@xtandard/webhooks 0.1.0

package/dist/entry-auth-delegated.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-auth-delegated.cjs","names":[],"sources":["../src/auth/delegated.ts"],"sourcesContent":["/**\n * Delegated {@link AuthProvider}. Wraps caller-supplied functions so you can\n * plug in any authentication scheme — JWT/bearer tokens, sessions, API keys,\n * OAuth, an existing middleware — without implementing the {@link AuthProvider}\n * interface by hand.\n *\n * The wrapper normalizes a synchronous-or-asynchronous `authenticate` into the\n * `Promise`-returning shape the contract requires, and forwards an optional\n * `challenge`.\n *\n * @module\n */\n\nimport type { AuthProvider, Principal } from \"./contract.ts\";\n\n/** Options for {@link delegatedAuth}. */\nexport interface DelegatedAuthOptions {\n  /**\n   * Resolve the {@link Principal} for a request, or `null` if unauthenticated.\n   * May be synchronous or asynchronous.\n   */\n  authenticate: (request: Request) => Promise<Principal | null> | Principal | null;\n  /**\n   * Optional challenge builder, mirroring {@link AuthProvider.challenge}. Return\n   * a `Response` (typically a `401`) to prompt for credentials, or `undefined`\n   * to fall back to the server's default.\n   */\n  challenge?: (request: Request) => Response | undefined;\n}\n\n/**\n * Create an {@link AuthProvider} from plain functions.\n *\n * @example\n * ```ts\n * import { delegatedAuth } from \"@xtandard/webhooks/auth/delegated\";\n *\n * const auth = delegatedAuth({\n *   authenticate: async (request) => {\n *     const token = request.headers.get(\"authorization\")?.replace(\"Bearer \", \"\");\n *     return token ? await verifyToken(token) : null;\n *   },\n * });\n * ```\n */\nexport function delegatedAuth(options: DelegatedAuthOptions): AuthProvider {\n  const provider: AuthProvider = {\n    async authenticate(request: Request): Promise<Principal | null> {\n      return await options.authenticate(request);\n    },\n  };\n  if (options.challenge) {\n    provider.challenge = options.challenge;\n  }\n  return provider;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA6CA,SAAgB,cAAc,SAA6C;CACzE,MAAM,WAAyB,EAC7B,MAAM,aAAa,SAA6C;EAC9D,OAAO,MAAM,QAAQ,aAAa,OAAO;CAC3C,EACF;CACA,IAAI,QAAQ,WACV,SAAS,YAAY,QAAQ;CAE/B,OAAO;AACT"}

package/dist/entry-auth-delegated.d.cts

@@ -0,0 +1,36 @@
+import { n as Principal, t as AuthProvider } from "./contract-lETlIuXo.cjs";
+
+//#region src/auth/delegated.d.ts
+/** Options for {@link delegatedAuth}. */
+interface DelegatedAuthOptions {
+  /**
+   * Resolve the {@link Principal} for a request, or `null` if unauthenticated.
+   * May be synchronous or asynchronous.
+   */
+  authenticate: (request: Request) => Promise<Principal | null> | Principal | null;
+  /**
+   * Optional challenge builder, mirroring {@link AuthProvider.challenge}. Return
+   * a `Response` (typically a `401`) to prompt for credentials, or `undefined`
+   * to fall back to the server's default.
+   */
+  challenge?: (request: Request) => Response | undefined;
+}
+/**
+ * Create an {@link AuthProvider} from plain functions.
+ *
+ * @example
+ * ```ts
+ * import { delegatedAuth } from "@xtandard/webhooks/auth/delegated";
+ *
+ * const auth = delegatedAuth({
+ *   authenticate: async (request) => {
+ *     const token = request.headers.get("authorization")?.replace("Bearer ", "");
+ *     return token ? await verifyToken(token) : null;
+ *   },
+ * });
+ * ```
+ */
+declare function delegatedAuth(options: DelegatedAuthOptions): AuthProvider;
+//#endregion
+export { DelegatedAuthOptions, delegatedAuth };
+//# sourceMappingURL=entry-auth-delegated.d.cts.map

package/dist/entry-auth-delegated.d.mts

@@ -0,0 +1,36 @@
+import { n as Principal, t as AuthProvider } from "./contract-lETlIuXo.mjs";
+
+//#region src/auth/delegated.d.ts
+/** Options for {@link delegatedAuth}. */
+interface DelegatedAuthOptions {
+  /**
+   * Resolve the {@link Principal} for a request, or `null` if unauthenticated.
+   * May be synchronous or asynchronous.
+   */
+  authenticate: (request: Request) => Promise<Principal | null> | Principal | null;
+  /**
+   * Optional challenge builder, mirroring {@link AuthProvider.challenge}. Return
+   * a `Response` (typically a `401`) to prompt for credentials, or `undefined`
+   * to fall back to the server's default.
+   */
+  challenge?: (request: Request) => Response | undefined;
+}
+/**
+ * Create an {@link AuthProvider} from plain functions.
+ *
+ * @example
+ * ```ts
+ * import { delegatedAuth } from "@xtandard/webhooks/auth/delegated";
+ *
+ * const auth = delegatedAuth({
+ *   authenticate: async (request) => {
+ *     const token = request.headers.get("authorization")?.replace("Bearer ", "");
+ *     return token ? await verifyToken(token) : null;
+ *   },
+ * });
+ * ```
+ */
+declare function delegatedAuth(options: DelegatedAuthOptions): AuthProvider;
+//#endregion
+export { DelegatedAuthOptions, delegatedAuth };
+//# sourceMappingURL=entry-auth-delegated.d.mts.map

