@stacksjs/buddy 0.70.88 → 0.70.91

package/dist/commands/mail.js

@@ -0,0 +1,752 @@
+import { log, runCommand } from "@stacksjs/cli";
+import { ExitCode } from "@stacksjs/types";
+import { getErrorMessage } from "@stacksjs/utils";
+import { CLI } from "@stacksjs/clapp";
+import { createHash, createHmac, randomBytes } from "crypto";
+import { readFileSync, existsSync } from "node:fs";
+import { execSync } from "node:child_process";
+export function resolveDirectMailHost(env = process.env) {
+  let configured = env.MAIL_SERVER_HOST || (env.HCLOUD_TOKEN || env.HETZNER_API_TOKEN ? env.MAIL_HOST : void 0);
+  if (configured && ["127.0.0.1", "localhost", "mailpit"].includes(configured))
+    configured = env.MAIL_DOMAIN ? `mail.${env.MAIL_DOMAIN}` : void 0;
+  if (!configured || configured === "127.0.0.1" || configured === "localhost")
+    return;
+  return configured.replace(/^https?:\/\//, "").split("/")[0]?.split(":")[0];
+}
+export function sanitizeLineCount(value) {
+  const count = Number.parseInt(value || "50", 10);
+  return String(Number.isFinite(count) ? Math.min(5000, Math.max(1, count)) : 50);
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+async function resolveOperationalMailHost() {
+  if (process.env.MAIL_SERVER_HOST)
+    return resolveDirectMailHost();
+  const token = process.env.HCLOUD_TOKEN || process.env.HETZNER_API_TOKEN;
+  if (!token)
+    return;
+  const appName = (process.env.APP_NAME || "stacks").toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  try {
+    const ip = (await (await fetch(`https://api.hetzner.cloud/v1/servers?name=${encodeURIComponent(`${appName}-production-app`)}`, {
+      headers: { Authorization: `Bearer ${token}` }
+    })).json()).servers?.[0]?.public_net?.ipv4?.ip;
+    if (ip)
+      return ip;
+  } catch {}
+  const configured = resolveDirectMailHost();
+  if (configured)
+    return configured;
+  const { email } = await import("@stacksjs/config");
+  return email?.domain ? `mail.${email.domain}` : void 0;
+}
+export function mailCommands(buddy) {
+  buddy.command("mail:provision", "Provision this app's mail from config/email.ts onto the shared mail server (domain + DKIM + mailboxes + MX/SPF/DKIM/DMARC DNS). Reusable + idempotent; the same reconcile buddy deploy runs.").option("--ip <ip>", "Mail server IP (defaults to the A record of config.email.domain)").action(async (options) => {
+    const { email: emailConfig } = await import("@stacksjs/config"), domain = emailConfig?.domain;
+    if (!domain) {
+      log.error("config/email.ts has no `domain` \u2014 set it (e.g. domain: 'bughq.org') and add `mailboxes`.");
+      process.exit(ExitCode.FatalError);
+    }
+    let ip = options.ip;
+    if (!ip)
+      try {
+        ip = (await (await import("node:dns")).promises.resolve4(domain))[0];
+      } catch {
+        log.error(`Could not resolve an IP for ${domain}. Deploy the site first, or pass --ip <mail-server-ip>.`);
+        process.exit(ExitCode.FatalError);
+      }
+    const { provisionMailTenant, reconcileMailDns } = await import("./deploy");
+    log.info(`Provisioning mail for ${domain} on ${ip}...`);
+    const res = await provisionMailTenant(ip, log);
+    if (res)
+      await reconcileMailDns(res, ip, log);
+    log.success(`Mail provisioned for ${domain}. Add MAIL_PASSWORD_<LOCALPART> env vars to pin mailbox passwords.`);
+    process.exit(ExitCode.Success);
+  });
+  buddy.command("mail:user:add <email>", "Add a mail user").option("--password <password>", "User password (generated if not provided)").action(async (email, options) => {
+    log.info(`Adding mail user: ${email}`);
+    try {
+      const password = options.password || randomBytes(16).toString("base64").replace(/[+/=]/g, "").substring(0, 16), passwordHash = createHash("sha256").update(password).digest("hex"), tableName = `${(process.env.APP_NAME || "stacks").toLowerCase().replace(/[^a-z0-9-]/g, "-")}-mail-users`, { DynamoDBClient } = await import("@stacksjs/ts-cloud");
