@xtandard/webhooks 0.1.0

package/dist/cli.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.mjs","names":[],"sources":["../src/cli.ts"],"sourcesContent":["/**\n * `xtandard-webhooks` CLI. Operates on the same storage your app/panel uses\n * (configured via the `STORAGE_DRIVER` / `QUEUE_STORAGE_DRIVER` env vars,\n * mirroring the standalone app), so it slots into shell, CI, and split-worker\n * workflows.\n *\n * Commands: `serve` (panel + dispatcher, no Docker), `dispatch` (dispatcher\n * ONLY — the split-worker mode), `init`, `list-apps`, `list-endpoints`,\n * `publish`, `retry`, `verify`, `sign` (build a signed request — the signature\n * playground), and `listen` (a local inspecting receiver — the webhook.site\n * you run yourself).\n *\n * @module\n */\n\nimport type { AuthProvider } from \"./auth/contract.ts\";\nimport type { AuthorizationProvider } from \"./authorization/contract.ts\";\nimport {\n  createWebhooksCore,\n  type RetentionOptions,\n  type RetentionRule,\n  type WebhooksCore,\n} from \"./core.ts\";\nimport type { DispatcherOptions } from \"./dispatcher.ts\";\nimport { durationToMs, parseDurationList } from \"./duration.ts\";\nimport type { JsonValue, WebhookDuration } from \"./schema.ts\";\nimport type { WebhooksStorage } from \"./storage/contract.ts\";\n\ntype Driver = \"memory\" | \"file\" | \"redis\" | \"postgres\" | \"mongodb\" | \"sqlite\" | \"libsql\";\n\n/** The two storage roles: control plane (`STORAGE`) and delivery queue (`QUEUE`). */\ntype Role = \"STORAGE\" | \"QUEUE\";\n\nconst env = (key: string, fallback = \"\"): string => process.env[key] ?? fallback;\n\nconst isTruthy = (value: string): boolean => value === \"1\" || value.toLowerCase() === \"true\";\n\n/**\n * The driver env var for a role: `STORAGE_DRIVER` for the control plane,\n * `QUEUE_STORAGE_DRIVER` for the delivery queue.\n */\nconst driverEnv = (role: Role): string =>\n  role === \"STORAGE\" ? \"STORAGE_DRIVER\" : \"QUEUE_STORAGE_DRIVER\";\n\n/**\n * Parse a duration env like `\"30d\"`, `\"34h\"`, `\"90m\"`, `\"10s\"` into a\n * {@link WebhookDuration}, warning and ignoring malformed values.\n */\nfunction parseDurationEnv(name: string): WebhookDuration | undefined {\n  const raw = env(name);\n  if (!raw) return undefined;\n  try {\n    durationToMs(raw as WebhookDuration); // validate eagerly\n    return raw as WebhookDuration;\n  } catch {\n    process.stderr.write(\n      `[xtandard/webhooks] Ignoring ${name}=\"${raw}\" — expected <number><unit> with unit ms|s|m|h|d (e.g. 34h, 30d).\\n`,\n    );\n    return undefined;\n  }\n}\n\n/**\n * Retention from env: `MESSAGE_KEEP_LAST` / `MESSAGE_MAX_AGE` and\n * `AUDIT_KEEP_LAST` / `AUDIT_MAX_AGE`. Returns undefined when none are set.\n */\nfunction retentionFromEnv(): RetentionOptions | undefined {\n  const rule = (keepVar: string, ageVar: string): RetentionRule | undefined => {\n    const keepRaw = env(keepVar);\n    const keepLast = keepRaw && /^\\d+$/.test(keepRaw) ? Number(keepRaw) : undefined;\n    if (keepRaw && keepLast === undefined) {\n      process.stderr.write(\n        `[xtandard/webhooks] Ignoring ${keepVar}=\"${keepRaw}\" — expected a number.\\n`,\n      );\n    }\n    const maxAge = parseDurationEnv(ageVar);\n    if (keepLast === undefined && !maxAge) return undefined;\n    return {\n      ...(keepLast !== undefined ? { keepLast } : {}),\n      ...(maxAge !== undefined ? { maxAge } : {}),\n    };\n  };\n  const messages = rule(\"MESSAGE_KEEP_LAST\", \"MESSAGE_MAX_AGE\");\n  const audit = rule(\"AUDIT_KEEP_LAST\", \"AUDIT_MAX_AGE\");\n  if (!messages && !audit) return undefined;\n  return {\n    ...(messages ? { messages } : {}),\n    ...(audit ? { audit } : {}),\n  };\n}\n\n/** Dispatcher config from env: `RETRY_SCHEDULE` (comma list, e.g. `0s,5s,5m`). */\nfunction dispatcherOptionsFromEnv(): DispatcherOptions {\n  const raw = env(\"RETRY_SCHEDULE\");\n  if (!raw) return {};\n  try {\n    return { retrySchedule: parseDurationList(raw) };\n  } catch {\n    process.stderr.write(\n      `[xtandard/webhooks] Ignoring RETRY_SCHEDULE=\"${raw}\" — expected a comma list of durations (e.g. \"0s,5s,5m,30m,2h,5h,10h\").\\n`,\n    );\n    return {};\n  }\n}\n\n/** Whether the in-process dispatcher is enabled (`DISPATCHER=0|false` disables). */\nfunction dispatcherEnabled(): boolean {\n  const raw = env(\"DISPATCHER\");\n  if (!raw) return true;\n  return !(raw === \"0\" || raw.toLowerCase() === \"false\");\n}\n\n/**\n * Build one storage role from env. `STORAGE` holds the control plane\n * (applications, event types, endpoints, messages, audit); `QUEUE` holds\n * deliveries + the due index and defaults to the same store (see\n * {@link buildQueueStorage}).\n */\nasync function buildStorage(role: Role): Promise<WebhooksStorage> {\n  const driver = (env(driverEnv(role), \"file\") as Driver) || \"file\";\n  const r = role.toLowerCase();\n  switch (driver) {\n    case \"redis\": {\n      const { createRedisStorage } = await import(\"./storage/redis.ts\");\n      return createRedisStorage({\n        url: env(\"REDIS_URL\", \"redis://localhost:6379\"),\n        prefix: env(`${role}_PREFIX`, `xtandard:webhooks:${r}`),\n      });\n    }\n    case \"postgres\": {\n      const { createPostgresStorage } = await import(\"./storage/postgres.ts\");\n      return createPostgresStorage({\n        connectionString:\n          env(\"DATABASE_URL\") || env(\"POSTGRES_URL\", \"postgres://localhost:5432/postgres\"),\n        table: env(`${role}_PG_TABLE`, `xtandard_webhooks_${r}`),\n      });\n    }\n    case \"mongodb\": {\n      const { createMongoStorage } = await import(\"./storage/mongodb.ts\");\n      return createMongoStorage({\n        url: env(\"MONGO_URL\", \"mongodb://localhost:27017\"),\n        dbName: env(\"MONGO_DB\", \"xtandard_webhooks\"),\n        collectionName: env(`${role}_MONGO_COLLECTION`, `webhooks_${r}`),\n      });\n    }\n    case \"sqlite\": {\n      // Requires running the CLI under Bun (`bunx xtandard-webhooks …`).\n      const { createSqliteStorage } = await import(\"./storage/sqlite.ts\");\n      return createSqliteStorage({\n        path: env(`${role}_SQLITE_PATH`, `./.webhooks/${r}.sqlite`),\n      });\n    }\n    case \"libsql\": {\n      const { createLibsqlStorage } = await import(\"./storage/libsql.ts\");\n      const authToken = env(\"LIBSQL_AUTH_TOKEN\");\n      return createLibsqlStorage({\n        url: env(`${role}_LIBSQL_URL`) || env(\"LIBSQL_URL\", `file:./.webhooks/${r}.db`),\n        ...(authToken ? { authToken } : {}),\n      });\n    }\n    case \"memory\": {\n      const { createMemoryStorage } = await import(\"./storage/memory.ts\");\n      return createMemoryStorage();\n    }\n    case \"file\":\n    default: {\n      const { createFileStorage } = await import(\"./storage/file.ts\");\n      return createFileStorage({ dir: env(`${role}_FILE_DIR`, `./.webhooks/${r}`) });\n    }\n  }\n}\n\n/**\n * The queue store, or `undefined` to share the control-plane store. Only built\n * when `QUEUE_STORAGE_DRIVER` is explicitly set (split-plane deployments:\n * control data in Postgres, queue in Redis).\n */\nasync function buildQueueStorage(): Promise<WebhooksStorage | undefined> {\n  if (!env(\"QUEUE_STORAGE_DRIVER\")) return undefined;\n  return buildStorage(\"QUEUE\");\n}\n\n/**\n * A human-readable, log-safe description of where a storage role persists data\n * — for the `serve`/`dispatch` startup banner. File/SQLite paths are resolved\n * to absolute so \"where did my webhooks go?\" is obvious; connection-string\n * drivers print only the driver name (never the URL, which may carry\n * credentials).\n */\nasync function describeStorage(role: Role): Promise<string> {\n  const { resolve } = await import(\"node:path\");\n  const driver = (env(driverEnv(role), \"file\") as Driver) || \"file\";\n  const r = role.toLowerCase();\n  switch (driver) {\n    case \"file\":\n      return `file → ${resolve(env(`${role}_FILE_DIR`, `./.webhooks/${r}`))}`;\n    case \"sqlite\":\n      return `sqlite → ${resolve(env(`${role}_SQLITE_PATH`, `./.webhooks/${r}.sqlite`))}`;\n    case \"memory\":\n      return \"memory (ephemeral — not persisted)\";\n    default:\n      return driver;\n  }\n}\n\n/** Build the auth + authorization providers from env (mirrors the standalone app). */\nasync function buildAuth(): Promise<{ auth: AuthProvider; authorization: AuthorizationProvider }> {\n  const mode = env(\"AUTH_MODE\", \"none\");\n  if (mode === \"basic\") {\n    const [{ basicAuth }, { rolesAuthorization }] = await Promise.all([\n      import(\"./auth/basic.ts\"),\n      import(\"./authorization/roles.ts\"),\n    ]);\n    const passwordHash = env(\"AUTH_PASSWORD_HASH\");\n    const password = env(\"AUTH_PASSWORD\");\n    if (!passwordHash && !password) {\n      process.stderr.write(\n        \"[xtandard/webhooks] AUTH_MODE=basic but neither AUTH_PASSWORD_HASH nor AUTH_PASSWORD is set.\\n\",\n      );\n    }\n    return {\n      auth: basicAuth({\n        users: [\n          {\n            username: env(\"AUTH_USERNAME\", \"admin\"),\n            ...(passwordHash ? { passwordHash } : {}),\n            ...(password ? { password } : {}),\n            roles: [\"admin\"],\n          },\n        ],\n      }),\n      authorization: rolesAuthorization({}),\n    };\n  }\n  const [{ noAuth }, { noAuthorization }] = await Promise.all([\n    import(\"./auth/none.ts\"),\n    import(\"./authorization/none.ts\"),\n  ]);\n  return { auth: noAuth(), authorization: noAuthorization() };\n}\n\ntype FetchHandler = (request: Request) => Response | Promise<Response>;\n\n/**\n * Serve a web-standard fetch handler under whatever runtime the CLI runs on:\n * `Bun.serve` under `bunx`, a `node:http` bridge under `npx`/Node. Resolves only\n * once the server is listening; the process then stays alive on the open socket.