@openora/core 0.4.1-canary.129 → 0.4.1-canary.130

package/dist/mail/adapters/default-email-template-renderer.js

@@ -0,0 +1,107 @@
+import { formatMoneyAmount, } from '@openora/core/contracts';
+const DEFAULT_LOCALE = 'en';
+const escapeHtml = (value) => value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+const textToHtml = (text) => text
+    .split(/\n{2,}/)
+    .map((block) => `<p>${escapeHtml(block).replace(/\n/g, '<br>')}</p>`)
+    .join('\n');
+const DATE_FORMAT_OPTS = { dateStyle: 'long', timeStyle: 'short', timeZone: 'UTC' };
+const dateFormatter = (locale) => {
+    try {
+        return new Intl.DateTimeFormat(locale, DATE_FORMAT_OPTS);
+    }
+    catch {
+        return new Intl.DateTimeFormat(DEFAULT_LOCALE, DATE_FORMAT_OPTS);
+    }
+};
+const formatEmailDate = (iso, locale) => iso === null ? 'further notice' : `${dateFormatter(locale).format(new Date(iso))} UTC`;
+const formatMoney = (amount, currency) => `${formatMoneyAmount(amount)} ${currency}`;
+const PLAIN_EMAIL_TEMPLATES = {
+    verifyEmail: (data) => ({
+        subject: 'Verify your email',
+        text: `Your email verification code is: ${data.otp}`,
+    }),
+    resetPasswordOtp: (data) => ({
+        subject: 'Reset your password',
+        text: `Your password reset code is: ${data.otp}`,
+    }),
+    adminResetPasswordOtp: (data) => ({
+        subject: 'Password reset requested by an administrator',
+        text: `An administrator requested a password reset for your account. Your reset code is: ${data.otp}`,
+    }),
+    existingAccountSignUp: (data) => ({
+        subject: 'You already have an account',
+        text: `Someone tried to create an account with this email address. ` +
+            `You already have one, so no new account was created. ` +
+            `If it was you, sign in as usual - or use this code to reset your password: ${data.otp}`,
+    }),
+    rgLimitUpdated: (data) => {
+        const value = data.amount !== null
+            ? formatMoney(data.amount, data.currency ?? '')
+            : `${data.minutes} minutes`;
+        return {
+            subject: 'Your gambling limit was updated',
+            text: `A ${data.period} ${data.type} limit of ${value.trim()} is now active on your account.`,
+        };
+    },
+    rgCoolingOffActivated: (data, locale) => ({
+        subject: 'Your cooling-off period has started',
+        text: `A cooling-off period is active on your account until ${formatEmailDate(data.expiresAt, locale)}.\n\nYou will not be able to log in or place bets until then.`,
+    }),
+    rgCoolingOffLifted: () => ({
+        subject: 'Your cooling-off period has ended',
+        text: 'Your cooling-off period has been ended and you can log in again.',
+    }),
+    rgSelfExclusionActivated: (data, locale) => ({
+        subject: 'Your self-exclusion has started',
+        text: data.isPermanent
+            ? 'Your account has been permanently self-excluded and you will not be able to log in.'
+            : `Your account is self-excluded until ${formatEmailDate(data.expiresAt, locale)}.\n\nYou will not be able to log in until then.`,
+    }),
+    rgSelfExclusionLifted: () => ({
+        subject: 'Your self-exclusion has been lifted',
+        text: 'Your self-exclusion has been lifted and you can log in again.',
+    }),
+    withdrawalApproved: (data, locale) => ({
+        subject: 'Your withdrawal was approved',
+        text: `Your withdrawal of ${formatMoney(data.amount, data.currency)} has been approved and is being processed.\n\n` +
+            `Transaction: ${data.transactionId}\nDate: ${formatEmailDate(data.occurredAt, locale)}`,
+    }),
+    withdrawalRejected: (data, locale) => ({
+        subject: 'Your withdrawal was rejected',
+        text: `Your withdrawal of ${formatMoney(data.amount, data.currency)} was rejected and the funds were returned to your balance.\n\n` +
+            `Transaction: ${data.transactionId}\nDate: ${formatEmailDate(data.occurredAt, locale)}` +
+            (data.reason ? `\nReason: ${data.reason}` : ''),
+    }),
+    kycResubmissionRequested: (data) => ({
+        subject: 'Document resubmission required',
+        text: `An admin has requested you resubmit your verification documents.` +
+            (data.reason ? ` Reason: ${data.reason}.` : ''),
+    }),
+    adminInvitation: (data, locale) => ({
+        subject: 'You have been invited as an administrator',
+        text: `Your admin invitation token: ${data.token}. It expires at ${formatEmailDate(data.expiresAt, locale)}.`,
+    }),
+    securityLoginAlert: (data, locale) => ({
+        subject: 'New sign-in to your account',
+        text: `A new sign-in to your account was detected on ${formatEmailDate(data.occurredAt, locale)}.\n\n` +
+            `If this was not you, secure your account immediately.`,
+    }),
+    securityWithdrawalRequested: (data, locale) => ({
+        subject: 'Withdrawal requested on your account',
+        text: `A withdrawal of ${formatMoney(data.amount, data.currency)} was requested on your account and is pending review.\n\n` +
+            `Transaction: ${data.transactionId}\nDate: ${formatEmailDate(data.occurredAt, locale)}\n\n` +
+            `If this was not you, secure your account immediately.`,
+    }),
+};
+const renderDefaultEmail = (template, locale) => {
+    const plain = PLAIN_EMAIL_TEMPLATES[template.key];
+    const { subject, text } = plain(template.data, locale);
+    return { subject, text, html: textToHtml(text) };
+};
+export class DefaultEmailTemplateRenderer {
+    render(template, locale) {
+        return renderDefaultEmail(template, locale);
+    }
+}
+//# sourceMappingURL=default-email-template-renderer.js.map

