arcane-os 0.5.17 → 0.5.18

package/src/mail-server.mjs

@@ -1,6 +1,9 @@
+import Is from 'strong-type';
 import {createHash,randomUUID,timingSafeEqual} from 'node:crypto';
 import http from 'node:http';
 
+const is = new Is(false);
+
 export const RESEND_MAIL_SERVER_PROTOCOL='arcane-resend-mail-gateway/1';
 export const RESEND_MAIL_PATH='/v1/mail';
 
@@ -41,22 +44,22 @@ function configurationError(message){
 }
 
 function completeErrorDetails(error){
-    if(!error||typeof error!=='object'){
+    if(!error||!is.object(error)){
         return {message:String(error??''),name:'Error'};
     }
     return {
         ...error,
-        ...(typeof error.code==='string'?{code:error.code}:{}),
-        message:typeof error.message==='string'?error.message:String(error),
-        name:typeof error.name==='string'?error.name:'Error',
-        ...(typeof error.stack==='string'?{stack:error.stack}:{})
+        ...(is.string(error.code)?{code:error.code}:{}),
+        message:is.string(error.message)?error.message:String(error),
+        name:is.string(error.name)?error.name:'Error',
+        ...(is.string(error.stack)?{stack:error.stack}:{})
     };
 }
 
 function positiveInteger(value,fallback,{label,allowZero=false}={}){
     const resolved=value===undefined?fallback:value;
     const minimum=allowZero?0:1;
-    if(!Number.isSafeInteger(resolved)||resolved<minimum){
+    if(!is.safeInteger(resolved)||resolved<minimum){
         throw configurationError(`${label} must be ${allowZero?'a nonnegative':'a positive'} integer.`);
     }
     return resolved;
@@ -64,7 +67,7 @@ function positiveInteger(value,fallback,{label,allowZero=false}={}){
 
 function optionalTimerDelay(value,label){
     if(value===undefined||value===null) return null;
-    if(!Number.isSafeInteger(value)||value<1||value>MAX_NODE_TIMER_DELAY_MS){
+    if(!is.safeInteger(value)||value<1||value>MAX_NODE_TIMER_DELAY_MS){
         throw configurationError(
             `${label} must be an integer from 1 through ${MAX_NODE_TIMER_DELAY_MS} `
             +'milliseconds, the Node timer range.'
@@ -74,12 +77,12 @@ function optionalTimerDelay(value,label){
 }
 
 function normalizeRetryAfter(value){
-    return Number.isSafeInteger(value)&&value>0?value:0;
+    return is.safeInteger(value)&&value>0?value:0;
 }
 
 function portNumber(value,fallback){
     const resolved=value===undefined?fallback:value;
-    if(!Number.isSafeInteger(resolved)||resolved<0||resolved>65_535){
+    if(!is.safeInteger(resolved)||resolved<0||resolved>65_535){
         throw configurationError('port must be an integer between 0 and 65535.');
     }
     return resolved;
@@ -93,14 +96,14 @@ function validateSignal(signal){
 }
 
 function validateApiKey(value){
-    if(typeof value!=='string'||value.length<1||!/^[\x21-\x7e]+$/u.test(value)){
+    if(!is.string(value)||value.length<1||!/^[\x21-\x7e]+$/u.test(value)){
         throw configurationError('Resend API key must be a nonempty printable ASCII string.');
     }
     return value;
 }
 
 function validateAppId(value){
-    if(typeof value!=='string'||!APP_ID_PATTERN.test(value)){
+    if(!is.string(value)||!APP_ID_PATTERN.test(value)){
         throw configurationError('Mail application identity is invalid.');
     }
     return value;
@@ -112,7 +115,7 @@ function appKeyDigest(value){
 
