@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/notifications/email/services/email-template-validator.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-template-validator.backend.service.js","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email-template-validator.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAapF,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAa;IACtD,mBAAmB;IACnB,yBAAyB;IACzB,qBAAqB;IACrB,kEAAkE;IAClE,0FAA0F;IAC1F,6FAA6F;IAC7F,gDAAgD;IAChD,EAAE;IACF,8FAA8F;IAC9F,yFAAyF;IACzF,8FAA8F;IAC9F,4FAA4F;IAC5F,0FAA0F;IAC1F,4BAA4B;IAC5B,0EAA0E;IAC1E,4BAA4B;IAC5B,sCAAsC;IACtC,UAAU;IACV,kBAAkB;IAClB,OAAO;CACR,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAgD;IACtE,eAAe;IACf,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACzE,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACvE,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACtE,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACpE,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC5E,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAC9D,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAEhE,cAAc;IACd,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACpE,EAAE,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,kCAAkC,EAAE;IAEvF,UAAU;IACV,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC/D,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,6BAA6B,EAAE;IACjE,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAC7D,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC5E,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,+BAA+B,EAAE;IAE5E,iBAAiB;IACjB,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC7D,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,uCAAuC,EAAE;IACjF,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,0CAA0C,EAAE;IACtF,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,2CAA2C,EAAE;IAExF,kBAAkB;IAClB,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,8BAA8B,EAAE;IACtE,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC7D,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,wBAAwB,EAAE;CAChE,CAAC;AAEF,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAGzE,IAAM,oCAAoC,GAA1C,MAAM,oCAAoC;IAIO;IAH5C,QAAQ,CAA+D;IAEjF,YACsD,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;QAEzE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;IACjF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;QAEtD,kCAAkC;QAClC,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAEhC,sBAAsB;QACtB,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAE7B,4DAA4D;QAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;QAE/B,4CAA4C;QAC5C,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAY,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,SAAiB;QAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,kBAAkB,EAAE,CAAC;YACtD,oBAAoB;YACpB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,SAAiB;QACvC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,0BAA0B;QAC1B,MAAM,WAAW,GAAG,sDAAsD,CAAC;QAC3E,IAAI,KAAK,CAAC;QAEV,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAE5B,6BAA6B;YAC7B,MAAM,SAAS,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChE,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAC3B,OAAO,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAClD,CAAC;gBAED,OAAO,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;YACxE,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,gBAAgB,UAAU,sCAAsC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3H,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAAC,SAAiB;QAChD,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAChF,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CAAC,SAAiB;QACzC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC;YACH,sBAAsB;YACtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YAExC,4DAA4D;YAC5D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE;gBAChD,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,QAAQ;gBAChB,GAAG,EAAE,WAAW;gBAChB,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YAEH,kCAAkC;YAClC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACtC,QAAQ,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAgF,CAAC;YAE/F,uBAAuB;YACvB,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAnLY,oCAAoC;IADhD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;;GAJzB,oCAAoC,CAmLhD","sourcesContent":["/**\n * Email Template Validator Backend Service\n *\n * Validates TSX email templates for security and correctness.\n * Checks for:\n * - Import allowlist compliance\n * - Forbidden patterns (Node.js APIs, dangerous code)\n * - Syntax validation via ESBuild\n */\n\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// TYPES\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface TsxValidationResult {\n  valid: boolean;\n  errors: string[];\n  warnings: string[];\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// CONSTANTS\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Allowed import paths for generated email templates\n * Templates can only import from these modules\n */\nexport const EMAIL_TEMPLATE_ALLOWED_IMPORTS: string[] = [\n  // React Email core\n  '@react-email/components',\n  '@react-email/render',\n  // Our predefined email components. Exported from the package root\n  // (`saas-backend-lib/src/index.ts`) so an application's authored template can import it —\n  // and it is why `InversifyContainer` is aliased there, to avoid the clash with React Email's\n  // own `Container` re-exported from this module.\n  //\n  // NOTE (#475, 2026-09-08): the email-template SANDBOX used to be the thing that resolved this\n  // specifier at runtime, and it was deleted as unreachable. Permitting the import here is\n  // therefore no longer backed by a loader inside the engine; an application template importing\n  // it resolves through its own bundler against the package root export. Keep the entry — the\n  // export is public API — but do not read it as evidence that the engine loads the module.