@cosmicdrift/kumiko-bundled-features 0.392.0 → 0.392.2

package/dist/cap-overview/web/cap-cards-panel.js

@@ -41,7 +41,7 @@ function ViewAllLink() {
     const { Link } = usePrimitives();
     const nav = useNav();
     const target = { screenId: MY_CAPS_SCREEN_ID };
-    return (_jsx(Link, { href: nav.hrefFor(target), onPress: () => nav.navigate(target), variant: "muted", testId: "cap-cards-view-all", children: t("cap-overview.cards.viewAll") }));
+    return (_jsx(Link, { href: nav.hrefFor(target), onPress: () => nav.navigate(target), testId: "cap-cards-view-all", children: t("cap-overview.cards.viewAll") }));
 }
 function CapUsageSummaryRow({ cap }) {
     const t = useTranslation();

package/dist/inbound-mail-foundation/types.d.ts

@@ -11,7 +11,7 @@ import type { OutboundMailMessage, OutboundMailSent } from "./outbound-mail.ts";
  *   secrets  — tenant secret reads (IMAP password, OAuth refresh token)
  *   auditUserId  — audit identity for secret reads. Handler path: unset,
  *              requireSecretsContext falls back to ctx.user.id; worker/provider
- *              path: system identity set by the resolver.
+ *              path: the supervisor sets the system identity.
  *   metricsFor — metrics handle of a feature by name, same behavior as
  *              HandlerContext.metricsFor: unregistered metrics are a silent
  *              no-op instead of a throw.

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -44,7 +44,8 @@
 // racing a new holder.
 import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
 import { fetchOne, insertOne, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/db";
-import { systemScopedRunner } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
+import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { systemScopedRunner, tenantScopedSecrets, } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { InboundMailAccountStatuses, InboundMailFoundationHandlers } from "./constants.js";
@@ -80,13 +81,21 @@ export function createInboundMailSupervisor(deps) {
     // configured TTL — real deployments (default 90s) never hit it.
     const renewIntervalMs = Math.max(50, Math.floor((leaseTtlSeconds * 1000) / 3));
     const log = deps.log ?? (() => { });
+    // The supervisor runs outside any request: secret reads need an audit
+    // identity, and under enforced row-level security they need the account's
+    // tenant scope, or the credential row is invisible and reads as missing.
+    const providerCtx = {
+        ...deps.providerCtx,
+        auditUserId: deps.providerCtx.auditUserId ?? SYSTEM_USER_ID,
+        ...(deps.providerCtx.secrets && { secrets: tenantScopedSecrets(deps.providerCtx.secrets) }),
+    };
     const systemDb = systemScopedRunner(deps.db, "mail sync supervisor polls accounts and cursors of all tenants outside a request");
     const oauthTokens = deps.oauthTokens ??
-        (deps.providerCtx.secrets
+        (providerCtx.secrets
             ? createOAuthAccessTokenManager({
                 db: systemDb,
-                secrets: deps.providerCtx.secrets,
-                providerCtx: deps.providerCtx,
+                secrets: providerCtx.secrets,
+                providerCtx,
             })
             : undefined);
     // Undefined for non-OAuth accounts. A refresh failure propagates into the
@@ -294,7 +303,7 @@ export function createInboundMailSupervisor(deps) {
             // exhausted.
             for (;;) {
                 const accessToken = await resolveAccessToken(account, plugin);
-                const result = await plugin.fetch(deps.providerCtx, account, cursor, {
+                const result = await plugin.fetch(providerCtx, account, cursor, {
                     backfillWindowDays,
                     maxMessages: budget,
                     filterUnknownMessageIds: unknownMessageIdsFilterFor(account),
@@ -317,7 +326,7 @@ export function createInboundMailSupervisor(deps) {
         for (const account of accounts) {
             let plugin;
             try {
-                plugin = resolveInboundProviderForAccount(deps.providerCtx, account);
+                plugin = resolveInboundProviderForAccount(providerCtx, account);
             }
             catch (err) {
                 log(`inbound-mail: ${describeError(err)}`);
@@ -461,7 +470,7 @@ export function createInboundMailSupervisor(deps) {
         state.starting = true;
         try {
             const accessToken = await resolveAccessToken(account, plugin);
-            const stop = await plugin.watch(deps.providerCtx, account, {
+            const stop = await plugin.watch(providerCtx, account, {
                 onMessages: async (msgs) => {
                     try {
                         await ingestBatch(account, msgs, "watch");

