@prenta/core 0.118.0

package/dist/email/resolve.js

@@ -0,0 +1,68 @@
+/**
+ * DB-aware transactional email sender resolution.
+ *
+ * Resolution order (first match wins):
+ *   1. `config.platform.email` — an explicit platform adapter keeps full
+ *      control, matching the sync resolver's contract.
+ *   2. Settings > Email (`__email_config__` document) via the provider factory
+ *      registered by `@prenta/plugin-email`. Admin-entered settings
+ *      beat env inference so what the UI shows is what actually sends.
+ *   3. The env-configured sender registered at boot via `setEmailSender`.
+ *
+ * Lives apart from `sender.ts` so the lightweight `email-sender` subpath
+ * (imported by plugin-email at config-load time) never drags in the DB or
+ * crypto modules.
+ */
+import { getPrentaConfig } from '../config/runtime.js';
+import { getDB, isDBInitialized } from '../db.js';
+import { getEmailProviderFactory, getRegisteredEmailSender } from './sender.js';
+import { getEmailConfig, resolveEmailProviderSettings } from './settings-store.js';
+// Built adapters are memoized on the config's updatedAt stamp so repeated
+// sends don't rebuild providers (and SMTP doesn't re-verify) on every call.
+// A single findFirst per send remains — acceptable for transactional volume.
+let cache = null;
+/** Test hook: drop the memoized DB-configured adapter. */
+export function clearEmailSenderCache() {
+    cache = null;
+}
+async function resolveDbConfiguredSender(db) {
+    const factory = getEmailProviderFactory();
+    if (!factory)
+        return null;
+    const client = db ?? (isDBInitialized() ? getDB() : null);
+    if (!client)
+        return null;
+    const config = await getEmailConfig(client);
+    if (!config.provider)
+        return null;
+    const stamp = `${config.provider}:${config.updatedAt ?? ''}`;
+    if (cache && cache.stamp === stamp)
+        return cache.adapter;
+    const settings = await resolveEmailProviderSettings(config);
+    const adapter = settings ? factory(settings) : null;
+    cache = { stamp, adapter };
+    return adapter;
+}
+/**
+ * Resolve the active transactional email sender, checking the DB-backed
+ * Settings > Email configuration. Returns `null` when nothing can send.
+ *
+ * Pass `db` when a client is already in hand (API routes); otherwise the
+ * lazily-initialized module client is used.
+ */
+export async function resolveEmailSenderAsync(db) {
+    const platform = getPrentaConfig()?.platform?.email;
+    if (platform)
+        return platform;
+    try {
+        const dbSender = await resolveDbConfiguredSender(db);
+        if (dbSender)
+            return dbSender;
+    }
+    catch {
+        // A broken DB config must never take down transactional email entirely —
+        // fall through to the env-configured sender.
+    }
+    return getRegisteredEmailSender();
+}
+//# sourceMappingURL=resolve.js.map

package/dist/email/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/email/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAEjD,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAElF,0EAA0E;AAC1E,4EAA4E;AAC5E,6EAA6E;AAC7E,IAAI,KAAK,GAA2D,IAAI,CAAA;AAExE,0DAA0D;AAC1D,MAAM,UAAU,qBAAqB;IACnC,KAAK,GAAG,IAAI,CAAA;AACd,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,EAAY;IACnD,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAA;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAEzB,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAExB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAEjC,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAA;IAC5D,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAA;IAExD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,MAAM,CAAC,CAAA;IAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACnD,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IAC1B,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAY;IACxD,MAAM,QAAQ,GAAG,eAAe,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAA;IACnD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAE7B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAA;QACpD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,6CAA6C;IAC/C,CAAC;IAED,OAAO,wBAAwB,EAAE,CAAA;AACnC,CAAC"}

