@multiplier-labs/stepflow 0.3.1 → 0.3.4

package/src/events/webhook.test.ts

@@ -1,27 +1,25 @@
-import { describe, it, expect, beforeEach, vi, afterEach } from "vitest";
-import * as dns from "node:dns";
-import { WebhookEventTransport, WebhookEndpoint } from "./webhook";
-import type { WorkflowEvent } from "./types";
+import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest';
+import * as dns from 'node:dns';
+import { WebhookEventTransport, WebhookEndpoint } from './webhook';
+import type { WorkflowEvent } from './types';
 
-vi.mock("node:dns", () => ({
+vi.mock('node:dns', () => ({
   promises: {
-    lookup: vi.fn().mockResolvedValue({ address: "93.184.216.34", family: 4 }),
+    lookup: vi.fn().mockResolvedValue({ address: '93.184.216.34', family: 4 }),
   },
 }));
 
-function createTestEvent(
-  overrides: Partial<WorkflowEvent> = {},
-): WorkflowEvent {
+function createTestEvent(overrides: Partial<WorkflowEvent> = {}): WorkflowEvent {
   return {
-    eventType: "run.started",
-    runId: "run-123",
-    kind: "test.workflow",
-    timestamp: new Date("2024-01-01T12:00:00Z"),
+    eventType: 'run.started',
+    runId: 'run-123',
+    kind: 'test.workflow',
+    timestamp: new Date('2024-01-01T12:00:00Z'),
     ...overrides,
   };
 }
 
-describe("WebhookEventTransport", () => {
+describe('WebhookEventTransport', () => {
   let transport: WebhookEventTransport;
   let mockFetch: ReturnType<typeof vi.fn>;
 
@@ -38,72 +36,72 @@ describe("WebhookEventTransport", () => {
     transport.close();
   });
 
-  describe("addEndpoint / removeEndpoint", () => {
-    it("should add an endpoint", () => {
+  describe('addEndpoint / removeEndpoint', () => {
+    it('should add an endpoint', () => {
       const endpoint: WebhookEndpoint = {
-        id: "test-1",
-        url: "https://example.com/webhook",
+        id: 'test-1',
+        url: 'https://example.com/webhook',
       };
 
       transport.addEndpoint(endpoint);
 
       expect(transport.getEndpoints()).toHaveLength(1);
-      expect(transport.getEndpoints()[0].id).toBe("test-1");
+      expect(transport.getEndpoints()[0].id).toBe('test-1');
     });
 
-    it("should add endpoint with enabled=true by default", () => {
+    it('should add endpoint with enabled=true by default', () => {
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook",
+        id: 'test-1',
+        url: 'https://example.com/webhook',
       });
 
       expect(transport.getEndpoints()[0].enabled).toBe(true);
     });
 
-    it("should remove an endpoint", () => {
+    it('should remove an endpoint', () => {
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook",
+        id: 'test-1',
+        url: 'https://example.com/webhook',
       });
 
-      const removed = transport.removeEndpoint("test-1");
+      const removed = transport.removeEndpoint('test-1');
 
       expect(removed).toBe(true);
       expect(transport.getEndpoints()).toHaveLength(0);
     });
 
-    it("should return false when removing non-existent endpoint", () => {
-      const removed = transport.removeEndpoint("nonexistent");
+    it('should return false when removing non-existent endpoint', () => {
+      const removed = transport.removeEndpoint('nonexistent');
       expect(removed).toBe(false);
     });
   });
 
-  describe("setEndpointEnabled", () => {
-    it("should enable/disable an endpoint", () => {
+  describe('setEndpointEnabled', () => {
+    it('should enable/disable an endpoint', () => {
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook",
+        id: 'test-1',
+        url: 'https://example.com/webhook',
         enabled: true,
       });
 
-      transport.setEndpointEnabled("test-1", false);
+      transport.setEndpointEnabled('test-1', false);
       expect(transport.getEndpoints()[0].enabled).toBe(false);
 
-      transport.setEndpointEnabled("test-1", true);
+      transport.setEndpointEnabled('test-1', true);
       expect(transport.getEndpoints()[0].enabled).toBe(true);
     });
 
-    it("should do nothing for non-existent endpoint", () => {
-      transport.setEndpointEnabled("nonexistent", false);
+    it('should do nothing for non-existent endpoint', () => {
+      transport.setEndpointEnabled('nonexistent', false);
       // Should not throw
     });
   });
 
-  describe("emit", () => {
-    it("should send event to enabled endpoints", async () => {
+  describe('emit', () => {
+    it('should send event to enabled endpoints', async () => {
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook",
+        id: 'test-1',
+        url: 'https://example.com/webhook',
       });
 
       const event = createTestEvent();
@@ -114,20 +112,20 @@ describe("WebhookEventTransport", () => {
 
       expect(mockFetch).toHaveBeenCalledTimes(1);
       expect(mockFetch).toHaveBeenCalledWith(
-        "https://example.com/webhook",
+        'https://example.com/webhook',
         expect.objectContaining({
-          method: "POST",
+          method: 'POST',
           headers: expect.objectContaining({
-            "Content-Type": "application/json",
+            'Content-Type': 'application/json',
           }),
-        }),
+        })
       );
     });
 
