@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/email/email.module.js

@@ -0,0 +1,171 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var EmailModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EmailModule = exports.EmailTemplateOverrideReporter = void 0;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../credentials/index");
+const email_settings_controller_1 = require("./email-settings.controller");
+const email_settings_service_1 = require("./email-settings.service");
+const email_test_send_service_1 = require("./email-test-send.service");
+const email_config_doctor_check_1 = require("./doctor/email-config.doctor-check");
+const email_egress_contributor_1 = require("./doctor/egress/email.egress.contributor");
+const email_options_1 = require("./email.options");
+const ses_email_provider_1 = require("./providers/ses-email.provider");
+const smtp_email_provider_1 = require("./providers/smtp-email.provider");
+const email_transport_resolver_1 = require("./transports/email-transport.resolver");
+const email_template_registry_1 = require("./templates/email-template.registry");
+const render_context_1 = require("./templates/render-context");
+// =============================================================================
+// EmailModule (issue #122, epic #109)
+// =============================================================================
+//
+// The transport layer, plus (as of #124) the admin surface over it. #123
+// added templates; #125 adds the dispatcher that decides which provider to use
+// for which event.
+//
+// #122 SHIPPED NO CONTROLLER, on the grounds that adding an HTTP surface
+// before there is something to expose puts a route to review in
+// infrastructure rather than in the diff that needs it. #124 is that diff:
+// `EmailSettingsController` is the admin settings page's three operations, all
+// gated on `system_settings:read`/`:write`, reviewed here where they are the
+// point rather than buried in shared plumbing.
+//
+// THAT CONTROLLER RETURNS NO SECRET. The SMTP password reaches this module
+// only as a write -- request body -> `EmailSettingsService.update` ->
+// `CredentialsService.setSecret` -- and the read side uses `describe`, whose
+// return type carries a compile-time proof that it has no field able to hold
+// secret material. `CredentialsService.getSecret`, the plaintext one, is
+// called from exactly one place in this module: `SmtpEmailProvider`, at the
+// moment it opens a connection.
+//
+// BOTH PROVIDERS ARE REGISTERED UNCONDITIONALLY, not chosen here from the
+// configured `provider` setting. Provider selection is a per-send, runtime
+// decision: the setting lives in the database and an admin can change it
+// without a restart, so a module-construction-time choice would be stale the
+// moment they did. Both classes are cheap to instantiate -- neither opens a
+// socket or reads a credential until its first send -- so registering both and
+// letting #125 pick costs nothing and keeps the choice where it can respond to
+// a settings change.
+//
+// NOT @Global(). SmtpEmailProvider depends transitively on
+// `CredentialsService.getSecret`, which returns plaintext; the set of modules
+// that can reach it should stay a list a person can read, which means every
+// consumer writes `imports: [EmailModule]` and shows up in a diff.
+// =============================================================================
+/** Overrides already logged in this process: "logged once at bootstrap", even across several apps in one test worker. */
+const loggedOverrides = new Set();
+/**
+ * Logs every template override once, at bootstrap: an override replaces what
+ * a platform message says, and that must be visible in the boot log rather
+ * than discovered in somebody's inbox.
+ *
+ * @internal
+ *
+ * @stability experimental
+ */
+let EmailTemplateOverrideReporter = class EmailTemplateOverrideReporter {
+    logger = new common_1.Logger('EmailTemplates');
+    onApplicationBootstrap() {
+        for (const { name, registrant } of (0, email_template_registry_1.listEmailTemplateOverrides)()) {
+            const key = `${name}\u0000${registrant}`;
+            if (loggedOverrides.has(key))
+                continue;
+            loggedOverrides.add(key);
+            this.logger.log(`Email template "${name}" is overridden by ${registrant}.`);
+        }
+    }
+};
+exports.EmailTemplateOverrideReporter = EmailTemplateOverrideReporter;