package/dist/mail/adapters/default-email-template-renderer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-email-template-renderer.js","sourceRoot":"","sources":["../../../src/mail/adapters/default-email-template-renderer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAMlB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3C,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAEnG,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAC1C,IAAI;KACD,KAAK,CAAC,QAAQ,CAAC;KACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;KACpE,IAAI,CAAC,IAAI,CAAC,CAAC;AAEhB,MAAM,gBAAgB,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAW,CAAC;AAE7F,MAAM,aAAa,GAAG,CAAC,MAAc,EAAuB,EAAE;IAC5D,IAAI,CAAC;QACH,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACnE,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,GAAkB,EAAE,MAAc,EAAU,EAAE,CACrE,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AAEzF,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAU,EAAE,CAC/D,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;AAO7C,MAAM,qBAAqB,GAAkD;IAC3E,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtB,OAAO,EAAE,mBAAmB;QAC5B,IAAI,EAAE,oCAAoC,IAAI,CAAC,GAAG,EAAE;KACrD,CAAC;IACF,gBAAgB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3B,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,gCAAgC,IAAI,CAAC,GAAG,EAAE;KACjD,CAAC;IACF,qBAAqB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChC,OAAO,EAAE,8CAA8C;QACvD,IAAI,EAAE,qFAAqF,IAAI,CAAC,GAAG,EAAE;KACtG,CAAC;IACF,qBAAqB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChC,OAAO,EAAE,6BAA6B;QACtC,IAAI,EACF,8DAA8D;YAC9D,uDAAuD;YACvD,8EAA8E,IAAI,CAAC,GAAG,EAAE;KAC3F,CAAC;IACF,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE;QACvB,MAAM,KAAK,GACT,IAAI,CAAC,MAAM,KAAK,IAAI;YAClB,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC/C,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,UAAU,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,iCAAiC;YAC1C,IAAI,EAAE,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,aAAa,KAAK,CAAC,IAAI,EAAE,iCAAiC;SAC9F,CAAC;IACJ,CAAC;IACD,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,qCAAqC;QAC9C,IAAI,EAAE,wDAAwD,eAAe,CAC3E,IAAI,CAAC,SAAS,EACd,MAAM,CACP,+DAA+D;KACjE,CAAC;IACF,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;QACzB,OAAO,EAAE,mCAAmC;QAC5C,IAAI,EAAE,kEAAkE;KACzE,CAAC;IACF,wBAAwB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,iCAAiC;QAC1C,IAAI,EAAE,IAAI,CAAC,WAAW;YACpB,CAAC,CAAC,qFAAqF;YACvF,CAAC,CAAC,uCAAuC,eAAe,CACpD,IAAI,CAAC,SAAS,EACd,MAAM,CACP,iDAAiD;KACvD,CAAC;IACF,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5B,OAAO,EAAE,qCAAqC;QAC9C,IAAI,EAAE,+DAA+D;KACtE,CAAC;IACF,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACrC,OAAO,EAAE,8BAA8B;QACvC,IAAI,EACF,sBAAsB,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,gDAAgD;YAC7G,gBAAgB,IAAI,CAAC,aAAa,WAAW,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE;KAC1F,CAAC;IACF,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACrC,OAAO,EAAE,8BAA8B;QACvC,IAAI,EACF,sBAAsB,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,gEAAgE;YAC7H,gBAAgB,IAAI,CAAC,aAAa,WAAW,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE;YACvF,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;IACF,wBAAwB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnC,OAAO,EAAE,gCAAgC;QACzC,IAAI,EACF,kEAAkE;YAClE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;IACF,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAClC,OAAO,EAAE,2CAA2C;QACpD,IAAI,EAAE,gCAAgC,IAAI,CAAC,KAAK,mBAAmB,eAAe,CAChF,IAAI,CAAC,SAAS,EACd,MAAM,CACP,GAAG;KACL,CAAC;IACF,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACrC,OAAO,EAAE,6BAA6B;QACtC,IAAI,EACF,iDAAiD,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO;YAChG,uDAAuD;KAC1D,CAAC;IACF,2BAA2B,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,sCAAsC;QAC/C,IAAI,EACF,mBAAmB,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,2DAA2D;YACrH,gBAAgB,IAAI,CAAC,aAAa,WAAW,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM;YAC3F,uDAAuD;KAC1D,CAAC;CACH,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,QAAsB,EAAE,MAAc,EAAiB,EAAE;IACnF,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAuC,CAAC;IACxF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;AACnD,CAAC,CAAC;AAEF,MAAM,OAAO,4BAA4B;IACvC,MAAM,CAAC,QAAsB,EAAE,MAAc;QAC3C,OAAO,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;CACF"}

