@agentcomms/events-daemon 0.0.0-stage → 0.17.0

package/dist/webhook-target-DyDTwWhV.mjs

@@ -0,0 +1,673 @@
+import { canonicalJson, sha256Hex } from "@agentcomms/core";
+//#endregion
+//#region src/network/iana-special-purpose.ts
+/** Checked-in IANA policy; network code must never refresh or consult it at runtime. */
+const IANA_SPECIAL_PURPOSE = {
+	snapshotVersion: "iana-special-purpose-2025-10-09",
+	ipv4: {
+		"title": "IANA IPv4 Special-Purpose Address Registry",
+		"url": "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry-1.csv",
+		"lastUpdated": "2025-10-09",
+		"rawSourceSha256": "e3e39e76d00b1677335db8e9a805c7b9480ea2f4dc9e33f0b93cd3a905128d73",
+		"prefixes": [
+			{
+				"prefix": "0.0.0.0/8",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "0.0.0.0/32",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "10.0.0.0/8",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "100.64.0.0/10",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "127.0.0.0/8",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "169.254.0.0/16",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "172.16.0.0/12",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.0.0.0/24",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.0.0.0/29",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.0.0.8/32",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.0.0.9/32",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "192.0.0.10/32",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "192.0.0.170/32",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.0.0.171/32",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.0.2.0/24",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.31.196.0/24",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "192.52.193.0/24",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "192.88.99.0/24",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.88.99.2/32",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.168.0.0/16",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "192.175.48.0/24",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "198.18.0.0/15",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "198.51.100.0/24",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "203.0.113.0/24",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "240.0.0.0/4",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "255.255.255.255/32",
+				"globallyReachable": false
+			}
+		]
+	},
+	ipv6: {
+		"title": "IANA IPv6 Special-Purpose Address Registry",
+		"url": "https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry-1.csv",
+		"lastUpdated": "2025-10-09",
+		"rawSourceSha256": "775feea0621dec8735a44fbf30f762e721e8f0a1b3ab7eb341961a88cfce2139",
+		"prefixes": [
+			{
+				"prefix": "::1/128",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "::/128",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "::ffff:0:0/96",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "64:ff9b::/96",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "64:ff9b:1::/48",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "100::/64",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "100:0:0:1::/64",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "2001::/23",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "2001::/32",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "2001:1::1/128",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "2001:1::2/128",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "2001:1::3/128",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "2001:2::/48",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "2001:3::/32",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "2001:4:112::/48",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "2001:10::/28",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "2001:20::/28",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "2001:30::/28",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "2001:db8::/32",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "2002::/16",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "2620:4f:8000::/48",
