@kelpie/server 0.5.2 → 0.7.0

package/migrations/meta/_journal.json

@@ -134,6 +134,20 @@
       "when": 1786656430307,
       "tag": "0018_hard_mystique",
       "breakpoints": true
+    },
+    {
+      "idx": 19,
+      "version": "7",
+      "when": 1787446086593,
+      "tag": "0019_sharp_red_skull",
+      "breakpoints": true
+    },
+    {
+      "idx": 20,
+      "version": "7",
+      "when": 1787447911296,
+      "tag": "0020_early_nemesis",
+      "breakpoints": true
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kelpie/server",
-  "version": "0.5.2",
+  "version": "0.7.0",
   "description": "The Kelpie service as a library: module runtime, core CRM modules, REST API, MCP surface, and the shared migration pipeline.",
   "keywords": [
     "kelpie",
@@ -52,13 +52,16 @@
   },
   "dependencies": {
     "@hono/node-server": "^2.0.12",
-    "@kelpie/schemas": "^0.5.2",
+    "@kelpie/schemas": "^0.7.0",
     "@node-rs/argon2": "^2.0.2",
     "drizzle-orm": "^0.45.2",
+    "emittery": "^2.0.0",
     "hono": "^4.12.32",
     "nodemailer": "^9.0.5",
     "postgres": "^3.4.9",
     "ulid": "^3.0.2",
+    "winston": "^3.19.0",
+    "winston-transport": "^4.9.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/src/app.ts

@@ -2,6 +2,7 @@ import { Hono } from 'hono'
 import type { Context } from 'hono'
 import { cors } from 'hono/cors'
 
+import type { RuntimeMode } from './lib/config.ts'
 import type { DatabaseProbe } from './lib/database.ts'
 import { AppError, internalErrorBody, toErrorBody } from './lib/errors.ts'
 import { PUBLIC_ROUTE_PREFIX } from './lib/http.ts'
@@ -51,6 +52,18 @@ export interface AppDependencies {
    * control (`testing/app.ts`).
    */
   readonly resolveClientIp: (context: Context) => string
+  /**
+   * Reported through `GET /v1/public/config` so the browser knows which
+   * runtime it is talking to. Defaults to `'production'` so a caller that has
+   * not thought about it fails safe: no banner shows.
+   */
+  readonly runtimeMode?: RuntimeMode
+  /**
+   * Reported through `GET /v1/public/config` so a non-production UI can name
+   * the site it is on. Undefined is fine and means "this deployment did not
+   * name itself".
+   */
+  readonly siteName?: string | undefined
 }
 
 /** Per-request values the middleware chain sets and handlers read. */
@@ -161,6 +174,19 @@ export function createApp(dependencies: AppDependencies): Hono<AppBindings> {
     app.route(PUBLIC_ROUTE_PREFIX, router)
   }
 
+  // Public deployment metadata the browser reads once at boot. Sits under the
+  // public prefix so the CORS and rate-limit layers above cover it, and takes
+  // no credentials for the same reason /healthz does not: the pages that read
+  // it include the sign-in page, which runs before any session exists. The
+  // runtime mode is already visible in error messages, and the site name
+  // exists to be visible; nothing here is sensitive.
+  const runtimeMode: RuntimeMode = dependencies.runtimeMode ?? 'production'
+  const siteName = dependencies.siteName ?? null
+
+  app.get(`${PUBLIC_ROUTE_PREFIX}/config`, (context) =>
+    context.json({ runtime_mode: runtimeMode, site_name: siteName }, 200),
+  )
+
   for (const { router } of dependencies.contributions.routers) {
     app.route('/v1', router)
   }

