@molecule/api-emails-ses 1.0.0

package/LICENSE

@@ -0,0 +1,115 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work.
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship.
+
+      "Contribution" shall mean any work of authorship, including the
+      original version of the Work and any modifications or additions
+      to that Work, that is intentionally submitted to the Licensor for
+      inclusion in the Work by the copyright owner or by an individual or
+      Legal Entity authorized to submit on behalf of the copyright owner.
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      patent license to make, have made, use, offer to sell, sell, import,
+      and otherwise transfer the Work.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file.
+
+   5. Submission of Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND.
+
+   8. Limitation of Liability. In no event and under no legal theory shall
+      any Contributor be liable to You for damages.
+
+   9. Accepting Warranty or Additional Liability.
+
+   Copyright 2026 Molecule Dev, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/browser-guard.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=browser-guard.d.ts.map

package/dist/browser-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-guard.d.ts","sourceRoot":"","sources":["../src/browser-guard.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,CAAA"}

package/dist/browser-guard.js

@@ -0,0 +1,19 @@
+/**
+ * Browser guard — `@molecule/api-emails-ses` is SERVER-ONLY.
+ *
+ * Generated by scripts/gen-browser-guards.mjs (workspace root) — edit THAT, not this.
+ * Evaluating a server package in a browser bundle is always an import-graph mistake
+ * (node APIs, secrets); without this guard it surfaces as a cryptic downstream crash
+ * ("Buffer is not defined") far from the culprit. Throwing here names the package and
+ * the fix at the exact moment the client bundle evaluates it. jsdom tests and SSR are
+ * unaffected: the throw requires browser globals AND the absence of a node runtime.
+ */
+const g = globalThis;
+if (g.window !== undefined && g.document !== undefined && !g.process?.versions?.node) {
+    throw new Error('@molecule/api-emails-ses is SERVER-ONLY: it was bundled into browser/client code. Import it only ' +
+        'from server code (a server route/function or your API), or dynamic-import it inside ' +
+        'the server handler — never from components or shared client modules, and never ' +
+        'polyfill Buffer/process to silence this.');
+}
+export {};
+//# sourceMappingURL=browser-guard.js.map

package/dist/browser-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-guard.js","sourceRoot":"","sources":["../src/browser-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,GAAG,UAIT,CAAA;AACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACrF,MAAM,IAAI,KAAK,CACb,mGAAmG;QACjG,sFAAsF;QACtF,iFAAiF;QACjF,0CAA0C,CAC7C,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,42 @@
+/**
+ * AWS SES email provider for molecule.dev.
+ *
+ * @see https://www.npmjs.com/package/nodemailer
+ * @see https://aws.amazon.com/ses/
+ *
+ * @remarks
+ * - **Configuration is lazy and env-driven**: the SES client is constructed on
+ *   the FIRST send — NOT at import — so `AWS_SES_REGION` (default `us-east-1`)
+ *   and the optional `AWS_SES_ENDPOINT` are read at send time. A region resolved
+ *   into env AFTER this module is imported (late secrets resolution via a
+ *   secrets bond) is honored; reading it at import instead froze the
+ *   default/empty region and sends failed in the WRONG region ("Email address
+ *   is not verified"). Credentials resolve lazily via the AWS default chain
+ *   (`AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY`, shared config, or an instance
+ *   role), so they may arrive after import too.
+ * - **No fail-fast**: because credentials can legitimately come from an instance
+ *   role or shared config (not env), missing credentials are not pre-checked —
+ *   they surface at first send as a descriptive AWS SDK error ("Could not load
+ *   credentials…"), not a tagged config error naming the env var.
+ * - New SES accounts are sandboxed: both the sender identity AND every
+ *   recipient must be verified until production access is granted.
+ * - On success `accepted` is mapped from `envelope.to` — nodemailer's SES
+ *   transport never sets `accepted`/`rejected` (the `@types/nodemailer` typings
+ *   claiming otherwise are drift); a resolved send means SES accepted the
+ *   message for every envelope recipient.
+ *
+ * @example
+ * ```typescript
+ * import { setTransport } from '@molecule/api-emails'
+ * import { provider } from '@molecule/api-emails-ses'
+ *
+ * setTransport(provider)
+ * ```
+ *
+ * @module
+ */
+export * from './browser-guard.js';
+export * from './provider.js';
+export * from './secrets.js';
+export * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA"}