+				"globallyReachable": true
+			},
+			{
+				"prefix": "3fff::/20",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "5f00::/16",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "fc00::/7",
+				"globallyReachable": false
+			},
+			{
+				"prefix": "fe80::/10",
+				"globallyReachable": false
+			}
+		]
+	}
+};
+var AddressPolicyError = class extends Error {
+	code = "NETWORK_ADDRESS_REFUSED";
+	constructor(message) {
+		super(message);
+		this.name = "AddressPolicyError";
+	}
+};
+const IPV4_BITS = 32;
+const IPV6_BITS = 128;
+const IPV4_MAX = (1n << 32n) - 1n;
+const WELL_KNOWN_NAT64 = parseCidr("64:ff9b::/96");
+const LOCALLY_ASSIGNED_NAT64 = parseCidr("64:ff9b:1::/48");
+const LINK_LOCAL_V4 = parseCidr("169.254.0.0/16");
+const LINK_LOCAL_V6 = parseCidr("fe80::/10");
+const MULTICAST_V4 = parseCidr("224.0.0.0/4");
+const MULTICAST_V6 = parseCidr("ff00::/8");
+const METADATA_V4 = parseIpLiteral("169.254.169.254");
+const METADATA_V6 = parseIpLiteral("fd00:ec2::254");
+const registryPrefixes = [...IANA_SPECIAL_PURPOSE.ipv4.prefixes.map((entry) => ({
+	...parseCidr(entry.prefix),
+	globallyReachable: entry.globallyReachable
+})), ...IANA_SPECIAL_PURPOSE.ipv6.prefixes.map((entry) => ({
+	...parseCidr(entry.prefix),
+	globallyReachable: entry.globallyReachable
+}))];
+function bitsFor(family) {
+	return family === 4 ? IPV4_BITS : IPV6_BITS;
+}
+function mask(family, prefixLength) {
+	const bits = bitsFor(family);
+	if (!Number.isInteger(prefixLength) || prefixLength < 0 || prefixLength > bits) throw new AddressPolicyError(`invalid CIDR prefix length ${prefixLength}`);
+	if (prefixLength === 0) return 0n;
+	return (1n << BigInt(prefixLength)) - 1n << BigInt(bits - prefixLength);
+}
+function stripBrackets(value) {
+	if (value.startsWith("[") && value.endsWith("]")) return value.slice(1, -1);
+	return value;
+}
+function parseIpv4(value) {
+	const parts = value.split(".");
+	if (parts.length !== 4) return null;
+	let result = 0n;
+	for (const part of parts) {
+		if (!/^(?:0|[1-9]\d{0,2})$/.test(part)) return null;
+		const octet = Number(part);
+		if (octet > 255) return null;
+		result = result << 8n | BigInt(octet);
+	}
+	return result;
+}
+function ipv4Text(value) {
+	return [
+		24n,
+		16n,
+		8n,
+		0n
+	].map((shift) => Number(value >> shift & 255n)).join(".");
+}
+function parseIpv6(value) {
+	if (value.includes("%")) return null;
+	const doubleColon = value.indexOf("::");
+	if (doubleColon !== -1 && value.indexOf("::", doubleColon + 1) !== -1) return null;
+	const left = doubleColon === -1 ? value : value.slice(0, doubleColon);
+	const right = doubleColon === -1 ? "" : value.slice(doubleColon + 2);
+	const leftParts = left === "" ? [] : left.split(":");
+	const rightParts = right === "" ? [] : right.split(":");
+	const rawParts = [...leftParts, ...rightParts];
+	if (rawParts.some((part) => part === "")) return null;
+	const groups = [];
+	for (let index = 0; index < rawParts.length; index += 1) {
+		const part = rawParts[index];
+		if (part === void 0) return null;
+		if (part.includes(".")) {
+			if (index !== rawParts.length - 1) return null;
+			const embedded = parseIpv4(part);
+			if (embedded === null) return null;
+			groups.push(Number(embedded >> 16n & 65535n), Number(embedded & 65535n));
+			continue;
+		}
+		if (!/^[0-9a-f]{1,4}$/i.test(part)) return null;
+		groups.push(Number.parseInt(part, 16));
+	}
+	if (doubleColon === -1) {
+		if (groups.length !== 8) return null;
+	} else {
+		if (groups.length >= 8) return null;
+		const omitted = 8 - groups.length;
+		groups.splice(leftParts.reduce((count, part) => count + (part.includes(".") ? 2 : 1), 0), 0, ...Array(omitted).fill(0));
+	}
+	let result = 0n;
+	for (const group of groups) result = result << 16n | BigInt(group);
+	return result;
+}
+function ipv6Text(value) {
+	const groups = Array.from({ length: 8 }, (_, index) => Number(value >> BigInt((7 - index) * 16) & 65535n));
+	let bestStart = -1;
+	let bestLength = 0;
+	for (let index = 0; index < groups.length;) {
