@vorionsys/security 1.0.0

package/dist/intent/webhooks/dns-pinning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-pinning.js","sourceRoot":"","sources":["../../../src/intent/webhooks/dns-pinning.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;AAY1D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW,EACX,QAA4B;IAE5B,2EAA2E;IAC3E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,EACP,oHAAoH,CACrH,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAElC,gDAAgD;QAChD,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,4CAA4C;oBACpD,SAAS,EAAE,QAAQ;oBACnB,QAAQ;iBACT,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACxD,CAAC;QAED,qBAAqB;QACrB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC;QAEjC,yCAAyC;QACzC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,EAC5B,sEAAsE,CACvE,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,4DAA4D;gBACpE,SAAS;gBACT,QAAQ;aACT,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,wDAAwD,CAAC,CAAC;QAChG,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,wCAAwC;YAChD,QAAQ;SACT,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/intent/webhooks/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Webhook Module
+ *
+ * Re-exports from the refactored webhook submodules for backward compatibility.
+ *
+ * @packageDocumentation
+ */
+export * from './types.js';
+export { isPrivateIP, validateWebhookUrl, validateWebhookUrlAtRuntime, } from './ssrf-protection.js';
+export { SIGNATURE_HEADER, SIGNATURE_TIMESTAMP_HEADER, generateSignature, verifyWebhookSignature, } from './signature.js';
+export type { DnsConsistencyResult } from './dns-pinning.js';
+export { validateWebhookIpConsistency } from './dns-pinning.js';
+export { WebhookDeliveryRepository, createWebhookDeliveryRepository, calculateNextRetryTime, } from './delivery-repository.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/intent/webhooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/intent/webhooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,cAAc,YAAY,CAAC;AAG3B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,sBAAsB,GACvB,MAAM,0BAA0B,CAAC"}

package/dist/intent/webhooks/index.js

@@ -0,0 +1,17 @@
+/**
+ * Webhook Module
+ *
+ * Re-exports from the refactored webhook submodules for backward compatibility.
+ *
+ * @packageDocumentation
+ */
+// Types
+export * from './types.js';
+// SSRF Protection
+export { isPrivateIP, validateWebhookUrl, validateWebhookUrlAtRuntime, } from './ssrf-protection.js';
+// Signature utilities
+export { SIGNATURE_HEADER, SIGNATURE_TIMESTAMP_HEADER, generateSignature, verifyWebhookSignature, } from './signature.js';
+export { validateWebhookIpConsistency } from './dns-pinning.js';
+// Delivery Repository
+export { WebhookDeliveryRepository, createWebhookDeliveryRepository, calculateNextRetryTime, } from './delivery-repository.js';
+//# sourceMappingURL=index.js.map

package/dist/intent/webhooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/intent/webhooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,QAAQ;AACR,cAAc,YAAY,CAAC;AAE3B,kBAAkB;AAClB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAE9B,sBAAsB;AACtB,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAEhE,sBAAsB;AACtB,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,sBAAsB,GACvB,MAAM,0BAA0B,CAAC"}

package/dist/intent/webhooks/signature.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Webhook Signature Utilities
+ *
+ * HMAC-SHA256 signature generation and verification for webhook payloads.
+ * Includes timestamp validation to prevent replay attacks.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Header name for the HMAC signature
+ * Format: v1=<hmac-sha256-hex>
+ */
+export declare const SIGNATURE_HEADER = "X-Vorion-Signature";
+/**
+ * Header name for the signature timestamp (Unix seconds)
+ * Used to prevent replay attacks
+ */
+export declare const SIGNATURE_TIMESTAMP_HEADER = "X-Vorion-Timestamp";
+/**
+ * Generate HMAC-SHA256 signature for webhook payload.
+ *
+ * The signature is computed over a signed payload that combines the timestamp
+ * and the JSON payload body to prevent replay attacks.
+ *
+ * @param payload - The JSON payload string to sign
+ * @param secret - The webhook secret shared with the recipient
+ * @param timestamp - Unix timestamp in seconds when the request was generated
+ * @returns Versioned signature string in format "v1=<hmac-hex>"
+ */
+export declare function generateSignature(payload: string, secret: string, timestamp: number): string;
+/**
+ * Verify webhook signature for incoming requests.
+ *
+ * Security Features:
+ * 1. Timestamp validation to prevent replay attacks
+ * 2. Timing-safe comparison to prevent timing attacks
+ * 3. Signed payload covers both timestamp and content
+ *
+ * @param payload - The raw JSON payload string from the request body
+ * @param signature - The signature from the X-Vorion-Signature header
+ * @param secret - The webhook secret configured for this endpoint
+ * @param timestamp - The timestamp from the X-Vorion-Timestamp header (Unix seconds)
+ * @param toleranceSeconds - Maximum age of the request in seconds (default: 300 = 5 minutes)
+ * @returns true if the signature is valid and timestamp is within tolerance
+ */
+export declare function verifyWebhookSignature(payload: string, signature: string, secret: string, timestamp: number, toleranceSeconds?: number): boolean;
+//# sourceMappingURL=signature.d.ts.map