\n  '@wildo-ai/email-components',\n  // App-owned runtime helpers used by the filesystem email template pattern\n  '@wildo-ai/saas-backend-lib',\n  '~backend-api/engine/email/components',\n  './labels',\n  // React (limited)\n  'react',\n];\n\n/**\n * Forbidden patterns that indicate potentially dangerous code\n */\nconst FORBIDDEN_PATTERNS: Array<{ pattern: RegExp; message: string }> = [\n  // Node.js APIs\n  { pattern: /require\\s*\\(/g, message: 'Dynamic require() is not allowed' },\n  { pattern: /import\\s*\\(/g, message: 'Dynamic import() is not allowed' },\n  { pattern: /process\\./g, message: 'Access to process is not allowed' },\n  { pattern: /global\\./g, message: 'Access to global is not allowed' },\n  { pattern: /globalThis\\./g, message: 'Access to globalThis is not allowed' },\n  { pattern: /__dirname/g, message: '__dirname is not allowed' },\n  { pattern: /__filename/g, message: '__filename is not allowed' },\n\n  // File system\n  { pattern: /\\bfs\\b/g, message: 'File system access is not allowed' },\n  { pattern: /\\bpath\\b\\.(?!join|resolve)/g, message: 'Path module access is restricted' },\n\n  // Network\n  { pattern: /\\bhttp\\b/g, message: 'HTTP module is not allowed' },\n  { pattern: /\\bhttps\\b/g, message: 'HTTPS module is not allowed' },\n  { pattern: /\\bnet\\b/g, message: 'Net module is not allowed' },\n  { pattern: /\\bfetch\\s*\\(/g, message: 'fetch() is not allowed in templates' },\n  { pattern: /\\bXMLHttpRequest\\b/g, message: 'XMLHttpRequest is not allowed' },\n\n  // Code execution\n  { pattern: /\\beval\\s*\\(/g, message: 'eval() is not allowed' },\n  { pattern: /\\bFunction\\s*\\(/g, message: 'Function() constructor is not allowed' },\n  { pattern: /\\bsetTimeout\\s*\\(/g, message: 'setTimeout() is not allowed in templates' },\n  { pattern: /\\bsetInterval\\s*\\(/g, message: 'setInterval() is not allowed in templates' },\n\n  // Child processes\n  { pattern: /child_process/g, message: 'child_process is not allowed' },\n  { pattern: /\\bexec\\s*\\(/g, message: 'exec() is not allowed' },\n  { pattern: /\\bspawn\\s*\\(/g, message: 'spawn() is not allowed' },\n];\n\n// ─────────────────────────────────────────────────────────────────────────────\n// SERVICE\n// ─────────────────────────────────────────────────────────────────────────────\n\n@injectable()\nexport class EmailTemplateValidatorBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n  ) {\n    this.logDebug = this.logger.debugByType('EmailTemplateValidatorBackendService');\n    this.logger.setDebugTypeLogging('EmailTemplateValidatorBackendService', false);\n  }\n\n  /**\n   * Validate a TSX template source\n   *\n   * @param tsxSource - The TSX template source code\n   * @returns Validation result with errors and warnings\n   */\n  async validate(tsxSource: string): Promise<TsxValidationResult> {\n    const errors: string[] = [];\n    const warnings: string[] = [];\n\n    this.logDebug('Validating email template TSX source');\n\n    // 1. Check for forbidden patterns\n    const forbiddenErrors = this.checkForbiddenPatterns(tsxSource);\n    errors.push(...forbiddenErrors);\n\n    // 2. Validate imports\n    const importErrors = this.validateImports(tsxSource);\n    errors.push(...importErrors);\n\n    // 3. Validate the filesystem email-template contract shape.\n    const contractErrors = this.validateTemplateContract(tsxSource);\n    errors.push(...contractErrors);\n\n    // 4. Syntax check via ESBuild (basic parse)\n    try {\n      const syntaxResult = await this.checkSyntax(tsxSource);\n      if (!syntaxResult.valid) {\n        errors.push(...syntaxResult.errors);\n      }\n      warnings.push(...syntaxResult.warnings);\n    } catch (err) {\n      const error = err as Error;\n      errors.push(`Syntax error: ${error.message}`);\n    }\n\n    const valid = errors.length === 0;\n\n    if (!valid) {\n      this.logger.warn('Email template validation failed', { errorCount: errors.length, errors });\n    } else {\n      this.logDebug('Email template validation passed', { warningCount: warnings.length });\n    }\n\n    return { valid, errors, warnings };\n  }\n\n  /**\n   * Check for forbidden patterns in the source code\n   */\n  private checkForbiddenPatterns(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    for (const { pattern, message } of FORBIDDEN_PATTERNS) {\n      // Reset regex state\n      pattern.lastIndex = 0;\n      if (pattern.test(tsxSource)) {\n        errors.push(message);\n      }\n    }\n\n    return errors;\n  }\n\n  /**\n   * Validate that all imports are in the allowlist\n   */\n  private validateImports(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    // Match import statements\n    const importRegex = /import\\s+(?:[\\w*{}\\s,]+\\s+from\\s+)?['\"]([^'\"]+)['\"]/g;\n    let match;\n\n    while ((match = importRegex.exec(tsxSource)) !== null) {\n      const importPath = match[1];\n\n      // Check if import is allowed\n      const isAllowed = EMAIL_TEMPLATE_ALLOWED_IMPORTS.some((allowed) => {\n        if (allowed === './labels') {\n          return /^\\.\\/labels\\.[^/'\"]+$/.test(importPath);\n        }\n\n        return importPath === allowed || importPath.startsWith(allowed + '/');\n      });\n\n      if (!isAllowed) {\n        errors.push(`Import from '${importPath}' is not allowed. Allowed imports: ${EMAIL_TEMPLATE_ALLOWED_IMPORTS.join(', ')}`);\n      }\n    }\n\n    return errors;\n  }\n\n  /**\n   * Validate that the source looks like a default-exported EmailTemplateDefinition\n   * object with the required `subject` and `body` members.\n   */\n  private validateTemplateContract(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    if (!/EmailTemplateDefinition(?:<[^>]+>)?/.test(tsxSource)) {\n      errors.push('Generated template must reference EmailTemplateDefinition');\n    }\n\n    if (!/\\bsubject\\s*[:(]/.test(tsxSource)) {\n      errors.push('Generated template must expose a subject member');\n    }\n\n    if (!/\\bbody\\s*[:(]/.test(tsxSource)) {\n      errors.push('Generated template must expose a body member');\n    }\n\n    if (!