@fabricorg/webhook-delivery 0.1.2 → 0.2.0

package/dist/node.cjs

@@ -1,880 +1,1223 @@
-'use strict';
-
-var buffer = require('buffer');
-var https = require('https');
-var promises = require('dns/promises');
-
-// src/node/transport.ts
-
-// src/snapshot.ts
-var reflectApply = Reflect.apply;
-var reflectOwnKeys = Reflect.ownKeys;
-var reflectGetOwnPropertyDescriptor = Reflect.getOwnPropertyDescriptor;
-var reflectGetPrototypeOf = Reflect.getPrototypeOf;
-var reflectDefineProperty = Reflect.defineProperty;
-var objectCreate = Object.create;
-var objectFreeze = Object.freeze;
-var objectHasOwn = Object.hasOwn;
-var objectPrototype = Object.prototype;
-var arrayIsArray = Array.isArray;
-var dateGetTime = Date.prototype.getTime;
-var regExpExec = RegExp.prototype.exec;
-var apply = reflectApply;
-var numberIsFinite = Number.isFinite;
-var numberIsSafeInteger = Number.isSafeInteger;
-var freeze = objectFreeze;
-var hasOwn = objectHasOwn;
-var isArray = arrayIsArray;
-var NOT_PRIMITIVE = /* @__PURE__ */ Symbol("webhook-delivery.not-primitive");
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let buffer = require("buffer");
+let https = require("https");
+let dns_promises = require("dns/promises");
+//#region src/snapshot.ts
+const reflectApply = Reflect.apply;
+const reflectOwnKeys = Reflect.ownKeys;
+const reflectGetOwnPropertyDescriptor$1 = Reflect.getOwnPropertyDescriptor;
+const reflectGetPrototypeOf = Reflect.getPrototypeOf;
+const reflectDefineProperty$1 = Reflect.defineProperty;
+const objectCreate$1 = Object.create;
+const objectFreeze = Object.freeze;
+const objectHasOwn = Object.hasOwn;
+const objectPrototype = Object.prototype;
+const arrayIsArray = Array.isArray;
+const dateGetTime = Date.prototype.getTime;
+Date.prototype.toISOString;
+const regExpExec = RegExp.prototype.exec;
+String.prototype.trim;
+/** Captured `Reflect.apply`, so a replaced `Function.prototype.call` is never used. */
+const apply = reflectApply;
+/** Captured numeric intrinsics. */
+const numberIsFinite = Number.isFinite;
+const numberIsSafeInteger = Number.isSafeInteger;
+Date.parse;
+const freeze = objectFreeze;
+const hasOwn = objectHasOwn;
+const isArray = arrayIsArray;
+/** Stands in for a non-primitive where an option must be a primitive, so validation rejects it. */
+const NOT_PRIMITIVE = Symbol("webhook-delivery.not-primitive");
+/** A null-prototype data descriptor, so `defineProperty` reads nothing from `Object.prototype`. */
 function dataDescriptor(value) {
-  const descriptor = objectCreate(null);
-  descriptor.value = value;
-  descriptor.enumerable = true;
-  descriptor.writable = false;
-  descriptor.configurable = false;
-  return descriptor;
+	const descriptor = objectCreate$1(null);
+	descriptor.value = value;
+	descriptor.enumerable = true;
+	descriptor.writable = false;
+	descriptor.configurable = false;
+	return descriptor;
 }
+/** Define an own, enumerable, read-only data property without consulting any prototype. */
 function define(target, key, value) {
-  reflectDefineProperty(target, key, dataDescriptor(value));
+	reflectDefineProperty$1(target, key, dataDescriptor(value));
 }
+/** A fresh array holding `values`' elements in order, frozen. `values` must be package-owned. */
 function frozenList(values) {
-  const list = [];
-  for (let index = 0; index < values.length; index += 1) define(list, index, values[index]);
-  return objectFreeze(list);
+	const list = [];
+	for (let index = 0; index < values.length; index += 1) define(list, index, values[index]);
+	return objectFreeze(list);
 }
+/**
+* A frozen null-prototype copy of a package-built object literal. Keys whose
+* value is `undefined` are left out, so optional fields are absent rather
+* than present-and-undefined.
+*/
 function record(fields) {
-  const out = objectCreate(null);
-  const keys = reflectOwnKeys(fields);
-  for (let index = 0; index < keys.length; index += 1) {
-    const key = keys[index];
-    const descriptor = reflectGetOwnPropertyDescriptor(fields, key);
-    if (descriptor !== void 0 && objectHasOwn(descriptor, "value") && descriptor.value !== void 0) define(out, key, descriptor.value);
-  }
-  return objectFreeze(out);
+	const out = objectCreate$1(null);
+	const keys = reflectOwnKeys(fields);
+	for (let index = 0; index < keys.length; index += 1) {
+		const key = keys[index];
+		const descriptor = reflectGetOwnPropertyDescriptor$1(fields, key);
+		if (descriptor !== void 0 && objectHasOwn(descriptor, "value") && descriptor.value !== void 0) define(out, key, descriptor.value);
+	}
+	return objectFreeze(out);
 }
+/** A mutable null-prototype map for package-internal bookkeeping. */
 function emptyMap() {
-  return objectCreate(null);
+	return objectCreate$1(null);
 }
+/** `true` when `re` matches `value`, using the captured `RegExp.prototype.exec`. */
 function matches(re, value) {
-  return reflectApply(regExpExec, re, [value]) !== null;
+	return reflectApply(regExpExec, re, [value]) !== null;
 }
+/** `true` for a non-array object whose prototype is `Object.prototype` or `null`. A Proxy's trap may run. */
 function isPlainRecord(value) {
-  if (value === null || typeof value !== "object" || arrayIsArray(value)) return false;
-  const prototype = reflectGetPrototypeOf(value);
-  return prototype === objectPrototype || prototype === null;
+	if (value === null || typeof value !== "object" || arrayIsArray(value)) return false;
+	const prototype = reflectGetPrototypeOf(value);
+	return prototype === objectPrototype || prototype === null;
 }
+/**
+* Read one own data property. Absent is `undefined`; an accessor is refused
+* through `fail` without being called.
+*/
 function readOwn(target, key, field, fail) {
-  const descriptor = reflectGetOwnPropertyDescriptor(target, key);
-  if (descriptor === void 0) return void 0;
-  if (!objectHasOwn(descriptor, "value")) return fail("accessor", field);
-  return descriptor.value;
+	const descriptor = reflectGetOwnPropertyDescriptor$1(target, key);
+	if (descriptor === void 0) return void 0;
+	if (!objectHasOwn(descriptor, "value")) return fail("accessor", field);
+	return descriptor.value;
 }
+/** `undefined` for an absent value, the value for a primitive, {@link NOT_PRIMITIVE} otherwise. */
 function primitive(value) {
-  if (value === null || typeof value !== "object" && typeof value !== "function") return value;
-  return NOT_PRIMITIVE;
+	if (value === null || typeof value !== "object" && typeof value !== "function") return value;
+	return NOT_PRIMITIVE;
 }
+/** The time value of a real `Date`, or `NaN` for anything else. */
 function timeOf(value) {
-  if (value === null || typeof value !== "object") return NaN;
-  try {
-    return reflectApply(dateGetTime, value, []);
-  } catch {
-    return NaN;
-  }
+	if (value === null || typeof value !== "object") return NaN;
+	try {
+		return reflectApply(dateGetTime, value, []);
+	} catch {
+		return NaN;
+	}
 }
-
-// src/address.ts
-var stringCharCodeAt = String.prototype.charCodeAt;
-var stringIndexOf = String.prototype.indexOf;
-var stringSlice = String.prototype.slice;
-var stringSplit = String.prototype.split;
-var MAX_ADDRESS_LENGTH = 45;
-var MAX_TEXT_LENGTH = 64;
-var IPV4_OCTET = "(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)";
-var IPV4_DOTTED = new RegExp(`^${IPV4_OCTET}(?:\\.${IPV4_OCTET}){3}$`);
-var HEX_GROUP = /^[0-9A-Fa-f]{1,4}$/;
+//#endregion
+//#region src/address.ts
+const stringCharCodeAt = String.prototype.charCodeAt;
+const stringIndexOf = String.prototype.indexOf;
+const stringSlice$1 = String.prototype.slice;
+const stringSplit = String.prototype.split;
+/** Longest address text parsed: a full IPv6 form with an embedded IPv4 tail is 45 characters. */
+const MAX_ADDRESS_LENGTH = 45;
+/** Longest text inspected at all, leaving room for a zone index. */
+const MAX_TEXT_LENGTH = 64;
+const IPV4_OCTET = "(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)";
+/** Canonical dotted-quad only: no leading zeros, no shorthand, no hex. */
+const IPV4_DOTTED = new RegExp(`^${IPV4_OCTET}(?:\\.${IPV4_OCTET}){3}$`);
+const HEX_GROUP = /^[0-9A-Fa-f]{1,4}$/;
 function ipv4Block(a, b, c, d, prefix) {
-  return freeze({ base: (a << 24 | b << 16 | c << 8 | d) >>> 0, prefix });
-}
-var REFUSED_IPV4_BLOCKS = freeze([
-  ipv4Block(0, 0, 0, 0, 8),
-  // "this network", including the unspecified 0.0.0.0
-  ipv4Block(10, 0, 0, 0, 8),
-  // private
-  ipv4Block(100, 64, 0, 0, 10),
-  // shared address space (CGNAT)
-  ipv4Block(127, 0, 0, 0, 8),
-  // loopback
-  ipv4Block(169, 254, 0, 0, 16),
-  // link-local, including cloud metadata endpoints
-  ipv4Block(172, 16, 0, 0, 12),
-  // private
-  ipv4Block(192, 0, 0, 0, 24),
-  // IETF protocol assignments
-  ipv4Block(192, 0, 2, 0, 24),
-  // documentation (TEST-NET-1)
-  ipv4Block(192, 88, 99, 0, 24),
-  // deprecated 6to4 relay anycast
-  ipv4Block(192, 168, 0, 0, 16),
-  // private
-  ipv4Block(198, 18, 0, 0, 15),
-  // benchmarking
-  ipv4Block(198, 51, 100, 0, 24),
-  // documentation (TEST-NET-2)
-  ipv4Block(203, 0, 113, 0, 24),
-  // documentation (TEST-NET-3)
-  ipv4Block(224, 0, 0, 0, 4),
-  // multicast
-  ipv4Block(240, 0, 0, 0, 4)
-  // reserved, including 255.255.255.255
+	return freeze({
+		base: (a << 24 | b << 16 | c << 8 | d) >>> 0,
+		prefix
+	});
+}
+/**
+* IPv4 blocks that are never a webhook destination. The IANA IPv4
+* Special-Purpose Address Registry's not-globally-reachable entries, plus
+* multicast (224.0.0.0/4) and reserved space (240.0.0.0/4, which holds the
+* limited broadcast address). 192.0.0.0/24 is refused whole, including the
+* two anycast /32s in it that IANA marks reachable; neither is a webhook
+* receiver.
