@runeditrun/rer 0.0.0-stage → 0.1.0

package/modules/erasure/receipt.mjs

@@ -0,0 +1,32 @@
+import { statement, canonicalJson, insist } from './sql.mjs';
+
+const parse = row => row && ({
+  id: row.id, entity: row.entity, phase: row.phase, label: row.label,
+  planned: JSON.parse(row.planned), deleted: JSON.parse(row.deleted), retained: JSON.parse(row.retained),
+  blobs: { total: row.blobs_total, deleted: row.blobs_deleted },
+  requestedAt: row.requested_at, committedAt: row.committed_at, completedAt: row.completed_at,
+  seconds: row.completed_at ? (Date.parse(row.completed_at) - Date.parse(row.requested_at)) / 1000 : null,
+});
+
+export async function receipt(db, id) {
+  const row = await statement(db, 'SELECT * FROM rer_erasure_operations WHERE id=?', id).first();
+  insist(row, 'erasure_not_found', 404);
+  return parse(row);
+}
+export async function activeFor(db, d, subject) {
+  return parse(await statement(db, "SELECT * FROM rer_erasure_operations o WHERE entity=? AND (subject=? OR (?=1 AND phase='blobs' AND EXISTS(SELECT 1 FROM rer_erasure_scope s WHERE s.operation=o.id AND s.kind='graph' AND s.table_name=? AND s.key_json=?)))", d.entity, canonicalJson(subject), Number(Boolean(d.root.redact)), d.root.table, canonicalJson(subject)).first());
+}
+/** The subject key is held only while rows are still being deleted. */
+export function openStatement(db, d, { id, subject, label, planned, blobs, now }) {
+  return statement(db, 'INSERT INTO rer_erasure_operations(id,entity,subject,label,phase,planned,retained,blobs_total,requested_at) VALUES(?,?,?,?,?,?,?,?,?)',
+    id, d.entity, canonicalJson(subject), label, 'deleting', canonicalJson(planned), canonicalJson([...d.retain.map(({ table, reason }) => ({ table, reason })), ...(d.root.redact ? [{ table: d.root.table, reason: d.root.redact.reason }] : [])]), blobs, now);
+}
+export function progressStatement(db, id, step, deleted) {
+  return statement(db, 'UPDATE rer_erasure_operations SET step=step+1,deleted=? WHERE id=? AND step=?', canonicalJson(deleted), id, step);
+}
+export function committedStatement(db, id, now) {
+  return statement(db, "UPDATE rer_erasure_operations SET phase='blobs',subject=NULL,committed_at=? WHERE id=? AND phase='deleting'", now, id);
+}
+export function completeStatement(db, id, now) {
+  return statement(db, "UPDATE rer_erasure_operations SET phase='complete',completed_at=? WHERE id=? AND phase='blobs' AND NOT EXISTS(SELECT 1 FROM rer_erasure_blobs WHERE operation=?)", now, id, id);
+}

package/modules/erasure/root.mjs

@@ -0,0 +1,21 @@
+import { insist, statement, quote, randomHex, canonicalJson } from './sql.mjs';
+
+/** Only the opaque primary key survives; every other root column is explicitly replaced. */
+export async function rootValues(d, keys, subject, anonymousId) {
+  if (!d.root.redact) return null;
+  const set = typeof d.root.redact.set === 'function' ? await d.root.redact.set({ subject, anonymousId }) : d.root.redact.set;
+  const identity = d.root.redact.identityColumns ?? [];
+  insist(identity.every(c => keys.columns.includes(c) && !keys.pk.includes(c)) && new Set(identity).size === identity.length, 'root_identity_columns', 409);
+  const columns = keys.columns.filter(c => !keys.pk.includes(c) && !identity.includes(c));
+  insist(set && columns.length === Object.keys(set).length && columns.every(c => Object.hasOwn(set, c)), 'root_redact_columns', 409);
+  insist(Object.values(set).every(v => v === null || typeof v === 'string' || (typeof v === 'number' && Number.isFinite(v))), 'root_redact_values', 409);
+  return set;
+}
+export async function rootStatements(ctx, d, plan, id) {
+  if (!d.root.redact || !plan.root) return [];
+  const keys = plan.keys.get(d.root.table);
+  // Independent of the audit label, so a retained root cannot identify that label.
+  const anonymousId = plan.anonymousId ??= randomHex(16);
+  const set = plan.rootSet ??= await rootValues(d, keys, plan.subject, anonymousId);
+  return [statement(ctx.db, "INSERT OR IGNORE INTO rer_erasure_scope VALUES(?,'redaction',?,?,?)", id, d.root.table, canonicalJson(plan.subject), canonicalJson({ anonymousId })), statement(ctx.db, `UPDATE ${quote(d.root.table)} SET ${Object.keys(set).map(c => `${quote(c)}=?`).join(',')} WHERE ${keys.pk.map(c => `${quote(c)}=?`).join(' AND ')}`, ...Object.values(set), ...keys.pk.map(c => plan.subject[c])), ...await ctx.fence.redaction()];
+}

package/modules/erasure/schema/erasure-rates.sql

@@ -0,0 +1,5 @@
+CREATE TABLE rer_erasure_rates (
+  rate_table TEXT NOT NULL, rate_key TEXT NOT NULL, entity TEXT NOT NULL, subject TEXT NOT NULL,
+  PRIMARY KEY(rate_table, rate_key, entity, subject)
+);
+CREATE INDEX rer_erasure_rates_subject ON rer_erasure_rates(entity, subject);

package/modules/erasure/schema/erasure.sql

@@ -0,0 +1,27 @@
+CREATE TABLE rer_erasure_operations (
+  id TEXT PRIMARY KEY NOT NULL,
+  entity TEXT NOT NULL,
+  subject TEXT,
+  label TEXT NOT NULL,
+  phase TEXT NOT NULL CHECK(phase IN ('deleting','blobs','complete')),
+  step INTEGER NOT NULL DEFAULT 0,
+  planned TEXT NOT NULL,
+  deleted TEXT NOT NULL DEFAULT '{}',
+  retained TEXT NOT NULL,
+  blobs_total INTEGER NOT NULL DEFAULT 0,
+  blobs_deleted INTEGER NOT NULL DEFAULT 0,
+  requested_at TEXT NOT NULL,
+  committed_at TEXT,
+  completed_at TEXT
+);
+CREATE UNIQUE INDEX rer_erasure_active_subject ON rer_erasure_operations(entity,subject) WHERE subject IS NOT NULL;
+CREATE TABLE rer_erasure_blobs (
+  operation TEXT NOT NULL, bucket TEXT NOT NULL, key TEXT NOT NULL, PRIMARY KEY(operation,bucket,key)
+);
+CREATE TABLE rer_erasure_guard (value INTEGER NOT NULL CHECK(value=1),
+  scope INTEGER NOT NULL DEFAULT 1 CONSTRAINT erasure_scope_changed CHECK(scope=1),
+  retained INTEGER NOT NULL DEFAULT 1 CONSTRAINT erasure_retained_missing CHECK(retained=1));
+CREATE TABLE rer_erasure_scope (
+  operation TEXT NOT NULL, kind TEXT NOT NULL, table_name TEXT NOT NULL, key_json TEXT NOT NULL, row_json TEXT NOT NULL,
+  PRIMARY KEY(operation,kind,table_name,key_json,row_json)
+);

