@selvajs/server 1.1.0 → 1.3.0

package/dist/handlers/reclaim.js

@@ -0,0 +1,38 @@
+/**
+ * Org owner/admin escape hatch for a project they cannot otherwise reach.
+ *
+ * Adds the actor as a co-owner and does NOT demote the existing owner.
+ * Idempotent: reclaiming twice is a no-op, because `addProjectMember`
+ * reactivates a soft-deleted row in place.
+ */
+import { created, requireParams } from '../api/index.js';
+import { actorFrom } from '@selvajs/platform';
+import { requireCanReclaim } from '../access/index.js';
+export const reclaimProject = async (req) => {
+    const { id } = requireParams(req.params, 'id');
+    const { user, ctx, project } = await requireCanReclaim(req, id);
+    const now = new Date().toISOString();
+    const member = {
+        projectId: id,
+        userId: user.id,
+        role: 'owner',
+        joinedAt: now,
+        updatedAt: now,
+        updatedBy: ctx.userId || user.id,
+        deletedAt: null
+    };
+    await req.deps.projects.addProjectMember(ctx, member);
+    // `addProjectMember` emits `project_member.added`, which is byte-identical
+    // to an owner adding a teammate. The whole escape hatch rests on the audit
+    // trail, so the escalation needs its own event or the log cannot answer the
+    // only question an auditor has here.
+    await req.deps.events.emit({
+        type: 'project.reclaimed',
+        projectId: id,
+        orgId: project.orgId,
+        actorId: actorFrom(ctx),
+        priorVisibility: project.visibility
+    });
+    return created({ member });
+};
+//# sourceMappingURL=reclaim.js.map

package/dist/handlers/reclaim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reclaim.js","sourceRoot":"","sources":["../../src/handlers/reclaim.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAmB,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAsB,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAEhE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAkB;QAC7B,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,GAAG;QACb,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE;QAChC,SAAS,EAAE,IAAI;KACf,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEtD,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,qCAAqC;IACrC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1B,IAAI,EAAE,mBAAmB;QACzB,SAAS,EAAE,EAAE;QACb,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;QACvB,eAAe,EAAE,OAAO,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC,CAAC"}

package/dist/handlers/services.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Accessors for the host-composed services on `SelvaDeps`.
+ *
+ * `services` is host-supplied and optional by type, so every call site would
+ * otherwise repeat a presence check or reach for `!`. A host that mounts these
+ * handlers without wiring a service it needs gets a named error here rather
+ * than `Cannot read properties of undefined` from inside the service call.
+ */
+import type { SelvaDeps } from '../api/index.js';
+import type { TokenCodec } from '../tokens/index.js';
+import type { OrgAssetService } from '../organizations/index.js';
+export declare function definitionService(deps: SelvaDeps): import("../definitions/definition-service.js").DefinitionService;
+export declare function orgAssetService(deps: SelvaDeps): OrgAssetService;
+/**
+ * A token codec, or a named failure.
+ *
+ * Minting through an absent codec is the one failure mode worth being loud
+ * about: a handler that quietly skipped hashing would persist a row whose token
+ * can never be verified, and nothing downstream would report it.
+ */
+export declare function tokenCodec(deps: SelvaDeps, family: keyof SelvaDeps['tokens']): TokenCodec;
+//# sourceMappingURL=services.d.ts.map

package/dist/handlers/services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../src/handlers/services.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEjE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,oEAMhD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,GAAG,eAAe,CAMhE;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,GAAG,UAAU,CAMzF"}