+      await new DynamoDBClient(process.env.AWS_REGION || "us-east-1").putItem({
+        TableName: tableName,
+        Item: {
+          email: { S: email.toLowerCase() },
+          passwordHash: { S: passwordHash },
+          createdAt: { S: new Date().toISOString() }
+        }
+      });
+      log.success(`User ${email} added successfully!`);
+      console.log("");
+      console.log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+      console.log("  MAIL CREDENTIALS");
+      console.log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+      console.log("");
+      console.log(`  Email:    ${email}`);
+      console.log(`  Password: ${password}`);
+      console.log("");
+      console.log("  To connect with Mail.app, run:");
+      console.log("    buddy mail:proxy");
+      console.log("");
+      console.log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+      console.log("");
+      if (!options.password)
+        log.warn("Save this password! It will not be shown again.");
+      process.exit(ExitCode.Success);
+    } catch (error) {
+      log.error(`Failed to add user: ${getErrorMessage(error)}`);
+      process.exit(ExitCode.FatalError);
+    }
+  });
+  buddy.command("mail:user:list", "List mail users").action(async () => {
+    try {
+      const tableName = `${(process.env.APP_NAME || "stacks").toLowerCase().replace(/[^a-z0-9-]/g, "-")}-mail-users`, { DynamoDBClient } = await import("@stacksjs/ts-cloud"), result = await new DynamoDBClient(process.env.AWS_REGION || "us-east-1").scan({ TableName: tableName });
+      console.log("");
+      console.log("Mail Users:");
+      console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+      if (!result.Items || result.Items.length === 0)
+        console.log("  No users found");
+      else
+        for (const item of result.Items) {
+          const email = item.email?.S || "unknown", createdAt = item.createdAt?.S || "unknown";
+          console.log(`  \uD83D\uDCE7 ${email}`);
+          console.log(`     Created: ${createdAt}`);
+        }
+      console.log("");
+      process.exit(ExitCode.Success);
+    } catch (error) {
+      log.error(`Failed to list users: ${getErrorMessage(error)}`);
+      process.exit(ExitCode.FatalError);
+    }
+  });
+  buddy.command("mail:user:delete <email>", "Delete a mail user").action(async (email) => {
+    try {
+      const tableName = `${(process.env.APP_NAME || "stacks").toLowerCase().replace(/[^a-z0-9-]/g, "-")}-mail-users`, { DynamoDBClient } = await import("@stacksjs/ts-cloud");
+      await new DynamoDBClient(process.env.AWS_REGION || "us-east-1").deleteItem({
+        TableName: tableName,
+        Key: { email: { S: email.toLowerCase() } }
+      });
+      log.success(`User ${email} deleted`);
+      process.exit(ExitCode.Success);
+    } catch (error) {
+      log.error(`Failed to delete user: ${getErrorMessage(error)}`);
+      process.exit(ExitCode.FatalError);
+    }
+  });
+  buddy.command("mail:proxy", "Start local IMAP proxy for Mail.app").option("--port <port>", "IMAP proxy port", { default: "1993" }).option("--api <url>", "Mail API URL").action(async (options) => {
+    log.info("Starting IMAP proxy...");
+    try {
+      let apiUrl = options.api;
+      if (!apiUrl) {
+        const { AWSCloudFormationClient } = await import("@stacksjs/ts-cloud"), cfn = new AWSCloudFormationClient(process.env.AWS_REGION || "us-east-1"), stackName = `${(process.env.APP_NAME || "stacks").toLowerCase().replace(/[^a-z0-9-]/g, "-")}-cloud`;
+        try {
+          apiUrl = ((await cfn.describeStacks({ stackName })).Stacks?.[0]?.Outputs || []).find((o) => o.OutputKey === "MailApiUrl")?.OutputValue;
+        } catch (e) {}
+      }
+      if (!apiUrl) {
+        log.error("Mail API URL not found. Run `buddy deploy` first to create the mail infrastructure.");
+        process.exit(ExitCode.FatalError);
+      }