package/dist/email/sender.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Transactional email sender registry.
+ *
+ * cms-core sends transactional email (password resets, form notifications)
+ * through a single resolver so callers never reach into a specific plugin or
+ * provider. Resolution order:
+ *
+ *   1. `config.platform.email` — an explicit platform adapter always wins, so
+ *      apps that wire their own adapter keep full control.
+ *   2. A sender registered via {@link setEmailSender} — this is how the email
+ *      plugin (`@prenta/plugin-email`) makes its configured provider
+ *      available to core *without* core depending on the plugin. Dependency
+ *      direction stays plugins → core: the plugin imports `setEmailSender` and
+ *      registers itself at boot.
+ *
+ * The registered sender is stored on `globalThis` so a single value survives
+ * even if more than one cms-core module instance is loaded in the same process,
+ * mirroring the config runtime contract (see `config/runtime.ts`). It is set
+ * once at boot (when the plugin factory runs) and read-only afterwards.
+ */
+import type { EmailAdapter } from '../config/types.js';
+/**
+ * Decrypted provider settings handed to the plugin-registered factory when
+ * email is configured through Settings > Email (the `__email_config__` doc).
+ */
+export interface ResolvedEmailProviderSettings {
+    provider: 'resend' | 'smtpcom' | 'ses' | 'smtp';
+    from: string;
+    apiKey?: string;
+    channel?: string;
+    region?: string;
+    host?: string;
+    port?: number;
+    secure?: boolean;
+    auth?: {
+        user: string;
+        pass: string;
+    };
+}
+/**
+ * Builds a concrete sender from DB-configured settings. Registered by
+ * `@prenta/plugin-email` at boot (the provider implementations and
+ * their optional deps live in the plugin, not in core). Returns `null` when
+ * the settings are incomplete for the selected provider.
+ */
+export type EmailProviderFactory = (settings: ResolvedEmailProviderSettings) => EmailAdapter | null;
+/**
+ * Register the process-wide transactional email sender. Called once at boot by
+ * the email plugin. Pass `null` to clear it (used in tests).
+ */
+export declare function setEmailSender(sender: EmailAdapter | null): void;
+/** The sender registered via {@link setEmailSender}, if any. */
+export declare function getRegisteredEmailSender(): EmailAdapter | null;
+/**
+ * Resolve the active transactional email sender, or `null` when email is not
+ * configured. Prefers an explicit `platform.email` adapter, then a
+ * plugin-registered sender.
+ *
+ * NOTE: this sync resolver does not see settings configured through the admin
+ * UI (Settings > Email). Send paths should prefer `resolveEmailSenderAsync()`
+ * from `email/resolve.js`, which checks the DB-backed config first.
+ */
+export declare function resolveEmailSender(): EmailAdapter | null;
+/**
+ * Register the factory that turns DB-configured email settings into a sender.
+ * Called once at boot by the email plugin. Pass `null` to clear (tests).
+ */
+export declare function setEmailProviderFactory(factory: EmailProviderFactory | null): void;
+/** The factory registered via {@link setEmailProviderFactory}, if any. */
+export declare function getEmailProviderFactory(): EmailProviderFactory | null;
+//# sourceMappingURL=sender.d.ts.map

package/dist/email/sender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender.d.ts","sourceRoot":"","sources":["../../src/email/sender.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAMtD;;;GAGG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,CAAA;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACtC;AAED;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,6BAA6B,KAAK,YAAY,GAAG,IAAI,CAAA;AAWnG;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI,CAEhE;AAED,gEAAgE;AAChE,wBAAgB,wBAAwB,IAAI,YAAY,GAAG,IAAI,CAE9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,IAAI,YAAY,GAAG,IAAI,CAExD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAElF;AAED,0EAA0E;AAC1E,wBAAgB,uBAAuB,IAAI,oBAAoB,GAAG,IAAI,CAErE"}

package/dist/email/sender.js

@@ -0,0 +1,41 @@
+import { getPrentaConfig } from '../config/runtime.js';
+const GLOBAL_KEY = '__prentaEmailSender';
+const FACTORY_KEY = '__prentaEmailProviderFactory';
+function store() {
+    return globalThis;
+}
+/**
+ * Register the process-wide transactional email sender. Called once at boot by
+ * the email plugin. Pass `null` to clear it (used in tests).
+ */
+export function setEmailSender(sender) {
+    store()[GLOBAL_KEY] = sender;
+}
+/** The sender registered via {@link setEmailSender}, if any. */
+export function getRegisteredEmailSender() {
+    return store()[GLOBAL_KEY] ?? null;
+}
+/**
+ * Resolve the active transactional email sender, or `null` when email is not
+ * configured. Prefers an explicit `platform.email` adapter, then a
+ * plugin-registered sender.
+ *
+ * NOTE: this sync resolver does not see settings configured through the admin
+ * UI (Settings > Email). Send paths should prefer `resolveEmailSenderAsync()`
+ * from `email/resolve.js`, which checks the DB-backed config first.
+ */
+export function resolveEmailSender() {
+    return getPrentaConfig()?.platform?.email ?? getRegisteredEmailSender();
+}
+/**
+ * Register the factory that turns DB-configured email settings into a sender.
+ * Called once at boot by the email plugin. Pass `null` to clear (tests).
+ */
+export function setEmailProviderFactory(factory) {
+    store()[FACTORY_KEY] = factory;
+}
+/** The factory registered via {@link setEmailProviderFactory}, if any. */
+export function getEmailProviderFactory() {
+    return store()[FACTORY_KEY] ?? null;
+}
+//# sourceMappingURL=sender.js.map

