@multiplier-labs/stepflow 0.3.4 → 0.3.8

package/src/events/webhook.test.ts

@@ -1,949 +0,0 @@
-import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest';
-import * as dns from 'node:dns';
-import { WebhookEventTransport, WebhookEndpoint } from './webhook';
-import type { WorkflowEvent } from './types';
-
-vi.mock('node:dns', () => ({
-  promises: {
-    lookup: vi.fn().mockResolvedValue({ address: '93.184.216.34', family: 4 }),
-  },
-}));
-
-function createTestEvent(overrides: Partial<WorkflowEvent> = {}): WorkflowEvent {
-  return {
-    eventType: 'run.started',
-    runId: 'run-123',
-    kind: 'test.workflow',
-    timestamp: new Date('2024-01-01T12:00:00Z'),
-    ...overrides,
-  };
-}
-
-describe('WebhookEventTransport', () => {
-  let transport: WebhookEventTransport;
-  let mockFetch: ReturnType<typeof vi.fn>;
-
-  beforeEach(() => {
-    mockFetch = vi.fn().mockResolvedValue({ ok: true });
-    transport = new WebhookEventTransport({
-      fetchFn: mockFetch,
-      defaultTimeout: 1000,
-      defaultRetries: 0, // Disable retries for faster tests
-    });
-  });
-
-  afterEach(() => {
-    transport.close();
-  });
-
-  describe('addEndpoint / removeEndpoint', () => {
-    it('should add an endpoint', () => {
-      const endpoint: WebhookEndpoint = {
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-      };
-
-      transport.addEndpoint(endpoint);
-
-      expect(transport.getEndpoints()).toHaveLength(1);
-      expect(transport.getEndpoints()[0].id).toBe('test-1');
-    });
-
-    it('should add endpoint with enabled=true by default', () => {
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-      });
-
-      expect(transport.getEndpoints()[0].enabled).toBe(true);
-    });
-
-    it('should remove an endpoint', () => {
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-      });
-
-      const removed = transport.removeEndpoint('test-1');
-
-      expect(removed).toBe(true);
-      expect(transport.getEndpoints()).toHaveLength(0);
-    });
-
-    it('should return false when removing non-existent endpoint', () => {
-      const removed = transport.removeEndpoint('nonexistent');
-      expect(removed).toBe(false);
-    });
-  });
-
-  describe('setEndpointEnabled', () => {
-    it('should enable/disable an endpoint', () => {
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-        enabled: true,
-      });
-
-      transport.setEndpointEnabled('test-1', false);
-      expect(transport.getEndpoints()[0].enabled).toBe(false);
-
-      transport.setEndpointEnabled('test-1', true);
-      expect(transport.getEndpoints()[0].enabled).toBe(true);
-    });
-
-    it('should do nothing for non-existent endpoint', () => {
-      transport.setEndpointEnabled('nonexistent', false);
-      // Should not throw
-    });
-  });
-
-  describe('emit', () => {
-    it('should send event to enabled endpoints', async () => {
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-      });
-
-      const event = createTestEvent();
-      transport.emit(event);
-
-      // Wait for async webhook
-      await new Promise((r) => setTimeout(r, 50));
-
-      expect(mockFetch).toHaveBeenCalledTimes(1);
-      expect(mockFetch).toHaveBeenCalledWith(
-        'https://example.com/webhook',
-        expect.objectContaining({
-          method: 'POST',
-          headers: expect.objectContaining({
-            'Content-Type': 'application/json',
-          }),
-        })
-      );
-    });
-
-    it('should not send to disabled endpoints', async () => {
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-        enabled: false,
-      });
-
-      const event = createTestEvent();
-      transport.emit(event);
-
-      await new Promise((r) => setTimeout(r, 50));
-
-      expect(mockFetch).not.toHaveBeenCalled();
-    });
-
-    it('should include custom headers', async () => {
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-        headers: { 'X-Custom-Header': 'custom-value' },
-      });
-