\n */\nasync function startServer(port: number, fetch: FetchHandler): Promise<void> {\n  const bun = (globalThis as { Bun?: { serve: (options: unknown) => unknown } }).Bun;\n  if (bun) {\n    bun.serve({ port, fetch });\n    return;\n  }\n  const { createServer } = await import(\"node:http\");\n  const server = createServer((req, res) => {\n    void (async () => {\n      try {\n        const chunks: Buffer[] = [];\n        for await (const c of req) chunks.push(c as Buffer);\n        const method = req.method ?? \"GET\";\n        const headers = new Headers();\n        for (const [k, v] of Object.entries(req.headers)) {\n          if (v === undefined) continue;\n          headers.set(k, Array.isArray(v) ? v.join(\", \") : v);\n        }\n        const host = req.headers.host ?? `localhost:${port}`;\n        const url = `http://${host}${req.url ?? \"/\"}`;\n        const hasBody = method !== \"GET\" && method !== \"HEAD\" && chunks.length > 0;\n        const request = new Request(url, {\n          method,\n          headers,\n          body: hasBody ? Buffer.concat(chunks) : undefined,\n        });\n        const response = await fetch(request);\n        res.statusCode = response.status;\n        response.headers.forEach((value, key) => res.setHeader(key, value));\n        res.end(Buffer.from(await response.arrayBuffer()));\n      } catch (err) {\n        res.statusCode = 500;\n        res.end(`Internal error: ${err instanceof Error ? err.message : String(err)}`);\n      }\n    })();\n  });\n  await new Promise<void>((resolve) => server.listen(port, resolve));\n}\n\n/** Verification outcome shown by `listen` for each captured request. */\nexport type InboundVerification =\n  | { state: \"unchecked\" } // no --secret given\n  | { state: \"ok\" }\n  | { state: \"failed\"; reason: string };\n\n/**\n * Format one captured inbound webhook for the terminal — the `listen` command's\n * pretty-printer. Pure and side-effect-free so it can be unit-tested.\n */\nexport function formatInboundWebhook(input: {\n  index: number;\n  method: string;\n  path: string;\n  headers: Record<string, string>;\n  body: string;\n  verification: InboundVerification;\n  at: string;\n}): string {\n  const wh = (name: string) => input.headers[name] ?? input.headers[name.toLowerCase()] ?? \"—\";\n  const badge =\n    input.verification.state === \"ok\"\n      ? \"signature: VERIFIED\"\n      : input.verification.state === \"failed\"\n        ? `signature: FAILED (${input.verification.reason})`\n        : \"signature: not checked (pass --secret to verify)\";\n  let prettyBody = input.body;\n  try {\n    prettyBody = JSON.stringify(JSON.parse(input.body), null, 2);\n  } catch {\n    // leave non-JSON bodies as-is\n  }\n  return [\n    `\\n── #${input.index}  ${input.method} ${input.path}  ${input.at} ──`,\n    `webhook-id:        ${wh(\"webhook-id\")}`,\n    `webhook-timestamp: ${wh(\"webhook-timestamp\")}`,\n    `webhook-signature: ${wh(\"webhook-signature\")}`,\n    badge,\n    \"body:\",\n    prettyBody,\n    \"\",\n  ].join(\"\\n\");\n}\n\n/** Minimal flag/value argv parser: `--key value` and `--flag`. */\nfunction parseArgs(argv: string[]): { _: string[]; flags: Record<string, string | boolean> } {\n  const _: string[] = [];\n  const flags: Record<string, string | boolean> = {};\n  for (let i = 0; i < argv.length; i++) {\n    const a = argv[i]!;\n    if (a.startsWith(\"--\")) {\n      const key = a.slice(2);\n      const next = argv[i + 1];\n      if (next === undefined || next.startsWith(\"--\")) flags[key] = true;\n      else {\n        flags[key] = next;\n        i++;\n      }\n    } else _.push(a);\n  }\n  return { _, flags };\n}\n\n/** A core over the env-configured storage (dispatcher NOT started). */\nasync function makeCore(): Promise<WebhooksCore> {\n  const [storage, queueStorage] = await Promise.all([buildStorage(\"STORAGE\"), buildQueueStorage()]);\n  const retention = retentionFromEnv();\n  return createWebhooksCore({\n    storage,\n    ...(queueStorage ? { queueStorage } : {}),\n    ...(retention ? { retention } : {}),\n    dispatcher: dispatcherOptionsFromEnv(),\n  });\n}\n\n/** Read this package's version from the nearest package.json (dist or src). */\nasync function pkgVersion(): Promise<string> {\n  try {\n    const { readFile } = await import(\"node:fs/promises\");\n    const { fileURLToPath } = await import(\"node:url\");\n    const pkg = JSON.parse(\n      await readFile(fileURLToPath(new URL(\"../package.json\", import.meta.url)), \"utf8\"),\n    ) as { version?: string };\n    return pkg.version ?? \"unknown\";\n  } catch {\n    return \"unknown\";\n  }\n}\n\nfunction helpText(version: string): string {\n  return `xtandard-webhooks v${version} — self-hosted, Standard Webhooks-compliant outbound webhook control plane\n\nUsage:\n  xtandard-webhooks <command> [options]     # the binary, after: npm i -g @xtandard/webhooks\n  npx @xtandard/webhooks <command>          # without installing (or: bunx @xtandard/webhooks …)\n\nCommands:\n  serve [--port <n>]            Run the admin panel + API + delivery dispatcher (no Docker).\n  dispatch [--port <n>]         Run the delivery dispatcher ONLY (split-worker mode).\n                                With --port/$PORT: also serves GET /healthcheck.\n  init [--app <key>]            Create an application + an example event type.\n  list-apps                     List applications.\n  list-endpoints --app <key>    List an application's endpoints.\n  publish --app <key> --type <event> --data '<json>' [--idempotency-key <k>]\n                                Publish a message (ingest from shell/CI).\n  retry --app <key> --delivery <id>\n                                Re-queue a dead-lettered delivery.\n  verify --secret <whsec_…> --payload-file <path> --headers-file <path>\n                                Verify a captured webhook (receiver-side debugging):\n                                reads the raw payload + a JSON headers object,\n                                prints the envelope, exits 1 on failure.\n  sign --secret <whsec_…> --data '<json>' [--id <msg_…>] [--timestamp <unix>] [--url <target>]\n                                Build a signed Standard Webhooks request (the\n                                signature playground): prints the headers + body,\n                                and a ready-to-run curl when --url is given.\n  listen [--port <n>] [--secret <whsec_…>] [--status <code>]\n                                Run a local inspecting receiver (the webhook.site\n                                you host yourself): pretty-prints every incoming\n                                webhook; with --secret, verifies the signature.\n\nGlobal options:\n  -h, --help                    Show this help.\n  -v, --version                 Print the version.\n\n\\`serve\\` / \\`dispatch\\` options:\n  --port <n>                    Port to listen on (default: $PORT or 3000).\n\nEnvironment variables\n  Storage  (control plane STORAGE_; delivery queue QUEUE_, defaults to the same store):\n    STORAGE_DRIVER, QUEUE_STORAGE_DRIVER\n                                memory | file | redis | postgres | mongodb | sqlite | libsql\n                                (CLI default: file · Docker default: memory)\n    REDIS_URL                   redis://localhost:6379                     (driver: redis)\n    STORAGE_PREFIX, QUEUE_PREFIX   key namespace                           (driver: redis)\n    DATABASE_URL | POSTGRES_URL  postgres://…                              (driver: postgres)\n    STORAGE_PG_TABLE, QUEUE_PG_TABLE                                       (driver: postgres)\n    MONGO_URL, MONGO_DB, STORAGE_MONGO_COLLECTION, QUEUE_MONGO_COLLECTION  (driver: mongodb)\n    STORAGE_FILE_DIR, QUEUE_FILE_DIR   default ./.webhooks/{storage,queue} (driver: file)\n    STORAGE_SQLITE_PATH, QUEUE_SQLITE_PATH                                 (driver: sqlite, Bun only)\n    LIBSQL_URL | STORAGE_LIBSQL_URL, QUEUE_LIBSQL_URL, LIBSQL_AUTH_TOKEN   (driver: libsql)\n\n  Server  (\\`serve\\` / standalone):\n    PORT            3000        Port to listen on (or --port).\n    BASE_PATH       \"\"          URL prefix, e.g. \"/webhooks\".\n    TITLE                       Navbar wordmark.\n    LOGO_URL                    Logo image URL.\n    READONLY        1|true      Block all mutating operations.\n    AUTH_MODE       none|basic  Authentication mode (default none).\n    AUTH_USERNAME   admin       Username for basic auth.\n    AUTH_PASSWORD_HASH          scrypt hash (preferred; see docs/AUTH.md).\n    AUTH_PASSWORD               Plaintext password (dev only).\n    PORTAL_SECRET               Enables portal-token access (whpt_… bearer tokens).\n\n  Delivery  (\\`serve\\` / \\`dispatch\\` / standalone):\n    DISPATCHER      1           0|false disables the in-process dispatcher\n                                (host publishes only; a split worker delivers).\n    RETRY_SCHEDULE              Comma list of retry delays, e.g. \"0s,5s,5m,30m,2h,5h,10h\".\n\n  Retention  (pruned opportunistically after publishes; kept if EITHER rule keeps it;\n              messages with a non-terminal delivery are always kept):\n    MESSAGE_KEEP_LAST           Keep at most the N most recent messages per app.\n    MESSAGE_MAX_AGE     30d     Keep messages newer than this (ms|s|m|h|d, e.g. 34h).\n    AUDIT_KEEP_LAST             Keep at most the N most recent audit entries.\n    AUDIT_MAX_AGE       90d     Keep audit entries newer than this.