@agentcomms/events-daemon 0.0.0-stage → 0.16.0

package/dist/webhook-target-BkA_wHIu.mjs

@@ -0,0 +1,662 @@
+import { canonicalJson, sha256Hex } from "@agentcomms/core";
+//#region src/domain/lifecycle.ts
+/** A content-free domain refusal. No caller should substitute an arbitrary Error message at a control boundary. */
+var EventDomainError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "EventDomainError";
+		this.code = code;
+	}
+};
+const JUDGE_KINDS = [
+	"typesafe",
+	"laya",
+	"local-endpoint"
+];
+function isJudgeKind(value) {
+	return typeof value === "string" && JUDGE_KINDS.includes(value);
+}
+function assertJudgeKindEnabled(kind, enabled) {
+	if (!enabled) throw new EventDomainError("JUDGE_KIND_DISABLED", `the ${kind} judge kind is disabled`);
+}
+//#endregion
+//#region src/network/iana-special-purpose.ts
+/** Checked-in IANA policy; network code must never refresh or consult it at runtime. */
+const IANA_SPECIAL_PURPOSE = {
+	snapshotVersion: "iana-special-purpose-2025-10-09",
+	ipv4: {
+		"title": "IANA IPv4 Special-Purpose Address Registry",
+		"url": "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry-1.csv",
+		"lastUpdated": "2025-10-09",
+		"rawSourceSha256": "e3e39e76d00b1677335db8e9a805c7b9480ea2f4dc9e33f0b93cd3a905128d73",
+		"prefixes": [
+			{
+				"prefix": "0.0.0.0/8",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "0.0.0.0/32",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "10.0.0.0/8",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "100.64.0.0/10",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "127.0.0.0/8",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "169.254.0.0/16",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "172.16.0.0/12",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.0.0.0/24",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.0.0.0/29",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.0.0.8/32",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.0.0.9/32",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "192.0.0.10/32",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "192.0.0.170/32",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.0.0.171/32",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.0.2.0/24",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.31.196.0/24",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "192.52.193.0/24",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "192.88.99.0/24",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.88.99.2/32",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.168.0.0/16",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.175.48.0/24",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "198.18.0.0/15",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "198.51.100.0/24",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "203.0.113.0/24",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "240.0.0.0/4",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "255.255.255.255/32",
+				"globallyReachable": false
+			}
+		]
+	},
+	ipv6: {
+		"title": "IANA IPv6 Special-Purpose Address Registry",
+		"url": "https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry-1.csv",
+		"lastUpdated": "2025-10-09",
+		"rawSourceSha256": "775feea0621dec8735a44fbf30f762e721e8f0a1b3ab7eb341961a88cfce2139",
+		"prefixes": [
+			{
