arcane-os 0.22.0 → 0.23.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.23.0
+
+- Rename the mail configuration file to `.arcane.env.json`. Upgrade existing
+  deployments by renaming `.env.json` in the directory where the mail command
+  runs, preserving its contents. Mail commands now read only the selected new
+  name and report `storage: '.arcane.env.json'`.
+- Keep configuration independent of the SDK installation directory, including
+  an SDK nested beneath the site root. Preserve provider profiles, relative TLS
+  paths, other JSON settings and HTTPS/HTTP2 port 4433. Update help, references,
+  the purpose-gate report and generated-workspace Git ignores.
+
+## 0.22.1
+
+- Change the mail gateway's default HTTPS/HTTP2 port from 8025 to 4433 in
+  the CLI and server configuration. Preserve explicit port overrides and the
+  existing occupied-port message; update current help, references and gate report.
+
 ## 0.22.0
 
 - Export `generateDocumentImportMaps()` from `arcane-os` for explicitly selected

package/README.md

@@ -19,12 +19,13 @@ version-locked SDK runtime, while an integrated Arcane checkout uses its live
 `arcane/` runtime. Both profiles preserve the same app URLs, theme, packaging,
 event, cancellation, and browser run contracts.
 
-This checkout defines the `0.22.0` SDK contract. Applications pin one exact npm
+This checkout defines the `0.23.0` SDK contract. Applications pin one exact npm
 version and lockfile; registry state is deliberately not baked into application
 artifacts.
 
-The [mail gateway](docs/reference/mail.md) serves HTTPS with HTTP/2 on port 8025,
-using certificate paths from `.env.json`, and defaults browser mail to
+The [mail gateway](docs/reference/mail.md) serves HTTPS with HTTP/2 on port 4433,
+using certificate paths from `.arcane.env.json` in the command's working
+directory, and defaults browser mail to
 `/v1/mail` on the current domain. Multiple applications can share
 one server with explicit allowed origins. Subscription verification is disabled
 until a `verifySubscription` callback is configured; that callback receives the

package/docs/reference/cli.md

@@ -32,7 +32,7 @@ and exits nonzero on failure. Machine output is defined by
 | `arcane update-check` | Performs one explicit, read-only npm dist-tag query for the installed SDK version. |
 | `arcane targets` | Lists target ids, declared status, formats, architectures, signing profiles, methods, and pairing reason. |
 | `arcane repo status\|pull\|push` | Runs one selected repository operation for the current app workspace. |
-| `arcane mail key set\|status\|delete` | Manages one server-only Resend API-key profile in `.env.json`. |
+| `arcane mail key set\|status\|delete` | Manages one server-only Resend API-key profile in `.arcane.env.json`. |
 | `arcane mail send` | Performs one explicit, idempotency-keyed Resend attempt from a complete JSON report on redirected stdin. |
 | `arcane mail serve` | Starts one Arcane-to-Resend gateway with a server-only provider profile, a selected listener, and optional CORS and recipient configuration. |
 
@@ -48,7 +48,7 @@ meaning and cardinality rules:
 | `--workspace` | directory | Commands that select an external or integrated workspace; defaults to `.`. |
 | `--app` | app id or label | Workspace/app operations except shared scope and `verify-bundle`; optional diagnostic label for `mail serve`. |
 | `--arcane-root` | directory | `doctor`, native `build`/`run`, `native-doctor`, `native-prepare` |
-| `--host` / `--port` | host / integer 0–65535 | Browser `dev`/`run` default to HTTPS at `127.0.0.1:8000`; `mail serve` defaults to HTTPS with HTTP/2 at `0.0.0.0:8025` and accepts an explicit bind host. |
+| `--host` / `--port` | host / integer 0–65535 | Browser `dev`/`run` default to HTTPS at `127.0.0.1:8000`; `mail serve` defaults to HTTPS with HTTP/2 at `0.0.0.0:4433` and accepts an explicit bind host. |
 | `--http-port` | integer 0–65535 | Browser `dev`/`run` HTTP redirect listener; defaults to `0`, which selects an available port. |
 | `--public` | flag | `dev`; binds to `0.0.0.0` unless `--host` explicitly selects another address. |
 | `--http` | flag | `dev` only; serves source and PWA routes on one HTTP listener selected by `--port`, without TLS. |
@@ -814,7 +814,7 @@ npm exec -- arcane repo status
 
