@cosmicdrift/kumiko-bundled-features 0.328.1 → 0.330.0

package/src/mail-transport-inmemory/__tests__/feature.test.ts

@@ -1,60 +0,0 @@
-// feature.ts contract tests for mail-transport-inmemory.
-
-import { describe, expect, test } from "bun:test";
-import { isMailTransportPlugin, type MailTransportPlugin } from "../../mail-foundation";
-import { describeMailTransportContract } from "../../mail-foundation/__tests__/mail-transport-contract";
-import { clearInbox, getInbox, mailTransportInMemoryFeature } from "../feature";
-
-function registeredPlugin(): MailTransportPlugin {
-  const usage = mailTransportInMemoryFeature.extensionUsages.find(
-    (u) => u.extensionName === "mailTransport" && u.entityName === "inmemory",
-  );
-  if (!usage || !isMailTransportPlugin(usage.options)) {
-    throw new Error("mail-transport-inmemory: plugin not registered under 'inmemory'");
-  }
-  return usage.options;
-}
-
-describeMailTransportContract(
-  "mail-transport-inmemory",
-  () => ({
-    plugin: registeredPlugin(),
-    ctx: {},
-    tenantId: "contract-test-tenant",
-    readBack: getInbox,
-  }),
-  { verifiesDelivery: true },
-);
-
-describe("mailTransportInMemoryFeature — shape", () => {
-  test("has the expected name", () => {
-    expect(mailTransportInMemoryFeature.name).toBe("mail-transport-inmemory");
-  });
-
-  test("requires only mail-foundation (no config, no secrets — nothing to configure)", () => {
-    expect(mailTransportInMemoryFeature.requires).toContain("mail-foundation");
-    expect(mailTransportInMemoryFeature.requires).not.toContain("config");
-    expect(mailTransportInMemoryFeature.requires).not.toContain("secrets");
-  });
-});
-
-describe("mailTransportInMemoryFeature — plugin-registration", () => {
-  test("registers itself under entityName 'inmemory' for mail-foundation's extension", () => {
-    const usages = mailTransportInMemoryFeature.extensionUsages;
-    expect(
-      usages.some((u) => u.extensionName === "mailTransport" && u.entityName === "inmemory"),
-    ).toBe(true);
-  });
-});
-
-describe("getInbox / clearInbox — per-tenant buffer helpers", () => {
-  test("getInbox liefert empty-array für unbekannten Tenant", () => {
-    expect(getInbox("never-touched-tenant")).toEqual([]);
-  });
-
-  test("clearInbox auf nicht-existierenden Tenant ist no-op (kein throw)", () => {
-    // Defensive — wenn ein Demo-Test clearInbox vor dem ersten send aufruft,
-    // soll das nicht crashen.
-    expect(() => clearInbox("not-yet-existing")).not.toThrow();
-  });
-});

package/src/mail-transport-inmemory/feature.ts

@@ -1,97 +0,0 @@
-// kumiko-feature-version: 1
-//
-// mail-transport-inmemory — In-Memory-EmailTransport für die mail-
-// foundation Plugin-API. Sammelt Mails in einem per-Tenant-Buffer
-// statt sie über einen echten SMTP-Server zu senden. Designed für
-// Demos, Sample-Apps und Tests die ohne Mailpit/Mailcrab/echten SMTP
-// laufen sollen.
-//
-// **Was diese Feature liefert:**
-//   1. Plugin-Registration via `r.useExtension("mailTransport",
-//      "inmemory", { build })`. Tenants setzen
-//      "mail-foundation:config:provider" auf "inmemory" und kriegen
-//      die buffered-Variante.
-//   2. **Pro-Tenant Inbox.** Jeder Tenant hat einen eigenen
-//      Mail-Buffer (Map<tenantId, EmailMessage[]>). Demo-Apps können
-//      die Inbox via `getInbox(tenantId)` lesen + UI rendern.
-//
-// **Pattern-Vorbild:** mirrors mail-transport-smtp.
-//
-// **NICHT für Production.** Buffer ist im Process-Memory, geht beim
-// Restart verloren. Cap-Counter / Audit-Trail bleiben trotzdem korrekt
-// — die hängen am event-store, nicht am Transport.
