create-volt 0.54.0 → 0.55.1

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `create-volt` are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and this project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [0.55.1] - 2026-07-05
+
+### Security
+- **Bump the scaffold's nodemailer pin `^6.10.1` → `^9.0.3`.** nodemailer <= 9.0.0
+  carries several high-severity advisories (email to an unintended domain, SMTP/CRLF
+  command injection, addressparser DoS, improper TLS validation, file-read/SSRF).
+  Apps that enable the mailer add-on now install the fixed 9.x — same
+  createTransport/sendMail/verify API, no code change.
+
+## [0.55.0] - 2026-07-05
+
+### Added
+- **Inline "Test" buttons for SMTP + AI in the config wizard** — the result shows
+  right next to each button. `/setup/test-smtp` verifies connection/auth (nodemailer,
+  or a TCP reachability fallback); `/setup/test-ai` does a 1-token live call to the
+  provider key or the hosted gateway. The DB test result is inline now too.
+
 ## [0.54.0] - 2026-07-04
 
 ### Added
@@ -703,6 +720,8 @@ All notable changes to `create-volt` are documented here. The format follows
   watching and full-page hot reload. Supports `--skip-install` and `--force`,
   and auto-detects npm / pnpm / yarn / bun for the install step.
 
+[0.55.1]: https://github.com/MIR-2025/volt/releases/tag/v0.55.1
+[0.55.0]: https://github.com/MIR-2025/volt/releases/tag/v0.55.0
 [0.54.0]: https://github.com/MIR-2025/volt/releases/tag/v0.54.0
 [0.53.0]: https://github.com/MIR-2025/volt/releases/tag/v0.53.0
 [0.52.0]: https://github.com/MIR-2025/volt/releases/tag/v0.52.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-volt",
-  "version": "0.54.0",
+  "version": "0.55.1",
   "description": "Scaffold a new Volt app — no-build, signals-based UI with Socket.io hot reload.",
   "type": "module",
   "bin": {

package/templates/blog/server.js

@@ -42,7 +42,7 @@ function configPort() {
   const env = readEnvFile(); // --edit runs before loadEnv(), so read the file too
   return cliPort() || Number(process.env.CONFIG_PORT) || Number(env.CONFIG_PORT) || CONFIG_DEFAULT_PORT;
 }
-const PKG_VERSIONS = { mongodb: "^6.21.0", mysql2: "^3.22.5", pg: "^8.22.0", nodemailer: "^6.10.1", marked: "^18.0.5", busboy: "^1.6.0", "@aws-sdk/client-s3": "^3.1075.0" };
+const PKG_VERSIONS = { mongodb: "^6.21.0", mysql2: "^3.22.5", pg: "^8.22.0", nodemailer: "^9.0.3", marked: "^18.0.5", busboy: "^1.6.0", "@aws-sdk/client-s3": "^3.1075.0" };
 const LIB_FILE = { db: "store.js", mailer: "mailer.js", auth: "auth.js", realtime: "realtime.js", pages: "pages.js", posts: "posts.js", media: "media.js" };
 
 // --- tiny .env loader (no dependency); never overrides an existing env var ---
@@ -564,6 +564,104 @@ function startSetup() {
       });
       return;
     }
+    // verify SMTP creds (form values merged over the saved .env) — auth check via
+    // nodemailer if available, else a TCP reachability check.
+    if (req.method === "POST" && p === "/setup/test-smtp") {
+      let body = "";
+      req.on("data", (c) => (body += c));
+      req.on("end", async () => {
+        res.setHeader("Content-Type", "application/json");
+        const done = (o) => res.end(JSON.stringify(o));
+        try {
+          const { env = {} } = JSON.parse(body || "{}");
+          const cfg = { ...readEnvFile(), ...env };
+          const url = cfg.SMTP_URL;
+          const host = cfg.SMTP_HOST;
+          if (!url && !host) return done({ ok: false, error: "no SMTP config (set SMTP_URL or SMTP_HOST)" });
+          let nodemailer;
+          try {
+            nodemailer = (await import("nodemailer")).default;
+          } catch {
+            /* not installed */
+          }
+          if (nodemailer) {
+            const transport = url
+              ? nodemailer.createTransport(url)
+              : nodemailer.createTransport({ host, port: Number(cfg.SMTP_PORT) || 587, secure: /^(1|true|yes|on)$/i.test(cfg.SMTP_SECURE || "") || Number(cfg.SMTP_PORT) === 465, auth: cfg.SMTP_USER ? { user: cfg.SMTP_USER, pass: cfg.SMTP_PASS } : undefined });
+            await transport.verify();
+            return done({ ok: true, detail: "connection + auth OK" });
+          }
+          const net = await import("node:net");
+          let h = host;
+          let prt = Number(cfg.SMTP_PORT) || 587;
+          if (url) {
+            const u = new URL(url.replace(/^smtps?:\/\//, "http://"));
+            h = u.hostname;
+            prt = Number(u.port) || (url.startsWith("smtps") ? 465 : 587);
+          }
+          await new Promise((resolve, reject) => {
+            const s = net.connect(prt, h, () => {
+              s.end();
+              resolve();
+            });
+            s.setTimeout(5000, () => {
+              s.destroy();
+              reject(new Error("timeout"));
+            });
+            s.on("error", reject);
+          });
+          done({ ok: true, detail: `${h}:${prt} reachable — enable the mailer add-on for a full auth test` });
+        } catch (e) {
+          done({ ok: false, error: e.message });
+        }
+      });
+      return;
+    }
+    // verify the AI provider key (or gateway token) with a 1-token live call.
+    if (req.method === "POST" && p === "/setup/test-ai") {
+      let body = "";
+      req.on("data", (c) => (body += c));
+      req.on("end", async () => {
+        res.setHeader("Content-Type", "application/json");
+        const done = (o) => res.end(JSON.stringify(o));
+        try {
+          const { env = {} } = JSON.parse(body || "{}");
+          const cfg = { ...readEnvFile(), ...env };
+          const provider = cfg.AI_PROVIDER || "anthropic";
+          const key = { anthropic: cfg.ANTHROPIC_API_KEY, openai: cfg.OPENAI_API_KEY, gemini: cfg.GEMINI_API_KEY }[provider];
+          let url, headers, payload, label;
+          if (key) {
+            label = provider + " key";
+            if (provider === "anthropic") {
+              url = "https://api.anthropic.com/v1/messages";
+              headers = { "x-api-key": key, "anthropic-version": "2023-06-01", "content-type": "application/json" };
+              payload = { model: cfg.AI_MODEL || "claude-haiku-4-5", max_tokens: 1, messages: [{ role: "user", content: "hi" }] };
+            } else if (provider === "openai") {
+              url = "https://api.openai.com/v1/chat/completions";
+              headers = { authorization: "Bearer " + key, "content-type": "application/json" };
+              payload = { model: cfg.AI_MODEL || "gpt-4o-mini", max_tokens: 1, messages: [{ role: "user", content: "hi" }] };
+            } else {
+              url = `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${key}`;
+              headers = { "content-type": "application/json" };
+              payload = { contents: [{ parts: [{ text: "hi" }] }] };
+            }
+          } else if (cfg.VOLT_AI_TOKEN) {
+            label = "hosted gateway";
+            url = cfg.VOLT_AI_GATEWAY || "https://voltjs.com/api/ai";
+            headers = { authorization: "Bearer " + cfg.VOLT_AI_TOKEN, "content-type": "application/json" };
+            payload = { model: cfg.AI_MODEL || "claude-haiku-4-5", max_tokens: 1, messages: [{ role: "user", content: "hi" }] };
+          } else {
+            return done({ ok: false, error: "no AI key or VOLT_AI_TOKEN set" });
+          }
+          const r = await fetch(url, { method: "POST", headers, body: JSON.stringify(payload) });
+          if (r.ok) return done({ ok: true, detail: `${label} works` });
+          done({ ok: false, error: `${r.status}: ${(await r.text()).slice(0, 120)}` });
+        } catch (e) {
+          done({ ok: false, error: e.message });
+        }
+      });
+      return;
+    }
     if (req.method === "POST" && p === "/setup/apply") {
       let body = "";
       req.on("data", (c) => (body += c));

