@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/notifications/email/services/email-template-sandbox.backend.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"email-template-sandbox.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email-template-sandbox.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAsBpF,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;GAEG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,OAAO;IACP,WAAW;IACX,yBAAyB;IACzB,qBAAqB;IACrB,4BAA4B;CAC7B,CAAC,CAAC;AAEH,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAGzE,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IAMS;IACa;IAN3D,qBAAqB,GAAmB,IAAI,CAAC;IAE3C,QAAQ,CAA+D;IAEjF,YACsD,MAAqB,EACR,YAAwC;QADrD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAEzG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,OAAgC,EAChC,UAA0B,EAAE;QAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,kBAAkB,CAAC;QAEtD,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,kCAAkC;YAClC,MAAM,cAAc,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAEnD,yBAAyB;YACzB,MAAM,OAAO,GAAe;gBAC1B,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;gBACvB,OAAO,EAAE,EAAE;gBACX,OAAO,EAAE,cAAc;gBACvB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE;gBACjC,sBAAsB;gBACtB,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;gBAC9B,6CAA6C;gBAC7C,MAAM,EAAE;oBACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;oBAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;iBACvC;aACF,CAAC;YAEF,qCAAqC;YACrC,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;gBAC9B,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACpD,CAAC;YAED,oBAAoB;YACpB,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAE1B,8CAA8C;YAC9C,MAAM,WAAW,GAAG;;YAEd,YAAY;;;OAGjB,CAAC;YAEF,uBAAuB;YACvB,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE;gBACxC,QAAQ,EAAE,mBAAmB;aAC9B,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE;gBAC1C,OAAO;gBACP,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,6BAA6B,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAE7D,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM;gBACN,UAAU;aACX,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAY,CAAC;YAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBAC5C,KAAK,EAAE,KAAK,CAAC,OAAO;gBACpB,UAAU;gBACV,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC;aAChE,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK,CAAC,OAAO;gBACpB,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,oBAAoB;QAC1B,OAAO,CAAC,UAAkB,EAAW,EAAE;YACrC,yEAAyE;YACzE,IAAI,UAAU,KAAK,4BAA4B,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC,wBAAwB,EAAE,CAAC;YACzC,CAAC;YAED,kCAAkC;YAClC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;oBACtF,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,wBAAwB;iBAClD,CAAC,CAAC;YACL,CAAC;YAED,4CAA4C;YAC5C,iEAAiE;YACjE,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,wBAAwB;QAC9B,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,yEAAyE;YACzE,MAAM,oBAAoB,GAAG;gBAC3B,8CAA8C;gBAC9C,GAAG,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC;gBAC/C,4CAA4C;gBAC5C,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;gBACnF,gCAAgC;gBAChC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,gEAAgE,CAAC,CAAC;gBACnH,gCAAgC;gBAChC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,gEAAgE,CAAC,CAAC;aACpH,CAAC;YAEF,KAAK,MAAM,QAAQ,IAAI,oBAAoB,EAAE,CAAC;gBAC5C,IAAI,CAAC;oBACH,IAAI,CAAC,qBAAqB,GAAG,QAAQ,EAAE,CAAC;oBACxC,IAAI,CAAC,QAAQ,CAAC,6CAA6C,CAAC,CAAC;oBAC7D,OAAO,IAAI,CAAC,qBAAqB,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,oBAAoB;gBACtB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAC9E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED;;OAEG;IACK,iBAAiB;QACvB,OAAO;YACL,GAAG,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,CAAC;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,UAAkB;QAChC,OAAO,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACrC,CAAC;CACF,CAAA;AAxMY,kCAAkC;IAD9C,UAAU,EAAE;IAOR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;;GAPtC,kCAAkC,CAwM9C","sourcesContent":["/**\n * Email Template Sandbox Backend Service\n *\n * Provides a secure execution environment for running compiled email templates.\n * Uses Node.js VM with restricted globals and a controlled require function.\n */\n\nimport { injectable, inject } from 'inversify';\nimport * as vm from 'vm';\nimport { ErrorType, ErrorCustomMessageReference } from '@wildo-ai/saas-models';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// TYPES\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface SandboxExecutionResult {\n  success: boolean;\n  result?: unknown;\n  error?: string;\n  durationMs: number;\n}\n\nexport interface SandboxOptions {\n  /** Timeout in milliseconds (default: 5000) */\n  timeout?: number;\n  /** Additional context to pass to the template */\n  additionalContext?: Record<string, unknown>;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// CONSTANTS\n// ─────────────────────────────────────────────────────────────────────────────\n\nconst DEFAULT_TIMEOUT_MS = 5000;\n\n/**\n * Allowed modules that can be required in the sandbox\n */\nconst ALLOWED_MODULES = new Set([\n  'react',\n  'react-dom',\n  '@react-email/components',\n  '@react-email/render',\n  '@wildo-ai/email-components',\n]);\n\n// ─────────────────────────────────────────────────────────────────────────────\n// SERVICE\n// ─────────────────────────────────────────────────────────────────────────────\n\n@injectable()\nexport class EmailTemplateSandboxBackendService {\n  private emailComponentsModule: unknown | null = null;\n\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('EmailTemplateSandboxBackendService');\n    this.logger.setDebugTypeLogging('EmailTemplateSandboxBackendService', false);\n  }\n\n  /**\n   * Execute a compiled module in the sandbox\n   *\n   * @param compiledCode - The compiled JavaScript code\n   * @param context - The context to pass to the template\n   * @param options - Execution options\n   * @returns Execution result with the rendered output or error\n   */\n  async execute(\n    compiledCode: string,\n    context: Record<string, unknown>,\n    options: SandboxOptions = {}\n  ): Promise<SandboxExecutionResult> {\n    const startTime = Date.now();\n    const timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;\n\n    this.logDebug('Executing email template in sandbox', { timeout });\n\n    try {\n      // Create sandbox require function\n      const sandboxRequire = this.createSandboxRequire();\n\n      // Create sandbox globals\n      const sandbox: vm.Context = {\n        module: { exports: {} },\n        exports: {},\n        require: sandboxRequire,\n        console: this.createSafeConsole(),\n        // Pass context values\n        __context: context,\n        __brand: context.__brand || {},\n        // Provide Buffer for any serialization needs\n        Buffer: {\n          from: Buffer.from.bind(Buffer),\n          isBuffer: Buffer.isBuffer.bind(Buffer),\n        },\n      };\n\n      // Add additional context if provided\n      if (options.additionalContext) {\n        Object.assign(sandbox, options.additionalContext);\n      }\n\n      // Create VM context\n      vm.createContext(sandbox);\n\n      // Wrap the code to capture the default export\n      const wrappedCode = `\n        (function(module, exports, require, __context, __brand) {\n          ${compiledCode}\n          return module.exports.default || module.exports;\n        })(module, exports, require, __context, __brand);\n      `;\n\n      // Execute with timeout\n      const script = new vm.Script(wrappedCode, {\n        filename: 'email-template.js',\n      });\n\n      const result = script.runInContext(sandbox, {\n        timeout,\n        displayErrors: true,\n      });\n\n      const durationMs = Date.now() - startTime;\n      this.logDebug('Sandbox execution completed', { durationMs });\n\n      return {\n        success: true,\n        result,\n        durationMs,\n      };\n    } catch (err) {\n      const error = err as Error;\n      const durationMs = Date.now() - startTime;\n\n      this.logger.error('Sandbox execution failed', {\n        error: error.message,\n        durationMs,\n        isTimeout: error.message.includes('Script execution timed out'),\n      });\n\n      return {\n        success: false,\n        error: error.message,\n        durationMs,\n      };\n    }\n  }\n\n  /**\n   * Create a safe require