package/dist/intent/webhooks/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../../../src/intent/webhooks/signature.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAQ/D;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAM5F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,gBAAgB,SAAM,GACrB,OAAO,CA0BT"}

package/dist/intent/webhooks/signature.js

@@ -0,0 +1,80 @@
+/**
+ * Webhook Signature Utilities
+ *
+ * HMAC-SHA256 signature generation and verification for webhook payloads.
+ * Includes timestamp validation to prevent replay attacks.
+ *
+ * @packageDocumentation
+ */
+import { createHmac, timingSafeEqual } from 'node:crypto';
+/**
+ * Header name for the HMAC signature
+ * Format: v1=<hmac-sha256-hex>
+ */
+export const SIGNATURE_HEADER = 'X-Vorion-Signature';
+/**
+ * Header name for the signature timestamp (Unix seconds)
+ * Used to prevent replay attacks
+ */
+export const SIGNATURE_TIMESTAMP_HEADER = 'X-Vorion-Timestamp';
+/**
+ * Current signature version
+ * Allows for future signature algorithm upgrades
+ */
+const SIGNATURE_VERSION = 'v1';
+/**
+ * Generate HMAC-SHA256 signature for webhook payload.
+ *
+ * The signature is computed over a signed payload that combines the timestamp
+ * and the JSON payload body to prevent replay attacks.
+ *
+ * @param payload - The JSON payload string to sign
+ * @param secret - The webhook secret shared with the recipient
+ * @param timestamp - Unix timestamp in seconds when the request was generated
+ * @returns Versioned signature string in format "v1=<hmac-hex>"
+ */
+export function generateSignature(payload, secret, timestamp) {
+    const signedPayload = `${timestamp}.${payload}`;
+    const hmac = createHmac('sha256', secret)
+        .update(signedPayload)
+        .digest('hex');
+    return `${SIGNATURE_VERSION}=${hmac}`;
+}
+/**
+ * Verify webhook signature for incoming requests.
+ *
+ * Security Features:
+ * 1. Timestamp validation to prevent replay attacks
+ * 2. Timing-safe comparison to prevent timing attacks
+ * 3. Signed payload covers both timestamp and content
+ *
+ * @param payload - The raw JSON payload string from the request body
+ * @param signature - The signature from the X-Vorion-Signature header
+ * @param secret - The webhook secret configured for this endpoint
+ * @param timestamp - The timestamp from the X-Vorion-Timestamp header (Unix seconds)
+ * @param toleranceSeconds - Maximum age of the request in seconds (default: 300 = 5 minutes)
+ * @returns true if the signature is valid and timestamp is within tolerance
+ */
+export function verifyWebhookSignature(payload, signature, secret, timestamp, toleranceSeconds = 300) {
+    // Validate inputs
+    if (!payload || !signature || !secret || !timestamp) {
+        return false;
+    }
+    // Check timestamp is within tolerance (prevent replay attacks)
+    const now = Math.floor(Date.now() / 1000);
+    if (Math.abs(now - timestamp) > toleranceSeconds) {
+        return false;
+    }
+    // Generate expected signature
+    const expectedSignature = generateSignature(payload, secret, timestamp);
+    // Convert to buffers for timing-safe comparison
+    const signatureBuffer = Buffer.from(signature);
+    const expectedBuffer = Buffer.from(expectedSignature);
+    // Signatures must be same length for timing-safe comparison
+    if (signatureBuffer.length !== expectedBuffer.length) {
+        return false;
+    }
+    // Constant-time comparison to prevent timing attacks
+    return timingSafeEqual(signatureBuffer, expectedBuffer);
+}
+//# sourceMappingURL=signature.js.map

