@hasna/events 0.1.16 → 0.1.18

package/dist/cli/index.js

@@ -3,7 +3,7 @@
 
 // src/cli/index.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { dirname, join as join5 } from "path";
+import { dirname, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
 // src/index.ts
@@ -109,16 +109,114 @@ function channelMatchesEvent(channel, event) {
 // src/storage.ts
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
+import { existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+
+// src/app-home.ts
 import { existsSync } from "fs";
 import { homedir } from "os";
-import { join } from "path";
+import { join, resolve } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+var PATHS_RESOLVER_KIND_ENV = {
+  config: "HASNA_CONFIG_HOME",
+  data: "HASNA_DATA_HOME",
+  state: "HASNA_STATE_HOME",
+  cache: "HASNA_CACHE_HOME"
+};
+var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathsResolverAssertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
+}
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
+    return override;
+  const home = options.home ?? pathsResolverHomedir();
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    switch (kind) {
+      case "config":
+      case "data":
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
+      case "state":
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return pathsResolverJoin(home, ".config", "hasna");
+    case "data":
+      return pathsResolverJoin(home, ".local", "share", "hasna");
+    case "state":
+      return pathsResolverJoin(home, ".local", "state", "hasna");
+    case "cache":
+      return pathsResolverJoin(home, ".cache", "hasna");
+  }
+}
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return pathsResolverResolve("data", options);
+}
 var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR";
 var HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME";
+var EVENTS_STORE_SENTINEL_FILE = "events.json";
+function effectiveHome() {
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir();
+}
+function legacyHomeDir() {
+  return join(effectiveHome(), ".hasna", "events");
+}
+function resolverHome() {
+  return dataDir({ app: "events", home: effectiveHome() || undefined });
+}
+function adoptResolverHome(resolved, env = process.env) {
+  const dataOverride = env.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync(join(resolved, EVENTS_STORE_SENTINEL_FILE));
+}
+function exactEventsHome() {
+  const dir = process.env[HASNA_EVENTS_DIR_ENV];
+  if (dir && dir.trim())
+    return dir.trim();
+  const home = process.env[HASNA_EVENTS_HOME_ENV];
+  if (home && home.trim())
+    return home.trim();
+  return;
+}
+function getEventsHome() {
+  const exact = exactEventsHome();
+  if (exact)
+    return resolve(exact);
+  const resolved = resolverHome();
+  return adoptResolverHome(resolved) ? resolve(resolved) : resolve(legacyHomeDir());
+}
+
+// src/storage.ts
 var LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:";
 var DEFAULT_EVENT_PAGE_LIMIT = 100;
 var MAX_EVENT_PAGE_LIMIT = 1000;
 function getEventsDataDir(override) {
-  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join(homedir(), ".hasna", "events");
+  return override || getEventsHome();
 }
 function getActiveEventsDirEnv() {
   if (process.env[HASNA_EVENTS_DIR_ENV])
@@ -134,12 +232,12 @@ class JsonEventsStore {
   channelsPath;
   eventsPath;
   deliveriesPath;
-  constructor(dataDir = getEventsDataDir()) {
-    this.dataDir = dataDir;
-    this.runtime = localJsonRuntime(dataDir);
-    this.channelsPath = join(dataDir, "channels.json");
-    this.eventsPath = join(dataDir, "events.json");
-    this.deliveriesPath = join(dataDir, "deliveries.json");
+  constructor(dataDir2 = getEventsDataDir()) {
+    this.dataDir = dataDir2;
+    this.runtime = localJsonRuntime(dataDir2);
+    this.channelsPath = join2(dataDir2, "channels.json");
+    this.eventsPath = join2(dataDir2, "events.json");
+    this.deliveriesPath = join2(dataDir2, "deliveries.json");
   }
   async init() {
     await mkdir(this.dataDir, { recursive: true, mode: 448 });