function that only allows specific modules\n   */\n  private createSandboxRequire(): (moduleName: string) => unknown {\n    return (moduleName: string): unknown => {\n      // Handle @wildo-ai/email-components specially - load our internal module\n      if (moduleName === '@wildo-ai/email-components') {\n        return this.getEmailComponentsModule();\n      }\n\n      // Check if module is in allowlist\n      if (!ALLOWED_MODULES.has(moduleName)) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_VALIDATION_FAILED,\n          context: { moduleName }, // diagnostic (log-only)\n        });\n      }\n\n      // For allowed modules, use the real require\n      // eslint-disable-next-line @typescript-eslint/no-require-imports\n      return require(moduleName);\n    };\n  }\n\n  /**\n   * Get the email components module (lazy loaded)\n   * Uses multiple resolution strategies for robustness across different build outputs\n   */\n  private getEmailComponentsModule(): unknown {\n    if (!this.emailComponentsModule) {\n      // Load our internal email components with multiple resolution strategies\n      const resolutionStrategies = [\n        // Strategy 1: Relative path from current file\n        () => require('../components/email-components'),\n        // Strategy 2: Absolute path using __dirname\n        () => require(require('path').resolve(__dirname, '../components/email-components')),\n        // Strategy 3: Try dist/esm path\n        () => require(require('path').resolve(__dirname, '../../dist/esm/notifications/email/components/email-components')),\n        // Strategy 4: Try dist/cjs path\n        () => require(require('path').resolve(__dirname, '../../dist/cjs/notifications/email/components/email-components')),\n      ];\n\n      for (const strategy of resolutionStrategies) {\n        try {\n          this.emailComponentsModule = strategy();\n          this.logDebug('Email components module loaded successfully');\n          return this.emailComponentsModule;\n        } catch {\n          // Try next strategy\n        }\n      }\n\n      this.logger.error('Failed to load email components module with any strategy');\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n        context: { message: 'Email components module not available' },\n      });\n    }\n    return this.emailComponentsModule;\n  }\n\n  /**\n   * Create a safe console that logs through our logger\n   */\n  private createSafeConsole(): Partial<Console> {\n    return {\n      log: (...args: unknown[]) => {\n        this.logger.debug('Template console.log', { args });\n      },\n      warn: (...args: unknown[]) => {\n        this.logger.warn('Template console.warn', { args });\n      },\n      error: (...args: unknown[]) => {\n        this.logger.error('Template console.error', { args });\n      },\n      info: (...args: unknown[]) => {\n        this.logger.info('Template console.info', { args });\n      },\n      debug: (...args: unknown[]) => {\n        this.logger.debug('Template console.debug', { args });\n      },\n    };\n  }\n\n  /**\n   * Check if a module is allowed in the sandbox\n   */\n  isModuleAllowed(moduleName: string): boolean {\n    return ALLOWED_MODULES.has(moduleName);\n  }\n\n  /**\n   * Get list of allowed modules (for LLM context)\n   */\n  getAllowedModules(): string[] {\n    return Array.from(ALLOWED_MODULES);\n  }\n}\n"]}

package/dist/esm/notifications/email/services/email-template-validator.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-template-validator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email-template-validator.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAMlG,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,EAYlD,CAAC;AA0CF,qBACa,oCAAoC;IAIV,OAAO,CAAC,QAAQ,CAAC,MAAM;IAH5D,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa;IAM3E;;;;;OAKG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAyC/D;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;OAEG;IACH,OAAO,CAAC,eAAe;IA2BvB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAsBhC;;OAEG;YACW,WAAW;IAwCzB;;OAEG;IACH,iBAAiB,IAAI,MAAM,EAAE;CAG9B"}
+{"version":3,"file":"email-template-validator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email-template-validator.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAMlG,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,EAqBlD,CAAC;AA0CF,qBACa,oCAAoC;IAIV,OAAO,CAAC,QAAQ,CAAC,MAAM;IAH5D,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa;IAM3E;;;;;OAKG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAyC/D;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;OAEG;IACH,OAAO,CAAC,eAAe;IA2BvB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAsBhC;;OAEG;YACW,WAAW;IAwCzB;;OAEG;IACH,iBAAiB,IAAI,MAAM,EAAE;CAG9B"}

package/dist/esm/notifications/email/services/email-template-validator.backend.service.js

@@ -32,7 +32,16 @@ export const EMAIL_TEMPLATE_ALLOWED_IMPORTS = [
     // React Email core
     '@react-email/components',
     '@react-email/render',
-    // Our predefined email components
+    // Our predefined email components. Exported from the package root
+    // (`saas-backend-lib/src/index.ts`) so an application's authored template can import it —
+    // and it is why `InversifyContainer` is aliased there, to avoid the clash with React Email's
+    // own `Container` re-exported from this module.
+    //
+    // NOTE (#475, 2026-09-08): the email-template SANDBOX used to be the thing that resolved this
+    // specifier at runtime, and it was deleted as unreachable. Permitting the import here is
+    // therefore no longer backed by a loader inside the engine; an application template importing
+    // it resolves through its own bundler against the package root export. Keep the entry — the
+    // export is public API — but do not read it as evidence that the engine loads the module.
     '@wildo-ai/email-components',
     // App-owned runtime helpers used by the filesystem email template pattern
     '@wildo-ai/saas-backend-lib',

package/dist/esm/notifications/email/services/email-template-validator.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-template-validator.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email-template-validator.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAapF,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAa;IACtD,mBAAmB;IACnB,yBAAyB;IACzB,qBAAqB;IACrB,kCAAkC;IAClC,4BAA4B;IAC5B,0EAA0E;IAC1E,4BAA4B;IAC5B,sCAAsC;IACtC,UAAU;IACV,kBAAkB;IAClB,OAAO;CACR,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAgD;IACtE,eAAe;IACf,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACzE,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACvE,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACtE,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACpE,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC5E,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAC9D,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAEhE,cAAc;IACd,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACpE,EAAE,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,kCAAkC,EAAE;IAEvF,UAAU;IACV,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC/D,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,6BAA6B,EAAE;IACjE,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAC7D,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC5E,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,+BAA+B,EAAE;IAE5E,iBAAiB;IACjB,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC7D,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,uCAAuC,EAAE;IACjF,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,0CAA0C,EAAE;IACtF,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,2CAA2C,EAAE;IAExF,kBAAkB;IAClB,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,8BAA8B,EAAE;IACtE,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC7D,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,wBAAwB,EAAE;CAChE,CAAC;AAEF,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAGzE,IAAM,oCAAoC,GAA1C,MAAM,oCAAoC;IAIO;IAH5C,QAAQ,CAA+D;IAEjF,YACsD,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;QAEzE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;IACjF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;QAEtD,kCAAkC;QAClC,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAEhC,sBAAsB;QACtB,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAE7B,4DAA4D;QAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