@serve.zone/platformclient 3.0.1 → 4.1.0

package/ts/classes.platformclient.ts

@@ -15,6 +15,8 @@ export interface ISzPlatformClientOptions {
   token?: string;
   url?: string;
   platformUrl?: string;
+  /** Explicit HTTPS Cloudly origin. Bindings never select this authority. */
+  cloudlyUrl?: string;
   binding?: plugins.servezoneInterfaces.platform.IPlatformBinding;
   bindings?: plugins.servezoneInterfaces.platform.IPlatformBinding[];
   coreMail?: ISzCoreMailConnectorOptions;
@@ -26,7 +28,13 @@ export class SzPlatformClient {
   private connectionAddress?: string;
   public platformBindings: plugins.servezoneInterfaces.platform.IPlatformBinding[] = [];
   public typedrouter: plugins.typedrequest.TypedRouter = new plugins.typedrequest.TypedRouter();
-  public typedsocket!: plugins.typedsocket.TypedSocket;
+  public typedsocket?: plugins.typedsocket.TypedSocket;
+  private identity?: plugins.servezoneInterfaces.data.IIdentity;
+  private authenticationGeneration = 0;
+  private authenticationAbort?: AbortController;
+  private authenticationOperations = new Set<Promise<unknown>>();
+  private renewalTimer?: ReturnType<typeof setTimeout>;
+  private statusSubscription?: { unsubscribe(): void };
   private qenvInstance = new plugins.qenv.Qenv();
   private stopped = false;
   private initPromise?: Promise<void>;
@@ -67,6 +75,7 @@ export class SzPlatformClient {
       return;
     }
 
+    await this.configureCoreMailFromEnv();
     this.platformBindings = this.mergePlatformBindings(
       this.platformBindings,
       await this.discoverPlatformBindings()
@@ -77,25 +86,41 @@ export class SzPlatformClient {
       return;
     }
     if (!this.authorizationString) throw new Error('authorizationString is required');
+    if (this.authorizationString.length > 8192 || /[\x00-\x20\x7f]/.test(this.authorizationString)) {
+      throw new Error('Platform authorization is invalid.');
+    }
     const socket = await plugins.typedsocket.TypedSocket.createClient(
-      this.typedrouter as any,
+      this.typedrouter,
       await this.getConnectionAddress(),
-      { abortSignal: this.platformSocketAbortController.signal },
+      {
+        autoReconnect: true, maxRetries: 100, initialBackoffMs: 1000, maxBackoffMs: 30_000,
+        abortSignal: this.platformSocketAbortController.signal,
+        restoreConnection: (context) => {
+          this.invalidateAuthentication();
+          const generation = this.authenticationGeneration;
+          return this.trackAuthentication(this.authenticate(context.createTypedRequest, context.abortSignal, generation));
+        },
+      },
     );
     if (this.stopped) {
-      await socket.stop().catch(() => undefined);
+      await socket.stop();
       throw this.createAbortError();
     }
     this.typedsocket = socket;
     try {
-      await this.setAuthorizationTag();
+      this.statusSubscription = socket.statusSubject.subscribe((status) => {
+        if (status === 'disconnected') this.invalidateAuthentication();
+        if (status === 'connected') this.scheduleRenewal(socket);
+      });
+      this.scheduleRenewal(socket);
       this.assertRunning();
       if (this.coreMailConnector.isConfigured) {
         await this.coreMailConnector.init();
         this.assertRunning();
       }
     } catch (error) {
-      await socket.stop().catch(() => undefined);
+      this.invalidateAuthentication();
+      await socket.stop();
       throw error;
     }
   }
@@ -131,7 +156,7 @@ export class SzPlatformClient {
       optionsArg.authorization ||
       optionsArg.token ||
       this.authorizationString;
-    this.connectionAddress = optionsArg.url || optionsArg.platformUrl || this.connectionAddress;
+    this.connectionAddress = optionsArg.cloudlyUrl || optionsArg.url || optionsArg.platformUrl || this.connectionAddress;
     this.platformBindings = this.mergePlatformBindings(
       this.platformBindings,
       [optionsArg.binding, ...(optionsArg.bindings || [])].filter(
@@ -146,34 +171,12 @@ export class SzPlatformClient {
   private async getConnectionAddress() {
     const connectionAddress =
       this.connectionAddress ||
-      (await this.getConfiguredEnvVar('SERVEZONE_PLATFORM_URL')) ||
-      this.getConnectionAddressFromBindings();
-    if (!connectionAddress) throw new Error('SERVEZONE_PLATFORM_URL or platform binding endpoint is required');
-    return connectionAddress;
-  }
-
-  private getConnectionAddressFromBindings() {
-    for (const binding of this.platformBindings) {
-      if (binding.desiredState === 'disabled' || binding.status === 'failed') {
-        continue;
-      }
-      if (!this.isSupportedConnectorCapability(binding.capability)) {
-        continue;
-      }
-      const endpoint = binding.endpoints?.find((endpointArg) => {
-        return endpointArg.protocol === 'typedrequest' || endpointArg.protocol === 'http';
-      });
-      const endpointUrl = endpoint?.internalUrl || endpoint?.externalUrl;
-      if (endpointUrl) {
-        return endpointUrl;
-      }
-    }
-  }
-
-  private isSupportedConnectorCapability(
-    capabilityArg: plugins.servezoneInterfaces.platform.TPlatformCapability
-  ) {
-    return ['email', 'sms', 'pushnotification', 'letter'].includes(capabilityArg);
+      (await this.getConfiguredEnvVar('SERVEZONE_PLATFORM_URL'));
+    if (!connectionAddress) throw new Error('An explicit Cloudly URL is required.');
+    const parsed = new URL(connectionAddress);
+    if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.search || parsed.hash
+      || parsed.pathname !== '/') throw new Error('Cloudly URL must be an HTTPS origin.');
+    return parsed.origin;
   }
 
