@de-otio/trellis 0.4.0

package/dist/lib/email-provider.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Email Provider Abstraction Layer
+ *
+ * This abstraction allows swapping email service providers per region without code changes.
+ * This is critical for China expansion, as Resend may not be available there.
+ *
+ * Supported Providers:
+ * - Resend (current, global)
+ * - Alibaba Cloud DirectMail (China)
+ * - Tencent Cloud SES (China)
+ * - AWS SES (global, including China regions)
+ * - SMTP (generic, for any SMTP-compatible service)
+ */
+import { type LoggerEnv } from "./logger";
+export interface EmailSendOptions {
+    from: string;
+    to: string | string[];
+    subject: string;
+    html?: string;
+    text?: string;
+    replyTo?: string;
+    cc?: string | string[];
+    bcc?: string | string[];
+    tags?: Record<string, string>;
+}
+export interface EmailSendResult {
+    messageId: string;
+    provider: string;
+}
+export interface EmailUsageStats {
+    emailsSent: number;
+    period: "month" | "day" | "year";
+    periodStart: string;
+    periodEnd: string;
+}
+export interface EmailProvider {
+    /**
+     * Send an email
+     */
+    sendEmail(options: EmailSendOptions): Promise<EmailSendResult>;
+    /**
+     * Get usage statistics (for cost calculation)
+     * Returns null if provider doesn't support usage stats
+     */
+    getUsageStats?(period?: "month" | "day" | "year"): Promise<EmailUsageStats | null>;
+    /**
+     * Get provider name for identification
+     */
+    getName(): string;
+}
+/**
+ * Resend Email Provider (Current Implementation)
+ *
+ * Used globally except in China where it may not be available.
+ */
+export declare class ResendEmailProvider implements EmailProvider {
+    private apiKey;
+    private baseUrl;
+    private logger;
+    constructor(apiKey: string, baseUrl?: string, env?: LoggerEnv | any);
+    getName(): string;
+    sendEmail(options: EmailSendOptions): Promise<EmailSendResult>;
+    getUsageStats(period?: "month" | "day" | "year"): Promise<EmailUsageStats | null>;
+}
+/**
+ * Alibaba Cloud DirectMail Provider (China)
+ *
+ * Alibaba Cloud DirectMail is a China-compliant email service.
+ * Documentation: https://www.alibabacloud.com/help/en/directmail
+ */
+export declare class AlibabaDirectMailProvider implements EmailProvider {
+    private accessKeyId;
+    private accessKeySecret;
+    private region;
+    private accountName;
+    constructor(accessKeyId: string, accessKeySecret: string, region: string | undefined, accountName: string);
+    getName(): string;
+    sendEmail(options: EmailSendOptions): Promise<EmailSendResult>;
+    getUsageStats(): Promise<EmailUsageStats | null>;
+}
+/**
+ * Tencent Cloud SES Provider (China)
+ *
+ * Tencent Cloud Simple Email Service is a China-compliant email service.
+ * Documentation: https://cloud.tencent.com/document/product/1288
+ */
+export declare class TencentSESProvider implements EmailProvider {
+    private secretId;
+    private secretKey;
+    private region;
+    private fromEmail;
+    constructor(secretId: string, secretKey: string, region: string | undefined, fromEmail: string);
+    getName(): string;
+    sendEmail(options: EmailSendOptions): Promise<EmailSendResult>;
+    getUsageStats(): Promise<EmailUsageStats | null>;
+}
+/**
+ * AWS SES Provider (Global, including China regions)
+ *
+ * AWS SES works globally and has China regions (Beijing, Ningxia).