package/dist/entry-auth-delegated.mjs

@@ -0,0 +1,27 @@
+//#region src/auth/delegated.ts
+/**
+* Create an {@link AuthProvider} from plain functions.
+*
+* @example
+* ```ts
+* import { delegatedAuth } from "@xtandard/webhooks/auth/delegated";
+*
+* const auth = delegatedAuth({
+*   authenticate: async (request) => {
+*     const token = request.headers.get("authorization")?.replace("Bearer ", "");
+*     return token ? await verifyToken(token) : null;
+*   },
+* });
+* ```
+*/
+function delegatedAuth(options) {
+	const provider = { async authenticate(request) {
+		return await options.authenticate(request);
+	} };
+	if (options.challenge) provider.challenge = options.challenge;
+	return provider;
+}
+//#endregion
+export { delegatedAuth };
+
+//# sourceMappingURL=entry-auth-delegated.mjs.map

package/dist/entry-auth-delegated.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-auth-delegated.mjs","names":[],"sources":["../src/auth/delegated.ts"],"sourcesContent":["/**\n * Delegated {@link AuthProvider}. Wraps caller-supplied functions so you can\n * plug in any authentication scheme — JWT/bearer tokens, sessions, API keys,\n * OAuth, an existing middleware — without implementing the {@link AuthProvider}\n * interface by hand.\n *\n * The wrapper normalizes a synchronous-or-asynchronous `authenticate` into the\n * `Promise`-returning shape the contract requires, and forwards an optional\n * `challenge`.\n *\n * @module\n */\n\nimport type { AuthProvider, Principal } from \"./contract.ts\";\n\n/** Options for {@link delegatedAuth}. */\nexport interface DelegatedAuthOptions {\n  /**\n   * Resolve the {@link Principal} for a request, or `null` if unauthenticated.\n   * May be synchronous or asynchronous.\n   */\n  authenticate: (request: Request) => Promise<Principal | null> | Principal | null;\n  /**\n   * Optional challenge builder, mirroring {@link AuthProvider.challenge}. Return\n   * a `Response` (typically a `401`) to prompt for credentials, or `undefined`\n   * to fall back to the server's default.\n   */\n  challenge?: (request: Request) => Response | undefined;\n}\n\n/**\n * Create an {@link AuthProvider} from plain functions.\n *\n * @example\n * ```ts\n * import { delegatedAuth } from \"@xtandard/webhooks/auth/delegated\";\n *\n * const auth = delegatedAuth({\n *   authenticate: async (request) => {\n *     const token = request.headers.get(\"authorization\")?.replace(\"Bearer \", \"\");\n *     return token ? await verifyToken(token) : null;\n *   },\n * });\n * ```\n */\nexport function delegatedAuth(options: DelegatedAuthOptions): AuthProvider {\n  const provider: AuthProvider = {\n    async authenticate(request: Request): Promise<Principal | null> {\n      return await options.authenticate(request);\n    },\n  };\n  if (options.challenge) {\n    provider.challenge = options.challenge;\n  }\n  return provider;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6CA,SAAgB,cAAc,SAA6C;CACzE,MAAM,WAAyB,EAC7B,MAAM,aAAa,SAA6C;EAC9D,OAAO,MAAM,QAAQ,aAAa,OAAO;CAC3C,EACF;CACA,IAAI,QAAQ,WACV,SAAS,YAAY,QAAQ;CAE/B,OAAO;AACT"}

package/dist/entry-auth-none.cjs

@@ -0,0 +1,4 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_none = require("./none-CAsxCOWN.cjs");
+exports.ANONYMOUS_PRINCIPAL = require_none.ANONYMOUS_PRINCIPAL;
+exports.noAuth = require_none.noAuth;

package/dist/entry-auth-none.d.cts

@@ -0,0 +1,25 @@
+import { n as Principal, t as AuthProvider } from "./contract-lETlIuXo.cjs";
+
+//#region src/auth/none.d.ts
+/** The fixed principal returned by {@link noAuth}. */
+declare const ANONYMOUS_PRINCIPAL: Principal;
+/**
+ * Create an {@link AuthProvider} that performs no authentication and resolves
+ * every request to the shared {@link ANONYMOUS_PRINCIPAL}.
+ *
+ * Because it never returns `null`, the request is always "authenticated" — use
+ * an {@link AuthorizationProvider} to control what the anonymous principal may
+ * actually do.
+ *
+ * @example
+ * ```ts
+ * import { noAuth } from "@xtandard/webhooks/auth/none";
+ *
+ * const auth = noAuth();
+ * await auth.authenticate(request); // → { id: "anonymous" }
+ * ```
+ */
+declare function noAuth(): AuthProvider;
+//#endregion
+export { ANONYMOUS_PRINCIPAL, noAuth };
+//# sourceMappingURL=entry-auth-none.d.cts.map

