@jini-ai/platform 0.6.15-rc.1 → 0.6.15

package/dist/fs/durable-json.js

@@ -43,8 +43,9 @@ export function createNodeDurableJsonPorts(_required) {
 export function createDurableJsonFile({ filePath, filesystem: fs, clock, sleep, process, random, report, notices }, { pollMs = 10, staleMs = 30000 } = {}) {
     if (!filePath)
         throw new TypeError("filePath is required");
-    if (!Number.isSafeInteger(pollMs) || pollMs <= 0 ||
-        ((!Number.isSafeInteger(staleMs) && staleMs !== Infinity) || staleMs <= 0))
+    const validPoll = Number.isSafeInteger(pollMs) && pollMs > 0;
+    const validStale = (Number.isSafeInteger(staleMs) || staleMs === Infinity) && staleMs > 0;
+    if (!validPoll || !validStale)
         throw new TypeError("lock intervals must be positive safe integers");
     // A synchronous read-modify-write normally takes milliseconds; five seconds allows contention
     // while refusing a wedged change. Short ten-millisecond polling fits those short critical sections.
@@ -139,31 +140,36 @@ export function salvageJsonPrefix({ text }, { maxAttempts = 1000 } = {}) {
 }
 // Cut only at completed strings/objects/arrays, sufficient for string-valued lists. Damage inside a
 // bare number/boolean falls back to the previous cut and loses that element rather than guessing it.
+const CLOSER_FOR = new Map([["{", "}"], ["[", "]"]]);
+const CLOSERS = new Set(["}", "]"]);
 function elementEnds(text) {
     const open = [];
     const cuts = [];
-    for (let index = 0; index < text.length; index += 1) {
+    let index = 0;
+    while (index < text.length) {
         const char = text[index];
+        const closer = CLOSER_FOR.get(char);
+        // An opener only records its closer; a completed string or container is a cut point.
+        if (closer !== undefined)
+            open.push(closer);
+        if (CLOSERS.has(char))
+            open.pop();
         if (char === '"')
             index = endOfString(text, index);
-        else if (char === "{" || char === "[") {
-            open.push(char === "{" ? "}" : "]");
-            continue;
-        }
-        else if (char === "}" || char === "]")
-            open.pop();
-        else
-            continue;
-        cuts.push({ end: index + 1, closers: [...open].reverse().join("") });
+        if (char === '"' || CLOSERS.has(char))
+            cuts.push({ end: index + 1, closers: [...open].reverse().join("") });
+        index += 1;
     }
     return cuts;
 }
 function endOfString(text, start) {
-    for (let index = start + 1; index < text.length; index += 1) {
-        if (text[index] === "\\")
-            index += 1;
-        else if (text[index] === '"')
+    let index = start + 1;
+    while (index < text.length) {
+        const char = text[index];
+        if (char === '"')
             return index;
+        // A backslash escapes the next character, whatever it is.
+        index += char === "\\" ? 2 : 1;
     }
     return text.length;
 }

package/dist/fs/errno.d.ts

@@ -0,0 +1,9 @@
+/** The string `code` of a Node system error (`ENOENT`, `EEXIST`, ...), or undefined for anything else.
+ *  @complexity O(1). */
+export declare function errorCodeOf(error: unknown): string | undefined;
+/** Returns `fallback` when `matches(error)` and rethrows anything else, so an expected failure reads
+ *  `catch (error) { return fallbackIf(error, isExpected, undefined); }`. @complexity O(matches). */
+export declare function fallbackIf<T>(error: unknown, matches: (error: unknown) => boolean, fallback: T): T;
+/** {@link fallbackIf} for a missing entry (ENOENT). @complexity O(1). */
+export declare function fallbackIfMissing<T>(error: unknown, fallback: T): T;
+//# sourceMappingURL=errno.d.ts.map

package/dist/fs/errno.js

@@ -0,0 +1,21 @@
+/** The string `code` of a Node system error (`ENOENT`, `EEXIST`, ...), or undefined for anything else.
+ *  @complexity O(1). */
+export function errorCodeOf(error) {
+    if (typeof error !== "object" || error === null || !("code" in error))
+        return undefined;
+    return typeof error.code === "string" ? error.code : undefined;
+}
+/** Returns `fallback` when `matches(error)` and rethrows anything else, so an expected failure reads
+ *  `catch (error) { return fallbackIf(error, isExpected, undefined); }`. @complexity O(matches). */
+export function fallbackIf(error, matches, fallback) {
+    if (matches(error))
+        return fallback;
+    throw error;
+}
+/** {@link fallbackIf} for a missing entry (ENOENT). @complexity O(1). */
+export function fallbackIfMissing(error, fallback) {
+    if (error.code === "ENOENT")
+        return fallback;
+    throw error;
+}
+//# sourceMappingURL=errno.js.map