package/dist/handlers/services.js

@@ -0,0 +1,37 @@
+/**
+ * Accessors for the host-composed services on `SelvaDeps`.
+ *
+ * `services` is host-supplied and optional by type, so every call site would
+ * otherwise repeat a presence check or reach for `!`. A host that mounts these
+ * handlers without wiring a service it needs gets a named error here rather
+ * than `Cannot read properties of undefined` from inside the service call.
+ */
+export function definitionService(deps) {
+    const service = deps.services.definitions;
+    if (!service) {
+        throw new Error('SelvaDeps.services.definitions is not wired — mount requires it.');
+    }
+    return service;
+}
+export function orgAssetService(deps) {
+    const service = deps.services.orgAssets;
+    if (!service) {
+        throw new Error('SelvaDeps.services.orgAssets is not wired — mount requires it.');
+    }
+    return service;
+}
+/**
+ * A token codec, or a named failure.
+ *
+ * Minting through an absent codec is the one failure mode worth being loud
+ * about: a handler that quietly skipped hashing would persist a row whose token
+ * can never be verified, and nothing downstream would report it.
+ */
+export function tokenCodec(deps, family) {
+    const codec = deps.tokens[family];
+    if (!codec) {
+        throw new Error(`SelvaDeps.tokens.${family} is not wired — mount requires it.`);
+    }
+    return codec;
+}
+//# sourceMappingURL=services.js.map

package/dist/handlers/services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.js","sourceRoot":"","sources":["../../src/handlers/services.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,UAAU,iBAAiB,CAAC,IAAe;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAe;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAe,EAAE,MAAiC;IAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,oCAAoC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/handlers/shareLinks.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Share-link administration.
+ *
+ * Minting, listing and revoking are gated by `canEditDefinition` — the same
+ * authority that uploads versions and publishes. The raw token appears in the
+ * POST response and nowhere else; everything afterwards sees `hasToken: true`.
+ *
+ * **Responses go through `shaped`/`shapedCollection`, never `{ body }`.** A
+ * `ShareLink` carries `tokenHash`, and the response schema is what drops it —
+ * returning the record directly would put a credential hash on the wire with
+ * nothing failing at build time.
+ */
+import type { ApiHandler } from '../api/index.js';
+export declare const listShareLinks: ApiHandler;
+export declare const createShareLink: ApiHandler;
+/**
+ * Revoke a share link (soft-delete). Idempotent, gated by `canEditDefinition`.
+ *
+ * The link must belong to this definition, so one definition's editor cannot
+ * revoke another's link with a guessed or leaked linkId.
+ */
+export declare const revokeShareLink: ApiHandler;
+//# sourceMappingURL=shareLinks.d.ts.map

package/dist/handlers/shareLinks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shareLinks.d.ts","sourceRoot":"","sources":["../../src/handlers/shareLinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AAsB9D,eAAO,MAAM,cAAc,EAAE,UAU5B,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,UA8B7B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,UAc7B,CAAC"}

