[`${endpointPath}/disable`]: {
+				parameters: [APP, ID],
+				post: {
+					tags: ["endpoints"],
+					summary: "Disable an endpoint (pending deliveries are held, not failed)",
+					responses: {
+						"200": okRef("Endpoint", "Disabled"),
+						"404": errorRes("Not found")
+					}
+				}
+			},
+			[`${endpointPath}/test`]: {
+				parameters: [APP, ID],
+				post: {
+					tags: ["endpoints"],
+					summary: "Fire a one-off signed example delivery (not retained as a message)",
+					requestBody: jsonBody({
+						type: "object",
+						required: ["eventType"],
+						properties: {
+							eventType: { type: "string" },
+							payload: {}
+						}
+					}),
+					responses: {
+						"200": jsonRes("Attempt outcome", { type: "object" }),
+						"404": errorRes("Not found")
+					}
+				}
+			},
+			[`${endpointPath}/recover`]: {
+				parameters: [APP, ID],
+				post: {
+					tags: ["deliveries"],
+					summary: "Re-queue every failed delivery for this endpoint since a timestamp",
+					requestBody: jsonBody({
+						type: "object",
+						required: ["since"],
+						properties: { since: {
+							type: "string",
+							format: "date-time"
+						} }
+					}),
+					responses: {
+						"200": okRef("RecoverResult", "Re-queued delivery ids"),
+						"404": errorRes("Not found")
+					}
+				}
+			},
+			"/api/applications/{app}/messages": {
+				parameters: [APP],
+				get: {
+					tags: ["messages"],
+					summary: "List messages (newest first)",
+					parameters: [
+						{
+							name: "eventType",
+							in: "query",
+							required: false,
+							schema: { type: "string" }
+						},
+						{
+							name: "limit",
+							in: "query",
+							required: false,
+							schema: { type: "integer" }
+						},
+						{
+							name: "before",
+							in: "query",
+							required: false,
+							schema: { type: "string" }
+						}
+					],
+					responses: { "200": jsonRes("Messages", arrayOf("Message")) }
+				},
+				post: {
+					tags: ["messages"],
+					summary: "Publish a message (fan-out to matching endpoints; the ingest route)",
+					description: "Honors an `idempotency-key` header OR a body `idempotencyKey` field (the header wins). A deduplicated publish answers 200 with the original message.",
+					parameters: [{
+						name: "idempotency-key",
+						in: "header",
+						required: false,
+						schema: { type: "string" }
+					}],
+					requestBody: jsonBody({
+						type: "object",
+						required: ["eventType", "payload"],
+						properties: {
+							eventType: { type: "string" },
+							payload: {},
+							timestamp: {
+								type: "string",
+								format: "date-time"
+							},
+							idempotencyKey: { type: "string" }
+						}
+					}),
+					responses: {
+						"200": okRef("PublishResult", "Deduplicated (existing message)"),
+						"201": okRef("PublishResult", "Published"),
+						"409": errorRes("Idempotency key reused with a different payload"),
+						"413": errorRes("Payload too large"),
+						"422": errorRes("Validation error")
+					}
+				}
+			},
+			"/api/applications/{app}/messages/{id}": {
+				parameters: [APP, ID],
+				get: {
+					tags: ["messages"],
+					summary: "Get a message with its deliveries",
+					responses: {
+						"200": jsonRes("Message + deliveries", {
+							allOf: [ref("Message")],
+							properties: { deliveries: arrayOf("Delivery") }
+						}),
+						"404": errorRes("Not found")
+					}
+				}
+			},
+			"/api/applications/{app}/deliveries": {
+				parameters: [APP],
+				get: {
+					tags: ["deliveries"],
+					summary: "List deliveries (newest first)",
+					parameters: [
+						{
+							name: "status",
+							in: "query",
+							required: false,
+							schema: {
+								type: "string",
+								enum: [
+									"pending",
+									"delivering",
+									"succeeded",
+									"failed"
+								]
+							}
+						},
+						{
+							name: "endpoint",
+							in: "query",
+							required: false,
+							schema: { type: "string" }
+						},
+						{
+							name: "limit",
+							in: "query",
+							required: false,
+							schema: { type: "integer" }
+						},
+						{
+							name: "before",
+							in: "query",
+							required: false,
+							schema: { type: "string" }
+						}
+					],
+					responses: { "200": jsonRes("Deliveries", arrayOf("Delivery")) }
+				}
+			},
+			"/api/applications/{app}/deliveries/{id}": {
+				parameters: [APP, ID],
+				get: {
+					tags: ["deliveries"],
+					summary: "Get a delivery with its attempt timeline",
+					responses: {
+						"200": jsonRes("Delivery + attempts", {
+							allOf: [ref("Delivery")],
+							properties: { attempts: arrayOf("DeliveryAttempt") }
+						}),
+						"404": errorRes("Not found")
+					}
+				}
+			},
+			"/api/applications/{app}/deliveries/{id}/retry": {
+				parameters: [APP, ID],
+				post: {
+					tags: ["deliveries"],
+					summary: "Re-queue a dead-lettered delivery",
+					responses: {
+						"200": okRef("Delivery", "Re-queued"),
+						"404": errorRes("Not found"),
+						"422": errorRes("Delivery is not in the failed state")
+					}
+				}
+			},
+			"/api/applications/{app}/audit": {
+				parameters: [APP],
+				get: {
+					tags: ["audit"],
+					summary: "List audit entries (newest first)",
+					responses: { "200": jsonRes("Audit", arrayOf("AuditEntry")) }
+				}
+			}
+		},
+		components: {
+			schemas,
+			securitySchemes: {
+				basicAuth: {
+					type: "http",
+					scheme: "basic"
+				},
+				bearerAuth: {
+					type: "http",
+					scheme: "bearer",
+					description: "Portal tokens (whpt_…) or host-issued bearer credentials."