package/templates/blog/setup/setup.js

@@ -39,6 +39,12 @@ const state = signal({
 const set = (patch) => state({ ...state(), ...patch });
 const toggle = (n) => state({ ...state(), addons: { ...state().addons, [n]: !state().addons[n] } });
 const status = signal("");
+// per-test inline results (shown right next to each Test button)
+const dbTest = signal("");
+const smtpTest = signal("");
+const aiTest = signal("");
+const testResult = (m) => (m ? html`<span class="small ms-2 ${m.startsWith("✓") ? "text-success" : m.startsWith("✗") ? "text-danger" : "text-muted"}">${m}</span>` : "");
+const envObj = () => Object.fromEntries(env().split("\n").filter((l) => /^[A-Za-z0-9_]+=/.test(l)).map((l) => { const i = l.indexOf("="); return [l.slice(0, i), l.slice(i + 1)]; }));
 
 // selected add-ons, dependencies expanded, in display order
 function effective(s) {
@@ -149,12 +155,30 @@ async function testDb() {
   } else if (s.dbDriver === "mysql" || s.dbDriver === "postgres") {
     e.DATABASE_URL = s.dbUrl;
   }
-  status("Testing connection…");
+  dbTest("Testing…");
   try {
     const r = await (await fetch("/setup/test-db", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ env: e }) })).json();
-    status(r.ok ? `✓ Connected (${r.driver}).` : `✗ ${r.error}`);
+    dbTest(r.ok ? `✓ Connected (${r.driver})` : `✗ ${r.error}`);
   } catch {
-    status("Network error testing connection.");
+    dbTest("✗ network error");
+  }
+}
+async function testSmtp() {
+  smtpTest("Testing…");
+  try {
+    const r = await (await fetch("/setup/test-smtp", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ env: envObj() }) })).json();
+    smtpTest(r.ok ? `✓ ${r.detail || "OK"}` : `✗ ${r.error}`);
+  } catch {
+    smtpTest("✗ network error");
+  }
+}
+async function testAi() {
+  aiTest("Testing…");
+  try {
+    const r = await (await fetch("/setup/test-ai", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ env: envObj() }) })).json();
+    aiTest(r.ok ? `✓ ${r.detail || "OK"}` : `✗ ${r.error}`);
+  } catch {
+    aiTest("✗ network error");
   }
 }
 
@@ -221,7 +245,7 @@ const dbSettings = () =>
         : dbDriver() === "mysql" || dbDriver() === "postgres"
           ? field("DATABASE_URL", "dbUrl", dbDriver() + "://user:pass@host/db")
           : null}
-    ${() => (dbDriver() !== "memory" ? html`<button class="btn btn-sm btn-outline-secondary mb-2" onclick=${testDb}>Test connection</button>` : null)}`;
+    ${() => (dbDriver() !== "memory" ? html`<button class="btn btn-sm btn-outline-secondary mb-2" onclick=${testDb}>Test connection</button>${() => testResult(dbTest())}` : null)}`;
 
 const mediaSettings = () =>
   html`<div class="mb-2">
@@ -270,6 +294,7 @@ const aiSettings = () =>
       ${field("API key", "aiKey", "sk-…")}
       <div class="small text-muted mt-2 mb-1">— or — no key? Use the hosted tier (free, capped, then pay-as-you-go):</div>
       ${() => (state().aiToken ? html`<div class="small">Hosted token: <code>${state().aiToken.slice(0, 14)}…</code> <button class="btn btn-sm btn-link p-0 ms-1" onclick=${() => set({ aiToken: "" })}>clear</button></div>` : html`<button class="btn btn-sm btn-outline-secondary" onclick=${genToken}>Generate a free hosted token</button>`)}
+      <div class="mt-2"><button class="btn btn-sm btn-outline-secondary" onclick=${testAi}>Test AI</button>${() => testResult(aiTest())}</div>
     </div>
   </details>`;
 