package/dist/email/sender.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender.js","sourceRoot":"","sources":["../../src/email/sender.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,MAAM,UAAU,GAAG,qBAAqB,CAAA;AACxC,MAAM,WAAW,GAAG,8BAA8B,CAAA;AA+BlD,SAAS,KAAK;IACZ,OAAO,UAA0C,CAAA;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAA2B;IACxD,KAAK,EAAE,CAAC,UAAU,CAAC,GAAG,MAAM,CAAA;AAC9B,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,wBAAwB;IACtC,OAAO,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,CAAA;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,EAAE,EAAE,QAAQ,EAAE,KAAK,IAAI,wBAAwB,EAAE,CAAA;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAoC;IAC1E,KAAK,EAAE,CAAC,WAAW,CAAC,GAAG,OAAO,CAAA;AAChC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB;IACrC,OAAO,KAAK,EAAE,CAAC,WAAW,CAAC,IAAI,IAAI,CAAA;AACrC,CAAC"}

package/dist/email/settings-store.d.ts

@@ -0,0 +1,116 @@
+/**
+ * DB-backed email delivery configuration store (Settings > Email).
+ *
+ * Storage: a single Document row with `collection = '__email_config__'`,
+ * mirroring the AI config-store pattern (`src/ai/config-store.ts`) so no
+ * Prisma migration is required.
+ *
+ * Security invariants:
+ *   - API keys and SMTP passwords are encrypted at rest via `encryptSecret`.
+ *   - Encrypted values are NEVER returned to the client; handlers serialize
+ *     through {@link toPublicEmailConfig} (masked last-4 + has-flags only).
+ *   - Sending with these settings requires the provider factory registered by
+ *     `@prenta/plugin-email` (dependency direction stays plugin → core).
+ */
+import type { ResolvedEmailProviderSettings } from './sender.js';
+export declare const EMAIL_CONFIG_COLLECTION = "__email_config__";
+export declare const EMAIL_PROVIDER_KEYS: readonly ["resend", "smtpcom", "ses", "smtp"];
+export type EmailProviderKey = (typeof EMAIL_PROVIDER_KEYS)[number];
+export declare function isEmailProviderKey(value: unknown): value is EmailProviderKey;
+export declare const EMAIL_PROVIDER_LABELS: Record<EmailProviderKey, string>;
+/** Persisted shape of the `__email_config__` document (secrets encrypted). */
+export interface EmailConfigDocument {
+    /** `null` = email is not configured through the admin UI. */
+    provider: EmailProviderKey | null;
+    /** Default sender address (e.g. `noreply@example.com`). */
+    from?: string;
+    /** Resend / SMTP.com API key (encrypted at rest). */
+    apiKeyEncrypted?: string;
+    apiKeyLast4?: string;
+    /** SMTP.com sender channel. */
+    channel?: string;
+    /** Amazon SES region (credentials come from the runtime's AWS env/role). */
+    region?: string;
+    /** Generic SMTP relay. */
+    host?: string;
+    port?: number;
+    secure?: boolean;
+    smtpUser?: string;
+    smtpPassEncrypted?: string;
+    /** Result of the most recent test send. */
+    lastTestStatus?: 'success' | 'failed';
+    lastTestedAt?: string;
+    lastTestError?: string;
+    updatedAt?: string;