 function normalizeCallerAuthentication(options){
     const allowUnauthenticatedCaller=options.allowUnauthenticatedCaller??false;
-    if(typeof allowUnauthenticatedCaller!=='boolean'){
+    if(!is.boolean(allowUnauthenticatedCaller)){
         throw configurationError('allowUnauthenticatedCaller must be a boolean.');
     }
     if(allowUnauthenticatedCaller){
@@ -126,7 +129,7 @@ function normalizeCallerAuthentication(options){
             callerAuthentication:'origin-app-id-only'
         };
     }
-    if(typeof options.appKey!=='string'||!/^[\x21-\x7e]+$/u.test(options.appKey)){
+    if(!is.string(options.appKey)||!/^[\x21-\x7e]+$/u.test(options.appKey)){
         throw configurationError(
             'appKey must be a nonempty printable ASCII string unless unauthenticated caller mode is explicitly enabled.'
         );
@@ -138,7 +141,7 @@ function normalizeCallerAuthentication(options){
 }
 
 function normalizedEmail(value,label){
-    if(typeof value!=='string'){
+    if(!is.string(value)){
         throw configurationError(`${label} must be an email address.`);
     }
     const normalized=value.trim().toLowerCase();
@@ -149,7 +152,7 @@ function normalizedEmail(value,label){
 }
 
 function validateFrom(value){
-    if(typeof value!=='string'||value!==value.trim()||value.length<3||value.length>320
+    if(!is.string(value)||value!==value.trim()||value.length<3||value.length>320
         ||/[\u0000-\u001f\u007f]/u.test(value)){
         throw configurationError('Mail sender is invalid.');
     }
@@ -165,7 +168,7 @@ function validateFrom(value){
 }
 
 function normalizeEmailList(value,label,{allowEmpty=false}={}){
-    if(!Array.isArray(value)||(!allowEmpty&&value.length===0)){
+    if(!is.array(value)||(!allowEmpty&&value.length===0)){
         throw configurationError(`${label} must contain ${allowEmpty?'zero or more':'one or more'} addresses.`);
     }
     const result=[];
@@ -177,7 +180,7 @@ function normalizeEmailList(value,label,{allowEmpty=false}={}){
 }
 
 function normalizeOrigin(value){
-    if(typeof value!=='string'||!value.trim()){
+    if(!is.string(value)||!value.trim()){
         throw configurationError('Every allowed mail origin must be a URL origin.');
     }
     let url;
@@ -194,7 +197,7 @@ function normalizeOrigin(value){
 }
 
 function normalizeOrigins(value){
-    if(!Array.isArray(value)||value.length===0){
+    if(!is.array(value)||value.length===0){
         throw configurationError('allowedOrigins must contain one or more exact origins.');
     }
     const origins=[];
@@ -218,7 +221,7 @@ function validateLoopbackHost(value){
 }
 
 function normalizeConfiguration(options={}){
-    if(!options||typeof options!=='object'||Array.isArray(options)){
+    if(!options||!is.object(options)||is.array(options)){
         throw configurationError('Mail server options must be an object.');
     }
     const callerAuthentication=normalizeCallerAuthentication(options);
@@ -239,13 +242,13 @@ function normalizeConfiguration(options={}){
         throw configurationError('Every error recipient must also be in recipientAllowlist.');
     }
     const fetchImpl=options.fetchImpl??globalThis.fetch;
-    if(typeof fetchImpl!=='function'){
+    if(!is.function(fetchImpl)){
         throw configurationError('A fetch implementation is required for Resend delivery.');
     }
-    if(options.onEvent!==undefined&&typeof options.onEvent!=='function'){
+    if(options.onEvent!==undefined&&!is.function(options.onEvent)){
         throw configurationError('onEvent must be a function when supplied.');
     }
-    if(options.requestIdFactory!==undefined&&typeof options.requestIdFactory!=='function'){
+    if(options.requestIdFactory!==undefined&&!is.function(options.requestIdFactory)){
         throw configurationError('requestIdFactory must be a function when supplied.');
     }
     return {
@@ -277,7 +280,7 @@ function normalizeConfiguration(options={}){
 function createRequestId(factory){
     try{
         const candidate=factory();
-        if(typeof candidate==='string'&&REQUEST_ID_PATTERN.test(candidate)){
+        if(is.string(candidate)&&REQUEST_ID_PATTERN.test(candidate)){
             return candidate;
         }
     }catch{
@@ -292,7 +295,7 @@ function isNumericLoopback(value){
 
