@lenne.tech/nest-server 11.43.4 → 11.43.6

package/.claude/rules/configurable-features.md

@@ -300,6 +300,7 @@ This pattern is currently applied to:
 | Password-Reset Token Lifetime | `auth.passwordReset.tokenExpiresInMinutes` | **Numeric Sentinel — Family C** (see above) | **60 minutes since 11.38.0. Before that the legacy reset token NEVER expired** — `resetPassword()` looked it up by value and compared no time, while the exception it threw read "Invalid or expired password reset token", claiming a check that did not exist. A reset link takes over an EXISTING account, so an unbounded one means a mail in an archive or a restored backup opens that account years later. The IAM half already expired after an hour (Better-Auth's `resetPasswordTokenExpiresIn`); only the legacy half had nothing. `0` opts out; an invalid value falls back to 60, never to unbounded. **A token minted before 11.38.0 carries no timestamp and is treated as EXPIRED** — reading "no timestamp" as "valid forever" would preserve the defect permanently rather than for a migration window. An expired token is answered exactly like an unknown one (404, same message) and deleted on sight. Model field `passwordResetTokenExpiresAt`, `@Restricted(S_NO_ONE)`. Implementation: `core-user.service.ts` → `passwordResetTokenExpiryMinutes()` / `isPasswordResetTokenExpired()` |
 | Legacy Password-Reset Link | `email.passwordResetLink` | Explicit Value with derived default | **`<appUrl>/auth/reset-password?token={token}` since 11.38.0.** Two conventions live here and which applies depends on whether the option is set AT ALL: unset yields `?token=`, the same string written out yields a PATH segment. That is deliberate — a project that configures such a value has a page built for a path parameter, and moving it silently would break the flow this release repairs — and because it is not guessable, `CoreUserService` **warns once at boot** when a configured value carries no `{token}`. The warning names a precondition: `{token}` is substituted by `buildPasswordResetLink()` and nothing else, so a caller still concatenating by hand must switch FIRST or it mails the placeholder verbatim. Returns `null` rather than a string containing `undefined`; resolves `appUrl` through `resolveServerUrls` (localhost defaults, host-split `baseUrl`) and honours `cors.deriveAppUrl` |
 | SMTP TLS Mode | `email.smtp.secure` + `SMTP_REQUIRE_TLS` | Derived from the port | **`secure` follows `SMTP_PORT` unless set to `'true'`/`'false'`.** It is not an independent setting: 465 negotiates TLS immediately, everything else upgrades via STARTTLS. The production profile shipped 587 + `secure: true` — a pair that cannot connect — so a deployment configuring only host and credentials sent NO mail, invisibly, because authentication mail is not awaited. Only the two canonical values override; anything else defers to the port, which is the only rule under which no input produces an unconnectable pair. `requireTLS` defaults to **true**: `secure: false` alone means opportunistic STARTTLS, and an on-path attacker stripping the capability line gets credentials and a live reset link in plaintext. `EmailService` warns once when the resolved pair cannot connect — reported, not overruled. Implementation: `config.helper.ts` → `resolveSmtpSecure()` / `isImpossibleSmtpTlsCombination()` |
+| Mail Reply-To | `email.defaultReplyTo` | Explicit Value — absent = no header | **Absent → no `Reply-To` header, exactly as before (11.43.6+).** A string (an address, or `"Name" <address>`) becomes the Reply-To of every mail `EmailService.sendMail()` sends; a call overrides it with `replyTo`, and `replyTo: false` (or `''`) sends that one mail without it. Env: `NSC__EMAIL__DEFAULT_REPLY_TO`. A value that is not a string is ignored with one warning — a misconfigured default must not stop password-reset or verification mail. SMTP path only (`email.smtp`, nodemailer, Hub capture unaffected): Brevo and Mailjet templates carry their own reply-to. Pinned by `tests/unit/email-smtp-roundtrip.spec.ts` (Reply-To block, real SMTP). Implementation: `common/services/email.service.ts` → `resolveReplyTo()` |
 | Legacy Auth Rate Limiting | `auth.rateLimit` | Presence Implies Enabled | `max: 10`, `windowSeconds: 60`. Counters live in a `RateLimitStore`: `RedisRateLimitStore` when `redis` is configured (limit enforced EXACTLY across replicas instead of `max × replicas`), else `InMemoryRateLimitStore` (previous behavior). On a Redis outage it degrades to the in-memory counter and logs once per transition — never a 500, never "allowed". `check()` / `reset()` / `clear()` are ASYNC since 11.33.0; `getStats().activeEntries` is `-1` on the Redis store |
 | BetterAuth Rate Limiting | `betterAuth.rateLimit` | Presence Implies Enabled | `max: 10`, `windowSeconds: 60`. Same `RateLimitStore` selection, degradation and async signatures as the Legacy Auth row (namespace `better-auth`) |
 | BetterAuth JWT Plugin | `betterAuth.jwt` | Boolean Shorthand | `expiresIn: '15m'` |

package/.claude/rules/package-management.md

@@ -330,6 +330,26 @@ on `FIX AVAILABLE` (a `first_patched_version` now exists) or on a withdrawn advi
 API is reported as `UNVERIFIED` and tolerated locally — but **fails under `CI`**, because a skip
 nobody reads is indistinguishable from a check that ran.
