@portaidentity/server 1.7.0

package/dist/auth/email-service.d.ts

@@ -0,0 +1,154 @@
+/**
+ * High-level email service for auth workflow emails.
+ *
+ * Provides specific methods for each email type (magic link, password reset,
+ * invitation, welcome, password-changed). Each method:
+ *   1. Renders HTML + plaintext templates via the email renderer
+ *   2. Sends via the email transport
+ *   3. Writes an audit log entry
+ *
+ * All methods use fire-and-forget semantics: send failures are caught,
+ * logged as warnings, and audit-logged — they never propagate to callers.
+ * This ensures email delivery never blocks core authentication flows.
+ *
+ * @example
+ *   await sendMagicLinkEmail(user, org, 'https://...', 'en');
+ */
+import type { EmailTransport } from './email-transport.js';
+/** Minimal user fields needed by email service */
+export interface EmailUser {
+    id: string;
+    email: string;
+    givenName?: string | null;
+    familyName?: string | null;
+}
+/** Minimal org fields needed by email service */
+export interface EmailOrganization {
+    id: string;
+    slug: string;
+    brandingLogoUrl?: string | null;
+    brandingPrimaryColor?: string | null;
+    brandingCompanyName?: string | null;
+}
+/** Closed recovery email variants sent by the durable worker. */
+export type RecoveryEmailType = 'magic_link' | 'password_reset';
+/** Input for strict recovery delivery with propagated transport failures. */
+export interface StrictRecoveryEmailInput {
+    /** Recovery template and subject selection. */
+    readonly type: RecoveryEmailType;
+    /** Eligible recipient account. */
+    readonly user: EmailUser;
+    /** Tenant branding and template authority. */
+    readonly organization: EmailOrganization;
+    /** Complete recovery URL containing the single-use artifact. */
+    readonly recoveryUrl: string;
+    /** Resolved locale. */
+    readonly locale: string;
+    /** Stable RFC 5322 message identity for bounded retries. */
+    readonly messageId: string;
+}
+/**
+ * Render and deliver one recovery email while propagating template and SMTP failures.
+ *
+ * The durable worker owns retry and terminal policy. This function deliberately performs no
+ * catch-and-ignore behavior and emits no recipient, URL, or transport-error details.
+ *
+ * @param input - Recovery template, recipient, tenant, link, locale, and message identity.
+ */
+export declare function sendRecoveryEmailStrict(input: StrictRecoveryEmailInput): Promise<void>;
+/**
+ * Override the email transport (for testing).
+ * Pass null to reset to the default SMTP transport.
+ *
+ * @param override - Custom transport or null to reset
+ */
+export declare function setEmailTransport(override: EmailTransport | null): void;
+/**
+ * Send a magic link email to a user.
+ *
+ * @param user - Recipient user
+ * @param org - Organization (for branding and template override)
+ * @param magicLinkUrl - Full URL the user clicks to authenticate
+ * @param locale - Locale for i18n (e.g., 'en')
+ */
+export declare function sendMagicLinkEmail(user: EmailUser, org: EmailOrganization, magicLinkUrl: string, locale: string): Promise<void>;
+/**
+ * Send a password reset email to a user.
+ *
+ * @param user - Recipient user
+ * @param org - Organization (for branding and template override)
+ * @param resetUrl - Full URL the user clicks to reset their password
+ * @param locale - Locale for i18n
+ */
+export declare function sendPasswordResetEmail(user: EmailUser, org: EmailOrganization, resetUrl: string, locale: string): Promise<void>;
+/**
+ * Optional parameters for enhanced invitation emails.
+ *
+ * Supports personal messages from the inviting admin and pre-assignment
+ * metadata display in the invitation email.
+ */
+export interface InvitationEmailOptions {
+    /** Optional personal message from the admin (HTML-escaped before rendering) */
+    personalMessage?: string;
+    /** Display name of the admin who sent the invitation */
+    inviterName?: string;
+}
+/**
+ * Send an invitation email to a newly created user.
