@prenta/core 0.118.0

package/dist/diagnostics/env.js

@@ -0,0 +1,354 @@
+/**
+ * Environment shape validation for the Prenta CMS runtime.
+ *
+ * The `/health` and admin diagnostics endpoints surface this so operators
+ * notice mis-configured secrets *before* a runtime call hits them. We never
+ * return the values themselves — only the validation verdict and a redacted
+ * preview where it helps debugging (e.g. "first 4 hex chars match").
+ *
+ * Why a dedicated module:
+ *   - Centralises all "is this env var well-formed" rules so consumers don't
+ *     re-invent length / hex / placeholder checks per call site.
+ *   - Fails closed on shape errors (e.g. a 31-char CMS_SECRET, an
+ *     `aes256-local-dev-key-...` placeholder still in production) which the
+ *     prior `presence-only` check missed entirely (audit issue M6).
+ */
+const HEX_RE = /^[0-9a-fA-F]+$/;
+const PLACEHOLDER_PATTERNS = [
+    /change-?(me|in-?prod)/i,
+    /your-?(secret|key|token)/i,
+    /placeholder/i,
+    /example/i,
+    /todo/i,
+    /aes256-local-dev-key/i,
+];
+function isPlaceholder(value) {
+    return PLACEHOLDER_PATTERNS.some((p) => p.test(value));
+}
+/**
+ * Determine which transactional email provider (if any) is configured via env.
+ * Mirrors `resolveEmailConfigFromEnv()` in `@prenta/plugin-email`:
+ * an explicit `EMAIL_PROVIDER` wins, otherwise we infer from the presence of
+ * `SMTP_HOST` (SMTP), an SMTP.com API key (SMTP.com), or `RESEND_API_KEY`
+ * (Resend). Returns a human-readable provider label, or `null` when none is
+ * configured.
+ */
+function detectEmailProvider(source) {
+    const provider = source.get('EMAIL_PROVIDER');
+    const resend = source.get('RESEND_API_KEY');
+    const smtpHost = source.get('SMTP_HOST');
+    const sesRegion = source.get('SES_REGION') ?? source.get('AWS_REGION');
+    // Accept the canonical `SMTPCOM_API_KEY` and the shorter `SMTP_KEY` alias
+    // (SMTP.com's dashboard surfaces the latter). Kept in lockstep with
+    // `resolveEmailConfigFromEnv()` in `@prenta/plugin-email`.
+    const smtpComKey = source.get('SMTPCOM_API_KEY') ?? source.get('SMTP_KEY');
+    switch (provider) {
+        case 'smtp':
+            return smtpHost ? 'SMTP' : null;
+        case 'ses':
+            return sesRegion ? 'AWS SES' : null;
+        case 'smtpcom':
+            return smtpComKey ? 'SMTP.com' : null;
+        case 'resend':
+            return resend ? 'Resend' : null;
+        case undefined:
+        case '':
+            // No explicit provider: infer from whichever credentials are present.
+            return smtpHost ? 'SMTP' : smtpComKey ? 'SMTP.com' : resend ? 'Resend' : null;
+        default:
+            return null;
+    }
+}
+const PROCESS_ENV = {
+    get: (name) => process.env[name],
+};
+/**
+ * Validate the shape of every well-known runtime env var. Pass a custom
+ * `source` to test without mutating `process.env`.
+ */
+export function validateEnvShape(source = PROCESS_ENV) {
+    const checks = [];
+    // ─── CMS_SECRET ──────────────────────────────────────────────
+    // The `source.get('CMS_SECRET')` lookup is intentionally pluggable: the
+    // runtime caller (`/api/cms/health`) wraps this so the lookup also covers
+    // the legacy `CMS_SESSION_SECRET` env var and `prenta.config.ts → secret`
+    // — those are equally valid sources at runtime via `getSessionSecret()`.
+    // Without that wrapping, a config-file-only deploy would be falsely
+    // reported as `missing` (Bugbot review on PR #43, Medium).