package/dist/handlers/shareLinks.js

@@ -0,0 +1,85 @@
+/**
+ * Share-link administration.
+ *
+ * Minting, listing and revoking are gated by `canEditDefinition` — the same
+ * authority that uploads versions and publishes. The raw token appears in the
+ * POST response and nowhere else; everything afterwards sees `hasToken: true`.
+ *
+ * **Responses go through `shaped`/`shapedCollection`, never `{ body }`.** A
+ * `ShareLink` carries `tokenHash`, and the response schema is what drops it —
+ * returning the record directly would put a credential hash on the wire with
+ * nothing failing at build time.
+ */
+import { randomUUID } from 'node:crypto';
+import { apiError, ApiErrorCode, CreatedShareLinkResponseSchema, noContent, parseBody, parseListOptions, parseParam, requireCaller, shaped, shapedCollection, ShareLinkResponseSchema } from '../api/index.js';
+import { CreateShareLinkInputSchema, DEFAULT_SHARE_LINK_MAX_SOLVES } from '@selvajs/platform';
+import { GuidSchema } from '@selvajs/platform/definitions';
+import { requireEditableDefinition } from '../access/index.js';
+import { tokenCodec } from './services.js';
+function assertSharingEnabled(req) {
+    if (!req.deps.flag('ENABLE_SHARING')) {
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Share links are disabled on this instance (ENABLE_SHARING).');
+    }
+}
+/** `tokenHash` is dropped by the response schema, not by this function. */
+function forClient(link) {
+    return { ...link, hasToken: true };
+}
+export const listShareLinks = async (req) => {
+    assertSharingEnabled(req);
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const { ctx } = await requireEditableDefinition(req, guid);
+    const page = await req.deps.shareLinks.listByDefinition(ctx, guid, parseListOptions(req.url));
+    return shapedCollection(ShareLinkResponseSchema, {
+        items: page.items.map(forClient),
+        nextCursor: page.nextCursor
+    });
+};
+export const createShareLink = async (req) => {
+    assertSharingEnabled(req);
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const { user } = requireCaller(req);
+    const { ctx } = await requireEditableDefinition(req, guid);
+    const input = await parseBody(req.request, CreateShareLinkInputSchema, { missingAs: {} });
+    const codec = tokenCodec(req.deps, 'shareLinks');
+    const raw = codec.mintRawToken();
+    const link = {
+        id: randomUUID(),
+        definitionId: guid,
+        channel: input.channel,
+        tokenHash: codec.hashToken(raw),
+        name: input.name,
+        createdBy: user.id,
+        createdAt: new Date().toISOString(),
+        expiresAt: input.expiresAt ?? null,
+        revokedAt: null,
+        allowSolve: input.allowSolve,
+        // The default applies only when the field is absent. An explicit `null`
+        // is a deliberate "uncap" choice and is preserved.
+        maxSolves: input.maxSolves === undefined ? DEFAULT_SHARE_LINK_MAX_SOLVES : input.maxSolves,
+        solveCount: 0
+    };
+    await req.deps.shareLinks.create(ctx, link);
+    // The token is returned once — a client that loses it must revoke and re-mint.
+    return shaped(CreatedShareLinkResponseSchema, { link: forClient(link), token: raw }, 201);
+};
+/**
+ * Revoke a share link (soft-delete). Idempotent, gated by `canEditDefinition`.
+ *
+ * The link must belong to this definition, so one definition's editor cannot
+ * revoke another's link with a guessed or leaked linkId.
+ */
+export const revokeShareLink = async (req) => {
+    assertSharingEnabled(req);
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const linkId = parseParam(req.params.linkId, GuidSchema, 'link ID');
+    const { ctx } = await requireEditableDefinition(req, guid);
+    const existing = await req.deps.shareLinks.getById(ctx, linkId);
+    if (!existing || existing.definitionId !== guid) {
+        // 404 either way — never disclose that the id exists on another definition.
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Share link not found.');
+    }
+    await req.deps.shareLinks.revoke(ctx, linkId);
+    return noContent();
+};
+//# sourceMappingURL=shareLinks.js.map

package/dist/handlers/shareLinks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shareLinks.js","sourceRoot":"","sources":["../../src/handlers/shareLinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,8BAA8B,EAC9B,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,MAAM,EACN,gBAAgB,EAChB,uBAAuB,EACvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAE9F,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,SAAS,oBAAoB,CAAC,GAAe;IAC5C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtC,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,6DAA6D,CAC7D,CAAC;IACH,CAAC;AACF,CAAC;AAED,2EAA2E;AAC3E,SAAS,SAAS,CAAC,IAAe;IACjC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,OAAO,gBAAgB,CAAC,uBAAuB,EAAE;QAChD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QAChC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,0BAA0B,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAE1F,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IACjC,MAAM,IAAI,GAAc;QACvB,EAAE,EAAE,UAAU,EAAE;QAChB,YAAY,EAAE,IAAI;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,IAAI,CAAC,EAAE;QAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,wEAAwE;QACxE,mDAAmD;QACnD,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;QAC1F,UAAU,EAAE,CAAC;KACb,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,+EAA+E;IAC/E,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;AAC3F,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAEpE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACjD,4EAA4E;QAC5E,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}

