@authup/server-core 1.0.0-beta.46 → 1.0.0-beta.48

package/dist/core/identity/password-recovery/service.mjs

@@ -2,6 +2,9 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { UserCredentialsService } from "../../authentication/credential/entities/user/module.mjs";
+import { MailTemplateName } from "../../mail/template/types.mjs";
+import "../../mail/index.mjs";
+import "./constants.mjs";
 import { PasswordRecoveryDisabledError } from "./disabled.mjs";
 import { EmailVerificationRequiredError } from "./email-verification-required.mjs";
 import { ResetTokenExpiredError } from "./token-expired.mjs";
@@ -16,13 +19,15 @@ var PasswordRecoveryService = class {
 	repository;
 	realmRepository;
 	mailClient;
+	mailTemplateRenderer;
 	constructor(ctx) {
 		this.options = ctx.options;
 		this.repository = ctx.repository;
 		this.realmRepository = ctx.realmRepository;
 		this.mailClient = ctx.mailClient;
+		this.mailTemplateRenderer = ctx.mailTemplateRenderer;
 	}
-	async forgotPassword(data) {
+	async forgotPassword(data, context) {
 		if (!this.options.passwordRecoveryEnabled) throw new PasswordRecoveryDisabledError();
 		if (!this.options.emailVerificationEnabled) throw new EmailVerificationRequiredError("Email verification is not enabled, but required to reset a password.");
 		const validated = await this.runForgotPasswordValidator(data);
@@ -40,13 +45,19 @@ var PasswordRecoveryService = class {
 		});
 		await this.repository.save(merged);
 		try {
+			const resetUrl = this.options.publicUrl ? `${this.options.publicUrl.replace(/\/+$/, "")}/password-reset?token=${encodeURIComponent(merged.reset_hash)}&realm_id=${encodeURIComponent(entity.realm_id)}` : void 0;
+			const mail = await this.mailTemplateRenderer.render({
+				template: MailTemplateName.PASSWORD_RESET,
+				params: {
+					code: merged.reset_hash,
+					url: resetUrl,
+					expiresInMinutes: 30
+				},
+				locale: context?.locale
+			});
 			await this.mailClient.send({
 				to: entity.email,
-				subject: "Forgot Password - Reset code",
-				html: `
-                <p>Please use the code below to reset your account password.</p>
-                <p>${merged.reset_hash}</p>
-                `
+				...mail
 			});
 		} catch {
 			this.repository.merge(merged, {