package/dist/fs/file-lock.js

@@ -18,6 +18,7 @@ import { hostname as nodeHostname } from "node:os";
 import path from "node:path";
 import { createSystemClock } from "@jini-ai/core/primitives";
 import { defaultPlatformMessages } from "../messages.js";
+import { errorCodeOf, fallbackIf } from "./errno.js";
 export const DEFAULT_LOCK_TIMEOUT_MS = 15_000;
 export const DEFAULT_LOCK_STALE_AFTER_MS = 10_000;
 export class FileLockTimeoutError extends Error {
@@ -44,14 +45,14 @@ export class FileLockLostError extends Error {
 export function isContendedLockError({ code, platform }) {
     return code === "EEXIST" || (code === "EPERM" && platform === "win32");
 }
-function errorCode(error) {
-    return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" ? error.code : undefined;
+function isContended(error) {
+    return isContendedLockError({ code: errorCodeOf(error), platform: process.platform });
 }
 function isAbsentOrContended(error) {
-    const code = errorCode(error);
+    const code = errorCodeOf(error);
     return code === "ENOENT" || isContendedLockError({ code, platform: process.platform });
 }
-function rethrowUnlessMissing(error) { if (errorCode(error) !== "ENOENT")
+function rethrowUnlessMissing(error) { if (errorCodeOf(error) !== "ENOENT")
     throw error; }
 function validPid(pid) { return typeof pid === "number" && Number.isSafeInteger(pid) && pid > 0; }
 function isHolderRecord(value) {
@@ -77,7 +78,10 @@ export function isLockStale(required) {
     return (required.ownerAlive === false || required.nowMs - required.mtimeMs > required.staleMs) && required.observedInode === required.currentInode && required.observedDevice === required.currentDevice;
 }
 function intervalsValid({ timeoutMs, staleMs, pollMs }) {
-    return Number.isSafeInteger(timeoutMs) && timeoutMs >= 0 && (Number.isSafeInteger(staleMs) || staleMs === Infinity) && staleMs > 0 && Number.isSafeInteger(pollMs) && pollMs > 0;
+    const validTimeout = Number.isSafeInteger(timeoutMs) && timeoutMs >= 0;
+    const validStale = (Number.isSafeInteger(staleMs) || staleMs === Infinity) && staleMs > 0;
+    const validPoll = Number.isSafeInteger(pollMs) && pollMs > 0;
+    return validTimeout && validStale && validPoll;
 }
 function intervals(options) {
     const timeoutMs = options.timeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS, staleMs = options.staleMs ?? DEFAULT_LOCK_STALE_AFTER_MS, pollMs = options.pollMs ?? 10;
@@ -91,7 +95,7 @@ function defaultProcessPort() {
             return true;
         }
         catch (error) {
-            return errorCode(error) !== "ESRCH";
+            return errorCodeOf(error) !== "ESRCH";
         } } };
 }
 function settings(options) {
@@ -102,7 +106,9 @@ function settings(options) {
     return { ...checked, processPort, clock, monotonicMs, boot: processPort.bootIdentity?.(), hostname: (options.hostname ?? nodeHostname)(), token: (options.token ?? randomUUID)() };
 }
 function ownership(s, options) {
-    return options.format === "token" ? `${s.processPort.pid}:${s.token}${s.boot ? ":" + s.boot.id : ""}` : JSON.stringify({ pid: s.processPort.pid, hostname: s.hostname, token: s.token, acquiredAt: new Date(s.clock.nowMs()).toISOString(), ...(s.boot ? { bootId: s.boot.id } : {}) });
+    if (options.format === "token")
+        return `${s.processPort.pid}:${s.token}${s.boot ? ":" + s.boot.id : ""}`;
+    return JSON.stringify({ pid: s.processPort.pid, hostname: s.hostname, token: s.token, acquiredAt: new Date(s.clock.nowMs()).toISOString(), ...(s.boot ? { bootId: s.boot.id } : {}) });
 }
 function holderAlive(holder, s) {
     if (holder.hostname !== s.hostname)
@@ -155,9 +161,7 @@ function inspectSync(lockPath, filesystem) {
         descriptor = filesystem.openSync(lockPath, "r");
     }
     catch (error) {
-        if (isAbsentOrContended(error))
-            return undefined;
-        throw error;
+        return fallbackIf(error, isAbsentOrContended, undefined);
     }
     try {
         const info = filesystem.fstatSync(descriptor), raw = filesystem.readFileSync(descriptor, "utf8");
@@ -173,9 +177,7 @@ async function inspectAsync(lockPath, filesystem) {
         handle = await filesystem.open(lockPath, "r");
     }
     catch (error) {
-        if (isAbsentOrContended(error))
-            return undefined;
-        throw error;
+        return fallbackIf(error, isAbsentOrContended, undefined);
     }
     try {
         const info = await handle.stat(), raw = await handle.readFile("utf8");
@@ -203,9 +205,7 @@ function tryCreateSync(ctx) {
         descriptor = filesystem.openSync(lockPath, "wx", 0o600);
     }
     catch (error) {
-        if (!isContendedLockError({ code: errorCode(error), platform: process.platform }))
-            throw error;
-        return undefined;
+        return fallbackIf(error, isContended, undefined);
     }
     let identity;
     try {
@@ -300,9 +300,7 @@ async function tryCreateAsync(ctx) {
         handle = await ctx.filesystem.open(ctx.lockPath, "wx", 0o600);
     }
     catch (error) {
-        if (!isContendedLockError({ code: errorCode(error), platform: process.platform }))
-            throw error;
-        return undefined;
+        return fallbackIf(error, isContended, undefined);
     }
     let identity;
     try {