   private async getConfiguredAuthorizationString() {
@@ -183,19 +186,81 @@ export class SzPlatformClient {
     );
   }
 
-  private async setAuthorizationTag() {
-    if (!this.authorizationString) {
-      return;
-    }
+  public requireTypedSocket(): plugins.typedsocket.TypedSocket {
+    this.assertRunning();
+    if (!this.typedsocket || this.typedsocket.getStatus() !== 'connected' || !this.identity
+      || this.identity.expiresAt <= Date.now()) throw new Error('Cloudly platform session is unavailable.');
+    return this.typedsocket;
+  }
+
+  private invalidateAuthentication(): void {
+    this.authenticationGeneration++;
+    this.authenticationAbort?.abort();
+    this.authenticationAbort = undefined;
+    this.identity = undefined;
+    if (this.renewalTimer) clearTimeout(this.renewalTimer);
+    this.renewalTimer = undefined;
+  }
+
+  private trackAuthentication<T>(operation: Promise<T>): Promise<T> {
+    this.authenticationOperations.add(operation);
+    void operation.then(() => this.authenticationOperations.delete(operation), () => this.authenticationOperations.delete(operation));
+    return operation;
+  }
+
+  private async authenticate(createRequest: plugins.typedsocket.TTypedSocketRestoreRequestFactory,
+    signal: AbortSignal, generation: number): Promise<void> {
+    const requireCurrent = () => {
+      this.assertRunning(); signal.throwIfAborted();
+      if (generation !== this.authenticationGeneration) throw this.createAbortError();
+    };
     try {
-      await this.typedsocket.setTag('authorization' as any, this.authorizationString);
-    } catch (error) {
-      if (await this.getConfiguredEnvVar('SERVEZONE_PLATFORMCLIENT_DEBUG')) {
-        console.warn('Could not set platform authorization tag:', (error as Error).message);
+      requireCurrent();
+      const exchange = createRequest<plugins.servezoneInterfaces.requests.identity.IRequest_Any_Cloudly_CoreflowManager_GetIdentityByToken>(
+        'getIdentityByToken');
+      exchange.skipHooks = true;
+      const response = await exchange.fire({ token: this.authorizationString! }, { maxRetries: 0, abortSignal: signal });
+      requireCurrent();
+      const identity = response.identity;
+      if (!identity || identity.type !== 'machine' || identity.role !== 'api'
+        || typeof identity.userId !== 'string' || !/^service-machine:[a-f0-9]{64}$/.test(identity.userId)
+        || !Number.isSafeInteger(identity.expiresAt) || identity.expiresAt <= Date.now() + 1000) {
+        throw new Error('Invalid platform identity.');
       }
+      const requestData = plugins.servezoneInterfaces.data.snapshotRegisterCloudlyClientSessionRequestV1({
+        schemaVersion: 1, identity: { jwt: identity.jwt },
+      });
+      const registration = createRequest<plugins.servezoneInterfaces.requests.runtimesession.IReq_Any_Cloudly_RegisterCloudlyClientSessionV1>(
+        'registerCloudlyClientSessionV1');
+      registration.skipHooks = true;
+      const registered = await registration.fire(requestData, { maxRetries: 0, abortSignal: signal });
+      plugins.servezoneInterfaces.data.snapshotRegisterCloudlyClientSessionResponseV1(registered);
+      requireCurrent();
+      this.identity = { type: identity.type, role: identity.role, userId: identity.userId,
+        name: identity.userId, expiresAt: identity.expiresAt, jwt: requestData.identity.jwt };
+    } catch {
+      if (this.stopped || signal.aborted || generation !== this.authenticationGeneration) throw this.createAbortError();
+      throw new Error('Cloudly platform authentication failed.');
     }
   }
 