-    it("should not send to disabled endpoints", async () => {
+    it('should not send to disabled endpoints', async () => {
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook",
+        id: 'test-1',
+        url: 'https://example.com/webhook',
         enabled: false,
       });
 
@@ -139,11 +137,11 @@ describe("WebhookEventTransport", () => {
       expect(mockFetch).not.toHaveBeenCalled();
     });
 
-    it("should include custom headers", async () => {
+    it('should include custom headers', async () => {
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook",
-        headers: { "X-Custom-Header": "custom-value" },
+        id: 'test-1',
+        url: 'https://example.com/webhook',
+        headers: { 'X-Custom-Header': 'custom-value' },
       });
 
       transport.emit(createTestEvent());
@@ -151,18 +149,18 @@ describe("WebhookEventTransport", () => {
       await new Promise((r) => setTimeout(r, 50));
 
       const callArgs = mockFetch.mock.calls[0];
-      expect(callArgs[1].headers["X-Custom-Header"]).toBe("custom-value");
+      expect(callArgs[1].headers['X-Custom-Header']).toBe('custom-value');
     });
 
-    it("should serialize payload correctly", async () => {
+    it('should serialize payload correctly', async () => {
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook",
+        id: 'test-1',
+        url: 'https://example.com/webhook',
       });
 
       const event = createTestEvent({
-        runId: "run-456",
-        kind: "my.workflow",
+        runId: 'run-456',
+        kind: 'my.workflow',
       });
       transport.emit(event);
 
@@ -171,81 +169,81 @@ describe("WebhookEventTransport", () => {
       const callArgs = mockFetch.mock.calls[0];
       const body = JSON.parse(callArgs[1].body);
 
-      expect(body.event.runId).toBe("run-456");
-      expect(body.event.kind).toBe("my.workflow");
-      expect(body.event.timestamp).toBe("2024-01-01T12:00:00.000Z");
-      expect(body.webhookId).toBe("test-1");
+      expect(body.event.runId).toBe('run-456');
+      expect(body.event.kind).toBe('my.workflow');
+      expect(body.event.timestamp).toBe('2024-01-01T12:00:00.000Z');
+      expect(body.webhookId).toBe('test-1');
       expect(body.deliveredAt).toBeDefined();
     });
   });
 
-  describe("event filtering", () => {
-    it("should filter by event type", async () => {
+  describe('event filtering', () => {
+    it('should filter by event type', async () => {
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook",
-        eventTypes: ["run.completed", "run.failed"],
+        id: 'test-1',
+        url: 'https://example.com/webhook',
+        eventTypes: ['run.completed', 'run.failed'],
       });
 
       // Should be filtered out
-      transport.emit(createTestEvent({ eventType: "run.started" }));
+      transport.emit(createTestEvent({ eventType: 'run.started' }));
 
       // Should be sent
-      transport.emit(createTestEvent({ eventType: "run.completed" }));
+      transport.emit(createTestEvent({ eventType: 'run.completed' }));
 
       await new Promise((r) => setTimeout(r, 50));
 
       expect(mockFetch).toHaveBeenCalledTimes(1);
     });
 
-    it("should filter by workflow kind", async () => {
+    it('should filter by workflow kind', async () => {
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook",
-        workflowKinds: ["order.process", "order.ship"],
+        id: 'test-1',
+        url: 'https://example.com/webhook',
+        workflowKinds: ['order.process', 'order.ship'],
       });
 
       // Should be filtered out
-      transport.emit(createTestEvent({ kind: "user.notify" }));
+      transport.emit(createTestEvent({ kind: 'user.notify' }));
 
       // Should be sent
-      transport.emit(createTestEvent({ kind: "order.process" }));
+      transport.emit(createTestEvent({ kind: 'order.process' }));
 
       await new Promise((r) => setTimeout(r, 50));
 
       expect(mockFetch).toHaveBeenCalledTimes(1);
     });
 
-    it("should apply both filters (AND logic)", async () => {
+    it('should apply both filters (AND logic)', async () => {
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook",
-        eventTypes: ["run.completed"],
-        workflowKinds: ["order.process"],
+        id: 'test-1',
+        url: 'https://example.com/webhook',
+        eventTypes: ['run.completed'],
+        workflowKinds: ['order.process'],
       });
 
       // Wrong event type
       transport.emit(
         createTestEvent({
-          eventType: "run.started",
-          kind: "order.process",
-        }),
+          eventType: 'run.started',
+          kind: 'order.process',
+        })
       );
 
       // Wrong workflow kind
       transport.emit(
         createTestEvent({
-          eventType: "run.completed",
-          kind: "user.notify",
-        }),
+          eventType: 'run.completed',
+          kind: 'user.notify',
+        })
       );
 
       // Both match
       transport.emit(
         createTestEvent({
-          eventType: "run.completed",
-          kind: "order.process",
-        }),
+          eventType: 'run.completed',
+          kind: 'order.process',
+        })
       );
 
       await new Promise((r) => setTimeout(r, 50));
@@ -253,14 +251,14 @@ describe("WebhookEventTransport", () => {
       expect(mockFetch).toHaveBeenCalledTimes(1);
     });
 
