@jini-ai/platform 0.6.10 → 0.6.12

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @jini-ai/platform
 
+## 0.6.12
+
+### Patch Changes
+
+- platform: `listProcessUsage()` RSS/CPU sampler for macOS, Windows and Linux; `@jini-ai/platform/secrets` adds `sealWithPassphrase`/`openWithPassphrase` (portable passphrase envelope for encrypted exports); internal mail engine contracts, provider-error redaction, domain reads and per-provider delivery wrapper (not yet exported).
+  - @jini-ai/core@0.6.12
+
+## 0.6.11
+
+### Patch Changes
+
+- Tool inputs apply a sole near-miss and declared input aliases; plugin-load outcomes are reported; `web_fetch` reads SVG/JS as text; `content_read` suggests its resource first; the browser falls back to system Chrome.
+- `./node` file-tree projects with revision undo and a React-free `./session`; `./html` gains a non-throwing region scan and pure region edits; async atomic writes in platform.
+- Updated dependencies
+- Updated dependencies
+  - @jini-ai/core@0.6.11
+
 ## 0.6.10
 
 ### Patch Changes

package/dist/fs/atomic-write.d.ts

@@ -109,7 +109,7 @@ export declare function writeJsonFileAtomic(required: Omit<AtomicWriteRequired,
  * Parent creation supports runtime-state and secret stores without another writer implementation. */
 export declare function writeFileAtomicAsync(required: {
     filePath: string;
-    content: string;
+    content: string | Uint8Array;
 }, options?: AtomicWriteOptions & {
     fs?: AtomicAsyncFilesystem;
     createParent?: boolean;

package/dist/fs/atomic-write.js

@@ -232,7 +232,7 @@ export async function writeFileAtomicAsync(required, options = {}) {
         closed = true;
         if (options.refuseSymlink)
             await ignoreMissingAsync(async () => assertNotSymlink(await filesystem.lstat(filePath), options));
-        await filesystem.rename(temporary, filePath);
+        await renameWithRetry({ filesystem, from: temporary, to: filePath });
         renamed = true;
         await syncDirectoryBestEffortAsync({ directory: path.dirname(filePath), open: (path, flags) => filesystem.open(path, flags) }, { platform });
     }
@@ -244,6 +244,23 @@ export async function writeFileAtomicAsync(required, options = {}) {
         throw error;
     }
 }
+/** Editors, antivirus and dev-server watchers can hold Windows destinations briefly.
+ * Retry only transient rename refusals; retain the same temporary file and fail after 5 tries.
+ * @complexity O(1) time/space, at most 150ms of backoff plus five filesystem calls.
+ */
+async function renameWithRetry({ filesystem, from, to }) {
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            await filesystem.rename(from, to);
+            return;
+        }
+        catch (error) {
+            if (attempt >= 4 || !hasErrorCode(error, ['EPERM', 'EBUSY']))
+                throw error;
+            await new Promise(resolve => setTimeout(resolve, 10 * 2 ** attempt));
+        }
+    }
+}
 /** Pretty JSON can retain a state-store's trailing newline without changing its serialization. */
 export async function writeJsonFileAtomicAsync(required, options = {}) {
     const { data, ...writer } = required;

package/dist/index.d.ts

@@ -36,8 +36,8 @@ export { createCommandInvocation, createPackageManagerInvocation } from "./comma
 export { omitEnvironmentKeys } from "./child-environment.js";
 export type { ResolveSystemProxyEnvOptions, SystemProxyCommandRunner } from "./proxy-env.js";
 export { mergeProxyAwareEnv, parseMacosScutilProxyOutput, parseWindowsInternetSettingsProxyOutput, resolveSystemProxyEnv, } from "./proxy-env.js";
-export type { ProcessSnapshot, ProcessStampContract, ProcessStampField, ProcessStampShape, SpawnProcessRequest, StampedProcessMatchCriteria, StopProcessesResult, } from "./process.js";
-export { collectProcessTreePids, createProcessStampArgs, isProcessAlive, listProcessSnapshots, matchesProcessStamp, matchesStampedProcess, readFlagValue, readProcessStamp, readProcessStampFromCommand, spawnBackgroundProcess, spawnLoggedProcess, stopProcesses, waitForProcessExit, } from "./process.js";
+export type { ProcessUsage, ProcessUsagePorts, ProcessUsageOptions, ProcessSnapshot, ProcessStampContract, ProcessStampField, ProcessStampShape, SpawnProcessRequest, StampedProcessMatchCriteria, StopProcessesResult, } from "./process.js";
+export { collectProcessTreePids, createProcessStampArgs, isProcessAlive, listProcessSnapshots, listProcessUsage, matchesProcessStamp, matchesStampedProcess, readFlagValue, readProcessStamp, readProcessStampFromCommand, spawnBackgroundProcess, spawnLoggedProcess, stopProcesses, waitForProcessExit, } from "./process.js";
 export type { AtomicCopyFileOptions, AtomicCopyFileResult, RemovePathBestEffortOptions, RemovePathBestEffortResult, } from "./fs.js";
 export { atomicCopyFile, pathContains, readLogTail, removePathBestEffort } from "./fs.js";
 export type { HttpWaitOptions } from "./http.js";

package/dist/index.js

@@ -34,7 +34,7 @@
 export { createCommandInvocation, createPackageManagerInvocation } from "./command.js";
 export { omitEnvironmentKeys } from "./child-environment.js";
 export { mergeProxyAwareEnv, parseMacosScutilProxyOutput, parseWindowsInternetSettingsProxyOutput, resolveSystemProxyEnv, } from "./proxy-env.js";
-export { collectProcessTreePids, createProcessStampArgs, isProcessAlive, listProcessSnapshots, matchesProcessStamp, matchesStampedProcess, readFlagValue, readProcessStamp, readProcessStampFromCommand, spawnBackgroundProcess, spawnLoggedProcess, stopProcesses, waitForProcessExit, } from "./process.js";
+export { collectProcessTreePids, createProcessStampArgs, isProcessAlive, listProcessSnapshots, listProcessUsage, matchesProcessStamp, matchesStampedProcess, readFlagValue, readProcessStamp, readProcessStampFromCommand, spawnBackgroundProcess, spawnLoggedProcess, stopProcesses, waitForProcessExit, } from "./process.js";
 export { atomicCopyFile, pathContains, readLogTail, removePathBestEffort } from "./fs.js";
 export { waitForHttpOk } from "./http.js";
 export { FETCH_TIMEOUT_MS, FetchTimeoutError, fetchWithTimeout } from "./fetch-with-timeout.js";

package/dist/mail/adapter-module.d.ts

@@ -15,6 +15,12 @@ export interface MailAdapterCreateContext {
 }
 /** Provider modules return the ordinary mail port; the shared contract names no vendor. */
 export interface MailAdapterModule {
+    /** Optional host-resolved account connection for domain reads only. The host validates the
+     * HTTPS origin and plugin ownership; this credential must never replace the sending key. */
+    readonly domainReadConnection?: {
+        readonly serverId: string;
+        readonly baseUrl: string;
+    };
     create(context: MailAdapterCreateContext): MailerPort;
 }
 //# sourceMappingURL=adapter-module.d.ts.map