package/dist/core/identity/password-recovery/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BadRequestError","EntityNotFoundError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidator","randomBytes","Container","z","UserCredentialsService","PasswordRecoveryService","options","repository","realmRepository","mailClient","ctx","forgotPassword","data","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realm_id","where","name","email","id","entity","findOneByWithEmail","merged","merge","reset_expires","Date","now","toISOString","reset_hash","toString","save","send","to","subject","html","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","reset_at","validator","oneOfContainer","oneOf","mount","string","trim","toLowerCase","regex","message","min","optional","uuid","nullable","run","max"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidator } from '@validup/zod';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IPasswordRecoveryService,\n    PasswordForgotResult,\n    PasswordRecoveryServiceContext,\n    PasswordRecoveryServiceOptions,\n    PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient } from '../../mail/types.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n    protected options: PasswordRecoveryServiceOptions;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected mailClient: IMailClient;\n\n    constructor(ctx: PasswordRecoveryServiceContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.mailClient = ctx.mailClient;\n    }\n\n    async forgotPassword(data: Record<string, any>): Promise<PasswordForgotResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        if (!this.options.emailVerificationEnabled) {\n            throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n        }\n\n        const validated = await this.runForgotPasswordValidator(data);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneByWithEmail(where);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            reset_expires: new Date(Date.now() + (1000 * 60 * 30)).toISOString(),\n            reset_hash: randomBytes(32).toString('hex'),\n        });\n\n        await this.repository.save(merged);\n\n        try {\n            await this.mailClient.send({\n                to: entity.email,\n                subject: 'Forgot Password - Reset code',\n                html: `\n                <p>Please use the code below to reset your account password.</p>\n                <p>${merged.reset_hash}</p>\n                `,\n            });\n        } catch {\n            this.repository.merge(merged, {\n                reset_hash: null,\n                reset_expires: null,\n            });\n            await this.repository.save(merged);\n\n            throw new BadRequestError('Password recovery failed. Could not send reset email.');\n        }\n\n        return { reset_expires: merged.reset_expires! };\n    }\n\n    async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        const validated = await this.runResetPasswordValidator(data);\n\n        await this.repository.validateJoinColumns(validated);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            reset_hash: validated.token,\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneBy(where);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!entity.reset_expires || new Date(entity.reset_expires) < new Date()) {\n            throw new ResetTokenExpiredError();\n        }\n\n        const credentialsService = new UserCredentialsService();\n        const hashedPassword = await credentialsService.protect(validated.password);\n\n        const merged = this.repository.merge(entity, {\n            reset_at: new Date().toISOString(),\n            reset_hash: null,\n            reset_expires: null,\n            password: hashedPassword,\n        });\n\n        await this.repository.save(merged);\n\n        return { reset_at: merged.reset_at! };\n    }\n\n    private async runForgotPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        return validator.run(data);\n    }\n\n    private async runResetPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        validator.mount(\n            'token',\n            createValidator(z.string().min(3).max(256)),\n        );\n\n        validator.mount(\n            'password',\n            createValidator(z.string().min(5).max(512)),\n        );\n\n        return validator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AA0BA,IAAaU,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKJ,UAAUI,IAAIJ;EACnB,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,aAAaC,IAAID;CAC1B;CAEA,MAAME,eAAeC,MAA0D;EAC3E,IAAI,CAAC,KAAKN,QAAQO,yBACd,MAAM,IAAIhB,8BAAAA;EAGd,IAAI,CAAC,KAAKS,QAAQQ,0BACd,MAAM,IAAIhB,+BAA+B,sEAAA;EAG7C,MAAMiB,YAAY,MAAM,KAAKC,2BAA2BJ,IAAAA;EAExD,MAAMK,QAAQ,MAAM,KAAKT,gBAAgBU,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKjB,WAAWkB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAM8B,SAAS,KAAKnB,WAAWoB,MAAMH,QAAQ;GACzCI,eAAe,IAAIC,KAAKA,KAAKC,IAAG,IAAM,MAAO,KAAK,EAAA,CAAA,CAAKC,YAAW;GAClEC,YAAY/B,YAAY,EAAA,CAAA,CAAIgC,SAAS,KAAA;EACzC,CAAA;EAEA,MAAM,KAAK1B,WAAW2B,KAAKR,MAAAA;EAE3B,IAAI;GACA,MAAM,KAAKjB,WAAW0B,KAAK;IACvBC,IAAIZ,OAAOF;IACXe,SAAS;IACTC,MAAM;;qBAEDZ,OAAOM,WAAW;;GAE3B,CAAA;EACJ,QAAQ;GACJ,KAAKzB,WAAWoB,MAAMD,QAAQ;IAC1BM,YAAY;IACZJ,eAAe;GACnB,CAAA;GACA,MAAM,KAAKrB,WAAW2B,KAAKR,MAAAA;GAE3B,MAAM,IAAI/B,gBAAgB,uDAAA;EAC9B;EAEA,OAAO,EAAEiC,eAAeF,OAAOE,cAAe;CAClD;CAEA,MAAMW,cAAc3B,MAAyD;EACzE,IAAI,CAAC,KAAKN,QAAQO,yBACd,MAAM,IAAIhB,8BAAAA;EAGd,MAAMkB,YAAY,MAAM,KAAKyB,0BAA0B5B,IAAAA;EAEvD,MAAM,KAAKL,WAAWkC,oBAAoB1B,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKT,gBAAgBU,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,YAAYjB,UAAU2B;GACtBvB,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKjB,WAAWoC,UAAUvB,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAI5B,oBAAAA;EAGd,IAAI,CAAC4B,OAAOI,iBAAiB,IAAIC,KAAKL,OAAOI,aAAa,oBAAI,IAAIC,KAAAA,GAC9D,MAAM,IAAI9B,uBAAAA;EAId,MAAM8C,iBAAiB,MAAMD,IADExC,uBACFwC,CAAAA,CAAmBE,QAAQ/B,UAAUgC,QAAQ;EAE1E,MAAMrB,SAAS,KAAKnB,WAAWoB,MAAMH,QAAQ;GACzCwB,2BAAU,IAAInB,KAAAA,EAAAA,CAAOE,YAAW;GAChCC,YAAY;GACZJ,eAAe;GACfmB,UAAUF;EACd,CAAA;EAEA,MAAM,KAAKtC,WAAW2B,KAAKR,MAAAA;EAE3B,OAAO,EAAEsB,UAAUtB,OAAOsB,SAAU;CACxC;CAEA,MAAchC,2BAA2BJ,MAA2B;EAChE,MAAMqC,YAAY,IAAI/C,UAAe,CAAC,CAAA;EAEtC,MAAMgD,iBAAiB,IAAIhD,UAAU,EAAEiD,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MACX,SACApD,gBACIG,EAAEkD,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXjC,MAAK,CAAA,CACLkC,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAItEP,eAAeE,MACX,QACApD,gBAAgBG,EAAEkD,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3D,gBAAgBG,EAAEyD,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrC,OAAOZ,UAAUa,IAAIlD,IAAAA;CACzB;CAEA,MAAc4B,0BAA0B5B,MAA2B;EAC/D,MAAMqC,YAAY,IAAI/C,UAAe,CAAC,CAAA;EAEtC,MAAMgD,iBAAiB,IAAIhD,UAAU,EAAEiD,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACApD,gBACIG,EAAEkD,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXjC,MAAK,CAAA,CACLkC,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAGtEP,eAAeE,MACX,QACApD,gBAAgBG,EAAEkD,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3D,gBAAgBG,EAAEyD,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrCZ,UAAUG,MACN,SACApD,gBAAgBG,EAAEkD,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1Cd,UAAUG,MACN,YACApD,gBAAgBG,EAAEkD,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1C,OAAOd,UAAUa,IAAIlD,IAAAA;CACzB;AACJ"}
+{"version":3,"file":"service.mjs","names":["BadRequestError","EntityNotFoundError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidator","randomBytes","Container","z","UserCredentialsService","MailTemplateName","PASSWORD_RESET_EXPIRES_IN_MINUTES","PasswordRecoveryService","options","repository","realmRepository","mailClient","mailTemplateRenderer","ctx","forgotPassword","data","context","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realm_id","where","name","email","id","entity","findOneByWithEmail","merged","merge","reset_expires","Date","now","toISOString","reset_hash","toString","save","resetUrl","publicUrl","replace","encodeURIComponent","undefined","mail","render","template","PASSWORD_RESET","params","code","url","expiresInMinutes","locale","send","to","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","reset_at","validator","oneOfContainer","oneOf","mount","string","trim","toLowerCase","regex","message","min","optional","uuid","nullable","run","max"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidator } from '@validup/zod';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IPasswordRecoveryService,\n    PasswordForgotResult,\n    PasswordRecoveryServiceContext,\n    PasswordRecoveryServiceOptions,\n    PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\nimport { PASSWORD_RESET_EXPIRES_IN_MINUTES } from './constants.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n    protected options: PasswordRecoveryServiceOptions;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    constructor(ctx: PasswordRecoveryServiceContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n    }\n\n    async forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        if (!this.options.emailVerificationEnabled) {\n            throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n        }\n\n        const validated = await this.runForgotPasswordValidator(data);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneByWithEmail(where);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            reset_expires: new Date(\n                Date.now() + (1000 * 60 * PASSWORD_RESET_EXPIRES_IN_MINUTES),\n            ).toISOString(),\n            reset_hash: randomBytes(32).toString('hex'),\n        });\n\n        await this.repository.save(merged);\n\n        try {\n            // realm_id MUST ride the link: resetPassword resolves the realm\n            // from the request and filters the lookup by it, so a realm-less\n            // link resolves to the master realm and never matches a\n            // non-master user.\n            const resetUrl = this.options.publicUrl ?\n                `${this.options.publicUrl.replace(/\\/+$/, '')}/password-reset` +\n                `?token=${encodeURIComponent(merged.reset_hash!)}` +\n                `&realm_id=${encodeURIComponent(entity.realm_id)}` :\n                undefined;\n\n            const mail = await this.mailTemplateRenderer.render({\n                template: MailTemplateName.PASSWORD_RESET,\n                params: {\n                    code: merged.reset_hash!,\n                    url: resetUrl,\n                    expiresInMinutes: PASSWORD_RESET_EXPIRES_IN_MINUTES,\n                },\n                locale: context?.locale,\n            });\n\n            await this.mailClient.send({\n                to: entity.email,\n                ...mail,\n            });\n        } catch {\n            this.repository.merge(merged, {\n                reset_hash: null,\n                reset_expires: null,\n            });\n            await this.repository.save(merged);\n\n            throw new BadRequestError('Password recovery failed. Could not send reset email.');\n        }\n\n        return { reset_expires: merged.reset_expires! };\n    }\n\n    async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        const validated = await this.runResetPasswordValidator(data);\n\n        await this.repository.validateJoinColumns(validated);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            reset_hash: validated.token,\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneBy(where);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!entity.reset_expires || new Date(entity.reset_expires) < new Date()) {\n            throw new ResetTokenExpiredError();\n        }\n\n        const credentialsService = new UserCredentialsService();\n        const hashedPassword = await credentialsService.protect(validated.password);\n\n        const merged = this.repository.merge(entity, {\n            reset_at: new Date().toISOString(),\n            reset_hash: null,\n            reset_expires: null,\n            password: hashedPassword,\n        });\n\n        await this.repository.save(merged);\n\n        return { reset_at: merged.reset_at! };\n    }\n\n    private async runForgotPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        return validator.run(data);\n    }\n\n    private async runResetPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        validator.mount(\n            'token',\n            createValidator(z.string().min(3).max(256)),\n        );\n\n        validator.mount(\n            'password',\n            createValidator(z.string().min(5).max(512)),\n        );\n\n        return validator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6BA,IAAaY,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKL,UAAUK,IAAIL;EACnB,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,uBAAuBC,IAAID;CACpC;CAEA,MAAME,eAAeC,MAA2BC,SAAkE;EAC9G,IAAI,CAAC,KAAKR,QAAQS,yBACd,MAAM,IAAIpB,8BAAAA;EAGd,IAAI,CAAC,KAAKW,QAAQU,0BACd,MAAM,IAAIpB,+BAA+B,sEAAA;EAG7C,MAAMqB,YAAY,MAAM,KAAKC,2BAA2BL,IAAAA;EAExD,MAAMM,QAAQ,MAAM,KAAKX,gBAAgBY,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKnB,WAAWoB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkC,SAAS,KAAKrB,WAAWsB,MAAMH,QAAQ;GACzCI,eAAe,IAAIC,KACfA,KAAKC,IAAG,IAAM,MAAO,KAAA,EAAK5B,CAAAA,CAC5B6B,YAAW;GACbC,YAAYnC,YAAY,EAAA,CAAA,CAAIoC,SAAS,KAAA;EACzC,CAAA;EAEA,MAAM,KAAK5B,WAAW6B,KAAKR,MAAAA;EAE3B,IAAI;GAKA,MAAMS,WAAW,KAAK/B,QAAQgC,YAC1B,GAAG,KAAKhC,QAAQgC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,wBACpCC,mBAAmBZ,OAAOM,UAAU,EAAA,YACjCM,mBAAmBd,OAAOL,QAAQ,MAC/CoB,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKhC,qBAAqBiC,OAAO;IAChDC,UAAUzC,iBAAiB0C;IAC3BC,QAAQ;KACJC,MAAMnB,OAAOM;KACbc,KAAKX;KACLY,kBAAAA;IACJ;IACAC,QAAQpC,SAASoC;GACrB,CAAA;GAEA,MAAM,KAAKzC,WAAW0C,KAAK;IACvBC,IAAI1B,OAAOF;IACX,GAAGkB;GACP,CAAA;EACJ,QAAQ;GACJ,KAAKnC,WAAWsB,MAAMD,QAAQ;IAC1BM,YAAY;IACZJ,eAAe;GACnB,CAAA;GACA,MAAM,KAAKvB,WAAW6B,KAAKR,MAAAA;GAE3B,MAAM,IAAInC,gBAAgB,uDAAA;EAC9B;EAEA,OAAO,EAAEqC,eAAeF,OAAOE,cAAe;CAClD;CAEA,MAAMuB,cAAcxC,MAAyD;EACzE,IAAI,CAAC,KAAKP,QAAQS,yBACd,MAAM,IAAIpB,8BAAAA;EAGd,MAAMsB,YAAY,MAAM,KAAKqC,0BAA0BzC,IAAAA;EAEvD,MAAM,KAAKN,WAAWgD,oBAAoBtC,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKX,gBAAgBY,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,YAAYjB,UAAUuC;GACtBnC,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKnB,WAAWkD,UAAUnC,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAACgC,OAAOI,iBAAiB,IAAIC,KAAKL,OAAOI,aAAa,oBAAI,IAAIC,KAAAA,GAC9D,MAAM,IAAIlC,uBAAAA;EAId,MAAM8D,iBAAiB,MAAMD,IADExD,uBACFwD,CAAAA,CAAmBE,QAAQ3C,UAAU4C,QAAQ;EAE1E,MAAMjC,SAAS,KAAKrB,WAAWsB,MAAMH,QAAQ;GACzCoC,2BAAU,IAAI/B,KAAAA,EAAAA,CAAOE,YAAW;GAChCC,YAAY;GACZJ,eAAe;GACf+B,UAAUF;EACd,CAAA;EAEA,MAAM,KAAKpD,WAAW6B,KAAKR,MAAAA;EAE3B,OAAO,EAAEkC,UAAUlC,OAAOkC,SAAU;CACxC;CAEA,MAAc5C,2BAA2BL,MAA2B;EAChE,MAAMkD,YAAY,IAAI/D,UAAe,CAAC,CAAA;EAEtC,MAAMgE,iBAAiB,IAAIhE,UAAU,EAAEiE,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MACX,SACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACX7C,MAAK,CAAA,CACL8C,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAItEP,eAAeE,MACX,QACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3E,gBAAgBG,EAAEyE,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrC,OAAOZ,UAAUa,IAAI/D,IAAAA;CACzB;CAEA,MAAcyC,0BAA0BzC,MAA2B;EAC/D,MAAMkD,YAAY,IAAI/D,UAAe,CAAC,CAAA;EAEtC,MAAMgE,iBAAiB,IAAIhE,UAAU,EAAEiE,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACX7C,MAAK,CAAA,CACL8C,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAGtEP,eAAeE,MACX,QACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3E,gBAAgBG,EAAEyE,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrCZ,UAAUG,MACN,SACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1Cd,UAAUG,MACN,YACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1C,OAAOd,UAAUa,IAAI/D,IAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/types.d.ts