+				}
+			}
+		}
+	};
+}
+//#endregion
+//#region src/server/render-index-html.ts
+/**
+* Renders the SPA `index.html`: injects a `<base>` tag so relative asset URLs
+* resolve under any mount path, and a bootstrap `window.__WEBHOOKS_CONFIG__`
+* blob. Falls back to a minimal built-in page when the UI bundle is absent
+* (e.g. before `bun run build:ui`, or in headless tests).
+*
+* @module
+*/
+const escapeJson = (value) => JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e");
+/** Build the `<base href>` value (always ends in `/`). */
+function baseHref(basePath) {
+	return basePath === "" ? "/" : `${basePath}/`;
+}
+function injectInto(html, config) {
+	const tags = `<base href="${baseHref(config.basePath)}"><script>window.__WEBHOOKS_CONFIG__=${escapeJson(config)}<\/script>`;
+	if (html.includes("<head>")) return html.replace("<head>", `<head>${tags}`);
+	return tags + html;
+}
+/** Minimal page served when no built UI is present. */
+function fallbackHtml(config) {
+	return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><base href="${baseHref(config.basePath)}"><title>${config.title}</title><script>window.__WEBHOOKS_CONFIG__=${escapeJson(config)}<\/script></head><body style="font-family:system-ui;margin:0;padding:3rem;background:#0a0a0a;color:#e5e5e5"><h1 style="margin:0 0 .5rem">${config.title}</h1><p style="color:#a3a3a3">The admin UI bundle is not built. Run <code style="background:#1a1a1a;padding:2px 6px;border-radius:4px">bun run build:ui</code>. The JSON API at <code style="background:#1a1a1a;padding:2px 6px;border-radius:4px">api/</code> is fully available.</p></body></html>`;
+}
+/** Read, inject into, and return the SPA index HTML (or a fallback). */
+async function renderIndexHtml(uiDir, config) {
+	try {
+		return injectInto(await (0, node_fs_promises.readFile)((0, node_path.join)(uiDir, "index.html"), "utf8"), config);
+	} catch {
+		return fallbackHtml(config);
+	}
+}
+//#endregion
+//#region src/server/routes.ts
+/**
+* The default portal grant: manage own endpoints (including secrets), inspect
+* own messages/deliveries, retry, and read the event-type catalog.
+*/
+const DEFAULT_PORTAL_ACTIONS = [
+	"endpoint:read",
+	"endpoint:create",
+	"endpoint:update",
+	"endpoint:delete",
+	"endpoint:rotate-secret",
+	"endpoint:read-secret",
+	"message:read",
+	"delivery:read",
+	"delivery:retry",
+	"event-type:read"
+];
+const json = (data, status = 200) => new Response(JSON.stringify(data), {
+	status,
+	headers: { "content-type": "application/json; charset=utf-8" }
+});
+const error = (status, message, extra) => json({
+	error: message,
+	...extra
+}, status);
+/** Match `pattern` (with `:name` segments) against `path`. */
+function match(pattern, path) {
+	const pp = pattern.split("/").filter(Boolean);
+	const ap = path.split("/").filter(Boolean);
+	if (pp.length !== ap.length) return null;
+	const params = {};
+	for (let i = 0; i < pp.length; i++) {
+		const seg = pp[i];
+		const val = ap[i];
+		if (seg.startsWith(":")) params[seg.slice(1)] = decodeURIComponent(val);
+		else if (seg !== val) return null;
+	}
+	return { params };
+}
+/**
+* An endpoint as served by read routes: secrets stripped. The secret is
+* returned exactly once at mint time (create / rotate); afterwards it is only
+* reachable through the dedicated `/secret` route gated by
+* `endpoint:read-secret`.