+		const group = groups[index];
+		if (group === void 0) break;
+		if (group !== 0) {
+			index += 1;
+			continue;
+		}
+		const start = index;
+		while (groups[index] === 0) index += 1;
+		const length = index - start;
+		if (length > bestLength && length > 1) {
+			bestStart = start;
+			bestLength = length;
+		}
+	}
+	if (bestStart === 0 && bestLength === 8) return "::";
+	const pieces = [];
+	for (let index = 0; index < groups.length; index += 1) {
+		if (index === bestStart) {
+			pieces.push("");
+			index += bestLength - 1;
+			if (index === groups.length - 1) pieces.push("");
+			continue;
+		}
+		const group = groups[index];
+		if (group === void 0) throw new Error("IPv6 formatter lost a parsed group");
+		pieces.push(group.toString(16));
+	}
+	return pieces.join(":").replace(/^:/, "::").replace(/:$/, "::");
+}
+/** Parses only a canonical-literal-shaped IP address, never a hostname or a DNS spelling. */
+function parseIpLiteral(input) {
+	const value = stripBrackets(input.trim());
+	const ipv4 = parseIpv4(value);
+	if (ipv4 !== null) return {
+		address: ipv4Text(ipv4),
+		family: 4,
+		value: ipv4
+	};
+	const ipv6 = parseIpv6(value);
+	if (ipv6 !== null) return {
+		address: ipv6Text(ipv6),
+		family: 6,
+		value: ipv6
+	};
+	throw new AddressPolicyError(`a literal IP address was required, received ${input}`);
+}
+function parseCidr(input) {
+	const slash = input.lastIndexOf("/");
+	if (slash <= 0 || slash === input.length - 1) throw new AddressPolicyError(`invalid CIDR ${input}`);
+	const address = parseIpLiteral(input.slice(0, slash));
+	const prefixLength = Number(input.slice(slash + 1));
+	const prefixMask = mask(address.family, prefixLength);
+	if ((address.value & prefixMask) !== address.value) throw new AddressPolicyError(`CIDR ${input} has host bits set`);
+	return {
+		source: `${address.address}/${prefixLength}`,
+		family: address.family,
+		prefixLength,
+		value: address.value
+	};
+}
+function inCidr(address, cidr) {
+	return address.family === cidr.family && (address.value & mask(cidr.family, cidr.prefixLength)) === cidr.value;
+}
+function parseApprovedAddressSet(entries) {
+	if (entries.length === 0) throw new AddressPolicyError("approvedAddressSet must be non-empty");
+	const parsed = entries.map((entry) => entry.includes("/") ? parseCidr(entry) : parseCidr(`${parseIpLiteral(entry).address}/${bitsFor(parseIpLiteral(entry).family)}`));
+	for (let index = 1; index < entries.length; index += 1) {
+		const previous = entries[index - 1];
+		const current = entries[index];
+		if (previous === void 0 || current === void 0) throw new AddressPolicyError("approvedAddressSet could not be read");
+		if (previous.localeCompare(current) >= 0) throw new AddressPolicyError("approvedAddressSet must contain sorted, duplicate-free literals or CIDRs");
+	}
+	return parsed;
+}
+/** Checks the persisted rule input before a connector can use it to resolve a host. */
+function assertApprovedAddressSet(entries) {
+	parseApprovedAddressSet(entries);
+}
+function isUnconditionallyDenied(address) {
+	return inCidr(address, LINK_LOCAL_V4) || inCidr(address, LINK_LOCAL_V6) || inCidr(address, MULTICAST_V4) || inCidr(address, MULTICAST_V6) || address.family === METADATA_V4.family && address.value === METADATA_V4.value || address.family === METADATA_V6.family && address.value === METADATA_V6.value;
+}
+function globallyReachable(address) {
+	return registryPrefixes.filter((entry) => inCidr(address, entry)).sort((left, right) => right.prefixLength - left.prefixLength)[0]?.globallyReachable ?? true;
+}
+function ipv4From(value) {
+	const ipv4 = value & IPV4_MAX;
+	return {
+		address: ipv4Text(ipv4),
+		family: 4,
+		value: ipv4
+	};
+}
+function configuredNat64(options) {
+	const raw = options.activeNat64Prefix ?? null;
+	if (raw === null) return null;
+	const entries = typeof raw === "string" ? [raw] : raw;
+	if (entries.length !== 1) throw new AddressPolicyError("NAT64 needs exactly one trusted /96 prefix");
+	const prefixText = entries[0];
+	if (prefixText === void 0) throw new AddressPolicyError("NAT64 prefix could not be read");
