sporades 0.6.6 → 0.7.1

package/CHANGES.md

@@ -1,9 +1,22 @@
 # Changes
 
-## Unreleased - 2026-08-04
+## Unreleased - 2026-08-12
 
-Changes since v0.6.5.
+Changes since v0.7.0.
 
-### 🐛 Bug Fixes
+### 🚀 Features
 
-- User preferences (cebd9f0).
+- Adapt Mailgun email events (66d4291).
+- Adapt Postmark email events (d30efa2).
+- Adapt SMTP2GO email events (8d39237).
+- Dispatch verified email provider events (d818b6d).
+- Trust required native installers (c0a539c).
+
+### 📝 Documentation
+
+- Clarify provider callback responses (7fde2ae).
+- Document Mailjet SMTP configuration (e710ba2).
+
+### 🧪 Tests
+
+- Cover Mailgun non-delivery retries (c5e566e).

package/README.md

@@ -57,6 +57,10 @@ sporades host push --restart
 
 - [User guide](https://mgscox.github.io/sporades/user-guide): build, run, inspect, deploy, auth,
   preferences, files, endpoints, messages, and common workflows.
+- [Feature reference](https://mgscox.github.io/sporades/guide/reference): exhaustive contracts and
+  command lookup, split into focused topic pages.
+- [LLM documentation manifest](https://mgscox.github.io/sporades/llms.txt): release-matched Markdown
+  sources for agents and other documentation tools.
 - [Architecture](https://mgscox.github.io/sporades/architecture): platform model, runtime modes, Host
   server design, and ownership boundaries.
 - [Runtime layout](https://mgscox.github.io/sporades/runtime-layout): generated files, mounts, Host
@@ -210,6 +214,15 @@ sporades create notes --template todo
 cd notes
 ```
 
+Use a reusable local Capsule template by passing its directory path. Sporades
+copies the template while honouring its `.gitignore`, excludes `.git`,
+`node_modules`, `.sporades`, and `.env.sporades.server`, rewrites the project
+name, and merges the current Sporades dependency and standard scripts:
+
+```sh
+sporades create notes --template /absolute/path/to/capsule-template
+```
+
 Run a local Dev session:
 
 ```sh
@@ -246,8 +259,9 @@ sporades host push --host personal --subname notes --verify --json
 
 Sporades is early, active platform work. It is useful for fast prototypes,
 agent-driven app loops, local production-like testing, and private hosted
-Capsules, but it is not trying to be a full production platform (yet). Check the 
-[Roadmap](docs/ROADMAP.md) for in-flight and planned features.
+Capsules, but it is not trying to be a full production platform (yet). Check the
+[Roadmap](https://mgscox.github.io/sporades/ROADMAP) for in-flight and planned
+features.
 
 The current focus is keeping the authoring surface small, the runtime
 inspectable, and the operational path friendly to both developers and agents.

