@tapflowio/relay 0.26.1 → 0.27.1

package/dist/lib/clientAddress.js.map

@@ -1 +1 @@
-{"version":3,"file":"clientAddress.js","sourceRoot":"","sources":["../../src/lib/clientAddress.ts"],"names":[],"mappings":"AAEA,qEAAqE;AACrE,sEAAsE;AAEtE,6EAA6E;AAC7E,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACrC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5E,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAChC,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACxC,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC7E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgC;IACxD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1C,MAAM,gBAAgB,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC9D,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE7C,IAAI,gBAAgB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,kEAAkE;QAClE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACxF,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;QACxB,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAA;QAC7D,2CAA2C;QAC3C,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;QAClD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED,8DAA8D;IAC9D,uDAAuD;IACvD,uDAAuD;IACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAA;AACtD,CAAC;AAED,0GAA0G;AAC1G,2GAA2G;AAC3G,kCAAkC;AAClC,MAAM,cAAc,GAAG,IAAI,OAAO,EAAwB,CAAA;AAE1D,MAAM,UAAU,iBAAiB,CAAC,GAAyB;IACzD,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAyB;IACvD,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAyB,EAAE,cAAwB;IACtF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC1C,OAAO,oBAAoB,CAAC;QAC1B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE;QAC1C,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;QAC/C,cAAc;QACd,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC;KAChC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"clientAddress.js","sourceRoot":"","sources":["../../src/lib/clientAddress.ts"],"names":[],"mappings":"AAEA,qEAAqE;AACrE,sEAAsE;AAEtE,6EAA6E;AAC7E,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACrC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5E,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAChC,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACxC,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC7E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgC;IACxD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1C,MAAM,gBAAgB,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC9D,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE7C,IAAI,gBAAgB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,kEAAkE;QAClE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACxF,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;QACxB,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAA;QAC7D,2CAA2C;QAC3C,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;QAClD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED,8DAA8D;IAC9D,uDAAuD;IACvD,uDAAuD;IACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAA;AACtD,CAAC;AAED;0CAC0C;AAC1C,MAAM,kBAAkB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,KAAK,CAAU,CAAA;AAE9G;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAkB,EAClB,OAAiC,EACjC,cAAwB;IAExB,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAClF,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,IAAI,IAAI,CAAA;AACzE,CAAC;AAED,0GAA0G;AAC1G,2GAA2G;AAC3G,kCAAkC;AAClC,MAAM,cAAc,GAAG,IAAI,OAAO,EAAwB,CAAA;AAE1D,MAAM,UAAU,iBAAiB,CAAC,GAAyB;IACzD,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAyB;IACvD,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAyB,EAAE,cAAwB;IACtF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC1C,OAAO,oBAAoB,CAAC;QAC1B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE;QAC1C,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;QAC/C,cAAc;QACd,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC;KAChC,CAAC,CAAA;AACJ,CAAC"}

package/dist/lib/uploads.d.ts

@@ -1,2 +1,15 @@
 export declare function unlinkSafe(filePath: string, label: string): void;
+/**
+ * Writes an uploaded file to `dest`. Resolves once it is on disk; on a failed upload or write, closes the
+ * writer, removes what was written and rejects.
+ *
+ * `stream.pipe(writer)` does neither: when busboy destroys a file's stream — a body that ends inside the
+ * part — the writer stays open and the partial file stays on disk, once per failed upload.
+ *
+ * The rejection is marked handled here, for the case where nobody awaits it: a failed part also fails the
+ * parser, whose `'error'` handler answers the request, and the route's `'finish'` never runs. A failed
+ * *write* (a full disk) is different — the parser still finishes and the route awaits a rejection, so every
+ * caller catches it.
+ */
+export declare function pipeUpload(stream: NodeJS.ReadableStream, dest: string, label: string): Promise<void>;
 //# sourceMappingURL=uploads.d.ts.map

package/dist/lib/uploads.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uploads.d.ts","sourceRoot":"","sources":["../../src/lib/uploads.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAQhE"}
+{"version":3,"file":"uploads.d.ts","sourceRoot":"","sources":["../../src/lib/uploads.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAQhE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBpG"}