-    it("should send to all endpoints when no filters", async () => {
+    it('should send to all endpoints when no filters', async () => {
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook1",
+        id: 'test-1',
+        url: 'https://example.com/webhook1',
       });
       transport.addEndpoint({
-        id: "test-2",
-        url: "https://example.com/webhook2",
+        id: 'test-2',
+        url: 'https://example.com/webhook2',
       });
 
       transport.emit(createTestEvent());
@@ -271,12 +269,12 @@ describe("WebhookEventTransport", () => {
     });
   });
 
-  describe("HMAC signing", () => {
-    it("should sign payload when secret is provided", async () => {
+  describe('HMAC signing', () => {
+    it('should sign payload when secret is provided', async () => {
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook",
-        secret: "my-secret-key",
+        id: 'test-1',
+        url: 'https://example.com/webhook',
+        secret: 'my-secret-key',
       });
 
       transport.emit(createTestEvent());
@@ -284,16 +282,16 @@ describe("WebhookEventTransport", () => {
       await new Promise((r) => setTimeout(r, 50));
 
       const callArgs = mockFetch.mock.calls[0];
-      const signature = callArgs[1].headers["X-Webhook-Signature"];
+      const signature = callArgs[1].headers['X-Webhook-Signature'];
 
       expect(signature).toBeDefined();
       expect(signature).toMatch(/^sha256=[a-f0-9]{64}$/);
     });
 
-    it("should not include signature header when no secret", async () => {
+    it('should not include signature header when no secret', async () => {
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook",
+        id: 'test-1',
+        url: 'https://example.com/webhook',
       });
 
       transport.emit(createTestEvent());
@@ -301,15 +299,15 @@ describe("WebhookEventTransport", () => {
       await new Promise((r) => setTimeout(r, 50));
 
       const callArgs = mockFetch.mock.calls[0];
-      expect(callArgs[1].headers["X-Webhook-Signature"]).toBeUndefined();
+      expect(callArgs[1].headers['X-Webhook-Signature']).toBeUndefined();
     });
   });
 
-  describe("retries", () => {
-    it("should retry on failure", async () => {
+  describe('retries', () => {
+    it('should retry on failure', async () => {
       mockFetch
-        .mockRejectedValueOnce(new Error("Network error"))
-        .mockRejectedValueOnce(new Error("Network error"))
+        .mockRejectedValueOnce(new Error('Network error'))
+        .mockRejectedValueOnce(new Error('Network error'))
         .mockResolvedValueOnce({ ok: true });
 
       transport = new WebhookEventTransport({
@@ -320,8 +318,8 @@ describe("WebhookEventTransport", () => {
       });
 
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook",
+        id: 'test-1',
+        url: 'https://example.com/webhook',
       });
 
       transport.emit(createTestEvent());
@@ -332,13 +330,9 @@ describe("WebhookEventTransport", () => {
       expect(mockFetch).toHaveBeenCalledTimes(3);
     });
 
-    it("should retry on non-ok response", async () => {
+    it('should retry on non-ok response', async () => {
       mockFetch
-        .mockResolvedValueOnce({
-          ok: false,
-          status: 500,
-          statusText: "Internal Server Error",
-        })
+        .mockResolvedValueOnce({ ok: false, status: 500, statusText: 'Internal Server Error' })
         .mockResolvedValueOnce({ ok: true });
 
       transport = new WebhookEventTransport({
@@ -349,8 +343,8 @@ describe("WebhookEventTransport", () => {
       });
 
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook",
+        id: 'test-1',
+        url: 'https://example.com/webhook',
       });
 
       transport.emit(createTestEvent());
@@ -361,72 +355,72 @@ describe("WebhookEventTransport", () => {
     });
   });
 
-  describe("subscribe / subscribeAll", () => {
-    it("should call local subscribers on emit", () => {
+  describe('subscribe / subscribeAll', () => {
+    it('should call local subscribers on emit', () => {
       const callback = vi.fn();
-      transport.subscribe("run-123", callback);
+      transport.subscribe('run-123', callback);
 
-      const event = createTestEvent({ runId: "run-123" });
+      const event = createTestEvent({ runId: 'run-123' });
       transport.emit(event);
 
       expect(callback).toHaveBeenCalledWith(event);
     });
 
-    it("should not call subscriber for different runId", () => {
+    it('should not call subscriber for different runId', () => {
       const callback = vi.fn();
-      transport.subscribe("run-123", callback);
+      transport.subscribe('run-123', callback);
 
-      const event = createTestEvent({ runId: "run-456" });
+      const event = createTestEvent({ runId: 'run-456' });
       transport.emit(event);
 
       expect(callback).not.toHaveBeenCalled();
     });
 
-    it("should call global subscribers for all events", () => {
+    it('should call global subscribers for all events', () => {
       const callback = vi.fn();
       transport.subscribeAll(callback);
 
-      transport.emit(createTestEvent({ runId: "run-1" }));
-      transport.emit(createTestEvent({ runId: "run-2" }));
+      transport.emit(createTestEvent({ runId: 'run-1' }));
+      transport.emit(createTestEvent({ runId: 'run-2' }));
 
       expect(callback).toHaveBeenCalledTimes(2);
     });
 
-    it("should unsubscribe correctly", () => {
+    it('should unsubscribe correctly', () => {
       const callback = vi.fn();
-      const unsubscribe = transport.subscribe("run-123", callback);
+      const unsubscribe = transport.subscribe('run-123', callback);
 
       unsubscribe();
 
