tina4-nodejs 3.13.91 → 3.13.94

package/packages/cli/dist/bin.js

@@ -1298,11 +1298,14 @@ var init_sqlite = __esm({
         const pragma = schema && isIdentifier(schema) && isIdentifier(tbl) ? `PRAGMA ${schema}.table_info("${tbl}")` : `PRAGMA table_info("${table2}")`;
         const rows = this.db.prepare(pragma).all();
         return rows.map((r) => ({
+          // PRAGMA table_info reports `pk` as the 1-BASED POSITION within the primary
+          // key, not a boolean: a composite key gives pk=1, pk=2, ... Testing `=== 1`
+          // reported only the first column of a composite key.
           name: r.name,
           type: r.type,
           nullable: r.notnull === 0,
           default: r.dflt_value,
-          primaryKey: r.pk === 1
+          primaryKey: Number(r.pk) > 0
         }));
       }
       lastInsertId() {
@@ -4298,6 +4301,8 @@ var init_database = __esm({
       poolIndex = 0;
       /** Factory for creating new adapters (used by pool) */
       adapterFactory = null;
+      /** table -> primary-key column name (or null), introspected once */
+      _pkCache = /* @__PURE__ */ new Map();
       /**
        * Whether a standalone write auto-commits. ON by default — a write made
        * outside an explicit transaction commits on its own connection before
@@ -4556,29 +4561,112 @@ var init_database = __esm({
         }
         return result;
       }
-      /** Update rows in a table matching filter. */
+      /**
+       * The table's primary-key column, introspected once and cached.
+       *
+       * Uses the cross-engine getColumns() contract (v3.13.14, #48), which reports
+       * primaryKey per column on every adapter. Resolves to null when the table has
+       * no primary key or cannot be introspected.
+       */
+      async primaryKey(table2) {
+        if (!this._pkCache.has(table2)) {
+          let pk = [];
+          try {
+            const columns = await this.getColumns(table2);
+            pk = columns.filter((c) => c.primaryKey).map((c) => c.name);
+          } catch {
+            pk = [];
+          }
+          this._pkCache.set(table2, pk);
+        }
+        return this._pkCache.get(table2) ?? [];
+      }
+      /**
+       * A failed write must be loud.
+       *
+       * The adapters catch a SQL error and return { success: false, affectedRows: 0 },
+       * so a filterless update produced invalid SQL ("... WHERE ") and reported
+       * nothing rather than raising. A caller who does not inspect the result
+       * believes the write landed (audit feature 4, P1).
+       */
+      static assertWrote(result, verb, table2) {
+        if (result && result.success === false) {
+          throw new Error(
+            `${verb} failed on ${table2}: ${result.error ?? "unknown error"}`
+          );
+        }
+        return result;
+      }
+      /**
+       * Update rows. A write with no filter is an error, not a full-table write.
+       *
+       * With no explicit filter the primary key is taken out of `data` and used as
+       * the WHERE clause. With neither a filter nor a primary key in `data` this
+       * throws rather than silently changing nothing (audit feature 4, P1).
+       */
       async update(table2, data, filter, params) {
+        let effectiveFilter = filter ?? {};
+        let effectiveData = data;
+        if (Object.keys(effectiveFilter).length === 0) {
+          const pkColumns = await this.primaryKey(table2);
+          const missing = pkColumns.filter((c) => !(c in data));
+          if (pkColumns.length === 0 || missing.length > 0) {
+            throw new Error(
+              `update requires a filter or the complete primary key in the data; pass filter explicitly to update multiple rows (table=${table2}, primary key=[${pkColumns.join(", ")}], missing from data=[${missing.join(", ")}]). To empty a table use truncate(${table2}).`
+            );
+          }
+          effectiveData = { ...data };
+          const keyed = {};
+          for (const col of pkColumns) {
+            keyed[col] = effectiveData[col];
+            delete effectiveData[col];
+          }
+          if (Object.keys(effectiveData).length === 0) {
+            throw new Error(
+              `update was given only the primary key [${pkColumns.join(", ")}] and no columns to set (table=${table2})`
+            );
+          }
+          effectiveFilter = keyed;
+        }
         const adapter = this.getNextAdapter();
-        const result = adapter.updateAsync ? await adapter.updateAsync(table2, data, filter ?? {}, params) : adapter.update(table2, data, filter ?? {}, params);
+        const result = adapter.updateAsync ? await adapter.updateAsync(table2, effectiveData, effectiveFilter, params) : adapter.update(table2, effectiveData, effectiveFilter, params);
         if (this.autoCommit && !this.inExplicitTransaction()) {
           try {
             await adapterCommit(adapter);
           } catch {
           }
         }
-        return result;
+        return _Database.assertWrote(result, "update", table2);
       }
-      /** Delete rows from a table matching filter. */
+      /** Delete rows. A filterless delete throws; use truncate() to empty a table. */
       async delete(table2, filter, params) {
+        const effectiveFilter = filter ?? {};
+        if (!Array.isArray(effectiveFilter) && typeof effectiveFilter !== "string" && Object.keys(effectiveFilter).length === 0) {
+          throw new Error(
+            `delete requires a filter (table=${table2}). To remove every row use truncate(${table2}).`
+          );
+        }
         const adapter = this.getNextAdapter();
-        const result = adapter.deleteAsync ? await adapter.deleteAsync(table2, filter ?? {}, params) : adapter.delete(table2, filter ?? {}, params);
+        const result = adapter.deleteAsync ? await adapter.deleteAsync(table2, effectiveFilter, params) : adapter.delete(table2, effectiveFilter, params);
         if (this.autoCommit && !this.inExplicitTransaction()) {
           try {
             await adapterCommit(adapter);
           } catch {
           }
         }
-        return result;
+        return _Database.assertWrote(result, "delete", table2);
+      }
+      /** Remove every row. The explicit spelling of a whole-table delete. */
+      async truncate(table2) {
+        const adapter = this.getNextAdapter();
+        const result = adapter.deleteAsync ? await adapter.deleteAsync(table2, "1 = 1", []) : adapter.delete(table2, "1 = 1", []);
+        if (this.autoCommit && !this.inExplicitTransaction()) {
+          try {
+            await adapterCommit(adapter);
+          } catch {
+          }
+        }
+        return _Database.assertWrote(result, "truncate", table2);
       }
       /** Close all database connections (pool or single). */
       close() {
@@ -12122,6 +12210,7 @@ var init_logger = __esm({
 var auth_exports = {};
 __export(auth_exports, {
   Auth: () => Auth,
+  JWT_LEEWAY_SECONDS: () => JWT_LEEWAY_SECONDS,
   authMiddleware: () => authMiddleware,
   authenticateRequest: () => authenticateRequest,
   checkPassword: () => checkPassword,
@@ -12130,6 +12219,7 @@ __export(auth_exports, {
   getToken: () => getToken,
   hashPassword: () => hashPassword,
   refreshToken: () => refreshToken,
+  resolveAlgorithm: () => resolveAlgorithm,
   validToken: () => validToken,
   validateApiKey: () => validateApiKey
 });
@@ -12190,6 +12280,18 @@ function ensureDevSecret(cwd) {
   }
   return newSecret;
 }
+function unsupportedAlgorithmError(algorithm) {
+  return new Error(
+    `Unsupported JWT algorithm "${algorithm}". Tina4 signs with ${SUPPORTED_ALGORITHMS.join(", ")} (HMAC via node:crypto; RS256 needs a PEM key pair). Set TINA4_JWT_ALGORITHM to one of those.`
+  );
+}
+function resolveAlgorithm(algorithm) {
+  const chosen = (algorithm || process.env.TINA4_JWT_ALGORITHM || "HS256").trim();
+  if (!HMAC_DIGESTS.has(chosen) && !RSA_SIGN_ALGORITHMS.has(chosen)) {
+    throw unsupportedAlgorithmError(chosen);
+  }
+  return chosen;
+}
 function base64urlEncode(data) {
   return data.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
@@ -12212,7 +12314,7 @@ function getToken(payload, secretOrExpiresIn, expiresIn = 60, algorithm) {
   if (!resolvedSecret) {
     _warnBlankSecret();
   }
-  const resolvedAlgorithm = algorithm ?? process.env.TINA4_JWT_ALGORITHM ?? "HS256";
+  const resolvedAlgorithm = resolveAlgorithm(algorithm);
   const header = { alg: resolvedAlgorithm, typ: "JWT" };
   const now = Math.floor(Date.now() / 1e3);
   const claims = { ...payload, iat: now };
@@ -12230,19 +12332,27 @@ function validToken(token, secret, algorithm) {
   if (!resolvedSecret) {
     _warnBlankSecret();
   }
-  const resolvedAlgorithm = algorithm ?? process.env.TINA4_JWT_ALGORITHM ?? "HS256";
+  const resolvedAlgorithm = resolveAlgorithm(algorithm);
   try {
     const parts = token.split(".");
     if (parts.length !== 3) return null;
     const [h, p, sig] = parts;
+    const header = JSON.parse(base64urlDecode(h).toString());
+    if (header.alg !== resolvedAlgorithm) return null;
     const signingInput = `${h}.${p}`;
     if (!verifySignature(signingInput, sig, resolvedSecret, resolvedAlgorithm)) {
       return null;
     }
     const payload = JSON.parse(base64urlDecode(p).toString());
-    if (typeof payload.exp === "number" && Date.now() / 1e3 > payload.exp) {
+    const now = Date.now() / 1e3;
+    if (typeof payload.exp === "number" && now > payload.exp) {
       return null;
     }
+    if (Object.hasOwn(payload, "nbf")) {
+      const notBefore = payload.nbf;
+      if (typeof notBefore !== "number" || !Number.isFinite(notBefore)) return null;
+      if (now + JWT_LEEWAY_SECONDS < notBefore) return null;
+    }
     return payload;
   } catch {
     return null;
@@ -12258,32 +12368,33 @@ function getPayload(token) {
   }
 }
 function sign(input, secret, algorithm) {
-  if (algorithm === "HS256") {
-    const sig = createHmac2("sha256", secret).update(input).digest();
-    return base64urlEncode(sig);
+  const digest = HMAC_DIGESTS.get(algorithm);
+  if (digest) {
+    return base64urlEncode(createHmac2(digest, secret).update(input).digest());
   }
-  if (algorithm === "RS256") {
-    const signer = createSign("RSA-SHA256");
+  const rsaAlgorithm = RSA_SIGN_ALGORITHMS.get(algorithm);
+  if (rsaAlgorithm) {
+    const signer = createSign(rsaAlgorithm);
     signer.update(input);
-    const sig = signer.sign(secret);
-    return base64urlEncode(sig);
+    return base64urlEncode(signer.sign(secret));
   }
-  throw new Error(`Unsupported algorithm: ${algorithm}`);
+  throw unsupportedAlgorithmError(algorithm);
 }
 function verifySignature(input, sig, secret, algorithm) {
-  if (algorithm === "HS256") {
+  if (HMAC_DIGESTS.has(algorithm)) {
     const expected = sign(input, secret, algorithm);
     const a = Buffer.from(sig);
     const b = Buffer.from(expected);
     if (a.length !== b.length) return false;
     return timingSafeEqual(a, b);
   }
-  if (algorithm === "RS256") {
-    const verifier = createVerify("RSA-SHA256");
+  const rsaAlgorithm = RSA_SIGN_ALGORITHMS.get(algorithm);
+  if (rsaAlgorithm) {
+    const verifier = createVerify(rsaAlgorithm);
     verifier.update(input);
     return verifier.verify(secret, base64urlDecode(sig));
   }
-  throw new Error(`Unsupported algorithm: ${algorithm}`);
+  throw unsupportedAlgorithmError(algorithm);
 }
 function hashPassword(password, salt, iterations = 26e4) {
   const actualSalt = salt ?? randomBytes3(16).toString("hex");
@@ -12308,7 +12419,7 @@ function checkPassword(password, hash) {
     return false;
   }
 }
-function authMiddleware(secret, algorithm = "HS256") {
+function authMiddleware(secret, algorithm) {
   return (req2, res, next) => {
     const authHeader = req2.headers.authorization ?? "";
     if (!authHeader.startsWith("Bearer ")) {
@@ -12331,11 +12442,11 @@ function refreshToken(token, expiresIn = 60) {
   const { iat: _iat, exp: _exp, ...claims } = payload;
   return getToken(claims, expiresIn);
 }
-function authenticateRequest(headers, secret, algorithm = "HS256") {
+function authenticateRequest(headers, secret, algorithm) {
   const authHeader = headers.authorization ?? headers.Authorization ?? "";
   if (!authHeader.startsWith("Bearer ")) return null;
   const token = authHeader.slice(7);
-  if (validToken(token)) return getPayload(token);
+  if (validToken(token, secret, algorithm)) return getPayload(token);
   if (validateApiKey(token)) {
     return { _auth: "api_key" };
   }
@@ -12349,12 +12460,23 @@ function validateApiKey(provided, expected) {
   if (a.length !== b.length) return false;
   return timingSafeEqual(a, b);
 }
-var BLANK_SECRET_WARNING, Auth;
+var BLANK_SECRET_WARNING, HMAC_DIGESTS, RSA_SIGN_ALGORITHMS, SUPPORTED_ALGORITHMS, JWT_LEEWAY_SECONDS, Auth;
 var init_auth = __esm({
   "../core/src/auth.ts"() {
     "use strict";
     init_dotenv();
     BLANK_SECRET_WARNING = "Auth: TINA4_SECRET is not set \u2014 JWT signing is insecure. Set TINA4_SECRET to a random value (e.g. `openssl rand -hex 32`) in your environment or .env before serving traffic. For LOCAL DEV, set TINA4_DEBUG=true and a per-machine secret is generated automatically into .env.local (gitignored). Seeing this warning means the run was NOT detected as dev \u2014 typically a container or CI without TINA4_DEBUG set, or TINA4_ENV=production.";
+    HMAC_DIGESTS = /* @__PURE__ */ new Map([
+      ["HS256", "sha256"],
+      ["HS384", "sha384"],
+      ["HS512", "sha512"]
+    ]);
+    RSA_SIGN_ALGORITHMS = /* @__PURE__ */ new Map([["RS256", "RSA-SHA256"]]);
+    SUPPORTED_ALGORITHMS = [
+      ...HMAC_DIGESTS.keys(),
+      ...RSA_SIGN_ALGORITHMS.keys()
+    ];
+    JWT_LEEWAY_SECONDS = 60;
     Auth = class {
       static getToken = getToken;
       static validToken = validToken;
@@ -13793,7 +13915,7 @@ function _generateFormToken(descriptor = "") {
 function _generateFormTokenValue(descriptor = "") {
   return new SafeString(_buildFormTokenJwt(descriptor));
 }
-var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
+var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, GATEABLE_TAGS, BLOCK_TAG_ENDS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
 var init_engine = __esm({
   "../frond/src/engine.ts"() {
     "use strict";
@@ -13836,6 +13958,29 @@ var init_engine = __esm({
       "endset",
       "endspaceless"
     ]);
+    GATEABLE_TAGS = /* @__PURE__ */ new Set([
+      "autoescape",
+      "cache",
+      "for",
+      "from",
+      "if",
+      "import",
+      "include",
+      "live",
+      "macro",
+      "set",
+      "spaceless"
+    ]);
+    BLOCK_TAG_ENDS = {
+      autoescape: "endautoescape",
+      cache: "endcache",
+      for: "endfor",
+      if: "endif",
+      live: "endlive",
+      macro: "endmacro",
+      set: "endset",
+      spaceless: "endspaceless"
+    };
     JSON_UNSAFE_RE = /[<>&'\u2028\u2029]/g;
     JSON_UNSAFE_MAP = {
       "<": "\\u003c",
@@ -14471,42 +14616,27 @@ var init_engine = __esm({
             if (stripA && i + 1 < tokens.length && tokens[i + 1][0] === "TEXT") {
               tokens[i + 1] = ["TEXT", tokens[i + 1][1].replace(LEADING_WS_RE, "")];
             }
-            if (tag === "if") {
-              if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("if")) {
-                const skip = this.skipBlock(tokens, i, "if", "endif");
-                i = skip;
-              } else {
-                const [result, skip] = this.handleIf(tokens, i, context);
-                output.push(result);
-                i = skip;
-              }
+            if (!this.tagPermitted(tag)) {
+              i = this.skipDeniedTag(tokens, i, tag, content);
+            } else if (tag === "if") {
+              const [result, skip] = this.handleIf(tokens, i, context);
+              output.push(result);
+              i = skip;
             } else if (tag === "for") {
-              if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("for")) {
-                const skip = this.skipBlock(tokens, i, "for", "endfor");
-                i = skip;
-              } else {
-                const [result, skip] = this.handleFor(tokens, i, context);
-                output.push(result);
-                i = skip;
-              }
+              const [result, skip] = this.handleFor(tokens, i, context);
+              output.push(result);
+              i = skip;
             } else if (tag === "set") {
-              const isBlockSet = !content.includes("=");
-              if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("set")) {
-                i = isBlockSet ? this.skipBlock(tokens, i, "set", "endset") : i + 1;
-              } else if (isBlockSet) {
+              if (!content.includes("=")) {
                 i = this.handleSetBlock(tokens, i, context);
               } else {
                 this.handleSet(content, context);
                 i++;
               }
             } else if (tag === "include") {
-              if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("include")) {
-                i++;
-              } else {
-                const result = this.handleInclude(content, context);
-                output.push(result);
-                i++;
-              }
+              const result = this.handleInclude(content, context);
+              output.push(result);
+              i++;
             } else if (tag === "macro") {
               const skip = this.handleMacro(tokens, i, context);
               i = skip;
@@ -14551,6 +14681,41 @@ var init_engine = __esm({
         }
         return output.join("");
       }
+      /**
+       * May this filter RUN under the current sandbox?
+       *
+       * The escaping decision has to ask this rather than read the filter name out of
+       * the source. Node carries safety as a FLAG rather than as a value-level marker
+       * (Python and Ruby return a SafeString, PHP prepends a RAW_MARKER -- all three
+       * produced only by actually running the filter), so here the name alone was
+       * enough to suppress auto-escaping even when the filter was denied and skipped.
+       */
+      filterPermitted(name) {
+        if (!this._sandbox || this._allowedFilters === null) return true;
+        return this._allowedFilters.has(name);
+      }
+      /**
+       * May this tag run under the current sandbox?
+       *
+       * One gate for every tag, so the allow-list governs the whole tag vocabulary
+       * instead of the four names that happened to be checked individually.
+       */
+      tagPermitted(tag) {
+        if (!this._sandbox || this._allowedTags === null) return true;
+        if (!GATEABLE_TAGS.has(tag)) return true;
+        return this._allowedTags.has(tag);
+      }
+      /**
+       * Consume a denied tag WITHOUT running it, returning the index past its body.
+       *
+       * Advancing a single token past a body-owning tag would leave the body's tokens
+       * to render at the TOP level, leaking exactly the content the sandbox denied.
+       */
+      skipDeniedTag(tokens, start2, tag, content) {
+        const closeTag = BLOCK_TAG_ENDS[tag];
+        if (closeTag === void 0 || tag === "set" && content.includes("=")) return start2 + 1;
+        return this.skipBlock(tokens, start2, tag, closeTag);
+      }
       skipBlock(tokens, start2, openTag, closeTag) {
         let depth = 0;
         let i = start2 + 1;
@@ -14558,7 +14723,7 @@ var init_engine = __esm({
           if (tokens[i][0] === "BLOCK") {
             const [content] = stripTag(tokens[i][1]);
             const tag = content.split(/\s+/)[0] || "";
-            if (tag === openTag) depth++;
+            if (tag === openTag && !(openTag === "set" && content.includes("="))) depth++;
             else if (tag === closeTag) {
               if (depth === 0) return i + 1;
               depth--;
@@ -14743,11 +14908,11 @@ var init_engine = __esm({
         for (const [fname, rawArgs] of filters) {
           const args = rawArgs.map((a) => a instanceof VarRef ? evalExpr(a.name, context) : a);
           if (fname === "raw" || fname === "safe") {
-            isSafe = true;
+            if (this.filterPermitted(fname)) isSafe = true;
             continue;
           }
           if (fname === "escape" || fname === "e") {
-            isSafe = true;
+            if (this.filterPermitted(fname)) isSafe = true;
           }
           if (this._sandbox && this._allowedFilters !== null) {
             if (!this._allowedFilters.has(fname)) {
@@ -16558,858 +16723,128 @@ var init_rateLimiter = __esm({
   }
 });
 