package/dist/http/index.d.ts

@@ -2,4 +2,5 @@ export { safeRedirectTarget } from './redirect.js';
 export { declaredBodySizeExceeds, type HeadersLike } from './body-size.js';
 export { applySecurityHeaders, type SecurityHeaderOptions } from './security-headers.js';
 export { createRouteClassifier, type RouteClassifier, type RouteClassifierConfig } from './route-classifier.js';
+export { createLoginRateLimiter, addressKeysCollapsed, type LoginRateLimiter, type LoginRateLimiterConfig } from './login-rate-limit.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/http/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACN,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACN,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,MAAM,uBAAuB,CAAC"}

package/dist/http/index.js

@@ -3,4 +3,5 @@ export { safeRedirectTarget } from './redirect.js';
 export { declaredBodySizeExceeds } from './body-size.js';
 export { applySecurityHeaders } from './security-headers.js';
 export { createRouteClassifier } from './route-classifier.js';
+export { createLoginRateLimiter, addressKeysCollapsed } from './login-rate-limit.js';
 //# sourceMappingURL=index.js.map

package/dist/http/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAoB,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAA8B,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACN,qBAAqB,EAGrB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAoB,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAA8B,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACN,qBAAqB,EAGrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EAGpB,MAAM,uBAAuB,CAAC"}

package/dist/http/login-rate-limit.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Login rate limiting: two buckets per attempt, because neither dimension
+ * covers the other.
+ *
+ *   - **Per-address** bounds one client hammering the form. It is only
+ *     meaningful when the host resolves a real client address. Behind a reverse
+ *     proxy that is not configured to forward one, every request reports the
+ *     socket peer — `127.0.0.1` for all of them — which collapses the whole key
+ *     space into a single bucket: five failed logins from anywhere lock out the
+ *     entire instance, and only a success clears it, which nobody can now
+ *     reach. That failure is completely silent, hence
+ *     {@link addressKeysCollapsed}.
+ *   - **Per-account** bounds a targeted guessing attack, which address limiting
+ *     does not: an attacker spread across many source IPs contends with no
+ *     shared counter at all, leaving password-hash cost as the only real bound
+ *     on online guessing.
+ *
+ * An attempt must clear both and a failure charges both. A success clears the
+ * account bucket and the calling address's — a *different* address that failed
+ * against the same account keeps its own penalty.
+ *
+ * The flow counts failures rather than attempts: `check` gates without spending
+ * budget, `recordFailure` spends, and `clear` forgives. A successful login
+ * therefore costs nothing, so an ordinary user typing one wrong password never
+ * walks toward a lockout.
+ */
+import type { RateLimitResult } from '../compute/rate-limit.js';
+export interface LoginRateLimiterConfig {
+    /** Window for both buckets. Default 15 minutes. */
+    windowMs?: number;
+    /** Failed logins per address per window. Default 5. */
+    maxPerAddress?: number;
+    /**
+     * Failed logins per account per window. Default 20 — deliberately looser
+     * than the address cap, because this bucket is reachable by an attacker who
+     * wants to lock a known user out of their own account. It trades a little
+     * brute-force headroom for not being a cheap denial of service on a named
+     * victim.
+     */
+    maxPerAccount?: number;
+}
+export interface LoginRateLimiter {
+    /**
+     * Gate one attempt without spending budget.
+     *
+     * `email` may be absent — a password-only login against a provider with no
+     * user store has no account to key on — in which case only the address
+     * bucket applies.
+     */
+    check(address: string, email?: string): RateLimitResult;
+    /** Charge a failed attempt to both buckets. */
+    recordFailure(address: string, email?: string): void;
+    /** Forgive on success. */
+    clear(address: string, email?: string): void;
+    /** Drop all state. For tests. */
+    reset(): void;
+}
+export declare function createLoginRateLimiter(config?: LoginRateLimiterConfig): LoginRateLimiter;
+/**
+ * Whether per-address limiting has degenerated into one shared bucket.
+ *
+ * True when the host reports a loopback address for a request it did not
+ * originate — which means it sits behind a proxy and is reading the socket peer
+ * instead of a forwarded client address. The host decides what to do about it;
+ * warning once at startup is enough, and warning per request is not.
+ *
+ * `addressHeaderConfigured` is the host's answer to "am I reading a forwarded
+ * header at all", since which header and how many hops to trust are deployment
+ * config that no package can resolve for it.
+ */
+export declare function addressKeysCollapsed(address: string, addressHeaderConfigured: boolean): boolean;
+//# sourceMappingURL=login-rate-limit.d.ts.map