+    const secret = source.get('CMS_SECRET');
+    if (!secret) {
+        checks.push({
+            name: 'CMS_SECRET',
+            status: 'missing',
+            message: 'Required. Generate with `node -e "console.log(crypto.randomBytes(32).toString(\'hex\'))"` and set `CMS_SECRET`, or pass `secret` in `prenta.config.ts`.',
+            required: true,
+        });
+    }
+    else if (secret.length < 32) {
+        checks.push({
+            name: 'CMS_SECRET',
+            status: 'error',
+            message: `Must be ≥ 32 characters (got ${secret.length}). JWT signing requires this minimum.`,
+            required: true,
+        });
+    }
+    else if (isPlaceholder(secret)) {
+        checks.push({
+            name: 'CMS_SECRET',
+            status: 'error',
+            message: 'Looks like a placeholder string. Replace with a real 32+ char random secret.',
+            required: true,
+        });
+    }
+    else {
+        // Intentionally do not include `secret.length` here — `/health` is
+        // unauthenticated and exact secret lengths narrow brute-force search
+        // space for an attacker. The error/warn branches above can stay verbose
+        // because they only trigger on operator-visible misconfigurations.
+        checks.push({
+            name: 'CMS_SECRET',
+            status: 'ok',
+            message: 'Configured.',
+            required: true,
+        });
+    }
+    // ─── CMS_ENCRYPTION_KEY ──────────────────────────────────────
+    const encKey = source.get('CMS_ENCRYPTION_KEY');
+    if (!encKey) {
+        checks.push({
+            name: 'CMS_ENCRYPTION_KEY',
+            status: 'warn',
+            message: 'Optional but recommended. AES-256-GCM field encryption will throw at runtime when not set. Provide 64 hex chars.',
+            required: false,
+        });
+    }
+    else if (encKey.length !== 64) {
+        checks.push({
+            name: 'CMS_ENCRYPTION_KEY',
+            status: 'error',
+            message: `Must be exactly 64 hex characters (32 bytes). Got ${encKey.length}.`,
+            required: false,
+        });
+    }
+    else if (!HEX_RE.test(encKey)) {
+        // No `isPlaceholder()` branch follows — by this point the value has
+        // already passed length-64 and `HEX_RE`, meaning it's pure hex chars.
+        // Every pattern in `PLACEHOLDER_PATTERNS` requires non-hex letters
+        // (`g`, `h`, `l`, `m`, `o`, `p`, `r`, `s`, `t`, `u`, `v`, `w`, `x`, `y`, `z`,
+        // hyphens) so a passing hex string can never match a placeholder. The
+        // message below already says "Looks like a placeholder" for the common
+        // case where the configured value is a documented dev placeholder
+        // (e.g. `aes256-local-dev-key-change-in-prod`, which fails this branch).
+        checks.push({
+            name: 'CMS_ENCRYPTION_KEY',
+            status: 'error',
+            message: 'Must contain only hex characters (0-9, a-f). Looks like a placeholder.',
+            required: false,
+        });
+    }
+    else {
+        checks.push({
+            name: 'CMS_ENCRYPTION_KEY',
+            status: 'ok',
+            message: 'Configured.',
+            required: false,
+        });
+    }
+    // ─── DATABASE_URL ────────────────────────────────────────────
+    const dbUrl = source.get('DATABASE_URL');
+    if (!dbUrl) {
+        checks.push({
+            name: 'DATABASE_URL',
+            status: 'missing',
+            message: 'Required. Connection string for the Prisma client.',
+            required: true,
+        });
+    }
+    else if (!/^(postgres(ql)?|mysql|file|sqlite|prisma(\+postgres)?):/i.test(dbUrl)) {
+        checks.push({
+            name: 'DATABASE_URL',
+            status: 'error',
+            // `prisma://` and `prisma+postgres://` are Prisma Accelerate / Prisma
+            // Postgres URLs; the runtime routes those through the Accelerate
+            // transport (see apps/dev/lib/prisma.ts) rather than a TCP driver.