-      transport.emit(createTestEvent());
-
-      await new Promise((r) => setTimeout(r, 50));
-
-      const callArgs = mockFetch.mock.calls[0];
-      expect(callArgs[1].headers['X-Custom-Header']).toBe('custom-value');
-    });
-
-    it('should serialize payload correctly', async () => {
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-      });
-
-      const event = createTestEvent({
-        runId: 'run-456',
-        kind: 'my.workflow',
-      });
-      transport.emit(event);
-
-      await new Promise((r) => setTimeout(r, 50));
-
-      const callArgs = mockFetch.mock.calls[0];
-      const body = JSON.parse(callArgs[1].body);
-
-      expect(body.event.runId).toBe('run-456');
-      expect(body.event.kind).toBe('my.workflow');
-      expect(body.event.timestamp).toBe('2024-01-01T12:00:00.000Z');
-      expect(body.webhookId).toBe('test-1');
-      expect(body.deliveredAt).toBeDefined();
-    });
-  });
-
-  describe('event filtering', () => {
-    it('should filter by event type', async () => {
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-        eventTypes: ['run.completed', 'run.failed'],
-      });
-
-      // Should be filtered out
-      transport.emit(createTestEvent({ eventType: 'run.started' }));
-
-      // Should be sent
-      transport.emit(createTestEvent({ eventType: 'run.completed' }));
-
-      await new Promise((r) => setTimeout(r, 50));
-
-      expect(mockFetch).toHaveBeenCalledTimes(1);
-    });
-
-    it('should filter by workflow kind', async () => {
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-        workflowKinds: ['order.process', 'order.ship'],
-      });
-
-      // Should be filtered out
-      transport.emit(createTestEvent({ kind: 'user.notify' }));
-
-      // Should be sent
-      transport.emit(createTestEvent({ kind: 'order.process' }));
-
-      await new Promise((r) => setTimeout(r, 50));
-
-      expect(mockFetch).toHaveBeenCalledTimes(1);
-    });
-
-    it('should apply both filters (AND logic)', async () => {
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-        eventTypes: ['run.completed'],
-        workflowKinds: ['order.process'],
-      });
-
-      // Wrong event type
-      transport.emit(
-        createTestEvent({
-          eventType: 'run.started',
-          kind: 'order.process',
-        })
-      );
-
-      // Wrong workflow kind
-      transport.emit(
-        createTestEvent({
-          eventType: 'run.completed',
-          kind: 'user.notify',
-        })
-      );
-
-      // Both match
-      transport.emit(
-        createTestEvent({
-          eventType: 'run.completed',
-          kind: 'order.process',
-        })
-      );
-
-      await new Promise((r) => setTimeout(r, 50));
-
-      expect(mockFetch).toHaveBeenCalledTimes(1);
-    });
-
-    it('should send to all endpoints when no filters', async () => {
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook1',
-      });
-      transport.addEndpoint({
-        id: 'test-2',
-        url: 'https://example.com/webhook2',
-      });
-
-      transport.emit(createTestEvent());
-
-      await new Promise((r) => setTimeout(r, 50));
-
-      expect(mockFetch).toHaveBeenCalledTimes(2);
-    });
-  });
-
-  describe('HMAC signing', () => {
-    it('should sign payload when secret is provided', async () => {
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-        secret: 'my-secret-key',
-      });
-
-      transport.emit(createTestEvent());
-
-      await new Promise((r) => setTimeout(r, 50));
-
-      const callArgs = mockFetch.mock.calls[0];
-      const signature = callArgs[1].headers['X-Webhook-Signature'];
-
-      expect(signature).toBeDefined();
-      expect(signature).toMatch(/^sha256=[a-f0-9]{64}$/);
-    });
-
-    it('should not include signature header when no secret', async () => {
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-      });
-
-      transport.emit(createTestEvent());
-
-      await new Promise((r) => setTimeout(r, 50));
-