package/dist/mail/adapters/stdout-email-sender.d.ts

@@ -0,0 +1,5 @@
+import type { EmailMessage, EmailSenderPort } from '@openora/core/contracts';
+export declare class StdoutEmailSender implements EmailSenderPort {
+    send(message: EmailMessage): Promise<void>;
+}
+//# sourceMappingURL=stdout-email-sender.d.ts.map

package/dist/mail/adapters/stdout-email-sender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdout-email-sender.d.ts","sourceRoot":"","sources":["../../../src/mail/adapters/stdout-email-sender.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI7E,qBAAa,iBAAkB,YAAW,eAAe;IACjD,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAMjD"}

package/dist/mail/adapters/stdout-email-sender.js

@@ -0,0 +1,8 @@
+import { createLogger } from '@openora/core/server';
+const logger = createLogger('mail');
+export class StdoutEmailSender {
+    async send(message) {
+        logger.info({ to: message.to, subject: message.subject, bytes: message.html.length }, 'mock email delivery (no EMAIL_SENDER overlay bound)');
+    }
+}
+//# sourceMappingURL=stdout-email-sender.js.map

package/dist/mail/adapters/stdout-email-sender.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdout-email-sender.js","sourceRoot":"","sources":["../../../src/mail/adapters/stdout-email-sender.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEpC,MAAM,OAAO,iBAAiB;IAC5B,KAAK,CAAC,IAAI,CAAC,OAAqB;QAC9B,MAAM,CAAC,IAAI,CACT,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EACxE,qDAAqD,CACtD,CAAC;IACJ,CAAC;CACF"}

package/dist/mail/contract/index.d.ts

@@ -0,0 +1,120 @@
+import * as z from 'zod';
+export declare const MAIL_SEND_QUEUE: import("@openora/core/contracts").QueueName;
+export declare const MailRecipientSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"user">;
+    userId: z.ZodUUID;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"address">;
+    email: z.ZodEmail;
+    locale: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "kind">;
+export type MailRecipient = z.infer<typeof MailRecipientSchema>;
+export declare const MailSendJobSchema: z.ZodObject<{
+    recipient: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"user">;
+        userId: z.ZodUUID;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"address">;
+        email: z.ZodEmail;
+        locale: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>], "kind">;
+    template: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        key: z.ZodLiteral<"verifyEmail">;
+        data: z.ZodObject<{
+            otp: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        key: z.ZodLiteral<"resetPasswordOtp">;
+        data: z.ZodObject<{
+            otp: z.ZodString;
+            email: z.ZodEmail;
+        }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        key: z.ZodLiteral<"adminResetPasswordOtp">;
+        data: z.ZodObject<{
+            otp: z.ZodString;
+            email: z.ZodEmail;
+        }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        key: z.ZodLiteral<"existingAccountSignUp">;
+        data: z.ZodObject<{
+            otp: z.ZodString;
+            email: z.ZodEmail;
+        }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        key: z.ZodLiteral<"rgLimitUpdated">;
+        data: z.ZodObject<{
+            period: z.ZodString;
+            type: z.ZodString;
+            amount: z.ZodNullable<z.ZodString>;
+            currency: z.ZodNullable<z.ZodString>;
+            minutes: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        key: z.ZodLiteral<"rgCoolingOffActivated">;
+        data: z.ZodObject<{
+            expiresAt: z.ZodISODateTime;
+        }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        key: z.ZodLiteral<"rgCoolingOffLifted">;
+        data: z.ZodObject<{}, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        key: z.ZodLiteral<"rgSelfExclusionActivated">;
+        data: z.ZodObject<{
+            expiresAt: z.ZodNullable<z.ZodISODateTime>;
+            isPermanent: z.ZodBoolean;
+        }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        key: z.ZodLiteral<"rgSelfExclusionLifted">;
+        data: z.ZodObject<{}, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        key: z.ZodLiteral<"withdrawalApproved">;
+        data: z.ZodObject<{
+            amount: z.ZodString;
+            currency: z.ZodString;
+            transactionId: z.ZodUUID;
+            occurredAt: z.ZodISODateTime;
+        }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        key: z.ZodLiteral<"withdrawalRejected">;
+        data: z.ZodObject<{
+            reason: z.ZodNullable<z.ZodString>;
+            amount: z.ZodString;
+            currency: z.ZodString;
+            transactionId: z.ZodUUID;
+            occurredAt: z.ZodISODateTime;
+        }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        key: z.ZodLiteral<"kycResubmissionRequested">;
+        data: z.ZodObject<{
+            reason: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        key: z.ZodLiteral<"adminInvitation">;
+        data: z.ZodObject<{
+            token: z.ZodString;
+            expiresAt: z.ZodISODateTime;
+        }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        key: z.ZodLiteral<"securityLoginAlert">;
+        data: z.ZodObject<{
+            occurredAt: z.ZodISODateTime;
+        }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        key: z.ZodLiteral<"securityWithdrawalRequested">;
+        data: z.ZodObject<{
+            amount: z.ZodString;
+            currency: z.ZodString;
+            transactionId: z.ZodUUID;
+            occurredAt: z.ZodISODateTime;
+        }, z.core.$strip>;
+    }, z.core.$strip>], "key">;
+}, z.core.$strip>;
+export type MailSendJob = z.infer<typeof MailSendJobSchema>;
+export declare const EncryptedMailSendJobSchema: z.ZodObject<{
+    ciphertext: z.ZodString;
+    iv: z.ZodString;
+    tag: z.ZodString;
+}, z.core.$strip>;
+export type EncryptedMailSendJob = z.infer<typeof EncryptedMailSendJobSchema>;
+//# sourceMappingURL=index.d.ts.map