-      transport.emit(createTestEvent({ runId: "run-123" }));
+      transport.emit(createTestEvent({ runId: 'run-123' }));
       expect(callback).not.toHaveBeenCalled();
     });
 
-    it("should handle callback errors gracefully", () => {
+    it('should handle callback errors gracefully', () => {
       const errorCallback = vi.fn().mockImplementation(() => {
-        throw new Error("Callback error");
+        throw new Error('Callback error');
       });
       const normalCallback = vi.fn();
 
-      transport.subscribe("run-123", errorCallback);
-      transport.subscribe("run-123", normalCallback);
+      transport.subscribe('run-123', errorCallback);
+      transport.subscribe('run-123', normalCallback);
 
-      transport.emit(createTestEvent({ runId: "run-123" }));
+      transport.emit(createTestEvent({ runId: 'run-123' }));
 
       expect(errorCallback).toHaveBeenCalled();
       expect(normalCallback).toHaveBeenCalled();
     });
   });
 
-  describe("close", () => {
-    it("should clear all endpoints and subscribers", () => {
+  describe('close', () => {
+    it('should clear all endpoints and subscribers', () => {
       transport.addEndpoint({
-        id: "test-1",
-        url: "https://example.com/webhook",
+        id: 'test-1',
+        url: 'https://example.com/webhook',
       });
 
       const callback = vi.fn();
-      transport.subscribe("run-123", callback);
+      transport.subscribe('run-123', callback);
       transport.subscribeAll(vi.fn());
 
       transport.close();
@@ -434,91 +428,346 @@ describe("WebhookEventTransport", () => {
       expect(transport.getEndpoints()).toHaveLength(0);
 
       // Callback should not be called after close
-      transport.emit(createTestEvent({ runId: "run-123" }));
+      transport.emit(createTestEvent({ runId: 'run-123' }));
       expect(callback).not.toHaveBeenCalled();
     });
   });
 
-  describe("SSRF protection - isBlockedHost", () => {
-    it("should block 10.x.x.x private range", () => {
+  describe('SSRF protection - isBlockedHost', () => {
+    it('should block 10.x.x.x private range', () => {
       expect(() =>
-        transport.addEndpoint({ id: "ssrf-1", url: "https://10.0.0.1/hook" }),
+        transport.addEndpoint({ id: 'ssrf-1', url: 'https://10.0.0.1/hook' })
       ).toThrow(/blocked/);
     });
 
-    it("should block 172.16-31.x.x private range", () => {
+    it('should block 172.16-31.x.x private range', () => {
       expect(() =>
-        transport.addEndpoint({ id: "ssrf-2", url: "https://172.16.0.1/hook" }),
+        transport.addEndpoint({ id: 'ssrf-2', url: 'https://172.16.0.1/hook' })
       ).toThrow(/blocked/);
       expect(() =>
-        transport.addEndpoint({
-          id: "ssrf-3",
-          url: "https://172.31.255.255/hook",
-        }),
+        transport.addEndpoint({ id: 'ssrf-3', url: 'https://172.31.255.255/hook' })
       ).toThrow(/blocked/);
       // 172.32 should NOT be blocked
-      transport.addEndpoint({ id: "ssrf-ok", url: "https://172.32.0.1/hook" });
-      expect(
-        transport.getEndpoints().find((e) => e.id === "ssrf-ok"),
-      ).toBeDefined();
+      transport.addEndpoint({ id: 'ssrf-ok', url: 'https://172.32.0.1/hook' });
+      expect(transport.getEndpoints().find(e => e.id === 'ssrf-ok')).toBeDefined();
     });
 
-    it("should block 192.168.x.x private range", () => {
+    it('should block 192.168.x.x private range', () => {
       expect(() =>
-        transport.addEndpoint({
-          id: "ssrf-4",
-          url: "https://192.168.1.1/hook",
-        }),
+        transport.addEndpoint({ id: 'ssrf-4', url: 'https://192.168.1.1/hook' })
       ).toThrow(/blocked/);
     });
 
-    it("should block 169.254.x.x link-local range", () => {
+    it('should block 169.254.x.x link-local range', () => {
       expect(() =>
-        transport.addEndpoint({
-          id: "ssrf-5",
-          url: "https://169.254.1.1/hook",
-        }),
+        transport.addEndpoint({ id: 'ssrf-5', url: 'https://169.254.1.1/hook' })
       ).toThrow(/blocked/);
     });
 
-    it("should block 0.0.0.0", () => {
+    it('should block 0.0.0.0', () => {
       expect(() =>
-        transport.addEndpoint({ id: "ssrf-6", url: "https://0.0.0.0/hook" }),
+        transport.addEndpoint({ id: 'ssrf-6', url: 'https://0.0.0.0/hook' })
       ).toThrow(/blocked/);
     });
 
-    it("should block IPv6 link-local (fe80::)", () => {
+    it('should block IPv6 link-local (fe80::)', () => {
       expect(() =>
-        transport.addEndpoint({ id: "ssrf-7", url: "https://[fe80::1]/hook" }),
+        transport.addEndpoint({ id: 'ssrf-7', url: 'https://[fe80::1]/hook' })
       ).toThrow(/blocked/);
     });
 