-// ../core/src/messenger.ts
-import net2 from "node:net";
-import tls from "node:tls";
-import { readFileSync as readFileSync8 } from "node:fs";
-import { basename as basename3 } from "node:path";
+// ../core/src/devMailbox.ts
+import { mkdirSync as mkdirSync9, readdirSync as readdirSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4, existsSync as existsSync11 } from "node:fs";
+import { join as join13 } from "node:path";
 import { randomUUID as randomUUID2 } from "node:crypto";
-function tlsRejectUnauthorized() {
-  return !isTruthy(process.env.TINA4_MAIL_TLS_INSECURE);
-}
-function readResponse(socket) {
-  return new Promise((resolve31, reject) => {
-    let buffer = "";
-    const onData = (chunk) => {
-      buffer += chunk.toString("utf-8");
-      const lines = buffer.split("\r\n");
-      for (let i = 0; i < lines.length; i++) {
-        const line = lines[i];
-        if (line.length < 3) continue;
-        const code = parseInt(line.substring(0, 3), 10);
-        if (line.length >= 4 && line[3] === " ") {
-          socket.removeListener("data", onData);
-          socket.removeListener("error", onError);
-          resolve31({ code, text: buffer.trim() });
-          return;
-        }
-      }
-    };
-    const onError = (err) => {
-      socket.removeListener("data", onData);
-      reject(err);
-    };
-    socket.on("data", onData);
-    socket.on("error", onError);
-  });
-}
-function sendCommand(socket, command) {
-  return new Promise((resolve31, reject) => {
-    socket.write(command + "\r\n", "utf-8", (err) => {
-      if (err) return reject(err);
-      readResponse(socket).then(resolve31, reject);
-    });
-  });
-}
-function buildMimeMessage(options) {
-  const boundary = `----=_Tina4_${Date.now()}_${Math.random().toString(36).substring(2)}`;
-  const altBoundary = `----=_Tina4Alt_${Date.now()}_${Math.random().toString(36).substring(2)}`;
-  const hasAttachments = options.attachments && options.attachments.length > 0;
-  const hasTextAlt = options.text !== void 0 && options.html;
-  const lines = [];
-  const fromHeader = options.fromName ? `"${options.fromName}" <${options.from}>` : options.from;
-  lines.push(`From: ${fromHeader}`);
-  lines.push(`To: ${options.to.join(", ")}`);
-  if (options.cc.length > 0) {
-    lines.push(`Cc: ${options.cc.join(", ")}`);
-  }
-  lines.push(`Subject: ${options.subject}`);
-  lines.push(`Date: ${(/* @__PURE__ */ new Date()).toUTCString()}`);
-  lines.push(`Message-ID: <${options.messageId}>`);
-  lines.push("MIME-Version: 1.0");
-  if (options.replyTo) {
-    lines.push(`Reply-To: ${options.replyTo}`);
-  }
-  if (options.headers) {
-    for (const [key, value] of Object.entries(options.headers)) {
-      lines.push(`${key}: ${value}`);
-    }
-  }
-  if (hasAttachments) {
-    lines.push(`Content-Type: multipart/mixed; boundary="${boundary}"`);
-    lines.push("");
-    lines.push(`--${boundary}`);
-    if (hasTextAlt) {
-      lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
-      lines.push("");
-      lines.push(`--${altBoundary}`);
-      lines.push("Content-Type: text/plain; charset=UTF-8");
-      lines.push("Content-Transfer-Encoding: 7bit");
-      lines.push("");
-      lines.push(options.text);
-      lines.push("");
-      lines.push(`--${altBoundary}`);
-      lines.push("Content-Type: text/html; charset=UTF-8");
-      lines.push("Content-Transfer-Encoding: 7bit");
-      lines.push("");
-      lines.push(options.body);
-      lines.push("");
-      lines.push(`--${altBoundary}--`);
-    } else {
-      const contentType = options.html ? "text/html" : "text/plain";
-      lines.push(`Content-Type: ${contentType}; charset=UTF-8`);
-      lines.push("Content-Transfer-Encoding: 7bit");
-      lines.push("");
-      lines.push(options.body);
-    }
-    for (const filePath of options.attachments) {
-      const fileName = basename3(filePath);
-      const fileData = readFileSync8(filePath);
-      const base64Data = fileData.toString("base64");
-      lines.push("");
-      lines.push(`--${boundary}`);
-      lines.push(`Content-Type: application/octet-stream; name="${fileName}"`);
-      lines.push("Content-Transfer-Encoding: base64");
-      lines.push(`Content-Disposition: attachment; filename="${fileName}"`);
-      lines.push("");
-      for (let i = 0; i < base64Data.length; i += 76) {
-        lines.push(base64Data.substring(i, i + 76));
-      }
-    }
-    lines.push("");
-    lines.push(`--${boundary}--`);
-  } else if (hasTextAlt) {
-    lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
-    lines.push("");
-    lines.push(`--${altBoundary}`);
-    lines.push("Content-Type: text/plain; charset=UTF-8");
-    lines.push("Content-Transfer-Encoding: 7bit");
-    lines.push("");
-    lines.push(options.text);
-    lines.push("");
-    lines.push(`--${altBoundary}`);
-    lines.push("Content-Type: text/html; charset=UTF-8");
-    lines.push("Content-Transfer-Encoding: 7bit");
-    lines.push("");
-    lines.push(options.body);
-    lines.push("");
-    lines.push(`--${altBoundary}--`);
-  } else {
-    const contentType = options.html ? "text/html" : "text/plain";
-    lines.push(`Content-Type: ${contentType}; charset=UTF-8`);
-    lines.push("");
-    lines.push(options.body);
-  }
-  return lines.join("\r\n");
-}
-function imapQuote(s) {
-  if (/^[a-zA-Z0-9_./-]+$/.test(s)) return s;
-  return '"' + s.replace(/\\/g, "\\\\").replace(/"/g, '\\"') + '"';
-}
-function imapReadLine(socket) {
-  return new Promise((resolve31, reject) => {
-    let buffer = "";
-    const onData = (chunk) => {
-      buffer += chunk.toString("utf-8");
-      const nlIndex = buffer.indexOf("\r\n");
-      if (nlIndex !== -1) {
-        socket.removeListener("data", onData);
-        socket.removeListener("error", onError);
-        resolve31(buffer);
+var DevMailbox;
+var init_devMailbox = __esm({
+  "../core/src/devMailbox.ts"() {
+    "use strict";
+    DevMailbox = class {
+      mailboxDir;
+      constructor(mailboxDir) {
+        this.mailboxDir = mailboxDir ?? process.env.TINA4_MAILBOX_DIR ?? "data/mailbox";
       }
-    };
-    const onError = (err) => {
-      socket.removeListener("data", onData);
-      reject(err);
-    };
-    socket.on("data", onData);
-    socket.on("error", onError);
-  });
-}
-function imapCommand(socket, command) {
-  return new Promise((resolve31, reject) => {
-    imapTagCounter++;
-    const tag = `T${imapTagCounter}`;
-    const fullCommand = `${tag} ${command}\r
-`;
-    let buffer = "";
-    const onData = (chunk) => {
-      buffer += chunk.toString("utf-8");
-      if (buffer.includes(`${tag} OK`)) {
-        socket.removeListener("data", onData);
-        socket.removeListener("error", onError);
-        resolve31(buffer);
-        return;
+      /**
+       * Ensure a folder directory exists.
+       */
+      ensureFolder(folder) {
+        const dir = join13(this.mailboxDir, folder);
+        mkdirSync9(dir, { recursive: true });
+        return dir;
       }
-      if (buffer.includes(`${tag} NO`) || buffer.includes(`${tag} BAD`)) {
-        socket.removeListener("data", onData);
-        socket.removeListener("error", onError);
-        reject(new MessengerConnectionError(`IMAP command failed: ${command.split(" ")[0]} \u2192 ${buffer.trim()}`));
+      /**
+       * Capture an email to the dev mailbox instead of sending it.
+       *
+       * The parameter order MATCHES Messenger.send() on purpose. It did not before:
+       * send()'s 5th positional was `text` and capture()'s was `cc`, so the same call
+       * meant different things depending on which door it came through -- that mismatch
+       * IS nodejs#42.
+       *
+       * BREAKING: `text` is now the 5th positional. A caller passing cc positionally
+       * must move it. Aligning the two signatures is the fix; leaving them apart would
+       * preserve the bug.
+       */
+      capture(to, subject, body, html = false, text, cc = [], bcc = [], replyTo, attachments = [], from) {
+        const id = randomUUID2();
+        const toList = Array.isArray(to) ? to : [to];
+        const ccList = Array.isArray(cc) ? cc : cc ? [cc] : [];
+        const bccList = Array.isArray(bcc) ? bcc : bcc ? [bcc] : [];
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        const message = {
+          id,
+          type: "outbox",
+          from: from ?? process.env.TINA4_MAIL_FROM ?? "dev@localhost",
+          to: toList,
+          cc: ccList,
+          bcc: bccList,
+          reply_to: replyTo,
+          subject,
+          body,
+          text,
+          html,
+          attachments,
+          date: now,
+          read: false
+        };
+        const outboxDir = this.ensureFolder("outbox");
+        writeFileSync7(join13(outboxDir, `${id}.json`), JSON.stringify(message, null, 2));
+        const inboxDir = this.ensureFolder("inbox");
+        const inboxMessage = { ...message, type: "inbox" };
+        writeFileSync7(join13(inboxDir, `${id}.json`), JSON.stringify(inboxMessage, null, 2));
+        return { success: true, message: "Email captured to dev mailbox", id };
       }
-    };
-    const onError = (err) => {
-      socket.removeListener("data", onData);
-      reject(err);
-    };
-    socket.on("data", onData);
-    socket.on("error", onError);
-    socket.write(fullCommand, "utf-8");
-  });
-}
-function imapFail(method, err) {
-  const e = err instanceof Error ? err : new Error(String(err));
-  Log.error(`Messenger IMAP ${method}() failed: ${e.name}: ${e.message}`);
-  if (e instanceof MessengerConnectionError) return e;
-  return new MessengerConnectionError(`IMAP ${method} failed: ${e.message}`);
-}
-function parseSearchResponse(response) {
-  const match = response.match(/\* SEARCH (.+)/);
-  if (!match) return [];
-  return match[1].trim().split(/\s+/).filter((s) => /^\d+$/.test(s));
-}
-function parseHeaderResponse(uid, response) {
-  const headers = {};
-  const headerBlock = response.match(/\r\n([\s\S]*?)\r\n\)/);
-  if (headerBlock) {
-    const lines = headerBlock[1].split(/\r\n/);
-    let currentKey = "";
-    for (const line of lines) {
-      if (/^\s/.test(line) && currentKey) {
-        headers[currentKey] += " " + line.trim();
-      } else {
-        const colonIdx = line.indexOf(":");
-        if (colonIdx > 0) {
-          currentKey = line.substring(0, colonIdx).trim().toLowerCase();
-          headers[currentKey] = line.substring(colonIdx + 1).trim();
+      /**
+       * List messages from a folder (default: inbox).
+       */
+      inbox(limit = 50, offset = 0, folder = "inbox") {
+        const dir = this.ensureFolder(folder);
+        const results = [];
+        let files;
+        try {
+          files = readdirSync6(dir).filter((f) => f.endsWith(".json")).sort().reverse();
+        } catch {
+          return [];
         }
-      }
-    }
-  }
-  const seen = /\\Seen/i.test(response);
-  return {
-    uid,
-    subject: headers["subject"] ?? "",
-    from: headers["from"] ?? "",
-    to: headers["to"] ?? "",
-    date: headers["date"] ?? "",
-    snippet: "",
-    seen
-  };
-}
-function emptyFullMessage(uid) {
-  return { uid, subject: "", from: "", to: "", cc: "", date: "", bodyText: "", bodyHtml: "", headers: {} };
-}
-function parseFullMessage(uid, response) {
-  const bodyMatch = response.match(/\{(\d+)\}\r\n([\s\S]*)/);
-  const rawMessage = bodyMatch ? bodyMatch[2] : response;
-  const headerEnd = rawMessage.indexOf("\r\n\r\n");
-  const headerSection = headerEnd > 0 ? rawMessage.substring(0, headerEnd) : rawMessage;
-  const bodySection = headerEnd > 0 ? rawMessage.substring(headerEnd + 4) : "";
-  const headers = {};
-  const headerLines = headerSection.split(/\r\n/);
-  let currentKey = "";
-  for (const line of headerLines) {
-    if (/^\s/.test(line) && currentKey) {
-      headers[currentKey] += " " + line.trim();
-    } else {
-      const colonIdx = line.indexOf(":");
-      if (colonIdx > 0) {
-        currentKey = line.substring(0, colonIdx).trim().toLowerCase();
-        headers[currentKey] = line.substring(colonIdx + 1).trim();
-      }
-    }
-  }
-  const contentType = headers["content-type"] ?? "text/plain";
-  let bodyText = "";
-  let bodyHtml = "";
-  if (contentType.includes("multipart")) {
-    const boundaryMatch = contentType.match(/boundary="?([^";\s]+)"?/);
-    if (boundaryMatch) {
-      const boundary = boundaryMatch[1];
-      const parts = bodySection.split("--" + boundary);
-      for (const part of parts) {
-        if (part.trim() === "" || part.trim() === "--") continue;
-        const partHeaderEnd = part.indexOf("\r\n\r\n");
-        const partHeaders = partHeaderEnd > 0 ? part.substring(0, partHeaderEnd).toLowerCase() : "";
-        const partBody = partHeaderEnd > 0 ? part.substring(partHeaderEnd + 4).trim() : "";
-        if (partHeaders.includes("text/html")) {
-          bodyHtml = partBody;
-        } else if (partHeaders.includes("text/plain")) {
-          bodyText = partBody;
+        const sliced = files.slice(offset, offset + limit);
+        for (const file of sliced) {
+          try {
+            const msg = JSON.parse(readFileSync8(join13(dir, file), "utf-8"));
+            results.push(msg);
+          } catch {
+          }
         }
+        return results;
       }
-    }
-  } else if (contentType.includes("text/html")) {
-    bodyHtml = bodySection;
-  } else {
-    bodyText = bodySection;
-  }
-  bodyText = bodyText.replace(/\)\r\n[A-Z]\d+ OK.*$/s, "").trim();
-  bodyHtml = bodyHtml.replace(/\)\r\n[A-Z]\d+ OK.*$/s, "").trim();
-  return {
-    uid,
-    subject: headers["subject"] ?? "",
-    from: headers["from"] ?? "",
-    to: headers["to"] ?? "",
-    cc: headers["cc"] ?? "",
-    date: headers["date"] ?? "",
-    bodyText,
-    bodyHtml,
-    headers
-  };
-}
-var MessengerConnectionError, Messenger, imapTagCounter;
-var init_messenger = __esm({
-  "../core/src/messenger.ts"() {
-    "use strict";
-    init_dotenv();
-    init_logger();
-    MessengerConnectionError = class extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "MessengerConnectionError";
-      }
-    };
-    Messenger = class {
-      host;
-      port;
-      username;
-      password;
-      fromAddress;
-      fromName;
-      encryption;
-      useTls;
-      imapHost;
-      imapPort;
-      imapUser;
-      imapPass;
-      imapEncryption;
-      constructor(options) {
-        this.host = options?.host ?? process.env.TINA4_MAIL_HOST ?? "localhost";
-        this.port = options?.port ?? parseInt(process.env.TINA4_MAIL_PORT ?? "587", 10);
-        this.username = options?.username ?? process.env.TINA4_MAIL_USERNAME ?? "";
-        this.password = options?.password ?? process.env.TINA4_MAIL_PASSWORD ?? "";
-        this.fromAddress = options?.fromAddress ?? process.env.TINA4_MAIL_FROM ?? (this.username || "noreply@localhost");
-        this.fromName = options?.fromName ?? process.env.TINA4_MAIL_FROM_NAME ?? "";
-        const envEncryption = options?.encryption ?? process.env.TINA4_MAIL_ENCRYPTION;
-        if (envEncryption) {
-          this.encryption = envEncryption.toLowerCase();
-        } else if (options?.useTls !== void 0) {
-          this.encryption = options.useTls ? "tls" : "none";
-        } else {
-          this.encryption = "tls";
+      /**
+       * Read a single message by ID. Searches all folders.
+       */
+      read(msgId) {
+        const folders = ["inbox", "outbox"];
+        for (const folder of folders) {
+          const filePath = join13(this.mailboxDir, folder, `${msgId}.json`);
+          if (existsSync11(filePath)) {
+            try {
+              const msg = JSON.parse(readFileSync8(filePath, "utf-8"));
+              msg.read = true;
+              writeFileSync7(filePath, JSON.stringify(msg, null, 2));
+              return msg;
+            } catch {
+              return null;
+            }
+          }
         }
-        this.useTls = ["tls", "starttls"].includes(this.encryption);
-        this.imapHost = options?.imapHost ?? process.env.TINA4_MAIL_IMAP_HOST ?? "";
-        this.imapPort = options?.imapPort ?? parseInt(process.env.TINA4_MAIL_IMAP_PORT ?? "993", 10);
-        this.imapUser = options?.imapUser ?? process.env.TINA4_MAIL_IMAP_USERNAME ?? this.username;
-        this.imapPass = options?.imapPass ?? process.env.TINA4_MAIL_IMAP_PASSWORD ?? this.password;
-        this.imapEncryption = (options?.imapEncryption ?? process.env.TINA4_MAIL_IMAP_ENCRYPTION ?? "tls").toLowerCase();
+        return null;
       }
       /**
-       * Read-only IMAP encryption mode for inspection / tests.
-       * Returns one of "tls", "starttls", "none", "ssl".
+       * Count unread messages in the inbox.
        */
-      getImapEncryption() {
-        return this.imapEncryption;
-      }
-      /**
-       * Send an email via SMTP.
-       */
-      async send(to, subject, body, html = false, text, cc, bcc, replyTo, attachments, headers) {
-        const options = { to, subject, body, html, text, cc, bcc, replyTo, attachments, headers };
-        const toList = Array.isArray(options.to) ? options.to : [options.to];
-        const ccList = Array.isArray(options.cc) ? options.cc : options.cc ? [options.cc] : [];
-        const bccList = Array.isArray(options.bcc) ? options.bcc : options.bcc ? [options.bcc] : [];
-        const allRecipients = [...toList, ...ccList, ...bccList];
-        const messageId = `${randomUUID2()}@${this.host}`;
-        if (allRecipients.length === 0) {
-          return { success: false, message: "No recipients specified" };
-        }
-        if (!this.fromAddress) {
-          return { success: false, message: "No from address configured" };
-        }
-        try {
-          let socket;
-          if (this.port === 465) {
-            socket = tls.connect({ host: this.host, port: this.port, rejectUnauthorized: tlsRejectUnauthorized() });
-            await new Promise((resolve31, reject) => {
-              socket.once("secureConnect", resolve31);
-              socket.once("error", reject);
-            });
-          } else {
-            socket = net2.createConnection({ host: this.host, port: this.port });
-            await new Promise((resolve31, reject) => {
-              socket.once("connect", resolve31);
-              socket.once("error", reject);
-            });
-          }
-          const greeting = await readResponse(socket);
-          if (greeting.code !== 220) {
-            socket.destroy();
-            return { success: false, message: `SMTP greeting failed: ${greeting.text}` };
-          }
-          const ehlo = await sendCommand(socket, `EHLO ${this.host}`);
-          if (ehlo.code !== 250) {
-            socket.destroy();
-            return { success: false, message: `EHLO failed: ${ehlo.text}` };
-          }
-          if (this.useTls && this.port !== 465 && ehlo.text.includes("STARTTLS")) {
-            const starttls = await sendCommand(socket, "STARTTLS");
-            if (starttls.code !== 220) {
-              socket.destroy();
-              return { success: false, message: `STARTTLS failed: ${starttls.text}` };
-            }
-            const plainSocket = socket;
-            socket = tls.connect(
-              { socket: plainSocket, host: this.host, rejectUnauthorized: tlsRejectUnauthorized() }
-            );
-            await new Promise((resolve31, reject) => {
-              socket.once("secureConnect", resolve31);
-              socket.once("error", reject);
-            });
-            const ehlo2 = await sendCommand(socket, `EHLO ${this.host}`);
-            if (ehlo2.code !== 250) {
-              socket.destroy();
-              return { success: false, message: `EHLO after STARTTLS failed: ${ehlo2.text}` };
-            }
-          }
-          if (this.username && this.password) {
-            const auth = await sendCommand(socket, "AUTH LOGIN");
-            if (auth.code !== 334) {
-              socket.destroy();
-              return { success: false, message: `AUTH LOGIN failed: ${auth.text}` };
-            }
-            const userResp = await sendCommand(socket, Buffer.from(this.username).toString("base64"));
-            if (userResp.code !== 334) {
-              socket.destroy();
-              return { success: false, message: `AUTH username failed: ${userResp.text}` };
-            }
-            const passResp = await sendCommand(socket, Buffer.from(this.password).toString("base64"));
-            if (passResp.code !== 235) {
-              socket.destroy();
-              return { success: false, message: `AUTH password failed: ${passResp.text}` };
-            }
-          }
-          const mailFrom = await sendCommand(socket, `MAIL FROM:<${this.fromAddress}>`);
-          if (mailFrom.code !== 250) {
-            socket.destroy();
-            return { success: false, message: `MAIL FROM failed: ${mailFrom.text}` };
-          }
-          for (const recipient of allRecipients) {
-            const rcpt = await sendCommand(socket, `RCPT TO:<${recipient}>`);
-            if (rcpt.code !== 250 && rcpt.code !== 251) {
-              socket.destroy();
-              return { success: false, message: `RCPT TO <${recipient}> failed: ${rcpt.text}` };
-            }
-          }
-          const dataCmd = await sendCommand(socket, "DATA");
-          if (dataCmd.code !== 354) {
-            socket.destroy();
-            return { success: false, message: `DATA failed: ${dataCmd.text}` };
-          }
-          const mimeMessage = buildMimeMessage({
-            from: this.fromAddress,
-            fromName: this.fromName,
-            to: toList,
-            cc: ccList,
-            subject: options.subject,
-            body: options.body,
-            html: options.html ?? false,
-            text: options.text,
-            replyTo: options.replyTo,
-            attachments: options.attachments,
-            headers: options.headers,
-            messageId
-          });
-          const endData = await sendCommand(socket, mimeMessage + "\r\n.");
-          if (endData.code !== 250) {
-            socket.destroy();
-            return { success: false, message: `Message delivery failed: ${endData.text}` };
-          }
-          await sendCommand(socket, "QUIT");
-          socket.destroy();
-          return { success: true, message: "Email sent successfully", id: messageId };
-        } catch (err) {
-          const errMsg = err instanceof Error ? err.message : String(err);
-          return { success: false, message: `SMTP error: ${errMsg}` };
-        }
-      }
-      /**
-       * Test the SMTP connection without sending an email.
-       */
-      async testConnection() {
-        try {
-          let socket;
-          if (this.port === 465) {
-            socket = tls.connect({ host: this.host, port: this.port, rejectUnauthorized: tlsRejectUnauthorized() });
-            await new Promise((resolve31, reject) => {
-              socket.once("secureConnect", resolve31);
-              socket.once("error", reject);
-            });
-          } else {
-            socket = net2.createConnection({ host: this.host, port: this.port });
-            await new Promise((resolve31, reject) => {
-              socket.once("connect", resolve31);
-              socket.once("error", reject);
-            });
-          }
-          const greeting = await readResponse(socket);
-          if (greeting.code !== 220) {
-            socket.destroy();
-            return { success: false, message: `SMTP greeting failed: ${greeting.text}` };
-          }
-          const ehlo = await sendCommand(socket, `EHLO ${this.host}`);
-          if (ehlo.code !== 250) {
-            socket.destroy();
-            return { success: false, message: `EHLO failed: ${ehlo.text}` };
-          }
-          await sendCommand(socket, "QUIT");
-          socket.destroy();
-          return { success: true, message: `Connected to ${this.host}:${this.port}` };
-        } catch (err) {
-          const errMsg = err instanceof Error ? err.message : String(err);
-          return { success: false, message: `Connection failed: ${errMsg}` };
-        }
-      }
-      // ── IMAP (Read) ────────────────────────────────────────────
-      /**
-       * Connect to the IMAP server via raw TCP/TLS.
-       * Returns the socket and reads the greeting.
-       */
-      async imapConnect() {
-        if (!this.imapHost) {
-          throw new Error("IMAP host not configured (set imapHost or IMAP_HOST env)");
-        }
-        let socket;
-        const useTls = this.imapEncryption === "tls" || this.imapEncryption === "ssl" || this.imapEncryption === "" && this.imapPort === 993;
-        if (useTls) {
-          socket = tls.connect({ host: this.imapHost, port: this.imapPort, rejectUnauthorized: tlsRejectUnauthorized() });
-          await new Promise((resolve31, reject) => {
-            socket.once("secureConnect", resolve31);
-            socket.once("error", reject);
-          });
-        } else {
-          socket = net2.createConnection({ host: this.imapHost, port: this.imapPort });
-          await new Promise((resolve31, reject) => {
-            socket.once("connect", resolve31);
-            socket.once("error", reject);
-          });
-        }
-        await imapReadLine(socket);
-        if (this.imapUser && this.imapPass) {
-          const loginResp = await imapCommand(socket, `LOGIN ${imapQuote(this.imapUser)} ${imapQuote(this.imapPass)}`);
-          if (!loginResp.includes("OK")) {
-            socket.destroy();
-            throw new Error(`IMAP login failed: ${loginResp}`);
-          }
-        }
-        return socket;
-      }
-      /**
-       * Disconnect from IMAP cleanly.
-       */
-      async imapDisconnect(socket) {
-        try {
-          await imapCommand(socket, "LOGOUT");
-        } catch {
-        }
-        socket.destroy();
-      }
-      /**
-       * Fetch latest messages from a folder.
-       * Returns list of message summaries.
-       */
-      async inbox(limit = 20, offset = 0, folder = "INBOX") {
-        let socket;
-        try {
-          socket = await this.imapConnect();
-        } catch (err) {
-          throw imapFail("inbox", err);
-        }
-        try {
-          await imapCommand(socket, `SELECT ${imapQuote(folder)}`);
-          const searchResp = await imapCommand(socket, "SEARCH ALL");
-          const uids = parseSearchResponse(searchResp);
-          if (uids.length === 0) return [];
-          uids.reverse();
-          const selected = uids.slice(offset, offset + limit);
-          if (selected.length === 0) return [];
-          const messages = [];
-          for (const uid of selected) {
-            const fetchResp = await imapCommand(socket, `FETCH ${uid} (FLAGS BODY.PEEK[HEADER.FIELDS (FROM TO SUBJECT DATE)])`);
-            messages.push(parseHeaderResponse(uid, fetchResp));
-          }
-          return messages;
-        } catch (err) {
-          throw imapFail("inbox", err);
-        } finally {
-          await this.imapDisconnect(socket);
-        }
-      }
-      /**
-       * Read a single message by sequence number or UID.
-       */
-      async read(uid, folder = "INBOX") {
-        let socket;
-        try {
-          socket = await this.imapConnect();
-        } catch (err) {
-          throw imapFail("read", err);
-        }
-        try {
-          await imapCommand(socket, `SELECT ${imapQuote(folder)}`);
-          const fetchResp = await imapCommand(socket, `FETCH ${uid} (FLAGS BODY[])`);
-          if (!/\{\d+\}/.test(fetchResp)) {
-            return emptyFullMessage(uid);
-          }
-          await imapCommand(socket, `STORE ${uid} +FLAGS (\\Seen)`);
-          return parseFullMessage(uid, fetchResp);
-        } catch (err) {
-          throw imapFail("read", err);
-        } finally {
-          await this.imapDisconnect(socket);
-        }
-      }
-      /**
-       * Search messages using IMAP search criteria.
-       */
-      async search(folder = "INBOX", subject, sender, since, before, unseenOnly = false, limit = 50) {
-        const criteria = ["ALL"];
-        if (subject) criteria.push(`SUBJECT "${subject}"`);
-        if (sender) criteria.push(`FROM "${sender}"`);
-        if (since) criteria.push(`SINCE ${since}`);
-        if (before) criteria.push(`BEFORE ${before}`);
-        if (unseenOnly) criteria.push("UNSEEN");
-        const query = criteria.join(" ");
-        let socket;
-        try {
-          socket = await this.imapConnect();
-        } catch (err) {
-          throw imapFail("search", err);
-        }
-        try {
-          await imapCommand(socket, `SELECT ${imapQuote(folder)}`);
-          const searchResp = await imapCommand(socket, `SEARCH ${query}`);
-          const uids = parseSearchResponse(searchResp);
-          if (uids.length === 0) return [];
-          uids.reverse();
-          const messages = [];
-          for (const uid of uids.slice(0, limit)) {
-            const fetchResp = await imapCommand(socket, `FETCH ${uid} (FLAGS BODY.PEEK[HEADER.FIELDS (FROM TO SUBJECT DATE)])`);
-            messages.push(parseHeaderResponse(uid, fetchResp));
-          }
-          return messages;
-        } catch (err) {
-          throw imapFail("search", err);
-        } finally {
-          await this.imapDisconnect(socket);
-        }
-      }
-      /**
-       * Delete a message by UID.
-       */
-      async deleteMessage(uid, folder = "INBOX") {
-        const socket = await this.imapConnect();
-        try {
-          await imapCommand(socket, `SELECT ${imapQuote(folder)}`);
-          await imapCommand(socket, `STORE ${uid} +FLAGS (\\Deleted)`);
-          await imapCommand(socket, "EXPUNGE");
-        } finally {
-          await this.imapDisconnect(socket);
-        }
-      }
-      /**
-       * Mark a message as read.
-       */
-      async markRead(uid, folder = "INBOX") {
-        const socket = await this.imapConnect();
-        try {
-          await imapCommand(socket, `SELECT ${imapQuote(folder)}`);
-          await imapCommand(socket, `STORE ${uid} +FLAGS (\\Seen)`);
-        } finally {
-          await this.imapDisconnect(socket);
-        }
-      }
-      /**
-       * Count unseen messages in a folder.
-       */
-      async unread(folder = "INBOX") {
-        let socket;
-        try {
-          socket = await this.imapConnect();
-        } catch (err) {
-          throw imapFail("unread", err);
-        }
-        try {
-          await imapCommand(socket, `SELECT ${imapQuote(folder)}`);
-          const searchResp = await imapCommand(socket, "SEARCH UNSEEN");
-          return parseSearchResponse(searchResp).length;
-        } catch (err) {
-          throw imapFail("unread", err);
-        } finally {
-          await this.imapDisconnect(socket);
-        }
-      }
-      /**
-       * List available IMAP folders/mailboxes.
-       */
-      async folders() {
-        let socket;
-        try {
-          socket = await this.imapConnect();
-        } catch (err) {
-          throw imapFail("folders", err);
-        }
-        try {
-          const resp = await imapCommand(socket, 'LIST "" "*"');
-          const result = [];
-          for (const line of resp.split("\r\n")) {
-            const m = line.match(/\* LIST \([^)]*\) "[^"]*" "?([^"\r\n]+)"?/i);
-            if (m) result.push(m[1]);
-          }
-          return result;
-        } catch (err) {
-          throw imapFail("folders", err);
-        } finally {
-          await this.imapDisconnect(socket);
-        }
-      }
-      /**
-       * Test IMAP connectivity without reading.
-       */
-      async testImapConnection() {
-        try {
-          const socket = await this.imapConnect();
-          await this.imapDisconnect(socket);
-          return { success: true, message: `Connected to ${this.imapHost}:${this.imapPort}` };
-        } catch (err) {
-          const errMsg = err instanceof Error ? err.message : String(err);
-          return { success: false, message: `IMAP connection failed: ${errMsg}` };
-        }
-      }
-    };
-    imapTagCounter = 0;
-  }
-});
-
-// ../core/src/devMailbox.ts
-import { mkdirSync as mkdirSync9, readdirSync as readdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4, existsSync as existsSync11 } from "node:fs";
-import { join as join13 } from "node:path";
-import { randomUUID as randomUUID3 } from "node:crypto";
-function createMessenger() {
-  const debug = process.env.TINA4_DEBUG;
-  const smtpHost = process.env.TINA4_MAIL_HOST;
-  const isProd = !isTruthy(debug) && process.env.NODE_ENV === "production";
-  if (isTruthy(debug)) {
-    return new DevMailbox();
-  }
-  if (!smtpHost) {
-    return new DevMailbox();
-  }
-  if (!isProd) {
-    return new DevMailbox();
-  }
-  return new Messenger();
-}
-var DevMailbox;
-var init_devMailbox = __esm({
-  "../core/src/devMailbox.ts"() {
-    "use strict";
-    init_messenger();
-    init_dotenv();
-    DevMailbox = class {
-      mailboxDir;
-      constructor(mailboxDir) {
-        this.mailboxDir = mailboxDir ?? process.env.TINA4_MAILBOX_DIR ?? "data/mailbox";
-      }
-      /**
-       * Ensure a folder directory exists.
-       */
-      ensureFolder(folder) {
-        const dir = join13(this.mailboxDir, folder);
-        mkdirSync9(dir, { recursive: true });
-        return dir;
-      }
-      /**
-       * Capture an email to the dev mailbox instead of sending it.
-       */
-      capture(to, subject, body, html = false, cc = [], bcc = [], replyTo, attachments = [], from) {
-        const id = randomUUID3();
-        const toList = Array.isArray(to) ? to : [to];
-        const now = (/* @__PURE__ */ new Date()).toISOString();
-        const message = {
-          id,
-          type: "outbox",
-          from: from ?? process.env.TINA4_MAIL_FROM ?? "dev@localhost",
-          to: toList,
-          cc,
-          bcc,
-          reply_to: replyTo,
-          subject,
-          body,
-          html,
-          attachments,
-          date: now,
-          read: false
-        };
-        const outboxDir = this.ensureFolder("outbox");
-        writeFileSync7(join13(outboxDir, `${id}.json`), JSON.stringify(message, null, 2));
-        const inboxDir = this.ensureFolder("inbox");
-        const inboxMessage = { ...message, type: "inbox" };
-        writeFileSync7(join13(inboxDir, `${id}.json`), JSON.stringify(inboxMessage, null, 2));
-        return { success: true, message: "Email captured to dev mailbox", id };
-      }
-      /**
-       * List messages from a folder (default: inbox).
-       */
-      inbox(limit = 50, offset = 0, folder = "inbox") {
-        const dir = this.ensureFolder(folder);
-        const results = [];
-        let files;
-        try {
-          files = readdirSync6(dir).filter((f) => f.endsWith(".json")).sort().reverse();
-        } catch {
-          return [];
-        }
-        const sliced = files.slice(offset, offset + limit);
-        for (const file of sliced) {
-          try {
-            const msg = JSON.parse(readFileSync9(join13(dir, file), "utf-8"));
-            results.push(msg);
-          } catch {
-          }
-        }
-        return results;
-      }
-      /**
-       * Read a single message by ID. Searches all folders.
-       */
-      read(msgId) {
-        const folders = ["inbox", "outbox"];
-        for (const folder of folders) {
-          const filePath = join13(this.mailboxDir, folder, `${msgId}.json`);
-          if (existsSync11(filePath)) {
-            try {
-              const msg = JSON.parse(readFileSync9(filePath, "utf-8"));
-              msg.read = true;
-              writeFileSync7(filePath, JSON.stringify(msg, null, 2));
-              return msg;
-            } catch {
-              return null;
-            }
-          }
-        }
-        return null;
-      }
-      /**
-       * Count unread messages in the inbox.
-       */
-      unreadCount() {
-        const dir = this.ensureFolder("inbox");
-        let count = 0;
-        try {
-          const files = readdirSync6(dir).filter((f) => f.endsWith(".json"));
-          for (const file of files) {
-            try {
-              const msg = JSON.parse(readFileSync9(join13(dir, file), "utf-8"));
-              if (!msg.read) count++;
-            } catch {
-            }
-          }
-        } catch {
-        }
-        return count;
+      unreadCount() {
+        const dir = this.ensureFolder("inbox");
+        let count = 0;
+        try {
+          const files = readdirSync6(dir).filter((f) => f.endsWith(".json"));
+          for (const file of files) {
+            try {
+              const msg = JSON.parse(readFileSync8(join13(dir, file), "utf-8"));
+              if (!msg.read) count++;
+            } catch {
+            }
+          }
+        } catch {
+        }
+        return count;
       }
       /**
        * Delete a message by ID. Removes from all folders.
@@ -17474,7 +16909,7 @@ var init_devMailbox = __esm({
           const subject = subjects[i % subjects.length];
           const from = senders[i % senders.length];
           const date = new Date(Date.now() - i * 36e5).toISOString();
-          const id = randomUUID3();
+          const id = randomUUID2();
           const message = {
             id,
             type: "inbox",
@@ -18595,7 +18030,7 @@ var init_metrics = __esm({
 });
 