+				"prefix": "::1/128",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "::/128",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "::ffff:0:0/96",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "64:ff9b::/96",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "64:ff9b:1::/48",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "100::/64",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "100:0:0:1::/64",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "2001::/23",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "2001::/32",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "2001:1::1/128",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "2001:1::2/128",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "2001:1::3/128",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "2001:2::/48",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "2001:3::/32",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "2001:4:112::/48",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "2001:10::/28",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "2001:20::/28",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "2001:30::/28",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "2001:db8::/32",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "2002::/16",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "2620:4f:8000::/48",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "3fff::/20",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "5f00::/16",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "fc00::/7",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "fe80::/10",
+				"globallyReachable": false
+			}
+		]
+	}
+};
+var AddressPolicyError = class extends Error {
+	code = "NETWORK_ADDRESS_REFUSED";
+	constructor(message) {
+		super(message);
+		this.name = "AddressPolicyError";
+	}
+};
+const IPV4_BITS = 32;
+const IPV6_BITS = 128;
+const IPV4_MAX = (1n << 32n) - 1n;
+const WELL_KNOWN_NAT64 = parseCidr("64:ff9b::/96");
+const LOCALLY_ASSIGNED_NAT64 = parseCidr("64:ff9b:1::/48");
+const LINK_LOCAL_V4 = parseCidr("169.254.0.0/16");
+const LINK_LOCAL_V6 = parseCidr("fe80::/10");
+const MULTICAST_V4 = parseCidr("224.0.0.0/4");
+const MULTICAST_V6 = parseCidr("ff00::/8");
+const METADATA_V4 = parseIpLiteral("169.254.169.254");
+const METADATA_V6 = parseIpLiteral("fd00:ec2::254");
+const registryPrefixes = [...IANA_SPECIAL_PURPOSE.ipv4.prefixes.map((entry) => ({
+	...parseCidr(entry.prefix),
+	globallyReachable: entry.globallyReachable
+})), ...IANA_SPECIAL_PURPOSE.ipv6.prefixes.map((entry) => ({
+	...parseCidr(entry.prefix),
+	globallyReachable: entry.globallyReachable
+}))];
+function bitsFor(family) {
+	return family === 4 ? IPV4_BITS : IPV6_BITS;
+}
+function mask(family, prefixLength) {
+	const bits = bitsFor(family);
+	if (!Number.isInteger(prefixLength) || prefixLength < 0 || prefixLength > bits) throw new AddressPolicyError(`invalid CIDR prefix length ${prefixLength}`);
+	if (prefixLength === 0) return 0n;
+	return (1n << BigInt(prefixLength)) - 1n << BigInt(bits - prefixLength);
+}
+function stripBrackets(value) {
+	if (value.startsWith("[") && value.endsWith("]")) return value.slice(1, -1);
+	return value;
+}
+function parseIpv4(value) {
+	const parts = value.split(".");
+	if (parts.length !== 4) return null;
+	let result = 0n;
+	for (const part of parts) {
+		if (!/^(?:0|[1-9]\d{0,2})$/.test(part)) return null;
+		const octet = Number(part);
+		if (octet > 255) return null;
+		result = result << 8n | BigInt(octet);
+	}
+	return result;
+}
+function ipv4Text(value) {
+	return [
+		24n,
+		16n,
+		8n,
+		0n
+	].map((shift) => Number(value >> shift & 255n)).join(".");
+}
+function parseIpv6(value) {
+	if (value.includes("%")) return null;
+	const doubleColon = value.indexOf("::");
+	if (doubleColon !== -1 && value.indexOf("::", doubleColon + 1) !== -1) return null;
+	const left = doubleColon === -1 ? value : value.slice(0, doubleColon);
+	const right = doubleColon === -1 ? "" : value.slice(doubleColon + 2);
+	const leftParts = left === "" ? [] : left.split(":");
+	const rightParts = right === "" ? [] : right.split(":");
+	const rawParts = [...leftParts, ...rightParts];
+	if (rawParts.some((part) => part === "")) return null;
+	const groups = [];
+	for (let index = 0; index < rawParts.length; index += 1) {
+		const part = rawParts[index];
+		if (part === void 0) return null;
+		if (part.includes(".")) {
+			if (index !== rawParts.length - 1) return null;
+			const embedded = parseIpv4(part);
