@cosmicdrift/kumiko-samples 0.392.0 → 0.392.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.392.0",
+  "version": "0.392.1",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.392.0",
+  "version": "0.392.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/src/cap-overview/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.392.1",
+    "type": "fix",
+    "title": "Cap cards \"view all\" link uses the primary link style",
+    "detail": "The link under the cap cards no longer renders in muted grey; it uses the default link variant like other text links."
+  },
   {
     "version": "0.392.0",
     "type": "improvement",

package/packages/bundled-features/src/cap-overview/web/cap-cards-panel.tsx

@@ -64,7 +64,6 @@ function ViewAllLink(): ReactNode {
     <Link
       href={nav.hrefFor(target)}
       onPress={() => nav.navigate(target)}
-      variant="muted"
       testId="cap-cards-view-all"
     >
       {t("cap-overview.cards.viewAll")}

package/packages/bundled-features/src/inbound-provider-imap/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.392.1",
+    "type": "fix",
+    "title": "Mailboxes connect and send over SMTP port 587 with STARTTLS",
+    "detail": "The connect form gets a required field \"SMTP port\", preset to 587, and stores it as smtpPort in the credential document (the schema still accepts any stored port, default now 587). Port 465 uses implicit TLS; every other port uses STARTTLS with requireTLS, so the password is never sent in clear text and the connection fails when the server offers no STARTTLS. The certificate is checked against the host name on the STARTTLS upgrade as well. The SMTP failure texts name the entered port. New key for the field label in all locale packages."
+  },
   {
     "version": "0.392.0",
     "type": "improvement",

package/packages/bundled-features/src/inbound-provider-imap/connect-mailbox.ts

@@ -20,15 +20,14 @@ import { IMAP_CONNECT_ERRORS, IMAP_PROVIDER_KEY, SMTP_CONNECT_ERRORS } from "./c
 import {
   type ImapCredentialDocument,
   imapCredentialDocumentSchema,
-  SMTP_IMPLICIT_TLS_PORT,
   smtpHostSchema,
 } from "./credential-document.ts";
 import { connectOnce, IMAP_HOST_UNREACHABLE_MESSAGE } from "./imap-client.ts";
 import { type SmtpFailure, SmtpFailureError, verifySmtpLogin } from "./smtp-client.ts";
 
-// No `secure` and no SMTP port input: the password never crosses the wire in clear text, so a
-// payload's secure:false or smtpPort is stripped like any unknown key and both logins always use
-// implicit TLS (SMTP on port 465).
+// No `secure`: the password never crosses the wire in clear text, so a payload's secure:false is
+// stripped like any unknown key. IMAP uses implicit TLS; SMTP uses implicit TLS on 465 and
+// enforced STARTTLS on every other port.
 const connectMailboxSchema = imapCredentialDocumentSchema
   .pick({ host: true, port: true, user: true })
   .extend({
@@ -36,6 +35,7 @@ const connectMailboxSchema = imapCredentialDocumentSchema
     address: z.email().max(320),
     password: z.string().min(1).max(1000),
     smtpHost: z.union([z.literal(""), smtpHostSchema]).nullish(),
+    smtpPort: z.number().int().min(1).max(65535),
   });
 type ConnectMailboxPayload = z.infer<typeof connectMailboxSchema>;
 
@@ -59,10 +59,10 @@ export function deriveSmtpHost(imapHost: string): string {
   return /^imap\./i.test(imapHost) ? `smtp.${imapHost.slice("imap.".length)}` : imapHost;
 }
 
-function credentialDocumentOf(payload: ConnectMailboxPayload): ImapCredentialDocument {
-  const { host, port, user, password } = payload;
+export function credentialDocumentOf(payload: ConnectMailboxPayload): ImapCredentialDocument {
+  const { host, port, user, password, smtpPort } = payload;
   const smtpHost = payload.smtpHost || deriveSmtpHost(host);
-  return { host, port, secure: true, user, password, smtpHost, smtpPort: SMTP_IMPLICIT_TLS_PORT };
+  return { host, port, secure: true, user, password, smtpHost, smtpPort };
 }
 
 // The raw error carries the host and the server response; the tenant only gets the category.
@@ -121,7 +121,9 @@ export const connectMailboxHandler = defineWriteHandler({
     if (smtpFailure) {
       const { reason, i18nKey } = SMTP_CONNECT_ERRORS[smtpFailure];
       ctx.obs.log.warn("smtp connect check failed", { reason });
-      return writeFailure(new UnprocessableError(reason, { i18nKey }));
+      return writeFailure(
+        new UnprocessableError(reason, { i18nKey, i18nParams: { port: doc.smtpPort } }),
+      );
     }
     return { isSuccess: true, data: null };
   },

package/packages/bundled-features/src/inbound-provider-imap/constants.ts

@@ -40,3 +40,5 @@ export const SMTP_CONNECT_ERRORS = {
     i18nKey: "inboundMail.imap.connect.errors.smtpConnectFailed",
   },
 } as const satisfies Record<keyof typeof IMAP_CONNECT_ERRORS, unknown>;
+
+export const SMTP_SUBMISSION_PORT = 587;

package/packages/bundled-features/src/inbound-provider-imap/credential-document.ts

@@ -27,9 +27,7 @@ import {
 } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import * as z from "zod";
-import { FEATURE_NAME } from "./constants.ts";
-
-export const SMTP_IMPLICIT_TLS_PORT = 465;
+import { FEATURE_NAME, SMTP_SUBMISSION_PORT } from "./constants.ts";
 