-
-import type {
-  EmailMessage,
-  EmailTransport,
-} from "@cosmicdrift/kumiko-bundled-features/channel-email";
-import { createInMemoryTransport } from "@cosmicdrift/kumiko-bundled-features/channel-email";
-import {
-  MAIL_TRANSPORT_EXTENSION,
-  type MailTransportContext,
-  type MailTransportPlugin,
-} from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
-import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-
-const FEATURE_NAME = "mail-transport-inmemory";
-
-// =============================================================================
-// Per-tenant in-memory buffer
-// =============================================================================
-//
-// Module-level Map weil der Plugin-build-call pro Send einen neuen
-// Transport-Wrapper baut, aber wir wollen dass alle Wrapper für
-// denselben Tenant auf denselben Buffer zeigen. Map<tenantId,
-// InMemoryTransport>.
-
-const transportsByTenant = new Map<string, ReturnType<typeof createInMemoryTransport>>();
-
-function getOrCreateTransportForTenant(tenantId: string) {
-  let transport = transportsByTenant.get(tenantId);
-  if (!transport) {
-    transport = createInMemoryTransport();
-    transportsByTenant.set(tenantId, transport);
-  }
-  return transport;
-}
-
-/**
- * Demo/Test-Helper: lies die "versendeten" Mails eines Tenants. Im
- * Sample-App rendert ein query-Handler darauf die Inbox-UI.
- */
-export function getInbox(tenantId: string): readonly EmailMessage[] {
-  return transportsByTenant.get(tenantId)?.sent ?? [];
-}
-
-/**
- * Demo/Test-Helper: clear einen Tenant-Buffer (z.B. zwischen Test-
- * Szenarien).
- */
-export function clearInbox(tenantId: string): void {
-  const t = transportsByTenant.get(tenantId);
-  if (t) t.sent.length = 0;
-}
-
-// =============================================================================
-// Feature-definition
-// =============================================================================
-
-export const mailTransportInMemoryFeature = defineFeature(FEATURE_NAME, (r) => {
-  r.describe(
-    'Registers an in-process `"inmemory"` provider for `mail-foundation` that buffers sent mails per tenant instead of contacting an SMTP server. Use `getInbox(tenantId)` and `clearInbox(tenantId)` in demo apps and tests; not for production (buffer is process-memory, lost on restart).',
-  );
-  // Kein r.requires("config") + kein r.requires("secrets") — der
-  // In-Memory-Transport hat keine Config (nichts zu konfigurieren) und
-  // kein Secret. Der einzige hard-require ist mail-foundation, das den
-  // extension-point "mailTransport" definiert.
-  r.requires("mail-foundation");
-
-  const plugin: MailTransportPlugin = {
-    build: async (_ctx: MailTransportContext, tenantId: string): Promise<EmailTransport> => {
-      // Returnt den per-tenant Buffer. Identitätsstabil zwischen calls
-      // damit die Demo-Inbox accumulated bleibt.
-      return getOrCreateTransportForTenant(tenantId);
-    }, // @wrapper-known semantic-alias
-  };
-  r.useExtension(MAIL_TRANSPORT_EXTENSION, "inmemory", plugin);
-});

package/src/mail-transport-inmemory/index.ts

@@ -1,3 +0,0 @@
-// Public API of the mail-transport-inmemory bundled-feature.
-
-export { clearInbox, getInbox, mailTransportInMemoryFeature } from "./feature";

package/src/mail-transport-smtp/__tests__/feature.test.ts

@@ -1,246 +0,0 @@
-// feature.ts contract tests for mail-transport-smtp — pins the
-// SMTP-specific config-keys + secret-handle that the plugin owns.
-// Plugin-registration shape is also pinned (drift-pin: name "smtp",
-// build-fn presence).