 // ../core/src/feedback.ts
-import { readFileSync as readFileSync11, existsSync as existsSync13 } from "node:fs";
+import { readFileSync as readFileSync10, existsSync as existsSync13 } from "node:fs";
 import { dirname as dirname6, join as join15, resolve as resolve9 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function feedbackEnabled() {
@@ -18736,7 +18171,7 @@ var init_feedback = __esm({
     handleFeedbackWidgetJs = (_req, res) => {
       let body;
       if (existsSync13(WIDGET_BUNDLE_PATH)) {
-        body = readFileSync11(WIDGET_BUNDLE_PATH);
+        body = readFileSync10(WIDGET_BUNDLE_PATH);
       } else {
         body = "console.warn('tina4-feedback-widget bundle not built yet');";
       }
@@ -20444,7 +19879,7 @@ __export(errorOverlay_exports, {
   renderErrorOverlay: () => renderErrorOverlay,
   renderProductionError: () => renderProductionError
 });
-import { readFileSync as readFileSync13, statSync as statSync10 } from "node:fs";
+import { readFileSync as readFileSync12, statSync as statSync10 } from "node:fs";
 import { resolve as resolve11 } from "node:path";
 function esc(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
@@ -20468,7 +19903,7 @@ function parseStack(stack) {
 function readSourceLines(filename, lineno) {
   try {
     const absPath = resolve11(filename);
-    const content = readFileSync13(absPath, "utf-8");
+    const content = readFileSync12(absPath, "utf-8");
     const allLines = content.split("\n");
     const start2 = Math.max(0, lineno - CONTEXT_LINES - 1);
     const end = Math.min(allLines.length, lineno + CONTEXT_LINES);
@@ -21732,8 +21167,8 @@ __export(context_exports, {
   fts5Supported: () => fts5Supported
 });
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
-import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync14, readdirSync as readdirSync9, realpathSync as realpathSync2 } from "node:fs";
-import { basename as basename5, dirname as dirname8, extname as extname6, isAbsolute as isAbsolute5, join as join17, relative as relative4, resolve as resolve12 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync13, readdirSync as readdirSync9, realpathSync as realpathSync2 } from "node:fs";
+import { basename as basename4, dirname as dirname8, extname as extname6, isAbsolute as isAbsolute5, join as join17, relative as relative4, resolve as resolve12 } from "node:path";
 function fts5Supported() {
   try {
     const conn = new DatabaseSync3(":memory:");
@@ -21756,7 +21191,7 @@ function realResolve(abs) {
   } catch {
   }
   try {
-    return join17(realpathSync2(dirname8(abs)), basename5(abs));
+    return join17(realpathSync2(dirname8(abs)), basename4(abs));
   } catch {
     return abs;
   }
@@ -21869,7 +21304,7 @@ var init_context = __esm({
       // ── indexing ───────────────────────────────────────────────
       static chunksFor(label, text) {
         const ext = extname6(label).toLowerCase();
-        const special = SPECIAL_FILES.has(basename5(label).toLowerCase());
+        const special = SPECIAL_FILES.has(basename4(label).toLowerCase());
         if (CODE_EXTS.has(ext) || CONFIG_EXTS.has(ext) || special) {
           return chunkCode(text, label);
         }
@@ -21886,7 +21321,7 @@ var init_context = __esm({
         const stored = label != null ? String(label) : String(file);
         let text;
         try {
-          text = readFileSync14(file, "utf-8");
+          text = readFileSync13(file, "utf-8");
         } catch {
           return 0;
         }
@@ -21966,7 +21401,7 @@ var init_context = __esm({
         if (parts.some((seg) => SKIP_DIRS.has(seg)) || dirParts.some((seg) => seg.startsWith("."))) {
           return -1;
         }
-        if (!_Context.eligible(basename5(rel))) return -1;
+        if (!_Context.eligible(basename4(rel))) return -1;
         const stored = rel;
         if (!existsSync15(abs)) {
           this.conn.prepare("DELETE FROM chunks WHERE path = ?").run(stored);
@@ -22058,7 +21493,7 @@ var init_context = __esm({
 });
 