+ *
+ * @param user - Recipient user (newly created)
+ * @param org - Organization (for branding and template override)
+ * @param inviteUrl - Full URL the user clicks to accept the invitation
+ * @param locale - Locale for i18n
+ * @param options - Optional personal message and inviter name
+ */
+export declare function sendInvitationEmail(user: EmailUser, org: EmailOrganization, inviteUrl: string, locale: string, options?: InvitationEmailOptions): Promise<void>;
+/**
+ * Render an invitation email without sending it (for preview).
+ *
+ * Returns the HTML, plain text, and subject line that would be sent,
+ * allowing admins to preview the invitation before sending.
+ *
+ * @param user - Recipient user
+ * @param org - Organization for branding
+ * @param inviteUrl - Full URL (can be a placeholder for preview)
+ * @param locale - Locale for i18n
+ * @param options - Optional personal message and inviter name
+ * @returns Rendered HTML, plain text, and subject line
+ */
+export declare function renderInvitationEmail(user: EmailUser, org: EmailOrganization, inviteUrl: string, locale: string, options?: InvitationEmailOptions): Promise<{
+    html: string;
+    text: string;
+    subject: string;
+}>;
+/**
+ * Send a welcome email to a user (for passwordless users after first login).
+ *
+ * @param user - Recipient user
+ * @param org - Organization (for branding and template override)
+ * @param locale - Locale for i18n
+ */
+export declare function sendWelcomeEmail(user: EmailUser, org: EmailOrganization, locale: string): Promise<void>;
+/**
+ * Send a 2FA OTP verification code email.
+ *
+ * Used during login when the user's 2FA method is 'email'. The email
+ * contains a 6-digit code that expires in the specified number of minutes.
+ * Follows the same fire-and-forget pattern as other email methods.
+ *
+ * @param user - Recipient user
+ * @param org - Organization (for branding and template override)
+ * @param code - 6-digit OTP code to include in the email
+ * @param expiresMinutes - Minutes until the code expires (e.g., 10)
+ * @param locale - Locale for i18n
+ */
+export declare function sendOtpCodeEmail(user: EmailUser, org: EmailOrganization, code: string, expiresMinutes: number, locale: string): Promise<void>;
+/**
+ * Send a password-changed confirmation email.
+ *
+ * @param user - Recipient user
+ * @param org - Organization (for branding and template override)
+ * @param locale - Locale for i18n
+ */
+export declare function sendPasswordChangedEmail(user: EmailUser, org: EmailOrganization, locale: string): Promise<void>;
+//# sourceMappingURL=email-service.d.ts.map

package/dist/auth/email-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-service.d.ts","sourceRoot":"","sources":["../../src/auth/email-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAU3D,kDAAkD;AAClD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,iEAAiE;AACjE,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,gBAAgB,CAAC;AAEhE,6EAA6E;AAC7E,MAAM,WAAW,wBAAwB;IACvC,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,8CAA8C;IAC9C,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uBAAuB;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAmBD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB5F;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,IAAI,CAEvE;AAuCD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,iBAAiB,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAwCf;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAyCD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,iBAAiB,EACtB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,iBAAiB,EACtB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAI1D;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,iBAAiB,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAoCf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAuCf;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,iBAAiB,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAsCf"}

package/dist/auth/email-service.js

@@ -0,0 +1,415 @@
+/**
+ * High-level email service for auth workflow emails.
+ *
+ * Provides specific methods for each email type (magic link, password reset,
+ * invitation, welcome, password-changed). Each method:
+ *   1. Renders HTML + plaintext templates via the email renderer
+ *   2. Sends via the email transport
+ *   3. Writes an audit log entry
+ *
+ * All methods use fire-and-forget semantics: send failures are caught,
+ * logged as warnings, and audit-logged — they never propagate to callers.