+	const prefix = parseCidr(prefixText);
+	if (prefix.family !== 6 || prefix.prefixLength !== 96) throw new AddressPolicyError("NAT64 needs one trusted IPv6 /96 prefix");
+	return prefix;
+}
+function embeddedAddresses(address, options) {
+	if (address.family !== 6) return [];
+	const embedded = [];
+	const upper96 = address.value >> 32n;
+	const mapped = upper96 === 65535n;
+	const compatible = upper96 === 0n && address.value > 1n;
+	if (mapped || compatible) embedded.push(ipv4From(address.value));
+	const configured = configuredNat64(options);
+	if (inCidr(address, WELL_KNOWN_NAT64) || inCidr(address, LOCALLY_ASSIGNED_NAT64) || configured !== null && inCidr(address, configured)) {
+		if (configured === null || !inCidr(address, configured)) throw new AddressPolicyError("NAT64 address has no single trusted active /96 prefix");
+		embedded.push(ipv4From(address.value));
+	}
+	if (inCidr(address, parseCidr("2002::/16"))) embedded.push(ipv4From(address.value >> 80n));
+	if (inCidr(address, parseCidr("2001:0::/32"))) {
+		embedded.push(ipv4From(address.value >> 64n));
+		embedded.push(ipv4From((address.value ^ IPV4_MAX) & IPV4_MAX));
+	}
+	const isatapInterface = address.value >> 32n & IPV4_MAX;
+	if (isatapInterface === 24318n || isatapInterface === 33578750n) embedded.push(ipv4From(address.value));
+	return embedded;
+}
+function assertOne(address, approved, options, seen) {
+	if (seen.has(`${address.family}:${address.value}`)) return [];
+	seen.add(`${address.family}:${address.value}`);
+	if (isUnconditionallyDenied(address)) throw new AddressPolicyError(`address ${address.address} is metadata or link-local and is always refused`);
+	if (options.addressMode === "global-only") {
+		if (!globallyReachable(address)) throw new AddressPolicyError(`non-global address ${address.address} is refused by global-only policy`);
+	} else {
+		if (approved === void 0) throw new AddressPolicyError("approvedAddressSet was unavailable");
+		const explicitlyApproved = approved.some((entry) => inCidr(address, entry));
+		if (!globallyReachable(address) && !explicitlyApproved) throw new AddressPolicyError(`non-global address ${address.address} needs an exact approvedAddressSet entry`);
+		if (!explicitlyApproved) throw new AddressPolicyError(`address ${address.address} is not in the approvedAddressSet`);
+	}
+	const nested = embeddedAddresses(address, options);
+	for (const child of nested) assertOne(child, approved, options, seen);
+	return nested;
+}
+/** Validates the literal itself and every embedded transition address under the selected exact-set or global-only policy. */
+function assertAddressAllowed(input, options) {
+	const address = parseIpLiteral(input);
+	const embedded = assertOne(address, options.addressMode === "global-only" ? void 0 : parseApprovedAddressSet(options.approvedAddressSet), options, /* @__PURE__ */ new Set());
+	return {
+		address: address.address,
+		family: address.family,
+		embedded
+	};
+}
+//#endregion
+//#region src/network/local-endpoint.ts
+var LocalEndpointError = class extends Error {
+	code = "LOCAL_ENDPOINT_REFUSED";
+	constructor(message) {
+		super(message);
+		this.name = "LocalEndpointError";
+	}
+};
+/** Validates the deliberately narrow local-only network descriptor. */
+function validateLocalEndpoint(input, approvedAddressSet) {
+	const url = typeof input === "string" ? new URL(input) : new URL(input.href);
+	const hostname = url.hostname.startsWith("[") && url.hostname.endsWith("]") ? url.hostname.slice(1, -1) : url.hostname;
+	if (url.protocol !== "http:") throw new LocalEndpointError("a local endpoint must use HTTP");
+	if (url.username !== "" || url.password !== "" || url.hash !== "") throw new LocalEndpointError("a local endpoint URL has unsupported authority data");
+	let address;
+	try {
+		address = parseIpLiteral(hostname).address;
+		assertAddressAllowed(address, { approvedAddressSet });
+	} catch (error) {
+		if (error instanceof AddressPolicyError) throw new LocalEndpointError(error.message);
+		throw error;
+	}