+*/
+function withoutSecrets(endpoint) {
+	const { secrets: _secrets, ...rest } = endpoint;
+	return rest;
+}
+/** Build the audit {@link Actor} for a principal. */
+function actorFor(principal) {
+	return {
+		id: principal.id,
+		...principal.email !== void 0 ? { email: principal.email } : {},
+		...principal.name !== void 0 ? { name: principal.name } : {}
+	};
+}
+/** Parse a positive-integer query param, or `undefined`. */
+function intParam(value) {
+	if (value === null) return void 0;
+	const n = Number(value);
+	return Number.isFinite(n) && n > 0 ? Math.floor(n) : void 0;
+}
+/**
+* Handle an API request. `path` is already base-path-stripped. Returns a
+* `Response` for API/config routes, or `null` if the path is not an API route.
+*/
+async function handleApiRequest(request, path, ctx) {
+	if (!(path === "/config" || path === "/api/config" || path === "/openapi.json" || path.startsWith("/api/"))) return null;
+	const method = request.method.toUpperCase();
+	if (path === "/api/openapi.json" || path === "/openapi.json") return json(buildOpenApiDocument({
+		basePath: ctx.basePath,
+		title: ctx.title
+	}));
+	if (path === "/api/event-types.json") return new Response(JSON.stringify(await ctx.core.listEventTypes()), {
+		status: 200,
+		headers: {
+			"content-type": "application/json; charset=utf-8",
+			"access-control-allow-origin": "*"
+		}
+	});
+	let principal = null;
+	let portalScope = null;
+	const bearer = request.headers.get("authorization");
+	if (ctx.portal && bearer?.startsWith(`Bearer whpt_`)) try {
+		const { applicationKey } = await verifyPortalToken(ctx.portal.secret, bearer.slice(7));
+		principal = {
+			id: `portal:${applicationKey}`,
+			metadata: {
+				portal: true,
+				applicationKey
+			}
+		};
+		portalScope = {
+			applicationKey,
+			allow: new Set(ctx.portal.allow ?? DEFAULT_PORTAL_ACTIONS)
+		};
+	} catch (err) {
+		return mapError(err);
+	}
+	else try {
+		principal = await ctx.auth.authenticate(request);
+	} catch (err) {
+		return mapError(err);
+	}
+	if (path === "/config" || path === "/api/config") return json({
+		title: ctx.title,
+		basePath: ctx.basePath,
+		readonly: ctx.readonly,
+		authenticated: principal !== null,
+		principal: principal ? {
+			id: principal.id,
+			email: principal.email,
+			name: principal.name,
+			roles: principal.roles
+		} : null,
+		portal: portalScope !== null,
+		logoUrl: ctx.logoUrl
+	});
+	if (principal === null) return ctx.auth.challenge?.(request) ?? error(401, "Unauthorized");
+	const authorize = async (action, resource) => {
+		if (portalScope) {
+			if (!portalScope.allow.has(action)) return error(403, "Forbidden", { action });
+			if (resource.type === "event-type") {
+				if (action !== "event-type:read") return error(403, "Forbidden", { action });
+				return null;
+			}
+			if (resource.applicationKey !== portalScope.applicationKey) return error(403, "Forbidden", { action });
+			return null;
+		}
+		return await ctx.authorization.authorize({
+			principal,
+			action,
+			resource,
+			request
+		}) ? null : error(403, "Forbidden", { action });
+	};
+	const actor = actorFor(principal);
+	const body = async () => await request.json();
+	try {
+		if (path === "/api/applications") {
+			if (method === "GET") {
+				const denied = await authorize("application:read", {
+					type: "application",
+					applicationKey: "*"
+				});
+				if (denied) return denied;
+				return json(await ctx.core.listApplications());
+			}
+			if (method === "POST") {
+				const input = await body();
+				const denied = await authorize("application:create", {
+					type: "application",
+					applicationKey: input.key
+				});
+				if (denied) return denied;
+				return json(await ctx.core.createApplication(input, { actor }), 201);
+			}
+		}
+		let m = match("/api/applications/:app", path);
+		if (m) {
+			const app = m.params.app;
+			const resource = {
+				type: "application",
+				applicationKey: app
+			};
+			if (method === "GET") {
+				const denied = await authorize("application:read", resource);
+				if (denied) return denied;
+				const application = await ctx.core.getApplication(app);
+				return application ? json(application) : error(404, `application "${app}" not found`);
+			}
+			if (method === "PUT") {
+				const patch = await body();