package/dist/http/login-rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-rate-limit.d.ts","sourceRoot":"","sources":["../../src/http/login-rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAKhE,MAAM,WAAW,sBAAsB;IACtC,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAChC;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IACxD,+CAA+C;IAC/C,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrD,0BAA0B;IAC1B,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,iCAAiC;IACjC,KAAK,IAAI,IAAI,CAAC;CACd;AAOD,wBAAgB,sBAAsB,CAAC,MAAM,GAAE,sBAA2B,GAAG,gBAAgB,CA8B5F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,OAAO,GAAG,OAAO,CAG/F"}

package/dist/http/login-rate-limit.js

@@ -0,0 +1,84 @@
+/**
+ * Login rate limiting: two buckets per attempt, because neither dimension
+ * covers the other.
+ *
+ *   - **Per-address** bounds one client hammering the form. It is only
+ *     meaningful when the host resolves a real client address. Behind a reverse
+ *     proxy that is not configured to forward one, every request reports the
+ *     socket peer — `127.0.0.1` for all of them — which collapses the whole key
+ *     space into a single bucket: five failed logins from anywhere lock out the
+ *     entire instance, and only a success clears it, which nobody can now
+ *     reach. That failure is completely silent, hence
+ *     {@link addressKeysCollapsed}.
+ *   - **Per-account** bounds a targeted guessing attack, which address limiting
+ *     does not: an attacker spread across many source IPs contends with no
+ *     shared counter at all, leaving password-hash cost as the only real bound
+ *     on online guessing.
+ *
+ * An attempt must clear both and a failure charges both. A success clears the
+ * account bucket and the calling address's — a *different* address that failed
+ * against the same account keeps its own penalty.
+ *
+ * The flow counts failures rather than attempts: `check` gates without spending
+ * budget, `recordFailure` spends, and `clear` forgives. A successful login
+ * therefore costs nothing, so an ordinary user typing one wrong password never
+ * walks toward a lockout.
+ */
+import { createComputeRateLimiter } from '../compute/rate-limit.js';
+/** Loopback in the three spellings a Node server actually reports. */
+const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
+/** Normalized so case tricks (`Alice@` vs `alice@`) share one bucket. */
+function accountKey(email) {
+    return `account:${email.trim().toLowerCase()}`;
+}
+export function createLoginRateLimiter(config = {}) {
+    const windowMs = config.windowMs ?? 15 * 60 * 1000;
+    const byAddress = createComputeRateLimiter({
+        windowMs,
+        maxPerWindow: config.maxPerAddress ?? 5
+    });
+    const byAccount = createComputeRateLimiter({
+        windowMs,
+        maxPerWindow: config.maxPerAccount ?? 20
+    });
+    return {
+        check(address, email) {
+            const address_ = byAddress.peek(address);
+            if (!address_.allowed || !email)
+                return address_;
+            return byAccount.peek(accountKey(email));
+        },
+        recordFailure(address, email) {
+            byAddress.check(address);
+            if (email)
+                byAccount.check(accountKey(email));
+        },
+        clear(address, email) {
+            byAddress.clear(address);
+            if (email)
+                byAccount.clear(accountKey(email));
+        },
+        reset() {
+            byAddress.reset();
+            byAccount.reset();
+        }
+    };
+}
+/**
+ * Whether per-address limiting has degenerated into one shared bucket.
+ *
+ * True when the host reports a loopback address for a request it did not
+ * originate — which means it sits behind a proxy and is reading the socket peer
+ * instead of a forwarded client address. The host decides what to do about it;
+ * warning once at startup is enough, and warning per request is not.
+ *
+ * `addressHeaderConfigured` is the host's answer to "am I reading a forwarded
+ * header at all", since which header and how many hops to trust are deployment
+ * config that no package can resolve for it.
+ */
+export function addressKeysCollapsed(address, addressHeaderConfigured) {
+    if (addressHeaderConfigured)
+        return false;
+    return LOOPBACK.has(address);
+}
+//# sourceMappingURL=login-rate-limit.js.map