+            message: 'Must start with a known DB scheme (postgres://, mysql://, file:, sqlite://, prisma://, prisma+postgres://).',
+            required: true,
+        });
+    }
+    else {
+        checks.push({
+            name: 'DATABASE_URL',
+            status: 'ok',
+            message: 'Configured.',
+            required: true,
+        });
+    }
+    // ─── BLOB_READ_WRITE_TOKEN / OIDC ───────────────────────────
+    const blobToken = source.get('BLOB_READ_WRITE_TOKEN');
+    const blobStoreId = source.get('BLOB_STORE_ID');
+    const oidcToken = source.get('VERCEL_OIDC_TOKEN');
+    const blobStoreLinked = Boolean(blobStoreId ?? source.get('BLOB_WEBHOOK_PUBLIC_KEY'));
+    const blobOidcReady = Boolean(blobStoreId && oidcToken);
+    if (blobOidcReady) {
+        checks.push({
+            name: 'BLOB_READ_WRITE_TOKEN',
+            status: 'ok',
+            message: 'Blob storage uses OIDC (BLOB_STORE_ID + VERCEL_OIDC_TOKEN). No read-write token required.',
+            required: false,
+        });
+    }
+    else if (!blobToken) {
+        checks.push({
+            name: 'BLOB_READ_WRITE_TOKEN',
+            status: blobStoreLinked ? 'error' : 'warn',
+            message: blobStoreLinked
+                ? 'A Vercel Blob store is linked (BLOB_STORE_ID present) but upload auth is missing for this environment. On Vercel, redeploy so VERCEL_OIDC_TOKEN is injected; locally run `vercel env pull`. Legacy stores can set BLOB_READ_WRITE_TOKEN instead.'
+                : 'Required for media uploads on Vercel Blob storage. Without it, /media/upload will fail unless OIDC credentials (BLOB_STORE_ID + VERCEL_OIDC_TOKEN) are present.',
+            required: blobStoreLinked,
+        });
+    }
+    else if (!blobToken.startsWith('vercel_blob_')) {
+        checks.push({
+            name: 'BLOB_READ_WRITE_TOKEN',
+            status: 'warn',
+            message: 'Does not start with `vercel_blob_` — verify this is a real Vercel Blob token.',
+            required: false,
+        });
+    }
+    else {
+        checks.push({
+            name: 'BLOB_READ_WRITE_TOKEN',
+            status: 'ok',
+            message: 'Configured.',
+            required: false,
+        });
+    }
+    // ─── UPSTASH_REDIS_REST_URL / TOKEN ─────────────────────────
+    // Accept the Vercel Marketplace Upstash (Redis/KV) names as a fallback —
+    // that integration provisions KV_REST_API_URL / KV_REST_API_TOKEN, which
+    // are the same REST credentials. Mirrors `resolveUpstashCredentials()` in
+    // `security/rate-limit.ts`; without this, the recommended provisioning path
+    // would still warn (and silently use the in-memory limiter).
+    const upstashUrl = source.get('UPSTASH_REDIS_REST_URL') ?? source.get('KV_REST_API_URL');
+    const upstashToken = source.get('UPSTASH_REDIS_REST_TOKEN') ?? source.get('KV_REST_API_TOKEN');
+    if (!upstashUrl && !upstashToken) {
+        checks.push({
+            name: 'UPSTASH_REDIS_REST_URL',
+            status: 'warn',
+            message: 'Optional. Without Upstash, rate limiting falls back to in-memory (single-process only — unsafe across serverless invocations).',
+            required: false,
+        });
+    }
+    else if (upstashUrl && !upstashToken) {
+        checks.push({
+            name: 'UPSTASH_REDIS_REST_TOKEN',
+            status: 'error',
+            message: 'URL is set but token is missing — rate limiter will refuse to start.',
+            required: false,
+        });
+    }
+    else if (!upstashUrl && upstashToken) {
+        checks.push({
+            name: 'UPSTASH_REDIS_REST_URL',
+            status: 'error',
+            message: 'Token is set but URL is missing — rate limiter will refuse to start.',
+            required: false,
+        });
+    }
+    else {
+        try {
+            // eslint-disable-next-line no-new
+            new URL(upstashUrl);
+            checks.push({
+                name: 'UPSTASH_REDIS_REST_URL',
+                status: 'ok',
+                message: 'Configured (Upstash backend active).',
+                required: false,
+            });
+        }
+        catch {
+            checks.push({
+                name: 'UPSTASH_REDIS_REST_URL',
+                status: 'error',
+                message: 'Not a valid URL.',
+                required: false,
+            });
+        }
+    }
+    // ─── Email provider (RESEND_API_KEY / SMTP / SES / SMTP.com) ──
+    // Transactional email is optional. We surface it under the historical
+    // `RESEND_API_KEY` check name (stable /health shape) but treat ANY supported
+    // provider as "configured" so SMTP/SES/SMTP.com users aren't warned about a
+    // missing Resend key.