+ * This ensures email delivery never blocks core authentication flows.
+ *
+ * @example
+ *   await sendMagicLinkEmail(user, org, 'https://...', 'en');
+ */
+import { createSmtpTransport } from './email-transport.js';
+import { renderEmail } from './email-renderer.js';
+import { writeAuditLog } from '../lib/audit-log.js';
+import { logger } from '../lib/logger.js';
+// ---------------------------------------------------------------------------
+// Module-level transport (lazy-initialized)
+// ---------------------------------------------------------------------------
+let transport = null;
+/**
+ * Get or create the email transport singleton.
+ * Lazy-initialized on first use to avoid startup dependency issues.
+ */
+function getTransport() {
+    if (!transport) {
+        transport = createSmtpTransport();
+    }
+    return transport;
+}
+/**
+ * Render and deliver one recovery email while propagating template and SMTP failures.
+ *
+ * The durable worker owns retry and terminal policy. This function deliberately performs no
+ * catch-and-ignore behavior and emits no recipient, URL, or transport-error details.
+ *
+ * @param input - Recovery template, recipient, tenant, link, locale, and message identity.
+ */
+export async function sendRecoveryEmailStrict(input) {
+    const isMagicLink = input.type === 'magic_link';
+    const { html, text } = await renderEmail(isMagicLink ? 'magic-link' : 'password-reset', input.organization.slug, {
+        userName: getUserDisplayName(input.user),
+        [isMagicLink ? 'magicLinkUrl' : 'resetUrl']: input.recoveryUrl,
+        expiresMinutes: isMagicLink ? 15 : 60,
+        branding: buildBrandingContext(input.organization),
+        locale: input.locale,
+    });
+    await getTransport().send({
+        to: input.user.email,
+        subject: isMagicLink ? 'Sign in to your account' : 'Reset your password',
+        html,
+        text,
+        messageId: input.messageId,
+    });
+}
+/**
+ * Override the email transport (for testing).
+ * Pass null to reset to the default SMTP transport.
+ *
+ * @param override - Custom transport or null to reset
+ */
+export function setEmailTransport(override) {
+    transport = override;
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Build branding context object from organization data.
+ *
+ * @param org - Organization with branding fields
+ * @returns Branding object for template context
+ */
+function buildBrandingContext(org) {
+    return {
+        logoUrl: org.brandingLogoUrl ?? '',
+        primaryColor: org.brandingPrimaryColor ?? '#3B82F6',
+        companyName: org.brandingCompanyName ?? org.slug,
+    };
+}
+/**
+ * Build the display name for a user.
+ * Falls back to email prefix if no name is set.
+ *
+ * @param user - User with optional name fields
+ * @returns Display name string
+ */
+function getUserDisplayName(user) {
+    if (user.givenName) {
+        return user.familyName ? `${user.givenName} ${user.familyName}` : user.givenName;
+    }
+    // Fall back to email prefix (everything before @)
+    return user.email.split('@')[0];
+}
+// ---------------------------------------------------------------------------
+// Email methods (fire-and-forget)
+// ---------------------------------------------------------------------------
+/**
+ * Send a magic link email to a user.
+ *
+ * @param user - Recipient user
+ * @param org - Organization (for branding and template override)
+ * @param magicLinkUrl - Full URL the user clicks to authenticate
+ * @param locale - Locale for i18n (e.g., 'en')
+ */
+export async function sendMagicLinkEmail(user, org, magicLinkUrl, locale) {
+    try {
+        const { html, text } = await renderEmail('magic-link', org.slug, {
+            userName: getUserDisplayName(user),
+            magicLinkUrl,
+            expiresMinutes: 15,
+            branding: buildBrandingContext(org),
+            locale,
+        });
+        await getTransport().send({
+            to: user.email,
+            subject: 'Sign in to your account',
+            html,
+            text,
+        });
+        // Fire-and-forget audit log
+        writeAuditLog({
+            organizationId: org.id,
+            userId: user.id,
+            eventType: 'email.send.magic_link',
+            eventCategory: 'auth',
+            description: `Magic link email sent to ${user.email}`,
+        });
+        logger.debug({ userId: user.id, email: user.email }, 'Magic link email sent');
+    }
+    catch (error) {
+        logger.warn({ error, userId: user.id, email: user.email }, 'Failed to send magic link email');
+        writeAuditLog({
+            organizationId: org.id,
+            userId: user.id,
+            eventType: 'email.send.failed',
+            eventCategory: 'auth',
+            description: `Failed to send magic link email to ${user.email}`,
+            metadata: { error: String(error), template: 'magic-link' },
+        });
+    }
+}
+/**
+ * Send a password reset email to a user.
