@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/notifications/email/services/email-template-validator.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-template-validator.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email-template-validator.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAapF,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAa;IACtD,mBAAmB;IACnB,yBAAyB;IACzB,qBAAqB;IACrB,kCAAkC;IAClC,4BAA4B;IAC5B,0EAA0E;IAC1E,4BAA4B;IAC5B,sCAAsC;IACtC,UAAU;IACV,kBAAkB;IAClB,OAAO;CACR,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAgD;IACtE,eAAe;IACf,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACzE,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACvE,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACtE,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACpE,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC5E,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAC9D,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAEhE,cAAc;IACd,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACpE,EAAE,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,kCAAkC,EAAE;IAEvF,UAAU;IACV,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC/D,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,6BAA6B,EAAE;IACjE,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAC7D,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC5E,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,+BAA+B,EAAE;IAE5E,iBAAiB;IACjB,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC7D,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,uCAAuC,EAAE;IACjF,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,0CAA0C,EAAE;IACtF,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,2CAA2C,EAAE;IAExF,kBAAkB;IAClB,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,8BAA8B,EAAE;IACtE,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC7D,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,wBAAwB,EAAE;CAChE,CAAC;AAEF,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAGzE,IAAM,oCAAoC,GAA1C,MAAM,oCAAoC;IAIO;IAH5C,QAAQ,CAA+D;IAEjF,YACsD,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;QAEzE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;IACjF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;QAEtD,kCAAkC;QAClC,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAEhC,sBAAsB;QACtB,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAE7B,4DAA4D;QAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;QAE/B,4CAA4C;QAC5C,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAY,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,SAAiB;QAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,kBAAkB,EAAE,CAAC;YACtD,oBAAoB;YACpB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,SAAiB;QACvC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,0BAA0B;QAC1B,MAAM,WAAW,GAAG,sDAAsD,CAAC;QAC3E,IAAI,KAAK,CAAC;QAEV,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAE5B,6BAA6B;YAC7B,MAAM,SAAS,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChE,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAC3B,OAAO,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAClD,CAAC;gBAED,OAAO,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;YACxE,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,gBAAgB,UAAU,sCAAsC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3H,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAAC,SAAiB;QAChD,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAChF,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CAAC,SAAiB;QACzC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC;YACH,sBAAsB;YACtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YAExC,4DAA4D;YAC5D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE;gBAChD,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,QAAQ;gBAChB,GAAG,EAAE,WAAW;gBAChB,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YAEH,kCAAkC;YAClC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACtC,QAAQ,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAgF,CAAC;YAE/F,uBAAuB;YACvB,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAnLY,oCAAoC;IADhD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;;GAJzB,oCAAoC,CAmLhD","sourcesContent":["/**\n * Email Template Validator Backend Service\n *\n * Validates TSX email templates for security and correctness.