package/dist/inbound-provider-imap/connect-mailbox.d.ts

@@ -1,5 +1,18 @@
 import * as z from "zod";
+import { type ImapCredentialDocument } from "./credential-document.ts";
+declare const connectMailboxSchema: z.ZodObject<{
+    host: z.ZodString;
+    port: z.ZodDefault<z.ZodNumber>;
+    user: z.ZodString;
+    displayName: z.ZodString;
+    address: z.ZodEmail;
+    password: z.ZodString;
+    smtpHost: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodLiteral<"">, z.ZodString]>>>;
+    smtpPort: z.ZodNumber;
+}, z.core.$strip>;
+type ConnectMailboxPayload = z.infer<typeof connectMailboxSchema>;
 export declare function deriveSmtpHost(imapHost: string): string;
+export declare function credentialDocumentOf(payload: ConnectMailboxPayload): ImapCredentialDocument;
 export declare const connectMailboxHandler: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"connect-mailbox", z.ZodObject<{
     host: z.ZodString;
     port: z.ZodDefault<z.ZodNumber>;
@@ -8,6 +21,8 @@ export declare const connectMailboxHandler: import("@cosmicdrift/kumiko-types/de
     address: z.ZodEmail;
     password: z.ZodString;
     smtpHost: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodLiteral<"">, z.ZodString]>>>;
+    smtpPort: z.ZodNumber;
 }, z.core.$strip>, {
     accountId: string;
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, null>;
+export {};

package/dist/inbound-provider-imap/connect-mailbox.js

@@ -8,12 +8,12 @@ import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { IMAP_CONNECT_ERRORS, IMAP_PROVIDER_KEY, SMTP_CONNECT_ERRORS } from "./constants.js";
-import { imapCredentialDocumentSchema, SMTP_IMPLICIT_TLS_PORT, smtpHostSchema, } from "./credential-document.js";
+import { imapCredentialDocumentSchema, smtpHostSchema, } from "./credential-document.js";
 import { connectOnce, IMAP_HOST_UNREACHABLE_MESSAGE } from "./imap-client.js";
 import { SmtpFailureError, verifySmtpLogin } from "./smtp-client.js";
-// No `secure` and no SMTP port input: the password never crosses the wire in clear text, so a
-// payload's secure:false or smtpPort is stripped like any unknown key and both logins always use
-// implicit TLS (SMTP on port 465).
+// No `secure`: the password never crosses the wire in clear text, so a payload's secure:false is
+// stripped like any unknown key. IMAP uses implicit TLS; SMTP uses implicit TLS on 465 and
+// enforced STARTTLS on every other port.
 const connectMailboxSchema = imapCredentialDocumentSchema
     .pick({ host: true, port: true, user: true })
     .extend({
@@ -21,6 +21,7 @@ const connectMailboxSchema = imapCredentialDocumentSchema
     address: z.email().max(320),
     password: z.string().min(1).max(1000),
     smtpHost: z.union([z.literal(""), smtpHostSchema]).nullish(),
+    smtpPort: z.number().int().min(1).max(65535),
 });
 const connectedAccountSchema = z.object({ accountId: z.string() });
 // Matched on the mapped error text, which also carries the host, so only markers no host name
@@ -34,10 +35,10 @@ const SECRET_TRANSACTION_REASON = "the credential secret is written on the reque
 export function deriveSmtpHost(imapHost) {
     return /^imap\./i.test(imapHost) ? `smtp.${imapHost.slice("imap.".length)}` : imapHost;
 }
-function credentialDocumentOf(payload) {
-    const { host, port, user, password } = payload;
+export function credentialDocumentOf(payload) {
+    const { host, port, user, password, smtpPort } = payload;
     const smtpHost = payload.smtpHost || deriveSmtpHost(host);
-    return { host, port, secure: true, user, password, smtpHost, smtpPort: SMTP_IMPLICIT_TLS_PORT };
+    return { host, port, secure: true, user, password, smtpHost, smtpPort };
 }
 // The raw error carries the host and the server response; the tenant only gets the category.
 // A blocked host and an unresolvable one share one text on purpose (see createImapClient).
@@ -97,7 +98,7 @@ export const connectMailboxHandler = defineWriteHandler({
         if (smtpFailure) {
             const { reason, i18nKey } = SMTP_CONNECT_ERRORS[smtpFailure];
             ctx.obs.log.warn("smtp connect check failed", { reason });
-            return writeFailure(new UnprocessableError(reason, { i18nKey }));
+            return writeFailure(new UnprocessableError(reason, { i18nKey, i18nParams: { port: doc.smtpPort } }));
         }
         return { isSuccess: true, data: null };
     },