package/dist/mail/contract/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mail/contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAGzB,eAAO,MAAM,eAAe,6CAAqB,CAAC;AAElD,eAAO,MAAM,mBAAmB;;;;;;;2BAG9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,0BAA0B;;;;iBAIrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/mail/contract/index.js

@@ -0,0 +1,17 @@
+import * as z from 'zod';
+import { MailTemplateSchema, UuidSchema, queue } from '@openora/core/contracts';
+export const MAIL_SEND_QUEUE = queue('mail-send');
+export const MailRecipientSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('user'), userId: UuidSchema }),
+    z.object({ kind: z.literal('address'), email: z.email(), locale: z.string().optional() }),
+]);
+export const MailSendJobSchema = z.object({
+    recipient: MailRecipientSchema,
+    template: MailTemplateSchema,
+});
+export const EncryptedMailSendJobSchema = z.object({
+    ciphertext: z.string().min(1),
+    iv: z.string().min(1),
+    tag: z.string().min(1),
+});
+//# sourceMappingURL=index.js.map

package/dist/mail/contract/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mail/contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAEhF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9D,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACzD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;CAC1F,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,SAAS,EAAE,mBAAmB;IAC9B,QAAQ,EAAE,kBAAkB;CAC7B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvB,CAAC,CAAC"}

package/dist/mail/index.d.ts

@@ -0,0 +1,5 @@
+export { MailService, type MailServiceDeps } from './service/mail.service.js';
+export { DefaultEmailTemplateRenderer } from './adapters/default-email-template-renderer.js';
+export { StdoutEmailSender } from './adapters/stdout-email-sender.js';
+export { MAIL_SEND_QUEUE, EncryptedMailSendJobSchema, MailSendJobSchema, MailRecipientSchema, type EncryptedMailSendJob, type MailSendJob, type MailRecipient, } from './contract/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/mail/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mail/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC"}

package/dist/mail/index.js

@@ -0,0 +1,5 @@
+export { MailService } from './service/mail.service.js';
+export { DefaultEmailTemplateRenderer } from './adapters/default-email-template-renderer.js';
+export { StdoutEmailSender } from './adapters/stdout-email-sender.js';
+export { MAIL_SEND_QUEUE, EncryptedMailSendJobSchema, MailSendJobSchema, MailRecipientSchema, } from './contract/index.js';
+//# sourceMappingURL=index.js.map

package/dist/mail/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mail/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAwB,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,iBAAiB,EACjB,mBAAmB,GAIpB,MAAM,qBAAqB,CAAC"}