+ *
+ * @param user - Recipient user
+ * @param org - Organization (for branding and template override)
+ * @param resetUrl - Full URL the user clicks to reset their password
+ * @param locale - Locale for i18n
+ */
+export async function sendPasswordResetEmail(user, org, resetUrl, locale) {
+    try {
+        const { html, text } = await renderEmail('password-reset', org.slug, {
+            userName: getUserDisplayName(user),
+            resetUrl,
+            expiresMinutes: 60,
+            branding: buildBrandingContext(org),
+            locale,
+        });
+        await getTransport().send({
+            to: user.email,
+            subject: 'Reset your password',
+            html,
+            text,
+        });
+        writeAuditLog({
+            organizationId: org.id,
+            userId: user.id,
+            eventType: 'email.send.password_reset',
+            eventCategory: 'auth',
+            description: `Password reset email sent to ${user.email}`,
+        });
+        logger.debug({ userId: user.id, email: user.email }, 'Password reset email sent');
+    }
+    catch (error) {
+        logger.warn({ error, userId: user.id, email: user.email }, 'Failed to send password reset email');
+        writeAuditLog({
+            organizationId: org.id,
+            userId: user.id,
+            eventType: 'email.send.failed',
+            eventCategory: 'auth',
+            description: `Failed to send password reset email to ${user.email}`,
+            metadata: { error: String(error), template: 'password-reset' },
+        });
+    }
+}
+/**
+ * Build the template context for an invitation email.
+ *
+ * Shared between sendInvitationEmail() and renderInvitationEmail()
+ * to ensure consistency between sent emails and preview renders.
+ *
+ * @param user - Recipient user
+ * @param org - Organization for branding
+ * @param inviteUrl - Full URL the user clicks to accept
+ * @param locale - Locale for i18n
+ * @param options - Optional personal message and inviter name
+ * @returns Template context and computed subject line
+ */
+function buildInvitationContext(user, org, inviteUrl, locale, options) {
+    const orgName = org.brandingCompanyName ?? org.slug;
+    return {
+        context: {
+            userName: getUserDisplayName(user),
+            inviteUrl,
+            orgName,
+            expiresDays: 7,
+            branding: buildBrandingContext(org),
+            locale,
+            // Enhanced invitation fields — only included when provided
+            personalMessage: options?.personalMessage ?? null,
+            inviterName: options?.inviterName ?? null,
+        },
+        subject: options?.inviterName
+            ? `${options.inviterName} has invited you to ${orgName}`
+            : `You've been invited to ${orgName}`,
+    };
+}
+/**
+ * Send an invitation email to a newly created user.