package/dist/inbound-provider-imap/constants.d.ts

@@ -39,3 +39,4 @@ export declare const SMTP_CONNECT_ERRORS: {
         readonly i18nKey: "inboundMail.imap.connect.errors.smtpConnectFailed";
     };
 };
+export declare const SMTP_SUBMISSION_PORT = 587;

package/dist/inbound-provider-imap/constants.js

@@ -37,3 +37,4 @@ export const SMTP_CONNECT_ERRORS = {
         i18nKey: "inboundMail.imap.connect.errors.smtpConnectFailed",
     },
 };
+export const SMTP_SUBMISSION_PORT = 587;

package/dist/inbound-provider-imap/credential-document.d.ts

@@ -1,6 +1,5 @@
 import { type InboundMailContext, type MailAccountRecord } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import * as z from "zod";
-export declare const SMTP_IMPLICIT_TLS_PORT = 465;
 export declare const smtpHostSchema: z.ZodString;
 export declare const imapCredentialDocumentSchema: z.ZodObject<{
     host: z.ZodString;

package/dist/inbound-provider-imap/credential-document.js

@@ -21,8 +21,7 @@
 import { InboundAuthError, inboundCredentialSecretKey, } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import * as z from "zod";
-import { FEATURE_NAME } from "./constants.js";
-export const SMTP_IMPLICIT_TLS_PORT = 465;
+import { FEATURE_NAME, SMTP_SUBMISSION_PORT } from "./constants.js";
 // A bare host name: a port, path or whitespace would point the connect somewhere the guard did
 // not check.
 export const smtpHostSchema = z
@@ -38,7 +37,7 @@ export const imapCredentialDocumentSchema = z.object({
     password: z.string().min(1).optional(),
     accessToken: z.string().min(1).optional(),
     smtpHost: smtpHostSchema.optional(),
-    smtpPort: z.number().int().min(1).max(65535).default(SMTP_IMPLICIT_TLS_PORT),
+    smtpPort: z.number().int().min(1).max(65535).default(SMTP_SUBMISSION_PORT),
 });
 export function parseImapCredentialDocument(raw) {
     let json;

package/dist/inbound-provider-imap/i18n.js

@@ -12,10 +12,11 @@ export const INBOUND_PROVIDER_IMAP_I18N = {
     [formFieldKey("user")]: { en: "User name" },
     [formFieldKey("password")]: { en: "Password" },
     [formFieldKey("smtpHost")]: { en: "Outgoing server (SMTP)" },
+    [formFieldKey("smtpPort")]: { en: "SMTP port" },
     "inboundMail.imap.connect.server": { en: "Server sign-in" },
     "inboundMail.imap.connect.outgoing": { en: "Sending" },
     "inboundMail.imap.connect.outgoingHint": {
-        en: "Replies go out from this address over your own mail server, with the same user name and password. Leave the field empty if the server is called like the IMAP server, with smtp. instead of imap.",
+        en: "Replies go out from this address over your own mail server, with the same user name and password. Leave the field empty if the server is called like the IMAP server, with smtp. instead of imap. Usually 587, even when your provider lists 465/SSL.",
     },
     "inboundMail.imap.connect.submit": { en: "Check and connect" },
     [IMAP_CONNECT_ERRORS.hostUnreachable.i18nKey]: {
@@ -37,9 +38,9 @@ export const INBOUND_PROVIDER_IMAP_I18N = {
         en: "Receiving works, but sending does not: the outgoing server rejected the sign-in.",
     },
     [SMTP_CONNECT_ERRORS.tlsFailed.i18nKey]: {
-        en: "Receiving works, but sending does not: the encrypted connection to the outgoing server on port 465 failed.",
+        en: "Receiving works, but sending does not: the encrypted connection to the outgoing server on port {port} failed.",
     },
     [SMTP_CONNECT_ERRORS.connectFailed.i18nKey]: {
-        en: "Receiving works, but sending does not: no connection to the outgoing server on port 465.",
+        en: "Receiving works, but sending does not: no connection to the outgoing server on port {port}.",
     },
 };