package/bin/sporades-host-helper.js

@@ -161,15 +161,31 @@ function validatePublicTreeFileSet(files) {
 }
 
 // src/server-runtime-source.ts
-import { createHash, createHmac, createPrivateKey, randomBytes, randomUUID, scryptSync, sign, timingSafeEqual, verify } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+
+// src/file-storage-runtime.ts
+var nodeCryptoModule = process.getBuiltinModule("node:crypto");
+
+// src/auth-runtime.ts
+var nodeCryptoModule2 = process.getBuiltinModule("node:crypto");
 var EMAIL_SIGN_IN_THROTTLE_WINDOW_MS = 15 * 60 * 1e3;
-function logPayloadMaxBytes(config = {}) {
-  const configured = Number(config.logs?.payloadMaxBytes ?? config.logging?.payloadMaxBytes);
-  return Number.isInteger(configured) && configured > 0 ? configured : 4096;
-}
-function logRedactedValue() {
-  return "[REDACTED]";
+var PASSWORD_RESET_DEFAULT_TTL_MS = 60 * 60 * 1e3;
+var PASSWORD_RESET_MIN_TTL_MS = 5 * 60 * 1e3;
+var PASSWORD_RESET_MAX_TTL_MS = 24 * 60 * 60 * 1e3;
+
+// src/runtime-log-policy.ts
+function isSensitiveLogKey(key) {
+  return /(^|[-_])(?:password|passwd|token|secret|authorization|cookie|client[-_]?secret|api[-_]?token|private[-_]?key|authorized[-_]?keys?|request[-_]?body|raw[-_]?body|stack(?:trace)?)([-_]|$)/i.test(String(key)) || /(?:password|passwd|token|secret|authorization|cookie|clientSecret|apiToken|privateKey|authorizedKeys|requestBody|rawRequestBody|stackTrace)/i.test(String(key));
 }
+
+// src/database-runtime.ts
+var nodeCryptoModule3 = process.getBuiltinModule("node:crypto");
+var nodeFsModule = process.getBuiltinModule("node:fs");
+
+// src/jobs-runtime.ts
+var nodeCryptoModule4 = process.getBuiltinModule("node:crypto");
+
+// src/acl-runtime.ts
 var PRIVILEGED_AUDIT_SCHEMA = "sporades.privileged-audit.v1";
 var PRIVILEGED_AUDIT_ACTOR_KINDS = /* @__PURE__ */ new Set(["privileged-server-role", "captured-user", "platform", "unknown"]);
 var PRIVILEGED_AUDIT_OUTCOMES = /* @__PURE__ */ new Set(["started", "completed", "errored", "finished"]);
@@ -240,6 +256,16 @@ function auditString(value, fallback) {
   const text = value === null || value === void 0 ? "" : String(value);
   return text.trim() ? text : fallback;
 }
+var ACL_HELPER_STATE = Symbol("sporades.aclHelperState");
+
+// src/server-runtime-source.ts
+function logPayloadMaxBytes(config = {}) {
+  const configured = Number(config.logs?.payloadMaxBytes ?? config.logging?.payloadMaxBytes);
+  return Number.isInteger(configured) && configured > 0 ? configured : 4096;
+}
+function logRedactedValue() {
+  return "[REDACTED]";
+}
 function createLogEnvelope(input) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const config = input.config ?? {};
@@ -309,9 +335,6 @@ function logDataContainsServerEnvValue(value, serverEnv) {
   );
   return values.some((secret) => serialized.includes(String(secret)));
 }
-function isSensitiveLogKey(key) {
-  return /(^|[-_])(?:password|passwd|token|secret|authorization|cookie|client[-_]?secret|api[-_]?token|private[-_]?key|authorized[-_]?keys?|request[-_]?body|raw[-_]?body|stack(?:trace)?)([-_]|$)/i.test(String(key)) || /(?:password|passwd|token|secret|authorization|cookie|clientSecret|apiToken|privateKey|authorizedKeys|requestBody|rawRequestBody|stackTrace)/i.test(String(key));
-}
 function isSensitiveLogString(value) {
   return /-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(value) || /\b(?:ssh-rsa|ssh-ed25519|ecdsa-sha2-[^\s]+)\s+[A-Za-z0-9+/=]{32,}/.test(value) || /(^|\n)\s*at\s+.+:\d+:\d+/.test(value);
 }
@@ -348,7 +371,6 @@ function capLogEnvelope(envelope, maxBytes) {
   capped.message = capped.message.slice(0, 256);
   return capped;
 }
-var ACL_HELPER_STATE = Symbol("sporades.aclHelperState");
 
 // src/cli/cli-support.ts
 function errorDetails(error) {
@@ -391,7 +413,7 @@ function writeEnvelope(result, failed = false) {
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.6.6";
+var CLI_VERSION = "0.7.1";
 
 // src/cli/schedule-inspection-envelope.ts
 function sanitizeScheduleInspectionEnvelope(envelope, invalid) {