package/dist/index.js

@@ -0,0 +1,42 @@
+/**
+ * AWS SES email provider for molecule.dev.
+ *
+ * @see https://www.npmjs.com/package/nodemailer
+ * @see https://aws.amazon.com/ses/
+ *
+ * @remarks
+ * - **Configuration is lazy and env-driven**: the SES client is constructed on
+ *   the FIRST send — NOT at import — so `AWS_SES_REGION` (default `us-east-1`)
+ *   and the optional `AWS_SES_ENDPOINT` are read at send time. A region resolved
+ *   into env AFTER this module is imported (late secrets resolution via a
+ *   secrets bond) is honored; reading it at import instead froze the
+ *   default/empty region and sends failed in the WRONG region ("Email address
+ *   is not verified"). Credentials resolve lazily via the AWS default chain
+ *   (`AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY`, shared config, or an instance
+ *   role), so they may arrive after import too.
+ * - **No fail-fast**: because credentials can legitimately come from an instance
+ *   role or shared config (not env), missing credentials are not pre-checked —
+ *   they surface at first send as a descriptive AWS SDK error ("Could not load
+ *   credentials…"), not a tagged config error naming the env var.
+ * - New SES accounts are sandboxed: both the sender identity AND every
+ *   recipient must be verified until production access is granted.
+ * - On success `accepted` is mapped from `envelope.to` — nodemailer's SES
+ *   transport never sets `accepted`/`rejected` (the `@types/nodemailer` typings
+ *   claiming otherwise are drift); a resolved send means SES accepted the
+ *   message for every envelope recipient.
+ *
+ * @example
+ * ```typescript
+ * import { setTransport } from '@molecule/api-emails'
+ * import { provider } from '@molecule/api-emails-ses'
+ *
+ * setTransport(provider)
+ * ```
+ *
+ * @module
+ */
+export * from './browser-guard.js';
+export * from './provider.js';
+export * from './secrets.js';
+export * from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA"}

package/dist/provider.d.ts

@@ -0,0 +1,61 @@
+/**
+ * AWS SES email provider implementation.
+ *
+ * @see https://www.npmjs.com/package/nodemailer
+ * @see https://aws.amazon.com/ses/
+ *
+ * @module
+ */
+import './secrets.js';
+import { SESv2Client } from '@aws-sdk/client-sesv2';
+import nodemailer from 'nodemailer';
+import type { EmailMessage, EmailSendResult, EmailTransport } from '@molecule/api-emails';
+/**
+ * Returns the AWS SESv2 client, constructing it from the environment on the
+ * FIRST call and memoizing thereafter.
+ *
+ * Construction is deferred to first use — NOT module load — so a region resolved
+ * into `process.env` AFTER this module is imported (late secrets resolution via
+ * a secrets bond) is honored: `AWS_SES_REGION` (default `us-east-1`) and the
+ * optional `AWS_SES_ENDPOINT` are read at send time, not frozen at import.
+ * Reading them at import instead pinned an empty/default region and every send
+ * failed in the WRONG region ("Email address is not verified"). Credentials
+ * still resolve lazily via the AWS default chain (`AWS_ACCESS_KEY_ID`/
+ * `AWS_SECRET_ACCESS_KEY`, shared config, or an instance role) at send time, so
+ * a missing credential surfaces then as a descriptive AWS SDK error.
+ *
+ * nodemailer 7 requires the SESv2 client + `SendEmailCommand` pair — the old
+ * `{ ses, aws }` (@aws-sdk/client-ses) shape made `createTransport` THROW
+ * ("legacy SES configuration"), breaking every real consumer of this bond.
+ *
+ * @returns The configured SESv2 client.
+ */
+export declare const getSesClient: () => SESv2Client;
+/**
+ * Sends an email through AWS SES via nodemailer. The SES client and transport
+ * are configured lazily from the environment on the first call, so late-resolved
+ * region/credentials are honored.
+ *
+ * @param message - The email message (to, from, subject, text/html, attachments).
+ * @returns Send result with accepted/rejected addresses and message ID.
+ */
+export declare const sendMail: (message: EmailMessage) => Promise<EmailSendResult>;
+/**
+ * The SES email provider implementing the `EmailTransport` interface.
+ */
+export declare const provider: EmailTransport;
+/**
+ * Raw nodemailer transport for direct access. Lazily configured on first send.
+ * @deprecated Use `sendMail()` or `provider` instead.
+ */
+export declare const transport: {
+    sendMail: (msg: nodemailer.SendMailOptions) => Promise<any>;
+};
+/**
+ * Raw nodemailer transport alias.
+ * @deprecated Use `sendMail()` or `provider` instead.
+ */
+export declare const email: {
+    sendMail: (msg: nodemailer.SendMailOptions) => Promise<any>;
+};
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,cAAc,CAAA;AACrB,OAAO,EAAoB,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,UAAU,MAAM,YAAY,CAAA;AAGnC,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAWzF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY,QAAO,WAS/B,CAAA;AAkBD;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,GAAU,SAAS,YAAY,KAAG,OAAO,CAAC,eAAe,CAsB7E,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,cAEtB,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,SAAS;oBACJ,UAAU,CAAC,eAAe;CAC3C,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,KAAK;oBAPA,UAAU,CAAC,eAAe;CAOd,CAAA"}