\n * Checks for:\n * - Import allowlist compliance\n * - Forbidden patterns (Node.js APIs, dangerous code)\n * - Syntax validation via ESBuild\n */\n\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// TYPES\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface TsxValidationResult {\n  valid: boolean;\n  errors: string[];\n  warnings: string[];\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// CONSTANTS\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Allowed import paths for generated email templates\n * Templates can only import from these modules\n */\nexport const EMAIL_TEMPLATE_ALLOWED_IMPORTS: string[] = [\n  // React Email core\n  '@react-email/components',\n  '@react-email/render',\n  // Our predefined email components\n  '@wildo-ai/email-components',\n  // App-owned runtime helpers used by the filesystem email template pattern\n  '@wildo-ai/saas-backend-lib',\n  '~backend-api/engine/email/components',\n  './labels',\n  // React (limited)\n  'react',\n];\n\n/**\n * Forbidden patterns that indicate potentially dangerous code\n */\nconst FORBIDDEN_PATTERNS: Array<{ pattern: RegExp; message: string }> = [\n  // Node.js APIs\n  { pattern: /require\\s*\\(/g, message: 'Dynamic require() is not allowed' },\n  { pattern: /import\\s*\\(/g, message: 'Dynamic import() is not allowed' },\n  { pattern: /process\\./g, message: 'Access to process is not allowed' },\n  { pattern: /global\\./g, message: 'Access to global is not allowed' },\n  { pattern: /globalThis\\./g, message: 'Access to globalThis is not allowed' },\n  { pattern: /__dirname/g, message: '__dirname is not allowed' },\n  { pattern: /__filename/g, message: '__filename is not allowed' },\n\n  // File system\n  { pattern: /\\bfs\\b/g, message: 'File system access is not allowed' },\n  { pattern: /\\bpath\\b\\.(?!join|resolve)/g, message: 'Path module access is restricted' },\n\n  // Network\n  { pattern: /\\bhttp\\b/g, message: 'HTTP module is not allowed' },\n  { pattern: /\\bhttps\\b/g, message: 'HTTPS module is not allowed' },\n  { pattern: /\\bnet\\b/g, message: 'Net module is not allowed' },\n  { pattern: /\\bfetch\\s*\\(/g, message: 'fetch() is not allowed in templates' },\n  { pattern: /\\bXMLHttpRequest\\b/g, message: 'XMLHttpRequest is not allowed' },\n\n  // Code execution\n  { pattern: /\\beval\\s*\\(/g, message: 'eval() is not allowed' },\n  { pattern: /\\bFunction\\s*\\(/g, message: 'Function() constructor is not allowed' },\n  { pattern: /\\bsetTimeout\\s*\\(/g, message: 'setTimeout() is not allowed in templates' },\n  { pattern: /\\bsetInterval\\s*\\(/g, message: 'setInterval() is not allowed in templates' },\n\n  // Child processes\n  { pattern: /child_process/g, message: 'child_process is not allowed' },\n  { pattern: /\\bexec\\s*\\(/g, message: 'exec() is not allowed' },\n  { pattern: /\\bspawn\\s*\\(/g, message: 'spawn() is not allowed' },\n];\n\n// ─────────────────────────────────────────────────────────────────────────────\n// SERVICE\n// ─────────────────────────────────────────────────────────────────────────────\n\n@injectable()\nexport class EmailTemplateValidatorBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n  ) {\n    this.logDebug = this.logger.debugByType('EmailTemplateValidatorBackendService');\n    this.logger.setDebugTypeLogging('EmailTemplateValidatorBackendService', false);\n  }\n\n  /**\n   * Validate a TSX template source\n   *\n   * @param tsxSource - The TSX template source code\n   * @returns Validation result with errors and warnings\n   */\n  async validate(tsxSource: string): Promise<TsxValidationResult> {\n    const errors: string[] = [];\n    const warnings: string[] = [];\n\n    this.logDebug('Validating email template TSX source');\n\n    // 1. Check for forbidden patterns\n    const forbiddenErrors = this.checkForbiddenPatterns(tsxSource);\n    errors.push(...forbiddenErrors);\n\n    // 2. Validate imports\n    const importErrors = this.validateImports(tsxSource);\n    errors.push(...importErrors);\n\n    // 3. Validate the filesystem email-template contract shape.\n    const contractErrors = this.validateTemplateContract(tsxSource);\n    errors.push(...contractErrors);\n\n    // 4. Syntax check via ESBuild (basic parse)\n    try {\n      const syntaxResult = await this.checkSyntax(tsxSource);\n      if (!syntaxResult.valid) {\n        errors.push(...syntaxResult.errors);\n      }\n      warnings.push(...syntaxResult.warnings);\n    } catch (err) {\n      const error = err as Error;\n      errors.push(`Syntax error: ${error.message}`);\n    }\n\n    const valid = errors.length === 0;\n\n    if (!valid) {\n      this.logger.warn('Email template validation failed', { errorCount: errors.length, errors });\n    } else {\n      this.logDebug('Email template validation passed', { warningCount: warnings.length });\n    }\n\n    return { valid, errors, warnings };\n  }\n\n  /**\n   * Check for forbidden patterns in the source code\n   */\n  private checkForbiddenPatterns(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    for (const { pattern, message } of FORBIDDEN_PATTERNS) {\n      // Reset regex state\n      pattern.lastIndex = 0;\n      if (pattern.test(tsxSource)) {\n        errors.push(message);\n      }\n    }\n\n    return errors;\n  }\n\n  /**\n   * Validate that all imports are in the allowlist\n   */\n  private validateImports(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    // Match import statements\n    const importRegex = /import\\s+(?:[\\w*{}\\s,]+\\s+from\\s+)?