+    updatedBy?: string;
+}
+/** Client-safe view: secrets stripped, replaced by masked metadata. */
+export interface EmailConfigPublic {
+    provider: EmailProviderKey | null;
+    from?: string;
+    apiKeyLast4?: string;
+    hasApiKey: boolean;
+    channel?: string;
+    region?: string;
+    host?: string;
+    port?: number;
+    secure?: boolean;
+    smtpUser?: string;
+    hasSmtpPass: boolean;
+    lastTestStatus?: 'success' | 'failed';
+    lastTestedAt?: string;
+    lastTestError?: string;
+    updatedAt?: string;
+    updatedBy?: string;
+}
+/** Last 4 chars of a secret for masked display (never the full value). */
+export declare function emailKeyLast4(key: string | undefined | null): string | undefined;
+/** Read the email config document; `{ provider: null }` when none exists. */
+export declare function getEmailConfig(db: unknown): Promise<EmailConfigDocument>;
+/**
+ * Upsert the email config document. Caller is responsible for auth/role
+ * checks. Stamps `updatedAt`/`updatedBy`.
+ */
+export declare function putEmailConfig(db: unknown, next: EmailConfigDocument, userId: string): Promise<EmailConfigDocument>;
+/** Strip secret material for client serialization. */
+export declare function toPublicEmailConfig(doc: EmailConfigDocument): EmailConfigPublic;
+/**
+ * Decrypt the stored config into the plain settings consumed by the provider
+ * factory. Returns `null` when no provider is configured or when a required
+ * secret cannot be decrypted (wrong/missing `CMS_ENCRYPTION_KEY`) — callers
+ * fall back to the env-configured sender rather than sending with bad creds.
+ */
+export declare function resolveEmailProviderSettings(doc: EmailConfigDocument): Promise<ResolvedEmailProviderSettings | null>;
+/** Encrypt a plaintext secret for storage with its masked suffix. */
+export declare function encryptEmailSecret(plaintext: string): Promise<{
+    encrypted: string;
+    last4: string;
+}>;
+/**
+ * Which provider (if any) the environment variables currently configure.
+ * Mirrors `resolveEmailConfigFromEnv()` in `@prenta/plugin-email` so
+ * the Settings UI can tell admins what env-based config exists alongside the
+ * DB settings.
+ */
+export declare function detectEnvEmailProvider(env?: Record<string, string | undefined>): EmailProviderKey | null;
+export interface EmailSettingsInput {
+    provider?: unknown;
+    from?: unknown;
+    apiKey?: unknown;
+    channel?: unknown;
+    region?: unknown;
+    host?: unknown;
+    port?: unknown;
+    secure?: unknown;
+    smtpUser?: unknown;
+    smtpPass?: unknown;
+}
+/**
+ * Validate a PUT payload against the selected provider's requirements.
+ * `hasStoredApiKey`/`hasStoredSmtpPass` let an update keep an existing secret
+ * without re-entering it (apiKey omitted = keep, null/'' = clear).
+ */
+export declare function validateEmailSettingsInput(input: EmailSettingsInput, stored: {
+    hasApiKey: boolean;
+}): string | null;
+//# sourceMappingURL=settings-store.d.ts.map