+*/
+const REFUSED_IPV4_BLOCKS = freeze([
+	ipv4Block(0, 0, 0, 0, 8),
+	ipv4Block(10, 0, 0, 0, 8),
+	ipv4Block(100, 64, 0, 0, 10),
+	ipv4Block(127, 0, 0, 0, 8),
+	ipv4Block(169, 254, 0, 0, 16),
+	ipv4Block(172, 16, 0, 0, 12),
+	ipv4Block(192, 0, 0, 0, 24),
+	ipv4Block(192, 0, 2, 0, 24),
+	ipv4Block(192, 88, 99, 0, 24),
+	ipv4Block(192, 168, 0, 0, 16),
+	ipv4Block(198, 18, 0, 0, 15),
+	ipv4Block(198, 51, 100, 0, 24),
+	ipv4Block(203, 0, 113, 0, 24),
+	ipv4Block(224, 0, 0, 0, 4),
+	ipv4Block(240, 0, 0, 0, 4)
 ]);
 function inIpv4Block(value, block) {
-  const mask = block.prefix === 0 ? 0 : 4294967295 << 32 - block.prefix >>> 0;
-  return (value & mask) >>> 0 === block.base;
+	return (value & (block.prefix === 0 ? 0 : 4294967295 << 32 - block.prefix >>> 0)) >>> 0 === block.base;
 }
+/** `true` when an IPv4 address, as an unsigned 32-bit integer, is publicly routable. */
 function isPublicIpv4Value(value) {
-  for (let index = 0; index < REFUSED_IPV4_BLOCKS.length; index += 1) {
-    if (inIpv4Block(value, REFUSED_IPV4_BLOCKS[index])) return false;
-  }
-  return true;
+	for (let index = 0; index < REFUSED_IPV4_BLOCKS.length; index += 1) if (inIpv4Block(value, REFUSED_IPV4_BLOCKS[index])) return false;
+	return true;
 }
+/** Parse a canonical dotted-quad to an unsigned 32-bit integer, or `undefined`. */
 function parseIpv4(text) {
-  if (!matches(IPV4_DOTTED, text)) return void 0;
-  const parts = apply(stringSplit, text, ["."]);
-  let value = 0;
-  for (let index = 0; index < 4; index += 1) value = value * 256 + decimal(parts[index]);
-  return value >>> 0;
+	if (!matches(IPV4_DOTTED, text)) return void 0;
+	const parts = apply(stringSplit, text, ["."]);
+	let value = 0;
+	for (let index = 0; index < 4; index += 1) value = value * 256 + decimal(parts[index]);
+	return value >>> 0;
 }
 function decimal(text) {
-  let value = 0;
-  for (let index = 0; index < text.length; index += 1) value = value * 10 + (apply(stringCharCodeAt, text, [index]) - 48);
-  return value;
+	let value = 0;
+	for (let index = 0; index < text.length; index += 1) value = value * 10 + (apply(stringCharCodeAt, text, [index]) - 48);
+	return value;
 }
 function hex(text) {
-  let value = 0;
-  for (let index = 0; index < text.length; index += 1) {
-    const code = apply(stringCharCodeAt, text, [index]);
-    const digit = code <= 57 ? code - 48 : code <= 70 ? code - 55 : code - 87;
-    value = value * 16 + digit;
-  }
-  return value;
+	let value = 0;
+	for (let index = 0; index < text.length; index += 1) {
+		const code = apply(stringCharCodeAt, text, [index]);
+		const digit = code <= 57 ? code - 48 : code <= 70 ? code - 55 : code - 87;
+		value = value * 16 + digit;
+	}
+	return value;
 }
+/** Parse one side of an IPv6 address (no `::`) into 16-bit words; `tailIpv4` allows a dotted last group. */
 function parseIpv6Groups(text, tailIpv4) {
-  const words = [];
-  if (text === "") return words;
-  const groups = apply(stringSplit, text, [":"]);
-  for (let index = 0; index < groups.length; index += 1) {
-    const group = groups[index];
-    if (tailIpv4 && index === groups.length - 1 && apply(stringIndexOf, group, ["."]) !== -1) {
-      const v4 = parseIpv4(group);
-      if (v4 === void 0) return void 0;
-      words[words.length] = v4 >>> 16;
-      words[words.length] = v4 & 65535;
-      continue;
-    }
-    if (!matches(HEX_GROUP, group)) return void 0;
-    words[words.length] = hex(group);
-  }
-  return words;
+	const words = [];
+	if (text === "") return words;
+	const groups = apply(stringSplit, text, [":"]);
+	for (let index = 0; index < groups.length; index += 1) {
+		const group = groups[index];
+		if (tailIpv4 && index === groups.length - 1 && apply(stringIndexOf, group, ["."]) !== -1) {
+			const v4 = parseIpv4(group);
+			if (v4 === void 0) return void 0;
+			words[words.length] = v4 >>> 16;
+			words[words.length] = v4 & 65535;
+			continue;
+		}
+		if (!matches(HEX_GROUP, group)) return void 0;
+		words[words.length] = hex(group);
+	}
+	return words;
 }
+/** Parse an IPv6 address (no brackets, no zone) into eight 16-bit words, or `undefined`. */
 function parseIpv6(text) {
-  const gap = apply(stringIndexOf, text, ["::"]);
-  if (gap === -1) {
-    const words2 = parseIpv6Groups(text, true);
-    return words2 !== void 0 && words2.length === 8 ? words2 : void 0;
-  }
-  if (apply(stringIndexOf, text, ["::", gap + 1]) !== -1) return void 0;
-  const head = parseIpv6Groups(apply(stringSlice, text, [0, gap]), false);
-  const tail = parseIpv6Groups(apply(stringSlice, text, [gap + 2]), true);
-  if (head === void 0 || tail === void 0 || head.length + tail.length > 7) return void 0;
-  const words = [];
-  for (let index = 0; index < head.length; index += 1) words[words.length] = head[index];
-  for (let index = head.length + tail.length; index < 8; index += 1) words[words.length] = 0;
-  for (let index = 0; index < tail.length; index += 1) words[words.length] = tail[index];
-  return words;
+	const gap = apply(stringIndexOf, text, ["::"]);
+	if (gap === -1) {
+		const words = parseIpv6Groups(text, true);
+		return words !== void 0 && words.length === 8 ? words : void 0;
+	}
+	if (apply(stringIndexOf, text, ["::", gap + 1]) !== -1) return void 0;
+	const head = parseIpv6Groups(apply(stringSlice$1, text, [0, gap]), false);
+	const tail = parseIpv6Groups(apply(stringSlice$1, text, [gap + 2]), true);
+	if (head === void 0 || tail === void 0 || head.length + tail.length > 7) return void 0;
+	const words = [];
+	for (let index = 0; index < head.length; index += 1) words[words.length] = head[index];
+	for (let index = head.length + tail.length; index < 8; index += 1) words[words.length] = 0;
+	for (let index = 0; index < tail.length; index += 1) words[words.length] = tail[index];
+	return words;
 }
+/** The IPv4 address held in two consecutive 16-bit words. */
 function embeddedIpv4(high, low) {
-  return (high << 16 | low) >>> 0;
+	return (high << 16 | low) >>> 0;
 }
+/** `true` when an IPv6 address, as eight 16-bit words, is publicly routable. */
 function isPublicIpv6Words(w) {
-  if (w[0] === 100 && w[1] === 65435 && w[2] === 0 && w[3] === 0 && w[4] === 0 && w[5] === 0) {
-    return isPublicIpv4Value(embeddedIpv4(w[6], w[7]));
-  }
-  if ((w[0] & 57344) !== 8192) return false;
-  if (w[0] === 8193 && (w[1] & 65024) === 0) {
-    if (w[1] !== 0) return false;
-    const server = embeddedIpv4(w[2], w[3]);
-    const client = ~embeddedIpv4(w[6], w[7]) >>> 0;
-    return isPublicIpv4Value(server) && isPublicIpv4Value(client);
-  }
-  if (w[0] === 8193 && w[1] === 3512) return false;
-  if (w[0] === 16383 && (w[1] & 61440) === 0) return false;
-  if (w[0] === 8194) return isPublicIpv4Value(embeddedIpv4(w[1], w[2]));
-  return true;
+	if (w[0] === 100 && w[1] === 65435 && w[2] === 0 && w[3] === 0 && w[4] === 0 && w[5] === 0) return isPublicIpv4Value(embeddedIpv4(w[6], w[7]));
+	if ((w[0] & 57344) !== 8192) return false;
+	if (w[0] === 8193 && (w[1] & 65024) === 0) {
+		if (w[1] !== 0) return false;
+		const server = embeddedIpv4(w[2], w[3]);
+		const client = ~embeddedIpv4(w[6], w[7]) >>> 0;
+		return isPublicIpv4Value(server) && isPublicIpv4Value(client);
+	}
+	if (w[0] === 8193 && w[1] === 3512) return false;
+	if (w[0] === 16383 && (w[1] & 61440) === 0) return false;
+	if (w[0] === 8194) return isPublicIpv4Value(embeddedIpv4(w[1], w[2]));
+	return true;
 }
+/** RFC 5952 text for eight 16-bit words: lowercase, no leading zeros, the longest zero run of two or more compressed. */
 function formatIpv6(w) {
-  let bestStart = -1;
-  let bestLength = 0;
-  for (let index = 0; index < 8; ) {
-    if (w[index] !== 0) {
-      index += 1;
-      continue;
-    }
-    let end = index;
-    while (end < 8 && w[end] === 0) end += 1;
-    if (end - index > bestLength) {
-      bestStart = index;
-      bestLength = end - index;
-    }
-    index = end;
-  }
-  if (bestLength < 2) bestStart = -1;
-  let text = "";
-  for (let index = 0; index < 8; index += 1) {
-    if (index === bestStart) {
-      text += "::";
-      index += bestLength - 1;
-      continue;
-    }
-    if (text !== "" && !endsWithColons(text)) text += ":";
-    text += hexText(w[index]);
-  }
-  return text;
+	let bestStart = -1;
+	let bestLength = 0;
+	for (let index = 0; index < 8;) {
+		if (w[index] !== 0) {
+			index += 1;
+			continue;
+		}
+		let end = index;
+		while (end < 8 && w[end] === 0) end += 1;
+		if (end - index > bestLength) {
+			bestStart = index;
+			bestLength = end - index;
+		}
+		index = end;
+	}
+	if (bestLength < 2) bestStart = -1;
+	let text = "";
+	for (let index = 0; index < 8; index += 1) {
+		if (index === bestStart) {
+			text += "::";
+			index += bestLength - 1;
+			continue;
+		}
+		if (text !== "" && !endsWithColons(text)) text += ":";
+		text += hexText(w[index]);
+	}
+	return text;
 }
 function endsWithColons(text) {
-  return text.length >= 2 && apply(stringSlice, text, [-2]) === "::";
+	return text.length >= 2 && apply(stringSlice$1, text, [-2]) === "::";
 }
-var HEX_DIGITS = "0123456789abcdef";
+const HEX_DIGITS = "0123456789abcdef";
 function hexText(value) {
-  if (value === 0) return "0";
-  let text = "";
-  for (let rest = value; rest > 0; rest = (rest - rest % 16) / 16) text = HEX_DIGITS[rest % 16] + text;
-  return text;
+	if (value === 0) return "0";
+	let text = "";
+	for (let rest = value; rest > 0; rest = (rest - rest % 16) / 16) text = HEX_DIGITS[rest % 16] + text;
+	return text;
 }
 function formatIpv4(value) {
-  return `${value >>> 24}.${value >>> 16 & 255}.${value >>> 8 & 255}.${value & 255}`;
+	return `${value >>> 24}.${value >>> 16 & 255}.${value >>> 8 & 255}.${value & 255}`;
 }
-var NON_PUBLIC_V4 = freeze({ kind: "non_public", family: 4 });
-var NON_PUBLIC_V6 = freeze({ kind: "non_public", family: 6 });
-var MALFORMED = freeze({ kind: "malformed" });
+const NON_PUBLIC_V4 = freeze({
+	kind: "non_public",
+	family: 4
+});
+const NON_PUBLIC_V6 = freeze({
+	kind: "non_public",
+	family: 6
+});
+const MALFORMED = freeze({ kind: "malformed" });
+/** @internal Classify a textual IP address (no brackets). The `address` of a public verdict is canonical. */
 function classifyAddress(text) {
-  if (typeof text !== "string" || text.length === 0 || text.length > MAX_TEXT_LENGTH) return MALFORMED;
-  const zone = apply(stringIndexOf, text, ["%"]);
-  if (zone !== -1) return parseIpv6(apply(stringSlice, text, [0, zone])) === void 0 ? MALFORMED : NON_PUBLIC_V6;
-  if (text.length > MAX_ADDRESS_LENGTH) return MALFORMED;
-  const v4 = parseIpv4(text);
-  if (v4 !== void 0) {
-    return isPublicIpv4Value(v4) ? freeze({ kind: "public", address: formatIpv4(v4), family: 4 }) : NON_PUBLIC_V4;
-  }
-  const v6 = parseIpv6(text);
-  if (v6 === void 0) return MALFORMED;
-  return isPublicIpv6Words(v6) ? freeze({ kind: "public", address: formatIpv6(v6), family: 6 }) : NON_PUBLIC_V6;
+	if (typeof text !== "string" || text.length === 0 || text.length > MAX_TEXT_LENGTH) return MALFORMED;
+	const zone = apply(stringIndexOf, text, ["%"]);
+	if (zone !== -1) return parseIpv6(apply(stringSlice$1, text, [0, zone])) === void 0 ? MALFORMED : NON_PUBLIC_V6;
+	if (text.length > MAX_ADDRESS_LENGTH) return MALFORMED;
+	const v4 = parseIpv4(text);
+	if (v4 !== void 0) return isPublicIpv4Value(v4) ? freeze({
+		kind: "public",
+		address: formatIpv4(v4),
+		family: 4
+	}) : NON_PUBLIC_V4;
+	const v6 = parseIpv6(text);
+	if (v6 === void 0) return MALFORMED;
+	return isPublicIpv6Words(v6) ? freeze({
+		kind: "public",
+		address: formatIpv6(v6),
+		family: 6
+	}) : NON_PUBLIC_V6;
 }
+/** @internal `true` for a canonical dotted-quad, the form WHATWG URL parsing gives an IPv4 host. */
 function isIpv4Literal(text) {
-  return matches(IPV4_DOTTED, text);
-}
-var CONFIG_MESSAGES = freeze({
-  limit_not_positive_finite: "Webhook delivery limit must be a positive, finite number.",
-  limit_not_integer: "Webhook delivery limit must be a whole number.",
-  limit_out_of_range: "Webhook delivery limit is outside its allowed range.",
-  retry_schedule_empty: "Webhook delivery retry schedule must list at least one delay.",
-  limit_unreadable: "Webhook delivery limits could not be read."