+	if (address !== "127.0.0.1" && address !== "::1") throw new LocalEndpointError("a local endpoint must use literal 127.0.0.1 or ::1");
+	if (approvedAddressSet.length !== 1 || approvedAddressSet[0] === void 0 || approvedAddressSet[0].includes("/") || parseIpLiteral(approvedAddressSet[0]).address !== address) throw new LocalEndpointError("a local endpoint requires its one exact approved literal loopback address");
+	return {
+		url,
+		address
+	};
+}
+//#endregion
+//#region src/domain/lifecycle.ts
+/** A content-free domain refusal. No caller should substitute an arbitrary Error message at a control boundary. */
+var EventDomainError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "EventDomainError";
+		this.code = code;
+	}
+};
+const JUDGE_KIND_TYPESAFE = "typesafe";
+const JUDGE_KIND_LAYA = "laya";
+const JUDGE_KIND_LOCAL_ENDPOINT = "local-endpoint";
+const JUDGE_KINDS = [
+	JUDGE_KIND_TYPESAFE,
+	JUDGE_KIND_LAYA,
+	JUDGE_KIND_LOCAL_ENDPOINT
+];
+function isJudgeKind(value) {
+	return typeof value === "string" && JUDGE_KINDS.includes(value);
+}
+function assertJudgeKindEnabled(kind, enabled) {
+	if (!enabled) throw new EventDomainError("JUDGE_KIND_DISABLED", `the ${kind} judge kind is disabled`);
+}
+//#endregion
+//#region src/domain/webhook-target.ts
+function fail(message) {
+	throw new EventDomainError("VERSION_DOCUMENT_INVALID", message);
+}
+function record(value, name) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return fail(`${name} is an object`);
+	try {
+		return JSON.parse(canonicalJson(value));
+	} catch {
+		return fail(`${name} is canonical JSON`);
+	}
+}
+function text(value, name) {
+	if (typeof value !== "string" || value.length === 0) return fail(`${name} is a non-empty string`);
+	return value;
+}
+function positiveInteger(value, name) {
+	if (!Number.isSafeInteger(value) || value < 1) return fail(`${name} is a positive safe integer`);
+	return value;
+}
+function canonicalPercentEscapes(value) {
+	return value.replace(/%[0-9a-f]{2}/gi, (encoded) => encoded.toUpperCase());
+}
+function canonicalUrl(value, allowQuery) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return fail("a webhook URL is absolute");
+	}
+	const scheme = parsed.protocol.slice(0, -1);
+	if (scheme !== "http" && scheme !== "https") return fail("a webhook URL uses http or https");
+	if (parsed.hash.length !== 0) return fail("a webhook URL has no fragment");
+	if (!allowQuery && (parsed.username.length !== 0 || parsed.password.length !== 0 || parsed.search.length !== 0)) return fail("a plain webhook URL has no userinfo or query");
+	const port = parsed.port.length === 0 ? scheme === "https" ? 443 : 80 : Number(parsed.port);
+	if (!Number.isSafeInteger(port) || port < 1 || port > 65535) return fail("a webhook URL has a valid port");
+	const host = parsed.hostname.toLowerCase();
+	if (host.length === 0) return fail("a webhook URL has a host");
+	return {
+		value: `${scheme}://${allowQuery && (parsed.username.length !== 0 || parsed.password.length !== 0) ? `${canonicalPercentEscapes(parsed.username)}${parsed.password.length === 0 ? "" : `:${canonicalPercentEscapes(parsed.password)}`}@` : ""}${host.includes(":") && !host.startsWith("[") ? `[${host}]` : host}:${port}${canonicalPercentEscapes(parsed.pathname)}${allowQuery ? canonicalPercentEscapes(parsed.search) : ""}`,
+		authority: {
+			scheme,
+			host,
+			port
+		}
+	};
+}
+/** Canonicalises the complete hidden URL only for the daemon's secret-store factory. */
+function secretWebhookUrlDescriptor(value) {
+	const canonical = canonicalUrl(value, true);
+	return {
+		kind: "secret",
+		...canonical.authority,
+		sha256: sha256Hex(canonical.value)
+	};
+}
+/** Produces the private stored URL and its public descriptor together; callers return only the descriptor. */
+function canonicalSecretWebhookUrl(value) {
+	const canonical = canonicalUrl(value, true);
+	return {
+		value: canonical.value,
+		descriptor: {
+			kind: "secret",
+			...canonical.authority,
+			sha256: sha256Hex(canonical.value)
+		}
+	};
+}
+function canonicalAddressSet(value) {