package/dist/email/settings-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-store.d.ts","sourceRoot":"","sources":["../../src/email/settings-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAEhE,eAAO,MAAM,uBAAuB,qBAAqB,CAAA;AAEzD,eAAO,MAAM,mBAAmB,+CAAgD,CAAA;AAChF,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEnE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAKlE,CAAA;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,6DAA6D;IAC7D,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACjC,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,2CAA2C;IAC3C,cAAc,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;IACrC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACjC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,OAAO,CAAA;IACpB,cAAc,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;IACrC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAID,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAIhF;AAED,6EAA6E;AAC7E,wBAAsB,cAAc,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAqB9E;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC,CA2B9B;AAED,sDAAsD;AACtD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,mBAAmB,GAAG,iBAAiB,CAO/E;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAuC/C;AAED,qEAAqE;AACrE,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,gBAAgB,GAAG,IAAI,CAOzB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAQD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,kBAAkB,EACzB,MAAM,EAAE;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAC7B,MAAM,GAAG,IAAI,CAyCf"}

package/dist/email/settings-store.js

@@ -0,0 +1,222 @@
+/**
+ * DB-backed email delivery configuration store (Settings > Email).
+ *
+ * Storage: a single Document row with `collection = '__email_config__'`,
+ * mirroring the AI config-store pattern (`src/ai/config-store.ts`) so no
+ * Prisma migration is required.
+ *
+ * Security invariants:
+ *   - API keys and SMTP passwords are encrypted at rest via `encryptSecret`.
+ *   - Encrypted values are NEVER returned to the client; handlers serialize
+ *     through {@link toPublicEmailConfig} (masked last-4 + has-flags only).
+ *   - Sending with these settings requires the provider factory registered by
+ *     `@prenta/plugin-email` (dependency direction stays plugin → core).
+ */
+import { decryptSecret, encryptSecret } from '../security/secret-storage.js';
+export const EMAIL_CONFIG_COLLECTION = '__email_config__';
+export const EMAIL_PROVIDER_KEYS = ['resend', 'smtpcom', 'ses', 'smtp'];
+export function isEmailProviderKey(value) {
+    return typeof value === 'string' && EMAIL_PROVIDER_KEYS.includes(value);
+}
+export const EMAIL_PROVIDER_LABELS = {
+    resend: 'Resend',
+    smtpcom: 'SMTP.com',
+    ses: 'Amazon SES',
+    smtp: 'SMTP server',
+};
+const EMPTY = { provider: null };
+/** Last 4 chars of a secret for masked display (never the full value). */
+export function emailKeyLast4(key) {
+    if (!key)
+        return undefined;
+    const trimmed = key.trim();
+    return trimmed.length >= 4 ? trimmed.slice(-4) : trimmed;
+}
+/** Read the email config document; `{ provider: null }` when none exists. */
+export async function getEmailConfig(db) {
+    const d = db;
+    if (!d?.document?.findFirst)
+        return { ...EMPTY };
+    try {
+        const doc = await d.document.findFirst({
+            where: { collection: EMAIL_CONFIG_COLLECTION, deletedAt: null },
+            select: { data: true },
+        });
+        if (!doc?.data || typeof doc.data !== 'object')
+            return { ...EMPTY };
+        const data = doc.data;
+        return {
+            ...data,
+            provider: isEmailProviderKey(data.provider) ? data.provider : null,
+        };
+    }
+    catch {
+        return { ...EMPTY };
+    }
+}
+/**
+ * Upsert the email config document. Caller is responsible for auth/role
+ * checks. Stamps `updatedAt`/`updatedBy`.
+ */
+export async function putEmailConfig(db, next, userId) {
+    const d = db;
+    const data = {
+        ...next,
+        updatedAt: new Date().toISOString(),
+        updatedBy: userId,
+    };
+    const existing = await d.document.findFirst({
+        where: { collection: EMAIL_CONFIG_COLLECTION, deletedAt: null },
+        select: { id: true },
+    });
+    if (existing) {
+        await d.document.update({ where: { id: existing.id }, data: { data, updatedById: userId } });
+    }
+    else {
+        await d.document.create({
+            data: {
+                collection: EMAIL_CONFIG_COLLECTION,
+                data,
+                status: 'PUBLISHED',
+                title: 'Email settings',
+                slug: 'email-config',
+                createdById: userId,
+                updatedById: userId,
+            },
+        });
+    }
+    return data;
+}
+/** Strip secret material for client serialization. */
+export function toPublicEmailConfig(doc) {
+    const { apiKeyEncrypted: _key, smtpPassEncrypted: _pass, ...rest } = doc;
+    return {
+        ...rest,
+        hasApiKey: Boolean(doc.apiKeyEncrypted),