+	return matches(IPV4_DOTTED, text);
+}
+freeze({
+	invalid_envelope: "Webhook projection failed: a required envelope or job field is missing or invalid.",
+	payload_field_not_json: "Webhook projection failed: an allowlisted payload field is not plain JSON.",
+	fact_field_not_json: "Webhook projection failed: a declared fact field is not plain JSON.",
+	accessor_property: "Webhook projection failed: accessor properties are not read.",
+	inspection_failed: "Webhook projection failed: an input could not be inspected.",
+	scope_mismatch: "Webhook projection failed: the subscription's scope does not match the event's tenant and space."
+});
+const CONFIG_MESSAGES = freeze({
+	limit_not_positive_finite: "Webhook delivery limit must be a positive, finite number.",
+	limit_not_integer: "Webhook delivery limit must be a whole number.",
+	limit_out_of_range: "Webhook delivery limit is outside its allowed range.",
+	retry_schedule_empty: "Webhook delivery retry schedule must list at least one delay.",
+	limit_unreadable: "Webhook delivery limits could not be read."
+});
+const INPUT_MESSAGES = freeze({
+	input_unreadable: "Webhook delivery input could not be read.",
+	observation_unknown: "Webhook delivery observation is not one decision 10 classifies.",
+	status_out_of_range: "Webhook response status must be a whole number from 100 to 599.",
+	signature_malformed: "Webhook signature must be a v1=<64 lowercase hex> value.",
+	timestamp_invalid: "Webhook timestamp must be a non-negative whole number of seconds.",
+	event_id_invalid: "Webhook eventId must be printable ASCII with no control characters or surrounding spaces.",
+	delivery_id_invalid: "Webhook deliveryId must be printable ASCII with no control characters or surrounding spaces.",
+	attempt_invalid: "Webhook attempt must be a positive whole number.",
+	raw_body_not_string: "Webhook raw body must be a string.",
+	random_source_missing: "createWebhookRetryDelay requires a random source.",
+	random_sample_invalid: "Webhook retry random source must return a number in [0, 1).",
+	random_source_failed: "Webhook retry random source failed.",
+	denial_code_unknown: "Webhook admission denial code is not in WEBHOOK_ADMISSION_DENIAL_CODES."
+});
+freeze({
+	input_invalid: "Webhook store input is missing, malformed or not plain data.",
+	record_mismatch: "Webhook store record does not match its parent's event, tenant, space or delivery.",
+	delivery_id_conflict: "Webhook store deliveryId is already used by another subscription and event.",
+	call_aborted: "Webhook store call was aborted before the store acted.",
+	deadline_passed: "Webhook store call deadline passed before the store acted.",
+	clock_invalid: "Webhook store clock failed or returned an invalid time.",
+	store_failed: "Webhook store failed."
 });
-var INPUT_MESSAGES = freeze({
-  input_unreadable: "Webhook delivery input could not be read.",
-  observation_unknown: "Webhook delivery observation is not one decision 10 classifies.",
-  status_out_of_range: "Webhook response status must be a whole number from 100 to 599.",
-  signature_malformed: "Webhook signature must be a v1=<64 lowercase hex> value.",
-  timestamp_invalid: "Webhook timestamp must be a non-negative whole number of seconds.",
-  event_id_invalid: "Webhook eventId must be printable ASCII with no control characters or surrounding spaces.",
-  delivery_id_invalid: "Webhook deliveryId must be printable ASCII with no control characters or surrounding spaces.",
-  attempt_invalid: "Webhook attempt must be a positive whole number.",
-  raw_body_not_string: "Webhook raw body must be a string.",
-  random_source_missing: "createWebhookRetryDelay requires a random source.",
-  random_sample_invalid: "Webhook retry random source must return a number in [0, 1).",
-  random_source_failed: "Webhook retry random source failed.",
-  denial_code_unknown: "Webhook admission denial code is not in WEBHOOK_ADMISSION_DENIAL_CODES."
+freeze({
+	event_past_replay_horizon: "Webhook fan-out refused the event: it is older than the replay horizon, so no fan-out job can be stored.",
+	fan_out_store_failed: "Webhook fan-out store call failed.",
+	fan_out_store_timeout: "Webhook fan-out store call did not settle in time.",
+	publish_aborted: "Webhook fan-out publish was aborted before the job was stored.",
+	sink_failed: "A required sink of the composite event publisher failed.",
+	sink_timeout: "A required sink of the composite event publisher did not settle in time.",
+	clock_invalid: "Webhook fan-out clock failed or returned an invalid time.",
+	options_invalid: "Webhook fan-out options are missing or malformed."
 });
+freeze({
+	delivery_store_failed: "Webhook delivery store call failed.",
+	delivery_store_timeout: "Webhook delivery store call did not settle in time.",
+	clock_invalid: "Webhook delivery clock failed or returned an invalid time.",
+	options_invalid: "Webhook delivery options are missing or malformed."
+});
+freeze({ options_invalid: "Webhook governed-action module options are missing or malformed." });
 function messageFor(table, code, fallback) {
-  return typeof code === "string" && hasOwn(table, code) ? table[code] : fallback;
+	return typeof code === "string" && hasOwn(table, code) ? table[code] : fallback;
 }
-var reflectDefineProperty2 = Reflect.defineProperty;
-var objectCreate2 = Object.create;
+const reflectDefineProperty = Reflect.defineProperty;
+const objectCreate = Object.create;
+/**
+* An own, enumerable, writable data property, defined with a null-prototype
+* descriptor so neither `Error.prototype` nor `Object.prototype` is consulted.
+* Errors the package throws are frozen afterwards.
+*/
 function defineField(target, key, value) {
-  const descriptor = objectCreate2(null);
-  descriptor.value = value;
-  descriptor.enumerable = true;
-  descriptor.writable = true;
-  descriptor.configurable = true;
-  reflectDefineProperty2(target, key, descriptor);
+	const descriptor = objectCreate(null);
+	descriptor.value = value;
+	descriptor.enumerable = true;
+	descriptor.writable = true;
+	descriptor.configurable = true;
+	reflectDefineProperty(target, key, descriptor);
 }
+/**
+* A configured limit was not usable: zero, negative, `NaN`, infinite, not an
+* integer where a count is required, outside its documented range, or not
+* readable as plain data. The message is constant for the code; `field`
+* names the limit, for example `deliveryRetryDelaysMs[2]`.
+*/
 var WebhookDeliveryConfigError = class extends Error {
-  constructor(code, field) {
-    super(messageFor(CONFIG_MESSAGES, code, "Webhook delivery limit was rejected."));
-    defineField(this, "name", "WebhookDeliveryConfigError");
-    defineField(this, "code", code);
-    defineField(this, "field", field);
-  }
+	constructor(code, field) {
+		super(messageFor(CONFIG_MESSAGES, code, "Webhook delivery limit was rejected."));
+		defineField(this, "name", "WebhookDeliveryConfigError");
+		defineField(this, "code", code);
+		defineField(this, "field", field);
+	}
 };
-var created = /* @__PURE__ */ new WeakSet();
-var weakSetAdd = WeakSet.prototype.add;
-var weakSetHas = WeakSet.prototype.has;
-var TypeErrorConstructor = TypeError;
+const created = /* @__PURE__ */ new WeakSet();
+const weakSetAdd = WeakSet.prototype.add;
+const weakSetHas = WeakSet.prototype.has;
+const TypeErrorConstructor = TypeError;
+const RangeErrorConstructor = RangeError;
+/**
+* Register a factory-made error and freeze it. Its native `stack` is
+* replaced first with fixed package text: V8 frames name the functions on
+* the call stack, and a caller can name its own function (a Proxy trap, a
+* getter, a callback that calls a package helper) after a secret. Replacing
+* it before anything reads it also means `Error.prepareStackTrace` is never
+* consulted for a package error.