 function headerValues(request,name){
     const distinct=request.headersDistinct?.[name];
-    if(Array.isArray(distinct)){
+    if(is.array(distinct)){
         return distinct.map(function stringifyDistinctHeader(value){return String(value);});
     }
     const values=[];
@@ -308,7 +311,7 @@ function headerValues(request,name){
     if(fallback===undefined){
         return [];
     }
-    return Array.isArray(fallback)?fallback.map(String):[String(fallback)];
+    return is.array(fallback)?fallback.map(String):[String(fallback)];
 }
 
 function singleHeader(request,name,{required=true}={}){
@@ -340,7 +343,7 @@ function validateLoopbackRequest(request){
     const hostLiteral=hostname.includes(':')?`[${hostname}]`:hostname;
     const expectedAuthority=localPort===80?hostLiteral:`${hostLiteral}:${String(localPort)}`;
     if(parsed.username||parsed.password||parsed.pathname!=='/'||parsed.search||parsed.hash
-        ||!isNumericLoopback(hostname)||!Number.isSafeInteger(localPort)
+        ||!isNumericLoopback(hostname)||!is.safeInteger(localPort)
         ||statedPort!==localPort||rawHost!==expectedAuthority){
         throw new MailGatewayFault('mail_invalid_host',{statusCode:421});
     }
@@ -483,7 +486,7 @@ function createObserver(onEvent){
         }catch{
             return;
         }
-        if(!result||typeof result.then!=='function'){
+        if(!result||!is.function(result.then)){
             return;
         }
         const task=Promise.resolve(result);
@@ -577,7 +580,7 @@ function readRequestBody(request,{timeoutMs,signal}){
 }
 
 function normalizedReportEmail(value){
-    if(typeof value!=='string'){
+    if(!is.string(value)){
         throw new MailGatewayFault('mail_invalid_recipient',{statusCode:422});
     }
     const address=value.trim().toLowerCase();
@@ -588,7 +591,7 @@ function normalizedReportEmail(value){
 }
 
 function normalizeReportRecipients(report,configuration){
-    if(!Array.isArray(report.to)){
+    if(!is.array(report.to)){
         throw new MailGatewayFault('mail_invalid_recipients',{statusCode:422});
     }
     const recipients=[];
@@ -609,23 +612,23 @@ function normalizeReportRecipients(report,configuration){
 }
 
 function normalizeReport(value,configuration){
-    if(!value||typeof value!=='object'||Array.isArray(value)){
+    if(!value||!is.object(value)||is.array(value)){
         throw new MailGatewayFault('mail_invalid_report',{statusCode:422});
     }
     if(!Object.hasOwn(value,'subject')||!Object.hasOwn(value,'to')
         ||!Object.hasOwn(value,'type')){
         throw new MailGatewayFault('mail_invalid_report_shape',{statusCode:422});
     }
-    if(typeof value.type!=='string'||!MAIL_TYPES.has(value.type)){
+    if(!is.string(value.type)||!MAIL_TYPES.has(value.type)){
         throw new MailGatewayFault('mail_invalid_type',{statusCode:422});
     }
-    if(typeof value.subject!=='string'){
+    if(!is.string(value.subject)){
         throw new MailGatewayFault('mail_invalid_subject',{statusCode:422});
     }
     const hasText=Object.hasOwn(value,'text');
     const hasHtml=Object.hasOwn(value,'html');
-    if(!hasText&&!hasHtml||(hasText&&typeof value.text!=='string')
-        ||(hasHtml&&typeof value.html!=='string')){
+    if(!hasText&&!hasHtml||(hasText&&!is.string(value.text))
+        ||(hasHtml&&!is.string(value.html))){
         throw new MailGatewayFault('mail_content_required',{statusCode:422});
     }
     const recipients=normalizeReportRecipients(value,configuration);
@@ -658,7 +661,7 @@ function parseReport(serialized,configuration){
 }
 