+ * Documentation: https://docs.aws.amazon.com/ses/
+ */
+export declare class AWSSESProvider implements EmailProvider {
+    private accessKeyId;
+    private secretAccessKey;
+    private region;
+    constructor(accessKeyId: string, secretAccessKey: string, region?: string);
+    getName(): string;
+    sendEmail(options: EmailSendOptions): Promise<EmailSendResult>;
+    getUsageStats(): Promise<EmailUsageStats | null>;
+}
+/**
+ * Factory function to create email provider based on region and configuration
+ */
+export interface EmailProviderConfig {
+    provider: "resend" | "alibaba-directmail" | "tencent-ses" | "aws-ses";
+    region?: string;
+    resendApiKey?: string;
+    resendBaseUrl?: string;
+    alibabaAccessKeyId?: string;
+    alibabaAccessKeySecret?: string;
+    alibabaRegion?: string;
+    alibabaAccountName?: string;
+    tencentSecretId?: string;
+    tencentSecretKey?: string;
+    tencentRegion?: string;
+    tencentFromEmail?: string;
+    awsAccessKeyId?: string;
+    awsSecretAccessKey?: string;
+    awsRegion?: string;
+}
+export declare function createEmailProvider(config: EmailProviderConfig): EmailProvider;
+//# sourceMappingURL=email-provider.d.ts.map

package/dist/lib/email-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-provider.d.ts","sourceRoot":"","sources":["../../src/lib/email-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAElD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAE/D;;;OAGG;IACH,aAAa,CAAC,CACZ,MAAM,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAChC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEnC;;OAEG;IACH,OAAO,IAAI,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,aAAa;IACvD,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;gBAGrB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,MAAiC,EAC1C,GAAG,CAAC,EAAE,SAAS,GAAG,GAAG;IAOvB,OAAO,IAAI,MAAM;IAIX,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAwC9D,aAAa,CACjB,MAAM,GAAE,OAAO,GAAG,KAAK,GAAG,MAAgB,GACzC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;CA8CnC;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,YAAW,aAAa;IAC7D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAS;gBAG1B,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,YAAgB,EAC9B,WAAW,EAAE,MAAM;IAQrB,OAAO,IAAI,MAAM;IAIX,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAiD9D,aAAa,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;CAKvD;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,aAAa;IACtD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAS;gBAGxB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,YAAe,EAC7B,SAAS,EAAE,MAAM;IAQnB,OAAO,IAAI,MAAM;IAIX,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAmD9D,aAAa,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;CAKvD;AAED;;;;;GAKG;AACH,qBAAa,cAAe,YAAW,aAAa;IAClD,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,MAAM,CAAS;gBAGrB,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,MAAM,GAAE,MAAoB;IAO9B,OAAO,IAAI,MAAM;IAIX,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAgE9D,aAAa,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;CAKvD;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,QAAQ,GAAG,oBAAoB,GAAG,aAAa,GAAG,SAAS,CAAC;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,mBAAmB,GAC1B,aAAa,CAuHf"}

package/dist/lib/email-provider.js

@@ -0,0 +1,391 @@
+"use strict";
+/**
+ * Email Provider Abstraction Layer
+ *
+ * This abstraction allows swapping email service providers per region without code changes.
+ * This is critical for China expansion, as Resend may not be available there.
+ *
+ * Supported Providers:
+ * - Resend (current, global)
+ * - Alibaba Cloud DirectMail (China)
+ * - Tencent Cloud SES (China)
+ * - AWS SES (global, including China regions)
+ * - SMTP (generic, for any SMTP-compatible service)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AWSSESProvider = exports.TencentSESProvider = exports.AlibabaDirectMailProvider = exports.ResendEmailProvider = void 0;
+exports.createEmailProvider = createEmailProvider;
+const logger_1 = require("./logger");
+/**
+ * Resend Email Provider (Current Implementation)
+ *
+ * Used globally except in China where it may not be available.
+ */
+class ResendEmailProvider {
+    apiKey;
+    baseUrl;
+    logger;
+    constructor(apiKey, baseUrl = "https://api.resend.com", env) {
+        this.apiKey = apiKey;
+        this.baseUrl = baseUrl;
+        this.logger = logger_1.Logger.getInstance(env);
+    }
+    getName() {
+        return "resend";
+    }
+    async sendEmail(options) {
+        const response = await fetch(`${this.baseUrl}/emails`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${this.apiKey}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                from: options.from,
+                to: Array.isArray(options.to) ? options.to : [options.to],
+                subject: options.subject,
+                html: options.html,
+                text: options.text,
+                reply_to: options.replyTo,
+                cc: options.cc
+                    ? Array.isArray(options.cc)
+                        ? options.cc
+                        : [options.cc]
+                    : undefined,
+                bcc: options.bcc
+                    ? Array.isArray(options.bcc)
+                        ? options.bcc
+                        : [options.bcc]
+                    : undefined,
+                tags: options.tags,
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Resend API error: ${response.status} ${error}`);
+        }
+        const data = (await response.json());
+        return {
+            messageId: data.id,
+            provider: "resend",
+        };
+    }
+    async getUsageStats(period = "month") {
+        try {
+            const response = await fetch(`${this.baseUrl}/usage`, {
+                headers: {
+                    Authorization: `Bearer ${this.apiKey}`,
+                },
+            });
+            if (!response.ok) {
+                return null;
+            }
+            const usage = (await response.json());
+            const emailsSent = usage.emails_sent || 0;
+            // Calculate period dates
+            const now = new Date();
+            let periodStart;
+            let periodEnd = now;
+            if (period === "month") {
+                periodStart = new Date(now.getFullYear(), now.getMonth(), 1);
+            }
+            else if (period === "day") {
+                periodStart = new Date(now.getFullYear(), now.getMonth(), now.getDate());
+            }
+            else {
+                periodStart = new Date(now.getFullYear(), 0, 1);
+            }
+            return {
+                emailsSent,
+                period,
+                periodStart: periodStart.toISOString(),
+                periodEnd: periodEnd.toISOString(),
+            };
+        }
+        catch (error) {
+            this.logger.error("[ResendEmailProvider] Error fetching usage stats:", error);
+            return null;
+        }
+    }
+}
+exports.ResendEmailProvider = ResendEmailProvider;
+/**
+ * Alibaba Cloud DirectMail Provider (China)
+ *
+ * Alibaba Cloud DirectMail is a China-compliant email service.