/export\\s+default\\s+/.test(tsxSource)) {\n      errors.push('Generated template must default-export the template definition');\n    }\n\n    return errors;\n  }\n\n  /**\n   * Check syntax using ESBuild's parser\n   */\n  private async checkSyntax(tsxSource: string): Promise<{ valid: boolean; errors: string[]; warnings: string[] }> {\n    const errors: string[] = [];\n    const warnings: string[] = [];\n\n    try {\n      // Lazy import esbuild\n      const esbuild = await import('esbuild');\n\n      // Transform with TSX loader - this will catch syntax errors\n      const result = await esbuild.transform(tsxSource, {\n        loader: 'tsx',\n        target: 'es2020',\n        jsx: 'automatic',\n        minify: false,\n      });\n\n      // Check for warnings from ESBuild\n      if (result.warnings && result.warnings.length > 0) {\n        for (const warning of result.warnings) {\n          warnings.push(`Line ${warning.location?.line || '?'}: ${warning.text}`);\n        }\n      }\n\n      return { valid: true, errors, warnings };\n    } catch (err) {\n      const error = err as Error & { errors?: Array<{ text: string; location?: { line: number } }> };\n\n      // ESBuild error format\n      if (error.errors && Array.isArray(error.errors)) {\n        for (const e of error.errors) {\n          errors.push(`Line ${e.location?.line || '?'}: ${e.text}`);\n        }\n      } else {\n        errors.push(error.message);\n      }\n\n      return { valid: false, errors, warnings };\n    }\n  }\n\n  /**\n   * Get the list of allowed imports (for LLM context)\n   */\n  getAllowedImports(): string[] {\n    return [...EMAIL_TEMPLATE_ALLOWED_IMPORTS];\n  }\n}\n"]}
+{"version":3,"file":"email-template-validator.backend.service.js","sourceRoot":"","sources":["../../../../../src/notifications/email/services/email-template-validator.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAapF,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAa;IACtD,mBAAmB;IACnB,yBAAyB;IACzB,qBAAqB;IACrB,kEAAkE;IAClE,0FAA0F;IAC1F,6FAA6F;IAC7F,gDAAgD;IAChD,EAAE;IACF,8FAA8F;IAC9F,yFAAyF;IACzF,8FAA8F;IAC9F,4FAA4F;IAC5F,0FAA0F;IAC1F,4BAA4B;IAC5B,0EAA0E;IAC1E,4BAA4B;IAC5B,sCAAsC;IACtC,UAAU;IACV,kBAAkB;IAClB,OAAO;CACR,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAgD;IACtE,eAAe;IACf,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACzE,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACvE,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACtE,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACpE,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC5E,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAC9D,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAEhE,cAAc;IACd,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACpE,EAAE,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,kCAAkC,EAAE;IAEvF,UAAU;IACV,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC/D,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,6BAA6B,EAAE;IACjE,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAC7D,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC5E,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,+BAA+B,EAAE;IAE5E,iBAAiB;IACjB,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC7D,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,uCAAuC,EAAE;IACjF,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,0CAA0C,EAAE;IACtF,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,2CAA2C,EAAE;IAExF,kBAAkB;IAClB,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,8BAA8B,EAAE;IACtE,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC7D,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,wBAAwB,EAAE;CAChE,CAAC;AAEF,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAGzE,IAAM,oCAAoC,GAA1C,MAAM,oCAAoC;IAIO;IAH5C,QAAQ,CAA+D;IAEjF,YACsD,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;QAEzE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;IACjF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;QAEtD,kCAAkC;QAClC,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAEhC,sBAAsB;QACtB,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAE7B,4DAA4D;QAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;QAE/B,4CAA4C;QAC5C,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAY,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,SAAiB;QAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,kBAAkB,EAAE,CAAC;YACtD,oBAAoB;YACpB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,SAAiB;QACvC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,0BAA0B;QAC1B,MAAM,WAAW,GAAG,sDAAsD,CAAC;QAC3E,IAAI,KAAK,CAAC;QAEV,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAE5B,6BAA6B;YAC7B,MAAM,SAAS,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChE,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAC3B,OAAO,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAClD,CAAC;gBAED,OAAO,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;YACxE,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,gBAAgB,UAAU,sCAAsC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3H,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAAC,SAAiB;QAChD,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAChF,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CAAC,SAAiB;QACzC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC;YACH,sBAAsB;YACtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YAExC,4DAA4D;YAC5D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE;gBAChD,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,QAAQ;gBAChB,GAAG,EAAE,WAAW;gBAChB,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YAEH,kCAAkC;YAClC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACtC,QAAQ,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAgF,CAAC;YAE/F,uBAAuB;YACvB,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAnLY,oCAAoC;IADhD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;;GAJzB,oCAAoC,CAmLhD","sourcesContent":["/**\n * Email Template Validator Backend Service\n *\n * Validates TSX email templates for security and correctness.