+				const denied = await authorize("application:update", resource);
+				if (denied) return denied;
+				return json(await ctx.core.updateApplication(app, patch, { actor }));
+			}
+			if (method === "DELETE") {
+				const denied = await authorize("application:delete", resource);
+				if (denied) return denied;
+				await ctx.core.deleteApplication(app, { actor });
+				return json({ ok: true });
+			}
+		}
+		if (path === "/api/event-types") {
+			if (method === "GET") {
+				const denied = await authorize("event-type:read", {
+					type: "event-type",
+					name: "*"
+				});
+				if (denied) return denied;
+				return json(await ctx.core.listEventTypes());
+			}
+			if (method === "POST") {
+				const input = await body();
+				const denied = await authorize("event-type:create", {
+					type: "event-type",
+					name: input.name
+				});
+				if (denied) return denied;
+				return json(await ctx.core.upsertEventType(input, { actor }), 201);
+			}
+		}
+		m = match("/api/event-types/:name", path);
+		if (m) {
+			const name = m.params.name;
+			const resource = {
+				type: "event-type",
+				name
+			};
+			if (method === "GET") {
+				const denied = await authorize("event-type:read", resource);
+				if (denied) return denied;
+				const eventType = await ctx.core.getEventType(name);
+				return eventType ? json(eventType) : error(404, `event type "${name}" not found`);
+			}
+			if (method === "PUT") {
+				const input = await body();
+				const denied = await authorize("event-type:update", resource);
+				if (denied) return denied;
+				return json(await ctx.core.upsertEventType({
+					...input,
+					name
+				}, { actor }));
+			}
+			if (method === "DELETE") {
+				const denied = await authorize("event-type:delete", resource);
+				if (denied) return denied;
+				await ctx.core.deleteEventType(name, { actor });
+				return json({ ok: true });
+			}
+		}
+		m = match("/api/applications/:app/endpoints", path);
+		if (m) {
+			const app = m.params.app;
+			if (method === "GET") {
+				const denied = await authorize("endpoint:read", {
+					type: "endpoint",
+					applicationKey: app,
+					endpointId: "*"
+				});
+				if (denied) return denied;
+				return json((await ctx.core.listEndpoints(app)).map(withoutSecrets));
+			}
+			if (method === "POST") {
+				const input = await body();
+				const denied = await authorize("endpoint:create", {
+					type: "endpoint",
+					applicationKey: app,
+					endpointId: "*"
+				});
+				if (denied) return denied;
+				return json(await ctx.core.createEndpoint(app, input, { actor }), 201);
+			}
+		}
+		m = match("/api/applications/:app/endpoints/:id", path);
+		if (m) {
+			const app = m.params.app;
+			const id = m.params.id;
+			const resource = {
+				type: "endpoint",
+				applicationKey: app,
+				endpointId: id
+			};
+			if (method === "GET") {
+				const denied = await authorize("endpoint:read", resource);
+				if (denied) return denied;
+				const endpoint = await ctx.core.getEndpoint(app, id);
+				return endpoint ? json(withoutSecrets(endpoint)) : error(404, `endpoint "${id}" not found`);
+			}
+			if (method === "PUT") {
+				const patch = await body();
+				const denied = await authorize("endpoint:update", resource);
+				if (denied) return denied;
+				return json(withoutSecrets(await ctx.core.updateEndpoint(app, id, patch, { actor })));
+			}
+			if (method === "DELETE") {
+				const denied = await authorize("endpoint:delete", resource);
+				if (denied) return denied;
+				await ctx.core.deleteEndpoint(app, id, { actor });
+				return json({ ok: true });
+			}
+		}
+		m = match("/api/applications/:app/endpoints/:id/secret", path);
+		if (m && method === "GET") {
+			const app = m.params.app;
+			const id = m.params.id;
+			const denied = await authorize("endpoint:read-secret", {
+				type: "endpoint",
+				applicationKey: app,
+				endpointId: id
+			});
+			if (denied) return denied;
+			return json(await ctx.core.getSecrets(app, id));
+		}
+		m = match("/api/applications/:app/endpoints/:id/rotate-secret", path);
+		if (m && method === "POST") {
+			const app = m.params.app;
+			const id = m.params.id;
+			const denied = await authorize("endpoint:rotate-secret", {
+				type: "endpoint",
+				applicationKey: app,
+				endpointId: id
+			});
+			if (denied) return denied;
+			return json(await ctx.core.rotateSecret(app, id, { actor }));