 
+**A fix nobody named is still a fix (11.43.5).** GitHub leaves `first_patched_version` null on some advisories
+after a release outside the vulnerable range shipped: GHSA-86w9-cpqp-85rv (node-forge) read
+`<= 1.4.0` / null a day after 1.4.1 was published. Until 11.43.4 the guard skipped such an advisory,
+so its suppression passed every run. It now reads the package's packument from the registry pnpm
+installs from and, per vulnerable copy in the lockfile, looks for a stable release above it that
+lies outside **every** range the advisory lists. A deprecated release is held back, not ruled out: it
+counts only when every such release is deprecated, because some packages deprecate all of them
+(node-sass: 132 of 132 stable releases), and ruling them out reads a published fix as "no fix" for good.
+
+| Finding | Verdict |
+|---------|---------|
+| every copy has such a release, past `minimumReleaseAge` | `FIX AVAILABLE`, naming it — `unusableFixConsumers` applies as for a named fix |
+| one is published but younger than `minimumReleaseAge` | passes, printed as `pending` with the date the gate clears (pnpm would refuse it, so failing would order a `minimumReleaseAgeExclude` nobody decided on) |
+| some copy has none | passes — the suppression is still justified |
+| no version the lockfile resolves is in the range any more | `NOT IN TREE` — the entry hides nothing |
+| registry or lockfile unreadable | `UNVERIFIED`, with the reason (fails under `CI`) |
+
+`--advisory-file` runs stay offline: they take packuments from `--packument-file` and never ask the
+registry.
+
 One consequence worth knowing before you reach for this mechanism: the guard fires when the advisory
 has a patched version for **any** affected range. For most findings that is the honest outcome — a
 fix exists, take it, and the case is an override problem rather than a suppression problem.
@@ -341,7 +361,7 @@ removed an export its consumer imports, or the consumer pins the vulnerable rang
 `FIX AVAILABLE` is not advice but a dead end, and the only ways out used to be a permanently red
 build or a guard switched off for that entry.
 
-Measured case (lt-crm, 2026-10-06): three `simple-git` advisories, one CRITICAL requiring `>=4.0.1`,
+Measured case (a consuming Nuxt project, 2026-10-06): three `simple-git` advisories, one CRITICAL requiring `>=4.0.1`,
 reachable only via `nuxt > @nuxt/devtools > simple-git`. simple-git 4 dropped the default export
 devtools imports, so the override made `nuxt prepare` fail outright. The newest devtools in the 3.x
 line still imports it that way, and devtools is a hard `dependencies` entry of `nuxt` — so it can be
@@ -372,6 +392,25 @@ any has moved:
    second version of the same consumer is a path nobody assessed, and comparing by name alone let
    one ride along on the other's declaration, with the winner decided by lockfile order.
 
+**"Pulls an affected package" means an affected VERSION (11.43.5).** Checks 3 and the idle check below
+count an edge only when its resolved version lies in one of the advisory's `vulnerable_version_range`s.