package/dist/http/login-rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-rate-limit.js","sourceRoot":"","sources":["../../src/http/login-rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAGpE,sEAAsE;AACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAkCnE,yEAAyE;AACzE,SAAS,UAAU,CAAC,KAAa;IAChC,OAAO,WAAW,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,SAAiC,EAAE;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACnD,MAAM,SAAS,GAAG,wBAAwB,CAAC;QAC1C,QAAQ;QACR,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,CAAC;KACvC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,wBAAwB,CAAC;QAC1C,QAAQ;QACR,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;KACxC,CAAC,CAAC;IAEH,OAAO;QACN,KAAK,CAAC,OAAO,EAAE,KAAK;YACnB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,KAAK;gBAAE,OAAO,QAAQ,CAAC;YACjD,OAAO,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,aAAa,CAAC,OAAO,EAAE,KAAK;YAC3B,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzB,IAAI,KAAK;gBAAE,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,OAAO,EAAE,KAAK;YACnB,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzB,IAAI,KAAK;gBAAE,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK;YACJ,SAAS,CAAC,KAAK,EAAE,CAAC;YAClB,SAAS,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;KACD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,uBAAgC;IACrF,IAAI,uBAAuB;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC"}

package/dist/notifications/deliver-invite.d.ts

@@ -0,0 +1,27 @@
+import type { AuthUser, IDataProvider, ILogger, INotificationProvider, Invite, RequestContext, UserProfile } from '@selvajs/platform';
+export type InviteDelivery = 'sent' | 'not-configured' | 'failed';
+export interface DeliverInviteInput {
+    ctx: RequestContext;
+    log: ILogger;
+    invite: Invite;
+    acceptUrl: string;
+    /** The admin minting the invite — used only for the "X invited you" line. */
+    actor: {
+        profile?: UserProfile;
+        user?: AuthUser;
+    };
+    orgs: IDataProvider['orgs'];
+    notifications: INotificationProvider;
+    /** Falls back into the org-name slot when the org has no name of its own. */
+    fallbackOrgName: string;
+}
+/**
+ * Mail an invite's accept link, best-effort.
+ *
+ * Shared by the mint and resend routes so they cannot disagree about what the
+ * invitee receives. Swallows every failure: the invite row is already
+ * committed and the caller still holds `acceptUrl` to share by hand, so a dead
+ * SMTP host must not report a valid invite as a failure.
+ */
+export declare function deliverInvite(input: DeliverInviteInput): Promise<InviteDelivery>;
+//# sourceMappingURL=deliver-invite.d.ts.map

package/dist/notifications/deliver-invite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliver-invite.d.ts","sourceRoot":"","sources":["../../src/notifications/deliver-invite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,QAAQ,EACR,aAAa,EACb,OAAO,EACP,qBAAqB,EACrB,MAAM,EACN,cAAc,EACd,WAAW,EACX,MAAM,mBAAmB,CAAC;AAG3B,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,gBAAgB,GAAG,QAAQ,CAAC;AAElE,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,cAAc,CAAC;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,WAAW,CAAC;QAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC;IAClD,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5B,aAAa,EAAE,qBAAqB,CAAC;IACrC,6EAA6E;IAC7E,eAAe,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuBtF"}