 ### Resend credential profiles
 
-The mail commands read `.env.json` from the invocation directory on Windows,
+The mail commands read `.arcane.env.json` from the invocation directory on Windows,
 Linux, and macOS. The credential subcommands select one profile in that file:
 
 ```text
@@ -825,7 +825,7 @@ arcane mail key delete [profile]
 
 `key set` reads the Resend API key from a hidden terminal prompt. The
 `--secret-stdin` form is for deliberately redirected non-interactive input and
-rejects a TTY before reading. The key is written to `.env.json` and is never
+rejects a TTY before reading. The key is written to `.arcane.env.json` and is never
 accepted in argv or returned in status output. The optional profile defaults
 to `mail`, which selects top-level `RESEND_API_KEY`. Any other exact profile
 selects `MAIL_PROFILES[profile].RESEND_API_KEY`, with no default-key fallback.
@@ -838,10 +838,10 @@ The minimal file is:
 }
 ```
 
-Fill in the key before starting mail, and add `.env.json` to the project's
+Fill in the key before starting mail, and add `.arcane.env.json` to the project's
 `.gitignore`; the SDK repository already ignores it. Set and delete preserve
 the file's other settings and profiles. Status returns the selected profile,
-`provider:'resend'`, `storage:'.env.json'`, and `exists`. Delete returns
+`provider:'resend'`, `storage:'.arcane.env.json'`, and `exists`. Delete returns
 `exists:false` for both a removed and an already-absent credential.
 
 Programmatic `createToolchain().mail(...)` resolves the configuration directory
@@ -852,6 +852,12 @@ Existing Windows Credential Manager records remain untouched; the JSON reader
 does not migrate or fall back to them. Mail reads JSON directly and does not
 populate or depend on process environment variables for this key.
 
+The SDK's installation directory does not affect this location. With an SDK
+under `my-site/arcane-os-sdk/`, run the command from `my-site/` and keep
+`my-site/.arcane.env.json` alongside that directory. Existing deployments using
+SDK 0.22.1 or earlier must rename `.env.json` to `.arcane.env.json` while
+preserving its contents; the loader reads only the new name.
+
 Missing files or missing/empty selected keys stop `send` and `serve` with the
 configuration path and exact JSON setting to fill in. Invalid JSON and file
 access failures remain observable without printing credential content.
@@ -887,7 +893,7 @@ Resend owns their accepted shape. The adapter removes the application-only
 `type` field and applies `--from` when supplied; otherwise the report or provider
 template supplies the sender. Direct CLI sending has
 no configured fallback recipients. The Resend credential comes only from the
-selected `.env.json` profile; omitting `--profile` selects `mail`. Neither the
+selected `.arcane.env.json` profile; omitting `--profile` selects `mail`. Neither the
 key nor report content is accepted through argv or process environment variables.
 
 The caller owns the nonempty `--report-key`, which is forwarded unchanged.
@@ -909,10 +915,10 @@ loss after the attempt begins is ambiguous because Resend may have accepted it.
 `mail serve` starts one owned HTTPS gateway with HTTP/2:
 
 ```text
-arcane mail serve [--profile <profile>] [--from <verified-sender>] [--app <label>] [--origin <exact-origin>] [--allow-to <addresses>] [--host 0.0.0.0] [--port 8025] [--request-timeout <ms>]
+arcane mail serve [--profile <profile>] [--from <verified-sender>] [--app <label>] [--origin <exact-origin>] [--allow-to <addresses>] [--host 0.0.0.0] [--port 4433] [--request-timeout <ms>]
 ```
 
-The selected `.env.json` profile supplies only the server-side Resend API key;
+The selected `.arcane.env.json` profile supplies only the server-side Resend API key;
 omitting `--profile` selects `mail`.
 
