@ultimat3/mail 16.0.0 → 17.0.0

package/CLAUDE.md

@@ -37,6 +37,16 @@
 - No hex outside `MAIL_TOKENS`. Base styling is inlined (clients strip `<style>`); dark mode is
   one `prefers-color-scheme` block keyed on short `data-x` role codes.
 - Never format a date without `options.tz`. The `Date:` header is UTC, stated as `+0000`.
+- **`timeoutMs` is refused at CONSTRUCTION, where `poolSize` already is, and its floor is 1**
+  (`As of 2026-08-26`). `finiteCount('createSmtpDriver'|'createResendDriver', 'timeoutMs', …, 1)`.
+  Zero is not "no deadline" in either driver: the value goes straight to `AbortSignal.timeout` and
+  to `setTimeout(fn, timeoutMs)`, both of which fire on the next tick, so `0` and `NaN` are the same
+  failure — `setTimeout(fn, NaN)` IS `setTimeout(fn, 0)`. Resend's was the worse half: the signal is
+  constructed INSIDE the `try` that wraps the fetch, so `AbortSignal.timeout(NaN)`'s bare
+  `TypeError` was caught and reported as a RETRYABLE egress failure whose `fix:` said to curl the
+  endpoint, and the queue retried a config error to the dead-letter table. `bun run finite-bounds`
+  is the ratchet; the repair is recognised by the shape of the call.
+
 - **Every "now" in this package comes from a `Clock`, `createMemoryDriver` included** (`As of
   2026-08-22`). It stamped `at: new Date()`, and `SentMail.at` is what `outbox()`, `lastTo()` and
   the `/_x` panel ORDER on — so the one fact a test most needs to state was the one it could only

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/mail",
-  "version": "16.0.0",
+  "version": "17.0.0",
   "description": "Transactional email as data: one template renders HTML and text, sent through a job.",
   "license": "MIT",
   "type": "module",
@@ -31,10 +31,10 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "16.0.0",
-    "@ultimat3/i18n": "16.0.0",
-    "@ultimat3/jobs": "16.0.0",
-    "@ultimat3/schema": "16.0.0",
-    "@ultimat3/time": "16.0.0"
+    "@ultimat3/core": "17.0.0",
+    "@ultimat3/i18n": "17.0.0",
+    "@ultimat3/jobs": "17.0.0",
+    "@ultimat3/schema": "17.0.0",
+    "@ultimat3/time": "17.0.0"
   }
 }

package/src/driver-resend.ts

@@ -5,6 +5,7 @@
 import {
   ConfigInvalidError,
   EnvMissingError,
+  finiteCount,
   // The status table is core's: this package's copy and `packages/cache/src/purge-http.ts`'s were
   // byte-identical in two packages that cannot import each other, so one was always going to be
   // edited alone. A throttle or a transient conflict can land unchanged; every other 4xx here is a
@@ -130,7 +131,17 @@ export function createResendDriver(options: ResendDriverOptions): MailDriver {
   const apiKey = requireApiKey(options.apiKey);
   const from = requireFrom(options.from);
   const baseUrl = options.baseUrl ?? RESEND_BASE_URL;
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  // Refused here, where `apiKey` and `from` already are, and not on the first send:
+  // `AbortSignal.timeout(NaN)` raises a bare TypeError INSIDE the try below, so a misconfigured
+  // deadline was reported as a retryable egress failure whose fix said to curl the endpoint — and
+  // the queue retried it to the dead-letter table for a value no network could change. `0` is not
+  // "no deadline" either: the signal aborts on the next tick, before a byte leaves the host.
+  const timeoutMs = finiteCount(
+    'createResendDriver',
+    'timeoutMs',
+    options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+    1,
+  );
   // A bare reference to `globalThis.fetch` risks "Illegal invocation" on some hosts; closing
   // over the call keeps it detached from any receiver, in production and in tests alike.
   const doFetch: MailFetch = options.fetch ?? ((input, init) => globalThis.fetch(input, init));

package/src/driver-smtp.ts

@@ -5,6 +5,7 @@
 import {
   type Clock,
   ConfigInvalidError,
+  finiteCount,
   isUltimateError,
   nanoid,
   renderThrowable,
@@ -139,7 +140,16 @@ export function createSmtpDriver(options: SmtpDriverOptions): MailDriver {
   }
   const clock = options.clock ?? systemClock;
   const connect = options.connect ?? bunSmtpStream;
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  // Refused where `poolSize` already is. The deadline reaches `setTimeout(fn, timeoutMs)` in the
+  // conversation and in the socket, and `setTimeout(fn, NaN)` is `setTimeout(fn, 0)` — so a
+  // non-finite deadline does not disable itself, it fires on the next tick and every send fails
+  // "the server sent nothing for NaNms". `0` is the same failure spelled deliberately.
+  const timeoutMs = finiteCount(
+    'createSmtpDriver',
+    'timeoutMs',
+    options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+    1,
+  );
   const limit = createLimiter(resolvePoolSize(options.poolSize));
   const session: SmtpSessionOptions = {
     clientName: options.clientName ?? addressDomain(options.from),