package/dist/mail/delivery-wrapper.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Per-provider wrapper around the existing delivery policy. Test mode is read for every recipient;
+ * limiter and observation-warning state live for the lifetime of the wrapper factory.
+ * The purpose gate still wraps the whole mailer at composition; this policy sits inside it.
+ */
+import { type MailResendPolicy } from "./policy.js";
+import type { MailCapturePort, MailerPort, MailSendLedgerPort, MailSuppressionRepoPort } from "./ports.js";
+import type { MailProviderModule } from "./provider.js";
+import type { MailerSendOptions, MailerSendResult, MailTestModeSetting, OutboundEmail } from "./types.js";
+export interface MailPolicyWrapperDeps {
+    ledger: MailSendLedgerPort;
+    suppression: MailSuppressionRepoPort;
+    /** Fresh host settings read; a mode change applies to the next recipient. */
+    readTestMode: () => Promise<MailTestModeSetting>;
+    /** The host owns purpose/module-specific resend decisions. */
+    resendPolicy: (required: {
+        options: MailerSendOptions;
+    }) => MailResendPolicy;
+    observe?: (required: {
+        message: OutboundEmail;
+        options: MailerSendOptions;
+        providerId: string;
+        mode: MailTestModeSetting;
+        result: MailerSendResult;
+    }) => Promise<void>;
+}
+export interface MailPolicyWrapperOptions {
+    /** Capture without a sink refuses rather than sending. */
+    capture?: MailCapturePort;
+    /** Limiter clock in ms; defaults to Date.now. */
+    now?: () => number;
+    /** Fixed observation-failure diagnostic; logger faults cannot affect delivery. */
+    warn?: (line: string) => void;
+}
+export interface MailPolicyWrapperInput {
+    providerId: string;
+    provider: MailProviderModule;
+    mailer: MailerPort;
+}
+/**
+ * Build the wrapper applied to each resolved provider. Settings/policy failures propagate;
+ * observer and diagnostic failures preserve the exact policy result.
+ * @complexity One settings read plus policy round-trips per recipient; batches run sequentially.
+ */
+export declare function createMailPolicyWrapper(required: MailPolicyWrapperDeps, optional?: MailPolicyWrapperOptions): (required: MailPolicyWrapperInput, optional?: Record<string, never>) => MailerPort;
+//# sourceMappingURL=delivery-wrapper.d.ts.map

package/dist/mail/delivery-wrapper.js

@@ -0,0 +1,109 @@
+/**
+ * Per-provider wrapper around the existing delivery policy. Test mode is read for every recipient;
+ * limiter and observation-warning state live for the lifetime of the wrapper factory.
+ * The purpose gate still wraps the whole mailer at composition; this policy sits inside it.
+ */
+import { createMailDeliveryPolicy } from "./policy.js";
+import { createMailLaneLimiter } from "./rate-limit.js";
+const CAPTURE_UNAVAILABLE = { ok: false, retryable: false, errorCode: "MAIL_TEST_CAPTURE_UNAVAILABLE", message: "mail test mode is set to capture, but no capture store is available; nothing was sent" };
+/** Maps settings to policy test mode; null means capture was requested without a sink. */
+function toTestMode(required) {
+    const { setting, capture } = required;
+    if (setting.mode === "redirect")
+        return { kind: "redirect", to: { email: setting.to } };
+    if (setting.mode === "capture")
+        return capture ? { kind: "capture", sink: capture } : null;
+    return undefined;
+}
+/** Preserve serialization order and null-provider approvals: these bytes are caller-owned. */
+function approvalChanged(required) {
+    const { message, options, providerId, mailer, setting } = required;
+    const approval = options.mailTestApproval;
+    const actual = { providerId, driver: mailer.capabilities({}).driver, from: message.from, mode: setting.mode, effectiveRecipient: setting.mode === "redirect" ? setting.to : message.to.email };
+    return !!approval && JSON.stringify({ ...actual, providerId: approval.providerId === null ? null : providerId }) !== JSON.stringify(approval);
+}
+/** Delivery has already happened: activity storage and diagnostics must never alter its result. */
+function createResultObserver(required, optional) {
+    let observationWarned = false;
+    return async function observeResult(event) {
+        try {
+            await required.observe?.(event);
+        }
+        catch {
+            if (observationWarned)
+                return;
+            observationWarned = true;
+            try {
+                (optional.warn ?? console.warn)("[mail] activity observation failed");
+            }
+            catch { /* Diagnostics cannot reject a send. */ }
+        }
+    };
+}
+/** One token bucket per provider id, shared across all mailers from this factory. */
+function createLimiterLookup(optional) {
+    const limiters = new Map();
+    return function limiterFor({ provider, providerId }) {
+        const limit = provider.capabilities.rateLimit;
+        if (!limit)
+            return undefined;
+        const existing = limiters.get(providerId);
+        if (existing)
+            return existing;
+        const created = createMailLaneLimiter({ limit }, optional.now ? { now: optional.now } : {});
+        limiters.set(providerId, created);
+        return created;
+    };
+}
+/** Convert the host's complete options to the existing mail port without changing delivery policy. */
+function sendToMailer(required) {
+    const { idempotencyKey, workspaceId, sourceContext, ...optional } = required.options;
+    return required.mailer.send({ message: required.message, idempotencyKey, workspaceId, sourceContext }, optional);
+}
+/** Read → approve → capture check → policy → observe. Rejections propagate before observation. */
+function createRecipientDelivery(required) {
+    const { providerId, mailer, deps, optional, limiterFor, observeResult } = required;
+    return async function deliverOne({ message, options }) {
+        const setting = await deps.readTestMode();
+        if (approvalChanged({ message, options, providerId, mailer, setting })) {
+            return { ok: false, retryable: false, errorCode: "MAIL_TEST_APPROVAL_CHANGED", message: "Mail configuration changed. Prepare a new approval; nothing was sent." };
+        }
+        const testMode = toTestMode({ setting, ...(optional.capture ? { capture: optional.capture } : {}) });
+        if (testMode === null)
+            return CAPTURE_UNAVAILABLE;
+        const limiter = limiterFor(required);
+        const policy = createMailDeliveryPolicy({ providerId, ledger: deps.ledger, suppression: deps.suppression, supportsAttachments: mailer.capabilities({}).supportsAttachments }, { ...(limiter ? { limiter } : {}), ...(testMode ? { testMode } : {}), resendPolicy: () => deps.resendPolicy({ options }) });
+        const result = await policy.deliver({ message, options, send: (call) => sendToMailer({ message: call.message, options, mailer }) });
+        await observeResult({ message, options, providerId, mode: setting, result });
+        return result;
+    };
+}
+/** Build a provider mailer; batches retain ordered, per-recipient policy results and indexed keys. */
+function wrapProviderMailer(required) {
+    const deliverOne = createRecipientDelivery(required);
+    return {
+        capabilities: () => required.mailer.capabilities({}),
+        send: ({ message, ...delivery }, optional = {}) => deliverOne({ message, options: { ...delivery, ...optional } }),
+        async sendBatch({ messages, ...delivery }, optional = {}) {
+            const options = { ...delivery, ...optional };
+            // Per-recipient ledger rows need per-recipient dispatch. A shared key makes messages 2..n
+            // look like retries of 1. Await each recipient so partial results and effects stay ordered.
+            const results = [];
+            for (const [index, message] of messages.entries())
+                results.push(await deliverOne({ message, options: { ...options, idempotencyKey: `${options.idempotencyKey}:${index}` } }));
+            return results;
+        },
+    };
+}
+/**
+ * Build the wrapper applied to each resolved provider. Settings/policy failures propagate;
+ * observer and diagnostic failures preserve the exact policy result.
+ * @complexity One settings read plus policy round-trips per recipient; batches run sequentially.
+ */
+export function createMailPolicyWrapper(required, optional = {}) {
+    const state = { deps: required, optional, limiterFor: createLimiterLookup(optional), observeResult: createResultObserver(required, optional) };
+    return function wrap(input, _optional = {}) {
+        return wrapProviderMailer({ ...input, ...state });
+    };
+}
+//# sourceMappingURL=delivery-wrapper.js.map