@@ -417,7 +442,7 @@ const configView = () =>
       ${field("SITE_NAME", "siteName", "My Site")}
       ${() => (hasContent() ? themePicker() : null)}
       ${() => (hasDb() ? dbSettings() : null)}
-      ${() => (hasMailer() ? html`${field("SMTP_URL (optional)", "smtpUrl", "smtp://user:pass@smtp.host:587")}${field("MAIL_FROM", "mailFrom", "App <no-reply@you.com>")}` : null)}
+      ${() => (hasMailer() ? html`${field("SMTP_URL (optional)", "smtpUrl", "smtp://user:pass@smtp.host:587")}${field("MAIL_FROM", "mailFrom", "App <no-reply@you.com>")}<div class="mb-2"><button class="btn btn-sm btn-outline-secondary" onclick=${testSmtp}>Test SMTP</button>${() => testResult(smtpTest())}</div>` : null)}
       ${() => (hasMedia() ? mediaSettings() : null)}
       ${aiSettings()}
       ${field("SITE_URL (optional — absolute links, RSS, canonical)", "siteUrl", "https://example.com")}

package/templates/default/server.js

@@ -42,7 +42,7 @@ function configPort() {
   const env = readEnvFile(); // --edit runs before loadEnv(), so read the file too
   return cliPort() || Number(process.env.CONFIG_PORT) || Number(env.CONFIG_PORT) || CONFIG_DEFAULT_PORT;
 }
-const PKG_VERSIONS = { mongodb: "^6.21.0", mysql2: "^3.22.5", pg: "^8.22.0", nodemailer: "^6.10.1", marked: "^18.0.5", busboy: "^1.6.0", "@aws-sdk/client-s3": "^3.1075.0" };
+const PKG_VERSIONS = { mongodb: "^6.21.0", mysql2: "^3.22.5", pg: "^8.22.0", nodemailer: "^9.0.3", marked: "^18.0.5", busboy: "^1.6.0", "@aws-sdk/client-s3": "^3.1075.0" };
 const LIB_FILE = { db: "store.js", mailer: "mailer.js", auth: "auth.js", realtime: "realtime.js", pages: "pages.js", posts: "posts.js", media: "media.js" };
 
 // --- tiny .env loader (no dependency); never overrides an existing env var ---
@@ -564,6 +564,104 @@ function startSetup() {
       });
       return;
     }
+    // verify SMTP creds (form values merged over the saved .env) — auth check via
+    // nodemailer if available, else a TCP reachability check.
+    if (req.method === "POST" && p === "/setup/test-smtp") {
+      let body = "";
+      req.on("data", (c) => (body += c));
+      req.on("end", async () => {
+        res.setHeader("Content-Type", "application/json");
+        const done = (o) => res.end(JSON.stringify(o));
+        try {
+          const { env = {} } = JSON.parse(body || "{}");
+          const cfg = { ...readEnvFile(), ...env };
+          const url = cfg.SMTP_URL;
+          const host = cfg.SMTP_HOST;
+          if (!url && !host) return done({ ok: false, error: "no SMTP config (set SMTP_URL or SMTP_HOST)" });
+          let nodemailer;
+          try {
+            nodemailer = (await import("nodemailer")).default;
+          } catch {
+            /* not installed */
+          }
+          if (nodemailer) {
+            const transport = url
+              ? nodemailer.createTransport(url)
+              : nodemailer.createTransport({ host, port: Number(cfg.SMTP_PORT) || 587, secure: /^(1|true|yes|on)$/i.test(cfg.SMTP_SECURE || "") || Number(cfg.SMTP_PORT) === 465, auth: cfg.SMTP_USER ? { user: cfg.SMTP_USER, pass: cfg.SMTP_PASS } : undefined });
+            await transport.verify();
+            return done({ ok: true, detail: "connection + auth OK" });
+          }
+          const net = await import("node:net");
+          let h = host;
+          let prt = Number(cfg.SMTP_PORT) || 587;
+          if (url) {
+            const u = new URL(url.replace(/^smtps?:\/\//, "http://"));
+            h = u.hostname;
+            prt = Number(u.port) || (url.startsWith("smtps") ? 465 : 587);
+          }
+          await new Promise((resolve, reject) => {
+            const s = net.connect(prt, h, () => {
+              s.end();
+              resolve();
+            });
+            s.setTimeout(5000, () => {
+              s.destroy();
+              reject(new Error("timeout"));
+            });
+            s.on("error", reject);
+          });
+          done({ ok: true, detail: `${h}:${prt} reachable — enable the mailer add-on for a full auth test` });
+        } catch (e) {
+          done({ ok: false, error: e.message });
+        }
+      });
+      return;
+    }
+    // verify the AI provider key (or gateway token) with a 1-token live call.
+    if (req.method === "POST" && p === "/setup/test-ai") {
+      let body = "";
+      req.on("data", (c) => (body += c));
+      req.on("end", async () => {
+        res.setHeader("Content-Type", "application/json");
+        const done = (o) => res.end(JSON.stringify(o));
+        try {
+          const { env = {} } = JSON.parse(body || "{}");
+          const cfg = { ...readEnvFile(), ...env };
+          const provider = cfg.AI_PROVIDER || "anthropic";
+          const key = { anthropic: cfg.ANTHROPIC_API_KEY, openai: cfg.OPENAI_API_KEY, gemini: cfg.GEMINI_API_KEY }[provider];
+          let url, headers, payload, label;
+          if (key) {
+            label = provider + " key";
+            if (provider === "anthropic") {
+              url = "https://api.anthropic.com/v1/messages";
+              headers = { "x-api-key": key, "anthropic-version": "2023-06-01", "content-type": "application/json" };
+              payload = { model: cfg.AI_MODEL || "claude-haiku-4-5", max_tokens: 1, messages: [{ role: "user", content: "hi" }] };
+            } else if (provider === "openai") {
+              url = "https://api.openai.com/v1/chat/completions";
+              headers = { authorization: "Bearer " + key, "content-type": "application/json" };
+              payload = { model: cfg.AI_MODEL || "gpt-4o-mini", max_tokens: 1, messages: [{ role: "user", content: "hi" }] };
+            } else {
+              url = `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${key}`;
+              headers = { "content-type": "application/json" };
+              payload = { contents: [{ parts: [{ text: "hi" }] }] };
+            }
+          } else if (cfg.VOLT_AI_TOKEN) {
+            label = "hosted gateway";
+            url = cfg.VOLT_AI_GATEWAY || "https://voltjs.com/api/ai";
+            headers = { authorization: "Bearer " + cfg.VOLT_AI_TOKEN, "content-type": "application/json" };
+            payload = { model: cfg.AI_MODEL || "claude-haiku-4-5", max_tokens: 1, messages: [{ role: "user", content: "hi" }] };
+          } else {
+            return done({ ok: false, error: "no AI key or VOLT_AI_TOKEN set" });
+          }
+          const r = await fetch(url, { method: "POST", headers, body: JSON.stringify(payload) });
+          if (r.ok) return done({ ok: true, detail: `${label} works` });
+          done({ ok: false, error: `${r.status}: ${(await r.text()).slice(0, 120)}` });
+        } catch (e) {
+          done({ ok: false, error: e.message });
+        }
+      });
+      return;
+    }
     if (req.method === "POST" && p === "/setup/apply") {
       let body = "";
       req.on("data", (c) => (body += c));