package/dist/entry-auth-none.d.mts

@@ -0,0 +1,25 @@
+import { n as Principal, t as AuthProvider } from "./contract-lETlIuXo.mjs";
+
+//#region src/auth/none.d.ts
+/** The fixed principal returned by {@link noAuth}. */
+declare const ANONYMOUS_PRINCIPAL: Principal;
+/**
+ * Create an {@link AuthProvider} that performs no authentication and resolves
+ * every request to the shared {@link ANONYMOUS_PRINCIPAL}.
+ *
+ * Because it never returns `null`, the request is always "authenticated" — use
+ * an {@link AuthorizationProvider} to control what the anonymous principal may
+ * actually do.
+ *
+ * @example
+ * ```ts
+ * import { noAuth } from "@xtandard/webhooks/auth/none";
+ *
+ * const auth = noAuth();
+ * await auth.authenticate(request); // → { id: "anonymous" }
+ * ```
+ */
+declare function noAuth(): AuthProvider;
+//#endregion
+export { ANONYMOUS_PRINCIPAL, noAuth };
+//# sourceMappingURL=entry-auth-none.d.mts.map

package/dist/entry-auth-none.mjs

@@ -0,0 +1,2 @@
+import { n as noAuth, t as ANONYMOUS_PRINCIPAL } from "./none-GhVIoh_s.mjs";
+export { ANONYMOUS_PRINCIPAL, noAuth };

package/dist/entry-authorization-delegated.cjs

@@ -0,0 +1,27 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/authorization/delegated.ts
+/**
+* Create an {@link AuthorizationProvider} from a plain decision function.
+*
+* @example
+* ```ts
+* import { delegatedAuthorization } from "@xtandard/webhooks/authorization/delegated";
+*
+* const authz = delegatedAuthorization({
+*   authorize: ({ principal, action, resource }) =>
+*     resource.type !== "application" ||
+*     (principal?.metadata as { apps?: string[] } | undefined)?.apps?.includes(
+*       resource.applicationKey,
+*     ) === true,
+* });
+* ```
+*/
+function delegatedAuthorization(options) {
+	return { async authorize(input) {
+		return await options.authorize(input);
+	} };
+}
+//#endregion
+exports.delegatedAuthorization = delegatedAuthorization;
+
+//# sourceMappingURL=entry-authorization-delegated.cjs.map

package/dist/entry-authorization-delegated.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-authorization-delegated.cjs","names":[],"sources":["../src/authorization/delegated.ts"],"sourcesContent":["/**\n * Delegated {@link AuthorizationProvider}. Wraps a caller-supplied `authorize`\n * function so you can implement any policy — ABAC, an external policy engine\n * (OPA, Cedar), per-application ownership checks — without implementing the\n * interface by hand.\n *\n * The wrapper normalizes a synchronous-or-asynchronous decision into the\n * `Promise<boolean>` the contract requires.\n *\n * @module\n */\n\nimport type { AuthorizationProvider, AuthorizeInput } from \"./contract.ts\";\n\n/** Options for {@link delegatedAuthorization}. */\nexport interface DelegatedAuthorizationOptions {\n  /**\n   * Decide whether the {@link AuthorizeInput} is permitted. Return `true` to\n   * allow. May be synchronous or asynchronous.\n   */\n  authorize: (input: AuthorizeInput) => Promise<boolean> | boolean;\n}\n\n/**\n * Create an {@link AuthorizationProvider} from a plain decision function.\n *\n * @example\n * ```ts\n * import { delegatedAuthorization } from \"@xtandard/webhooks/authorization/delegated\";\n *\n * const authz = delegatedAuthorization({\n *   authorize: ({ principal, action, resource }) =>\n *     resource.type !== \"application\" ||\n *     (principal?.metadata as { apps?: string[] } | undefined)?.apps?.includes(\n *       resource.applicationKey,\n *     ) === true,\n * });\n * ```\n */\nexport function delegatedAuthorization(\n  options: DelegatedAuthorizationOptions,\n): AuthorizationProvider {\n  return {\n    async authorize(input: AuthorizeInput): Promise<boolean> {\n      return await options.authorize(input);\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAuCA,SAAgB,uBACd,SACuB;CACvB,OAAO,EACL,MAAM,UAAU,OAAyC;EACvD,OAAO,MAAM,QAAQ,UAAU,KAAK;CACtC,EACF;AACF"}

package/dist/entry-authorization-delegated.d.cts

@@ -0,0 +1,31 @@
+import { n as AuthorizeInput, t as AuthorizationProvider } from "./contract-CiPskNvS.cjs";
+
+//#region src/authorization/delegated.d.ts
+/** Options for {@link delegatedAuthorization}. */
+interface DelegatedAuthorizationOptions {
+  /**
+   * Decide whether the {@link AuthorizeInput} is permitted. Return `true` to
+   * allow. May be synchronous or asynchronous.
+   */
+  authorize: (input: AuthorizeInput) => Promise<boolean> | boolean;
+}
+/**
+ * Create an {@link AuthorizationProvider} from a plain decision function.
+ *
+ * @example
+ * ```ts
+ * import { delegatedAuthorization } from "@xtandard/webhooks/authorization/delegated";
+ *
+ * const authz = delegatedAuthorization({
+ *   authorize: ({ principal, action, resource }) =>
+ *     resource.type !== "application" ||
+ *     (principal?.metadata as { apps?: string[] } | undefined)?.apps?.includes(
+ *       resource.applicationKey,
+ *     ) === true,
+ * });
+ * ```
+ */
+declare function delegatedAuthorization(options: DelegatedAuthorizationOptions): AuthorizationProvider;
+//#endregion
+export { DelegatedAuthorizationOptions, delegatedAuthorization };
+//# sourceMappingURL=entry-authorization-delegated.d.cts.map