\n * Checks for:\n * - Import allowlist compliance\n * - Forbidden patterns (Node.js APIs, dangerous code)\n * - Syntax validation via ESBuild\n */\n\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// TYPES\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface TsxValidationResult {\n  valid: boolean;\n  errors: string[];\n  warnings: string[];\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// CONSTANTS\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Allowed import paths for generated email templates\n * Templates can only import from these modules\n */\nexport const EMAIL_TEMPLATE_ALLOWED_IMPORTS: string[] = [\n  // React Email core\n  '@react-email/components',\n  '@react-email/render',\n  // Our predefined email components. Exported from the package root\n  // (`saas-backend-lib/src/index.ts`) so an application's authored template can import it —\n  // and it is why `InversifyContainer` is aliased there, to avoid the clash with React Email's\n  // own `Container` re-exported from this module.\n  //\n  // NOTE (#475, 2026-09-08): the email-template SANDBOX used to be the thing that resolved this\n  // specifier at runtime, and it was deleted as unreachable. Permitting the import here is\n  // therefore no longer backed by a loader inside the engine; an application template importing\n  // it resolves through its own bundler against the package root export. Keep the entry — the\n  // export is public API — but do not read it as evidence that the engine loads the module.\n  '@wildo-ai/email-components',\n  // App-owned runtime helpers used by the filesystem email template pattern\n  '@wildo-ai/saas-backend-lib',\n  '~backend-api/engine/email/components',\n  './labels',\n  // React (limited)\n  'react',\n];\n\n/**\n * Forbidden patterns that indicate potentially dangerous code\n */\nconst FORBIDDEN_PATTERNS: Array<{ pattern: RegExp; message: string }> = [\n  // Node.js APIs\n  { pattern: /require\\s*\\(/g, message: 'Dynamic require() is not allowed' },\n  { pattern: /import\\s*\\(/g, message: 'Dynamic import() is not allowed' },\n  { pattern: /process\\./g, message: 'Access to process is not allowed' },\n  { pattern: /global\\./g, message: 'Access to global is not allowed' },\n  { pattern: /globalThis\\./g, message: 'Access to globalThis is not allowed' },\n  { pattern: /__dirname/g, message: '__dirname is not allowed' },\n  { pattern: /__filename/g, message: '__filename is not allowed' },\n\n  // File system\n  { pattern: /\\bfs\\b/g, message: 'File system access is not allowed' },\n  { pattern: /\\bpath\\b\\.(?!join|resolve)/g, message: 'Path module access is restricted' },\n\n  // Network\n  { pattern: /\\bhttp\\b/g, message: 'HTTP module is not allowed' },\n  { pattern: /\\bhttps\\b/g, message: 'HTTPS module is not allowed' },\n  { pattern: /\\bnet\\b/g, message: 'Net module is not allowed' },\n  { pattern: /\\bfetch\\s*\\(/g, message: 'fetch() is not allowed in templates' },\n  { pattern: /\\bXMLHttpRequest\\b/g, message: 'XMLHttpRequest is not allowed' },\n\n  // Code execution\n  { pattern: /\\beval\\s*\\(/g, message: 'eval() is not allowed' },\n  { pattern: /\\bFunction\\s*\\(/g, message: 'Function() constructor is not allowed' },\n  { pattern: /\\bsetTimeout\\s*\\(/g, message: 'setTimeout() is not allowed in templates' },\n  { pattern: /\\bsetInterval\\s*\\(/g, message: 'setInterval() is not allowed in templates' },\n\n  // Child processes\n  { pattern: /child_process/g, message: 'child_process is not allowed' },\n  { pattern: /\\bexec\\s*\\(/g, message: 'exec() is not allowed' },\n  { pattern: /\\bspawn\\s*\\(/g, message: 'spawn() is not allowed' },\n];\n\n// ─────────────────────────────────────────────────────────────────────────────\n// SERVICE\n// ─────────────────────────────────────────────────────────────────────────────\n\n@injectable()\nexport class EmailTemplateValidatorBackendService {\n  protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n  ) {\n    this.logDebug = this.logger.debugByType('EmailTemplateValidatorBackendService');\n    this.logger.setDebugTypeLogging('EmailTemplateValidatorBackendService', false);\n  }\n\n  /**\n   * Validate a TSX template source\n   *\n   * @param tsxSource - The TSX template source code\n   * @returns Validation result with errors and warnings\n   */\n  async validate(tsxSource: string): Promise<TsxValidationResult> {\n    const errors: string[] = [];\n    const warnings: string[] = [];\n\n    this.logDebug('Validating email template TSX source');\n\n    // 1. Check for forbidden patterns\n    const forbiddenErrors = this.checkForbiddenPatterns(tsxSource);\n    errors.push(...forbiddenErrors);\n\n    // 2. Validate imports\n    const importErrors = this.validateImports(tsxSource);\n    errors.push(...importErrors);\n\n    // 3. Validate the filesystem email-template contract shape.\n    const contractErrors = this.validateTemplateContract(tsxSource);\n    errors.push(...contractErrors);\n\n    // 4. Syntax check via ESBuild (basic parse)\n    try {\n      const syntaxResult = await this.checkSyntax(tsxSource);\n      if (!syntaxResult.valid) {\n        errors.push(...syntaxResult.errors);\n      }\n      warnings.push(...syntaxResult.warnings);\n    } catch (err) {\n      const error = err as Error;\n      errors.push(`Syntax error: ${error.message}`);\n    }\n\n    const valid = errors.length === 0;\n\n    if (!valid) {\n      this.logger.warn('Email template validation failed', { errorCount: errors.length, errors });\n    } else {\n      this.logDebug('Email template validation passed', { warningCount: warnings.length });\n    }\n\n    return { valid, errors, warnings };\n  }\n\n  /**\n   * Check for forbidden patterns in the source code\n   */\n  private checkForbiddenPatterns(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    for (const { pattern, message } of FORBIDDEN_PATTERNS) {\n      // Reset regex state\n      pattern.lastIndex = 0;\n      if (pattern.test(tsxSource)) {\n        errors.push(message);\n      }\n    }\n\n    return errors;\n  }\n\n  /**\n   * Validate that all imports are in the allowlist\n   */\n  private validateImports(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    // Match import statements\n    const importRegex = /import\\s+(?:[\\w*{}\\s,]+\\s+from\\s+)?