package/dist/mail/plugin.d.ts

@@ -0,0 +1,181 @@
+declare const _default: {
+    readonly id: "mail";
+    readonly register: (ctx: import("@openora/core/server").PluginContext<{
+        ADMIN_GAME_REPORTING: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminGameReporting>;
+        ADMIN_GUARD: import("@openora/core/contracts").Token<import("@openora/core/server").AdminGuard>;
+        ADMIN_PERMISSION_RESOLVER: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminPermissionResolver>;
+        ADMIN_PLAYER_ACTIVITY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminPlayerActivity>;
+        ADMIN_ROLE_ASSIGNMENT_DIRECTORY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminRoleAssignmentDirectory>;
+        ADMIN_SECURITY_POLICY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminSecurityPolicy>;
+        ADMIN_USER_DIRECTORY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminUserDirectory>;
+        ADMIN_WALLET_REPORTING: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminWalletReporting>;
+        AUDIT_WRITER: import("@openora/core/contracts").SealedToken<import("@openora/core/contracts").AuditWritePort>;
+        AUTH_SESSION: import("@openora/core/contracts").Token<import("@openora/core/server").SessionResolver>;
+        CACHE: import("@openora/core/contracts").Token<import("@openora/core/contracts").CacheAdapter>;
+        CHAT_BLOCK_WRITER: import("@openora/core/contracts").Token<import("@openora/core/contracts").ChatBlockWriter>;
+        CHAT_MODERATION: import("@openora/core/contracts").Token<import("@openora/core/contracts").ChatModeration, string>;
+        CHAT_REALTIME_CLIENT_AUTHORIZER: import("@openora/core/contracts").Token<import("@openora/core/contracts").RealtimeClientAuthorizer>;
+        CHAT_REALTIME_TRANSPORT: import("@openora/core/contracts").Token<import("@openora/core/contracts").RealtimeTransport>;
+        CHAT_ROOM_ACCESS: import("@openora/core/contracts").Token<import("@openora/core/contracts").ChatRoomAccess>;
+        CHAT_SYSTEM_WRITER: import("@openora/core/contracts").Token<import("@openora/core/contracts").ChatSystemWriter, string>;
+        DRIZZLE: import("@openora/core/contracts").Token<import("@openora/core/server").DrizzleService>;
+        EMAIL_SENDER: import("@openora/core/contracts").Token<import("@openora/core/contracts").EmailSenderPort>;
+        EMAIL_TEMPLATE_RENDERER: import("@openora/core/contracts").Token<import("@openora/core/contracts").EmailTemplateRenderer>;
+        ERROR_TRACKING: import("@openora/core/contracts").Token<import("@openora/core/contracts").ErrorTrackingAdapter>;
+        EVENT_BUS: import("@openora/core/contracts").Token<import("@openora/core/server").EventBus>;
+        EXCHANGE_RATE_READER: import("@openora/core/contracts").Token<import("@openora/core/contracts").ExchangeRateReader>;
+        CRYPTO_EXCHANGE_RATE_PROVIDER: import("@openora/core/contracts").Token<import("@openora/core/contracts").ExchangeRateProvider>;
+        FIAT_EXCHANGE_RATE_PROVIDER: import("@openora/core/contracts").Token<import("@openora/core/contracts").ExchangeRateProvider>;
+        SWAP_ADAPTER: import("@openora/core/contracts").Token<import("@openora/core/contracts").SwapAdapter>;
+        SWAP_WEBHOOK_VERIFIER: import("@openora/core/contracts").Token<import("@openora/core/contracts").SwapWebhookVerifier>;
+        GAME_ADAPTER: import("@openora/core/contracts").Token<import("@openora/core/contracts").GameAdapter>;
+        GEO_CHECK_COMMANDS: import("@openora/core/contracts").Token<import("@openora/core/contracts").GeoCheckCommands>;
+        GEO_IP_ADAPTER: import("@openora/core/contracts").Token<import("@openora/core/contracts").GeoIpAdapter>;
+        IDENTITY_OPTIONS: import("@openora/core/contracts").Token<import("@openora/core/contracts").IdentityServiceOptions>;
+        IDENTITY_READER: import("@openora/core/contracts").Token<import("@openora/core/contracts").IdentityReader, string>;
+        IGAMING_CONFIG: import("@openora/core/contracts").Token<{
+            branding: {
+                name: string;
+                themePreset?: string | undefined;
+                supportEmail?: string | undefined;
+            };
+            currencies: string[];
+            jurisdictions: string[];
+            blockedCountries: string[];
+            limits: {
+                maxDepositPerDay?: number | undefined;
+                maxDepositPerMonth?: number | undefined;
+                maxLossPerDay?: number | undefined;
+                maxStakePerBet?: number | undefined;
+                sessionReminderMinutes?: number | undefined;
+            };
+            providers: {
+                payment?: string | undefined;
+                kyc?: string | undefined;
+                geoIp?: string | undefined;
+                aggregator?: string | undefined;
+                notification?: string | undefined;
+            };
+            enabledModules?: string[] | undefined;
+        }, string>;
+        JOB_QUEUE: import("@openora/core/contracts").Token<import("@openora/core/contracts").JobQueueAdapter>;
+        KYC_ADAPTER: import("@openora/core/contracts").Token<import("@openora/core/contracts").KycAdapter>;
+        KYC_STATUS_WRITER: import("@openora/core/contracts").Token<import("@openora/core/contracts").KycStatusWriter>;
+        KYC_WEBHOOK_VERIFIER: import("@openora/core/contracts").Token<import("@openora/core/contracts").KycWebhookVerifier>;
+        LOGIN_ENFORCEMENT: import("@openora/core/contracts").Token<import("@openora/core/contracts").LoginEnforcementPort>;
+        MAIL_DISPATCH: import("@openora/core/contracts").Token<import("@openora/core/contracts").MailDispatchPort>;
+        MESSAGE_BROKER: import("@openora/core/contracts").Token<import("@openora/core/contracts").MessageBrokerAdapter>;
+        OUTBOX: import("@openora/core/contracts").Token<import("@openora/core/contracts").OutboxWriter>;
+        PAYMENT_ADAPTER: import("@openora/core/contracts").Token<import("@openora/core/contracts").PaymentAdapter>;
+        PAYMENT_PROVIDERS: import("@openora/core/contracts").Token<import("@openora/core/contracts").PaymentProviderRegistry>;
+        PAYMENT_WEBHOOK_VERIFIER: import("@openora/core/contracts").Token<import("@openora/core/contracts").PaymentWebhookVerifier>;