-      const callArgs = mockFetch.mock.calls[0];
-      expect(callArgs[1].headers['X-Webhook-Signature']).toBeUndefined();
-    });
-  });
-
-  describe('retries', () => {
-    it('should retry on failure', async () => {
-      mockFetch
-        .mockRejectedValueOnce(new Error('Network error'))
-        .mockRejectedValueOnce(new Error('Network error'))
-        .mockResolvedValueOnce({ ok: true });
-
-      transport = new WebhookEventTransport({
-        fetchFn: mockFetch,
-        defaultTimeout: 1000,
-        defaultRetries: 3,
-        retryDelay: 10, // Fast retries for tests
-      });
-
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-      });
-
-      transport.emit(createTestEvent());
-
-      // Wait for retries
-      await new Promise((r) => setTimeout(r, 200));
-
-      expect(mockFetch).toHaveBeenCalledTimes(3);
-    });
-
-    it('should retry on non-ok response', async () => {
-      mockFetch
-        .mockResolvedValueOnce({ ok: false, status: 500, statusText: 'Internal Server Error' })
-        .mockResolvedValueOnce({ ok: true });
-
-      transport = new WebhookEventTransport({
-        fetchFn: mockFetch,
-        defaultTimeout: 1000,
-        defaultRetries: 3,
-        retryDelay: 10,
-      });
-
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-      });
-
-      transport.emit(createTestEvent());
-
-      await new Promise((r) => setTimeout(r, 200));
-
-      expect(mockFetch).toHaveBeenCalledTimes(2);
-    });
-  });
-
-  describe('subscribe / subscribeAll', () => {
-    it('should call local subscribers on emit', () => {
-      const callback = vi.fn();
-      transport.subscribe('run-123', callback);
-
-      const event = createTestEvent({ runId: 'run-123' });
-      transport.emit(event);
-
-      expect(callback).toHaveBeenCalledWith(event);
-    });
-
-    it('should not call subscriber for different runId', () => {
-      const callback = vi.fn();
-      transport.subscribe('run-123', callback);
-
-      const event = createTestEvent({ runId: 'run-456' });
-      transport.emit(event);
-
-      expect(callback).not.toHaveBeenCalled();
-    });
-
-    it('should call global subscribers for all events', () => {
-      const callback = vi.fn();
-      transport.subscribeAll(callback);
-
-      transport.emit(createTestEvent({ runId: 'run-1' }));
-      transport.emit(createTestEvent({ runId: 'run-2' }));
-
-      expect(callback).toHaveBeenCalledTimes(2);
-    });
-
-    it('should unsubscribe correctly', () => {
-      const callback = vi.fn();
-      const unsubscribe = transport.subscribe('run-123', callback);
-
-      unsubscribe();
-
-      transport.emit(createTestEvent({ runId: 'run-123' }));
-      expect(callback).not.toHaveBeenCalled();
-    });
-
-    it('should handle callback errors gracefully', () => {
-      const errorCallback = vi.fn().mockImplementation(() => {
-        throw new Error('Callback error');
-      });
-      const normalCallback = vi.fn();
-
-      transport.subscribe('run-123', errorCallback);
-      transport.subscribe('run-123', normalCallback);
-
-      transport.emit(createTestEvent({ runId: 'run-123' }));
-
-      expect(errorCallback).toHaveBeenCalled();
-      expect(normalCallback).toHaveBeenCalled();
-    });
-  });
-
-  describe('close', () => {
-    it('should clear all endpoints and subscribers', () => {
-      transport.addEndpoint({
-        id: 'test-1',
-        url: 'https://example.com/webhook',
-      });
-
-      const callback = vi.fn();
-      transport.subscribe('run-123', callback);
-      transport.subscribeAll(vi.fn());
-
-      transport.close();
-
-      expect(transport.getEndpoints()).toHaveLength(0);
-
-      // Callback should not be called after close
-      transport.emit(createTestEvent({ runId: 'run-123' }));
-      expect(callback).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('SSRF protection - isBlockedHost', () => {
-    it('should block 10.x.x.x private range', () => {
-      expect(() =>