package/dist/intent/webhooks/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../../src/intent/webhooks/signature.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,MAAc,EAAE,SAAiB;IAClF,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SACtC,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,GAAG,iBAAiB,IAAI,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,SAAiB,EACjB,MAAc,EACd,SAAiB,EACjB,gBAAgB,GAAG,GAAG;IAEtB,kBAAkB;IAClB,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+DAA+D;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,gBAAgB,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8BAA8B;IAC9B,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAExE,gDAAgD;IAChD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAEtD,4DAA4D;IAC5D,IAAI,eAAe,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qDAAqD;IACrD,OAAO,eAAe,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;AAC1D,CAAC"}

package/dist/intent/webhooks/ssrf-protection.d.ts

@@ -0,0 +1,29 @@
+/**
+ * SSRF Protection for Webhooks
+ *
+ * Provides URL validation and private IP detection to prevent
+ * Server-Side Request Forgery attacks on webhook delivery.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Check if an IP address is in a private/internal range
+ */
+export declare function isPrivateIP(ip: string): boolean;
+/**
+ * Validate a webhook URL for SSRF protection
+ */
+export declare function validateWebhookUrl(url: string): Promise<{
+    valid: boolean;
+    reason?: string;
+}>;
+/**
+ * Validate URL at connection time (DNS resolution check)
+ * This performs actual DNS resolution to catch DNS rebinding attacks
+ */
+export declare function validateWebhookUrlAtRuntime(url: string): Promise<{
+    valid: boolean;
+    reason?: string;
+    resolvedIP?: string;
+}>;
+//# sourceMappingURL=ssrf-protection.d.ts.map

package/dist/intent/webhooks/ssrf-protection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-protection.d.ts","sourceRoot":"","sources":["../../../src/intent/webhooks/ssrf-protection.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;GAEG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CA+C/C;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAwElG;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAuChI"}