+		}
+		m = match("/api/applications/:app/endpoints/:id/enable", path);
+		if (m && method === "POST") {
+			const app = m.params.app;
+			const id = m.params.id;
+			const denied = await authorize("endpoint:update", {
+				type: "endpoint",
+				applicationKey: app,
+				endpointId: id
+			});
+			if (denied) return denied;
+			return json(withoutSecrets(await ctx.core.enableEndpoint(app, id, { actor })));
+		}
+		m = match("/api/applications/:app/endpoints/:id/disable", path);
+		if (m && method === "POST") {
+			const app = m.params.app;
+			const id = m.params.id;
+			const denied = await authorize("endpoint:update", {
+				type: "endpoint",
+				applicationKey: app,
+				endpointId: id
+			});
+			if (denied) return denied;
+			return json(withoutSecrets(await ctx.core.disableEndpoint(app, id, { actor })));
+		}
+		m = match("/api/applications/:app/endpoints/:id/test", path);
+		if (m && method === "POST") {
+			const app = m.params.app;
+			const id = m.params.id;
+			const denied = await authorize("endpoint:update", {
+				type: "endpoint",
+				applicationKey: app,
+				endpointId: id
+			});
+			if (denied) return denied;
+			const input = await body();
+			return json(await ctx.core.sendExample(app, id, input, { actor }));
+		}
+		m = match("/api/applications/:app/endpoints/:id/recover", path);
+		if (m && method === "POST") {
+			const app = m.params.app;
+			const id = m.params.id;
+			const denied = await authorize("delivery:retry", {
+				type: "delivery",
+				applicationKey: app
+			});
+			if (denied) return denied;
+			const input = await body();
+			return json(await ctx.core.recoverEndpoint(app, id, input, { actor }));
+		}
+		m = match("/api/applications/:app/messages", path);
+		if (m) {
+			const app = m.params.app;
+			if (method === "GET") {
+				const denied = await authorize("message:read", {
+					type: "message",
+					applicationKey: app
+				});
+				if (denied) return denied;
+				const url = new URL(request.url);
+				const eventType = url.searchParams.get("eventType") ?? void 0;
+				const before = url.searchParams.get("before") ?? void 0;
+				const limit = intParam(url.searchParams.get("limit"));
+				return json(await ctx.core.listMessages(app, {
+					...eventType !== void 0 ? { eventType } : {},
+					...before !== void 0 ? { before } : {},
+					...limit !== void 0 ? { limit } : {}
+				}));
+			}
+			if (method === "POST") {
+				const input = await body();
+				const denied = await authorize("message:publish", {
+					type: "message",
+					applicationKey: app
+				});
+				if (denied) return denied;
+				const idempotencyKey = request.headers.get("idempotency-key") ?? input.idempotencyKey;
+				const result = await ctx.core.publish(app, {
+					eventType: input.eventType,
+					payload: input.payload,
+					...input.timestamp !== void 0 ? { timestamp: input.timestamp } : {},
+					...idempotencyKey !== void 0 ? { idempotencyKey } : {}
+				}, { actor });
+				return json(result, result.deduplicated ? 200 : 201);
+			}
+		}
+		m = match("/api/applications/:app/messages/:id", path);
+		if (m && method === "GET") {
+			const app = m.params.app;
+			const id = m.params.id;
+			const denied = await authorize("message:read", {
+				type: "message",
+				applicationKey: app,
+				messageId: id
+			});
+			if (denied) return denied;
+			const message = await ctx.core.getMessage(app, id);
+			if (!message) return error(404, `message "${id}" not found`);
+			const deliveries = await ctx.core.listDeliveries(app, { messageId: id });
+			return json({
+				...message,
+				deliveries
+			});
+		}
+		m = match("/api/applications/:app/deliveries", path);
+		if (m && method === "GET") {
+			const app = m.params.app;
+			const denied = await authorize("delivery:read", {
+				type: "delivery",
+				applicationKey: app
+			});
+			if (denied) return denied;
+			const url = new URL(request.url);
+			const status = url.searchParams.get("status") ?? void 0;
+			const endpointId = url.searchParams.get("endpoint") ?? void 0;
+			const before = url.searchParams.get("before") ?? void 0;
+			const limit = intParam(url.searchParams.get("limit"));
+			return json(await ctx.core.listDeliveries(app, {
+				...status !== void 0 ? { status } : {},
+				...endpointId !== void 0 ? { endpointId } : {},