+ *
+ * @param user - Recipient user (newly created)
+ * @param org - Organization (for branding and template override)
+ * @param inviteUrl - Full URL the user clicks to accept the invitation
+ * @param locale - Locale for i18n
+ * @param options - Optional personal message and inviter name
+ */
+export async function sendInvitationEmail(user, org, inviteUrl, locale, options) {
+    try {
+        const { context, subject } = buildInvitationContext(user, org, inviteUrl, locale, options);
+        const { html, text } = await renderEmail('invitation', org.slug, context);
+        await getTransport().send({
+            to: user.email,
+            subject,
+            html,
+            text,
+        });
+        writeAuditLog({
+            organizationId: org.id,
+            userId: user.id,
+            eventType: 'email.send.invitation',
+            eventCategory: 'auth',
+            description: `Invitation email sent to ${user.email}`,
+        });
+        logger.debug({ userId: user.id, email: user.email }, 'Invitation email sent');
+    }
+    catch (error) {
+        logger.warn({ error, userId: user.id, email: user.email }, 'Failed to send invitation email');
+        writeAuditLog({
+            organizationId: org.id,
+            userId: user.id,
+            eventType: 'email.send.failed',
+            eventCategory: 'auth',
+            description: `Failed to send invitation email to ${user.email}`,
+            metadata: { error: String(error), template: 'invitation' },
+        });
+    }
+}
+/**
+ * Render an invitation email without sending it (for preview).
+ *
+ * Returns the HTML, plain text, and subject line that would be sent,
+ * allowing admins to preview the invitation before sending.
+ *
+ * @param user - Recipient user
+ * @param org - Organization for branding
+ * @param inviteUrl - Full URL (can be a placeholder for preview)
+ * @param locale - Locale for i18n
+ * @param options - Optional personal message and inviter name
+ * @returns Rendered HTML, plain text, and subject line
+ */
+export async function renderInvitationEmail(user, org, inviteUrl, locale, options) {
+    const { context, subject } = buildInvitationContext(user, org, inviteUrl, locale, options);
+    const { html, text } = await renderEmail('invitation', org.slug, context);
+    return { html, text, subject };
+}
+/**
+ * Send a welcome email to a user (for passwordless users after first login).
+ *
+ * @param user - Recipient user
+ * @param org - Organization (for branding and template override)
+ * @param locale - Locale for i18n
+ */
+export async function sendWelcomeEmail(user, org, locale) {
+    try {
+        const { html, text } = await renderEmail('welcome', org.slug, {
+            userName: getUserDisplayName(user),
+            orgName: org.brandingCompanyName ?? org.slug,
+            branding: buildBrandingContext(org),
+            locale,
+        });
+        await getTransport().send({
+            to: user.email,
+            subject: `Welcome to ${org.brandingCompanyName ?? org.slug}`,
+            html,
+            text,
+        });
+        writeAuditLog({
+            organizationId: org.id,
+            userId: user.id,
+            eventType: 'email.send.welcome',
+            eventCategory: 'auth',
+            description: `Welcome email sent to ${user.email}`,
+        });
+        logger.debug({ userId: user.id, email: user.email }, 'Welcome email sent');
+    }
+    catch (error) {
+        logger.warn({ error, userId: user.id, email: user.email }, 'Failed to send welcome email');
+        writeAuditLog({
+            organizationId: org.id,
+            userId: user.id,
+            eventType: 'email.send.failed',
+            eventCategory: 'auth',
+            description: `Failed to send welcome email to ${user.email}`,
+            metadata: { error: String(error), template: 'welcome' },
+        });
+    }
+}
+/**
+ * Send a 2FA OTP verification code email.
+ *
+ * Used during login when the user's 2FA method is 'email'. The email
+ * contains a 6-digit code that expires in the specified number of minutes.
+ * Follows the same fire-and-forget pattern as other email methods.