package/modules/erasure/scope.mjs

@@ -0,0 +1,29 @@
+import { all, statement, canonicalJson, quote } from './sql.mjs';
+import { tableKeys } from './plan.mjs';
+
+/** Temporary private scope, cleared atomically at completion. It lets a later
+ * batch find new copies through parents that an earlier batch already deleted. */
+export async function readScope(db, id) {
+  return (await all(db, "SELECT table_name,key_json,row_json FROM rer_erasure_scope WHERE operation=? AND kind='graph'", id)).map(r => ({ table: r.table_name, key: JSON.parse(r.key_json), row: JSON.parse(r.row_json) }));
+}
+export async function scopeStatements(db, d, plan, id, entries = plan.entries) {
+  const out = [];
+  for (const { table, row, key } of entries) {
+    out.push(statement(db, "INSERT OR IGNORE INTO rer_erasure_scope VALUES(?,'graph',?,?,?)", id, table, canonicalJson(key), canonicalJson(row)));
+  }
+  for (const { table } of d.retain) {
+    const { pk } = await tableKeys(db, table);
+    const key = `json_object(${pk.flatMap(c => ["'" + c.replaceAll("'", "''") + "'", quote(c)]).join(',')})`;
+    out.push(statement(db, `INSERT OR IGNORE INTO rer_erasure_scope SELECT ?,'retain',?,${key},${key} FROM ${quote(table)}`, id, table));
+  }
+  if (d.root.redact && plan.root) {
+    const identity = Object.fromEntries((d.root.redact.identityColumns ?? []).map(c => [c, plan.root.row[c]]));
+    out.push(statement(db, "INSERT INTO rer_erasure_scope SELECT ?,'identity',?,?,? WHERE NOT EXISTS(SELECT 1 FROM rer_erasure_scope WHERE operation=? AND kind='identity')", id, d.root.table, canonicalJson(plan.subject), canonicalJson(identity), id));
+  }
+  return out;
+}
+export async function readRedaction(db, id) {
+  const rows = await all(db, "SELECT kind,row_json FROM rer_erasure_scope WHERE operation=? AND kind IN ('identity','redaction')", id);
+  return Object.fromEntries(rows.map(r => [r.kind, JSON.parse(r.row_json)]));
+}
+export const forgetScope = (db, id) => statement(db, 'DELETE FROM rer_erasure_scope WHERE operation=?', id);

package/modules/erasure/sql.mjs

@@ -0,0 +1,23 @@
+export class ErasureError extends Error {
+  constructor(code, status = 400) { super(code); this.code = code; this.status = status; }
+}
+export function insist(condition, code, status = 400) { if (!condition) throw new ErasureError(code, status); }
+export const quote = name => '"' + name.replaceAll('"', '""') + '"';
+export const statement = (db, sql, ...values) => values.length ? db.prepare(sql).bind(...values) : db.prepare(sql);
+export const all = async (db, sql, ...values) => (await statement(db, sql, ...values).all()).results;
+// A failed guard aborts the whole D1 batch through the CHECK constraint.
+export const guard = (db, condition, ...values) =>
+  statement(db, `INSERT INTO rer_erasure_guard(value) SELECT CASE WHEN (${condition}) THEN 1 ELSE 0 END`, ...values);
+export function canonicalJson(value) {
+  if (Array.isArray(value)) return '[' + value.map(canonicalJson).join(',') + ']';
+  if (value && typeof value === 'object') return '{' + Object.keys(value).sort().map(k => JSON.stringify(k) + ':' + canonicalJson(value[k])).join(',') + '}';
+  return JSON.stringify(value);
+}
+export async function sha256(text) {
+  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));
+  return [...new Uint8Array(digest)].map(b => b.toString(16).padStart(2, '0')).join('');
+}
+export function randomHex(bytes) {
+  return [...crypto.getRandomValues(new Uint8Array(bytes))].map(b => b.toString(16).padStart(2, '0')).join('');
+}
+export const chunks = (list, size) => Array.from({ length: Math.ceil(list.length / size) }, (_, i) => list.slice(i * size, (i + 1) * size));