;QAE/B,4CAA4C;QAC5C,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAY,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,SAAiB;QAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,kBAAkB,EAAE,CAAC;YACtD,oBAAoB;YACpB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,SAAiB;QACvC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,0BAA0B;QAC1B,MAAM,WAAW,GAAG,sDAAsD,CAAC;QAC3E,IAAI,KAAK,CAAC;QAEV,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAE5B,6BAA6B;YAC7B,MAAM,SAAS,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChE,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAC3B,OAAO,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAClD,CAAC;gBAED,OAAO,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;YACxE,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,gBAAgB,UAAU,sCAAsC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3H,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAAC,SAAiB;QAChD,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAChF,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CAAC,SAAiB;QACzC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC;YACH,sBAAsB;YACtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YAExC,4DAA4D;YAC5D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE;gBAChD,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,QAAQ;gBAChB,GAAG,EAAE,WAAW;gBAChB,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YAEH,kCAAkC;YAClC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACtC,QAAQ,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAgF,CAAC;YAE/F,uBAAuB;YACvB,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAnLY,oCAAoC;IADhD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;;GAJzB,oCAAoC,CAmLhD","sourcesContent":["/**\n * Email Template Validator Backend Service\n *\n * Validates TSX email templates for security and correctness.\n * Checks for:\n * - Import allowlist compliance\n * - Forbidden patterns (Node.js APIs, dangerous code)\n * - Syntax validation via ESBuild\n */\n\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// TYPES\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface TsxValidationResult {\n  valid: boolean;\n  errors: string[];\n  warnings: string[];\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// CONSTANTS\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Allowed import paths for generated email templates\n * Templates can only import from these modules\n */\nexport const EMAIL_TEMPLATE_ALLOWED_IMPORTS: string[] = [\n  // React Email core\n  '@react-email/components',\n  '@react-email/render',\n  // Our predefined email components\n  '@wildo-ai/email-components',\n  // App-owned runtime helpers used by the filesystem email template pattern\n  '@wildo-ai/saas-backend-lib',\n  '~backend-api/engine/email/components',\n  './labels',\n  // React (limited)\n  'react',\n];\n\n/**\n * Forbidden patterns that indicate potentially dangerous code\n */\nconst FORBIDDEN_PATTERNS: Array<{ pattern: RegExp; message: string }> = [\n  // Node.js APIs\n  { pattern: /require\\s*\\(/g, message: 'Dynamic require() is not allowed' },\n  { pattern: /import\\s*\\(/g, message: 'Dynamic import() is not allowed' },\n  { pattern: /process\\./g, message: 'Access to process is not allowed' },\n  { pattern: /global\\./g, message: 'Access to global is not allowed' },\n  { pattern: /globalThis\\./g, message: 'Access to globalThis is not allowed' },\n  { pattern: /__dirname/g, message: '__dirname is not allowed' },\n  { pattern: /__filename/g, message: '__filename is not allowed' },\n\n  // File system\n  { pattern: /\\bfs\\b/g, message: 'File system access is not allowed' },\n  { pattern: /\\bpath\\b\\.(?!join|resolve)/g, message: 'Path module access is restricted' },\n\n  // Network\n  { pattern: /\\bhttp\\b/g, message: 'HTTP module is not allowed' },\n  { pattern: /\\bhttps\\b/g, message: 'HTTPS module is not allowed' },\n  { pattern: /\\bnet\\b/g, message: 'Net module is not allowed' },\n  { pattern: /\\bfetch\\s*\\(/g, message: 'fetch() is not allowed in templates' },\n  { pattern: /\\bXMLHttpRequest\\b/g, message: 'XMLHttpRequest is not allowed' },\n\n  // Code execution\n  { pattern: /\\beval\\s*\\(/g, message: 'eval() is not allowed' },\n  { pattern: /\\bFunction\\s*\\(/g, message: 'Function() constructor is not allowed' },\n  { pattern: /\\bsetTimeout\\s*\\(/g, message: 'setTimeout() is not allowed in templates' },\n  { pattern: /\\bsetInterval\\s*\\(/g, message: 'setInterval() is not allowed in templates' },\n\n  // Child processes\n  { pattern: /child_process/g, message: 'child_process is not allowed' },\n  { pattern: /\\bexec\\s*\\(/g, message: 'exec() is not allowed' },\n  { pattern: /\\bspawn\\s*\\(/g, message: 'spawn() is not allowed' },\n];\n\n// ─────────────────────────────────────────────────────────────────────────────\n// SERVICE\n// ─────────────────────────────────────────────────────────────────────────────\n\n@injectable()\nexport class EmailTemplateValidatorBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n  ) {\n    this.logDebug = this.logger.debugByType('EmailTemplateValidatorBackendService');\n    this.logger.setDebugTypeLogging('EmailTemplateValidatorBackendService', false);\n  }\n\n  /**\n   * Validate a TSX template source\n   *\n   * @param tsxSource - The TSX template source code\n   * @returns Validation result with errors and warnings\n   */\n  async validate(tsxSource: string): Promise<TsxValidationResult> {\n    const errors: string[] = [];\n    const warnings: string[] = [];\n\n    this.logDebug('Validating email template TSX source');\n\n    // 1. Check for forbidden patterns\n    const forbiddenErrors = this.checkForbiddenPatterns(tsxSource);\n    errors.push(...forbiddenErrors);\n\n    // 2. Validate imports\n    const importErrors = this.validateImports(tsxSource);\n    errors.push(...importErrors);\n\n    // 3. Validate the filesystem email-template contract shape.\n    const contractErrors = this.validateTemplateContract(tsxSource);\n    errors.push(...contractErrors);\n\n    // 4. Syntax check via ESBuild (basic parse)\n    try {\n      const syntaxResult = await this.checkSyntax(tsxSource);\n      if (!syntaxResult.valid) {\n        errors.push(...syntaxResult.errors);\n      }\n      warnings.push(...syntaxResult.warnings);\n    } catch (err) {\n      const error = err as Error;\n      errors.push(`Syntax error: ${error.message}`);\n    }\n\n    const valid = errors.length === 0;\n\n    if (!valid) {\n      this.logger.warn('Email template validation failed', { errorCount: errors.length, errors });\n    } else {\n      this.logDebug('Email template validation passed', { warningCount: warnings.length });\n    }\n\n    return { valid, errors, warnings };\n  }\n\n  /**\n   * Check for forbidden patterns in the source code\n   */\n  private checkForbiddenPatterns(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    for (const { pattern, message } of FORBIDDEN_PATTERNS) {\n      // Reset regex state\n      pattern.lastIndex = 0;\n      if (pattern.test(tsxSource)) {\n        errors.push(message);\n      }\n    }\n\n    return errors;\n  }\n\n  /**\n   * Validate that all imports are in the allowlist\n   */\n  private validateImports(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    // Match import statements\n    const importRegex = /import\\s+(?:[\\w*{}\\s,]+\\s+from\\s+)?['\"]([^'\"]+)['\"]/g;\n    let match;\n\n    while ((match = importRegex.exec(tsxSource)) !== null) {\n      const importPath = match[1];\n\n      // Check if import is allowed\n      const isAllowed = EMAIL_TEMPLATE_ALLOWED_IMPORTS.some((allowed) => {\n        if (allowed === './labels') {\n          return /^\\.\\/labels\\.[^/'\"]+$/.test(importPath);\n        }\n\n        return importPath === allowed || importPath.startsWith(allowed + '/');\n      });\n\n      if (!isAllowed) {\n        errors.push(`Import from '${importPath}' is not allowed. Allowed imports: ${EMAIL_TEMPLATE_ALLOWED_IMPORTS.join(', ')}`);\n      }\n    }\n\n    return errors;\n  }\n\n  /**\n   * Validate that the source looks like a default-exported EmailTemplateDefinition\n   * object with the required `subject` and `body` members.\n   */\n  private validateTemplateContract(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    if (!/EmailTemplateDefinition(?:<[^>]+>)?/.test(tsxSource)) {\n      errors.push('Generated template must reference EmailTemplateDefinition');\n    }\n\n    if (!