@@ -256,7 +354,7 @@ class JsonEventsStore {
     };
   }
   async ensureArrayFile(path) {
-    if (!existsSync(path)) {
+    if (!existsSync2(path)) {
       await writeFile(path, `[]
 `, { encoding: "utf-8", mode: 384 });
     }
@@ -286,7 +384,7 @@ class JsonEventsStore {
     });
   }
 }
-function localJsonRuntime(dataDir = getEventsDataDir()) {
+function localJsonRuntime(dataDir2 = getEventsDataDir()) {
   return {
     mode: "local-files",
     name: "json-events-store",
@@ -299,7 +397,7 @@ function localJsonRuntime(dataDir = getEventsDataDir()) {
     durable: true,
     idempotency: "best-effort-local",
     replayCursors: true,
-    description: `Local JSON files in ${dataDir}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+    description: `Local JSON files in ${dataDir2}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
   };
 }
 function encodeLocalJsonEventCursor(offset, options = {}) {
@@ -363,8 +461,8 @@ function assertCursorFilter(name, cursorValue, optionValue) {
 function findEventByIdentity(events, identity) {
   return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
 }
-async function getEventsStatus(dataDir) {
-  const store = new JsonEventsStore(dataDir);
+async function getEventsStatus(dataDir2) {
+  const store = new JsonEventsStore(dataDir2);
   await store.init();
   const [channels, events, deliveries] = await Promise.all([
     store.listChannels(),
@@ -406,14 +504,16 @@ async function getEventsStatus(dataDir) {
     }
   };
 }
-function statusFile(dataDir, fileName, records) {
-  const path = join(dataDir, fileName);
-  return { path, exists: existsSync(path), records };
+function statusFile(dataDir2, fileName, records) {
+  const path = join2(dataDir2, fileName);
+  return { path, exists: existsSync2(path), records };
 }
 
 // src/transports.ts
 import { randomUUID } from "crypto";
 import { spawn } from "child_process";
+import { request as nodeHttpRequest } from "http";
+import { request as nodeHttpsRequest } from "https";
 
 // src/signing.ts
 import { createHmac, timingSafeEqual } from "crypto";
@@ -426,6 +526,218 @@ function signPayload(secret, timestamp, body) {
   return `sha256=${digest}`;
 }
 
+// src/ssrf.ts
+import { lookup as dnsLookup } from "dns/promises";
+import { isIP } from "net";
+var DEFAULT_MAX_REDIRECTS = 5;
+var IPV4_PRIVATE_RANGES = [
+  [0, 16777215],
+  [167772160, 184549375],
+  [1681915904, 1686110207],
+  [2130706432, 2147483647],
+  [2851995648, 2852061183],
+  [2886729728, 2887778303],
+  [3221225472, 3221225727],
+  [3221225984, 3221226239],
+  [3227017984, 3227018239],
+  [3232235520, 3232301055],
+  [3323068416, 3323199487],
+  [3325256704, 3325256959],
+  [3405803776, 3405804031],
+  [3758096384, 4294967295]
+];
+var IPV6_SPECIAL_PREFIXES = [
+  { groups: [0, 0, 0, 0, 0, 0, 0, 0], bits: 128 },
+  { groups: [0, 0, 0, 0, 0, 0, 0, 1], bits: 128 },
+  { groups: [0, 0, 0, 0, 0, 65535, 0, 0], bits: 96 },
+  { groups: [100, 65435, 0, 0, 0, 0, 0, 0], bits: 96 },
+  { groups: [256, 0, 0, 0, 0, 0, 0, 0], bits: 64 },
+  { groups: [8193, 0, 0, 0, 0, 0, 0, 0], bits: 32 },
+  { groups: [8193, 2, 0, 0, 0, 0, 0, 0], bits: 48 },
+  { groups: [8193, 16, 0, 0, 0, 0, 0, 0], bits: 28 },
+  { groups: [8193, 3512, 0, 0, 0, 0, 0, 0], bits: 32 },
+  { groups: [8194, 0, 0, 0, 0, 0, 0, 0], bits: 16 },
+  { groups: [16383, 0, 0, 0, 0, 0, 0, 0], bits: 20 },
+  { groups: [64512, 0, 0, 0, 0, 0, 0, 0], bits: 7 },
+  { groups: [65152, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
+  { groups: [65216, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
+  { groups: [65280, 0, 0, 0, 0, 0, 0, 0], bits: 8 }
+];
+function isPrivateAddress(address) {
+  const normalized = stripZoneId(address);
+  const version = isIP(normalized);
+  if (version === 4) {
+    const integer = ipv4ToInt(normalized);
+    if (integer === undefined)
+      return true;
+    return IPV4_PRIVATE_RANGES.some(([low, high]) => integer >= low && integer <= high);
+  }
+  if (version === 6) {
+    const groups = ipv6Groups(normalized);
+    if (!groups)
+      return true;