package/modules/erasure/verification.mjs

@@ -0,0 +1,69 @@
+import { quote, statement, chunks } from './sql.mjs';
+import { matchSql, tableKeys } from './plan.mjs';
+
+const verify = (db, kind, condition, ...values) => statement(db, `INSERT INTO rer_erasure_guard(value,${kind}) SELECT 1,CASE WHEN (${condition}) THEN 1 ELSE 0 END`, ...values);
+
+/** Re-read every declared path and audit inside the same atomic batch as the
+ * final root effect and portability fence. A new dependent rolls the batch back
+ * and returns to collection; it cannot be silently cascaded away. */
+export async function verificationStatements(db, d, plan, id, label, { final = false, intake = !final } = {}) {
+  const out = [];
+  if (intake) {
+    for (const [table, entries] of plan.rows) {
+      const columns = [...new Set([...entries.values()].flatMap(e => Object.keys(e.row)))];
+      for (const part of chunks([...entries.values()], 200)) out.push(verify(db, 'scope', `NOT EXISTS(SELECT 1 FROM json_each(?) j WHERE NOT EXISTS(SELECT 1 FROM ${quote(table)} WHERE ${columns.map((c, i) => `${quote(c)} IS json_extract(j.value,'$[${i}]')`).join(' AND ')}))`, JSON.stringify(part.map(e => columns.map(c => e.row[c])))));
+    }
+    // The schema can contain another FK path into a selected parent. Protect it
+    // in the transaction too, including rows inserted after collection.
+    for (const { table, parentTable, group } of plan.foreignKeys) {
+      const pk = plan.keys.get(table).pk, parentPk = plan.keys.get(parentTable).pk;
+      const parents = [...plan.rows.get(parentTable).values()].map(e => parentPk.map(c => e.key[c]));
+      const children = [...plan.rows.get(table).values()].map(e => pk.map(c => e.key[c]));
+      const keyMatch = (alias, columns) => columns.map((c, i) => `${alias}.${quote(c)} IS json_extract(j.value,'$[${i}]')`).join(' AND ');
+      const joined = group.map(f => `c.${quote(f.from)}=p.${quote(f.to || parentPk[f.seq])}`).join(' AND ');
+      out.push(verify(db, 'scope', `NOT EXISTS(SELECT 1 FROM ${quote(table)} c JOIN ${quote(parentTable)} p ON ${joined} WHERE EXISTS(SELECT 1 FROM json_each(?) j WHERE ${keyMatch('p', parentPk)}) AND NOT EXISTS(SELECT 1 FROM json_each(?) j WHERE ${keyMatch('c', pk)}))`, JSON.stringify(parents), JSON.stringify(children)));
+    }
+    for (const edge of d.edges) for (const m of matchSql(edge, [...plan.known.get(edge.from).values()])) {
+      const pk = plan.keys.get(edge.table).pk, keys = [...plan.rows.get(edge.table).values()].map(e => pk.map(c => e.key[c]));
+      const selected = `EXISTS(SELECT 1 FROM json_each(?) k WHERE ${pk.map((c, i) => `${quote(edge.table)}.${quote(c)} IS json_extract(k.value,'$[${i}]')`).join(' AND ')})`;
+      out.push(verify(db, 'scope', `NOT EXISTS(SELECT 1 FROM ${quote(edge.table)} WHERE ${m.where} AND NOT (${selected}))`, ...m.values, JSON.stringify(keys)));
+    }
+  }
+  if (final) {
+    for (const edge of d.edges) for (const m of matchSql(edge, [...plan.known.get(edge.from).values()])) {
+      out.push(verify(db, 'scope', `NOT EXISTS(SELECT 1 FROM ${quote(edge.table)} WHERE ${m.where})`, ...m.values));
+    }
+    for (const item of d.audit) {
+      const keys = [...plan.known.get(item.of).values()].map(row => row[plan.keys.get(item.of).pk[0]]);
+      for (const part of chunks(keys, 200)) out.push(verify(db, 'scope', `NOT EXISTS(SELECT 1 FROM ${quote(item.table)} WHERE ${quote(item.column)} IN (SELECT value FROM json_each(?))${item.where ? ` AND (${item.where})` : ''})`, JSON.stringify(part)));
+      const clear = Object.entries(item.clear ?? {});
+      if (clear.length) out.push(verify(db, 'scope', `NOT EXISTS(SELECT 1 FROM ${quote(item.table)} WHERE ${quote(item.column)} IS ? AND (${clear.map(([c]) => `${quote(c)} IS NOT ?`).join(' OR ')})${item.where ? ` AND (${item.where})` : ''})`, label, ...clear.map(([, value]) => value)));
+    }
+    if (d.root.redact) {
+      const pk = plan.keys.get(d.root.table).pk, set = plan.rootSet, identity = d.root.redact.identityColumns ?? [];
+      out.push(verify(db, 'retained', `EXISTS(SELECT 1 FROM ${quote(d.root.table)} WHERE ${[...pk.map(c => `${quote(c)} IS ?`), ...identity.map(c => `${quote(c)} IS ?`), ...Object.keys(set).map(c => `${quote(c)} IS ?`)].join(' AND ')})`, ...pk.map(c => plan.subject[c]), ...identity.map(c => (plan.rootIdentity ?? plan.root.row)[c]), ...Object.values(set)));
+    }
+  }
+  for (const { table } of d.retain) {
+    const { pk } = await tableKeys(db, table);
+    out.push(verify(db, 'retained', `NOT EXISTS(SELECT 1 FROM rer_erasure_scope s WHERE s.operation=? AND s.kind='retain' AND s.table_name=? AND NOT EXISTS(SELECT 1 FROM ${quote(table)} t WHERE ${pk.map(c => `t.${quote(c)} IS json_extract(s.key_json,'$.${c}')`).join(' AND ')}))`, id, table));
+  }
+  return out;
+}
+
+export function rootGoneStatement(db, d, plan) {
+  const pk = plan.keys.get(d.root.table).pk;
+  return verify(db, 'scope', `NOT EXISTS(SELECT 1 FROM ${quote(d.root.table)} WHERE ${pk.map(c => `${quote(c)} IS ?`).join(' AND ')})`, ...pk.map(c => plan.subject[c]));
+}
+
+/** Immediately before a parent DELETE, its physical FK children must be gone.
+ * This also protects against children created by a trigger in the same batch. */
+export function childAbsenceStatements(db, plan, entry) {
+  const out = [], parentPk = plan.keys.get(entry.table).pk;
+  for (const { table, parentTable, group } of plan.foreignKeys.filter(f => f.parentTable === entry.table)) {
+    const join = group.map(f => `c.${quote(f.from)}=p.${quote(f.to || parentPk[f.seq])}`).join(' AND ');
+    const self = table === entry.table ? ` AND NOT (${parentPk.map(c => `c.${quote(c)} IS p.${quote(c)}`).join(' AND ')})` : '';
+    out.push(verify(db, 'scope', `NOT EXISTS(SELECT 1 FROM ${quote(table)} c JOIN ${quote(parentTable)} p ON ${join} WHERE ${parentPk.map(c => `p.${quote(c)} IS ?`).join(' AND ')}${self})`, ...parentPk.map(c => entry.key[c])));
+  }
+  return out;
+}