package/dist/lib/uploads.js

@@ -11,4 +11,45 @@ export function unlinkSafe(filePath, label) {
         }
     }
 }
+/**
+ * Writes an uploaded file to `dest`. Resolves once it is on disk; on a failed upload or write, closes the
+ * writer, removes what was written and rejects.
+ *
+ * `stream.pipe(writer)` does neither: when busboy destroys a file's stream — a body that ends inside the
+ * part — the writer stays open and the partial file stays on disk, once per failed upload.
+ *
+ * The rejection is marked handled here, for the case where nobody awaits it: a failed part also fails the
+ * parser, whose `'error'` handler answers the request, and the route's `'finish'` never runs. A failed
+ * *write* (a full disk) is different — the parser still finishes and the route awaits a rejection, so every
+ * caller catches it.
+ */
+export function pipeUpload(stream, dest, label) {
+    const writer = fs.createWriteStream(dest);
+    const written = new Promise((resolve, reject) => {
+        let failed = false;
+        const fail = (err) => {
+            if (failed)
+                return;
+            failed = true;
+            // Keep reading the upload: a writer error unpipes it, and a part nobody reads holds the parser short
+            // of `'finish'`, so the route would never answer.
+            stream.resume();
+            // Remove the file once the writer has closed it: Windows refuses to delete an open file, and an error
+            // before the open completes would otherwise delete nothing and leave the file it then creates.
+            const remove = () => { unlinkSafe(dest, label); reject(err); };
+            if (writer.closed)
+                remove();
+            else {
+                writer.once('close', remove);
+                writer.destroy();
+            }
+        };
+        writer.on('finish', resolve);
+        writer.on('error', fail);
+        stream.on('error', fail);
+    });
+    written.catch(() => { });
+    stream.pipe(writer);
+    return written;
+}
 //# sourceMappingURL=uploads.js.map

package/dist/lib/uploads.js.map

@@ -1 +1 @@
-{"version":3,"file":"uploads.js","sourceRoot":"","sources":["../../src/lib/uploads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AAEnB,yDAAyD;AACzD,kDAAkD;AAClD,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,KAAa;IACxD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,8BAA8B,KAAK,EAAE,EAAG,GAAa,CAAC,OAAO,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"uploads.js","sourceRoot":"","sources":["../../src/lib/uploads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AAEnB,yDAAyD;AACzD,kDAAkD;AAClD,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,KAAa;IACxD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,8BAA8B,KAAK,EAAE,EAAG,GAAa,CAAC,OAAO,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CAAC,MAA6B,EAAE,IAAY,EAAE,KAAa;IACnF,MAAM,MAAM,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpD,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,MAAM,IAAI,GAAG,CAAC,GAAY,EAAE,EAAE;YAC5B,IAAI,MAAM;gBAAE,OAAM;YAClB,MAAM,GAAG,IAAI,CAAA;YACb,qGAAqG;YACrG,kDAAkD;YAClD,MAAM,CAAC,MAAM,EAAE,CAAA;YACf,sGAAsG;YACtG,+FAA+F;YAC/F,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA,CAAC,CAAC,CAAA;YAC7D,IAAI,MAAM,CAAC,MAAM;gBAAE,MAAM,EAAE,CAAA;iBACtB,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAAC,MAAM,CAAC,OAAO,EAAE,CAAA;YAAC,CAAC;QACzD,CAAC,CAAA;QACD,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC5B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACxB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IACF,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnB,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/lib/webhookTransport.d.ts

@@ -0,0 +1,29 @@
+export type FetchLike = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+    signal: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    text: () => Promise<string>;
+}>;
+export type LookupFn = (hostname: string) => Promise<{
+    address: string;
+    family: number;
+}[]>;
+export declare class BlockedDestinationError extends Error {
+    constructor(host: string, address: string);
+}
+/**
+ * Webhook delivery transport. Unlike global fetch it judges the addresses a hostname resolves to, and
+ * the socket connects only to addresses that passed: the check runs inside the connection's own
+ * `lookup`, so there is no second resolution for DNS rebinding to answer differently. It never
+ * follows redirects — node's http client doesn't — so a 3xx comes back as a non-ok response instead of
+ * a hop to wherever the receiver points.
+ */
+export declare function createSafeFetch(opts?: {
+    lookup?: LookupFn;
+    isBlocked?: (ip: string) => boolean;
+}): FetchLike;
+//# sourceMappingURL=webhookTransport.d.ts.map

package/dist/lib/webhookTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhookTransport.d.ts","sourceRoot":"","sources":["../../src/lib/webhookTransport.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,KACzF,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAA;AAE1E,MAAM,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC,CAAA;AAO3F,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAI1C;AAID;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,QAAQ,CAAC;IAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAA;CAAO,GACpE,SAAS,CAmEX"}