 function parseRetryAfter(value,now=Date.now()){
-    if(typeof value!=='string'||!value.trim()){
+    if(!is.string(value)||!value.trim()){
         return 0;
     }
     const trimmed=value.trim();
@@ -666,7 +669,7 @@ function parseRetryAfter(value,now=Date.now()){
         return normalizeRetryAfter(Math.ceil(Number(trimmed)*1000));
     }
     const timestamp=Date.parse(trimmed);
-    return Number.isFinite(timestamp)
+    return is.finite(timestamp)
         ? normalizeRetryAfter(Math.max(0,timestamp-now))
         : 0;
 }
@@ -712,7 +715,7 @@ function awaitAbortable(value,signal){
 function ignoreCancellationFailure(){}
 
 function cancelProviderBody(body){
-    if(!body||typeof body.cancel!=='function'){
+    if(!body||!is.function(body.cancel)){
         return;
     }
     try{
@@ -723,7 +726,7 @@ function cancelProviderBody(body){
 }
 
 function cancelProviderReader(reader){
-    if(!reader||typeof reader.cancel!=='function'){
+    if(!reader||!is.function(reader.cancel)){
         return;
     }
     try{
@@ -737,7 +740,7 @@ async function readProviderBody(response,signal){
     if(response.body===null||response.body===undefined){
         return '';
     }
-    if(typeof response.body.getReader!=='function'){
+    if(!is.function(response.body.getReader)){
         cancelProviderBody(response.body);
         throw new MailGatewayFault('resend_unreadable_response',{
             statusCode:502,
@@ -782,7 +785,7 @@ function parseProviderObject(text){
     }
     try{
         const value=JSON.parse(text);
-        return value&&typeof value==='object'&&!Array.isArray(value)?value:null;
+        return value&&is.object(value)&&!is.array(value)?value:null;
     }catch{
         return null;
     }
@@ -790,7 +793,7 @@ function parseProviderObject(text){
 
 function providerCode(value,statusCode){
     const candidate=value?.name;
-    if(typeof candidate==='string'&&PROVIDER_CODE_PATTERN.test(candidate)){
+    if(is.string(candidate)&&PROVIDER_CODE_PATTERN.test(candidate)){
         return candidate;
     }
     return `resend_http_${String(statusCode)}`;
@@ -883,7 +886,7 @@ async function performResendAttempt(configuration,delivery,idempotencyKey,signal
             ));
         }
         const statusCode=Number(response?.status);
-        if(!Number.isSafeInteger(statusCode)||statusCode<100||statusCode>599){
+        if(!is.safeInteger(statusCode)||statusCode<100||statusCode>599){
             return completeAttempt(ambiguousResult(
                 'resend_invalid_response',
                 configuration.retryableDelayMs,
@@ -912,7 +915,7 @@ async function performResendAttempt(configuration,delivery,idempotencyKey,signal
         }
         const value=parseProviderObject(text);
         if(statusCode>=200&&statusCode<300){
-            if(!value||typeof value.id!=='string'||!PROVIDER_ID_PATTERN.test(value.id)){
+            if(!value||!is.string(value.id)||!PROVIDER_ID_PATTERN.test(value.id)){
                 return completeAttempt(ambiguousResult(
                     'resend_invalid_success_response',
                     configuration.retryableDelayMs,
@@ -945,26 +948,26 @@ async function performResendAttempt(configuration,delivery,idempotencyKey,signal
             report:delivery.report,
             durationMs:Math.max(0,Date.now()-startedAt),
             requestId,
-            providerStatus:Number.isSafeInteger(Number(response?.status))?Number(response.status):0
+            providerStatus:is.safeInteger(Number(response?.status))?Number(response.status):0
         });
     }
 }
 