\n\nExamples:\n  # Quick local panel (file storage, no auth):\n  npx @xtandard/webhooks serve --port 3004\n\n  # Production-ish: Redis storage + basic auth:\n  PORT=4000 AUTH_MODE=basic AUTH_USERNAME=admin AUTH_PASSWORD=secret \\\\\n    STORAGE_DRIVER=redis REDIS_URL=redis://localhost:6379 \\\\\n    npx @xtandard/webhooks serve\n\n  # Split planes: Postgres control plane + Redis queue:\n  STORAGE_DRIVER=postgres DATABASE_URL=postgres://localhost:5432/webhooks \\\\\n    QUEUE_STORAGE_DRIVER=redis REDIS_URL=redis://localhost:6379 \\\\\n    npx @xtandard/webhooks serve\n\n  # Split worker: the web process publishes only (DISPATCHER=0); this delivers:\n  STORAGE_DRIVER=redis REDIS_URL=redis://localhost:6379 \\\\\n    npx @xtandard/webhooks dispatch\n\n  # Publish from CI:\n  xtandard-webhooks publish --app acme --type invoice.paid --data '{\"invoiceId\":\"inv_1\"}'\n\n  # Debug a captured webhook on the receiving side:\n  xtandard-webhooks verify --secret whsec_… --payload-file body.json --headers-file headers.json\n\n  # Inspect webhooks locally (point an endpoint at http://localhost:4000):\n  xtandard-webhooks listen --port 4000 --secret whsec_…\n\n  # Build + fire a signed request by hand (the signature playground):\n  xtandard-webhooks sign --secret whsec_… --data '{\"hi\":1}' --url http://localhost:4000\n\nReceivers verify with @xtandard/webhooks/receiver — or any Standard Webhooks\nlibrary. Docs: https://github.com/xantiagoma/xtandard-webhooks\n`;\n}\n\n/** Entry point. Returns the process exit code. */\nexport async function run(argv: string[]): Promise<number> {\n  const { _, flags } = parseArgs(argv);\n  const command = _[0];\n\n  // `--version` (bare) / `-v` / `version` → print version. Only the boolean form\n  // is treated as \"print version\" so a future `--version <value>` flag can coexist.\n  if (flags.version === true || argv.includes(\"-v\") || command === \"version\") {\n    process.stdout.write(`${await pkgVersion()}\\n`);\n    return 0;\n  }\n\n  const wantsHelp = Boolean(flags.help) || argv.includes(\"-h\") || command === \"help\";\n  if (!command || wantsHelp) {\n    process.stdout.write(helpText(await pkgVersion()));\n    // Explicit help request → success; bare invocation with no command → usage error.\n    return wantsHelp ? 0 : 1;\n  }\n\n  try {\n    switch (command) {\n      case \"init\": {\n        const core = await makeCore();\n        const app = typeof flags.app === \"string\" ? flags.app : env(\"APP\", \"default\");\n        const existing = await core.getApplication(app);\n        if (!existing) await core.createApplication({ key: app });\n        await core.upsertEventType({\n          name: \"example.ping\",\n          description: \"Example event type created by `xtandard-webhooks init`.\",\n        });\n        process.stdout.write(\n          `Initialized application \"${app}\" with event type \"example.ping\".\\n` +\n            `Add endpoints in the panel (xtandard-webhooks serve), then:\\n` +\n            `  xtandard-webhooks publish --app ${app} --type example.ping --data '{\"hello\":\"world\"}'\\n`,\n        );\n        return 0;\n      }\n      case \"list-apps\": {\n        const core = await makeCore();\n        const apps = await core.listApplications();\n        if (apps.length === 0) process.stdout.write(\"No applications.\\n\");\n        for (const app of apps) {\n          process.stdout.write(`${app.key}${app.name ? `  ${app.name}` : \"\"}\\n`);\n        }\n        return 0;\n      }\n      case \"list-endpoints\": {\n        if (typeof flags.app !== \"string\") {\n          process.stderr.write(\"Usage: xtandard-webhooks list-endpoints --app <key>\\n\");\n          return 1;\n        }\n        const core = await makeCore();\n        const endpoints = await core.listEndpoints(flags.app);\n        if (endpoints.length === 0) process.stdout.write(\"No endpoints.\\n\");\n        for (const endpoint of endpoints) {\n          const subscriptions = endpoint.eventTypes?.length\n            ? endpoint.eventTypes.join(\",\")\n            : \"all events\";\n          process.stdout.write(\n            `${endpoint.disabled ? \"○\" : \"●\"} ${endpoint.id}  ${endpoint.url}  [${subscriptions}]\\n`,\n          );\n        }\n        return 0;\n      }\n      case \"publish\": {\n        if (typeof flags.app !== \"string\" || typeof flags.type !== \"string\") {\n          process.stderr.write(\n            \"Usage: xtandard-webhooks publish --app <key> --type <event> --data '<json>' [--idempotency-key <k>]\\n\",\n          );\n          return 1;\n        }\n        let payload: JsonValue = {};\n        if (typeof flags.data === \"string\") {\n          try {\n            payload = JSON.parse(flags.data) as JsonValue;\n          } catch {\n            process.stderr.write(\"Invalid --data JSON.\\n\");\n            return 1;\n          }\n        }\n        const core = await makeCore();\n        const idempotencyKey =\n          typeof flags[\"idempotency-key\"] === \"string\" ? flags[\"idempotency-key\"] : undefined;\n        const result = await core.publish(flags.app, {\n          eventType: flags.type,\n          payload,\n          ...(idempotencyKey !== undefined ? { idempotencyKey } : {}),\n        });\n        process.stdout.write(\n          `${result.deduplicated ? \"Deduplicated\" : \"Published\"} ${result.message.id} → ` +\n            `${result.deliveries.length} deliver${result.deliveries.length === 1 ? \"y\" : \"ies\"} queued.\\n`,\n        );\n        return 0;\n      }\n      case \"retry\": {\n        if (typeof flags.app !== \"string\" || typeof flags.delivery !== \"string\") {\n          process.stderr.write(\"Usage: xtandard-webhooks retry --app <key> --delivery <id>\\n\");\n          return 1;\n        }\n        const core = await makeCore();\n        const delivery = await core.retryDelivery(flags.app, flags.delivery);\n        process.stdout.write(`Re-queued delivery ${delivery.id} (status: ${delivery.status}).\\n`);\n        return 0;\n      }\n      case \"verify\": {\n        if (\n          typeof flags.secret !== \"string\" ||\n          typeof flags[\"payload-file\"] !== \"string\" ||\n          typeof flags[\"headers-file\"] !== \"string\"\n        ) {\n          process.stderr.write(\n            \"Usage: xtandard-webhooks verify --secret <whsec_…> --payload-file <path> --headers-file <path>\\n\",\n          );\n          return 1;\n        }\n        const { readFile } = await import(\"node:fs/promises\");\n        const payload = await readFile(flags[\"payload-file\"], \"utf8\");\n        let headers: Record<string, string>;\n        try {\n          headers = JSON.parse(await readFile(flags[\"headers-file\"], \"utf8\")) as Record<\n            string,\n            string\n          >;\n        } catch {\n          process.stderr.write(\"Invalid --headers-file: expected a JSON object of headers.\\n\");\n          return 1;\n        }\n        const { verify, WebhookVerificationError } = await import(\"./signing.ts\");\n        try {\n          const envelope = await verify({ payload, headers, secret: flags.secret });\n          process.stdout.write(`Signature OK.\\n${JSON.stringify(envelope, null, 2)}\\n`);\n          return 0;\n        } catch (err) {\n          if (err instanceof WebhookVerificationError) {\n            process.stderr.write(`Verification FAILED: ${err.message}\\n`);\n            return 1;\n          }\n          throw err;\n        }\n      }\n      case \"sign\": {\n        // The signature playground: build a fully signed Standard Webhooks\n        // request from a secret + payload, so you can curl it at a receiver or\n        // paste it into https://www.standardwebhooks.com/simulate.\n        if (typeof flags.secret !== \"string\" || typeof flags.data !== \"string\") {\n          process.stderr.write(\n            \"Usage: xtandard-webhooks sign --secret <whsec_…> --data '<json>' [--id <msg_…>] [--timestamp <unix-seconds>] [--url <post-target>]\\n\",\n          );\n          return 1;\n        }\n        // Validate the payload is JSON, but sign the exact bytes given.\n        try {\n          JSON.parse(flags.data);\n        } catch {\n          process.stderr.write(\"Invalid --data: expected a JSON string.\\n\");\n          return 1;\n        }\n        const { newId } = await import(\"./id.ts\");\n        const { sign } = await import(\"./signing.ts\");\n        const id = typeof flags.id === \"string\" ? flags.id : newId(\"msg\");\n        const timestamp =\n          typeof flags.timestamp === \"string\"\n            ? Number(flags.timestamp)\n            : Math.floor(Date.now() / 1000);\n        const signature = await sign(flags.secret, id, timestamp, flags.data);\n        const headerLines = [\n          `webhook-id: ${id}`,\n          `webhook-timestamp: ${timestamp}`,\n          `webhook-signature: ${signature}`,\n        ];\n        process.stdout.write(`${headerLines.join(\"\\n\")}\\n\\n${flags.data}\\n`);\n        if (typeof flags.url === \"string\") {\n          const curl = [\n            `curl -X POST ${flags.url} \\\\`,\n            `  -H 'content-type: application/json' \\\\`,\n            `  -H 'webhook-id: ${id}' \\\\`,\n            `  -H 'webhook-timestamp: ${timestamp}' \\\\`,\n            `  -H 'webhook-signature: ${signature}' \\\\`,\n            `  -d '${flags.data.replace(/'/g, \"'\\\\''\")}'`,\n          ].join(\"\\n\");\n          process.stdout.write(`\\n${curl}\\n`);\n        }\n        return 0;\n      }\n      case \"listen\": {\n        // A local inspecting receiver — the webhook.site you run yourself.\n        // Prints every incoming request; with --secret it verifies the\n        // signature and shows a VERIFIED/FAILED badge.\n        const port = Number((flags.port as string) || env(\"PORT\", \"4000\"));\n        const secret = typeof flags.secret === \"string\" ? flags.secret : undefined;\n        const status = typeof flags.status === \"string\" ? Number(flags.status) : 200;\n        const { verify, WebhookVerificationError } = await import(\"./signing.ts\");\n        let count = 0;\n\n        await startServer(port, async (request) => {\n          const url = new URL(request.url);\n          if (url.pathname === \"/healthcheck\") {\n            return new Response(JSON.stringify({ status: \"ok\" }), {\n              headers: { \"content-type\": \"application/json\" },\n            });\n          }\n          const body = await request.text();\n          const headers: Record<string, string> = {};\n          request.headers.forEach((value, key) => {\n            headers[key] = value;\n          });\n          let verification: InboundVerification = { state: \"unchecked\" };\n          if (secret) {\n            try {\n              await verify({ payload: body, headers, secret });\n              verification = { state: \"ok\" };\n            } catch (err) {\n              verification = {\n                state: \"failed\",\n                reason: err instanceof WebhookVerificationError ? err.message : String(err),\n              };\n            }\n          }\n          count += 1;\n          process.stdout.write(\n            formatInboundWebhook({\n              index: count,\n              method: request.method,\n              path: url.pathname,\n              headers,\n              body,\n              verification,\n              at: new Date().toISOString(),\n            }),\n          );\n          // A signature failure answers 401 so senders exercise their retry path;\n          // otherwise echo the configured status (default 200).