+        hasSmtpPass: Boolean(doc.smtpPassEncrypted),
+    };
+}
+/**
+ * Decrypt the stored config into the plain settings consumed by the provider
+ * factory. Returns `null` when no provider is configured or when a required
+ * secret cannot be decrypted (wrong/missing `CMS_ENCRYPTION_KEY`) — callers
+ * fall back to the env-configured sender rather than sending with bad creds.
+ */
+export async function resolveEmailProviderSettings(doc) {
+    if (!doc.provider)
+        return null;
+    const from = doc.from?.trim();
+    if (!from)
+        return null;
+    try {
+        switch (doc.provider) {
+            case 'resend':
+            case 'smtpcom': {
+                if (!doc.apiKeyEncrypted)
+                    return null;
+                const apiKey = await decryptSecret(doc.apiKeyEncrypted);
+                if (!apiKey)
+                    return null;
+                return {
+                    provider: doc.provider,
+                    from,
+                    apiKey,
+                    ...(doc.provider === 'smtpcom' && doc.channel ? { channel: doc.channel } : {}),
+                };
+            }
+            case 'ses': {
+                if (!doc.region)
+                    return null;
+                return { provider: 'ses', from, region: doc.region };
+            }
+            case 'smtp': {
+                if (!doc.host)
+                    return null;
+                const pass = doc.smtpPassEncrypted ? await decryptSecret(doc.smtpPassEncrypted) : undefined;
+                return {
+                    provider: 'smtp',
+                    from,
+                    host: doc.host,
+                    port: doc.port,
+                    secure: doc.secure,
+                    auth: doc.smtpUser ? { user: doc.smtpUser, pass: pass ?? '' } : undefined,
+                };
+            }
+        }
+    }
+    catch {
+        return null;
+    }
+}
+/** Encrypt a plaintext secret for storage with its masked suffix. */
+export async function encryptEmailSecret(plaintext) {
+    return { encrypted: await encryptSecret(plaintext), last4: emailKeyLast4(plaintext) ?? '' };
+}
+/**
+ * Which provider (if any) the environment variables currently configure.
+ * Mirrors `resolveEmailConfigFromEnv()` in `@prenta/plugin-email` so
+ * the Settings UI can tell admins what env-based config exists alongside the
+ * DB settings.
+ */
+export function detectEnvEmailProvider(env = process.env) {
+    const explicit = env.EMAIL_PROVIDER;
+    if (isEmailProviderKey(explicit))
+        return explicit;
+    if (env.SMTP_HOST)
+        return 'smtp';
+    if (env.SMTPCOM_API_KEY ?? env.SMTP_KEY)
+        return 'smtpcom';
+    if (env.RESEND_API_KEY)
+        return 'resend';
+    return null;
+}
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const REGION_RE = /^[a-z]{2}(-[a-z]+)+-\d$/;
+// Hostname only — no scheme, path, port suffix, or whitespace.
+const HOST_RE = /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)+$/;
+/**
+ * Validate a PUT payload against the selected provider's requirements.
+ * `hasStoredApiKey`/`hasStoredSmtpPass` let an update keep an existing secret
+ * without re-entering it (apiKey omitted = keep, null/'' = clear).
+ */
+export function validateEmailSettingsInput(input, stored) {
+    if (input.provider === null)
+        return null; // clearing the config is always valid
+    if (!isEmailProviderKey(input.provider)) {
+        return 'A valid `provider` is required (resend, smtpcom, ses, smtp) or null to disable.';
+    }
+    const from = typeof input.from === 'string' ? input.from.trim() : '';
+    if (!from || !EMAIL_RE.test(from)) {
+        return 'A valid sender address (`from`) is required, e.g. noreply@yoursite.com.';
+    }
+    const newKey = typeof input.apiKey === 'string' ? input.apiKey.trim() : '';
+    const keepsKey = input.apiKey === undefined && stored.hasApiKey;
+    switch (input.provider) {
+        case 'resend':
+        case 'smtpcom':
+            if (!newKey && !keepsKey)
+                return 'An API key is required for this provider.';
+            return null;
+        case 'ses': {
+            const region = typeof input.region === 'string' ? input.region.trim() : '';
+            if (!region || !REGION_RE.test(region)) {
+                return 'A valid AWS region is required, e.g. us-east-1.';
+            }
+            return null;
+        }
+        case 'smtp': {
+            const host = typeof input.host === 'string' ? input.host.trim() : '';
+            if (!host || !HOST_RE.test(host)) {
+                return 'A valid SMTP hostname is required, e.g. smtp.example.com.';
+            }
+            if (input.port !== undefined && input.port !== null) {
+                const port = Number(input.port);
+                if (!Number.isInteger(port) || port < 1 || port > 65535) {
+                    return 'SMTP port must be an integer between 1 and 65535.';
+                }
+            }
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=settings-store.js.map