package/dist/mail/domain-read.d.ts

@@ -0,0 +1,21 @@
+import type { ProviderResult } from "@jini-ai/core/provider-registry";
+import type { MailAdapterCredential } from "./adapter-module.js";
+import type { MailProviderCallContext } from "./provider.js";
+/** The active provider's plugin can supply a separate, read-capable account credential. */
+export type MailDomainReadCredentialPort = (required: {
+    id: string;
+}, options?: Record<string, never>) => Promise<MailAdapterCredential | null>;
+/** Only permission refusals justify asking for a more capable account connection. */
+export declare function isDomainReadPermissionRefused(required: {
+    result: ProviderResult<unknown>;
+}, _options?: Record<string, never>): boolean;
+/** Read with the sending key first, then the plugin's account key on a permission refusal.
+ * The replacement context is read-only and never reaches the sending mailer.
+ * @complexity At most two provider reads and one account-credential lookup. */
+export declare function readMailDomain<T>(required: {
+    ctx: MailProviderCallContext;
+    providerId: string;
+    read: (ctx: MailProviderCallContext) => Promise<ProviderResult<T>>;
+    resolveDomainReadCredential?: MailDomainReadCredentialPort;
+}, _options?: Record<string, never>): Promise<ProviderResult<T>>;
+//# sourceMappingURL=domain-read.d.ts.map

package/dist/mail/domain-read.js

@@ -0,0 +1,17 @@
+/** Only permission refusals justify asking for a more capable account connection. */
+export function isDomainReadPermissionRefused(required, _options = {}) {
+    const { result } = required;
+    return result.status === "rejected" && result.error.code === "forbidden";
+}
+/** Read with the sending key first, then the plugin's account key on a permission refusal.
+ * The replacement context is read-only and never reaches the sending mailer.
+ * @complexity At most two provider reads and one account-credential lookup. */
+export async function readMailDomain(required, _options = {}) {
+    const { ctx, providerId, read, resolveDomainReadCredential } = required;
+    const result = await read(ctx);
+    if (!isDomainReadPermissionRefused({ result }) || !resolveDomainReadCredential)
+        return result;
+    const credential = await resolveDomainReadCredential({ id: providerId }).catch(() => null);
+    return credential ? read({ ...ctx, credential }) : result;
+}
+//# sourceMappingURL=domain-read.js.map

package/dist/mail/engine-contracts.d.ts

@@ -0,0 +1,129 @@
+import type { MailAdapterCredential } from "./adapter-module.js";
+import type { MailDomainState, MailProviderCapabilities, MailProviderRegistry, MailProviderSetting, MailStatus } from "./provider.js";
+/** Metadata only: the host reads these facts before decrypting a credential. */
+export interface MailCredentialFact {
+    readonly id: string;
+    readonly label: string;
+    readonly vaultRevision?: number;
+    readonly updatedAt: string;
+}
+/** Credential presence exposed in configuration reports; never a token or username. */
+export interface MailProviderCredentialFacts {
+    readonly required: boolean;
+    readonly saved: boolean;
+    readonly label?: string;
+    readonly credentialId?: string;
+    readonly updatedAt?: string;
+}
+/** Declarative setup copy belongs to the host or plugin. */
+export interface MailProviderField {
+    readonly key: string;
+    readonly label: string;
+    readonly type: "secret" | "text" | "url" | "email";
+    readonly required: boolean;
+    readonly defaultValue?: string;
+    readonly placeholder?: string;
+    readonly help?: string;
+    readonly helpUrl?: string;
+}
+export interface MailProviderSetup {
+    readonly fields: readonly MailProviderField[];
+    readonly helpUrl?: string;
+}
+/** Safe host-supplied projection; configuration building and product copy stay in the host. */
+export interface MailProviderConfiguration {
+    readonly pluginId?: string;
+    readonly id: string;
+    readonly label: string;
+    readonly origin: "core" | "plugin";
+    readonly hosted: boolean;
+    readonly lanes: readonly ("transactional" | "bulk")[];
+    readonly capabilities: Pick<MailProviderCapabilities, "feedback" | "domainVerification" | "rateLimit">;
+    readonly credential: MailProviderCredentialFacts;
+    readonly selectable: boolean;
+    readonly refusal?: string;
+    readonly setup: MailProviderSetup;
+}
+export interface MailProviderConfigurationReport {
+    readonly setting: MailProviderSetting;
+    readonly providers: readonly MailProviderConfiguration[];
+    readonly refusals: readonly string[];
+}
+/** A provider failure safe for callers; contains neither credentials nor message bodies. */
+export interface MailProviderError {
+    readonly at: string;
+    readonly providerId: string | null;
+    readonly source: "send" | "check";
+    readonly code?: string;
+    readonly message: string;
+}
+/** Alias the provider's existing verdict vocabulary instead of defining another taxonomy. */
+export type ProviderDomainState = MailDomainState;
+/** Provider verification is independent of DNS answers and credential presence. */
+export type SenderDomainVerification = {
+    state: ProviderDomainState;
+    domain: string;
+    providerId: string;
+} | {
+    state: "no_sender";
+    providerId: string | null;
+} | {
+    state: "no_provider";
+    domain: string;
+    providerId: string | null;
+} | {
+    state: "unsupported";
+    domain: string;
+    providerId: string;
+} | {
+    state: "unknown";
+    domain?: string;
+    providerId: string | null;
+    reason: string;
+};
+export interface MailStatusReport extends MailStatus {
+    readonly senderDomainVerification?: SenderDomainVerification;
+    readonly providers: readonly MailProviderConfiguration[];
+    readonly refusals: readonly string[];
+    readonly checkedAt: string;
+    readonly lastError?: MailProviderError;
+}
+export type MailProviderCheck = {
+    ok: true;
+    label: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Host-built catalog: trusted loading, labels and setup copy remain outside the engine. */
+export interface MailProviderCatalog {
+    readonly registry: MailProviderRegistry;
+    readonly pluginIds: readonly string[];
+    readonly refusals: readonly string[];
+    credentialLabelFor(required: {
+        id: string;
+    }): string | undefined;
+    setupFor(required: {
+        id: string;
+    }): MailProviderSetup;
+}
+/** Host settings adapter; reads do not infer provider selection from saved credentials. */
+export interface MailProviderSettingPort {
+    read(required: Record<string, never>): Promise<MailProviderSetting | null>;
+    write(required: {
+        setting: MailProviderSetting;
+    }): Promise<void>;
+}
+/** Host owns metadata lookup and decryption. Metadata may fail independently of key resolution. */
+export interface MailCredentialPort {
+    readFact(required: {
+        label: string;
+    }): Promise<MailCredentialFact | undefined>;
+    resolve(required: {
+        catalog: MailProviderCatalog;
+        id: string;
+    }): Promise<MailAdapterCredential | null>;
+}
+/** Read-only provider verdict; implementations return unknown on lookup/provider failures. */
+export type SenderDomainVerificationPort = () => Promise<SenderDomainVerification>;
+//# sourceMappingURL=engine-contracts.d.ts.map