+exports.EmailTemplateOverrideReporter = EmailTemplateOverrideReporter = __decorate([
+    (0, common_1.Injectable)()
+], EmailTemplateOverrideReporter);
+/**
+ * The email slice: the SES and SMTP transports, the `email` settings row and
+ * its admin routes (`GET`/`PUT /api/email-settings`,
+ * `POST /api/email-settings/test`, all `system_settings:read|write`), the
+ * template registry and layout, and the doctor check.
+ *
+ * NOT GLOBAL: `SmtpEmailProvider` reaches `CredentialsService.getSecret`
+ * (plaintext), so every consumer writes `imports: [EmailModule]` and shows up
+ * in a diff. Export the one `forRoot()` result and import that object
+ * everywhere (one module to Nest).
+ *
+ * @stability experimental
+ */
+let EmailModule = EmailModule_1 = class EmailModule {
+    /**
+     * The slice for one app. Configures the render context (product name, URL,
+     * layout theme, brand mark) and registers the platform's nine templates
+     * (unless `registerDefaultTemplates: false`); both are idempotent.
+     *
+     * Needs, from the app: `SettingsModule.forRoot()` (the row store),
+     * `PlatformHostModule` (`PLATFORM_PRISMA`, `AUDIT_SINK`), the doctor
+     * registries and the credentials store's encryption key.
+     *
+     * @param options - see {@link EmailModuleOptions}.
+     * @returns the dynamic module. It exports `EmailSettingsService`,
+     *   `EmailTransportResolver`, `SesEmailProvider`, `SmtpEmailProvider` and
+     *   `EMAIL_OPTIONS`.
+     * @throws Error when an option is invalid (a missing `appName`, a theme
+     *   colour that is not hex, a malformed brand mark).
+     *
+     * @example
+     * ```ts
+     * export const EmailModule = PlatformEmailModule.forRoot({
+     *   appName: APP_NAME,
+     *   appUrl: () => process.env.APP_URL,
+     *   classifyRateLimit,
+     * });
+     * ```
+     *
+     * @extensionPoint option
+     * @stability experimental
+     */
+    static forRoot(options) {
+        const resolved = (0, email_options_1.resolveEmailModuleOptions)(options);
+        (0, render_context_1.configureEmailRendering)({ appName: resolved.appName, appUrl: resolved.appUrl, layout: resolved.layout });
+        if (resolved.registerDefaultTemplates)
+            (0, email_template_registry_1.registerPlatformEmailTemplates)();
+        return {
+            module: EmailModule_1,
+            imports: [
+                // The SMTP password and the SES secret access key. Imported explicitly
+                // (CredentialsModule is deliberately not global) so this module's
+                // access to a plaintext-returning service is visible right here.
+                index_1.CredentialsModule,
+            ],
+            controllers: [email_settings_controller_1.EmailSettingsController],
+            providers: [
+                { provide: email_options_1.EMAIL_OPTIONS, useValue: resolved },
+                email_settings_service_1.EmailSettingsService,
+                // The test-send path (#124): one method over the transports this
+                // module owns; reached only through the controller.
+                email_test_send_service_1.EmailTestSendService,
+                ses_email_provider_1.SesEmailProvider,
+                smtp_email_provider_1.SmtpEmailProvider,
+                // The configured transport, resolved from the registry (PP-14.8):
+                // the ONE thing the notification channel and the test send depend on.
+                email_transport_resolver_1.EmailTransportResolver,
+                // Doctor check (#634): reads the admin view, never sends.
+                email_config_doctor_check_1.EmailConfigDoctorCheck,
+                // Egress inventory (#773): the SMTP relay or the SES regional endpoint.
+                email_egress_contributor_1.EmailEgressContributor,
+                EmailTemplateOverrideReporter,
+            ],
+            // EmailTestSendService is deliberately NOT exported: sending a test
+            // message is an admin action reached through this module's controller.
+            exports: [email_options_1.EMAIL_OPTIONS, email_settings_service_1.EmailSettingsService, email_transport_resolver_1.EmailTransportResolver, ses_email_provider_1.SesEmailProvider, smtp_email_provider_1.SmtpEmailProvider],
+        };
+    }
+};
+exports.EmailModule = EmailModule;
+exports.EmailModule = EmailModule = EmailModule_1 = __decorate([
+    (0, common_1.Module)({})
+], EmailModule);
+//# sourceMappingURL=email.module.js.map