+*/
 function mark(error, name, code) {
-  const stack = objectCreate2(null);
-  stack.value = `${name}: ${code}`;
-  stack.enumerable = false;
-  stack.writable = false;
-  stack.configurable = false;
-  if (!reflectDefineProperty2(error, "stack", stack)) throw new TypeErrorConstructor("Webhook delivery could not seal an error.");
-  apply(weakSetAdd, created, [error]);
-  return freeze(error);
+	const stack = objectCreate(null);
+	stack.value = `${name}: ${code}`;
+	stack.enumerable = false;
+	stack.writable = false;
+	stack.configurable = false;
+	if (!reflectDefineProperty(error, "stack", stack)) throw new TypeErrorConstructor("Webhook delivery could not seal an error.");
+	apply(weakSetAdd, created, [error]);
+	return freeze(error);
 }
+/** `true` only for an error one of this module's factories created. Runs no code of `value`. */
 function isPackageError(value) {
-  return (typeof value === "object" || typeof value === "function") && value !== null && apply(weakSetHas, created, [value]) === true;
+	return (typeof value === "object" || typeof value === "function") && value !== null && apply(weakSetHas, created, [value]) === true;
 }
+/** @internal A package-created, frozen limit error. */
 function configError(code, field) {
-  return mark(new WebhookDeliveryConfigError(code, field), "WebhookDeliveryConfigError", code);
+	return mark(new WebhookDeliveryConfigError(code, field), "WebhookDeliveryConfigError", code);
 }
+/** @internal A package-created, frozen `TypeError` or `RangeError` carrying `code`. */
 function inputError(kind, code) {
-  const message = INPUT_MESSAGES[code];
-  const error = new TypeErrorConstructor(message) ;
-  define(error, "code", code);
-  return mark(error, "TypeError" , code);
+	const message = INPUT_MESSAGES[code];
+	const error = kind === "type" ? new TypeErrorConstructor(message) : new RangeErrorConstructor(message);
+	define(error, "code", code);
+	return mark(error, kind === "type" ? "TypeError" : "RangeError", code);
 }
+/**
+* @internal Run an entry point. A package-created error passes through
+* unchanged; anything else thrown (by a Proxy trap, an injected callback or
+* the engine) is never inspected and is replaced by `replacement()`.
+*/
 function guard(run, replacement) {
-  try {
-    return run();
-  } catch (thrown) {
-    if (isPackageError(thrown)) throw thrown;
-    throw replacement();
-  }
-}
-var WEBHOOK_MAX_TIMER_MS = 2147483647;
+	try {
+		return run();
+	} catch (thrown) {
+		if (isPackageError(thrown)) throw thrown;
+		throw replacement();
+	}
+}
+//#endregion
+//#region src/limits.ts
+const MINUTE = 6e4;
+const HOUR = 60 * MINUTE;
+const DAY = 24 * HOUR;
+/** The largest delay a JavaScript timer accepts without overflowing. */
+const WEBHOOK_MAX_TIMER_MS = 2147483647;
+Object.freeze({
+	maxDeliveryAttempts: 8,
+	deliveryRetryDelaysMs: Object.freeze([
+		MINUTE,
+		5 * MINUTE,
+		15 * MINUTE,
+		HOUR,
+		6 * HOUR,
+		12 * HOUR,
+		24 * HOUR
+	]),
+	deliveryDeadlineMs: 72 * HOUR,
+	maxFanOutAttempts: 24,
+	fanOutRetryDelaysMs: Object.freeze([
+		1e3,
+		5e3,
+		3e4,
+		MINUTE,
+		5 * MINUTE,
+		15 * MINUTE
+	]),
+	fanOutDeadlineMs: 24 * HOUR,
+	attemptTimeoutMs: 15e3,
+	portTimeoutMs: 5e3,
+	retryJitterRatio: .1,
+	maxRetryAfterMs: HOUR,
+	replayHorizonMs: 30 * DAY
+});
+Object.freeze([
+	"maxDeliveryAttempts",
+	"deliveryRetryDelaysMs",
+	"deliveryDeadlineMs",
+	"maxFanOutAttempts",
+	"fanOutRetryDelaysMs",
+	"fanOutDeadlineMs",
+	"attemptTimeoutMs",
+	"portTimeoutMs",
+	"retryJitterRatio",
+	"maxRetryAfterMs",
+	"replayHorizonMs"
+]);
+/** @internal `value` must come from a snapshot (a primitive). */
 function assertPositiveFinite(value, field) {
-  if (typeof value !== "number" || !numberIsFinite(value) || value <= 0) {
-    throw configError("limit_not_positive_finite", field);
-  }
+	if (typeof value !== "number" || !numberIsFinite(value) || value <= 0) throw configError("limit_not_positive_finite", field);
 }
+/** @internal */
 function assertPositiveInteger(value, field) {
-  assertPositiveFinite(value, field);
-  if (!numberIsSafeInteger(value)) {
-    throw configError("limit_not_integer", field);
-  }
+	assertPositiveFinite(value, field);
+	if (!numberIsSafeInteger(value)) throw configError("limit_not_integer", field);
 }
-
-// src/call-bounds.ts
-var reflectGetOwnPropertyDescriptor2 = Reflect.getOwnPropertyDescriptor;
-var abortedGetter = typeof AbortSignal === "function" ? reflectGetOwnPropertyDescriptor2(AbortSignal.prototype, "aborted")?.get : void 0;
-var eventTargetAdd = typeof EventTarget === "function" ? EventTarget.prototype.addEventListener : void 0;
-var eventTargetRemove = typeof EventTarget === "function" ? EventTarget.prototype.removeEventListener : void 0;
-var setTimer = setTimeout;
-var clearTimer = clearTimeout;
-var dateNow = Date.now;
-var mathMax = Math.max;
-var mathMin = Math.min;
-var unreadable = () => inputError("type", "input_unreadable");
-var unreadableFail = () => {
-  throw unreadable();
+//#endregion
+//#region src/call-bounds.ts
+const reflectGetOwnPropertyDescriptor = Reflect.getOwnPropertyDescriptor;
+const abortedGetter = typeof AbortSignal === "function" ? reflectGetOwnPropertyDescriptor(AbortSignal.prototype, "aborted")?.get : void 0;
+const eventTargetAdd = typeof EventTarget === "function" ? EventTarget.prototype.addEventListener : void 0;
+const eventTargetRemove = typeof EventTarget === "function" ? EventTarget.prototype.removeEventListener : void 0;
+const setTimer = setTimeout;
+const clearTimer = clearTimeout;
+const dateNow = Date.now;
+const mathMax = Math.max;
+const mathMin = Math.min;
+const unreadable$2 = () => inputError("type", "input_unreadable");
+const unreadableFail$2 = () => {
+	throw unreadable$2();
 };
+/**
+* @internal Read `{ deadline, signal }` at entry, one descriptor read each.
+* The deadline must be a real `Date` with a finite time and the signal a real
+* `AbortSignal`; anything else throws `input_unreadable`.
+*/
 function readCallBounds(options) {
-  if (options === null || typeof options !== "object") throw unreadable();
-  const deadlineMs = timeOf(readOwn(options, "deadline", "deadline", unreadableFail));
-  if (!(deadlineMs === deadlineMs) || deadlineMs === Infinity || deadlineMs === -Infinity) throw unreadable();
-  const signal = readOwn(options, "signal", "signal", unreadableFail);
-  if (signal === null || typeof signal !== "object") throw unreadable();
-  try {
-    isAborted(signal);
-  } catch {
-    throw unreadable();
-  }
-  return { deadlineMs, signal };
+	if (options === null || typeof options !== "object") throw unreadable$2();
+	const deadlineMs = timeOf(readOwn(options, "deadline", "deadline", unreadableFail$2));
+	if (!(deadlineMs === deadlineMs) || deadlineMs === Infinity || deadlineMs === -Infinity) throw unreadable$2();
+	const signal = readOwn(options, "signal", "signal", unreadableFail$2);
+	if (signal === null || typeof signal !== "object") throw unreadable$2();
+	try {
+		isAborted(signal);
+	} catch {
+		throw unreadable$2();
+	}
+	return {
+		deadlineMs,
+		signal
+	};
 }
+/**
+* @internal Whether a real `AbortSignal` has aborted, read through the
+* intrinsic getter (it throws for anything else and runs none of its code).
+*/
 function isAborted(signal) {
-  if (abortedGetter === void 0) throw unreadable();
-  return apply(abortedGetter, signal, []) === true;
+	if (abortedGetter === void 0) throw unreadable$2();
+	return apply(abortedGetter, signal, []) === true;
 }
+/** @internal Call `listener` once when `signal` aborts; the returned function removes it. */
 function onAbort(signal, listener) {
-  if (eventTargetAdd === void 0 || eventTargetRemove === void 0) throw unreadable();
-  apply(eventTargetAdd, signal, ["abort", listener, { once: true }]);
-  return () => {
-    apply(eventTargetRemove, signal, ["abort", listener]);
-  };
+	if (eventTargetAdd === void 0 || eventTargetRemove === void 0) throw unreadable$2();
+	apply(eventTargetAdd, signal, [
+		"abort",
+		listener,
+		{ once: true }
+	]);
+	return () => {
+		apply(eventTargetRemove, signal, ["abort", listener]);
+	};
 }
+/** @internal Capture an optional {@link WebhookClock}; a non-object or a missing `now` throws `input_unreadable`. */
 function captureOptionalClock(clock) {
-  if (clock === void 0) return { target: void 0, now: void 0 };
-  if (clock === null || typeof clock !== "object") throw unreadable();
-  const now = clock.now;
-  if (typeof now !== "function") throw unreadable();
-  return { target: clock, now };
+	if (clock === void 0) return {
+		target: void 0,
+		now: void 0
+	};
+	if (clock === null || typeof clock !== "object") throw unreadable$2();
+	const now = clock.now;
+	if (typeof now !== "function") throw unreadable$2();
+	return {
+		target: clock,
+		now
+	};
 }
+/** @internal Epoch milliseconds from the clock, or `NaN` when it throws or returns no valid `Date`. Never throws. */
 function clockNowMs(clock) {
-  if (clock.now === void 0) return dateNow();
-  try {
-    const ms = timeOf(apply(clock.now, clock.target, []));
-    return ms === Infinity || ms === -Infinity ? NaN : ms;
-  } catch {
-    return NaN;
-  }
+	if (clock.now === void 0) return dateNow();
+	try {
+		const ms = timeOf(apply(clock.now, clock.target, []));
+		return ms === Infinity || ms === -Infinity ? NaN : ms;
+	} catch {
+		return NaN;
+	}
 }
+/**
+* @internal Run `fire` after `ms`, clamped to `[0, WEBHOOK_MAX_TIMER_MS]` so a
+* far deadline cannot overflow into an immediate timer. Returns a cancel
+* function.
+*/
 function startTimer(ms, fire) {
-  const handle = setTimer(fire, mathMax(0, mathMin(ms, WEBHOOK_MAX_TIMER_MS)));
-  return () => {
-    clearTimer(handle);
-  };
+	const handle = setTimer(fire, mathMax(0, mathMin(ms, WEBHOOK_MAX_TIMER_MS)));
+	return () => {
+		clearTimer(handle);
+	};
 }
-
-// src/destination.ts
-var WEBHOOK_DESTINATION_MAX_URL_LENGTH = 2048;
-var URLConstructor = URL;
-var urlGetter = (name) => {
-  const getter = Reflect.getOwnPropertyDescriptor(URL.prototype, name)?.get;
-  if (getter === void 0) throw new TypeError(`URL.prototype.${name} is not an accessor.`);
-  return getter;
+const URLConstructor = URL;
+const urlGetter = (name) => {
+	const getter = Reflect.getOwnPropertyDescriptor(URL.prototype, name)?.get;
+	if (getter === void 0) throw new TypeError(`URL.prototype.${name} is not an accessor.`);
+	return getter;
 };
-var urlProtocol = urlGetter("protocol");
-var urlUsername = urlGetter("username");
-var urlPassword = urlGetter("password");
-var urlPort = urlGetter("port");
-var urlHostname = urlGetter("hostname");
-var urlPathname = urlGetter("pathname");
-var urlSearch = urlGetter("search");
-var stringSlice2 = String.prototype.slice;
-var stringEndsWith = String.prototype.endsWith;
+const urlProtocol = urlGetter("protocol");
+const urlUsername = urlGetter("username");
+const urlPassword = urlGetter("password");
+const urlPort = urlGetter("port");
+const urlHostname = urlGetter("hostname");
+const urlPathname = urlGetter("pathname");
+const urlSearch = urlGetter("search");
+const stringSlice = String.prototype.slice;
+const stringEndsWith = String.prototype.endsWith;
+Promise.prototype.then;
+AbortController.prototype.abort;
 Reflect.getOwnPropertyDescriptor(AbortController.prototype, "signal").get;
-var URL_TEXT = /^[^\x00-\x20\x7f]+$/;
-var URL_PREFIX = /^https:\/\/[^/\\?#@]/i;
-var INVALID_URL = freeze({ ok: false, code: "invalid_url" });
-var PRIVATE_URL = freeze({ ok: false, code: "private_address" });
+/** No ASCII control character or space anywhere: WHATWG parsing would strip or drop them silently. */
+const URL_TEXT = /^[^\x00-\x20\x7f]+$/;
+/**
+* `https://` then a host character. WHATWG parsing also accepts
+* `https:host`, `https:///host` and backslashes for a special scheme and
+* finds a host in them; requiring the plain form keeps the host an operator
+* sees in the URL the one that is checked.