+				...before !== void 0 ? { before } : {},
+				...limit !== void 0 ? { limit } : {}
+			}));
+		}
+		m = match("/api/applications/:app/deliveries/:id", path);
+		if (m && method === "GET") {
+			const app = m.params.app;
+			const id = m.params.id;
+			const denied = await authorize("delivery:read", {
+				type: "delivery",
+				applicationKey: app,
+				deliveryId: id
+			});
+			if (denied) return denied;
+			const found = await ctx.core.getDelivery(app, id);
+			if (!found) return error(404, `delivery "${id}" not found`);
+			return json({
+				...found.delivery,
+				attempts: found.attempts
+			});
+		}
+		m = match("/api/applications/:app/deliveries/:id/request", path);
+		if (m && method === "GET") {
+			const app = m.params.app;
+			const id = m.params.id;
+			const denied = await authorize("delivery:read", {
+				type: "delivery",
+				applicationKey: app,
+				deliveryId: id
+			});
+			if (denied) return denied;
+			const preview = await ctx.core.previewDeliveryRequest(app, id);
+			if (!preview) return error(404, `delivery "${id}" not found (or its endpoint was deleted)`);
+			return json(preview);
+		}
+		m = match("/api/applications/:app/deliveries/:id/retry", path);
+		if (m && method === "POST") {
+			const app = m.params.app;
+			const id = m.params.id;
+			const denied = await authorize("delivery:retry", {
+				type: "delivery",
+				applicationKey: app,
+				deliveryId: id
+			});
+			if (denied) return denied;
+			return json(await ctx.core.retryDelivery(app, id, { actor }));
+		}
+		m = match("/api/applications/:app/audit", path);
+		if (m && method === "GET") {
+			const app = m.params.app;
+			const denied = await authorize("audit:read", {
+				type: "audit",
+				applicationKey: app
+			});
+			if (denied) return denied;
+			return json(await ctx.core.listAudit(app));
+		}
+		return error(404, "Not found");
+	} catch (err) {
+		return mapError(err);
+	}
+}
+/**
+* Cross-bundle error detection: `instanceof` first, `err.name` fallback. An
+* error thrown from a separate subpath bundle carries its own copy of the
+* class, so `instanceof` alone would mis-map it to 500.
+*/
+function isNamed(err, ctor, name) {
+	return err instanceof ctor || err instanceof Error && err.name === name;
+}
+/**
+* A hook denial, detected by `name` rather than `instanceof`: a hook thrown from
+* a separate subpath bundle carries its own copy of the `HookDeniedError` class,
+* so `instanceof` would miss it and mis-map the denial to 500. Returns the
+* status to respond with, or `null` if not a denial.
+*/
+function hookDeniedStatus(err) {
+	if (err instanceof require_core.HookDeniedError) return err.status;
+	if (err instanceof Error && err.name === "HookDeniedError") {
+		const status = err.status;
+		return typeof status === "number" ? status : 403;
+	}
+	return null;
+}
+/** Map domain errors to HTTP responses. */
+function mapError(err) {
+	if (isNamed(err, require_core.ReadonlyError, "ReadonlyError")) return error(403, err.message, { code: "READONLY" });
+	const denied = hookDeniedStatus(err);
+	if (denied !== null) return error(denied, err.message, { code: "HOOK_DENIED" });
+	if (isNamed(err, PortalTokenError, "PortalTokenError")) return error(401, err.message, { code: "PORTAL_TOKEN" });
+	if (isNamed(err, require_core.NotFoundError, "NotFoundError")) return error(404, err.message);
+	if (isNamed(err, require_core.IdempotencyConflictError, "IdempotencyConflictError")) return error(409, err.message, { code: "IDEMPOTENCY_CONFLICT" });
+	if (isNamed(err, require_core.ConflictError, "ConflictError")) return error(409, err.message, { code: "CONFLICT" });
+	if (isNamed(err, require_core.PayloadTooLargeError, "PayloadTooLargeError")) return error(413, err.message, { code: "PAYLOAD_TOO_LARGE" });
+	if (isNamed(err, require_core.ValidationError, "ValidationError")) {
+		const errors = err.errors;
+		return error(422, err.message, {
+			code: "VALIDATION",
+			errors: Array.isArray(errors) ? errors : []
+		});
+	}
+	if (err instanceof SyntaxError) return error(400, "Invalid JSON body");
+	return error(500, err instanceof Error ? err.message : "Internal error");
+}
+//#endregion
+//#region src/server/static-assets.ts
+/**
+* Serves the bundled SPA's static assets from the UI output directory. Maps file
+* extensions to content types and guards against path traversal.