['\"]([^'\"]+)['\"]/g;\n    let match;\n\n    while ((match = importRegex.exec(tsxSource)) !== null) {\n      const importPath = match[1];\n\n      // Check if import is allowed\n      const isAllowed = EMAIL_TEMPLATE_ALLOWED_IMPORTS.some((allowed) => {\n        if (allowed === './labels') {\n          return /^\\.\\/labels\\.[^/'\"]+$/.test(importPath);\n        }\n\n        return importPath === allowed || importPath.startsWith(allowed + '/');\n      });\n\n      if (!isAllowed) {\n        errors.push(`Import from '${importPath}' is not allowed. Allowed imports: ${EMAIL_TEMPLATE_ALLOWED_IMPORTS.join(', ')}`);\n      }\n    }\n\n    return errors;\n  }\n\n  /**\n   * Validate that the source looks like a default-exported EmailTemplateDefinition\n   * object with the required `subject` and `body` members.\n   */\n  private validateTemplateContract(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    if (!/EmailTemplateDefinition(?:<[^>]+>)?/.test(tsxSource)) {\n      errors.push('Generated template must reference EmailTemplateDefinition');\n    }\n\n    if (!/\\bsubject\\s*[:(]/.test(tsxSource)) {\n      errors.push('Generated template must expose a subject member');\n    }\n\n    if (!/\\bbody\\s*[:(]/.test(tsxSource)) {\n      errors.push('Generated template must expose a body member');\n    }\n\n    if (!/export\\s+default\\s+/.test(tsxSource)) {\n      errors.push('Generated template must default-export the template definition');\n    }\n\n    return errors;\n  }\n\n  /**\n   * Check syntax using ESBuild's parser\n   */\n  private async checkSyntax(tsxSource: string): Promise<{ valid: boolean; errors: string[]; warnings: string[] }> {\n    const errors: string[] = [];\n    const warnings: string[] = [];\n\n    try {\n      // Lazy import esbuild\n      const esbuild = await import('esbuild');\n\n      // Transform with TSX loader - this will catch syntax errors\n      const result = await esbuild.transform(tsxSource, {\n        loader: 'tsx',\n        target: 'es2020',\n        jsx: 'automatic',\n        minify: false,\n      });\n\n      // Check for warnings from ESBuild\n      if (result.warnings && result.warnings.length > 0) {\n        for (const warning of result.warnings) {\n          warnings.push(`Line ${warning.location?.line || '?'}: ${warning.text}`);\n        }\n      }\n\n      return { valid: true, errors, warnings };\n    } catch (err) {\n      const error = err as Error & { errors?: Array<{ text: string; location?: { line: number } }> };\n\n      // ESBuild error format\n      if (error.errors && Array.isArray(error.errors)) {\n        for (const e of error.errors) {\n          errors.push(`Line ${e.location?.line || '?'}: ${e.text}`);\n        }\n      } else {\n        errors.push(error.message);\n      }\n\n      return { valid: false, errors, warnings };\n    }\n  }\n\n  /**\n   * Get the list of allowed imports (for LLM context)\n   */\n  getAllowedImports(): string[] {\n    return [...EMAIL_TEMPLATE_ALLOWED_IMPORTS];\n  }\n}\n"]}
+{"version":3,"file":"email-template-validator.backend.service.js","sourceRoot":"","sources":["../../../../../src/notifications/email/services/email-template-validator.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAapF,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAa;IACtD,mBAAmB;IACnB,yBAAyB;IACzB,qBAAqB;IACrB,kEAAkE;IAClE,0FAA0F;IAC1F,6FAA6F;IAC7F,gDAAgD;IAChD,EAAE;IACF,8FAA8F;IAC9F,yFAAyF;IACzF,8FAA8F;IAC9F,4FAA4F;IAC5F,0FAA0F;IAC1F,4BAA4B;IAC5B,0EAA0E;IAC1E,4BAA4B;IAC5B,sCAAsC;IACtC,UAAU;IACV,kBAAkB;IAClB,OAAO;CACR,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAgD;IACtE,eAAe;IACf,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACzE,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACvE,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACtE,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACpE,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC5E,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAC9D,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAEhE,cAAc;IACd,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACpE,EAAE,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,kCAAkC,EAAE;IAEvF,UAAU;IACV,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC/D,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,6BAA6B,EAAE;IACjE,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAC7D,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC5E,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,+BAA+B,EAAE;IAE5E,iBAAiB;IACjB,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC7D,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,uCAAuC,EAAE;IACjF,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,0CAA0C,EAAE;IACtF,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,2CAA2C,EAAE;IAExF,kBAAkB;IAClB,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,8BAA8B,EAAE;IACtE,