+*/
+const URL_PREFIX = /^https:\/\/[^/\\?#@]/i;
+const INVALID_URL$1 = freeze({
+	ok: false,
+	code: "invalid_url"
+});
+const PRIVATE_URL = freeze({
+	ok: false,
+	code: "private_address"
+});
+/**
+* @internal {@link checkWebhookDestinationUrl}, optionally accepting a
+* non-public host (an IP literal or a `localhost` name) while every other
+* rule still applies. `true` is passed only when the Node transport was built
+* by the internal test factory with its public-address re-check off.
+*/
 function checkDestinationUrl(url, allowNonPublic) {
-  try {
-    return checkUrl(primitive(url), allowNonPublic);
-  } catch {
-    return INVALID_URL;
-  }
+	try {
+		return checkUrl(primitive(url), allowNonPublic);
+	} catch {
+		return INVALID_URL$1;
+	}
 }
 function checkUrl(text, allowNonPublic) {
-  if (typeof text !== "string" || text.length === 0 || text.length > WEBHOOK_DESTINATION_MAX_URL_LENGTH) return INVALID_URL;
-  if (!matches(URL_TEXT, text) || !matches(URL_PREFIX, text)) return INVALID_URL;
-  let parsed;
-  try {
-    parsed = new URLConstructor(text);
-  } catch {
-    return INVALID_URL;
-  }
-  if (apply(urlProtocol, parsed, []) !== "https:") return INVALID_URL;
-  if (apply(urlUsername, parsed, []) !== "" || apply(urlPassword, parsed, []) !== "") return INVALID_URL;
-  if (apply(urlPort, parsed, []) !== "") return INVALID_URL;
-  const host = apply(urlHostname, parsed, []);
-  if (host === "" || apply(stringEndsWith, host, ["."])) return INVALID_URL;
-  const url = `https://${host}${apply(urlPathname, parsed, [])}${apply(urlSearch, parsed, [])}`;
-  const v6 = host[0] === "[";
-  if (v6 || isIpv4Literal(host)) {
-    const text2 = v6 ? apply(stringSlice2, host, [1, -1]) : host;
-    const literal = classifyAddress(text2);
-    if (literal.kind === "malformed") return INVALID_URL;
-    if (literal.kind === "non_public" && !allowNonPublic) return PRIVATE_URL;
-    const family = v6 ? 6 : 4;
-    return record({ ok: true, url, hostname: text2, literal: record({ address: text2, family }) });
-  }
-  if (!allowNonPublic && (host === "localhost" || apply(stringEndsWith, host, [".localhost"]))) return PRIVATE_URL;
-  return record({ ok: true, url, hostname: host });
+	if (typeof text !== "string" || text.length === 0 || text.length > 2048) return INVALID_URL$1;
+	if (!matches(URL_TEXT, text) || !matches(URL_PREFIX, text)) return INVALID_URL$1;
+	let parsed;
+	try {
+		parsed = new URLConstructor(text);
+	} catch {
+		return INVALID_URL$1;
+	}
+	if (apply(urlProtocol, parsed, []) !== "https:") return INVALID_URL$1;
+	if (apply(urlUsername, parsed, []) !== "" || apply(urlPassword, parsed, []) !== "") return INVALID_URL$1;
+	if (apply(urlPort, parsed, []) !== "") return INVALID_URL$1;
+	const host = apply(urlHostname, parsed, []);
+	if (host === "" || apply(stringEndsWith, host, ["."])) return INVALID_URL$1;
+	const url = `https://${host}${apply(urlPathname, parsed, [])}${apply(urlSearch, parsed, [])}`;
+	const v6 = host[0] === "[";
+	if (v6 || isIpv4Literal(host)) {
+		const text = v6 ? apply(stringSlice, host, [1, -1]) : host;
+		const literal = classifyAddress(text);
+		if (literal.kind === "malformed") return INVALID_URL$1;
+		if (literal.kind === "non_public" && !allowNonPublic) return PRIVATE_URL;
+		return record({
+			ok: true,
+			url,
+			hostname: text,
+			literal: record({
+				address: text,
+				family: v6 ? 6 : 4
+			})
+		});
+	}
+	if (!allowNonPublic && (host === "localhost" || apply(stringEndsWith, host, [".localhost"]))) return PRIVATE_URL;
+	return record({
+		ok: true,
+		url,
+		hostname: host
+	});
 }
-
-// src/node/transport.ts
-var DEFAULT_NODE_WEBHOOK_MAX_RESPONSE_BYTES = 65536;
-var DEFAULT_NODE_WEBHOOK_MAX_CONCURRENT_REQUESTS = 16;
-var MAX_CONCURRENT_REQUESTS_LIMIT = 1024;
-var MAX_HEADERS = 64;
-var MAX_RETRY_AFTER_LENGTH = 128;
-var MAX_RESPONSE_HEADER_BYTES = 16384;
-var unreadable2 = () => inputError("type", "input_unreadable");
-var unreadableFail2 = () => {
-  throw unreadable2();
+freeze({
+	ok: false,
+	code: "dns_failure"
+});
+freeze({
+	ok: false,
+	code: "private_address"
+});
+//#endregion
+//#region src/node/transport.ts
+/** The default response body cap: past it the connection is closed (the crossing chunk is already read). */
+const DEFAULT_NODE_WEBHOOK_MAX_RESPONSE_BYTES = 65536;
+/** The default number of requests one transport runs at once; later calls wait in its queue. */
+const DEFAULT_NODE_WEBHOOK_MAX_CONCURRENT_REQUESTS = 16;
+const MAX_CONCURRENT_REQUESTS_LIMIT = 1024;
+const MAX_HEADERS = 64;
+const MAX_RETRY_AFTER_LENGTH = 128;
+const MAX_RESPONSE_HEADER_BYTES = 16384;
+const unreadable$1 = () => inputError("type", "input_unreadable");
+const unreadableFail$1 = () => {
+	throw unreadable$1();
 };
-var PromiseConstructor = Promise;
-var bufferFrom = buffer.Buffer.from;
-var NumberConstructor = Number;
-var HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-var HEADER_VALUE = /^[\t\x20-\x7e]*$/;
-var RESERVED_HEADER = /^(?:host|content-length|connection|transfer-encoding|keep-alive|upgrade|te|expect|proxy-.*)$/i;
-var DECIMAL = /^\d+$/;
-var NOT_SENT_DEADLINE = freeze({ kind: "not_sent", reason: "deadline_expired" });
-var NOT_SENT_ABORTED = freeze({ kind: "not_sent", reason: "aborted" });
-var TIMEOUT = freeze({ kind: "timeout" });
-var NETWORK_ERROR = freeze({ kind: "network_error" });
-var INVALID_URL2 = freeze({ kind: "invalid_url" });
-var PRIVATE_ADDRESS2 = freeze({ kind: "private_address" });
+const PromiseConstructor = Promise;
+const bufferFrom = buffer.Buffer.from;
+const NumberConstructor = Number;
+/** RFC 9110 token characters. */
+const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+/** Visible ASCII, space and tab: no CR, LF, NUL or other control characters. */
+const HEADER_VALUE = /^[\t\x20-\x7e]*$/;
+/** Header names the transport sets itself; a caller's copy is dropped. */
+const RESERVED_HEADER = /^(?:host|content-length|connection|transfer-encoding|keep-alive|upgrade|te|expect|proxy-.*)$/i;
+const DECIMAL = /^\d+$/;
+const NOT_SENT_DEADLINE = freeze({
+	kind: "not_sent",
+	reason: "deadline_expired"
+});
+const NOT_SENT_ABORTED = freeze({
+	kind: "not_sent",
+	reason: "aborted"
+});
+const TIMEOUT = freeze({ kind: "timeout" });
+const NETWORK_ERROR = freeze({ kind: "network_error" });
+const INVALID_URL = freeze({ kind: "invalid_url" });
+const PRIVATE_ADDRESS = freeze({ kind: "private_address" });
+/**
+* The Node `WebhookTransport` (ADR 0018 decision 6, R3, R8).
+*
+* - **Pinned addresses.** It connects only to `destination.addresses`,
+*   through a lookup function that answers with those addresses and nothing
+*   else; it never resolves the hostname. The hostname is kept for SNI (left
+*   out for an IP literal, as RFC 6066 requires), certificate verification and
+*   the `Host` header. Certificate and hostname verification are always on.
+* - **Re-checked destination.** It refuses as `private_address` a destination with no addresses
+*   or any address that is not public, and as `invalid_url` one whose URL
+*   breaks decision 6's rules or whose hostname does not match it. Nothing is
+*   sent.
+* - **No redirects.** A 3xx is returned as a response for the classifier;
+*   `Location` is never followed.
+* - **Bounded response.** Body bytes are counted and discarded as they
+*   arrive. As soon as the count passes `maxResponseBytes`, or a declared
+*   `Content-Length` exceeds it, the connection is closed. The chunk that
+*   crosses the cap has already been read, so the bytes read can exceed the
+*   cap by up to one chunk as the socket delivered it. Only the status and a
+*   `Retry-After` of at most 128 characters are returned; once the status
+*   has arrived, the result is that response whatever happens to the body.
+* - **Deadline and cancellation.** A call whose signal has already aborted,
+*   or whose deadline has passed, returns `not_sent` without connecting. A
+*   call waiting in the queue that is aborted, or whose deadline passes, is
+*   removed and returns `not_sent` without ever starting; the same check runs
+*   again immediately before the connection is opened. Once started, the
+*   request is destroyed at the deadline or on abort and returns `timeout`
+*   (or the response, if its status had arrived).
+*
+* Each request uses its own connection (`agent: false`, `Connection:
+* close`), so no pooled socket opened for an earlier resolution is reused.
+* Transport failures (refused connection, TLS or certificate failure, reset)
+* are `network_error`; nothing is logged.
+*
+* @throws {TypeError} `input_unreadable` at construction for unreadable
+* options or `ca`, and from `send` (as a rejected promise) when the request
+* or `{ deadline, signal }` cannot be read: no destination record, a
+* non-string body, a header name or value that is not header-safe, more than
+* 64 headers, or a deadline and signal that are not a real `Date` and
+* `AbortSignal`.
+* @throws {WebhookDeliveryConfigError} when `maxResponseBytes` or
+* `maxConcurrentRequests` (at most 1024) is not a positive whole number.