package/modules/integrations/core/CONTRACT.md

@@ -0,0 +1,50 @@
+# Integrations core public contract (v2)
+
+Source exports are `core/index.ts`. Types live in `core/types.ts`. No dependencies are required; Node SQLite and Node HTTPS adapters are separate imports (`core/sqlite.ts`, `core/node-transport.ts`) from the portable D1/core code.
+
+Provider units implement `DeliveryProtocol` with `id`, async `prepare(envelope, nowMilliseconds)` returning `{url, headers, body}`, and synchronous `classify({status, headers, body}, now)` returning an `Outcome`. `prepare` reads trusted credential/destination configuration using `envelope.destinationId`; never accept arbitrary bot URLs or caller credentials. URL must be stable for a destination version. Core hashes the prepared URL at enqueue and rejects configuration drift at dispatch. `body` must exactly equal the immutable envelope body. Prepare must perform no HTTP requests. Providers expose their own serialization and configuration factory; pass the resulting protocol to core. Classifier returns accepted/rejected/retryable/uncertain, fixed safe `code`, optional status and retryAfterMs. Never include raw provider text, URLs, auth, or personal data in codes. HTTP errors without proven rejection are uncertain. All lost responses and classifier errors become uncertain. Non-idempotent providers never automatically replay uncertain attempts.
+
+`new DeliveryService({repository, protocols, transport, now?, hashDestination?})`; `enqueue(envelope, {maxAttempts?, retryDelaysMs?}?)`; `dispatch(id)`; `dispatchDue(limit=100)`; `recoverExpired()`; `get(id)`; `log(id)`; `resolveUncertain(id, 'accepted'|'rejected', evidenceCode)`. Calls are tenant-scoped by the repository. Logical ID, tenant, destination ID, protocol, event and exact body are immutable. Reused IDs with changed content reject. Default maximum 4 attempts, delays 1s/5s/30s; explicit retryable outcomes are bounded. Accepted means protocol acknowledgement, not confirmed human receipt. Expired claims remain uncertain with durable history. Reconciliation is a trusted operator call; no general replay switch exists.
+
+`hashDestination?: (url: string) => Promise<string>` is a trusted consumer callback, called with the exact prepared URL after URL/body validation at both enqueue and dispatch. It must return 64 lowercase hexadecimal characters, optionally prefixed by a 1–16 character version identifier (lowercase ASCII letter first, then lowercase letters, digits or hyphens) and `:`; for example `hmac-v1:<64 lowercase hex characters>`. Other output rejects before insertion or transport; dispatch records only `rejected` with code `preflight_failed`. Without this option, the SHA-256 URL digest and all default delivery/request fields are unchanged. The resulting string participates in the existing immutable fingerprint and destination comparison. Hashing does not change the wire request, retry policy, claim check or uncertain-send semantics.
+
+Consumers needing protection against offline URL guessing can capture a separately configured 32+ random-byte HMAC key in this callback and return a versioned HMAC-SHA256 digest. One consumer format is `hmac-v1:` plus lowercase HMAC-SHA256 of the UTF-8 lowercase SHA-256 hex digest of the prepared URL; it also permits consumer-owned rekeying of existing URL digests without recovering plaintext. Base performs no URL normalization in the callback path. The consumer owns canonical URL preparation, stable algorithm/key custody across enqueue and dispatch, immutable destination versions, and any coordinated migration of existing hashes and fingerprints. Changing the algorithm/key without that migration rejects existing work. Keep the key outside delivery storage and transport requests. Default SHA-256 is unkeyed, and this option does not encrypt destinations or automatically protect consumers that do not adopt it.
+
+`new IntegrationsRepository(sql, namespace)` uses an actual transactional SQLite/D1 database. `D1SqlDatabase(binding)` adapts D1; `SqliteDatabase(path)` adapts Node built-in SQLite. Apply `core/schema.sql` once in the consumer migration chain; numbering is the integrator's. Namespace must be server-selected per installation/tenant; envelope tenant must equal namespace. Never expose repository or service management calls directly to unauthenticated input.
+
+`createWebhookProtocol({resolveDestination, signingKey, timestampedBodySignature?})` accepts a trusted `(destinationId)=>Promise<string>` and async `signingKey(envelope)=>Promise<Uint8Array>`. 32+ random-byte HMAC keys, held outside delivery storage. Signatures bind version, tenant, destination ID, event, logical ID, timestamp and exact UTF-8 body. Receiver uses `verifyWebhook({body,headers,key,tenant,destinationId,now?,toleranceMs?})`, then `repository.acceptReplay(verified)` BEFORE applying its effect. Replay claims are permanent; duplicate effect must not be reapplied. For transactional effect processing consume the durable replay inbox, with the edition's effect in the same DB transaction; external effect uncertainty still needs reconciliation. Receiver signature success alone is not replay protection.
+
+`timestampedBodySignature: {timestampHeader: string, signatureHeader: string, signingKey?: (envelope: Envelope) => Promise<Uint8Array>}` is an optional generic compatibility format, also exported as the `TimestampedBodySignature` type. It adds an ISO 8601 UTC timestamp (`new Date(timestampSeconds * 1000).toISOString()`, with `.000Z`) and unprefixed, unpadded base64url HMAC-SHA256 over UTF-8 `isoTimestamp + '.' + exactBodyString`. Both timestamps represent the same whole-second instant. Exact Unicode, whitespace, newlines and BOM are preserved. Header names must be HTTP token names, unique ignoring case, and must not collide ignoring case with `content-type`, `webhook-id`, `webhook-tenant`, `webhook-destination`, `webhook-event`, `webhook-timestamp` or `webhook-signature`. Configuration is validated and captured at creation; no metadata override is provided. The optional key callback resolves a separate key; otherwise the already-resolved Base key is reused. Both keys must be `Uint8Array` values of at least 32 bytes. A consumer whose established contract signs with a random secret string may explicitly encode its literal UTF-8 bytes for either key instead of decoding it as hex/base64. Keys and configured values never enter delivery rows or logs.
+
+Without this option the request is byte-identical to the default Base format. With it the Base signature and headers remain intact, and `verifyWebhook` continues to verify only the Base format. The additional signature does not bind Base metadata; its receiver owns freshness and replay/effect handling. It changes no classifier, uncertain-send, retry, transport or security semantics.
+
+The compatibility header names also cannot replace transport-controlled or authorization headers: `host`, `connection`, `content-length`, `transfer-encoding`, `proxy-authorization`, `authorization`, `keep-alive`, `proxy-connection`, `te`, `trailer` and `upgrade`. These reject at protocol creation even when using a Worker transport.
+
+`new TokenService(repository, authority, now?)`: `issue(context,{name,scopes,expiresAt?})`, `authorize(token,requiredScopes,{requestId,resource})` (durably records every allowed/denied attempt and returns safe metadata or null), `revoke(context,id)`, `list(context)`, `usage(context)`. TokenAuthority's trusted async grant callback returns `{scopes, commitGuard: {sql, params}}`, and administer rejects unauthorized administration. `commitGuard.sql` is a trusted SELECT that returns a row only if the authenticated issuer is still active/authorized and every durable revision used to derive `scopes` is unchanged. Core embeds it as an EXISTS predicate inside the token INSERT in the same SQLite/D1 batch as the issuance audit. A stale/missing issuer or grant revision rejects issuance, returns no token and creates no issued audit event. An audit failure rolls back issuance. A plain scope array or missing guard rejects; there is no compatibility fallback. The consumer must store authority in the repository database and update its revision(s) in every transaction changing issuer permissions or grant ceilings, including removal and reactivation. A query checking a constant/preflight value or a different database does not implement this contract. Every use checks current scopes, expiry/revocation in SQL and records usage atomically. Plaintext is returned only by issue, database persists SHA-256 hash only.