package/dist/entry-authorization-delegated.d.mts

@@ -0,0 +1,31 @@
+import { n as AuthorizeInput, t as AuthorizationProvider } from "./contract-C2r2Xzwp.mjs";
+
+//#region src/authorization/delegated.d.ts
+/** Options for {@link delegatedAuthorization}. */
+interface DelegatedAuthorizationOptions {
+  /**
+   * Decide whether the {@link AuthorizeInput} is permitted. Return `true` to
+   * allow. May be synchronous or asynchronous.
+   */
+  authorize: (input: AuthorizeInput) => Promise<boolean> | boolean;
+}
+/**
+ * Create an {@link AuthorizationProvider} from a plain decision function.
+ *
+ * @example
+ * ```ts
+ * import { delegatedAuthorization } from "@xtandard/webhooks/authorization/delegated";
+ *
+ * const authz = delegatedAuthorization({
+ *   authorize: ({ principal, action, resource }) =>
+ *     resource.type !== "application" ||
+ *     (principal?.metadata as { apps?: string[] } | undefined)?.apps?.includes(
+ *       resource.applicationKey,
+ *     ) === true,
+ * });
+ * ```
+ */
+declare function delegatedAuthorization(options: DelegatedAuthorizationOptions): AuthorizationProvider;
+//#endregion
+export { DelegatedAuthorizationOptions, delegatedAuthorization };
+//# sourceMappingURL=entry-authorization-delegated.d.mts.map

package/dist/entry-authorization-delegated.mjs

@@ -0,0 +1,26 @@
+//#region src/authorization/delegated.ts
+/**
+* Create an {@link AuthorizationProvider} from a plain decision function.
+*
+* @example
+* ```ts
+* import { delegatedAuthorization } from "@xtandard/webhooks/authorization/delegated";
+*
+* const authz = delegatedAuthorization({
+*   authorize: ({ principal, action, resource }) =>
+*     resource.type !== "application" ||
+*     (principal?.metadata as { apps?: string[] } | undefined)?.apps?.includes(
+*       resource.applicationKey,
+*     ) === true,
+* });
+* ```
+*/
+function delegatedAuthorization(options) {
+	return { async authorize(input) {
+		return await options.authorize(input);
+	} };
+}
+//#endregion
+export { delegatedAuthorization };
+
+//# sourceMappingURL=entry-authorization-delegated.mjs.map

package/dist/entry-authorization-delegated.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-authorization-delegated.mjs","names":[],"sources":["../src/authorization/delegated.ts"],"sourcesContent":["/**\n * Delegated {@link AuthorizationProvider}. Wraps a caller-supplied `authorize`\n * function so you can implement any policy — ABAC, an external policy engine\n * (OPA, Cedar), per-application ownership checks — without implementing the\n * interface by hand.\n *\n * The wrapper normalizes a synchronous-or-asynchronous decision into the\n * `Promise<boolean>` the contract requires.\n *\n * @module\n */\n\nimport type { AuthorizationProvider, AuthorizeInput } from \"./contract.ts\";\n\n/** Options for {@link delegatedAuthorization}. */\nexport interface DelegatedAuthorizationOptions {\n  /**\n   * Decide whether the {@link AuthorizeInput} is permitted. Return `true` to\n   * allow. May be synchronous or asynchronous.\n   */\n  authorize: (input: AuthorizeInput) => Promise<boolean> | boolean;\n}\n\n/**\n * Create an {@link AuthorizationProvider} from a plain decision function.\n *\n * @example\n * ```ts\n * import { delegatedAuthorization } from \"@xtandard/webhooks/authorization/delegated\";\n *\n * const authz = delegatedAuthorization({\n *   authorize: ({ principal, action, resource }) =>\n *     resource.type !== \"application\" ||\n *     (principal?.metadata as { apps?: string[] } | undefined)?.apps?.includes(\n *       resource.applicationKey,\n *     ) === true,\n * });\n * ```\n */\nexport function delegatedAuthorization(\n  options: DelegatedAuthorizationOptions,\n): AuthorizationProvider {\n  return {\n    async authorize(input: AuthorizeInput): Promise<boolean> {\n      return await options.authorize(input);\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAuCA,SAAgB,uBACd,SACuB;CACvB,OAAO,EACL,MAAM,UAAU,OAAyC;EACvD,OAAO,MAAM,QAAQ,UAAU,KAAK;CACtC,EACF;AACF"}

package/dist/entry-authorization-none.cjs

@@ -0,0 +1,3 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_none = require("./none-CZVrfnmF.cjs");
+exports.noAuthorization = require_none.noAuthorization;