package/src/boot.ts

@@ -0,0 +1,89 @@
+import type { Environment, KelpieConfig } from './lib/config.ts'
+import { connectDatabase } from './lib/database.ts'
+import type { DatabaseConnection } from './lib/database.ts'
+import { createIdFactory } from './lib/ids.ts'
+import type { IdFactory } from './lib/ids.ts'
+import { resolveKelpieConfig } from './lib/kelpieConfigFile.ts'
+import type { KelpieConfigInput } from './lib/kelpieConfigFile.ts'
+import { createLogger, createTransportForDestination } from './lib/logger.ts'
+import type { Logger } from './lib/logger.ts'
+import { readModuleConfigFile } from './lib/moduleConfig.ts'
+import { resolveActorFrom } from './modules/auth/credentials.ts'
+import type { CredentialDependencies } from './modules/auth/credentials.ts'
+import { createEventBus } from './runtime/events.ts'
+import { registerModules } from './runtime/registry.ts'
+import type { ModuleContributions } from './runtime/registry.ts'
+import { createTransactionScope } from './runtime/transaction.ts'
+
+/**
+ * A resolved assembly: config parsed, database connected, modules registered.
+ *
+ * This is the common prelude every entry point needs before it does its own
+ * work. `server.ts` goes on to build the app and serve; `migrate.ts` goes on to
+ * apply migrations and exit. Both start here, so the wiring lives in one place
+ * rather than drifting between two copies.
+ *
+ * The database is connected but not opened: postgres.js connects lazily, and
+ * registration issues no query, so a caller that only needs the contributions
+ * pays for no connection. The caller owns `database.close()`.
+ */
+export interface AssemblyBoot {
+  readonly config: KelpieConfig
+  readonly logger: Logger
+  readonly database: DatabaseConnection
+  readonly createId: IdFactory
+  readonly credentials: CredentialDependencies
+  readonly contributions: ModuleContributions
+}
+
+/**
+ * Resolves an assembly's config, connects the database, and runs the module
+ * registration pass.
+ *
+ * Registration touches no database. It only collects what the modules
+ * contribute, migrations directories included, which is why an entry point can
+ * call this and then decide whether to serve, migrate, or both.
+ *
+ * @throws ConfigurationError when a required variable is missing or malformed.
+ * @throws ModuleConfigFileError when the module override file cannot be read.
+ * @throws ModuleBootError when the module list is invalid or a module fails to
+ *   register. The caller maps these to a fix hint and an exit code.
+ */
+export async function bootAssembly(
+  kelpieConfig: KelpieConfigInput,
+  environment: Environment,
+): Promise<AssemblyBoot> {
+  const config = resolveKelpieConfig(kelpieConfig, environment)
+  const logger = createLogger({
+    level: config.logging.level,
+    transports: config.logging.destinations.map(createTransportForDestination),
+  })
+  const database = connectDatabase(config.databaseUrl, logger)
+  const events = createEventBus(logger)
+  const createId = createIdFactory()
+  const credentials: CredentialDependencies = { db: database.db, now: () => new Date() }
+  const moduleConfig = readModuleConfigFile(config.moduleConfigPath)
+  const contributions = await registerModules({
+    modules: kelpieConfig.modules,
+    environment: config.env,
+    logger,
+    events,
+    moduleConfig,
+    resolveActor: (context) => resolveActorFrom(credentials, context),
+    services: {
+      db: database.db,
+      transaction: createTransactionScope({ db: database.db, bus: events, logger, createId }),
+      createId,
+      now: () => new Date(),
+      appBaseUrl: config.appBaseUrl,
+      secretEncryption: config.secretEncryption,
+    },
+    // `provider` picks a named sender from the runtime's registry. `'log'` is
+    // built in; `'smtp'` is registered by the built-in `smtp-email` core
+    // module; other names come from third-party provider modules listed in
+    // `kelpie.config.ts`. `from` is the address on every outgoing message.
+    email: { provider: config.email.EMAIL_PROVIDER, from: config.email.EMAIL_FROM },
+  })
+
+  return { config, logger, database, createId, credentials, contributions }
+}

package/src/index.ts

@@ -1,12 +1,35 @@
+// Carries each module's `KelpieEventMap` augmentation into the emitted
+// `index.d.ts` so consumers installed from npm get a typed `event.data`. See
+// `modules/eventCatalogs.ts` for why the entry point has to reference them.
+import './modules/eventCatalogs.ts'
+
 export { createApp } from './app.ts'
 export type { AppDependencies, AppBindings } from './app.ts'
 
+export { bootAssembly } from './boot.ts'
+export type { AssemblyBoot } from './boot.ts'
+
 export { WebBundleError, serveWebBundle } from './webBundle.ts'
 export type { WebBundleOptions } from './webBundle.ts'
 
 export { ConfigurationError, loadConfig } from './lib/config.ts'
 export type { Environment, KelpieConfig, LogLevel, RuntimeMode } from './lib/config.ts'
 