package/dist/lib/webhookTransport.js

@@ -0,0 +1,86 @@
+import dns from 'dns';
+import http from 'http';
+import https from 'https';
+import net from 'net';
+import { isBlockedAddress } from './webhookUrl.js';
+const systemLookup = (hostname) => dns.promises.lookup(hostname, { all: true });
+// Only drained, never read for meaning, so a receiver can't make the relay buffer a large reply.
+const MAX_RESPONSE_BYTES = 64 * 1024;
+export class BlockedDestinationError extends Error {
+    constructor(host, address) {
+        super(`${host} resolves to ${address}, a loopback or metadata address`);
+        this.name = 'BlockedDestinationError';
+    }
+}
+/**
+ * Webhook delivery transport. Unlike global fetch it judges the addresses a hostname resolves to, and
+ * the socket connects only to addresses that passed: the check runs inside the connection's own
+ * `lookup`, so there is no second resolution for DNS rebinding to answer differently. It never
+ * follows redirects — node's http client doesn't — so a 3xx comes back as a non-ok response instead of
+ * a hop to wherever the receiver points.
+ */
+export function createSafeFetch(opts = {}) {
+    const resolve = opts.lookup ?? systemLookup;
+    const isBlocked = opts.isBlocked ?? isBlockedAddress;
+    const gatedLookup = (hostname, options, callback) => {
+        resolve(hostname).then((answers) => {
+            if (answers.length === 0)
+                return callback(Object.assign(new Error(`getaddrinfo ENOTFOUND ${hostname}`), { code: 'ENOTFOUND' }), '');
+            // Blocked answers are dropped rather than failing the name: macOS answers a LAN host's `.local`
+            // name with its fe80:: address next to its 192.168.x one, and that host is a webhook receiver this
+            // feature exists for. Dropping is safe because only what survives is handed to the socket.
+            const permitted = answers.filter((a) => !isBlocked(a.address));
+            if (permitted.length === 0)
+                return callback(new BlockedDestinationError(hostname, answers[0].address), '');
+            const wanted = options.family === 4 || options.family === 6 ? permitted.filter((a) => a.family === options.family) : permitted;
+            if (wanted.length === 0)
+                return callback(Object.assign(new Error(`getaddrinfo ENOTFOUND ${hostname}`), { code: 'ENOTFOUND' }), '');
+            if (options.all)
+                return callback(null, wanted);
+            callback(null, wanted[0].address, wanted[0].family);
+        }, (err) => callback(err, ''));
+    };
+    return (url, init) => new Promise((resolvePromise, reject) => {
+        const u = new URL(url);
+        const host = u.hostname.replace(/^\[|\]$/g, '');
+        // net.connect skips `lookup` for an IP literal, so a literal is judged here.
+        if (net.isIP(host) && isBlocked(host))
+            return reject(new BlockedDestinationError(host, host));
+        // A row written before registration refused these must not leak them as an Authorization header.
+        if (u.username || u.password)
+            return reject(new Error('webhook URL must not contain credentials'));
+        const client = u.protocol === 'https:' ? https : http;
+        const req = client.request(u, {
+            method: init.method,
+            // fetch sent a User-Agent and Accept on its own, and edge WAFs commonly refuse a request with no
+            // User-Agent at all.
+            headers: {
+                'User-Agent': 'tapflow-webhook',
+                Accept: '*/*',
+                ...init.headers,
+                'Content-Length': String(Buffer.byteLength(init.body)),
+            },
+            lookup: gatedLookup,
+            signal: init.signal,
+            // A pooled socket would skip the lookup; every delivery resolves and is judged afresh.
+            agent: false,
+        }, (res) => {
+            const chunks = [];
+            let size = 0;
+            res.on('data', (c) => {
+                if (size < MAX_RESPONSE_BYTES)
+                    chunks.push(c);
+                size += c.length;
+            });
+            res.on('error', reject);
+            res.on('end', () => {
+                const status = res.statusCode ?? 0;
+                const body = Buffer.concat(chunks).subarray(0, MAX_RESPONSE_BYTES).toString();
+                resolvePromise({ ok: status >= 200 && status < 300, status, text: async () => body });
+            });
+        });
+        req.on('error', reject);
+        req.end(init.body);
+    });
+}
+//# sourceMappingURL=webhookTransport.js.map