 Add the listener's certificate configuration at the top level of the same file:
@@ -926,15 +932,15 @@ Add the listener's certificate configuration at the top level of the same file:
 ```
 
 Supply an existing PEM certificate chain and its private key. Paths resolve
-relative to `.env.json`, or may be absolute. They are shared across provider
+relative to `.arcane.env.json`, or may be absolute. They are shared across provider
 profiles. Missing TLS settings name the fields to fill in before a listener
 opens; the TLS owner reports PEM file errors. Keep private-key material outside
-tracked source. The SDK repository already ignores `.arcane/` and `.env.json`.
+tracked source. The SDK repository already ignores `.arcane/` and `.arcane.env.json`.
 
 The selected `node-http-server` module negotiates HTTP/2 with HTTP/1.1 fallback
-on the same HTTPS port, default `8025`, with no plain-HTTP listener. Callers use
+on the same HTTPS port, default `4433`, with no plain-HTTP listener. Callers use
 a hostname covered by the certificate, such as
-`https://mail.example.com:8025/v1/mail`; `0.0.0.0` identifies the bind address.
+`https://mail.example.com:4433/v1/mail`; `0.0.0.0` identifies the bind address.
 Restart the gateway after replacing renewed certificate files. Certificate
 issuance and renewal remain with the deployment's certificate owner.
 

package/docs/reference/mail.md

@@ -13,7 +13,7 @@ gateway and is never included in browser or WebAssembly state.
 | `MailTransport.mjs` | Browser, WebView, or compatible Fetch host | Sends one already-persisted request to the configured Arcane gateway with the stable report key as its idempotency key. |
 | `arcane mail send` | Node on the local machine | Reads one complete provider-neutral report from redirected stdin and performs one explicit Resend attempt with a caller-owned idempotency key. |
 | `arcane mail serve` | Node on the configured host | Owns caller verification, protects the provider credential, applies explicitly configured recipient and origin settings, and makes one server-side Resend request. |
-| `arcane mail key ...` | Node on Windows, Linux, or macOS | Stores, inspects, or deletes a Resend API key in the selected `.env.json`. |
+| `arcane mail key ...` | Node on Windows, Linux, or macOS | Stores, inspects, or deletes a Resend API key in the selected `.arcane.env.json`. |
 
 The browser never receives the Resend API key. The gateway never writes that
 key to source, argv, logs, events, fixtures, browser storage, or its public
@@ -56,7 +56,7 @@ browser import while preserving one shared CLI/toolchain implementation.
 Arcane Mail deliberately separates two credentials:
 
 - The **Resend API key** is provider authority. The Node process reads it from
-  `.env.json`. `arcane mail key set [profile]` can store it there through hidden
+  `.arcane.env.json`. `arcane mail key set [profile]` can store it there through hidden
   input; `mail send` and `mail serve` read the selected profile inside that process.
 - The **subscription key** is the application user's subscription credential.
   When present, the browser sends it as `Authorization: Bearer <subscriptionKey>`,
@@ -272,7 +272,7 @@ committed acceptance result.
 
 ## Operate the CLI and gateway
 
-Create `.env.json` in the directory from which the mail command runs, then fill
+Create `.arcane.env.json` in the directory from which the mail command runs, then fill
 in the provider key and the HTTPS certificate paths:
 
 ```json
@@ -283,7 +283,7 @@ in the provider key and the HTTPS certificate paths:
 }
 ```
 
-The SDK repository ignores `.env.json`. Keep the same entry in a consuming
+The SDK repository ignores `.arcane.env.json`. Keep the same entry in a consuming
 project's `.gitignore`. This is a JSON configuration file; the mail commands
 read it directly without copying its contents into `process.env`.
 
@@ -306,12 +306,33 @@ An absent named profile does not fall back to the default key. The profile
 selects Resend provider credentials; it is separate from the incoming
 application name and subscriber key.
 
-Programmatic operations resolve `.env.json` from `options.cwd`, then
+Programmatic operations resolve `.arcane.env.json` from `options.cwd`, then
 `options.workspaceRoot`, then `process.cwd()`, choosing the first supplied
 directory. The CLI uses its invocation directory. There is no upward directory
 search or dependency on a Windows installation directory or temporary-directory
 environment variable.
 
+Keep the configuration in the deployment directory even when the SDK is nested
+below it:
+
+```text
+my-site/
+├── .arcane.env.json
+└── arcane-os-sdk/
+    └── bin/arcane.mjs
+```
+
+Run from `my-site`, for example:
+
+```sh
+node ./arcane-os-sdk/bin/arcane.mjs mail serve --port 4433
+```
+
+The SDK directory does not choose the configuration location. When upgrading
+from SDK 0.22.1 or earlier, rename the existing `.env.json` to
+`.arcane.env.json` in the invocation directory, preserving its contents.
+The loader reads only `.arcane.env.json`.
+
 The existing key commands manage the same file:
 
