@antasphere/chassis-server 1.0.0

package/src/constant-time.ts

@@ -0,0 +1,9 @@
+import { timingSafeEqual } from 'node:crypto';
+
+/** Length-safe constant-time string comparison for token checks. */
+export function constantTimeEquals(a: string, b: string): boolean {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}

package/src/email/driver.ts

@@ -0,0 +1,139 @@
+import type { Logger } from '../logger.js';
+import type { Env } from '../env.js';
+
+export interface EmailMessage {
+  to: string;
+  subject: string;
+  html: string;
+  text?: string;
+}
+
+export interface EmailDriver {
+  readonly name: 'none' | 'smtp' | 'resend' | 'brevo';
+  /** True when this driver actually delivers mail. */
+  readonly delivers: boolean;
+  send(message: EmailMessage): Promise<void>;
+}
+
+/**
+ * Default driver: no SMTP required, ever. Flows that would email (invitations,
+ * OTP) must always offer a copyable-link alternative; this driver just logs.
+ */
+class NoneDriver implements EmailDriver {
+  readonly name = 'none' as const;
+  readonly delivers = false;
+  constructor(private readonly logger: Logger) {}
+  async send(message: EmailMessage): Promise<void> {
+    this.logger.info({ to: message.to, subject: message.subject }, 'email driver=none: not sending');
+  }
+}
+
+class SmtpDriver implements EmailDriver {
+  readonly name = 'smtp' as const;
+  readonly delivers = true;
+  // Loaded lazily so the none/resend paths never import nodemailer.
+  // eslint-disable-next-line @typescript-eslint/consistent-type-imports
+  private transporterPromise: Promise<import('nodemailer').Transporter> | null = null;
+  constructor(
+    private readonly url: string,
+    private readonly from: string
+  ) {}
+  private transporter() {
+    this.transporterPromise ??= import('nodemailer').then((m) => m.default.createTransport(this.url));
+    return this.transporterPromise;
+  }
+  async send(message: EmailMessage): Promise<void> {
+    const t = await this.transporter();
+    await t.sendMail({ from: this.from, ...message });
+  }
+}
+
+class ResendDriver implements EmailDriver {
+  readonly name = 'resend' as const;
+  readonly delivers = true;
+  // eslint-disable-next-line @typescript-eslint/consistent-type-imports
+  private clientPromise: Promise<import('resend').Resend> | null = null;
+  constructor(
+    private readonly apiKey: string,
+    private readonly from: string
+  ) {}
+  private client() {
+    this.clientPromise ??= import('resend').then((m) => new m.Resend(this.apiKey));
+    return this.clientPromise;
+  }
+  async send(message: EmailMessage): Promise<void> {
+    const client = await this.client();
+    const { error } = await client.emails.send({ from: this.from, ...message });
+    if (error) throw new Error(`resend: ${error.message}`);
+  }
+}
+
+/**
+ * Brevo over its REST API, no SDK: the endpoint takes one JSON body and answers
+ * 2xx or an error, and a dependency buys nothing on top of that. Brevo is the
+ * house provider across the Antasphere templates (PRDCT-2431); `resend` and
+ * `smtp` stay supported for the instances already on them.
+ */
+class BrevoDriver implements EmailDriver {
+  readonly name = 'brevo' as const;
+  readonly delivers = true;
+  constructor(
+    private readonly apiKey: string,
+    private readonly from: string
+  ) {}
+  async send(message: EmailMessage): Promise<void> {
+    const res = await fetch('https://api.brevo.com/v3/smtp/email', {
+      method: 'POST',
+      headers: {
+        'api-key': this.apiKey,
+        'content-type': 'application/json',
+        accept: 'application/json'
+      },
+      body: JSON.stringify({
+        sender: parseSender(this.from),
+        to: [{ email: message.to }],
+        subject: message.subject,
+        htmlContent: message.html,
+        ...(message.text ? { textContent: message.text } : {})
+      })
+    });
+    if (res.ok) return;
+    // The body names the reason (bad key, unverified sender, malformed
+    // recipient) and may echo the request, so it never reaches the thrown
+    // message a caller might relay onward.