+
+Transport is required and trusted: `TrustedTransport.send` MUST enforce public IP validation at connect time, verified TLS, no redirects and bounded response/request time. `NodePinnedTransport` is the supplied production enforcing implementation. Worker consumers must supply a trusted pinned-resolution egress service/runtime port; plain fetch is explicitly unsupported. Only tests may provide a transport mapping synthetic HTTPS URLs to a real loopback receiver. There is no production test flag.
+
+`isPublicAddress` uses the single maintained range policy in [public-address.ts](public-address.ts), shared by `validateDestination` for literal URLs and `NodePinnedTransport` for **every** DNS answer before connecting. Mixed public/non-public answers reject as a whole. The conservative policy excludes private, loopback, link-local, multicast, reserved, documentation, benchmarking and special-purpose allocations, even when a special-purpose address is globally reachable. This includes Azure `168.63.129.16`, IPv4 <code>192.31.196.0/24</code>, <code>192.52.193.0/24</code>, <code>192.175.48.0/24</code>, IPv6 `2620:4f:8000::/48`, `3ffe::/16`, and both ISATAP interface-identifier forms. IPv6 must be ordinary `2000::/3` unicast outside the exclusions; mapped/translation/transition forms reject. Base retains its broader <code>192.0.0.0/16</code> and `3fff::/16` exclusions. Compressed and expanded IPv6 follow the same policy. The direct IPv4 guard requires four canonical decimal octets (0–255), with no leading zeros except a single `0`. URL parsing normalizes IP aliases before literal validation; malformed addresses reject. The portable guard imports no Node APIs.
+
+## Adoption details
+
+`dispatchDue` discovers due jobs from durable storage after restart; schedule it from a consumer queue/cron. Claims last 60 seconds, and the supplied transport bounds DNS to 15 seconds and a connection/request to a further 15 seconds by default. User-supplied prepare callbacks should also finish within the claim horizon. Core checks the durable claim and its expiry again after preparation; an expired or reconciled claim cannot start a late request. An expired in-flight attempt is never overwritten by a late response. Any database exception propagates to the caller; the application must expose that failure. No send occurs without a committed attempt row. A retryable final attempt has state `rejected` and retains its explicit retryable provider reason in the attempt log.
+
+Signature canonical input is the UTF-8 encoding of JSON.stringify(["integrations.webhook.v1", tenant, destinationId, event, id, timestampSeconds, exactBodyString]). Outbound bodies must round-trip through UTF-8 without replacement. The header set is `webhook-id`, `webhook-tenant`, `webhook-destination`, `webhook-event`, `webhook-timestamp`, `webhook-signature` (`v1=` plus lower-case SHA-256 hex). A request is fresh within 300 seconds by default (configurable downward only). The key is raw random bytes, not a password or hex string; decode a configured hex/base64 secret to bytes before calling. This version has one active verification key; coordinated key rotation is consumer-owned and no implicit multi-key behavior is claimed.
+
+Receiver `body` is the original `Uint8Array`, obtained from `new Uint8Array(await request.arrayBuffer())` in Fetch/Workers or concatenated raw Node request chunks. Verification decodes strict UTF-8 with `{fatal: true, ignoreBOM: true}`: malformed encodings reject, and a leading UTF-8 BOM remains part of the signed text. No Unicode normalization or JSON parsing occurs. The existing string input is only for caller-owned canonical text and rejects unpaired surrogates; it cannot prove bytes already lost by `Request.text()`, `Buffer.toString('utf8')`, a default TextDecoder, or middleware. Those are unsupported receiver boundaries. Pass only the returned `verified.envelope.body` to subsequent parsing and inbox processing. See the [native receiver guide](../receiver.md).
+
+Receiver replay rows are a durable inbox, not proof an external side effect completed. `acceptReplay` returns true exactly once for a logical ID and rejects changed signed contents, even after restart. Do not erase replay rows while the logical ID can be reused. For transactional business effects, adopt `integration_replays` as an inbox and maintain the application's processed marker in the same database transaction as that effect; do not blindly execute an effect again after a receiver crash. Response-lost external effects require reconciliation just like outbound delivery. There is deliberately no automatic uncertain-send retry, even for custom webhooks.
+
+Secrets never enter delivery rows: URL hashes bind the trusted destination version, while full secret URLs, bearer headers and signing keys are resolved only for the current attempt. Payloads are durable product data and must not contain credentials. Logs retain machine codes, status, timestamps, feature/protocol identity through the envelope, and reconciliation records. They do not retain provider bodies/error messages. Consumer credentials, destination lookup, authorization contexts, scheduling, egress declarations and UI/operator audit actors remain consumer wiring. Do not treat any caller-controlled `Context` or destination registration as trusted without native server authorization.
+
+Retry policy (maximum attempts and delay vector) also participates in immutable enqueue identity. Attempts are capped at ten and each configured delay at one day. A retry-after delay above one day terminates as `rejected` with code `retry_delay_exceeded` rather than retrying earlier than the destination requested. There is no total elapsed retry horizon; multiple delays and late dispatch can extend beyond one day. Issuance/revocation and their feature-tagged audit events commit together; token event rows survive token deletion. Integrating editions may supplement these with native human actor audit identity.
+
+
+## Token API v2 adoption
+
+`DeliveryProtocol`, signing, delivery and transport signatures are unchanged. Token grants require a commit guard and token authorization requires concrete request context. For example, a trusted consumer reading its own `issuers(namespace,id,revision,active,scopes)` record can return the parsed scopes plus `commitGuard: { sql: 'SELECT 1 FROM issuers WHERE namespace=? AND id=? AND revision=? AND active=1', params: [namespace, authenticatedIssuerId, readRevision] }`. Revisions must never be reused across removal/recreation. If scope ceilings depend on multiple rows (roles, application approvals, session state), the guard must bind/check all of them. The SQL is supplied only by trusted server policy, never by request input. It is a SELECT without a trailing semicolon; it may join native consumer tables and uses positional `?` parameters. Parameter arrays and scopes are copied before asynchronous hashing. Core owns no issuer registry or identity policy.
+
+Each `authorize` call must supply `{requestId, resource}` from the handling application's request/resource identifiers, including denied or unknown-token attempts. Both fields use the existing safe identifier grammar: 1–200 ASCII characters, first alphanumeric, then alphanumeric or `_.:/-`. They must not contain credentials or raw URL/query/body data. Missing/invalid context rejects before authorization and does not invent a usage receipt. The recorded fields bind the decision to the supplied request and resource; this does not make resource-level access decisions on behalf of the consumer. Required scopes remain consumer-selected, and repeated request IDs produce separate attempt receipts. Request context is copied before asynchronous work. Both allowed and denied valid calls commit their context together with the live token decision. Usage storage failure rejects visibly.
+
+`schema.sql` remains an unnumbered fresh-install proposal. Consumers that already applied the earlier proposal must separately apply `upgrade-token-usage-context.sql` exactly once in their migration chain (numbered by their integrator); rerunning CREATE TABLE IF NOT EXISTS is not an upgrade. That expansion preserves historical usage with null request/resource rather than inventing provenance. New service calls always write both validated fields. Audit and usage survive credential deletion.