 ```text
@@ -324,7 +345,7 @@ arcane mail key delete
 non-interactive alternative and rejects a TTY. Each command accepts an optional
 profile argument, defaulting to `mail`. Set and delete preserve other JSON
 settings and profiles; status reports existence without returning the key.
-Results identify `storage: '.env.json'`. An already-absent deletion succeeds
+Results identify `storage: '.arcane.env.json'`. An already-absent deletion succeeds
 with `exists: false`.
 
 Existing Windows Credential Manager records remain untouched. The JSON path
@@ -364,10 +385,10 @@ deadline.
 Start the gateway:
 
 ```text
-npm exec -- arcane mail serve --profile mail --host 0.0.0.0 --port 8025
+npm exec -- arcane mail serve --profile mail --host 0.0.0.0 --port 4433
 ```
 
-The default listener is `0.0.0.0:8025`; `--host` and `--port` select its bind
+The default listener is `0.0.0.0:4433`; `--host` and `--port` select its bind
 address and port. The server can serve callers from multiple domains on the
 same machine. Route the page's `/v1/mail` to this listener, or configure an
 explicit shared endpoint in the caller.
@@ -376,12 +397,12 @@ explicit shared endpoint in the caller.
 `node-http-server` PEM API owns TLS and negotiates HTTP/2 or HTTP/1.1 on the
 same listener. It creates no additional plain-HTTP listener. The returned URL
 uses `https://`; `0.0.0.0` is the bind address, so callers use the deployed
-domain, for example `https://mail.example.com:8025/v1/mail`.
+domain, for example `https://mail.example.com:4433/v1/mail`.
 
 Set `MAIL_TLS_CERT_PATH` to the PEM certificate chain and `MAIL_TLS_KEY_PATH`
 to its PEM private-key file. These top-level settings belong to the listener
 and apply regardless of the selected provider profile. Relative paths resolve
-from the directory containing `.env.json`; absolute paths are also accepted.
+from the directory containing `.arcane.env.json`; absolute paths are also accepted.
 The certificate must cover the hostname callers use. One certificate may
 cover multiple names; the gateway does not require one certificate per calling
 application. Keep private-key files outside tracked source, such as in the

package/docs/reviews/mail-server-purpose-review.md

@@ -1,10 +1,10 @@
-[Roshi's Codex PRIME] The gateway review and its portable credential follow-up apply the same three purpose gates. The gateway removals preserve complete delivery outcomes, configured CORS and recipient policy, and the optional subscription verifier. Mail credentials now belong in the user-selected `.env.json`, with one portable Node implementation for Windows, Linux, and macOS and a compatible Node host as the Android adaptation boundary. The original gateway inventory below uses baseline `f055e05`; the credential follow-up reviews the Windows storage implementation present at SDK `0.18.0`. Commit, package, publication, and actual platform execution outcomes belong to the delivery record rather than to this source-review report.
+[Roshi's Codex PRIME] The gateway review and its portable credential follow-up apply the same three purpose gates. The gateway removals preserve complete delivery outcomes, configured CORS and recipient policy, and the optional subscription verifier. Mail credentials now belong in the user-selected `.arcane.env.json`, with one portable Node implementation for Windows, Linux, and macOS and a compatible Node host as the Android adaptation boundary. The original gateway inventory below uses baseline `f055e05`; the credential follow-up reviews the Windows storage implementation present at SDK `0.18.0`. Commit, package, publication, and actual platform execution outcomes belong to the delivery record rather than to this source-review report.
 