+export { fromEnv, isFromEnvMarker, resolveMarker, resolveMarkers } from './lib/fromEnv.ts'
+export type { ConfigValue, FromEnvMarker, FromEnvProblem, ResolveResult } from './lib/fromEnv.ts'
+
+export { defineKelpieConfig, resolveKelpieConfig } from './lib/kelpieConfigFile.ts'
+export type {
+  EmailInput,
+  KelpieConfigInput,
+  RateLimitBudgetInput,
+  RateLimitInput,
+  SecretEncryptionInput,
+} from './lib/kelpieConfigFile.ts'
+
+export { appUrlConfigSchema } from './lib/appUrl.ts'
+export type { AppUrlConfig } from './lib/appUrl.ts'
+
 export { resolveClientIpFrom } from './lib/clientIp.ts'
 
 export { ModuleConfigFileError, readModuleConfigFile } from './lib/moduleConfig.ts'
@@ -23,9 +46,12 @@ export type { Database, DatabaseConnection, DatabaseProbe } from './lib/database
 
 export * as schema from './schema/index.ts'
 
-export { createEmailSender, createLogEmailSender, emailConfigSchema } from './lib/email.ts'
+export { createLogEmailSender, emailConfigSchema } from './lib/email.ts'
 export type { EmailConfig, EmailMessage, EmailSender } from './lib/email.ts'
 
+export { SMTP_EMAIL_PROVIDER, createSmtpEmailModule, createSmtpEmailSender } from './modules/smtp-email/index.ts'
+export type { SmtpEmailConfig, SmtpEmailModuleOptions, SmtpTransport } from './modules/smtp-email/index.ts'
+
 export { MINIMUM_PASSWORD_LENGTH, hashPassword, isPasswordStrongEnough, verifyPassword } from './lib/passwords.ts'
 export { generateToken, hashToken, tokenHashesMatch } from './lib/tokens.ts'
 
@@ -49,8 +75,13 @@ export type { ErrorBody, ErrorCode, ErrorDetail, ErrorStatus, ValidationIssue }
 export { createIdFactory, idPrefixes } from './lib/ids.ts'
 export type { IdFactory, ObjectKind } from './lib/ids.ts'
 
-export { createLogger } from './lib/logger.ts'
-export type { LogFields, Logger, LogSink } from './lib/logger.ts'
+export {
+  createCaptureTransport,
+  createLogger,
+  createStdoutTransport,
+  createTransportForDestination,
+} from './lib/logger.ts'
+export type { CreateLoggerOptions, LogFields, Logger, LoggingDestination } from './lib/logger.ts'
 
 export type {
   KelpieModule,
@@ -76,21 +107,33 @@ export type {
 
 export { SEATS_LIMIT } from './modules/workspace/capabilities.ts'
 
-export { DOMAIN_EVENT_NAMES, RECORD_OBJECT_TYPES, createEventBus } from './runtime/events.ts'
+export {
+  RECORD_OBJECT_TYPES,
+  checkEventCycle,
+  createEventBus,
+  currentEventChain,
+} from './runtime/events.ts'
 export type {
-  DomainEventName,
-  DomainEvents,
+  AnyEventHandler,
+  CycleGuardOutcome,
   EventBus,
+  EventBusOptions,
+  EventCatalog,
+  EventChainEntry,
   EventHandler,
+  EventName,
+  KelpieEventMap,
   RecordObjectType,
-  StagedObjectType,
+  SubscribeOptions,
 } from './runtime/events.ts'
+export type { ModuleEventCatalog } from './runtime/module.ts'
 
 export { createTransactionScope } from './runtime/transaction.ts'
 export type {
   BufferedEvents,
   Transaction,
   TransactionContext,
+  TransactionOptions,
   TransactionScope,
   TransactionScopeDependencies,
 } from './runtime/transaction.ts'
@@ -100,8 +143,8 @@ export type { MigrationPlanStep } from './runtime/migrate.ts'
 
 export { coreMigrationsDirectory, coreModules } from './modules/core.ts'
 
-export { resealStoredSecrets } from './modules/reseal.ts'
-export type { ResealColumnOutcome, ResealOutcome } from './modules/reseal.ts'
+export { resealStoredSecrets, runReseal } from './modules/reseal.ts'
+export type { ResealColumnOutcome, ResealOutcome, ResealPass, RunResealOptions } from './modules/reseal.ts'
 
 export { KEY_KINDS, kindOfSecret, mintKey, parseKeyKind, readBearerToken } from './modules/api-keys/keys.ts'
 export type { KeyKind, MintedKey } from './modules/api-keys/keys.ts'

package/src/lib/actor.ts

@@ -1,4 +1,4 @@
-import type { MemberRole } from '@kelpie/schemas'
+import type { EventActor, MemberRole } from '@kelpie/schemas'
 
 import { AppError } from './errors.ts'
 