package/dist/inbound-provider-imap/screens.js

@@ -1,6 +1,6 @@
 import { IMAP_CONNECT_SCREEN_ID, MAIL_ACCOUNT_LIST_SCREEN_QN, } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import { i18nKey } from "@cosmicdrift/kumiko-framework/engine";
-import { ImapHandlers } from "./constants.js";
+import { ImapHandlers, SMTP_SUBMISSION_PORT } from "./constants.js";
 // Reached from the toolbar of the foundation's mail account list, never from the nav.
 export const imapConnectScreen = {
     id: IMAP_CONNECT_SCREEN_ID,
@@ -15,6 +15,14 @@ export const imapConnectScreen = {
         user: { type: "text", required: true, maxLength: 320 },
         password: { type: "text", required: true, format: "password", sensitive: true },
         smtpHost: { type: "text", maxLength: 255 },
+        smtpPort: {
+            type: "number",
+            integer: true,
+            required: true,
+            min: 1,
+            max: 65535,
+            default: SMTP_SUBMISSION_PORT,
+        },
     },
     layout: {
         sections: [
@@ -27,7 +35,7 @@ export const imapConnectScreen = {
             {
                 title: i18nKey("inboundMail.imap.connect.outgoing"),
                 description: i18nKey("inboundMail.imap.connect.outgoingHint"),
-                fields: ["smtpHost"],
+                fields: ["smtpHost", "smtpPort"],
             },
         ],
     },

package/dist/inbound-provider-imap/smtp-client.d.ts

@@ -1,4 +1,5 @@
 import { type MailConnectTarget } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
+export declare const SMTP_IMPLICIT_TLS_PORT = 465;
 export type SmtpLogin = {
     readonly host: string;
     readonly port: number;
@@ -14,7 +15,8 @@ export declare function classifySmtpError(err: unknown): SmtpFailure;
 export declare function smtpTransportOptions(login: SmtpLogin, target: MailConnectTarget): {
     readonly host: string;
     readonly port: number;
-    readonly secure: true;
+    readonly secure: boolean;
+    readonly requireTLS?: boolean | undefined;
     readonly servername?: string | undefined;
     readonly auth: {
         readonly user: string;

package/dist/inbound-provider-imap/smtp-client.js

@@ -1,11 +1,12 @@
 // nodemailer wiring for sending from a connected mailbox: one short-lived, non-pooled connection
-// per call, always implicit TLS, pinned to the address the mail host guard approved.
+// per call, TLS enforced (implicit on 465, STARTTLS otherwise), pinned to the address the mail host guard approved.
 import { BlockedHostError, resolveMailConnectTarget, } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { errorCodeOf, propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { createTransport } from "nodemailer";
 import { imapMailHostGuard } from "./imap-client.js";
 const log = createFallbackLogger("inbound-provider-imap");
+export const SMTP_IMPLICIT_TLS_PORT = 465;
 // nodemailer's defaults wait minutes; the connect form holds a request open meanwhile.
 const CONNECTION_TIMEOUT_MS = 10_000;
 const GREETING_TIMEOUT_MS = 10_000;
@@ -43,7 +44,9 @@ export function smtpTransportOptions(login, target) {
     return {
         host: target.host,
         port: login.port,
-        secure: true,
+        secure: login.port === SMTP_IMPLICIT_TLS_PORT,
+        // Without it nodemailer sends AUTH in clear text when the server offers no STARTTLS.
+        ...(login.port !== SMTP_IMPLICIT_TLS_PORT && { requireTLS: true }),
         ...(target.servername && { servername: target.servername }),
         auth: { user: login.user, pass: login.password },
         connectionTimeout: CONNECTION_TIMEOUT_MS,