+ * Documentation: https://www.alibabacloud.com/help/en/directmail
+ */
+class AlibabaDirectMailProvider {
+    accessKeyId;
+    accessKeySecret;
+    region; // e.g., 'cn-hangzhou'
+    accountName; // Verified sender email address
+    constructor(accessKeyId, accessKeySecret, region = "cn-hangzhou", accountName) {
+        this.accessKeyId = accessKeyId;
+        this.accessKeySecret = accessKeySecret;
+        this.region = region;
+        this.accountName = accountName;
+    }
+    getName() {
+        return "alibaba-directmail";
+    }
+    async sendEmail(options) {
+        // Alibaba Cloud DirectMail uses Alibaba Cloud SDK
+        // This is a simplified implementation - in production, use @alicloud/dysmsapi-sdk
+        // For now, we'll use their REST API
+        const endpoint = `https://dm.${this.region}.aliyuncs.com`;
+        const action = "SingleSendMail";
+        // Build request parameters
+        const params = new URLSearchParams({
+            Action: action,
+            Version: "2015-11-23",
+            AccessKeyId: this.accessKeyId,
+            Format: "JSON",
+            SignatureMethod: "HMAC-SHA1",
+            Timestamp: new Date().toISOString().replace(/[:\-]|\.\d{3}/g, ""),
+            SignatureVersion: "1.0",
+            AccountName: this.accountName,
+            FromAlias: options.from.split("@")[0],
+            ToAddress: Array.isArray(options.to) ? options.to.join(",") : options.to,
+            Subject: options.subject,
+            HtmlBody: options.html || options.text || "",
+            TextBody: options.text || "",
+            ReplyToAddress: options.replyTo || "false",
+        });
+        // Note: In production, you'd need to properly sign the request using HMAC-SHA1
+        // This is a placeholder - implement proper Alibaba Cloud signature algorithm
+        const response = await fetch(`${endpoint}?${params.toString()}`, {
+            method: "POST",
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Alibaba DirectMail API error: ${response.status} ${error}`);
+        }
+        const data = (await response.json());
+        return {
+            messageId: data.EnvId || data.RequestId || "unknown",
+            provider: "alibaba-directmail",
+        };
+    }
+    async getUsageStats() {
+        // Alibaba Cloud DirectMail usage stats would require additional API calls
+        // This is a placeholder - implement based on Alibaba Cloud API documentation
+        return null;
+    }
+}
+exports.AlibabaDirectMailProvider = AlibabaDirectMailProvider;
+/**
+ * Tencent Cloud SES Provider (China)
+ *
+ * Tencent Cloud Simple Email Service is a China-compliant email service.
+ * Documentation: https://cloud.tencent.com/document/product/1288
+ */
+class TencentSESProvider {
+    secretId;
+    secretKey;
+    region; // e.g., 'ap-beijing'
+    fromEmail; // Verified sender email address
+    constructor(secretId, secretKey, region = "ap-beijing", fromEmail) {
+        this.secretId = secretId;
+        this.secretKey = secretKey;
+        this.region = region;
+        this.fromEmail = fromEmail;
+    }
+    getName() {
+        return "tencent-ses";
+    }
+    async sendEmail(options) {
+        // Tencent Cloud SES uses Tencent Cloud SDK
+        // This is a simplified implementation - in production, use tencentcloud-sdk-nodejs
+        // For now, we'll use their API v3
+        const endpoint = `https://ses.tencentcloudapi.com`;
+        // Note: In production, you'd need to properly sign the request using TC3-HMAC-SHA256
+        // This is a placeholder - implement proper Tencent Cloud signature algorithm
+        const payload = {
+            FromEmailAddress: this.fromEmail,
+            Destination: Array.isArray(options.to) ? options.to : [options.to],
+            Subject: options.subject,
+            Template: {
+                TemplateID: 0, // Use template ID if using templates
+                TemplateData: JSON.stringify({
+                    html: options.html || options.text || "",
+                    text: options.text || "",
+                }),
+            },
+            Simple: {
+                Html: options.html || options.text || "",
+                Text: options.text || "",
+            },
+        };
+        const response = await fetch(endpoint, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "X-TC-Action": "SendEmail",
+                "X-TC-Version": "2020-10-14",
+                "X-TC-Region": this.region,
+            },
+            body: JSON.stringify(payload),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Tencent SES API error: ${response.status} ${error}`);
+        }
+        const data = (await response.json());
+        return {
+            messageId: data.Response?.MessageId || "unknown",
+            provider: "tencent-ses",
+        };
+    }
+    async getUsageStats() {
+        // Tencent Cloud SES usage stats would require additional API calls
+        // This is a placeholder - implement based on Tencent Cloud API documentation
+        return null;
+    }
+}
+exports.TencentSESProvider = TencentSESProvider;
+/**
+ * AWS SES Provider (Global, including China regions)
+ *
+ * AWS SES works globally and has China regions (Beijing, Ningxia).