-        transport.addEndpoint({ id: 'ssrf-1', url: 'https://10.0.0.1/hook' })
-      ).toThrow(/blocked/);
-    });
-
-    it('should block 172.16-31.x.x private range', () => {
-      expect(() =>
-        transport.addEndpoint({ id: 'ssrf-2', url: 'https://172.16.0.1/hook' })
-      ).toThrow(/blocked/);
-      expect(() =>
-        transport.addEndpoint({ id: 'ssrf-3', url: 'https://172.31.255.255/hook' })
-      ).toThrow(/blocked/);
-      // 172.32 should NOT be blocked
-      transport.addEndpoint({ id: 'ssrf-ok', url: 'https://172.32.0.1/hook' });
-      expect(transport.getEndpoints().find(e => e.id === 'ssrf-ok')).toBeDefined();
-    });
-
-    it('should block 192.168.x.x private range', () => {
-      expect(() =>
-        transport.addEndpoint({ id: 'ssrf-4', url: 'https://192.168.1.1/hook' })
-      ).toThrow(/blocked/);
-    });
-
-    it('should block 169.254.x.x link-local range', () => {
-      expect(() =>
-        transport.addEndpoint({ id: 'ssrf-5', url: 'https://169.254.1.1/hook' })
-      ).toThrow(/blocked/);
-    });
-
-    it('should block 0.0.0.0', () => {
-      expect(() =>
-        transport.addEndpoint({ id: 'ssrf-6', url: 'https://0.0.0.0/hook' })
-      ).toThrow(/blocked/);
-    });
-
-    it('should block IPv6 link-local (fe80::)', () => {
-      expect(() =>
-        transport.addEndpoint({ id: 'ssrf-7', url: 'https://[fe80::1]/hook' })
-      ).toThrow(/blocked/);
-    });
-
-    it('should block localhost and 127.x.x.x', () => {
-      expect(() =>
-        transport.addEndpoint({ id: 'ssrf-8', url: 'https://localhost/hook' })
-      ).toThrow(/blocked/);
-      expect(() =>
-        transport.addEndpoint({ id: 'ssrf-9', url: 'https://127.0.0.1/hook' })
-      ).toThrow(/blocked/);
-      expect(() =>
-        transport.addEndpoint({ id: 'ssrf-10', url: 'https://127.0.0.2/hook' })
-      ).toThrow(/blocked/);
-    });
-
-    it('should block cloud metadata endpoint', () => {
-      expect(() =>
-        transport.addEndpoint({ id: 'ssrf-11', url: 'https://169.254.169.254/latest/meta-data' })
-      ).toThrow(/blocked/);
-    });
-  });
-
-  describe('SSRF protection - IPv6 coverage', () => {
-    it('should block IPv6 loopback ::1 (in any abbreviated form)', () => {
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-loop-1', url: 'https://[::1]/hook' })
-      ).toThrow(/blocked/);
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-loop-2', url: 'https://[0000:0000:0000:0000:0000:0000:0000:0001]/hook' })
-      ).toThrow(/blocked/);
-    });
-
-    it('should block IPv6 unspecified ::', () => {
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-unspec', url: 'https://[::]/hook' })
-      ).toThrow(/blocked/);
-    });
-
-    it('should block link-local fe80::/10 across the full range', () => {
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-ll-1', url: 'https://[fe80::1]/hook' })
-      ).toThrow(/blocked/);
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-ll-2', url: 'https://[febf::abcd]/hook' })
-      ).toThrow(/blocked/);
-      // fec0:: is NOT link-local (deprecated site-local), should not be caught by fe80::/10
-      // but fe7f:: is below the range and should be allowed
-      transport.addEndpoint({ id: 'v6-ll-ok', url: 'https://[fe7f::1]/hook' });
-      expect(transport.getEndpoints().find(e => e.id === 'v6-ll-ok')).toBeDefined();
-    });
-
-    it('should block ULA fc00::/7 (fc and fd prefixes)', () => {
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-ula-1', url: 'https://[fc00::1]/hook' })
-      ).toThrow(/blocked/);
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-ula-2', url: 'https://[fd12:3456::abcd]/hook' })
-      ).toThrow(/blocked/);
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-ula-3', url: 'https://[fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]/hook' })
-      ).toThrow(/blocked/);
-    });
-
-    it('should block IPv4-mapped ::ffff:0:0/96 by decoding embedded IPv4', () => {
-      // ::ffff:127.0.0.1 → loopback