-
-import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
-import type { lookup } from "node:dns/promises";
-import type { ConfigAccessor } from "@cosmicdrift/kumiko-framework/engine";
-import { UnconfiguredError } from "@cosmicdrift/kumiko-framework/errors";
-import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import { createSecret } from "@cosmicdrift/kumiko-framework/secrets";
-import { HostResolutionError, MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR } from "../../foundation-shared";
-import { isMailTransportPlugin, type MailTransportPlugin } from "../../mail-foundation";
-import { describeMailTransportContract } from "../../mail-foundation/__tests__/mail-transport-contract";
-import { mailTransportSmtpFeature, SMTP_PASSWORD, setSmtpMailHostLookup } from "../feature";
-
-// The contract fixture's host never actually connects (nodemailer's pool
-// connects lazily on send, never on construction) — "localhost" only needs
-// to pass the host-egress guard, so it goes through the operator escape
-// hatch instead of a real DNS lookup for a placeholder hostname.
-const originalAllowedPrivateHostsEnv = process.env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR];
-
-beforeAll(() => {
-  process.env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR] = "localhost";
-});
-
-afterAll(() => {
-  if (originalAllowedPrivateHostsEnv === undefined) {
-    delete process.env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR];
-  } else {
-    process.env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR] = originalAllowedPrivateHostsEnv;
-  }
-});
-
-function registeredPlugin(): MailTransportPlugin {
-  const usage = mailTransportSmtpFeature.extensionUsages.find(
-    (u) => u.extensionName === "mailTransport" && u.entityName === "smtp",
-  );
-  if (!usage || !isMailTransportPlugin(usage.options)) {
-    throw new Error("mail-transport-smtp: plugin not registered under 'smtp'");
-  }
-  return usage.options;
-}
-
-function fakeConfig(
-  overrides: Partial<
-    Record<"host" | "port" | "secure" | "from" | "authUser", string | number | boolean>
-  > = {},
-): ConfigAccessor {
-  const keys = mailTransportSmtpFeature.exports.configKeys;
-  const values = new Map<string, string | number | boolean>([
-    [keys.host.name, overrides.host ?? "localhost"],
-    [keys.port.name, overrides.port ?? 587],
-    [keys.secure.name, overrides.secure ?? false],
-    [keys.from.name, overrides.from ?? "noreply@contract-test.invalid"],
-    [keys.authUser.name, overrides.authUser ?? "contract-test-user"],
-  ]);
-  return (async (handle: string | { readonly name: string }) => {
-    const key = typeof handle === "string" ? handle : handle.name;
-    return values.get(key);
-  }) as ConfigAccessor;
-}
-
-function fakeSecrets(): SecretsContext {
-  return {
-    get: async () => createSecret("contract-test-password"),
-    has: async () => true,
-    set: async () => {},
-    delete: async () => true,
-  };
-}
-
-describeMailTransportContract(
-  "mail-transport-smtp",
-  () => ({
-    plugin: registeredPlugin(),
-    ctx: { config: fakeConfig(), secrets: fakeSecrets(), _userId: "contract-test-user" },
-    tenantId: "contract-test-tenant",
-  }),
-  // send() needs a live SMTP server — can't assert real delivery here.
-  { verifiesDelivery: false },
-);
-
-describe("mailTransportSmtpFeature — build error path", () => {
-  test("build rejects when a required config-key (host) is unset", async () => {
-    const ctx = {
-      config: fakeConfig({ host: "" }),
-      secrets: fakeSecrets(),
-      _userId: "contract-test-user",
-    };
-    await expect(registeredPlugin().build(ctx, "contract-test-tenant")).rejects.toThrow(/host/);
-  });
-});
-
-describe("mailTransportSmtpFeature — mail-host guard", () => {
-  afterEach(() => {
-    setSmtpMailHostLookup(undefined);
-    delete process.env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR];
-  });
-
-  test("a private IP-literal host is rejected as unconfigured, naming 'host'", async () => {
-    const ctx = { config: fakeConfig({ host: "10.0.0.5" }), secrets: fakeSecrets(), _userId: "x" };
-    try {
-      await registeredPlugin().build(ctx, "contract-test-tenant");
-      expect.unreachable("expected build to throw");
-    } catch (e) {
-      expect(e).toBeInstanceOf(UnconfiguredError);
-      expect((e as UnconfiguredError).details).toMatchObject({
-        feature: "mail-transport-smtp",
-        key: "host",
-      });
-      expect((e as Error).message).not.toContain("10.0.0.5");
-    }
-  });
-
-  test("a blocked host and a DNS resolution failure produce the exact same tenant-visible message", async () => {
-    const blockedCtx = {
-      config: fakeConfig({ host: "10.0.0.5" }),