 // A bare host name: a port, path or whitespace would point the connect somewhere the guard did
 // not check.
@@ -47,7 +45,7 @@ export const imapCredentialDocumentSchema = z.object({
   password: z.string().min(1).optional(),
   accessToken: z.string().min(1).optional(),
   smtpHost: smtpHostSchema.optional(),
-  smtpPort: z.number().int().min(1).max(65535).default(SMTP_IMPLICIT_TLS_PORT),
+  smtpPort: z.number().int().min(1).max(65535).default(SMTP_SUBMISSION_PORT),
 });
 export type ImapCredentialDocument = z.infer<typeof imapCredentialDocumentSchema>;
 

package/packages/bundled-features/src/inbound-provider-imap/i18n.ts

@@ -15,10 +15,11 @@ export const INBOUND_PROVIDER_IMAP_I18N: Readonly<Record<string, { readonly en:
   [formFieldKey("user")]: { en: "User name" },
   [formFieldKey("password")]: { en: "Password" },
   [formFieldKey("smtpHost")]: { en: "Outgoing server (SMTP)" },
+  [formFieldKey("smtpPort")]: { en: "SMTP port" },
   "inboundMail.imap.connect.server": { en: "Server sign-in" },
   "inboundMail.imap.connect.outgoing": { en: "Sending" },
   "inboundMail.imap.connect.outgoingHint": {
-    en: "Replies go out from this address over your own mail server, with the same user name and password. Leave the field empty if the server is called like the IMAP server, with smtp. instead of imap.",
+    en: "Replies go out from this address over your own mail server, with the same user name and password. Leave the field empty if the server is called like the IMAP server, with smtp. instead of imap. Usually 587, even when your provider lists 465/SSL.",
   },
   "inboundMail.imap.connect.submit": { en: "Check and connect" },
   [IMAP_CONNECT_ERRORS.hostUnreachable.i18nKey]: {
@@ -40,9 +41,9 @@ export const INBOUND_PROVIDER_IMAP_I18N: Readonly<Record<string, { readonly en:
     en: "Receiving works, but sending does not: the outgoing server rejected the sign-in.",
   },
   [SMTP_CONNECT_ERRORS.tlsFailed.i18nKey]: {
-    en: "Receiving works, but sending does not: the encrypted connection to the outgoing server on port 465 failed.",
+    en: "Receiving works, but sending does not: the encrypted connection to the outgoing server on port {port} failed.",
   },
   [SMTP_CONNECT_ERRORS.connectFailed.i18nKey]: {
-    en: "Receiving works, but sending does not: no connection to the outgoing server on port 465.",
+    en: "Receiving works, but sending does not: no connection to the outgoing server on port {port}.",
   },
 };

package/packages/bundled-features/src/inbound-provider-imap/screens.ts

@@ -4,7 +4,7 @@ import {
 } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import { i18nKey } from "@cosmicdrift/kumiko-framework/engine";
 import type { ActionFormScreenDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
-import { ImapHandlers } from "./constants.ts";
+import { ImapHandlers, SMTP_SUBMISSION_PORT } from "./constants.ts";
 
 // Reached from the toolbar of the foundation's mail account list, never from the nav.
 export const imapConnectScreen: ActionFormScreenDefinition = {
@@ -20,6 +20,14 @@ export const imapConnectScreen: ActionFormScreenDefinition = {
     user: { type: "text", required: true, maxLength: 320 },
     password: { type: "text", required: true, format: "password", sensitive: true },
     smtpHost: { type: "text", maxLength: 255 },
+    smtpPort: {
+      type: "number",
+      integer: true,
+      required: true,
+      min: 1,
+      max: 65535,
+      default: SMTP_SUBMISSION_PORT,
+    },
   },
   layout: {
     sections: [
@@ -32,7 +40,7 @@ export const imapConnectScreen: ActionFormScreenDefinition = {
       {
         title: i18nKey("inboundMail.imap.connect.outgoing"),
         description: i18nKey("inboundMail.imap.connect.outgoingHint"),
-        fields: ["smtpHost"],
+        fields: ["smtpHost", "smtpPort"],
       },
     ],
   },

package/packages/bundled-features/src/inbound-provider-imap/smtp-client.ts

@@ -1,5 +1,5 @@
 // nodemailer wiring for sending from a connected mailbox: one short-lived, non-pooled connection
-// per call, always implicit TLS, pinned to the address the mail host guard approved.
+// per call, TLS enforced (implicit on 465, STARTTLS otherwise), pinned to the address the mail host guard approved.
 
 import {
   BlockedHostError,
@@ -13,6 +13,8 @@ import { imapMailHostGuard } from "./imap-client.ts";
 
 const log = createFallbackLogger("inbound-provider-imap");
 
+export const SMTP_IMPLICIT_TLS_PORT = 465;
+
 // nodemailer's defaults wait minutes; the connect form holds a request open meanwhile.
 const CONNECTION_TIMEOUT_MS = 10_000;
 const GREETING_TIMEOUT_MS = 10_000;
@@ -65,7 +67,9 @@ export function smtpTransportOptions(login: SmtpLogin, target: MailConnectTarget
   return {
     host: target.host,
     port: login.port,
-    secure: true,
+    secure: login.port === SMTP_IMPLICIT_TLS_PORT,
+    // Without it nodemailer sends AUTH in clear text when the server offers no STARTTLS.
+    ...(login.port !== SMTP_IMPLICIT_TLS_PORT && { requireTLS: true }),
     ...(target.servername && { servername: target.servername }),
     auth: { user: login.user, pass: login.password },
     connectionTimeout: CONNECTION_TIMEOUT_MS,