package/dist/intent/webhooks/ssrf-protection.js

@@ -0,0 +1,161 @@
+/**
+ * SSRF Protection for Webhooks
+ *
+ * Provides URL validation and private IP detection to prevent
+ * Server-Side Request Forgery attacks on webhook delivery.
+ *
+ * @packageDocumentation
+ */
+import { createLogger } from '../../common/logger.js';
+const logger = createLogger({ component: 'ssrf-protection' });
+/**
+ * Check if an IP address is in a private/internal range
+ */
+export function isPrivateIP(ip) {
+    // IPv4 private ranges
+    const ipv4PrivateRanges = [
+        /^127\./, // Loopback
+        /^10\./, // Class A private
+        /^172\.(1[6-9]|2[0-9]|3[0-1])\./, // Class B private
+        /^192\.168\./, // Class C private
+        /^169\.254\./, // Link-local
+        /^0\./, // Current network
+        /^100\.(6[4-9]|[7-9][0-9]|1[0-1][0-9]|12[0-7])\./, // Shared address space (CGNAT)
+        /^192\.0\.0\./, // IETF Protocol Assignments
+        /^192\.0\.2\./, // TEST-NET-1
+        /^198\.51\.100\./, // TEST-NET-2
+        /^203\.0\.113\./, // TEST-NET-3
+        /^224\./, // Multicast
+        /^240\./, // Reserved
+        /^255\.255\.255\.255$/, // Broadcast
+    ];
+    // IPv6 private/special ranges
+    const ipv6PrivateRanges = [
+        /^::1$/, // Loopback
+        /^fe80:/i, // Link-local
+        /^fc00:/i, // Unique local address
+        /^fd00:/i, // Unique local address
+        /^ff00:/i, // Multicast
+        /^::ffff:127\./i, // IPv4-mapped loopback
+        /^::ffff:10\./i, // IPv4-mapped Class A private
+        /^::ffff:172\.(1[6-9]|2[0-9]|3[0-1])\./i, // IPv4-mapped Class B private
+        /^::ffff:192\.168\./i, // IPv4-mapped Class C private
+    ];
+    // Check IPv4
+    for (const range of ipv4PrivateRanges) {
+        if (range.test(ip)) {
+            return true;
+        }
+    }
+    // Check IPv6
+    for (const range of ipv6PrivateRanges) {
+        if (range.test(ip)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Validate a webhook URL for SSRF protection
+ */
+export async function validateWebhookUrl(url) {
+    try {
+        const parsed = new URL(url);
+        // Only allow HTTPS (except for localhost in development)
+        if (parsed.protocol !== 'https:') {
+            // Allow HTTP only for localhost in non-production
+            const isDevelopment = process.env['VORION_ENV'] !== 'production';
+            const isLocalhost = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';
+            if (!(isDevelopment && isLocalhost)) {
+                return { valid: false, reason: 'Webhook URL must use HTTPS' };
+            }
+        }
+        // Block internal hostnames
+        const blockedHostnames = [
+            'localhost',
+            '127.0.0.1',
+            '0.0.0.0',
+            '::1',
+            'metadata.google.internal', // GCP metadata
+            '169.254.169.254', // AWS/Azure/GCP metadata
+            'metadata.internal',
+            'kubernetes.default',
+            'kubernetes.default.svc',
+        ];
+        if (blockedHostnames.includes(parsed.hostname.toLowerCase())) {
+            // Allow localhost only in development
+            const isDevelopment = process.env['VORION_ENV'] !== 'production';
+            const isLocalhost = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';
+            if (!(isDevelopment && isLocalhost)) {
+                return { valid: false, reason: 'Webhook URL hostname is blocked' };
+            }
+        }
+        // Block internal domains
+        const blockedPatterns = [
+            /\.internal$/i,
+            /\.local$/i,
+            /\.localhost$/i,
+            /\.svc$/i,
+            /\.cluster\.local$/i,
+            /\.corp$/i,
+            /\.lan$/i,
+            /\.home$/i,
+        ];
+        for (const pattern of blockedPatterns) {
+            if (pattern.test(parsed.hostname)) {
+                return { valid: false, reason: 'Webhook URL domain pattern is blocked' };
+            }
+        }
+        // Resolve hostname and check for private IPs
+        const ipMatch = parsed.hostname.match(/^(\d{1,3}\.){3}\d{1,3}$/);
+        if (ipMatch && isPrivateIP(parsed.hostname)) {
+            return { valid: false, reason: 'Webhook URL resolves to private IP address' };
+        }
+        // Block ports commonly used for internal services
+        const blockedPorts = ['22', '23', '25', '3306', '5432', '6379', '27017', '9200', '11211'];
+        if (parsed.port && blockedPorts.includes(parsed.port)) {
+            return { valid: false, reason: `Webhook URL port ${parsed.port} is blocked` };
+        }
+        return { valid: true };
+    }
+    catch {
+        return { valid: false, reason: 'Invalid webhook URL format' };
+    }
+}
+/**
+ * Validate URL at connection time (DNS resolution check)
+ * This performs actual DNS resolution to catch DNS rebinding attacks
+ */
+export async function validateWebhookUrlAtRuntime(url) {
+    const basicValidation = await validateWebhookUrl(url);
+    if (!basicValidation.valid) {
+        return basicValidation;
+    }
+    try {
+        const { hostname } = new URL(url);
+        // Skip DNS check for IP addresses (already validated)
+        if (/^(\d{1,3}\.){3}\d{1,3}$/.test(hostname)) {
+            return { valid: true, resolvedIP: hostname };
+        }
+        // Perform DNS lookup
+        const dns = await import('node:dns');
+        const { promisify } = await import('node:util');
+        const lookup = promisify(dns.lookup);
+        const result = await lookup(hostname);
+        const resolvedIP = result.address;
+        if (isPrivateIP(resolvedIP)) {
+            logger.warn({ url, resolvedIP }, 'SSRF attempt detected: webhook URL resolves to private IP');
+            return {
+                valid: false,
+                reason: 'Webhook URL resolves to private IP address',
+                resolvedIP,
+            };
+        }
+        return { valid: true, resolvedIP };
+    }
+    catch (error) {
+        logger.warn({ url, error }, 'Failed to resolve webhook URL');
+        return { valid: false, reason: 'Failed to resolve webhook URL hostname' };
+    }
+}
+//# sourceMappingURL=ssrf-protection.js.map