+      console.log("");
+      console.log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+      console.log("  IMAP PROXY");
+      console.log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+      console.log("");
+      console.log(`  API URL:  ${apiUrl}`);
+      console.log(`  Port:     ${options.port}`);
+      console.log("");
+      console.log("  Configure Mail.app with:");
+      console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+      console.log("  Account Type:     IMAP");
+      console.log("  Incoming Server:  localhost");
+      console.log(`  Incoming Port:    ${options.port}`);
+      console.log("  SSL:              No (local connection)");
+      console.log("  Outgoing Server:  localhost");
+      console.log(`  Outgoing Port:    ${options.port}`);
+      console.log("  Username:         your-email@stacksjs.com");
+      console.log("  Password:         your-password");
+      console.log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+      console.log("");
+      process.env.MAIL_API_URL = apiUrl;
+      process.env.IMAP_PORT = options.port;
+      const { ImapProxy } = await import("../../mail-server/src/proxy/imap-proxy"), proxy = new ImapProxy(Number.parseInt(options.port, 10), apiUrl);
+      await proxy.start();
+      process.on("SIGINT", () => {
+        console.log(`
+Shutting down proxy...`);
+        proxy.stop();
+        process.exit(0);
+      });
+    } catch (error) {
+      log.error(`Failed to start proxy: ${getErrorMessage(error)}`);
+      process.exit(ExitCode.FatalError);
+    }
+  });
+  buddy.command("mail:test", "Test mail API connection").action(async () => {
+    try {
+      const { AWSCloudFormationClient } = await import("@stacksjs/ts-cloud"), cfn = new AWSCloudFormationClient(process.env.AWS_REGION || "us-east-1"), stackName = `${(process.env.APP_NAME || "stacks").toLowerCase().replace(/[^a-z0-9-]/g, "-")}-cloud`, mailApiOutput = ((await cfn.describeStacks({ stackName })).Stacks?.[0]?.Outputs || []).find((o) => o.OutputKey === "MailApiUrl");
+      if (!mailApiOutput?.OutputValue) {
+        log.error("Mail API not deployed. Run `buddy deploy` first.");
+        process.exit(ExitCode.FatalError);
+      }
+      const apiUrl = mailApiOutput.OutputValue;
+      log.info(`Testing Mail API at ${apiUrl}`);
+      const response = await fetch(`${apiUrl}/mailboxes`, {
+        headers: {
+          Authorization: `Basic ${Buffer.from("test@stacksjs.com:test").toString("base64")}`
+        }
+      });
+      if (response.status === 401)
+        log.success("Mail API is responding (auth required)");
+      else if (response.ok) {
+        log.success("Mail API is working!");
+        const data = await response.json();
+        console.log("Response:", JSON.stringify(data, null, 2));
+      } else
+        log.warn(`Mail API returned status ${response.status}`);
+      process.exit(ExitCode.Success);
+    } catch (error) {
+      log.error(`Failed to test API: ${getErrorMessage(error)}`);
+      process.exit(ExitCode.FatalError);
+    }
+  });
+  buddy.command("mail:credentials [email]", "Show SMTP credentials for email access").action(async (emailAddress) => {
+    loadEnvFiles();
+    const domain = process.env.APP_DOMAIN || process.env.MAIL_DOMAIN || "stacksjs.com", mailHost = `mail.${domain}`, email = emailAddress || `chris@${domain}`, username = email.includes("@") ? email.split("@")[0] : email, envKey = `MAIL_PASSWORD_${username.toUpperCase()}`, password = process.env[envKey];
+    console.log("");
+    console.log("==========================================================");
+    console.log(`  EMAIL CREDENTIALS \u2014 ${email}`);
+    console.log("==========================================================");
+    console.log("");
+    console.log(`  Email:       ${email}`);
+    console.log(`  Host:        ${mailHost}`);
+    console.log("  Port:        587");
+    console.log("  Security:    STARTTLS");