+A parent pulling the FIXED release is no consumer of the vulnerability. Until 11.43.5 every parent
+counted, so lifting one subtree to the fixed major (glob 14.0.3 pulling minimatch 11.0.3 next to
+consumers still on minimatch 10) failed a correct declaration for good. An edge whose version cannot be
+read (`link:`, `file:`), or any edge of an advisory that lists no range, still counts: "I could not tell
+which version it pulls" must not read as "it pulls the fixed one" (mutations
+`unusable-fix-counts-fixed-edges`, `unusable-fix-skips-unreadable-edge`). An edge is matched by the package it
+PULLS, not by its key: pnpm keys an npm alias by the alias (`mm-cjs: minimatch@5.1.9`, an importer's
+`version: minimatch@5.1.9`), so a key match missed every consumer behind an alias and read an edge keyed
+`minimatch` that pulls a fork as a minimatch edge (mutation `unusable-fix-matches-alias-by-key`).
+
+**Several consumers (11.43.5)** are joined with ` + `, each at its assessed version —
+`'@nestjs/cli@11.0.24 + rimraf@6.1.3 cannot use 14.0.2'`. One vulnerable package often sits under
+several dev tools at once, and before this a declaration could name only one, so such a finding had no
+honest way in. Every listed consumer gets checks 1 and 3, and one more: a listed consumer that no
+longer pulls an affected package fails too (mutation `unusable-fix-accepts-idle-consumer`), because a
+list is where a path that is gone would otherwise keep covering.
+
 The third check reads **both halves** of the lockfile. `importers:` holds what the repository itself
 declares (`.`, `projects/api`, `projects/app`), `snapshots:` the edges between third-party packages
 — and the first is the likelier production path, because a direct dependency can simply be raised.
@@ -401,12 +440,22 @@ plus one for the opposite failure, a guard that rejects a declaration which is s
 matters just as much: a check that cries wolf on correct entries is a check that gets switched off,
 which is how the hole this feature closes came about in the first place.
 
-**Current entry (since 2026-10-11):** `GHSA-vfj7-8cjw-p6xm` (braces, via nodemon / npm-watch), a
-dev-tooling-only path of an advisory with no patched release at all; the justification sits next to
-the entry in `pnpm-workspace.yaml`. **Do not copy it into nest-server-starter without thinking it
-through:** since lt CLI 1.42.0 the starter's `auditConfig` is hoisted as a union into every
-generated project, so an entry there hides the advisory in every customer workspace — including
-production paths this repository does not have.
+**Current entries on `release/11.x` (since 11.43.5).** `GHSA-gcqx-w48m-w2h4` (deepmerge `<= 4.3.1`, low,
+since 11.43.4): dev tooling only, through @nestjs/cli 11 > fork-ts-checker-webpack-plugin, with no patched
+release at all. `GHSA-g3hv-75wg-m249` (minimatch `< 11.0.1`) and `GHSA-3g3m-2fjr-6pw4` (glob `<= 14.0.1`), both
+moderate, both fixed only in a new major released 2026-10-27 that none of their consumers can take yet — five
+for minimatch (@nestjs/cli 11.0.24 pins fork-ts-checker-webpack-plugin 9.1.0, which needs minimatch ^3), two for
+glob (@nestjs/cli 11.0.24 pins glob 13.0.6 exactly, rimraf 6.1.3 needs ^13); the same two entries as 12.x
+(DEV-3899). The justification is in the comment above `ignoreGhsas`, the declarations in
+`unusableFixConsumers`. `tests/unit/audit-suppression-scope.spec.ts` keeps deepmerge and glob out of the
+production tree and allows minimatch there only under `@ts-morph/common` (ts-morph, the Permissions module's
+scanner, matching globs the developer writes) — its `prodVia` form.
+
+`GHSA-vfj7-8cjw-p6xm` (braces, via nodemon / npm-watch) was listed from 2026-10-11 until 11.43.4: a
+dev-tooling-only path of an advisory with no patched release at all, withdrawn by GitHub on 2026-10-23.
+**Before adding an entry, and before copying one into nest-server-starter:** since lt CLI 1.42.0 the
+starter's `auditConfig` is hoisted as a union into every generated project, so an entry there hides the
+advisory in every customer workspace — including production paths this repository does not have.
 
 **An entry whose package has left the declared range goes, even when the new version is no fix.**
 `GHSA-ch52-4w7c-c8xp` (http-cache-semantics `<= 4.2.0`) was listed from 2026-10-03 to 2026-10-11.