 | Decision | Behavior | Why it matters | Source status at this review |
 | --- | --- | --- | --- |
 | Remove | Loopback-only admission, manual header reconstruction, address/origin normalization, local payload grammar, manual content-length scan, dead queue knobs | These restrict supported use, rewrite supplied values, or repeat work already owned elsewhere. | Removed from the inspected source; naming-only changes carry no runtime claim. |
 | Remove and replace | Local app-key hashes and X-Mail-Key authentication | The selected application plus bearer subscription contract needs an actual verifier, not a local shared-key comparison. | Removed. Optional `verifySubscription` implements the local integration contract; the remote endpoint adapter remains future work. Initial setup without that callback performs no caller authentication. |
-| Remove and replace | Windows-only credential process, native interop, helper timers, environment prerequisites, encoding and input/output limits | They prevent the required portable startup and perform work absent from the selected JSON storage path. | Replaced by direct `.env.json` access. Existing Windows credential records remain untouched. Default and named credential operations remain useful and are preserved. |
+| Remove and replace | Windows-only credential process, native interop, helper timers, environment prerequisites, encoding and input/output limits | They prevent the required portable startup and perform work absent from the selected JSON storage path. | Replaced by direct `.arcane.env.json` access. Existing Windows credential records remain untouched. Default and named credential operations remain useful and are preserved. |
 | Simplify | Exact CORS policy, one configuration resolution, one provider request construction/serialization, optional observation | Preserve the intended result while eliminating repeated parsing, copies, policy structures, and absent-observer work. | Present in inspected source. Explicit nonempty origin lists remain authoritative; otherwise the nominal-domain default applies. |
 | Keep | Configured subscription authentication, explicit recipient policy/fallback, stable idempotency, real cancellation/deadlines, complete provider outcomes, concurrent requests and owned shutdown | These have concrete callers and determine whether mail is sent, retried, reported honestly, or stopped correctly. | Retained. Only a verifier result of `true` permits authenticated delivery; failures and cancellation prevent the provider attempt. |
 
@@ -35,7 +35,7 @@ The latest user-selected boundaries govern this review:
 - Explicit recipient allowlists and error-recipient fallback remain. A configured nonempty allowlist covers resolved `to`, `cc`, and `bcc` recipients; allowing additional provider fields must not bypass the selected recipient policy. With no allowlist, the policy performs no recipient scan. Per-address trimming, lowercasing, and local email grammar do not remain.
 - Caller-selected deadlines, the cancellation adapter, complete provider outcomes, retry classification, stable idempotency, and independently constructed snapshots for emitted observations remain. Shared mutable provider snapshots have not been selected.
 - Remove manual response content-length scanning, duplicate configuration/CORS construction, unobserved event payload creation, unused `allowZero`, and unused CLI queue options.
-- All SDK mail operations require a functional Windows, Linux, and macOS path, with Android adaptation at the host boundary. Read provider configuration directly from an ignored `.env.json`; an operating-system limitation notice does not satisfy the portable requirement. Default profile `mail` uses `RESEND_API_KEY`; other exact names use `MAIL_PROFILES[profile].RESEND_API_KEY`. Missing configuration must identify the file and setting to fill in. Existing Windows records remain untouched, without an automatic read or migration.
+- All SDK mail operations require a functional Windows, Linux, and macOS path, with Android adaptation at the host boundary. Read provider configuration directly from an ignored `.arcane.env.json`; an operating-system limitation notice does not satisfy the portable requirement. Default profile `mail` uses `RESEND_API_KEY`; other exact names use `MAIL_PROFILES[profile].RESEND_API_KEY`. Missing configuration must identify the file and setting to fill in. Existing Windows records remain untouched, without an automatic read or migration.
 
 Source inspection during this report's handoff shows local app/email/sender/API-key format validators and loopback admission removed; origin values retained in one Set; complete provider JSON values or raw response text preserved; template-shaped provider requests no longer required to supply local text/HTML fields; and configuration passed once into `createConfiguredMailHandler`. Observer objects, pending Sets, callback closures, event payload reconstruction, and drain waits are absent when `onEvent` is omitted. An already-cancelled direct send stops before provider payload construction or serialization. Response writing no longer calculates content length. The fixed `/v1/mail` route accepts its query-bearing form, matching the portable endpoint parser. These are source observations, not executed behavior.
 