-    it("should block localhost and 127.x.x.x", () => {
+    it('should block localhost and 127.x.x.x', () => {
       expect(() =>
-        transport.addEndpoint({ id: "ssrf-8", url: "https://localhost/hook" }),
+        transport.addEndpoint({ id: 'ssrf-8', url: 'https://localhost/hook' })
       ).toThrow(/blocked/);
       expect(() =>
-        transport.addEndpoint({ id: "ssrf-9", url: "https://127.0.0.1/hook" }),
+        transport.addEndpoint({ id: 'ssrf-9', url: 'https://127.0.0.1/hook' })
       ).toThrow(/blocked/);
       expect(() =>
-        transport.addEndpoint({ id: "ssrf-10", url: "https://127.0.0.2/hook" }),
+        transport.addEndpoint({ id: 'ssrf-10', url: 'https://127.0.0.2/hook' })
       ).toThrow(/blocked/);
     });
 
-    it("should block cloud metadata endpoint", () => {
+    it('should block cloud metadata endpoint', () => {
       expect(() =>
-        transport.addEndpoint({
-          id: "ssrf-11",
-          url: "https://169.254.169.254/latest/meta-data",
-        }),
+        transport.addEndpoint({ id: 'ssrf-11', url: 'https://169.254.169.254/latest/meta-data' })
       ).toThrow(/blocked/);
     });
   });
 