package/templates/default/setup/setup.js

@@ -39,6 +39,12 @@ const state = signal({
 const set = (patch) => state({ ...state(), ...patch });
 const toggle = (n) => state({ ...state(), addons: { ...state().addons, [n]: !state().addons[n] } });
 const status = signal("");
+// per-test inline results (shown right next to each Test button)
+const dbTest = signal("");
+const smtpTest = signal("");
+const aiTest = signal("");
+const testResult = (m) => (m ? html`<span class="small ms-2 ${m.startsWith("✓") ? "text-success" : m.startsWith("✗") ? "text-danger" : "text-muted"}">${m}</span>` : "");
+const envObj = () => Object.fromEntries(env().split("\n").filter((l) => /^[A-Za-z0-9_]+=/.test(l)).map((l) => { const i = l.indexOf("="); return [l.slice(0, i), l.slice(i + 1)]; }));
 
 // selected add-ons, dependencies expanded, in display order
 function effective(s) {
@@ -149,12 +155,30 @@ async function testDb() {
   } else if (s.dbDriver === "mysql" || s.dbDriver === "postgres") {
     e.DATABASE_URL = s.dbUrl;
   }
-  status("Testing connection…");
+  dbTest("Testing…");
   try {
     const r = await (await fetch("/setup/test-db", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ env: e }) })).json();
-    status(r.ok ? `✓ Connected (${r.driver}).` : `✗ ${r.error}`);
+    dbTest(r.ok ? `✓ Connected (${r.driver})` : `✗ ${r.error}`);
   } catch {
-    status("Network error testing connection.");
+    dbTest("✗ network error");
+  }
+}
+async function testSmtp() {
+  smtpTest("Testing…");
+  try {
+    const r = await (await fetch("/setup/test-smtp", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ env: envObj() }) })).json();
+    smtpTest(r.ok ? `✓ ${r.detail || "OK"}` : `✗ ${r.error}`);
+  } catch {
+    smtpTest("✗ network error");
+  }
+}
+async function testAi() {
+  aiTest("Testing…");
+  try {
+    const r = await (await fetch("/setup/test-ai", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ env: envObj() }) })).json();
+    aiTest(r.ok ? `✓ ${r.detail || "OK"}` : `✗ ${r.error}`);
+  } catch {
+    aiTest("✗ network error");
   }
 }
 
@@ -221,7 +245,7 @@ const dbSettings = () =>
         : dbDriver() === "mysql" || dbDriver() === "postgres"
           ? field("DATABASE_URL", "dbUrl", dbDriver() + "://user:pass@host/db")
           : null}
-    ${() => (dbDriver() !== "memory" ? html`<button class="btn btn-sm btn-outline-secondary mb-2" onclick=${testDb}>Test connection</button>` : null)}`;
+    ${() => (dbDriver() !== "memory" ? html`<button class="btn btn-sm btn-outline-secondary mb-2" onclick=${testDb}>Test connection</button>${() => testResult(dbTest())}` : null)}`;
 
 const mediaSettings = () =>
   html`<div class="mb-2">
@@ -270,6 +294,7 @@ const aiSettings = () =>
       ${field("API key", "aiKey", "sk-…")}
       <div class="small text-muted mt-2 mb-1">— or — no key? Use the hosted tier (free, capped, then pay-as-you-go):</div>
       ${() => (state().aiToken ? html`<div class="small">Hosted token: <code>${state().aiToken.slice(0, 14)}…</code> <button class="btn btn-sm btn-link p-0 ms-1" onclick=${() => set({ aiToken: "" })}>clear</button></div>` : html`<button class="btn btn-sm btn-outline-secondary" onclick=${genToken}>Generate a free hosted token</button>`)}
+      <div class="mt-2"><button class="btn btn-sm btn-outline-secondary" onclick=${testAi}>Test AI</button>${() => testResult(aiTest())}</div>
     </div>
   </details>`;
 