package/dist/lib/webhookTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhookTransport.js","sourceRoot":"","sources":["../../src/lib/webhookTransport.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,KAAK,CAAA;AACrB,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,GAAG,MAAM,KAAK,CAAA;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAUlD,MAAM,YAAY,GAAa,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;AAEzF,iGAAiG;AACjG,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAA;AAEpC,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,GAAG,IAAI,gBAAgB,OAAO,kCAAkC,CAAC,CAAA;QACvE,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AAID;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAmE,EAAE;IAErE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAA;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAA;IAEpD,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAE,OAA0B,EAAE,QAAwB,EAAQ,EAAE;QACnG,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpB,CAAC,OAAO,EAAE,EAAE;YACV,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;YACnI,gGAAgG;YAChG,mGAAmG;YACnG,2FAA2F;YAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;YAC9D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,IAAI,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;YAC1G,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC9H,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;YAClI,IAAI,OAAO,CAAC,GAAG;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACrD,CAAC,EACD,CAAC,GAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAClC,CAAA;IACH,CAAC,CAAA;IAED,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CACnB,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACtB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;QAC/C,6EAA6E;QAC7E,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,IAAI,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAC7F,iGAAiG;QACjG,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAA;QAElG,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;QACrD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CACxB,CAAC,EACD;YACE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,iGAAiG;YACjG,qBAAqB;YACrB,OAAO,EAAE;gBACP,YAAY,EAAE,iBAAiB;gBAC/B,MAAM,EAAE,KAAK;gBACb,GAAG,IAAI,CAAC,OAAO;gBACf,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACvD;YACD,MAAM,EAAE,WAA4C;YACpD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,uFAAuF;YACvF,KAAK,EAAE,KAAK;SACb,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;YACZ,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;gBAC3B,IAAI,IAAI,GAAG,kBAAkB;oBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBAC7C,IAAI,IAAI,CAAC,CAAC,MAAM,CAAA;YAClB,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACvB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAA;gBAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAA;gBAC7E,cAAc,CAAC,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;YACvF,CAAC,CAAC,CAAA;QACJ,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;AACN,CAAC"}

package/dist/lib/webhookUrl.d.ts

@@ -1,8 +1,14 @@
+/** True when an IP address is one a webhook must never be delivered to. */
+export declare function isBlockedAddress(ip: string): boolean;
 /**
  * Validate a webhook destination URL. Returns an error string, or null when allowed.
  * Blocks loopback and cloud-metadata addresses; private LAN ranges (10/172.16/192.168)
  * are intentionally allowed because self-hosted CI often lives there.
  *
+ * This is the registration-time check and sees only the URL, so a hostname is judged by its name.
+ * The address it resolves to is judged at delivery, by webhookTransport.ts — DNS can point a
+ * harmless-looking name at loopback, and can change after registration.
+ *
  * Lives in its own module so both webhooks.ts (delivery) and config.ts (config-file
  * endpoints) can validate without a circular import — webhooks.ts imports config.ts,
  * so config.ts can't import back into webhooks.ts.

package/dist/lib/webhookUrl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhookUrl.d.ts","sourceRoot":"","sources":["../../src/lib/webhookUrl.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA8B7D"}
+{"version":3,"file":"webhookUrl.d.ts","sourceRoot":"","sources":["../../src/lib/webhookUrl.ts"],"names":[],"mappings":"AAgCA,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwB7D"}