+  private scheduleRenewal(socket: plugins.typedsocket.TypedSocket): void {
+    if (this.renewalTimer) clearTimeout(this.renewalTimer);
+    if (this.stopped || this.typedsocket !== socket || !this.identity) return;
+    const generation = this.authenticationGeneration;
+    const remaining = this.identity.expiresAt - Date.now();
+    this.renewalTimer = setTimeout(() => {
+      this.renewalTimer = undefined;
+      if (this.stopped || this.typedsocket !== socket || generation !== this.authenticationGeneration) return;
+      const abort = new AbortController(); this.authenticationAbort = abort;
+      const work = this.trackAuthentication(this.authenticate(
+        (method) => socket.createTypedRequest(method), abort.signal, generation));
+      void work.then(() => this.scheduleRenewal(socket), () => {
+        if (!this.stopped && generation === this.authenticationGeneration) void this.stop().catch(() => undefined);
+      });
+    }, Math.max(1, Math.min(30 * 60 * 1000, Math.floor(remaining / 2))));
+  }
+
   public stop(): Promise<void> {
     this.stopPromise ??= this.stopInner();
     return this.stopPromise;
@@ -203,21 +268,26 @@ export class SzPlatformClient {
 
   private async stopInner(): Promise<void> {
     this.stopped = true;
+    this.invalidateAuthentication();
+    this.statusSubscription?.unsubscribe();
+    this.statusSubscription = undefined;
     this.platformSocketAbortController.abort(this.createAbortError());
     const socket = this.typedsocket;
-    await Promise.allSettled([
+    this.typedsocket = undefined;
+    const results = await Promise.allSettled([
       this.emailConnector.stop(),
       this.webPushConnector.stop(),
       this.coreMailConnector.stop(),
       socket?.stop(),
-      this.initPromise,
     ]);
-    if (this.typedsocket && this.typedsocket !== socket) {
-      await this.typedsocket.stop().catch(() => undefined);
-    }
+    await this.initPromise?.catch(() => undefined);
+    while (this.authenticationOperations.size) await Promise.allSettled([...this.authenticationOperations]);
+    const failures = results.filter((result): result is PromiseRejectedResult => result.status === 'rejected');
+    if (failures.length) throw new AggregateError(failures.map(result => result.reason), 'Platform client shutdown failed.');
   }
 