+    for (const prefix of IPV6_SPECIAL_PREFIXES) {
+      if (!ipv6MatchesPrefix(groups, prefix.groups, prefix.bits))
+        continue;
+      if (prefix.bits === 96 && groups[5] === 65535) {
+        return isPrivateAddress(ipv4IntToString(groups[6] << 16 | groups[7]));
+      }
+      if (prefix.bits === 16 && groups[0] === 8194) {
+        return isPrivateAddress(ipv4IntToString(groups[1] << 16 | groups[2]));
+      }
+      return true;
+    }
+    return false;
+  }
+  return true;
+}
+async function resolveWebhookTarget(url, policy = {}) {
+  const hostname = normalizeHostname(url.hostname);
+  const allowlist = (policy.allowPrivateHosts ?? []).map((entry) => normalizeHostname(entry.toLowerCase()));
+  if (allowlist.includes(hostname)) {
+    const version2 = isIP(hostname);
+    if (version2 === 4 || version2 === 6) {
+      return { hostname, addresses: [hostname] };
+    }
+    const lookup2 = policy.lookup ?? defaultTargetLookup;
+    let resolved2;
+    try {
+      resolved2 = await lookup2(hostname);
+    } catch {
+      throw new Error(`Webhook target ${hostname} could not be resolved`);
+    }
+    if (!Array.isArray(resolved2) || resolved2.length === 0) {
+      throw new Error(`Webhook target ${hostname} resolved to no addresses`);
+    }
+    const addresses = resolved2.map((entry) => normalizeHostname(entry.address));
+    return { hostname, addresses };
+  }
+  const version = isIP(hostname);
+  if (version === 4 || version === 6) {
+    if (isPrivateAddress(hostname)) {
+      throw new Error(`Webhook target ${hostname} is a private or special-use address`);
+    }
+    return { hostname, addresses: [hostname] };
+  }
+  const lookup = policy.lookup ?? defaultTargetLookup;
+  let resolved;
+  try {
+    resolved = await lookup(hostname);
+  } catch {
+    throw new Error(`Webhook target ${hostname} could not be resolved`);
+  }
+  if (!Array.isArray(resolved) || resolved.length === 0) {
+    throw new Error(`Webhook target ${hostname} resolved to no addresses`);
+  }
+  const allowed = [];
+  for (const entry of resolved) {
+    const address = normalizeHostname(entry.address);
+    if (isPrivateAddress(address)) {
+      if (allowlist.includes(address)) {
+        allowed.push(address);
+        continue;
+      }
+      throw new Error(`Webhook target ${hostname} resolves to private or special-use address ${address}`);
+    }
+    allowed.push(address);
+  }
+  if (allowed.length === 0) {
+    throw new Error(`Webhook target ${hostname} resolved to no public addresses`);
+  }
+  return { hostname, addresses: allowed };
+}
+function normalizeMaxRedirects(value) {
+  if (value === undefined)
+    return DEFAULT_MAX_REDIRECTS;
+  if (!Number.isInteger(value) || value < 0)
+    throw new Error("webhookTargetPolicy.maxRedirects must be a non-negative integer");
+  return value;
+}
+var defaultTargetLookup = async (hostname) => {
+  return dnsLookup(hostname, { all: true, verbatim: false });
+};
+function normalizeHostname(hostname) {
+  const lower = hostname.toLowerCase();
+  if (lower.startsWith("[") && lower.endsWith("]"))
+    return lower.slice(1, -1);
+  return lower;
+}
+function stripZoneId(address) {
+  const percent = address.indexOf("%");
+  return percent === -1 ? address : address.slice(0, percent);
+}
+function ipv4ToInt(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4)
+    return;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part))
+      return;
+    const octet = Number(part);
+    if (octet > 255)
+      return;
+    value = value << 8 | octet;
+  }
+  return value >>> 0;
+}
+function ipv4IntToString(integer) {
+  return [
+    integer >>> 24 & 255,
+    integer >>> 16 & 255,
+    integer >>> 8 & 255,
+    integer & 255
+  ].join(".");
+}
+function ipv6Groups(address) {
+  const raw = stripZoneId(address);
+  const doubleColon = raw.indexOf("::");
+  const headText = doubleColon === -1 ? raw : raw.slice(0, doubleColon);
+  const tailText = doubleColon === -1 ? "" : raw.slice(doubleColon + 2);
+  const parseGroups = (text) => {