package/dist/lib/webhookUrl.js

@@ -1,8 +1,48 @@
+import net from 'net';
+// Loopback, unspecified, link-local (which holds the 169.254.169.254 metadata service) and AWS's IPv6
+// metadata address. Private LAN ranges (10/172.16/192.168, fc00::/7) are intentionally absent:
+// self-hosted CI usually lives there, and webhooks reaching it is the feature.
+const blocked = new net.BlockList();
+// BlockList matches the IPv4-mapped form (::ffff:127.0.0.1, ::ffff:7f00:1) of an IPv4 subnet by itself,
+// but no other IPv6 spelling that carries an IPv4 address. Those are added as subnets of their own:
+// IPv4-compatible ::a.b.c.d, IPv4-translated ::ffff:0:a.b.c.d (RFC 6052), the NAT64 well-known
+// prefix 64:ff9b::/96, and 6to4 2002:aabb:ccdd::/48 — a NAT64 or 6to4 gateway on the relay's network
+// hands such an address to the embedded IPv4 host. Not covered: the local-use NAT64 prefix
+// 64:ff9b:1::/48 (RFC 8215) and any prefix an operator picks. Only a gateway that operator configured
+// translates those, and an operator's own prefix cannot be known from here.
+function blockIPv4Subnet(address, prefix) {
+    blocked.addSubnet(address, prefix, 'ipv4');
+    const [a, b, c, d] = address.split('.').map(Number);
+    const hi = ((a << 8) | b).toString(16);
+    const lo = ((c << 8) | d).toString(16);
+    blocked.addSubnet(`::${hi}:${lo}`, 96 + prefix, 'ipv6');
+    blocked.addSubnet(`::ffff:0:${hi}:${lo}`, 96 + prefix, 'ipv6');
+    blocked.addSubnet(`64:ff9b::${hi}:${lo}`, 96 + prefix, 'ipv6');
+    blocked.addSubnet(`2002:${hi}:${lo}::`, 16 + prefix, 'ipv6');
+}
+blockIPv4Subnet('127.0.0.0', 8);
+blockIPv4Subnet('0.0.0.0', 8);
+blockIPv4Subnet('169.254.0.0', 16);
+blocked.addAddress('::1', 'ipv6');
+blocked.addAddress('::', 'ipv6');
+blocked.addSubnet('fe80::', 10, 'ipv6');
+blocked.addAddress('fd00:ec2::254', 'ipv6');
+/** True when an IP address is one a webhook must never be delivered to. */
+export function isBlockedAddress(ip) {
+    const family = net.isIP(ip);
+    if (family === 0)
+        return false;
+    return blocked.check(ip, family === 4 ? 'ipv4' : 'ipv6');
+}
 /**
  * Validate a webhook destination URL. Returns an error string, or null when allowed.
  * Blocks loopback and cloud-metadata addresses; private LAN ranges (10/172.16/192.168)
  * are intentionally allowed because self-hosted CI often lives there.
  *
+ * This is the registration-time check and sees only the URL, so a hostname is judged by its name.
+ * The address it resolves to is judged at delivery, by webhookTransport.ts — DNS can point a
+ * harmless-looking name at loopback, and can change after registration.
+ *
  * Lives in its own module so both webhooks.ts (delivery) and config.ts (config-file
  * endpoints) can validate without a circular import — webhooks.ts imports config.ts,
  * so config.ts can't import back into webhooks.ts.
@@ -18,21 +58,17 @@ export function validateWebhookUrl(raw) {
     if (u.protocol !== 'http:' && u.protocol !== 'https:') {
         return 'URL must use http or https';
     }
-    let host = u.hostname.toLowerCase().replace(/^\[|\]$/g, ''); // strip IPv6 brackets
-    // Node normalizes an IPv4-mapped IPv6 host (e.g. ::ffff:127.0.0.1) to a hex form
-    // like ::ffff:7f00:1, which would slip past the IPv4 checks below yet still connect
-    // to the embedded IPv4 — an SSRF bypass. Unwrap it back to dotted IPv4 first.
-    const mapped = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
-    if (mapped) {
-        const hi = parseInt(mapped[1], 16);
-        const lo = parseInt(mapped[2], 16);
-        host = [hi >> 8, hi & 0xff, lo >> 8, lo & 0xff].join('.');
+    // fetch refused these outright; node's http client would turn them into an Authorization header.
+    if (u.username || u.password) {
+        return 'URL must not contain credentials';
     }
-    if (host === 'localhost' ||
-        host === '0.0.0.0' ||
-        host === '::1' ||
-        host.startsWith('127.') ||
-        host.startsWith('169.254.')) {
+    // WHATWG URL has already canonicalized numeric IPv4 spellings (2130706433, 0x7f.1 → 127.0.0.1).
+    const host = u.hostname
+        .toLowerCase()
+        .replace(/^\[|\]$/g, '') // strip IPv6 brackets
+        .replace(/\.$/, ''); // a trailing dot names the same host
+    // RFC 6761 reserves localhost and every name under it for loopback, with no DNS involved.
+    if (host === 'localhost' || host.endsWith('.localhost') || isBlockedAddress(host)) {
         return 'URL host is not allowed (loopback or metadata address)';
     }
     return null;