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC7D,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,wBAAwB,EAAE;CAChE,CAAC;AAEF,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAGzE,IAAM,oCAAoC,GAA1C,MAAM,oCAAoC;IAIO;IAH5C,QAAQ,CAA+D;IAEjF,YACsD,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;QAEzE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;IACjF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;QAEtD,kCAAkC;QAClC,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAEhC,sBAAsB;QACtB,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAE7B,4DAA4D;QAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;QAE/B,4CAA4C;QAC5C,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAY,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,SAAiB;QAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,kBAAkB,EAAE,CAAC;YACtD,oBAAoB;YACpB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,SAAiB;QACvC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,0BAA0B;QAC1B,MAAM,WAAW,GAAG,sDAAsD,CAAC;QAC3E,IAAI,KAAK,CAAC;QAEV,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAE5B,6BAA6B;YAC7B,MAAM,SAAS,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChE,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAC3B,OAAO,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAClD,CAAC;gBAED,OAAO,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;YACxE,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,gBAAgB,UAAU,sCAAsC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3H,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAAC,SAAiB;QAChD,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAChF,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CAAC,SAAiB;QACzC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC;YACH,sBAAsB;YACtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YAExC,4DAA4D;YAC5D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE;gBAChD,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,QAAQ;gBAChB,GAAG,EAAE,WAAW;gBAChB,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YAEH,kCAAkC;YAClC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACtC,QAAQ,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAgF,CAAC;YAE/F,uBAAuB;YACvB,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAnLY,oCAAoC;IADhD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;;GAJzB,oCAAoC,CAmLhD","sourcesContent":["/**\n * Email Template Validator Backend Service\n *\n * Validates TSX email templates for security and correctness.\n * Checks for:\n * - Import allowlist compliance\n * - Forbidden patterns (Node.js APIs, dangerous code)\n * - Syntax validation via ESBuild\n */\n\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// TYPES\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface TsxValidationResult {\n  valid: boolean;\n  errors: string[];\n  warnings: string[];\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// CONSTANTS\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Allowed import paths for generated email templates\n * Templates can only import from these modules\n */\nexport const EMAIL_TEMPLATE_ALLOWED_IMPORTS: string[] = [\n  // React Email core\n  '@react-email/components',\n  '@react-email/render',\n  // Our predefined email components. Exported from the package root\n  // (`saas-backend-lib/src/index.ts`) so an application's authored template can import it —\n  // and it is why `InversifyContainer` is aliased there, to avoid the clash with React Email's\n  // own `Container` re-exported from this module.\n  //\n  // NOTE (#475, 2026-09-08): the email-template SANDBOX used to be the thing that resolved this\n  // specifier at runtime, and it was deleted as unreachable. Permitting the import here is\n  // therefore no longer backed by a loader inside the engine; an application template importing\n  // it resolves through its own bundler against the package root export. Keep the entry — the\n  // export is public API — but do not read it as evidence that the engine loads the module.\n  '@wildo-ai/email-components',\n  // App-owned runtime helpers used by the filesystem email template pattern\n  '@wildo-ai/saas-backend-lib',\n  '~backend-api/engine/email/components',\n  './labels',\n  // React (limited)\n  'react',\n];\n\n/**\n * Forbidden patterns that indicate potentially dangerous code\n */\nconst FORBIDDEN_PATTERNS: Array<{ pattern: RegExp; message: string }> = [\n  // Node.js APIs\n  { pattern: /require\\s*\\(/g, message: 'Dynamic require() is not allowed' },\n  { pattern: /import\\s*\\(/g, message: 'Dynamic import() is not allowed' },\n  { pattern: /process\\./g, message: 'Access to process is not allowed' },\n  { pattern: /global\\./g, message: 'Access to global is not allowed' },\n  { pattern: /globalThis\\./g, message: 'Access to globalThis is not allowed' },\n  { pattern: /__dirname/g, message: '__dirname is not allowed' },\n  { pattern: /__filename/g, message: '__filename is not allowed' },\n\n  // File system\n  { pattern: /\\bfs\\b/g, message: 'File system access is not allowed' },\n  { pattern: /\\bpath\\b\\.