package/dist/fs/guarded-reader.js

@@ -1,6 +1,9 @@
 import nodeFs from "node:fs";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { trimCharsEnd } from "@jini-ai/core/primitives";
 import { FsFilePathError } from '@jini-ai/core/filesystem';
+/** Path segments that never add a component: empty (doubled separator), ".", and "..". */
+const NON_DESCENDING_SEGMENTS = new Set(["", ".", ".."]);
 export { FsFilePathError } from '@jini-ai/core/filesystem';
 /** Native filesystem adapter; callers can replace individual operations for a virtual filesystem. */
 export function createNodeGuardedReaderFilesystem(_required) { return nodeFs; }
@@ -34,8 +37,9 @@ export function createGuardedFileReader({ rootPath, denyRules, limits, filesyste
     // name::$DATA as name. Compare raw AND folded names: folding may add denials, never remove them,
     // and must not change the path actually opened.
     function foldFsNameForDenylist(name) {
-        const withoutStream = name.replace(/:[^]*$/, "");
-        const withoutTrailing = withoutStream.replace(/[. ]+$/, "");
+        const streamAt = name.indexOf(":");
+        const withoutStream = streamAt === -1 ? name : name.slice(0, streamAt);
+        const withoutTrailing = trimCharsEnd({ text: withoutStream, chars: ". " });
         return withoutTrailing.toLowerCase().toUpperCase().toLowerCase();
     }
     // Split both separator spellings even on a host whose native separator is '/', so deny checks
@@ -43,13 +47,11 @@ export function createGuardedFileReader({ rootPath, denyRules, limits, filesyste
     function normalizeFsRelativePath(relativePath) {
         const segments = [];
         for (const segment of relativePath.split(/[\\/]/)) {
-            if (segment === "" || segment === ".")
-                continue;
-            if (segment === "..") {
+            // Empty and "." segments are no-ops; ".." climbs one level; anything else descends.
+            if (segment === "..")
                 segments.pop();
-                continue;
-            }
-            segments.push(segment);
+            if (!NON_DESCENDING_SEGMENTS.has(segment))
+                segments.push(segment);
         }
         return segments.join("/");
     }
@@ -362,11 +364,15 @@ function descriptorOpenFlags({ filesystem, policy }) {
         throw new TypeError("exactMode must contain only permission bits (0o0000 through 0o7777)");
     return O_RDONLY | O_NOFOLLOW | O_NONBLOCK;
 }
+/** A safe, non-negative integer no larger than `max`; guards the size reported by an injected stat. */
+function isByteCountWithin(value, max) {
+    return Number.isSafeInteger(value) && value >= 0 && value <= max;
+}
 /** Both read paths validate the opened object, independent of earlier pathname metadata. */
 function assertDescriptorStat({ stat, relativePath, maxBytes }, { exactMode } = {}) {
     if (!stat.isFile())
         throw new FsFilePathError({ message: `path '${relativePath}' is not a regular file` });
-    if (!Number.isSafeInteger(stat.size) || stat.size < 0 || stat.size > maxBytes)
+    if (!isByteCountWithin(stat.size, maxBytes))
         throw new FsFilePathError({ message: `file '${relativePath}' exceeds the ${maxBytes}-byte descriptor limit` });
     // Include setuid/setgid/sticky: "exact" 0o600 must refuse a 0o4600 file.
     if (exactMode !== undefined && (stat.mode & 0o7777) !== exactMode)