+    if (res.status === 401) throw new Error('brevo: authentication failed');
+    if (res.status === 429) throw new Error('brevo: rate limited');
+    if (res.status >= 500) throw new Error('brevo: temporarily unavailable');
+    throw new Error(`brevo: refused the message (${res.status})`);
+  }
+}
+
+/** `Name <addr>` → Brevo's split `{ name, email }`; a bare address passes through. */
+function parseSender(from: string): { name?: string; email: string } {
+  const match = /^\s*(.*?)\s*<\s*([^>]+)\s*>\s*$/.exec(from);
+  if (!match) return { email: from.trim() };
+  const [, name, email] = match;
+  return name ? { name, email: email!.trim() } : { email: email!.trim() };
+}
+
+export function createEmailDriver(
+  env: Pick<Env, 'EMAIL_DRIVER' | 'SMTP_URL' | 'RESEND_API_KEY' | 'BREVO_API_KEY' | 'EMAIL_FROM'>,
+  logger: Logger
+): EmailDriver {
+  switch (env.EMAIL_DRIVER) {
+    case 'smtp':
+      if (!env.SMTP_URL) throw new Error('EMAIL_DRIVER=smtp requires SMTP_URL');
+      if (!env.EMAIL_FROM) throw new Error('EMAIL_DRIVER=smtp requires EMAIL_FROM');
+      return new SmtpDriver(env.SMTP_URL, env.EMAIL_FROM);
+    case 'resend':
+      if (!env.RESEND_API_KEY) throw new Error('EMAIL_DRIVER=resend requires RESEND_API_KEY');
+      if (!env.EMAIL_FROM) throw new Error('EMAIL_DRIVER=resend requires EMAIL_FROM');
+      return new ResendDriver(env.RESEND_API_KEY, env.EMAIL_FROM);
+    case 'brevo':
+      if (!env.BREVO_API_KEY) throw new Error('EMAIL_DRIVER=brevo requires BREVO_API_KEY');
+      if (!env.EMAIL_FROM) throw new Error('EMAIL_DRIVER=brevo requires EMAIL_FROM');
+      return new BrevoDriver(env.BREVO_API_KEY, env.EMAIL_FROM);
+    default:
+      return new NoneDriver(logger);
+  }
+}

package/src/email/index.ts

@@ -0,0 +1,26 @@
+export { type EmailDriver, type EmailMessage, createEmailDriver } from './driver.js';
+export {
+  type EmailAssets,
+  type MailBrand,
+  type ShellParts,
+  button,
+  codePlate,
+  emailAssetsAt,
+  esc,
+  facts,
+  fine,
+  fmtDate,
+  makeShell,
+  para,
+  quietButton,
+  quote,
+  setEmailAssets,
+  spelledLink
+} from './shell.js';
+export {
+  buildChangeEmailConfirmEmail,
+  buildInviteEmail,
+  buildOtpEmail,
+  buildPasswordResetEmail,
+  buildVerifyEmailEmail
+} from './templates.js';

package/src/email/shell.ts

@@ -0,0 +1,201 @@
+/**
+ * The mail shell: the one layout every transactional email is set in, and the
+ * few blocks a builder composes a body from. The hub and the chassis carry this
+ * file BYTE-IDENTICAL (the twin rule, LESSONS.md): change one, copy it to the
+ * other. What differs per product is the `MailBrand` its templates.ts passes.
+ *
+ * The look is the dashboards': the creme paper, the umber accent, the serif
+ * display face over the sans body, mono field-note labels, and the grain over
+ * a gradient as a band at the top of the card.
+ *
+ * Mail clients are not browsers, which shapes three choices here:
+ *  - The grain band and the mark are hosted IMAGES (`/email/band.jpg`,
+ *    `/email/mark.png`, served from the dashboard's static folder). Gmail
+ *    strips SVG and data URIs, so neither can travel inline. Until
+ *    `setEmailAssets` is called (or where images are blocked) the band falls
+ *    back to a plain CSS gradient and the header to the name alone.
+ *  - Layout is tables and inline styles; the webfonts load where the client
+ *    allows a stylesheet (Apple Mail, iOS) and fall back to Georgia and the
+ *    system sans everywhere else.
+ *  - `color-scheme: light` keeps a dark-mode client from inverting the paper.
+ *
+ * Env-free like the builders: the asset urls are handed in once at boot, so a
+ * preview script can hand in its own.