@@ -1,12 +1,15 @@
-import type { IMailClient } from '../../mail/types.ts';
+import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
 import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IdentityWorkflowContext } from '../types.ts';
 export type PasswordRecoveryServiceOptions = {
     passwordRecoveryEnabled?: boolean;
     emailVerificationEnabled?: boolean;
+    publicUrl?: string;
 };
 export type PasswordRecoveryServiceContext = {
     options: PasswordRecoveryServiceOptions;
     mailClient: IMailClient;
+    mailTemplateRenderer: IMailTemplateRenderer;
     repository: IUserRepository;
     realmRepository: IRealmRepository;
 };
@@ -17,7 +20,7 @@ export type PasswordResetResult = {
     reset_at: string;
 };
 export interface IPasswordRecoveryService {
-    forgotPassword(data: Record<string, any>): Promise<PasswordForgotResult>;
+    forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult>;
     resetPassword(data: Record<string, any>): Promise<PasswordResetResult>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/core/identity/password-recovery/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,MAAM,MAAM,8BAA8B,GAAG;IACzC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,EAAE,WAAW,CAAC;IACxB,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACzE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,8BAA8B,GAAG;IACzC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1E"}

package/dist/core/identity/registration/service.d.ts

@@ -1,13 +1,15 @@
 import type { IRegistrationService, RegistrationResult, RegistrationServiceContext, RegistrationServiceOptions } from './types.ts';
-import type { IMailClient } from '../../mail/types.ts';
+import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
 import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IdentityWorkflowContext } from '../types.ts';
 export declare class RegistrationService implements IRegistrationService {
     protected options: RegistrationServiceOptions;
     protected mailClient: IMailClient;
+    protected mailTemplateRenderer: IMailTemplateRenderer;
     protected repository: IUserRepository;
     protected realmRepository: IRealmRepository;
     constructor(ctx: RegistrationServiceContext);
-    register(data: Record<string, any>): Promise<RegistrationResult>;
+    register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult>;
     activate(data: {
         token: string;
     }): Promise<void>;