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-map-1', url: 'https://[::ffff:127.0.0.1]/hook' })
-      ).toThrow(/blocked/);
-      // ::ffff:10.0.0.1 → RFC 1918
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-map-2', url: 'https://[::ffff:10.0.0.1]/hook' })
-      ).toThrow(/blocked/);
-      // ::ffff:169.254.169.254 → cloud metadata
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-map-3', url: 'https://[::ffff:169.254.169.254]/hook' })
-      ).toThrow(/blocked/);
-      // Hex form ::ffff:c0a8:0001 == ::ffff:192.168.0.1
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-map-4', url: 'https://[::ffff:c0a8:0001]/hook' })
-      ).toThrow(/blocked/);
-    });
-
-    it('should block 6to4 2002::/16 by decoding embedded IPv4', () => {
-      // 2002:7f00:0001:: == 6to4 wrapping 127.0.0.1
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-6to4-loop', url: 'https://[2002:7f00:0001::]/hook' })
-      ).toThrow(/blocked/);
-      // 2002:c0a8:0001:: == 6to4 wrapping 192.168.0.1
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-6to4-1918', url: 'https://[2002:c0a8:0001::]/hook' })
-      ).toThrow(/blocked/);
-    });
-
-    it('should block Teredo 2001::/32', () => {
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-teredo', url: 'https://[2001:0:4136:e378:8000:63bf:3fff:fdd2]/hook' })
-      ).toThrow(/blocked/);
-    });
-
-    it('should block IPv6 multicast ff00::/8', () => {
-      expect(() =>
-        transport.addEndpoint({ id: 'v6-mc', url: 'https://[ff02::1]/hook' })
-      ).toThrow(/blocked/);
-    });
-
-    it('should allow legitimate public IPv6 addresses', () => {
-      // Google Public DNS — must not be blocked
-      transport.addEndpoint({ id: 'v6-pub-1', url: 'https://[2001:4860:4860::8888]/hook' });
-      // Cloudflare DNS
-      transport.addEndpoint({ id: 'v6-pub-2', url: 'https://[2606:4700:4700::1111]/hook' });
-      expect(transport.getEndpoints().find(e => e.id === 'v6-pub-1')).toBeDefined();
-      expect(transport.getEndpoints().find(e => e.id === 'v6-pub-2')).toBeDefined();
-    });
-
-    it('should block when DNS resolves to an IPv6 ULA address', async () => {
-      const dnsLookup = dns.promises.lookup as ReturnType<typeof vi.fn>;
-      dnsLookup.mockResolvedValueOnce({ address: 'fd00::1', family: 6 });
-
-      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
-      transport = new WebhookEventTransport({
-        fetchFn: mockFetch,
-        defaultRetries: 0,
-        logger,
-      });
-
-      transport.addEndpoint({
-        id: 'v6-dns-ula',
-        url: 'https://internal.example.com/hook',
-      });
-
-      transport.emit(createTestEvent());
-      await new Promise((r) => setTimeout(r, 50));
-
-      expect(mockFetch).not.toHaveBeenCalled();
-      expect(logger.error).toHaveBeenCalledWith(
-        expect.stringContaining('v6-dns-ula'),
-        expect.objectContaining({
-          message: expect.stringContaining('resolves to blocked IP'),
-        })
-      );
-    });
-
-    it('should block when DNS resolves to an IPv4-mapped IPv6 loopback', async () => {
-      const dnsLookup = dns.promises.lookup as ReturnType<typeof vi.fn>;
-      dnsLookup.mockResolvedValueOnce({ address: '::ffff:127.0.0.1', family: 6 });
-
-      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
-      transport = new WebhookEventTransport({
-        fetchFn: mockFetch,
-        defaultRetries: 0,
-        logger,
-      });
-
-      transport.addEndpoint({
-        id: 'v6-dns-mapped',
-        url: 'https://sneaky.example.com/hook',
-      });
-
-      transport.emit(createTestEvent());
-      await new Promise((r) => setTimeout(r, 50));
-
-      expect(mockFetch).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('queue back-pressure (memory exhaustion guard)', () => {
-    it('should drop deliveries beyond maxQueueDepth and log a warning', async () => {
-      // Hold every fetch open so the active slot fills and subsequent emits queue.