+ */
+
+export interface MailBrand {
+  /** The product's name, as the header and the footer say it. */
+  name: string;
+  /** One line under the footer's name: what this product is. */
+  tagline: string;
+}
+
+export interface EmailAssets {
+  /** The grain-over-gradient band, 1200x320. */
+  band: string;
+  /** The woven-A mark, transparent, 120x120. */
+  mark: string;
+}
+
+let assets: EmailAssets | null = null;
+
+/** Hand the shell its two image urls. Called once at boot; the preview hands in its own. */
+export function setEmailAssets(next: EmailAssets | null): void {
+  assets = next;
+}
+
+/** The two urls as an instance serves them, from the dashboard's static folder. */
+export function emailAssetsAt(publicBaseUrl: string): EmailAssets {
+  const base = publicBaseUrl.replace(/\/+$/, '');
+  return { band: `${base}/email/band.jpg`, mark: `${base}/email/mark.png` };
+}
+
+/** Nothing reaches email HTML unescaped: user text, and urls in attributes alike. */
+export const esc = (s: string): string =>
+  s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+
+const INK = '#1c1915';
+const INK_SOFT = '#35302a';
+const MUTED = '#6e6759';
+const HAIRLINE = '#e0daca';
+const GROUND = '#f1ede1';
+const SHEET = '#fbf9f3';
+const PLATE = '#f4f0e5';
+const ACCENT = '#7a6652';
+const ACCENT_INK = '#f7f4ec';
+
+const DISPLAY = "'Sentient',Georgia,'Times New Roman',serif";
+const UI = "'Synonym',-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif";
+const MONO = "ui-monospace,'SF Mono',Menlo,Consolas,monospace";
+
+/** A date the way a person says it: "Thursday 22 January 2026, 14:00 UTC". */
+export function fmtDate(d: Date): string {
+  const day = new Intl.DateTimeFormat('en-GB', {
+    weekday: 'long',
+    day: 'numeric',
+    month: 'long',
+    year: 'numeric',
+    timeZone: 'UTC'
+  }).format(d);
+  const time = new Intl.DateTimeFormat('en-GB', {
+    hour: '2-digit',
+    minute: '2-digit',
+    hour12: false,
+    timeZone: 'UTC'
+  }).format(d);
+  return `${day.replace(',', '')}, ${time} UTC`;
+}
+
+// ─── Blocks ──────────────────────────────────────────────────────────
+// Each takes HTML that is already safe: the builder escapes user text.
+
+/** A paragraph of body copy. */
+export const para = (html: string): string =>
+  `<p style="margin:0 0 18px;font-family:${UI};font-size:15px;line-height:1.65;color:${INK_SOFT}">${html}</p>`;
+
+/** The one thing to do. */
+export const button = (url: string, label: string): string =>
+  `<table role="presentation" cellpadding="0" cellspacing="0" style="margin:6px 0 26px"><tr>
+<td style="border-radius:16px;background:${ACCENT}">
+<a href="${esc(url)}" style="display:inline-block;padding:12px 24px;border-radius:16px;font-family:${UI};font-size:15px;font-weight:500;color:${ACCENT_INK};text-decoration:none">${label}</a>
+</td></tr></table>`;
+
+/** The other thing to do, when a mail offers two. */
+export const quietButton = (url: string, label: string): string =>
+  `<table role="presentation" cellpadding="0" cellspacing="0" style="margin:6px 0 26px"><tr>
+<td style="border-radius:16px;border:1px solid ${HAIRLINE};background:${SHEET}">
+<a href="${esc(url)}" style="display:inline-block;padding:11px 23px;border-radius:16px;font-family:${UI};font-size:15px;font-weight:500;color:${INK};text-decoration:none">${label}</a>
+</td></tr></table>`;
+
+/** Someone's own words, set apart from ours. */
+export const quote = (html: string): string =>
+  `<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="margin:0 0 20px"><tr>
+<td style="border-left:2px solid ${ACCENT};padding:4px 0 4px 16px;font-family:${DISPLAY};font-size:17px;line-height:1.55;font-style:italic;color:${INK}">${html}</td>
+</tr></table>`;
+
+/** A plate of labelled facts: mono field-note labels over the values. */
+export const facts = (rows: Array<[label: string, valueHtml: string]>): string =>
+  `<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="margin:0 0 24px;background:${PLATE};border:1px solid ${HAIRLINE};border-radius:12px"><tr><td style="padding:6px 18px">
+<table role="presentation" width="100%" cellpadding="0" cellspacing="0">${rows
+    .map(
+      ([label, value], i) => `<tr>
+<td style="padding:11px 16px 11px 0;${i > 0 ? `border-top:1px solid ${HAIRLINE};` : ''}font-family:${MONO};font-size:10px;letter-spacing:0.14em;text-transform:uppercase;color:${MUTED};white-space:nowrap;vertical-align:top;width:1%">${label}</td>