package/dist/fs/user-data-directories.js

@@ -1,6 +1,8 @@
 import path from "node:path";
 import fs from "node:fs";
 import { execFileSync } from "node:child_process";
+import { windowsSystemTool } from "../windows-system-tools.js";
+import { fallbackIfMissing } from "./errno.js";
 /** Electron-free OS directory rules. Windows uses roaming app-data and the redirected Personal
  * known folder; Linux honors XDG user-dirs. No directories are created by this resolver.
  * env-paths is intentionally not used: its Windows data directory is LocalAppData/<app>/Data.
@@ -43,21 +45,17 @@ export function readOptionalText({ file }, _options = {}) {
         return fs.readFileSync(file, "utf8");
     }
     catch (error) {
-        if (error.code === "ENOENT")
-            return undefined;
-        throw error;
+        return fallbackIfMissing(error, undefined);
     }
 }
 function readWindowsDocuments() {
-    // eslint-disable-next-line sonarjs/no-os-command-from-path -- Fixed Windows registry utility/argv intentionally uses the desktop operator's trusted PATH, not request input.
-    const output = execFileSync("reg.exe", ["query", "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", "/v", "Personal"], { encoding: "utf8", timeout: 3000, windowsHide: true });
+    const output = execFileSync(windowsSystemTool({ relativePath: ["reg.exe"] }), ["query", "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", "/v", "Personal"], { encoding: "utf8", timeout: 3000, windowsHide: true });
     return /Personal\s+REG_(?:EXPAND_)?SZ\s+(.+)/.exec(output)?.[1]?.trim();
 }
 /** OneDrive publishes account mount paths in HKCU; absent accounts are a normal empty result. */
 export function readWindowsOneDriveRoots(_required, _options = {}) {
     try {
-        // eslint-disable-next-line sonarjs/no-os-command-from-path -- Fixed Windows registry utility/argv intentionally uses the desktop operator's trusted PATH, not request input.
-        const output = execFileSync("reg.exe", ["query", "HKCU\\Software\\Microsoft\\OneDrive\\Accounts", "/s", "/v", "UserFolder"], { encoding: "utf8", timeout: 3000, windowsHide: true });
+        const output = execFileSync(windowsSystemTool({ relativePath: ["reg.exe"] }), ["query", "HKCU\\Software\\Microsoft\\OneDrive\\Accounts", "/s", "/v", "UserFolder"], { encoding: "utf8", timeout: 3000, windowsHide: true });
         return [...output.matchAll(/UserFolder\s+REG_(?:EXPAND_)?SZ\s+([^\r\n]+)/g)].map((match) => match[1].trim());
     }
     catch (error) {

package/dist/fs.js

@@ -8,6 +8,7 @@
  * Keeps private `errorCode` / `errorMessage` copies so it owns no cross-module
  * runtime surface.
  */
+import { randomUUID } from "node:crypto";
 import { copyFile, mkdir, readFile, rename, rm, stat } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 /** @internal Extract a Node `error.code` as a string, or `null` when the value carries no code. */
@@ -72,7 +73,7 @@ export async function atomicCopyFile(sourcePath, destinationPath, options = {})
     if (existing != null && options.overwrite !== true) {
         throw destinationExistsError(destination);
     }
-    const tempPath = join(destinationDir, `.${basename(destination)}.${process.pid}.${Date.now().toString(36)}.${Math.random().toString(36).slice(2)}.tmp`);
+    const tempPath = join(destinationDir, `.${basename(destination)}.${process.pid}.${Date.now().toString(36)}.${randomUUID()}.tmp`);
     try {
         await copyFile(source, tempPath);
         // Rename replaces the old file atomically. Removing it first opens a