+			if (embedded === null) return null;
+			groups.push(Number(embedded >> 16n & 65535n), Number(embedded & 65535n));
+			continue;
+		}
+		if (!/^[0-9a-f]{1,4}$/i.test(part)) return null;
+		groups.push(Number.parseInt(part, 16));
+	}
+	if (doubleColon === -1) {
+		if (groups.length !== 8) return null;
+	} else {
+		if (groups.length >= 8) return null;
+		const omitted = 8 - groups.length;
+		groups.splice(leftParts.reduce((count, part) => count + (part.includes(".") ? 2 : 1), 0), 0, ...Array(omitted).fill(0));
+	}
+	let result = 0n;
+	for (const group of groups) result = result << 16n | BigInt(group);
+	return result;
+}
+function ipv6Text(value) {
+	const groups = Array.from({ length: 8 }, (_, index) => Number(value >> BigInt((7 - index) * 16) & 65535n));
+	let bestStart = -1;
+	let bestLength = 0;
+	for (let index = 0; index < groups.length;) {
+		const group = groups[index];
+		if (group === void 0) break;
+		if (group !== 0) {
+			index += 1;
+			continue;
+		}
+		const start = index;
+		while (groups[index] === 0) index += 1;
+		const length = index - start;
+		if (length > bestLength && length > 1) {
+			bestStart = start;
+			bestLength = length;
+		}
+	}
+	if (bestStart === 0 && bestLength === 8) return "::";
+	const pieces = [];
+	for (let index = 0; index < groups.length; index += 1) {
+		if (index === bestStart) {
+			pieces.push("");
+			index += bestLength - 1;
+			if (index === groups.length - 1) pieces.push("");
+			continue;
+		}
+		const group = groups[index];
+		if (group === void 0) throw new Error("IPv6 formatter lost a parsed group");
+		pieces.push(group.toString(16));
+	}
+	return pieces.join(":").replace(/^:/, "::").replace(/:$/, "::");
+}
+/** Parses only a canonical-literal-shaped IP address, never a hostname or a DNS spelling. */
+function parseIpLiteral(input) {
+	const value = stripBrackets(input.trim());
+	const ipv4 = parseIpv4(value);
+	if (ipv4 !== null) return {
+		address: ipv4Text(ipv4),
+		family: 4,
+		value: ipv4
+	};
+	const ipv6 = parseIpv6(value);
+	if (ipv6 !== null) return {
+		address: ipv6Text(ipv6),
+		family: 6,
+		value: ipv6
+	};
+	throw new AddressPolicyError(`a literal IP address was required, received ${input}`);
+}
+function parseCidr(input) {
+	const slash = input.lastIndexOf("/");
+	if (slash <= 0 || slash === input.length - 1) throw new AddressPolicyError(`invalid CIDR ${input}`);
+	const address = parseIpLiteral(input.slice(0, slash));
+	const prefixLength = Number(input.slice(slash + 1));
+	const prefixMask = mask(address.family, prefixLength);
+	if ((address.value & prefixMask) !== address.value) throw new AddressPolicyError(`CIDR ${input} has host bits set`);
+	return {
+		source: `${address.address}/${prefixLength}`,
+		family: address.family,
+		prefixLength,
+		value: address.value
+	};
+}
+function inCidr(address, cidr) {
+	return address.family === cidr.family && (address.value & mask(cidr.family, cidr.prefixLength)) === cidr.value;
+}
+function parseApprovedAddressSet(entries) {
+	if (entries.length === 0) throw new AddressPolicyError("approvedAddressSet must be non-empty");
+	const parsed = entries.map((entry) => entry.includes("/") ? parseCidr(entry) : parseCidr(`${parseIpLiteral(entry).address}/${bitsFor(parseIpLiteral(entry).family)}`));
+	for (let index = 1; index < entries.length; index += 1) {
+		const previous = entries[index - 1];
+		const current = entries[index];
+		if (previous === void 0 || current === void 0) throw new AddressPolicyError("approvedAddressSet could not be read");
+		if (previous.localeCompare(current) >= 0) throw new AddressPolicyError("approvedAddressSet must contain sorted, duplicate-free literals or CIDRs");
+	}
+	return parsed;
+}
+/** Checks the persisted rule input before a connector can use it to resolve a host. */
+function assertApprovedAddressSet(entries) {
+	parseApprovedAddressSet(entries);
+}
+function isUnconditionallyDenied(address) {