-  private assertRunning(): void {
+  /** Connector admission guard; shutdown is terminal for this client lifetime. */
+  public assertRunning(): void {
     if (this.stopped) {
       throw this.createAbortError();
     }
@@ -229,6 +299,45 @@ export class SzPlatformClient {
     return error;
   }
 
+  /**
+   * Configures the CoreMail connector from the unscoped MAIL_COREMAIL_* group
+   * when no programmatic `coreMail` option was supplied. Per-address groups
+   * (MAIL_<TOKEN>_COREMAIL_*) are resolved by the email connector at send time;
+   * this only establishes the default binding so init() can authenticate early.
+   * A partially configured group throws rather than starting unconfigured.
+   */
+  private async configureCoreMailFromEnv(): Promise<void> {
+    if (this.coreMailConnector.isConfigured) return;
+    const endpointUrl = await this.getConfiguredEnvVar('MAIL_COREMAIL_URL');
+    const bindingId = await this.getConfiguredEnvVar('MAIL_COREMAIL_BINDING_ID');
+    const credentialId = await this.getConfiguredEnvVar('MAIL_COREMAIL_CREDENTIAL_ID');
+    const credentialVersion = await this.getConfiguredEnvVar('MAIL_COREMAIL_CREDENTIAL_VERSION');
+    const credentialSecret = await this.getConfiguredEnvVar('MAIL_COREMAIL_CREDENTIAL_SECRET');
+    const present = [endpointUrl, bindingId, credentialId, credentialVersion, credentialSecret];
+    if (!present.some(Boolean)) return;
+    const missing = [
+      ...(endpointUrl ? [] : ['MAIL_COREMAIL_URL']),
+      ...(bindingId ? [] : ['MAIL_COREMAIL_BINDING_ID']),
+      ...(credentialId ? [] : ['MAIL_COREMAIL_CREDENTIAL_ID']),
+      ...(credentialVersion ? [] : ['MAIL_COREMAIL_CREDENTIAL_VERSION']),
+      ...(credentialSecret ? [] : ['MAIL_COREMAIL_CREDENTIAL_SECRET']),
+    ];
+    if (missing.length > 0) {
+      throw new Error(`CoreMail is partially configured. Missing: ${missing.join(', ')}`);
+    }
+    const parsedVersion = Number(credentialVersion);
+    if (!Number.isSafeInteger(parsedVersion) || parsedVersion < 1) {
+      throw new Error('MAIL_COREMAIL_CREDENTIAL_VERSION must be a positive integer');
+    }
+    this.coreMailConnector.configure({
+      endpointUrl: endpointUrl!,
+      bindingId: bindingId!,
+      credentialId: credentialId!,
+      credentialVersion: parsedVersion,
+      credentialSecret: credentialSecret!,
+    });
+  }
+
   private async discoverPlatformBindings() {
     const bindings: plugins.servezoneInterfaces.platform.IPlatformBinding[] = [];
     const envBindings = await this.getConfiguredEnvVar('SERVEZONE_PLATFORM_BINDINGS');

package/ts/coremail/classes.coremailconnector.ts

@@ -19,6 +19,29 @@ export interface ISzCoreMailConnectorOptions {
   credentialSecret: string;
 }
 
+/** Default cadence for the pull-based inbound loop. */
+export const szCoreMailInboundPollDefaults = Object.freeze({
+  intervalMs: 5_000,
+  minimumIntervalMs: 250,
+  maximumBackoffMs: 120_000,
+  pageLimit: 25,
+});
+
+export interface ISzCoreMailInboundPollOptions {
+  /** Tick cadence in milliseconds; defaults to 5000, floored at 250. */
+  intervalMs?: number;
+  /** Deliveries requested per tick; defaults to 25. */
+  pageLimit?: number;
+}
+
+/**
+ * Invoked once per pending delivery. Resolving acknowledges the delivery as
+ * `processed`; throwing leaves it pending for a later tick.
+ */
+export type TSzCoreMailInboundHandler = (
+  resultArg: ISzCoreMailInboundFetchResult,
+) => Promise<void> | void;
+
 export interface ISzCoreMailUploadPartOptions {
   submissionId: string;
   part: plugins.servezoneInterfaces.data.ICoreMailContentDescriptor;
@@ -70,11 +93,37 @@ export class SzCoreMailConnector {
   private readonly stopController = new AbortController();
   private readonly activeOperations = new Set<Promise<unknown>>();
   private stopPromise?: Promise<void>;
+  private inboundHandler?: TSzCoreMailInboundHandler;
+  private inboundPollOptions = { intervalMs: 0, pageLimit: 0 };
+  private inboundTimer?: ReturnType<typeof setTimeout>;
+  private inboundTickPromise?: Promise<void>;
+  private inboundConsecutiveFailures = 0;
 