package/dist/entry-authorization-none.d.cts

@@ -0,0 +1,18 @@
+import { t as AuthorizationProvider } from "./contract-CiPskNvS.cjs";
+
+//#region src/authorization/none.d.ts
+/**
+ * Create an {@link AuthorizationProvider} that authorizes everything.
+ *
+ * @example
+ * ```ts
+ * import { noAuthorization } from "@xtandard/webhooks/authorization/none";
+ *
+ * const authz = noAuthorization();
+ * await authz.authorize(input); // → true, always
+ * ```
+ */
+declare function noAuthorization(): AuthorizationProvider;
+//#endregion
+export { noAuthorization };
+//# sourceMappingURL=entry-authorization-none.d.cts.map

package/dist/entry-authorization-none.d.mts

@@ -0,0 +1,18 @@
+import { t as AuthorizationProvider } from "./contract-C2r2Xzwp.mjs";
+
+//#region src/authorization/none.d.ts
+/**
+ * Create an {@link AuthorizationProvider} that authorizes everything.
+ *
+ * @example
+ * ```ts
+ * import { noAuthorization } from "@xtandard/webhooks/authorization/none";
+ *
+ * const authz = noAuthorization();
+ * await authz.authorize(input); // → true, always
+ * ```
+ */
+declare function noAuthorization(): AuthorizationProvider;
+//#endregion
+export { noAuthorization };
+//# sourceMappingURL=entry-authorization-none.d.mts.map

package/dist/entry-authorization-none.mjs

@@ -0,0 +1,2 @@
+import { t as noAuthorization } from "./none-BnZtaGNJ.mjs";
+export { noAuthorization };

package/dist/entry-authorization-roles.cjs

@@ -0,0 +1,6 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_roles = require("./roles-D0G9XqBq.cjs");
+exports.ALL_ACTIONS = require_roles.ALL_ACTIONS;
+exports.DEFAULT_ROLE_POLICY = require_roles.DEFAULT_ROLE_POLICY;
+exports.READ_ACTIONS = require_roles.READ_ACTIONS;
+exports.rolesAuthorization = require_roles.rolesAuthorization;

package/dist/entry-authorization-roles.d.cts

@@ -0,0 +1,65 @@
+import { i as WebhooksAction, t as AuthorizationProvider } from "./contract-CiPskNvS.cjs";
+
+//#region src/authorization/roles.d.ts
+/** Every action in the system, used to expand non-wildcard "all actions" presets. */
+declare const ALL_ACTIONS: readonly WebhooksAction[];
+/**
+ * Every read-only action (the `*:read` subset of {@link ALL_ACTIONS}).
+ * `endpoint:read-secret` is deliberately excluded — secret access is sensitive
+ * and must be granted explicitly.
+ */
+declare const READ_ACTIONS: readonly WebhooksAction[];
+/** A role policy: each role maps to an explicit action list or the `"*"` wildcard. */
+type RolePolicy = Record<string, WebhooksAction[] | "*">;
+/**
+ * The default role policy applied when {@link RolesAuthorizationOptions.policy}
+ * is omitted.
+ *
+ * - `admin` — `"*"`, every action.
+ * - `editor` — every action (explicit list, equivalent to `admin` here).
+ * - `viewer` — every `*:read` action only.
+ */
+declare const DEFAULT_ROLE_POLICY: RolePolicy;
+/** Options for {@link rolesAuthorization}. */
+interface RolesAuthorizationOptions {
+  /**
+   * Role → granted actions. `"*"` grants everything. Defaults to
+   * {@link DEFAULT_ROLE_POLICY} when omitted.
+   */
+  policy?: RolePolicy;
+  /**
+   * When `true`, every {@link isMutatingAction mutating} action is denied
+   * regardless of the principal's roles.
+   * @default false
+   */
+  readonly?: boolean;
+}
+/**
+ * Create a role-based {@link AuthorizationProvider}.
+ *
+ * Decision order:
+ * 1. If `readonly` and the action mutates → **deny**.
+ * 2. If the principal is `null` → **deny**.
+ * 3. If any of the principal's roles grants the action (via `"*"` or an explicit
+ *    list) → **allow**; otherwise **deny**.
+ *
+ * @example
+ * ```ts
+ * import { rolesAuthorization } from "@xtandard/webhooks/authorization/roles";
+ *
+ * // Built-in admin/editor/viewer policy:
+ * const authz = rolesAuthorization();
+ *
+ * // Custom policy:
+ * const custom = rolesAuthorization({
+ *   policy: {
+ *     ops: ["delivery:read", "delivery:retry", "endpoint:read"],
+ *     auditor: ["audit:read"],
+ *   },
+ * });
+ * ```
+ */
+declare function rolesAuthorization(options?: RolesAuthorizationOptions): AuthorizationProvider;
+//#endregion
+export { ALL_ACTIONS, DEFAULT_ROLE_POLICY, READ_ACTIONS, RolePolicy, RolesAuthorizationOptions, rolesAuthorization };
+//# sourceMappingURL=entry-authorization-roles.d.cts.map