\n          if (verification.state === \"failed\")\n            return new Response(\"invalid signature\", { status: 401 });\n          return new Response(\"ok\", { status });\n        });\n        process.stdout.write(\n          `[xtandard/webhooks] listening for webhooks on http://localhost:${port}` +\n            `${secret ? \" (verifying signatures)\" : \" (not verifying — pass --secret)\"}\\n`,\n        );\n        return await new Promise<number>(() => {});\n      }\n      case \"dispatch\": {\n        const core = await makeCore();\n        const { createDispatcher } = await import(\"./dispatcher.ts\");\n        const dispatcher = createDispatcher(core); // merges core.options.dispatcher (RETRY_SCHEDULE)\n        dispatcher.start();\n\n        const [storageDesc, queueDesc] = await Promise.all([\n          describeStorage(\"STORAGE\"),\n          env(\"QUEUE_STORAGE_DRIVER\") ? describeStorage(\"QUEUE\") : Promise.resolve(\"(same store)\"),\n        ]);\n        process.stdout.write(`[xtandard/webhooks] storage: ${storageDesc}\\n`);\n        process.stdout.write(`[xtandard/webhooks] queue:   ${queueDesc}\\n`);\n\n        // Optional minimal healthcheck server — only when a port was asked for.\n        const portRaw = typeof flags.port === \"string\" ? flags.port : env(\"PORT\");\n        if (portRaw) {\n          const port = Number(portRaw);\n          await startServer(port, (request) => {\n            const url = new URL(request.url);\n            if (url.pathname === \"/healthcheck\") {\n              return new Response(JSON.stringify({ status: \"ok\", dispatcher: \"running\" }), {\n                headers: { \"content-type\": \"application/json\" },\n              });\n            }\n            return new Response(\"Not Found\", { status: 404 });\n          });\n          process.stdout.write(\n            `[xtandard/webhooks] dispatcher running; healthcheck on http://localhost:${port}/healthcheck\\n`,\n          );\n        } else {\n          // Dispatcher timers are unref()ed by design; hold the event loop open.\n          setInterval(() => {}, 2 ** 30);\n          process.stdout.write(\"[xtandard/webhooks] dispatcher running.\\n\");\n        }\n        // The worker owns the process now; never resolve so the bin doesn't exit.\n        return await new Promise<number>(() => {});\n      }\n      case \"serve\": {\n        const port = Number((flags.port as string) || env(\"PORT\", \"3000\"));\n        const basePath = env(\"BASE_PATH\", \"\");\n        const title = env(\"TITLE\", \"@xtandard/webhooks\");\n        const logoUrl = env(\"LOGO_URL\");\n        const readonly = isTruthy(env(\"READONLY\"));\n        const authMode = env(\"AUTH_MODE\", \"none\");\n        const portalSecret = env(\"PORTAL_SECRET\");\n\n        const { createFetchHandler } = await import(\"./server/create-fetch-handler.ts\");\n        const [storage, queueStorage] = await Promise.all([\n          buildStorage(\"STORAGE\"),\n          buildQueueStorage(),\n        ]);\n        const { auth, authorization } = await buildAuth();\n\n        if (authMode === \"none\") {\n          process.stderr.write(\n            \"[xtandard/webhooks] AUTH_MODE=none — do NOT expose this publicly without authentication.\\n\",\n          );\n        }\n\n        const retention = retentionFromEnv();\n        const panel = createFetchHandler({\n          storage,\n          ...(queueStorage ? { queueStorage } : {}),\n          basePath,\n          title,\n          ...(logoUrl ? { logoUrl } : {}),\n          readonly,\n          auth,\n          authorization,\n          ...(portalSecret ? { portal: { secret: portalSecret } } : {}),\n          ...(retention ? { retention } : {}),\n          dispatcher: dispatcherEnabled() ? dispatcherOptionsFromEnv() : false,\n        });\n\n        const normalizedBase =\n          basePath && basePath !== \"/\"\n            ? basePath.startsWith(\"/\")\n              ? basePath\n              : `/${basePath}`\n            : \"\";\n\n        const handler: FetchHandler = (request) => {\n          const url = new URL(request.url);\n          if (url.pathname === \"/healthcheck\" || url.pathname === `${normalizedBase}/healthcheck`) {\n            return new Response(JSON.stringify({ status: \"ok\", title }), {\n              headers: { \"content-type\": \"application/json\" },\n            });\n          }\n          return panel.fetch(request);\n        };\n\n        const [storageDesc, queueDesc] = await Promise.all([\n          describeStorage(\"STORAGE\"),\n          env(\"QUEUE_STORAGE_DRIVER\") ? describeStorage(\"QUEUE\") : Promise.resolve(\"(same store)\"),\n        ]);\n        process.stdout.write(`[xtandard/webhooks] storage: ${storageDesc}\\n`);\n        process.stdout.write(`[xtandard/webhooks] queue:   ${queueDesc}\\n`);\n        process.stdout.write(\n          `[xtandard/webhooks] dispatcher: ${panel.dispatcher ? \"running\" : \"disabled (DISPATCHER=0)\"}\\n`,\n        );\n\n        await startServer(port, handler);\n        process.stdout.write(\n          `[xtandard/webhooks] listening on http://localhost:${port}${normalizedBase || \"/\"}\\n`,\n        );\n        // The server owns the process now; never resolve so the bin doesn't exit.\n        return await new Promise<number>(() => {});\n      }\n      default:\n        process.stderr.write(`Unknown command: ${command}\\n\\n${helpText(await pkgVersion())}`);\n        return 1;\n    }\n  } catch (err) {\n    process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\\n`);\n    return 1;\n  }\n}\n"],"mappings":";;AAiCA,MAAM,OAAO,KAAa,WAAW,OAAe,QAAQ,IAAI,QAAQ;AAExE,MAAM,YAAY,UAA2B,UAAU,OAAO,MAAM,YAAY,MAAM;;;;;AAMtF,MAAM,aAAa,SACjB,SAAS,YAAY,mBAAmB;;;;;AAM1C,SAAS,iBAAiB,MAA2C;CACnE,MAAM,MAAM,IAAI,IAAI;CACpB,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,IAAI;EACF,aAAa,GAAsB;EACnC,OAAO;CACT,QAAQ;EACN,QAAQ,OAAO,MACb,gCAAgC,KAAK,IAAI,IAAI,oEAC/C;EACA;CACF;AACF;;;;;AAMA,SAAS,mBAAiD;CACxD,MAAM,QAAQ,SAAiB,WAA8C;EAC3E,MAAM,UAAU,IAAI,OAAO;EAC3B,MAAM,WAAW,WAAW,QAAQ,KAAK,OAAO,IAAI,OAAO,OAAO,IAAI,KAAA;EACtE,IAAI,WAAW,aAAa,KAAA,GAC1B,QAAQ,OAAO,MACb,gCAAgC,QAAQ,IAAI,QAAQ,yBACtD;EAEF,MAAM,SAAS,iBAAiB,MAAM;EACtC,IAAI,aAAa,KAAA,KAAa,CAAC,QAAQ,OAAO,KAAA;EAC9C,OAAO;GACL,GAAI,aAAa,KAAA,IAAY,EAAE,SAAS,IAAI,CAAC;GAC7C,GAAI,WAAW,KAAA,IAAY,EAAE,OAAO,IAAI,CAAC;EAC3C;CACF;CACA,MAAM,WAAW,KAAK,qBAAqB,iBAAiB;CAC5D,MAAM,QAAQ,KAAK,mBAAmB,eAAe;CACrD,IAAI,CAAC,YAAY,CAAC,OAAO,OAAO,KAAA;CAChC,OAAO;EACL,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;EAC/B,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;CAC3B;AACF;;AAGA,SAAS,2BAA8C;CACrD,MAAM,MAAM,IAAI,gBAAgB;CAChC,IAAI,CAAC,KAAK,OAAO,CAAC;CAClB,IAAI;EACF,OAAO,EAAE,eAAe,kBAAkB,GAAG,EAAE;CACjD,QAAQ;EACN,QAAQ,OAAO,MACb,gDAAgD,IAAI,0EACtD;EACA,OAAO,CAAC;CACV;AACF;;AAGA,SAAS,oBAA6B;CACpC,MAAM,MAAM,IAAI,YAAY;CAC5B,IAAI,CAAC,KAAK,OAAO;CACjB,OAAO,EAAE,QAAQ,OAAO,IAAI,YAAY,MAAM;AAChD;;;;;;;AAQA,eAAe,aAAa,MAAsC;CAChE,MAAM,SAAU,IAAI,UAAU,IAAI,GAAG,MAAM,KAAgB;CAC3D,MAAM,IAAI,KAAK,YAAY;CAC3B,QAAQ,QAAR;EACE,KAAK,SAAS;GACZ,MAAM,EAAE,uBAAuB,MAAM,OAAO,wBAAA,MAAA,MAAA,EAAA,CAAA;GAC5C,OAAO,mBAAmB;IACxB,KAAK,IAAI,aAAa,wBAAwB;IAC9C,QAAQ,IAAI,GAAG,KAAK,UAAU,qBAAqB,GAAG;GACxD,CAAC;EACH;EACA,KAAK,YAAY;GACf,MAAM,EAAE,0BAA0B,MAAM,OAAO,2BAAA,MAAA,MAAA,EAAA,CAAA;GAC/C,OAAO,sBAAsB;IAC3B,kBACE,IAAI,cAAc,KAAK,IAAI,gBAAgB,oCAAoC;IACjF,OAAO,IAAI,GAAG,KAAK,YAAY,qBAAqB,GAAG;GACzD,CAAC;EACH;EACA,KAAK,WAAW;GACd,MAAM,EAAE,uBAAuB,MAAM,OAAO,0BAAA,MAAA,MAAA,EAAA,CAAA;GAC5C,OAAO,mBAAmB;IACxB,KAAK,IAAI,aAAa,2BAA2B;IACjD,QAAQ,IAAI,YAAY,mBAAmB;IAC3C,gBAAgB,IAAI,GAAG,KAAK,oBAAoB,YAAY,GAAG;GACjE,CAAC;EACH;EACA,KAAK,UAAU;GAEb,MAAM,EAAE,wBAAwB,MAAM,OAAO,yBAAA,MAAA,MAAA,EAAA,CAAA;GAC7C,OAAO,oBAAoB,EACzB,MAAM,IAAI,GAAG,KAAK,eAAe,eAAe,EAAE,QAAQ,EAC5D,CAAC;EACH;EACA,KAAK,UAAU;GACb,MAAM,EAAE,wBAAwB,MAAM,OAAO,yBAAA,MAAA,MAAA,EAAA,CAAA;GAC7C,MAAM,YAAY,IAAI,mBAAmB;GACzC,OAAO,oBAAoB;IACzB,KAAK,IAAI,GAAG,KAAK,YAAY,KAAK,IAAI,cAAc,oBAAoB,EAAE,IAAI;IAC9E,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;GACnC,CAAC;EACH;EACA,KAAK,UAAU;GACb,MAAM,EAAE,wBAAwB,MAAM,OAAO,yBAAA,MAAA,MAAA,EAAA,CAAA;GAC7C,OAAO,oBAAoB;EAC7B;EAEA,SAAS;GACP,MAAM,EAAE,sBAAsB,MAAM,OAAO,uBAAA,MAAA,MAAA,EAAA,CAAA;GAC3C,OAAO,kBAAkB,EAAE,KAAK,IAAI,GAAG,KAAK,YAAY,eAAe,GAAG,EAAE,CAAC;EAC/E;CACF;AACF;;;;;;AAOA,eAAe,oBAA0D;CACvE,IAAI,CAAC,IAAI,sBAAsB,GAAG,OAAO,KAAA;CACzC,OAAO,aAAa,OAAO;AAC7B;;;;;;;;AASA,eAAe,gBAAgB,MAA6B;CAC1D,MAAM,EAAE,YAAY,MAAM,OAAO;CACjC,MAAM,SAAU,IAAI,UAAU,IAAI,GAAG,MAAM,KAAgB;CAC3D,MAAM,IAAI,KAAK,YAAY;CAC3B,QAAQ,QAAR;EACE,KAAK,QACH,OAAO,UAAU,QAAQ,IAAI,GAAG,KAAK,YAAY,eAAe,GAAG,CAAC;EACtE,KAAK,UACH,OAAO,YAAY,QAAQ,IAAI,GAAG,KAAK,eAAe,eAAe,EAAE,QAAQ,CAAC;EAClF,KAAK,UACH,OAAO;EACT,SACE,OAAO;CACX;AACF;;AAGA,eAAe,YAAmF;CAEhG,IADa,IAAI,aAAa,MACvB,MAAM,SAAS;EACpB,MAAM,CAAC,EAAE,aAAa,EAAE,wBAAwB,MAAM,QAAQ,IAAI,CAChE,OAAO,wBAAA,MAAA,MAAA,EAAA,CAAA,GACP,OAAO,wBAAA,MAAA,MAAA,EAAA,CAAA,CACT,CAAC;EACD,MAAM,eAAe,IAAI,oBAAoB;EAC7C,MAAM,WAAW,IAAI,eAAe;EACpC,IAAI,CAAC,gBAAgB,CAAC,UACpB,QAAQ,OAAO,MACb,gGACF;EAEF,OAAO;GACL,MAAM,UAAU,EACd,OAAO,CACL;IACE,UAAU,IAAI,iBAAiB,OAAO;IACtC,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;IACvC,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;IAC/B,OAAO,CAAC,OAAO;GACjB,CACF,EACF,CAAC;GACD,eAAe,mBAAmB,CAAC,CAAC;EACtC;CACF;CACA,MAAM,CAAC,EAAE,UAAU,EAAE,qBAAqB,MAAM,QAAQ,IAAI,CAC1D,OAAO,uBAAA,MAAA,MAAA,EAAA,CAAA,GACP,OAAO,uBAAA,MAAA,MAAA,EAAA,CAAA,CACT,CAAC;CACD,OAAO;EAAE,MAAM,OAAO;EAAG,eAAe,gBAAgB;CAAE;AAC5D;;;;;;AASA,eAAe,YAAY,MAAc,OAAoC;CAC3E,MAAM,MAAO,WAAkE;CAC/E,IAAI,KAAK;EACP,IAAI,MAAM;GAAE;GAAM;EAAM,CAAC;EACzB;CACF;CACA,MAAM,EAAE,iBAAiB,MAAM,OAAO;CACtC,MAAM,SAAS,cAAc,KAAK,QAAQ;EACxC,CAAM,YAAY;GAChB,IAAI;IACF,MAAM,SAAmB,CAAC;IAC1B,WAAW,MAAM,KAAK,KAAK,OAAO,KAAK,CAAW;IAClD,MAAM,SAAS,IAAI,UAAU;IAC7B,MAAM,UAAU,IAAI,QAAQ;IAC5B,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,IAAI,OAAO,GAAG;KAChD,IAAI,MAAM,KAAA,GAAW;KACrB,QAAQ,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IACpD;IAEA,MAAM,MAAM,UADC,IAAI,QAAQ,QAAQ,aAAa,SACjB,IAAI,OAAO;IACxC,MAAM,UAAU,WAAW,SAAS,WAAW,UAAU,OAAO,SAAS;IAMzE,MAAM,WAAW,MAAM,MAAM,IALT,QAAQ,KAAK;KAC/B;KACA;KACA,MAAM,UAAU,OAAO,OAAO,MAAM,IAAI,KAAA;IAC1C,CACmC,CAAC;IACpC,IAAI,aAAa,SAAS;IAC1B,SAAS,QAAQ,SAAS,OAAO,QAAQ,IAAI,UAAU,KAAK,KAAK,CAAC;IAClE,IAAI,IAAI,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC,CAAC;GACnD,SAAS,KAAK;IACZ,IAAI,aAAa;IACjB,IAAI,IAAI,mBAAmB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG;GAC/E;EACF,GAAG;CACL,CAAC;CACD,MAAM,IAAI,SAAe,YAAY,OAAO,OAAO,MAAM,OAAO,CAAC;AACnE;;;;;AAYA,SAAgB,qBAAqB,OAQ1B;CACT,MAAM,MAAM,SAAiB,MAAM,QAAQ,SAAS,MAAM,QAAQ,KAAK,YAAY,MAAM;CACzF,MAAM,QACJ,MAAM,aAAa,UAAU,OACzB,wBACA,MAAM,aAAa,UAAU,WAC3B,sBAAsB,MAAM,aAAa,OAAO,KAChD;CACR,IAAI,aAAa,MAAM;CACvB,IAAI;EACF,aAAa,KAAK,UAAU,KAAK,MAAM,MAAM,IAAI,GAAG,MAAM,CAAC;CAC7D,QAAQ,CAER;CACA,OAAO;EACL,SAAS,MAAM,MAAM,IAAI,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,MAAM,GAAG;EACjE,sBAAsB,GAAG,YAAY;EACrC,sBAAsB,GAAG,mBAAmB;EAC5C,sBAAsB,GAAG,mBAAmB;EAC5C;EACA;EACA;EACA;CACF,EAAE,KAAK,IAAI;AACb;;AAGA,SAAS,UAAU,MAA0E;CAC3F,MAAM,IAAc,CAAC;CACrB,MAAM,QAA0C,CAAC;CACjD,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,IAAI,KAAK;EACf,IAAI,EAAE,WAAW,IAAI,GAAG;GACtB,MAAM,MAAM,EAAE,MAAM,CAAC;GACrB,MAAM,OAAO,KAAK,IAAI;GACtB,IAAI,SAAS,KAAA,KAAa,KAAK,WAAW,IAAI,GAAG,MAAM,OAAO;QACzD;IACH,MAAM,OAAO;IACb;GACF;EACF,OAAO,EAAE,KAAK,CAAC;CACjB;CACA,OAAO;EAAE;EAAG;CAAM;AACpB;;AAGA,eAAe,WAAkC;CAC/C,MAAM,CAAC,SAAS,gBAAgB,MAAM,QAAQ,IAAI,CAAC,aAAa,SAAS,GAAG,kBAAkB,CAAC,CAAC;CAChG,MAAM,YAAY,iBAAiB;CACnC,OAAO,mBAAmB;EACxB;EACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;EACvC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;EACjC,YAAY,yBAAyB;CACvC,CAAC;AACH;;AAGA,eAAe,aAA8B;CAC3C,IAAI;EACF,MAAM,EAAE,aAAa,MAAM,OAAO;EAClC,MAAM,EAAE,kBAAkB,MAAM,OAAO;EAIvC,OAHY,KAAK,MACf,MAAM,SAAS,cAAc,IAAI,IAAI,mBAAmB,OAAO,KAAK,GAAG,CAAC,GAAG,MAAM,CAE1E,EAAE,WAAW;CACxB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,SAAS,SAAyB;CACzC,OAAO,sBAAsB,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4GvC;;AAGA,eAAsB,IAAI,MAAiC;CACzD,MAAM,EAAE,GAAG,UAAU,UAAU,IAAI;CACnC,MAAM,UAAU,EAAE;CAIlB,IAAI,MAAM,YAAY,QAAQ,KAAK,SAAS,IAAI,KAAK,YAAY,WAAW;EAC1E,QAAQ,OAAO,MAAM,GAAG,MAAM,WAAW,EAAE,GAAG;EAC9C,OAAO;CACT;CAEA,MAAM,YAAY,QAAQ,MAAM,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,YAAY;CAC5E,IAAI,CAAC,WAAW,WAAW;EACzB,QAAQ,OAAO,MAAM,SAAS,MAAM,WAAW,CAAC,CAAC;EAEjD,OAAO,YAAY,IAAI;CACzB;CAEA,IAAI;EACF,QAAQ,SAAR;GACE,KAAK,QAAQ;IACX,MAAM,OAAO,MAAM,SAAS;IAC5B,MAAM,MAAM,OAAO,MAAM,QAAQ,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS;IAE5E,IAAI,CAAC,MADkB,KAAK,eAAe,GAAG,GAC/B,MAAM,KAAK,kBAAkB,EAAE,KAAK,IAAI,CAAC;IACxD,MAAM,KAAK,gBAAgB;KACzB,MAAM;KACN,aAAa;IACf,CAAC;IACD,QAAQ,OAAO,MACb,4BAA4B,IAAI,oIAEO,IAAI,kDAC7C;IACA,OAAO;GACT;GACA,KAAK,aAAa;IAEhB,MAAM,OAAO,OAAM,MADA,SAAS,GACJ,iBAAiB;IACzC,IAAI,KAAK,WAAW,GAAG,QAAQ,OAAO,MAAM,oBAAoB;IAChE,KAAK,MAAM,OAAO,MAChB,QAAQ,OAAO,MAAM,GAAG,IAAI,MAAM,IAAI,OAAO,KAAK,IAAI,SAAS,GAAG,GAAG;IAEvE,OAAO;GACT;GACA,KAAK,kBAAkB;IACrB,IAAI,OAAO,MAAM,QAAQ,UAAU;KACjC,QAAQ,OAAO,MAAM,uDAAuD;KAC5E,OAAO;IACT;IAEA,MAAM,YAAY,OAAM,MADL,SAAS,GACC,cAAc,MAAM,GAAG;IACpD,IAAI,UAAU,WAAW,GAAG,QAAQ,OAAO,MAAM,iBAAiB;IAClE,KAAK,MAAM,YAAY,WAAW;KAChC,MAAM,gBAAgB,SAAS,YAAY,SACvC,SAAS,WAAW,KAAK,GAAG,IAC5B;KACJ,QAAQ,OAAO,MACb,GAAG,SAAS,WAAW,MAAM,IAAI,GAAG,SAAS,GAAG,IAAI,SAAS,IAAI,KAAK,cAAc,IACtF;IACF;IACA,OAAO;GACT;GACA,KAAK,WAAW;IACd,IAAI,OAAO,MAAM,QAAQ,YAAY,OAAO,MAAM,SAAS,UAAU;KACnE,QAAQ,OAAO,MACb,uGACF;KACA,OAAO;IACT;IACA,IAAI,UAAqB,CAAC;IAC1B,IAAI,OAAO,MAAM,SAAS,UACxB,IAAI;KACF,UAAU,KAAK,MAAM,MAAM,IAAI;IACjC,QAAQ;KACN,QAAQ,OAAO,MAAM,wBAAwB;KAC7C,OAAO;IACT;IAEF,MAAM,OAAO,MAAM,SAAS;IAC5B,MAAM,iBACJ,OAAO,MAAM,uBAAuB,WAAW,MAAM,qBAAqB,KAAA;IAC5E,MAAM,SAAS,MAAM,KAAK,QAAQ,MAAM,KAAK;KAC3C,WAAW,MAAM;KACjB;KACA,GAAI,mBAAmB,KAAA,IAAY,EAAE,eAAe,IAAI,CAAC;IAC3D,CAAC;IACD,QAAQ,OAAO,MACb,GAAG,OAAO,eAAe,iBAAiB,YAAY,GAAG,OAAO,QAAQ,GAAG,KACtE,OAAO,WAAW,OAAO,UAAU,OAAO,WAAW,WAAW,IAAI,MAAM,MAAM,WACvF;IACA,OAAO;GACT;GACA,KAAK,SAAS;IACZ,IAAI,OAAO,MAAM,QAAQ,YAAY,OAAO,MAAM,aAAa,UAAU;KACvE,QAAQ,OAAO,MAAM,8DAA8D;KACnF,OAAO;IACT;IAEA,MAAM,WAAW,OAAM,MADJ,SAAS,GACA,cAAc,MAAM,KAAK,MAAM,QAAQ;IACnE,QAAQ,OAAO,MAAM,sBAAsB,SAAS,GAAG,YAAY,SAAS,OAAO,KAAK;IACxF,OAAO;GACT;GACA,KAAK,UAAU;IACb,IACE,OAAO,MAAM,WAAW,YACxB,OAAO,MAAM,oBAAoB,YACjC,OAAO,MAAM,oBAAoB,UACjC;KACA,QAAQ,OAAO,MACb,kGACF;KACA,OAAO;IACT;IACA,MAAM,EAAE,aAAa,MAAM,OAAO;IAClC,MAAM,UAAU,MAAM,SAAS,MAAM,iBAAiB,MAAM;IAC5D,IAAI;IACJ,IAAI;KACF,UAAU,KAAK,MAAM,MAAM,SAAS,MAAM,iBAAiB,MAAM,CAAC;IAIpE,QAAQ;KACN,QAAQ,OAAO,MAAM,8DAA8D;KACnF,OAAO;IACT;IACA,MAAM,EAAE,QAAQ,6BAA6B,MAAM,OAAO;IAC1D,IAAI;KACF,MAAM,WAAW,MAAM,OAAO;MAAE;MAAS;MAAS,QAAQ,MAAM;KAAO,CAAC;KACxE,QAAQ,OAAO,MAAM,kBAAkB,KAAK,UAAU,UAAU,MAAM,CAAC,EAAE,GAAG;KAC5E,OAAO;IACT,SAAS,KAAK;KACZ,IAAI,eAAe,0BAA0B;MAC3C,QAAQ,OAAO,MAAM,wBAAwB,IAAI,QAAQ,GAAG;MAC5D,OAAO;KACT;KACA,MAAM;IACR;GACF;GACA,KAAK,QAAQ;IAIX,IAAI,OAAO,MAAM,WAAW,YAAY,OAAO,MAAM,SAAS,UAAU;KACtE,QAAQ,OAAO,MACb,sIACF;KACA,OAAO;IACT;IAEA,IAAI;KACF,KAAK,MAAM,MAAM,IAAI;IACvB,QAAQ;KACN,QAAQ,OAAO,MAAM,2CAA2C;KAChE,OAAO;IACT;IACA,MAAM,EAAE,UAAU,MAAM,OAAO,uBAAA,MAAA,MAAA,EAAA,CAAA;IAC/B,MAAM,EAAE,SAAS,MAAM,OAAO;IAC9B,MAAM,KAAK,OAAO,MAAM,OAAO,WAAW,MAAM,KAAK,MAAM,KAAK;IAChE,MAAM,YACJ,OAAO,MAAM,cAAc,WACvB,OAAO,MAAM,SAAS,IACtB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;IAClC,MAAM,YAAY,MAAM,KAAK,MAAM,QAAQ,IAAI,WAAW,MAAM,IAAI;IACpE,MAAM,cAAc;KAClB,eAAe;KACf,sBAAsB;KACtB,sBAAsB;IACxB;IACA,QAAQ,OAAO,MAAM,GAAG,YAAY,KAAK,IAAI,EAAE,MAAM,MAAM,KAAK,GAAG;IACnE,IAAI,OAAO,MAAM,QAAQ,UAAU;KACjC,MAAM,OAAO;MACX,gBAAgB,MAAM,IAAI;MAC1B;MACA,qBAAqB,GAAG;MACxB,4BAA4B,UAAU;MACtC,4BAA4B,UAAU;MACtC,SAAS,MAAM,KAAK,QAAQ,MAAM,OAAO,EAAE;KAC7C,EAAE,KAAK,IAAI;KACX,QAAQ,OAAO,MAAM,KAAK,KAAK,GAAG;IACpC;IACA,OAAO;GACT;GACA,KAAK,UAAU;IAIb,MAAM,OAAO,OAAQ,MAAM,QAAmB,IAAI,QAAQ,MAAM,CAAC;IACjE,MAAM,SAAS,OAAO,MAAM,WAAW,WAAW,MAAM,SAAS,KAAA;IACjE,MAAM,SAAS,OAAO,MAAM,WAAW,WAAW,OAAO,MAAM,MAAM,IAAI;IACzE,MAAM,EAAE,QAAQ,6BAA6B,MAAM,OAAO;IAC1D,IAAI,QAAQ;IAEZ,MAAM,YAAY,MAAM,OAAO,YAAY;KACzC,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;KAC/B,IAAI,IAAI,aAAa,gBACnB,OAAO,IAAI,SAAS,KAAK,UAAU,EAAE,QAAQ,KAAK,CAAC,GAAG,EACpD,SAAS,EAAE,gBAAgB,mBAAmB,EAChD,CAAC;KAEH,MAAM,OAAO,MAAM,QAAQ,KAAK;KAChC,MAAM,UAAkC,CAAC;KACzC,QAAQ,QAAQ,SAAS,OAAO,QAAQ;MACtC,QAAQ,OAAO;KACjB,CAAC;KACD,IAAI,eAAoC,EAAE,OAAO,YAAY;KAC7D,IAAI,QACF,IAAI;MACF,MAAM,OAAO;OAAE,SAAS;OAAM;OAAS;MAAO,CAAC;MAC/C,eAAe,EAAE,OAAO,KAAK;KAC/B,SAAS,KAAK;MACZ,eAAe;OACb,OAAO;OACP,QAAQ,eAAe,2BAA2B,IAAI,UAAU,OAAO,GAAG;MAC5E;KACF;KAEF,SAAS;KACT,QAAQ,OAAO,MACb,qBAAqB;MACnB,OAAO;MACP,QAAQ,QAAQ;MAChB,MAAM,IAAI;MACV;MACA;MACA;MACA,qBAAI,IAAI,KAAK,GAAE,YAAY;KAC7B,CAAC,CACH;KAGA,IAAI,aAAa,UAAU,UACzB,OAAO,IAAI,SAAS,qBAAqB,EAAE,QAAQ,IAAI,CAAC;KAC1D,OAAO,IAAI,SAAS,MAAM,EAAE,OAAO,CAAC;IACtC,CAAC;IACD,QAAQ,OAAO,MACb,kEAAkE,OAC7D,SAAS,4BAA4B,mCAAmC,GAC/E;IACA,OAAO,MAAM,IAAI,cAAsB,CAAC,CAAC;GAC3C;GACA,KAAK,YAAY;IACf,MAAM,OAAO,MAAM,SAAS;IAC5B,MAAM,EAAE,qBAAqB,MAAM,OAAO,6BAAA,MAAA,MAAA,EAAA,CAAA;IAE1C,iBADoC,IAC3B,EAAE,MAAM;IAEjB,MAAM,CAAC,aAAa,aAAa,MAAM,QAAQ,IAAI,CACjD,gBAAgB,SAAS,GACzB,IAAI,sBAAsB,IAAI,gBAAgB,OAAO,IAAI,QAAQ,QAAQ,cAAc,CACzF,CAAC;IACD,QAAQ,OAAO,MAAM,gCAAgC,YAAY,GAAG;IACpE,QAAQ,OAAO,MAAM,gCAAgC,UAAU,GAAG;IAGlE,MAAM,UAAU,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO,IAAI,MAAM;IACxE,IAAI,SAAS;KACX,MAAM,OAAO,OAAO,OAAO;KAC3B,MAAM,YAAY,OAAO,YAAY;MAEnC,IAAI,IADY,IAAI,QAAQ,GACtB,EAAE,aAAa,gBACnB,OAAO,IAAI,SAAS,KAAK,UAAU;OAAE,QAAQ;OAAM,YAAY;MAAU,CAAC,GAAG,EAC3E,SAAS,EAAE,gBAAgB,mBAAmB,EAChD,CAAC;MAEH,OAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;KAClD,CAAC;KACD,QAAQ,OAAO,MACb,2EAA2E,KAAK,eAClF;IACF,OAAO;KAEL,kBAAkB,CAAC,GAAG,KAAK,EAAE;KAC7B,QAAQ,OAAO,MAAM,2CAA2C;IAClE;IAEA,OAAO,MAAM,IAAI,cAAsB,CAAC,CAAC;GAC3C;GACA,KAAK,SAAS;IACZ,MAAM,OAAO,OAAQ,MAAM,QAAmB,IAAI,QAAQ,MAAM,CAAC;IACjE,MAAM,WAAW,IAAI,aAAa,EAAE;IACpC,MAAM,QAAQ,IAAI,SAAS,oBAAoB;IAC/C,MAAM,UAAU,IAAI,UAAU;IAC9B,MAAM,WAAW,SAAS,IAAI,UAAU,CAAC;IACzC,MAAM,WAAW,IAAI,aAAa,MAAM;IACxC,MAAM,eAAe,IAAI,eAAe;IAExC,MAAM,EAAE,uBAAuB,MAAM,OAAO,uCAAA,MAAA,MAAA,EAAA,CAAA;IAC5C,MAAM,CAAC,SAAS,gBAAgB,MAAM,QAAQ,IAAI,CAChD,aAAa,SAAS,GACtB,kBAAkB,CACpB,CAAC;IACD,MAAM,EAAE,MAAM,kBAAkB,MAAM,UAAU;IAEhD,IAAI,aAAa,QACf,QAAQ,OAAO,MACb,4FACF;IAGF,MAAM,YAAY,iBAAiB;IACnC,MAAM,QAAQ,mBAAmB;KAC/B;KACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;KACvC;KACA;KACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;KAC7B;KACA;KACA;KACA,GAAI,eAAe,EAAE,QAAQ,EAAE,QAAQ,aAAa,EAAE,IAAI,CAAC;KAC3D,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;KACjC,YAAY,kBAAkB,IAAI,yBAAyB,IAAI;IACjE,CAAC;IAED,MAAM,iBACJ,YAAY,aAAa,MACrB,SAAS,WAAW,GAAG,IACrB,WACA,IAAI,aACN;IAEN,MAAM,WAAyB,YAAY;KACzC,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;KAC/B,IAAI,IAAI,aAAa,kBAAkB,IAAI,aAAa,GAAG,eAAe,eACxE,OAAO,IAAI,SAAS,KAAK,UAAU;MAAE,QAAQ;MAAM;KAAM,CAAC,GAAG,EAC3D,SAAS,EAAE,gBAAgB,mBAAmB,EAChD,CAAC;KAEH,OAAO,MAAM,MAAM,OAAO;IAC5B;IAEA,MAAM,CAAC,aAAa,aAAa,MAAM,QAAQ,IAAI,CACjD,gBAAgB,SAAS,GACzB,IAAI,sBAAsB,IAAI,gBAAgB,OAAO,IAAI,QAAQ,QAAQ,cAAc,CACzF,CAAC;IACD,QAAQ,OAAO,MAAM,gCAAgC,YAAY,GAAG;IACpE,QAAQ,OAAO,MAAM,gCAAgC,UAAU,GAAG;IAClE,QAAQ,OAAO,MACb,mCAAmC,MAAM,aAAa,YAAY,0BAA0B,GAC9F;IAEA,MAAM,YAAY,MAAM,OAAO;IAC/B,QAAQ,OAAO,MACb,qDAAqD,OAAO,kBAAkB,IAAI,GACpF;IAEA,OAAO,MAAM,IAAI,cAAsB,CAAC,CAAC;GAC3C;GACA;IACE,QAAQ,OAAO,MAAM,oBAAoB,QAAQ,MAAM,SAAS,MAAM,WAAW,CAAC,GAAG;IACrF,OAAO;EACX;CACF,SAAS,KAAK;EACZ,QAAQ,OAAO,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,GAAG;EACnF,OAAO;CACT;AACF"}