   public get isConfigured(): boolean {
     return Boolean(this.options);
   }
 
+  /**
+   * Value-free identity of the binding this connector is configured for, or
+   * undefined while unconfigured. Deliberately excludes credentialSecret: it
+   * exists so a caller holding several bindings can tell whether this instance
+   * already serves one of them, which never requires the secret.
+   */
+  public get configuredBinding(): Readonly<{
+    endpointUrl: string;
+    bindingId: string;
+    credentialId: string;
+    credentialVersion: number;
+  }> | undefined {
+    if (!this.options) return undefined;
+    return Object.freeze({
+      endpointUrl: this.options.endpointUrl,
+      bindingId: this.options.bindingId,
+      credentialId: this.options.credentialId,
+      credentialVersion: this.options.credentialVersion,
+    });
+  }
+
   public configure(optionsArg: ISzCoreMailConnectorOptions): void {
     if (this.stopped) {
       throw new Error('CoreMail connector has stopped.');
@@ -181,18 +230,144 @@ export class SzCoreMailConnector {
     };
   }
 
+  /**
+   * Starts the bounded pull loop (list -> fetch -> acknowledge). CoreMail never
+   * pushes inbound mail, so the workload polls. One registration owns the loop;
+   * re-registering replaces the handler without starting a second timer.
+   */
+  public startInboundPolling(
+    handlerArg: TSzCoreMailInboundHandler,
+    optionsArg: ISzCoreMailInboundPollOptions = {},
+  ): void {
+    this.requireOptions();
+    if (typeof handlerArg !== 'function') {
+      throw new Error('CoreMail inbound handler must be a function.');
+    }
+    const requestedInterval = optionsArg.intervalMs ?? szCoreMailInboundPollDefaults.intervalMs;
+    if (!Number.isSafeInteger(requestedInterval) || requestedInterval < szCoreMailInboundPollDefaults.minimumIntervalMs) {
+      throw new Error(
+        `CoreMail inbound intervalMs must be an integer of at least ${szCoreMailInboundPollDefaults.minimumIntervalMs}.`,
+      );
+    }
+    const requestedPageLimit = optionsArg.pageLimit ?? szCoreMailInboundPollDefaults.pageLimit;
+    if (
+      !Number.isSafeInteger(requestedPageLimit)
+      || requestedPageLimit < 1
+      || requestedPageLimit > plugins.servezoneInterfaces.data.coreMailLimits.inboundPageSize
+    ) {
+      throw new Error(
+        `CoreMail inbound pageLimit must be an integer between 1 and ${plugins.servezoneInterfaces.data.coreMailLimits.inboundPageSize}.`,
+      );
+    }
+    this.inboundHandler = handlerArg;
+    this.inboundPollOptions = { intervalMs: requestedInterval, pageLimit: requestedPageLimit };
+    this.inboundConsecutiveFailures = 0;
+    if (!this.inboundTimer && !this.inboundTickPromise) {
+      this.scheduleInboundTick(0);
+    }
+  }
+
+  /** Stops the pull loop and awaits the tick in flight. */
+  public async stopInboundPolling(): Promise<void> {
+    this.inboundHandler = undefined;
+    if (this.inboundTimer) {
+      clearTimeout(this.inboundTimer);
+      this.inboundTimer = undefined;
+    }
+    await this.inboundTickPromise?.catch(() => undefined);
+  }
+
   public stop(): Promise<void> {
     this.stopPromise ??= this.stopInner();
     return this.stopPromise;
   }
 