 // ../core/src/websocketBackplane.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 function createBackplane(url) {
   const backend = (process.env.TINA4_WS_BACKPLANE ?? "").trim().toLowerCase();
   switch (backend) {
@@ -22088,7 +21523,7 @@ function buildEnvelope(src, kind, message, opts = {}) {
   return envelope;
 }
 function randomInstanceId() {
-  return randomUUID4().replace(/-/g, "").slice(0, 16);
+  return randomUUID3().replace(/-/g, "").slice(0, 16);
 }
 var RedisBackplane, NATSBackplane, WS_BACKPLANE_CHANNEL, WsBackplaneManager;
 var init_websocketBackplane = __esm({
@@ -22316,7 +21751,7 @@ __export(websocket_exports, {
 });
 import { createServer } from "node:http";
 import { createHash as createHash4 } from "node:crypto";
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 function computeAcceptKey(key) {
   return createHash4("sha1").update(key + MAGIC_STRING).digest("base64");
 }
@@ -22444,7 +21879,7 @@ function parseFrame(data) {
   return { fin: !!fin, opcode, payload: Buffer.from(payload), bytesConsumed: offset + payloadLen };
 }
 function createRouteConnection(socket, path8, headers, params, auth) {
-  const id = randomUUID5().slice(0, 8);
+  const id = randomUUID4().slice(0, 8);
   const send = (message) => {
     try {
       socket.write(buildFrame(OP_TEXT, Buffer.from(message, "utf-8")));
@@ -23001,7 +22436,7 @@ var init_websocket = __esm({
         }
         responseLines.push("", "");
         socket.write(responseLines.join("\r\n"));
-        const clientId = randomUUID5().slice(0, 8);
+        const clientId = randomUUID4().slice(0, 8);
         const client = {
           id: clientId,
           socket,
@@ -23289,7 +22724,7 @@ var init_websocket = __esm({
 