@@ -52,7 +52,7 @@ Configuration and foundational methods follow. Each baseline name is recorded so
 | `positiveInteger` | Resolves the retry delay; baseline exposes unused `allowZero`. | Y/Y/Y — Simplify. | The uncalled zero branch and its extra option/prose are removed. Current name: `readRetryDelayMs`, which resolves the actual retry-delay setting. |
 | `optionalTimeoutMs` | Reads body/provider deadlines only when supplied. | Y/Y/N — Keep. | Omitting a deadline produces no timer. Node timer-range handling prevents caller-selected delays from changing meaning. Current name remains `optionalTimeoutMs`. |
 | `normalizeRetryAfter` | Error and result constructors keep a usable retry delay. | Y/Y/N — Keep. | Retry scheduling consumes this value. It is control metadata, not a transformation of message content. Current name: `retryDelayOrZero`. |
-| `portNumber` | Startup resolves default or configured port, including ephemeral port zero. | Y/Y/Y — Remove wrapper; retain configuration value. | The HTTP owner handles actual port binding. Preserve default 8025 and explicit port zero; no extra port validator or domain policy is required. |
+| `portNumber` | Startup resolves default or configured port, including ephemeral port zero. | Y/Y/Y — Remove wrapper; retain configuration value. | The HTTP owner handles actual port binding. Use the selected default 4433 and preserve explicit port zero; no extra port validator or domain policy is required. |
 | `validateSignal` | Direct send and server options accept caller cancellation. | Y/Y/Y — Remove wrapper; retain original signal. | Native signal operations already own their contract. Cancellation controllers/listeners and the abortable adapter remain. |
 | `validateApiKey` | Provider configuration supplies the credential used by Resend Fetch. | Y/Y/Y — Remove local format validator. | CLI credential retrieval reports missing provider credentials; Fetch/provider own actual transport validity. Never echo the credential. |
 | `validateAppId` | Validates application identity using the old lowercase-slug grammar. | Y/Y/Y — Remove the grammar and closed-list/equality admission. | Per-request identity matters and remains an ordinary string. Any application may use the shared server. Read the supplied identity for subscription verification without rewriting it; no standalone wrapper is needed solely to restrict spelling. |
@@ -311,7 +311,7 @@ The coupled CLI/browser actions below are necessary to avoid leaving contradicto
 
 | Coupled path/action | Gates and decision | Required result and evidence boundary |
 | --- | --- | --- |
-| `src/mail.mjs` `serveMail` old hidden app-key input and local auth options | Y/Y/Y — Reconciled with the optional verifier contract. | Obsolete shared-app-key prompt/options are removed. Current `serveMailGateway` forwards `options.verifySubscription` to the server and keeps provider credential operations and the provider API key separate. The portable follow-up resolves that provider credential from `.env.json`. |
+| `src/mail.mjs` `serveMail` old hidden app-key input and local auth options | Y/Y/Y — Reconciled with the optional verifier contract. | Obsolete shared-app-key prompt/options are removed. Current `serveMailGateway` forwards `options.verifySubscription` to the server and keeps provider credential operations and the provider API key separate. The portable follow-up resolves that provider credential from `.arcane.env.json`. |
 | `src/mail.mjs` `recipientList` and origin list preparation | Y/Y/Y — Remove redundant rewriting, preserve configured policy values. | Gateway and CLI must not disagree about preserved recipients/origins. An exact allowlist is still an intentional policy. |
 | `src/mail.mjs` `withoutMailCredentials` | N/N/Y for recursive payload-key redaction — Remove. | It recursively traversed/copied complete results and deleted any content property named `apiKey` or `appKey`, including ordinary user payload fields. Keep actual transport credentials outside constructed public results at their owning boundary; do not rewrite the report based on property names. Source inspection shows this traversal removed. |
 | `src/mail.mjs` `completeSendFailure` | Y/Y/Y — Remove helper after preserving the complete result directly. | Failure output still contains the provider result, or a narrow wrapper for a non-object injected result. No recursive copying/redaction pass remains. |
@@ -378,7 +378,7 @@ Existing native credential records are neither read nor changed.
 | `setMailCredential`, `readMailCredential`, `getMailCredentialStatus`, `deleteMailCredential` | Y/Y/Y | Preserve all four operations and replace their implementation. Explicit set/delete update only the selected credential field while preserving other settings and profiles; read returns the selected key or null; status reports existence. File access uses portable Node APIs. |
 | `mailCredentialOptions`, `readMailProviderKey` | Y/Y/Y | Keep shared command configuration and consolidate the real send/serve duplicate key-read error path. Remove Windows runner, helper directory, and helper timeout forwarding. Missing configuration names the exact JSON setting and file before opening a listener or attempting delivery. |
 | CLI required profile flag and omitted invocation directory | Y/Y/Y | Make the profile optional with default `mail`, retaining explicit profiles. Forward the invocation directory through every mail operation, so the CLI reads the operator's selected file. Preserve hidden/stdin key entry and existing send/serve lifecycle. |
-| Repository and workspace-template `.gitignore` entry | Y/Y/N | Keep `.env.json` out of source control in this checkout and newly generated workspaces. The populated local file is outside the committed and published change. |
+| Repository and workspace-template `.gitignore` entry | Y/Y/N | Keep `.arcane.env.json` out of source control in this checkout and newly generated workspaces. The populated local file is outside the committed and published change. |
 