package/.claude/rules/testing.md

@@ -268,7 +268,7 @@ pnpm run check:mutations -- --id=<id>       # one mutation
 pnpm run check:mutations -- --list          # the registry, without running anything
 pnpm run check:mutations -- --allow-dirty   # when the fix and its evidence share a working tree
 pnpm run check:mutations -- --jobs=4        # N mutations at a time (default: 2, or 4 on >=12 cores)
-pnpm run check:mutations -- --no-infra      # only the 166 that need no MongoDB
+pnpm run check:mutations -- --no-infra      # only the 176 that need no MongoDB
 pnpm run check:mutations -- --since=<ref>   # only mutations touching files changed since <ref>
 ```
 
@@ -287,7 +287,7 @@ when the registry, a vitest config or a setup file changed, since those can move
 commit, and in CI alongside the publish without blocking it. The price of caching is a cache that
 has to model each spec's full dependency closure correctly, and getting that wrong produces a stale
 PASS for a test that has since gone vacuous — exactly what the gate is there to prevent. Bad trade
-at 252 mutations.
+at 262 mutations.
 
 **Decided 2026-10-03 (repo owner): keep the full run.** Measured at 128 mutations, the CI job for
 11.41.6 took **14 minutes**. The trigger to revisit is that wall time, not the mutation count —
@@ -334,7 +334,7 @@ exactly the environment where the answer matters.
 
 Worth knowing before optimising the wrong thing: the specs behind all 86 e2e mutations add up to
 **~40 seconds**. The step takes ~740s. The remaining ~700s is paying vitest's startup — process
-spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 252 times.
+spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 262 times.
 That work is largely single-threaded I/O and barely scales with cores: the full registry measures
 **744s on a 12-core laptop and 777s on a 4-vCPU CI runner**.
 

package/.claude/rules/versioning.md

@@ -25,6 +25,13 @@
 1. **Document breaking changes** clearly in commit messages when incrementing MINOR version
 2. **Update nest-server-starter** with migration instructions for breaking changes
 3. **Consider downstream impact** - this package is used by multiple projects
+4. **Every published version gets its nest-server-starter version** (repo owner, 2026-11-03). The
+   starter's `version` always equals the `@lenne.tech/nest-server` version it pins. Every version
+   published to npm is followed by the starter commit `Updated to nest-server version <X.Y.Z>`, tagged
+   `v<X.Y.Z>` by the starter's `tag.yml`, also when the bump is the only change. Starter changes
+   between two releases never change its version: the starter follows nest-server, never the other
+   way round. This covers the maintenance line too: a release from `release/11.x` is followed on the
+   starter's `release/11.x` branch.
 
 ## Release Process
 
@@ -36,8 +43,12 @@
    (You can also sync manually any time via `pnpm run spectaql:sync`.)
 3. Build the package (`pnpm run build`) — this also regenerates `FRAMEWORK-API.md` with the new version
 4. Publish to npm
-5. Update and test in [nest-server-starter](https://github.com/lenneTech/nest-server-starter)
-6. Commit changes to starter with migration notes
+5. **Release [nest-server-starter](https://github.com/lenneTech/nest-server-starter) with the same
+   version — a required step, not an optional "update and test".** Raise the framework and the
+   starter's own `version` to the new version (`pnpm run update`, migration guides applied), test, and
+   commit as `Updated to nest-server version <X.Y.Z>`; the starter's `tag.yml` tags it `v<X.Y.Z>` (rule 4).
+6. A release made with `/lt-dev:publish --skip-downstream` leaves a gap in the starter's tag series.
+   Close it before the next nest-server release.
 
 ### Version Consistency Check
 

package/FRAMEWORK-API.md

@@ -1,6 +1,6 @@
 # @lenne.tech/nest-server — Framework API Reference
 
-> Auto-generated from source code as of 2026-10-22 (v11.43.4)
+> Auto-generated from source code as of 2026-11-03 (v11.43.6)
 > File: `FRAMEWORK-API.md` — compact, machine-readable API surface for Claude Code
 
 ## CoreModule.forRoot()
@@ -26,7 +26,7 @@
   - `cors?`: `boolean | ICorsConfig | undefined` (default: `undefined (enabled with auto-derived origins)`) — CORS (Cross-Origin Resource Sharing) configuration.