 // ../core/src/queueBackends/rabbitmqBackend.ts
 import { execFileSync } from "node:child_process";
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 function parseAmqpUrl(url) {
   const config = {};
   let rest = url.replace(/^amqps:\/\//, "").replace(/^amqp:\/\//, "");
@@ -23733,7 +23168,7 @@ var init_rabbitmqBackend = __esm({
         }
       }
       push(queue, payload, _delay) {
-        const id = randomUUID6();
+        const id = randomUUID5();
         const now = (/* @__PURE__ */ new Date()).toISOString();
         const job = {
           id,
@@ -23772,7 +23207,7 @@ var init_rabbitmqBackend = __esm({
 
 // ../core/src/queueBackends/kafkaBackend.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 function kafkaSecurityConfig(env = process.env) {
   const mapping = [
     ["security.protocol", "SECURITY_PROTOCOL"],
@@ -23796,7 +23231,7 @@ var init_kafkaBackend = __esm({
     "use strict";
     API_PRODUCE = 0;
     API_FETCH = 1;
-    KafkaBackend = class {
+    KafkaBackend = class _KafkaBackend {
       brokers;
       groupId;
       constructor(config) {
@@ -24158,12 +23593,15 @@ var init_kafkaBackend = __esm({
             if (errCode === 0) {
               finish("__PUBLISHED__", 0);
             } else {
+              // Report the CODE, not just "it failed" \u2014 the caller decides
+              // whether it is retriable (3/5, the async topic-creation race)
+              // or fatal (e.g. 29 TOPIC_AUTHORIZATION_FAILED).
               process.stderr.write("Produce error code " + errCode);
-              finish("__ERROR__" + errCode, 0);
+              finish("__PRODUCEERROR__" + errCode, 0);
             }
           } catch (e) {
             process.stderr.write("produce parse: " + e.message);
-            finish("__ERROR__", 0);
+            finish("__PARSEERROR__produce: " + e.message, 0);
           }
           return;
         } else if (operation === "get") {
@@ -24177,6 +23615,7 @@ var init_kafkaBackend = __esm({
             pos += 4;                                   // throttleTimeMs (v1+)
             const topicCount = buffer.readInt32BE(pos); pos += 4;
             let out = "__EMPTY__";
+            let fatalCode = 0;
             for (let t = 0; t < topicCount; t++) {
               const tl = buffer.readInt16BE(pos); pos += 2 + tl;
               const pc = buffer.readInt32BE(pos); pos += 4;
@@ -24188,6 +23627,14 @@ var init_kafkaBackend = __esm({
                 const abortedCount = buffer.readInt32BE(pos); pos += 4;
                 if (abortedCount > 0) pos += abortedCount * 16; // (-1 => none, skip)
                 const recSetSize = buffer.readInt32BE(pos); pos += 4;
+                // 3 = UNKNOWN_TOPIC_OR_PARTITION, 5 = LEADER_NOT_AVAILABLE:
+                // "nothing to read here yet", which a consumer that starts
+                // before its producer hits on every cold start. Any OTHER code
+                // (29 TOPIC_AUTHORIZATION_FAILED, 13 STALE_CONTROLLER_EPOCH, \u2026)
+                // is a real failure and must NOT be reported as an empty queue.
+                if (errCode !== 0 && errCode !== 3 && errCode !== 5) {
+                  fatalCode = errCode;
+                }
                 if (errCode === 0 && recSetSize > 0) {
                   const val = firstRecordValue(buffer, pos, pos + recSetSize);
                   if (val !== null) out = val;
@@ -24195,21 +23642,33 @@ var init_kafkaBackend = __esm({
                 pos += recSetSize > 0 ? recSetSize : 0;
               }
             }
+            if (fatalCode !== 0) {
+              process.stderr.write("Fetch error code " + fatalCode);
+              finish("__FETCHERROR__" + fatalCode, 0);
+              return;
+            }
             finish(out, 0);
           } catch (e) {
+            // A parse failure is NOT an empty queue either \u2014 say so.
             process.stderr.write("fetch parse: " + e.message);
-            finish("__EMPTY__", 0);
+            finish("__PARSEERROR__fetch: " + e.message, 0);
           }
           return;
         }
       });
 
+      // Report the reason on STDOUT and exit 0. Writing it to stderr and
+      // exiting non-zero LOST it: stderr to a pipe is an async write and
+      // process.exit() truncates it, so the parent saw an empty stderr and fell
+      // back to execFileSync's message -- which embeds this entire script.
+      // stdout is flushed by finish()'s write callback, so it survives.
       sock.on("error", (err) => {
-        process.stderr.write(err.message);
-        finish("", 1);
+        finish("__TRANSPORTERROR__" + err.message, 0);
       });
 
-      var timer = setTimeout(() => { finish("", 1); }, 10000);
+      var timer = setTimeout(() => {
+        finish("__TRANSPORTERROR__timed out after 10s talking to " + host + ":" + port, 0);
+      }, 10000);
     `;
         try {
           const result = execFileSync2(process.execPath, ["-e", script], {
@@ -24218,12 +23677,51 @@ var init_kafkaBackend = __esm({
             stdio: ["pipe", "pipe", "pipe"]
           });
           return result;
-        } catch {
-          return "";
+        } catch (err) {
+          const e = err;
+          const reason = String(e.stderr ?? "").trim() || e.message || "unknown error";
+          const firstLine2 = reason.split("\n", 1)[0].slice(0, 200);
+          return "__TRANSPORTERROR__" + firstLine2;
+        }
+      }
+      /**
+       * Sleep synchronously between produce retries.
+       *
+       * `push()` is synchronous (the whole backend drives its socket through a child
+       * process), so there is no event loop to await on. `Atomics.wait` on a
+       * SharedArrayBuffer is the stdlib way to block a thread for a fixed time --
+       * no dependency, no busy-wait burning CPU.
+       */
+      static sleepSync(ms) {
+        const shared = new Int32Array(new SharedArrayBuffer(4));
+        Atomics.wait(shared, 0, 0, ms);
+      }
+      /**
+       * Turn a sentinel from the protocol child into a thrown error, or return.
+       *
+       * The wording matches the Python and PHP backends exactly -- the parity rule
+       * covers user-visible error messages, not just behaviour.
+       */
+      static assertNoError(result, operation, topic) {
+        const fatal = /^__(PRODUCEERROR|FETCHERROR)__(\d+)/.exec(result);
+        if (fatal) {
+          throw new Error(
+            `Kafka rejected the ${operation} for topic ${topic}: error code ${fatal[2]}`
+          );
+        }
+        if (result.startsWith("__TRANSPORTERROR__")) {
+          throw new Error(
+            `Kafka ${operation} for topic ${topic} failed: ` + result.slice("__TRANSPORTERROR__".length)
+          );
+        }
+        if (result.startsWith("__PARSEERROR__")) {
+          throw new Error(
+            `Kafka ${operation} for topic ${topic} returned an unreadable response: ` + result.slice("__PARSEERROR__".length)
+          );
         }
       }
       push(queue, payload, _delay) {
-        const id = randomUUID7();
+        const id = randomUUID6();
         const now = (/* @__PURE__ */ new Date()).toISOString();
         const job = {
           id,
@@ -24233,14 +23731,25 @@ var init_kafkaBackend = __esm({
           attempts: 0,
           delayUntil: null
         };
-        const result = this.execSync("publish", queue, JSON.stringify(job));
-        if (!result.includes("__PUBLISHED__")) {
-          throw new Error("Kafka publish failed");
+        const body = JSON.stringify(job);
+        let result = "";
+        for (let attempt = 1; attempt <= 10; attempt++) {
+          result = this.execSync("publish", queue, body);
+          if (result.includes("__PUBLISHED__")) {
+            return id;
+          }
+          const retriable = /^__PRODUCEERROR__(3|5)\b/.test(result);
+          if (!retriable || attempt === 10) {
+            break;
+          }
+          _KafkaBackend.sleepSync(200);
         }
-        return id;
+        _KafkaBackend.assertNoError(result, "produce", queue);
+        throw new Error(`Kafka publish failed for topic ${queue}: ${result || "no response"}`);
       }
       pop(queue) {
         const result = this.execSync("get", queue);
+        _KafkaBackend.assertNoError(result, "fetch", queue);
         if (!result || result === "__EMPTY__" || result === "__UNSUPPORTED__") return null;
         try {
           return JSON.parse(result);
@@ -24258,7 +23767,7 @@ var init_kafkaBackend = __esm({
 });
 
 // ../core/src/queueBackends/mongoBackend.ts
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 import { execFileSync as execFileSync3 } from "node:child_process";
 var MongoBackend2;
 var init_mongoBackend = __esm({
@@ -24571,7 +24080,7 @@ var init_mongoBackend = __esm({
         }
       }
       push(queue, payload, delay) {
-        const id = randomUUID8();
+        const id = randomUUID7();
         const now = (/* @__PURE__ */ new Date()).toISOString();
         const job = {
           id,
@@ -24706,9 +24215,9 @@ var init_job = __esm({
 });
 
 // ../core/src/queueBackends/liteBackend.ts
-import { mkdirSync as mkdirSync12, readdirSync as readdirSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync9, unlinkSync as unlinkSync5, existsSync as existsSync16 } from "node:fs";
+import { mkdirSync as mkdirSync12, readdirSync as readdirSync10, readFileSync as readFileSync14, writeFileSync as writeFileSync9, unlinkSync as unlinkSync5, existsSync as existsSync16 } from "node:fs";
 import { join as join18 } from "node:path";
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 var LiteBackend;
 var init_liteBackend = __esm({
   "../core/src/queueBackends/liteBackend.ts"() {
@@ -24760,7 +24269,7 @@ var init_liteBackend = __esm({
       }
       push(queue, payload, delay, priority) {
         const dir = this.ensureDir(queue);
-        const id = randomUUID9();
+        const id = randomUUID8();
         const now = (/* @__PURE__ */ new Date()).toISOString();
         const job = {
           id,
@@ -24796,7 +24305,7 @@ var init_liteBackend = __esm({
           const filePath = join18(dir, filename);
           let job;
           try {
-            job = JSON.parse(readFileSync15(filePath, "utf-8"));
+            job = JSON.parse(readFileSync14(filePath, "utf-8"));
           } catch {
             continue;
           }
@@ -24860,7 +24369,7 @@ var init_liteBackend = __esm({
           const filePath = join18(reservedDir, filename);
           let record;
           try {
-            record = JSON.parse(readFileSync15(filePath, "utf-8"));
+            record = JSON.parse(readFileSync14(filePath, "utf-8"));
           } catch {
             continue;
           }
@@ -24973,7 +24482,7 @@ var init_liteBackend = __esm({
         let count = 0;
         for (const file of files) {
           try {
-            const job = JSON.parse(readFileSync15(join18(scanDir, file), "utf-8"));
+            const job = JSON.parse(readFileSync14(join18(scanDir, file), "utf-8"));
             if (job.status === status2) count++;
           } catch {
           }
@@ -25030,7 +24539,7 @@ var init_liteBackend = __esm({
           const files = readdirSync10(dir).filter((f) => f.endsWith(".queue-data")).sort();
           for (const file of files) {
             try {
-              const job = JSON.parse(readFileSync15(join18(dir, file), "utf-8"));
+              const job = JSON.parse(readFileSync14(join18(dir, file), "utf-8"));
               const attempts = job.attempts || 0;
               if (attempts > 0 && attempts < maxRetries) {
                 results.push(job);
@@ -25056,7 +24565,7 @@ var init_liteBackend = __esm({
             const failedDir = join18(this.basePath, q, "failed");
             const filePath = join18(failedDir, `${jobId}.queue-data`);
             if (existsSync16(filePath)) {
-              const job = JSON.parse(readFileSync15(filePath, "utf-8"));
+              const job = JSON.parse(readFileSync14(filePath, "utf-8"));
               job.status = "pending";
               job.attempts = (job.attempts || 0) + 1;
               job.error = void 0;
@@ -25080,7 +24589,7 @@ var init_liteBackend = __esm({
           const files = readdirSync10(failedDir).filter((f) => f.endsWith(".queue-data")).sort();
           for (const file of files) {
             try {
-              const job = JSON.parse(readFileSync15(join18(failedDir, file), "utf-8"));
+              const job = JSON.parse(readFileSync14(join18(failedDir, file), "utf-8"));
               if ((job.attempts || 0) >= maxRetries) {
                 job.status = "dead";
                 results.push(job);
@@ -25114,7 +24623,7 @@ var init_liteBackend = __esm({
             const files = readdirSync10(dir).filter((f) => f.endsWith(".queue-data"));
             for (const file of files) {
               try {
-                const job = JSON.parse(readFileSync15(join18(dir, file), "utf-8"));
+                const job = JSON.parse(readFileSync14(join18(dir, file), "utf-8"));
                 if (job.status === status2) {
                   unlinkSync5(join18(dir, file));
                   count++;
@@ -25141,7 +24650,7 @@ var init_liteBackend = __esm({
           for (const file of files) {
             try {
               const filePath = join18(failedDir, file);
-              const job = JSON.parse(readFileSync15(filePath, "utf-8"));
+              const job = JSON.parse(readFileSync14(filePath, "utf-8"));
               if ((job.attempts || 0) >= maxRetries) {
                 continue;
               }
@@ -25173,7 +24682,7 @@ var init_liteBackend = __esm({
           const filePath = join18(dir, file);
           let job;
           try {
-            job = JSON.parse(readFileSync15(filePath, "utf-8"));
+            job = JSON.parse(readFileSync14(filePath, "utf-8"));
           } catch {
             continue;
           }
@@ -27663,7 +27172,7 @@ ${end}
 
