Release Skim v1.0.22 · nikserg/skim

Skim v1.0.22 — "Ask the MX, not the vibes" 🛂

The one where Skim stops pretending that Microsoft owns exactly four domains on the entire internet.

Work & school accounts are finally recognized. 🏢 If your company lives on Exchange Online, Skim now asks your domain's MX records who really hosts the mail. Everything Microsoft runs answers on *.protection.outlook.com, so the sign-in button that actually works shows up on its own — no more falling into the manual IMAP/SMTP form to guess hostnames that were never going to connect. (Yes, hotmail.de too. Sorry it took a whole minor version to notice Germany exists. 🇩🇪)
Behind a mail gateway? Proofpoint and Mimecast tenants don't advertise Microsoft in MX at all, so unknown domains now get one quiet "Work or school account?" line instead of a shrug. One line. We counted. 📏
The DNS probe goes through the machine's own resolver (DnsQuery_W) — your domain never visits a third party, results are memoized, the whole thing is capped at 3 seconds, and if it fails the screen looks exactly like it did before. 🔒

The connect screen no longer flashes the manual form for a split second before deciding what it actually wanted to show. Nobody liked that little strobe. 🪩
Failed Microsoft sign-ins can now, revolutionarily, display an error. The error slot was living inside the password snippet, which is a great hiding spot if your goal is to never be seen. 🙈
OAuth buttons stopped submitting the form because someone forgot type="button". Classic. 🤦
access_denied is no longer universally translated as "you cancelled". AADSTS65004 is a genuine decline; the rest of that family is your tenant's consent policy saying no on your behalf — and now it says that instead of blaming you. 🙅

Fixes #33.

The MX walk now traverses the record list as NonNull instead of raw pointers, because CodeQL followed a null_mut() all the way into a dereference and made a very good point. 🔍 The null check now lives in the type, each unsafe block vouches for exactly one operation, and behavior is unchanged — verified against a real tenant domain, a country consumer domain, a Google-hosted domain, and an NXDOMAIN that politely refused to exist.
Eleven locales got their new strings. 🌍