@@ -97,3 +97,17 @@ export function actorUserId(actor: Actor): string | null {
 export function actorMemberId(actor: Actor): string | null {
   return actor.memberId
 }
+
+/**
+ * Maps the request actor to the actor stamped on domain events.
+ *
+ * A signed-in user becomes `user`. A workspace key (no user behind it) becomes
+ * `system`, because the event was caused by the workspace itself rather than
+ * any one person.
+ */
+export function toEventActor(actor: Actor): EventActor {
+  if (actor.userId !== null) {
+    return { kind: 'user', id: actor.userId }
+  }
+  return { kind: 'system' }
+}

package/src/lib/config.ts

@@ -3,8 +3,14 @@ import { z } from 'zod'
 import { emailConfigSchema } from './email.ts'
 import type { EmailConfig } from './email.ts'
 import { describeValidationIssue } from './errors.ts'
+// `EmailConfig` is `{ EMAIL_PROVIDER, EMAIL_FROM }`. `EMAIL_PROVIDER` names one
+// of the registered senders; `'log'` is always available, other names come
+// from provider modules. Provider-specific config (SMTP settings, an API key)
+// belongs to the module that reads it through `context.config(...)`.
+import type { LoggingDestination } from './logger.ts'
 import { rateLimitConfigFrom, rateLimitConfigSchema } from './rateLimit.ts'
 import type { RateLimitConfig } from './rateLimit.ts'
+import type { SecretEncryptionConfig } from './secrets.ts'
 
 /**
  * The single place the service reads environment variables. Every other module
@@ -18,12 +24,36 @@ export type RuntimeMode = 'development' | 'test' | 'production'
 
 export type LogLevel = 'debug' | 'info' | 'warn' | 'error'
 
+/**
+ * Everything the logger needs to boot: the minimum severity to emit, and the
+ * ordered list of destinations each line is written to. Stdout is one such
+ * destination; adding a file or a hosted collector means adding an entry to
+ * `destinations` and extending `LoggingDestination` in `lib/logger.ts`.
+ */
+export interface LoggingConfig {
+  readonly level: LogLevel
+  readonly destinations: readonly LoggingDestination[]
+}
+
 export interface KelpieConfig {
   readonly runtimeMode: RuntimeMode
   readonly port: number
   readonly databaseUrl: string
-  readonly logLevel: LogLevel
-  /** Transactional mail only. Roadmap decision 4: configured, never hardcoded. */
+  /**
+   * Human-readable name of this deployment ("dev", "demo", "cloud", or
+   * whatever the self-hoster picks). Undefined is normal. Exposed to the
+   * browser through `GET /v1/public/config` so a non-production UI can name
+   * the site it is on. Ignored when `runtimeMode` is `production`.
+   */
+  readonly siteName: string | undefined
+  readonly logging: LoggingConfig
+  /**
+   * The provider name the module runtime looks up in its registry, and the
+   * from address every outgoing message uses. See `lib/email.ts` for the
+   * shape and rules; `'log'` is always available, `'smtp'` is registered by
+   * the built-in `smtp-email` core module, and other names come from
+   * third-party provider modules.
+   */
   readonly email: EmailConfig
   /**
    * Path to the deploy-time module override file (`lib/moduleConfig.ts`).
@@ -44,6 +74,28 @@ export interface KelpieConfig {
    * client IP is read from `X-Forwarded-For` (`lib/clientIp.ts`).
    */
   readonly trustedProxyHopCount: number
+  /**
+   * What modules see through `context.config(schema)`. `resolveKelpieConfig`
+   * produces this by merging any `env` section in `kelpie.config.ts` over
+   * `process.env`, so a key in the config file wins for that key and unset
+   * keys pass through. `loadConfig` sets it to the environment it was given,
+   * so an old caller keeps the same behaviour.
+   */
+  readonly env: Environment
+  /**
+   * The deployment's base URL, source of every emailed link. Optional so an
+   * older assembly that omits it from `kelpie.config.ts` still boots: modules
+   * that need it fall back to `context.config(appUrlConfigSchema)` when unset.
+   * A new assembly declares it as a first-class field.
+   */
+  readonly appBaseUrl: string | undefined
+  /**
+   * The key(s) that seal stored secrets. Optional for the same reason
+   * `appBaseUrl` is: modules that need it fall back to
+   * `context.config(secretEncryptionConfigSchema)`. The base assembly declares
+   * it, so both webhooks and agent-tasks receive it through `services`.
+   */
+  readonly secretEncryption: SecretEncryptionConfig | undefined
 }
 