 // ../core/src/devAdmin.ts
 import { cpus as osCpus } from "node:os";
-import { readFileSync as readFileSync19, writeFileSync as writeFileSync13, existsSync as existsSync20, readdirSync as readdirSync14, mkdirSync as mkdirSync15, copyFileSync as copyFileSync2, statSync as statSync15 } from "node:fs";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync13, existsSync as existsSync20, readdirSync as readdirSync14, mkdirSync as mkdirSync15, copyFileSync as copyFileSync2, statSync as statSync15 } from "node:fs";
 import { join as join22, dirname as dirname10, resolve as resolve16, relative as relative8 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { timingSafeEqual as timingSafeEqual2 } from "node:crypto";
@@ -27849,7 +27358,7 @@ function resolveDevEnvVar(key) {
   if (live !== void 0 && live !== "") return live;
   const envPath = join22(process.cwd(), ".env");
   if (!existsSync20(envPath)) return "";
-  for (const line of readFileSync19(envPath, "utf-8").split("\n")) {
+  for (const line of readFileSync18(envPath, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#") || !t.includes("=")) continue;
     const eq = t.indexOf("=");
@@ -27859,7 +27368,7 @@ function resolveDevEnvVar(key) {
 }
 function upsertDevEnvVar(key, value) {
   const envPath = join22(process.cwd(), ".env");
-  const lines = existsSync20(envPath) ? readFileSync19(envPath, "utf-8").split("\n") : [];
+  const lines = existsSync20(envPath) ? readFileSync18(envPath, "utf-8").split("\n") : [];
   let found = false;
   const out = [];
   for (const line of lines) {
@@ -27892,7 +27401,7 @@ function parseEnvFile() {
   const envPath = join22(process.cwd(), ".env");
   const result = {};
   if (!existsSync20(envPath)) return result;
-  const lines = readFileSync19(envPath, "utf-8").split("\n");
+  const lines = readFileSync18(envPath, "utf-8").split("\n");
   for (const line of lines) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#") || !trimmed.includes("=")) continue;
@@ -28249,7 +27758,7 @@ var init_devAdmin = __esm({
         for (const rel of ["../../../package.json", "../../package.json"]) {
           const p = resolve16(__dirname2, rel);
           if (existsSync20(p)) {
-            const pkg = JSON.parse(readFileSync19(p, "utf-8"));
+            const pkg = JSON.parse(readFileSync18(p, "utf-8"));
             if (pkg.version) return pkg.version;
           }
         }
@@ -28907,7 +28416,7 @@ var init_devAdmin = __esm({
             for (const filename of readdirSync14(queueDir).sort()) {
               if (!filename.endsWith(".queue-data")) continue;
               try {
-                const job = JSON.parse(readFileSync19(join22(queueDir, filename), "utf-8"));
+                const job = JSON.parse(readFileSync18(join22(queueDir, filename), "utf-8"));
                 jobs.push(mapQueueJob(job, topic, "pending"));
               } catch {
               }
@@ -29393,7 +28902,7 @@ var init_devAdmin = __esm({
       }
       try {
         const envPath = join22(process.cwd(), ".env");
-        const lines = existsSync20(envPath) ? readFileSync19(envPath, "utf-8").split("\n") : [];
+        const lines = existsSync20(envPath) ? readFileSync18(envPath, "utf-8").split("\n") : [];
         const keysFound = { TINA4_DATABASE_URL: false, TINA4_DATABASE_USERNAME: false, TINA4_DATABASE_PASSWORD: false };
         const newLines = [];
         for (const line of lines) {
@@ -29439,7 +28948,7 @@ var init_devAdmin = __esm({
           const metaFile = join22(entryPath, "meta.json");
           if (statSync15(entryPath).isDirectory() && existsSync20(metaFile)) {
             try {
-              const meta = JSON.parse(readFileSync19(metaFile, "utf-8"));
+              const meta = JSON.parse(readFileSync18(metaFile, "utf-8"));
               meta.id = entry;
               const srcDir = join22(entryPath, "src");
               if (existsSync20(srcDir)) {
@@ -29654,7 +29163,7 @@ var init_devAdmin = __esm({
         return;
       }
       try {
-        const content = readFileSync19(target, "utf-8");
+        const content = readFileSync18(target, "utf-8");
         const path8 = relative8(root, target);
         res.json({ path: path8, content, language: devAdminLanguage(path8), bytes: Buffer.byteLength(content, "utf-8") });
       } catch (e) {
@@ -29696,7 +29205,7 @@ var init_devAdmin = __esm({
         return;
       }
       try {
-        const buf = readFileSync19(target);
+        const buf = readFileSync18(target);
         const ext = target.slice(target.lastIndexOf(".") + 1).toLowerCase();
         const mime = {
           js: "application/javascript",
@@ -30124,7 +29633,7 @@ var init_devAdmin = __esm({
 });
 
 // ../core/src/i18n.ts
-import { readFileSync as readFileSync20, readdirSync as readdirSync15, existsSync as existsSync21 } from "node:fs";
+import { readFileSync as readFileSync19, readdirSync as readdirSync15, existsSync as existsSync21 } from "node:fs";
 import { join as join23, resolve as resolve17 } from "node:path";
 var I18n;
 var init_i18n = __esm({
@@ -30221,7 +29730,7 @@ var init_i18n = __esm({
         const filePath = join23(this._localeDir, `${locale}.json`);
         if (existsSync21(filePath)) {
           try {
-            const raw = readFileSync20(filePath, "utf-8");
+            const raw = readFileSync19(filePath, "utf-8");
             const data = JSON.parse(raw);
             this._translations.set(locale, _I18n._flatten(data));
             return;
@@ -30234,7 +29743,7 @@ var init_i18n = __esm({
           const yamlPath = join23(this._localeDir, `${locale}${ext}`);
           if (existsSync21(yamlPath)) {
             try {
-              const raw = readFileSync20(yamlPath, "utf-8");
+              const raw = readFileSync19(yamlPath, "utf-8");
               const data = _I18n._parseSimpleYaml(raw);
               this._translations.set(locale, _I18n._flatten(data));
               return;
@@ -30902,6 +30411,36 @@ var init_docsAutoDiscovery = __esm({
   }
 });
 
+// ../core/src/sessionHandlers/childError.ts
+function childFailureReason(err) {
+  const e = err ?? {};
+  const stderr = String(e.stderr ?? "").trim();
+  if (stderr !== "") {
+    return firstLine(stderr);
+  }
+  if (e.code === "ETIMEDOUT" || e.signal) {
+    return `timed out or was killed (${e.code ?? e.signal})`;
+  }
+  if (typeof e.status === "number" && e.status !== 0) {
+    return `child exited with code ${e.status} and no output`;
+  }
+  return firstLine(String(e.message ?? "unknown error"));
+}
+function firstLine(text) {
+  const line = text.split("\n", 1)[0] ?? "";
+  return line.length > MAX_FALLBACK ? `${line.slice(0, MAX_FALLBACK)}...` : line;
+}
+function childFailureError(label, err) {
+  return new Error(`${label} command failed: ${childFailureReason(err)}`);
+}
+var MAX_FALLBACK;
+var init_childError = __esm({
+  "../core/src/sessionHandlers/childError.ts"() {
+    "use strict";
+    MAX_FALLBACK = 200;
+  }
+});
+
 // ../core/src/sessionHandlers/respClient.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 function respCommandSync(target, args, label = "Redis") {
@@ -31021,7 +30560,7 @@ function respCommandSync(target, args, label = "Redis") {
       stdio: ["pipe", "pipe", "pipe"]
     });
   } catch (err) {
-    throw new Error(`${label} command failed: ${err.message}`);
+    throw childFailureError(label, err);
   }
   if (result === "__NULL__") return "";
   if (result.startsWith("__ERR__")) {
@@ -31032,6 +30571,7 @@ function respCommandSync(target, args, label = "Redis") {
 var init_respClient = __esm({
   "../core/src/sessionHandlers/respClient.ts"() {
     "use strict";
+    init_childError();
   }
 });
 
@@ -31050,6 +30590,7 @@ var moduleRequire, RedisNpmSessionHandler;
 var init_redisHandler = __esm({
   "../core/src/sessionHandlers/redisHandler.ts"() {
     "use strict";
+    init_childError();
     init_respClient();
     moduleRequire = createRequire8(import.meta.url);
     RedisNpmSessionHandler = class {
@@ -31110,9 +30651,17 @@ var init_redisHandler = __esm({
       (async () => {
         try {
           const redis = require("redis");
+          // reconnectStrategy: false \u2014 this child runs ONE command and exits, so
+          // retrying inside it is pointless: the handler is called again on the
+          // next request anyway. With the driver's default strategy a refused
+          // connection never rejects, the child hangs until execFileSync's 5s
+          // timeout kills it, and the caller is told "timed out" when the truth
+          // is "connection refused". Off, connect() rejects in ~5ms with the real
+          // reason -- a better message AND no 5s stall per request when Redis is
+          // down.
           const clientOpts = useUrl
-            ? { url }
-            : { socket: { host, port }, password: password || undefined, database: db };
+            ? { url, socket: { reconnectStrategy: false } }
+            : { socket: { host, port, reconnectStrategy: false }, password: password || undefined, database: db };
           const client = redis.createClient(clientOpts);
           client.on("error", () => {});
           await client.connect();
@@ -31126,8 +30675,10 @@ var init_redisHandler = __esm({
           const out = (result === null || result === undefined) ? "__NULL__" : String(result);
           process.stdout.write(out, () => process.exit(0));
         } catch (err) {
-          process.stderr.write(String((err && err.message) || err));
-          process.exit(1);
+          // Exit from the write CALLBACK: stderr to a pipe is an async write and
+          // a bare process.exit() truncates it, which left the parent with an
+          // empty stderr and nothing but execFileSync's script-dump message.
+          process.stderr.write(String((err && err.message) || err), () => process.exit(1));
         }
       })();
     `;
@@ -31139,7 +30690,7 @@ var init_redisHandler = __esm({
             stdio: ["pipe", "pipe", "pipe"]
           });
         } catch (err) {
-          throw new Error(`Redis command failed: ${err.message}`);
+          throw childFailureError("Redis", err);
         }
         if (result === "__NULL__") return "";
         return result;
@@ -31271,8 +30822,10 @@ function mongoCommandSync(target, command, args, label = "MongoDB") {
           process.stdout.write(out, () => process.exit(0));
         } catch (err) {
           try { if (client) await client.close(); } catch (e) {}
-          process.stderr.write(String((err && err.message) || err));
-          process.exit(1);
+          // Exit from the write CALLBACK: stderr to a pipe is an async write and
+          // a bare process.exit() truncates it, which left the parent with an
+          // empty stderr and nothing but execFileSync's script-dump message.
+          process.stderr.write(String((err && err.message) || err), () => process.exit(1));
         }
       })();
     } else {
@@ -31413,12 +30966,13 @@ function mongoCommandSync(target, command, args, label = "MongoDB") {
       stdio: ["pipe", "pipe", "pipe"]
     });
   } catch (err) {
-    throw new Error(`${label} command failed: ${err.message}`);
+    throw childFailureError(label, err);
   }
 }
 var init_mongoClient = __esm({
   "../core/src/sessionHandlers/mongoClient.ts"() {
     "use strict";
+    init_childError();
   }
 });
 
@@ -31571,7 +31125,7 @@ __export(session_exports, {
   sessionCookieName: () => sessionCookieName
 });
 import { randomBytes as randomBytes6 } from "node:crypto";
-import { existsSync as existsSync23, mkdirSync as mkdirSync18, readFileSync as readFileSync22, writeFileSync as writeFileSync16, unlinkSync as unlinkSync7, readdirSync as readdirSync16 } from "node:fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync18, readFileSync as readFileSync21, writeFileSync as writeFileSync16, unlinkSync as unlinkSync7, readdirSync as readdirSync16 } from "node:fs";
 import { join as join25 } from "node:path";
 function isSecureScheme(forwardedProto, socketEncrypted) {
   const forwarded = (forwardedProto ?? "").trim();
@@ -31624,7 +31178,7 @@ var init_session = __esm({
         const filePath = this.filePath(sessionId);
         try {
           if (!existsSync23(filePath)) return null;
-          const raw = readFileSync22(filePath, "utf-8");
+          const raw = readFileSync21(filePath, "utf-8");
           const wrapper = JSON.parse(raw);
           if (wrapper._expires && wrapper._expires > 0 && Date.now() / 1e3 > wrapper._expires) {
             try {
@@ -31660,7 +31214,7 @@ var init_session = __esm({
             if (!file.endsWith(".json")) continue;
             const fullPath = join25(this.storagePath, file);
             try {
-              const raw = readFileSync22(fullPath, "utf-8");
+              const raw = readFileSync21(fullPath, "utf-8");
               const wrapper = JSON.parse(raw);
               if (wrapper._expires && wrapper._expires > 0 && now > wrapper._expires) {
                 unlinkSync7(fullPath);
@@ -32177,7 +31731,7 @@ var init_events = __esm({
 // ../core/src/server.ts
 import { createServer as createServer2 } from "node:http";
 import { resolve as resolve19, dirname as dirname11, join as join26, relative as relative9 } from "node:path";
-import { existsSync as existsSync24, readdirSync as readdirSync17, readFileSync as readFileSync23, statSync as statSync16 } from "node:fs";
+import { existsSync as existsSync24, readdirSync as readdirSync17, readFileSync as readFileSync22, statSync as statSync16 } from "node:fs";
 import { isatty } from "node:tty";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { execFileSync as execFileSync7, exec } from "node:child_process";
@@ -32239,7 +31793,7 @@ async function autoMigrateOnStartup(migrationDir = "migrations", base = process.
 function readPackageVersion() {
   try {
     const pkgPath = resolve19(dirname11(fileURLToPath5(import.meta.url)), "..", "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync23(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync22(pkgPath, "utf-8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -33069,7 +32623,7 @@ ${reset2}
             res.raw.writeHead(200, void 0, { "Content-Type": "text/html; charset=utf-8" });
             res.raw.end(html);
           } else {
-            const html = readFileSync23(resolve19(templatesDir, tplFile), "utf-8");
+            const html = readFileSync22(resolve19(templatesDir, tplFile), "utf-8");
             res.raw.writeHead(200, void 0, { "Content-Type": "text/html; charset=utf-8" });
             res.raw.end(html);
           }
@@ -33460,7 +33014,7 @@ var init_constants = __esm({
 });
 
 // ../core/src/scss.ts
-import { readFileSync as readFileSync24, writeFileSync as writeFileSync17, existsSync as existsSync25, mkdirSync as mkdirSync19, readdirSync as readdirSync18 } from "node:fs";
+import { readFileSync as readFileSync23, writeFileSync as writeFileSync17, existsSync as existsSync25, mkdirSync as mkdirSync19, readdirSync as readdirSync18 } from "node:fs";
 import { join as join27, resolve as resolve20, dirname as dirname12 } from "node:path";
 function compileString(scss, importPaths, variables) {
   const imported = /* @__PURE__ */ new Set();
@@ -33491,7 +33045,7 @@ function resolveImports(content, paths, imported) {
     for (const candidate of candidates) {
       if (existsSync25(candidate) && !imported.has(candidate)) {
         imported.add(candidate);
-        const fileContent = readFileSync24(candidate, "utf-8");
+        const fileContent = readFileSync23(candidate, "utf-8");
         return resolveImports(fileContent, [dirname12(candidate), ...paths], imported);
       }
     }
@@ -33832,7 +33386,7 @@ var init_scss = __esm({
       /** Compile an SCSS file to CSS. */
       compileFile(filePath) {
         const absPath = resolve20(filePath);
-        const content = readFileSync24(absPath, "utf-8");
+        const content = readFileSync23(absPath, "utf-8");
         const paths = [dirname12(absPath), ...this._importPaths];
         return compileString(content, paths, { ...this._variables });
       }
@@ -33855,7 +33409,7 @@ var init_scss = __esm({
         const imported = /* @__PURE__ */ new Set();
         let merged = "";
         for (const file of files) {
-          const content = readFileSync24(file, "utf-8");
+          const content = readFileSync23(file, "utf-8");
           imported.add(file);
           merged += resolveImports(content, paths, imported) + "\n";
         }
@@ -33872,7 +33426,7 @@ var init_scss = __esm({
         if (!existsSync25(outDir)) mkdirSync19(outDir, { recursive: true });
         let existing = null;
         try {
-          existing = existsSync25(absOutput) ? readFileSync24(absOutput, "utf-8") : null;
+          existing = existsSync25(absOutput) ? readFileSync23(absOutput, "utf-8") : null;
         } catch {
           existing = null;
         }
@@ -33956,10 +33510,10 @@ var init_mqttMessage = __esm({
 });
 