package/modules/integrations/core/README.md

@@ -0,0 +1,27 @@
+# Durable integration core
+
+Import portable delivery, signed webhook, token and D1 APIs from `./index.ts`.
+Import Node adapters explicitly from `./sqlite.ts` and `./node-transport.ts`.
+Node 26 is the tested runtime; no runtime npm dependency is needed.
+
+The [consumer guide](../README.md) contains fresh SQLite migration, enqueue and
+Worker scheduling examples. The [public contract](CONTRACT.md) defines exact
+HMAC framing, retry outcomes, durable replay and same-database token authority.
+The [receiver guide](../receiver.md) supplies executable Node and Fetch receiver
+boundaries that verify original bytes before claiming replay identities.
+
+Apply `schema.sql` once through the application's numbered migration ledger.
+Existing installations of the earlier proposal instead apply
+`upgrade-token-usage-context.sql` once. Namespaces and authority callbacks come
+from native authenticated server state. Use a durable database, trusted secret
+storage and a transport enforcing public destinations at connect time. Worker
+consumers must supply an enforcing egress binding; ordinary fetch is insufficient.
+
+Schedule `dispatchDue()` after restart and at future due times. Expose durable
+attempts and uncertain outcomes in the native operator experience. Receiving a
+signed delivery and claiming its replay ID do not complete a domain effect:
+commit an inbox processed marker with the effect in the application's transaction.
+
+Run `node --test modules/integrations/tests/integration.test.ts` from Base's root
+for the retained integration suites, including local HTTP/TLS, SQLite and actual
+D1 tests. These checks establish local behavior, not production delivery.

package/modules/integrations/core/crypto.ts

@@ -0,0 +1,19 @@
+const encoder = new TextEncoder();
+export const hex = (bytes: Uint8Array) => Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+export async function sha256(text: string) { return hex(new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(text)))); }
+export function randomId() { return crypto.randomUUID(); }
+export function assertLabel(value: string, name = 'identifier') {
+  if (typeof value !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_.:/-]{0,199}$/.test(value)) throw new Error(`Invalid ${name}`);
+}
+export function assertCode(code: string) { if (!/^[a-zA-Z0-9_.-]{1,100}$/.test(code)) throw new Error('Invalid safe outcome code'); }
+export async function hmacBytes(key: Uint8Array, data: string) {
+  if (!(key instanceof Uint8Array) || key.length < 32) throw new Error('HMAC key must contain at least 32 bytes');
+  const imported = await crypto.subtle.importKey('raw', new Uint8Array(key), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  return new Uint8Array(await crypto.subtle.sign('HMAC', imported, encoder.encode(data)));
+}
+export async function hmac(key: Uint8Array, data: string) { return hex(await hmacBytes(key, data)); }
+export function equalSignature(a: string, b: string) {
+  if (!/^[0-9a-f]{64}$/.test(a) || !/^[0-9a-f]{64}$/.test(b)) return false;
+  let result = 0; for (let i = 0; i < a.length; i++) result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return result === 0;
+}

package/modules/integrations/core/database.ts

@@ -0,0 +1,21 @@
+export interface SqlStatement { sql: string; params?: (string | number | null)[] }
+export interface SqlDatabase {
+  /** All statements execute in one transaction; any failure rolls everything back. */
+  batch(statements: SqlStatement[]): Promise<Record<string, unknown>[][]>;
+}
+interface D1Statement {
+  bind(...values: (string | number | null)[]): D1Statement;
+}
+export interface D1Binding {
+  prepare(sql: string): D1Statement;
+  batch(statements: D1Statement[]): Promise<{ results: Record<string, unknown>[]; success: boolean }[]>;
+}
+export class D1SqlDatabase implements SqlDatabase {
+  private binding: D1Binding;
+  constructor(binding: D1Binding) { this.binding = binding; }
+  async batch(statements: SqlStatement[]) {
+    const result = await this.binding.batch(statements.map(s => this.binding.prepare(s.sql).bind(...(s.params ?? []))));
+    if (result.some(r => !r.success)) throw new Error('Integration database transaction failed');
+    return result.map(r => r.results);
+  }
+}