+*/
 function createNodeWebhookTransport(options = {}) {
-  return buildTransport(guard(() => readTransportOptions(options, PRODUCTION_SWITCHES), unreadable2));
+	return buildTransport(guard(() => readTransportOptions(options, PRODUCTION_SWITCHES), unreadable$1));
 }
-var PRODUCTION_SWITCHES = freeze({ allowNonPublicAddresses: false, port: 443 });
+/** What the public constructor always uses: the public-address re-check on, port 443. */
+const PRODUCTION_SWITCHES = freeze({
+	allowNonPublicAddresses: false,
+	port: 443
+});
+/** @internal Build a transport from validated settings. Not exported from any package entry. */
 function buildTransport(settings) {
-  const slots = { active: 0, pumping: false, head: void 0, tail: void 0 };
-  const transport = {
-    send(request, callOptions) {
-      let bounds;
-      let prepared;
-      try {
-        bounds = readCallBounds(callOptions);
-        prepared = prepareRequest(request, settings);
-      } catch {
-        return PromiseConstructor.reject(unreadable2());
-      }
-      if ("kind" in prepared) return PromiseConstructor.resolve(prepared);
-      const refused = notWanted(bounds, settings.clock);
-      if (refused !== void 0) return PromiseConstructor.resolve(refused);
-      return dispatch(slots, settings, prepared, bounds);
-    }
-  };
-  return freeze(transport);
+	const slots = {
+		active: 0,
+		pumping: false,
+		head: void 0,
+		tail: void 0
+	};
+	return freeze({ send(request, callOptions) {
+		let bounds;
+		let prepared;
+		try {
+			bounds = readCallBounds(callOptions);
+			prepared = prepareRequest(request, settings);
+		} catch {
+			return PromiseConstructor.reject(unreadable$1());
+		}
+		if ("kind" in prepared) return PromiseConstructor.resolve(prepared);
+		const refused = notWanted(bounds, settings.clock);
+		if (refused !== void 0) return PromiseConstructor.resolve(refused);
+		return dispatch(slots, settings, prepared, bounds);
+	} });
 }
+/**
+* @internal Read the public options by name, one descriptor read each; no
+* other key of `options` is read, so a test switch placed on it has no
+* effect. The switches come from the caller as a separate argument.
+*/
 function readTransportOptions(options, switches) {
-  if (!isPlainRecord(options)) throw unreadable2();
-  const rawMax = primitive(readOwn(options, "maxResponseBytes", "maxResponseBytes", unreadableFail2));
-  const maxResponseBytes = rawMax === void 0 ? DEFAULT_NODE_WEBHOOK_MAX_RESPONSE_BYTES : rawMax;
-  assertPositiveInteger(maxResponseBytes, "maxResponseBytes");
-  const rawConcurrency = primitive(readOwn(options, "maxConcurrentRequests", "maxConcurrentRequests", unreadableFail2));
-  const maxConcurrentRequests = rawConcurrency === void 0 ? DEFAULT_NODE_WEBHOOK_MAX_CONCURRENT_REQUESTS : rawConcurrency;
-  assertPositiveInteger(maxConcurrentRequests, "maxConcurrentRequests");
-  if (maxConcurrentRequests > MAX_CONCURRENT_REQUESTS_LIMIT) throw configError("limit_out_of_range", "maxConcurrentRequests");
-  const ca = readCa(readOwn(options, "ca", "ca", unreadableFail2));
-  const clock = captureOptionalClock(readOwn(options, "clock", "clock", unreadableFail2));
-  return freeze({
-    maxResponseBytes,
-    maxConcurrentRequests,
-    ca,
-    clock,
-    allowNonPublic: switches.allowNonPublicAddresses === true,
-    port: switches.port
-  });
+	if (!isPlainRecord(options)) throw unreadable$1();
+	const rawMax = primitive(readOwn(options, "maxResponseBytes", "maxResponseBytes", unreadableFail$1));
+	const maxResponseBytes = rawMax === void 0 ? DEFAULT_NODE_WEBHOOK_MAX_RESPONSE_BYTES : rawMax;
+	assertPositiveInteger(maxResponseBytes, "maxResponseBytes");
+	const rawConcurrency = primitive(readOwn(options, "maxConcurrentRequests", "maxConcurrentRequests", unreadableFail$1));
+	const maxConcurrentRequests = rawConcurrency === void 0 ? 16 : rawConcurrency;
+	assertPositiveInteger(maxConcurrentRequests, "maxConcurrentRequests");
+	if (maxConcurrentRequests > MAX_CONCURRENT_REQUESTS_LIMIT) throw configError("limit_out_of_range", "maxConcurrentRequests");
+	const ca = readCa(readOwn(options, "ca", "ca", unreadableFail$1));
+	const clock = captureOptionalClock(readOwn(options, "clock", "clock", unreadableFail$1));
+	return freeze({
+		maxResponseBytes,
+		maxConcurrentRequests,
+		ca,
+		clock,
+		allowNonPublic: switches.allowNonPublicAddresses === true,
+		port: switches.port
+	});
 }
 function readCa(value) {
-  if (value === void 0) return void 0;
-  if (typeof value === "string") return value === "" ? unreadableFail2() : frozenList([value]);
-  if (!isArray(value)) throw unreadable2();
-  const length = readOwn(value, "length", "ca", unreadableFail2);
-  if (typeof length !== "number" || !numberIsSafeInteger(length) || length < 1 || length > 1024) throw unreadable2();
-  const copy = [];
-  for (let index = 0; index < length; index += 1) {
-    const item = readOwn(value, `${index}`, "ca", unreadableFail2);
-    if (typeof item !== "string" || item === "") throw unreadable2();
-    copy[copy.length] = item;
-  }
-  return frozenList(copy);
+	if (value === void 0) return void 0;
+	if (typeof value === "string") return value === "" ? unreadableFail$1("not_plain", "ca") : frozenList([value]);
+	if (!isArray(value)) throw unreadable$1();
+	const length = readOwn(value, "length", "ca", unreadableFail$1);
+	if (typeof length !== "number" || !numberIsSafeInteger(length) || length < 1 || length > 1024) throw unreadable$1();
+	const copy = [];
+	for (let index = 0; index < length; index += 1) {
+		const item = readOwn(value, `${index}`, "ca", unreadableFail$1);
+		if (typeof item !== "string" || item === "") throw unreadable$1();
+		copy[copy.length] = item;
+	}
+	return frozenList(copy);
 }
+/** Read the request into a snapshot and re-check its destination. A refusal is returned as a result. */
 function prepareRequest(request, settings) {
-  if (!isPlainRecord(request)) throw unreadable2();
-  const destination = readOwn(request, "destination", "destination", unreadableFail2);
-  const method = primitive(readOwn(request, "method", "method", unreadableFail2));
-  const body = primitive(readOwn(request, "body", "body", unreadableFail2));
-  const headers = readOwn(request, "headers", "headers", unreadableFail2);
-  if (!isPlainRecord(destination) || method !== "POST" || typeof body !== "string") throw unreadable2();
-  const outgoing = readHeaders(headers);
-  const url = primitive(readOwn(destination, "url", "destination.url", unreadableFail2));
-  const hostname = primitive(readOwn(destination, "hostname", "destination.hostname", unreadableFail2));
-  const port = primitive(readOwn(destination, "port", "destination.port", unreadableFail2));
-  const rawAddresses = readOwn(destination, "addresses", "destination.addresses", unreadableFail2);
-  const check = checkDestinationUrl(url, settings.allowNonPublic);
-  if (!check.ok) return check.code === "private_address" ? PRIVATE_ADDRESS2 : INVALID_URL2;
-  if (port !== 443 || hostname !== check.hostname) return INVALID_URL2;
-  const addresses = readAddresses(rawAddresses, settings.allowNonPublic);
-  if (addresses === void 0) return PRIVATE_ADDRESS2;
-  if (check.literal !== void 0) {
-    for (let index = 0; index < addresses.length; index += 1) {
-      if (addresses[index].address !== check.literal.address) return INVALID_URL2;
-    }
-  }
-  const hostHeader = check.literal !== void 0 && check.literal.family === 6 ? `[${check.hostname}]` : check.hostname;
-  const path = check.url.slice(`https://${hostHeader}`.length);
-  const encoded = bufferFrom(body, "utf8");
-  outgoing["Host"] = hostHeader;
-  outgoing["Content-Length"] = `${encoded.length}`;
-  outgoing["Connection"] = "close";
-  return freeze({ hostname: check.hostname, path, headers: outgoing, body: encoded, addresses, literal: check.literal !== void 0 });
+	if (!isPlainRecord(request)) throw unreadable$1();
+	const destination = readOwn(request, "destination", "destination", unreadableFail$1);
+	const method = primitive(readOwn(request, "method", "method", unreadableFail$1));
+	const body = primitive(readOwn(request, "body", "body", unreadableFail$1));
+	const headers = readOwn(request, "headers", "headers", unreadableFail$1);
+	if (!isPlainRecord(destination) || method !== "POST" || typeof body !== "string") throw unreadable$1();
+	const outgoing = readHeaders(headers);
+	const url = primitive(readOwn(destination, "url", "destination.url", unreadableFail$1));
+	const hostname = primitive(readOwn(destination, "hostname", "destination.hostname", unreadableFail$1));
+	const port = primitive(readOwn(destination, "port", "destination.port", unreadableFail$1));
+	const rawAddresses = readOwn(destination, "addresses", "destination.addresses", unreadableFail$1);
+	const check = checkDestinationUrl(url, settings.allowNonPublic);
+	if (!check.ok) return check.code === "private_address" ? PRIVATE_ADDRESS : INVALID_URL;
+	if (port !== 443 || hostname !== check.hostname) return INVALID_URL;
+	const addresses = readAddresses(rawAddresses, settings.allowNonPublic);
+	if (addresses === void 0) return PRIVATE_ADDRESS;
+	if (check.literal !== void 0) {
+		for (let index = 0; index < addresses.length; index += 1) if (addresses[index].address !== check.literal.address) return INVALID_URL;
+	}
+	const hostHeader = check.literal !== void 0 && check.literal.family === 6 ? `[${check.hostname}]` : check.hostname;
+	const path = check.url.slice(`https://${hostHeader}`.length);
+	const encoded = bufferFrom(body, "utf8");
+	outgoing["Host"] = hostHeader;
+	outgoing["Content-Length"] = `${encoded.length}`;
+	outgoing["Connection"] = "close";
+	return freeze({
+		hostname: check.hostname,
+		path,
+		headers: outgoing,
+		body: encoded,
+		addresses,
+		literal: check.literal !== void 0
+	});
 }
 function readHeaders(value) {
-  if (!isPlainRecord(value)) throw unreadable2();
-  const out = emptyMap();
-  const keys = Reflect.ownKeys(value);
-  if (keys.length > MAX_HEADERS) throw unreadable2();
-  for (let index = 0; index < keys.length; index += 1) {
-    const name = keys[index];
-    if (typeof name !== "string") throw unreadable2();
-    const headerValue = primitive(readOwn(value, name, "headers", unreadableFail2));
-    if (typeof headerValue !== "string" || !matches(HEADER_NAME, name) || !matches(HEADER_VALUE, headerValue)) throw unreadable2();
-    if (matches(RESERVED_HEADER, name)) continue;
-    out[name] = headerValue;
-  }
-  return out;