package/dist/provider.js

@@ -0,0 +1,118 @@
+/**
+ * AWS SES email provider implementation.
+ *
+ * @see https://www.npmjs.com/package/nodemailer
+ * @see https://aws.amazon.com/ses/
+ *
+ * @module
+ */
+// Side-effect import: registers this bond's secret definitions so the
+// runtime registry is populated even when provider.js is imported directly
+// (not through the package barrel).
+import './secrets.js';
+import { SendEmailCommand, SESv2Client } from '@aws-sdk/client-sesv2';
+import { defaultProvider } from '@aws-sdk/credential-provider-node';
+import nodemailer from 'nodemailer';
+import { getLogger } from '@molecule/api-bond';
+const logger = getLogger();
+/**
+ * The lazily-constructed AWS SESv2 client and nodemailer transport. Both are
+ * built on first send — NOT at import — and memoized thereafter.
+ */
+let _ses;
+let _nodemailerTransport;
+/**
+ * Returns the AWS SESv2 client, constructing it from the environment on the
+ * FIRST call and memoizing thereafter.
+ *
+ * Construction is deferred to first use — NOT module load — so a region resolved
+ * into `process.env` AFTER this module is imported (late secrets resolution via
+ * a secrets bond) is honored: `AWS_SES_REGION` (default `us-east-1`) and the
+ * optional `AWS_SES_ENDPOINT` are read at send time, not frozen at import.
+ * Reading them at import instead pinned an empty/default region and every send
+ * failed in the WRONG region ("Email address is not verified"). Credentials
+ * still resolve lazily via the AWS default chain (`AWS_ACCESS_KEY_ID`/
+ * `AWS_SECRET_ACCESS_KEY`, shared config, or an instance role) at send time, so
+ * a missing credential surfaces then as a descriptive AWS SDK error.
+ *
+ * nodemailer 7 requires the SESv2 client + `SendEmailCommand` pair — the old
+ * `{ ses, aws }` (@aws-sdk/client-ses) shape made `createTransport` THROW
+ * ("legacy SES configuration"), breaking every real consumer of this bond.
+ *
+ * @returns The configured SESv2 client.
+ */
+export const getSesClient = () => {
+    if (!_ses) {
+        _ses = new SESv2Client({
+            region: process.env.AWS_SES_REGION || 'us-east-1',
+            credentialDefaultProvider: defaultProvider,
+            ...(process.env.AWS_SES_ENDPOINT ? { endpoint: process.env.AWS_SES_ENDPOINT } : {}),
+        });
+    }
+    return _ses;
+};
+/**
+ * Returns the lazily-initialized nodemailer transport (nodemailer 7 SESv2
+ * shape), constructing it — and the underlying SESv2 client — from the
+ * environment on the first send and memoizing thereafter.
+ *
+ * @returns The nodemailer `Transporter` backed by AWS SES.
+ */
+const getTransport = () => {
+    if (!_nodemailerTransport) {
+        _nodemailerTransport = nodemailer.createTransport({
+            SES: { sesClient: getSesClient(), SendEmailCommand },
+        });
+    }
+    return _nodemailerTransport;
+};
+/**
+ * Sends an email through AWS SES via nodemailer. The SES client and transport
+ * are configured lazily from the environment on the first call, so late-resolved
+ * region/credentials are honored.
+ *
+ * @param message - The email message (to, from, subject, text/html, attachments).
+ * @returns Send result with accepted/rejected addresses and message ID.
+ */
+export const sendMail = async (message) => {
+    try {
+        const result = await getTransport().sendMail(message);
+        return {
+            // nodemailer's SES transport resolves with `{ envelope, messageId,
+            // response, raw }` — it NEVER sets `accepted`/`rejected` (only the SMTP
+            // transports do; the @types/nodemailer SentMessageInfo claiming otherwise
+            // is type-level drift). A resolved SendEmail call means SES accepted the
+            // message for every envelope recipient, so map `envelope.to` to
+            // `accepted` — without this, every successful send reported
+            // `accepted: []` and callers gating on "was my recipient accepted?"
+            // concluded delivery failed.
+            accepted: (result.accepted ?? result.envelope?.to ?? []),
+            rejected: (result.rejected ?? []),
+            messageId: result.messageId,
+            response: result.response,
+        };
+    }
+    catch (error) {
+        logger.error('SES sendMail error:', error);
+        throw error;
+    }
+};
+/**
+ * The SES email provider implementing the `EmailTransport` interface.
+ */
+export const provider = {
+    sendMail,
+};
+/**
+ * Raw nodemailer transport for direct access. Lazily configured on first send.
+ * @deprecated Use `sendMail()` or `provider` instead.
+ */
+export const transport = {
+    sendMail: (msg) => getTransport().sendMail(msg),
+};
+/**
+ * Raw nodemailer transport alias.
+ * @deprecated Use `sendMail()` or `provider` instead.
+ */
+export const email = transport;
+//# sourceMappingURL=provider.js.map