+ * Documentation: https://docs.aws.amazon.com/ses/
+ */
+class AWSSESProvider {
+    accessKeyId;
+    secretAccessKey;
+    region; // e.g., 'us-east-1', 'cn-north-1', 'cn-northwest-1'
+    constructor(accessKeyId, secretAccessKey, region = "us-east-1") {
+        this.accessKeyId = accessKeyId;
+        this.secretAccessKey = secretAccessKey;
+        this.region = region;
+    }
+    getName() {
+        return "aws-ses";
+    }
+    async sendEmail(options) {
+        // AWS SES uses AWS Signature Version 4
+        // This is a simplified implementation - in production, use AWS SDK
+        // For now, we'll use their REST API
+        const endpoint = `https://email.${this.region}.amazonaws.com`;
+        // Note: In production, you'd need to properly sign the request using AWS Signature V4
+        // This is a placeholder - implement proper AWS signature algorithm
+        const payload = {
+            Source: options.from,
+            Destination: {
+                ToAddresses: Array.isArray(options.to) ? options.to : [options.to],
+                CcAddresses: options.cc
+                    ? Array.isArray(options.cc)
+                        ? options.cc
+                        : [options.cc]
+                    : undefined,
+                BccAddresses: options.bcc
+                    ? Array.isArray(options.bcc)
+                        ? options.bcc
+                        : [options.bcc]
+                    : undefined,
+            },
+            Message: {
+                Subject: {
+                    Data: options.subject,
+                    Charset: "UTF-8",
+                },
+                Body: {
+                    Html: options.html
+                        ? { Data: options.html, Charset: "UTF-8" }
+                        : undefined,
+                    Text: options.text
+                        ? { Data: options.text, Charset: "UTF-8" }
+                        : undefined,
+                },
+            },
+            ReplyToAddresses: options.replyTo ? [options.replyTo] : undefined,
+        };
+        const response = await fetch(endpoint, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-amz-json-1.1",
+                "X-Amz-Target": "AWSSimpleEmailService.SendEmail",
+            },
+            body: JSON.stringify(payload),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`AWS SES API error: ${response.status} ${error}`);
+        }
+        const data = (await response.json());
+        return {
+            messageId: data.SendEmailResult?.MessageId || "unknown",
+            provider: "aws-ses",
+        };
+    }
+    async getUsageStats() {
+        // AWS SES usage stats would require CloudWatch API calls
+        // This is a placeholder - implement based on AWS CloudWatch API
+        return null;
+    }
+}
+exports.AWSSESProvider = AWSSESProvider;
+function createEmailProvider(config) {
+    // If region is China, prefer China-compatible providers
+    if (config.region === "CN" || config.region === "cn") {
+        // Priority: Alibaba DirectMail > Tencent SES > AWS SES (China regions)
+        if (config.provider === "alibaba-directmail" ||
+            (config.provider === "resend" && config.alibabaAccessKeyId)) {
+            if (!config.alibabaAccessKeyId ||
+                !config.alibabaAccessKeySecret ||
+                !config.alibabaAccountName) {
+                throw new Error("Alibaba DirectMail requires accessKeyId, accessKeySecret, and accountName");
+            }
+            return new AlibabaDirectMailProvider(config.alibabaAccessKeyId, config.alibabaAccessKeySecret, config.alibabaRegion || "cn-hangzhou", config.alibabaAccountName);
+        }
+        if (config.provider === "tencent-ses" ||
+            (config.provider === "resend" && config.tencentSecretId)) {
+            if (!config.tencentSecretId ||
+                !config.tencentSecretKey ||
+                !config.tencentFromEmail) {
+                throw new Error("Tencent SES requires secretId, secretKey, and fromEmail");
+            }
+            return new TencentSESProvider(config.tencentSecretId, config.tencentSecretKey, config.tencentRegion || "ap-beijing", config.tencentFromEmail);
+        }