+    const resend = source.get('RESEND_API_KEY');
+    const activeEmailProvider = detectEmailProvider(source);
+    if (!activeEmailProvider) {
+        checks.push({
+            name: 'RESEND_API_KEY',
+            status: 'warn',
+            message: 'Optional. No email provider configured (RESEND_API_KEY for Resend; EMAIL_PROVIDER=smtp with SMTP_HOST/SMTP_USER/SMTP_PASS for a generic relay; or SMTP_KEY/SMTP_CHANNEL/SMTP_EMAIL for SMTP.com). Transactional email (lead notifications, password reset) is silently skipped.',
+            required: false,
+        });
+    }
+    else if (activeEmailProvider === 'Resend' && resend && !resend.startsWith('re_')) {
+        checks.push({
+            name: 'RESEND_API_KEY',
+            status: 'warn',
+            message: 'Does not start with `re_` — verify this is a real Resend API key.',
+            required: false,
+        });
+    }
+    else {
+        checks.push({
+            name: 'RESEND_API_KEY',
+            status: 'ok',
+            message: `Configured (${activeEmailProvider}).`,
+            required: false,
+        });
+    }
+    // ─── CRON_SECRET ────────────────────────────────────────────
+    const cronSecret = source.get('CRON_SECRET');
+    if (!cronSecret) {
+        checks.push({
+            name: 'CRON_SECRET',
+            status: 'warn',
+            message: 'Required to authorise /api/cms/cron/* endpoints. Without it, cron routes return 401 to all callers.',
+            required: false,
+        });
+    }
+    else if (cronSecret.length < 16) {
+        checks.push({
+            name: 'CRON_SECRET',
+            status: 'error',
+            message: `Should be ≥ 16 chars (got ${cronSecret.length}). Cron endpoints are publicly addressable.`,
+            required: false,
+        });
+    }
+    else if (isPlaceholder(cronSecret)) {
+        checks.push({
+            name: 'CRON_SECRET',
+            status: 'error',
+            message: 'Looks like a placeholder string.',
+            required: false,
+        });
+    }
+    else {
+        // Same reasoning as CMS_SECRET above — keep the length out of the
+        // unauthenticated /health surface.