package/dist/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,sEAAsE;AACtE,2EAA2E;AAC3E,oCAAoC;AACpC,OAAO,cAAc,CAAA;AACrB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,UAAU,MAAM,YAAY,CAAA;AAEnC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAG9C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;AAE1B;;;GAGG;AACH,IAAI,IAA6B,CAAA;AACjC,IAAI,oBAAwD,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,GAAgB,EAAE;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,IAAI,WAAW,CAAC;YACrB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,WAAW;YACjD,yBAAyB,EAAE,eAAe;YAC1C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,GAA2B,EAAE;IAChD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,oBAAoB,GAAG,UAAU,CAAC,eAAe,CAAC;YAChD,GAAG,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,gBAAgB,EAAE;SACD,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,oBAAoB,CAAA;AAC7B,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAqB,EAA4B,EAAE;IAChF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC,QAAQ,CAAC,OAAqC,CAAC,CAAA;QAEnF,OAAO;YACL,mEAAmE;YACnE,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,gEAAgE;YAChE,4DAA4D;YAC5D,oEAAoE;YACpE,6BAA6B;YAC7B,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAa;YACpE,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAa;YAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;QAC1C,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAmB;IACtC,QAAQ;CACT,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,QAAQ,EAAE,CAAC,GAA+B,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;CAC5E,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,SAAS,CAAA"}

package/dist/secrets.d.ts

@@ -0,0 +1,16 @@
+/**
+ * AWS SES secret definitions — self-registered at import time so the
+ * runtime secrets registry (`@molecule/api-secrets`) can drive boot-time
+ * configuration reports and actionable "not configured" errors.
+ *
+ * Content is derived MECHANICALLY from this package's mlcl registry secrets
+ * entry (label/instructions/setupUrl/example) via the fleet formula, so
+ * packages sharing a key register byte-identical definitions and
+ * registration order never matters.
+ *
+ * @module
+ */
+import type { SecretDefinition } from '@molecule/api-secrets';
+/** Secret definitions required by the AWS SES email bond. */
+export declare const emailsSesSecretDefinitions: SecretDefinition[];
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAG7D,6DAA6D;AAC7D,eAAO,MAAM,0BAA0B,EAAE,gBAAgB,EAuBxD,CAAA"}