package/modules/integrations/core/delivery.ts

@@ -0,0 +1,97 @@
+import { assertCode, assertLabel, sha256 } from './crypto.ts';
+import { validateDestination } from './destination.ts';
+import { IntegrationsRepository, pickEnvelope } from './repository.ts';
+import type { Delivery, DeliveryProtocol, Envelope, Outcome, TrustedTransport, WireRequest } from './types.ts';
+
+export class DeliveryService {
+  private repository: IntegrationsRepository;
+  private protocols: Map<string, DeliveryProtocol>;
+  private transport: TrustedTransport;
+  private now: () => number;
+  private hashDestination: (url: string) => Promise<string>;
+  constructor(options: { repository: IntegrationsRepository; protocols: DeliveryProtocol[]; transport: TrustedTransport; now?: () => number; hashDestination?: (url: string) => Promise<string> }) {
+    this.repository = options.repository; this.protocols = new Map(); this.transport = options.transport; this.now = options.now ?? Date.now;
+    this.hashDestination = options.hashDestination ?? sha256;
+    for (const protocol of options.protocols) { assertLabel(protocol.id); if (this.protocols.has(protocol.id)) throw new Error('Duplicate protocol'); this.protocols.set(protocol.id, protocol); }
+  }
+  private protocol(id: string) { const protocol = this.protocols.get(id); if (!protocol) throw new Error('Unknown delivery protocol'); return protocol; }
+  private async destinationHash(url: string) {
+    const hash = await this.hashDestination(url);
+    if (typeof hash !== 'string' || !/^(?:[a-z][a-z0-9-]{0,15}:)?[0-9a-f]{64}(?![\s\S])/.test(hash)) throw new Error('Invalid destination hash');
+    return hash;
+  }
+  private checkWire(wire: WireRequest, envelope: Envelope) {
+    validateDestination(wire.url);
+    if (wire.body !== envelope.body) throw new Error('Protocol changed immutable body');
+    const bytes = new TextEncoder().encode(wire.body);
+    if (bytes.length > 1048576 || new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes) !== wire.body) throw new Error('Delivery body must be bounded valid UTF-8');
+  }
+  async enqueue(input: Envelope, options: { maxAttempts?: number; retryDelaysMs?: number[] } = {}) {
+    const envelope = pickEnvelope(input);
+    for (const label of [envelope.id, envelope.tenant, envelope.destinationId, envelope.event, envelope.protocol]) assertLabel(label);
+    if (envelope.tenant !== this.repository.namespace || typeof envelope.body !== 'string') throw new Error('Invalid envelope tenant or body');
+    const maxAttempts = options.maxAttempts ?? 4, delays = options.retryDelaysMs ?? [1000, 5000, 30000];
+    if (!Array.isArray(delays)) throw new Error('Invalid bounded retry policy');
+    const retryDelaysMs = [...delays];
+    if (!Number.isSafeInteger(maxAttempts) || maxAttempts < 1 || maxAttempts > 10 || retryDelaysMs.length < maxAttempts - 1 || retryDelaysMs.some(d => !Number.isSafeInteger(d) || d < 1 || d > 86400000)) throw new Error('Invalid bounded retry policy');
+    const now = this.now(); const wire = await this.protocol(envelope.protocol).prepare(envelope, now); this.checkWire(wire, envelope);
+    const destinationHash = await this.destinationHash(wire.url);
+    const fingerprint = await sha256(JSON.stringify({ envelope, destinationHash, maxAttempts, retryDelaysMs }));
+    return this.repository.insert({ ...envelope, destinationHash, fingerprint, maxAttempts, retryDelaysMs: [...retryDelaysMs], state: 'queued', attempts: 0, createdAt: now, nextAt: now, claim: null, claimUntil: null });
+  }
+  get(id: string) { return this.repository.get(id); }
+  log(id: string) { return this.repository.log(id); }
+  recoverExpired() { return this.repository.recoverExpired(this.now()); }
+  async resolveUncertain(id: string, kind: 'accepted' | 'rejected', evidenceCode: string) {
+    assertCode(evidenceCode); if (kind !== 'accepted' && kind !== 'rejected') throw new Error('Invalid resolution');
+    await this.repository.resolve(id, { kind, code: evidenceCode }, this.now());
+    return this.get(id);
+  }
+  async dispatchDue(limit = 100): Promise<(Delivery | null)[]> {
+    await this.recoverExpired();
+    const results: (Delivery | null)[] = [];
+    for (const id of await this.repository.due(this.now(), limit)) results.push(await this.dispatch(id));
+    return results;
+  }
+  async dispatch(id: string): Promise<Delivery | null> {
+    await this.recoverExpired();
+    const claim = await this.repository.claim(id, this.now(), 60000);
+    if (!claim) return this.get(id);
+    const delivery = (await this.get(id))!;
+    let outcome: Outcome;
+    // Preflight failures provably happen before transport; no credential/error text enters the log.
+    let wire: WireRequest;
+    try {
+      wire = await this.protocol(delivery.protocol).prepare(pickEnvelope(delivery), this.now());
+      this.checkWire(wire, delivery);
+      if (await this.destinationHash(wire.url) !== delivery.destinationHash) throw new Error('Destination changed');
+    } catch {
+      outcome = { kind: 'rejected', code: 'preflight_failed' };
+      if (!await this.repository.finish(id, claim, outcome, this.now(), null)) await this.recoverExpired();
+      return this.get(id);
+    }
+    // Preparing a destination can yield. Recheck the durable claim before starting
+    // an external effect; expired or reconciled work must never start a late send.
+    const current = await this.get(id);
+    if (!current || current.state !== 'sending' || current.claim !== claim || current.claimUntil! <= this.now()) {
+      await this.recoverExpired();
+      return this.get(id);
+    }
+    try {
+      const response = await this.transport.send(wire);
+      outcome = this.protocol(delivery.protocol).classify(response, this.now());
+      if (!['accepted', 'rejected', 'retryable', 'uncertain'].includes(outcome.kind)) throw new Error('Invalid classification');
+      assertCode(outcome.code);
+      if (outcome.status !== undefined && (!Number.isInteger(outcome.status) || outcome.status < 100 || outcome.status > 599)) throw new Error('Invalid status');
+      if (outcome.retryAfterMs !== undefined && (!Number.isFinite(outcome.retryAfterMs) || outcome.retryAfterMs < 0)) throw new Error('Invalid retry delay');
+      if (outcome.kind === 'retryable' && (outcome.retryAfterMs ?? 0) > 86400000) outcome = { kind: 'rejected', code: 'retry_delay_exceeded', status: outcome.status };
+      outcome = { kind: outcome.kind, code: outcome.code, ...(outcome.status === undefined ? {} : { status: outcome.status }), ...(outcome.retryAfterMs === undefined ? {} : { retryAfterMs: outcome.retryAfterMs }) };
+    } catch { outcome = { kind: 'uncertain', code: 'response_unknown' }; }
+    const now = this.now();
+    const nextAt = outcome.kind === 'retryable' && delivery.attempts < delivery.maxAttempts
+      ? now + Math.max(delivery.retryDelaysMs[delivery.attempts - 1]!, (outcome.retryAfterMs ?? 0)) : null;
+    // Storage failures propagate; a still-held claim later recovers as uncertain, never a replay.
+    if (!await this.repository.finish(id, claim, outcome, now, nextAt)) await this.recoverExpired();
+    return this.get(id);
+  }
+}

package/modules/integrations/core/destination.ts

@@ -0,0 +1,13 @@
+import { isPublicAddress } from './public-address.ts';
+export { isPublicAddress } from './public-address.ts';
+
+export function validateDestination(value: string): URL {
+  let url: URL;
+  try { url = new URL(value); } catch { throw new Error('Invalid destination'); }
+  if (url.protocol !== 'https:' || url.username || url.password || url.hash || (url.port && url.port !== '443') || value.length > 8192) throw new Error('Destination must be public HTTPS without credentials, fragment or nonstandard port');
+  const host = url.hostname.toLowerCase();
+  if (!host || host.endsWith('.') || host === 'localhost' || /\.(localhost|local|internal|invalid|test)$/.test(host)) throw new Error('Destination hostname is not public');
+  if (host.includes(':') || /^[\d.]+$/.test(host)) { if (!isPublicAddress(host)) throw new Error('Destination address is not public'); }
+  else if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(host)) throw new Error('Invalid destination hostname');
+  return url;
+}

package/modules/integrations/core/index.ts

@@ -0,0 +1,7 @@
+export * from './types.ts';
+export * from './database.ts';
+export * from './repository.ts';
+export * from './delivery.ts';
+export * from './destination.ts';
+export * from './webhook.ts';
+export * from './tokens.ts';