-      secrets: fakeSecrets(),
-      _userId: "x",
-    };
-    let blockedMessage: string | undefined;
-    try {
-      await registeredPlugin().build(blockedCtx, "contract-test-tenant");
-      expect.unreachable("expected build to throw");
-    } catch (e) {
-      blockedMessage = (e as Error).message;
-    }
-
-    const failingLookup = (async () => {
-      throw new Error("ENOTFOUND");
-    }) as unknown as typeof lookup;
-    setSmtpMailHostLookup(failingLookup);
-    const unresolvableCtx = {
-      config: fakeConfig({ host: "nowhere.test" }),
-      secrets: fakeSecrets(),
-      _userId: "x",
-    };
-    let unresolvableMessage: string | undefined;
-    try {
-      await registeredPlugin().build(unresolvableCtx, "contract-test-tenant");
-      expect.unreachable("expected build to throw");
-    } catch (e) {
-      unresolvableMessage = (e as Error).message;
-    }
-
-    expect(blockedMessage).toBe(unresolvableMessage);
-    expect(blockedMessage).not.toContain("10.0.0.5");
-    expect(unresolvableMessage).not.toContain("nowhere.test");
-  });
-
-  test("a hostname resolving to a private address is rejected as unconfigured", async () => {
-    const fakeLookup = (async () => [
-      { address: "127.0.0.1", family: 4 },
-    ]) as unknown as typeof lookup;
-    setSmtpMailHostLookup(fakeLookup);
-    const ctx = {
-      config: fakeConfig({ host: "internal-relay.test" }),
-      secrets: fakeSecrets(),
-      _userId: "x",
-    };
-    await expect(registeredPlugin().build(ctx, "contract-test-tenant")).rejects.toBeInstanceOf(
-      UnconfiguredError,
-    );
-  });
-
-  test("a DNS resolution failure is not reclassified as unconfigured (transient, not a tenant config problem)", async () => {
-    const failingLookup = (async () => {
-      throw new Error("ENOTFOUND");
-    }) as unknown as typeof lookup;
-    setSmtpMailHostLookup(failingLookup);
-    const ctx = {
-      config: fakeConfig({ host: "nowhere.test" }),
-      secrets: fakeSecrets(),
-      _userId: "x",
-    };
-    await expect(registeredPlugin().build(ctx, "contract-test-tenant")).rejects.toBeInstanceOf(
-      HostResolutionError,
-    );
-  });
-
-  test("an operator-allowlisted private host builds successfully, bypassing resolution", async () => {
-    process.env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR] = "relay.internal";
-    const ctx = {
-      config: fakeConfig({ host: "relay.internal" }),
-      secrets: fakeSecrets(),
-      _userId: "x",
-    };
-    const transport = await registeredPlugin().build(ctx, "contract-test-tenant");
-    expect(typeof transport.send).toBe("function");
-  });
-});
-
-describe("mailTransportSmtpFeature — shape", () => {
-  test("has the expected name", () => {
-    expect(mailTransportSmtpFeature.name).toBe("mail-transport-smtp");
-  });
-
-  test("requires config + secrets + mail-foundation as hard dependencies", () => {
-    expect(mailTransportSmtpFeature.requires).toContain("config");
-    expect(mailTransportSmtpFeature.requires).toContain("secrets");
-    expect(mailTransportSmtpFeature.requires).toContain("mail-foundation");
-  });
-});
-
-describe("mailTransportSmtpFeature.exports — typed handles", () => {
-  test("exports.configKeys covers the SMTP-config knobs", () => {
-    const keys = mailTransportSmtpFeature.exports.configKeys;
-    expect(keys.host).toBeDefined();
-    expect(keys.port).toBeDefined();
-    expect(keys.secure).toBeDefined();
-    expect(keys.from).toBeDefined();
-    expect(keys.authUser).toBeDefined();
-  });
-
-  test("exports.password is the SMTP_PASSWORD secret-handle (drift-pin)", () => {
-    expect(mailTransportSmtpFeature.exports.password).toBe(SMTP_PASSWORD);
-    expect(SMTP_PASSWORD.name).toBe("mail-transport-smtp:secret:smtp-password");
-  });
-});
-
-describe("SMTP_PASSWORD — generic redaction", () => {
-  const secretDef = mailTransportSmtpFeature.secretKeys["smtp.password"];
-
-  test("redact preserves first 3 + last 2 chars for verifiability on long keys", () => {
-    expect(secretDef?.redact).toBeDefined();
-    expect(secretDef?.redact?.("brevoXKEY01abc")).toMatch(/^bre\.\.\.bc$/);
-  });
-
-  test("redact masks short keys completely (no leak on under-8-char input)", () => {
-    expect(secretDef?.redact?.("shortpw")).toBe("•".repeat(7));
-  });
-});
-
-describe("mailTransportSmtpFeature — plugin-registration", () => {
-  test("registers itself under entityName 'smtp' for mail-foundation's extension", () => {
-    // r.useExtension("mailTransport", "smtp", ...) lands in the feature's
-    // feature.extensionUsages. Drift-pin: tenant sets `mail-foundation:
-    // config:provider = "smtp"` and the foundation-factory looks up by
-    // exactly this name.