   - `cronJobs?`: `Record<string, string | false | 0 | CronJobConfigWithTimeZone<null, null> | C...` — Cron jobs configuration object with the name of the cron job function as key
   - `debugProcessInput?`: `boolean | undefined` (default: `false`) — When true, logs a debug message when prepareInput() changes the input type during process().
-  - `email?`: `{ defaultSender?: { email?: string; name?: string; }; mailjet?: MailjetOption...` — SMTP and template configuration for sending emails
+  - `email?`: `{ defaultReplyTo?: string; defaultSender?: { email?: string; name?: string; }...` — SMTP and template configuration for sending emails
   - `env?`: `string | undefined` — Environment
   - `version?`: `string | undefined` — Semantic version of the running build (e.g. from package.json / meta.json).
   - `errorCode?`: `IErrorCode | undefined` — Configuration for the error code module

package/dist/core/common/interfaces/server-options.interface.d.ts

@@ -293,6 +293,7 @@ export interface IServerOptions {
     cronJobs?: Record<string, CronExpression | CronJobConfigWithTimeZone | CronJobConfigWithUtcOffset | Date | Falsy | string>;
     debugProcessInput?: boolean;
     email?: {
+        defaultReplyTo?: string;
         defaultSender?: {
             email?: string;
             name?: string;

package/dist/core/common/services/email.service.d.ts

@@ -12,13 +12,16 @@ export declare class EmailService implements OnModuleDestroy {
     private cachedSmtpConfig;
     protected readonly emailServiceLogger: Logger;
     private smtpTlsWarningEmitted;
+    private replyToWarningEmitted;
     constructor(configService: ConfigService, templateService: TemplateService, emailCapture?: IHubEmailCapture);
     protected warnOnImpossibleSmtpTlsCombination(smtp: unknown): void;
+    protected resolveReplyTo(replyTo: false | string | undefined): string | undefined;
     onModuleDestroy(): void;
     sendMail(recipients: string | string[], subject: string, config: {
         attachments?: Attachment[];
         html?: string;
         htmlTemplate?: string;
+        replyTo?: false | string;
         senderEmail?: string;
         senderName?: string;
         smtp?: MailTransportOptions;

package/dist/core/common/services/email.service.js

@@ -30,6 +30,7 @@ let EmailService = EmailService_1 = class EmailService {
     cachedSmtpConfig = null;
     emailServiceLogger = new common_1.Logger(EmailService_1.name);
     smtpTlsWarningEmitted = false;
+    replyToWarningEmitted = false;
     constructor(configService, templateService, emailCapture) {
         this.configService = configService;
         this.templateService = templateService;
@@ -53,6 +54,23 @@ let EmailService = EmailService_1 = class EmailService {
             '"wrong version number" from OpenSSL and NO outgoing mail — silently, because authentication mail ' +
             'is not awaited. Set SMTP_SECURE=false for port 587, or SMTP_PORT=465 to keep implicit TLS.');
     }
+    resolveReplyTo(replyTo) {
+        if (replyTo === false) {
+            return undefined;
+        }
+        const value = replyTo ?? this.configService.getFastButReadOnly('email.defaultReplyTo');
+        if (value === undefined || value === null) {
+            return undefined;
+        }
+        if (typeof value === 'string') {
+            return value.trim() || undefined;
+        }
+        if (!this.replyToWarningEmitted) {
+            this.replyToWarningEmitted = true;
+            this.emailServiceLogger.warn(`Reply-To ignored: expected an address string (email.defaultReplyTo / replyTo), got ${typeof value}.`);
+        }
+        return undefined;
+    }
     onModuleDestroy() {
         if (this.cachedTransporter) {
             this.cachedTransporter.close();
@@ -121,10 +139,12 @@ let EmailService = EmailService_1 = class EmailService {
             this.cachedTransporter = nodemailer.createTransport(smtp);