 /** Thrown at boot when the environment cannot produce a valid configuration. */
@@ -74,6 +126,7 @@ const environmentSchema = z.object({
     .refine(isPostgresUrl, { message: 'must be a postgres:// or postgresql:// connection string' }),
   LOG_LEVEL: z.enum(['debug', 'info', 'warn', 'error']),
   KELPIE_MODULE_CONFIG_PATH: z.string().min(1).optional(),
+  KELPIE_SITE_NAME: z.string().min(1).optional(),
   WEB_BUNDLE_DIR: z.string().min(1).optional(),
   TRUSTED_PROXY_HOP_COUNT: z.coerce.number().int().nonnegative().default(0),
   ...rateLimitConfigSchema.shape,
@@ -82,10 +135,8 @@ const environmentSchema = z.object({
 /**
  * Parses an environment into a validated config.
  *
- * `emailConfigSchema` is a discriminated union, so it is parsed separately
- * from the rest: a union has no flat `.shape` to spread into `environmentSchema`,
- * only its own `EMAIL_PROVIDER`-keyed branches. Problems from both parses are
- * combined into one error, preserving the "every missing variable at once" rule.
+ * The email variables are parsed separately so a caller sees every missing
+ * variable at once, rather than one at a time.
  *
  * @param environment Raw variables, normally `process.env`.
  * @throws ConfigurationError listing every invalid or missing variable.
@@ -107,11 +158,18 @@ export function loadConfig(environment: Environment): KelpieConfig {
     runtimeMode: environmentResult.data.NODE_ENV,
     port: environmentResult.data.PORT,
     databaseUrl: environmentResult.data.DATABASE_URL,
-    logLevel: environmentResult.data.LOG_LEVEL,
+    logging: {
+      level: environmentResult.data.LOG_LEVEL,
+      destinations: [{ kind: 'stdout' }],
+    },
     email: emailResult.data,
     moduleConfigPath: environmentResult.data.KELPIE_MODULE_CONFIG_PATH,
+    siteName: environmentResult.data.KELPIE_SITE_NAME,
     webBundleDirectory: environmentResult.data.WEB_BUNDLE_DIR,
     rateLimit: rateLimitConfigFrom(environmentResult.data),
     trustedProxyHopCount: environmentResult.data.TRUSTED_PROXY_HOP_COUNT,
+    env: environment,
+    appBaseUrl: undefined,
+    secretEncryption: undefined,
   }
 }

package/src/lib/email.ts

@@ -1,7 +1,5 @@
-import nodemailer from 'nodemailer'
 import { z } from 'zod'
 
-import { describeThrown } from './errors.ts'
 import type { Logger } from './logger.ts'
 
 /**
@@ -9,15 +7,15 @@ import type { Logger } from './logger.ts'
  * and account-change notifications, nothing else. Kelpie never sends outreach
  * email.
  *
- * Roadmap decision 4: the provider is configured, never hardcoded. Core ships
- * the port and two providers, `log` and `smtp`. Both need no vendor account a
- * deployment doesn't already have, which is what keeps them in core rather than
- * a module, per `modules.md`'s split test. A provider that does need one
- * (Resend, Postmark, Mailtrap, SendGrid) is a commercial integration under that
- * same test and belongs in a module: it supplies its own `EmailSender` from its
- * own config, and an assembly's entry point wires it into `services.email` in
- * place of `createEmailSender`, the same way `kelpie-cloud/src/server.ts` wires
- * this one today.
+ * The assembly names one named provider in `kelpie.config.ts`'s
+ * `email.provider`. The module runtime resolves the name against a registry
+ * every module can contribute to via `context.provideEmailSender(name, sender)`.
+ * `'log'` is a built-in name the runtime always registers, so a bare install
+ * has something to point at. `'smtp'` is registered by the built-in
+ * `smtp-email` core module. Other names come from third-party provider modules
+ * (Resend, Postmark, SES) that follow the same registry pattern. Transport is
+ * arbitrary: the module builds one behind the `EmailSender` interface and
+ * hands it to core, which knows only how to `send`.
  */
 
 export interface EmailMessage {
@@ -30,40 +28,29 @@ export interface EmailSender {
   send(message: EmailMessage): Promise<void>
 }
 