package/dist/core/identity/registration/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/service.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,0BAA0B;IAOrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgDhE,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAczD"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/service.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAEtD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,0BAA0B;IAQrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAsDnG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAczD"}

package/dist/core/identity/registration/service.mjs

@@ -2,6 +2,8 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { UserCredentialsService } from "../../authentication/credential/entities/user/module.mjs";
+import { MailTemplateName } from "../../mail/template/types.mjs";
+import "../../mail/index.mjs";
 import { RegistrationDisabledError } from "./error.mjs";
 import { UserValidator } from "@authup/core-kit";
 import { createNanoID } from "@authup/kit";
@@ -12,15 +14,17 @@ import { randomBytes } from "node:crypto";
 var RegistrationService = class {
 	options;
 	mailClient;
+	mailTemplateRenderer;
 	repository;
 	realmRepository;
 	constructor(ctx) {
 		this.options = ctx.options;
 		this.mailClient = ctx.mailClient;
+		this.mailTemplateRenderer = ctx.mailTemplateRenderer;
 		this.repository = ctx.repository;
 		this.realmRepository = ctx.realmRepository;
 	}
-	async register(data) {
+	async register(data, context) {
 		if (!this.options.registrationEnabled) throw new RegistrationDisabledError();
 		const validator = new Container({});
 		validator.mount(new UserValidator({ pathsToInclude: [
@@ -42,13 +46,18 @@ var RegistrationService = class {
 		entity.realm_id = (await this.realmRepository.resolve(entity.realm_id, true)).id;
 		await this.repository.save(entity);
 		if (this.options.emailVerificationEnabled) try {
+			const activateUrl = this.options.publicUrl ? `${this.options.publicUrl.replace(/\/+$/, "")}/activate?token=${entity.activate_hash}` : void 0;
+			const mail = await this.mailTemplateRenderer.render({
+				template: MailTemplateName.REGISTRATION_ACTIVATION,
+				params: {
+					code: entity.activate_hash,
+					url: activateUrl
+				},
+				locale: context?.locale
+			});
 			await this.mailClient.send({
 				to: entity.email,
-				subject: "Registration - Activation code",
-				html: `
-                    <p>Please use the code below to activate your account and start using the site.</p>
-                    <p>${entity.activate_hash}</p>
-                    `
+				...mail
 			});
 		} catch {
 			await this.repository.remove(entity);

package/dist/core/identity/registration/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["UserValidator","createNanoID","BadRequestError","EntityNotFoundError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","RegistrationService","options","mailClient","repository","realmRepository","ctx","register","data","registrationEnabled","validator","mount","pathsToInclude","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","send","to","email","subject","html","remove","activate","findOneBy","token","merged","merge"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserValidator } from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient } from '../../mail/types.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async register(data: Record<string, any>): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({ pathsToInclude: ['email', 'name', 'password', 'realm_id'] }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                await this.mailClient.send({\n                    to: entity.email,\n                    subject: 'Registration - Activation code',\n                    html: `\n                    <p>Please use the code below to activate your account and start using the site.</p>\n                    <p>${entity.activate_hash}</p>\n                    `,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new BadRequestError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n    }\n}\n"],"mappings":";;;;;;;;;;;AAuBA,IAAaQ,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EACnB,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,SAASC,MAAwD;EACnE,IAAI,CAAC,KAAKN,QAAQO,qBACd,MAAM,IAAIZ,0BAAAA;EAGd,MAAMa,YAAY,IAAIX,UAAU,CAAC,CAAA;EACjCW,UAAUC,MAAM,IAAIlB,cAAc,EAAEmB,gBAAgB;GAAC;GAAS;GAAQ;GAAY;IAAY,CAAA,CAAA;EAC9F,MAAMC,YAAY,MAAMH,UAAUI,IAAIN,MAAM,EAAEO,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKX,WAAWY,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKX,QAAQe,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,gBAAgBrB,YAAY,EAAA,CAAA,CAAIsB,SAAS,KAAA;EACvD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKjB,WAAWkB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAIvB,uBAAAA;EAC/BqB,OAAOG,WAAWH,OAAOG,YAAY9B,aAAa,EAAA;EAClD2B,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,YAAWF,MADE,KAAKrB,gBAAgBsB,QAAQN,OAAOO,UAAU,IAAA,EAAA,CAC1CC;EAExB,MAAM,KAAKzB,WAAW0B,KAAKT,MAAAA;EAE3B,IAAI,KAAKnB,QAAQe,0BACb,IAAI;GACA,MAAM,KAAKd,WAAW4B,KAAK;IACvBC,IAAIX,OAAOY;IACXC,SAAS;IACTC,MAAM;;yBAEDd,OAAOF,cAAc;;GAE9B,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKf,WAAWgC,OAAOf,MAAAA;GAC7B,MAAM,IAAI1B,gBAAgB,uDAAA;EAC9B;EAGJ,OAAO,EAAEuB,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAMmB,SAAS7B,MAAwC;EACnD,MAAMa,SAAS,MAAM,KAAKjB,WAAWkC,UAAU,EAAEnB,eAAeX,KAAK+B,MAAM,CAAA;EAE3E,IAAI,CAAClB,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAM4C,SAAS,KAAKpC,WAAWqC,MAAMpB,QAAQ;GACzCH,QAAQ;GACRC,eAAe;EACnB,CAAA;EAEA,MAAM,KAAKf,WAAW0B,KAAKU,MAAAA;CAC/B;AACJ"}
+{"version":3,"file":"service.mjs","names":["UserValidator","createNanoID","BadRequestError","EntityNotFoundError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","MailTemplateName","RegistrationService","options","mailClient","mailTemplateRenderer","repository","realmRepository","ctx","register","data","context","registrationEnabled","validator","mount","pathsToInclude","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","activateUrl","publicUrl","replace","undefined","mail","render","template","REGISTRATION_ACTIVATION","params","code","url","locale","send","to","email","remove","activate","findOneBy","token","merged","merge"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserValidator } from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({ pathsToInclude: ['email', 'name', 'password', 'realm_id'] }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                const activateUrl = this.options.publicUrl ?\n                    `${this.options.publicUrl.replace(/\\/+$/, '')}/activate?token=${entity.activate_hash}` :\n                    undefined;\n\n                const mail = await this.mailTemplateRenderer.render({\n                    template: MailTemplateName.REGISTRATION_ACTIVATION,\n                    params: { code: entity.activate_hash!, url: activateUrl },\n                    locale: context?.locale,\n                });\n\n                await this.mailClient.send({\n                    to: entity.email,\n                    ...mail,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new BadRequestError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAyBA,IAAaS,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKL,UAAUK,IAAIL;EACnB,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,SAASC,MAA2BC,SAAgE;EACtG,IAAI,CAAC,KAAKR,QAAQS,qBACd,MAAM,IAAIf,0BAAAA;EAGd,MAAMgB,YAAY,IAAId,UAAU,CAAC,CAAA;EACjCc,UAAUC,MAAM,IAAIrB,cAAc,EAAEsB,gBAAgB;GAAC;GAAS;GAAQ;GAAY;IAAY,CAAA,CAAA;EAC9F,MAAMC,YAAY,MAAMH,UAAUI,IAAIP,MAAM,EAAEQ,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKZ,WAAWa,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKb,QAAQiB,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,gBAAgBxB,YAAY,EAAA,CAAA,CAAIyB,SAAS,KAAA;EACvD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKlB,WAAWmB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAI1B,uBAAAA;EAC/BwB,OAAOG,WAAWH,OAAOG,YAAYjC,aAAa,EAAA;EAClD8B,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,YAAWF,MADE,KAAKtB,gBAAgBuB,QAAQN,OAAOO,UAAU,IAAA,EAAA,CAC1CC;EAExB,MAAM,KAAK1B,WAAW2B,KAAKT,MAAAA;EAE3B,IAAI,KAAKrB,QAAQiB,0BACb,IAAI;GACA,MAAMc,cAAc,KAAK/B,QAAQgC,YAC7B,GAAG,KAAKhC,QAAQgC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,kBAAkBZ,OAAOF,kBACvEe,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKjC,qBAAqBkC,OAAO;IAChDC,UAAUvC,iBAAiBwC;IAC3BC,QAAQ;KAAEC,MAAMnB,OAAOF;KAAgBsB,KAAKV;IAAY;IACxDW,QAAQlC,SAASkC;GACrB,CAAA;GAEA,MAAM,KAAKzC,WAAW0C,KAAK;IACvBC,IAAIvB,OAAOwB;IACX,GAAGV;GACP,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKhC,WAAW2C,OAAOzB,MAAAA;GAC7B,MAAM,IAAI7B,gBAAgB,uDAAA;EAC9B;EAGJ,OAAO,EAAE0B,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAM6B,SAASxC,MAAwC;EACnD,MAAMc,SAAS,MAAM,KAAKlB,WAAW6C,UAAU,EAAE7B,eAAeZ,KAAK0C,MAAM,CAAA;EAE3E,IAAI,CAAC5B,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMyD,SAAS,KAAK/C,WAAWgD,MAAM9B,QAAQ;GACzCH,QAAQ;GACRC,eAAe;EACnB,CAAA;EAEA,MAAM,KAAKhB,WAAW2B,KAAKoB,MAAAA;CAC/B;AACJ"}