package/dist/email/email.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.module.js","sourceRoot":"","sources":["../../src/email/email.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAwG;AAExG,gDAAyD;AACzD,2EAAsE;AACtE,qEAAgE;AAChE,uEAAiE;AACjE,kFAA4E;AAC5E,uFAAkF;AAClF,mDAAoG;AACpG,uEAAkE;AAClE,yEAAoE;AACpE,oFAA+E;AAC/E,iFAAiH;AACjH,+DAAqE;AAErE,gFAAgF;AAChF,sCAAsC;AACtC,gFAAgF;AAChF,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,mBAAmB;AACnB,EAAE;AACF,yEAAyE;AACzE,gEAAgE;AAChE,2EAA2E;AAC3E,+EAA+E;AAC/E,6EAA6E;AAC7E,+CAA+C;AAC/C,EAAE;AACF,2EAA2E;AAC3E,sEAAsE;AACtE,6EAA6E;AAC7E,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,gCAAgC;AAChC,EAAE;AACF,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,qBAAqB;AACrB,EAAE;AACF,2DAA2D;AAC3D,8EAA8E;AAC9E,4EAA4E;AAC5E,mEAAmE;AACnE,gFAAgF;AAEhF,yHAAyH;AACzH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;AAE1C;;;;;;;;GAQG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACvB,MAAM,GAAG,IAAI,eAAM,CAAC,gBAAgB,CAAC,CAAC;IAEvD,sBAAsB;QACpB,KAAK,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,IAAA,oDAA0B,GAAE,EAAE,CAAC;YAChE,MAAM,GAAG,GAAG,GAAG,IAAI,SAAS,UAAU,EAAE,CAAC;YACzC,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACvC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,IAAI,sBAAsB,UAAU,GAAG,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;CACF,CAAA;AAXY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;GACA,6BAA6B,CAWzC;AAED;;;;;;;;;;;;GAYG;AAEI,IAAM,WAAW,mBAAjB,MAAM,WAAW;IACtB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,MAAM,CAAC,OAAO,CAAC,OAA2B;QACxC,MAAM,QAAQ,GAAG,IAAA,yCAAyB,EAAC,OAAO,CAAC,CAAC;QACpD,IAAA,wCAAuB,EAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACzG,IAAI,QAAQ,CAAC,wBAAwB;YAAE,IAAA,wDAA8B,GAAE,CAAC;QAExE,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,OAAO,EAAE;gBACP,uEAAuE;gBACvE,kEAAkE;gBAClE,iEAAiE;gBACjE,yBAAiB;aAClB;YACD,WAAW,EAAE,CAAC,mDAAuB,CAAC;YACtC,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,6BAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE;gBAC9C,6CAAoB;gBACpB,iEAAiE;gBACjE,oDAAoD;gBACpD,8CAAoB;gBACpB,qCAAgB;gBAChB,uCAAiB;gBACjB,kEAAkE;gBAClE,sEAAsE;gBACtE,iDAAsB;gBACtB,0DAA0D;gBAC1D,kDAAsB;gBACtB,wEAAwE;gBACxE,iDAAsB;gBACtB,6BAA6B;aAC9B;YACD,oEAAoE;YACpE,uEAAuE;YACvE,OAAO,EAAE,CAAC,6BAAa,EAAE,6CAAoB,EAAE,iDAAsB,EAAE,qCAAgB,EAAE,uCAAiB,CAAC;SAC5G,CAAC;IACJ,CAAC;CACF,CAAA;AAjEY,kCAAW;sBAAX,WAAW;IADvB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,WAAW,CAiEvB"}