/\\bsubject\\s*[:(]/.test(tsxSource)) {\n      errors.push('Generated template must expose a subject member');\n    }\n\n    if (!/\\bbody\\s*[:(]/.test(tsxSource)) {\n      errors.push('Generated template must expose a body member');\n    }\n\n    if (!/export\\s+default\\s+/.test(tsxSource)) {\n      errors.push('Generated template must default-export the template definition');\n    }\n\n    return errors;\n  }\n\n  /**\n   * Check syntax using ESBuild's parser\n   */\n  private async checkSyntax(tsxSource: string): Promise<{ valid: boolean; errors: string[]; warnings: string[] }> {\n    const errors: string[] = [];\n    const warnings: string[] = [];\n\n    try {\n      // Lazy import esbuild\n      const esbuild = await import('esbuild');\n\n      // Transform with TSX loader - this will catch syntax errors\n      const result = await esbuild.transform(tsxSource, {\n        loader: 'tsx',\n        target: 'es2020',\n        jsx: 'automatic',\n        minify: false,\n      });\n\n      // Check for warnings from ESBuild\n      if (result.warnings && result.warnings.length > 0) {\n        for (const warning of result.warnings) {\n          warnings.push(`Line ${warning.location?.line || '?'}: ${warning.text}`);\n        }\n      }\n\n      return { valid: true, errors, warnings };\n    } catch (err) {\n      const error = err as Error & { errors?: Array<{ text: string; location?: { line: number } }> };\n\n      // ESBuild error format\n      if (error.errors && Array.isArray(error.errors)) {\n        for (const e of error.errors) {\n          errors.push(`Line ${e.location?.line || '?'}: ${e.text}`);\n        }\n      } else {\n        errors.push(error.message);\n      }\n\n      return { valid: false, errors, warnings };\n    }\n  }\n\n  /**\n   * Get the list of allowed imports (for LLM context)\n   */\n  getAllowedImports(): string[] {\n    return [...EMAIL_TEMPLATE_ALLOWED_IMPORTS];\n  }\n}\n"]}
+{"version":3,"file":"email-template-validator.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email-template-validator.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAapF,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAa;IACtD,mBAAmB;IACnB,yBAAyB;IACzB,qBAAqB;IACrB,kEAAkE;IAClE,0FAA0F;IAC1F,6FAA6F;IAC7F,gDAAgD;IAChD,EAAE;IACF,8FAA8F;IAC9F,yFAAyF;IACzF,8FAA8F;IAC9F,4FAA4F;IAC5F,0FAA0F;IAC1F,4BAA4B;IAC5B,0EAA0E;IAC1E,4BAA4B;IAC5B,sCAAsC;IACtC,UAAU;IACV,kBAAkB;IAClB,OAAO;CACR,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAgD;IACtE,eAAe;IACf,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACzE,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACvE,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACtE,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACpE,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC5E,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAC9D,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAEhE,cAAc;IACd,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACpE,EAAE,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,kCAAkC,EAAE;IAEvF,UAAU;IACV,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC/D,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,6BAA6B,EAAE;IACjE,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAC7D,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC5E,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,+BAA+B,EAAE;IAE5E,iBAAiB;IACjB,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC7D,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,uCAAuC,EAAE;IACjF,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,0CAA0C,EAAE;IACtF,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,2CAA2C,EAAE;IAExF,kBAAkB;IAClB,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,8BAA8B,EAAE;IACtE,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC7D,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,wBAAwB,EAAE;CAChE,CAAC;AAEF,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAGzE,IAAM,oCAAoC,GAA1C,MAAM,oCAAoC;IAIO;IAH5C,QAAQ,CAA+D;IAEjF,YACsD,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;QAEzE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;IACjF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;QAEtD,kCAAkC;QAClC,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAEhC,sBAAsB;QACtB,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAE7B,4DAA4D;QAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;QAE/B,4CAA4C;QAC5C,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAY,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,SAAiB;QAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,kBAAkB,EAAE,CAAC;YACtD,oBAAoB;YACpB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,SAAiB;QACvC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,0BAA0B;QAC1B,MAAM,WAAW,GAAG,sDAAsD,CAAC;QAC3E,IAAI,KAAK,CAAC;QAEV,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAE5B,6BAA6B;YAC7B,MAAM,SAAS,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChE,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAC3B,OAAO,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAClD,CAAC;gBAED,OAAO,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;YACxE,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,gBAAgB,UAAU,sCAAsC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3H,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAAC,SAAiB;QAChD,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAChF,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CAAC,SAAiB;QACzC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC;YACH,sBAAsB;YACtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YAExC,4DAA4D;YAC5D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE;gBAChD,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,QAAQ;gBAChB,GAAG,EAAE,WAAW;gBAChB,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YAEH,kCAAkC;YAClC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACtC,QAAQ,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAgF,CAAC;YAE/F,uBAAuB;YACvB,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAnLY,oCAAoC;IADhD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;;GAJzB,oCAAoC,CAmLhD","sourcesContent":["/**\n * Email Template Validator Backend Service\n *\n * Validates TSX email templates for security and correctness.\n * Checks for:\n * - Import allowlist compliance\n * - Forbidden patterns (Node.js APIs, dangerous code)\n * - Syntax validation via ESBuild\n */\n\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// TYPES\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface TsxValidationResult {\n  valid: boolean;\n  errors: string[];\n  warnings: string[];\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// CONSTANTS\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Allowed import paths for generated email templates\n * Templates can only import from these modules\n */\nexport const EMAIL_TEMPLATE_ALLOWED_IMPORTS: string[] = [\n  // React Email core\n  '@react-email/components',\n  '@react-email/render',\n  // Our predefined email components. Exported from the package root\n  // (`saas-backend-lib/src/index.ts`) so an application's authored template can import it —\n  // and it is why `InversifyContainer` is aliased there, to avoid the clash with React Email's\n  // own `Container` re-exported from this module.\n  //\n  // NOTE (#475, 2026-09-08): the email-template SANDBOX used to be the thing that resolved this\n  // specifier at runtime, and it was deleted as unreachable. Permitting the import here is\n  // therefore no longer backed by a loader inside the engine; an application template importing\n  // it resolves through its own bundler against the package root export. Keep the entry — the\n  // export is public API — but do not read it as evidence that the engine loads the module.\n  '@wildo-ai/email-components',\n  // App-owned runtime helpers used by the filesystem email template pattern\n  '@wildo-ai/saas-backend-lib',\n  '~backend-api/engine/email/components',\n  './labels',\n  // React (limited)\n  'react',\n];\n\n/**\n * Forbidden patterns that indicate potentially dangerous code\n */\nconst FORBIDDEN_PATTERNS: Array<{ pattern: RegExp; message: string }> = [\n  // Node.js APIs\n  { pattern: /require\\s*\\(/g, message: 'Dynamic require() is not allowed' },\n  { pattern: /import\\s*\\(/g, message: 'Dynamic import() is not allowed' },\n  { pattern: /process\\./g, message: 'Access to process is not allowed' },\n  { pattern: /global\\./g, message: 'Access to global is not allowed' },\n  { pattern: /globalThis\\./g, message: 'Access to globalThis is not allowed' },\n  { pattern: /__dirname/g, message: '__dirname is not allowed' },\n  { pattern: /__filename/g, message: '__filename is not allowed' },\n\n  // File system\n  { pattern: /\\bfs\\b/g, message: 'File system access is not allowed' },\n  { pattern: /\\bpath\\b\\.