package/dist/contract-8h-Azxa5.d.cts

@@ -0,0 +1,71 @@
+import { o as Delivery } from "./schema-mo__wv4P.cjs";
+
+//#region src/storage/contract.d.ts
+/** The minimal key/value contract every storage backend must satisfy. */
+interface WebhooksStorage {
+  /** Read a value, or `null` if absent. */
+  getItem<T>(key: string): Promise<T | null>;
+  /** Write a value (overwriting any existing). */
+  setItem<T>(key: string, value: T): Promise<void>;
+  /** Delete a key (no-op if absent). */
+  removeItem(key: string): Promise<void>;
+  /** List all keys beginning with `prefix`. */
+  getKeys(prefix: string): Promise<string[]>;
+}
+/** A storage change event delivered to {@link WatchableWebhooksStorage.watch} callbacks. */
+interface StorageChangeEvent {
+  type: "update" | "remove";
+  key: string;
+}
+/** Storage that can push change notifications (e.g. Redis pub/sub, fs.watch). */
+interface WatchableWebhooksStorage extends WebhooksStorage {
+  /**
+   * Subscribe to changes under `prefix`. Resolves to an unsubscribe function.
+   */
+  watch(prefix: string, callback: (event: StorageChangeEvent) => void): Promise<() => void>;
+}
+/** Storage that supports atomic multi-key transactions. */
+interface TransactionalWebhooksStorage extends WebhooksStorage {
+  transaction<T>(callback: (tx: WebhooksStorage) => Promise<T>): Promise<T>;
+}
+/** Storage that supports optimistic concurrency via compare-and-swap. */
+interface CompareAndSwapWebhooksStorage extends WebhooksStorage {
+  compareAndSwap<T>(input: {
+    key: string;
+    expected: T | null;
+    next: T;
+  }): Promise<boolean>;
+}
+/**
+ * Storage that can natively claim due deliveries (sorted-set / `SKIP LOCKED`
+ * class backends). When present, the dispatcher delegates claiming entirely to
+ * the adapter instead of scanning the generic due index.
+ *
+ * The claim contract: atomically transition each returned delivery to
+ * `status: "delivering"` with `leaseUntil = now + leaseMs`, reposition its due
+ * entry at the lease expiry (so a crashed claimer's work re-surfaces), and
+ * never return the same delivery to two concurrent claimers.
+ */
+interface DeliveryQueueStorage extends WebhooksStorage {
+  claimDue(input: {
+    now: string;
+    limit: number;
+    leaseMs: number;
+  }): Promise<Delivery[]>;
+}
+/** Runtime feature-detection: does this storage implement `watch`? */
+declare function isWatchable(storage: WebhooksStorage): storage is WatchableWebhooksStorage;
+/** Runtime feature-detection: does this storage implement `transaction`? */
+declare function isTransactional(storage: WebhooksStorage): storage is TransactionalWebhooksStorage;
+/** Runtime feature-detection: does this storage implement `compareAndSwap`? */
+declare function isCompareAndSwap(storage: WebhooksStorage): storage is CompareAndSwapWebhooksStorage;
+/** Runtime feature-detection: does this storage implement `claimDue`? */
+declare function hasDeliveryQueue(storage: WebhooksStorage): storage is DeliveryQueueStorage;
+/**
+ * Helper for adapters whose subpath requires an optional peer dependency. Throws
+ * a clear, actionable error when the peer is missing.
+ */
+declare function requirePeer(name: string, subpath: string): never;
+//#endregion
+export { WatchableWebhooksStorage as a, isCompareAndSwap as c, requirePeer as d, TransactionalWebhooksStorage as i, isTransactional as l, DeliveryQueueStorage as n, WebhooksStorage as o, StorageChangeEvent as r, hasDeliveryQueue as s, CompareAndSwapWebhooksStorage as t, isWatchable as u };
+//# sourceMappingURL=contract-8h-Azxa5.d.cts.map

package/dist/contract-9XpcwcCn.mjs

@@ -0,0 +1,22 @@
+//#region src/authorization/contract.ts
+/** Actions that mutate state — blocked in readonly mode. */
+const MUTATING_ACTIONS = new Set([
+	"application:create",
+	"application:update",
+	"application:delete",
+	"event-type:create",
+	"event-type:update",
+	"event-type:delete",
+	"endpoint:create",
+	"endpoint:update",
+	"endpoint:delete",
+	"endpoint:rotate-secret",
+	"message:publish",
+	"delivery:retry"
+]);
+/** True if the action mutates state. */
+const isMutatingAction = (action) => MUTATING_ACTIONS.has(action);
+//#endregion
+export { isMutatingAction as n, MUTATING_ACTIONS as t };
+
+//# sourceMappingURL=contract-9XpcwcCn.mjs.map

package/dist/contract-9XpcwcCn.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-9XpcwcCn.mjs","names":[],"sources":["../src/authorization/contract.ts"],"sourcesContent":["/**\n * Authorization contract. Answers: \"Can this principal perform this action on\n * this resource?\"\n *\n * Every mutating admin API route consults the {@link AuthorizationProvider}.\n * Ships `none`/`roles`/`delegated` implementations.\n *\n * @module\n */\n\nimport type { Principal } from \"../auth/contract.ts\";\n\n/** The full set of authorizable actions. */\nexport type WebhooksAction =\n  | \"application:read\"\n  | \"application:create\"\n  | \"application:update\"\n  | \"application:delete\"\n  | \"event-type:read\"\n  | \"event-type:create\"\n  | \"event-type:update\"\n  | \"event-type:delete\"\n  | \"endpoint:read\"\n  | \"endpoint:create\"\n  | \"endpoint:update\"\n  | \"endpoint:delete\"\n  | \"endpoint:rotate-secret\"\n  | \"endpoint:read-secret\"\n  | \"message:read\"\n  | \"message:publish\"\n  | \"delivery:read\"\n  | \"delivery:retry\"\n  | \"audit:read\";\n\n/** The resource an action targets. */\nexport type WebhooksResource =\n  | { type: \"application\"; applicationKey: string }\n  | { type: \"event-type\"; name: string }\n  | { type: \"endpoint\"; applicationKey: string; endpointId: string }\n  | { type: \"message\"; applicationKey: string; messageId?: string }\n  | { type: \"delivery\"; applicationKey: string; deliveryId?: string }\n  | { type: \"audit\"; applicationKey?: string };\n\n/** Input passed to {@link AuthorizationProvider.authorize}. */\nexport interface AuthorizeInput {\n  principal: Principal | null;\n  action: WebhooksAction;\n  resource: WebhooksResource;\n  request: Request;\n}\n\n/** Decides whether an action is permitted. */\nexport interface AuthorizationProvider {\n  authorize(input: AuthorizeInput): Promise<boolean>;\n}\n\n/** Actions that mutate state — blocked in readonly mode. */\nexport const MUTATING_ACTIONS: ReadonlySet<WebhooksAction> = new Set<WebhooksAction>([\n  \"application:create\",\n  \"application:update\",\n  \"application:delete\",\n  \"event-type:create\",\n  \"event-type:update\",\n  \"event-type:delete\",\n  \"endpoint:create\",\n  \"endpoint:update\",\n  \"endpoint:delete\",\n  \"endpoint:rotate-secret\",\n  \"message:publish\",\n  \"delivery:retry\",\n]);\n\n/** True if the action mutates state. */\nexport const isMutatingAction = (action: WebhooksAction): boolean => MUTATING_ACTIONS.has(action);\n"],"mappings":";;AAyDA,MAAa,mBAAgD,IAAI,IAAoB;CACnF;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAa,oBAAoB,WAAoC,iBAAiB,IAAI,MAAM"}

package/dist/contract-B2d5dNU3.cjs

@@ -0,0 +1,33 @@
+//#region src/authorization/contract.ts
+/** Actions that mutate state — blocked in readonly mode. */
+const MUTATING_ACTIONS = new Set([
+	"application:create",
+	"application:update",
+	"application:delete",
+	"event-type:create",
+	"event-type:update",
+	"event-type:delete",
+	"endpoint:create",
+	"endpoint:update",
+	"endpoint:delete",
+	"endpoint:rotate-secret",
+	"message:publish",
+	"delivery:retry"
+]);
+/** True if the action mutates state. */
+const isMutatingAction = (action) => MUTATING_ACTIONS.has(action);
+//#endregion
+Object.defineProperty(exports, "MUTATING_ACTIONS", {
+	enumerable: true,
+	get: function() {
+		return MUTATING_ACTIONS;
+	}
+});
+Object.defineProperty(exports, "isMutatingAction", {
+	enumerable: true,
+	get: function() {
+		return isMutatingAction;
+	}
+});
+
+//# sourceMappingURL=contract-B2d5dNU3.cjs.map