package/dist/intent/webhooks/ssrf-protection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-protection.js","sourceRoot":"","sources":["../../../src/intent/webhooks/ssrf-protection.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAE9D;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,sBAAsB;IACtB,MAAM,iBAAiB,GAAG;QACxB,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,kBAAkB;QAC3B,gCAAgC,EAAE,kBAAkB;QACpD,aAAa,EAAE,kBAAkB;QACjC,aAAa,EAAE,aAAa;QAC5B,MAAM,EAAE,kBAAkB;QAC1B,iDAAiD,EAAE,+BAA+B;QAClF,cAAc,EAAE,4BAA4B;QAC5C,cAAc,EAAE,aAAa;QAC7B,iBAAiB,EAAE,aAAa;QAChC,gBAAgB,EAAE,aAAa;QAC/B,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,WAAW;QACrB,sBAAsB,EAAE,YAAY;KACrC,CAAC;IAEF,8BAA8B;IAC9B,MAAM,iBAAiB,GAAG;QACxB,OAAO,EAAE,WAAW;QACpB,SAAS,EAAE,aAAa;QACxB,SAAS,EAAE,uBAAuB;QAClC,SAAS,EAAE,uBAAuB;QAClC,SAAS,EAAE,YAAY;QACvB,gBAAgB,EAAE,uBAAuB;QACzC,eAAe,EAAE,8BAA8B;QAC/C,wCAAwC,EAAE,8BAA8B;QACxE,qBAAqB,EAAE,8BAA8B;KACtD,CAAC;IAEF,aAAa;IACb,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,aAAa;IACb,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5B,yDAAyD;QACzD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,kDAAkD;YAClD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,YAAY,CAAC;YACjE,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;YAEvF,IAAI,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;YAChE,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,MAAM,gBAAgB,GAAG;YACvB,WAAW;YACX,WAAW;YACX,SAAS;YACT,KAAK;YACL,0BAA0B,EAAE,eAAe;YAC3C,iBAAiB,EAAE,yBAAyB;YAC5C,mBAAmB;YACnB,oBAAoB;YACpB,wBAAwB;SACzB,CAAC;QAEF,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC7D,sCAAsC;YACtC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,YAAY,CAAC;YACjE,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;YAEvF,IAAI,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;YACrE,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,MAAM,eAAe,GAAG;YACtB,cAAc;YACd,WAAW;YACX,eAAe;YACf,SAAS;YACT,oBAAoB;YACpB,UAAU;YACV,SAAS;YACT,UAAU;SACX,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;YAC3E,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjE,IAAI,OAAO,IAAI,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;QAChF,CAAC;QAED,kDAAkD;QAClD,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1F,IAAI,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAChF,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAW;IAC3D,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC3B,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAElC,sDAAsD;QACtD,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QAC/C,CAAC;QAED,qBAAqB;QACrB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC;QAElC,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,UAAU,EAAE,EACnB,2DAA2D,CAC5D,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,4CAA4C;gBACpD,UAAU;aACX,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC"}