package/dist/mail/engine-contracts.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=engine-contracts.js.map

package/dist/mail/provider-error.d.ts

@@ -0,0 +1,18 @@
+/** Provider diagnostics cross the host boundary only after Jini's secret scrubber, then a cap.
+ * Exact credential values are supplied where available; redaction precedes truncation so a token
+ * crossing the length boundary cannot leave a readable prefix. Mail also masks URL token parameters
+ * (including fragments) through Jini's caller-owned patterns.
+ * @complexity O(n) in diagnostic text for a bounded set of credential values; output <= 1000 chars.
+ */
+export declare function safeMailProviderText({ text }: {
+    text: string;
+}, { secrets }?: {
+    secrets?: readonly string[];
+}): string;
+/** The credential's string values, so exact redaction also catches keys no pattern recognises.
+ * @complexity O(k) credential fields.
+ */
+export declare function credentialSecrets({ credential }: {
+    credential: object;
+}, _options?: Record<string, never>): string[];
+//# sourceMappingURL=provider-error.d.ts.map

package/dist/mail/provider-error.js

@@ -0,0 +1,24 @@
+import { redactSecrets } from "@jini-ai/core";
+/** Provider diagnostics cross the host boundary only after Jini's secret scrubber, then a cap.
+ * Exact credential values are supplied where available; redaction precedes truncation so a token
+ * crossing the length boundary cannot leave a readable prefix. Mail also masks URL token parameters
+ * (including fragments) through Jini's caller-owned patterns.
+ * @complexity O(n) in diagnostic text for a bounded set of credential values; output <= 1000 chars.
+ */
+export function safeMailProviderText({ text }, { secrets = [] } = {}) {
+    return redactSecrets({ input: text }, {
+        exactSecrets: secrets,
+        redactPii: false,
+        // Any secret-shaped URL parameter (token, key, secret, signature, code, password), not only `token=`:
+        // provider errors echo whole request URLs, and the parameter name varies by provider. The value runs
+        // to the next `&` so a trailing `#fragment` is masked with it.
+        extraPatterns: [{ name: "url_secret_param", regex: /[?&#;][\w.-]*(?:token|key|secret|signature|sig|code|password|pwd|auth)[\w.-]*=[^&\s"'<>]+/gi }],
+    }).slice(0, 1000);
+}
+/** The credential's string values, so exact redaction also catches keys no pattern recognises.
+ * @complexity O(k) credential fields.
+ */
+export function credentialSecrets({ credential }, _options = {}) {
+    return Object.values(credential).filter((value) => typeof value === "string");
+}
+//# sourceMappingURL=provider-error.js.map

package/dist/mail/purpose-scoped-mailer.d.ts

@@ -1,13 +1,24 @@
 /** Unknown and absent lanes require a durable notification path in production.
  * Local mode and explicit interactive sends proceed without that gate.
  */
-import type { MailerPort, DeliveryReadinessPolicy } from "./ports.js";
+import type { MailerPort, MailerSendOptions, DeliveryReadinessPolicy } from "./ports.js";
 type RuntimeMode = "production" | "local";
 export interface WrapMailerWithPurposeGateOptions {
     inner: MailerPort;
     mode: RuntimeMode;
     readiness: DeliveryReadinessPolicy;
 }
+export interface PurposeGateRequired {
+    mode: RuntimeMode;
+    readiness: DeliveryReadinessPolicy;
+    options: Pick<MailerSendOptions, "lane" | "sourceContext">;
+}
+/**
+ * Ask the delivery gate without delivering: unknown/absent lanes require durable readiness.
+ * Invalid modes throw TypeError; readiness errors propagate so callers can report unknown.
+ * @complexity O(1), with at most one call to the supplied readiness predicate.
+ */
+export declare function isPurposeGateOpen(required: PurposeGateRequired): boolean;
 /** Validates the mode at wrap time and gates notification sends/batches before delivery.
  * Unknown modes throw TypeError; only explicit local mode bypasses durable readiness.
  * @complexity O(1) policy work per send/batch, before delegating delivery.

package/dist/mail/purpose-scoped-mailer.js

@@ -9,6 +9,25 @@ function resolveLane(options) {
 function refusalError(capabilityName) {
     return new Error(`MAILER_SEND_REFUSED_NO_DURABLE_PATH: notification-lane mailer send refused for capability "${capabilityName}" — no durable outbox path registered`);
 }
+function validateMode(mode) {
+    if (mode !== "production" && mode !== "local") {
+        throw new TypeError('mailer mode must be "production" or "local"');
+    }
+}
+/**
+ * Ask the delivery gate without delivering: unknown/absent lanes require durable readiness.
+ * Invalid modes throw TypeError; readiness errors propagate so callers can report unknown.
+ * @complexity O(1), with at most one call to the supplied readiness predicate.
+ */
+export function isPurposeGateOpen(required) {
+    const { mode, readiness, options } = required;
+    validateMode(mode);
+    if (mode === "local")
+        return true;
+    if (resolveLane(options) !== "notification")
+        return true;
+    return readiness.isReady({ capabilityName: options.sourceContext?.module ?? "unknown" });
+}
 // Decorate the existing port rather than inventing a second delivery contract. The caller resolves
 // mode once at composition; never re-read the environment per send and change policy mid-process.
 /** Validates the mode at wrap time and gates notification sends/batches before delivery.
@@ -18,19 +37,11 @@ function refusalError(capabilityName) {
  */
 export function wrapMailerWithPurposeGate(options) {
     const { inner, mode, readiness } = options;
-    // Validate once at composition: typos must never silently disable durable delivery.
-    if (mode !== "production" && mode !== "local") {
-        throw new TypeError('mailer mode must be "production" or "local"');
-    }
+    // Validate at composition: typos must never silently disable durable delivery.
+    validateMode(mode);
     function checkGate(sendOptions) {
-        if (mode === "local")
-            return; // Local mode never refuses delivery.
-        const lane = resolveLane(sendOptions);
-        if (lane !== "notification")
-            return;
-        const capabilityName = sendOptions.sourceContext?.module ?? "unknown";
-        if (!readiness.isReady({ capabilityName })) {
-            throw refusalError(capabilityName);
+        if (!isPurposeGateOpen({ mode, readiness, options: sendOptions })) {
+            throw refusalError(sendOptions.sourceContext?.module ?? "unknown");
         }
     }
     return {