-  describe("emit subscriber error isolation", () => {
-    it("should catch subscriber error and still call other subscribers", () => {
+  describe('SSRF protection - IPv6 coverage', () => {
+    it('should block IPv6 loopback ::1 (in any abbreviated form)', () => {
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-loop-1', url: 'https://[::1]/hook' })
+      ).toThrow(/blocked/);
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-loop-2', url: 'https://[0000:0000:0000:0000:0000:0000:0000:0001]/hook' })
+      ).toThrow(/blocked/);
+    });
+
+    it('should block IPv6 unspecified ::', () => {
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-unspec', url: 'https://[::]/hook' })
+      ).toThrow(/blocked/);
+    });
+
+    it('should block link-local fe80::/10 across the full range', () => {
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-ll-1', url: 'https://[fe80::1]/hook' })
+      ).toThrow(/blocked/);
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-ll-2', url: 'https://[febf::abcd]/hook' })
+      ).toThrow(/blocked/);
+      // fec0:: is NOT link-local (deprecated site-local), should not be caught by fe80::/10
+      // but fe7f:: is below the range and should be allowed
+      transport.addEndpoint({ id: 'v6-ll-ok', url: 'https://[fe7f::1]/hook' });
+      expect(transport.getEndpoints().find(e => e.id === 'v6-ll-ok')).toBeDefined();
+    });
+
+    it('should block ULA fc00::/7 (fc and fd prefixes)', () => {
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-ula-1', url: 'https://[fc00::1]/hook' })
+      ).toThrow(/blocked/);
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-ula-2', url: 'https://[fd12:3456::abcd]/hook' })
+      ).toThrow(/blocked/);
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-ula-3', url: 'https://[fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]/hook' })
+      ).toThrow(/blocked/);
+    });
+
+    it('should block IPv4-mapped ::ffff:0:0/96 by decoding embedded IPv4', () => {
+      // ::ffff:127.0.0.1 → loopback
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-map-1', url: 'https://[::ffff:127.0.0.1]/hook' })
+      ).toThrow(/blocked/);
+      // ::ffff:10.0.0.1 → RFC 1918
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-map-2', url: 'https://[::ffff:10.0.0.1]/hook' })
+      ).toThrow(/blocked/);
+      // ::ffff:169.254.169.254 → cloud metadata
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-map-3', url: 'https://[::ffff:169.254.169.254]/hook' })
+      ).toThrow(/blocked/);
+      // Hex form ::ffff:c0a8:0001 == ::ffff:192.168.0.1
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-map-4', url: 'https://[::ffff:c0a8:0001]/hook' })
+      ).toThrow(/blocked/);
+    });
+
+    it('should block 6to4 2002::/16 by decoding embedded IPv4', () => {
+      // 2002:7f00:0001:: == 6to4 wrapping 127.0.0.1
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-6to4-loop', url: 'https://[2002:7f00:0001::]/hook' })
+      ).toThrow(/blocked/);
+      // 2002:c0a8:0001:: == 6to4 wrapping 192.168.0.1
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-6to4-1918', url: 'https://[2002:c0a8:0001::]/hook' })
+      ).toThrow(/blocked/);
+    });
+
+    it('should block Teredo 2001::/32', () => {
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-teredo', url: 'https://[2001:0:4136:e378:8000:63bf:3fff:fdd2]/hook' })
+      ).toThrow(/blocked/);
+    });
+
+    it('should block IPv6 multicast ff00::/8', () => {
+      expect(() =>
+        transport.addEndpoint({ id: 'v6-mc', url: 'https://[ff02::1]/hook' })
+      ).toThrow(/blocked/);
+    });
+
+    it('should allow legitimate public IPv6 addresses', () => {
+      // Google Public DNS — must not be blocked
+      transport.addEndpoint({ id: 'v6-pub-1', url: 'https://[2001:4860:4860::8888]/hook' });
+      // Cloudflare DNS
+      transport.addEndpoint({ id: 'v6-pub-2', url: 'https://[2606:4700:4700::1111]/hook' });
+      expect(transport.getEndpoints().find(e => e.id === 'v6-pub-1')).toBeDefined();
+      expect(transport.getEndpoints().find(e => e.id === 'v6-pub-2')).toBeDefined();
+    });
+
+    it('should block when DNS resolves to an IPv6 ULA address', async () => {
+      const dnsLookup = dns.promises.lookup as ReturnType<typeof vi.fn>;
+      dnsLookup.mockResolvedValueOnce({ address: 'fd00::1', family: 6 });
+
+      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
+      transport = new WebhookEventTransport({
+        fetchFn: mockFetch,
+        defaultRetries: 0,
+        logger,
+      });
+
+      transport.addEndpoint({
+        id: 'v6-dns-ula',
+        url: 'https://internal.example.com/hook',
+      });
+
+      transport.emit(createTestEvent());
+      await new Promise((r) => setTimeout(r, 50));
+
+      expect(mockFetch).not.toHaveBeenCalled();
+      expect(logger.error).toHaveBeenCalledWith(
+        expect.stringContaining('v6-dns-ula'),
+        expect.objectContaining({
+          message: expect.stringContaining('resolves to blocked IP'),
+        })
+      );
+    });
+
+    it('should block when DNS resolves to an IPv4-mapped IPv6 loopback', async () => {
+      const dnsLookup = dns.promises.lookup as ReturnType<typeof vi.fn>;
+      dnsLookup.mockResolvedValueOnce({ address: '::ffff:127.0.0.1', family: 6 });
+
+      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
+      transport = new WebhookEventTransport({
+        fetchFn: mockFetch,
+        defaultRetries: 0,
+        logger,
+      });
+
+      transport.addEndpoint({
+        id: 'v6-dns-mapped',
+        url: 'https://sneaky.example.com/hook',
+      });
+
+      transport.emit(createTestEvent());
+      await new Promise((r) => setTimeout(r, 50));
+
+      expect(mockFetch).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('queue back-pressure (memory exhaustion guard)', () => {
+    it('should drop deliveries beyond maxQueueDepth and log a warning', async () => {
+      // Hold every fetch open so the active slot fills and subsequent emits queue.
+      let resolveFetch: ((v: { ok: true }) => void) | undefined;
+      const blockingFetch = vi.fn().mockImplementation(
+        () => new Promise<{ ok: true }>((r) => { resolveFetch = r; })
+      );
+
+      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
+
+      transport = new WebhookEventTransport({
+        fetchFn: blockingFetch as unknown as typeof fetch,
+        defaultRetries: 0,
+        maxConcurrentRequests: 1,
+        maxQueueDepth: 2,
+        logger,
+      });
+
+      transport.addEndpoint({ id: 'cap-test', url: 'https://example.com/hook' });
+
+      // 1st emit → consumes the active slot.
+      // 2nd, 3rd emit → fill the queue (depth 2/2).
+      // 4th, 5th emit → must be dropped.
+      for (let i = 0; i < 5; i++) {
+        transport.emit(createTestEvent({ runId: `run-${i}` }));
+      }
+
+      // Let the dispatch loop run.
+      await new Promise((r) => setTimeout(r, 10));
+
+      expect(transport.getDroppedRequestCount()).toBe(2);
+      expect(transport.getQueueDepth()).toBe(2);
+      expect(logger.warn).toHaveBeenCalledTimes(2);
+      expect(logger.warn).toHaveBeenCalledWith(
+        expect.stringMatching(/cap-test delivery dropped: queue full/)
+      );
+      expect(logger.warn).toHaveBeenCalledWith(
+        expect.stringMatching(/retryAfterMs 1000/)
+      );
+
+      // Drain the in-flight request so .close() doesn't hang.
+      resolveFetch?.({ ok: true });
+      await new Promise((r) => setTimeout(r, 20));
+    });
+
+    it('should resume accepting deliveries after the queue drains', async () => {
+      let pendingResolvers: Array<(v: { ok: true }) => void> = [];
+      const blockingFetch = vi.fn().mockImplementation(
+        () => new Promise<{ ok: true }>((r) => { pendingResolvers.push(r); })
+      );
+
+      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
+
+      transport = new WebhookEventTransport({
+        fetchFn: blockingFetch as unknown as typeof fetch,
+        defaultRetries: 0,
+        maxConcurrentRequests: 1,
+        maxQueueDepth: 1,
+        logger,
+      });
+
+      transport.addEndpoint({ id: 'drain', url: 'https://example.com/hook' });
+
+      // 1 active + 1 queued + 1 dropped
+      transport.emit(createTestEvent({ runId: 'a' }));
+      transport.emit(createTestEvent({ runId: 'b' }));
+      transport.emit(createTestEvent({ runId: 'c' }));
+      await new Promise((r) => setTimeout(r, 10));
+      expect(transport.getDroppedRequestCount()).toBe(1);
+
+      // Drain everything in flight.
+      while (pendingResolvers.length > 0) {
+        const next = pendingResolvers.shift()!;
+        next({ ok: true });
+        await new Promise((r) => setTimeout(r, 5));
+      }
+      // Allow any newly-promoted queued requests to start and resolve.
+      while (pendingResolvers.length > 0) {
+        const next = pendingResolvers.shift()!;
+        next({ ok: true });
+        await new Promise((r) => setTimeout(r, 5));
+      }
+
+      // Now a new emit should be accepted, not dropped.
+      transport.emit(createTestEvent({ runId: 'd' }));
+      await new Promise((r) => setTimeout(r, 10));
+      expect(transport.getDroppedRequestCount()).toBe(1); // unchanged
+    });
+
+    it('should treat maxQueueDepth: 0 as unbounded', async () => {
+      let resolveFetch: ((v: { ok: true }) => void) | undefined;
+      const blockingFetch = vi.fn().mockImplementation(
+        () => new Promise<{ ok: true }>((r) => { resolveFetch = r; })
+      );
+
+      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
+
+      transport = new WebhookEventTransport({
+        fetchFn: blockingFetch as unknown as typeof fetch,
+        defaultRetries: 0,
+        maxConcurrentRequests: 1,
+        maxQueueDepth: 0, // explicit opt-out
+        logger,
+      });
+
+      transport.addEndpoint({ id: 'no-cap', url: 'https://example.com/hook' });
+
+      for (let i = 0; i < 50; i++) {
+        transport.emit(createTestEvent({ runId: `run-${i}` }));
+      }
+      await new Promise((r) => setTimeout(r, 10));
+
+      expect(transport.getDroppedRequestCount()).toBe(0);
+      expect(logger.warn).not.toHaveBeenCalled();
+
+      resolveFetch?.({ ok: true });
+      await new Promise((r) => setTimeout(r, 20));
+    });
+
+    it('should reject negative maxQueueDepth at construction', () => {
+      expect(
+        () => new WebhookEventTransport({ maxQueueDepth: -1 })
+      ).toThrow(/maxQueueDepth/);
+    });
+  });
+
+  describe('emit subscriber error isolation', () => {
+    it('should catch subscriber error and still call other subscribers', () => {
       const errorCallback = vi.fn().mockImplementation(() => {
-        throw new Error("Subscriber exploded");
+        throw new Error('Subscriber exploded');
       });
       const normalCallback = vi.fn();
 
