arcane-os 0.22.0 → 0.22.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.22.1
+
+- Change the mail gateway's default HTTPS/HTTP2 port from 8025 to 4433 in
+  the CLI and server configuration. Preserve explicit port overrides and the
+  existing occupied-port message; update current help, references and gate report.
+
 ## 0.22.0
 
 - Export `generateDocumentImportMaps()` from `arcane-os` for explicitly selected

package/README.md

@@ -19,11 +19,11 @@ version-locked SDK runtime, while an integrated Arcane checkout uses its live
 `arcane/` runtime. Both profiles preserve the same app URLs, theme, packaging,
 event, cancellation, and browser run contracts.
 
-This checkout defines the `0.22.0` SDK contract. Applications pin one exact npm
+This checkout defines the `0.22.1` SDK contract. Applications pin one exact npm
 version and lockfile; registry state is deliberately not baked into application
 artifacts.
 
-The [mail gateway](docs/reference/mail.md) serves HTTPS with HTTP/2 on port 8025,
+The [mail gateway](docs/reference/mail.md) serves HTTPS with HTTP/2 on port 4433,
 using certificate paths from `.env.json`, and defaults browser mail to
 `/v1/mail` on the current domain. Multiple applications can share
 one server with explicit allowed origins. Subscription verification is disabled

package/docs/reference/cli.md

@@ -48,7 +48,7 @@ meaning and cardinality rules:
 | `--workspace` | directory | Commands that select an external or integrated workspace; defaults to `.`. |
 | `--app` | app id or label | Workspace/app operations except shared scope and `verify-bundle`; optional diagnostic label for `mail serve`. |
 | `--arcane-root` | directory | `doctor`, native `build`/`run`, `native-doctor`, `native-prepare` |
-| `--host` / `--port` | host / integer 0–65535 | Browser `dev`/`run` default to HTTPS at `127.0.0.1:8000`; `mail serve` defaults to HTTPS with HTTP/2 at `0.0.0.0:8025` and accepts an explicit bind host. |
+| `--host` / `--port` | host / integer 0–65535 | Browser `dev`/`run` default to HTTPS at `127.0.0.1:8000`; `mail serve` defaults to HTTPS with HTTP/2 at `0.0.0.0:4433` and accepts an explicit bind host. |
 | `--http-port` | integer 0–65535 | Browser `dev`/`run` HTTP redirect listener; defaults to `0`, which selects an available port. |
 | `--public` | flag | `dev`; binds to `0.0.0.0` unless `--host` explicitly selects another address. |
 | `--http` | flag | `dev` only; serves source and PWA routes on one HTTP listener selected by `--port`, without TLS. |
@@ -909,7 +909,7 @@ loss after the attempt begins is ambiguous because Resend may have accepted it.
 `mail serve` starts one owned HTTPS gateway with HTTP/2:
 
 ```text
-arcane mail serve [--profile <profile>] [--from <verified-sender>] [--app <label>] [--origin <exact-origin>] [--allow-to <addresses>] [--host 0.0.0.0] [--port 8025] [--request-timeout <ms>]
+arcane mail serve [--profile <profile>] [--from <verified-sender>] [--app <label>] [--origin <exact-origin>] [--allow-to <addresses>] [--host 0.0.0.0] [--port 4433] [--request-timeout <ms>]
 ```
 
 The selected `.env.json` profile supplies only the server-side Resend API key;
@@ -932,9 +932,9 @@ opens; the TLS owner reports PEM file errors. Keep private-key material outside
 tracked source. The SDK repository already ignores `.arcane/` and `.env.json`.
 
 The selected `node-http-server` module negotiates HTTP/2 with HTTP/1.1 fallback
-on the same HTTPS port, default `8025`, with no plain-HTTP listener. Callers use
+on the same HTTPS port, default `4433`, with no plain-HTTP listener. Callers use
 a hostname covered by the certificate, such as
-`https://mail.example.com:8025/v1/mail`; `0.0.0.0` identifies the bind address.
+`https://mail.example.com:4433/v1/mail`; `0.0.0.0` identifies the bind address.
 Restart the gateway after replacing renewed certificate files. Certificate
 issuance and renewal remain with the deployment's certificate owner.
 

package/docs/reference/mail.md

@@ -364,10 +364,10 @@ deadline.
 Start the gateway:
 
 ```text
-npm exec -- arcane mail serve --profile mail --host 0.0.0.0 --port 8025
+npm exec -- arcane mail serve --profile mail --host 0.0.0.0 --port 4433
 ```
 
-The default listener is `0.0.0.0:8025`; `--host` and `--port` select its bind
+The default listener is `0.0.0.0:4433`; `--host` and `--port` select its bind
 address and port. The server can serve callers from multiple domains on the
 same machine. Route the page's `/v1/mail` to this listener, or configure an
 explicit shared endpoint in the caller.
@@ -376,7 +376,7 @@ explicit shared endpoint in the caller.
 `node-http-server` PEM API owns TLS and negotiates HTTP/2 or HTTP/1.1 on the
 same listener. It creates no additional plain-HTTP listener. The returned URL
 uses `https://`; `0.0.0.0` is the bind address, so callers use the deployed
-domain, for example `https://mail.example.com:8025/v1/mail`.
+domain, for example `https://mail.example.com:4433/v1/mail`.
 