-      let resolveFetch: ((v: { ok: true }) => void) | undefined;
-      const blockingFetch = vi.fn().mockImplementation(
-        () => new Promise<{ ok: true }>((r) => { resolveFetch = r; })
-      );
-
-      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
-
-      transport = new WebhookEventTransport({
-        fetchFn: blockingFetch as unknown as typeof fetch,
-        defaultRetries: 0,
-        maxConcurrentRequests: 1,
-        maxQueueDepth: 2,
-        logger,
-      });
-
-      transport.addEndpoint({ id: 'cap-test', url: 'https://example.com/hook' });
-
-      // 1st emit → consumes the active slot.
-      // 2nd, 3rd emit → fill the queue (depth 2/2).
-      // 4th, 5th emit → must be dropped.
-      for (let i = 0; i < 5; i++) {
-        transport.emit(createTestEvent({ runId: `run-${i}` }));
-      }
-
-      // Let the dispatch loop run.
-      await new Promise((r) => setTimeout(r, 10));
-
-      expect(transport.getDroppedRequestCount()).toBe(2);
-      expect(transport.getQueueDepth()).toBe(2);
-      expect(logger.warn).toHaveBeenCalledTimes(2);
-      expect(logger.warn).toHaveBeenCalledWith(
-        expect.stringMatching(/cap-test delivery dropped: queue full/)
-      );
-      expect(logger.warn).toHaveBeenCalledWith(
-        expect.stringMatching(/retryAfterMs 1000/)
-      );
-
-      // Drain the in-flight request so .close() doesn't hang.
-      resolveFetch?.({ ok: true });
-      await new Promise((r) => setTimeout(r, 20));
-    });
-
-    it('should resume accepting deliveries after the queue drains', async () => {
-      let pendingResolvers: Array<(v: { ok: true }) => void> = [];
-      const blockingFetch = vi.fn().mockImplementation(
-        () => new Promise<{ ok: true }>((r) => { pendingResolvers.push(r); })
-      );
-
-      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
-
-      transport = new WebhookEventTransport({
-        fetchFn: blockingFetch as unknown as typeof fetch,
-        defaultRetries: 0,
-        maxConcurrentRequests: 1,
-        maxQueueDepth: 1,
-        logger,
-      });
-
-      transport.addEndpoint({ id: 'drain', url: 'https://example.com/hook' });
-
-      // 1 active + 1 queued + 1 dropped
-      transport.emit(createTestEvent({ runId: 'a' }));
-      transport.emit(createTestEvent({ runId: 'b' }));
-      transport.emit(createTestEvent({ runId: 'c' }));
-      await new Promise((r) => setTimeout(r, 10));
-      expect(transport.getDroppedRequestCount()).toBe(1);
-
-      // Drain everything in flight.
-      while (pendingResolvers.length > 0) {
-        const next = pendingResolvers.shift()!;
-        next({ ok: true });
-        await new Promise((r) => setTimeout(r, 5));
-      }
-      // Allow any newly-promoted queued requests to start and resolve.
-      while (pendingResolvers.length > 0) {
-        const next = pendingResolvers.shift()!;
-        next({ ok: true });
-        await new Promise((r) => setTimeout(r, 5));
-      }
-
-      // Now a new emit should be accepted, not dropped.