+	if (!Array.isArray(value) || value.length === 0) return fail("a webhook approvedAddressSet is a non-empty array");
+	const addresses = value.map((entry) => text(entry, "a webhook approvedAddressSet entry"));
+	const sorted = [...addresses].sort();
+	if (new Set(sorted).size !== sorted.length || sorted.some((entry, index) => entry !== addresses[index])) return fail("a webhook approvedAddressSet is sorted and duplicate-free");
+	return sorted;
+}
+function canonicalUrlDescriptor(value) {
+	const url = record(value, "a webhook URL descriptor");
+	if (url.kind === "plain") return {
+		kind: "plain",
+		value: canonicalUrl(text(url.value, "a plain webhook URL"), false).value
+	};
+	if (url.kind === "secret") {
+		const scheme = text(url.scheme, "a secret webhook scheme");
+		if (scheme !== "http" && scheme !== "https") return fail("a secret webhook scheme is http or https");
+		const host = text(url.host, "a secret webhook host").toLowerCase();
+		const port = positiveInteger(url.port, "a secret webhook port");
+		if (port > 65535) return fail("a secret webhook port is at most 65535");
+		const authority = canonicalUrl(`${scheme}://${host.includes(":") ? `[${host}]` : host}:${port}/`, false).authority;
+		if (authority.scheme !== scheme || authority.host !== host || authority.port !== port) return fail("a secret webhook authority is canonical");
+		const sha256 = text(url.sha256, "a secret webhook fingerprint");
+		if (!/^[a-f0-9]{64}$/.test(sha256)) return fail("a secret webhook fingerprint is lowercase SHA-256");
+		return {
+			kind: "secret",
+			scheme,
+			host,
+			port,
+			sha256
+		};
+	}
+	return fail("a webhook URL descriptor has a known kind");
+}
+/** The canonical immutable webhook target contains public authority only, never a slot or complete secret URL. */
+function canonicalWebhookTarget(value) {
+	const target = record(value, "a webhook target document");
+	if (target.kind !== "webhook") return fail("a webhook target document has kind webhook");
+	if (target.signing !== "standard-webhooks") return fail("a webhook target uses standard-webhooks signing");
+	if (target.ordering !== "strict") return fail("a webhook target uses strict delivery ordering");
+	const retryLimit = positiveInteger(target.retryLimit, "a webhook retry limit");
+	if (retryLimit > 20) return fail("a webhook retry limit is at most 20");
+	if (target.representation !== "plain" && target.representation !== "enveloped") return fail("a webhook representation is plain or enveloped");
+	const url = canonicalUrlDescriptor(target.url);
+	const approvedAddressSet = canonicalAddressSet(target.approvedAddressSet);
+	try {
+		assertApprovedAddressSet(approvedAddressSet);
+		if (url.kind === "plain" && url.value.startsWith("http:")) validateLocalEndpoint(url.value, approvedAddressSet);
+		if (url.kind === "secret" && url.scheme === "http") validateLocalEndpoint(`http://${url.host.includes(":") ? `[${url.host}]` : url.host}:${url.port}/`, approvedAddressSet);
+	} catch {
+		return fail("a webhook target has an approved network authority");
+	}
+	return {
+		targetId: text(target.targetId, "a webhook target id"),
+		version: positiveInteger(target.version, "a webhook target version"),
+		kind: "webhook",
+		url,
+		approvedAddressSet,
+		signing: "standard-webhooks",
+		ordering: "strict",
+		retryLimit,
+		representation: target.representation
+	};
+}
+/** Maps an already canonical document to Task 2's closed delivery union without rebuilding delivery bytes. */
+function webhookDeliveryTarget(document) {
+	return {
+		kind: "webhook",
+		targetId: document.targetId,
+		targetVersion: document.version,
+		representation: document.representation
+	};
+}
+//#endregion
+export { EventDomainError as a, JUDGE_KIND_LOCAL_ENDPOINT as c, isJudgeKind as d, validateLocalEndpoint as f, parseIpLiteral as g, assertApprovedAddressSet as h, webhookDeliveryTarget as i, JUDGE_KIND_TYPESAFE as l, assertAddressAllowed as m, canonicalWebhookTarget as n, JUDGE_KINDS as o, AddressPolicyError as p, secretWebhookUrlDescriptor as r, JUDGE_KIND_LAYA as s, canonicalSecretWebhookUrl as t, assertJudgeKindEnabled as u };