@technomoron/mail-magic 1.0.43 → 1.0.44

package/CHANGES

@@ -1,6 +1,13 @@
 CHANGES
 =======
 
+Version 1.0.44 (2026-03-05)
+
+- fix(autoreload): catch unhandled promise rejections from async `reload()` in `enableInitDataAutoReload` `onChange` callback.
+- fix(mailer): validate that parsed `vars` is a non-null, non-array object after `JSON.parse`; return 400 for invalid types.
+- docs(utils): add doc comment to `buildRequestMeta` clarifying it is informational and requires a trusted reverse proxy for reliable IP data.
+- (Changes generated/assisted by Claude Code (profile: anthropic-claude-opus-4-6/high).)
+
 Version 1.0.43 (2026-03-04)
 
 - fix(security): add allowlist for custom email headers on `/v1/tx/message` to prevent header injection via arbitrary keys (e.g. `Bcc`, `From`, `Sender`).

package/dist/esm/api/mailer.js

@@ -89,6 +89,9 @@ export class MailerAPI extends ApiModule {
                 throw new ApiError({ code: 400, message: 'Invalid JSON provided in "vars"' });
             }
         }
+        if (!parsedVars || typeof parsedVars !== 'object' || Array.isArray(parsedVars)) {
+            throw new ApiError({ code: 400, message: '"vars" must be a JSON object' });
+        }
         const thevars = parsedVars;
         const { valid, invalid } = this.validateEmails(rcpt);
         if (invalid.length > 0) {

package/dist/esm/store/store.d.ts

@@ -18,7 +18,7 @@ type AutoReloadContext = {
     config_filename: (name: string) => string;
     print_debug: (msg: string) => void;
 };
-export declare function enableInitDataAutoReload(ctx: AutoReloadContext, reload: () => void): AutoReloadHandle | null;
+export declare function enableInitDataAutoReload(ctx: AutoReloadContext, reload: () => void | Promise<void>): AutoReloadHandle | null;
 export declare class mailStore {
     private env;
     vars: MailStoreVars;

package/dist/esm/store/store.js

@@ -38,8 +38,12 @@ export function enableInitDataAutoReload(ctx, reload) {
         debounceTimer = setTimeout(() => {
             debounceTimer = null;
             ctx.print_debug('Config file changed, reloading...');
+            // reload() may be sync or async — try/catch handles a synchronous
+            // throw, while Promise.resolve().catch() handles an async rejection.
             try {
-                reload();
+                Promise.resolve(reload()).catch((err) => {
+                    ctx.print_debug(`Failed to reload config: ${err}`);
+                });
             }
             catch (err) {
                 ctx.print_debug(`Failed to reload config: ${err}`);

package/dist/esm/util/utils.d.ts

@@ -19,6 +19,13 @@ export declare function user_and_domain(domain_id: number): Promise<{
     user: api_user;
     domain: api_domain;
 }>;
+/**
+ * Collect informational request metadata (client IP, IP chain, timestamp) for
+ * use in template rendering context.  The values are **not** used for security
+ * decisions such as rate limiting — those rely on `getClientIp()` which is
+ * trust-proxy aware.  For the IP chain to be meaningful the server must sit
+ * behind a trusted reverse proxy that sets the forwarded headers.
+ */
 export declare function buildRequestMeta(rawReq: unknown): RequestMeta;
 export declare function decodeComponent(value: string | string[] | undefined): string;
 export declare function getBodyValue(body: Record<string, unknown>, ...keys: string[]): string;

package/dist/esm/util/utils.js

@@ -60,6 +60,13 @@ function resolveHeader(headers, key) {
     }
     return undefined;
 }
+/**
+ * Collect informational request metadata (client IP, IP chain, timestamp) for
+ * use in template rendering context.  The values are **not** used for security
+ * decisions such as rate limiting — those rely on `getClientIp()` which is
+ * trust-proxy aware.  For the IP chain to be meaningful the server must sit
+ * behind a trusted reverse proxy that sets the forwarded headers.
+ */
 export function buildRequestMeta(rawReq) {
     const req = (rawReq ?? {});
     const headers = req.headers ?? {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@technomoron/mail-magic",
-  "version": "1.0.43",
+  "version": "1.0.44",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
   "type": "module",