package/dist/inbound-provider-inmemory/feature.d.ts

@@ -1,4 +1,4 @@
-import type { InboundMailProviderPlugin, RawInboundMessage } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+import { type InboundMailProviderPlugin, type RawInboundMessage } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 export declare const INMEMORY_PROVIDER_KEY = "inmemory";
 /** Test helper: adds a message to the mailbox. If a watch is active, it is
  *  pushed immediately (IDLE simulation); the next fetch also returns it by
@@ -9,6 +9,9 @@ export declare function seedInboundMessage(accountId: string, msg: RawInboundMes
 export declare function failNextFetchWith(accountId: string, err: unknown): void;
 /** Test helper: injects a one-shot error into the next verify. */
 export declare function failNextVerifyWith(accountId: string, err: unknown): void;
+/** Test helper: every fetch reads this tenant secret first, like a real
+ *  provider reads its stored credentials; a missing secret is an auth error. */
+export declare function requireCredentialSecretOnFetch(accountId: string, key: string): void;
 /** Test helper: simulates the live connection terminating (the supervisor
  *  must restart with backoff). */
 export declare function emitWatchError(accountId: string, err: unknown): void;

package/dist/inbound-provider-inmemory/feature.js

@@ -10,6 +10,8 @@
 //
 // **Pattern basis:** mail-transport-inmemory (module-level state +
 // test-helper exports). Not for production.
+import { InboundAuthError, } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 const FEATURE_NAME = "inbound-provider-inmemory";
 export const INMEMORY_PROVIDER_KEY = "inmemory";
@@ -17,7 +19,13 @@ const accounts = new Map();
 function stateFor(accountId) {
     let state = accounts.get(accountId);
     if (!state) {
-        state = { log: [], watch: null, nextFetchError: null, nextVerifyError: null };
+        state = {
+            log: [],
+            watch: null,
+            nextFetchError: null,
+            nextVerifyError: null,
+            credentialSecretKey: null,
+        };
         accounts.set(accountId, state);
     }
     return state;
@@ -40,6 +48,17 @@ export function failNextFetchWith(accountId, err) {
 export function failNextVerifyWith(accountId, err) {
     stateFor(accountId).nextVerifyError = err;
 }
+/** Test helper: every fetch reads this tenant secret first, like a real
+ *  provider reads its stored credentials; a missing secret is an auth error. */
+export function requireCredentialSecretOnFetch(accountId, key) {
+    stateFor(accountId).credentialSecretKey = key;
+}
+async function readCredentialSecret(ctx, account, key) {
+    const secrets = requireSecretsContext({ secrets: ctx.secrets, auditUserId: ctx.auditUserId }, FEATURE_NAME);
+    const secret = await secrets.get(account.tenantId, key);
+    if (!secret)
+        throw new InboundAuthError(`${FEATURE_NAME}: no credential secret ${key}`);
+}
 /** Test helper: simulates the live connection terminating (the supervisor
  *  must restart with backoff). */
 export function emitWatchError(accountId, err) {
@@ -75,13 +94,16 @@ export const inMemoryInboundMailPlugin = {
             throw err;
         }
     },
-    fetch: async (_ctx, account, cursor, opts) => {
+    fetch: async (ctx, account, cursor, opts) => {
         const state = stateFor(account.id);
         if (state.nextFetchError) {
             const err = state.nextFetchError;
             state.nextFetchError = null;
             throw err;
         }
+        if (state.credentialSecretKey) {
+            await readCredentialSecret(ctx, account, state.credentialSecretKey);
+        }
         const offset = offsetOf(cursor);
         const slice = state.log.slice(offset, offset + opts.maxMessages);
         const nextOffset = offset + slice.length;