+*
+* @module
+*/
+const CONTENT_TYPES = {
+	".html": "text/html; charset=utf-8",
+	".js": "text/javascript; charset=utf-8",
+	".mjs": "text/javascript; charset=utf-8",
+	".css": "text/css; charset=utf-8",
+	".json": "application/json; charset=utf-8",
+	".svg": "image/svg+xml",
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".gif": "image/gif",
+	".webp": "image/webp",
+	".ico": "image/x-icon",
+	".woff": "font/woff",
+	".woff2": "font/woff2",
+	".ttf": "font/ttf",
+	".map": "application/json; charset=utf-8",
+	".txt": "text/plain; charset=utf-8"
+};
+function contentType(path) {
+	const dot = path.lastIndexOf(".");
+	return CONTENT_TYPES[dot >= 0 ? path.slice(dot).toLowerCase() : ""] ?? "application/octet-stream";
+}
+/** True if the path has a file extension (so a miss should 404 rather than fall through to the SPA). */
+function looksLikeAsset(path) {
+	return (path.split("/").pop() ?? "").includes(".");
+}
+/**
+* Try to serve `path` (base-path-stripped, leading `/`) as a static file from
+* `uiDir`. Returns a `Response`, or `null` if the file does not exist.
+*/
+async function serveStaticAsset(uiDir, path) {
+	const rel = (0, node_path.normalize)(path).replace(/^(\.\.(\/|\\|$))+/, "");
+	const full = (0, node_path.join)(uiDir, rel);
+	if (!full.startsWith((0, node_path.normalize)(uiDir))) return null;
+	try {
+		const data = await (0, node_fs_promises.readFile)(full);
+		return new Response(new Uint8Array(data), {
+			status: 200,
+			headers: {
+				"content-type": contentType(full),
+				"cache-control": rel.includes("/assets/") ? "public, max-age=31536000, immutable" : "no-cache"
+			}
+		});
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/server/create-fetch-handler.ts
+/**
+* The web-standard fetch handler at the heart of every framework adapter and the
+* standalone app. Composes auth/authorization (plus portal-token scoping), the
+* JSON admin API, static-asset serving, and SPA fallback into a single
+* `(request: Request) => Promise<Response>` — and, by default, starts the
+* in-process delivery dispatcher so mounting the panel is all it takes to
+* deliver webhooks.
+*
+* @module
+*/
+var create_fetch_handler_exports = /* @__PURE__ */ require_keys.__exportAll({ createFetchHandler: () => createFetchHandler });
+const defaultAuth = { authenticate: async () => ({ id: "anonymous" }) };
+const defaultAuthorization = { authorize: async () => true };
+/**
+* Locate the built admin SPA (`dist/ui`). When this module runs compiled (the
+* normal npm-consumer case) it lives in `dist/` and the bundle is the sibling
+* `./ui`. When it runs from TypeScript source (examples / dev against a
+* `file:`-linked checkout, where the runtime executes `src/server/*.ts`
+* directly), the bundle is instead at `<repo>/dist/ui` — i.e. `../../dist/ui`
+* relative to `src/server/`. Try the candidates and return the first that
+* exists, falling back to the compiled-layout path so the "build the UI" hint
+* still fires when nothing is built yet.
+*/
+function defaultUiDir() {
+	try {
+		const candidates = [new URL("./ui", require("url").pathToFileURL(__filename).href), new URL("../../dist/ui", require("url").pathToFileURL(__filename).href)].map((u) => (0, node_url.fileURLToPath)(u));
+		return candidates.find((p) => (0, node_fs.existsSync)(p)) ?? candidates[0];
+	} catch {
+		return "./ui";
+	}
+}
+/**
+* Build the panel fetch handler.