(?!join|resolve)/g, message: 'Path module access is restricted' },\n\n  // Network\n  { pattern: /\\bhttp\\b/g, message: 'HTTP module is not allowed' },\n  { pattern: /\\bhttps\\b/g, message: 'HTTPS module is not allowed' },\n  { pattern: /\\bnet\\b/g, message: 'Net module is not allowed' },\n  { pattern: /\\bfetch\\s*\\(/g, message: 'fetch() is not allowed in templates' },\n  { pattern: /\\bXMLHttpRequest\\b/g, message: 'XMLHttpRequest is not allowed' },\n\n  // Code execution\n  { pattern: /\\beval\\s*\\(/g, message: 'eval() is not allowed' },\n  { pattern: /\\bFunction\\s*\\(/g, message: 'Function() constructor is not allowed' },\n  { pattern: /\\bsetTimeout\\s*\\(/g, message: 'setTimeout() is not allowed in templates' },\n  { pattern: /\\bsetInterval\\s*\\(/g, message: 'setInterval() is not allowed in templates' },\n\n  // Child processes\n  { pattern: /child_process/g, message: 'child_process is not allowed' },\n  { pattern: /\\bexec\\s*\\(/g, message: 'exec() is not allowed' },\n  { pattern: /\\bspawn\\s*\\(/g, message: 'spawn() is not allowed' },\n];\n\n// ─────────────────────────────────────────────────────────────────────────────\n// SERVICE\n// ─────────────────────────────────────────────────────────────────────────────\n\n@injectable()\nexport class EmailTemplateValidatorBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n  ) {\n    this.logDebug = this.logger.debugByType('EmailTemplateValidatorBackendService');\n    this.logger.setDebugTypeLogging('EmailTemplateValidatorBackendService', false);\n  }\n\n  /**\n   * Validate a TSX template source\n   *\n   * @param tsxSource - The TSX template source code\n   * @returns Validation result with errors and warnings\n   */\n  async validate(tsxSource: string): Promise<TsxValidationResult> {\n    const errors: string[] = [];\n    const warnings: string[] = [];\n\n    this.logDebug('Validating email template TSX source');\n\n    // 1. Check for forbidden patterns\n    const forbiddenErrors = this.checkForbiddenPatterns(tsxSource);\n    errors.push(...forbiddenErrors);\n\n    // 2. Validate imports\n    const importErrors = this.validateImports(tsxSource);\n    errors.push(...importErrors);\n\n    // 3. Validate the filesystem email-template contract shape.\n    const contractErrors = this.validateTemplateContract(tsxSource);\n    errors.push(...contractErrors);\n\n    // 4. Syntax check via ESBuild (basic parse)\n    try {\n      const syntaxResult = await this.checkSyntax(tsxSource);\n      if (!syntaxResult.valid) {\n        errors.push(...syntaxResult.errors);\n      }\n      warnings.push(...syntaxResult.warnings);\n    } catch (err) {\n      const error = err as Error;\n      errors.push(`Syntax error: ${error.message}`);\n    }\n\n    const valid = errors.length === 0;\n\n    if (!valid) {\n      this.logger.warn('Email template validation failed', { errorCount: errors.length, errors });\n    } else {\n      this.logDebug('Email template validation passed', { warningCount: warnings.length });\n    }\n\n    return { valid, errors, warnings };\n  }\n\n  /**\n   * Check for forbidden patterns in the source code\n   */\n  private checkForbiddenPatterns(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    for (const { pattern, message } of FORBIDDEN_PATTERNS) {\n      // Reset regex state\n      pattern.lastIndex = 0;\n      if (pattern.test(tsxSource)) {\n        errors.push(message);\n      }\n    }\n\n    return errors;\n  }\n\n  /**\n   * Validate that all imports are in the allowlist\n   */\n  private validateImports(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    // Match import statements\n    const importRegex = /import\\s+(?:[\\w*{}\\s,]+\\s+from\\s+)?['\"]([^'\"]+)['\"]/g;\n    let match;\n\n    while ((match = importRegex.exec(tsxSource)) !== null) {\n      const importPath = match[1];\n\n      // Check if import is allowed\n      const isAllowed = EMAIL_TEMPLATE_ALLOWED_IMPORTS.some((allowed) => {\n        if (allowed === './labels') {\n          return /^\\.\\/labels\\.[^/'\"]+$/.test(importPath);\n        }\n\n        return importPath === allowed || importPath.startsWith(allowed + '/');\n      });\n\n      if (!isAllowed) {\n        errors.push(`Import from '${importPath}' is not allowed. Allowed imports: ${EMAIL_TEMPLATE_ALLOWED_IMPORTS.join(', ')}`);\n      }\n    }\n\n    return errors;\n  }\n\n  /**\n   * Validate that the source looks like a default-exported EmailTemplateDefinition\n   * object with the required `subject` and `body` members.\n   */\n  private validateTemplateContract(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    if (!/EmailTemplateDefinition(?:<[^>]+>)?/.test(tsxSource)) {\n      errors.push('Generated template must reference EmailTemplateDefinition');\n    }\n\n    if (!