+        if (config.provider === "aws-ses" ||
+            (config.provider === "resend" && config.awsAccessKeyId)) {
+            if (!config.awsAccessKeyId || !config.awsSecretAccessKey) {
+                throw new Error("AWS SES requires accessKeyId and secretAccessKey");
+            }
+            // Use China region for AWS SES
+            return new AWSSESProvider(config.awsAccessKeyId, config.awsSecretAccessKey, config.awsRegion || "cn-north-1");
+        }
+    }
+    // Default to Resend for non-China regions or explicit Resend selection
+    if (config.provider === "resend" || !config.provider) {
+        if (!config.resendApiKey) {
+            throw new Error("Resend requires resendApiKey");
+        }
+        return new ResendEmailProvider(config.resendApiKey, config.resendBaseUrl);
+    }
+    // Explicit provider selection
+    switch (config.provider) {
+        case "alibaba-directmail":
+            if (!config.alibabaAccessKeyId ||
+                !config.alibabaAccessKeySecret ||
+                !config.alibabaAccountName) {
+                throw new Error("Alibaba DirectMail requires accessKeyId, accessKeySecret, and accountName");
+            }
+            return new AlibabaDirectMailProvider(config.alibabaAccessKeyId, config.alibabaAccessKeySecret, config.alibabaRegion || "cn-hangzhou", config.alibabaAccountName);
+        case "tencent-ses":
+            if (!config.tencentSecretId ||
+                !config.tencentSecretKey ||
+                !config.tencentFromEmail) {
+                throw new Error("Tencent SES requires secretId, secretKey, and fromEmail");
+            }
+            return new TencentSESProvider(config.tencentSecretId, config.tencentSecretKey, config.tencentRegion || "ap-beijing", config.tencentFromEmail);
+        case "aws-ses":
+            if (!config.awsAccessKeyId || !config.awsSecretAccessKey) {
+                throw new Error("AWS SES requires accessKeyId and secretAccessKey");
+            }
+            return new AWSSESProvider(config.awsAccessKeyId, config.awsSecretAccessKey, config.awsRegion || "us-east-1");
+        default:
+            throw new Error(`Unknown email provider: ${config.provider}`);
+    }
+}
+//# sourceMappingURL=email-provider.js.map

package/dist/lib/email-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-provider.js","sourceRoot":"","sources":["../../src/lib/email-provider.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAqcH,kDAyHC;AA5jBD,qCAAkD;AA8ClD;;;;GAIG;AACH,MAAa,mBAAmB;IACtB,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,MAAM,CAAS;IAEvB,YACE,MAAc,EACd,UAAkB,wBAAwB,EAC1C,GAAqB;QAErB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,OAAO;QACL,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAyB;QACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,SAAS,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;gBACtC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzD,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,OAAO;gBACzB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACZ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;wBACzB,CAAC,CAAC,OAAO,CAAC,EAAE;wBACZ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChB,CAAC,CAAC,SAAS;gBACb,GAAG,EAAE,OAAO,CAAC,GAAG;oBACd,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;wBAC1B,CAAC,CAAC,OAAO,CAAC,GAAG;wBACb,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;oBACjB,CAAC,CAAC,SAAS;gBACb,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAC;QACvD,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB,QAAQ,EAAE,QAAQ;SACnB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,SAAmC,OAAO;QAE1C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,QAAQ,EAAE;gBACpD,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;iBACvC;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA6B,CAAC;YAClE,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC;YAE1C,yBAAyB;YACzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,WAAiB,CAAC;YACtB,IAAI,SAAS,GAAS,GAAG,CAAC;YAE1B,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;YAC/D,CAAC;iBAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC5B,WAAW,GAAG,IAAI,IAAI,CACpB,GAAG,CAAC,WAAW,EAAE,EACjB,GAAG,CAAC,QAAQ,EAAE,EACd,GAAG,CAAC,