 function normalizeDirectSendOptions(options){
-    if(!options||typeof options!=='object'||Array.isArray(options)){
+    if(!options||!is.object(options)||is.array(options)){
         throw configurationError('Mail send options must be an object.');
     }
-    if(typeof options.reportKey!=='string'||!IDEMPOTENCY_KEY_PATTERN.test(options.reportKey)){
+    if(!is.string(options.reportKey)||!IDEMPOTENCY_KEY_PATTERN.test(options.reportKey)){
         throw configurationError('reportKey must contain safe identifier characters.');
     }
     const fetchImpl=options.fetchImpl??globalThis.fetch;
-    if(typeof fetchImpl!=='function'){
+    if(!is.function(fetchImpl)){
         throw configurationError('A fetch implementation is required for Resend delivery.');
     }
-    if(options.onEvent!==undefined&&typeof options.onEvent!=='function'){
+    if(options.onEvent!==undefined&&!is.function(options.onEvent)){
         throw configurationError('onEvent must be a function when supplied.');
     }
-    if(options.requestIdFactory!==undefined&&typeof options.requestIdFactory!=='function'){
+    if(options.requestIdFactory!==undefined&&!is.function(options.requestIdFactory)){
         throw configurationError('requestIdFactory must be a function when supplied.');
     }
     return {
@@ -1343,7 +1346,7 @@ export async function startResendMailServer(options={}){
         throw error;
     }
     const address=server.address();
-    if(!address||typeof address==='string'||!isNumericLoopback(address.address)){
+    if(!address||is.string(address)||!isNumericLoopback(address.address)){
         await Promise.allSettled([closeHttpServer(server),requestHandler.close()]);
         throw configurationError('Mail server did not bind to a numeric loopback address.');
     }

package/src/mail.mjs

@@ -1,3 +1,4 @@
+import Is from 'strong-type';
 import {ArcaneError,ERROR_CODES,throwIfAborted} from './errors.mjs';
 import {
     deleteMailCredential,
@@ -7,6 +8,8 @@ import {
 } from './mail-credentials.mjs';
 import {sendResendMail,startResendMailServer} from './mail-server.mjs';
 
+const is = new Is(false);
+
 export const MAIL_COMMAND_ACTIONS=[
     'key-set',
     'key-status',
@@ -22,10 +25,10 @@ function usage(message){
 }
 
 function validateOptions(options){
-    if(!options||typeof options!=='object'||Array.isArray(options)){
+    if(!options||!is.object(options)||is.array(options)){
         usage('Mail command options must be an object.');
     }
-    if(typeof options.action!=='string'||!ACTION_SET.has(options.action)){
+    if(!is.string(options.action)||!ACTION_SET.has(options.action)){
         usage(`Mail action must be one of: ${MAIL_COMMAND_ACTIONS.join(', ')}.`);
     }
     return options;
@@ -33,26 +36,26 @@ function validateOptions(options){
 
 function dependency(options,name,fallback){
     const value=options[name]??fallback;
-    if(typeof value!=='function'){
+    if(!is.function(value)){
         usage(`${name} must be a function when supplied.`);
     }
     return value;
 }
 
 function recipientList(value,label){
-    if(value===undefined||value===null||value===''||(Array.isArray(value)&&value.length===0)){
+    if(value===undefined||value===null||value===''||(is.array(value)&&value.length===0)){
         return [];
     }
-    const entries=Array.isArray(value)
+    const entries=is.array(value)
         ? value
-        : typeof value==='string'
+        : is.string(value)
             ? value.split(',')
             : null;
     if(!entries||entries.length===0){
         usage(`${label} must contain at least one email address when supplied.`);
     }
     const result=entries.map(function normalizeMailRecipient(entry){
-        if(typeof entry!=='string'||!entry.trim()){
+        if(!is.string(entry)||!entry.trim()){
             usage(`${label} contains an empty email address.`);
         }
         return entry.trim();
@@ -66,9 +69,9 @@ function recipientList(value,label){
 }
 
 function originList(value){
-    const entries=Array.isArray(value)?value:[value];
+    const entries=is.array(value)?value:[value];
     if(entries.length===0||entries.some(function invalidOrigin(entry){
-        return typeof entry!=='string'||!entry.trim();
+        return !is.string(entry)||!entry.trim();
     })){
         usage('Mail serve requires at least one exact allowed origin.');
     }
@@ -115,9 +118,9 @@ async function deleteCredential(options){
 }
 