package/dist/email/settings-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-store.js","sourceRoot":"","sources":["../../src/email/settings-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAG5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAA;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAU,CAAA;AAGhF,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,mBAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAChG,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAqC;IACrE,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,UAAU;IACnB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,aAAa;CACpB,CAAA;AAiDD,MAAM,KAAK,GAAwB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;AAErD,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,GAA8B;IAC1D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAC1B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;AAC1D,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAW;IAC9C,MAAM,CAAC,GAAG,EAIT,CAAA;IACD,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAA;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YACrC,KAAK,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE,SAAS,EAAE,IAAI,EAAE;YAC/D,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAA;QACnE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAoC,CAAA;QACrD,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;SACnE,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,KAAK,EAAE,CAAA;IACrB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAW,EACX,IAAyB,EACzB,MAAc;IAEd,MAAM,CAAC,GAAG,EAAS,CAAA;IACnB,MAAM,IAAI,GAAwB;QAChC,GAAG,IAAI;QACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,MAAM;KAClB,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC1C,KAAK,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE,SAAS,EAAE,IAAI,EAAE;QAC/D,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;KACrB,CAAC,CAAA;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;IAC9F,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtB,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAuB;gBACnC,IAAI;gBACJ,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,gBAAgB;gBACvB,IAAI,EAAE,cAAc;gBACpB,WAAW,EAAE,MAAM;gBACnB,WAAW,EAAE,MAAM;aACpB;SACF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,mBAAmB,CAAC,GAAwB;IAC1D,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAA;IACxE,OAAO;QACL,GAAG,IAAI;QACP,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QACvC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;KAC5C,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAwB;IAExB,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAA;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAEtB,IAAI,CAAC;QACH,QAAQ,GAAG,CAAC,QAAQ,EAAE,CAAC;YACrB,KAAK,QAAQ,CAAC;YACd,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,IAAI,CAAC,GAAG,CAAC,eAAe;oBAAE,OAAO,IAAI,CAAA;gBACrC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;gBACvD,IAAI,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAA;gBACxB,OAAO;oBACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,IAAI;oBACJ,MAAM;oBACN,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/E,CAAA;YACH,CAAC;YACD,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,IAAI,CAAC,GAAG,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAA;gBAC5B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;YACtD,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,IAAI,CAAC,GAAG,CAAC,IAAI;oBAAE,OAAO,IAAI,CAAA;gBAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC3F,OAAO;oBACL,QAAQ,EAAE,MAAM;oBAChB,IAAI;oBACJ,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;iBAC1E,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB;IAEjB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAA;AAC7F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,CAAA;IACnC,IAAI,kBAAkB,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAA;IACjD,IAAI,GAAG,CAAC,SAAS;QAAE,OAAO,MAAM,CAAA;IAChC,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAA;IACzD,IAAI,GAAG,CAAC,cAAc;QAAE,OAAO,QAAQ,CAAA;IACvC,OAAO,IAAI,CAAA;AACb,CAAC;AAeD,MAAM,QAAQ,GAAG,4BAA4B,CAAA;AAC7C,MAAM,SAAS,GAAG,yBAAyB,CAAA;AAC3C,+DAA+D;AAC/D,MAAM,OAAO,GACX,qFAAqF,CAAA;AAEvF;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAyB,EACzB,MAA8B;IAE9B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA,CAAC,sCAAsC;IAE/E,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,iFAAiF,CAAA;IAC1F,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACpE,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,yEAAyE,CAAA;IAClF,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAA;IAE/D,QAAQ,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;gBAAE,OAAO,2CAA2C,CAAA;YAC5E,OAAO,IAAI,CAAA;QACb,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;YAC1E,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,OAAO,iDAAiD,CAAA;YAC1D,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;YACpE,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,OAAO,2DAA2D,CAAA;YACpE,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACpD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;oBACxD,OAAO,mDAAmD,CAAA;gBAC5D,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/fields/component-block.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `componentBlock` field type — validates a stored block instance
+ * against an extracted Manifest. Lives in its own file so the larger
+ * validation rules (per-prop coercion, allow-list enforcement) can grow
+ * without bloating the registry index.
+ *
+ * Stored-value shape:
+ *   { component: 'Hero', props: { title: 'Welcome', alignment: 'center' } }
+ */
+import type { FieldDefinition } from '../config/types.js';
+import type { FieldTypeDefinition } from './index.js';
+/**
+ * Validate a stored block value against the manifest declared on its
+ * field. Returns `true` on success or a human-readable error string.
+ *
+ * Performs structural checks only — the per-prop type validation is
+ * shared with the admin form generator in the next slice (PR #2) and
+ * lives in `@prenta/component-blocks`. Pulling that here would
+ * couple cms-core to the extractor, which we want to keep optional.
+ */
+export declare function validateComponentBlockValue(value: unknown, field: FieldDefinition): string | true;
+export declare const componentBlockFieldType: FieldTypeDefinition;
+//# sourceMappingURL=component-block.d.ts.map

package/dist/fields/component-block.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"component-block.d.ts","sourceRoot":"","sources":["../../src/fields/component-block.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAGV,eAAe,EAChB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AA2CrD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CA4CjG;AAqCD,eAAO,MAAM,uBAAuB,EAAE,mBAQrC,CAAA"}