package/dist/inbound-provider-inmemory/index.d.ts

@@ -1 +1 @@
-export { createInboundProviderInMemoryFeature, emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, isWatching, resetInboundInMemory, seedInboundMessage, } from "./feature.ts";
+export { createInboundProviderInMemoryFeature, emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, isWatching, requireCredentialSecretOnFetch, resetInboundInMemory, seedInboundMessage, } from "./feature.ts";

package/dist/inbound-provider-inmemory/index.js

@@ -1,2 +1,2 @@
 // Public API of the inbound-provider-inmemory bundled-feature.
-export { createInboundProviderInMemoryFeature, emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, isWatching, resetInboundInMemory, seedInboundMessage, } from "./feature.js";
+export { createInboundProviderInMemoryFeature, emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, isWatching, requireCredentialSecretOnFetch, resetInboundInMemory, seedInboundMessage, } from "./feature.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.392.0",
+  "version": "0.392.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -558,9 +558,9 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-framework": "0.392.0",
-    "@cosmicdrift/kumiko-renderer": "0.392.0",
-    "@cosmicdrift/kumiko-types": "0.392.0",
+    "@cosmicdrift/kumiko-framework": "0.392.2",
+    "@cosmicdrift/kumiko-renderer": "0.392.2",
+    "@cosmicdrift/kumiko-types": "0.392.2",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "^3.31.3",
@@ -1142,17 +1142,17 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.392.0",
-    "@cosmicdrift/kumiko-locale-es": "0.392.0",
-    "@cosmicdrift/kumiko-locale-fr": "0.392.0",
-    "@cosmicdrift/kumiko-locale-it": "0.392.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.392.0",
+    "@cosmicdrift/kumiko-locale-de": "0.392.2",
+    "@cosmicdrift/kumiko-locale-es": "0.392.2",
+    "@cosmicdrift/kumiko-locale-fr": "0.392.2",
+    "@cosmicdrift/kumiko-locale-it": "0.392.2",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.392.2",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1",
-    "@cosmicdrift/kumiko-testing": "0.392.0"
+    "@cosmicdrift/kumiko-testing": "0.392.2"
   },
   "peerDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.392.0"
+    "@cosmicdrift/kumiko-testing": "0.392.2"
   },
   "peerDependenciesMeta": {
     "@cosmicdrift/kumiko-testing": {

package/src/cap-overview/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.392.1",
+    "type": "fix",
+    "title": "Cap cards \"view all\" link uses the primary link style",
+    "detail": "The link under the cap cards no longer renders in muted grey; it uses the default link variant like other text links."
+  },
   {
     "version": "0.392.0",
     "type": "improvement",

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.392.2",
+    "type": "fix",
+    "title": "Mail sync no longer fails when reading IMAP credentials",
+    "detail": "createInboundMailSupervisor builds its provider context with auditUserId defaulting to the system user. Apps that did not set auditUserId in providerCtx got an internal error on every fetch and watch because the secrets context needs an audit identity. An explicitly set auditUserId is kept."
+  },
+  {
+    "version": "0.392.2",
+    "type": "fix",
+    "title": "Mail sync finds the stored IMAP credentials under row-level security",
+    "detail": "createInboundMailSupervisor runs outside any request, so secret reads ran without a tenant scope and the application role saw no row in read_tenant_secrets. The supervisor now wraps providerCtx.secrets with tenantScopedSecrets, which the framework exports from internal/row-level-security. inbound-provider-inmemory gains requireCredentialSecretOnFetch so tests can exercise credential reads; a new integration test runs the secrets against an application-role database."
+  },
   {
     "version": "0.392.0",
     "type": "fix",

package/src/inbound-provider-imap/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.392.1",
+    "type": "fix",
+    "title": "Mailboxes connect and send over SMTP port 587 with STARTTLS",
+    "detail": "The connect form gets a required field \"SMTP port\", preset to 587, and stores it as smtpPort in the credential document (the schema still accepts any stored port, default now 587). Port 465 uses implicit TLS; every other port uses STARTTLS with requireTLS, so the password is never sent in clear text and the connection fails when the server offers no STARTTLS. The certificate is checked against the host name on the STARTTLS upgrade as well. The SMTP failure texts name the entered port. New key for the field label in all locale packages."
+  },
   {
     "version": "0.392.0",
     "type": "improvement",