@@ -417,7 +442,7 @@ const configView = () =>
       ${field("SITE_NAME", "siteName", "My Site")}
       ${() => (hasContent() ? themePicker() : null)}
       ${() => (hasDb() ? dbSettings() : null)}
-      ${() => (hasMailer() ? html`${field("SMTP_URL (optional)", "smtpUrl", "smtp://user:pass@smtp.host:587")}${field("MAIL_FROM", "mailFrom", "App <no-reply@you.com>")}` : null)}
+      ${() => (hasMailer() ? html`${field("SMTP_URL (optional)", "smtpUrl", "smtp://user:pass@smtp.host:587")}${field("MAIL_FROM", "mailFrom", "App <no-reply@you.com>")}<div class="mb-2"><button class="btn btn-sm btn-outline-secondary" onclick=${testSmtp}>Test SMTP</button>${() => testResult(smtpTest())}</div>` : null)}
       ${() => (hasMedia() ? mediaSettings() : null)}
       ${aiSettings()}
       ${field("SITE_URL (optional — absolute links, RSS, canonical)", "siteUrl", "https://example.com")}

package/templates/docs/server.js

@@ -42,7 +42,7 @@ function configPort() {
   const env = readEnvFile(); // --edit runs before loadEnv(), so read the file too
   return cliPort() || Number(process.env.CONFIG_PORT) || Number(env.CONFIG_PORT) || CONFIG_DEFAULT_PORT;
 }
-const PKG_VERSIONS = { mongodb: "^6.21.0", mysql2: "^3.22.5", pg: "^8.22.0", nodemailer: "^6.10.1", marked: "^18.0.5", busboy: "^1.6.0", "@aws-sdk/client-s3": "^3.1075.0" };
+const PKG_VERSIONS = { mongodb: "^6.21.0", mysql2: "^3.22.5", pg: "^8.22.0", nodemailer: "^9.0.3", marked: "^18.0.5", busboy: "^1.6.0", "@aws-sdk/client-s3": "^3.1075.0" };
 const LIB_FILE = { db: "store.js", mailer: "mailer.js", auth: "auth.js", realtime: "realtime.js", pages: "pages.js", posts: "posts.js", media: "media.js" };
 
 // --- tiny .env loader (no dependency); never overrides an existing env var ---
@@ -564,6 +564,104 @@ function startSetup() {
       });
       return;
     }
+    // verify SMTP creds (form values merged over the saved .env) — auth check via
+    // nodemailer if available, else a TCP reachability check.
+    if (req.method === "POST" && p === "/setup/test-smtp") {
+      let body = "";
+      req.on("data", (c) => (body += c));
+      req.on("end", async () => {
+        res.setHeader("Content-Type", "application/json");
+        const done = (o) => res.end(JSON.stringify(o));
+        try {
+          const { env = {} } = JSON.parse(body || "{}");
+          const cfg = { ...readEnvFile(), ...env };
+          const url = cfg.SMTP_URL;
+          const host = cfg.SMTP_HOST;
+          if (!url && !host) return done({ ok: false, error: "no SMTP config (set SMTP_URL or SMTP_HOST)" });
+          let nodemailer;
+          try {
+            nodemailer = (await import("nodemailer")).default;
+          } catch {
+            /* not installed */
+          }
+          if (nodemailer) {
+            const transport = url
+              ? nodemailer.createTransport(url)
+              : nodemailer.createTransport({ host, port: Number(cfg.SMTP_PORT) || 587, secure: /^(1|true|yes|on)$/i.test(cfg.SMTP_SECURE || "") || Number(cfg.SMTP_PORT) === 465, auth: cfg.SMTP_USER ? { user: cfg.SMTP_USER, pass: cfg.SMTP_PASS } : undefined });
+            await transport.verify();
+            return done({ ok: true, detail: "connection + auth OK" });
+          }
+          const net = await import("node:net");
+          let h = host;
+          let prt = Number(cfg.SMTP_PORT) || 587;
+          if (url) {
+            const u = new URL(url.replace(/^smtps?:\/\//, "http://"));
+            h = u.hostname;
+            prt = Number(u.port) || (url.startsWith("smtps") ? 465 : 587);
+          }
+          await new Promise((resolve, reject) => {
+            const s = net.connect(prt, h, () => {
+              s.end();
+              resolve();
+            });
+            s.setTimeout(5000, () => {
+              s.destroy();
+              reject(new Error("timeout"));
+            });
+            s.on("error", reject);
+          });
+          done({ ok: true, detail: `${h}:${prt} reachable — enable the mailer add-on for a full auth test` });
+        } catch (e) {
+          done({ ok: false, error: e.message });
+        }
+      });
+      return;
+    }
+    // verify the AI provider key (or gateway token) with a 1-token live call.
+    if (req.method === "POST" && p === "/setup/test-ai") {
+      let body = "";
+      req.on("data", (c) => (body += c));
+      req.on("end", async () => {
+        res.setHeader("Content-Type", "application/json");
+        const done = (o) => res.end(JSON.stringify(o));
+        try {
+          const { env = {} } = JSON.parse(body || "{}");
+          const cfg = { ...readEnvFile(), ...env };
+          const provider = cfg.AI_PROVIDER || "anthropic";
+          const key = { anthropic: cfg.ANTHROPIC_API_KEY, openai: cfg.OPENAI_API_KEY, gemini: cfg.GEMINI_API_KEY }[provider];
+          let url, headers, payload, label;
+          if (key) {
+            label = provider + " key";
+            if (provider === "anthropic") {
+              url = "https://api.anthropic.com/v1/messages";
+              headers = { "x-api-key": key, "anthropic-version": "2023-06-01", "content-type": "application/json" };
+              payload = { model: cfg.AI_MODEL || "claude-haiku-4-5", max_tokens: 1, messages: [{ role: "user", content: "hi" }] };
+            } else if (provider === "openai") {
+              url = "https://api.openai.com/v1/chat/completions";
+              headers = { authorization: "Bearer " + key, "content-type": "application/json" };
+              payload = { model: cfg.AI_MODEL || "gpt-4o-mini", max_tokens: 1, messages: [{ role: "user", content: "hi" }] };
+            } else {
+              url = `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${key}`;
+              headers = { "content-type": "application/json" };
+              payload = { contents: [{ parts: [{ text: "hi" }] }] };
+            }
+          } else if (cfg.VOLT_AI_TOKEN) {
+            label = "hosted gateway";
+            url = cfg.VOLT_AI_GATEWAY || "https://voltjs.com/api/ai";
+            headers = { authorization: "Bearer " + cfg.VOLT_AI_TOKEN, "content-type": "application/json" };
+            payload = { model: cfg.AI_MODEL || "claude-haiku-4-5", max_tokens: 1, messages: [{ role: "user", content: "hi" }] };
+          } else {
+            return done({ ok: false, error: "no AI key or VOLT_AI_TOKEN set" });
+          }
+          const r = await fetch(url, { method: "POST", headers, body: JSON.stringify(payload) });
+          if (r.ok) return done({ ok: true, detail: `${label} works` });
+          done({ ok: false, error: `${r.status}: ${(await r.text()).slice(0, 120)}` });
+        } catch (e) {
+          done({ ok: false, error: e.message });
+        }
+      });
+      return;
+    }
     if (req.method === "POST" && p === "/setup/apply") {
       let body = "";
       req.on("data", (c) => (body += c));