+    if (text === "")
+      return [];
+    const out = [];
+    for (const part of text.split(":")) {
+      if (part.includes(".")) {
+        const v4 = ipv4ToInt(part);
+        if (v4 === undefined)
+          return;
+        out.push(v4 >>> 16 & 65535, v4 & 65535);
+      } else {
+        if (!/^[0-9a-fA-F]{1,4}$/.test(part))
+          return;
+        out.push(parseInt(part, 16));
+      }
+    }
+    return out;
+  };
+  const head = parseGroups(headText);
+  if (!head)
+    return;
+  const tail = parseGroups(tailText);
+  if (!tail)
+    return;
+  const total = head.length + tail.length;
+  if (doubleColon === -1) {
+    return total === 8 ? head : undefined;
+  }
+  if (total >= 8)
+    return;
+  return [...head, ...new Array(8 - total).fill(0), ...tail];
+}
+function ipv6MatchesPrefix(groups, prefixGroups, prefixBits) {
+  let remaining = prefixBits;
+  for (let index = 0;index < prefixGroups.length && remaining > 0; index += 1) {
+    const take = Math.min(16, remaining);
+    const mask = 65535 << 16 - take & 65535;
+    if ((groups[index] & mask) !== (prefixGroups[index] & mask))
+      return false;
+    remaining -= take;
+  }
+  return true;
+}
+
 // src/transports.ts
 function now() {
   return new Date().toISOString();
@@ -457,9 +769,18 @@ function buildWebhookRequest(event, channel, options = {}) {
   }
   return { body, headers };
 }
+function normalizeWebhookUrl(raw) {
+  const url = new URL(raw);
+  if (url.username !== "" || url.password !== "") {
+    url.username = "";
+    url.password = "";
+  }
+  return url.toString();
+}
 async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
+  const webhookUrl = normalizeWebhookUrl(channel.webhook.url);
   const startedAt = now();
   let secret = channel.webhook.secret;
   if (channel.webhook.secretRef) {
@@ -476,10 +797,14 @@ async function dispatchWebhook(event, channel, options = {}) {
   }
   const timestamp = (options.now?.() ?? new Date).toISOString();
   const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp });
+  const validateTargets = options.webhookTargetPolicy !== undefined || options.fetchImpl === undefined;
+  if (validateTargets) {
+    return dispatchValidatedWebhook(event, channel, { body, headers, startedAt, options });
+  }
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
-    const response = await (options.fetchImpl ?? fetch)(channel.webhook.url, {
+    const response = await (options.fetchImpl ?? fetch)(webhookUrl, {
       method: "POST",
       headers,
       body,
@@ -507,6 +832,130 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
+function isRedirectStatus(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function redirectKeepsBody(status) {
+  return status === 307 || status === 308;
+}
+async function pinnedNativeRequest(target, addresses, method, headers, body, signal, tls) {
+  const isHttps = target.protocol === "https:";
+  if (!isHttps && target.protocol !== "http:") {
+    throw new Error(`Webhook target uses unsupported protocol ${target.protocol}`);
+  }
+  const defaultPort = isHttps ? 443 : 80;
+  const port = target.port ? Number(target.port) : defaultPort;
+  const requestOptions = {
+    hostname: target.hostname,
+    port,
+    path: `${target.pathname}${target.search}`,
+    method,
+    headers,
+    ...tls?.ca ? { ca: tls.ca } : {},
+    lookup: (hostname, _options, callback) => {
+      const entries = addresses.map((address) => ({
+        address,
+        family: address.includes(":") ? 6 : 4
+      }));
+      callback(null, entries);
+    }
+  };
+  return new Promise((resolve2, reject) => {
+    const request = isHttps ? nodeHttpsRequest(requestOptions, onResponse) : nodeHttpRequest(requestOptions, onResponse);
+    const onAbort = () => {
+      const error = new Error("The operation was aborted.");
+      error.name = "AbortError";
+      request.destroy(error);
+    };
+    if (signal.aborted)
+      onAbort();
+    else
+      signal.addEventListener("abort", onAbort, { once: true });
+    request.on("error", reject);