package/dist/core/identity/registration/types.d.ts

@@ -1,12 +1,15 @@
-import type { IMailClient } from '../../mail/types.ts';
+import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
 import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IdentityWorkflowContext } from '../types.ts';
 export type RegistrationServiceOptions = {
     registrationEnabled?: boolean;
     emailVerificationEnabled?: boolean;
+    publicUrl?: string;
 };
 export type RegistrationServiceContext = {
     options: RegistrationServiceOptions;
     mailClient: IMailClient;
+    mailTemplateRenderer: IMailTemplateRenderer;
     repository: IUserRepository;
     realmRepository: IRealmRepository;
 };
@@ -14,7 +17,7 @@ export type RegistrationResult = {
     active: boolean;
 };
 export interface IRegistrationService {
-    register(data: Record<string, any>): Promise<RegistrationResult>;
+    register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult>;
     activate(data: {
         token: string;
     }): Promise<void>;

package/dist/core/identity/registration/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,MAAM,MAAM,0BAA0B,GAAG;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,EAAE,WAAW,CAAC;IACxB,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjE,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,0BAA0B,GAAG;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}

package/dist/core/identity/role/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAErF,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,2BAA2B;IAMtC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAkBjE,OAAO,CAAC,sBAAsB;CAUjC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAErF,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,2BAA2B;IAMtC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAkBjE,OAAO,CAAC,sBAAsB;CAiBjC"}

package/dist/core/identity/role/module.mjs

@@ -21,7 +21,7 @@ var IdentityRoleProvider = class {
 	}
 	reduceByIdentityClient(entities, identity) {
 		if (!identity.clientId) return entities;
-		return entities.filter((entity) => entity.client_id === identity.clientId);
+		return entities.filter((entity) => !entity.client_id || entity.client_id === identity.clientId);
 	}
 };
 //#endregion

package/dist/core/identity/role/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityRoleProvider","clientRepository","userRepository","robotRepository","ctx","getRolesFor","identity","type","getBoundRoles","id","then","data","reduceByIdentityClient","entities","clientId","filter","entity","client_id"],"sources":["../../../../src/core/identity/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Role } from '@authup/core-kit';\nimport type { IdentityPolicyData } from '@authup/access';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';\n\nexport class IdentityRoleProvider implements IIdentityRoleProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected robotRepository: IRobotRepository;\n\n    constructor(ctx: IdentityRoleProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async getRolesFor(identity: IdentityPolicyData) : Promise<Role[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.clientRepository.getBoundRoles(identity.id);\n            }\n            case 'user': {\n                return this.userRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n            case 'robot': {\n                return this.robotRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n        }\n\n        return [];\n    }\n\n    private reduceByIdentityClient<T extends { client_id?: string | null }>(\n        entities: T[],\n        identity: IdentityPolicyData,\n    ): T[] {\n        if (!identity.clientId) {\n            return entities;\n        }\n\n        return entities.filter((entity) => entity.client_id === identity.clientId);\n    }\n}\n"],"mappings":";;;;AAcA,IAAaA,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,YAAYC,UAAgD;EAC9D,QAAQA,SAASC,MAAjB;GACI,KAAK,UACD,OAAO,KAAKN,iBAAiBO,cAAcF,SAASG,EAAE;GAE1D,KAAK,QACD,OAAO,KAAKP,eAAeM,cAAcF,SAASG,EAAE,CAAA,CAC/CC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;GAE1D,KAAK,SACD,OAAO,KAAKH,gBAAgBK,cAAcF,SAASG,EAAE,CAAA,CAChDC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;EAE9D;EAEA,OAAO,CAAA;CACX;CAEQM,uBACJC,UACAP,UACG;EACH,IAAI,CAACA,SAASQ,UACV,OAAOD;EAGX,OAAOA,SAASE,QAAQC,WAAWA,OAAOC,cAAcX,SAASQ,QAAQ;CAC7E;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityRoleProvider","clientRepository","userRepository","robotRepository","ctx","getRolesFor","identity","type","getBoundRoles","id","then","data","reduceByIdentityClient","entities","clientId","filter","entity","client_id"],"sources":["../../../../src/core/identity/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Role } from '@authup/core-kit';\nimport type { IdentityPolicyData } from '@authup/access';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';\n\nexport class IdentityRoleProvider implements IIdentityRoleProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected robotRepository: IRobotRepository;\n\n    constructor(ctx: IdentityRoleProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async getRolesFor(identity: IdentityPolicyData) : Promise<Role[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.clientRepository.getBoundRoles(identity.id);\n            }\n            case 'user': {\n                return this.userRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n            case 'robot': {\n                return this.robotRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n        }\n\n        return [];\n    }\n\n    private reduceByIdentityClient<T extends { client_id?: string | null }>(\n        entities: T[],\n        identity: IdentityPolicyData,\n    ): T[] {\n        if (!identity.clientId) {\n            return entities;\n        }\n\n        // Keep client-agnostic (global / realm) roles — client_id null — in\n        // addition to roles scoped to the authenticating client. Dropping the\n        // null case stripped every global/realm role from a token issued via\n        // a real client (e.g. the per-realm `web` client used by the\n        // realm-selection login), leaving permissions/roles empty.\n        return entities.filter(\n            (entity) => !entity.client_id || entity.client_id === identity.clientId,\n        );\n    }\n}\n"],"mappings":";;;;AAcA,IAAaA,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,YAAYC,UAAgD;EAC9D,QAAQA,SAASC,MAAjB;GACI,KAAK,UACD,OAAO,KAAKN,iBAAiBO,cAAcF,SAASG,EAAE;GAE1D,KAAK,QACD,OAAO,KAAKP,eAAeM,cAAcF,SAASG,EAAE,CAAA,CAC/CC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;GAE1D,KAAK,SACD,OAAO,KAAKH,gBAAgBK,cAAcF,SAASG,EAAE,CAAA,CAChDC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;EAE9D;EAEA,OAAO,CAAA;CACX;CAEQM,uBACJC,UACAP,UACG;EACH,IAAI,CAACA,SAASQ,UACV,OAAOD;EAQX,OAAOA,SAASE,QACXC,WAAW,CAACA,OAAOC,aAAaD,OAAOC,cAAcX,SAASQ,QAAQ;CAE/E;AACJ"}