+	if (!isPlainRecord(value)) throw unreadable$1();
+	const out = emptyMap();
+	const keys = Reflect.ownKeys(value);
+	if (keys.length > MAX_HEADERS) throw unreadable$1();
+	for (let index = 0; index < keys.length; index += 1) {
+		const name = keys[index];
+		if (typeof name !== "string") throw unreadable$1();
+		const headerValue = primitive(readOwn(value, name, "headers", unreadableFail$1));
+		if (typeof headerValue !== "string" || !matches(HEADER_NAME, name) || !matches(HEADER_VALUE, headerValue)) throw unreadable$1();
+		if (matches(RESERVED_HEADER, name)) continue;
+		out[name] = headerValue;
+	}
+	return out;
 }
+/** The vetted addresses, canonical; `undefined` when there are none or one is not public (unless allowed). */
 function readAddresses(value, allowNonPublic) {
-  if (!isArray(value)) return void 0;
-  const length = readOwn(value, "length", "destination.addresses", unreadableFail2);
-  if (typeof length !== "number" || !numberIsSafeInteger(length) || length < 1 || length > 32) return void 0;
-  const out = [];
-  for (let index = 0; index < length; index += 1) {
-    const entry = readOwn(value, `${index}`, "destination.addresses", unreadableFail2);
-    if (!isPlainRecord(entry)) return void 0;
-    const address = primitive(readOwn(entry, "address", "destination.addresses", unreadableFail2));
-    const family = primitive(readOwn(entry, "family", "destination.addresses", unreadableFail2));
-    const judged = classifyAddress(address);
-    if (judged.kind === "public" && judged.family === family) {
-      out[out.length] = record({ address: judged.address, family: judged.family });
-      continue;
-    }
-    if (allowNonPublic && judged.kind === "non_public" && judged.family === family && typeof address === "string" && !address.includes("%")) {
-      out[out.length] = record({ address, family: judged.family });
-      continue;
-    }
-    return void 0;
-  }
-  return frozenList(out);
+	if (!isArray(value)) return void 0;
+	const length = readOwn(value, "length", "destination.addresses", unreadableFail$1);
+	if (typeof length !== "number" || !numberIsSafeInteger(length) || length < 1 || length > 32) return void 0;
+	const out = [];
+	for (let index = 0; index < length; index += 1) {
+		const entry = readOwn(value, `${index}`, "destination.addresses", unreadableFail$1);
+		if (!isPlainRecord(entry)) return void 0;
+		const address = primitive(readOwn(entry, "address", "destination.addresses", unreadableFail$1));
+		const family = primitive(readOwn(entry, "family", "destination.addresses", unreadableFail$1));
+		const judged = classifyAddress(address);
+		if (judged.kind === "public" && judged.family === family) {
+			out[out.length] = record({
+				address: judged.address,
+				family: judged.family
+			});
+			continue;
+		}
+		if (allowNonPublic && judged.kind === "non_public" && judged.family === family && typeof address === "string" && !address.includes("%")) {
+			out[out.length] = record({
+				address,
+				family: judged.family
+			});
+			continue;
+		}
+		return;
+	}
+	return frozenList(out);
 }
+/** `not_sent` when the call is no longer wanted: aborted, past its deadline, or the clock cannot tell. */
 function notWanted(bounds, clock) {
-  if (isAborted(bounds.signal)) return NOT_SENT_ABORTED;
-  if (!(bounds.deadlineMs > clockNowMs(clock))) return NOT_SENT_DEADLINE;
-  return void 0;
+	if (isAborted(bounds.signal)) return NOT_SENT_ABORTED;
+	if (!(bounds.deadlineMs > clockNowMs(clock))) return NOT_SENT_DEADLINE;
 }
 function dispatch(slots, settings, prepared, bounds) {
-  return new PromiseConstructor((resolve) => {
-    const release = () => {
-      slots.active -= 1;
-      pump(slots, settings);
-    };
-    const begin = () => {
-      perform(settings, prepared, bounds, (result) => {
-        release();
-        resolve(result);
-      });
-    };
-    if (slots.active < settings.maxConcurrentRequests) {
-      slots.active += 1;
-      begin();
-      return;
-    }
-    enqueue(slots, settings, bounds, begin, resolve);
-  });
+	return new PromiseConstructor((resolve) => {
+		const release = () => {
+			slots.active -= 1;
+			pump(slots, settings);
+		};
+		const begin = () => {
+			perform(settings, prepared, bounds, (result) => {
+				release();
+				resolve(result);
+			});
+		};
+		if (slots.active < settings.maxConcurrentRequests) {
+			slots.active += 1;
+			begin();
+			return;
+		}
+		enqueue(slots, settings, bounds, begin, resolve);
+	});
 }
 function enqueue(slots, settings, bounds, begin, resolve) {
-  let cancelTimer = () => {
-  };
-  let removeAbort = () => {
-  };
-  const call = {
-    start: () => {
-      cancelTimer();
-      removeAbort();
-      begin();
-    },
-    next: void 0,
-    prev: void 0
-  };
-  const drop = (result) => {
-    unlink(slots, call);
-    cancelTimer();
-    removeAbort();
-    resolve(result);
-  };
-  if (slots.tail === void 0) {
-    slots.head = call;
-    slots.tail = call;
-  } else {
-    call.prev = slots.tail;
-    slots.tail.next = call;
-    slots.tail = call;
-  }
-  cancelTimer = startTimer(bounds.deadlineMs - clockNowMs(settings.clock), () => drop(NOT_SENT_DEADLINE));
-  removeAbort = onAbort(bounds.signal, () => drop(NOT_SENT_ABORTED));
+	let cancelTimer = () => {};
+	let removeAbort = () => {};
+	const call = {
+		start: () => {
+			cancelTimer();
+			removeAbort();
+			begin();
+		},
+		next: void 0,
+		prev: void 0
+	};
+	const drop = (result) => {
+		unlink(slots, call);
+		cancelTimer();
+		removeAbort();
+		resolve(result);
+	};
+	if (slots.tail === void 0) {
+		slots.head = call;
+		slots.tail = call;
+	} else {
+		call.prev = slots.tail;
+		slots.tail.next = call;
+		slots.tail = call;
+	}
+	cancelTimer = startTimer(bounds.deadlineMs - clockNowMs(settings.clock), () => drop(NOT_SENT_DEADLINE));
+	removeAbort = onAbort(bounds.signal, () => drop(NOT_SENT_ABORTED));
 }
 function unlink(slots, call) {
-  if (call.prev !== void 0) call.prev.next = call.next;
-  else if (slots.head === call) slots.head = call.next;
-  if (call.next !== void 0) call.next.prev = call.prev;
-  else if (slots.tail === call) slots.tail = call.prev;
-  call.next = void 0;
-  call.prev = void 0;
+	if (call.prev !== void 0) call.prev.next = call.next;
+	else if (slots.head === call) slots.head = call.next;
+	if (call.next !== void 0) call.next.prev = call.prev;
+	else if (slots.tail === call) slots.tail = call.prev;
+	call.next = void 0;
+	call.prev = void 0;
 }
+/**
+* Start queued calls, oldest first, while slots are free. A started call
+* that fails its last check settles synchronously and releases its slot,
+* which calls `pump` again; the `pumping` flag turns that re-entry into
+* another turn of this loop, so draining any backlog uses constant stack
+* depth.
+*/
 function pump(slots, settings) {
-  if (slots.pumping) return;
-  slots.pumping = true;
-  try {
-    while (slots.head !== void 0 && slots.active < settings.maxConcurrentRequests) {
-      const call = slots.head;
-      unlink(slots, call);
-      slots.active += 1;
-      call.start();
-    }
-  } finally {
-    slots.pumping = false;
-  }
+	if (slots.pumping) return;
+	slots.pumping = true;
+	try {
+		while (slots.head !== void 0 && slots.active < settings.maxConcurrentRequests) {
+			const call = slots.head;
+			unlink(slots, call);
+			slots.active += 1;
+			call.start();
+		}
+	} finally {
+		slots.pumping = false;
+	}
 }
+/**
+* The lookup Node's socket uses: it answers with the vetted addresses for
+* the vetted name and refuses any other name. Node connects synchronously
+* from inside this callback, so a throw there (an address it cannot use)
+* would escape as an uncaught exception; it is caught and reported through
+* `onFault` instead.
+*/
 function pinnedLookup(hostname, addresses, onFault) {
-  return (host, options, callback) => {
-    try {
-      if (host !== hostname) {
-        const error = new Error("Webhook transport refused a lookup for a name other than the vetted one.");
-        error.code = "ENOTFOUND";
-        callback(error, "", 4);
-        return;
-      }
-      if (options.all === true) {
-        const all = [];
-        for (let index = 0; index < addresses.length; index += 1) all[all.length] = { address: addresses[index].address, family: addresses[index].family };
-        callback(null, all);
-        return;
-      }
-      callback(null, addresses[0].address, addresses[0].family);
-    } catch {
-      onFault();
-    }
-  };
+	return (host, options, callback) => {
+		try {
+			if (host !== hostname) {
+				const error = /* @__PURE__ */ new Error("Webhook transport refused a lookup for a name other than the vetted one.");
+				error.code = "ENOTFOUND";
+				callback(error, "", 4);
+				return;
+			}
+			if (options.all === true) {
+				const all = [];
+				for (let index = 0; index < addresses.length; index += 1) all[all.length] = {
+					address: addresses[index].address,
+					family: addresses[index].family
+				};
+				callback(null, all);
+				return;
+			}
+			callback(null, addresses[0].address, addresses[0].family);
+		} catch {
+			onFault();
+		}
+	};
 }
 function perform(settings, prepared, bounds, done) {
-  let settled = false;
-  let status;
-  let retryAfter = null;
-  let request;
-  let response;
-  let cancelTimer = () => {
-  };
-  let removeAbort = () => {
-  };
-  const responseResult = () => record({ kind: "response", status, retryAfter });
-  const finish = (result) => {
-    if (settled) return;
-    settled = true;
-    cancelTimer();
-    removeAbort();
-    response?.destroy();
-    request?.destroy();
-    done(result);
-  };
-  const stop = () => finish(status === void 0 ? TIMEOUT : responseResult());
-  if (isAborted(bounds.signal)) {
-    finish(NOT_SENT_ABORTED);
-    return;
-  }
-  const remaining = bounds.deadlineMs - clockNowMs(settings.clock);
-  if (!(remaining > 0)) {
-    finish(NOT_SENT_DEADLINE);
-    return;
-  }
-  cancelTimer = startTimer(remaining, stop);
-  removeAbort = onAbort(bounds.signal, stop);
-  try {
-    request = https.request({
-      host: prepared.hostname,
-      port: settings.port,
-      method: "POST",
-      path: prepared.path,
-      headers: prepared.headers,
-      setHost: false,
-      agent: false,
-      lookup: pinnedLookup(prepared.hostname, prepared.addresses, () => finish(status === void 0 ? NETWORK_ERROR : responseResult())),
-      // RFC 6066 forbids an IP address as SNI; the certificate is then checked against the IP.