-      transport.emit(createTestEvent({ runId: 'd' }));
-      await new Promise((r) => setTimeout(r, 10));
-      expect(transport.getDroppedRequestCount()).toBe(1); // unchanged
-    });
-
-    it('should treat maxQueueDepth: 0 as unbounded', async () => {
-      let resolveFetch: ((v: { ok: true }) => void) | undefined;
-      const blockingFetch = vi.fn().mockImplementation(
-        () => new Promise<{ ok: true }>((r) => { resolveFetch = r; })
-      );
-
-      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
-
-      transport = new WebhookEventTransport({
-        fetchFn: blockingFetch as unknown as typeof fetch,
-        defaultRetries: 0,
-        maxConcurrentRequests: 1,
-        maxQueueDepth: 0, // explicit opt-out
-        logger,
-      });
-
-      transport.addEndpoint({ id: 'no-cap', url: 'https://example.com/hook' });
-
-      for (let i = 0; i < 50; i++) {
-        transport.emit(createTestEvent({ runId: `run-${i}` }));
-      }
-      await new Promise((r) => setTimeout(r, 10));
-
-      expect(transport.getDroppedRequestCount()).toBe(0);
-      expect(logger.warn).not.toHaveBeenCalled();
-
-      resolveFetch?.({ ok: true });
-      await new Promise((r) => setTimeout(r, 20));
-    });
-
-    it('should reject negative maxQueueDepth at construction', () => {
-      expect(
-        () => new WebhookEventTransport({ maxQueueDepth: -1 })
-      ).toThrow(/maxQueueDepth/);
-    });
-  });
-
-  describe('emit subscriber error isolation', () => {
-    it('should catch subscriber error and still call other subscribers', () => {
-      const errorCallback = vi.fn().mockImplementation(() => {
-        throw new Error('Subscriber exploded');
-      });
-      const normalCallback = vi.fn();
-
-      transport.subscribeAll(errorCallback);
-      transport.subscribeAll(normalCallback);
-
-      const event = createTestEvent();
-      transport.emit(event);
-
-      expect(errorCallback).toHaveBeenCalledWith(event);
-      expect(normalCallback).toHaveBeenCalledWith(event);
-    });
-
-    it('should catch run-subscriber error and still call other run-subscribers', () => {
-      const errorCallback = vi.fn().mockImplementation(() => {
-        throw new Error('Run subscriber failed');
-      });
-      const normalCallback = vi.fn();
-
-      transport.subscribe('run-123', errorCallback);
-      transport.subscribe('run-123', normalCallback);
-
-      const event = createTestEvent({ runId: 'run-123' });
-      transport.emit(event);
-
-      expect(errorCallback).toHaveBeenCalled();
-      expect(normalCallback).toHaveBeenCalled();
-    });
-  });
-
-  describe('close clears all state', () => {
-    it('should clear endpoints, run subscribers, and global subscribers after close', () => {
-      transport.addEndpoint({ id: 'ep-1', url: 'https://example.com/hook' });
-      const runCb = vi.fn();
-      const globalCb = vi.fn();
-      transport.subscribe('run-123', runCb);
-      transport.subscribeAll(globalCb);
-
-      transport.close();
-
-      expect(transport.getEndpoints()).toHaveLength(0);
-
-      // Subscribers should no longer receive events
-      transport.emit(createTestEvent({ runId: 'run-123' }));
-      expect(runCb).not.toHaveBeenCalled();
-      expect(globalCb).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('constructor with initial endpoints', () => {
-    it('should register initial endpoints', () => {
-      transport = new WebhookEventTransport({
-        fetchFn: mockFetch,
-        endpoints: [
-          { id: 'ep-1', url: 'https://example.com/1' },
-          { id: 'ep-2', url: 'https://example.com/2' },
-        ],
-      });
-
-      expect(transport.getEndpoints()).toHaveLength(2);
-    });
-  });
-
-  describe('SSRF protection - DNS resolution', () => {