+    if (body !== undefined)
+      request.write(body);
+    request.end();
+    function onResponse(response) {
+      const chunks = [];
+      response.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+      response.on("error", reject);
+      response.on("end", () => {
+        const headersRecord = {};
+        for (const [name, value] of Object.entries(response.headers)) {
+          if (typeof value === "string")
+            headersRecord[name] = value;
+          else if (Array.isArray(value))
+            headersRecord[name] = value.join(", ");
+        }
+        resolve2(new Response(Buffer.concat(chunks), { status: response.statusCode ?? 200, headers: headersRecord }));
+      });
+    }
+  });
+}
+async function dispatchValidatedWebhook(event, channel, input) {
+  const { body, headers, startedAt, options } = input;
+  const webhook = channel.webhook;
+  if (!webhook)
+    throw new Error(`Channel ${channel.id} has no webhook config`);
+  const policy = options.webhookTargetPolicy ?? {};
+  const maxRedirects = normalizeMaxRedirects(policy.maxRedirects);
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), webhook.timeoutMs ?? 15000);
+  try {
+    let target = new URL(normalizeWebhookUrl(webhook.url));
+    let requestHeaders = headers;
+    let method = "POST";
+    let requestBody = body;
+    let redirectsFollowed = 0;
+    for (;; ) {
+      const resolved = await resolveWebhookTarget(target, policy).catch((error) => {
+        throw new Error(`Webhook target rejected by SSRF guard: ${error.message}`);
+      });
+      const response = options.fetchImpl ? await options.fetchImpl(target, {
+        method,
+        headers: requestHeaders,
+        body: requestBody,
+        signal: controller.signal,
+        redirect: "manual"
+      }) : await pinnedNativeRequest(target, resolved.addresses, method, requestHeaders, requestBody, controller.signal, options.tls);
+      const location = response.headers.get("location");
+      if (isRedirectStatus(response.status) && location) {
+        if (redirectsFollowed >= maxRedirects) {
+          return failedAttempt(startedAt, `Webhook target exceeded ${maxRedirects} redirects`);
+        }
+        redirectsFollowed += 1;
+        const next = new URL(location, target);
+        target = next;
+        if (!redirectKeepsBody(response.status)) {
+          method = "GET";
+          requestBody = undefined;
+          requestHeaders = Object.fromEntries(Object.entries(requestHeaders).filter(([name]) => name.toLowerCase() !== "content-type" && name.toLowerCase() !== "content-length"));
+        }
+        continue;
+      }
+      const responseBody = truncate(await response.text());
+      return {
+        attempt: 1,
+        status: response.ok ? "success" : "failed",
+        startedAt,
+        completedAt: now(),
+        responseStatus: response.status,
+        responseBody,
+        error: response.ok ? undefined : `Webhook returned HTTP ${response.status}`
+      };
+    }
+  } catch (error) {
+    return {
+      attempt: 1,
+      status: "failed",
+      startedAt,
+      completedAt: now(),
+      error: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 function failedAttempt(startedAt, error) {
   return {
     attempt: 1,
@@ -535,7 +984,7 @@ async function dispatchCommand(event, channel) {
     HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
     HASNA_EVENT_JSON: eventJson
   };
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const child = spawn(channel.command.command, channel.command.args ?? [], {
       cwd: channel.command.cwd,
       env,
@@ -553,7 +1002,7 @@ async function dispatchCommand(event, channel) {
     });
     child.on("error", (error) => {
       clearTimeout(timeout);
-      resolve({
+      resolve2({
         attempt: 1,
         status: "failed",
         startedAt,
@@ -566,7 +1015,7 @@ async function dispatchCommand(event, channel) {
     child.on("close", (code, signal) => {
       clearTimeout(timeout);
       const success = code === 0;
-      resolve({
+      resolve2({