+	return inCidr(address, LINK_LOCAL_V4) || inCidr(address, LINK_LOCAL_V6) || inCidr(address, MULTICAST_V4) || inCidr(address, MULTICAST_V6) || address.family === METADATA_V4.family && address.value === METADATA_V4.value || address.family === METADATA_V6.family && address.value === METADATA_V6.value;
+}
+function globallyReachable(address) {
+	return registryPrefixes.filter((entry) => inCidr(address, entry)).sort((left, right) => right.prefixLength - left.prefixLength)[0]?.globallyReachable ?? true;
+}
+function ipv4From(value) {
+	const ipv4 = value & IPV4_MAX;
+	return {
+		address: ipv4Text(ipv4),
+		family: 4,
+		value: ipv4
+	};
+}
+function configuredNat64(options) {
+	const raw = options.activeNat64Prefix ?? null;
+	if (raw === null) return null;
+	const entries = typeof raw === "string" ? [raw] : raw;
+	if (entries.length !== 1) throw new AddressPolicyError("NAT64 needs exactly one trusted /96 prefix");
+	const prefixText = entries[0];
+	if (prefixText === void 0) throw new AddressPolicyError("NAT64 prefix could not be read");
+	const prefix = parseCidr(prefixText);
+	if (prefix.family !== 6 || prefix.prefixLength !== 96) throw new AddressPolicyError("NAT64 needs one trusted IPv6 /96 prefix");
+	return prefix;
+}
+function embeddedAddresses(address, options) {
+	if (address.family !== 6) return [];
+	const embedded = [];
+	const upper96 = address.value >> 32n;
+	const mapped = upper96 === 65535n;
+	const compatible = upper96 === 0n && address.value > 1n;
+	if (mapped || compatible) embedded.push(ipv4From(address.value));
+	const configured = configuredNat64(options);
+	if (inCidr(address, WELL_KNOWN_NAT64) || inCidr(address, LOCALLY_ASSIGNED_NAT64) || configured !== null && inCidr(address, configured)) {
+		if (configured === null || !inCidr(address, configured)) throw new AddressPolicyError("NAT64 address has no single trusted active /96 prefix");
+		embedded.push(ipv4From(address.value));
+	}
+	if (inCidr(address, parseCidr("2002::/16"))) embedded.push(ipv4From(address.value >> 80n));
+	if (inCidr(address, parseCidr("2001:0::/32"))) {
+		embedded.push(ipv4From(address.value >> 64n));
+		embedded.push(ipv4From((address.value ^ IPV4_MAX) & IPV4_MAX));
+	}
+	return embedded;
+}
+function assertOne(address, approved, options, seen) {
+	if (seen.has(`${address.family}:${address.value}`)) return [];
+	seen.add(`${address.family}:${address.value}`);
+	if (isUnconditionallyDenied(address)) throw new AddressPolicyError(`address ${address.address} is metadata or link-local and is always refused`);
+	const explicitlyApproved = approved.some((entry) => inCidr(address, entry));
+	if (!globallyReachable(address) && !explicitlyApproved) throw new AddressPolicyError(`non-global address ${address.address} needs an exact approvedAddressSet entry`);
+	if (!explicitlyApproved) throw new AddressPolicyError(`address ${address.address} is not in the approvedAddressSet`);
+	const nested = embeddedAddresses(address, options);
+	for (const child of nested) assertOne(child, approved, options, seen);
+	return nested;
+}
+/** Validates the literal itself and every embedded transition address against the exact approved set. */
+function assertAddressAllowed(input, options) {
+	const address = parseIpLiteral(input);
+	const embedded = assertOne(address, parseApprovedAddressSet(options.approvedAddressSet), options, /* @__PURE__ */ new Set());
+	return {
+		address: address.address,
+		family: address.family,
+		embedded
+	};
+}
+//#endregion
+//#region src/network/local-endpoint.ts
+var LocalEndpointError = class extends Error {
+	code = "LOCAL_ENDPOINT_REFUSED";
+	constructor(message) {
+		super(message);
+		this.name = "LocalEndpointError";
+	}
+};
+/** Validates the deliberately narrow local-only network descriptor. */
+function validateLocalEndpoint(input, approvedAddressSet) {
+	const url = typeof input === "string" ? new URL(input) : new URL(input.href);
