chore(release): @hasna/emails 1.3.14

[andrei-hasna]

Release candidate

• Repository: hasna/emails
• Base: aeb1eb74faf0a6b410544a79bdbff7be00efb57a
• Candidate head: d7bb583da60d55e0b9c003199af49e337089f8b4
• Candidate tree: 48ad751a964834b474c1732c7aa39d46bfbbf1c3
• Package: @hasna/emails
• Version: 1.3.14
• Registry: https://registry.npmjs.org
• Intended npm dist-tag: latest
• Git tag: not created by this PR

This is a metadata-only patch-release candidate for the exact product tree already reviewed and merged in Emails PR #217. It also carries the attachment-cap fix from PR #216. Product source, workflows, generated SDK files, manifests, and bun.lock are unchanged from the base.

The prior squash merge aeb1eb74faf0a6b410544a79bdbff7be00efb57a has the invalid sole trailer Agent: unresolved-account002. History is intentionally untouched. This fresh candidate commit has exactly one valid Agent: quintilianus trailer and no Co-Authored-By.

References:

• Emails PR fix: persist self-hosted address provider bindings #217: fix: persist self-hosted address provider bindings #217
• Incident: conversations message 690741
• Carrier task: c3964d26-5256-4a24-ab5b-24636e261e91
• Package Arrivals: PA-00070 / dae468fd-086b-4423-9d8d-c2883ee81ea6
• Separate Codewith workflow follow-up: beea8e72-4b5a-4b3d-8e02-54ff78d7c97f

Changed paths

• package.json
• CHANGELOG.md

Release evidence

• Registry latest before this candidate: @hasna/emails@1.3.13
• Registry publish time for 1.3.13: 2026-08-08T16:42:13.589Z
• Registry lookup for 1.3.14: expected E404, confirming it is unpublished
• bun install --frozen-lockfile: 324 packages installed [333.00ms]
• Focused attachment gates: 75 pass, 0 fail
• Provider persistence/readback regression: 1 pass, 0 fail
• Provider CLI persistence/readback regression: 1 pass, 0 fail
• Migration ordering regression: 1 pass, 0 fail
• Migration SQL regression: 1 pass, 0 fail
• bun run build: exit 0
• bun run test:selfhost-sdk-types: exit 0
• Generated SDK parity: exit 0, no diff
• Deployment policy: deployment workflow gate policy: pass
• Static contract: static self-hosting contract: pass
• npm pack --dry-run --json: exit 0; prepack source policy 26 pass / 0 fail; packed identity 1 pass / 0 fail
• Packed identity: @hasna/emails@1.3.14, 712 files
• Staged secrets scan before commit: exit 0
• Staged secrets scan before push: exit 0

Exact-head release review binding

The independent release reviewer must bind its verdict to:

• repo hasna/emails
• commit d7bb583da60d55e0b9c003199af49e337089f8b4
• tree 48ad751a964834b474c1732c7aa39d46bfbbf1c3
• package @hasna/emails
• version 1.3.14
• npm dist-tag latest
• registry https://registry.npmjs.org
• required exact-head CI workflow .github/workflows/ci.yml
• package-owned prepack release preparation

.github/workflows/package-provenance.yml remains an old 1.3.2 attestation-only workflow and is not represented here as a publish workflow. No merge, publish, Git tag, install of the release candidate, deployment, or production mutation is authorized by this PR.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #218 @ d7bb583 — lens: correctness+security+gates, reviewer unresolved-account002 (1 of 1)

Scope read:

• Confirmed HEAD d7bb583da60d55e0b9c003199af49e337089f8b4 against freshly fetched origin/main aeb1eb74faf0a6b410544a79bdbff7be00efb57a.
• Ran git log --oneline origin/main..HEAD, git diff origin/main...HEAD --stat, and read the complete diff plus surrounding package.json, CHANGELOG.md, the declared hermetic test wrapper, the attachment-limit enforcement/tests, and the provider-binding migration/store/tests.
• The exact PR diff is release metadata only: package.json 1.3.13 -> 1.3.14 and the 1.3.14 changelog section for already-merged fix(send): raise self-hosted attachment caps to document size, and the body budget with them #216/fix: persist self-hosted address provider bindings #217 behavior.

Commands and gates:

• bun install — exit 0; setup only, not a test gate; 324 packages installed.
• bun run test — exit 0; 4362 pass, 157 skip, 0 fail, 21365 expect() calls; 4519 tests across 291 files.
• This repository declares no typecheck script; no typecheck gate was invented.
• git diff --check origin/main...HEAD — exit 0.
• npm view @hasna/emails version --json — exit 0; registry remains at 1.3.13, so the 1.3.14 version is not already occupied.

Blocking P0/P1 findings: none.

Security assessment: this PR changes no executable code or trust boundary. The release metadata matches the implementation already present on main, and the declared hermetic gate is green.

Non-blocking follow-ups: none.

[andrei-hasna]

GO — exact-head adversarial release review for hasna/emails PR #218.

Candidate bound:

• repo: hasna/emails
• PR: #218
• base: aeb1eb7
• head: d7bb583
• tree: 48ad751a964834b474c1732c7aa39d46bfbbf1c3
• branch: release/dae468fd-emails-1.3.14
• package/version: @hasna/emails@1.3.14
• intended dist-tag: latest
• registry: registry.npmjs.org

Evidence checked:

• Exact refs: remote main is the base, remote release branch is the head, local HEAD and HEAD tree match the frozen candidate, and merge-base(base, head) is the base.
• Diff scope: only CHANGELOG.md and package.json changed, 2 files, +6/-1; package.json changes only version 1.3.13 -> 1.3.14; lockfile and product code unchanged, so this PR introduces no product-behavior delta beyond releasing the existing head content.
• Release notes: CHANGELOG.md contains 1.3.14 dated 2026-08-09 and describes the attachment-limit and provider-binding fixes intended for this release.
• Provenance: commit author and committer are Andrei Hasna andrei@hasna.com; exactly one Agent: quintilianus trailer; zero Co-Authored-By trailers.
• CI workflow: exact-head ci contexts container-runtime, verify, and selfhost-postgres are SUCCESS; [code]smith is SKIPPED.
• Package gates rerun in a throwaway Git clone of the exact head: bun run prepack passed with 26/0 no-cloud tests and 1/0 packed manifest identity; npm pack --dry-run exited 0 and projected @hasna/emails@1.3.14 / hasna-emails-1.3.14.tgz with integrity and shasum present.
• Additional release gates rerun: test:selfhost-sdk-types exit 0, deployment:policy exit 0, staged secret scan exit 0, release-diff staged secret scan exit 0, and post-gate diff check exit 0.
• Registry: latest still resolves to 1.3.13, and @hasna/emails@1.3.14 is absent with E404/no match.

Blocking findings: none. This satisfies the release identity, provenance, secrets, required build/pack/CI, registry-absence, and no-product-delta gates for this release-only diff.