['\"]([^'\"]+)['\"]/g;\n    let match;\n\n    while ((match = importRegex.exec(tsxSource)) !== null) {\n      const importPath = match[1];\n\n      // Check if import is allowed\n      const isAllowed = EMAIL_TEMPLATE_ALLOWED_IMPORTS.some((allowed) => {\n        if (allowed === './labels') {\n          return /^\\.\\/labels\\.[^/'\"]+$/.test(importPath);\n        }\n\n        return importPath === allowed || importPath.startsWith(allowed + '/');\n      });\n\n      if (!isAllowed) {\n        errors.push(`Import from '${importPath}' is not allowed. Allowed imports: ${EMAIL_TEMPLATE_ALLOWED_IMPORTS.join(', ')}`);\n      }\n    }\n\n    return errors;\n  }\n\n  /**\n   * Validate that the source looks like a default-exported EmailTemplateDefinition\n   * object with the required `subject` and `body` members.\n   */\n  private validateTemplateContract(tsxSource: string): string[] {\n    const errors: string[] = [];\n\n    if (!/EmailTemplateDefinition(?:<[^>]+>)?/.test(tsxSource)) {\n      errors.push('Generated template must reference EmailTemplateDefinition');\n    }\n\n    if (!/\\bsubject\\s*[:(]/.test(tsxSource)) {\n      errors.push('Generated template must expose a subject member');\n    }\n\n    if (!/\\bbody\\s*[:(]/.test(tsxSource)) {\n      errors.push('Generated template must expose a body member');\n    }\n\n    if (!/export\\s+default\\s+/.test(tsxSource)) {\n      errors.push('Generated template must default-export the template definition');\n    }\n\n    return errors;\n  }\n\n  /**\n   * Check syntax using ESBuild's parser\n   */\n  private async checkSyntax(tsxSource: string): Promise<{ valid: boolean; errors: string[]; warnings: string[] }> {\n    const errors: string[] = [];\n    const warnings: string[] = [];\n\n    try {\n      // Lazy import esbuild\n      const esbuild = await import('esbuild');\n\n      // Transform with TSX loader - this will catch syntax errors\n      const result = await esbuild.transform(tsxSource, {\n        loader: 'tsx',\n        target: 'es2020',\n        jsx: 'automatic',\n        minify: false,\n      });\n\n      // Check for warnings from ESBuild\n      if (result.warnings && result.warnings.length > 0) {\n        for (const warning of result.warnings) {\n          warnings.push(`Line ${warning.location?.line || '?'}: ${warning.text}`);\n        }\n      }\n\n      return { valid: true, errors, warnings };\n    } catch (err) {\n      const error = err as Error & { errors?: Array<{ text: string; location?: { line: number } }> };\n\n      // ESBuild error format\n      if (error.errors && Array.isArray(error.errors)) {\n        for (const e of error.errors) {\n          errors.push(`Line ${e.location?.line || '?'}: ${e.text}`);\n        }\n      } else {\n        errors.push(error.message);\n      }\n\n      return { valid: false, errors, warnings };\n    }\n  }\n\n  /**\n   * Get the list of allowed imports (for LLM context)\n   */\n  getAllowedImports(): string[] {\n    return [...EMAIL_TEMPLATE_ALLOWED_IMPORTS];\n  }\n}\n"]}

package/dist/esm/notifications/email/services/email.backend.service.d.ts

@@ -31,21 +31,63 @@ import type { ExternalProvidersRegistryBackendService } from '../../../external-
 import type { FilesBackendService } from '../../../files/services/files.backend.service';
 import type { EmailTemplateRegistryBackendService } from './email-template-registry.backend.service';
 import { EmailTemplateContext, EmailTemplateType } from '@wildo-ai/saas-models';
+import type { EmailProviderPublishedEnvelope } from '@wildo-ai/external-connectors-private/backend';
 import { AvailableLanguage } from '@wildo-ai/presets-components-models';
 /**
  * Total size ceiling for the attachments of ONE email, applied after the bytes are resolved (#429).
  *
- * 10 MB, deliberately below every provider ceiling this framework talks to — SendGrid 30 MB,
- * Mailgun 25 MB, SES 40 MB on the raw message — so an over-size send is refused HERE, naming the
- * files and the measured total, instead of at a vendor whose rejection an application cannot act
- * on. Base64 also inflates the wire payload by roughly a third, so a limit set AT a provider's
- * number would still fail there.
+ * 10 MB, deliberately below every provider ceiling this framework talks to, so an over-size send is
+ * refused HERE — naming the files and the measured total — instead of at a vendor whose rejection an
+ * application cannot act on. Base64 also inflates the wire payload by roughly a third, so a limit set
+ * AT a provider's number would still fail there.
+ *
+ * ## That claim is now CHECKED, and it used to be three numbers from memory
+ *
+ * This paragraph named "SendGrid 30 MB, Mailgun 25 MB, SES 40 MB" with no source — and this framework
+ * ships no SES provider, so one of the three was about a vendor nothing here talks to. Each shipped
+ * email provider now DECLARES its vendor's published envelope beside a mandatory `source`
+ * (`BackendProviderModule.emailEnvelope`), and `email-provider-envelope-ceiling.test.ts` asserts this
+ * constant is strictly below every declared ceiling.
+ *
+ * So the sentence above is an invariant rather than a recollection: adding a provider whose vendor
+ * publishes a tighter envelope than 10 MB fails a test here, instead of failing at that vendor on a
+ * customer's send.
  *
  * A constant rather than a config key, until an application needs a different number: a configurable
  * limit that nothing reads is the exact defect this issue closed, and adding the reader is the
  * cheaper half of that change.
  */
 export declare const OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT: number;
+/**
+ * The attachment ceiling for one resolved provider: the tighter of the engine default and the
+ * vendor's own published envelope.