+<td style="padding:9px 0;${i > 0 ? `border-top:1px solid ${HAIRLINE};` : ''}font-family:${UI};font-size:14px;line-height:1.5;color:${INK};vertical-align:top">${value}</td>
+</tr>`
+    )
+    .join('')}</table>
+</td></tr></table>`;
+
+/** A code to type, large enough to read across a desk. */
+export const codePlate = (code: string): string =>
+  `<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="margin:0 0 24px;background:${PLATE};border:1px solid ${HAIRLINE};border-radius:12px"><tr>
+<td align="center" style="padding:22px 12px;font-family:${MONO};font-size:34px;font-weight:600;letter-spacing:0.28em;color:${INK}">${esc(code)}</td>
+</tr></table>`;
+
+/** The small print under the action. */
+export const fine = (html: string): string =>
+  `<p style="margin:0 0 10px;font-family:${UI};font-size:13px;line-height:1.6;color:${MUTED}">${html}</p>`;
+
+/** The link spelled out, for when the button does not work. */
+export const spelledLink = (url: string): string =>
+  `<p style="margin:0;font-family:${UI};font-size:12px;line-height:1.6;color:${MUTED}">Button not working? Paste this into your browser:<br>
+<span style="font-family:${MONO};font-size:11px;word-break:break-all;color:${MUTED}">${esc(url)}</span></p>`;
+
+// ─── The shell ───────────────────────────────────────────────────────
+
+export interface ShellParts {
+  /** The inbox preview line, hidden in the body. */
+  preheader: string;
+  /** The mono label over the title: what kind of mail this is. */
+  eyebrow: string;
+  /** The title, already escaped. */
+  title: string;
+  /** The blocks. */
+  body: string;
+}
+
+export function makeShell(brand: MailBrand): (parts: ShellParts) => string {
+  return (parts) => {
+    const band = assets
+      ? `background-color:#e6dccb;background-image:url('${esc(assets.band)}');background-size:cover;background-position:center`
+      : 'background-color:#e6dccb;background-image:linear-gradient(115deg,#f6f0e4 0%,#ece4d6 45%,#d9c6ac 80%,#c9b193 100%)';
+    const mark = assets
+      ? `<td style="padding-right:11px;vertical-align:middle"><img src="${esc(assets.mark)}" width="34" height="34" alt="" style="display:block;border:0"></td>`
+      : '';
+
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="light">
+<meta name="supported-color-schemes" content="light">
+<title>${esc(brand.name)}</title>
+<link rel="stylesheet" href="https://api.fontshare.com/v2/css?f%5B%5D=sentient@300,400&f%5B%5D=synonym@400,500&display=swap">
+</head>
+<body style="margin:0;padding:0;background:${GROUND}">
+<div style="display:none;max-height:0;overflow:hidden;opacity:0;color:${GROUND};font-size:1px;line-height:1px">${esc(parts.preheader)}</div>
+<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:${GROUND}">
+<tr><td align="center" style="padding:36px 16px 40px">
+<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:560px;background:${SHEET};border:1px solid ${HAIRLINE};border-radius:18px;overflow:hidden">
+<tr><td height="124" style="height:124px;padding:0 36px 22px;vertical-align:bottom;border-bottom:1px solid ${HAIRLINE};${band}">
+  <table role="presentation" cellpadding="0" cellspacing="0"><tr>
+    ${mark}
+    <td style="vertical-align:middle;font-family:${DISPLAY};font-size:23px;font-weight:300;letter-spacing:-0.01em;color:${INK}">${esc(brand.name)}</td>
+  </tr></table>
+</td></tr>
+<tr><td style="padding:34px 36px 30px">
+  <p style="margin:0 0 12px;font-family:${MONO};font-size:10px;letter-spacing:0.16em;text-transform:uppercase;color:${ACCENT}">${esc(parts.eyebrow)}</p>
+  <h1 style="margin:0 0 20px;font-family:${DISPLAY};font-size:29px;line-height:1.2;font-weight:300;letter-spacing:-0.015em;color:${INK}">${parts.title}</h1>
+  ${parts.body}
+</td></tr>
+<tr><td style="padding:20px 36px 24px;border-top:1px solid ${HAIRLINE};background:${PLATE}">
+  <p style="margin:0 0 3px;font-family:${DISPLAY};font-size:15px;font-weight:400;color:${INK}">${esc(brand.name)}</p>
+  <p style="margin:0;font-family:${UI};font-size:12px;line-height:1.55;color:${MUTED}">${esc(brand.tagline)}</p>
+</td></tr>
+</table>
+</td></tr>
+</table>
+</body></html>`;
+  };
+}

package/src/email/templates.ts

@@ -0,0 +1,184 @@
+/**
+ * The account mails every tool sends: the workspace invitation, the password
+ * reset, the two legs of an email change and the sign-in code. Env-free by
+ * design (ported convention from a predecessor template): every env-dependent
+ * value (urls, names, dates) arrives as a parameter, so a preview script can
+ * render these standalone (`pnpm preview:emails` in a tool's server app).