+    console.log(`  Username:    ${username}`);
+    if (password)
+      console.log(`  Password:    ${password}`);
+    else
+      console.log(`  Password:    (not set \u2014 add ${envKey} to .env.production)`);
+    console.log("");
+    console.log("==========================================================");
+    console.log("");
+    process.exit(ExitCode.Success);
+  });
+  buddy.command("mail:logs", "Show mail server logs from production").option("-n, --lines <count>", "Number of log lines to show", { default: "50" }).option("-f, --follow", "Follow log output (poll every 5s)").option("--filter <pattern>", "Filter logs by pattern (e.g. AUTH, LOGIN, error)").action(async (options) => {
+    loadEnvFiles();
+    const directHost = await resolveOperationalMailHost();
+    if (directHost) {
+      const lines = sanitizeLineCount(options.lines), filter = options.filter ? options.filter.replace(/[^a-zA-Z0-9_.@\s-]/g, "") : "", command = `journalctl -u mail --no-pager -n ${lines}${filter ? ` | grep -iE ${shellQuote(filter)}` : ""}`;
+      try {
+        const output = execSync(`ssh -o BatchMode=yes -o ConnectTimeout=10 root@${shellQuote(directHost)} ${shellQuote(command)}`, { encoding: "utf8" });
+        console.log(output);
+        process.exit(ExitCode.Success);
+      } catch (error) {
+        log.error(`Failed to fetch logs from ${directHost}: ${getErrorMessage(error)}`);
+        process.exit(ExitCode.FatalError);
+      }
+    }
+    const region = process.env.AWS_REGION || "us-east-1", appName = (process.env.APP_NAME || "stacks").toLowerCase().replace(/[^a-z0-9-]/g, "-");
+    try {
+      const { EC2Client, SSMClient } = await import("@stacksjs/ts-cloud"), ec2 = new EC2Client(region), ssm = new SSMClient(region);
+      log.info("Finding mail server...");
+      const instanceId = (await ec2.describeInstances({
+        Filters: [
+          { Name: "tag:Name", Values: [`${appName}-mail-server`] },
+          { Name: "instance-state-name", Values: ["running"] }
+        ]
+      })).Reservations?.[0]?.Instances?.[0]?.InstanceId;
+      if (!instanceId) {
+        log.error("No running mail server found.");
+        log.info(`Looked for instances tagged: ${appName}-mail-server`);
+        process.exit(ExitCode.FatalError);
+      }
+      log.info(`Found instance: ${instanceId}`);
+      const lines = sanitizeLineCount(options.lines), sanitizedFilter = options.filter ? options.filter.replace(/[^a-zA-Z0-9_.@\s-]/g, "") : "", filterCmd = sanitizedFilter ? ` | grep -iE '${sanitizedFilter}'` : "", fetchLogs = async () => {
+        const cmd = `journalctl -u smtp-server -u mail-server --no-pager -n ${lines} --since "10 minutes ago" 2>&1${filterCmd}`, result = await ssm.runShellCommand(instanceId, [cmd], {
+          timeoutSeconds: 30,
+          maxWaitMs: 30000,
+          pollIntervalMs: 2000
+        });
+        if (!result.success) {
+          log.error(`Failed to fetch logs: ${result.error || "Unknown error"}`);
+          return !1;
+        }
+        if (result.output) {
+          const logLines = result.output.trim().split(`
+`);
+          for (const line of logLines)
+            if (line.includes("error") || line.includes("Error") || line.includes("AUTH failed"))
+              console.log(`  \x1B[31m${line}\x1B[0m`);
+            else if (line.includes("warning") || line.includes("Warning"))
+              console.log(`  \x1B[33m${line}\x1B[0m`);
+            else if (line.includes("AUTH success") || line.includes("LOGIN completed") || line.includes("authenticated"))
+              console.log(`  \x1B[32m${line}\x1B[0m`);
+            else
+              console.log(`  ${line}`);
+        } else
+          console.log("  No log entries found.");
+        return !0;
+      };
+      console.log("");
+      console.log("==========================================================");
+      console.log("  MAIL SERVER LOGS");