 // ../core/src/mqtt.ts
-import net3 from "node:net";
-import tls2 from "node:tls";
+import net2 from "node:net";
+import tls from "node:tls";
 import { randomBytes as randomBytes7 } from "node:crypto";
-import { existsSync as existsSync26, readFileSync as readFileSync25 } from "node:fs";
+import { existsSync as existsSync26, readFileSync as readFileSync24 } from "node:fs";
 var MqttError, MqttTimeoutError, CONNECT, CONNACK, PUBLISH, PUBACK, SUBSCRIBE, SUBACK, PINGREQ, PINGRESP, DISCONNECT, PROTOCOL_LEVEL, DEFAULT_PORT, DEFAULT_TLS_PORT, DEFAULT_URL, DEFAULT_KEEPALIVE, SUBSCRIPTION_REFUSED, MAX_REMAINING_LENGTH, QOS2_REFUSED_MESSAGE, CONNACK_RETURN_CODES, Mqtt;
 var init_mqtt = __esm({
   "../core/src/mqtt.ts"() {
@@ -34424,10 +33978,10 @@ var init_mqtt = __esm({
               servername: this.host,
               rejectUnauthorized: this.tlsVerify
             };
-            if (this.tlsVerify && this.caFile) opts.ca = readFileSync25(this.caFile);
-            sock = tls2.connect(opts, () => settle(() => resolve31(sock)));
+            if (this.tlsVerify && this.caFile) opts.ca = readFileSync24(this.caFile);
+            sock = tls.connect(opts, () => settle(() => resolve31(sock)));
           } else {
-            sock = net3.createConnection({ host: this.host, port: this.port }, () => settle(() => resolve31(sock)));
+            sock = net2.createConnection({ host: this.host, port: this.port }, () => settle(() => resolve31(sock)));
           }
           sock.once("error", (err) => {
             settle(() => {
@@ -34978,7 +34532,7 @@ import https from "node:https";
 import { URL as URL2 } from "node:url";
 import { randomBytes as randomBytes8 } from "node:crypto";
 import { promises as fsp, createWriteStream } from "node:fs";
-import { basename as basename7 } from "node:path";
+import { basename as basename6 } from "node:path";
 import { pipeline } from "node:stream/promises";
 function sameOrigin(urlA, urlB) {
   try {
@@ -35268,7 +34822,7 @@ var init_api = __esm({
               error: err instanceof Error ? err.message : String(err)
             };
           }
-          uploadName = filename || basename7(filePath);
+          uploadName = filename || basename6(filePath);
         } else {
           return { http_code: null, body: null, headers: {}, error: "upload requires filePath or fileBytes" };
         }
@@ -35624,6 +35178,777 @@ var init_api = __esm({
   }
 });
 