package/dist/mail/sender-domain-verification.d.ts

@@ -0,0 +1,40 @@
+import type { MailAdapterCredential } from "./adapter-module.js";
+import type { MailProviderModule } from "./provider.js";
+import type { HttpClientPort } from "@jini-ai/core/primitives";
+import type { SenderDomainVerificationPort } from "./engine-contracts.js";
+import { type MailDomainReadCredentialPort } from "./domain-read.js";
+/**
+ * @file The sender domain's state at the active transactional provider (its own `domainStatus`),
+ * for callers that need the provider verdict. Kept apart from the DNS
+ * check on purpose: a provider can report `pending` after every record resolves, and DNS can match
+ * while the provider was never asked. Each reason the provider cannot be asked is named apart, so
+ * "DNS verification unavailable for this provider" is a state of its own, not a failure.
+ */
+export interface SenderDomainVerificationDeps {
+    workspaceId: string;
+    /** The host's guarded outbound-HTTP seam, handed through to the provider. */
+    httpClient: HttpClientPort;
+    /** The installed providers, read fresh (host catalog). */
+    findProvider: (required: {
+        id: string;
+    }) => Promise<MailProviderModule | undefined>;
+    /** The provider's saved key, or `null` when none is saved (host credential resolver). */
+    resolveCredential: (required: {
+        id: string;
+    }) => Promise<MailAdapterCredential | null>;
+    resolveDomainReadCredential?: MailDomainReadCredentialPort;
+    /** The configured transactional lane. */
+    readProviderId: () => Promise<string | null>;
+    /** The configured sender address. */
+    readSenderEmail: () => Promise<string | undefined>;
+}
+/**
+ * Build the never-throwing provider-verdict port. Lookup failures become explicit verdicts;
+ * the deadline covers the whole check and clears its timer without cancelling provider work.
+ * @complexity Per call: two settings reads, one catalog load, at most two key lookups and two provider calls; O(1) space.
+ * @example createSenderDomainVerification(deps)()
+ */
+export declare function createSenderDomainVerification(required: SenderDomainVerificationDeps, options?: {
+    timeoutMs?: number;
+}): SenderDomainVerificationPort;
+//# sourceMappingURL=sender-domain-verification.d.ts.map

package/dist/mail/sender-domain-verification.js

@@ -0,0 +1,71 @@
+import { credentialSecrets, safeMailProviderText } from "./provider-error.js";
+import { isDomainReadPermissionRefused, readMailDomain } from "./domain-read.js";
+/** The configured sender's domain, lower-cased; undefined when unset or unreadable.
+ * @complexity O(n) time and space in the sender address length; one settings read. */
+async function senderDomain(deps) {
+    const email = await deps.readSenderEmail().catch(() => undefined);
+    return email?.split("@")[1]?.trim().toLowerCase() || undefined;
+}
+/** Read domain status, trying the plugin's account on permission refusal; failures stay `unknown`.
+ * @complexity At most two provider reads and two key lookups; diagnostic output is capped at 1000 characters. */
+async function askProvider(required) {
+    const { deps, provider, providerId, domain } = required;
+    const credential = await deps.resolveCredential({ id: providerId }).catch(() => null);
+    if (!credential)
+        return { state: "unknown", domain, providerId, reason: "the provider's key is not saved" };
+    // Same call context `resolve-mailer.ts` builds for a provider call: this workspace, live, its key.
+    const ctx = { workspaceId: deps.workspaceId, mode: "live", credential, httpClient: deps.httpClient };
+    const result = await readMailDomain({ ctx, providerId, read: context => provider.domainStatus(context, { domain }), ...(deps.resolveDomainReadCredential ? { resolveDomainReadCredential: deps.resolveDomainReadCredential } : {}) }).catch(() => null);
+    if (result?.status === "ok")
+        return { state: result.value.state, domain, providerId };
+    return { state: "unknown", domain, providerId, reason: providerReadFailureReason({ result, credential }) };
+}
+/** A refusal both keys hit is named plainly; any other provider answer keeps its code+message,
+ * secret-redacted (the sending key's exact values plus Jini's patterns) and capped.
+ * @complexity O(n) diagnostic text plus credential values; output is capped at 1000 characters.
+ */
+function providerReadFailureReason(required) {
+    const { result, credential } = required;
+    if (!result)
+        return "the provider did not answer the domain check";
+    if (isDomainReadPermissionRefused({ result }))
+        return "the sending key can't check domains, and no connected account could check it either";
+    return safeMailProviderText({ text: `${result.error.code}: ${result.error.message}` }, { secrets: credentialSecrets({ credential }) });
+}
+/** Resolve the configured sender against its provider, independently of DNS answers.
+ * Settings start together; catalog and credential reads follow in their original await order.
+ * @complexity Two settings reads, one catalog lookup and at most two provider reads; O(1) space.
+ */
+async function checkSenderDomain(deps) {
+    const [providerId, domain] = await Promise.all([deps.readProviderId().catch(() => null), senderDomain(deps)]);
+    if (!domain)
+        return { state: "no_sender", providerId };
+    const provider = providerId === null ? undefined : await deps.findProvider({ id: providerId }).catch(() => undefined);
+    if (!provider)
+        return { state: "no_provider", domain, providerId };
+    const id = providerId;
+    if (!provider.domainStatus)
+        return { state: "unsupported", domain, providerId: id };
+    return askProvider({ deps, provider, providerId: id, domain });
+}
+/**
+ * Build the never-throwing provider-verdict port. Lookup failures become explicit verdicts;
+ * the deadline covers the whole check and clears its timer without cancelling provider work.
+ * @complexity Per call: two settings reads, one catalog load, at most two key lookups and two provider calls; O(1) space.
+ * @example createSenderDomainVerification(deps)()
+ */
+export function createSenderDomainVerification(required, options = {}) {
+    return async () => {
+        let timer;
+        const timeout = new Promise(resolve => {
+            timer = setTimeout(() => resolve({ state: "unknown", providerId: null, reason: "provider_domain_check_timed_out" }), options.timeoutMs ?? 5_000);
+        });
+        try {
+            return await Promise.race([checkSenderDomain(required), timeout]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+}
+//# sourceMappingURL=sender-domain-verification.js.map

package/dist/mail/types.d.ts

@@ -39,6 +39,8 @@ export interface MailerSendOptions {
      * distinguish them. Unmapped/absent lanes resolve to notification rather than opening the
      * interactive bypass; the caller-facing facade applies that fail-closed allowlist. */
     lane?: "interactive" | "notification";
+    /** Configuration facts approved by the caller, rechecked immediately before delivery. */
+    mailTestApproval?: MailTestApproval;
 }
 /** Serializable outcomes cross the adapter ABI; live thrown objects cannot be carried as results. */
 export type MailerSendResult = {
@@ -89,4 +91,21 @@ export type MailerSendRequired = MailerDelivery & {
 export type MailerBatchRequired = MailerDelivery & {
     messages: readonly OutboundEmail[];
 };
+/** Persisted test-mode shape; capture availability is decided separately by the delivery wrapper. */
+export type MailTestModeSetting = {
+    mode: "off";
+} | {
+    mode: "redirect";
+    to: string;
+} | {
+    mode: "capture";
+};
+/** Preserve field order when constructing/comparing approvals: approval bytes are caller-owned. */
+export interface MailTestApproval {
+    providerId: string | null;
+    driver: string;
+    from: OutboundEmail["from"];
+    mode: MailTestModeSetting["mode"];
+    effectiveRecipient: string;
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/process.d.ts