+        PLATFORM_CONFIG: import("@openora/core/contracts").Token<{
+            features: Record<string, boolean>;
+            brands: {
+                id: string;
+                name: string;
+                themePreset?: string | undefined;
+                themeOverrides?: Record<string, string> | undefined;
+            }[];
+            rgLimits: Record<string, {
+                maxDepositPerDay?: number | undefined;
+                maxDepositPerMonth?: number | undefined;
+                maxLossPerDay?: number | undefined;
+                maxStakePerBet?: number | undefined;
+                sessionReminderMinutes?: number | undefined;
+            }>;
+            responsibleGambling: {
+                limitIncreaseCooldownHours: number;
+                limitChangeConfirmationWindowHours: number;
+            };
+            chat: {
+                allowedAttachmentHosts: string[];
+                moderationExpiry?: {
+                    cron: string;
+                } | undefined;
+            };
+            adminSecurity: {
+                requireTwoFactor: boolean;
+                bindSessionToDevice: boolean;
+                trustedDeviceDays: number;
+                ipChangePolicy: "any" | "country" | "off";
+                twoFactorLockout: {
+                    maxAttempts: number;
+                    durationMs: number;
+                };
+            };
+            cms: {
+                allowedBannerImageHosts: string[];
+            };
+            activeBrand?: string | undefined;
+            kyc?: {
+                gateWithdrawals: boolean;
+                provider?: string | undefined;
+                webhookSecretEnv?: string | undefined;
+                reverifyThresholds?: Record<string, string> | undefined;
+            } | undefined;
+            autoWithdrawal?: {
+                enabled: boolean;
+                dailyCapAmount?: string | undefined;
+                dailyCapCount?: number | undefined;
+            } | undefined;
+            wallet?: {
+                cryptoCurrencies?: string[] | undefined;
+                treasuryRefs?: Record<string, string> | undefined;
+                sweep?: {
+                    cron: string;
+                    feeMultiple: string;
+                    batchSize: number;
+                    concurrency: number;
+                    unknownAfterMinutes: number;
+                    staleRunAfterMinutes: number;
+                } | undefined;
+                reconciliation?: {
+                    cron: string;
+                    lookbackHours: number;
+                    batchSize: number;
+                    stuckAfterMinutes: number;
+                    staleRunAfterMinutes: number;
+                    alertThreshold: number;
+                } | undefined;
+            } | undefined;
+            exchangeRate?: {
+                pivot: string;
+                freshTtlMs: number;
+                hardMaxAgeMs: number;
+                providerTimeoutMs: number;
+            } | undefined;
+            registration?: {
+                termsVersion: string;
+                requireEmailVerification: boolean;
+            } | undefined;
+            notifications?: {
+                retention?: {
+                    days: number;
+                    cron: string;
+                } | undefined;
+            } | undefined;
+            supportedLanguages?: string[] | undefined;
+            displayCurrencies?: string[] | undefined;
+        }, string>;
+        PLAYER_ACTIVITY_TRACKER: import("@openora/core/contracts").Token<import("@openora/core/contracts").PlayerActivityTracker>;
+        PLAYER_PROVISIONING: import("@openora/core/contracts").Token<import("@openora/core/contracts").PlayerProvisioning>;
+        PLAYER_TAGS: import("@openora/core/contracts").Token<import("@openora/core/contracts").PlayerTags>;
+        PLAY_ELIGIBILITY: import("@openora/core/contracts").Token<import("@openora/core/contracts").PlayEligibilityPort>;
+        RATE_LIMITER: import("@openora/core/contracts").Token<import("@openora/core/contracts").RateLimiterAdapter<`register:${string}` | `login:${string}` | `enable2fa:${string}` | `verify2fa:${string}` | `disable2fa:${string}` | `pwreset-req:${string}` | `pwreset-verify:${string}` | `pwreset:${string}` | `change-password:${string}` | `email-verify:${string}` | `verify-email:${string}` | `wallet-mutation:${string}` | `wallet-webhook:${string}` | `chat-room-join:${string}` | `chat-send:${string}` | `report-access-denied:${string}`>>;
+        REALTIME_CLIENT_AUTHORIZER: import("@openora/core/contracts").Token<import("@openora/core/contracts").RealtimeClientAuthorizer>;
+        REALTIME_TRANSPORT: import("@openora/core/contracts").Token<import("@openora/core/contracts").RealtimeTransport>;
+        RG_LIMITS: import("@openora/core/contracts").Token<import("@openora/core/contracts").RgLimitsPort>;
+        RNG_ADAPTER: import("@openora/core/contracts").Token<import("@openora/core/contracts").RngAdapter>;
+        SESSION_COMMANDS: import("@openora/core/contracts").Token<import("@openora/core/contracts").SessionCommands>;
+        USER_COMMANDS: import("@openora/core/contracts").Token<import("@openora/core/contracts").UserCommands>;
+        SMS_ADAPTER: import("@openora/core/contracts").Token<import("@openora/core/contracts").SmsAdapter>;
+        SOCIAL_COMMANDS: import("@openora/core/contracts").Token<import("@openora/core/contracts").SocialCommands>;
+        TAG_EVALUATION_COMMANDS: import("@openora/core/contracts").Token<import("@openora/core/contracts").TagEvaluationCommands>;
+        WALLET_ASSET_CATALOG: import("@openora/core/contracts").Token<import("@openora/core/contracts").WalletAssetCatalog, string>;
+        WALLET_COMMANDS: import("@openora/core/contracts").Token<import("@openora/core/contracts").WalletCommands>;
+        WALLET_READER: import("@openora/core/contracts").Token<import("@openora/core/contracts").WalletReader, string>;
+    }>) => void;
+};
+export default _default;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/mail/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/mail/plugin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,wBAiE8C"}