 The credential path performs one file read per selected operation and one write
 only for an explicit set or a deletion that finds a credential. Startup reads
@@ -395,14 +395,14 @@ cancellation before writes, and CLI defaults. Local tests and checks were not ru
 ## HTTPS and HTTP/2 follow-up
 
 The user explicitly selected HTTPS with HTTP/2. The mail listener remains on
-its dedicated configured port, default 8025, with the published
+its dedicated configured port, now default 4433, with the published
 `node-http-server` module owning TLS, protocol negotiation and listener/session
 shutdown. This increment preserves the provider attempt, report content,
 subscription callback, sender selection, recipient configuration and cancellation.
 
 | Method or action | Gates | Decision, callers, and concrete purpose |
 | --- | --- | --- |
-| `readMailServerSettings` | Y/Y/N | Read the same `.env.json` once for server startup, select the existing provider profile and resolve the two shared PEM path settings relative to that file. This avoids a second configuration read and platform-specific credential or certificate processes. |
+| `readMailServerSettings` | Y/Y/N | Read the same `.arcane.env.json` once for server startup, select the existing provider profile and resolve the two shared PEM path settings relative to that file. This avoids a second configuration read and platform-specific credential or certificate processes. |
 | `readMailProviderKey` and `serveMailGateway` | Y/Y/N | Preserve the existing credential-injection interface and missing-provider error while consuming the already-read startup key. Require the selected TLS pair before binding; forward only the paths to the listener. Direct provider sending and key CRUD remain unchanged. |
 | `MAIL_TLS_CERT_PATH` and `MAIL_TLS_KEY_PATH` | Y/Y/N | Clear top-level names identify certificate and private-key file paths for one listener, independently of any provider profile or calling application. Missing settings and unusable JSON values name the field without printing its content. |
 | `startResendMailServer` TLS options | Y/Y/N | Add `certPath` and `keyPath` through the module's published PEM API. HTTPS-only mode creates one listener with HTTP/2 and HTTP/1.1 negotiation on the selected port. This internal source integration retains its existing HTTP behavior when neither path is supplied; it is not an npm package export. The public toolchain mail operation requires the JSON pair. |
@@ -423,3 +423,37 @@ JSON paths and missing TLS settings. Synthetic TLS selection is not evidence of
 an encrypted handshake. No local tests, checks, server launch, real TLS
 negotiation or provider send were performed for this follow-up review. Selected
 package and publication results belong to the delivery record.
+
+## Main mail port follow-up
+
+The user selected 4433 as the main mail-server port. Both the CLI's omitted-port
+setting and the server's programmatic default now select 4433. Explicit ports,
+including ephemeral port zero, continue through the existing configuration.
+
+The port setting passes Y/Y/N: the listener needs a bind port, deployments need
+an override, and removing either would lose required behavior. Changing the two
+defaults adds no runtime work or helper. TLS negotiation, the returned endpoint
+and the occupied-port message already use the selected port. Existing test
+source was updated for the omitted-port path; explicit-port cases were retained.
+No local tests, checks or server launch were performed for this increment.
+
+## Deployment configuration filename follow-up
+
+The user selected `.arcane.env.json` in the command's invocation directory,
+independently of a nested SDK directory. `mailCredentialLocation` remains the
+single filename owner for key operations, direct sending and server startup;
+`mailCredentialStatus` reports the same new name. The directory precedence and
+relative certificate-path resolution remain unchanged.
+
+The filename change passes Y/Y/N: its name identifies Arcane configuration,
+deployment ownership makes the location useful, and removing that configuration
+would lose the provider and TLS settings. Additional filename fallbacks, upward
+searches and automatic migrations fail N/N/Y and are omitted. This rename adds
+no read, timer, helper or per-request work. Existing deployments rename their
+file with its contents intact when adopting SDK 0.23.0. Repository and generated
+workspace ignores include the new name and retain the old entry for existing
+private files. Only the intended filename and status contract change; mail
+payloads, profiles, other settings and lifecycle remain unchanged.
+
+Existing credential and CLI test fixtures now use the selected name. Source
+and diff were reviewed; local tests, checks and server execution were not run.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",