             this.cachedSmtpConfig = smtpKey;
         }
+        const replyTo = this.resolveReplyTo(config.replyTo);
         return this.cachedTransporter.sendMail({
             attachments,
             from: `"${senderName}" <${senderEmail}>`,
             html,
+            ...(replyTo ? { replyTo } : {}),
             subject,
             text,
             to: recipients,

package/dist/core/common/services/email.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"email.service.js","sourceRoot":"","sources":["../../../../src/core/common/services/email.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mCAAoC;AACpC,2CAAuF;AACvF,yCAA0C;AAG1C,4DAA0E;AAC1E,0DAAgF;AAEhF,mEAAoE;AACpE,qDAAiD;AACjD,yDAAqD;AAO9C,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAiBX;IACA;IAGgD;IAhBpD,iBAAiB,GAAkC,IAAI,CAAC;IACxD,gBAAgB,GAAkB,IAAI,CAAC;IAE5B,kBAAkB,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAG9D,qBAAqB,GAAG,KAAK,CAAC;IAKtC,YACY,aAA4B,EAC5B,eAAgC,EAGgB,YAA+B;QAJ/E,kBAAa,GAAb,aAAa,CAAe;QAC5B,oBAAe,GAAf,eAAe,CAAiB;QAGgB,iBAAY,GAAZ,YAAY,CAAmB;IACxF,CAAC;IAeM,kCAAkC,CAAC,IAAa;QACxD,IAAI,IAAI,CAAC,qBAAqB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAA4C,CAAC;QACtE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAA,8CAA8B,EAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;QAClC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAC1B,gCAAgC,IAAI,gBAAgB,MAAM,uCAAuC;YAC/F,oGAAoG;YACpG,0EAA0E;YAC1E,mGAAmG;YACnG,4FAA4F,CAC/F,CAAC;IACJ,CAAC;IAED,eAAe;QACb,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,CAAC;IACH,CAAC;IAKM,KAAK,CAAC,QAAQ,CACnB,UAA6B,EAC7B,OAAe,EACf,MAUC;QAGD,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG;YAC/F,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,2BAA2B,CAAC;YAC/E,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,0BAA0B,CAAC;YAC7E,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC;YACzD,GAAG,MAAM;SACV,CAAC;QAEF,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAGvB,IAAA,qBAAM,EAAC,UAAU,CAAC,CAAC;QACnB,IAAA,+BAAgB,EAAC,OAAO,CAAC,CAAC;QAC1B,IAAA,+BAAgB,EAAC,UAAU,CAAC,CAAC;QAC7B,IAAA,+BAAgB,EAAC,WAAW,CAAC,CAAC;QAG9B,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC/E,CAAC;QAGD,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC/E,CAAC;QAGD,IAAI,CAAC,IAAA,+BAAgB,EAAC,IAAI,EAAE,0BAAW,CAAC,EAAE,CAAC;YACzC,IAAA,+BAAgB,EAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,IAAA,+BAAgB,EAAC,IAAI,EAAE,0BAAW,CAAC,EAAE,CAAC;YACzC,IAAA,+BAAgB,EAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAOD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAS,KAAK,CAAC,CAAC;QACjE,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAE,IAAgC,CAAC,aAAa,EAAE,CAAC;gBACnG,MAAM,IAAI,KAAK,CACb,2FAA2F;oBACzF,2EAA2E,CAC9E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC;QAK9C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,aAAa,GAAG,KAAK,CAAC;YAC1B,IAAI,CAAC;gBACH,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;oBACxC,IAAI,EAAE,IAAI,UAAU,MAAM,WAAW,GAAG;oBACxC,IAAI;oBACJ,OAAO;oBACP,YAAY,EAAE,YAAY,IAAI,YAAY;oBAC1C,IAAI;oBACJ,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU;iBACnE,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;YAET,CAAC;YACD,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO;oBACL,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;oBAC/D,QAAQ,EAAE,IAAI;oBACd,SAAS,EAAE,aAAa;oBACxB,QAAQ,EAAE,EAAE;iBACb,CAAC;YACJ,CAAC;QACH,CAAC;QAID,MAAM,OAAO,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;YACjE,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAClC,CAAC;QAGD,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;YACrC,WAAW;YACX,IAAI,EAAE,IAAI,UAAU,MAAM,WAAW,GAAG;YACxC,IAAI;YACJ,OAAO;YACP,IAAI;YACJ,EAAE,EAAE,UAAU;SACf,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAxLY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAsBR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,iCAAiB,CAAC,CAAA;qCAJb,8BAAa;QACX,kCAAe;GAlBjC,YAAY,CAwLxB"}