package/dist/mail/plugin.js

@@ -0,0 +1,66 @@
+import { ADMIN_USER_DIRECTORY, AUDIT_WRITER, EMAIL_SENDER, EMAIL_TEMPLATE_RENDERER, JOB_QUEUE, MAIL_DISPATCH, } from '@openora/core/contracts';
+import { createLogger } from '@openora/core/server';
+import { MailService } from './service/mail.service.js';
+import { MIN_MAIL_ENCRYPTION_SECRET_LENGTH } from './service/mail-payload.service.js';
+import { DefaultEmailTemplateRenderer } from './adapters/default-email-template-renderer.js';
+import { StdoutEmailSender } from './adapters/stdout-email-sender.js';
+import { EncryptedMailSendJobSchema, MAIL_SEND_QUEUE } from './contract/index.js';
+const logger = createLogger('mail');
+export default {
+    id: 'mail',
+    register(ctx) {
+        const encryptionSecret = process.env['AUTH_SECRET'] ?? '';
+        if (encryptionSecret.length < MIN_MAIL_ENCRYPTION_SECRET_LENGTH) {
+            throw new Error(`mail: AUTH_SECRET must be at least ${MIN_MAIL_ENCRYPTION_SECRET_LENGTH} characters - mail-send job payloads (OTPs, invitation tokens) are encrypted with it`);
+        }
+        let svcRef = null;
+        const mailService = (c) => (svcRef ??= new MailService({
+            sender: c.get(EMAIL_SENDER),
+            renderer: c.get(EMAIL_TEMPLATE_RENDERER),
+            directory: c.get(ADMIN_USER_DIRECTORY),
+            jobQueue: c.get(JOB_QUEUE),
+            audit: c.has(AUDIT_WRITER) ? c.get(AUDIT_WRITER) : null,
+            encryptionSecret,
+        }));
+        ctx.provide(EMAIL_SENDER, () => new StdoutEmailSender());
+        ctx.provide(EMAIL_TEMPLATE_RENDERER, () => new DefaultEmailTemplateRenderer());
+        ctx.provide(MAIL_DISPATCH, (c) => {
+            const svc = mailService(c);
+            return {
+                toUser: (input) => svc.enqueueToUser(input),
+                toAddress: (input) => svc.enqueueToAddress(input),
+            };
+        });
+        ctx.routers.add('mail', (c) => {
+            if (c.get(EMAIL_SENDER) instanceof StdoutEmailSender) {
+                const msg = 'mail: no EMAIL_SENDER overlay bound. StdoutEmailSender only logs metadata and never ' +
+                    'delivers - bind a real EMAIL_SENDER (SMTP/SES/Postmark) in an overlay loaded after the mail plugin.';
+                if (process.env['NODE_ENV'] === 'production') {
+                    throw new Error(msg);
+                }
+                logger.warn(msg);
+            }
+            mailService(c);
+            return {};
+        });
+        ctx.jobs.worker({
+            queue: MAIL_SEND_QUEUE,
+            schema: EncryptedMailSendJobSchema,
+            options: { concurrency: 5 },
+            handler: async ({ payload, attempt }) => {
+                if (!svcRef) {
+                    throw new Error('mail: service not constructed yet');
+                }
+                await svcRef.deliverEncrypted(payload, attempt);
+            },
+            onDeadLetter: (jobCtx, error) => {
+                if (!svcRef) {
+                    logger.error({ err: error }, 'mail delivery exhausted retries before service init');
+                    return;
+                }
+                return svcRef.onEncryptedDeliveryExhausted(jobCtx.payload, error, jobCtx.attempt);
+            },
+        });
+    },
+};
+//# sourceMappingURL=plugin.js.map