package/dist/email/email.options.d.ts

@@ -0,0 +1,83 @@
+import type { GenericRateLimitClassifier } from './email-rate-limit';
+import type { EmailLayoutOptions } from './templates/layout-theme';
+/**
+ * Options of `EmailModule.forRoot`.
+ *
+ * @stability experimental
+ */
+export interface EmailModuleOptions {
+    /**
+     * The product name, in subjects, the wordmark and the footer. Required:
+     * core exposes no product-identity token (the reference app passes
+     * `APP_NAME` from its shared identity).
+     */
+    appName: string;
+    /**
+     * The deployment's base URL (the test email's "Open email settings" link,
+     * `EmailRenderContext.appUrl`), or a function read when it is needed.
+     * Default: none (the link is omitted).
+     */
+    appUrl?: string | (() => string | undefined);
+    /** The layout theme, inline brand mark and footer. Default: the platform layout. */
+    layout?: EmailLayoutOptions;
+    /** Register the nine platform templates (idempotent). Default `true`. */
+    registerDefaultTemplates?: boolean;
+    /**
+     * The generic HTTP / SDK rate-limit classifier email layers its SMTP and SES
+     * rules over. Default: none (only the email-specific rules apply). The
+     * reference app passes the job queue's `classifyRateLimit`.
+     */
+    classifyRateLimit?: GenericRateLimitClassifier;
+    /**
+     * The SES region used when the settings name none, read at send time.
+     * Default: none (an SES send without a region fails, naming the setting).
+     * The reference app reads its existing `SES_REGION` deployment variable.
+     */
+    sesRegionFallback?: () => string | undefined;
+}
+/**
+ * The options with every default filled in.
+ *
+ * @stability experimental
+ */
+export interface ResolvedEmailModuleOptions {
+    /** The product name. */
+    readonly appName: string;
+    /** The base URL, read now. */
+    readonly appUrl: () => string | undefined;
+    /** The layout option, as given. */
+    readonly layout: EmailLayoutOptions | undefined;
+    /** Whether the platform templates were registered. */
+    readonly registerDefaultTemplates: boolean;
+    /** The generic classifier, or `undefined`. */
+    readonly classifyRateLimit: GenericRateLimitClassifier | undefined;
+    /** The SES region fallback, read now. */
+    readonly sesRegionFallback: () => string | undefined;
+}
+/**
+ * Injection token of the {@link ResolvedEmailModuleOptions}. `Symbol.for`, so
+ * two copies of this file agree.
+ *
+ * @stability experimental
+ */
+export declare const EMAIL_OPTIONS: unique symbol;
+/**
+ * Fills in the defaults and checks the options.
+ *
+ * @param options - the `forRoot` options.
+ * @returns the resolved options (frozen).
+ * @throws Error when `appName` is missing or a function option is not one.
+ *
+ * @stability experimental
+ */
+export declare function resolveEmailModuleOptions(options: EmailModuleOptions): ResolvedEmailModuleOptions;
+/**
+ * Options of a module built without `forRoot` (a unit test constructing a
+ * provider by hand): no classifier, no SES fallback, no URL.
+ *
+ * @internal
+ *
+ * @stability experimental
+ */
+export declare const UNCONFIGURED_EMAIL_OPTIONS: Pick<ResolvedEmailModuleOptions, 'appUrl' | 'classifyRateLimit' | 'sesRegionFallback'>;
+//# sourceMappingURL=email.options.d.ts.map

package/dist/email/email.options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.options.d.ts","sourceRoot":"","sources":["../../src/email/email.options.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,oFAAoF;IACpF,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,yEAAyE;IACzE,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;IAC/C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,wBAAwB;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC1C,mCAAmC;IACnC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAChD,sDAAsD;IACtD,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C,8CAA8C;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,0BAA0B,GAAG,SAAS,CAAC;IACnE,yCAAyC;IACzC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CACtD;AAED;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,OAAO,MAAyD,CAAC;AAE7F;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,kBAAkB,GAAG,0BAA0B,CAkBjG;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,IAAI,CAC3C,0BAA0B,EAC1B,QAAQ,GAAG,mBAAmB,GAAG,mBAAmB,CAKpD,CAAC"}

package/dist/email/email.options.js

@@ -0,0 +1,64 @@
+"use strict";
+// =============================================================================
+// EmailModule options (issue #737, PP-8.4)
+// =============================================================================
+//
+// Every tunable of the email slice, as a `forRoot()` option. NONE IS AN
+// ENVIRONMENT VARIABLE: which transport, the SMTP relay, the SES identity and
+// the sender are configured at runtime on `/admin/settings/email` (the `email`
+// row of `system_settings` plus the credential store). What is here is what
+// the APP knows at composition time: its product name, its URL, its look, and
+// the queue's rate-limit classifier.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UNCONFIGURED_EMAIL_OPTIONS = exports.EMAIL_OPTIONS = void 0;
+exports.resolveEmailModuleOptions = resolveEmailModuleOptions;
+/**
+ * Injection token of the {@link ResolvedEmailModuleOptions}. `Symbol.for`, so
+ * two copies of this file agree.
+ *
+ * @stability experimental
+ */
+exports.EMAIL_OPTIONS = Symbol.for('@marinoscar/platform/email/OPTIONS');
+/**
+ * Fills in the defaults and checks the options.
+ *
+ * @param options - the `forRoot` options.
+ * @returns the resolved options (frozen).
+ * @throws Error when `appName` is missing or a function option is not one.
+ *
+ * @stability experimental
+ */
+function resolveEmailModuleOptions(options) {
+    if (!options || typeof options.appName !== 'string' || options.appName.trim() === '') {
+        throw new Error('EmailModule.forRoot: { appName } is required (the product name in subjects and footers).');
+    }
+    for (const key of ['classifyRateLimit', 'sesRegionFallback']) {
+        if (options[key] !== undefined && typeof options[key] !== 'function') {
+            throw new Error(`EmailModule.forRoot: ${key} must be a function.`);
+        }
+    }
+    const appUrl = options.appUrl;
+    return Object.freeze({
+        appName: options.appName.trim(),
+        appUrl: typeof appUrl === 'function' ? appUrl : () => appUrl,
+        layout: options.layout,
+        registerDefaultTemplates: options.registerDefaultTemplates ?? true,
+        classifyRateLimit: options.classifyRateLimit,
+        sesRegionFallback: options.sesRegionFallback ?? (() => undefined),
+    });
+}
+/**
+ * Options of a module built without `forRoot` (a unit test constructing a
+ * provider by hand): no classifier, no SES fallback, no URL.
+ *
+ * @internal
+ *
+ * @stability experimental
+ */
+exports.UNCONFIGURED_EMAIL_OPTIONS = Object.freeze({
+    appUrl: () => undefined,
+    classifyRateLimit: undefined,
+    sesRegionFallback: () => undefined,
+});
+//# sourceMappingURL=email.options.js.map