package/src/cli/main.mjs

@@ -85,8 +85,8 @@ Usage:
   ${CLI_NAME} mail key status [profile]
   ${CLI_NAME} mail key delete [profile]
   ${CLI_NAME} mail send [--profile <profile>] [--from <address>] --report-key <id> --report-stdin [--request-timeout <ms>]
-  ${CLI_NAME} mail serve [--profile <profile>] [--from <address>] [--app <label>] [--origin <origin>] [--allow-to <addresses>] [--host 0.0.0.0] [--port 8025] [--request-timeout <ms>]
-    HTTPS/HTTP2; .env.json supplies RESEND_API_KEY, MAIL_TLS_CERT_PATH, and MAIL_TLS_KEY_PATH.
+  ${CLI_NAME} mail serve [--profile <profile>] [--from <address>] [--app <label>] [--origin <origin>] [--allow-to <addresses>] [--host 0.0.0.0] [--port 4433] [--request-timeout <ms>]
+    HTTPS/HTTP2; .arcane.env.json supplies RESEND_API_KEY, MAIL_TLS_CERT_PATH, and MAIL_TLS_KEY_PATH.
 
 Development:
   --public                      Bind dev to all IPv4 interfaces (0.0.0.0) and print network URLs.
@@ -698,7 +698,7 @@ function operationOptions(command,parsed,cwd){
                 origin:values.origin,
                 allowTo:values['allow-to'],
                 host:values.host??'0.0.0.0',
-                port:readPort(values.port,8025),
+                port:readPort(values.port,4433),
                 requestTimeout:readMailRequestTimeout(values['request-timeout']),
             };
         }

package/src/mail-credentials.mjs

@@ -11,7 +11,7 @@ export function mailCredentialLocation(options={}){
         throw new ArcaneError(ERROR_CODES.usage,'Mail credential profile must be a nonempty string.');
     }
     return {
-        filePath:path.resolve(options.cwd??options.workspaceRoot??process.cwd(),'.env.json'),
+        filePath:path.resolve(options.cwd??options.workspaceRoot??process.cwd(),'.arcane.env.json'),
         profile,
         setting:profile==='mail'?'RESEND_API_KEY':`MAIL_PROFILES[${JSON.stringify(profile)}].RESEND_API_KEY`
     };
@@ -79,7 +79,7 @@ function configuredMailKey(settings,location){
 }
 
 function mailCredentialStatus(profile,exists){
-    return {profile,provider:'resend',storage:'.env.json',exists};
+    return {profile,provider:'resend',storage:'.arcane.env.json',exists};
 }
 
 export async function setMailCredential(options={}){

package/src/mail-server.mjs

@@ -113,7 +113,7 @@ function resolveMailServerConfiguration(options={}){
         host:options.host??'0.0.0.0',
         callerAuthentication:options.verifySubscription?'subscription':'none',
         onEvent:options.onEvent,
-        port:options.port??8025,
+        port:options.port??4433,
         providerTimeoutMs:optionalTimeoutMs(options.providerTimeoutMs,'providerTimeoutMs'),
         requestIdFactory:options.requestIdFactory??randomUUID,
         retryableDelayMs:readRetryDelayMs(options.retryableDelayMs),

package/src/templates/workspace-template.mjs

@@ -133,6 +133,7 @@ appropriate.
         'build/',
         '.arcane/',
         '.env.json',
+        '.arcane.env.json',
         '*.log',
         ''
     ].join('\n'));