+{"version":3,"file":"email.service.js","sourceRoot":"","sources":["../../../../src/core/common/services/email.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mCAAoC;AACpC,2CAAuF;AACvF,yCAA0C;AAG1C,4DAA0E;AAC1E,0DAAgF;AAEhF,mEAAoE;AACpE,qDAAiD;AACjD,yDAAqD;AAO9C,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAoBX;IACA;IAGgD;IAnBpD,iBAAiB,GAAkC,IAAI,CAAC;IACxD,gBAAgB,GAAkB,IAAI,CAAC;IAE5B,kBAAkB,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAG9D,qBAAqB,GAAG,KAAK,CAAC;IAG9B,qBAAqB,GAAG,KAAK,CAAC;IAKtC,YACY,aAA4B,EAC5B,eAAgC,EAGgB,YAA+B;QAJ/E,kBAAa,GAAb,aAAa,CAAe;QAC5B,oBAAe,GAAf,eAAe,CAAiB;QAGgB,iBAAY,GAAZ,YAAY,CAAmB;IACxF,CAAC;IAeM,kCAAkC,CAAC,IAAa;QACxD,IAAI,IAAI,CAAC,qBAAqB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAA4C,CAAC;QACtE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAA,8CAA8B,EAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;QAClC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAC1B,gCAAgC,IAAI,gBAAgB,MAAM,uCAAuC;YAC/F,oGAAoG;YACpG,0EAA0E;YAC1E,mGAAmG;YACnG,4FAA4F,CAC/F,CAAC;IACJ,CAAC;IAOS,cAAc,CAAC,OAAmC;QAC1D,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAY,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAC;QAChG,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;YAClC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAC1B,sFAAsF,OAAO,KAAK,GAAG,CACtG,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,eAAe;QACb,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,CAAC;IACH,CAAC;IAKM,KAAK,CAAC,QAAQ,CACnB,UAA6B,EAC7B,OAAe,EACf,MAYC;QAGD,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG;YAC/F,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,2BAA2B,CAAC;YAC/E,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,0BAA0B,CAAC;YAC7E,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC;YACzD,GAAG,MAAM;SACV,CAAC;QAEF,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAGvB,IAAA,qBAAM,EAAC,UAAU,CAAC,CAAC;QACnB,IAAA,+BAAgB,EAAC,OAAO,CAAC,CAAC;QAC1B,IAAA,+BAAgB,EAAC,UAAU,CAAC,CAAC;QAC7B,IAAA,+BAAgB,EAAC,WAAW,CAAC,CAAC;QAG9B,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC/E,CAAC;QAGD,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC/E,CAAC;QAGD,IAAI,CAAC,IAAA,+BAAgB,EAAC,IAAI,EAAE,0BAAW,CAAC,EAAE,CAAC;YACzC,IAAA,+BAAgB,EAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,IAAA,+BAAgB,EAAC,IAAI,EAAE,0BAAW,CAAC,EAAE,CAAC;YACzC,IAAA,+BAAgB,EAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAOD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAS,KAAK,CAAC,CAAC;QACjE,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAE,IAAgC,CAAC,aAAa,EAAE,CAAC;gBACnG,MAAM,IAAI,KAAK,CACb,2FAA2F;oBACzF,2EAA2E,CAC9E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC;QAK9C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,aAAa,GAAG,KAAK,CAAC;YAC1B,IAAI,CAAC;gBACH,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;oBACxC,IAAI,EAAE,IAAI,UAAU,MAAM,WAAW,GAAG;oBACxC,IAAI;oBACJ,OAAO;oBACP,YAAY,EAAE,YAAY,IAAI,YAAY;oBAC1C,IAAI;oBACJ,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU;iBACnE,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;YAET,CAAC;YACD,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO;oBACL,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;oBAC/D,QAAQ,EAAE,IAAI;oBACd,SAAS,EAAE,aAAa;oBACxB,QAAQ,EAAE,EAAE;iBACb,CAAC;YACJ,CAAC;QACH,CAAC;QAID,MAAM,OAAO,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;YACjE,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAClC,CAAC;QAGD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;YACrC,WAAW;YACX,IAAI,EAAE,IAAI,UAAU,MAAM,WAAW,GAAG;YACxC,IAAI;YACJ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,OAAO;YACP,IAAI;YACJ,EAAE,EAAE,UAAU;SACf,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAxNY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAyBR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,iCAAiB,CAAC,CAAA;qCAJb,8BAAa;QACX,kCAAe;GArBjC,YAAY,CAwNxB"}