         attempt: 1,
         status: success ? "success" : "failed",
         startedAt,
@@ -722,7 +1171,9 @@ class EventsClient {
     this.transportOptions = {
       fetchImpl: options.fetchImpl,
       secretResolver: options.secretResolver,
-      now: options.now
+      now: options.now,
+      tls: options.tls,
+      webhookTargetPolicy: options.webhookTargetPolicy
     };
     this.catalog = options.catalog ?? defaultEventTypeCatalog;
     this.validateCatalogTypes = options.validateCatalogTypes ?? false;
@@ -946,15 +1397,17 @@ import { createHash, randomUUID as randomUUID3 } from "crypto";
 import {
   chmodSync,
   closeSync,
-  existsSync as existsSync2,
+  existsSync as existsSync3,
   fsyncSync,
   mkdirSync,
   openSync,
   readdirSync,
   readFileSync,
-  unlinkSync
+  renameSync,
+  unlinkSync,
+  writeFileSync
 } from "fs";
-import { join as join2 } from "path";
+import { basename, join as join3 } from "path";
 var DURABLE_SCHEMA_VERSION = 1;
 var MAX_RETRY_ATTEMPTS = 1000;
 var MAX_RETRY_DELAY_MS = 365 * 24 * 60 * 60 * 1000;
@@ -1097,12 +1550,14 @@ class DurableEventsBroker {
     if (!options.dataDir)
       throw new Error("DurableEventsBroker requires dataDir");
     this.dataDir = options.dataDir;
-    this.databasePath = join2(options.dataDir, options.databaseName ?? "events.sqlite");
+    this.databasePath = join3(options.dataDir, options.databaseName ?? "events.sqlite");
     this.now = options.now ?? (() => new Date);
     this.transportOptions = {
       fetchImpl: options.fetchImpl,
       secretResolver: options.secretResolver ?? defaultWebhookSecretResolver,
-      now: this.now
+      now: this.now,
+      tls: options.tls,
+      webhookTargetPolicy: options.webhookTargetPolicy
     };
     mkdirSync(this.dataDir, { recursive: true, mode: 448 });
     chmodSync(this.dataDir, 448);
@@ -1239,24 +1694,29 @@ class DurableEventsBroker {
     return summary;
   }
   importSpool(options = {}) {
-    const inboxDir = join2(this.dataDir, "spool", "inbox");
-    if (!existsSync2(inboxDir))
-      return { scanned: 0, imported: 0, deduped: 0, queued: 0 };
+    const inboxDir = join3(this.dataDir, "spool", "inbox");
+    if (!existsSync3(inboxDir))
+      return { scanned: 0, imported: 0, deduped: 0, queued: 0, quarantined: 0 };
     const limit = normalizePositiveInteger(options.limit, 100, "limit");
     const names = readdirSync(inboxDir).filter((name) => /^[a-f0-9]{64}\.json$/.test(name)).sort().slice(0, limit);
-    const result = { scanned: names.length, imported: 0, deduped: 0, queued: 0 };
+    const result = { scanned: names.length, imported: 0, deduped: 0, queued: 0, quarantined: 0 };
     for (const name of names) {
-      const path = join2(inboxDir, name);
+      const path = join3(inboxDir, name);
       let event;
       try {
         event = parseSpoolEnvelope(readFileSync(path, "utf8"));
       } catch (error) {
         if (isNodeError(error, "ENOENT"))
           continue;
-        throw error;
+        quarantineSpoolRecord(this.dataDir, path, "malformed");
+        result.quarantined += 1;
+        continue;
+      }
+      if (spoolFileName(event) !== name) {
+        quarantineSpoolRecord(this.dataDir, path, "identity-mismatch");
+        result.quarantined += 1;
+        continue;
       }
-      if (spoolFileName(event) !== name)
-        throw new Error("Durable event spool filename does not match its identity");
       const enqueued = this.enqueue(event);
       if (enqueued.deduped)
         result.deduped += 1;
@@ -1581,7 +2041,7 @@ class DurableEventsBroker {
   }
   secureDatabaseFiles() {
     for (const path of [this.databasePath, `${this.databasePath}-wal`, `${this.databasePath}-shm`]) {
-      if (!existsSync2(path))
+      if (!existsSync3(path))
         continue;
       chmodSync(path, 384);
     }
@@ -1712,6 +2172,26 @@ function syncDirectory(path) {
     closeSync(descriptor);
   }
 }
+function quarantineSpoolRecord(dataDir2, path, reason) {
+  const spoolDir = join3(dataDir2, "spool");
+  const quarantineDir = join3(spoolDir, "quarantine");