+*
+* @example
+* ```ts
+* import { createFetchHandler } from "@xtandard/webhooks";
+* import { createFileStorage } from "@xtandard/webhooks/storage/file";
+*
+* const storage = createFileStorage({ dir: "./data/webhooks" });
+* const { fetch, core } = createFetchHandler({
+*   storage,
+*   basePath: "/webhooks",
+*   title: "Acme Webhooks",
+* });
+*
+* Bun.serve({ port: 3000, fetch });
+* // Elsewhere in the app:
+* await core.publish("acme", { eventType: "invoice.paid", payload: { id: "inv_1" } });
+* ```
+*/
+function createFetchHandler(options) {
+	const basePath = normalizeBasePath(options.basePath);
+	const readonly = options.readonly ?? false;
+	const title = options.title ?? "@xtandard/webhooks";
+	const uiDir = options.uiDir ?? defaultUiDir();
+	const dispatcherOptions = options.dispatcher === false ? void 0 : options.dispatcher;
+	const core = options.core ?? require_core.createWebhooksCore({
+		storage: options.storage,
+		...options.queueStorage ? { queueStorage: options.queueStorage } : {},
+		readonly,
+		...options.hooks !== void 0 ? { hooks: options.hooks } : {},
+		...options.onHookError ? { onHookError: options.onHookError } : {},
+		...options.retention ? { retention: options.retention } : {},
+		...options.onDelivery ? { onDelivery: options.onDelivery } : {},
+		...options.onDeliveryError ? { onDeliveryError: options.onDeliveryError } : {},
+		...dispatcherOptions ? { dispatcher: dispatcherOptions } : {}
+	});
+	let dispatcher = null;
+	if (options.dispatcher !== false) {
+		const queue = options.queueStorage ?? options.storage;
+		if (queue && !require_contract.hasDeliveryQueue(queue) && !require_contract.isCompareAndSwap(queue)) console.warn("[@xtandard/webhooks] The panel started an in-process dispatcher over storage without atomic claiming (no claimDue/compareAndSwap). If you run more than one instance, deliveries WILL be sent multiple times — set `dispatcher: false` on all but one instance, or use redis/memory storage. See docs/DELIVERY.md.");
+		dispatcher = require_dispatcher.createDispatcher(core, dispatcherOptions ?? {});
+		dispatcher.start();
+	}
+	const apiCtx = {
+		core,
+		auth: options.auth ?? defaultAuth,
+		authorization: options.authorization ?? defaultAuthorization,
+		title,
+		readonly,
+		basePath,
+		...options.logoUrl !== void 0 ? { logoUrl: options.logoUrl } : {},
+		...options.portal ? { portal: options.portal } : {}
+	};
+	const cors = options.cors;
+	async function fetch(request) {
+		if (cors && request.method === "OPTIONS") return preflightResponse(request, cors);
+		const response = await respond(request);
+		return cors ? applyCorsHeaders(request, response, cors) : response;
+	}
+	async function respond(request) {
+		const path = stripBasePath(new URL(request.url).pathname, basePath);
+		const api = await handleApiRequest(request, path, apiCtx);
+		if (api) return api;
+		if (request.method !== "GET" && request.method !== "HEAD") return new Response("Method Not Allowed", { status: 405 });
+		const asset = await serveStaticAsset(uiDir, path);
+		if (asset) return asset;
+		if (path !== "/" && looksLikeAsset(path)) return new Response("Not Found", { status: 404 });
+		const html = await renderIndexHtml(uiDir, {
+			title,
+			basePath,
+			readonly,
+			...options.logoUrl !== void 0 ? { logoUrl: options.logoUrl } : {}
+		});
+		return new Response(html, {
+			status: 200,
+			headers: { "content-type": "text/html; charset=utf-8" }
+		});
+	}
+	return {
+		fetch,
+		core,
+		dispatcher,
+		openapi: () => buildOpenApiDocument({
+			basePath,
+			title
+		})
+	};
+}
+//#endregion
+Object.defineProperty(exports, "DEFAULT_PORTAL_ACTIONS", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_PORTAL_ACTIONS;
+	}
+});
+Object.defineProperty(exports, "PORTAL_TOKEN_PREFIX", {
+	enumerable: true,
+	get: function() {
+		return PORTAL_TOKEN_PREFIX;
+	}
+});
+Object.defineProperty(exports, "PortalTokenError", {
+	enumerable: true,
+	get: function() {
+		return PortalTokenError;
+	}
+});
+Object.defineProperty(exports, "buildOpenApiDocument", {
+	enumerable: true,
+	get: function() {
+		return buildOpenApiDocument;
+	}
+});
+Object.defineProperty(exports, "createFetchHandler", {
+	enumerable: true,
+	get: function() {
+		return createFetchHandler;
+	}
+});
+Object.defineProperty(exports, "createPortalToken", {
+	enumerable: true,
+	get: function() {
+		return createPortalToken;
+	}
+});
+Object.defineProperty(exports, "create_fetch_handler_exports", {
+	enumerable: true,
+	get: function() {
+		return create_fetch_handler_exports;
+	}
+});
+Object.defineProperty(exports, "verifyPortalToken", {
+	enumerable: true,
+	get: function() {
+		return verifyPortalToken;
+	}
+});
+
+//# sourceMappingURL=create-fetch-handler-CmooujQo.cjs.map