+ *
+ * The layout and the blocks live in shell.ts; this file holds what the mails
+ * SAY. The voice is the product's, not a log's: say what happened, who did it,
+ * and the one thing to do next, in the words a person would use.
+ *
+ * The chassis spells no product. The name and the footer line arrive as the
+ * `brand` (`identity.displayName` + `copy.mail.tagline`), and the two phrases
+ * of the invitation that say what the tool IS arrive from `copy.mail` too. A
+ * tool's own mails (its app's email folder) compose the same shell and blocks.
+ */
+import {
+  button,
+  codePlate,
+  esc,
+  fine,
+  fmtDate,
+  makeShell,
+  para,
+  spelledLink,
+  type MailBrand
+} from './shell.js';
+
+export interface InviteEmailParams {
+  /** The product's name and footer line (`identity.displayName`, `copy.mail.tagline`). */
+  brand: MailBrand;
+  /** What joining gives, in the tool's words (`copy.mail.invitePitch`). */
+  pitch: string;
+  /** The end of the inbox preview line, after "Join <workspace> on <name>: " (`copy.mail.invitePreheader`). */
+  preheader: string;
+  inviteeEmail: string;
+  inviterName: string;
+  workspaceName: string;
+  acceptUrl: string;
+  expiresAt: Date;
+}
+
+export function buildInviteEmail(p: InviteEmailParams): { subject: string; html: string; text: string } {
+  const name = p.brand.name;
+  const subject = `${p.inviterName} invited you to ${p.workspaceName}`;
+  const html = makeShell(p.brand)({
+    preheader: `Join ${p.workspaceName} on ${name}: ${p.preheader}`,
+    eyebrow: 'Invitation',
+    title: `${esc(p.inviterName)} wants you in ${esc(p.workspaceName)}`,
+    body:
+      para(
+        `You have been invited to <strong>${esc(p.workspaceName)}</strong>, a workspace on ${esc(name)}.
+         ${esc(p.pitch)}`
+      ) +
+      button(p.acceptUrl, 'Join the workspace') +
+      fine(
+        `This invitation was sent to ${esc(p.inviteeEmail)} and stays open until ${fmtDate(p.expiresAt)}.`
+      ) +
+      spelledLink(p.acceptUrl)
+  });
+  const text = `${p.inviterName} invited you to join ${p.workspaceName} on ${name}.\n\nJoin the workspace: ${p.acceptUrl}\n\nThe invitation stays open until ${fmtDate(p.expiresAt)}.`;
+  return { subject, html, text };
+}
+
+export interface PasswordResetEmailParams {
+  /** The product's name and footer line (`identity.displayName`, `copy.mail.tagline`). */
+  brand: MailBrand;
+  resetUrl: string;
+  expiresAt: Date;
+}
+
+export function buildPasswordResetEmail(p: PasswordResetEmailParams): {
+  subject: string;
+  html: string;
+  text: string;
+} {
+  const name = p.brand.name;
+  const subject = `Reset your ${name} password`;
+  const html = makeShell(p.brand)({
+    preheader: 'Choose a new password. If you did not ask for this, nothing changes.',
+    eyebrow: 'Your account',
+    title: 'Let’s get you a new password',
+    body:
+      para(
+        `Someone asked to reset the password of your ${esc(name)} account. If that was you, choose a new one here:`
+      ) +
+      button(p.resetUrl, 'Choose a new password') +
+      fine(
+        `The link works until ${fmtDate(p.expiresAt)}. If you did not ask for this, ignore this email: your password stays as it is.`
+      ) +
+      spelledLink(p.resetUrl)
+  });
+  const text = `Reset your ${name} password: ${p.resetUrl}\n\nThe link works until ${fmtDate(p.expiresAt)}. If you did not ask for this, ignore this email: your password stays as it is.`;
+  return { subject, html, text };
+}
+
+export interface ChangeEmailConfirmEmailParams {