+  mkdirSync(quarantineDir, { recursive: true, mode: 448 });
+  chmodSync(spoolDir, 448);
+  chmodSync(quarantineDir, 448);
+  const name = basename(path);
+  const base = name.replace(/\.json$/, "");
+  const suffix = `${Date.now()}-${randomUUID3().slice(0, 8)}`;
+  const destination = join3(quarantineDir, `${base}.${suffix}.json`);
+  renameSync(path, destination);
+  const metadata = {
+    quarantinedAt: new Date().toISOString(),
+    originalName: name,
+    reason
+  };
+  writeFileSync(join3(quarantineDir, `${base}.${suffix}.meta.json`), `${JSON.stringify(metadata, null, 2)}
+`, { mode: 384 });
+  syncDirectory(quarantineDir);
+}
 function isNodeError(error, code) {
   return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
 }
@@ -1723,7 +2203,7 @@ function spoolFileName(event) {
 // src/durable-worker.ts
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, watch } from "fs";
 import { randomUUID as randomUUID5 } from "crypto";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 
 // src/durable-spool.ts
 import { createHash as createHash2, randomUUID as randomUUID4 } from "crypto";
@@ -1737,7 +2217,7 @@ import {
   stat,
   unlink
 } from "fs/promises";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 class DurableEventSpool {
   dataDir;
   inboxDir;
@@ -1745,13 +2225,13 @@ class DurableEventSpool {
     if (!options.dataDir)
       throw new Error("DurableEventSpool requires dataDir");
     this.dataDir = options.dataDir;
-    this.inboxDir = join3(options.dataDir, "spool", "inbox");
+    this.inboxDir = join4(options.dataDir, "spool", "inbox");
   }
   async enqueue(input) {
     const event = redactSensitiveKeys(createSpoolEvent(input));
     await this.ensureInbox();
     const finalPath = this.pathFor(event);
-    const tempPath = join3(this.inboxDir, `.tmp-${process.pid}-${randomUUID4()}`);
+    const tempPath = join4(this.inboxDir, `.tmp-${process.pid}-${randomUUID4()}`);
     const handle = await open(tempPath, "wx", 384);
     try {
       await handle.writeFile(`${JSON.stringify(event)}
@@ -1784,7 +2264,7 @@ class DurableEventSpool {
     const result = { recovered: 0, deduped: 0, cleaned: 0 };
     const names = (await readdir(this.inboxDir)).filter((name) => name.startsWith(".tmp-")).sort();
     for (const name of names) {
-      const tempPath = join3(this.inboxDir, name);
+      const tempPath = join4(this.inboxDir, name);
       const details = await stat(tempPath).catch(() => {
         return;
       });
@@ -1822,7 +2302,7 @@ class DurableEventSpool {
   pathFor(event) {
     const identity = event.dedupeKey ?? event.id;
     const digest = createHash2("sha256").update(identity, "utf8").digest("hex");
-    return join3(this.inboxDir, `${digest}.json`);
+    return join4(this.inboxDir, `${digest}.json`);
   }
   async assertSameIdentity(path, event) {
     const existing = parseEnvelope(await readFile2(path, "utf8"));
@@ -1831,7 +2311,7 @@ class DurableEventSpool {
       throw new Error("Durable spool identity collision");
   }
   async ensureInbox() {
-    const spoolDir = join3(this.dataDir, "spool");
+    const spoolDir = join4(this.dataDir, "spool");
     await mkdir2(this.inboxDir, { recursive: true, mode: 448 });
     await chmod2(this.dataDir, 448);
     await chmod2(spoolDir, 448);
@@ -1899,7 +2379,7 @@ async function runDurableWorker(options) {
   const spool = new DurableEventSpool({ dataDir: options.broker.dataDir });
   const inboxDir = spool.inboxDir;
   mkdirSync2(inboxDir, { recursive: true, mode: 448 });
-  chmodSync2(join4(options.broker.dataDir, "spool"), 448);
+  chmodSync2(join5(options.broker.dataDir, "spool"), 448);
   chmodSync2(inboxDir, 448);
   const totals = {
     workerId,
@@ -1911,7 +2391,7 @@ async function runDurableWorker(options) {
     dead: 0,
     lost: 0
   };
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let watcher;
     let debounceTimer;
     let retryTimer;
@@ -1939,7 +2419,7 @@ async function runDurableWorker(options) {
         clearTimeout(restartTimer);