package/dist/core/identity/types.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Per-request ambience the HTTP adapter passes alongside the raw payload of
+ * an identity workflow (registration, password recovery, ...). Carries no
+ * business data — only context such as the requester's preferred locale,
+ * which drives outbound mail localization.
+ */
+export type IdentityWorkflowContext = {
+    locale?: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/identity/types.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/core/identity/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/index.mjs

@@ -12,6 +12,7 @@ import { CredentialsAuthenticator } from "./authentication/module.mjs";
 import { SessionManager } from "./authentication/session/module.mjs";
 import "./authentication/index.mjs";
 import { ClientService } from "./entities/client/service.mjs";
+import { WebClientProvisioner, buildWebClientAttributes } from "./entities/client/web-client.mjs";
 import { ClientPermissionService } from "./entities/client-permission/service.mjs";
 import { ClientRoleService } from "./entities/client-role/service.mjs";
 import { ClientScopeService } from "./entities/client-scope/service.mjs";
@@ -32,6 +33,11 @@ import { UserPermissionService } from "./entities/user-permission/service.mjs";
 import { UserRoleService } from "./entities/user-role/service.mjs";
 import { IdentityProviderRoleMappingService } from "./entities/identity-provider-role-mapping/service.mjs";
 import "./entities/index.mjs";
+import { defineMailTemplate } from "./mail/template/define.mjs";
+import { MailTemplateName } from "./mail/template/types.mjs";
+import { MAIL_TEMPLATE_REGISTRY } from "./mail/template/registry.mjs";
+import { MailTemplateRenderer } from "./mail/renderer.mjs";
+import "./mail/index.mjs";
 import { OAuth2AuthorizationCodeIssuer } from "./oauth2/authorization/code/issuer/module.mjs";
 import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./oauth2/authorization/helpers.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./oauth2/authorization/code/verifier/module.mjs";
@@ -56,6 +62,7 @@ import { OAuth2TokenRevoker } from "./oauth2/token/revoker/module.mjs";
 import { OAuth2TokenSigner } from "./oauth2/token/signer/module.mjs";
 import { OAuth2TokenVerifier } from "./oauth2/token/verifier/module.mjs";
 import "./oauth2/index.mjs";
+import { PASSWORD_RESET_EXPIRES_IN_MINUTES } from "./identity/password-recovery/constants.mjs";
 import { PasswordRecoveryService } from "./identity/password-recovery/service.mjs";
 import { PermissionBindingPolicyEvaluator } from "./security/policy/evaluator.mjs";
 import { PolicyEngine } from "./security/policy/engine.mjs";
@@ -107,4 +114,4 @@ import { ScopeProvisioningSynchronizer } from "./provisioning/synchronizer/scope
 import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/module.mjs";
 import "./provisioning/index.mjs";
 import "./security/index.mjs";
-export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, CredentialsAuthenticator, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, UserAttributeService, UserAuthenticator, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createIdentityProviderOAuth2Authenticator, generateOAuth2CodeVerifier, normalizeEntityProvisioningStrategy };
+export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, CredentialsAuthenticator, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, UserAttributeService, UserAuthenticator, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WebClientProvisioner, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildWebClientAttributes, createIdentityProviderOAuth2Authenticator, defineMailTemplate, generateOAuth2CodeVerifier, normalizeEntityProvisioningStrategy };

package/dist/core/mail/format/blocks.d.ts

@@ -0,0 +1,12 @@
+import type { MailActionBlock, MailCodeBlock, MailNoteBlock, MailParagraphBlock } from './types.ts';
+export declare function paragraph(text: string): MailParagraphBlock;
+export declare function code(label: string, value: string): MailCodeBlock;
+export declare function action(label: string, url: string): MailActionBlock;
+export declare function note(text: string): MailNoteBlock;
+/**
+ * Only http(s) URLs may become call-to-action links. Action URLs are built
+ * from `publicUrl` config today, so this is defense in depth against a
+ * future caller passing an attacker-influenced value (e.g. `javascript:`).
+ */
+export declare function isSafeActionURL(input: string): boolean;
+//# sourceMappingURL=blocks.d.ts.map

package/dist/core/mail/format/blocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocks.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/format/blocks.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,eAAe,EACf,aAAa,EACb,aAAa,EACb,kBAAkB,EACrB,MAAM,YAAY,CAAC;AAEpB,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAE1D;AAED,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAMhE;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,eAAe,CAMlE;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAUtD"}

package/dist/core/mail/format/blocks.mjs

@@ -0,0 +1,47 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/mail/format/blocks.ts
+function paragraph(text) {
+	return {
+		type: "paragraph",
+		text
+	};
+}
+function code(label, value) {
+	return {
+		type: "code",
+		label,
+		value
+	};
+}
+function action(label, url) {
+	return {
+		type: "action",
+		label,
+		url
+	};
+}
+function note(text) {
+	return {
+		type: "note",
+		text
+	};
+}
+/**
+* Only http(s) URLs may become call-to-action links. Action URLs are built
+* from `publicUrl` config today, so this is defense in depth against a
+* future caller passing an attacker-influenced value (e.g. `javascript:`).
+*/ function isSafeActionURL(input) {
+	let parsed;
+	try {
+		parsed = new URL(input);
+	} catch {
+		return false;
+	}
+	return parsed.protocol === "http:" || parsed.protocol === "https:";
+}
+//#endregion
+export { action, code, isSafeActionURL, note, paragraph };
+
+//# sourceMappingURL=blocks.mjs.map