+	const hostname = url.hostname.startsWith("[") && url.hostname.endsWith("]") ? url.hostname.slice(1, -1) : url.hostname;
+	if (url.protocol !== "http:") throw new LocalEndpointError("a local endpoint must use HTTP");
+	if (url.username !== "" || url.password !== "" || url.hash !== "") throw new LocalEndpointError("a local endpoint URL has unsupported authority data");
+	let address;
+	try {
+		address = parseIpLiteral(hostname).address;
+		assertAddressAllowed(address, { approvedAddressSet });
+	} catch (error) {
+		if (error instanceof AddressPolicyError) throw new LocalEndpointError(error.message);
+		throw error;
+	}
+	if (address !== "127.0.0.1" && address !== "::1") throw new LocalEndpointError("a local endpoint must use literal 127.0.0.1 or ::1");
+	if (approvedAddressSet.length !== 1 || approvedAddressSet[0] === void 0 || approvedAddressSet[0].includes("/") || parseIpLiteral(approvedAddressSet[0]).address !== address) throw new LocalEndpointError("a local endpoint requires its one exact approved literal loopback address");
+	return {
+		url,
+		address
+	};
+}
+//#endregion
+//#region src/domain/webhook-target.ts
+function fail(message) {
+	throw new EventDomainError("VERSION_DOCUMENT_INVALID", message);
+}
+function record(value, name) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return fail(`${name} is an object`);
+	try {
+		return JSON.parse(canonicalJson(value));
+	} catch {
+		return fail(`${name} is canonical JSON`);
+	}
+}
+function text(value, name) {
+	if (typeof value !== "string" || value.length === 0) return fail(`${name} is a non-empty string`);
+	return value;
+}
+function positiveInteger(value, name) {
+	if (!Number.isSafeInteger(value) || value < 1) return fail(`${name} is a positive safe integer`);
+	return value;
+}
+function canonicalPercentEscapes(value) {
+	return value.replace(/%[0-9a-f]{2}/gi, (encoded) => encoded.toUpperCase());
+}
+function canonicalUrl(value, allowQuery) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return fail("a webhook URL is absolute");
+	}
+	const scheme = parsed.protocol.slice(0, -1);
+	if (scheme !== "http" && scheme !== "https") return fail("a webhook URL uses http or https");
+	if (parsed.hash.length !== 0) return fail("a webhook URL has no fragment");
+	if (!allowQuery && (parsed.username.length !== 0 || parsed.password.length !== 0 || parsed.search.length !== 0)) return fail("a plain webhook URL has no userinfo or query");
+	const port = parsed.port.length === 0 ? scheme === "https" ? 443 : 80 : Number(parsed.port);
+	if (!Number.isSafeInteger(port) || port < 1 || port > 65535) return fail("a webhook URL has a valid port");
+	const host = parsed.hostname.toLowerCase();
+	if (host.length === 0) return fail("a webhook URL has a host");
+	return {
+		value: `${scheme}://${allowQuery && (parsed.username.length !== 0 || parsed.password.length !== 0) ? `${canonicalPercentEscapes(parsed.username)}${parsed.password.length === 0 ? "" : `:${canonicalPercentEscapes(parsed.password)}`}@` : ""}${host.includes(":") && !host.startsWith("[") ? `[${host}]` : host}:${port}${canonicalPercentEscapes(parsed.pathname)}${allowQuery ? canonicalPercentEscapes(parsed.search) : ""}`,
+		authority: {
+			scheme,
+			host,
+			port
+		}
+	};
+}
+/** Canonicalises the complete hidden URL only for the daemon's secret-store factory. */
+function secretWebhookUrlDescriptor(value) {
+	const canonical = canonicalUrl(value, true);
+	return {
+		kind: "secret",
+		...canonical.authority,
+		sha256: sha256Hex(canonical.value)
+	};
+}
+/** Produces the private stored URL and its public descriptor together; callers return only the descriptor. */
+function canonicalSecretWebhookUrl(value) {
+	const canonical = canonicalUrl(value, true);
+	return {
+		value: canonical.value,
+		descriptor: {
+			kind: "secret",
+			...canonical.authority,
+			sha256: sha256Hex(canonical.value)
+		}
+	};
+}
+function canonicalAddressSet(value) {
+	if (!Array.isArray(value) || value.length === 0) return fail("a webhook approvedAddressSet is a non-empty array");