(?!join|resolve)/g, message: 'Path module access is restricted' },\n\n  // Network\n  { pattern: /\\bhttp\\b/g, message: 'HTTP module is not allowed' },\n  { pattern: /\\bhttps\\b/g, message: 'HTTPS module is not allowed' },\n  { pattern: /\\bnet\\b/g, message: 'Net module is not allowed' },\n  { pattern: /\\bfetch\\s*\\(/g, message: 'fetch() is not allowed in templates' },\n  { pattern: /\\bXMLHttpRequest\\b/g, message: 'XMLHttpRequest is not allowed' },\n\n  // Code execution\n  { pattern: /\\beval\\s*\\(/g, message: 'eval() is not allowed' },\n  { pattern: /\\bFunction\\s*\\(/g, message: 'Function() constructor is not allowed' },\n  { pattern: /\\bsetTimeout\\s*\\(/g, message: 'setTimeout() is not allowed in templates' },\n  { pattern: /\\bsetInterval\\s*\\(/g, message: 'setInterval() is not allowed in templates' },\n\n  // Child processes\n  { pattern: /child_process/g, message: 'child_process is not allowed' },\n  { pattern: /\\bexec\\s*\\(/g, message: 'exec() is not allowed' },\n  { pattern: /\\bspawn\\s*\\(/g, message: 'spawn() is not allowed' },\n];\n\n// ─────────────────────────────────────────────────────────────────────────────\n// SERVICE\n// ─────────────────────────────────────────────────────────────────────────────\n\n@injectable()\nexport class EmailTemplateValidatorBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n  ) {\n    this.logDebug = this.logger.debugByType('EmailTemplateValidatorBackendService');\n    this.logger.setDebugTypeLogging('EmailTemplateValidatorBackendService', false);\n  }\n\n  /**\n   * Validate a TSX template source\n   *\n   * @param tsxSource - The TSX template source code\n   * @returns Validation result with errors and warnings\n   */\n  async validate(tsxSource: string): Promise<TsxValidationResult> {\n    const errors: string[] = [];\n    const warnings: string[] = [];\n\n    this.logDebug('Validating email template TSX source');\n\n    // 1. Check for forbidden patterns\n    const forbiddenErrors = this.checkForbiddenPatterns(tsxSource);\n    errors.push(...forbiddenErrors);\n\n    // 2. Validate imports\n    const importErrors = this.validateImports(tsxSource);\n    errors.push(...importErrors);\n\n    // 3. Validate the filesystem email-template contract shape.\n    const contractErrors = this.validateTemplateContract(tsxSource);\n    errors.push(...contractErrors);\n\n    // 4. Syntax check via ESBuild (basic parse)\n    try {\n      const syntaxResult = await this.checkSyntax(tsxSource);\n      if (!syntaxResult.valid) {\n        errors.push(...syntaxResult.errors);\n      }\n      warnings.push(...syntaxResult.warnings);\n    } catch (err) {\n      const error = err as Error;\n      errors.push(`Syntax error: ${error.message}`);\n    }\n\n    const valid = errors.length === 0;\n\n    if (!valid) {\n      this.logger.warn('Email template validation failed', { errorCount: errors.length, errors });\n    } else {\n      this.logDebug('Email template validation passed', { warningCount: warnings.length });\n    }\n\n    return { valid, errors, warnings };\n  }\n\n  /**\n   * Check for forbidden patterns in the source code\n   */\n  private checkForbiddenPatterns(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    for (const { pattern, message } of FORBIDDEN_PATTERNS) {\n      // Reset regex state\n      pattern.lastIndex = 0;\n      if (pattern.test(tsxSource)) {\n        errors.push(message);\n      }\n    }\n\n    return errors;\n  }\n\n  /**\n   * Validate that all imports are in the allowlist\n   */\n  private validateImports(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    // Match import statements\n    const importRegex = /import\\s+(?:[\\w*{}\\s,]+\\s+from\\s+)?['\"]([^'\"]+)['\"]/g;\n    let match;\n\n    while ((match = importRegex.exec(tsxSource)) !== null) {\n      const importPath = match[1];\n\n      // Check if import is allowed\n      const isAllowed = EMAIL_TEMPLATE_ALLOWED_IMPORTS.some((allowed) => {\n        if (allowed === './labels') {\n          return /^\\.\\/labels\\.[^/'\"]+$/.test(importPath);\n        }\n\n        return importPath === allowed || importPath.startsWith(allowed + '/');\n      });\n\n      if (!isAllowed) {\n        errors.push(`Import from '${importPath}' is not allowed. Allowed imports: ${EMAIL_TEMPLATE_ALLOWED_IMPORTS.join(', ')}`);\n      }\n    }\n\n    return errors;\n  }\n\n  /**\n   * Validate that the source looks like a default-exported EmailTemplateDefinition\n   * object with the required `subject` and `body` members.\n   */\n  private validateTemplateContract(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    if (!/EmailTemplateDefinition(?:<[^>]+>)?/.test(tsxSource)) {\n      errors.push('Generated template must reference EmailTemplateDefinition');\n    }\n\n    if (!/\\bsubject\\s*[:(]/.test(tsxSource)) {\n      errors.push('Generated template must expose a subject member');\n    }\n\n    if (!/\\bbody\\s*[:(]/.test(tsxSource)) {\n      errors.push('Generated template must expose a body member');\n    }\n\n    if (!/export\\s+default\\s+/.test(tsxSource)) {\n      errors.push('Generated template must default-export the template definition');\n    }\n\n    return errors;\n  }\n\n  /**\n   * Check syntax using ESBuild's parser\n   */\n  private async checkSyntax(tsxSource: string): Promise<{ valid: boolean; errors: string[]; warnings: string[] }> {\n    const errors: string[] = [];\n    const warnings: string[] = [];\n\n    try {\n      // Lazy import esbuild\n      const esbuild = await import('esbuild');\n\n      // Transform with TSX loader - this will catch syntax errors\n      const result = await esbuild.transform(tsxSource, {\n        loader: 'tsx',\n        target: 'es2020',\n        jsx: 'automatic',\n        minify: false,\n      });\n\n      // Check for warnings from ESBuild\n      if (result.warnings && result.warnings.length > 0) {\n        for (const warning of result.warnings) {\n          warnings.push(`Line ${warning.location?.line || '?'}: ${warning.text}`);\n        }\n      }\n\n      return { valid: true, errors, warnings };\n    } catch (err) {\n      const error = err as Error & { errors?: Array<{ text: string; location?: { line: number } }> };\n\n      // ESBuild error format\n      if (error.errors && Array.isArray(error.errors)) {\n        for (const e of error.errors) {\n          errors.push(`Line ${e.location?.line || '?'}: ${e.text}`);\n        }\n      } else {\n        errors.push(error.message);\n      }\n\n      return { valid: false, errors, warnings };\n    }\n  }\n\n  /**\n   * Get the list of allowed imports (for LLM context)\n   */\n  getAllowedImports(): string[] {\n    return [...EMAIL_TEMPLATE_ALLOWED_IMPORTS];\n  }\n}\n"]}

package/dist/esm/notifications/email/services/email.backend.service.d.ts

@@ -6,15 +6,46 @@
  * - Context building
  * - React Email rendering (subject fn + body fn → HTML/text)
  * - Provider resolution and HTTP execution
+ *
+ * ## A sent email leaves LOG LINES and nothing else — by decision (#412, 2026-09-08)
+ *
+ * There is no persisted record of a sent email anywhere in the framework: no core resource, no
+ * delivery log, no per-tenant history. **"Did this customer receive it?" is answered with the email
+ * provider's own tooling, never with Wildo.** Say that to anyone who asks for it here, rather than
+ * treating the absence as a gap to be filled.
+ *
+ * It reads as an oversight because the sibling subsystem does the opposite: outbound M2M webhooks
+ * carry a persisted per-tenant delivery log (`ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG` and its
+ * application twin). The asymmetry is deliberate and the reason is not the table — it is that a
+ * persisted email record is a new per-user personal-data store carrying retention policy, privacy
+ * classification, subject-export and erasure obligations FOR MESSAGE CONTENT. A metadata-only
+ * variant (recipient, template, timestamp, provider id; no body) was on the table and declined too,
+ * because it carries the same set of obligations over a smaller payload.