       options.signal.removeEventListener("abort", stop);
       if (!running)
-        resolve(totals);
+        resolve2(totals);
     };
     const scheduleRetryWake = () => {
       clearRetryTimer();
@@ -1986,7 +2466,7 @@ async function runDurableWorker(options) {
         running = false;
       }
       if (stopped) {
-        resolve(totals);
+        resolve2(totals);
       } else if (rerun) {
         rerun = false;
         queueMicrotask(() => {
@@ -2125,10 +2605,19 @@ function parseMatcherExpression(value, label) {
   };
 }
 
+// src/cli-webhook-policy.ts
+function webhookTargetPolicyFromEnv() {
+  const value = process.env.HASNA_EVENTS_ALLOW_PRIVATE_WEBHOOK_TARGETS;
+  if (!value)
+    return;
+  const hosts = value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+  return hosts.length > 0 ? { allowPrivateHosts: hosts } : undefined;
+}
+
 // src/cli/index.ts
 function version() {
   try {
-    const packagePath = join5(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
+    const packagePath = join6(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
     return JSON.parse(readFileSync2(packagePath, "utf-8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -2267,9 +2756,13 @@ Global options (must precede the command group):
   -v, --version            Show version
 
 Environment:
-  HASNA_EVENTS_DIR          Primary data-directory override
-  HASNA_EVENTS_HOME         Legacy data-directory fallback
-  Default directory         ${getEventsDataDir()}`);
+  HASNA_EVENTS_DIR                               Primary data-directory override
+  HASNA_EVENTS_HOME                              Legacy data-directory fallback
+  HASNA_EVENTS_ALLOW_PRIVATE_WEBHOOK_TARGETS     Admin allowlist for intentional private webhook
+                                                 ingress (comma-separated hostnames or IPs).
+                                                 Webhook targets default-deny private/special-use
+                                                 addresses.
+  Default directory                              ${getEventsDataDir()}`);
 }
 function printChannelsHelp(options = {}) {
   const name = commandName(options);
@@ -2394,7 +2887,10 @@ async function runEventsCli(argv = process.argv.slice(2), options = {}) {
       printDurableHelp(options);
       return;
     }
-    const broker = new DurableEventsBroker({ dataDir: parsed.dir ?? getEventsDataDir() });
+    const broker = new DurableEventsBroker({
+      dataDir: parsed.dir ?? getEventsDataDir(),
+      webhookTargetPolicy: webhookTargetPolicyFromEnv()
+    });
     try {
       await handleDurable(broker, command, tail, parsed);
     } finally {
@@ -2403,7 +2899,7 @@ async function runEventsCli(argv = process.argv.slice(2), options = {}) {
     return;
   }
   const store = new JsonEventsStore(parsed.dir);
-  const client = new EventsClient({ store });
+  const client = new EventsClient({ store, webhookTargetPolicy: webhookTargetPolicyFromEnv() });
   if (group === "channels") {
     if (!command || command === "--help" || command === "-h") {
       printChannelsHelp(options);
@@ -2521,7 +3017,7 @@ async function handleDurable(broker, command, tail, parsed) {
   if (command === "import") {
     const args = [...tail];
     const result = broker.importSpool({ limit: numberOption(takeOption(args, "--limit")) });
-    output(parsed, result, () => console.log(`Imported ${result.imported}, deduped ${result.deduped}, queued ${result.queued}`));
+    output(parsed, result, () => console.log(`Imported ${result.imported}, deduped ${result.deduped}, queued ${result.queued}, quarantined ${result.quarantined}`));
     return;
   }
   if (command === "drain") {
@@ -2664,6 +3160,8 @@ async function handleChannels(client, command, tail, parsed, options) {
       metadata: parseJsonOption(takeOption(args, "--metadata"), {})
     }, { honorFilters });
     output(parsed, result, () => console.log(`${result.status}: ${result.channelId}`));
+    if (result.status === "failed")
+      process.exitCode = 1;
     return;
   }
   if (command === "match") {