+ *
+ * ## Why this is not simply the engine default
+ *
+ * The default's whole purpose is that an over-size send is refused HERE rather than at a vendor
+ * whose rejection an application cannot act on — and that only holds while the number is genuinely
+ * under every vendor's ceiling. It was not. `OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT` is 10 MB and
+ * **Brevo publishes 4 MB**, so an application on Brevo could pass the engine's check and be refused
+ * by the vendor: precisely the outcome the constant exists to prevent, for as long as the constant
+ * was calibrated against three vendors named from memory in a comment.
+ *
+ * Lowering the flat number to Brevo's would have punished every other provider for one vendor's
+ * envelope, so the ceiling is per-provider and the default is the FLOOR under providers that
+ * publish nothing.
+ *
+ * ## Both published ceilings are considered
+ *
+ * A vendor may document a whole-message ceiling, an attachment ceiling, both, or neither, and the
+ * two are independent facts rather than derivations of each other — Postmark publishes a 50 MB
+ * payload and no attachment ceiling; Resend publishes a 40 MB attachment ceiling and no message
+ * ceiling. Taking the minimum of whatever is declared is the only reading that is correct for all
+ * four shapes.
+ *
+ * A message ceiling is a ceiling on MORE than the attachments (headers and body count against it),
+ * so using it as an attachment ceiling is deliberately conservative rather than exact — which is
+ * the right direction for a refusal that exists to avoid a vendor round trip.
+ */
+export declare function resolveOutboundAttachmentCeiling(envelope: EmailProviderPublishedEnvelope | undefined): number;
 export interface EmailSendRequest {
     /**
      * Stable identity of one logical provider submission. A caller that can
@@ -164,7 +206,6 @@ export declare class EmailBackendService {
      * headers and body consumption and can never outlive the durable lease.
      */
     private readResponseTextWithAbort;
-    private abortReasonToError;
     private describeRejectedRecipients;
     private responseHeadersToRecord;
     /**

package/dist/esm/notifications/email/services/email.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/notifications/email/services/email.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAEnH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAKpH,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAC1J,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AACnG,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,2CAA2C,CAAC;AAErG,OAAO,EACL,oBAAoB,EAEpB,iBAAiB,EAMlB,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAkBxE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qCAAqC,QAAmB,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B;;;;MAIE;IACF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,sCAAsC;IACtC,IAAI,EAAE,iBAAiB,CAAC;IACxB,iCAAiC;IACjC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,+BAA+B;IAC/B,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,0DAA0D;IAC1D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,oBAAY,sBAAsB;IAChC,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;CAC1C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,sBAAsB,CAAC;IAChC,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kBAAkB,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAgGD,qBACa,mBAAmB;IAIO,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa;IACd,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAQ3C,OAAO,CAAC,QAAQ,CAAC,YAAY;IAf3F,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACtC,gBAAgB,EAAE,mCAAmC,EAC1D,aAAa,EAAE,uBAAuB,EACtB,yBAAyB,EAAE,uCAAuC,EAQnE,YAAY,EAAE,mBAAmB,GAAG,SAAS;IAM5H;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IA0L/D;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAS9E,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,oBAAoB;IAqG5B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,kBAAkB;IA2ChC,OAAO,CAAC,iBAAiB;YAwCX,sBAAsB;IAoRpC,OAAO,CAAC,2BAA2B;IASnC,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,kCAAkC;IAI1C;;;;;OAKG;YACW,yBAAyB;IAuBvC,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,0BAA0B;IASlC,OAAO,CAAC,uBAAuB;IAQ/B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,yBAAyB;IAuBjC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;CA6BtC"}
+{"version":3,"file":"email.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/notifications/email/services/email.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAEnH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAKpH,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAC1J,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AACnG,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,2CAA2C,CAAC;AAErG,OAAO,EACL,oBAAoB,EAEpB,iBAAiB,EAMlB,MAAM,uBAAuB,CAAC;AAc/B,OAAO,KAAK,EAGV,8BAA8B,EAC/B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAoBxE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,qCAAqC,QAAmB,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,8BAA8B,GAAG,SAAS,GAAG,MAAM,CAQ7G;AAGD,MAAM,WAAW,gBAAgB;IAC/B;;;;MAIE;IACF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,sCAAsC;IACtC,IAAI,EAAE,iBAAiB,CAAC;IACxB,iCAAiC;IACjC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,+BAA+B;IAC/B,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,0DAA0D;IAC1D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,oBAAY,sBAAsB;IAChC,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;CAC1C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,sBAAsB,CAAC;IAChC,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kBAAkB,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAuGD,qBACa,mBAAmB;IAIO,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa;IACd,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAQ3C,OAAO,CAAC,QAAQ,CAAC,YAAY;IAf3F,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACtC,gBAAgB,EAAE,mCAAmC,EAC1D,aAAa,EAAE,uBAAuB,EACtB,yBAAyB,EAAE,uCAAuC,EAQnE,YAAY,EAAE,mBAAmB,GAAG,SAAS;IAM5H;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IA0L/D;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAS9E,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,oBAAoB;IA2G5B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,kBAAkB;IA8ChC,OAAO,CAAC,iBAAiB;YAwCX,sBAAsB;IAiSpC,OAAO,CAAC,2BAA2B;IASnC,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,kCAAkC;IAI1C;;;;;OAKG;YACW,yBAAyB;IASvC,OAAO,CAAC,0BAA0B;IASlC,OAAO,CAAC,uBAAuB;IAQ/B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,yBAAyB;IAuBjC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;CA6BtC"}

package/dist/esm/notifications/email/services/email.backend.service.js

@@ -46,6 +46,8 @@ import { buildEmailBrandTokensFromConfig } from '../../../notifications/email/ut
 import { EmailTemplateType_ToEngineCapability, ErrorCustomMessageReference, ErrorType, isWildoBackendError, WildoHeaderKeys, } from '@wildo-ai/saas-models';
 import { EmailProviderPayloadEncoding, EmailProviderSubmissionClassification, ExternalProvider_ExchangeProtocol_Kind, StandardEmail_SendRequestSchema, StandardEmail_SendResponseSchema, ProviderProtocolRuntimeKind, } from '@wildo-ai/external-connectors-models';
 import { EMAIL_PROVIDER_TRANSPORT_TIMEOUT_MS, } from '../../../notifications/email/models/email-transport.backend.definitions.js';
+import { readResponseTextWithinDeadline } from '../../../security/outbound/outbound-request-deadline.backend.utils.js';
+import { withEngineOwnedHeaders } from '../../../security/outbound/outbound-request-headers.backend.utils.js';
 // ─────────────────────────────────────────────────────────────────────────────
 // UTILITIES
 // ─────────────────────────────────────────────────────────────────────────────
@@ -59,17 +61,66 @@ function validateEmailAddresses(emails) {
 /**
  * Total size ceiling for the attachments of ONE email, applied after the bytes are resolved (#429).