package/dist/http/guarded/client.js

@@ -1,6 +1,7 @@
 // Policy refusals use EgressRefusedError; DNS, connection and transport failures retain their
 // own errors because they are operational failures, not decisions that a different URL fixes.
 import { classifyIpAddress } from "../../net/address.js";
+import { effectivePort } from "../../core/effective-port.js";
 import { FetchTimeoutError } from "../../fetch-with-timeout.js";
 import { isIP } from "node:net";
 import { EgressRefusedError } from "./errors.js";
@@ -55,7 +56,7 @@ function assertNoPrivateAddress(hostname, addresses) {
 }
 async function resolvePinnedPeer(url, policy, dns) {
     assertAllowedTarget(url, policy);
-    const port = url.port ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
+    const port = effectivePort({ url });
     const hostname = stripIpv6Brackets(url.hostname);
     const isDevAllowlisted = policy.devHostAllowlist.includes(hostname);
     const addresses = await resolveHostAddresses(url.hostname, dns);

package/dist/http.js

@@ -43,6 +43,7 @@ export async function waitForHttpOk(url, { timeoutMs = 20000 } = {}) {
         }
         await sleep(150);
     }
-    throw new Error(`timed out waiting for ${url}${lastError ? ` (${lastError.message})` : ""}`);
+    const detail = lastError ? ` (${lastError.message})` : "";
+    throw new Error(`timed out waiting for ${url}${detail}`);
 }
 //# sourceMappingURL=http.js.map

package/dist/index.d.ts

@@ -42,8 +42,8 @@ export type { AtomicCopyFileOptions, AtomicCopyFileResult, RemovePathBestEffortO
 export { atomicCopyFile, pathContains, readLogTail, removePathBestEffort } from "./fs.js";
 export type { HttpWaitOptions } from "./http.js";
 export { waitForHttpOk } from "./http.js";
-export type { FetchWithTimeoutOptions } from "./fetch-with-timeout.js";
-export { FETCH_TIMEOUT_MS, FetchTimeoutError, fetchWithTimeout } from "./fetch-with-timeout.js";
+export type { DeadlineSignalOptions, FetchWithTimeoutOptions } from "./fetch-with-timeout.js";
+export { FETCH_TIMEOUT_MS, FetchTimeoutError, ResponseLimitExceededError, createDeadlineSignal, fetchWithTimeout } from "./fetch-with-timeout.js";
 export type { WellKnownUserToolchainOptions } from "./toolchain.js";
 export { wellKnownUserToolchainBins } from "./toolchain.js";
 export type { BufferedCommandResult } from "./shell.js";

package/dist/index.js

@@ -37,7 +37,7 @@ export { mergeProxyAwareEnv, parseMacosScutilProxyOutput, parseWindowsInternetSe
 export { collectProcessTreePids, createProcessStampArgs, isProcessAlive, listProcessSnapshots, listProcessUsage, matchesProcessStamp, matchesStampedProcess, readFlagValue, readProcessStamp, readProcessStampFromCommand, spawnBackgroundProcess, spawnLoggedProcess, stopProcesses, waitForProcessExit, } from "./process.js";
 export { atomicCopyFile, pathContains, readLogTail, removePathBestEffort } from "./fs.js";
 export { waitForHttpOk } from "./http.js";
-export { FETCH_TIMEOUT_MS, FetchTimeoutError, fetchWithTimeout } from "./fetch-with-timeout.js";
+export { FETCH_TIMEOUT_MS, FetchTimeoutError, ResponseLimitExceededError, createDeadlineSignal, fetchWithTimeout } from "./fetch-with-timeout.js";
 export { wellKnownUserToolchainBins } from "./toolchain.js";
 export { execCommandViaLoginShell, execFileBuffered } from "./shell.js";
 export { AssetCacheError, assertSafePublicUrl, assetCacheKey, assetCacheRewriteUrl, createAssetCache, createAssetCacheDispatcher, createValidatingLookup, isCacheableExternalUrl, } from "./asset-cache.js";