+ *
+ * Reopening this is legitimate, and it starts with the obligations rather than with the schema.
  */
 import type { LoggerService } from '../../../monitoring/logger/services/logger.service';
 import type { ErrorBuilderBackendService } from '../../../errors/services/error-builder.backend.service';
 import type { AppConfigurationService } from '../../../config/services/app-configuration.backend.service';
 import type { ExternalProvidersRegistryBackendService } from '../../../external-providers/services/external-providers-registry.backend.service';
-import type { EmailContextProviderRegistryBackendService } from './email-context-provider-registry.backend.service';
+import type { FilesBackendService } from '../../../files/services/files.backend.service';
 import type { EmailTemplateRegistryBackendService } from './email-template-registry.backend.service';
 import { EmailTemplateContext, EmailTemplateType } from '@wildo-ai/saas-models';
 import { AvailableLanguage } from '@wildo-ai/presets-components-models';
+/**
+ * Total size ceiling for the attachments of ONE email, applied after the bytes are resolved (#429).
+ *
+ * 10 MB, deliberately below every provider ceiling this framework talks to — SendGrid 30 MB,
+ * Mailgun 25 MB, SES 40 MB on the raw message — so an over-size send is refused HERE, naming the
+ * files and the measured total, instead of at a vendor whose rejection an application cannot act
+ * on. Base64 also inflates the wire payload by roughly a third, so a limit set AT a provider's
+ * number would still fail there.
+ *
+ * A constant rather than a config key, until an application needs a different number: a configurable
+ * limit that nothing reads is the exact defect this issue closed, and adding the reader is the
+ * cheaper half of that change.
+ */
+export declare const OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT: number;
 export interface EmailSendRequest {
     /**
      * Stable identity of one logical provider submission. A caller that can
@@ -78,11 +109,11 @@ export declare class EmailBackendService {
     private readonly logger;
     private readonly errorBuilder;
     private readonly templateRegistry;
-    private readonly contextProviderRegistry;
     private readonly configService;
     private readonly externalProvidersRegistry;
+    private readonly filesService;
     protected logDebug: (message: string, context?: Record<string, unknown>) => void;
-    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, templateRegistry: EmailTemplateRegistryBackendService, contextProviderRegistry: EmailContextProviderRegistryBackendService, configService: AppConfigurationService, externalProvidersRegistry: ExternalProvidersRegistryBackendService);
+    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, templateRegistry: EmailTemplateRegistryBackendService, configService: AppConfigurationService, externalProvidersRegistry: ExternalProvidersRegistryBackendService, filesService: FilesBackendService | undefined);
     /**
      * Send an email using a file-based template definition.
      */
@@ -95,6 +126,32 @@ export declare class EmailBackendService {
     private getFallbackLocale;
     private getDesignTokens;
     private resolveEmailProvider;
+    /**
+     * Resolve `attachmentFileIds` to the vendor-neutral `attachments` array several provider adapters
+     * already map (#429).
+     *
+     * Until this existed the field was declared and read by nothing, so a caller supplying an
+     * attachment got a successful send and an attachment-less email. Every refusal below therefore
+     * THROWS: a silent drop is the defect, and error handling that drops quietly is the same defect.
+     *
+     * ## The size cap is the framework's, not a provider's
+     *
+     * {@link OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT} is deliberately below every provider limit this
+     * framework talks to, so the refusal happens HERE — with the file ids and the measured total in
+     * the error — rather than at a vendor that answers with a rejected submission and a message the
+     * application cannot act on. It is a named constant rather than a config key on purpose: an
+     * authored limit nothing read is precisely the class of defect this issue came from, and a
+     * config surface can be added the day an application needs a different number.
+     *
+     * ## What is NOT checked here, and why
+     *
+     * The file TYPE. A file reaching this point has already passed upload-time validation and, where
+     * the field opts into scanning, the scanner — and the status gate inside
+     * `readFilesForOutboundAttachment` admits only what the download route would serve, which
+     * excludes INFECTED. Re-deciding admissible types at send time would be a second policy that can
+     * disagree with the first.
+     */
+    private resolveAttachments;
     private buildEmailRequest;
     private executeProviderRequest;
     private bestEffortParseResponseBody;
@@ -125,6 +182,5 @@ export declare class EmailBackendService {
      * `providerId === '<literal>'` branches.
      */
     private serializeProviderEmailPayload;
-    private createProviderUtils;
 }
 //# sourceMappingURL=email.backend.service.d.ts.map

package/dist/esm/notifications/email/services/email.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAEnH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAKpH,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAC1J,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,mDAAmD,CAAC;AACpH,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,2CAA2C,CAAC;AAErG,OAAO,EACL,oBAAoB,EAEpB,iBAAiB,EAMlB,MAAM,uBAAuB,CAAC;AAgB/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAkBxE,MAAM,WAAW,gBAAgB;IAC/B;;;;MAIE;IACF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,sCAAsC;IACtC,IAAI,EAAE,iBAAiB,CAAC;IACxB,iCAAiC;IACjC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,+BAA+B;IAC/B,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,0DAA0D;IAC1D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,oBAAY,sBAAsB;IAChC,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;CAC1C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,sBAAsB,CAAC;IAChC,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kBAAkB,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAgGD,qBACa,mBAAmB;IAIO,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC1B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa;IACd,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IARzG,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACtC,gBAAgB,EAAE,mCAAmC,EAC9C,uBAAuB,EAAE,0CAA0C,EAC/E,aAAa,EAAE,uBAAuB,EACtB,yBAAyB,EAAE,uCAAuC;IAMlJ;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IA+L/D;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAS9E,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,oBAAoB;IAqG5B,OAAO,CAAC,iBAAiB;YAoCX,sBAAsB;IAwPpC,OAAO,CAAC,2BAA2B;IASnC,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,kCAAkC;IAI1C;;;;;OAKG;YACW,yBAAyB;IAuBvC,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,0BAA0B;IASlC,OAAO,CAAC,uBAAuB;IAQ/B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,yBAAyB;IAuBjC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IA6BrC,OAAO,CAAC,mBAAmB;CAyB5B"}
+{"version":3,"file":"email.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAEnH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAKpH,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAC1J,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AACnG,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,2CAA2C,CAAC;AAErG,OAAO,EACL,oBAAoB,EAEpB,iBAAiB,EAMlB,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAkBxE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qCAAqC,QAAmB,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B;;;;MAIE;IACF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,sCAAsC;IACtC,IAAI,EAAE,iBAAiB,CAAC;IACxB,iCAAiC;IACjC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,+BAA+B;IAC/B,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,0DAA0D;IAC1D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,oBAAY,sBAAsB;IAChC,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;CAC1C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,sBAAsB,CAAC;IAChC,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kBAAkB,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAgGD,qBACa,mBAAmB;IAIO,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa;IACd,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAQ3C,OAAO,CAAC,QAAQ,CAAC,YAAY;IAf3F,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACtC,gBAAgB,EAAE,mCAAmC,EAC1D,aAAa,EAAE,uBAAuB,EACtB,yBAAyB,EAAE,uCAAuC,EAQnE,YAAY,EAAE,mBAAmB,GAAG,SAAS;IAM5H;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IA0L/D;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAS9E,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,oBAAoB;IAqG5B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,kBAAkB;IA2ChC,OAAO,CAAC,iBAAiB;YAwCX,sBAAsB;IAoRpC,OAAO,CAAC,2BAA2B;IASnC,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,kCAAkC;IAI1C;;;;;OAKG;YACW,yBAAyB;IAuBvC,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,0BAA0B;IASlC,OAAO,CAAC,uBAAuB;IAQ/B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,yBAAyB;IAuBjC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;CA6BtC"}

package/dist/esm/notifications/email/services/email.backend.service.js

@@ -6,6 +6,23 @@
  * - Context building
  * - React Email rendering (subject fn + body fn → HTML/text)
  * - Provider resolution and HTTP execution
+ *
+ * ## A sent email leaves LOG LINES and nothing else — by decision (#412, 2026-09-08)
+ *
+ * There is no persisted record of a sent email anywhere in the framework: no core resource, no
+ * delivery log, no per-tenant history. **"Did this customer receive it?" is answered with the email
+ * provider's own tooling, never with Wildo.** Say that to anyone who asks for it here, rather than
+ * treating the absence as a gap to be filled.