@@ -532,16 +781,16 @@ describe("WebhookEventTransport", () => {
       expect(normalCallback).toHaveBeenCalledWith(event);
     });
 
-    it("should catch run-subscriber error and still call other run-subscribers", () => {
+    it('should catch run-subscriber error and still call other run-subscribers', () => {
       const errorCallback = vi.fn().mockImplementation(() => {
-        throw new Error("Run subscriber failed");
+        throw new Error('Run subscriber failed');
       });
       const normalCallback = vi.fn();
 
-      transport.subscribe("run-123", errorCallback);
-      transport.subscribe("run-123", normalCallback);
+      transport.subscribe('run-123', errorCallback);
+      transport.subscribe('run-123', normalCallback);
 
-      const event = createTestEvent({ runId: "run-123" });
+      const event = createTestEvent({ runId: 'run-123' });
       transport.emit(event);
 
       expect(errorCallback).toHaveBeenCalled();
@@ -549,12 +798,12 @@ describe("WebhookEventTransport", () => {
     });
   });
 
-  describe("close clears all state", () => {
-    it("should clear endpoints, run subscribers, and global subscribers after close", () => {
-      transport.addEndpoint({ id: "ep-1", url: "https://example.com/hook" });
+  describe('close clears all state', () => {
+    it('should clear endpoints, run subscribers, and global subscribers after close', () => {
+      transport.addEndpoint({ id: 'ep-1', url: 'https://example.com/hook' });
       const runCb = vi.fn();
       const globalCb = vi.fn();
-      transport.subscribe("run-123", runCb);
+      transport.subscribe('run-123', runCb);
       transport.subscribeAll(globalCb);
 
       transport.close();
@@ -562,19 +811,19 @@ describe("WebhookEventTransport", () => {
       expect(transport.getEndpoints()).toHaveLength(0);
 
       // Subscribers should no longer receive events
-      transport.emit(createTestEvent({ runId: "run-123" }));
+      transport.emit(createTestEvent({ runId: 'run-123' }));
       expect(runCb).not.toHaveBeenCalled();
       expect(globalCb).not.toHaveBeenCalled();
     });
   });
 
-  describe("constructor with initial endpoints", () => {
-    it("should register initial endpoints", () => {
+  describe('constructor with initial endpoints', () => {
+    it('should register initial endpoints', () => {
       transport = new WebhookEventTransport({
         fetchFn: mockFetch,
         endpoints: [
-          { id: "ep-1", url: "https://example.com/1" },
-          { id: "ep-2", url: "https://example.com/2" },
+          { id: 'ep-1', url: 'https://example.com/1' },
+          { id: 'ep-2', url: 'https://example.com/2' },
         ],
       });
 
@@ -582,17 +831,12 @@ describe("WebhookEventTransport", () => {
     });
   });
 
-  describe("SSRF protection - DNS resolution", () => {
-    it("should block webhooks when hostname resolves to private IP", async () => {
+  describe('SSRF protection - DNS resolution', () => {
+    it('should block webhooks when hostname resolves to private IP', async () => {
       const dnsLookup = dns.promises.lookup as ReturnType<typeof vi.fn>;
-      dnsLookup.mockResolvedValueOnce({ address: "10.0.0.5", family: 4 });
+      dnsLookup.mockResolvedValueOnce({ address: '10.0.0.5', family: 4 });
 