OAAO,EAAE,CACd,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;YAED,OAAO;gBACL,UAAU;gBACV,MAAM;gBACN,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;gBACtC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,mDAAmD,EACnD,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AA3GD,kDA2GC;AAED;;;;;GAKG;AACH,MAAa,yBAAyB;IAC5B,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,MAAM,CAAS,CAAC,sBAAsB;IACtC,WAAW,CAAS,CAAC,gCAAgC;IAE7D,YACE,WAAmB,EACnB,eAAuB,EACvB,SAAiB,aAAa,EAC9B,WAAmB;QAEnB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,OAAO;QACL,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAyB;QACvC,kDAAkD;QAClD,kFAAkF;QAClF,oCAAoC;QAEpC,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,eAAe,CAAC;QAC1D,MAAM,MAAM,GAAG,gBAAgB,CAAC;QAEhC,2BAA2B;QAC3B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,YAAY;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,MAAM;YACd,eAAe,EAAE,WAAW;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACjE,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;YACxE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE;YAC5C,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;YAC5B,cAAc,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO;SAC3C,CAAC,CAAC;QAEH,+EAA+E;QAC/E,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE;YAC/D,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,iCAAiC,QAAQ,CAAC,MAAM,IAAI,KAAK,EAAE,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;QACF,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,SAAS;YACpD,QAAQ,EAAE,oBAAoB;SAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA5ED,8DA4EC;AAED;;;;;GAKG;AACH,MAAa,kBAAkB;IACrB,QAAQ,CAAS;IACjB,SAAS,CAAS;IAClB,MAAM,CAAS,CAAC,qBAAqB;IACrC,SAAS,CAAS,CAAC,gCAAgC;IAE3D,YACE,QAAgB,EAChB,SAAiB,EACjB,SAAiB,YAAY,EAC7B,SAAiB;QAEjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAyB;QACvC,2CAA2C;QAC3C,mFAAmF;QACnF,kCAAkC;QAElC,MAAM,QAAQ,GAAG,iCAAiC,CAAC;QAEnD,qFAAqF;QACrF,6EAA6E;QAC7E,MAAM,OAAO,GAAG;YACd,gBAAgB,EAAE,IAAI,CAAC,SAAS;YAChC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE;gBACR,UAAU,EAAE,CAAC,EAAE,qCAAqC;gBACpD,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC;oBAC3B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE;oBACxC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;iBACzB,CAAC;aACH;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE;gBACxC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;aACzB;SACF,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,WAAW;gBAC1B,cAAc,EAAE,YAAY;gBAC5B,aAAa,EAAE,IAAI,CAAC,MAAM;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAElC,CAAC;QACF,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,IAAI,SAAS;YAChD,QAAQ,EAAE,aAAa;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,mEAAmE;QACnE,6EAA6E;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA9ED,gDA8EC;AAED;;;;;GAKG;AACH,MAAa,cAAc;IACjB,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,MAAM,CAAS,CAAC,oDAAoD;IAE5E,YACE,WAAmB,EACnB,eAAuB,EACvB,SAAiB,WAAW;QAE5B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,OAAO;QACL,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAyB;QACvC,uCAAuC;QACvC,mEAAmE;QACnE,oCAAoC;QAEpC,MAAM,QAAQ,GAAG,iBAAiB,IAAI,CAAC,MAAM,gBAAgB,CAAC;QAE9D,sFAAsF;QACtF,mEAAmE;QACnE,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,OAAO,CAAC,IAAI;YACpB,WAAW,EAAE;gBACX,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClE,WAAW,EAAE,OAAO,CAAC,EAAE;oBACrB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;wBACzB,CAAC,CAAC,OAAO,CAAC,EAAE;wBACZ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChB,CAAC,CAAC,SAAS;gBACb,YAAY,EAAE,OAAO,CAAC,GAAG;oBACvB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;wBAC1B,CAAC,CAAC,OAAO,CAAC,GAAG;wBACb,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;oBACjB,CAAC,CAAC,SAAS;aACd;YACD,OAAO,EAAE;gBACP,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO,CAAC,OAAO;oBACrB,OAAO,EAAE,OAAO;iBACjB;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;wBAChB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE;wBAC1C,CAAC,CAAC,SAAS;oBACb,IAAI,EAAE,OAAO,CAAC,IAAI;wBAChB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE;wBAC1C,CAAC,CAAC,SAAS;iBACd;aACF;YACD,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;SAClE,