package/dist/entry-authorization-roles.d.mts

@@ -0,0 +1,65 @@
+import { i as WebhooksAction, t as AuthorizationProvider } from "./contract-C2r2Xzwp.mjs";
+
+//#region src/authorization/roles.d.ts
+/** Every action in the system, used to expand non-wildcard "all actions" presets. */
+declare const ALL_ACTIONS: readonly WebhooksAction[];
+/**
+ * Every read-only action (the `*:read` subset of {@link ALL_ACTIONS}).
+ * `endpoint:read-secret` is deliberately excluded — secret access is sensitive
+ * and must be granted explicitly.
+ */
+declare const READ_ACTIONS: readonly WebhooksAction[];
+/** A role policy: each role maps to an explicit action list or the `"*"` wildcard. */
+type RolePolicy = Record<string, WebhooksAction[] | "*">;
+/**
+ * The default role policy applied when {@link RolesAuthorizationOptions.policy}
+ * is omitted.
+ *
+ * - `admin` — `"*"`, every action.
+ * - `editor` — every action (explicit list, equivalent to `admin` here).
+ * - `viewer` — every `*:read` action only.
+ */
+declare const DEFAULT_ROLE_POLICY: RolePolicy;
+/** Options for {@link rolesAuthorization}. */
+interface RolesAuthorizationOptions {
+  /**
+   * Role → granted actions. `"*"` grants everything. Defaults to
+   * {@link DEFAULT_ROLE_POLICY} when omitted.
+   */
+  policy?: RolePolicy;
+  /**
+   * When `true`, every {@link isMutatingAction mutating} action is denied
+   * regardless of the principal's roles.
+   * @default false
+   */
+  readonly?: boolean;
+}
+/**
+ * Create a role-based {@link AuthorizationProvider}.
+ *
+ * Decision order:
+ * 1. If `readonly` and the action mutates → **deny**.
+ * 2. If the principal is `null` → **deny**.
+ * 3. If any of the principal's roles grants the action (via `"*"` or an explicit
+ *    list) → **allow**; otherwise **deny**.
+ *
+ * @example
+ * ```ts
+ * import { rolesAuthorization } from "@xtandard/webhooks/authorization/roles";
+ *
+ * // Built-in admin/editor/viewer policy:
+ * const authz = rolesAuthorization();
+ *
+ * // Custom policy:
+ * const custom = rolesAuthorization({
+ *   policy: {
+ *     ops: ["delivery:read", "delivery:retry", "endpoint:read"],
+ *     auditor: ["audit:read"],
+ *   },
+ * });
+ * ```
+ */
+declare function rolesAuthorization(options?: RolesAuthorizationOptions): AuthorizationProvider;
+//#endregion
+export { ALL_ACTIONS, DEFAULT_ROLE_POLICY, READ_ACTIONS, RolePolicy, RolesAuthorizationOptions, rolesAuthorization };
+//# sourceMappingURL=entry-authorization-roles.d.mts.map

package/dist/entry-authorization-roles.mjs

@@ -0,0 +1,2 @@
+import { i as rolesAuthorization, n as DEFAULT_ROLE_POLICY, r as READ_ACTIONS, t as ALL_ACTIONS } from "./roles-vp361lTk.mjs";
+export { ALL_ACTIONS, DEFAULT_ROLE_POLICY, READ_ACTIONS, rolesAuthorization };

package/dist/entry-bun.cjs

@@ -0,0 +1,24 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_create_fetch_handler = require("./create-fetch-handler-CmooujQo.cjs");
+//#region src/adapters/bun.ts
+/**
+* Bun adapter. The handler is already web-standard, so this is a passthrough you
+* can hand straight to `Bun.serve({ fetch })`. The panel starts the delivery
+* dispatcher by default; pass `dispatcher: false` for split-worker deployments.
+*
+* ```ts
+* import { webhooksPanel } from "@xtandard/webhooks/bun";
+* const panel = webhooksPanel({ storage });
+* Bun.serve({ port: 3000, fetch: panel.fetch });
+* ```
+*
+* @module
+*/
+/** Create a Bun-ready panel handler (`fetch` + `core` + `dispatcher` + `openapi`). */
+function webhooksPanel(options) {
+	return require_create_fetch_handler.createFetchHandler(options);
+}
+//#endregion
+exports.webhooksPanel = webhooksPanel;
+
+//# sourceMappingURL=entry-bun.cjs.map

package/dist/entry-bun.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-bun.cjs","names":["createFetchHandler"],"sources":["../src/adapters/bun.ts"],"sourcesContent":["/**\n * Bun adapter. The handler is already web-standard, so this is a passthrough you\n * can hand straight to `Bun.serve({ fetch })`. The panel starts the delivery\n * dispatcher by default; pass `dispatcher: false` for split-worker deployments.\n *\n * ```ts\n * import { webhooksPanel } from \"@xtandard/webhooks/bun\";\n * const panel = webhooksPanel({ storage });\n * Bun.serve({ port: 3000, fetch: panel.fetch });\n * ```\n *\n * @module\n */\n\nimport {\n  createFetchHandler,\n  type CreateFetchHandlerResult,\n  type WebhooksPanelOptions,\n} from \"../server/create-fetch-handler.ts\";\n\n/** Create a Bun-ready panel handler (`fetch` + `core` + `dispatcher` + `openapi`). */\nexport function webhooksPanel(options: WebhooksPanelOptions): CreateFetchHandlerResult {\n  return createFetchHandler(options);\n}\n\nexport type { WebhooksPanelOptions, CreateFetchHandlerResult };\n"],"mappings":";;;;;;;;;;;;;;;;;AAqBA,SAAgB,cAAc,SAAyD;CACrF,OAAOA,6BAAAA,mBAAmB,OAAO;AACnC"}