package/dist/email/email.options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.options.js","sourceRoot":"","sources":["../../src/email/email.options.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,2CAA2C;AAC3C,gFAAgF;AAChF,EAAE;AACF,wEAAwE;AACxE,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,qCAAqC;AACrC,gFAAgF;;;AA8EhF,8DAkBC;AAnCD;;;;;GAKG;AACU,QAAA,aAAa,GAAkB,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;AAE7F;;;;;;;;GAQG;AACH,SAAgB,yBAAyB,CAAC,OAA2B;IACnE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;IAC9G,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,CAAU,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,sBAAsB,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE;QAC/B,MAAM,EAAE,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM;QAC5D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB,IAAI,IAAI;QAClE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;KAClE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACU,QAAA,0BAA0B,GAGnC,MAAM,CAAC,MAAM,CAAC;IAChB,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;IACvB,iBAAiB,EAAE,SAAS;IAC5B,iBAAiB,EAAE,GAAG,EAAE,CAAC,SAAS;CACnC,CAAC,CAAC"}

package/dist/email/email.types.d.ts

@@ -0,0 +1,125 @@
+/**
+ * A fully-rendered, ready-to-send email message.
+ *
+ * Everything here is final. A provider does not render, does not apply the
+ * configured from-address, and does not fall back to a default subject — by
+ * the time a message reaches a provider, every decision has been made. That
+ * keeps "what did we send?" answerable from one place (#123/#125) rather than
+ * from whichever transport happened to be selected.
+ *
+ * @stability stable
+ */
+export interface EmailMessage {
+    /** Single recipient. Fan-out is the dispatcher's job (#125), not a transport's. */
+    to: string;
+    /**
+     * RFC 5322 From. Either a bare address or `Name <address>`.
+     *
+     * Required, not defaulted from `email.fromAddress`: a provider that silently
+     * substitutes a from-address turns "the admin never configured a sender"
+     * into a send that succeeds against SES and then bounces at the recipient,
+     * which is a far harder failure to trace than a refused send.
+     */
+    from: string;
+    /** The subject line, plain text. */
+    subject: string;
+    /** HTML body. Always present — #123 renders both parts for every template. */
+    html: string;
+    /**
+     * Plain-text alternative. NOT optional: a text part is required both for
+     * deliverability scoring and for clients that refuse to render HTML, and
+     * making it optional here is how it quietly stops being produced.
+     */
+    text: string;
+    /**
+     * Extra RFC 5322 headers, passed to the transport verbatim.
+     *
+     * For per-RECIPIENT headers that cannot be provider configuration — a
+     * `List-Unsubscribe` pair whose token embeds the user id, a correlation id.
+     */
+    headers?: Record<string, string>;
+    /**
+     * MIME parts sent alongside the body (issue #737; harvested from EvoPath):
+     * the layout's brand mark, an INLINE part the HTML references as
+     * `cid:<contentId>`, and any plain attachment. Each provider maps it to its
+     * own SDK's shape (nodemailer `attachments` with `cid`, SESv2
+     * `Content.Simple.Attachments`).
+     */
+    attachments?: EmailAttachment[];
+}
+/**
+ * One MIME part of an {@link EmailMessage}.
+ *
+ * PROVIDER-NEUTRAL ON PURPOSE: base64 text rather than a `Buffer`, so a
+ * template (a pure function with no Node I/O) can produce it from a constant
+ * and a test can compare it with `toEqual`.
+ *
+ * @stability experimental
+ */
+export interface EmailAttachment {
+    /** File name shown by clients that list attachments. */
+    filename: string;
+    /** MIME type, e.g. `image/png`. */
+    contentType: string;
+    /** The bytes, base64-encoded (no `data:` prefix, no line breaks). */
+    contentBase64: string;
+    /** Content-ID WITHOUT angle brackets; required for a part the HTML references as `cid:`. */
+    contentId?: string;
+    /** `inline` for a part the HTML references by `cid:`; `attachment` for a file to download. */
+    disposition: 'inline' | 'attachment';