package/dist/mail/adapter-module.d.ts

@@ -12,7 +12,25 @@ export interface MailAdapterKit {
 export interface MailAdapterCreateContext {
     readonly credential: MailAdapterCredential;
     readonly kit: MailAdapterKit;
+    /** Sample at the point of use. Hosts normalize this to the real clock when omitted. */
+    readonly now?: () => Date;
+    /** Per-install configuration; only the provider module owns its schema and validation. */
+    readonly settings?: unknown;
 }
+/**
+ * Normalize a host's module context without inspecting settings or replacing its guarded ports.
+ * The optional fields on {@link MailAdapterCreateContext} preserve legacy direct create calls;
+ * hosts use this boundary to supply both defaults before invoking a provider module.
+ * @param required Sending credential and guarded adapter kit, passed through unchanged.
+ * @param optional Clock and opaque per-install settings. Only undefined selects a default.
+ * @returns A context with a live clock and settings (a fresh empty object when omitted).
+ * @complexity O(1) time and space; does not sample the clock or perform I/O.
+ * @example provider.create(createMailAdapterContext({ credential, kit }, { now, settings }));
+ */
+export declare function createMailAdapterContext(required: {
+    credential: MailAdapterCredential;
+    kit: MailAdapterKit;
+}, { now, settings }?: Pick<MailAdapterCreateContext, "now" | "settings">): Required<MailAdapterCreateContext>;
 /** Provider modules return the ordinary mail port; the shared contract names no vendor. */
 export interface MailAdapterModule {
     /** Optional host-resolved account connection for domain reads only. The host validates the

package/dist/mail/adapter-module.js

@@ -1,2 +1,14 @@
-export {};
+/**
+ * Normalize a host's module context without inspecting settings or replacing its guarded ports.
+ * The optional fields on {@link MailAdapterCreateContext} preserve legacy direct create calls;
+ * hosts use this boundary to supply both defaults before invoking a provider module.
+ * @param required Sending credential and guarded adapter kit, passed through unchanged.
+ * @param optional Clock and opaque per-install settings. Only undefined selects a default.
+ * @returns A context with a live clock and settings (a fresh empty object when omitted).
+ * @complexity O(1) time and space; does not sample the clock or perform I/O.
+ * @example provider.create(createMailAdapterContext({ credential, kit }, { now, settings }));
+ */
+export function createMailAdapterContext(required, { now = () => new Date(), settings = {} } = {}) {
+    return { credential: required.credential, kit: required.kit, now, settings };
+}
 //# sourceMappingURL=adapter-module.js.map

package/dist/mail/builtin-providers.js

@@ -6,6 +6,7 @@
  * `hosted: false`, so it can never make a site look configured.
  */
 import { nowIso } from "@jini-ai/core/primitives";
+import { effectivePort } from "../core/effective-port.js";
 import { SmtpMailerAdapter } from "./smtp.js";
 /**
  * SMTP endpoint packed into a credential `baseUrl` (`https://host:port`); 443/465 = implicit TLS.
@@ -13,7 +14,7 @@ import { SmtpMailerAdapter } from "./smtp.js";
  */
 export function parseSmtpEndpoint({ baseUrl }) {
     const url = new URL(baseUrl);
-    const port = url.port ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
+    const port = effectivePort({ url });
     return { host: url.hostname, port, secure: port === 443 || port === 465 };
 }
 export function createSmtpMailProvider(required) {
@@ -39,7 +40,8 @@ export function createConsoleMailProvider(required, optional = {}) {
             // The body is the point of a local mailer: a sign-in or confirmation link must be usable from the
             // log, since nothing is delivered. Text is preferred (readable); an html-only message shows its html.
             const body = message.text ?? message.html;
-            log(`[mail:console] to=${message.to.email} subject=${JSON.stringify(message.subject)}${body === undefined ? "" : `\n${body}`}`);
+            const bodySuffix = body === undefined ? "" : `\n${body}`;
+            log(`[mail:console] to=${message.to.email} subject=${JSON.stringify(message.subject)}${bodySuffix}`);
             return { ok: true, providerMessageId: `console-${counter}`, acceptedAt: nowIso({ clock: required.clock }) };
         },
         async sendBatch({ messages, ...delivery }) {

package/dist/mail/feedback.js

@@ -37,7 +37,7 @@ export function createMailFeedbackIngest(required, optional = {}) {
     const apply = async (input) => {
         const outcome = await required.inbox.record(input);
         if (outcome === "duplicate")
-            return outcome;
+            return "duplicate";
         const scope = suppressionScopeFor({ event: input.event });
         if (scope !== null) {
             const reason = input.event.kind === "complained" ? "complained" : "bounced";