package/dist/entry-bun.d.cts

@@ -0,0 +1,8 @@
+import { n as WebhooksPanelOptions, t as CreateFetchHandlerResult } from "./create-fetch-handler-Dlkhustu.cjs";
+
+//#region src/adapters/bun.d.ts
+/** Create a Bun-ready panel handler (`fetch` + `core` + `dispatcher` + `openapi`). */
+declare function webhooksPanel(options: WebhooksPanelOptions): CreateFetchHandlerResult;
+//#endregion
+export { type CreateFetchHandlerResult, type WebhooksPanelOptions, webhooksPanel };
+//# sourceMappingURL=entry-bun.d.cts.map

package/dist/entry-bun.d.mts

@@ -0,0 +1,8 @@
+import { n as WebhooksPanelOptions, t as CreateFetchHandlerResult } from "./create-fetch-handler-jy3hy5nZ.mjs";
+
+//#region src/adapters/bun.d.ts
+/** Create a Bun-ready panel handler (`fetch` + `core` + `dispatcher` + `openapi`). */
+declare function webhooksPanel(options: WebhooksPanelOptions): CreateFetchHandlerResult;
+//#endregion
+export { type CreateFetchHandlerResult, type WebhooksPanelOptions, webhooksPanel };
+//# sourceMappingURL=entry-bun.d.mts.map

package/dist/entry-bun.mjs

@@ -0,0 +1,23 @@
+import { t as createFetchHandler } from "./create-fetch-handler-BIdk9P30.mjs";
+//#region src/adapters/bun.ts
+/**
+* Bun adapter. The handler is already web-standard, so this is a passthrough you
+* can hand straight to `Bun.serve({ fetch })`. The panel starts the delivery
+* dispatcher by default; pass `dispatcher: false` for split-worker deployments.
+*
+* ```ts
+* import { webhooksPanel } from "@xtandard/webhooks/bun";
+* const panel = webhooksPanel({ storage });
+* Bun.serve({ port: 3000, fetch: panel.fetch });
+* ```
+*
+* @module
+*/
+/** Create a Bun-ready panel handler (`fetch` + `core` + `dispatcher` + `openapi`). */
+function webhooksPanel(options) {
+	return createFetchHandler(options);
+}
+//#endregion
+export { webhooksPanel };
+
+//# sourceMappingURL=entry-bun.mjs.map

package/dist/entry-bun.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-bun.mjs","names":[],"sources":["../src/adapters/bun.ts"],"sourcesContent":["/**\n * Bun adapter. The handler is already web-standard, so this is a passthrough you\n * can hand straight to `Bun.serve({ fetch })`. The panel starts the delivery\n * dispatcher by default; pass `dispatcher: false` for split-worker deployments.\n *\n * ```ts\n * import { webhooksPanel } from \"@xtandard/webhooks/bun\";\n * const panel = webhooksPanel({ storage });\n * Bun.serve({ port: 3000, fetch: panel.fetch });\n * ```\n *\n * @module\n */\n\nimport {\n  createFetchHandler,\n  type CreateFetchHandlerResult,\n  type WebhooksPanelOptions,\n} from \"../server/create-fetch-handler.ts\";\n\n/** Create a Bun-ready panel handler (`fetch` + `core` + `dispatcher` + `openapi`). */\nexport function webhooksPanel(options: WebhooksPanelOptions): CreateFetchHandlerResult {\n  return createFetchHandler(options);\n}\n\nexport type { WebhooksPanelOptions, CreateFetchHandlerResult };\n"],"mappings":";;;;;;;;;;;;;;;;AAqBA,SAAgB,cAAc,SAAyD;CACrF,OAAO,mBAAmB,OAAO;AACnC"}

package/dist/entry-drizzle-mysql.cjs

@@ -0,0 +1,20 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let drizzle_orm_mysql_core = require("drizzle-orm/mysql-core");
+//#region src/drizzle/mysql.ts
+/**
+* Build the MySQL `mysqlTable` for the webhooks KV store: `key varchar PRIMARY
+* KEY`, `value json NOT NULL`. The table name defaults to `"xtandard_webhooks"`.
+*/
+function mysqlWebhooksTable(name = "xtandard_webhooks", opts) {
+	const columns = {
+		key: (0, drizzle_orm_mysql_core.varchar)("key", { length: opts?.keyLength ?? 512 }).primaryKey(),
+		value: (0, drizzle_orm_mysql_core.json)("value").notNull(),
+		...opts?.extraColumns?.()
+	};
+	const extraConfig = opts?.extraIndexes;
+	return (0, drizzle_orm_mysql_core.mysqlTable)(name, columns, extraConfig);
+}
+//#endregion
+exports.mysqlWebhooksTable = mysqlWebhooksTable;
+
+//# sourceMappingURL=entry-drizzle-mysql.cjs.map