package/dist/intent/webhooks/types.d.ts

@@ -0,0 +1,132 @@
+/**
+ * Webhook Types and Interfaces
+ *
+ * @packageDocumentation
+ */
+import type { ID } from '../../common/types.js';
+import type { EncryptedEnvelope } from '../../common/encryption.js';
+/**
+ * Webhook event types
+ */
+export type WebhookEventType = 'escalation.created' | 'escalation.approved' | 'escalation.rejected' | 'escalation.timeout' | 'intent.approved' | 'intent.denied' | 'intent.completed';
+/**
+ * Webhook payload structure
+ */
+export interface WebhookPayload {
+    id: string;
+    eventType: WebhookEventType;
+    timestamp: string;
+    tenantId: ID;
+    data: Record<string, unknown>;
+}
+/**
+ * Webhook configuration
+ */
+export interface WebhookConfig {
+    url: string;
+    secret?: string;
+    enabled: boolean;
+    events: WebhookEventType[];
+    retryAttempts?: number;
+    retryDelayMs?: number;
+    /**
+     * Resolved IP address stored at registration time for DNS pinning.
+     * Used to prevent DNS rebinding attacks where an attacker changes DNS
+     * after validation to point to internal IPs (e.g., 169.254.169.254).
+     */
+    resolvedIp?: string;
+}
+/**
+ * Webhook delivery result
+ */
+export interface WebhookDeliveryResult {
+    success: boolean;
+    statusCode?: number;
+    error?: string;
+    attempts: number;
+    deliveredAt?: string;
+    /** True if delivery was skipped due to open circuit breaker */
+    skippedByCircuitBreaker?: boolean;
+}
+/**
+ * Circuit breaker states for webhook delivery
+ * - closed: Normal operation, deliveries proceed
+ * - open: Circuit is tripped, deliveries are skipped
+ * - half_open: Testing if webhook is healthy again
+ */
+export type CircuitBreakerState = 'closed' | 'open' | 'half_open';
+/**
+ * Circuit breaker state stored in Redis
+ */
+export interface CircuitBreakerData {
+    /** Number of consecutive failures */
+    failures: number;
+    /** Timestamp when circuit was opened (milliseconds since epoch) */
+    openedAt: number | null;
+    /** Current state of the circuit */
+    state: CircuitBreakerState;
+}
+/**
+ * Internal interface for webhook config as stored in Redis.
+ * The secret field is encrypted using AES-256-GCM.
+ */
+export interface StoredWebhookConfig {
+    url: string;
+    /** Encrypted secret envelope, or undefined if no secret */
+    encryptedSecret?: EncryptedEnvelope;
+    enabled: boolean;
+    events: WebhookEventType[];
+    retryAttempts?: number;
+    retryDelayMs?: number;
+    resolvedIp?: string;
+}
+/**
+ * Webhook delivery status
+ */
+export type WebhookDeliveryStatus = 'pending' | 'delivered' | 'failed' | 'retrying';
+/**
+ * Webhook delivery record - represents a persistent delivery attempt
+ */
+export interface WebhookDelivery {
+    id: ID;
+    webhookId: ID;
+    tenantId: ID;
+    eventType: string;
+    payload: Record<string, unknown>;
+    status: WebhookDeliveryStatus;
+    attempts: number;
+    lastAttemptAt: string | null;
+    lastError: string | null;
+    nextRetryAt: string | null;
+    deliveredAt: string | null;
+    responseStatus: number | null;
+    responseBody: string | null;
+    createdAt: string;
+}
+/**
+ * Options for creating a new delivery record
+ */
+export interface CreateDeliveryOptions {
+    webhookId: ID;
+    tenantId: ID;
+    eventType: string;
+    payload: Record<string, unknown>;
+}
+/**
+ * Options for updating delivery status
+ */
+export interface UpdateDeliveryStatusOptions {
+    status: WebhookDeliveryStatus;
+    attempts?: number;
+    lastAttemptAt?: Date;
+    lastError?: string | null;
+    nextRetryAt?: Date | null;
+    deliveredAt?: Date | null;
+    responseStatus?: number | null;
+    responseBody?: string | null;
+}
+/**
+ * Numeric values for circuit breaker states (for metrics)
+ */
+export declare const CIRCUIT_STATE_VALUES: Record<CircuitBreakerState, number>;
+//# sourceMappingURL=types.d.ts.map

package/dist/intent/webhooks/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/intent/webhooks/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEpE;;GAEG;AACH,MAAM,MAAM,gBAAgB,GACxB,oBAAoB,GACpB,qBAAqB,GACrB,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,GACjB,eAAe,GACf,kBAAkB,CAAC;AAEvB;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,gBAAgB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,EAAE,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;AAElE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mCAAmC;IACnC,KAAK,EAAE,mBAAmB,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,eAAe,CAAC,EAAE,iBAAiB,CAAC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEpF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,EAAE,CAAC;IACP,SAAS,EAAE,EAAE,CAAC;IACd,QAAQ,EAAE,EAAE,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,EAAE,CAAC;IACd,QAAQ,EAAE,EAAE,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,qBAAqB,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAIpE,CAAC"}

package/dist/intent/webhooks/types.js

@@ -0,0 +1,14 @@
+/**
+ * Webhook Types and Interfaces
+ *
+ * @packageDocumentation
+ */
+/**
+ * Numeric values for circuit breaker states (for metrics)
+ */
+export const CIRCUIT_STATE_VALUES = {
+    closed: 0,
+    open: 1,
+    half_open: 2,
+};
+//# sourceMappingURL=types.js.map

package/dist/intent/webhooks/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/intent/webhooks/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA+IH;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwC;IACvE,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,SAAS,EAAE,CAAC;CACb,CAAC"}