package/dist/core/mail/format/blocks.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocks.mjs","names":["paragraph","text","type","code","label","value","action","url","note","isSafeActionURL","input","parsed","URL","protocol"],"sources":["../../../../src/core/mail/format/blocks.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    MailActionBlock,\n    MailCodeBlock,\n    MailNoteBlock,\n    MailParagraphBlock,\n} from './types.ts';\n\nexport function paragraph(text: string): MailParagraphBlock {\n    return { type: 'paragraph', text };\n}\n\nexport function code(label: string, value: string): MailCodeBlock {\n    return {\n        type: 'code', \n        label, \n        value, \n    };\n}\n\nexport function action(label: string, url: string): MailActionBlock {\n    return {\n        type: 'action', \n        label, \n        url, \n    };\n}\n\nexport function note(text: string): MailNoteBlock {\n    return { type: 'note', text };\n}\n\n/**\n * Only http(s) URLs may become call-to-action links. Action URLs are built\n * from `publicUrl` config today, so this is defense in depth against a\n * future caller passing an attacker-influenced value (e.g. `javascript:`).\n */\nexport function isSafeActionURL(input: string): boolean {\n    let parsed: URL;\n\n    try {\n        parsed = new URL(input);\n    } catch {\n        return false;\n    }\n\n    return parsed.protocol === 'http:' || parsed.protocol === 'https:';\n}\n"],"mappings":";;;;AAcA,SAAgBA,UAAUC,MAAY;CAClC,OAAO;EAAEC,MAAM;EAAaD;CAAK;AACrC;AAEA,SAAgBE,KAAKC,OAAeC,OAAa;CAC7C,OAAO;EACHH,MAAM;EACNE;EACAC;CACJ;AACJ;AAEA,SAAgBC,OAAOF,OAAeG,KAAW;CAC7C,OAAO;EACHL,MAAM;EACNE;EACAG;CACJ;AACJ;AAEA,SAAgBC,KAAKP,MAAY;CAC7B,OAAO;EAAEC,MAAM;EAAQD;CAAK;AAChC;;;;;GAOA,SAAgBQ,gBAAgBC,OAAa;CACzC,IAAIC;CAEJ,IAAI;EACAA,SAAS,IAAIC,IAAIF,KAAAA;CACrB,QAAQ;EACJ,OAAO;CACX;CAEA,OAAOC,OAAOE,aAAa,WAAWF,OAAOE,aAAa;AAC9D"}

package/dist/core/mail/format/html.d.ts

@@ -0,0 +1,9 @@
+import type { MailDocument } from './types.ts';
+export declare function escapeHtml(input: string): string;
+/**
+ * Wrap the block list in a small branded HTML shell. Inline styles only —
+ * mail clients strip <style>/external CSS. The preheader is rendered
+ * invisible but picked up by clients as the preview line.
+ */
+export declare function renderHtmlDocument(document: MailDocument): string;
+//# sourceMappingURL=html.d.ts.map

package/dist/core/mail/format/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/format/html.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAa,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1D,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AAyBD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,CAgBjE"}

package/dist/core/mail/format/html.mjs

@@ -0,0 +1,41 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/mail/format/html.ts
+function escapeHtml(input) {
+	return input.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function renderBlock(block) {
+	switch (block.type) {
+		case "paragraph": return `<p style="margin:0 0 16px;">${escapeHtml(block.text)}</p>`;
+		case "code": return `<p style="margin:0 0 4px;font-size:13px;color:#9aa0aa;">${escapeHtml(block.label)}</p>
+        <p style="margin:0 0 16px;font-family:monospace;font-size:16px;letter-spacing:0.04em;word-break:break-all;background:#f4f4f6;border-radius:8px;padding:12px 14px;">${escapeHtml(block.value)}</p>`;
+		case "action": return `<p style="margin:24px 0 16px;">
+            <a href="${escapeHtml(block.url)}" style="display:inline-block;padding:10px 18px;border-radius:8px;background:#6d7fcc;color:#ffffff;text-decoration:none;font-weight:600;">${escapeHtml(block.label)}</a>
+        </p>`;
+		case "note": return `<p style="margin:0 0 8px;font-size:13px;color:#9aa0aa;">${escapeHtml(block.text)}</p>`;
+		default: return "";
+	}
+}
+/**
+* Wrap the block list in a small branded HTML shell. Inline styles only —
+* mail clients strip <style>/external CSS. The preheader is rendered
+* invisible but picked up by clients as the preview line.
+*/ function renderHtmlDocument(document) {
+	const preheader = document.preview ? `<div style="display:none;max-height:0;overflow:hidden;mso-hide:all;">${escapeHtml(document.preview)}</div>` : "";
+	return `<!doctype html>
+<html lang="${escapeHtml(document.lang || "en")}">
+<body style="margin:0;padding:24px;background:#f4f4f6;font-family:Nunito,Segoe UI,Arial,sans-serif;color:#26272c;">
+    ${preheader}
+    <div style="max-width:480px;margin:0 auto;background:#ffffff;border-radius:12px;padding:28px;">
+        <div style="font-family:Asap,Arial,sans-serif;font-weight:700;font-size:20px;color:#6d7fcc;margin-bottom:16px;">Authup</div>
+        ${document.blocks.map((block) => renderBlock(block)).join("\n        ")}
+    </div>
+    <div style="max-width:480px;margin:12px auto 0;text-align:center;font-size:12px;color:#9aa0aa;">Made with &#128154;</div>
+</body>
+</html>`;
+}
+//#endregion
+export { escapeHtml, renderHtmlDocument };
+
+//# sourceMappingURL=html.mjs.map