  *
- * 10 MB, deliberately below every provider ceiling this framework talks to — SendGrid 30 MB,
- * Mailgun 25 MB, SES 40 MB on the raw message — so an over-size send is refused HERE, naming the
- * files and the measured total, instead of at a vendor whose rejection an application cannot act
- * on. Base64 also inflates the wire payload by roughly a third, so a limit set AT a provider's
- * number would still fail there.
+ * 10 MB, deliberately below every provider ceiling this framework talks to, so an over-size send is
+ * refused HERE — naming the files and the measured total — instead of at a vendor whose rejection an
+ * application cannot act on. Base64 also inflates the wire payload by roughly a third, so a limit set
+ * AT a provider's number would still fail there.
+ *
+ * ## That claim is now CHECKED, and it used to be three numbers from memory
+ *
+ * This paragraph named "SendGrid 30 MB, Mailgun 25 MB, SES 40 MB" with no source — and this framework
+ * ships no SES provider, so one of the three was about a vendor nothing here talks to. Each shipped
+ * email provider now DECLARES its vendor's published envelope beside a mandatory `source`
+ * (`BackendProviderModule.emailEnvelope`), and `email-provider-envelope-ceiling.test.ts` asserts this
+ * constant is strictly below every declared ceiling.
+ *
+ * So the sentence above is an invariant rather than a recollection: adding a provider whose vendor
+ * publishes a tighter envelope than 10 MB fails a test here, instead of failing at that vendor on a
+ * customer's send.
  *
  * A constant rather than a config key, until an application needs a different number: a configurable
  * limit that nothing reads is the exact defect this issue closed, and adding the reader is the
  * cheaper half of that change.
  */
 export const OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT = 10 * 1024 * 1024;
+/**
+ * The attachment ceiling for one resolved provider: the tighter of the engine default and the
+ * vendor's own published envelope.
+ *
+ * ## Why this is not simply the engine default
+ *
+ * The default's whole purpose is that an over-size send is refused HERE rather than at a vendor
+ * whose rejection an application cannot act on — and that only holds while the number is genuinely
+ * under every vendor's ceiling. It was not. `OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT` is 10 MB and
+ * **Brevo publishes 4 MB**, so an application on Brevo could pass the engine's check and be refused
+ * by the vendor: precisely the outcome the constant exists to prevent, for as long as the constant
+ * was calibrated against three vendors named from memory in a comment.
+ *
+ * Lowering the flat number to Brevo's would have punished every other provider for one vendor's
+ * envelope, so the ceiling is per-provider and the default is the FLOOR under providers that
+ * publish nothing.
+ *
+ * ## Both published ceilings are considered
+ *
+ * A vendor may document a whole-message ceiling, an attachment ceiling, both, or neither, and the
+ * two are independent facts rather than derivations of each other — Postmark publishes a 50 MB
+ * payload and no attachment ceiling; Resend publishes a 40 MB attachment ceiling and no message
+ * ceiling. Taking the minimum of whatever is declared is the only reading that is correct for all
+ * four shapes.
+ *
+ * A message ceiling is a ceiling on MORE than the attachments (headers and body count against it),
+ * so using it as an attachment ceiling is deliberately conservative rather than exact — which is
+ * the right direction for a refusal that exists to avoid a vendor round trip.
+ */
+export function resolveOutboundAttachmentCeiling(envelope) {
+    const declared = [envelope?.maxMessageSizeMB, envelope?.maxAttachmentSizeMB]
+        .filter((value) => typeof value === 'number' && value > 0)
+        .map((megabytes) => megabytes * 1024 * 1024);
+    // An absent envelope, or one publishing no ceiling at all, keeps the engine default. That is the
+    // honest answer rather than "unlimited": the default exists precisely for the provider whose
+    // vendor says nothing.
+    return Math.min(OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT, ...declared);
+}
 export var EmailSubmissionOutcome;
 (function (EmailSubmissionOutcome) {
     EmailSubmissionOutcome["NOT_SUBMITTED"] = "not_submitted";
@@ -157,7 +208,7 @@ let EmailBackendService = class EmailBackendService {
             // 6b. Resolve caller-supplied attachments to bytes (#429). Before the request is built,
             // because a file that cannot be served must refuse the send rather than produce an email
             // that silently lacks what the caller attached.