+ *
+ * It reads as an oversight because the sibling subsystem does the opposite: outbound M2M webhooks
+ * carry a persisted per-tenant delivery log (`ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG` and its
+ * application twin). The asymmetry is deliberate and the reason is not the table — it is that a
+ * persisted email record is a new per-user personal-data store carrying retention policy, privacy
+ * classification, subject-export and erasure obligations FOR MESSAGE CONTENT. A metadata-only
+ * variant (recipient, template, timestamp, provider id; no body) was on the table and declined too,
+ * because it carries the same set of obligations over a smaller payload.
+ *
+ * Reopening this is legitimate, and it starts with the obligations rather than with the schema.
  */
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -19,7 +36,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { injectable, inject } from 'inversify';
+import { injectable, inject, optional } from 'inversify';
 import { render } from '@react-email/render';
 import { randomUUID } from 'node:crypto';
 import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
@@ -27,7 +44,7 @@ import { describeCaughtError } from '../../../errors/utils/error-log-level-class
 import { getConfiguredFallbackLanguage, getConfiguredPrimaryLanguage, } from '../../../config/services/app-configuration.backend.utils.js';
 import { buildEmailBrandTokensFromConfig } from '../../../notifications/email/utils/color-conversion.utils.js';
 import { EmailTemplateType_ToEngineCapability, ErrorCustomMessageReference, ErrorType, isWildoBackendError, WildoHeaderKeys, } from '@wildo-ai/saas-models';
-import { EmailProviderPayloadEncoding, EmailProviderSubmissionClassification, ExternalProvider_ExchangeProtocol_Kind, StandardEmail_SendRequestSchema, StandardEmail_SendResponseSchema, } from '@wildo-ai/external-connectors-models';
+import { EmailProviderPayloadEncoding, EmailProviderSubmissionClassification, ExternalProvider_ExchangeProtocol_Kind, StandardEmail_SendRequestSchema, StandardEmail_SendResponseSchema, ProviderProtocolRuntimeKind, } from '@wildo-ai/external-connectors-models';
 import { EMAIL_PROVIDER_TRANSPORT_TIMEOUT_MS, } from '../../../notifications/email/models/email-transport.backend.definitions.js';
 // ─────────────────────────────────────────────────────────────────────────────
 // UTILITIES
@@ -36,6 +53,23 @@ function validateEmailAddresses(emails) {
     const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
     return emails.filter(email => !emailRegex.test(email.trim()));
 }
+// ─────────────────────────────────────────────────────────────────────────────
+// TYPES
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Total size ceiling for the attachments of ONE email, applied after the bytes are resolved (#429).
+ *
+ * 10 MB, deliberately below every provider ceiling this framework talks to — SendGrid 30 MB,
+ * Mailgun 25 MB, SES 40 MB on the raw message — so an over-size send is refused HERE, naming the
+ * files and the measured total, instead of at a vendor whose rejection an application cannot act
+ * on. Base64 also inflates the wire payload by roughly a third, so a limit set AT a provider's
+ * number would still fail there.
+ *
+ * A constant rather than a config key, until an application needs a different number: a configurable
+ * limit that nothing reads is the exact defect this issue closed, and adding the reader is the
+ * cheaper half of that change.
+ */
+export const OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT = 10 * 1024 * 1024;
 export var EmailSubmissionOutcome;
 (function (EmailSubmissionOutcome) {
     EmailSubmissionOutcome["NOT_SUBMITTED"] = "not_submitted";
@@ -50,17 +84,17 @@ let EmailBackendService = class EmailBackendService {
     logger;
     errorBuilder;
     templateRegistry;
-    contextProviderRegistry;
     configService;
     externalProvidersRegistry;
+    filesService;
     logDebug;
-    constructor(logger, errorBuilder, templateRegistry, contextProviderRegistry, configService, externalProvidersRegistry) {
+    constructor(logger, errorBuilder, templateRegistry, configService, externalProvidersRegistry, filesService) {
         this.logger = logger;
         this.errorBuilder = errorBuilder;
         this.templateRegistry = templateRegistry;
-        this.contextProviderRegistry = contextProviderRegistry;
         this.configService = configService;
         this.externalProvidersRegistry = externalProvidersRegistry;
+        this.filesService = filesService;
         this.logDebug = this.logger.debugByType('EmailBackendService');
         this.logger.setDebugTypeLogging('EmailBackendService', false);
     }
@@ -101,20 +135,13 @@ let EmailBackendService = class EmailBackendService {
             const resolved = this.templateRegistry.resolve(request.templateRef, request.locale, defaultLocale, this.getFallbackLocale());
             // 2. Get design tokens
             const brandTokens = this.getDesignTokens();
-            // 3. Build additional context from providers
-            const additionalContext = await this.contextProviderRegistry.buildAdditionalContext({
-                templateRef: request.templateRef,
-                locale: request.locale,
-                baseContext: request.context,
-            }, this.createProviderUtils());
-            // 4. Build full context
+            // 3. Build full context
             const fullContext = {
                 currentObject: request.context.currentObject,
                 objectContext: request.context.objectContext,
                 userContext: request.context.userContext,
                 additionalContext: {
                     ...(request.context.additionalContext || {}),
-                    ...additionalContext,
                 },
             };
             // 5. Render subject and body from definition functions
@@ -127,8 +154,12 @@ let EmailBackendService = class EmailBackendService {
             const emailType = resolved.definition.type ?? request.type;
             const engineCapability = EmailTemplateType_ToEngineCapability[emailType];
             const providerConfig = this.resolveEmailProvider(engineCapability);
+            // 6b. Resolve caller-supplied attachments to bytes (#429). Before the request is built,
+            // because a file that cannot be served must refuse the send rather than produce an email
+            // that silently lacks what the caller attached.
+            const attachments = await this.resolveAttachments(request);
             // 7. Build email request
-            const emailRequest = this.buildEmailRequest(request, submissionId, { subject, bodyHtml, bodyText }, providerConfig, recipients);
+            const emailRequest = this.buildEmailRequest(request, submissionId, { subject, bodyHtml, bodyText }, providerConfig, recipients, attachments);
             const providerRequest = providerConfig.delivery === 'network'
                 ? providerConfig.buildSendRequest({
                     request: emailRequest,
@@ -252,7 +283,7 @@ let EmailBackendService = class EmailBackendService {
             throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, { context: { message: `Email provider is disabled by external provider configuration: ${providerId}`, providerId, capability } });
         }
         const emailContract = this.externalProvidersRegistry.getProviderConfiguration(providerId, ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER)?.runtimeContract;
-        if (emailContract?.kind !== 'email') {
+        if (emailContract?.kind !== ProviderProtocolRuntimeKind.EMAIL) {
             throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, { context: { message: `No EMAIL_PROVIDER runtime contract found for provider: ${providerId}`, providerId, capability } });
         }
         const appConfig = this.configService.config;
@@ -305,7 +336,70 @@ let EmailBackendService = class EmailBackendService {
             parseSendResponse: emailContract.parseSendResponse,
         };
     }
-    buildEmailRequest(request, submissionId, rendered, providerConfig, recipients) {
+    /**
+     * Resolve `attachmentFileIds` to the vendor-neutral `attachments` array several provider adapters
+     * already map (#429).