 function withoutMailCredentials(value,seen=new WeakMap()){
-    if(!value||typeof value!=='object')return value;
+    if(!value||!is.object(value))return value;
     if(seen.has(value))return seen.get(value);
-    const copy=Array.isArray(value)?[]:{};
+    const copy=is.array(value)?[]:{};
     seen.set(value,copy);
     for(const [key,entry] of Object.entries(value)){
         if(key==='apiKey'||key==='appKey')continue;
@@ -127,7 +130,7 @@ function withoutMailCredentials(value,seen=new WeakMap()){
 }
 
 function completeSendFailure(result){
-    if(!result||typeof result!=='object'||Array.isArray(result)){
+    if(!result||!is.object(result)||is.array(result)){
         return {provider:'resend',result:withoutMailCredentials(result)};
     }
     // Complete provider detail remains visible; only credential fields are omitted.
@@ -148,7 +151,7 @@ async function sendMail(options){
             `No Resend credential is configured for profile ${String(options.profile)}.`
         );
     }
-    if(typeof apiKey!=='string'||!apiKey){
+    if(!is.string(apiKey)||!apiKey){
         throw new ArcaneError(
             ERROR_CODES.operationFailed,
             'The configured Resend credential could not be read.'
@@ -195,7 +198,7 @@ async function serveMail(options){
             `No Resend credential is configured for profile ${String(options.profile)}.`
         );
     }
-    if(typeof apiKey!=='string'||!apiKey){
+    if(!is.string(apiKey)||!apiKey){
         throw new ArcaneError(
             ERROR_CODES.operationFailed,
             'The configured Resend credential could not be read.'
@@ -205,7 +208,7 @@ async function serveMail(options){
     try{
         throwIfAborted(options.signal);
         appKey=await readAppKey();
-        if(typeof appKey!=='string'||!appKey){
+        if(!is.string(appKey)||!appKey){
             throw new ArcaneError(
                 ERROR_CODES.operationFailed,
                 'The local Mail gateway app key could not be read.'

package/src/native-plan.mjs

@@ -1,9 +1,12 @@
+import Is from 'strong-type';
 import {lstat,readFile,realpath} from 'node:fs/promises';
 import path from 'node:path';
 import {validateAppDescriptor} from './app-descriptor.mjs';
 import {normalizeRelativePath} from './packager/core.mjs';
 import {ArcaneError,ERROR_CODES,throwIfAborted} from './errors.mjs';
 
+const is = new Is(false);
+
 export const NATIVE_BUILD_PLAN_PROTOCOL='arcane-native-build-plan/1';
 export const NATIVE_BUILDER_PROTOCOL='arcane-native-builder/1';
 
@@ -38,15 +41,15 @@ function fail(message,code=ERROR_CODES.policyDenied,details){
 }
 
 function isObject(value){
-    return value!==null&&typeof value==='object'&&!Array.isArray(value);
+    return value!==null&&is.object(value)&&!is.array(value);
 }
 
 async function emit(onEvent,event){
-    if(typeof onEvent==='function')await onEvent(event);
+    if(is.function(onEvent))await onEvent(event);
 }
 
 async function realDirectory(location,label){
-    if(typeof location!=='string'||!location.trim())fail(`${label} is required.`,ERROR_CODES.usage);
+    if(!is.string(location)||!location.trim())fail(`${label} is required.`,ERROR_CODES.usage);
     const requested=path.resolve(location);
     let info;
     try{info=await lstat(requested);}
@@ -110,7 +113,7 @@ export function validateNativeBuilder(provider){
         fail(`Native builder protocol must be ${NATIVE_BUILDER_PROTOCOL}.`,ERROR_CODES.targetUnavailable);
     }
     for(const method of ['describe','doctor','prepare','build','verify','run']){
-        if(typeof provider[method]!=='function'){
+        if(!is.function(provider[method])){
             fail(`Native builder must implement ${method}().`,ERROR_CODES.targetUnavailable);
         }
     }
@@ -119,7 +122,7 @@ export function validateNativeBuilder(provider){
 