-            const attachments = await this.resolveAttachments(request);
+            const attachments = await this.resolveAttachments(request, providerConfig.outboundAttachmentCeilingBytes);
             // 7. Build email request
             const emailRequest = this.buildEmailRequest(request, submissionId, { subject, bodyHtml, bodyText }, providerConfig, recipients, attachments);
             const providerRequest = providerConfig.delivery === 'network'
@@ -298,6 +349,9 @@ let EmailBackendService = class EmailBackendService {
         if (emailContract.delivery === 'log') {
             return {
                 providerId,
+                // Per-provider, because the engine default is NOT below every vendor's envelope — Brevo
+                // publishes 4 MB against the default's 10 MB. See `resolveOutboundAttachmentCeiling`.
+                outboundAttachmentCeilingBytes: resolveOutboundAttachmentCeiling(emailContract.publishedEnvelope),
                 delivery: 'log',
                 fromAddress: providerConfig?.fromAddress,
                 fromName: providerConfig?.fromName,
@@ -320,6 +374,9 @@ let EmailBackendService = class EmailBackendService {
         }
         return {
             providerId,
+            // Per-provider, because the engine default is NOT below every vendor's envelope — Brevo
+            // publishes 4 MB against the default's 10 MB. See `resolveOutboundAttachmentCeiling`.
+            outboundAttachmentCeilingBytes: resolveOutboundAttachmentCeiling(emailContract.publishedEnvelope),
             delivery: 'network',
             apiKey,
             endpoint: this.composeEmailSendEndpoint(emailContract.baseUrl, emailContract.sendEndpointPath, configuredDomain),
@@ -361,7 +418,7 @@ let EmailBackendService = class EmailBackendService {
      * excludes INFECTED. Re-deciding admissible types at send time would be a second policy that can
      * disagree with the first.
      */
-    async resolveAttachments(request) {
+    async resolveAttachments(request, ceilingBytes) {
         const fileIds = request.attachmentFileIds ?? [];
         if (fileIds.length === 0) {
             return [];
@@ -382,13 +439,16 @@ let EmailBackendService = class EmailBackendService {
             ...(request.organizationId ? { organizationId: request.organizationId } : {}),
         });
         const totalBytes = resolved.reduce((total, file) => total + file.bytes.byteLength, 0);
-        if (totalBytes > OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT) {
+        if (totalBytes > ceilingBytes) {
             throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
                 customMessageReference: ErrorCustomMessageReference.VALIDATION,
                 context: {
                     message: 'Email attachments exceed the outbound total-size limit',
                     totalBytes,
-                    limitBytes: OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT,
+                    limitBytes: ceilingBytes,
+                    // Both numbers, because "which limit refused me" is the first question an application asks
+                    // and the answer differs by provider: the engine default, or a tighter vendor envelope.
+                    engineDefaultLimitBytes: OUTBOUND_ATTACHMENT_TOTAL_BYTES_LIMIT,
                     fileIds: resolved.map((file) => file.fileId),
                 },
             });
@@ -489,10 +549,20 @@ let EmailBackendService = class EmailBackendService {
         if (!providerRequest) {
             throw new Error('Network email submission is missing its provider request');
         }
-        const headers = {
-            ...this.buildProviderEmailHeaders(providerConfig),
-            ...providerRequest.transportHeaders,
-        };
+        /*
+         * The engine's credential is authoritative, and the provider's headers cannot reach it.
+         *
+         * This merge previously spread `transportHeaders` LAST, which is the strongest form of the
+         * defect corrected across the outbound arms on 2026-09-09: an identical spelling let a provider
+         * REPLACE the engine's `Authorization` outright, and a differing one produced two object keys
+         * that `fetch` combines into `authorization: <provider>, <engine>` — a request that
+         * authenticates with neither. Neither outcome is one a provider function should be able to
+         * cause; it never receives a credential in the first place.
+         *
+         * Nothing legitimate is lost: the shipped providers contribute `Accept` (Postmark) and
+         * `Idempotency-Key` (Resend), and both still reach the wire untouched.
+         */
+        const headers = withEngineOwnedHeaders(providerRequest.transportHeaders, this.buildProviderEmailHeaders(providerConfig));
         const body = this.serializeProviderEmailPayload(providerConfig, providerRequest.payload);
         const abortController = new AbortController();
         const timeoutHandle = setTimeout(() => abortController.abort(new Error(`Email provider request exceeded ${EMAIL_PROVIDER_TRANSPORT_TIMEOUT_MS}ms`)), EMAIL_PROVIDER_TRANSPORT_TIMEOUT_MS);
@@ -681,29 +751,9 @@ let EmailBackendService = class EmailBackendService {
      * headers and body consumption and can never outlive the durable lease.
      */
     async readResponseTextWithAbort(response, signal) {
-        if (signal.aborted) {
-            throw this.abortReasonToError(signal.reason);
-        }
-        let abortListener;
-        const aborted = new Promise((_resolve, reject) => {
-            abortListener = () => reject(this.abortReasonToError(signal.reason));
-            signal.addEventListener('abort', abortListener, { once: true });
-        });
-        try {
-            return await Promise.race([response.text(), aborted]);
-        }
-        finally {
-            if (abortListener) {
-                signal.removeEventListener('abort', abortListener);
-            }
-        }
-    }
-    abortReasonToError(reason) {
-        return reason instanceof Error
-            ? reason
-            : new Error(typeof reason === 'string'
-                ? reason
-                : 'Email provider request was aborted');
+        // The race itself is shared with every other substitutable outbound transport, so the property
+        // has one implementation rather than one per subsystem.
+        return readResponseTextWithinDeadline(response, signal);
     }
     describeRejectedRecipients(rejectedRecipients) {
         if (!rejectedRecipients?.length) {