@@ -7,11 +7,12 @@
  * Windows `Get-CimInstance`), walk a process tree, and stop a set of PIDs with
  * SIGTERM-then-SIGKILL escalation.
  *
- * Depends on the `command` module for invocation construction; keeps a private
- * `errorCode` copy so it owns no cross-module runtime surface.
+ * Uses `command` for invocation construction and `shell`'s direct buffered
+ * executor for bounded usage samples; keeps a private `errorCode` copy.
  */
 import { type ChildProcess } from "node:child_process";
 import { type CommandInvocationRequest } from "./command.js";
+import { execFileBuffered } from "./shell.js";
 export type ProcessStampShape = object;
 export type ProcessStampField<TStamp extends ProcessStampShape> = Extract<keyof TStamp, string>;
 export type ProcessStampContract<TStamp extends ProcessStampShape, TCriteria extends Partial<TStamp> = Partial<TStamp>> = {
@@ -32,6 +33,22 @@ export type ProcessSnapshot = {
     pid: number;
     ppid: number;
 };
+/** Display-only usage: RSS is bytes; CPU is cumulative seconds across all cores. */
+export type ProcessUsage = {
+    pid: number;
+    ppid: number;
+    rssBytes: number;
+    cpuSeconds: number;
+    /** Executable basename only; empty when the OS provides no name. */
+    name: string;
+};
+export type ProcessUsagePorts = {
+    platform?: NodeJS.Platform;
+    run?: typeof execFileBuffered;
+};
+export type ProcessUsageOptions = {
+    timeoutMs?: number;
+};
 export type StampedProcessMatchCriteria<TStamp extends ProcessStampShape> = Partial<TStamp>;
 export type StopProcessesResult = {
     alreadyStopped: boolean;
@@ -139,6 +156,14 @@ export declare function waitForProcessExit(pid: number | null | undefined, timeo
  * @returns The current process snapshots (empty on error).
  */
 export declare function listProcessSnapshots(): Promise<ProcessSnapshot[]>;
+/**
+ * Sample process RSS and cumulative CPU without reading command lines. Returns
+ * [] on command, timeout, buffer or JSON failure. RSS totals may count shared
+ * pages more than once; CPU percentages require deltas between samples.
+ * @param input - Optional host platform and bounded command-execution port.
+ * @param options - Execution timeout (default 5000ms); output is capped at 8MiB.
+ */
+export declare function listProcessUsage(input?: ProcessUsagePorts, options?: ProcessUsageOptions): Promise<ProcessUsage[]>;
 /**
  * Collect the transitive set of descendant PIDs (including the roots) from a
  * process snapshot list, returned sorted by numeric PID descending for deterministic ordering.

package/dist/process.js

@@ -7,12 +7,14 @@
  * Windows `Get-CimInstance`), walk a process tree, and stop a set of PIDs with
  * SIGTERM-then-SIGKILL escalation.
  *
- * Depends on the `command` module for invocation construction; keeps a private
- * `errorCode` copy so it owns no cross-module runtime surface.
+ * Uses `command` for invocation construction and `shell`'s direct buffered
+ * executor for bounded usage samples; keeps a private `errorCode` copy.
  */
 import { execFile, spawn } from "node:child_process";
+import { posix, win32 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { createCommandInvocation } from "./command.js";
+import { execFileBuffered } from "./shell.js";
 /** @internal Extract a Node `error.code` as a string, or `null` when the value carries no code. */
 function errorCode(error) {
     if (typeof error !== "object" || error == null || !("code" in error))
@@ -285,6 +287,87 @@ export async function listProcessSnapshots() {
         return [];
     }
 }
+/** @internal Decode ps cumulative CPU time, including macOS fractional seconds and days. */
+function parseCpuTime(value) {
+    const match = value.match(/^(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+(?:\.\d+)?)$/);
+    if (!match)
+        return NaN;
+    return Number(match[1] ?? 0) * 86400 + Number(match[2] ?? 0) * 3600
+        + Number(match[3]) * 60 + Number(match[4]);
+}
+/** @internal Reject incomplete metrics instead of presenting missing usage as zero. */
+function validProcessUsage(usage) {
+    const { pid, ppid, rssBytes, cpuSeconds } = usage;
+    return [pid, ppid].every(Number.isSafeInteger) && [rssBytes, cpuSeconds].every(Number.isFinite)
+        && [pid, ppid, rssBytes, cpuSeconds].every((value) => value >= 0);
+}
+/** @internal Read only comm, never args/command, so credentials cannot enter the result. */
+function parsePsUsage(stdout) {
+    return stdout.split(/\r?\n/).flatMap((line) => {
+        const match = line.match(/^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(\S.*)$/);
+        if (!match)
+            return [];
+        const usage = {
+            pid: Number(match[1]), ppid: Number(match[2]), rssBytes: Number(match[3]) * 1024,
+            cpuSeconds: parseCpuTime(match[4]), name: posix.basename(match[5].trim()),
+        };
+        return validProcessUsage(usage) ? [usage] : [];
+    });
+}
+/** @internal CIM serializes numeric fields as numbers or strings; null is not zero usage. */
+function cimNumber(value) {
+    if (typeof value === "number")
+        return value;
+    return typeof value === "string" && value.trim() ? Number(value) : NaN;
+}
+/** @internal Convert Windows 100ns CPU counters and retain nameless process rows. */
+function parseCimUsage(stdout) {
+    if (!stdout.trim())
+        return [];
+    const payload = JSON.parse(stdout);
+    return (Array.isArray(payload) ? payload : [payload]).flatMap((record) => {
+        if (!record || typeof record !== "object")
+            return [];
+        const row = record;
+        const usage = {
+            pid: cimNumber(row.ProcessId), ppid: cimNumber(row.ParentProcessId),
+            rssBytes: cimNumber(row.WorkingSetSize),
+            cpuSeconds: (cimNumber(row.UserModeTime) + cimNumber(row.KernelModeTime)) / 10_000_000,
+            name: typeof row.Name === "string" ? win32.basename(row.Name.trim()) : "",
+        };
+        return validProcessUsage(usage) ? [usage] : [];
+    });
+}
+/** @internal Fixed executable and argv, invoked directly without a command shell. */
+function processUsageCommand(windows) {
+    return windows
+        ? { command: "powershell.exe", args: ["-NoProfile", "-NonInteractive", "-Command",
+                "$ErrorActionPreference = 'Stop'; Get-CimInstance Win32_Process | Select-Object ProcessId, ParentProcessId, WorkingSetSize, UserModeTime, KernelModeTime, Name | ConvertTo-Json -Compress"] }
+        : { command: "ps", args: ["-axo", "pid=,ppid=,rss=,time=,comm="] };
+}
+/**
+ * Sample process RSS and cumulative CPU without reading command lines. Returns
+ * [] on command, timeout, buffer or JSON failure. RSS totals may count shared
+ * pages more than once; CPU percentages require deltas between samples.
+ * @param input - Optional host platform and bounded command-execution port.
+ * @param options - Execution timeout (default 5000ms); output is capped at 8MiB.
+ */
+export async function listProcessUsage(input = {}, options = {}) {
+    const windows = (input.platform ?? process.platform) === "win32";
+    const { command, args } = processUsageCommand(windows);
+    try {
+        const result = await (input.run ?? execFileBuffered)(command, args, {
+            encoding: "utf8", timeout: options.timeoutMs ?? 5000, maxBuffer: 8 * 1024 * 1024,
+            windowsHide: true,
+        });
+        if (!result.ok)
+            return [];
+        return windows ? parseCimUsage(result.stdout) : parsePsUsage(result.stdout);
+    }
+    catch {
+        return [];
+    }
+}
 /**
  * Collect the transitive set of descendant PIDs (including the roots) from a
  * process snapshot list, returned sorted by numeric PID descending for deterministic ordering.