package/dist/secrets.js

@@ -0,0 +1,37 @@
+/**
+ * AWS SES secret definitions — self-registered at import time so the
+ * runtime secrets registry (`@molecule/api-secrets`) can drive boot-time
+ * configuration reports and actionable "not configured" errors.
+ *
+ * Content is derived MECHANICALLY from this package's mlcl registry secrets
+ * entry (label/instructions/setupUrl/example) via the fleet formula, so
+ * packages sharing a key register byte-identical definitions and
+ * registration order never matters.
+ *
+ * @module
+ */
+import { registerSecrets } from '@molecule/api-secrets';
+/** Secret definitions required by the AWS SES email bond. */
+export const emailsSesSecretDefinitions = [
+    {
+        key: 'AWS_ACCESS_KEY_ID',
+        description: 'AWS access key ID — Create an IAM user with the needed policy (SES/S3/SQS) and create an access key under Security credentials.',
+        helpUrl: 'https://console.aws.amazon.com/iam/',
+        required: true,
+        example: 'AKIA...',
+    },
+    {
+        key: 'AWS_SECRET_ACCESS_KEY',
+        description: 'AWS secret access key — Shown once when creating the IAM access key — store it immediately.',
+        helpUrl: 'https://console.aws.amazon.com/iam/',
+        required: true,
+    },
+    {
+        key: 'AWS_SES_REGION',
+        description: 'AWS SES region — The AWS region where SES is set up (and out of sandbox for production sending).',
+        required: true,
+        example: 'us-east-1',
+    },
+];
+registerSecrets(emailsSesSecretDefinitions);
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,0BAA0B,GAAuB;IAC5D;QACE,GAAG,EAAE,mBAAmB;QACxB,WAAW,EACT,iIAAiI;QACnI,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,SAAS;KACnB;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,WAAW,EACT,6FAA6F;QAC/F,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,IAAI;KACf;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,WAAW,EACT,kGAAkG;QACpG,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,WAAW;KACrB;CACF,CAAA;AAED,eAAe,CAAC,0BAA0B,CAAC,CAAA"}

package/dist/types.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Type definitions for the AWS SES email provider.
+ *
+ * @module
+ */
+export type { EmailMessage, EmailSendResult, EmailTransport } from '@molecule/api-emails';
+declare global {
+    namespace NodeJS {
+        /**
+         * Process Env interface.
+         */
+        interface ProcessEnv {
+            /**
+             * The AWS API access key ID.
+             */
+            AWS_ACCESS_KEY_ID?: string;
+            /**
+             * The AWS API secret access key.
+             */
+            AWS_SECRET_ACCESS_KEY?: string;
+            /**
+             * The AWS region for SES.
+             *
+             * @default us-east-1
+             */
+            AWS_SES_REGION?: string;
+            /**
+             * Optional SES service endpoint override (e.g. a credential broker or a
+             * self-hosted / SES-compatible service). When unset, the SDK resolves the
+             * default regional endpoint.
+             */
+            AWS_SES_ENDPOINT?: string;
+        }
+    }
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAEzF,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,MAAM,CAAC;QACf;;WAEG;QACH,UAAiB,UAAU;YACzB;;eAEG;YACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;YAE1B;;eAEG;YACH,qBAAqB,CAAC,EAAE,MAAM,CAAA;YAE9B;;;;eAIG;YACH,cAAc,CAAC,EAAE,MAAM,CAAA;YAEvB;;;;eAIG;YACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;SAC1B;KACF;CACF"}

package/dist/types.js

@@ -0,0 +1,7 @@
+/**
+ * Type definitions for the AWS SES email provider.
+ *
+ * @module
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@molecule/api-emails-ses",
+  "version": "1.0.0",
+  "description": "AWS SES email provider for molecule.dev.",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "molecule",
+    "email",
+    "ses",
+    "aws",
+    "nodemailer"
+  ],
+  "license": "Apache-2.0",
+  "dependencies": {
+    "@aws-sdk/client-sesv2": "3.1098.0",
+    "@aws-sdk/credential-provider-node": "3.972.75",
+    "nodemailer": "9.0.3"
+  },
+  "devDependencies": {
+    "@molecule/api-bond": "1.0.0",
+    "@types/node": "26.1.2",
+    "@types/nodemailer": "8.0.1",
+    "typescript": "6.0.3",
+    "vitest": "4.1.10"
+  },
+  "peerDependencies": {
+    "@molecule/api-bond": "^1.0.0",
+    "@molecule/api-emails": "^1.0.0",
+    "@molecule/api-secrets": "^1.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/molecule-dev/molecule.git",
+    "directory": "packages/api/bonds/emails/ses"
+  },
+  "homepage": "https://github.com/molecule-dev/molecule/tree/main/packages/api/bonds/emails/ses",
+  "bugs": "https://github.com/molecule-dev/molecule/issues",
+  "publishConfig": {
+    "access": "public"
+  }
+}