/\\bsubject\\s*[:(]/.test(tsxSource)) {\n      errors.push('Generated template must expose a subject member');\n    }\n\n    if (!/\\bbody\\s*[:(]/.test(tsxSource)) {\n      errors.push('Generated template must expose a body member');\n    }\n\n    if (!/export\\s+default\\s+/.test(tsxSource)) {\n      errors.push('Generated template must default-export the template definition');\n    }\n\n    return errors;\n  }\n\n  /**\n   * Check syntax using ESBuild's parser\n   */\n  private async checkSyntax(tsxSource: string): Promise<{ valid: boolean; errors: string[]; warnings: string[] }> {\n    const errors: string[] = [];\n    const warnings: string[] = [];\n\n    try {\n      // Lazy import esbuild\n      const esbuild = await import('esbuild');\n\n      // Transform with TSX loader - this will catch syntax errors\n      const result = await esbuild.transform(tsxSource, {\n        loader: 'tsx',\n        target: 'es2020',\n        jsx: 'automatic',\n        minify: false,\n      });\n\n      // Check for warnings from ESBuild\n      if (result.warnings && result.warnings.length > 0) {\n        for (const warning of result.warnings) {\n          warnings.push(`Line ${warning.location?.line || '?'}: ${warning.text}`);\n        }\n      }\n\n      return { valid: true, errors, warnings };\n    } catch (err) {\n      const error = err as Error & { errors?: Array<{ text: string; location?: { line: number } }> };\n\n      // ESBuild error format\n      if (error.errors && Array.isArray(error.errors)) {\n        for (const e of error.errors) {\n          errors.push(`Line ${e.location?.line || '?'}: ${e.text}`);\n        }\n      } else {\n        errors.push(error.message);\n      }\n\n      return { valid: false, errors, warnings };\n    }\n  }\n\n  /**\n   * Get the list of allowed imports (for LLM context)\n   */\n  getAllowedImports(): string[] {\n    return [...EMAIL_TEMPLATE_ALLOWED_IMPORTS];\n  }\n}\n"]}

package/dist/esm/notifications/email/services/email.backend.service.d.ts

@@ -6,15 +6,88 @@
  * - Context building
  * - React Email rendering (subject fn + body fn → HTML/text)
  * - Provider resolution and HTTP execution
+ *
+ * ## A sent email leaves LOG LINES and nothing else — by decision (#412, 2026-09-08)
+ *
+ * There is no persisted record of a sent email anywhere in the framework: no core resource, no
+ * delivery log, no per-tenant history. **"Did this customer receive it?" is answered with the email
+ * provider's own tooling, never with Wildo.** Say that to anyone who asks for it here, rather than
+ * treating the absence as a gap to be filled.
+ *
+ * It reads as an oversight because the sibling subsystem does the opposite: outbound M2M webhooks
+ * carry a persisted per-tenant delivery log (`ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG` and its
+ * application twin). The asymmetry is deliberate and the reason is not the table — it is that a
+ * persisted email record is a new per-user personal-data store carrying retention policy, privacy
+ * classification, subject-export and erasure obligations FOR MESSAGE CONTENT. A metadata-only
+ * variant (recipient, template, timestamp, provider id; no body) was on the table and declined too,
+ * because it carries the same set of obligations over a smaller payload.
+ *
+ * Reopening this is legitimate, and it starts with the obligations rather than with the schema.
  */
 import type { LoggerService } from '../../../monitoring/logger/services/logger.service';
 import type { ErrorBuilderBackendService } from '../../../errors/services/error-builder.backend.service';
 import type { AppConfigurationService } from '../../../config/services/app-configuration.backend.service';
 import type { ExternalProvidersRegistryBackendService } from '../../../external-providers/services/external-providers-registry.backend.service';
-import type { EmailContextProviderRegistryBackendService } from './email-context-provider-registry.backend.service';
+import type { FilesBackendService } from '../../../files/services/files.backend.service';
 import type { EmailTemplateRegistryBackendService } from './email-template-registry.backend.service';
 import { EmailTemplateContext, EmailTemplateType } from '@wildo-ai/saas-models';
+import type { EmailProviderPublishedEnvelope } from '@wildo-ai/external-connectors-private/backend';
 import { AvailableLanguage } from '@wildo-ai/presets-components-models';
+/**
+ * Total size ceiling for the attachments of ONE email, applied after the bytes are resolved (#429).
+ *
+ * 10 MB, deliberately below every provider ceiling this framework talks to, so an over-size send is
+ * refused HERE — naming the files and the measured total — instead of at a vendor whose rejection an
+ * application cannot act on. Base64 also inflates the wire payload by roughly a third, so a limit set
+ * AT a provider's number would still fail there.