package/dist/contract-B2d5dNU3.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-B2d5dNU3.cjs","names":[],"sources":["../src/authorization/contract.ts"],"sourcesContent":["/**\n * Authorization contract. Answers: \"Can this principal perform this action on\n * this resource?\"\n *\n * Every mutating admin API route consults the {@link AuthorizationProvider}.\n * Ships `none`/`roles`/`delegated` implementations.\n *\n * @module\n */\n\nimport type { Principal } from \"../auth/contract.ts\";\n\n/** The full set of authorizable actions. */\nexport type WebhooksAction =\n  | \"application:read\"\n  | \"application:create\"\n  | \"application:update\"\n  | \"application:delete\"\n  | \"event-type:read\"\n  | \"event-type:create\"\n  | \"event-type:update\"\n  | \"event-type:delete\"\n  | \"endpoint:read\"\n  | \"endpoint:create\"\n  | \"endpoint:update\"\n  | \"endpoint:delete\"\n  | \"endpoint:rotate-secret\"\n  | \"endpoint:read-secret\"\n  | \"message:read\"\n  | \"message:publish\"\n  | \"delivery:read\"\n  | \"delivery:retry\"\n  | \"audit:read\";\n\n/** The resource an action targets. */\nexport type WebhooksResource =\n  | { type: \"application\"; applicationKey: string }\n  | { type: \"event-type\"; name: string }\n  | { type: \"endpoint\"; applicationKey: string; endpointId: string }\n  | { type: \"message\"; applicationKey: string; messageId?: string }\n  | { type: \"delivery\"; applicationKey: string; deliveryId?: string }\n  | { type: \"audit\"; applicationKey?: string };\n\n/** Input passed to {@link AuthorizationProvider.authorize}. */\nexport interface AuthorizeInput {\n  principal: Principal | null;\n  action: WebhooksAction;\n  resource: WebhooksResource;\n  request: Request;\n}\n\n/** Decides whether an action is permitted. */\nexport interface AuthorizationProvider {\n  authorize(input: AuthorizeInput): Promise<boolean>;\n}\n\n/** Actions that mutate state — blocked in readonly mode. */\nexport const MUTATING_ACTIONS: ReadonlySet<WebhooksAction> = new Set<WebhooksAction>([\n  \"application:create\",\n  \"application:update\",\n  \"application:delete\",\n  \"event-type:create\",\n  \"event-type:update\",\n  \"event-type:delete\",\n  \"endpoint:create\",\n  \"endpoint:update\",\n  \"endpoint:delete\",\n  \"endpoint:rotate-secret\",\n  \"message:publish\",\n  \"delivery:retry\",\n]);\n\n/** True if the action mutates state. */\nexport const isMutatingAction = (action: WebhooksAction): boolean => MUTATING_ACTIONS.has(action);\n"],"mappings":";;AAyDA,MAAa,mBAAgD,IAAI,IAAoB;CACnF;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAa,oBAAoB,WAAoC,iBAAiB,IAAI,MAAM"}

package/dist/contract-BEhDcd_5.mjs

@@ -0,0 +1,28 @@
+//#region src/storage/contract.ts
+/** Runtime feature-detection: does this storage implement `watch`? */
+function isWatchable(storage) {
+	return typeof storage.watch === "function";
+}
+/** Runtime feature-detection: does this storage implement `transaction`? */
+function isTransactional(storage) {
+	return typeof storage.transaction === "function";
+}
+/** Runtime feature-detection: does this storage implement `compareAndSwap`? */
+function isCompareAndSwap(storage) {
+	return typeof storage.compareAndSwap === "function";
+}
+/** Runtime feature-detection: does this storage implement `claimDue`? */
+function hasDeliveryQueue(storage) {
+	return typeof storage.claimDue === "function";
+}
+/**
+* Helper for adapters whose subpath requires an optional peer dependency. Throws
+* a clear, actionable error when the peer is missing.
+*/
+function requirePeer(name, subpath) {
+	throw new Error(`@xtandard/webhooks/${subpath} requires the "${name}" package. Install it with: bun add ${name}`);
+}
+//#endregion
+export { requirePeer as a, isWatchable as i, isCompareAndSwap as n, isTransactional as r, hasDeliveryQueue as t };
+
+//# sourceMappingURL=contract-BEhDcd_5.mjs.map

package/dist/contract-BEhDcd_5.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-BEhDcd_5.mjs","names":[],"sources":["../src/storage/contract.ts"],"sourcesContent":["/**\n * Storage contracts. The base {@link WebhooksStorage} is intentionally tiny —\n * four async methods — so users can bring their own backend. Optional\n * capabilities (watch, transactions, compare-and-swap, native delivery-queue\n * claiming) are separate interfaces that adapters may implement and the core\n * feature-detects.\n *\n * @module\n */\n\nimport type { Delivery } from \"../schema.ts\";\n\n/** The minimal key/value contract every storage backend must satisfy. */\nexport interface WebhooksStorage {\n  /** Read a value, or `null` if absent. */\n  getItem<T>(key: string): Promise<T | null>;\n  /** Write a value (overwriting any existing). */\n  setItem<T>(key: string, value: T): Promise<void>;\n  /** Delete a key (no-op if absent). */\n  removeItem(key: string): Promise<void>;\n  /** List all keys beginning with `prefix`. */\n  getKeys(prefix: string): Promise<string[]>;\n}\n\n/** A storage change event delivered to {@link WatchableWebhooksStorage.watch} callbacks. */\nexport interface StorageChangeEvent {\n  type: \"update\" | \"remove\";\n  key: string;\n}\n\n/** Storage that can push change notifications (e.g. Redis pub/sub, fs.watch). */\nexport interface WatchableWebhooksStorage extends WebhooksStorage {\n  /**\n   * Subscribe to changes under `prefix`. Resolves to an unsubscribe function.\n   */\n  watch(prefix: string, callback: (event: StorageChangeEvent) => void): Promise<() => void>;\n}\n\n/** Storage that supports atomic multi-key transactions. */\nexport interface TransactionalWebhooksStorage extends WebhooksStorage {\n  transaction<T>(callback: (tx: WebhooksStorage) => Promise<T>): Promise<T>;\n}\n\n/** Storage that supports optimistic concurrency via compare-and-swap. */\nexport interface CompareAndSwapWebhooksStorage extends WebhooksStorage {\n  compareAndSwap<T>(input: { key: string; expected: T | null; next: T }): Promise<boolean>;\n}\n\n/**\n * Storage that can natively claim due deliveries (sorted-set / `SKIP LOCKED`\n * class backends). When present, the dispatcher delegates claiming entirely to\n * the adapter instead of scanning the generic due index.\n *\n * The claim contract: atomically transition each returned delivery to\n * `status: \"delivering\"` with `leaseUntil = now + leaseMs`, reposition its due\n * entry at the lease expiry (so a crashed claimer's work re-surfaces), and\n * never return the same delivery to two concurrent claimers.\n */\nexport interface DeliveryQueueStorage extends WebhooksStorage {\n  claimDue(input: { now: string; limit: number; leaseMs: number }): Promise<Delivery[]>;\n}\n\n/** Runtime feature-detection: does this storage implement `watch`? */\nexport function isWatchable(storage: WebhooksStorage): storage is WatchableWebhooksStorage {\n  return typeof (storage as Partial<WatchableWebhooksStorage>).watch === \"function\";\n}\n\n/** Runtime feature-detection: does this storage implement `transaction`? */\nexport function isTransactional(storage: WebhooksStorage): storage is TransactionalWebhooksStorage {\n  return typeof (storage as Partial<TransactionalWebhooksStorage>).transaction === \"function\";\n}\n\n/** Runtime feature-detection: does this storage implement `compareAndSwap`? */\nexport function isCompareAndSwap(\n  storage: WebhooksStorage,\n): storage is CompareAndSwapWebhooksStorage {\n  return typeof (storage as Partial<CompareAndSwapWebhooksStorage>).compareAndSwap === \"function\";\n}\n\n/** Runtime feature-detection: does this storage implement `claimDue`? */\nexport function hasDeliveryQueue(storage: WebhooksStorage): storage is DeliveryQueueStorage {\n  return typeof (storage as Partial<DeliveryQueueStorage>).claimDue === \"function\";\n}\n\n/**\n * Helper for adapters whose subpath requires an optional peer dependency. Throws\n * a clear, actionable error when the peer is missing.\n */\nexport function requirePeer(name: string, subpath: string): never {\n  throw new Error(\n    `@xtandard/webhooks/${subpath} requires the \"${name}\" package. Install it with: bun add ${name}`,\n  );\n}\n"],"mappings":";;AA+DA,SAAgB,YAAY,SAA+D;CACzF,OAAO,OAAQ,QAA8C,UAAU;AACzE;;AAGA,SAAgB,gBAAgB,SAAmE;CACjG,OAAO,OAAQ,QAAkD,gBAAgB;AACnF;;AAGA,SAAgB,iBACd,SAC0C;CAC1C,OAAO,OAAQ,QAAmD,mBAAmB;AACvF;;AAGA,SAAgB,iBAAiB,SAA2D;CAC1F,OAAO,OAAQ,QAA0C,aAAa;AACxE;;;;;AAMA,SAAgB,YAAY,MAAc,SAAwB;CAChE,MAAM,IAAI,MACR,sBAAsB,QAAQ,iBAAiB,KAAK,sCAAsC,MAC5F;AACF"}

package/dist/contract-Bf1qguwt.cjs

@@ -0,0 +1,57 @@
+//#region src/storage/contract.ts
+/** Runtime feature-detection: does this storage implement `watch`? */
+function isWatchable(storage) {
+	return typeof storage.watch === "function";
+}
+/** Runtime feature-detection: does this storage implement `transaction`? */
+function isTransactional(storage) {
+	return typeof storage.transaction === "function";
+}
+/** Runtime feature-detection: does this storage implement `compareAndSwap`? */
+function isCompareAndSwap(storage) {
+	return typeof storage.compareAndSwap === "function";
+}
+/** Runtime feature-detection: does this storage implement `claimDue`? */
+function hasDeliveryQueue(storage) {
+	return typeof storage.claimDue === "function";
+}
+/**
+* Helper for adapters whose subpath requires an optional peer dependency. Throws
+* a clear, actionable error when the peer is missing.
+*/
+function requirePeer(name, subpath) {
+	throw new Error(`@xtandard/webhooks/${subpath} requires the "${name}" package. Install it with: bun add ${name}`);
+}
+//#endregion
+Object.defineProperty(exports, "hasDeliveryQueue", {
+	enumerable: true,
+	get: function() {
+		return hasDeliveryQueue;
+	}
+});
+Object.defineProperty(exports, "isCompareAndSwap", {
+	enumerable: true,
+	get: function() {
+		return isCompareAndSwap;
+	}
+});
+Object.defineProperty(exports, "isTransactional", {
+	enumerable: true,
+	get: function() {
+		return isTransactional;
+	}
+});
+Object.defineProperty(exports, "isWatchable", {
+	enumerable: true,
+	get: function() {
+		return isWatchable;
+	}
+});
+Object.defineProperty(exports, "requirePeer", {
+	enumerable: true,
+	get: function() {
+		return requirePeer;
+	}
+});
+
+//# sourceMappingURL=contract-Bf1qguwt.cjs.map