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,4BAA4B;gBAC5C,cAAc,EAAE,iCAAiC;aAClD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAElC,CAAC;QACF,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,SAAS;YACvD,QAAQ,EAAE,SAAS;SACpB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,yDAAyD;QACzD,gEAAgE;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAxFD,wCAwFC;AA2BD,SAAgB,mBAAmB,CACjC,MAA2B;IAE3B,wDAAwD;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACrD,uEAAuE;QACvE,IACE,MAAM,CAAC,QAAQ,KAAK,oBAAoB;YACxC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,kBAAkB,CAAC,EAC3D,CAAC;YACD,IACE,CAAC,MAAM,CAAC,kBAAkB;gBAC1B,CAAC,MAAM,CAAC,sBAAsB;gBAC9B,CAAC,MAAM,CAAC,kBAAkB,EAC1B,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,yBAAyB,CAClC,MAAM,CAAC,kBAAkB,EACzB,MAAM,CAAC,sBAAsB,EAC7B,MAAM,CAAC,aAAa,IAAI,aAAa,EACrC,MAAM,CAAC,kBAAkB,CAC1B,CAAC;QACJ,CAAC;QAED,IACE,MAAM,CAAC,QAAQ,KAAK,aAAa;YACjC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,eAAe,CAAC,EACxD,CAAC;YACD,IACE,CAAC,MAAM,CAAC,eAAe;gBACvB,CAAC,MAAM,CAAC,gBAAgB;gBACxB,CAAC,MAAM,CAAC,gBAAgB,EACxB,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,kBAAkB,CAC3B,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,gBAAgB,EACvB,MAAM,CAAC,aAAa,IAAI,YAAY,EACpC,MAAM,CAAC,gBAAgB,CACxB,CAAC;QACJ,CAAC;QAED,IACE,MAAM,CAAC,QAAQ,KAAK,SAAS;YAC7B,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,EACvD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,+BAA+B;YAC/B,OAAO,IAAI,cAAc,CACvB,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,kBAAkB,EACzB,MAAM,CAAC,SAAS,IAAI,YAAY,CACjC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,8BAA8B;IAC9B,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,oBAAoB;YACvB,IACE,CAAC,MAAM,CAAC,kBAAkB;gBAC1B,CAAC,MAAM,CAAC,sBAAsB;gBAC9B,CAAC,MAAM,CAAC,kBAAkB,EAC1B,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,yBAAyB,CAClC,MAAM,CAAC,kBAAkB,EACzB,MAAM,CAAC,sBAAsB,EAC7B,MAAM,CAAC,aAAa,IAAI,aAAa,EACrC,MAAM,CAAC,kBAAkB,CAC1B,CAAC;QAEJ,KAAK,aAAa;YAChB,IACE,CAAC,MAAM,CAAC,eAAe;gBACvB,CAAC,MAAM,CAAC,gBAAgB;gBACxB,CAAC,MAAM,CAAC,gBAAgB,EACxB,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,kBAAkB,CAC3B,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,gBAAgB,EACvB,MAAM,CAAC,aAAa,IAAI,YAAY,EACpC,MAAM,CAAC,gBAAgB,CACxB,CAAC;QAEJ,KAAK,SAAS;YACZ,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,IAAI,cAAc,CACvB,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,kBAAkB,EACzB,MAAM,CAAC,SAAS,IAAI,WAAW,CAChC,CAAC;QAEJ;YACE,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC"}

package/dist/lib/encryption-key-service.d.ts

@@ -0,0 +1,115 @@
+/**
+ * EncryptionKeyService
+ *
+ * Manages UserEncryptionKey records for Border Safety Mode and Encrypted DM.
+ * Provides unified key management using the shared cryptographic library.
+ *
+ * Features:
+ * - Key creation and retrieval
+ * - Key derivation from passwords (using shared crypto library)
+ * - Key rotation support
+ * - Multiple key types (border_safety, e2e_messages)
+ * - Multiple key purposes (data_encryption, backup, export, message_encryption)
+ *
+ * @see packages/crypto for shared cryptographic operations
+ * @see doc/02-technical/architecture/cryptography/ for design documentation
+ */
+import { PrismaClient, UserEncryptionKey } from "@prisma/client";
+import type { KDFParams } from "./crypto/index.js";
+import { type LoggerEnv } from "./logger";
+/**
+ * Key type values
+ */
+export type KeyType = "border_safety" | "e2e_messages";
+/**
+ * Key purpose values
+ */
+export type KeyPurpose = "data_encryption" | "backup" | "export" | "message_encryption";
+/**
+ * EncryptionKeyService class for managing user encryption keys
+ */
+export declare class EncryptionKeyService {
+    private prisma;
+    private logger;
+    constructor(prisma: PrismaClient, env?: LoggerEnv);
+    /**
+     * Get or create an encryption key for a user
+     *
+     * If a key with the same userId, contextId, keyPurpose, and keyType exists,
+     * it is returned. Otherwise, a new key is created.
+     *
+     * Note: This method does NOT derive the key from a password. The key material
+     * should be derived client-side and passed as encryptedKey (encrypted with
+     * the user's password-derived key).