+// ../core/src/messenger.ts
+import net3 from "node:net";
+import tls2 from "node:tls";
+import { readFileSync as readFileSync25 } from "node:fs";
+import { basename as basename7 } from "node:path";
+import { randomUUID as randomUUID9 } from "node:crypto";
+function tlsRejectUnauthorized() {
+  return !isTruthy(process.env.TINA4_MAIL_TLS_INSECURE);
+}
+function readResponse(socket) {
+  return new Promise((resolve31, reject) => {
+    let buffer = "";
+    const onData = (chunk) => {
+      buffer += chunk.toString("utf-8");
+      const lines = buffer.split("\r\n");
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (line.length < 3) continue;
+        const code = parseInt(line.substring(0, 3), 10);
+        if (line.length >= 4 && line[3] === " ") {
+          socket.removeListener("data", onData);
+          socket.removeListener("error", onError);
+          resolve31({ code, text: buffer.trim() });
+          return;
+        }
+      }
+    };
+    const onError = (err) => {
+      socket.removeListener("data", onData);
+      reject(err);
+    };
+    socket.on("data", onData);
+    socket.on("error", onError);
+  });
+}
+function sendCommand(socket, command) {
+  return new Promise((resolve31, reject) => {
+    socket.write(command + "\r\n", "utf-8", (err) => {
+      if (err) return reject(err);
+      readResponse(socket).then(resolve31, reject);
+    });
+  });
+}
+function buildMimeMessage(options) {
+  const boundary = `----=_Tina4_${Date.now()}_${Math.random().toString(36).substring(2)}`;
+  const altBoundary = `----=_Tina4Alt_${Date.now()}_${Math.random().toString(36).substring(2)}`;
+  const hasAttachments = options.attachments && options.attachments.length > 0;
+  const hasTextAlt = options.text !== void 0 && options.html;
+  const lines = [];
+  const fromHeader = options.fromName ? `"${options.fromName}" <${options.from}>` : options.from;
+  lines.push(`From: ${fromHeader}`);
+  lines.push(`To: ${options.to.join(", ")}`);
+  if (options.cc.length > 0) {
+    lines.push(`Cc: ${options.cc.join(", ")}`);
+  }
+  lines.push(`Subject: ${options.subject}`);
+  lines.push(`Date: ${(/* @__PURE__ */ new Date()).toUTCString()}`);
+  lines.push(`Message-ID: <${options.messageId}>`);
+  lines.push("MIME-Version: 1.0");
+  if (options.replyTo) {
+    lines.push(`Reply-To: ${options.replyTo}`);
+  }
+  if (options.headers) {
+    for (const [key, value] of Object.entries(options.headers)) {
+      lines.push(`${key}: ${value}`);
+    }
+  }
+  if (hasAttachments) {
+    lines.push(`Content-Type: multipart/mixed; boundary="${boundary}"`);
+    lines.push("");
+    lines.push(`--${boundary}`);
+    if (hasTextAlt) {
+      lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
+      lines.push("");
+      lines.push(`--${altBoundary}`);
+      lines.push("Content-Type: text/plain; charset=UTF-8");
+      lines.push("Content-Transfer-Encoding: 7bit");
+      lines.push("");
+      lines.push(options.text);
+      lines.push("");
+      lines.push(`--${altBoundary}`);
+      lines.push("Content-Type: text/html; charset=UTF-8");
+      lines.push("Content-Transfer-Encoding: 7bit");
+      lines.push("");
+      lines.push(options.body);
+      lines.push("");
+      lines.push(`--${altBoundary}--`);
+    } else {
+      const contentType = options.html ? "text/html" : "text/plain";
+      lines.push(`Content-Type: ${contentType}; charset=UTF-8`);
+      lines.push("Content-Transfer-Encoding: 7bit");
+      lines.push("");
+      lines.push(options.body);
+    }
+    for (const filePath of options.attachments) {
+      const fileName = basename7(filePath);
+      const fileData = readFileSync25(filePath);
+      const base64Data = fileData.toString("base64");
+      lines.push("");
+      lines.push(`--${boundary}`);
+      lines.push(`Content-Type: application/octet-stream; name="${fileName}"`);
+      lines.push("Content-Transfer-Encoding: base64");
+      lines.push(`Content-Disposition: attachment; filename="${fileName}"`);
+      lines.push("");
+      for (let i = 0; i < base64Data.length; i += 76) {
+        lines.push(base64Data.substring(i, i + 76));
+      }
+    }
+    lines.push("");
+    lines.push(`--${boundary}--`);
+  } else if (hasTextAlt) {
+    lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
+    lines.push("");
+    lines.push(`--${altBoundary}`);
+    lines.push("Content-Type: text/plain; charset=UTF-8");
+    lines.push("Content-Transfer-Encoding: 7bit");
+    lines.push("");
+    lines.push(options.text);
+    lines.push("");
+    lines.push(`--${altBoundary}`);
+    lines.push("Content-Type: text/html; charset=UTF-8");
+    lines.push("Content-Transfer-Encoding: 7bit");
+    lines.push("");
+    lines.push(options.body);
+    lines.push("");
+    lines.push(`--${altBoundary}--`);
+  } else {
+    const contentType = options.html ? "text/html" : "text/plain";
+    lines.push(`Content-Type: ${contentType}; charset=UTF-8`);
+    lines.push("");
+    lines.push(options.body);
+  }
+  return lines.join("\r\n");
+}
+function imapQuote(s) {
+  if (/^[a-zA-Z0-9_./-]+$/.test(s)) return s;
+  return '"' + s.replace(/\\/g, "\\\\").replace(/"/g, '\\"') + '"';
+}
+function imapReadLine(socket) {
+  return new Promise((resolve31, reject) => {
+    let buffer = "";
+    const onData = (chunk) => {
+      buffer += chunk.toString("utf-8");
+      const nlIndex = buffer.indexOf("\r\n");
+      if (nlIndex !== -1) {
+        socket.removeListener("data", onData);
+        socket.removeListener("error", onError);
+        resolve31(buffer);
+      }
+    };
+    const onError = (err) => {
+      socket.removeListener("data", onData);
+      reject(err);
+    };
+    socket.on("data", onData);
+    socket.on("error", onError);
+  });
+}
+function imapCommand(socket, command) {
+  return new Promise((resolve31, reject) => {
+    imapTagCounter++;
+    const tag = `T${imapTagCounter}`;
+    const fullCommand = `${tag} ${command}\r
+`;
+    let buffer = "";
+    const onData = (chunk) => {
+      buffer += chunk.toString("utf-8");
+      if (buffer.includes(`${tag} OK`)) {
+        socket.removeListener("data", onData);
+        socket.removeListener("error", onError);
+        resolve31(buffer);
+        return;
+      }
+      if (buffer.includes(`${tag} NO`) || buffer.includes(`${tag} BAD`)) {
+        socket.removeListener("data", onData);
+        socket.removeListener("error", onError);
+        reject(new MessengerConnectionError(`IMAP command failed: ${command.split(" ")[0]} \u2192 ${buffer.trim()}`));
+      }
+    };
+    const onError = (err) => {
+      socket.removeListener("data", onData);
+      reject(err);
+    };
+    socket.on("data", onData);
+    socket.on("error", onError);
+    socket.write(fullCommand, "utf-8");
+  });
+}
+function imapFail(method, err) {
+  const e = err instanceof Error ? err : new Error(String(err));
+  Log.error(`Messenger IMAP ${method}() failed: ${e.name}: ${e.message}`);
+  if (e instanceof MessengerConnectionError) return e;
+  return new MessengerConnectionError(`IMAP ${method} failed: ${e.message}`);
+}
+function parseSearchResponse(response) {
+  const match = response.match(/\* SEARCH (.+)/);
+  if (!match) return [];
+  return match[1].trim().split(/\s+/).filter((s) => /^\d+$/.test(s));
+}
+function parseHeaderResponse(uid, response) {
+  const headers = {};
+  const headerBlock = response.match(/\r\n([\s\S]*?)\r\n\)/);
+  if (headerBlock) {
+    const lines = headerBlock[1].split(/\r\n/);
+    let currentKey = "";
+    for (const line of lines) {
+      if (/^\s/.test(line) && currentKey) {
+        headers[currentKey] += " " + line.trim();
+      } else {
+        const colonIdx = line.indexOf(":");
+        if (colonIdx > 0) {
+          currentKey = line.substring(0, colonIdx).trim().toLowerCase();
+          headers[currentKey] = line.substring(colonIdx + 1).trim();
+        }
+      }
+    }
+  }
+  const seen = /\\Seen/i.test(response);
+  return {
+    uid,
+    subject: headers["subject"] ?? "",
+    from: headers["from"] ?? "",
+    to: headers["to"] ?? "",
+    date: headers["date"] ?? "",
+    snippet: "",
+    seen
+  };
+}
+function emptyFullMessage(uid) {
+  return { uid, subject: "", from: "", to: "", cc: "", date: "", bodyText: "", bodyHtml: "", headers: {} };
+}
+function parseFullMessage(uid, response) {
+  const bodyMatch = response.match(/\{(\d+)\}\r\n([\s\S]*)/);
+  const rawMessage = bodyMatch ? bodyMatch[2] : response;
+  const headerEnd = rawMessage.indexOf("\r\n\r\n");
+  const headerSection = headerEnd > 0 ? rawMessage.substring(0, headerEnd) : rawMessage;
+  const bodySection = headerEnd > 0 ? rawMessage.substring(headerEnd + 4) : "";
+  const headers = {};
+  const headerLines = headerSection.split(/\r\n/);
+  let currentKey = "";
+  for (const line of headerLines) {
+    if (/^\s/.test(line) && currentKey) {
+      headers[currentKey] += " " + line.trim();
+    } else {
+      const colonIdx = line.indexOf(":");
+      if (colonIdx > 0) {
+        currentKey = line.substring(0, colonIdx).trim().toLowerCase();
+        headers[currentKey] = line.substring(colonIdx + 1).trim();
+      }
+    }
+  }
+  const contentType = headers["content-type"] ?? "text/plain";
+  let bodyText = "";
+  let bodyHtml = "";
+  if (contentType.includes("multipart")) {
+    const boundaryMatch = contentType.match(/boundary="?([^";\s]+)"?/);
+    if (boundaryMatch) {
+      const boundary = boundaryMatch[1];
+      const parts = bodySection.split("--" + boundary);
+      for (const part of parts) {
+        if (part.trim() === "" || part.trim() === "--") continue;
+        const partHeaderEnd = part.indexOf("\r\n\r\n");
+        const partHeaders = partHeaderEnd > 0 ? part.substring(0, partHeaderEnd).toLowerCase() : "";
+        const partBody = partHeaderEnd > 0 ? part.substring(partHeaderEnd + 4).trim() : "";
+        if (partHeaders.includes("text/html")) {
+          bodyHtml = partBody;
+        } else if (partHeaders.includes("text/plain")) {
+          bodyText = partBody;
+        }
+      }
+    }
+  } else if (contentType.includes("text/html")) {
+    bodyHtml = bodySection;
+  } else {
+    bodyText = bodySection;
+  }
+  bodyText = bodyText.replace(/\)\r\n[A-Z]\d+ OK.*$/s, "").trim();
+  bodyHtml = bodyHtml.replace(/\)\r\n[A-Z]\d+ OK.*$/s, "").trim();
+  return {
+    uid,
+    subject: headers["subject"] ?? "",
+    from: headers["from"] ?? "",
+    to: headers["to"] ?? "",
+    cc: headers["cc"] ?? "",
+    date: headers["date"] ?? "",
+    bodyText,
+    bodyHtml,
+    headers
+  };
+}
+function createMessenger() {
+  return new Messenger();
+}
+var MessengerConnectionError, Messenger, imapTagCounter;
+var init_messenger = __esm({
+  "../core/src/messenger.ts"() {
+    "use strict";
+    init_dotenv();
+    init_devMailbox();
+    init_logger();
+    MessengerConnectionError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "MessengerConnectionError";
+      }
+    };
+    Messenger = class {
+      host;
+      port;
+      username;
+      password;
+      fromAddress;
+      fromName;
+      encryption;
+      useTls;
+      /** Whether an SMTP host was actually configured (see the constructor). */
+      smtpConfigured = false;
+      /** The local mailbox, present only when this messenger captures. */
+      devMailbox = null;
+      imapHost;
+      imapPort;
+      imapUser;
+      imapPass;
+      imapEncryption;
+      constructor(options) {
+        this.smtpConfigured = Boolean(options?.host ?? process.env.TINA4_MAIL_HOST);
+        this.host = options?.host ?? process.env.TINA4_MAIL_HOST ?? "localhost";
+        this.port = options?.port ?? parseInt(process.env.TINA4_MAIL_PORT ?? "587", 10);
+        this.username = options?.username ?? process.env.TINA4_MAIL_USERNAME ?? "";
+        this.password = options?.password ?? process.env.TINA4_MAIL_PASSWORD ?? "";
+        this.fromAddress = options?.fromAddress ?? process.env.TINA4_MAIL_FROM ?? (this.username || "noreply@localhost");
+        this.fromName = options?.fromName ?? process.env.TINA4_MAIL_FROM_NAME ?? "";
+        const envEncryption = options?.encryption ?? process.env.TINA4_MAIL_ENCRYPTION;
+        if (envEncryption) {
+          this.encryption = envEncryption.toLowerCase();
+        } else if (options?.useTls !== void 0) {
+          this.encryption = options.useTls ? "tls" : "none";
+        } else {
+          this.encryption = "tls";
+        }
+        this.useTls = ["tls", "starttls"].includes(this.encryption);
+        this.imapHost = options?.imapHost ?? process.env.TINA4_MAIL_IMAP_HOST ?? "";
+        this.imapPort = options?.imapPort ?? parseInt(process.env.TINA4_MAIL_IMAP_PORT ?? "993", 10);
+        this.imapUser = options?.imapUser ?? process.env.TINA4_MAIL_IMAP_USERNAME ?? this.username;
+        this.imapPass = options?.imapPass ?? process.env.TINA4_MAIL_IMAP_PASSWORD ?? this.password;
+        this.imapEncryption = (options?.imapEncryption ?? process.env.TINA4_MAIL_IMAP_ENCRYPTION ?? "tls").toLowerCase();
+      }
+      /**
+       * Read-only IMAP encryption mode for inspection / tests.
+       * Returns one of "tls", "starttls", "none", "ssl".
+       */
+      getImapEncryption() {
+        return this.imapEncryption;
+      }
+      /**
+       * Send an email via SMTP.
+       */
+      /**
+       * Should send() capture locally instead of talking to SMTP?
+       *
+       * Availability decides, not verbosity. With no SMTP host configured sending is
+       * impossible, so simulate it into a folder rather than failing -- that is what
+       * makes a laptop with no mail server usable. TINA4_MAIL_CAPTURE forces capture
+       * even when a host IS configured.
+       *
+       * TINA4_DEBUG deliberately does NOT gate this, and neither does NODE_ENV. Debug
+       * must still be able to send, and the old `NODE_ENV !== "production"` clause
+       * silently swallowed every staging email.
+       */
+      shouldCapture() {
+        if (isTruthy(process.env.TINA4_MAIL_CAPTURE)) return true;
+        return !this.smtpConfigured;
+      }
+      /** The local mailbox, created on first capture and reused after. */
+      getDevMailbox() {
+        if (this.devMailbox === null) {
+          this.devMailbox = new DevMailbox();
+        }
+        return this.devMailbox;
+      }
+      async send(to, subject, body, html = false, text, cc, bcc, replyTo, attachments, headers) {
+        const options = { to, subject, body, html, text, cc, bcc, replyTo, attachments, headers };
+        const toList = Array.isArray(options.to) ? options.to : [options.to];
+        const ccList = Array.isArray(options.cc) ? options.cc : options.cc ? [options.cc] : [];
+        const bccList = Array.isArray(options.bcc) ? options.bcc : options.bcc ? [options.bcc] : [];
+        const allRecipients = [...toList, ...ccList, ...bccList];
+        if (this.shouldCapture()) {
+          return this.getDevMailbox().capture(
+            to,
+            subject,
+            body,
+            html,
+            text,
+            ccList,
+            bccList,
+            replyTo,
+            attachments,
+            this.fromAddress || void 0
+          );
+        }
+        const messageId = `${randomUUID9()}@${this.host}`;
+        if (allRecipients.length === 0) {
+          return { success: false, message: "No recipients specified" };
+        }
+        if (!this.fromAddress) {
+          return { success: false, message: "No from address configured" };
+        }
+        try {
+          let socket;
+          if (this.port === 465) {
+            socket = tls2.connect({ host: this.host, port: this.port, rejectUnauthorized: tlsRejectUnauthorized() });
+            await new Promise((resolve31, reject) => {
+              socket.once("secureConnect", resolve31);
+              socket.once("error", reject);
+            });
+          } else {
+            socket = net3.createConnection({ host: this.host, port: this.port });
+            await new Promise((resolve31, reject) => {
+              socket.once("connect", resolve31);
+              socket.once("error", reject);
+            });
+          }
+          const greeting = await readResponse(socket);
+          if (greeting.code !== 220) {
+            socket.destroy();
+            return { success: false, message: `SMTP greeting failed: ${greeting.text}` };
+          }
+          const ehlo = await sendCommand(socket, `EHLO ${this.host}`);
+          if (ehlo.code !== 250) {
+            socket.destroy();
+            return { success: false, message: `EHLO failed: ${ehlo.text}` };
+          }
+          if (this.useTls && this.port !== 465 && ehlo.text.includes("STARTTLS")) {
+            const starttls = await sendCommand(socket, "STARTTLS");
+            if (starttls.code !== 220) {
+              socket.destroy();
+              return { success: false, message: `STARTTLS failed: ${starttls.text}` };
+            }
+            const plainSocket = socket;
+            socket = tls2.connect(
+              { socket: plainSocket, host: this.host, rejectUnauthorized: tlsRejectUnauthorized() }
+            );
+            await new Promise((resolve31, reject) => {
+              socket.once("secureConnect", resolve31);
+              socket.once("error", reject);
+            });
+            const ehlo2 = await sendCommand(socket, `EHLO ${this.host}`);
+            if (ehlo2.code !== 250) {
+              socket.destroy();
+              return { success: false, message: `EHLO after STARTTLS failed: ${ehlo2.text}` };
+            }
+          }
+          if (this.username && this.password) {
+            const auth = await sendCommand(socket, "AUTH LOGIN");
+            if (auth.code !== 334) {
+              socket.destroy();
+              return { success: false, message: `AUTH LOGIN failed: ${auth.text}` };
+            }
+            const userResp = await sendCommand(socket, Buffer.from(this.username).toString("base64"));
+            if (userResp.code !== 334) {
+              socket.destroy();
+              return { success: false, message: `AUTH username failed: ${userResp.text}` };
+            }
+            const passResp = await sendCommand(socket, Buffer.from(this.password).toString("base64"));
+            if (passResp.code !== 235) {
+              socket.destroy();
+              return { success: false, message: `AUTH password failed: ${passResp.text}` };
+            }
+          }
+          const mailFrom = await sendCommand(socket, `MAIL FROM:<${this.fromAddress}>`);
+          if (mailFrom.code !== 250) {
+            socket.destroy();
+            return { success: false, message: `MAIL FROM failed: ${mailFrom.text}` };
+          }
+          for (const recipient of allRecipients) {
+            const rcpt = await sendCommand(socket, `RCPT TO:<${recipient}>`);
+            if (rcpt.code !== 250 && rcpt.code !== 251) {
+              socket.destroy();
+              return { success: false, message: `RCPT TO <${recipient}> failed: ${rcpt.text}` };
+            }
+          }
+          const dataCmd = await sendCommand(socket, "DATA");
+          if (dataCmd.code !== 354) {
+            socket.destroy();
+            return { success: false, message: `DATA failed: ${dataCmd.text}` };
+          }
+          const mimeMessage = buildMimeMessage({
+            from: this.fromAddress,
+            fromName: this.fromName,
+            to: toList,
+            cc: ccList,
+            subject: options.subject,
+            body: options.body,
+            html: options.html ?? false,
+            text: options.text,
+            replyTo: options.replyTo,
+            attachments: options.attachments,
+            headers: options.headers,
+            messageId
+          });
+          const endData = await sendCommand(socket, mimeMessage + "\r\n.");
+          if (endData.code !== 250) {
+            socket.destroy();
+            return { success: false, message: `Message delivery failed: ${endData.text}` };
+          }
+          await sendCommand(socket, "QUIT");
+          socket.destroy();
+          return { success: true, message: "Email sent successfully", id: messageId };
+        } catch (err) {
+          const errMsg = err instanceof Error ? err.message : String(err);
+          return { success: false, message: `SMTP error: ${errMsg}` };
+        }
+      }
+      /**
+       * Test the SMTP connection without sending an email.
+       */
+      async testConnection() {
+        try {
+          let socket;
+          if (this.port === 465) {
+            socket = tls2.connect({ host: this.host, port: this.port, rejectUnauthorized: tlsRejectUnauthorized() });
+            await new Promise((resolve31, reject) => {
+              socket.once("secureConnect", resolve31);
+              socket.once("error", reject);
+            });
+          } else {
+            socket = net3.createConnection({ host: this.host, port: this.port });
+            await new Promise((resolve31, reject) => {
+              socket.once("connect", resolve31);
+              socket.once("error", reject);
+            });
+          }
+          const greeting = await readResponse(socket);
+          if (greeting.code !== 220) {
+            socket.destroy();
+            return { success: false, message: `SMTP greeting failed: ${greeting.text}` };
+          }
+          const ehlo = await sendCommand(socket, `EHLO ${this.host}`);
+          if (ehlo.code !== 250) {
+            socket.destroy();
+            return { success: false, message: `EHLO failed: ${ehlo.text}` };
+          }
+          await sendCommand(socket, "QUIT");
+          socket.destroy();
+          return { success: true, message: `Connected to ${this.host}:${this.port}` };
+        } catch (err) {
+          const errMsg = err instanceof Error ? err.message : String(err);
+          return { success: false, message: `Connection failed: ${errMsg}` };
+        }
+      }
+      // ── IMAP (Read) ────────────────────────────────────────────
+      /**
+       * Connect to the IMAP server via raw TCP/TLS.
+       * Returns the socket and reads the greeting.
+       */
+      async imapConnect() {
+        if (!this.imapHost) {
+          throw new Error("IMAP host not configured (set imapHost or IMAP_HOST env)");
+        }
+        let socket;
+        const useTls = this.imapEncryption === "tls" || this.imapEncryption === "ssl" || this.imapEncryption === "" && this.imapPort === 993;
+        if (useTls) {
+          socket = tls2.connect({ host: this.imapHost, port: this.imapPort, rejectUnauthorized: tlsRejectUnauthorized() });
+          await new Promise((resolve31, reject) => {
+            socket.once("secureConnect", resolve31);
+            socket.once("error", reject);
+          });
+        } else {
+          socket = net3.createConnection({ host: this.imapHost, port: this.imapPort });
+          await new Promise((resolve31, reject) => {
+            socket.once("connect", resolve31);
+            socket.once("error", reject);
+          });
+        }
+        await imapReadLine(socket);
+        if (this.imapUser && this.imapPass) {
+          const loginResp = await imapCommand(socket, `LOGIN ${imapQuote(this.imapUser)} ${imapQuote(this.imapPass)}`);
+          if (!loginResp.includes("OK")) {
+            socket.destroy();
+            throw new Error(`IMAP login failed: ${loginResp}`);
+          }
+        }
+        return socket;
+      }
+      /**
+       * Disconnect from IMAP cleanly.
+       */
+      async imapDisconnect(socket) {
+        try {
+          await imapCommand(socket, "LOGOUT");
+        } catch {
+        }
+        socket.destroy();
+      }
+      /**
+       * Fetch latest messages from a folder.
+       * Returns list of message summaries.
+       */
+      async inbox(limit = 20, offset = 0, folder = "INBOX") {
+        let socket;
+        try {
+          socket = await this.imapConnect();
+        } catch (err) {
+          throw imapFail("inbox", err);
+        }
+        try {
+          await imapCommand(socket, `SELECT ${imapQuote(folder)}`);
+          const searchResp = await imapCommand(socket, "SEARCH ALL");
+          const uids = parseSearchResponse(searchResp);
+          if (uids.length === 0) return [];
+          uids.reverse();
+          const selected = uids.slice(offset, offset + limit);
+          if (selected.length === 0) return [];
+          const messages = [];
+          for (const uid of selected) {
+            const fetchResp = await imapCommand(socket, `FETCH ${uid} (FLAGS BODY.PEEK[HEADER.FIELDS (FROM TO SUBJECT DATE)])`);
+            messages.push(parseHeaderResponse(uid, fetchResp));
+          }
+          return messages;
+        } catch (err) {
+          throw imapFail("inbox", err);
+        } finally {
+          await this.imapDisconnect(socket);
+        }
+      }
+      /**
+       * Read a single message by sequence number or UID.
+       */
+      async read(uid, folder = "INBOX") {
+        let socket;
+        try {
+          socket = await this.imapConnect();
+        } catch (err) {
+          throw imapFail("read", err);
+        }
+        try {
+          await imapCommand(socket, `SELECT ${imapQuote(folder)}`);
+          const fetchResp = await imapCommand(socket, `FETCH ${uid} (FLAGS BODY[])`);
+          if (!/\{\d+\}/.test(fetchResp)) {
+            return emptyFullMessage(uid);
+          }
+          await imapCommand(socket, `STORE ${uid} +FLAGS (\\Seen)`);
+          return parseFullMessage(uid, fetchResp);
+        } catch (err) {
+          throw imapFail("read", err);
+        } finally {
+          await this.imapDisconnect(socket);
+        }
+      }
+      /**
+       * Search messages using IMAP search criteria.
+       */
+      async search(folder = "INBOX", subject, sender, since, before, unseenOnly = false, limit = 50) {
+        const criteria = ["ALL"];
+        if (subject) criteria.push(`SUBJECT "${subject}"`);
+        if (sender) criteria.push(`FROM "${sender}"`);
+        if (since) criteria.push(`SINCE ${since}`);
+        if (before) criteria.push(`BEFORE ${before}`);
+        if (unseenOnly) criteria.push("UNSEEN");
+        const query = criteria.join(" ");
+        let socket;
+        try {
+          socket = await this.imapConnect();
+        } catch (err) {
+          throw imapFail("search", err);
+        }
+        try {
+          await imapCommand(socket, `SELECT ${imapQuote(folder)}`);
+          const searchResp = await imapCommand(socket, `SEARCH ${query}`);
+          const uids = parseSearchResponse(searchResp);
+          if (uids.length === 0) return [];
+          uids.reverse();
+          const messages = [];
+          for (const uid of uids.slice(0, limit)) {
+            const fetchResp = await imapCommand(socket, `FETCH ${uid} (FLAGS BODY.PEEK[HEADER.FIELDS (FROM TO SUBJECT DATE)])`);
+            messages.push(parseHeaderResponse(uid, fetchResp));
+          }
+          return messages;
+        } catch (err) {
+          throw imapFail("search", err);
+        } finally {
+          await this.imapDisconnect(socket);
+        }
+      }
+      /**
+       * Delete a message by UID.
+       */
+      async deleteMessage(uid, folder = "INBOX") {
+        const socket = await this.imapConnect();
+        try {
+          await imapCommand(socket, `SELECT ${imapQuote(folder)}`);
+          await imapCommand(socket, `STORE ${uid} +FLAGS (\\Deleted)`);
+          await imapCommand(socket, "EXPUNGE");
+        } finally {
+          await this.imapDisconnect(socket);
+        }
+      }
+      /**
+       * Mark a message as read.
+       */
+      async markRead(uid, folder = "INBOX") {
+        const socket = await this.imapConnect();
+        try {
+          await imapCommand(socket, `SELECT ${imapQuote(folder)}`);
+          await imapCommand(socket, `STORE ${uid} +FLAGS (\\Seen)`);
+        } finally {
+          await this.imapDisconnect(socket);
+        }
+      }
+      /**
+       * Count unseen messages in a folder.
+       */
+      async unread(folder = "INBOX") {
+        let socket;
+        try {
+          socket = await this.imapConnect();
+        } catch (err) {
+          throw imapFail("unread", err);
+        }
+        try {
+          await imapCommand(socket, `SELECT ${imapQuote(folder)}`);
+          const searchResp = await imapCommand(socket, "SEARCH UNSEEN");
+          return parseSearchResponse(searchResp).length;
+        } catch (err) {
+          throw imapFail("unread", err);
+        } finally {
+          await this.imapDisconnect(socket);
+        }
+      }
+      /**
+       * List available IMAP folders/mailboxes.
+       */
+      async folders() {
+        let socket;
+        try {
+          socket = await this.imapConnect();
+        } catch (err) {
+          throw imapFail("folders", err);
+        }
+        try {
+          const resp = await imapCommand(socket, 'LIST "" "*"');
+          const result = [];
+          for (const line of resp.split("\r\n")) {
+            const m = line.match(/\* LIST \([^)]*\) "[^"]*" "?([^"\r\n]+)"?/i);
+            if (m) result.push(m[1]);
+          }
+          return result;
+        } catch (err) {
+          throw imapFail("folders", err);
+        } finally {
+          await this.imapDisconnect(socket);
+        }
+      }
+      /**
+       * Test IMAP connectivity without reading.
+       */
+      async testImapConnection() {
+        try {
+          const socket = await this.imapConnect();
+          await this.imapDisconnect(socket);
+          return { success: true, message: `Connected to ${this.imapHost}:${this.imapPort}` };
+        } catch (err) {
+          const errMsg = err instanceof Error ? err.message : String(err);
+          return { success: false, message: `IMAP connection failed: ${errMsg}` };
+        }
+      }
+    };
+    imapTagCounter = 0;
+  }
+});
+
 // ../core/src/wsdl.ts
 function escapeXml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");