+ *
+ * @param user - Recipient user
+ * @param org - Organization (for branding and template override)
+ * @param code - 6-digit OTP code to include in the email
+ * @param expiresMinutes - Minutes until the code expires (e.g., 10)
+ * @param locale - Locale for i18n
+ */
+export async function sendOtpCodeEmail(user, org, code, expiresMinutes, locale) {
+    try {
+        const { html, text } = await renderEmail('otp-code', org.slug, {
+            userName: getUserDisplayName(user),
+            code,
+            expiresMinutes,
+            orgName: org.brandingCompanyName ?? org.slug,
+            branding: buildBrandingContext(org),
+            locale,
+        });
+        await getTransport().send({
+            to: user.email,
+            subject: `Your verification code: ${code}`,
+            html,
+            text,
+        });
+        // Fire-and-forget audit log
+        writeAuditLog({
+            organizationId: org.id,
+            userId: user.id,
+            eventType: 'email.send.otp_code',
+            eventCategory: 'auth',
+            description: `OTP code email sent to ${user.email}`,
+        });
+        logger.debug({ userId: user.id, email: user.email }, 'OTP code email sent');
+    }
+    catch (error) {
+        logger.warn({ error, userId: user.id, email: user.email }, 'Failed to send OTP code email');
+        writeAuditLog({
+            organizationId: org.id,
+            userId: user.id,
+            eventType: 'email.send.failed',
+            eventCategory: 'auth',
+            description: `Failed to send OTP code email to ${user.email}`,
+            metadata: { error: String(error), template: 'otp-code' },
+        });
+    }
+}
+/**
+ * Send a password-changed confirmation email.
+ *
+ * @param user - Recipient user
+ * @param org - Organization (for branding and template override)
+ * @param locale - Locale for i18n
+ */
+export async function sendPasswordChangedEmail(user, org, locale) {
+    try {
+        const { html, text } = await renderEmail('password-changed', org.slug, {
+            userName: getUserDisplayName(user),
+            branding: buildBrandingContext(org),
+            locale,
+        });
+        await getTransport().send({
+            to: user.email,
+            subject: 'Your password has been changed',
+            html,
+            text,
+        });
+        writeAuditLog({
+            organizationId: org.id,
+            userId: user.id,
+            eventType: 'email.send.password_changed',
+            eventCategory: 'auth',
+            description: `Password changed email sent to ${user.email}`,
+        });
+        logger.debug({ userId: user.id, email: user.email }, 'Password changed email sent');
+    }
+    catch (error) {
+        logger.warn({ error, userId: user.id, email: user.email }, 'Failed to send password changed email');
+        writeAuditLog({
+            organizationId: org.id,
+            userId: user.id,
+            eventType: 'email.send.failed',
+            eventCategory: 'auth',
+            description: `Failed to send password changed email to ${user.email}`,
+            metadata: { error: String(error), template: 'password-changed' },
+        });
+    }
+}
+//# sourceMappingURL=email-service.js.map

package/dist/auth/email-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-service.js","sourceRoot":"","sources":["../../src/auth/email-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA0C1C,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E,IAAI,SAAS,GAA0B,IAAI,CAAC;AAE5C;;;GAGG;AACH,SAAS,YAAY;IACnB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAA+B;IAC3E,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;IAChD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CACtC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,EAC7C,KAAK,CAAC,YAAY,CAAC,IAAI,EACvB;QACE,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC;QACxC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,WAAW;QAC9D,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QACrC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC;QAClD,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CACF,CAAC;IACF,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;QACxB,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;QACpB,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,qBAAqB;QACxE,IAAI;QACJ,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA+B;IAC/D,SAAS,GAAG,QAAQ,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAsB;IAClD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,eAAe,IAAI,EAAE;QAClC,YAAY,EAAE,GAAG,CAAC,oBAAoB,IAAI,SAAS;QACnD,WAAW,