package/dist/mail/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/mail/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,uBAAuB,EACvB,SAAS,EACT,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,iCAAiC,EAAE,MAAM,mCAAmC,CAAC;AACtF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAElF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEpC,eAAe;IACb,EAAE,EAAE,MAAM;IACV,QAAQ,CAAC,GAAG;QACV,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,gBAAgB,CAAC,MAAM,GAAG,iCAAiC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,sCAAsC,iCAAiC,sFAAsF,CAC9J,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,GAAuB,IAAI,CAAC;QACtC,MAAM,WAAW,GAAG,CAAC,CAAmC,EAAe,EAAE,CACvE,CAAC,MAAM,KAAK,IAAI,WAAW,CAAC;YAC1B,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;YAC3B,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACxC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACtC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YAC1B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;YACvD,gBAAgB;SACjB,CAAC,CAAC,CAAC;QAEN,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;QACzD,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,IAAI,4BAA4B,EAAE,CAAC,CAAC;QAE/E,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE;YAC/B,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,OAAO;gBACL,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC;gBAC3C,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC;aAClD,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YAC5B,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,YAAY,iBAAiB,EAAE,CAAC;gBACrD,MAAM,GAAG,GACP,sFAAsF;oBACtF,qGAAqG,CAAC;gBACxG,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;oBAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;gBACvB,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,WAAW,CAAC,CAAC,CAAC,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YACd,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,0BAA0B;YAClC,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE;YAC3B,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;gBACtC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACvD,CAAC;gBACD,MAAM,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YACD,YAAY,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;gBAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,qDAAqD,CAAC,CAAC;oBACpF,OAAO;gBACT,CAAC;gBACD,OAAO,MAAM,CAAC,4BAA4B,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACpF,CAAC;SACF,CAAC,CAAC;IACL,CAAC;CAC0C,CAAC"}

package/dist/mail/service/mail-payload.service.d.ts

@@ -0,0 +1,8 @@
+import { type EncryptedMailSendJob, type MailSendJob } from '../contract/index.js';
+export declare const MIN_MAIL_ENCRYPTION_SECRET_LENGTH = 32;
+export type MailPayloadCipher = {
+    encrypt(job: MailSendJob): EncryptedMailSendJob;
+    decrypt(job: EncryptedMailSendJob): MailSendJob;
+};
+export declare function createMailPayloadCipher(secret: string): MailPayloadCipher;
+//# sourceMappingURL=mail-payload.service.d.ts.map

package/dist/mail/service/mail-payload.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-payload.service.d.ts","sourceRoot":"","sources":["../../../src/mail/service/mail-payload.service.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAI9B,eAAO,MAAM,iCAAiC,KAAK,CAAC;AAEpD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,oBAAoB,CAAC;IAChD,OAAO,CAAC,GAAG,EAAE,oBAAoB,GAAG,WAAW,CAAC;CACjD,CAAC;AAOF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAiCzE"}

package/dist/mail/service/mail-payload.service.js

@@ -0,0 +1,43 @@
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from 'node:crypto';
+import { MailSendJobSchema, } from '../contract/index.js';
+const ALGORITHM = 'aes-256-gcm';
+const IV_BYTES = 12;
+export const MIN_MAIL_ENCRYPTION_SECRET_LENGTH = 32;
+const MAIL_PAYLOAD_KEY_INFO = 'openora:mail-payload:v1';
+const toKey = (secret) => Buffer.from(hkdfSync('sha256', secret, Buffer.alloc(0), MAIL_PAYLOAD_KEY_INFO, 32));
+export function createMailPayloadCipher(secret) {
+    if (secret.length < MIN_MAIL_ENCRYPTION_SECRET_LENGTH) {
+        throw new Error('AUTH_SECRET must have at least 32 characters to encrypt mail jobs');
+    }
+    const key = toKey(secret);
+    return {
+        encrypt(job) {
+            const iv = randomBytes(IV_BYTES);
+            const cipher = createCipheriv(ALGORITHM, key, iv);
+            const ciphertext = Buffer.concat([
+                cipher.update(JSON.stringify(job), 'utf8'),
+                cipher.final(),
+            ]).toString('base64url');
+            return {
+                ciphertext,
+                iv: iv.toString('base64url'),
+                tag: cipher.getAuthTag().toString('base64url'),
+            };
+        },
+        decrypt(job) {
+            try {
+                const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(job.iv, 'base64url'));
+                decipher.setAuthTag(Buffer.from(job.tag, 'base64url'));
+                const plaintext = Buffer.concat([
+                    decipher.update(Buffer.from(job.ciphertext, 'base64url')),
+                    decipher.final(),
+                ]).toString('utf8');
+                return MailSendJobSchema.parse(JSON.parse(plaintext));
+            }
+            catch {
+                throw new Error('mail job payload could not be decrypted');
+            }
+        },
+    };
+}
+//# sourceMappingURL=mail-payload.service.js.map