+}
+/**
+ * The outcome of a single send attempt.
+ *
+ * THIS TYPE IS THE ONLY WAY A PROVIDER REPORTS FAILURE. See
+ * `./providers/email-provider.interface.ts` for why `send` must never
+ * throw, and `base-email.provider.ts` for how that is enforced structurally.
+ *
+ * @stability stable
+ */
+export interface EmailSendResult {
+    /** Whether the transport accepted the message (not: delivered it). */
+    success: boolean;
+    /** Transport-assigned id, present on success. Recorded by #125's delivery rows. */
+    messageId?: string;
+    /**
+     * Human-readable failure text, present on failure.
+     *
+     * SURFACED TO AN ADMIN VERBATIM by #124's "Send test email" button —
+     * diagnosing a mail misconfiguration is that page's entire purpose, so a
+     * generic "send failed" would make it useless. That makes this field a
+     * disclosure surface: it must never contain the SMTP password, an AWS
+     * secret key, or a message body. The providers redact and truncate before
+     * populating it; do not bypass that.
+     */
+    error?: string;
+    /**
+     * `true` when the failure was the PROVIDER THROTTLING US rather than the
+     * message, the address or the configuration being wrong (issue #456).
+     *
+     * Only ever set on a failure, and only by `BaseEmailProvider.send`, which
+     * classifies the thrown transport error through `classifyEmailRateLimit`
+     * (`../email-rate-limit.ts`). ABSENT MEANS "NOT A RATE LIMIT", never
+     * "unknown": the classifier is deliberately conservative, so a bad address,
+     * an authentication failure or an unconfigured provider all come back
+     * without it.
+     *
+     * WHY A FLAG AND NOT A THROW. `send` must never throw (see
+     * `providers/email-provider.interface.ts`), and that contract is not
+     * negotiable for the one caller who needs this: a job handler that has to
+     * STOP sending into a refusing provider (the broadcast fan-out). So the
+     * transport reports the fact, and only the caller that can act on it —
+     * `NotificationsService.notifyNow` → `BroadcastChunkHandler` — turns it into
+     * a `RateLimitError` the queue understands. Every other caller (#124's test
+     * button, the detached `notify()`) simply ignores an extra field.
+     */
+    rateLimited?: boolean;
+    /**
+     * The provider's requested wait in milliseconds, when it named one (an HTTP
+     * `Retry-After` on an AWS SDK error). Only meaningful beside
+     * `rateLimited: true`. SMTP has no such header, so it is always absent
+     * there and the queue falls back to its own `JOBS_RATELIMIT_*` backoff.
+     */
+    retryAfterMs?: number;
+}
+//# sourceMappingURL=email.types.d.ts.map

package/dist/email/email.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.types.d.ts","sourceRoot":"","sources":["../../src/email/email.types.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,EAAE,EAAE,MAAM,CAAC;IAEX;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAEhB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IAEb;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;CACjC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,WAAW,EAAE,QAAQ,GAAG,YAAY,CAAC;CACtC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAC;IAEjB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;;;;;;;;;;;;;;;;OAmBG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}

package/dist/email/email.types.js

@@ -0,0 +1,14 @@
+"use strict";
+// =============================================================================
+// Email transport types (issue #122, epic #109)
+// =============================================================================
+//
+// The wire format between "something that renders a message" (#123 templates,
+// #125 dispatcher) and "something that puts it on the network" (the providers
+// in ./providers). Deliberately free of Nest, Prisma and the AWS/nodemailer
+// SDKs: a template test and a dispatcher test should be able to build an
+// `EmailMessage` and assert on an `EmailSendResult` without standing up DI or
+// mocking a transport.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=email.types.js.map