+ *
+ * ## That claim is now CHECKED, and it used to be three numbers from memory
+ *
+ * This paragraph named "SendGrid 30 MB, Mailgun 25 MB, SES 40 MB" with no source — and this framework
+ * ships no SES provider, so one of the three was about a vendor nothing here talks to. Each shipped
+ * email provider now DECLARES its vendor's published envelope beside a mandatory `source`
+ * (`BackendProviderModule.emailEnvelope`), and `email-provider-envelope-ceiling.test.ts` asserts this
+ * constant is strictly below every declared ceiling.
+ *
+ * So the sentence above is an invariant rather than a recollection: adding a provider whose vendor
+ * publishes a tighter envelope than 10 MB fails a test here, instead of failing at that vendor on a
+ * customer's send.
+ *
+ * A constant rather than a config key, until an application needs a different number: a configurable
+ * limit that nothing reads is the exact defect this issue closed, and adding the reader is the
+ * cheaper half of that change.
+ */
+export declare const OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT: number;
+/**
+ * The attachment ceiling for one resolved provider: the tighter of the engine default and the
+ * vendor's own published envelope.
+ *
+ * ## Why this is not simply the engine default
+ *
+ * The default's whole purpose is that an over-size send is refused HERE rather than at a vendor
+ * whose rejection an application cannot act on — and that only holds while the number is genuinely
+ * under every vendor's ceiling. It was not. `OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT` is 10 MB and
+ * **Brevo publishes 4 MB**, so an application on Brevo could pass the engine's check and be refused
+ * by the vendor: precisely the outcome the constant exists to prevent, for as long as the constant
+ * was calibrated against three vendors named from memory in a comment.
+ *
+ * Lowering the flat number to Brevo's would have punished every other provider for one vendor's
+ * envelope, so the ceiling is per-provider and the default is the FLOOR under providers that
+ * publish nothing.
+ *
+ * ## Both published ceilings are considered
+ *
+ * A vendor may document a whole-message ceiling, an attachment ceiling, both, or neither, and the
+ * two are independent facts rather than derivations of each other — Postmark publishes a 50 MB
+ * payload and no attachment ceiling; Resend publishes a 40 MB attachment ceiling and no message
+ * ceiling. Taking the minimum of whatever is declared is the only reading that is correct for all
+ * four shapes.
+ *
+ * A message ceiling is a ceiling on MORE than the attachments (headers and body count against it),
+ * so using it as an attachment ceiling is deliberately conservative rather than exact — which is
+ * the right direction for a refusal that exists to avoid a vendor round trip.
+ */
+export declare function resolveOutboundAttachmentCeiling(envelope: EmailProviderPublishedEnvelope | undefined): number;
 export interface EmailSendRequest {
     /**
      * Stable identity of one logical provider submission. A caller that can
@@ -78,11 +151,11 @@ export declare class EmailBackendService {
     private readonly logger;
     private readonly errorBuilder;
     private readonly templateRegistry;
-    private readonly contextProviderRegistry;
     private readonly configService;
     private readonly externalProvidersRegistry;
+    private readonly filesService;
     protected logDebug: (message: string, context?: Record<string, unknown>) => void;
-    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, templateRegistry: EmailTemplateRegistryBackendService, contextProviderRegistry: EmailContextProviderRegistryBackendService, configService: AppConfigurationService, externalProvidersRegistry: ExternalProvidersRegistryBackendService);
+    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, templateRegistry: EmailTemplateRegistryBackendService, configService: AppConfigurationService, externalProvidersRegistry: ExternalProvidersRegistryBackendService, filesService: FilesBackendService | undefined);
     /**
      * Send an email using a file-based template definition.
      */
@@ -95,6 +168,32 @@ export declare class EmailBackendService {
     private getFallbackLocale;
     private getDesignTokens;
     private resolveEmailProvider;
+    /**
+     * Resolve `attachmentFileIds` to the vendor-neutral `attachments` array several provider adapters
+     * already map (#429).
+     *
+     * Until this existed the field was declared and read by nothing, so a caller supplying an
+     * attachment got a successful send and an attachment-less email. Every refusal below therefore
+     * THROWS: a silent drop is the defect, and error handling that drops quietly is the same defect.
+     *
+     * ## The size cap is the framework's, not a provider's
+     *
+     * {@link OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT} is deliberately below every provider limit this
+     * framework talks to, so the refusal happens HERE — with the file ids and the measured total in
+     * the error — rather than at a vendor that answers with a rejected submission and a message the
+     * application cannot act on. It is a named constant rather than a config key on purpose: an
+     * authored limit nothing read is precisely the class of defect this issue came from, and a
+     * config surface can be added the day an application needs a different number.