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,IAAI;KACjD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAe;IACzC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;IACnF,CAAC;IACD,kDAAkD;IAClD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAe,EACf,GAAsB,EACtB,YAAoB,EACpB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE;YAC/D,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC;YAClC,YAAY;YACZ,cAAc,EAAE,EAAE;YAClB,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACnC,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;YACxB,EAAE,EAAE,IAAI,CAAC,KAAK;YACd,OAAO,EAAE,yBAAyB;YAClC,IAAI;YACJ,IAAI;SACL,CAAC,CAAC;QAEH,4BAA4B;QAC5B,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,uBAAuB;YAClC,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,4BAA4B,IAAI,CAAC,KAAK,EAAE;SACtD,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAC9F,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,mBAAmB;YAC9B,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,sCAAsC,IAAI,CAAC,KAAK,EAAE;YAC/D,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAe,EACf,GAAsB,EACtB,QAAgB,EAChB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,gBAAgB,EAAE,GAAG,CAAC,IAAI,EAAE;YACnE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC;YAClC,QAAQ;YACR,cAAc,EAAE,EAAE;YAClB,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACnC,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;YACxB,EAAE,EAAE,IAAI,CAAC,KAAK;YACd,OAAO,EAAE,qBAAqB;YAC9B,IAAI;YACJ,IAAI;SACL,CAAC,CAAC;QAEH,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,2BAA2B;YACtC,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gCAAgC,IAAI,CAAC,KAAK,EAAE;SAC1D,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,2BAA2B,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAC7C,qCAAqC,CACtC,CAAC;QACF,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,mBAAmB;YAC9B,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,0CAA0C,IAAI,CAAC,KAAK,EAAE;YACnE,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAeD;;;;;;;;;;;;GAYG;AACH,SAAS,sBAAsB,CAC7B,IAAe,EACf,GAAsB,EACtB,SAAiB,EACjB,MAAc,EACd,OAAgC;IAEhC,MAAM,OAAO,GAAG,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,IAAI,CAAC;IACpD,OAAO;QACL,OAAO,EAAE;YACP,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC;YAClC,SAAS;YACT,OAAO;YACP,WAAW,EAAE,CAAC;YACd,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACnC,MAAM;YACN,2DAA2D;YAC3D,eAAe,EAAE,OAAO,EAAE,eAAe,IAAI,IAAI;YACjD,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,IAAI;SAC1C;QACD,OAAO,EAAE,OAAO,EAAE,WAAW;YAC3B,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,uBAAuB,OAAO,EAAE;YACxD,CAAC,CAAC,0BAA0B,OAAO,EAAE;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAe,EACf,GAAsB,EACtB,SAAiB,EACjB,MAAc,EACd,OAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3F,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE1E,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;YACxB,EAAE,EAAE,IAAI,CAAC,KAAK;YACd,OAAO;YACP,IAAI;YACJ,IAAI;SACL,CAAC,CAAC;QAEH,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,uBAAuB;YAClC,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,4BAA4B,IAAI,CAAC,KAAK,EAAE;SACtD,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAC9F,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,mBAAmB;YAC9B,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,sCAAsC,IAAI,CAAC,KAAK,EAAE;YAC/D,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAe,EACf,GAAsB,EACtB,SAAiB,EACjB,MAAc,EACd,OAAgC;IAEhC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3F,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAe,EACf,GAAsB,EACtB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE;YAC5D,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC;YAClC,OAAO,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,IAAI;YAC5C,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACnC,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;YACxB,EAAE,EAAE,IAAI,CAAC,KAAK;YACd,OAAO,EAAE,cAAc,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,IAAI,EAAE;YAC5D,IAAI;YACJ,IAAI;SACL,CAAC,CAAC;QAEH,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,oBAAoB;YAC/B,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,yBAAyB,IAAI,CAAC,KAAK,EAAE;SACnD,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,8BAA8B,CAAC,CAAC;QAC3F,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,mBAAmB;YAC9B,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,mCAAmC,IAAI,CAAC,KAAK,EAAE;YAC5D,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAe,EACf,GAAsB,EACtB,IAAY,EACZ,cAAsB,EACtB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE;YAC7D,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC;YAClC,IAAI;YACJ,cAAc;YACd,OAAO,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,IAAI;YAC5C,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACnC,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;YACxB,EAAE,EAAE,IAAI,CAAC,KAAK;YACd,OAAO,EAAE,2BAA2B,IAAI,EAAE;YAC1C,IAAI;YACJ,IAAI;SACL,CAAC,CAAC;QAEH,4BAA4B;QAC5B,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,qBAAqB;YAChC,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,0BAA0B,IAAI,CAAC,KAAK,EAAE;SACpD,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,qBAAqB,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC5F,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,mBAAmB;YAC9B,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,oCAAoC,IAAI,CAAC,KAAK,EAAE;YAC7D,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE;SACzD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAe,EACf,GAAsB,EACtB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC,IAAI,EAAE;YACrE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC;YAClC,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACnC,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;YACxB,EAAE,EAAE,IAAI,CAAC,KAAK;YACd,OAAO,EAAE,gCAAgC;YACzC,IAAI;YACJ,IAAI;SACL,CAAC,CAAC;QAEH,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,6BAA6B;YACxC,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,kCAAkC,IAAI,CAAC,KAAK,EAAE;SAC5D,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,6BAA6B,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAC7C,uCAAuC,CACxC,CAAC;QACF,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,mBAAmB;YAC9B,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,4CAA4C,IAAI,CAAC,KAAK,EAAE;YACrE,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE;SACjE,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/auth/email-transport.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Pluggable email transport abstraction.
+ *
+ * Defines a transport interface and provides a default SMTP implementation
+ * using Nodemailer. The interface allows swapping transports for testing
+ * (mock transport) or future providers (SES, SendGrid, etc.).
+ *
+ * SMTP configuration is read from the app config (`config.smtp.*`).
+ * Auth is only applied when `smtp.user` is provided — MailHog in dev
+ * doesn't need authentication.
+ *
+ * @example
+ *   const transport = createSmtpTransport();
+ *   const result = await transport.send({
+ *     to: 'user@example.com',
+ *     subject: 'Welcome',
+ *     html: '<h1>Hello</h1>',
+ *     text: 'Hello',
+ *   });
+ */
+/** Options for sending an email */
+export interface SendEmailOptions {
+    /** Recipient email address */
+    to: string;
+    /** Sender address — falls back to config.smtp.from if not provided */
+    from?: string;
+    /** Email subject line */
+    subject: string;
+    /** HTML body */
+    html: string;
+    /** Plaintext body (fallback for clients that don't render HTML) */
+    text: string;
+    /** Reply-to address (optional) */
+    replyTo?: string;
+    /** Stable RFC 5322 message identity used for idempotent recovery retries. */
+    messageId?: string;
+}
+/** Result of sending an email */
+export interface EmailResult {
+    /** SMTP message ID */
+    messageId: string;
+    /** Email addresses that accepted the message */
+    accepted: string[];
+    /** Email addresses that rejected the message */
+    rejected: string[];
+}
+/** Pluggable transport interface — SMTP is the default, others can be added */
+export interface EmailTransport {
+    /** Send an email with the given options */
+    send(options: SendEmailOptions): Promise<EmailResult>;
+}
+/**
+ * Create an SMTP email transport using Nodemailer.
+ *
+ * Reads SMTP configuration from the app config:
+ *   - `config.smtp.host` — SMTP server hostname
+ *   - `config.smtp.port` — SMTP port (465 = TLS, 587 = STARTTLS, 1025 = MailHog)
+ *   - `config.smtp.user` — Username (optional, omit for MailHog)
+ *   - `config.smtp.pass` — Password (optional)
+ *   - `config.smtp.from` — Default sender address
+ *
+ * @returns EmailTransport implementation backed by Nodemailer SMTP
+ */
+export declare function createSmtpTransport(): EmailTransport;
+//# sourceMappingURL=email-transport.d.ts.map

package/dist/auth/email-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-transport.d.ts","sourceRoot":"","sources":["../../src/auth/email-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAWH,mCAAmC;AACnC,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iCAAiC;AACjC,MAAM,WAAW,WAAW;IAC1B,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACvD;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,IAAI,cAAc,CAqDpD"}