+  /** The product's name and footer line (`identity.displayName`, `copy.mail.tagline`). */
+  brand: MailBrand;
+  newEmail: string;
+  confirmUrl: string;
+  expiresAt: Date;
+}
+
+/** To the OLD address: a verified user must confirm the change first (two-leg flow). */
+export function buildChangeEmailConfirmEmail(p: ChangeEmailConfirmEmailParams): {
+  subject: string;
+  html: string;
+  text: string;
+} {
+  const name = p.brand.name;
+  const subject = `Confirm your ${name} email change`;
+  const html = makeShell(p.brand)({
+    preheader: `You asked to move your account to ${p.newEmail}. Confirm it here.`,
+    eyebrow: 'Your account',
+    title: 'Moving to a new address?',
+    body:
+      para(
+        `You asked to change the email of your ${esc(name)} account to <strong>${esc(p.newEmail)}</strong>.
+         Confirm it here, and we will send one last link to the new address to finish the move.`
+      ) +
+      button(p.confirmUrl, 'Yes, change my email') +
+      fine(
+        `The link works until ${fmtDate(p.expiresAt)}. If you did not ask for this, ignore this email: your address stays as it is.`
+      ) +
+      spelledLink(p.confirmUrl)
+  });
+  const text = `Confirm changing your ${name} email to ${p.newEmail}: ${p.confirmUrl}\n\nThe link works until ${fmtDate(p.expiresAt)}. If you did not ask for this, ignore this email: your address stays as it is.`;
+  return { subject, html, text };
+}
+
+export interface VerifyEmailEmailParams {
+  /** The product's name and footer line (`identity.displayName`, `copy.mail.tagline`). */
+  brand: MailBrand;
+  verifyUrl: string;
+  expiresAt: Date;
+}
+
+/** To the NEW address: the final leg of every email change (and any plain verification). */
+export function buildVerifyEmailEmail(p: VerifyEmailEmailParams): {
+  subject: string;
+  html: string;
+  text: string;
+} {
+  const name = p.brand.name;
+  const subject = `Verify your ${name} email address`;
+  const html = makeShell(p.brand)({
+    preheader: 'One click to confirm this address is yours.',
+    eyebrow: 'Your account',
+    title: 'Is this address yours?',
+    body:
+      para(
+        `One click confirms that this address belongs to you, and it becomes the email of your ${esc(name)} account.`
+      ) +
+      button(p.verifyUrl, 'Yes, verify this address') +
+      fine(`The link works until ${fmtDate(p.expiresAt)}. If you did not ask for this, ignore this email.`) +
+      spelledLink(p.verifyUrl)
+  });
+  const text = `Verify your ${name} email address: ${p.verifyUrl}\n\nThe link works until ${fmtDate(p.expiresAt)}. If you did not ask for this, ignore this email.`;
+  return { subject, html, text };
+}
+
+export interface OtpEmailParams {
+  /** The product's name and footer line (`identity.displayName`, `copy.mail.tagline`). */
+  brand: MailBrand;
+  otp: string;
+  type: string;
+}
+
+export function buildOtpEmail(p: OtpEmailParams): { subject: string; html: string; text: string } {
+  const name = p.brand.name;
+  const subject = `${p.otp} is your ${name} code`;
+  const html = makeShell(p.brand)({
+    preheader: 'Type it in to continue. It only works once.',
+    eyebrow: 'Sign in',
+    title: 'Here is your code',
+    body:
+      para(`Type this into ${esc(name)} to continue:`) +
+      codePlate(p.otp) +
+      fine('The code works once and only for a few minutes. If you did not ask for it, ignore this email.')
+  });
+  const text = `Your ${name} code: ${p.otp}\n\nIt works once and only for a few minutes. If you did not ask for it, ignore this email.`;
+  return { subject, html, text };
+}