+        checks.push({
+            name: 'CRON_SECRET',
+            status: 'ok',
+            message: 'Configured.',
+            required: false,
+        });
+    }
+    const errorCount = checks.filter((c) => c.status === 'error' || (c.status === 'missing' && c.required)).length;
+    const warnCount = checks.filter((c) => c.status === 'warn').length;
+    return {
+        ok: errorCount === 0,
+        errorCount,
+        warnCount,
+        checks,
+    };
+}
+//# sourceMappingURL=env.js.map

package/dist/diagnostics/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/diagnostics/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAwBH,MAAM,MAAM,GAAG,gBAAgB,CAAA;AAC/B,MAAM,oBAAoB,GAAG;IAC3B,wBAAwB;IACxB,2BAA2B;IAC3B,cAAc;IACd,UAAU;IACV,OAAO;IACP,uBAAuB;CACxB,CAAA;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,MAAiB;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACtE,0EAA0E;IAC1E,oEAAoE;IACpE,2DAA2D;IAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAE1E,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QACjC,KAAK,KAAK;YACR,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;QACrC,KAAK,SAAS;YACZ,OAAO,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAA;QACvC,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QACjC,KAAK,SAAS,CAAC;QACf,KAAK,EAAE;YACL,sEAAsE;YACtE,OAAO,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/E;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC;AAMD,MAAM,WAAW,GAAc;IAC7B,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;CACjC,CAAA;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAoB,WAAW;IAC9D,MAAM,MAAM,GAAe,EAAE,CAAA;IAE7B,gEAAgE;IAChE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,oEAAoE;IACpE,2DAA2D;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,SAAS;YACjB,OAAO,EACL,yJAAyJ;YAC3J,QAAQ,EAAE,IAAI;SACf,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,gCAAgC,MAAM,CAAC,MAAM,uCAAuC;YAC7F,QAAQ,EAAE,IAAI;SACf,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,8EAA8E;YACvF,QAAQ,EAAE,IAAI;SACf,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,mEAAmE;QACnE,qEAAqE;QACrE,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAA;IACJ,CAAC;IAED,gEAAgE;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EACL,kHAAkH;YACpH,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,qDAAqD,MAAM,CAAC,MAAM,GAAG;YAC9E,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,oEAAoE;QACpE,sEAAsE;QACtE,mEAAmE;QACnE,8EAA8E;QAC9E,sEAAsE;QACtE,uEAAuE;QACvE,kEAAkE;QAClE,yEAAyE;QACzE,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,wEAAwE;YACjF,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;IAED,gEAAgE;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,oDAAoD;YAC7D,QAAQ,EAAE,IAAI;SACf,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,CAAC,0DAA0D,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,OAAO;YACf,sEAAsE;YACtE,iEAAiE;YACjE,mEAAmE;YACnE,OAAO,EACL,6GAA6G;YAC/G,QAAQ,EAAE,IAAI;SACf,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAA;IACJ,CAAC;IAED,+DAA+D;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;IACrD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACjD,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAA;IACrF,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC,CAAA;IAEvD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,IAAI;YACZ,OAAO,EACL,2FAA2F;YAC7F,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC1C,OAAO,EAAE,eAAe;gBACtB,CAAC,CAAC,kPAAkP;gBACpP,CAAC,CAAC,iKAAiK;YACrK,QAAQ,EAAE,eAAe;SAC1B,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,+EAA+E;YACxF,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;IAED,+DAA+D;IAC/D,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACxF,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAC9F,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EACL,gIAAgI;YAClI,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,sEAAsE;YAC/E,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,CAAC,UAAU,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,sEAAsE;YAC/E,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,kCAAkC;YAClC,IAAI,GAAG,CAAC,UAAoB,CAAC,CAAA;YAC7B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,sCAAsC;gBAC/C,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,kBAAkB;gBAC3B,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,sEAAsE;IACtE,6EAA6E;IAC7E,4EAA4E;IAC5E,sBAAsB;IACtB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAC3C,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;IACvD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EACL,iRAAiR;YACnR,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,mBAAmB,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACnF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mEAAmE;YAC5E,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,eAAe,mBAAmB,IAAI;YAC/C,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;IAED,+DAA+D;IAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EACL,qGAAqG;YACvG,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,6BAA6B,UAAU,CAAC,MAAM,6CAA6C;YACpG,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,kCAAkC;YAC3C,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,kEAAkE;QAClE,mCAAmC;QACnC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,CACtE,CAAC,MAAM,CAAA;IACR,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAA;IAElE,OAAO;QACL,EAAE,EAAE,UAAU,KAAK,CAAC;QACpB,UAAU;QACV,SAAS;QACT,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/diagnostics/logger.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Structured logger for Prenta CMS (audit issue L7).
+ *
+ * Why a dedicated module instead of `console.*`:
+ *
+ *   1. **Filterable in production.** Operators can set
+ *      `PRENTA_LOG_LEVEL=warn` to silence routine info logs without losing
+ *      error visibility — `console.*` calls can't be silenced without
+ *      monkey-patching.