package/dist/core/mail/format/html.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.mjs","names":["escapeHtml","input","replace","renderBlock","block","type","text","label","value","url","renderHtmlDocument","document","preheader","preview","lang","blocks","map","join"],"sources":["../../../../src/core/mail/format/html.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { MailBlock, MailDocument } from './types.ts';\n\nexport function escapeHtml(input: string): string {\n    return input\n        .replace(/&/g, '&amp;')\n        .replace(/</g, '&lt;')\n        .replace(/>/g, '&gt;')\n        .replace(/\"/g, '&quot;')\n        .replace(/'/g, '&#39;');\n}\n\nfunction renderBlock(block: MailBlock): string {\n    switch (block.type) {\n        case 'paragraph': {\n            return `<p style=\"margin:0 0 16px;\">${escapeHtml(block.text)}</p>`;\n        }\n        case 'code': {\n            return `<p style=\"margin:0 0 4px;font-size:13px;color:#9aa0aa;\">${escapeHtml(block.label)}</p>\n        <p style=\"margin:0 0 16px;font-family:monospace;font-size:16px;letter-spacing:0.04em;word-break:break-all;background:#f4f4f6;border-radius:8px;padding:12px 14px;\">${escapeHtml(block.value)}</p>`;\n        }\n        case 'action': {\n            return `<p style=\"margin:24px 0 16px;\">\n            <a href=\"${escapeHtml(block.url)}\" style=\"display:inline-block;padding:10px 18px;border-radius:8px;background:#6d7fcc;color:#ffffff;text-decoration:none;font-weight:600;\">${escapeHtml(block.label)}</a>\n        </p>`;\n        }\n        case 'note': {\n            return `<p style=\"margin:0 0 8px;font-size:13px;color:#9aa0aa;\">${escapeHtml(block.text)}</p>`;\n        }\n        default: {\n            return '';\n        }\n    }\n}\n\n/**\n * Wrap the block list in a small branded HTML shell. Inline styles only —\n * mail clients strip <style>/external CSS. The preheader is rendered\n * invisible but picked up by clients as the preview line.\n */\nexport function renderHtmlDocument(document: MailDocument): string {\n    const preheader = document.preview ?\n        `<div style=\"display:none;max-height:0;overflow:hidden;mso-hide:all;\">${escapeHtml(document.preview)}</div>` :\n        '';\n\n    return `<!doctype html>\n<html lang=\"${escapeHtml(document.lang || 'en')}\">\n<body style=\"margin:0;padding:24px;background:#f4f4f6;font-family:Nunito,Segoe UI,Arial,sans-serif;color:#26272c;\">\n    ${preheader}\n    <div style=\"max-width:480px;margin:0 auto;background:#ffffff;border-radius:12px;padding:28px;\">\n        <div style=\"font-family:Asap,Arial,sans-serif;font-weight:700;font-size:20px;color:#6d7fcc;margin-bottom:16px;\">Authup</div>\n        ${document.blocks.map((block) => renderBlock(block)).join('\\n        ')}\n    </div>\n    <div style=\"max-width:480px;margin:12px auto 0;text-align:center;font-size:12px;color:#9aa0aa;\">Made with &#128154;</div>\n</body>\n</html>`;\n}\n"],"mappings":";;;;AASA,SAAgBA,WAAWC,OAAa;CACpC,OAAOA,MACFC,QAAQ,MAAM,OAAA,CAAA,CACdA,QAAQ,MAAM,MAAA,CAAA,CACdA,QAAQ,MAAM,MAAA,CAAA,CACdA,QAAQ,MAAM,QAAA,CAAA,CACdA,QAAQ,MAAM,OAAA;AACvB;AAEA,SAASC,YAAYC,OAAgB;CACjC,QAAQA,MAAMC,MAAd;EACI,KAAK,aACD,OAAO,+BAA+BL,WAAWI,MAAME,IAAI,EAAE;EAEjE,KAAK,QACD,OAAO,2DAA2DN,WAAWI,MAAMG,KAAK,EAAE;6KACuEP,WAAWI,MAAMI,KAAK,EAAE;EAE7L,KAAK,UACD,OAAO;uBACIR,WAAWI,MAAMK,GAAG,EAAE,4IAA4IT,WAAWI,MAAMG,KAAK,EAAE;;EAGzM,KAAK,QACD,OAAO,2DAA2DP,WAAWI,MAAME,IAAI,EAAE;EAE7F,SACI,OAAO;CAEf;AACJ;;;;;GAOA,SAAgBI,mBAAmBC,UAAsB;CACrD,MAAMC,YAAYD,SAASE,UACvB,wEAAwEb,WAAWW,SAASE,OAAO,EAAE,UACrG;CAEJ,OAAO;cACGb,WAAWW,SAASG,QAAQ,IAAA,EAAM;;MAE1CF,UAAU;;;UAGND,SAASI,OAAOC,KAAKZ,UAAUD,YAAYC,KAAAA,CAAAA,CAAAA,CAAQa,KAAK,YAAA,EAAc;;;;;AAKhF"}

package/dist/core/mail/format/index.d.ts

@@ -0,0 +1,5 @@
+export * from './blocks.ts';
+export * from './html.ts';
+export * from './text.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/mail/format/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/format/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}

package/dist/core/mail/format/index.mjs

@@ -0,0 +1,7 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { action, code, isSafeActionURL, note, paragraph } from "./blocks.mjs";
+import { escapeHtml, renderHtmlDocument } from "./html.mjs";
+import { renderTextDocument } from "./text.mjs";
+export { action, code, escapeHtml, isSafeActionURL, note, paragraph, renderHtmlDocument, renderTextDocument };

package/dist/core/mail/format/text.d.ts

@@ -0,0 +1,3 @@
+import type { MailDocument } from './types.ts';
+export declare function renderTextDocument(document: MailDocument): string;
+//# sourceMappingURL=text.d.ts.map

package/dist/core/mail/format/text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/format/text.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAa,YAAY,EAAE,MAAM,YAAY,CAAC;AAsB1D,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,CAKjE"}

package/dist/core/mail/format/text.mjs

@@ -0,0 +1,20 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/mail/format/text.ts
+function renderBlock(block) {
+	switch (block.type) {
+		case "paragraph": return block.text;
+		case "code": return `${block.label}: ${block.value}`;
+		case "action": return `${block.label}: ${block.url}`;
+		case "note": return block.text;
+		default: return "";
+	}
+}
+function renderTextDocument(document) {
+	return document.blocks.map((block) => renderBlock(block)).filter((line) => line.length > 0).join("\n\n");
+}
+//#endregion
+export { renderTextDocument };
+
+//# sourceMappingURL=text.mjs.map

package/dist/core/mail/format/text.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.mjs","names":["renderBlock","block","type","text","label","value","url","renderTextDocument","document","blocks","map","filter","line","length","join"],"sources":["../../../../src/core/mail/format/text.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { MailBlock, MailDocument } from './types.ts';\n\nfunction renderBlock(block: MailBlock): string {\n    switch (block.type) {\n        case 'paragraph': {\n            return block.text;\n        }\n        case 'code': {\n            return `${block.label}: ${block.value}`;\n        }\n        case 'action': {\n            return `${block.label}: ${block.url}`;\n        }\n        case 'note': {\n            return block.text;\n        }\n        default: {\n            return '';\n        }\n    }\n}\n\nexport function renderTextDocument(document: MailDocument): string {\n    return document.blocks\n        .map((block) => renderBlock(block))\n        .filter((line) => line.length > 0)\n        .join('\\n\\n');\n}\n"],"mappings":";;;;AASA,SAASA,YAAYC,OAAgB;CACjC,QAAQA,MAAMC,MAAd;EACI,KAAK,aACD,OAAOD,MAAME;EAEjB,KAAK,QACD,OAAO,GAAGF,MAAMG,MAAM,IAAIH,MAAMI;EAEpC,KAAK,UACD,OAAO,GAAGJ,MAAMG,MAAM,IAAIH,MAAMK;EAEpC,KAAK,QACD,OAAOL,MAAME;EAEjB,SACI,OAAO;CAEf;AACJ;AAEA,SAAgBI,mBAAmBC,UAAsB;CACrD,OAAOA,SAASC,OACXC,KAAKT,UAAUD,YAAYC,KAAAA,CAAAA,CAAAA,CAC3BU,QAAQC,SAASA,KAAKC,SAAS,CAAA,CAAA,CAC/BC,KAAK,MAAA;AACd"}