package/dist/notifications/deliver-invite.js

@@ -0,0 +1,32 @@
+import { renderInviteEmail } from '@selvajs/notifications';
+/**
+ * Mail an invite's accept link, best-effort.
+ *
+ * Shared by the mint and resend routes so they cannot disagree about what the
+ * invitee receives. Swallows every failure: the invite row is already
+ * committed and the caller still holds `acceptUrl` to share by hand, so a dead
+ * SMTP host must not report a valid invite as a failure.
+ */
+export async function deliverInvite(input) {
+    const { ctx, log, invite, acceptUrl, actor, orgs, notifications, fallbackOrgName } = input;
+    try {
+        const org = await orgs.getOrg(ctx, invite.orgId);
+        const { status } = await notifications.send(renderInviteEmail({
+            to: invite.email,
+            acceptUrl,
+            orgName: org?.name ?? fallbackOrgName,
+            invitedBy: actor.profile?.displayName || actor.user?.email,
+            expiresAt: invite.expiresAt
+        }), log);
+        return status;
+    }
+    catch (err) {
+        log.warn('Invite mail could not be prepared', {
+            component: 'Invites',
+            inviteId: invite.id,
+            reason: err instanceof Error ? err.message : String(err)
+        });
+        return 'failed';
+    }
+}
+//# sourceMappingURL=deliver-invite.js.map

package/dist/notifications/deliver-invite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliver-invite.js","sourceRoot":"","sources":["../../src/notifications/deliver-invite.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAiB3D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAyB;IAC5D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAC3F,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAC1C,iBAAiB,CAAC;YACjB,EAAE,EAAE,MAAM,CAAC,KAAK;YAChB,SAAS;YACT,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,eAAe;YACrC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK;YAC1D,SAAS,EAAE,MAAM,CAAC,SAAS;SAC3B,CAAC,EACF,GAAG,CACH,CAAC;QACF,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE;YAC7C,SAAS,EAAE,SAAS;YACpB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IACjB,CAAC;AACF,CAAC"}

package/dist/notifications/index.d.ts

@@ -0,0 +1,4 @@
+export { SmtpNotificationProvider } from './smtp-provider.js';
+export { readSmtpConfig, type SmtpConfig, type SmtpEnv } from './smtp-config.js';
+export { deliverInvite, type DeliverInviteInput, type InviteDelivery } from './deliver-invite.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/notifications/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/notifications/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/notifications/index.js

@@ -0,0 +1,4 @@
+export { SmtpNotificationProvider } from './smtp-provider.js';
+export { readSmtpConfig } from './smtp-config.js';
+export { deliverInvite } from './deliver-invite.js';
+//# sourceMappingURL=index.js.map

package/dist/notifications/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/notifications/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAiC,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAgD,MAAM,qBAAqB,CAAC"}

package/dist/notifications/smtp-config.d.ts

@@ -0,0 +1,37 @@
+export interface SmtpConfig {
+    host: string;
+    port: number;
+    secure: boolean;
+    auth?: {
+        user: string;
+        pass: string;
+    };
+    from: string;
+}
+/** The env vars this provider reads. The app passes `process.env` or its framework equivalent. */
+export interface SmtpEnv {
+    SMTP_HOST?: string;
+    SMTP_PORT?: string;
+    SMTP_USER?: string;
+    SMTP_PASS?: string;
+    SMTP_FROM?: string;
+    SMTP_SECURE?: string;
+    [key: string]: string | undefined;
+}
+/**
+ * Read SMTP settings from an env bag. Taken as a parameter rather than read
+ * from `process.env` directly: under `vite dev` the framework does not mirror
+ * `.env` into `process.env`, so the app must hand over its own resolved env
+ * (`$env/dynamic/private` in SvelteKit) or overrides silently fall back to
+ * defaults.
+ *
+ * Returns null when mail is not configured — the caller treats that as "no
+ * mail", not as an error.
+ *
+ * Throws only when `SMTP_HOST` is set but `SMTP_FROM` is missing: that
+ * combination is a half-finished config, and failing loudly beats silently
+ * never sending. Every message needs an envelope sender, and guessing one
+ * produces mail that fails SPF at the recipient.
+ */
+export declare function readSmtpConfig(env: SmtpEnv): SmtpConfig | null;
+//# sourceMappingURL=smtp-config.d.ts.map