package/templates/docs/setup/setup.js

@@ -39,6 +39,12 @@ const state = signal({
 const set = (patch) => state({ ...state(), ...patch });
 const toggle = (n) => state({ ...state(), addons: { ...state().addons, [n]: !state().addons[n] } });
 const status = signal("");
+// per-test inline results (shown right next to each Test button)
+const dbTest = signal("");
+const smtpTest = signal("");
+const aiTest = signal("");
+const testResult = (m) => (m ? html`<span class="small ms-2 ${m.startsWith("✓") ? "text-success" : m.startsWith("✗") ? "text-danger" : "text-muted"}">${m}</span>` : "");
+const envObj = () => Object.fromEntries(env().split("\n").filter((l) => /^[A-Za-z0-9_]+=/.test(l)).map((l) => { const i = l.indexOf("="); return [l.slice(0, i), l.slice(i + 1)]; }));
 
 // selected add-ons, dependencies expanded, in display order
 function effective(s) {
@@ -149,12 +155,30 @@ async function testDb() {
   } else if (s.dbDriver === "mysql" || s.dbDriver === "postgres") {
     e.DATABASE_URL = s.dbUrl;
   }
-  status("Testing connection…");
+  dbTest("Testing…");
   try {
     const r = await (await fetch("/setup/test-db", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ env: e }) })).json();
-    status(r.ok ? `✓ Connected (${r.driver}).` : `✗ ${r.error}`);
+    dbTest(r.ok ? `✓ Connected (${r.driver})` : `✗ ${r.error}`);
   } catch {
-    status("Network error testing connection.");
+    dbTest("✗ network error");
+  }
+}
+async function testSmtp() {
+  smtpTest("Testing…");
+  try {
+    const r = await (await fetch("/setup/test-smtp", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ env: envObj() }) })).json();
+    smtpTest(r.ok ? `✓ ${r.detail || "OK"}` : `✗ ${r.error}`);
+  } catch {
+    smtpTest("✗ network error");
+  }
+}
+async function testAi() {
+  aiTest("Testing…");
+  try {
+    const r = await (await fetch("/setup/test-ai", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ env: envObj() }) })).json();
+    aiTest(r.ok ? `✓ ${r.detail || "OK"}` : `✗ ${r.error}`);
+  } catch {
+    aiTest("✗ network error");
   }
 }
 
@@ -221,7 +245,7 @@ const dbSettings = () =>
         : dbDriver() === "mysql" || dbDriver() === "postgres"
           ? field("DATABASE_URL", "dbUrl", dbDriver() + "://user:pass@host/db")
           : null}
-    ${() => (dbDriver() !== "memory" ? html`<button class="btn btn-sm btn-outline-secondary mb-2" onclick=${testDb}>Test connection</button>` : null)}`;
+    ${() => (dbDriver() !== "memory" ? html`<button class="btn btn-sm btn-outline-secondary mb-2" onclick=${testDb}>Test connection</button>${() => testResult(dbTest())}` : null)}`;
 
 const mediaSettings = () =>
   html`<div class="mb-2">
@@ -270,6 +294,7 @@ const aiSettings = () =>
       ${field("API key", "aiKey", "sk-…")}
       <div class="small text-muted mt-2 mb-1">— or — no key? Use the hosted tier (free, capped, then pay-as-you-go):</div>
       ${() => (state().aiToken ? html`<div class="small">Hosted token: <code>${state().aiToken.slice(0, 14)}…</code> <button class="btn btn-sm btn-link p-0 ms-1" onclick=${() => set({ aiToken: "" })}>clear</button></div>` : html`<button class="btn btn-sm btn-outline-secondary" onclick=${genToken}>Generate a free hosted token</button>`)}
+      <div class="mt-2"><button class="btn btn-sm btn-outline-secondary" onclick=${testAi}>Test AI</button>${() => testResult(aiTest())}</div>
     </div>
   </details>`;
 