package/dist/entry-drizzle-mysql.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-drizzle-mysql.cjs","names":[],"sources":["../src/drizzle/mysql.ts"],"sourcesContent":["/**\n * `@xtandard/webhooks/drizzle/mysql` — MySQL Drizzle table factory for the\n * webhooks KV store. Schema-only (imports just `drizzle-orm/mysql-core`).\n *\n * Base columns: `key varchar PRIMARY KEY` (length configurable), `value json\n * NOT NULL`. `extraColumns`/`extraIndexes` mirror `drizzle-audit`.\n *\n * @example\n * ```ts\n * import { mysqlWebhooksTable } from \"@xtandard/webhooks/drizzle/mysql\";\n * export const webhooksKv = mysqlWebhooksTable();\n * ```\n *\n * @module\n */\n\nimport type { BuildColumns } from \"drizzle-orm\";\nimport {\n  json,\n  mysqlTable,\n  varchar,\n  type MySqlColumnBuilderBase,\n  type MySqlTableExtraConfigValue,\n} from \"drizzle-orm/mysql-core\";\nimport type { DrizzleKvTable } from \"./table.ts\";\n\nexport type { DrizzleKvTable } from \"./table.ts\";\n\n/** The `self` passed to an {@link MysqlWebhooksTableOptions.extraIndexes} callback. */\ntype MysqlWebhooksColumns = BuildColumns<string, Record<string, MySqlColumnBuilderBase>, \"mysql\">;\n\n/** Options for {@link mysqlWebhooksTable}. */\nexport interface MysqlWebhooksTableOptions {\n  /**\n   * `varchar` length for the `key` primary key. Default `512` (store keys are\n   * short slash-delimited paths). Keep within your InnoDB index-prefix limit.\n   */\n  keyLength?: number;\n  /** Additional columns merged into the table. */\n  extraColumns?: () => Record<string, MySqlColumnBuilderBase>;\n  /** Additional indexes/constraints; receives the built table for column references. */\n  extraIndexes?: (table: MysqlWebhooksColumns) => MySqlTableExtraConfigValue[];\n}\n\n/**\n * Build the MySQL `mysqlTable` for the webhooks KV store: `key varchar PRIMARY\n * KEY`, `value json NOT NULL`. The table name defaults to `\"xtandard_webhooks\"`.\n */\nexport function mysqlWebhooksTable(\n  name = \"xtandard_webhooks\",\n  opts?: MysqlWebhooksTableOptions,\n): DrizzleKvTable {\n  const columns = {\n    key: varchar(\"key\", { length: opts?.keyLength ?? 512 }).primaryKey(),\n    value: json(\"value\").notNull(),\n    ...opts?.extraColumns?.(),\n  };\n  // Cast to the exact `self` type Drizzle infers from `columns` — the public\n  // `extraIndexes` type uses a generic column map, which is a supertype.\n  const extraConfig = opts?.extraIndexes as\n    | ((self: BuildColumns<string, typeof columns, \"mysql\">) => MySqlTableExtraConfigValue[])\n    | undefined;\n  return mysqlTable(name, columns, extraConfig);\n}\n"],"mappings":";;;;;;;AAgDA,SAAgB,mBACd,OAAO,qBACP,MACgB;CAChB,MAAM,UAAU;EACd,MAAA,GAAA,uBAAA,SAAa,OAAO,EAAE,QAAQ,MAAM,aAAa,IAAI,CAAC,EAAE,WAAW;EACnE,QAAA,GAAA,uBAAA,MAAY,OAAO,EAAE,QAAQ;EAC7B,GAAG,MAAM,eAAe;CAC1B;CAGA,MAAM,cAAc,MAAM;CAG1B,QAAA,GAAA,uBAAA,YAAkB,MAAM,SAAS,WAAW;AAC9C"}

package/dist/entry-drizzle-mysql.d.cts

@@ -0,0 +1,27 @@
+import { t as DrizzleKvTable } from "./table-Ce3Tzwqs.cjs";
+import { BuildColumns } from "drizzle-orm";
+import { MySqlColumnBuilderBase, MySqlTableExtraConfigValue } from "drizzle-orm/mysql-core";
+
+//#region src/drizzle/mysql.d.ts
+/** The `self` passed to an {@link MysqlWebhooksTableOptions.extraIndexes} callback. */
+type MysqlWebhooksColumns = BuildColumns<string, Record<string, MySqlColumnBuilderBase>, "mysql">;
+/** Options for {@link mysqlWebhooksTable}. */
+interface MysqlWebhooksTableOptions {
+  /**
+   * `varchar` length for the `key` primary key. Default `512` (store keys are
+   * short slash-delimited paths). Keep within your InnoDB index-prefix limit.
+   */
+  keyLength?: number;
+  /** Additional columns merged into the table. */
+  extraColumns?: () => Record<string, MySqlColumnBuilderBase>;
+  /** Additional indexes/constraints; receives the built table for column references. */
+  extraIndexes?: (table: MysqlWebhooksColumns) => MySqlTableExtraConfigValue[];
+}
+/**
+ * Build the MySQL `mysqlTable` for the webhooks KV store: `key varchar PRIMARY
+ * KEY`, `value json NOT NULL`. The table name defaults to `"xtandard_webhooks"`.
+ */
+declare function mysqlWebhooksTable(name?: string, opts?: MysqlWebhooksTableOptions): DrizzleKvTable;
+//#endregion
+export { type DrizzleKvTable, MysqlWebhooksTableOptions, mysqlWebhooksTable };
+//# sourceMappingURL=entry-drizzle-mysql.d.cts.map