package/dist/contract-Bf1qguwt.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-Bf1qguwt.cjs","names":[],"sources":["../src/storage/contract.ts"],"sourcesContent":["/**\n * Storage contracts. The base {@link WebhooksStorage} is intentionally tiny —\n * four async methods — so users can bring their own backend. Optional\n * capabilities (watch, transactions, compare-and-swap, native delivery-queue\n * claiming) are separate interfaces that adapters may implement and the core\n * feature-detects.\n *\n * @module\n */\n\nimport type { Delivery } from \"../schema.ts\";\n\n/** The minimal key/value contract every storage backend must satisfy. */\nexport interface WebhooksStorage {\n  /** Read a value, or `null` if absent. */\n  getItem<T>(key: string): Promise<T | null>;\n  /** Write a value (overwriting any existing). */\n  setItem<T>(key: string, value: T): Promise<void>;\n  /** Delete a key (no-op if absent). */\n  removeItem(key: string): Promise<void>;\n  /** List all keys beginning with `prefix`. */\n  getKeys(prefix: string): Promise<string[]>;\n}\n\n/** A storage change event delivered to {@link WatchableWebhooksStorage.watch} callbacks. */\nexport interface StorageChangeEvent {\n  type: \"update\" | \"remove\";\n  key: string;\n}\n\n/** Storage that can push change notifications (e.g. Redis pub/sub, fs.watch). */\nexport interface WatchableWebhooksStorage extends WebhooksStorage {\n  /**\n   * Subscribe to changes under `prefix`. Resolves to an unsubscribe function.\n   */\n  watch(prefix: string, callback: (event: StorageChangeEvent) => void): Promise<() => void>;\n}\n\n/** Storage that supports atomic multi-key transactions. */\nexport interface TransactionalWebhooksStorage extends WebhooksStorage {\n  transaction<T>(callback: (tx: WebhooksStorage) => Promise<T>): Promise<T>;\n}\n\n/** Storage that supports optimistic concurrency via compare-and-swap. */\nexport interface CompareAndSwapWebhooksStorage extends WebhooksStorage {\n  compareAndSwap<T>(input: { key: string; expected: T | null; next: T }): Promise<boolean>;\n}\n\n/**\n * Storage that can natively claim due deliveries (sorted-set / `SKIP LOCKED`\n * class backends). When present, the dispatcher delegates claiming entirely to\n * the adapter instead of scanning the generic due index.\n *\n * The claim contract: atomically transition each returned delivery to\n * `status: \"delivering\"` with `leaseUntil = now + leaseMs`, reposition its due\n * entry at the lease expiry (so a crashed claimer's work re-surfaces), and\n * never return the same delivery to two concurrent claimers.\n */\nexport interface DeliveryQueueStorage extends WebhooksStorage {\n  claimDue(input: { now: string; limit: number; leaseMs: number }): Promise<Delivery[]>;\n}\n\n/** Runtime feature-detection: does this storage implement `watch`? */\nexport function isWatchable(storage: WebhooksStorage): storage is WatchableWebhooksStorage {\n  return typeof (storage as Partial<WatchableWebhooksStorage>).watch === \"function\";\n}\n\n/** Runtime feature-detection: does this storage implement `transaction`? */\nexport function isTransactional(storage: WebhooksStorage): storage is TransactionalWebhooksStorage {\n  return typeof (storage as Partial<TransactionalWebhooksStorage>).transaction === \"function\";\n}\n\n/** Runtime feature-detection: does this storage implement `compareAndSwap`? */\nexport function isCompareAndSwap(\n  storage: WebhooksStorage,\n): storage is CompareAndSwapWebhooksStorage {\n  return typeof (storage as Partial<CompareAndSwapWebhooksStorage>).compareAndSwap === \"function\";\n}\n\n/** Runtime feature-detection: does this storage implement `claimDue`? */\nexport function hasDeliveryQueue(storage: WebhooksStorage): storage is DeliveryQueueStorage {\n  return typeof (storage as Partial<DeliveryQueueStorage>).claimDue === \"function\";\n}\n\n/**\n * Helper for adapters whose subpath requires an optional peer dependency. Throws\n * a clear, actionable error when the peer is missing.\n */\nexport function requirePeer(name: string, subpath: string): never {\n  throw new Error(\n    `@xtandard/webhooks/${subpath} requires the \"${name}\" package. Install it with: bun add ${name}`,\n  );\n}\n"],"mappings":";;AA+DA,SAAgB,YAAY,SAA+D;CACzF,OAAO,OAAQ,QAA8C,UAAU;AACzE;;AAGA,SAAgB,gBAAgB,SAAmE;CACjG,OAAO,OAAQ,QAAkD,gBAAgB;AACnF;;AAGA,SAAgB,iBACd,SAC0C;CAC1C,OAAO,OAAQ,QAAmD,mBAAmB;AACvF;;AAGA,SAAgB,iBAAiB,SAA2D;CAC1F,OAAO,OAAQ,QAA0C,aAAa;AACxE;;;;;AAMA,SAAgB,YAAY,MAAc,SAAwB;CAChE,MAAM,IAAI,MACR,sBAAsB,QAAQ,iBAAiB,KAAK,sCAAsC,MAC5F;AACF"}

package/dist/contract-Bnb3fgRJ.d.cts

@@ -0,0 +1,177 @@
+import { a as AuditEntry, f as EventType, l as Endpoint, m as Message, n as Application, o as Delivery, p as JsonValue, s as DeliveryAttempt, t as Actor } from "./schema-mo__wv4P.cjs";
+
+//#region src/hooks/contract.d.ts
+/**
+ * Event delivered to {@link WebhooksHooks.before} — the *proposed* mutation,
+ * before it commits. Throw from the handler to deny it.
+ */
+type BeforeEvent = {
+  type: "application.create" | "application.update";
+  application: Application;
+  actor: Actor | null;
+} | {
+  type: "application.delete";
+  applicationKey: string;
+  actor: Actor | null;
+} | {
+  type: "event-type.upsert";
+  eventType: EventType;
+  actor: Actor | null;
+} | {
+  type: "event-type.delete";
+  name: string;
+  actor: Actor | null;
+} | {
+  type: "endpoint.create" | "endpoint.update";
+  applicationKey: string;
+  endpoint: Endpoint;
+  actor: Actor | null;
+} | {
+  type: "endpoint.delete" | "endpoint.rotate-secret" | "endpoint.disable" | "endpoint.enable";
+  applicationKey: string;
+  endpointId: string;
+  actor: Actor | null;
+} | {
+  /** The host's approval/quota gate for the publish hot path. */type: "message.publish";
+  applicationKey: string;
+  eventType: string;
+  payload: JsonValue;
+  idempotencyKey?: string;
+  actor: Actor | null;
+} | {
+  type: "delivery.retry";
+  applicationKey: string;
+  deliveryId: string;
+  actor: Actor | null;
+} | {
+  type: "endpoint.recover";
+  applicationKey: string;
+  endpointId: string;
+  since: string;
+  actor: Actor | null;
+};
+/**
+ * Event delivered to {@link WebhooksHooks.after} — the *committed* mutation.
+ * Carries the resulting state in full: for destructive events this is the last
+ * chance to offload the payload before it is gone from storage.
+ */
+type AfterEvent = {
+  type: "application.created" | "application.updated";
+  application: Application;
+  at: string;
+} | {
+  /** Carries the deleted application — everything under it is already gone. */type: "application.deleted";
+  applicationKey: string;
+  application: Application;
+  at: string;
+} | {
+  type: "event-type.upserted";
+  eventType: EventType;
+  at: string;
+} | {
+  type: "event-type.deleted";
+  name: string;
+  eventType: EventType;
+  at: string;
+} | {
+  type: "endpoint.created" | "endpoint.updated" | "endpoint.deleted" | "endpoint.secret-rotated" | "endpoint.disabled" | "endpoint.enabled" /** Disabled by the failure policy, not an operator (see dispatcher `autoDisable`). */ | "endpoint.auto-disabled";
+  applicationKey: string;
+  endpoint: Endpoint;
+  at: string;
+} | {
+  type: "message.published";
+  applicationKey: string;
+  message: Message;
+  deliveryIds: string[];
+  at: string;
+} | {
+  type: "delivery.succeeded";
+  applicationKey: string;
+  delivery: Delivery;
+  attempt: DeliveryAttempt;
+  at: string;
+} | {
+  /** Dead-letter offload point: the retry schedule is exhausted. */type: "delivery.exhausted";
+  applicationKey: string;
+  delivery: Delivery;
+  attempts: DeliveryAttempt[];
+  at: string;
+} | {
+  /** Messages removed by retention. Carries the **full messages** — offload now or lose them. */type: "message.pruned";
+  applicationKey: string;
+  messages: Message[];
+  at: string;
+} | {
+  /** Audit entries removed by retention (oldest-first). */type: "audit.pruned";
+  applicationKey?: string;
+  entries: AuditEntry[];
+  at: string;
+};
+/** The discriminant strings of {@link BeforeEvent} / {@link AfterEvent}. */
+type BeforeEventType = BeforeEvent["type"];
+type AfterEventType = AfterEvent["type"];
+/**
+ * Thrown from a {@link WebhooksHooks.before} handler to **deny** a mutation with
+ * a clean HTTP status (default `403`). Any thrown error denies the mutation,
+ * but a plain `Error` maps to `500` at the API layer (treated as an unexpected
+ * bug); throw this to signal a deliberate policy rejection (`403`, or a custom
+ * `status` such as `409`/`422`).
+ *
+ * @example
+ * ```ts
+ * before(event) {
+ *   if (event.type === "message.publish" && overQuota(event.applicationKey)) {
+ *     throw new HookDeniedError("Monthly webhook quota exceeded.", { status: 429 });
+ *   }
+ * }
+ * ```
+ */
+declare class HookDeniedError extends Error {
+  /** HTTP status the API layer should respond with. Default `403`. */
+  readonly status: number;
+  constructor(message: string, options?: {
+    status?: number;
+    cause?: unknown;
+  });
+}
+/**
+ * A control-plane hook. Implement `before`, `after`, or both. Pass one — or an
+ * array — to {@link ../core.createWebhooksCore} via `hooks`.
+ */
+interface WebhooksHooks {
+  /**
+   * Runs before a mutation commits. **Throw to deny** (the error propagates to
+   * the caller; its message is the reason). Return/resolve to allow. Must not
+   * mutate the event payload.
+   */
+  before?(event: BeforeEvent): void | Promise<void>;
+  /**
+   * Runs after a mutation commits. For side effects only. Errors are isolated
+   * and reported via `onHookError` — they never fail the (already committed)
+   * operation.
+   */
+  after?(event: AfterEvent): void | Promise<void>;
+}
+/** Accepts a single hook, an array, or nothing. */
+type WebhooksHooksInput = WebhooksHooks | readonly WebhooksHooks[] | undefined;
+/** Reports an error thrown by an `after` hook. */
+type HookErrorReporter = (error: unknown, event: AfterEvent) => void;
+/** Normalize the `hooks` option into a flat array (empty when unset). */
+declare function normalizeHooks(input: WebhooksHooksInput): WebhooksHooks[];
+/**
+ * Run every `before` hook sequentially, in order. The first hook to throw
+ * aborts: the error propagates to the caller (denying the mutation) and no
+ * later hook runs. A no-op when there are no `before` hooks.
+ */
+declare function runBefore(hooks: WebhooksHooks[], event: BeforeEvent): Promise<void>;
+/**
+ * Run every `after` hook, isolating failures. The mutation has already
+ * committed, so a throwing hook must not fail the operation — its error is
+ * routed to `onError` and swallowed. Remaining hooks still run.
+ */
+declare function runAfter(hooks: WebhooksHooks[], event: AfterEvent, onError: HookErrorReporter): Promise<void>;
+/** Default `after`-hook error reporter: warn, but never throw. */
+declare const defaultHookErrorReporter: HookErrorReporter;
+//#endregion
+export { HookDeniedError as a, WebhooksHooksInput as c, runAfter as d, runBefore as f, BeforeEventType as i, defaultHookErrorReporter as l, AfterEventType as n, HookErrorReporter as o, BeforeEvent as r, WebhooksHooks as s, AfterEvent as t, normalizeHooks as u };
+//# sourceMappingURL=contract-Bnb3fgRJ.d.cts.map

package/dist/contract-C2r2Xzwp.d.mts

@@ -0,0 +1,46 @@
+import { n as Principal } from "./contract-lETlIuXo.mjs";
+
+//#region src/authorization/contract.d.ts
+/** The full set of authorizable actions. */
+type WebhooksAction = "application:read" | "application:create" | "application:update" | "application:delete" | "event-type:read" | "event-type:create" | "event-type:update" | "event-type:delete" | "endpoint:read" | "endpoint:create" | "endpoint:update" | "endpoint:delete" | "endpoint:rotate-secret" | "endpoint:read-secret" | "message:read" | "message:publish" | "delivery:read" | "delivery:retry" | "audit:read";
+/** The resource an action targets. */
+type WebhooksResource = {
+  type: "application";
+  applicationKey: string;
+} | {
+  type: "event-type";
+  name: string;
+} | {
+  type: "endpoint";
+  applicationKey: string;
+  endpointId: string;
+} | {
+  type: "message";
+  applicationKey: string;
+  messageId?: string;
+} | {
+  type: "delivery";
+  applicationKey: string;
+  deliveryId?: string;
+} | {
+  type: "audit";
+  applicationKey?: string;
+};
+/** Input passed to {@link AuthorizationProvider.authorize}. */
+interface AuthorizeInput {
+  principal: Principal | null;
+  action: WebhooksAction;
+  resource: WebhooksResource;
+  request: Request;
+}
+/** Decides whether an action is permitted. */
+interface AuthorizationProvider {
+  authorize(input: AuthorizeInput): Promise<boolean>;
+}
+/** Actions that mutate state — blocked in readonly mode. */
+declare const MUTATING_ACTIONS: ReadonlySet<WebhooksAction>;
+/** True if the action mutates state. */
+declare const isMutatingAction: (action: WebhooksAction) => boolean;
+//#endregion
+export { WebhooksResource as a, WebhooksAction as i, AuthorizeInput as n, isMutatingAction as o, MUTATING_ACTIONS as r, AuthorizationProvider as t };
+//# sourceMappingURL=contract-C2r2Xzwp.d.mts.map