-    const usages = mailTransportSmtpFeature.extensionUsages;
-    expect(usages.some((u) => u.extensionName === "mailTransport" && u.entityName === "smtp")).toBe(
-      true,
-    );
-  });
-});

package/src/mail-transport-smtp/feature.ts

@@ -1,268 +0,0 @@
-// kumiko-feature-version: 1
-//
-// mail-transport-smtp — concrete SMTP-implementation for the
-// mail-foundation plugin-API.
-//
-// **Was diese Feature liefert:**
-//   1. Provider-spezifische Tenant-Config (host/port/secure/from/authUser)
-//      und Secret (smtp.password). Self-contained — mail-foundation kennt
-//      diese Schlüssel nicht; wenn ein App-Owner zwischen SMTP und Brevo-
-//      API wechseln will, hat er pro-Plugin eigenständige Config-Sets.
-//   2. **Plugin-Registration** via `r.useExtension("mailTransport",
-//      "smtp", { build })`. Beim Boot kennt mail-foundation's
-//      Factory-Lookup damit den name "smtp" ↔ build-Funktion.
-//   3. `build(ctx, tenantId)` liest die config-keys + secret und ruft
-//      `createSmtpTransport()` aus channel-email auf. Das ist der
-//      EINZIGE Cross-Feature-Import dieses Plugins — bewusst lokal
-//      gehalten, mail-foundation bleibt provider-frei.
-//
-// **Pattern-Vorbild:** mirrors `channel-email` registering itself for
-// `delivery`. Diese Feature ist analog: registriert sich für
-// mail-foundation's "mailTransport"-Extension-Point.
-//
-// **Boot-Dependencies:**
-//   - `mail-foundation` — extension-point owner
-//   - `config` — für die Tenant-Config-Keys
-//   - `secrets` — für das verschlüsselte SMTP-Password
-
-import type { lookup } from "node:dns/promises";
-import {
-  createSmtpTransport,
-  type EmailTransport,
-} from "@cosmicdrift/kumiko-bundled-features/channel-email";
-import {
-  BlockedHostError,
-  HostResolutionError,
-  MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR,
-  type MailConnectTarget,
-  readAllowedPrivateMailHostsFromEnv,
-  requireDefined,
-  requireNonEmpty,
-  requireSecretSet,
-  resolveMailConnectTarget,
-} from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
-import {
-  MAIL_TRANSPORT_EXTENSION,
-  type MailTransportContext,
-  type MailTransportPlugin,
-} from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
-import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
-import { access, createTenantConfig, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { UnconfiguredError } from "@cosmicdrift/kumiko-framework/errors";
-import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
-import * as z from "zod";
-
-const FEATURE_NAME = "mail-transport-smtp";
-
-const log = createFallbackLogger(FEATURE_NAME);
-
-// Operator escape hatch for an internal relay or a dev/test SMTP server
-// (mailpit, MailHog): KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS, an operator env
-// var never a tenant-config value, so a tenant can never grant themselves
-// the private-host bypass. Declared here (not duplicated in
-// inbound-provider-imap's envSchema) since both features read the same
-// var and composeEnvSchema rejects two features declaring the same key —
-// see foundation-shared/mail-host-policy.ts for the shared reader + the
-// guard this feeds.