+     *
+     * @param userId - User ID
+     * @param contextId - Context ID ('primary' or 'decoy')
+     * @param keyPurpose - Key purpose ('data_encryption', 'backup', 'export', 'message_encryption')
+     * @param keyType - Key type ('border_safety' or 'e2e_messages')
+     * @param encryptedKey - Encrypted key material (encrypted with user's password-derived key)
+     * @param kdfParams - Key derivation parameters (JSON string)
+     * @param algorithm - Encryption algorithm (default: 'AES-256-GCM')
+     * @returns UserEncryptionKey record
+     * @throws Error if key creation fails
+     */
+    getOrCreateKey(userId: string, contextId: string, keyPurpose: KeyPurpose, keyType: KeyType, encryptedKey: string, kdfParams: string, algorithm?: string): Promise<UserEncryptionKey>;
+    /**
+     * Derive encryption key from password using shared cryptographic library
+     *
+     * This is a convenience method that uses EncryptionService.deriveKey().
+     * The derived key is a CryptoKey and cannot be exported (for security).
+     *
+     * @param password - Password to derive key from
+     * @param salt - Salt (base64-encoded, minimum 128 bits / 16 bytes)
+     * @param kdfParams - Key derivation parameters
+     * @returns CryptoKey for AES-256-GCM
+     * @throws Error if key derivation fails
+     */
+    deriveKeyFromPassword(password: string, salt: string, kdfParams: KDFParams): Promise<CryptoKey>;
+    /**
+     * Rotate an encryption key
+     *
+     * Updates the key record with new encrypted key material and sets rotatedAt timestamp.
+     * The old key material is replaced (not kept for backward compatibility).
+     *
+     * @param keyId - Key ID to rotate
+     * @param newEncryptedKey - New encrypted key material
+     * @param newKdfParams - New KDF parameters (optional, if key derivation changed)
+     * @returns Updated UserEncryptionKey record
+     * @throws Error if key rotation fails
+     */
+    rotateKey(keyId: string, newEncryptedKey: string, newKdfParams?: string): Promise<UserEncryptionKey>;
+    /**
+     * Get encryption key by type for a user
+     *
+     * Returns the first key matching the userId and keyType.
+     * If multiple keys exist (different contexts or purposes), use getKeysByUser().
+     *
+     * @param userId - User ID
+     * @param keyType - Key type ('border_safety' or 'e2e_messages')
+     * @returns UserEncryptionKey or null if not found
+     */
+    getKeyByType(userId: string, keyType: KeyType): Promise<UserEncryptionKey | null>;
+    /**
+     * Get all encryption keys for a user
+     *
+     * @param userId - User ID
+     * @returns Array of UserEncryptionKey records
+     */
+    getKeysByUser(userId: string): Promise<UserEncryptionKey[]>;
+    /**
+     * Get encryption key by ID
+     *
+     * @param keyId - Key ID
+     * @returns UserEncryptionKey or null if not found
+     */
+    getKeyById(keyId: string): Promise<UserEncryptionKey | null>;
+    /**
+     * Delete an encryption key
+     *
+     * @param keyId - Key ID
+     * @throws Error if key deletion fails
+     */
+    deleteKey(keyId: string): Promise<void>;
+}
+//# sourceMappingURL=encryption-key-service.d.ts.map

package/dist/lib/encryption-key-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption-key-service.d.ts","sourceRoot":"","sources":["../../src/lib/encryption-key-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAElD;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,eAAe,GAAG,cAAc,CAAC;AAEvD;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,iBAAiB,GACjB,QAAQ,GACR,QAAQ,GACR,oBAAoB,CAAC;AAEzB;;GAEG;AACH,qBAAa,oBAAoB;IAI7B,OAAO,CAAC,MAAM;IAHhB,OAAO,CAAC,MAAM,CAAS;gBAGb,MAAM,EAAE,YAAY,EAC5B,GAAG,CAAC,EAAE,SAAS;IAKjB;;;;;;;;;;;;;;;;;;;OAmBG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,MAAsB,GAChC,OAAO,CAAC,iBAAiB,CAAC;IA6D7B;;;;;;;;;;;OAWG;IACG,qBAAqB,CACzB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,SAAS,CAAC;IAarB;;;;;;;;;;;OAWG;IACG,SAAS,CACb,KAAK,EAAE,MAAM,EACb,eAAe,EAAE,MAAM,EACvB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,iBAAiB,CAAC;IAqC7B;;;;;;;;;OASG;IACG,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAsBpC;;;;;OAKG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAuBjE;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAkBlE;;;;;OAKG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAiB9C"}