+     *
+     * Until this existed the field was declared and read by nothing, so a caller supplying an
+     * attachment got a successful send and an attachment-less email. Every refusal below therefore
+     * THROWS: a silent drop is the defect, and error handling that drops quietly is the same defect.
+     *
+     * ## The size cap is the framework's, not a provider's
+     *
+     * {@link OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT} is deliberately below every provider limit this
+     * framework talks to, so the refusal happens HERE — with the file ids and the measured total in
+     * the error — rather than at a vendor that answers with a rejected submission and a message the
+     * application cannot act on. It is a named constant rather than a config key on purpose: an
+     * authored limit nothing read is precisely the class of defect this issue came from, and a
+     * config surface can be added the day an application needs a different number.
+     *
+     * ## What is NOT checked here, and why
+     *
+     * The file TYPE. A file reaching this point has already passed upload-time validation and, where
+     * the field opts into scanning, the scanner — and the status gate inside
+     * `readFilesForOutboundAttachment` admits only what the download route would serve, which
+     * excludes INFECTED. Re-deciding admissible types at send time would be a second policy that can
+     * disagree with the first.
+     */
+    async resolveAttachments(request) {
+        const fileIds = request.attachmentFileIds ?? [];
+        if (fileIds.length === 0) {
+            return [];
+        }
+        if (!this.filesService) {
+            throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.CONFIGURATION,
+                context: {
+                    message: 'Email attachments were requested but the files service is not bound',
+                    attachmentCount: fileIds.length,
+                },
+            });
+        }
+        const resolved = await this.filesService.readFilesForOutboundAttachment(fileIds, {
+            applicationId: this.configService.applicationId ?? undefined,
+            // The tenancy confinement. An organization-scoped send reaches only that organization's
+            // files; a send without one reaches only application-scoped files.
+            ...(request.organizationId ? { organizationId: request.organizationId } : {}),
+        });
+        const totalBytes = resolved.reduce((total, file) => total + file.bytes.byteLength, 0);
+        if (totalBytes > OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT) {
+            throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                context: {
+                    message: 'Email attachments exceed the outbound total-size limit',
+                    totalBytes,
+                    limitBytes: OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT,
+                    fileIds: resolved.map((file) => file.fileId),
+                },
+            });
+        }
+        return resolved.map((file) => ({
+            filename: file.filename,
+            content: file.bytes.toString('base64'),
+            contentType: file.mimeType,
+        }));
+    }
+    buildEmailRequest(request, submissionId, rendered, providerConfig, recipients, attachments) {
         const toAddresses = recipients.map(email => ({ email }));
         // From-address precedence: per-send override → per-provider config
         // (`providerConfigurations.<provider>.EMAIL_PROVIDER.fromAddress`) → the
@@ -330,6 +424,9 @@ let EmailBackendService = class EmailBackendService {
             subject: rendered.subject,
             html: rendered.bodyHtml,
             text: rendered.bodyText,
+            // Omitted rather than sent empty: the field is optional on the vendor-neutral contract and
+            // several adapters branch on its presence.
+            ...(attachments.length > 0 ? { attachments } : {}),
         });
     }
     async executeProviderRequest(providerConfig, request, providerRequest, onTransportStart) {
@@ -349,6 +446,34 @@ let EmailBackendService = class EmailBackendService {
                 bcc: request.bcc?.map(recipient => recipient.email),
                 subject: request.subject,
                 textPreview: request.text?.slice(0, 2000),
+                /*
+                 * DERIVED FACTS ABOUT THE HTML, never the HTML itself (#522).
+                 *
+                 * This provider is how a developer sees a local send, and it surfaced a TEXT preview only —
+                 * so anything that exists only in the HTML was invisible here. A brand logo is an `<img>`,
+                 * which is a fair part of why ninety-five templates rendered none without anyone noticing.
+                 *
+                 * The body is not logged. That is the same rule the attachment line below already follows —
+                 * names, never the bytes — and a full HTML email in a log line would be both unreadable and
+                 * a place for personal data to accumulate. `imageCount` is the smallest fact that tells the
+                 * two cases apart, which is all the dev loop needs: 0 where a logo did not resolve, 1 where
+                 * it did.
+                 *
+                 * Writing the rendered HTML to a FILE a developer can open is the better surface and is a
+                 * real decision — where it lives, who removes it, and which environments produce it — so it
+                 * is recorded rather than invented inside a provider branch.
+                 */
+                htmlBytes: request.html === undefined ? undefined : Buffer.byteLength(request.html, 'utf8'),
+                imageCount: request.html === undefined ? undefined : (request.html.match(/<img\b/gi) ?? []).length,
+                // Names only, never the bytes (#429). The log-delivery provider is how a developer sees a
+                // local send, so an attachment that resolved has to be visible here — otherwise the dev
+                // loop looks identical whether the resolution worked or silently produced nothing, which
+                // is the failure this whole path exists to remove.
+                attachments: request.attachments?.map((attachment) => ({
+                    filename: attachment.filename,
+                    contentType: attachment.contentType,
+                    bytes: Buffer.from(attachment.content, 'base64').byteLength,
+                })),
             });
             return {
                 outcome: EmailSubmissionOutcome.PROVIDER_ACCEPTED,
@@ -644,39 +769,16 @@ let EmailBackendService = class EmailBackendService {
             ? { ...payload, key: providerConfig.apiKey }
             : payload);
     }
-    // Per-provider payload building lives in the provider module's
-    // `runtimeContract.buildSendRequest` (one of the six EMAIL_PROVIDER
-    // backend modules). The email service no longer branches on provider id.
-    createProviderUtils() {
-        return {
-            getRepository: (resourceType) => {
-                throw new Error(`getRepository('${resourceType}') is not available in the email context provider. Inject repository data via additionalContext instead.`);
-            },
-            logger: {
-                debug: (message, meta) => this.logger.debug(message, meta),
-                info: (message, meta) => this.logger.info(message, meta),
-                warn: (message, meta) => this.logger.warn(message, meta),
-                error: (message, meta) => this.logger.error(message, meta),
-            },
-            errorBuilder: {
-                buildError: (type, message, details) => {
-                    const err = new Error(message);
-                    err.type = type;
-                    err.details = details;
-                    return err;
-                },
-            },
-        };
-    }
 };
 EmailBackendService = __decorate([
     injectable(),
     __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
     __param(1, inject(SAAS_SERVICE_TYPES.ErrorBuilderService)),
     __param(2, inject(SAAS_SERVICE_TYPES.EmailTemplateRegistry)),
-    __param(3, inject(SAAS_SERVICE_TYPES.EmailContextProviderRegistry)),
-    __param(4, inject(SAAS_SERVICE_TYPES.AppConfigService)),
-    __param(5, inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService)),
+    __param(3, inject(SAAS_SERVICE_TYPES.AppConfigService)),
+    __param(4, inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService)),
+    __param(5, inject(SAAS_SERVICE_TYPES.FilesBackendService)),
+    __param(5, optional()),
     __metadata("design:paramtypes", [Function, Function, Function, Function, Function, Function])
 ], EmailBackendService);
 export { EmailBackendService };