 Set `MAIL_TLS_CERT_PATH` to the PEM certificate chain and `MAIL_TLS_KEY_PATH`
 to its PEM private-key file. These top-level settings belong to the listener

package/docs/reviews/mail-server-purpose-review.md

@@ -52,7 +52,7 @@ Configuration and foundational methods follow. Each baseline name is recorded so
 | `positiveInteger` | Resolves the retry delay; baseline exposes unused `allowZero`. | Y/Y/Y — Simplify. | The uncalled zero branch and its extra option/prose are removed. Current name: `readRetryDelayMs`, which resolves the actual retry-delay setting. |
 | `optionalTimeoutMs` | Reads body/provider deadlines only when supplied. | Y/Y/N — Keep. | Omitting a deadline produces no timer. Node timer-range handling prevents caller-selected delays from changing meaning. Current name remains `optionalTimeoutMs`. |
 | `normalizeRetryAfter` | Error and result constructors keep a usable retry delay. | Y/Y/N — Keep. | Retry scheduling consumes this value. It is control metadata, not a transformation of message content. Current name: `retryDelayOrZero`. |
-| `portNumber` | Startup resolves default or configured port, including ephemeral port zero. | Y/Y/Y — Remove wrapper; retain configuration value. | The HTTP owner handles actual port binding. Preserve default 8025 and explicit port zero; no extra port validator or domain policy is required. |
+| `portNumber` | Startup resolves default or configured port, including ephemeral port zero. | Y/Y/Y — Remove wrapper; retain configuration value. | The HTTP owner handles actual port binding. Use the selected default 4433 and preserve explicit port zero; no extra port validator or domain policy is required. |
 | `validateSignal` | Direct send and server options accept caller cancellation. | Y/Y/Y — Remove wrapper; retain original signal. | Native signal operations already own their contract. Cancellation controllers/listeners and the abortable adapter remain. |
 | `validateApiKey` | Provider configuration supplies the credential used by Resend Fetch. | Y/Y/Y — Remove local format validator. | CLI credential retrieval reports missing provider credentials; Fetch/provider own actual transport validity. Never echo the credential. |
 | `validateAppId` | Validates application identity using the old lowercase-slug grammar. | Y/Y/Y — Remove the grammar and closed-list/equality admission. | Per-request identity matters and remains an ordinary string. Any application may use the shared server. Read the supplied identity for subscription verification without rewriting it; no standalone wrapper is needed solely to restrict spelling. |
@@ -395,7 +395,7 @@ cancellation before writes, and CLI defaults. Local tests and checks were not ru
 ## HTTPS and HTTP/2 follow-up
 
 The user explicitly selected HTTPS with HTTP/2. The mail listener remains on
-its dedicated configured port, default 8025, with the published
+its dedicated configured port, now default 4433, with the published
 `node-http-server` module owning TLS, protocol negotiation and listener/session
 shutdown. This increment preserves the provider attempt, report content,
 subscription callback, sender selection, recipient configuration and cancellation.
@@ -423,3 +423,16 @@ JSON paths and missing TLS settings. Synthetic TLS selection is not evidence of
 an encrypted handshake. No local tests, checks, server launch, real TLS
 negotiation or provider send were performed for this follow-up review. Selected
 package and publication results belong to the delivery record.
+
+## Main mail port follow-up
+
+The user selected 4433 as the main mail-server port. Both the CLI's omitted-port
+setting and the server's programmatic default now select 4433. Explicit ports,
+including ephemeral port zero, continue through the existing configuration.
+
+The port setting passes Y/Y/N: the listener needs a bind port, deployments need
+an override, and removing either would lose required behavior. Changing the two
+defaults adds no runtime work or helper. TLS negotiation, the returned endpoint
+and the occupied-port message already use the selected port. Existing test
+source was updated for the omitted-port path; explicit-port cases were retained.
+No local tests, checks or server launch were performed for this increment.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.22.0",
+  "version": "0.22.1",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",

package/src/cli/main.mjs

@@ -85,7 +85,7 @@ Usage:
   ${CLI_NAME} mail key status [profile]
   ${CLI_NAME} mail key delete [profile]
   ${CLI_NAME} mail send [--profile <profile>] [--from <address>] --report-key <id> --report-stdin [--request-timeout <ms>]
-  ${CLI_NAME} mail serve [--profile <profile>] [--from <address>] [--app <label>] [--origin <origin>] [--allow-to <addresses>] [--host 0.0.0.0] [--port 8025] [--request-timeout <ms>]
+  ${CLI_NAME} mail serve [--profile <profile>] [--from <address>] [--app <label>] [--origin <origin>] [--allow-to <addresses>] [--host 0.0.0.0] [--port 4433] [--request-timeout <ms>]
     HTTPS/HTTP2; .env.json supplies RESEND_API_KEY, MAIL_TLS_CERT_PATH, and MAIL_TLS_KEY_PATH.
 
 Development:
@@ -698,7 +698,7 @@ function operationOptions(command,parsed,cwd){
                 origin:values.origin,
                 allowTo:values['allow-to'],
                 host:values.host??'0.0.0.0',
-                port:readPort(values.port,8025),
+                port:readPort(values.port,4433),
                 requestTimeout:readMailRequestTimeout(values['request-timeout']),
             };
         }

package/src/mail-server.mjs

@@ -113,7 +113,7 @@ function resolveMailServerConfiguration(options={}){
         host:options.host??'0.0.0.0',
         callerAuthentication:options.verifySubscription?'subscription':'none',
         onEvent:options.onEvent,
-        port:options.port??8025,
+        port:options.port??4433,
         providerTimeoutMs:optionalTimeoutMs(options.providerTimeoutMs,'providerTimeoutMs'),
         requestIdFactory:options.requestIdFactory??randomUUID,
         retryableDelayMs:readRetryDelayMs(options.retryableDelayMs),