+  private scheduleInboundTick(delayMsArg: number): void {
+    if (this.stopped || !this.inboundHandler) return;
+    this.inboundTimer = setTimeout(() => {
+      this.inboundTimer = undefined;
+      // One tick at a time: the next tick is only scheduled once this one settles.
+      const tick = this.runInboundTick().catch(() => undefined).finally(() => {
+        if (this.inboundTickPromise === tick) this.inboundTickPromise = undefined;
+        this.scheduleInboundTick(this.nextInboundDelayMs());
+      });
+      this.inboundTickPromise = tick;
+    }, delayMsArg);
+    this.inboundTimer.unref?.();
+  }
+
+  /** Exponential backoff on transport failure, capped; reset by a clean tick. */
+  private nextInboundDelayMs(): number {
+    if (this.inboundConsecutiveFailures === 0) return this.inboundPollOptions.intervalMs;
+    const backoff = this.inboundPollOptions.intervalMs * 2 ** Math.min(this.inboundConsecutiveFailures, 16);
+    return Math.min(backoff, szCoreMailInboundPollDefaults.maximumBackoffMs);
+  }
+
+  private async runInboundTick(): Promise<void> {
+    const handler = this.inboundHandler;
+    if (this.stopped || !handler) return;
+    try {
+      const page = await this.listInboundDeliveries({ limit: this.inboundPollOptions.pageLimit });
+      this.inboundConsecutiveFailures = 0;
+      for (const delivery of page.deliveries) {
+        if (this.stopped || this.inboundHandler !== handler) return;
+        if (delivery.state === 'acknowledged') continue;
+        let fetched: ISzCoreMailInboundFetchResult;
+        try {
+          fetched = await this.fetchInboundDelivery(delivery);
+        } catch (error) {
+          // Leave the delivery pending; a later tick retries the fetch.
+          this.inboundConsecutiveFailures++;
+          return;
+        }
+        try {
+          await handler(fetched);
+        } catch {
+          // A throwing handler must not acknowledge. The delivery stays pending.
+          continue;
+        }
+        await this.acknowledgeInboundDelivery({
+          deliveryId: fetched.delivery.deliveryId,
+          outcome: 'processed',
+        });
+      }
+    } catch (error) {
+      this.inboundConsecutiveFailures++;
+    }
+  }
+
+  /**
+   * Mirrors the loopback rule TypedSocket enforces before it downgrades a
+   * connection to an insecure WebSocket. See `isLoopbackHostname` in
+   * node_modules/@api.global/typedsocket/dist_ts/classes.typedsocket.js:257-267,
+   * applied at classes.typedsocket.js:986-988
+   * ('TypedSocket insecure WebSocket transport is restricted to loopback hosts.').
+   * Keeping the predicates identical means this connector never accepts an
+   * endpoint that TypedSocket would refuse one layer down.
+   */
+  private isLoopbackHostname(hostnameArg: string): boolean {
+    const hostname = hostnameArg.toLowerCase().replace(/^\[(.*)\]$/, '$1');
+    if (hostname === 'localhost' || hostname.endsWith('.localhost') || hostname === '::1') {
+      return true;
+    }
+    const octets = hostname.split('.');
+    return octets.length === 4
+      && octets.every((octetArg) => /^\d{1,3}$/.test(octetArg) && Number(octetArg) <= 255)
+      && Number(octets[0]) === 127;
+  }
+
   private normalizeOptions(
     optionsArg: ISzCoreMailConnectorOptions,
   ): ISzCoreMailConnectorOptions {
     const endpointUrl = new URL(optionsArg.endpointUrl);
+    // TypedSocket maps http:/ws: onto ws: and https:/wss: onto wss:
+    // (classes.typedsocket.js:974-985), so the same four schemes are accepted
+    // here; the insecure pair stays restricted to loopback authorities.
+    const isSecureProtocol = endpointUrl.protocol === 'https:' || endpointUrl.protocol === 'wss:';
+    const isInsecureProtocol = endpointUrl.protocol === 'http:' || endpointUrl.protocol === 'ws:';
     if (
       optionsArg.endpointUrl.trim() !== optionsArg.endpointUrl
-      || endpointUrl.protocol !== 'https:'
+      || (!isSecureProtocol && !isInsecureProtocol)
       || endpointUrl.username
       || endpointUrl.password
       || endpointUrl.search
@@ -202,6 +377,11 @@ export class SzCoreMailConnector {
     ) {
       throw new Error('CoreMail endpointUrl must be one canonical HTTPS /socket URL.');
     }
+    if (isInsecureProtocol && !this.isLoopbackHostname(endpointUrl.hostname)) {
+      throw new Error(
+        'CoreMail insecure endpointUrl is restricted to loopback hosts.',
+      );
+    }
     for (const [name, value] of [
       ['bindingId', optionsArg.bindingId],
       ['credentialId', optionsArg.credentialId],
@@ -397,8 +577,13 @@ export class SzCoreMailConnector {
       throw new Error('CoreMail returned an invalid transfer origin.');
     }
     const url = new URL(valueArg);
+    // The transfer origin must follow the same scheme rule as endpointUrl: a
+    // loopback CoreMail reached over http: also issues http: transfer grants,
+    // so restricting this to https: would make loopback deployments unusable.
+    const isSecureProtocol = url.protocol === 'https:';
+    const isInsecureProtocol = url.protocol === 'http:';
     if (
-      url.protocol !== 'https:'
+      (!isSecureProtocol && !isInsecureProtocol)
       || url.username
       || url.password
       || url.search
@@ -408,6 +593,9 @@ export class SzCoreMailConnector {
     ) {
       throw new Error('CoreMail returned a noncanonical transfer origin.');
     }
+    if (isInsecureProtocol && !this.isLoopbackHostname(url.hostname)) {
+      throw new Error('CoreMail returned an insecure non-loopback transfer origin.');
+    }
     return valueArg;
   }
 