+	const addresses = value.map((entry) => text(entry, "a webhook approvedAddressSet entry"));
+	const sorted = [...addresses].sort();
+	if (new Set(sorted).size !== sorted.length || sorted.some((entry, index) => entry !== addresses[index])) return fail("a webhook approvedAddressSet is sorted and duplicate-free");
+	return sorted;
+}
+function canonicalUrlDescriptor(value) {
+	const url = record(value, "a webhook URL descriptor");
+	if (url.kind === "plain") return {
+		kind: "plain",
+		value: canonicalUrl(text(url.value, "a plain webhook URL"), false).value
+	};
+	if (url.kind === "secret") {
+		const scheme = text(url.scheme, "a secret webhook scheme");
+		if (scheme !== "http" && scheme !== "https") return fail("a secret webhook scheme is http or https");
+		const host = text(url.host, "a secret webhook host").toLowerCase();
+		const port = positiveInteger(url.port, "a secret webhook port");
+		if (port > 65535) return fail("a secret webhook port is at most 65535");
+		const authority = canonicalUrl(`${scheme}://${host.includes(":") ? `[${host}]` : host}:${port}/`, false).authority;
+		if (authority.scheme !== scheme || authority.host !== host || authority.port !== port) return fail("a secret webhook authority is canonical");
+		const sha256 = text(url.sha256, "a secret webhook fingerprint");
+		if (!/^[a-f0-9]{64}$/.test(sha256)) return fail("a secret webhook fingerprint is lowercase SHA-256");
+		return {
+			kind: "secret",
+			scheme,
+			host,
+			port,
+			sha256
+		};
+	}
+	return fail("a webhook URL descriptor has a known kind");
+}
+/** The canonical immutable webhook target contains public authority only, never a slot or complete secret URL. */
+function canonicalWebhookTarget(value) {
+	const target = record(value, "a webhook target document");
+	if (target.kind !== "webhook") return fail("a webhook target document has kind webhook");
+	if (target.signing !== "standard-webhooks") return fail("a webhook target uses standard-webhooks signing");
+	if (target.ordering !== "strict") return fail("a webhook target uses strict delivery ordering");
+	const retryLimit = positiveInteger(target.retryLimit, "a webhook retry limit");
+	if (retryLimit > 20) return fail("a webhook retry limit is at most 20");
+	if (target.representation !== "plain" && target.representation !== "enveloped") return fail("a webhook representation is plain or enveloped");
+	const url = canonicalUrlDescriptor(target.url);
+	const approvedAddressSet = canonicalAddressSet(target.approvedAddressSet);
+	try {
+		assertApprovedAddressSet(approvedAddressSet);
+		if (url.kind === "plain" && url.value.startsWith("http:")) validateLocalEndpoint(url.value, approvedAddressSet);
+		if (url.kind === "secret" && url.scheme === "http") validateLocalEndpoint(`http://${url.host.includes(":") ? `[${url.host}]` : url.host}:${url.port}/`, approvedAddressSet);
+	} catch {
+		return fail("a webhook target has an approved network authority");
+	}
+	return {
+		targetId: text(target.targetId, "a webhook target id"),
+		version: positiveInteger(target.version, "a webhook target version"),
+		kind: "webhook",
+		url,
+		approvedAddressSet,
+		signing: "standard-webhooks",
+		ordering: "strict",
+		retryLimit,
+		representation: target.representation
+	};
+}
+/** Maps an already canonical document to Task 2's closed delivery union without rebuilding delivery bytes. */
+function webhookDeliveryTarget(document) {
+	return {
+		kind: "webhook",
+		targetId: document.targetId,
+		targetVersion: document.version,
+		representation: document.representation
+	};
+}
+//#endregion
+export { AddressPolicyError as a, parseIpLiteral as c, isJudgeKind as d, webhookDeliveryTarget as i, EventDomainError as l, canonicalWebhookTarget as n, assertAddressAllowed as o, secretWebhookUrlDescriptor as r, assertApprovedAddressSet as s, canonicalSecretWebhookUrl as t, assertJudgeKindEnabled as u };