-export const mailTransportSmtpEnvSchema = z.object({
-  [MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR]: z
-    .string()
-    .optional()
-    .describe(
-      "Comma-separated operator allowlist of private/internal hosts (e.g. a local mailpit/greenmail dev server) that bypass the public-address check for SMTP and IMAP host config. Shared with inbound-provider-imap — never a tenant-config value.",
-    ),
-});
-
-// Test-only DNS seam — production never calls this, resolveMailConnectTarget
-// defaults to the real resolver. Lets tests pin deterministic, network-free
-// host resolutions instead of depending on real DNS for a placeholder host.
-// Reset it in afterEach/afterAll — this is module-global state.
-let mailHostLookup: typeof lookup | undefined;
-
-export function setSmtpMailHostLookup(fn: typeof lookup | undefined): void {
-  mailHostLookup = fn;
-}
-
-// =============================================================================
-// Feature-definition
-// =============================================================================
-
-export const mailTransportSmtpFeature = defineFeature(FEATURE_NAME, (r) => {
-  r.describe(
-    'Registers itself as the `"smtp"` provider for `mail-foundation` and owns the per-tenant config keys (`host`, `port`, `secure`, `from`, `authUser`) and the encrypted `smtp.password` secret. Tenants set `mail-foundation`\'s `provider` config key to `"smtp"` to activate it; set the SMTP credentials via the admin UI or a seed handler before sending the first mail.',
-  );
-  r.uiHints({
-    displayLabel: "Mail Transport · SMTP",
-    category: "notifications",
-    recommended: false,
-  });
-  r.requires("config");
-  r.requires("secrets");
-  r.requires("mail-foundation");
-  r.envSchema(mailTransportSmtpEnvSchema);
-
-  // Provider-secret. Sensitive: redact-helper for admin-UI display.
-  const password = r.secret("smtp.password", {
-    label: { en: "SMTP password" },
-    hint: {
-      en: "Login password at the SMTP server. Brevo/Postmark/SES call it 'API key' or 'SMTP credentials'.",
-    },
-    redact: (plaintext) => {
-      if (plaintext.length < 8) return "•".repeat(plaintext.length);
-      return `${plaintext.slice(0, 3)}...${plaintext.slice(-2)}`;
-    },
-    scope: "tenant",
-    // required: true ↔ the missing-secret throw in readPassword — keep in sync.
-    required: true,
-  });
-
-  // required: true ↔ the requireNonEmpty calls in buildSmtpTransport — keep in sync.
-  const configKeys = r.config({
-    keys: {
-      host: createTenantConfig("text", {
-        required: true,
-        default: "",
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin"),
-      }),
-      port: createTenantConfig("number", {
-        default: 587,
-        bounds: { min: 1, max: 65535 },
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-      }),
-      secure: createTenantConfig("boolean", {
-        default: false,
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-      }),
-      from: createTenantConfig("text", {
-        required: true,
-        default: "",
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin"),
-      }),
-      authUser: createTenantConfig("text", {
-        required: true,
-        default: "",
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin"),
-      }),
-    },
-  });
-
-  // Plugin: register against mail-foundation's "mailTransport" extension.
-  // `entityName` "smtp" is what tenants set in mail-foundation's
-  // `provider` config-key to pick this transport.
-  const plugin: MailTransportPlugin = {
-    build: async (ctx: MailTransportContext, tenantId: string) => buildSmtpTransport(ctx, tenantId), // @wrapper-known semantic-alias
-  };
-  r.useExtension(MAIL_TRANSPORT_EXTENSION, "smtp", plugin);
-
-  return {
-    /** Config-key-handles — typed reads via `ctx.config(...)` in
-     *  consumer handlers. */
-    configKeys,
-    /** Secret-handle for the SMTP password. */
-    password,
-  };
-});
-
-/** Typed handle for the SMTP password — exported so seeds + tests can
- *  set it via `secrets:write:set` with the full qualified-name. */
-export const SMTP_PASSWORD = mailTransportSmtpFeature.exports.password;
-
-// =============================================================================
-// Internal: build the EmailTransport from tenant config + secret
-// =============================================================================
-
-// Tenant-visible for both a blocked host and a DNS failure — must not
-// reveal which one occurred, or the host itself. Built once so a
-// HostResolutionError raised for the other branch can reuse the exact same
-// `.message` string byte-for-byte instead of just a similar hint.