@@ -689,7 +877,7 @@ export class SzCoreMailConnector {
         response.status !== 200
         || response.headers.get('content-type') !== grantArg.contentType
         || response.headers.get('content-length') !== String(grantArg.lengthBytes)
-        || response.headers.get('cache-control') !== 'no-store'
+        || !this.forbidsStoringResponse(response.headers.get('cache-control'))
         || response.headers.get('x-content-type-options') !== 'nosniff'
         || !responseBody
       ) {
@@ -794,6 +982,22 @@ export class SzCoreMailConnector {
     return url.toString();
   }
 
+  /**
+   * A one-time transfer payload must never be cached, but the exact spelling of
+   * Cache-Control is not ours to dictate: CoreMail's transfer service sets
+   * 'no-store' and typedserver's `noCache: true` then expands it to the full
+   * directive set ('no-store, no-cache, must-revalidate, proxy-revalidate,
+   * max-age=0'). Requiring byte equality with 'no-store' rejected every real
+   * CoreMail response, so assert the directive is present instead.
+   */
+  private forbidsStoringResponse(cacheControlArg: string | null): boolean {
+    if (!cacheControlArg) return false;
+    return cacheControlArg
+      .split(',')
+      .map((directiveArg) => directiveArg.trim().toLowerCase())
+      .includes('no-store');
+  }
+
   private async createSha256(
     bytesArg: Uint8Array,
   ): Promise<plugins.servezoneInterfaces.data.TCoreMailSha256> {
@@ -906,6 +1110,14 @@ export class SzCoreMailConnector {
   private async stopInner(): Promise<void> {
     this.stopped = true;
     this.generation++;
+    this.inboundHandler = undefined;
+    if (this.inboundTimer) {
+      clearTimeout(this.inboundTimer);
+      this.inboundTimer = undefined;
+    }
+    const inboundTick = this.inboundTickPromise;
+    this.inboundTickPromise = undefined;
+    await inboundTick?.catch(() => undefined);
     this.stopController.abort(this.createAbortError());
     const connection = this.connection;
     const pendingConnection = this.pendingConnection;