v0.1.1

Security scan triage (2026-07-29). No public API, runtime dependency, or behavior change.

• Fixed: pinned the transitive dev-only uuid to ^11.1.1 via a root overrides entry, clearing GHSA-w5hq-g745-h8pq (missing buffer bounds check in v3/v5/v6) from the development tree, with a lockfile regression test so the pin cannot silently regress.
• Accepted with documented justification: the brace-expansion (GHSA-mh99-v99m-4gvg) and @opentelemetry/core (GHSA-8988-4f7v-96qf) advisories remain, dev-only. Each one's sole patched release is API-incompatible with the tree azurite pins — verified empirically and recorded in docs/securityscan.md so the override is not re-attempted.
• Disputed, no code change: the "hardcoded storage key" is Microsoft's published Azurite well-known emulator key against 127.0.0.1, and the "unvalidated recipient" arrives only from the host-owned preparation port that SECURITY.md places on the trusted side of the boundary.

npm audit --omit=dev remains 0; npm audit drops from 12 advisories (5 high, 7 moderate) to 9 (5 high, 4 moderate). Also restores npm run format:check, which main was failing.

v0.1.0

Release notes

0.1.0 — first advertised supported release

Status: prepared for reviewed merge, a protected signed annotated v0.1.0
tag, and trusted-publisher OIDC publication. It is not published by this
change.

@pegma/mail@0.1.0 provides the provider-neutral durable mail state machine
shared by Pegma hosts:

• mail jobs are projected into caller-owned records and committed beside the
  state change that caused them;
• send, reconciliation, and terminal discovery page the caller's authoritative
  collection through bounded @pegma/storage-core scans;
• adapter-issued cursors stay opaque, completed pages may replay safely, and
  repeated complete cycles cannot permanently omit a live committed row;
• physical scan keys, opaque versions, page bounds, dense data-property
  records, and projection keys are validated before provider work;
• UUID-fenced send and reconciliation claims, stable provider idempotency
  keys, bounded retry generations, late authenticated callbacks, explicit
  terminal acknowledgement, and version-conditional retention are included;
  and
• Node 22 and 24, the in-memory store, and real Azurite exercise crash,
  phantom, replay, fairness, corruption, and retention-race behavior.

This first supported API requires exactly @pegma/spine@0.1.1 and
@pegma/storage-core@0.4.0. The separate 0.0.0 artifact is only the
manual package-name bootstrap prerequisite; it is not an advertised supported
release and remains outside the normal OIDC lane.