package/dist/mail/index.d.ts

@@ -1,6 +1,7 @@
 export type * from "./types.js";
 export type * from "./ports.js";
 export type * from "./adapter-module.js";
+export { createMailAdapterContext } from "./adapter-module.js";
 export type * from "./engine-contracts.js";
 export { wrapMailerWithPurposeGate, isPurposeGateOpen } from "./purpose-scoped-mailer.js";
 export type { WrapMailerWithPurposeGateOptions, PurposeGateRequired } from "./purpose-scoped-mailer.js";

package/dist/mail/index.js

@@ -1,3 +1,4 @@
+export { createMailAdapterContext } from "./adapter-module.js";
 export { wrapMailerWithPurposeGate, isPurposeGateOpen } from "./purpose-scoped-mailer.js";
 export { isMailDeliveryAvailable } from "./delivery-availability.js";
 export { createMailSenderIdentityResolver, NON_DELIVERING_MAIL_DRIVERS, SenderIdentityNotConfiguredError } from "./sender-identity.js";

package/dist/mail/prepare-sender-email.js

@@ -54,7 +54,7 @@ export async function prepareSenderEmail(required, _optional = {}) {
     validateEmailSourceTemplate({ fields: source.fields, template });
     const resolved = await sender.resolveEvent({ ...context, eventId });
     // MOVE: Compare against the latest activation so re-enabling cannot revive a backlog.
-    if (!binding.activatedAt || !(Date.parse(resolved.occurredAt) >= Date.parse(binding.activatedAt)))
+    if (!occurredSinceActivation({ occurredAt: resolved.occurredAt, activatedAt: binding.activatedAt }))
         throw new EmailSenderError({ code: "configuration" });
     const to = recipientAddress({ source, resolved, recipientId: binding.recipientId });
     const { values, warnings } = templateValues({ fields: source.fields, tokens: template.fields, values: resolved.values });
@@ -65,4 +65,10 @@ export async function prepareSenderEmail(required, _optional = {}) {
         replyTo: { email: binding.replyTo }, subject: rendered.subject, html: rendered.html, text: rendered.text,
         purpose: source.purpose, lane: source.lane, warnings };
 }
+/** True only for an event at or after the binding's activation; an unparsable time is never current. */
+function occurredSinceActivation({ occurredAt, activatedAt }) {
+    if (!activatedAt)
+        return false;
+    return Date.parse(occurredAt) >= Date.parse(activatedAt);
+}
 //# sourceMappingURL=prepare-sender-email.js.map

package/dist/mail/provider.js

@@ -21,11 +21,14 @@ export function validateMailProvider({ provider }) {
     // A capability claim without the code behind it is how Resend once advertised feedback with no route.
     if (caps.feedback !== (provider.feedback !== undefined))
         return "capabilities.feedback must match the presence of a feedback parser";
-    const hasDomain = typeof provider.domainRequirements === "function" && typeof provider.domainStatus === "function";
+    const hasDomain = hasDomainVerification(provider);
     if (caps.domainVerification !== hasDomain)
         return "capabilities.domainVerification must match domainRequirements + domainStatus";
     return undefined;
 }
+function hasDomainVerification(provider) {
+    return typeof provider.domainRequirements === "function" && typeof provider.domainStatus === "function";
+}
 /** Mail registry over the shared keyed registry; built-ins throw on a bad registration, plugins are refused. */
 export function createMailProviderRegistry(_required = {}, optional = {}) {
     const seed = (optional.builtins ?? []).map((provider) => ({ id: provider.id, provider, label: provider.label }));
@@ -61,14 +64,20 @@ function laneStatus(required) {
 export function computeMailStatus(required, optional = {}) {
     const { setting, registry, hasCredential } = required;
     const lanes = ["transactional", "bulk"].map((lane) => laneStatus({ lane, providerId: setting[lane], registry, hasCredential }));
-    const warnings = [];
-    const domain = optional.senderDomainState;
+    const senderWarning = senderDomainWarning(optional.senderDomainState);
+    const warnings = senderWarning === undefined ? [] : [senderWarning];
+    return { state: overallMailState(lanes), lanes, warnings };
+}
+function senderDomainWarning(domain) {
     if (domain === null)
-        warnings.push("sender_unknown");
-    else if (domain !== undefined && domain !== "verified")
-        warnings.push("sender_unverified");
-    const ready = lanes.filter((status) => status.state === "ready").length;
-    const state = ready === lanes.length ? "ready" : lanes[0].state === "unconfigured" ? "unconfigured" : "degraded";
-    return { state, lanes, warnings };
+        return "sender_unknown";
+    if (domain === undefined || domain === "verified")
+        return undefined;
+    return "sender_unverified";
+}
+function overallMailState(lanes) {
+    if (lanes.every((status) => status.state === "ready"))
+        return "ready";
+    return lanes[0].state === "unconfigured" ? "unconfigured" : "degraded";
 }
 //# sourceMappingURL=provider.js.map