package/dist/email/email.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.types.js","sourceRoot":"","sources":["../../src/email/email.types.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,gDAAgD;AAChD,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,uBAAuB;AACvB,gFAAgF"}

package/dist/email/index.d.ts

@@ -0,0 +1,55 @@
+import type { PlatformEmailTemplateDataMap } from './templates/platform-email-templates';
+export { EmailModule, EmailTemplateOverrideReporter } from './email.module';
+export { EMAIL_OPTIONS, resolveEmailModuleOptions } from './email.options';
+export type { EmailModuleOptions, ResolvedEmailModuleOptions } from './email.options';
+export { EmailSettingsService, EMAIL_SETTINGS_KEY } from './email-settings.service';
+export type { CredentialStatus, EmailPrisma, EmailSettingsAdminView, EmailSettingsUpdatedBy, SmtpPasswordStatus, } from './email-settings.service';
+export { EmailSettingsController } from './email-settings.controller';
+export type { EmailTransportSettingsRecord, EmailTransportsRecord } from './email-settings-compat';
+export { EmailTestSendService, formatFromHeader } from './email-test-send.service';
+export type { TestSendActor } from './email-test-send.service';
+export { SMTP_CREDENTIAL_LABEL, SMTP_CREDENTIAL_NAME, SMTP_CREDENTIAL_PURPOSE, SMTP_CREDENTIAL_PURPOSE_DEF, } from './smtp-credential.constants';
+export { SES_CREDENTIAL_LABEL, SES_CREDENTIAL_NAME, SES_CREDENTIAL_PURPOSE, SES_CREDENTIAL_PURPOSE_DEF, } from './ses-credential.constants';
+export { UpdateEmailSettingsDto, updateEmailSettingsSchema } from './dto/update-email-settings.dto';
+export type { UpdateEmailSettingsInput } from './dto/update-email-settings.dto';
+export { EmailSettingsResponseDto, emailSettingsResponseSchema } from './dto/email-settings-response.dto';
+export type { EmailSettingsResponse } from './dto/email-settings-response.dto';
+export { TestEmailResultDto, testEmailResultSchema } from './dto/test-email-result.dto';
+export type { TestEmailResult } from './dto/test-email-result.dto';
+export { BUILTIN_EMAIL_PROVIDER_KINDS, DEFAULT_EMAIL_SETTINGS, DEFAULT_SMTP_PORT, EMAIL_PROVIDER_KINDS, EMAIL_TRANSPORT_ID_PATTERN, IMPLICIT_TLS_SMTP_PORT, emailSettingsSchema, } from './email-settings.schema';
+export type { BuiltinEmailProviderKind, EmailProviderKind, EmailSettings } from './email-settings.schema';
+export { describeEmailTransports, emailTransportCredentialPurpose, emailTransportDefinitions, emailTransportIds, emailTransportKind, emailTransportSecretAddress, getEmailTransport, labelOfEmailTransport, missingEmailTransportFields, registerEmailTransport, requireEmailTransport, } from './transports/email-transport';
+export type { EmailTransport, EmailTransportBuildContext, EmailTransportBuildInput, EmailTransportDefinition, EmailTransportEgressOptions, EmailTransportSecretAddress, EmailTransportSettings, EmailTransportVerification, } from './transports/email-transport';
+export { EmailTransportResolver } from './transports/email-transport.resolver';
+export type { ActiveEmailTransport, EmailTransportResolution, UnavailableEmailTransport } from './transports/email-transport.resolver';
+export { BUILTIN_EMAIL_TRANSPORT_IDS, registerBuiltinEmailTransports, sesEmailTransport, smtpEmailTransport, } from './transports/builtin-email-transports';
+export type { SesTransportSettings, SmtpTransportSettings } from './transports/builtin-email-transports';
+export { BaseEmailProvider, SecretRedactor } from './base-email.provider';
+export { SesEmailProvider } from './providers/ses-email.provider';
+export { SmtpEmailProvider } from './providers/smtp-email.provider';
+export type { EmailProvider } from './providers/email-provider.interface';
+export type { EmailAttachment, EmailMessage, EmailSendResult } from './email.types';
+export { classifyEmailRateLimit } from './email-rate-limit';
+export type { EmailRateLimitClassification, GenericRateLimitClassifier } from './email-rate-limit';
+export { EMAIL_SETTINGS_PATH, EmailConfigDoctorCheck, decideEmailConfig } from './doctor/email-config.doctor-check';
+export { EmailEgressContributor } from './doctor/egress/email.egress.contributor';