@@ -417,7 +442,7 @@ const configView = () =>
       ${field("SITE_NAME", "siteName", "My Site")}
       ${() => (hasContent() ? themePicker() : null)}
       ${() => (hasDb() ? dbSettings() : null)}
-      ${() => (hasMailer() ? html`${field("SMTP_URL (optional)", "smtpUrl", "smtp://user:pass@smtp.host:587")}${field("MAIL_FROM", "mailFrom", "App <no-reply@you.com>")}` : null)}
+      ${() => (hasMailer() ? html`${field("SMTP_URL (optional)", "smtpUrl", "smtp://user:pass@smtp.host:587")}${field("MAIL_FROM", "mailFrom", "App <no-reply@you.com>")}<div class="mb-2"><button class="btn btn-sm btn-outline-secondary" onclick=${testSmtp}>Test SMTP</button>${() => testResult(smtpTest())}</div>` : null)}
       ${() => (hasMedia() ? mediaSettings() : null)}
       ${aiSettings()}
       ${field("SITE_URL (optional — absolute links, RSS, canonical)", "siteUrl", "https://example.com")}

package/templates/starter/server.js

@@ -43,7 +43,7 @@ function configPort() {
   const env = readEnvFile(); // --edit runs before loadEnv(), so read the file too
   return cliPort() || Number(process.env.CONFIG_PORT) || Number(env.CONFIG_PORT) || CONFIG_DEFAULT_PORT;
 }
-const PKG_VERSIONS = { mongodb: "^6.21.0", mysql2: "^3.22.5", pg: "^8.22.0", nodemailer: "^6.10.1", marked: "^18.0.5", busboy: "^1.6.0", "@aws-sdk/client-s3": "^3.1075.0" };
+const PKG_VERSIONS = { mongodb: "^6.21.0", mysql2: "^3.22.5", pg: "^8.22.0", nodemailer: "^9.0.3", marked: "^18.0.5", busboy: "^1.6.0", "@aws-sdk/client-s3": "^3.1075.0" };
 const LIB_FILE = { db: "store.js", mailer: "mailer.js", auth: "auth.js", realtime: "realtime.js", pages: "pages.js", posts: "posts.js", media: "media.js" };
 
 // --- tiny .env loader (no dependency); never overrides an existing env var ---
@@ -590,6 +590,104 @@ function startSetup() {
       });
       return;
     }
+    // verify SMTP creds (form values merged over the saved .env) — auth check via
+    // nodemailer if available, else a TCP reachability check.
+    if (req.method === "POST" && p === "/setup/test-smtp") {
+      let body = "";
+      req.on("data", (c) => (body += c));
+      req.on("end", async () => {
+        res.setHeader("Content-Type", "application/json");
+        const done = (o) => res.end(JSON.stringify(o));
+        try {
+          const { env = {} } = JSON.parse(body || "{}");
+          const cfg = { ...readEnvFile(), ...env };
+          const url = cfg.SMTP_URL;
+          const host = cfg.SMTP_HOST;
+          if (!url && !host) return done({ ok: false, error: "no SMTP config (set SMTP_URL or SMTP_HOST)" });
+          let nodemailer;
+          try {
+            nodemailer = (await import("nodemailer")).default;
+          } catch {
+            /* not installed */
+          }
+          if (nodemailer) {
+            const transport = url
+              ? nodemailer.createTransport(url)
+              : nodemailer.createTransport({ host, port: Number(cfg.SMTP_PORT) || 587, secure: /^(1|true|yes|on)$/i.test(cfg.SMTP_SECURE || "") || Number(cfg.SMTP_PORT) === 465, auth: cfg.SMTP_USER ? { user: cfg.SMTP_USER, pass: cfg.SMTP_PASS } : undefined });
+            await transport.verify();
+            return done({ ok: true, detail: "connection + auth OK" });
+          }
+          const net = await import("node:net");
+          let h = host;
+          let prt = Number(cfg.SMTP_PORT) || 587;
+          if (url) {
+            const u = new URL(url.replace(/^smtps?:\/\//, "http://"));
+            h = u.hostname;
+            prt = Number(u.port) || (url.startsWith("smtps") ? 465 : 587);
+          }
+          await new Promise((resolve, reject) => {
+            const s = net.connect(prt, h, () => {
+              s.end();
+              resolve();
+            });
+            s.setTimeout(5000, () => {
+              s.destroy();
+              reject(new Error("timeout"));
+            });
+            s.on("error", reject);
+          });
+          done({ ok: true, detail: `${h}:${prt} reachable — enable the mailer add-on for a full auth test` });
+        } catch (e) {
+          done({ ok: false, error: e.message });
+        }
+      });
+      return;
+    }
+    // verify the AI provider key (or gateway token) with a 1-token live call.
+    if (req.method === "POST" && p === "/setup/test-ai") {
+      let body = "";
+      req.on("data", (c) => (body += c));
+      req.on("end", async () => {
+        res.setHeader("Content-Type", "application/json");
+        const done = (o) => res.end(JSON.stringify(o));
+        try {
+          const { env = {} } = JSON.parse(body || "{}");
+          const cfg = { ...readEnvFile(), ...env };
+          const provider = cfg.AI_PROVIDER || "anthropic";
+          const key = { anthropic: cfg.ANTHROPIC_API_KEY, openai: cfg.OPENAI_API_KEY, gemini: cfg.GEMINI_API_KEY }[provider];
+          let url, headers, payload, label;
+          if (key) {
+            label = provider + " key";
+            if (provider === "anthropic") {
+              url = "https://api.anthropic.com/v1/messages";
+              headers = { "x-api-key": key, "anthropic-version": "2023-06-01", "content-type": "application/json" };
+              payload = { model: cfg.AI_MODEL || "claude-haiku-4-5", max_tokens: 1, messages: [{ role: "user", content: "hi" }] };
+            } else if (provider === "openai") {
+              url = "https://api.openai.com/v1/chat/completions";
+              headers = { authorization: "Bearer " + key, "content-type": "application/json" };
+              payload = { model: cfg.AI_MODEL || "gpt-4o-mini", max_tokens: 1, messages: [{ role: "user", content: "hi" }] };
+            } else {
+              url = `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${key}`;
+              headers = { "content-type": "application/json" };
+              payload = { contents: [{ parts: [{ text: "hi" }] }] };
+            }
+          } else if (cfg.VOLT_AI_TOKEN) {
+            label = "hosted gateway";
+            url = cfg.VOLT_AI_GATEWAY || "https://voltjs.com/api/ai";
+            headers = { authorization: "Bearer " + cfg.VOLT_AI_TOKEN, "content-type": "application/json" };
+            payload = { model: cfg.AI_MODEL || "claude-haiku-4-5", max_tokens: 1, messages: [{ role: "user", content: "hi" }] };
+          } else {
+            return done({ ok: false, error: "no AI key or VOLT_AI_TOKEN set" });
+          }
+          const r = await fetch(url, { method: "POST", headers, body: JSON.stringify(payload) });
+          if (r.ok) return done({ ok: true, detail: `${label} works` });
+          done({ ok: false, error: `${r.status}: ${(await r.text()).slice(0, 120)}` });
+        } catch (e) {
+          done({ ok: false, error: e.message });
+        }
+      });
+      return;
+    }
     if (req.method === "POST" && p === "/setup/apply") {
       let body = "";
       req.on("data", (c) => (body += c));