-const logEmailConfigSchema = z.object({
-  EMAIL_PROVIDER: z.literal('log'),
+export const emailConfigSchema = z.object({
+  /**
+   * The named provider `registerModules` resolves against its registry. `'log'`
+   * is a built-in, always present. Any other name needs a module that
+   * registered it via `context.provideEmailSender(name, sender)`. Free-string
+   * so a self-hoster can add a module core has never heard of.
+   */
+  EMAIL_PROVIDER: z.string().min(1),
   EMAIL_FROM: z.string().min(1),
 })
 
-const smtpEmailConfigSchema = z.object({
-  EMAIL_PROVIDER: z.literal('smtp'),
-  EMAIL_FROM: z.string().min(1),
-  SMTP_HOST: z.string().min(1),
-  SMTP_PORT: z.coerce.number().int().positive().max(65535),
-  SMTP_SECURE: z.enum(['true', 'false']).transform((value) => value === 'true'),
-  SMTP_USER: z.string().min(1),
-  SMTP_PASSWORD: z.string().min(1),
-})
-
-export const emailConfigSchema = z.discriminatedUnion('EMAIL_PROVIDER', [
-  logEmailConfigSchema,
-  smtpEmailConfigSchema,
-])
-
 export type EmailConfig = z.infer<typeof emailConfigSchema>
-export type SmtpEmailConfig = z.infer<typeof smtpEmailConfigSchema>
 
 /**
- * Writes the message to the log instead of sending it. For self-hosted
- * development, where the reset link in the log is exactly what you want.
- *
- * This is a deliberate choice, not a fallback: `EMAIL_PROVIDER` has no default,
- * so nobody reaches this provider without naming it.
+ * Writes the message to the log instead of sending it. The registry default,
+ * swapped out for a real sender by picking a different provider name in
+ * `email.provider` (`'smtp'` for the built-in SMTP module, or any name a
+ * third-party provider module registers).
  */
 export function createLogEmailSender(logger: Logger, from: string): EmailSender {
   return {
     send(message) {
-      logger.info('email not sent: provider is "log"', {
+      logger.info('email not sent: no provider module registered', {
         from,
         to: message.to,
         subject: message.subject,
@@ -74,60 +61,3 @@ export function createLogEmailSender(logger: Logger, from: string): EmailSender
     },
   }
 }
-
-/**
- * What `createSmtpEmailSender` sends a message through. A real deployment gets
- * one backed by `nodemailer`; a test injects one that records calls, so the
- * sender is verifiable without a container running a real SMTP conversation.
- */
-export interface SmtpTransport {
-  sendMail(message: { from: string; to: string; subject: string; text: string }): Promise<unknown>
-}
-
-function createNodemailerTransport(config: SmtpEmailConfig): SmtpTransport {
-  return nodemailer.createTransport({
-    host: config.SMTP_HOST,
-    port: config.SMTP_PORT,
-    secure: config.SMTP_SECURE,
-    auth: { user: config.SMTP_USER, pass: config.SMTP_PASSWORD },
-  })
-}
-
-/** Sends over SMTP. `transport` defaults to a real connection built from `config`. */
-export function createSmtpEmailSender(
-  config: SmtpEmailConfig,
-  logger: Logger,
-  transport: SmtpTransport = createNodemailerTransport(config),
-): EmailSender {
-  return {
-    async send(message) {
-      try {
-        await transport.sendMail({
-          from: config.EMAIL_FROM,
-          to: message.to,
-          subject: message.subject,
-          text: message.body,
-        })
-      } catch (cause) {
-        const reason = describeThrown(cause)
-        logger.error('smtp send failed', { to: message.to, reason })
-        throw new Error(`Failed to send email to ${message.to} over SMTP: ${reason}`, { cause })
-      }
-    },
-  }
-}
-
-/**
- * Builds the configured sender.
- *
- * @throws Never. An unknown provider cannot reach here: the config schema is a
- *   discriminated union, so boot rejects it first.
- */
-export function createEmailSender(config: EmailConfig, logger: Logger): EmailSender {
-  switch (config.EMAIL_PROVIDER) {
-    case 'log':
-      return createLogEmailSender(logger, config.EMAIL_FROM)
-    case 'smtp':
-      return createSmtpEmailSender(config, logger)
-  }
-}