+ *
+ *   2. **Structured output for log aggregators.** Setting
+ *      `PRENTA_LOG_FORMAT=json` switches to one-line JSON entries with
+ *      consistent fields (`ts`, `level`, `scope`, `msg`, `details`),
+ *      ready for ingestion by Datadog, Sentry, or CloudWatch.
+ *
+ *   3. **Scoped namespaces.** `createLogger('rate-limit')` prefixes every
+ *      message with `[prenta][rate-limit]` so a grep finds related
+ *      entries instantly.
+ *
+ * **Migration path:** existing `console.*` calls keep working. New code and
+ * security-sensitive paths use the logger. Replace `console.*` callsites
+ * incrementally as files are touched.
+ */
+export type LogLevel = 'silent' | 'error' | 'warn' | 'info' | 'debug';
+export interface ScopedLogger {
+    error(msg: string, details?: Record<string, unknown>): void;
+    warn(msg: string, details?: Record<string, unknown>): void;
+    info(msg: string, details?: Record<string, unknown>): void;
+    debug(msg: string, details?: Record<string, unknown>): void;
+}
+/**
+ * Create a logger scoped to a subsystem name (e.g. `rate-limit`, `oauth`).
+ * Output format:
+ *   text: `[prenta][rate-limit] Upstash failed { reason: '...' }`
+ *   json: `{"ts":"...","level":"error","scope":"rate-limit","msg":"...","details":{...}}`
+ */
+export declare function createLogger(scope: string): ScopedLogger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/diagnostics/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/diagnostics/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;AAkErE,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAC3D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAC1D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAC1D,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CAC5D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAOxD"}

package/dist/diagnostics/logger.js

@@ -0,0 +1,89 @@
+/**
+ * Structured logger for Prenta CMS (audit issue L7).
+ *
+ * Why a dedicated module instead of `console.*`:
+ *
+ *   1. **Filterable in production.** Operators can set
+ *      `PRENTA_LOG_LEVEL=warn` to silence routine info logs without losing
+ *      error visibility — `console.*` calls can't be silenced without
+ *      monkey-patching.
+ *
+ *   2. **Structured output for log aggregators.** Setting
+ *      `PRENTA_LOG_FORMAT=json` switches to one-line JSON entries with
+ *      consistent fields (`ts`, `level`, `scope`, `msg`, `details`),
+ *      ready for ingestion by Datadog, Sentry, or CloudWatch.
+ *
+ *   3. **Scoped namespaces.** `createLogger('rate-limit')` prefixes every
+ *      message with `[prenta][rate-limit]` so a grep finds related
+ *      entries instantly.
+ *
+ * **Migration path:** existing `console.*` calls keep working. New code and
+ * security-sensitive paths use the logger. Replace `console.*` callsites
+ * incrementally as files are touched.
+ */
+const LEVEL_RANK = {
+    silent: 0,
+    error: 10,
+    warn: 20,
+    info: 30,
+    debug: 40,
+};
+function resolveLevel() {
+    const raw = (process.env.PRENTA_LOG_LEVEL ?? '').toLowerCase();
+    if (raw === 'silent' || raw === 'error' || raw === 'warn' || raw === 'info' || raw === 'debug') {
+        return raw;
+    }
+    // Default: warn in production, info elsewhere. Tests run with NODE_ENV=test
+    // and benefit from `info` so failing assertions show context.