+export { DEFAULT_EMAIL_LAYOUT_THEME, DEFAULT_EMAIL_TONES, EMAIL_TEMPLATE_NAME_PATTERN, PLATFORM_EMAIL_TEMPLATES, RENDERED_EMAIL_MATCHES_MESSAGE, SafeHtml, TRANSACTIONAL_EMAIL_HEADERS, allowlistInvitationEmail, backupFailedEmail, broadcastEmail, configureEmailRendering, createEmailRenderContext, currentEmailRenderContext, emailTemplateOverrideRegistry, emailTemplateRegistry, escapeHtml, findEmailTemplate, html, isEmailRenderingConfigured, isEmailTemplateName, jobFailedEmail, listEmailTemplateOverrides, nodeOfflineEmail, plainText, registerEmailTemplate, registerEmailTemplates, registerPlatformEmailTemplates, renderCallout, renderEmailTemplate, renderLayout, resolveEmailLayout, resolveEmailRenderContext, restoreCompletedEmail, roleChangedEmail, safeUrl, testEmail, userWelcomeEmail, withLayoutAttachments, } from './templates/index';
+export type { AllowlistInvitationEmailData, BackupFailedEmailData, BackupFailureOutcome, BroadcastEmailData, EmailBrandMark, EmailLayoutOptions, EmailLayoutTheme, EmailRenderContext, EmailRenderingOptions, EmailTemplate, EmailTemplateEntry, EmailTemplateName, EmailTemplateOverride, EmailTone, EmailToneStyle, JobFailedEmailData, MessageRenderedPartFitsRendered, NodeOfflineEmailData, PlainTextOptions, PlatformEmailTemplateDataMap, PlatformEmailTemplateName, RegisterEmailTemplateOptions, RenderCalloutOptions, RenderLayoutOptions, RenderedEmail, RenderedEmailFitsMessage, ResolvedEmailLayout, RestoreCompletedEmailData, RoleChangedEmailData, TestEmailData, UserWelcomeEmailData, } from './templates/index';
+/**
+ * Every template, mapped to the data it renders from: the platform's nine,
+ * plus whatever an app declares by module augmentation, next to its
+ * registration:
+ *
+ * ```ts
+ * declare module '@marinoscar/platform-api/email' {
+ *   interface EmailTemplateDataMap { 'coach-weekly-review': CoachWeeklyReviewEmailData }
+ * }
+ * registerEmailTemplate('coach-weekly-review', coachWeeklyReviewEmail);
+ * ```
+ *
+ * @extensionPoint schema
+ * @stability experimental
+ */
+export interface EmailTemplateDataMap extends PlatformEmailTemplateDataMap {
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/email/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/email/index.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAEzF,OAAO,EAAE,WAAW,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,YAAY,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAGtF,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACpF,YAAY,EACV,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,YAAY,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AACnF,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AACpG,YAAY,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAC1G,YAAY,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACxF,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAG1G,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAC/B,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,EAClB,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,cAAc,EACd,0BAA0B,EAC1B,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,YAAY,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACvI,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,EAC9B,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAGzG,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,YAAY,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAGnG,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACpH,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAGlF,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,2BAA2B,EAC3B,wBAAwB,EACxB,8BAA8B,EAC9B,QAAQ,EACR,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,IAAI,EACJ,0BAA0B,EAC1B,mBAAmB,EACnB,cAAc,EACd,0BAA0B,EAC1B,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,sBAAsB,EACtB,8BAA8B,EAC9B,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,yBAAyB,EACzB,qBAAqB,EACrB,gBAAgB,EAChB,OAAO,EACP,SAAS,EACT,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,4BAA4B,EAC5B,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,SAAS,EACT,cAAc,EACd,kBAAkB,EAClB,+BAA+B,EAC/B,oBAAoB,EACpB,gBAAgB,EAChB,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACpB,aAAa,EACb,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAI3B;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,oBAAqB,SAAQ,4BAA4B;CAAG"}