package/dist/secrets/index.d.ts

@@ -1,6 +1,8 @@
 export type { SealedSecret } from "./types.js";
 export type { KeyringPort, SecretSealerPort } from "./ports.js";
 export { AesGcmSecretSealer } from "./secret-sealer.aesgcm.js";
+export { sealWithPassphrase, openWithPassphrase } from "./passphrase-envelope.js";
+export type { PassphraseEnvelopeOptions } from "./passphrase-envelope.js";
 export { EnvOrFileKeyring } from "./keyring.env.js";
 export type { EnvOrFileKeyringRequired, EnvOrFileKeyringOptions } from "./keyring.env.js";
 export type { RootKeyHandle as SiteKeyHandle } from "./ports.js";

package/dist/secrets/index.js

@@ -1,4 +1,5 @@
 export { AesGcmSecretSealer } from "./secret-sealer.aesgcm.js";
+export { sealWithPassphrase, openWithPassphrase } from "./passphrase-envelope.js";
 export { EnvOrFileKeyring } from "./keyring.env.js";
 export { FixedRootKeyKeyring as FixedSiteKeyKeyring } from "./keyring.env.js"; // site-key-legacy: implementation binding; remove on/after 2026-11-01
 export { UnusableRootKeyError as UnusableSiteKeyError } from "./keyring.env.js"; // site-key-legacy: implementation binding; remove on/after 2026-11-01

package/dist/secrets/passphrase-envelope.d.ts

@@ -0,0 +1,26 @@
+/** Optional randomness port for reproducible wire fixtures; production uses Node's CSPRNG. */
+export interface PassphraseEnvelopeOptions {
+    randomBytesFn?: (input: {
+        byteLength: number;
+    }) => Uint8Array;
+}
+/** Encrypts a UTF-8 payload (up to 16 MiB) into portable JSON, without host key material.
+ * Uses asynchronous scrypt and the existing sealer; performs no filesystem or environment I/O.
+ * Rejects invalid inputs or randomness. Passphrases are not normalized; only an empty one is refused,
+ * because sealing under "" turns the export into obfuscation (strength policy stays with the host).
+ * @complexity O(n + N*r*p) time and O(n + N*r) space for n payload bytes and bounded KDF costs.
+ */
+export declare function sealWithPassphrase({ payload, passphrase }: {
+    payload: string;
+    passphrase: string;
+}, options?: PassphraseEnvelopeOptions): Promise<string>;
+/** Authenticates a portable JSON envelope before returning its exact UTF-8 payload.
+ * Rejects malformed/oversized envelopes and unsupported KDF costs before deriving a key.
+ * Wrong passphrases and modified ciphertext/header reject without returning partial plaintext.
+ * @complexity O(n + N*r*p) time and O(n + N*r) space with fixed size and KDF ceilings.
+ */
+export declare function openWithPassphrase({ envelope, passphrase }: {
+    envelope: string;
+    passphrase: string;
+}, _options?: Record<string, never>): Promise<string>;
+//# sourceMappingURL=passphrase-envelope.d.ts.map

package/dist/secrets/passphrase-envelope.js

@@ -0,0 +1,125 @@
+import { randomBytes, scrypt } from "node:crypto";
+import { FixedRootKeyKeyring } from "./keyring.env.js";
+import { AesGcmSecretSealer } from "./secret-sealer.aesgcm.js";
+const FORMAT = "jini-passphrase-envelope";
+const HKDF_SALT = "jini-passphrase-envelope-v1";
+const MAX_PAYLOAD_BYTES = 16 * 1024 * 1024;
+const MAX_ENVELOPE_BYTES = 24 * 1024 * 1024;
+const SCRYPT_MAX_MEMORY = 128 * 1024 * 1024;
+/** Encrypts a UTF-8 payload (up to 16 MiB) into portable JSON, without host key material.
+ * Uses asynchronous scrypt and the existing sealer; performs no filesystem or environment I/O.
+ * Rejects invalid inputs or randomness. Passphrases are not normalized; only an empty one is refused,
+ * because sealing under "" turns the export into obfuscation (strength policy stays with the host).
+ * @complexity O(n + N*r*p) time and O(n + N*r) space for n payload bytes and bounded KDF costs.
+ */
+export async function sealWithPassphrase({ payload, passphrase }, options = {}) {
+    assertText(payload, MAX_PAYLOAD_BYTES);
+    assertText(passphrase, MAX_PAYLOAD_BYTES);
+    if (passphrase === "")
+        throw new TypeError("Passphrase envelope: passphrase must not be empty");
+    const randomBytesFn = options.randomBytesFn ?? (({ byteLength }) => randomBytes(byteLength));
+    const salt = Buffer.from(randomBytesFn({ byteLength: 16 }));
+    if (salt.length !== 16)
+        throw new TypeError("Passphrase envelope: salt must contain exactly 16 bytes");
+    const header = {
+        format: FORMAT, version: 1,
+        kdf: { name: "scrypt", salt: salt.toString("hex"), N: 32768, r: 8, p: 1 },
+    };
+    const keyring = await deriveKeyring({ passphrase, kdf: header.kdf });
+    const sealer = new AesGcmSecretSealer({ keyring }, { randomBytesFn });
+    const sealed = await sealer.seal({
+        plaintext: payload, key: await keyring.activeKey({}), aad: JSON.stringify(header),
+    });
+    return JSON.stringify({ header, sealed });
+}
+/** Authenticates a portable JSON envelope before returning its exact UTF-8 payload.
+ * Rejects malformed/oversized envelopes and unsupported KDF costs before deriving a key.
+ * Wrong passphrases and modified ciphertext/header reject without returning partial plaintext.
+ * @complexity O(n + N*r*p) time and O(n + N*r) space with fixed size and KDF ceilings.
+ */
+export async function openWithPassphrase({ envelope, passphrase }, _options = {}) {
+    assertText(passphrase, MAX_PAYLOAD_BYTES);
+    const parsed = parseEnvelope({ envelope });
+    const keyring = await deriveKeyring({ passphrase, kdf: parsed.header.kdf });
+    const sealer = new AesGcmSecretSealer({ keyring });
+    try {
+        return await sealer.open({ sealed: parsed.sealed }, { aad: JSON.stringify(parsed.header) });
+    }
+    catch {
+        // Never include the passphrase, payload, or crypto-library error context in recovery errors.
+        throw new Error("Passphrase envelope: authentication failed");
+    }
+}
+/** The format fixes r/p and accepts only bounded power-of-two N costs, preventing KDF DoS.
+ * The full header is AAD, including additional fields, so metadata cannot be silently modified.
+ */
+function parseEnvelope({ envelope }) {
+    assertText(envelope, MAX_ENVELOPE_BYTES);
+    let parsed;
+    try {
+        parsed = JSON.parse(envelope);
+    }
+    catch {
+        throw new TypeError("Passphrase envelope: invalid JSON");
+    }
+    if (!isRecord(parsed) || !isRecord(parsed.header))
+        throw invalidEnvelope();
+    if (parsed.header.format !== FORMAT || parsed.header.version !== 1)
+        throw invalidEnvelope();
+    assertKdf(parsed.header.kdf);
+    assertSealed(parsed.sealed);
+    return parsed;
+}
+function assertKdf(kdf) {
+    if (!isRecord(kdf))
+        throw invalidEnvelope();
+    if (kdf.name !== "scrypt" || typeof kdf.salt !== "string")
+        throw invalidEnvelope();
+    if (!/^[a-f0-9]{32}$/i.test(kdf.salt))
+        throw invalidEnvelope();
+    if (![16384, 32768, 65536].includes(kdf.N) || kdf.r !== 8 || kdf.p !== 1) {
+        throw invalidEnvelope();
+    }
+}
+function assertSealed(sealed) {
+    if (!isRecord(sealed))
+        throw invalidEnvelope();
+    if (sealed.alg !== "aes-256-gcm" || sealed.keyId !== "v1")
+        throw invalidEnvelope();
+    assertBase64(sealed.nonce, 12, 12);
+    assertBase64(sealed.ciphertext, 16, MAX_PAYLOAD_BYTES + 16);
+}
+function assertBase64(value, minBytes, maxBytes) {
+    if (typeof value !== "string")
+        throw invalidEnvelope();
+    const bytes = Buffer.from(value, "base64");
+    if (bytes.length < minBytes || bytes.length > maxBytes || bytes.toString("base64") !== value) {
+        throw invalidEnvelope();
+    }
+}
+function assertText(value, maxBytes) {
+    if (typeof value !== "string")
+        throw new TypeError("Passphrase envelope: expected a string");
+    if (Buffer.byteLength(value, "utf8") > maxBytes)
+        throw new RangeError("Passphrase envelope: size limit exceeded");
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function invalidEnvelope() {
+    return new TypeError("Passphrase envelope: invalid or unsupported envelope");
+}
+/** scrypt supplies only a temporary root; the existing keyring owns HKDF domain separation. */
+async function deriveKeyring({ passphrase, kdf }) {
+    const root = await new Promise((resolve, reject) => {
+        scrypt(passphrase, Buffer.from(kdf.salt, "hex"), 32, { N: kdf.N, r: kdf.r, p: kdf.p, maxmem: SCRYPT_MAX_MEMORY }, (error, key) => error ? reject(error) : resolve(key));
+    });
+    try {
+        return new FixedRootKeyKeyring({ hex: root.toString("hex"), hkdfSalt: HKDF_SALT });
+    }
+    finally {
+        // The keyring copies the derived bytes; do not retain the temporary scrypt buffer as well.
+        root.fill(0);
+    }
+}
+//# sourceMappingURL=passphrase-envelope.js.map