-      const logger = {
-        debug: vi.fn(),
-        info: vi.fn(),
-        warn: vi.fn(),
-        error: vi.fn(),
-      };
+      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
       transport = new WebhookEventTransport({
         fetchFn: mockFetch,
         defaultRetries: 0,
@@ -600,8 +844,8 @@ describe("WebhookEventTransport", () => {
       });
 
       transport.addEndpoint({
-        id: "ssrf-dns",
-        url: "https://evil.example.com/hook",
+        id: 'ssrf-dns',
+        url: 'https://evil.example.com/hook',
       });
 
       transport.emit(createTestEvent());
@@ -610,23 +854,18 @@ describe("WebhookEventTransport", () => {
 
       expect(mockFetch).not.toHaveBeenCalled();
       expect(logger.error).toHaveBeenCalledWith(
-        expect.stringContaining("ssrf-dns"),
+        expect.stringContaining('ssrf-dns'),
         expect.objectContaining({
-          message: expect.stringContaining("resolves to blocked IP"),
-        }),
+          message: expect.stringContaining('resolves to blocked IP'),
+        })
       );
     });
 
-    it("should block webhooks when hostname resolves to loopback", async () => {
+    it('should block webhooks when hostname resolves to loopback', async () => {
       const dnsLookup = dns.promises.lookup as ReturnType<typeof vi.fn>;
-      dnsLookup.mockResolvedValueOnce({ address: "127.0.0.1", family: 4 });
+      dnsLookup.mockResolvedValueOnce({ address: '127.0.0.1', family: 4 });
 
-      const logger = {
-        debug: vi.fn(),
-        info: vi.fn(),
-        warn: vi.fn(),
-        error: vi.fn(),
-      };
+      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
       transport = new WebhookEventTransport({
         fetchFn: mockFetch,
         defaultRetries: 0,
@@ -634,8 +873,8 @@ describe("WebhookEventTransport", () => {
       });
 
       transport.addEndpoint({
-        id: "ssrf-loopback",
-        url: "https://loopback.example.com/hook",
+        id: 'ssrf-loopback',
+        url: 'https://loopback.example.com/hook',
       });
 
       transport.emit(createTestEvent());
@@ -645,19 +884,11 @@ describe("WebhookEventTransport", () => {
       expect(mockFetch).not.toHaveBeenCalled();
     });
 
-    it("should block webhooks when hostname resolves to cloud metadata IP", async () => {
+    it('should block webhooks when hostname resolves to cloud metadata IP', async () => {
       const dnsLookup = dns.promises.lookup as ReturnType<typeof vi.fn>;
-      dnsLookup.mockResolvedValueOnce({
-        address: "169.254.169.254",
-        family: 4,
-      });
+      dnsLookup.mockResolvedValueOnce({ address: '169.254.169.254', family: 4 });
 
-      const logger = {
-        debug: vi.fn(),
-        info: vi.fn(),
-        warn: vi.fn(),
-        error: vi.fn(),
-      };
+      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
       transport = new WebhookEventTransport({
         fetchFn: mockFetch,
         defaultRetries: 0,
@@ -665,8 +896,8 @@ describe("WebhookEventTransport", () => {
       });
 
       transport.addEndpoint({
-        id: "ssrf-metadata",
-        url: "https://metadata.example.com/hook",
+        id: 'ssrf-metadata',
+        url: 'https://metadata.example.com/hook',
       });
 
       transport.emit(createTestEvent());
@@ -676,13 +907,35 @@ describe("WebhookEventTransport", () => {
       expect(mockFetch).not.toHaveBeenCalled();
     });
 
-    it("should allow webhooks when hostname resolves to public IP", async () => {
+    it('should allow webhooks when hostname resolves to public IP', async () => {
+      const dnsLookup = dns.promises.lookup as ReturnType<typeof vi.fn>;
+      dnsLookup.mockResolvedValueOnce({ address: '93.184.216.34', family: 4 });
+
+      transport.addEndpoint({
+        id: 'public-ok',
+        url: 'https://example.com/hook',
+      });
+
+      transport.emit(createTestEvent());
+
+      await new Promise((r) => setTimeout(r, 50));
+
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+    });
+
+    it('resolves the hostname exactly once per webhook send (no rebinding TOCTOU window)', async () => {
+      // Audit M1: the previous impl validated DNS once and then handed the
+      // hostname to fetch, which re-resolved at connect time. Two lookups in
+      // the same delivery is the symptom we're guarding against — assert the
+      // counter does not advance past one when both validation and connect
+      // run in the same delivery.
       const dnsLookup = dns.promises.lookup as ReturnType<typeof vi.fn>;
-      dnsLookup.mockResolvedValueOnce({ address: "93.184.216.34", family: 4 });
+      dnsLookup.mockClear();
+      dnsLookup.mockResolvedValue({ address: '93.184.216.34', family: 4 });
 
       transport.addEndpoint({
-        id: "public-ok",
-        url: "https://example.com/hook",
+        id: 'one-lookup',
+        url: 'https://example.com/hook',
       });
 
       transport.emit(createTestEvent());
@@ -690,6 +943,7 @@ describe("WebhookEventTransport", () => {
       await new Promise((r) => setTimeout(r, 50));
 
       expect(mockFetch).toHaveBeenCalledTimes(1);
+      expect(dnsLookup).toHaveBeenCalledTimes(1);
     });
   });
 });