-      servername: prepared.literal ? "" : prepared.hostname,
-      rejectUnauthorized: true,
-      minVersion: "TLSv1.2",
-      maxHeaderSize: MAX_RESPONSE_HEADER_BYTES,
-      ...settings.ca === void 0 ? {} : { ca: settings.ca }
-    });
-  } catch {
-    finish(NETWORK_ERROR);
-    return;
-  }
-  request.on("error", () => finish(status === void 0 ? NETWORK_ERROR : responseResult()));
-  request.on("response", (incoming) => {
-    response = incoming;
-    incoming.on("error", () => finish(responseResult()));
-    const code = incoming.statusCode;
-    if (typeof code !== "number" || !numberIsSafeInteger(code) || code < 100 || code > 599) {
-      finish(NETWORK_ERROR);
-      return;
-    }
-    status = code;
-    const header = incoming.headers["retry-after"];
-    retryAfter = typeof header === "string" && header.length <= MAX_RETRY_AFTER_LENGTH ? header : null;
-    const declared = incoming.headers["content-length"];
-    if (typeof declared === "string" && matches(DECIMAL, declared) && NumberConstructor(declared) > settings.maxResponseBytes) {
-      finish(responseResult());
-      return;
-    }
-    let received = 0;
-    incoming.on("data", (chunk) => {
-      received += chunk.length;
-      if (received > settings.maxResponseBytes) finish(responseResult());
-    });
-    incoming.on("end", () => finish(responseResult()));
-    incoming.on("close", () => finish(responseResult()));
-  });
-  if (settled) return;
-  request.end(prepared.body);
-}
-var DEFAULT_NODE_WEBHOOK_DNS_TIMEOUT_MS = 5e3;
-var unreadable3 = () => inputError("type", "input_unreadable");
-var unreadableFail3 = () => {
-  throw unreadable3();
+	let settled = false;
+	let status;
+	let retryAfter = null;
+	let request;
+	let response;
+	let cancelTimer = () => {};
+	let removeAbort = () => {};
+	const responseResult = () => record({
+		kind: "response",
+		status,
+		retryAfter
+	});
+	const finish = (result) => {
+		if (settled) return;
+		settled = true;
+		cancelTimer();
+		removeAbort();
+		response?.destroy();
+		request?.destroy();
+		done(result);
+	};
+	const stop = () => finish(status === void 0 ? TIMEOUT : responseResult());
+	if (isAborted(bounds.signal)) {
+		finish(NOT_SENT_ABORTED);
+		return;
+	}
+	const remaining = bounds.deadlineMs - clockNowMs(settings.clock);
+	if (!(remaining > 0)) {
+		finish(NOT_SENT_DEADLINE);
+		return;
+	}
+	cancelTimer = startTimer(remaining, stop);
+	removeAbort = onAbort(bounds.signal, stop);
+	try {
+		request = (0, https.request)({
+			host: prepared.hostname,
+			port: settings.port,
+			method: "POST",
+			path: prepared.path,
+			headers: prepared.headers,
+			setHost: false,
+			agent: false,
+			lookup: pinnedLookup(prepared.hostname, prepared.addresses, () => finish(status === void 0 ? NETWORK_ERROR : responseResult())),
+			servername: prepared.literal ? "" : prepared.hostname,
+			rejectUnauthorized: true,
+			minVersion: "TLSv1.2",
+			maxHeaderSize: MAX_RESPONSE_HEADER_BYTES,
+			...settings.ca === void 0 ? {} : { ca: settings.ca }
+		});
+	} catch {
+		finish(NETWORK_ERROR);
+		return;
+	}
+	request.on("error", () => finish(status === void 0 ? NETWORK_ERROR : responseResult()));
+	request.on("response", (incoming) => {
+		response = incoming;
+		incoming.on("error", () => finish(responseResult()));
+		const code = incoming.statusCode;
+		if (typeof code !== "number" || !numberIsSafeInteger(code) || code < 100 || code > 599) {
+			finish(NETWORK_ERROR);
+			return;
+		}
+		status = code;
+		const header = incoming.headers["retry-after"];
+		retryAfter = typeof header === "string" && header.length <= MAX_RETRY_AFTER_LENGTH ? header : null;
+		const declared = incoming.headers["content-length"];
+		if (typeof declared === "string" && matches(DECIMAL, declared) && NumberConstructor(declared) > settings.maxResponseBytes) {
+			finish(responseResult());
+			return;
+		}
+		let received = 0;
+		incoming.on("data", (chunk) => {
+			received += chunk.length;
+			if (received > settings.maxResponseBytes) finish(responseResult());
+		});
+		incoming.on("end", () => finish(responseResult()));
+		incoming.on("close", () => finish(responseResult()));
+	});
+	if (settled) return;
+	request.end(prepared.body);
+}
+//#endregion
+//#region src/node/lookup.ts
+/** The default per-query timeout of {@link createNodeWebhookDnsLookup}. */
+const DEFAULT_NODE_WEBHOOK_DNS_TIMEOUT_MS = 5e3;
+const unreadable = () => inputError("type", "input_unreadable");
+const unreadableFail = () => {
+	throw unreadable();
 };
+/**
+* "The name exists but has no records of this type": an empty half of the
+* answer, not a failure. "No such name" (`ENOTFOUND`) is a failure: the two
+* queries disagreeing about whether the name exists is a partial answer.
+*/
 function isNoRecords(error) {
-  return error?.code === "ENODATA";
+	return error?.code === "ENODATA";
 }
+/**
+* A {@link WebhookDnsLookup} for `createWebhookDestinationResolver()` built on
+* a fresh `node:dns` `Resolver` per call, asking for A and AAAA records
+* together. It uses c-ares rather than `dns.lookup()` because a c-ares query
+* can be cancelled: when the resolver aborts the call's signal, the queries
+* are cancelled instead of holding a libuv thread-pool thread until the
+* operating system gives up, so a slow authoritative server named in a
+* destination cannot starve the pool. It therefore does not consult
+* `/etc/hosts`.
+*
+* The answer is every A and AAAA address. A query that fails for any reason
+* other than "no records of this type" (`ENODATA`), "no such name"
+* (`ENOTFOUND`) included, rejects the whole lookup, so a half-answered name
+* is a `dns_failure` behind the resolver, never a partial pass.
+*
+* @throws {TypeError} `input_unreadable` when `servers` is not a list of
+* server strings `Resolver.setServers` accepts.
+* @throws {WebhookDeliveryConfigError} when `timeoutMs` is not a positive
+* whole number of at most `WEBHOOK_MAX_TIMER_MS`.
+*/
 function createNodeWebhookDnsLookup(options = {}) {
-  const settings = guard(() => readLookupOptions(options), unreadable3);
-  const lookup = async (hostname, callOptions) => {
-    const signal = callOptions.signal;
-    if (isAborted(signal)) throw unreadable3();
-    const resolver = new promises.Resolver({ timeout: settings.timeoutMs, tries: 1 });
-    if (settings.servers !== void 0) resolver.setServers(settings.servers);
-    const removeAbort = onAbort(signal, () => resolver.cancel());
-    try {
-      const [v4, v6] = await Promise.all([records(resolver.resolve4(hostname)), records(resolver.resolve6(hostname))]);
-      const answer = [];
-      for (const address of v4) answer[answer.length] = record({ address, family: 4 });
-      for (const address of v6) answer[answer.length] = record({ address, family: 6 });
-      return frozenList(answer);
-    } finally {
-      removeAbort();
-      resolver.cancel();
-    }
-  };
-  return lookup;
+	const settings = guard(() => readLookupOptions(options), unreadable);
+	const lookup = async (hostname, callOptions) => {
+		const signal = callOptions.signal;
+		if (isAborted(signal)) throw unreadable();
+		const resolver = new dns_promises.Resolver({
+			timeout: settings.timeoutMs,
+			tries: 1
+		});
+		if (settings.servers !== void 0) resolver.setServers(settings.servers);
+		const removeAbort = onAbort(signal, () => resolver.cancel());
+		try {
+			const [v4, v6] = await Promise.all([records(resolver.resolve4(hostname)), records(resolver.resolve6(hostname))]);
+			const answer = [];
+			for (const address of v4) answer[answer.length] = record({
+				address,
+				family: 4
+			});
+			for (const address of v6) answer[answer.length] = record({
+				address,
+				family: 6
+			});
+			return frozenList(answer);
+		} finally {
+			removeAbort();
+			resolver.cancel();
+		}
+	};
+	return lookup;
 }
 async function records(query) {
-  try {
-    return await query;
-  } catch (error) {
-    if (isNoRecords(error)) return [];
-    throw error;
-  }
+	try {
+		return await query;
+	} catch (error) {
+		if (isNoRecords(error)) return [];
+		throw error;
+	}
 }
 function readLookupOptions(options) {
-  if (!isPlainRecord(options)) throw unreadable3();
-  const rawTimeout = primitive(readOwn(options, "timeoutMs", "timeoutMs", unreadableFail3));
-  const timeoutMs = rawTimeout === void 0 ? DEFAULT_NODE_WEBHOOK_DNS_TIMEOUT_MS : rawTimeout;
-  assertPositiveInteger(timeoutMs, "timeoutMs");
-  if (timeoutMs > WEBHOOK_MAX_TIMER_MS) throw configError("limit_out_of_range", "timeoutMs");
-  const rawServers = readOwn(options, "servers", "servers", unreadableFail3);
-  let servers;
-  if (rawServers !== void 0) {
-    if (!isArray(rawServers)) throw unreadable3();
-    const length = readOwn(rawServers, "length", "servers", unreadableFail3);
-    if (typeof length !== "number" || !numberIsSafeInteger(length) || length < 1 || length > 16) throw unreadable3();
-    const copy = [];
-    for (let index = 0; index < length; index += 1) {
-      const item = primitive(readOwn(rawServers, `${index}`, "servers", unreadableFail3));
-      if (typeof item !== "string") throw unreadable3();
-      copy[copy.length] = item;
-    }
-    new promises.Resolver().setServers(copy);
-    servers = frozenList(copy);
-  }
-  return { servers, timeoutMs };
+	if (!isPlainRecord(options)) throw unreadable();
+	const rawTimeout = primitive(readOwn(options, "timeoutMs", "timeoutMs", unreadableFail));
+	const timeoutMs = rawTimeout === void 0 ? DEFAULT_NODE_WEBHOOK_DNS_TIMEOUT_MS : rawTimeout;
+	assertPositiveInteger(timeoutMs, "timeoutMs");
+	if (timeoutMs > 2147483647) throw configError("limit_out_of_range", "timeoutMs");
+	const rawServers = readOwn(options, "servers", "servers", unreadableFail);
+	let servers;
+	if (rawServers !== void 0) {
+		if (!isArray(rawServers)) throw unreadable();
+		const length = readOwn(rawServers, "length", "servers", unreadableFail);
+		if (typeof length !== "number" || !numberIsSafeInteger(length) || length < 1 || length > 16) throw unreadable();
+		const copy = [];
+		for (let index = 0; index < length; index += 1) {
+			const item = primitive(readOwn(rawServers, `${index}`, "servers", unreadableFail));
+			if (typeof item !== "string") throw unreadable();
+			copy[copy.length] = item;
+		}
+		new dns_promises.Resolver().setServers(copy);
+		servers = frozenList(copy);
+	}
+	return {
+		servers,
+		timeoutMs
+	};
 }
-
+//#endregion
 exports.DEFAULT_NODE_WEBHOOK_DNS_TIMEOUT_MS = DEFAULT_NODE_WEBHOOK_DNS_TIMEOUT_MS;
 exports.DEFAULT_NODE_WEBHOOK_MAX_CONCURRENT_REQUESTS = DEFAULT_NODE_WEBHOOK_MAX_CONCURRENT_REQUESTS;
 exports.DEFAULT_NODE_WEBHOOK_MAX_RESPONSE_BYTES = DEFAULT_NODE_WEBHOOK_MAX_RESPONSE_BYTES;
 exports.createNodeWebhookDnsLookup = createNodeWebhookDnsLookup;
 exports.createNodeWebhookTransport = createNodeWebhookTransport;
-//# sourceMappingURL=node.cjs.map
+
 //# sourceMappingURL=node.cjs.map