+    return process.env.NODE_ENV === 'production' ? 'warn' : 'info';
+}
+function isJsonFormat() {
+    return (process.env.PRENTA_LOG_FORMAT ?? '').toLowerCase() === 'json';
+}
+function shouldLog(level) {
+    const current = resolveLevel();
+    return LEVEL_RANK[level] <= LEVEL_RANK[current];
+}
+function emit(level, scope, msg, details) {
+    if (!shouldLog(level))
+        return;
+    const sink = level === 'error'
+        ? console.error
+        : level === 'warn'
+            ? console.warn
+            : level === 'info'
+                ? console.info
+                : console.debug;
+    if (isJsonFormat()) {
+        sink(JSON.stringify({
+            ts: new Date().toISOString(),
+            level,
+            scope,
+            msg,
+            ...(details ? { details } : {}),
+        }));
+        return;
+    }
+    const prefix = `[prenta][${scope}]`;
+    if (details) {
+        sink(prefix, msg, details);
+    }
+    else {
+        sink(prefix, msg);
+    }
+}
+/**
+ * Create a logger scoped to a subsystem name (e.g. `rate-limit`, `oauth`).
+ * Output format:
+ *   text: `[prenta][rate-limit] Upstash failed { reason: '...' }`
+ *   json: `{"ts":"...","level":"error","scope":"rate-limit","msg":"...","details":{...}}`
+ */
+export function createLogger(scope) {
+    return {
+        error: (msg, details) => emit('error', scope, msg, details),
+        warn: (msg, details) => emit('warn', scope, msg, details),
+        info: (msg, details) => emit('info', scope, msg, details),
+        debug: (msg, details) => emit('debug', scope, msg, details),
+    };
+}
+//# sourceMappingURL=logger.js.map

package/dist/diagnostics/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/diagnostics/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,MAAM,UAAU,GAA6B;IAC3C,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;CACV,CAAA;AAED,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAC9D,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC/F,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,4EAA4E;IAC5E,8DAA8D;IAC9D,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;AAChE,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAA;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,KAAe;IAChC,MAAM,OAAO,GAAG,YAAY,EAAE,CAAA;IAC9B,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,IAAI,CACX,KAAkC,EAClC,KAAa,EACb,GAAW,EACX,OAAiC;IAEjC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAM;IAC7B,MAAM,IAAI,GACR,KAAK,KAAK,OAAO;QACf,CAAC,CAAC,OAAO,CAAC,KAAK;QACf,CAAC,CAAC,KAAK,KAAK,MAAM;YAChB,CAAC,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC,KAAK,KAAK,MAAM;gBAChB,CAAC,CAAC,OAAO,CAAC,IAAI;gBACd,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;IAEvB,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,IAAI,CACF,IAAI,CAAC,SAAS,CAAC;YACb,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,KAAK;YACL,KAAK;YACL,GAAG;YACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CACH,CAAA;QACD,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,KAAK,GAAG,CAAA;IACnC,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC5B,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACnB,CAAC;AACH,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC;QAC3D,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC;QACzD,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC;QACzD,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC;KAC5D,CAAA;AACH,CAAC"}

package/dist/diagnostics/sentry.d.ts

@@ -0,0 +1,8 @@
+/** Initialize Sentry when `SENTRY_DSN` is set. Safe to call repeatedly. */
+export declare function initServerSentry(): Promise<void>;
+/** Report a server-side exception when Sentry is configured. Never throws. */
+export declare function captureServerException(err: unknown, context?: {
+    scope?: string;
+    extra?: Record<string, unknown>;
+}): Promise<void>;
+//# sourceMappingURL=sentry.d.ts.map

package/dist/diagnostics/sentry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentry.d.ts","sourceRoot":"","sources":["../../src/diagnostics/sentry.ts"],"names":[],"mappings":"AAoBA,2EAA2E;AAC3E,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAetD;AAED,8EAA8E;AAC9E,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,OAAO,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC5D,OAAO,CAAC,IAAI,CAAC,CAaf"}

package/dist/diagnostics/sentry.js

@@ -0,0 +1,54 @@
+let initialized = false;
+let sentryLoad;
+/**
+ * Lazily loads `@sentry/node`, which is an OPTIONAL peer dependency of cms-core
+ * — apps that don't set `SENTRY_DSN` never load it. Returns null when it isn't
+ * installed so error reporting degrades to a no-op instead of throwing. The
+ * import promise is cached so the module is resolved at most once.