package/dist/web/web-page.d.ts

@@ -77,6 +77,8 @@ export interface WebFetchResult {
     meta: Record<string, string>;
     fetchedAt: string;
     rendered?: true;
+    /** Explains a browser-unavailable fallback; the returned content has not executed JavaScript. */
+    note?: string;
     data?: RenderedWebPage["data"];
     dataUnmatched?: RenderedWebPage["dataUnmatched"];
     dataTruncated?: boolean;
@@ -129,7 +131,8 @@ export interface WebFetchPorts {
  * @complexity O(url length + filter characters), with at most 20 filters of 500 characters each.
  */
 export declare function readWebFetchInput(input: Record<string, unknown>, _optional?: Record<string, never>): WebFetchInput;
-/** text/*, HTML/XHTML, XML (incl. RSS/Atom/sitemaps), JSON (incl. +json); a missing type is judged by the body. */
+/** text/*, JavaScript, SVG, HTML/XHTML, XML (incl. RSS/Atom/sitemaps), JSON (incl. +json);
+ * a missing type is judged by the body. */
 export declare function isAllowedContentType({ mediaType }: {
     mediaType: string;
 }, _optional?: Record<string, never>): boolean;

package/dist/web/web-page.js

@@ -108,11 +108,12 @@ function header(headers, name) {
             return value;
     return "";
 }
-/** text/*, HTML/XHTML, XML (incl. RSS/Atom/sitemaps), JSON (incl. +json); a missing type is judged by the body. */
+/** text/*, JavaScript, SVG, HTML/XHTML, XML (incl. RSS/Atom/sitemaps), JSON (incl. +json);
+ * a missing type is judged by the body. */
 export function isAllowedContentType({ mediaType }, _optional = {}) {
     if (mediaType === "" || mediaType.startsWith("text/"))
         return true;
-    return /^application\/(?:xhtml\+xml|xml|json|[\w.+-]+\+(?:xml|json))$/.test(mediaType);
+    return /^(?:image\/svg\+xml|application\/(?:javascript|ecmascript|xhtml\+xml|xml|json|[\w.+-]+\+(?:xml|json)))$/.test(mediaType);
 }
 function charsetOf(contentType, body, isHtml) {
     const fromHeader = /charset\s*=\s*"?([\w.:-]+)/i.exec(contentType)?.[1];
@@ -178,7 +179,7 @@ function render(format, body, isHtml, pageUrl, ports) {
 /** Renderer error codes whose meaning the model can act on; any other code falls through to transport mapping. */
 const RENDER_ERROR_MESSAGES = {
     WEB_RENDER_BUSY: "web_fetch_page: render capacity is busy; retry shortly.",
-    WEB_RENDER_UNAVAILABLE: "web_fetch_page: this deployment cannot render pages: its headless browser (Playwright Chromium) is not installed or failed to start.",
+    WEB_RENDER_UNAVAILABLE: "web_fetch_page: this deployment cannot render pages: its headless browser (Playwright Chromium or system Chrome) is not installed or failed to start.",
     WEB_RENDER_REFUSED: "web_fetch_page: the rendered page target is not a public internet address (including after redirects). Localhost, private-network and cloud-metadata addresses are refused.",
 };
 function errorCode({ error }, _optional = {}) {
@@ -268,11 +269,26 @@ async function enforceRateLimit({ ports, url, rateLimitScope, observe }) {
         throw new ToolInputError({ message: `web_fetch_page: too many fetches from ${host} in the last minute. Retry in ${verdict.retryAfterSeconds} seconds.` });
     }
 }
+/** Only an unavailable browser permits a guarded raw fetch; screenshots still require a browser.
+ * Reuses the call's deadline, rate-limit check and caller-safe error mapping.
+ * @complexity O(response bytes), with the same byte and redirect bounds as the ordinary fetch. */
 async function fetchRendered({ input, ports, url }, { signal, timeoutMs }) {
-    if (!ports.renderPage)
-        throw new ToolInputError({ message: "web_fetch_page: rendered pages are unavailable in this deployment." });
-    const page = await ports.renderPage({ input: { ...input, url: url.href } }, { signal, timeoutMs });
-    return projectRendered({ input, ports, url, page });
+    try {
+        if (!ports.renderPage)
+            throw Object.assign(new Error("Browser unavailable"), { code: "WEB_RENDER_UNAVAILABLE" });
+        const page = await ports.renderPage({ input: { ...input, url: url.href } }, { signal, timeoutMs });
+        return projectRendered({ input, ports, url, page });
+    }
+    catch (error) {
+        // Refusals, capacity, navigation and cancellation must never trigger a different network path.
+        if (signal.aborted || input.screenshot || errorCode({ error }) !== "WEB_RENDER_UNAVAILABLE")
+            throw error;
+        const response = await send(ports, url, signal, timeoutMs);
+        return {
+            ...project({ input, ports, url, response }),
+            note: "Browser unavailable; returned a guarded non-rendered fetch. JavaScript was not executed.",
+        };
+    }
 }
 function project({ input, ports, url, response }) {
     const contentType = header(response.headers, "content-type");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/platform",
-  "version": "0.6.10",
+  "version": "0.6.12",
   "description": "Generic OS/platform primitives: process exec and lifecycle, filesystem containment, HTTP readiness polling, toolchain discovery, blob storage, AWS signing, and an SSRF-safe asset cache.",
   "license": "Apache-2.0",
   "repository": {
@@ -200,7 +200,7 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@jini-ai/core": "^0.6.10"
+    "@jini-ai/core": "^0.6.12"
   },
   "publishConfig": {
     "access": "public",