package/dist/mail/rate-limit.js

@@ -7,7 +7,9 @@
  */
 export function createMailLaneLimiter(required, optional = {}) {
     const { perSecond, burst } = required.limit;
-    if (!(perSecond > 0) || !(burst >= 1))
+    // Positive comparisons on purpose: NaN fails both and is rejected.
+    const validLimit = perSecond > 0 && burst >= 1;
+    if (!validLimit)
         throw new RangeError("mail rate limit needs perSecond > 0 and burst >= 1");
     const now = optional.now ?? Date.now;
     // At least one token whenever burst > 1: 20% of a small burst (Resend's 2) floors to 0, which let

package/dist/net/endpoint-policy.js

@@ -13,7 +13,13 @@ function normalizeBracketedIpv6(hostname) {
     // form, so `localhost.` must normalize to `localhost` before the equality
     // check below — and `0.0.0.0.`, `10.0.0.1.`, etc. must normalize before
     // the IPv4 classifier parses them. Strips one or more trailing dots.
-    return stripped.toLowerCase().replace(/\.+$/, '');
+    // A scan rather than /\.+$/, which backtracks quadratically on long interior dot runs. This module
+    // stays import-free (see its contract test), so it does not use core's trimCharsEnd.
+    const lowered = stripped.toLowerCase();
+    let end = lowered.length;
+    while (end > 0 && lowered[end - 1] === '.')
+        end -= 1;
+    return lowered.slice(0, end);
 }
 function parseIpv4(hostname) {
     const parts = hostname.split('.');
@@ -71,7 +77,7 @@ export function expandIpv6({ address: addr }) {
         const fill = 8 - left.length - right.length;
         if (fill < 1)
             return null;
-        groups = [...left, ...new Array(fill).fill(0), ...right];
+        groups = [...left, ...Array.from({ length: fill }, () => 0), ...right];
     }
     if (!validIpv6Groups(groups))
         return null;
@@ -88,8 +94,8 @@ function foldIpv4Tail(s) {
         if (o.length !== 4 || o.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
             return null;
         // `o` is now a validated 4-element array — indices 0-3 always defined.
-        const hi = (((o[0] << 8) | o[1])).toString(16);
-        const lo = (((o[2] << 8) | o[3])).toString(16);
+        const hi = ((o[0] << 8) | o[1]).toString(16);
+        const lo = ((o[2] << 8) | o[3]).toString(16);
         s = `${v4[1]}${hi}:${lo}`;
     }
     return s;
@@ -116,9 +122,11 @@ function classifyIpv4Bytes(bytes) {
 function isPrivateIpv4Bytes([a, b]) {
     if (a === 100)
         return b >= 64 && b <= 127;
-    return a === 10 ||
-        (a === 172 && b >= 16 && b <= 31) ||
-        (a === 192 && b === 168);
+    if (a === 172)
+        return b >= 16 && b <= 31;
+    if (a === 192)
+        return b === 168;
+    return a === 10;
 }
 // Each /96 prefix carries IPv4 in the final four bytes. Matching canonical
 // bytes also handles expanded IPv6 and WHATWG URL's dotted-to-hex normalization.

package/dist/object-store/local-fs.js

@@ -29,7 +29,9 @@ function contained(required) {
     const { rootDir, key } = required;
     const path = join(rootDir, key);
     const rel = relative(resolve(rootDir), resolve(path));
-    if (key === '' || isAbsolute(key) || rel === '' || rel.startsWith('..') || isAbsolute(rel)) {
+    const invalidKey = key === '' || isAbsolute(key);
+    const escapesRoot = rel === '' || rel.startsWith('..') || isAbsolute(rel);
+    if (invalidKey || escapesRoot) {
         throw new Error(`object key '${key}' is outside the store root`);
     }
     return path;