package/dist/notifications/smtp-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smtp-config.d.ts","sourceRoot":"","sources":["../../src/notifications/smtp-config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;CACb;AAED,kGAAkG;AAClG,MAAM,WAAW,OAAO;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IAKrB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAClC;AAOD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAsB9D"}

package/dist/notifications/smtp-config.js

@@ -0,0 +1,41 @@
+function parsePort(raw) {
+    const n = Number(raw ?? 587);
+    return Number.isInteger(n) && n > 0 && n < 65536 ? n : 587;
+}
+/**
+ * Read SMTP settings from an env bag. Taken as a parameter rather than read
+ * from `process.env` directly: under `vite dev` the framework does not mirror
+ * `.env` into `process.env`, so the app must hand over its own resolved env
+ * (`$env/dynamic/private` in SvelteKit) or overrides silently fall back to
+ * defaults.
+ *
+ * Returns null when mail is not configured — the caller treats that as "no
+ * mail", not as an error.
+ *
+ * Throws only when `SMTP_HOST` is set but `SMTP_FROM` is missing: that
+ * combination is a half-finished config, and failing loudly beats silently
+ * never sending. Every message needs an envelope sender, and guessing one
+ * produces mail that fails SPF at the recipient.
+ */
+export function readSmtpConfig(env) {
+    const host = env.SMTP_HOST?.trim();
+    if (!host)
+        return null;
+    const from = env.SMTP_FROM?.trim();
+    if (!from) {
+        throw new Error('SMTP_HOST is set but SMTP_FROM is missing — mail needs a sender address.');
+    }
+    const port = parsePort(env.SMTP_PORT);
+    const user = env.SMTP_USER?.trim();
+    const pass = env.SMTP_PASS;
+    return {
+        host,
+        port,
+        // Port 465 is implicit TLS; 587 and 25 start plaintext and upgrade via
+        // STARTTLS, which nodemailer does on its own when `secure` is false.
+        secure: env.SMTP_SECURE ? env.SMTP_SECURE === 'true' : port === 465,
+        auth: user && pass ? { user, pass } : undefined,
+        from
+    };
+}
+//# sourceMappingURL=smtp-config.js.map

package/dist/notifications/smtp-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smtp-config.js","sourceRoot":"","sources":["../../src/notifications/smtp-config.ts"],"names":[],"mappings":"AAuBA,SAAS,SAAS,CAAC,GAAuB;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC;IAE3B,OAAO;QACN,IAAI;QACJ,IAAI;QACJ,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG;QACnE,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC/C,IAAI;KACJ,CAAC;AACH,CAAC"}

package/dist/notifications/smtp-provider.d.ts

@@ -0,0 +1,18 @@
+import { type ILogger, type INotificationProvider, type OutboundMessage, type SendResult } from '@selvajs/platform';
+import { type SmtpEnv } from './smtp-config.js';
+/**
+ * SMTP transport. Any server works — a transactional provider, an internal
+ * relay, or a mailbox with an app password.
+ *
+ * Settings are read per send rather than cached, so a restart is the only
+ * thing needed to reconfigure and a rotated password takes effect without
+ * anyone remembering there is a cache.
+ */
+export declare class SmtpNotificationProvider implements INotificationProvider {
+    private readonly env;
+    readonly name = "SMTP";
+    constructor(env: SmtpEnv);
+    send(message: OutboundMessage, log?: ILogger): Promise<SendResult>;
+    isConfigured(): boolean;
+}
+//# sourceMappingURL=smtp-provider.d.ts.map

package/dist/notifications/smtp-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smtp-provider.d.ts","sourceRoot":"","sources":["../../src/notifications/smtp-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,OAAO,EACZ,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAkB,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhE;;;;;;;GAOG;AACH,qBAAa,wBAAyB,YAAW,qBAAqB;IAGzD,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFhC,QAAQ,CAAC,IAAI,UAAU;gBAEM,GAAG,EAAE,OAAO;IAEnC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,GAAE,OAA0B,GAAG,OAAO,CAAC,UAAU,CAAC;IA6C1F,YAAY,IAAI,OAAO;CAOvB"}