+      console.log("==========================================================");
+      console.log("");
+      await fetchLogs();
+      if (options.follow) {
+        console.log("");
+        log.info("Following logs (Ctrl+C to stop)...");
+        let polling = !1;
+        const poll = setInterval(() => {
+          if (polling)
+            return;
+          polling = !0;
+          console.log("");
+          fetchLogs().catch((e) => log.error("Log polling failed:", e)).finally(() => {
+            polling = !1;
+          });
+        }, 5000);
+        await new Promise((resolve) => {
+          process.on("SIGINT", () => {
+            clearInterval(poll);
+            resolve();
+          });
+        });
+      }
+      console.log("");
+      process.exit(ExitCode.Success);
+    } catch (error) {
+      log.error(`Failed to fetch logs: ${getErrorMessage(error)}`);
+      process.exit(ExitCode.FatalError);
+    }
+  });
+  buddy.command("mail:status", "Show mail server status").action(async () => {
+    loadEnvFiles();
+    const directHost = await resolveOperationalMailHost();
+    if (directHost) {
+      const command = 'systemctl is-active mail; systemctl show mail -p NRestarts -p ActiveEnterTimestamp --value; ss -H -ltn | grep -E "(:(25|143|465|587|993))\\b"; systemctl is-enabled mail-health.timer; systemctl is-active mail-health.timer';
+      try {
+        const output = execSync(`ssh -o BatchMode=yes -o ConnectTimeout=10 root@${shellQuote(directHost)} ${shellQuote(command)}`, { encoding: "utf8" });
+        console.log(output);
+        process.exit(ExitCode.Success);
+      } catch (error) {
+        log.error(`Mail server ${directHost} is unhealthy: ${getErrorMessage(error)}`);
+        process.exit(ExitCode.FatalError);
+      }
+    }
+    const region = process.env.AWS_REGION || "us-east-1", appName = (process.env.APP_NAME || "stacks").toLowerCase().replace(/[^a-z0-9-]/g, "-");
+    try {
+      const { EC2Client, SSMClient } = await import("@stacksjs/ts-cloud"), ec2 = new EC2Client(region), ssm = new SSMClient(region), instanceId = (await ec2.describeInstances({
+        Filters: [
+          { Name: "tag:Name", Values: [`${appName}-mail-server`] },
+          { Name: "instance-state-name", Values: ["running"] }
+        ]
+      })).Reservations?.[0]?.Instances?.[0]?.InstanceId;
+      if (!instanceId) {
+        log.error("No running mail server found.");
+        log.info(`Looked for instances tagged: ${appName}-mail-server`);
+        process.exit(ExitCode.FatalError);
+      }
+      const result = await ssm.runShellCommand(instanceId, [
+        "echo === Service ===",
+        "(systemctl status smtp-server --no-pager 2>&1 || systemctl status mail-server --no-pager 2>&1) | head -15",
+        "echo === Ports ===",
+        'ss -tlnp 2>&1 | grep -E "(25|587|465|993|143|110|995)" || echo "No mail ports listening"',
+        "echo === Memory ===",
+        `ps aux | grep -E "(smtp-server|bun|mail)" | grep -v grep | awk '{print $6/1024 "MB", $11}'`
+      ], {
+        timeoutSeconds: 30,
+        maxWaitMs: 30000,
+        pollIntervalMs: 2000
+      });
+      console.log("");
+      console.log("==========================================================");
+      console.log("  MAIL SERVER STATUS");
+      console.log("==========================================================");
+      console.log("");
+      if (result.success && result.output)
+        for (const line of result.output.trim().split(`
+`))
+          console.log(`  ${line}`);
+      else
+        log.error(`Failed: ${result.error}`);
+      console.log("");
+      process.exit(ExitCode.Success);
+    } catch (error) {
+      log.error(`Failed to get status: ${getErrorMessage(error)}`);
+      process.exit(ExitCode.FatalError);
+    }
+  });