+ */
+async function loadSentry() {
+    if (!sentryLoad) {
+        sentryLoad = import('@sentry/node').catch(() => null);
+    }
+    return sentryLoad;
+}
+function resolveEnvironment() {
+    return process.env.VERCEL_ENV ?? process.env.NODE_ENV ?? 'development';
+}
+/** Initialize Sentry when `SENTRY_DSN` is set. Safe to call repeatedly. */
+export async function initServerSentry() {
+    if (initialized)
+        return;
+    const dsn = process.env.SENTRY_DSN?.trim();
+    if (!dsn)
+        return;
+    const Sentry = await loadSentry();
+    if (!Sentry || initialized)
+        return;
+    Sentry.init({
+        dsn,
+        environment: resolveEnvironment(),
+        release: process.env.SENTRY_RELEASE?.trim() || undefined,
+        tracesSampleRate: 0,
+    });
+    initialized = true;
+}
+/** Report a server-side exception when Sentry is configured. Never throws. */
+export async function captureServerException(err, context) {
+    try {
+        if (!process.env.SENTRY_DSN?.trim())
+            return;
+        await initServerSentry();
+        const Sentry = await loadSentry();
+        if (!Sentry)
+            return;
+        Sentry.captureException(err, {
+            tags: context?.scope ? { scope: context.scope } : undefined,
+            extra: context?.extra,
+        });
+    }
+    catch {
+        // Observability must never break user requests.
+    }
+}
+//# sourceMappingURL=sentry.js.map

package/dist/diagnostics/sentry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentry.js","sourceRoot":"","sources":["../../src/diagnostics/sentry.ts"],"names":[],"mappings":"AAAA,IAAI,WAAW,GAAG,KAAK,CAAA;AACvB,IAAI,UAAqE,CAAA;AAEzE;;;;;GAKG;AACH,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAA;AACxE,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,WAAW;QAAE,OAAM;IACvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAM;IAEhB,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;IACjC,IAAI,CAAC,MAAM,IAAI,WAAW;QAAE,OAAM;IAElC,MAAM,CAAC,IAAI,CAAC;QACV,GAAG;QACH,WAAW,EAAE,kBAAkB,EAAE;QACjC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,SAAS;QACxD,gBAAgB,EAAE,CAAC;KACpB,CAAC,CAAA;IACF,WAAW,GAAG,IAAI,CAAA;AACpB,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAY,EACZ,OAA6D;IAE7D,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;YAAE,OAAM;QAC3C,MAAM,gBAAgB,EAAE,CAAA;QACxB,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QACjC,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE;YAC3B,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;YAC3D,KAAK,EAAE,OAAO,EAAE,KAAK;SACtB,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC"}

package/dist/email/resolve.d.ts

@@ -0,0 +1,27 @@
+/**
+ * DB-aware transactional email sender resolution.
+ *
+ * Resolution order (first match wins):
+ *   1. `config.platform.email` — an explicit platform adapter keeps full
+ *      control, matching the sync resolver's contract.
+ *   2. Settings > Email (`__email_config__` document) via the provider factory
+ *      registered by `@prenta/plugin-email`. Admin-entered settings
+ *      beat env inference so what the UI shows is what actually sends.
+ *   3. The env-configured sender registered at boot via `setEmailSender`.
+ *
+ * Lives apart from `sender.ts` so the lightweight `email-sender` subpath
+ * (imported by plugin-email at config-load time) never drags in the DB or
+ * crypto modules.
+ */
+import type { EmailAdapter } from '../config/types.js';
+/** Test hook: drop the memoized DB-configured adapter. */
+export declare function clearEmailSenderCache(): void;
+/**
+ * Resolve the active transactional email sender, checking the DB-backed
+ * Settings > Email configuration. Returns `null` when nothing can send.
+ *
+ * Pass `db` when a client is already in hand (API routes); otherwise the
+ * lazily-initialized module client is used.
+ */
+export declare function resolveEmailSenderAsync(db?: unknown): Promise<EmailAdapter | null>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/email/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/email/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAStD,0DAA0D;AAC1D,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAqBD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAaxF"}