@meith/settings 0.29.0 → 0.29.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meith/settings",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "zod": "^4.4.3",
-    "@meith/core": "0.29.0",
-    "@meith/i18n": "0.29.0"
+    "@meith/core": "0.29.1",
+    "@meith/i18n": "0.29.1"
   }
 }

package/src/definitions.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import { normaliseLocale, SOURCE_LOCALE } from '@meith/i18n'
 
 import { DEFAULT_PRIVACY_POLICY, DEFAULT_TERMS_OF_SERVICE } from './legal'
+import { mailEndpointProblem } from './mail'
 import { isUsableFeedUrl, isUsableIssuer, isUsableOrigin } from './origin'
 
 export type SettingGroup =
@@ -417,14 +418,16 @@ export const SETTING_DEFINITIONS = [
       'Only for the provider-API transport. The board posts Resend’s exact ' +
       'field names with a Bearer token, so this works for Resend and for ' +
       'anything that copies it — and not for Postmark or Mailgun, whose SMTP ' +
-      'hosts are the way in.',
+      'hosts are the way in. It must be an https:// address with no embedded ' +
+      'credentials, and the board refuses to reach one that resolves to a ' +
+      'private or internal address.',
     schema: z
       .string()
       .trim()
-      .refine(
-        (value) => value === '' || z.string().url().safeParse(value).success,
-        'That is not a URL.',
-      ),
+      .superRefine((value, ctx) => {
+        const problem = mailEndpointProblem(value)
+        if (problem !== null) ctx.addIssue({ code: z.ZodIssueCode.custom, message: problem })
+      }),
     default: '',
   }),
   define({

package/src/index.ts

@@ -48,6 +48,7 @@ export {
   mailConfigFromEnvironment,
   mailConfigFromSettings,
   mailConfigProblems,
+  mailEndpointProblem,
   NO_MAIL,
   resolveMailConfig,
   type SmtpMailConfig,

package/src/mail.ts

@@ -175,6 +175,24 @@ function hostOf(endpoint: string): string {
   }
 }
 
+export function mailEndpointProblem(value: string): string | null {
+  const trimmed = value.trim()
+  if (trimmed === '') return null
+
+  let url: URL
+  try {
+    url = new URL(trimmed)
+  } catch {
+    return 'That is not a URL.'
+  }
+
+  if (url.protocol !== 'https:') return 'The endpoint must be an https:// URL.'
+  if (url.username !== '' || url.password !== '') {
+    return 'The endpoint must not carry a username or password.'
+  }
+  return null
+}
+
 export interface MailPreset {
   readonly id: string
   readonly label: string