-    it('should block webhooks when hostname resolves to private IP', async () => {
-      const dnsLookup = dns.promises.lookup as ReturnType<typeof vi.fn>;
-      dnsLookup.mockResolvedValueOnce({ address: '10.0.0.5', family: 4 });
-
-      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
-      transport = new WebhookEventTransport({
-        fetchFn: mockFetch,
-        defaultRetries: 0,
-        logger,
-      });
-
-      transport.addEndpoint({
-        id: 'ssrf-dns',
-        url: 'https://evil.example.com/hook',
-      });
-
-      transport.emit(createTestEvent());
-
-      await new Promise((r) => setTimeout(r, 50));
-
-      expect(mockFetch).not.toHaveBeenCalled();
-      expect(logger.error).toHaveBeenCalledWith(
-        expect.stringContaining('ssrf-dns'),
-        expect.objectContaining({
-          message: expect.stringContaining('resolves to blocked IP'),
-        })
-      );
-    });
-
-    it('should block webhooks when hostname resolves to loopback', async () => {
-      const dnsLookup = dns.promises.lookup as ReturnType<typeof vi.fn>;
-      dnsLookup.mockResolvedValueOnce({ address: '127.0.0.1', family: 4 });
-
-      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
-      transport = new WebhookEventTransport({
-        fetchFn: mockFetch,
-        defaultRetries: 0,
-        logger,
-      });
-
-      transport.addEndpoint({
-        id: 'ssrf-loopback',
-        url: 'https://loopback.example.com/hook',
-      });
-
-      transport.emit(createTestEvent());
-
-      await new Promise((r) => setTimeout(r, 50));
-
-      expect(mockFetch).not.toHaveBeenCalled();
-    });
-
-    it('should block webhooks when hostname resolves to cloud metadata IP', async () => {
-      const dnsLookup = dns.promises.lookup as ReturnType<typeof vi.fn>;
-      dnsLookup.mockResolvedValueOnce({ address: '169.254.169.254', family: 4 });
-
-      const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
-      transport = new WebhookEventTransport({
-        fetchFn: mockFetch,
-        defaultRetries: 0,
-        logger,
-      });
-
-      transport.addEndpoint({
-        id: 'ssrf-metadata',
-        url: 'https://metadata.example.com/hook',
-      });
-
-      transport.emit(createTestEvent());
-
-      await new Promise((r) => setTimeout(r, 50));
-
-      expect(mockFetch).not.toHaveBeenCalled();
-    });
-
-    it('should allow webhooks when hostname resolves to public IP', async () => {
-      const dnsLookup = dns.promises.lookup as ReturnType<typeof vi.fn>;
-      dnsLookup.mockResolvedValueOnce({ address: '93.184.216.34', family: 4 });
-
-      transport.addEndpoint({
-        id: 'public-ok',
-        url: 'https://example.com/hook',
-      });
-
-      transport.emit(createTestEvent());
-
-      await new Promise((r) => setTimeout(r, 50));
-
-      expect(mockFetch).toHaveBeenCalledTimes(1);
-    });
-
-    it('resolves the hostname exactly once per webhook send (no rebinding TOCTOU window)', async () => {
-      // Audit M1: the previous impl validated DNS once and then handed the
-      // hostname to fetch, which re-resolved at connect time. Two lookups in
-      // the same delivery is the symptom we're guarding against — assert the
-      // counter does not advance past one when both validation and connect
-      // run in the same delivery.
-      const dnsLookup = dns.promises.lookup as ReturnType<typeof vi.fn>;
-      dnsLookup.mockClear();
-      dnsLookup.mockResolvedValue({ address: '93.184.216.34', family: 4 });
-
-      transport.addEndpoint({
-        id: 'one-lookup',
-        url: 'https://example.com/hook',
-      });
-
-      transport.emit(createTestEvent());
-
-      await new Promise((r) => setTimeout(r, 50));
-
-      expect(mockFetch).toHaveBeenCalledTimes(1);
-      expect(dnsLookup).toHaveBeenCalledTimes(1);
-    });
-  });
-});