+  buddy.command("mail:port25:request", "Request port 25 unblock for direct SMTP delivery").option("--provider <provider>", "Cloud provider: aws or hetzner", { default: "aws" }).option("--instance-id <id>", "AWS EC2 instance ID (auto-detected if not provided)").option("--server-id <id>", "Hetzner server ID (auto-detected if not provided)").option("--elastic-ip <ip>", "AWS Elastic IP address").option("--rdns <hostname>", "Reverse DNS hostname (e.g. mail.stacksjs.com)").option("--use-case <text>", "Description of email use case").action(async (options) => {
+    loadEnvFiles();
+    const domain = process.env.APP_DOMAIN || process.env.MAIL_DOMAIN || "stacksjs.com", provider = options.provider.toLowerCase();
+    if (provider === "aws")
+      await requestAwsPort25(options, domain);
+    else if (provider === "hetzner")
+      await requestHetznerPort25(options, domain);
+    else {
+      log.error(`Unknown provider: ${provider}. Use 'aws' or 'hetzner'.`);
+      process.exit(ExitCode.FatalError);
+    }
+  });
+  buddy.command("mail:port25:status", "Check outbound port 25 status on the mail server").option("--provider <provider>", "Cloud provider: aws or hetzner", { default: "aws" }).action(async (options) => {
+    loadEnvFiles();
+    const region = process.env.AWS_REGION || "us-east-1", appName = (process.env.APP_NAME || "stacks").toLowerCase().replace(/[^a-z0-9-]/g, "-");
+    if (options.provider === "hetzner") {
+      const hetznerToken = process.env.HETZNER_API_TOKEN;
+      if (!hetznerToken) {
+        log.error("HETZNER_API_TOKEN not set");
+        process.exit(ExitCode.FatalError);
+      }
+      try {
+        const ip = (await (await fetch("https://api.hetzner.cloud/v1/servers?label_selector=service=mail", {
+          headers: { Authorization: `Bearer ${hetznerToken}` }
+        })).json()).servers?.[0]?.public_net?.ipv4?.ip;
+        if (!ip) {
+          const mailServer = (await (await fetch("https://api.hetzner.cloud/v1/servers", {
+            headers: { Authorization: `Bearer ${hetznerToken}` }
+          })).json()).servers?.find((s) => s.name?.includes("mail"));
+          if (mailServer) {
+            const serverIp = mailServer.public_net?.ipv4?.ip;
+            log.info(`Found Hetzner server: ${mailServer.name} (${serverIp})`);
+            const result = execSync(`ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 root@${serverIp} "timeout 5 bash -c 'echo QUIT > /dev/tcp/gmail-smtp-in.l.google.com/25' 2>&1 && echo PORT_25_OPEN || echo PORT_25_BLOCKED"`, { encoding: "utf-8" });
+            printPort25Status(result.trim(), "Hetzner", serverIp);
+          } else
+            log.error("No mail server found on Hetzner");
+        } else {
+          const result = execSync(`ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 root@${ip} "timeout 5 bash -c 'echo QUIT > /dev/tcp/gmail-smtp-in.l.google.com/25' 2>&1 && echo PORT_25_OPEN || echo PORT_25_BLOCKED"`, { encoding: "utf-8" });
+          printPort25Status(result.trim(), "Hetzner", ip);
+        }
+      } catch (error) {
+        log.error(`Failed: ${getErrorMessage(error)}`);
+      }
+      process.exit(ExitCode.Success);
+    }
+    try {
+      const { EC2Client, SSMClient } = await import("@stacksjs/ts-cloud"), ec2 = new EC2Client(region), ssm = new SSMClient(region), instance = (await ec2.describeInstances({
+        Filters: [
+          { Name: "tag:Name", Values: [`${appName}-mail-server`] },
+          { Name: "instance-state-name", Values: ["running"] }
+        ]
+      })).Reservations?.[0]?.Instances?.[0], instanceId = instance?.InstanceId;
+      if (!instanceId) {
+        log.error("No running mail server found.");
+        process.exit(ExitCode.FatalError);
+      }
+      const publicIp = instance?.PublicIpAddress || "unknown";
+      log.info(`Testing port 25 on ${instanceId} (${publicIp})...`);
+      const result = await ssm.runShellCommand(instanceId, [
+        'timeout 5 bash -c "echo QUIT > /dev/tcp/gmail-smtp-in.l.google.com/25" 2>&1 && echo PORT_25_OPEN || echo PORT_25_BLOCKED'