package/templates/starter/setup/setup.js

@@ -39,6 +39,12 @@ const state = signal({
 const set = (patch) => state({ ...state(), ...patch });
 const toggle = (n) => state({ ...state(), addons: { ...state().addons, [n]: !state().addons[n] } });
 const status = signal("");
+// per-test inline results (shown right next to each Test button)
+const dbTest = signal("");
+const smtpTest = signal("");
+const aiTest = signal("");
+const testResult = (m) => (m ? html`<span class="small ms-2 ${m.startsWith("✓") ? "text-success" : m.startsWith("✗") ? "text-danger" : "text-muted"}">${m}</span>` : "");
+const envObj = () => Object.fromEntries(env().split("\n").filter((l) => /^[A-Za-z0-9_]+=/.test(l)).map((l) => { const i = l.indexOf("="); return [l.slice(0, i), l.slice(i + 1)]; }));
 
 // selected add-ons, dependencies expanded, in display order
 function effective(s) {
@@ -149,12 +155,30 @@ async function testDb() {
   } else if (s.dbDriver === "mysql" || s.dbDriver === "postgres") {
     e.DATABASE_URL = s.dbUrl;
   }
-  status("Testing connection…");
+  dbTest("Testing…");
   try {
     const r = await (await fetch("/setup/test-db", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ env: e }) })).json();
-    status(r.ok ? `✓ Connected (${r.driver}).` : `✗ ${r.error}`);
+    dbTest(r.ok ? `✓ Connected (${r.driver})` : `✗ ${r.error}`);
   } catch {
-    status("Network error testing connection.");
+    dbTest("✗ network error");
+  }
+}
+async function testSmtp() {
+  smtpTest("Testing…");
+  try {
+    const r = await (await fetch("/setup/test-smtp", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ env: envObj() }) })).json();
+    smtpTest(r.ok ? `✓ ${r.detail || "OK"}` : `✗ ${r.error}`);
+  } catch {
+    smtpTest("✗ network error");
+  }
+}
+async function testAi() {
+  aiTest("Testing…");
+  try {
+    const r = await (await fetch("/setup/test-ai", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ env: envObj() }) })).json();
+    aiTest(r.ok ? `✓ ${r.detail || "OK"}` : `✗ ${r.error}`);
+  } catch {
+    aiTest("✗ network error");
   }
 }
 
@@ -221,7 +245,7 @@ const dbSettings = () =>
         : dbDriver() === "mysql" || dbDriver() === "postgres"
           ? field("DATABASE_URL", "dbUrl", dbDriver() + "://user:pass@host/db")
           : null}
-    ${() => (dbDriver() !== "memory" ? html`<button class="btn btn-sm btn-outline-secondary mb-2" onclick=${testDb}>Test connection</button>` : null)}`;
+    ${() => (dbDriver() !== "memory" ? html`<button class="btn btn-sm btn-outline-secondary mb-2" onclick=${testDb}>Test connection</button>${() => testResult(dbTest())}` : null)}`;
 
 const mediaSettings = () =>
   html`<div class="mb-2">
@@ -270,6 +294,7 @@ const aiSettings = () =>
       ${field("API key", "aiKey", "sk-…")}
       <div class="small text-muted mt-2 mb-1">— or — no key? Use the hosted tier (free, capped, then pay-as-you-go):</div>
       ${() => (state().aiToken ? html`<div class="small">Hosted token: <code>${state().aiToken.slice(0, 14)}…</code> <button class="btn btn-sm btn-link p-0 ms-1" onclick=${() => set({ aiToken: "" })}>clear</button></div>` : html`<button class="btn btn-sm btn-outline-secondary" onclick=${genToken}>Generate a free hosted token</button>`)}
+      <div class="mt-2"><button class="btn btn-sm btn-outline-secondary" onclick=${testAi}>Test AI</button>${() => testResult(aiTest())}</div>
     </div>
   </details>`;
 
@@ -417,7 +442,7 @@ const configView = () =>
       ${field("SITE_NAME", "siteName", "My Site")}
       ${() => (hasContent() ? themePicker() : null)}
       ${() => (hasDb() ? dbSettings() : null)}
-      ${() => (hasMailer() ? html`${field("SMTP_URL (optional)", "smtpUrl", "smtp://user:pass@smtp.host:587")}${field("MAIL_FROM", "mailFrom", "App <no-reply@you.com>")}` : null)}
+      ${() => (hasMailer() ? html`${field("SMTP_URL (optional)", "smtpUrl", "smtp://user:pass@smtp.host:587")}${field("MAIL_FROM", "mailFrom", "App <no-reply@you.com>")}<div class="mb-2"><button class="btn btn-sm btn-outline-secondary" onclick=${testSmtp}>Test SMTP</button>${() => testResult(smtpTest())}</div>` : null)}
       ${() => (hasMedia() ? mediaSettings() : null)}
       ${aiSettings()}
       ${field("SITE_URL (optional — absolute links, RSS, canonical)", "siteUrl", "https://example.com")}