-function mailHostUnreachableError(): UnconfiguredError {
-  return new UnconfiguredError({
-    feature: FEATURE_NAME,
-    key: "host",
-    hint: "host is not reachable or not allowed",
-  });
-}
-
-async function buildSmtpTransport(
-  ctx: MailTransportContext,
-  tenantId: string,
-): Promise<EmailTransport> {
-  const ctxConfig = ctx.config;
-  if (!ctxConfig) {
-    throw new Error(
-      `${FEATURE_NAME}: ctx.config is missing — feature requires the config-feature mounted in the registry`,
-    );
-  }
-
-  const SMTP_HINT = "Set via tenant-admin UI or seed-handler before sending mail.";
-  const host = requireNonEmpty(
-    await ctxConfig(mailTransportSmtpFeature.exports.configKeys.host),
-    FEATURE_NAME,
-    "host",
-    SMTP_HINT,
-  );
-  const port = requireDefined(
-    await ctxConfig(mailTransportSmtpFeature.exports.configKeys.port),
-    FEATURE_NAME,
-    "port",
-  ) as number; // @cast-boundary engine-payload
-  const secure = requireDefined(
-    await ctxConfig(mailTransportSmtpFeature.exports.configKeys.secure),
-    FEATURE_NAME,
-    "secure",
-  ) as boolean; // @cast-boundary engine-payload
-  const from = requireNonEmpty(
-    await ctxConfig(mailTransportSmtpFeature.exports.configKeys.from),
-    FEATURE_NAME,
-    "from",
-    SMTP_HINT,
-  );
-  const authUser = requireNonEmpty(
-    await ctxConfig(mailTransportSmtpFeature.exports.configKeys.authUser),
-    FEATURE_NAME,
-    "authUser",
-    SMTP_HINT,
-  );
-
-  const password = await readPassword(ctx, tenantId);
-
-  let target: MailConnectTarget;
-  try {
-    target = await resolveMailConnectTarget(host, {
-      allowedPrivateMailHosts: readAllowedPrivateMailHostsFromEnv(),
-      lookupFn: mailHostLookup,
-    });
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    // Both branches throw the exact same tenant-visible message text — the
-    // blocked-vs-unresolvable distinction and the host itself stay
-    // server-log-only. Class stays distinct: UnconfiguredError (422, a
-    // config problem, no retry) for a blocked host vs HostResolutionError
-    // (transient, retried) for a DNS failure — see mailHostUnreachableError().
-    const unreachable = mailHostUnreachableError();
-    if (err instanceof BlockedHostError) {
-      log.warn("rejected blocked host", { host, reason });
-      throw unreachable;
-    }
-    log.warn("host resolution failed", { host, reason });
-    throw new HostResolutionError(unreachable.message);
-  }
-
-  return createSmtpTransport({
-    host: target.host,
-    port,
-    secure,
-    from,
-    auth: { user: authUser, pass: password },
-    ...(target.servername && { servername: target.servername }),
-  });
-}
-
-async function readPassword(ctx: MailTransportContext, tenantId: string): Promise<string> {
-  const secrets = requireSecretsContext(ctx, FEATURE_NAME);
-  const branded = await secrets.get(tenantId, SMTP_PASSWORD);
-  return requireSecretSet(branded, FEATURE_NAME, SMTP_PASSWORD.name).reveal();
-}

package/src/mail-transport-smtp/index.ts

@@ -1,8 +0,0 @@
-// Public API of the mail-transport-smtp bundled-feature.
-
-export {
-  mailTransportSmtpEnvSchema,
-  mailTransportSmtpFeature,
-  SMTP_PASSWORD,
-  setSmtpMailHostLookup,
-} from "./feature";