+     *
+     * ## What is NOT checked here, and why
+     *
+     * The file TYPE. A file reaching this point has already passed upload-time validation and, where
+     * the field opts into scanning, the scanner — and the status gate inside
+     * `readFilesForOutboundAttachment` admits only what the download route would serve, which
+     * excludes INFECTED. Re-deciding admissible types at send time would be a second policy that can
+     * disagree with the first.
+     */
+    private resolveAttachments;
     private buildEmailRequest;
     private executeProviderRequest;
     private bestEffortParseResponseBody;
@@ -107,7 +206,6 @@ export declare class EmailBackendService {
      * headers and body consumption and can never outlive the durable lease.
      */
     private readResponseTextWithAbort;
-    private abortReasonToError;
     private describeRejectedRecipients;
     private responseHeadersToRecord;
     /**
@@ -125,6 +223,5 @@ export declare class EmailBackendService {
      * `providerId === '<literal>'` branches.
      */
     private serializeProviderEmailPayload;
-    private createProviderUtils;
 }
 //# sourceMappingURL=email.backend.service.d.ts.map

package/dist/esm/notifications/email/services/email.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAEnH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAKpH,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAC1J,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,mDAAmD,CAAC;AACpH,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,2CAA2C,CAAC;AAErG,OAAO,EACL,oBAAoB,EAEpB,iBAAiB,EAMlB,MAAM,uBAAuB,CAAC;AAgB/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAkBxE,MAAM,WAAW,gBAAgB;IAC/B;;;;MAIE;IACF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,sCAAsC;IACtC,IAAI,EAAE,iBAAiB,CAAC;IACxB,iCAAiC;IACjC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,+BAA+B;IAC/B,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,0DAA0D;IAC1D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,oBAAY,sBAAsB;IAChC,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;CAC1C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,sBAAsB,CAAC;IAChC,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kBAAkB,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAgGD,qBACa,mBAAmB;IAIO,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC1B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa;IACd,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IARzG,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACtC,gBAAgB,EAAE,mCAAmC,EAC9C,uBAAuB,EAAE,0CAA0C,EAC/E,aAAa,EAAE,uBAAuB,EACtB,yBAAyB,EAAE,uCAAuC;IAMlJ;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IA+L/D;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAS9E,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,oBAAoB;IAqG5B,OAAO,CAAC,iBAAiB;YAoCX,sBAAsB;IAwPpC,OAAO,CAAC,2BAA2B;IASnC,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,kCAAkC;IAI1C;;;;;OAKG;YACW,yBAAyB;IAuBvC,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,0BAA0B;IASlC,OAAO,CAAC,uBAAuB;IAQ/B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,yBAAyB;IAuBjC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IA6BrC,OAAO,CAAC,mBAAmB;CAyB5B"}
+{"version":3,"file":"email.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/email/services/email.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAEnH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAKpH,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAC1J,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AACnG,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,2CAA2C,CAAC;AAErG,OAAO,EACL,oBAAoB,EAEpB,iBAAiB,EAMlB,MAAM,uBAAuB,CAAC;AAc/B,OAAO,KAAK,EAGV,8BAA8B,EAC/B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAoBxE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,qCAAqC,QAAmB,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,8BAA8B,GAAG,SAAS,GAAG,MAAM,CAQ7G;AAGD,MAAM,WAAW,gBAAgB;IAC/B;;;;MAIE;IACF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,sCAAsC;IACtC,IAAI,EAAE,iBAAiB,CAAC;IACxB,iCAAiC;IACjC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,+BAA+B;IAC/B,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,0DAA0D;IAC1D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,oBAAY,sBAAsB;IAChC,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;CAC1C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,sBAAsB,CAAC;IAChC,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kBAAkB,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAuGD,qBACa,mBAAmB;IAIO,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa;IACd,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAQ3C,OAAO,CAAC,QAAQ,CAAC,YAAY;IAf3F,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACtC,gBAAgB,EAAE,mCAAmC,EAC1D,aAAa,EAAE,uBAAuB,EACtB,yBAAyB,EAAE,uCAAuC,EAQnE,YAAY,EAAE,mBAAmB,GAAG,SAAS;IAM5H;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IA0L/D;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAS9E,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,oBAAoB;IA2G5B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,kBAAkB;IA8ChC,OAAO,CAAC,iBAAiB;YAwCX,sBAAsB;IAiSpC,OAAO,CAAC,2BAA2B;IASnC,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,kCAAkC;IAI1C;;;;;OAKG;YACW,yBAAyB;IASvC,OAAO,CAAC,0BAA0B;IASlC,OAAO,CAAC,uBAAuB;IAQ/B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,yBAAyB;IAuBjC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;CA6BtC"}