package/modules/integrations/core/node-transport.ts

@@ -0,0 +1,72 @@
+import { lookup } from 'node:dns/promises';
+import { request } from 'node:https';
+import { isIP } from 'node:net';
+import type { IncomingMessage } from 'node:http';
+import { isPublicAddress, validateDestination } from './destination.ts';
+import type { TrustedTransport, WireRequest, WireResponse } from './types.ts';
+
+/** Resolves once, validates EVERY answer, and pins that address to the TLS connection's lookup.
+ * TLS SNI/certificate verification still uses the original hostname; no redirect is followed. */
+export class NodePinnedTransport implements TrustedTransport {
+  private timeoutMs: number;
+  private maxResponseBytes: number;
+  constructor(options: { timeoutMs?: number; maxResponseBytes?: number } = {}) {
+    this.timeoutMs = options.timeoutMs ?? 15000; this.maxResponseBytes = options.maxResponseBytes ?? 65536;
+    if (!Number.isSafeInteger(this.timeoutMs) || this.timeoutMs < 1 || this.timeoutMs > 30000 || !Number.isSafeInteger(this.maxResponseBytes) || this.maxResponseBytes < 1 || this.maxResponseBytes > 1048576) throw new Error('Invalid transport limits');
+  }
+  async send(wire: WireRequest): Promise<WireResponse> {
+    const url = validateDestination(wire.url);
+    const host = url.hostname.replace(/^\[|\]$/g, '');
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const addresses = isIP(host) ? [{ address: host, family: isIP(host) }] : await Promise.race([
+      lookup(host, { all: true, verbatim: true }),
+      new Promise<never>((_resolve, reject) => { timer = setTimeout(() => reject(new Error('DNS timeout')), this.timeoutMs); }),
+    ]).finally(() => { if (timer) clearTimeout(timer); });
+    if (!addresses.length || addresses.some(a => !isPublicAddress(a.address))) throw new Error('Destination DNS is not public');
+    const pinned = addresses[0]!;
+    for (const name of Object.keys(wire.headers)) if (/^(host|connection|transfer-encoding|content-length|proxy-authorization)$/i.test(name)) throw new Error('Forbidden transport header');
+    return new Promise((resolve, reject) => {
+      let settled = false, response: IncomingMessage | undefined;
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      const fail = (error: Error) => {
+        if (settled) return;
+        // Reject synchronously before destroy can race a queued response end event.
+        settled = true; clearTimeout(timer); reject(error);
+        response?.destroy(); req.destroy();
+      };
+      const req = request(url, {
+        method: 'POST', agent: false, rejectUnauthorized: true,
+        headers: { ...wire.headers, 'content-length': Buffer.byteLength(wire.body) },
+        lookup: (_hostname, options, callback) => {
+          if (options.all) callback(null, [pinned]);
+          else callback(null, pinned.address, pinned.family);
+        },
+      }, res => {
+        response = res;
+        if (settled) { res.destroy(); return; }
+        const chunks: Buffer[] = []; let size = 0;
+        res.on('data', (chunk: Buffer) => {
+          if (settled) return;
+          size += chunk.length;
+          if (size > this.maxResponseBytes) fail(new Error('Response limit exceeded'));
+          else chunks.push(chunk);
+        });
+        res.on('error', fail);
+        res.on('aborted', () => fail(new Error('Response aborted')));
+        res.on('close', () => { if (!res.complete) fail(new Error('Response incomplete')); });
+        res.on('end', () => {
+          if (settled) return;
+          if (!res.complete) { fail(new Error('Response incomplete')); return; }
+          const headers: Record<string, string> = {};
+          for (const [name, value] of Object.entries(res.headers)) if (value !== undefined) headers[name] = Array.isArray(value) ? value.join(', ') : value;
+          settled = true; clearTimeout(timer);
+          resolve({ status: res.statusCode ?? 0, headers, body: Buffer.concat(chunks).toString('utf8') });
+        });
+      });
+      timer = setTimeout(() => fail(new Error('Transport timeout')), this.timeoutMs);
+      req.on('close', () => { if (!settled) fail(new Error('Transport closed')); });
+      req.on('error', fail);
+      req.end(wire.body);
+    });
+  }
+}

package/modules/integrations/core/public-address.ts

@@ -0,0 +1,57 @@
+/** Maintained conservative routing policy for both saved literals and every DNS answer.
+ * Special-purpose allocations reject even when some are globally reachable. */
+const nonPublicRanges = {
+  ipv4: [
+    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8],
+    ['168.63.129.16', 32], // Azure platform virtual address
+    ['169.254.0.0', 16], ['172.16.0.0', 12],
+    ['192.0.0.0', 16], // Preserve Base's broader exclusion, including 192.0.2.0/24.
+    ['192.31.196.0', 24], ['192.52.193.0', 24], ['192.88.99.0', 24],
+    ['192.168.0.0', 16], ['192.175.48.0', 24], ['198.18.0.0', 15],
+    ['198.51.100.0', 24], ['203.0.113.0', 24], ['224.0.0.0', 3],
+  ],
+  ipv6: [
+    ['::', 3], ['4000::', 2], ['8000::', 1], // Only ordinary 2000::/3 unicast is eligible.
+    ['2001::', 23], ['2001:db8::', 32], ['2002::', 16],
+    ['2620:4f:8000::', 48], ['3ffe::', 16],
+    ['3fff::', 16], // Preserve Base's broader exclusion than the 3fff::/20 allocation.
+  ],
+} as const;
+
+function ipv4(address: string): number | null {
+  const octets = address.split('.');
+  if (octets.length !== 4 || octets.some(octet => !/^(0|[1-9]\d{0,2})$/.test(octet))) return null;
+  const bytes = octets.map(Number);
+  if (bytes.some(byte => byte > 255)) return null;
+  return bytes.reduce((value, byte) => value * 256 + byte, 0);
+}
+
+function ipv6(address: string): bigint | null {
+  if (!/^[0-9a-f:]+$/.test(address) || !address.includes(':')) return null;
+  const pieces = address.split('::');
+  if (pieces.length > 2) return null;
+  const left = pieces[0] ? pieces[0].split(':') : [];
+  const right = pieces[1] ? pieces[1].split(':') : [];
+  if ([...left, ...right].some(word => !/^[0-9a-f]{1,4}$/.test(word))) return null;
+  const missing = 8 - left.length - right.length;
+  if ((pieces.length === 1 && missing !== 0) || (pieces.length === 2 && missing < 1)) return null;
+  return [...left, ...Array(pieces.length === 2 ? missing : 0).fill('0'), ...right]
+    .reduce((value: bigint, word: string) => (value << 16n) | BigInt(parseInt(word, 16)), 0n);
+}
+
+const ipv4Ranges = nonPublicRanges.ipv4.map(([base, bits]) => ({ base: ipv4(base)!, divisor: 2 ** (32 - bits) }));
+const ipv6Ranges = nonPublicRanges.ipv6.map(([base, bits]) => ({ base: ipv6(base)!, shift: BigInt(128 - bits) }));
+
+/** Portable Worker/Node guard; DNS and URL callers share this exact policy. */
+export function isPublicAddress(raw: string): boolean {
+  if (typeof raw !== 'string') return false;
+  const address = (raw.startsWith('[') && raw.endsWith(']') ? raw.slice(1, -1) : raw).toLowerCase();
+  const v4 = ipv4(address);
+  if (v4 !== null) return !ipv4Ranges.some(({ base, divisor }) => Math.floor(v4 / divisor) === Math.floor(base / divisor));
+  const v6 = ipv6(address);
+  if (v6 === null) return false;
+  // ISATAP embeds IPv4 in an interface identifier under otherwise-public prefixes.
+  const interfacePrefix = (v6 >> 32n) & 0xffffffffn;
+  if (interfacePrefix === 0x00005efen || interfacePrefix === 0x02005efen) return false;
+  return !ipv6Ranges.some(({ base, shift }) => v6 >> shift === base >> shift);
+}