package/dist/lib/webhookUrl.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhookUrl.js","sourceRoot":"","sources":["../../src/lib/webhookUrl.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,CAAM,CAAA;IACV,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,4BAA4B,CAAA;IACrC,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA,CAAC,sBAAsB;IAClF,iFAAiF;IACjF,oFAAoF;IACpF,8EAA8E;IAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAA;IACrE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAClC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAClC,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC3D,CAAC;IACD,IACE,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,SAAS;QAClB,IAAI,KAAK,KAAK;QACd,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QACvB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAC3B,CAAC;QACD,OAAO,wDAAwD,CAAA;IACjE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"webhookUrl.js","sourceRoot":"","sources":["../../src/lib/webhookUrl.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,KAAK,CAAA;AAErB,sGAAsG;AACtG,+FAA+F;AAC/F,+EAA+E;AAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,CAAA;AAEnC,wGAAwG;AACxG,oGAAoG;AACpG,+FAA+F;AAC/F,qGAAqG;AACrG,2FAA2F;AAC3F,sGAAsG;AACtG,4EAA4E;AAC5E,SAAS,eAAe,CAAC,OAAe,EAAE,MAAc;IACtD,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACnD,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,CAAC,CAAA;IACvD,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9D,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9D,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,CAAC,CAAA;AAC9D,CAAC;AACD,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;AAC/B,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;AAC7B,eAAe,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;AAClC,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AACjC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAChC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;AACvC,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;AAE3C,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC3B,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,CAAM,CAAA;IACV,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,4BAA4B,CAAA;IACrC,CAAC;IACD,iGAAiG;IACjG,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7B,OAAO,kCAAkC,CAAA;IAC3C,CAAC;IACD,gGAAgG;IAChG,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ;SACpB,WAAW,EAAE;SACb,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,sBAAsB;SAC9C,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA,CAAC,qCAAqC;IAC3D,0FAA0F;IAC1F,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClF,OAAO,wDAAwD,CAAA;IACjE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/lib/webhooks.d.ts

@@ -1,4 +1,6 @@
+import { type FetchLike } from './webhookTransport.js';
 export { validateWebhookUrl } from './webhookUrl.js';
+export type { FetchLike } from './webhookTransport.js';
 export declare const WEBHOOK_TIMEOUT_MS = 5000;
 export interface WebhookPayload {
     event: string;
@@ -10,16 +12,6 @@ export interface WebhookPayload {
     };
     changedAt: string;
 }
-export type FetchLike = (url: string, init: {
-    method: string;
-    headers: Record<string, string>;
-    body: string;
-    signal: AbortSignal;
-}) => Promise<{
-    ok: boolean;
-    status: number;
-    text: () => Promise<string>;
-}>;
 /** HMAC-SHA256 signature of the raw request body, formatted like EAS's expo-signature. */
 export declare function signPayload(secret: string, body: string): string;
 /**

package/dist/lib/webhooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/lib/webhooks.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAKpD,eAAO,MAAM,kBAAkB,OAAO,CAAA;AAEtC,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE;QACL,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;IACD,SAAS,EAAE,MAAM,CAAA;CAClB;AAGD,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,KACzF,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAA;AAE1E,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAOD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,SAAS,CAAA;CAAO,GACjC,OAAO,CAAC,IAAI,CAAC,CAiCf"}
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/lib/webhooks.ts"],"names":[],"mappings":"AAIA,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAIvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,YAAY,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAKtD,eAAO,MAAM,kBAAkB,OAAO,CAAA;AAEtC,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE;QACL,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;IACD,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAOD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,SAAS,CAAA;CAAO,GACjC,OAAO,CAAC,IAAI,CAAC,CAqCf"}

package/dist/lib/webhooks.js

@@ -2,6 +2,7 @@ import crypto from 'crypto';
 import { createLogger } from '@tapflowio/agent-core';
 import { getDb } from '../db.js';
 import { config } from './config.js';
+import { createSafeFetch } from './webhookTransport.js';
 // Re-exported so existing importers keep using webhooks.ts; the implementation lives
 // in webhookUrl.ts to avoid a circular import with config.ts (which also validates).
 export { validateWebhookUrl } from './webhookUrl.js';
@@ -29,7 +30,7 @@ export async function deliverWebhooks(payload, opts = {}) {
     if (rows.length === 0)
         return;
     const body = JSON.stringify(payload);
-    const fetchFn = opts.fetchFn ?? globalThis.fetch;
+    const fetchFn = opts.fetchFn ?? createSafeFetch();
     await Promise.allSettled(rows.map(async (ep) => {
         const headers = { 'Content-Type': 'application/json' };
         if (ep.secret)
@@ -41,10 +42,14 @@ export async function deliverWebhooks(payload, opts = {}) {
                 body,
                 signal: AbortSignal.timeout(WEBHOOK_TIMEOUT_MS),
             });
-            // Drain the body so undici releases the connection back to the pool.
+            // Drain the body so the connection is released.
             await res.text();
-            if (!res.ok)
+            if (res.status >= 300 && res.status < 400) {
+                logger.warn(`webhook POST ${ep.url} returned ${res.status} (redirects are not followed; register the final URL)`);
+            }
+            else if (!res.ok) {
                 logger.warn(`webhook POST ${ep.url} returned ${res.status}`);
+            }
         }
         catch (err) {
             logger.warn(`webhook POST ${ep.url} failed: ${String(err)}`);