 async function releaseSelection(releaseRoot,release,label){
     const root=await realDirectory(releaseRoot,`${label} root`);
-    if(!isObject(release)||!Array.isArray(release.files)){
+    if(!isObject(release)||!is.array(release.files)){
         fail(`${label} must provide its structural file inventory.`,ERROR_CODES.usage);
     }
     const files=release.files.map((entry,index)=>normalizeRelativePath(
@@ -150,11 +153,11 @@ async function releaseSelection(releaseRoot,release,label){
 
 async function dependencySelections(value,{signal}={}){
     if(value===undefined)return [];
-    if(!Array.isArray(value))fail('dependencyReleases must be an array.',ERROR_CODES.usage);
+    if(!is.array(value))fail('dependencyReleases must be an array.',ERROR_CODES.usage);
     const dependencies=[];
     for(const [index,item] of value.entries()){
         throwIfAborted(signal);
-        if(!isObject(item)||typeof item.appId!=='string'){
+        if(!isObject(item)||!is.string(item.appId)){
             fail(`dependencyReleases[${index}] is malformed.`,ERROR_CODES.usage);
         }
         const selected=await releaseSelection(
@@ -191,10 +194,10 @@ export async function createNativeBuildPlan({
     ));
     const application=await releaseSelection(appReleaseRoot,release,'application release');
     const dependencies=await dependencySelections(dependencyReleases,{signal});
-    if(!Array.isArray(protectedRoots)){
+    if(!is.array(protectedRoots)){
         fail('protectedRoots must be an array.',ERROR_CODES.usage);
     }
-    if(typeof outputRoot!=='string'||!outputRoot.trim()){
+    if(!is.string(outputRoot)||!outputRoot.trim()){
         fail('outputRoot is required.',ERROR_CODES.usage);
     }
     const selectedOutput=path.resolve(outputRoot);

package/src/native-provider-loader.mjs

@@ -1,9 +1,12 @@
+import Is from 'strong-type';
 import {lstat,realpath} from 'node:fs/promises';
 import path from 'node:path';
 import {pathToFileURL} from 'node:url';
 import {ArcaneError,ERROR_CODES,throwIfAborted} from './errors.mjs';
 import {validateNativeBuilder} from './native-plan.mjs';
 
+const is = new Is(false);
+
 const PROVIDER_ROOT=['machine_bundles','arcane-os-machine-bundle','tools'];
 
 function providerPath(fileName){
@@ -55,10 +58,10 @@ async function resolveProviderLocation({
             supportedTargets:Object.keys(FIXED_NATIVE_PROVIDER_PATHS)
         });
     }
-    if(typeof arcaneRoot!=='string'||!arcaneRoot.trim()){
+    if(!is.string(arcaneRoot)||!arcaneRoot.trim()){
         fail(`The ${target} native provider requires an Arcane OS checkout root.`);
     }
-    if(typeof inspect!=='function'||typeof canonicalize!=='function'){
+    if(!is.function(inspect)||!is.function(canonicalize)){
         fail('The Arcane native provider loader dependencies are invalid.');
     }
     const requestedRoot=path.resolve(arcaneRoot);
@@ -107,7 +110,7 @@ async function resolveProviderLocation({
 }
 
 export async function loadArcaneNativeProvider(options={}){
-    if(options===null||typeof options!=='object'||Array.isArray(options)){
+    if(options===null||!is.object(options)||is.array(options)){
         fail('Arcane native provider options must be an object.');
     }
     const {
@@ -120,7 +123,7 @@ export async function loadArcaneNativeProvider(options={}){
         onEvent
     }=options;
     throwIfAborted(signal);
-    if(typeof importModule!=='function')fail('The Arcane native provider importer is invalid.');
+    if(!is.function(importModule))fail('The Arcane native provider importer is invalid.');
     await onEvent?.({
         type:'native.provider.load.started',
         target,