package/dist/lib/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/lib/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,qFAAqF;AACrF,qFAAqF;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAEpD,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAA;AAE7C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAmBtC,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,IAAY;IACtD,OAAO,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACnF,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAuB,EACvB,OAAgC,EAAE;IAElC,MAAM,MAAM,GAAG,KAAK,EAAE;SACnB,OAAO,CAAC,6DAA6D,CAAC;SACtE,GAAG,EAAmB,CAAA;IACzB,oFAAoF;IACpF,MAAM,UAAU,GAAkB,MAAM,CAAC,QAAQ;SAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;IACzD,MAAM,IAAI,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC,CAAA;IACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAK,UAAU,CAAC,KAA8B,CAAA;IAE1E,MAAM,OAAO,CAAC,UAAU,CACtB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACpB,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAA;QAC9E,IAAI,EAAE,CAAC,MAAM;YAAE,OAAO,CAAC,qBAAqB,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC5E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI;gBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;aAChD,CAAC,CAAA;YACF,qEAAqE;YACrE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAChB,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,GAAG,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,GAAG,YAAY,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC,CAAC,CACH,CAAA;AACH,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/lib/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAkB,MAAM,uBAAuB,CAAA;AAEvE,qFAAqF;AACrF,qFAAqF;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAGpD,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAA;AAE7C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAatC,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,IAAY;IACtD,OAAO,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACnF,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAuB,EACvB,OAAgC,EAAE;IAElC,MAAM,MAAM,GAAG,KAAK,EAAE;SACnB,OAAO,CAAC,6DAA6D,CAAC;SACtE,GAAG,EAAmB,CAAA;IACzB,oFAAoF;IACpF,MAAM,UAAU,GAAkB,MAAM,CAAC,QAAQ;SAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;IACzD,MAAM,IAAI,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC,CAAA;IACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,EAAE,CAAA;IAEjD,MAAM,OAAO,CAAC,UAAU,CACtB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACpB,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAA;QAC9E,IAAI,EAAE,CAAC,MAAM;YAAE,OAAO,CAAC,qBAAqB,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC5E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI;gBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;aAChD,CAAC,CAAA;YACF,gDAAgD;YAChD,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAChB,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,GAAG,aAAa,GAAG,CAAC,MAAM,uDAAuD,CAAC,CAAA;YACnH,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,GAAG,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;YAC9D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,GAAG,YAAY,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC,CAAC,CACH,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tapflowio/relay",
-  "version": "0.26.1",
+  "version": "0.27.1",
   "description": "WebSocket relay server for tapflow — NAT traversal, session routing, JWT auth, bundled dashboard",
   "keywords": [
     "tapflow",
@@ -49,18 +49,18 @@
     "better-sqlite3": "^12.11.1",
     "busboy": "^1.6.0",
     "jsonwebtoken": "^9.0.3",
-    "nodemailer": "^9.1.1",
-    "ws": "^8.21.3",
+    "nodemailer": "^10.0.11",
+    "ws": "^8.22.0",
     "zod": "^4.6.5",
-    "@tapflowio/agent-core": "0.26.1",
-    "@tapflowio/protocol": "0.26.1"
+    "@tapflowio/agent-core": "0.27.1",
+    "@tapflowio/protocol": "0.27.1"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
     "@types/busboy": "^1.5.4",
     "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^22.20.4",
-    "@types/nodemailer": "^8.0.1",
+    "@types/nodemailer": "^8.0.2",
     "@types/ws": "^8.0.0",
     "typescript": "^5.0.0",
     "vitest": "^4.1.11",