+      ], { timeoutSeconds: 15, maxWaitMs: 20000, pollIntervalMs: 2000 });
+      printPort25Status(result.output?.trim() || "PORT_25_BLOCKED", "AWS", publicIp);
+      process.exit(ExitCode.Success);
+    } catch (error) {
+      log.error(`Failed: ${getErrorMessage(error)}`);
+      process.exit(ExitCode.FatalError);
+    }
+  });
+  buddy.command("mail:server", "Start SMTP relay server").option("--port <port>", "SMTP port", { default: "587" }).action(async (options) => {
+    loadEnvFiles();
+    const domain = process.env.APP_DOMAIN || process.env.MAIL_DOMAIN || "stacksjs.com", port = Number.parseInt(options.port, 10), mailboxes = ["chris", "blake", "glenn"], users = {}, generated = [];
+    for (const name of mailboxes) {
+      const envKey = `MAIL_PASSWORD_${name.toUpperCase()}`;
+      let password = process.env[envKey];
+      if (!password) {
+        password = randomBytes(16).toString("base64url");
+        generated.push(`${envKey}=${password}`);
+      }
+      users[name] = { password, email: `${name}@${domain}` };
+    }
+    if (generated.length > 0) {
+      console.log("");
+      log.warn("Generated missing passwords. Add these to .env.production:");
+      for (const line of generated)
+        console.log(`  ${line}`);
+    }
+    console.log("");
+    console.log("==========================================================");
+    console.log("  SMTP RELAY SERVER");
+    console.log("==========================================================");
+    console.log("");
+    console.log(`  Host:        mail.${domain}`);
+    console.log(`  Port:        ${port}`);
+    console.log(`  Domain:      ${domain}`);
+    console.log("");
+    console.log("  Mailboxes:");
+    for (const [name, user] of Object.entries(users))
+      console.log(`    ${name} (${user.email})`);
+    console.log("");
+    console.log("  Relaying through AWS SES");
+    console.log("==========================================================");
+    console.log("");
+    try {
+      const { SmtpServer } = await import("../../../cloud/src/imap/smtp-server"), server = new SmtpServer({
+        port,
+        host: "0.0.0.0",
+        domain,
+        users,
+        sentBucket: "stacks-production-email",
+        sentPrefix: "sent/"
+      });
+      await server.start();
+      await new Promise((resolve) => {
+        process.on("SIGINT", async () => {
+          console.log(`
+Shutting down SMTP server...`);
+          await server.stop();
+          resolve();
+        });
+      });
+      process.exit(0);
+    } catch (error) {
+      log.error(`Failed to start SMTP server: ${getErrorMessage(error)}`);
+      process.exit(ExitCode.FatalError);
+    }
+  });
+  buddy.command("mail:preview", "Open the dev-only Mailable preview UI in your browser").option("--no-open", "Print the URL but skip the browser-open step", { default: !1 }).option("--port <port>", "Override the API port (default: from config.ports.api / PORT_API)").example("buddy mail:preview").example("buddy mail:preview --no-open").example("buddy mail:preview --port 4000").action(async (options) => {
+    const { config } = await import("@stacksjs/config"), portFromOption = options.port ? Number(options.port) : void 0, portFromEnv = process.env.PORT_API ? Number(process.env.PORT_API) : void 0, url = `http://localhost:${portFromOption || portFromEnv || config.ports?.api || 3008}/_stacks/mail/preview`;
+    log.info(`Mailable preview: ${url}`);
+    log.info("(Make sure `./buddy dev:api` is running.)");
+    if (options.open !== !1)
+      try {
+        execSync(`open "${url}" 2>/dev/null || xdg-open "${url}" 2>/dev/null || true`, { encoding: "utf-8" });
+      } catch {}
+    process.exit(ExitCode.Success);
+  });
+}
+function loadEnvFiles() {
+  const envPath = ".env.production";
+  if (existsSync(envPath)) {
+    const content = readFileSync(envPath, "utf-8");
+    for (const line of content.split(`
+`)) {
+      const eq = line.indexOf("=");
+      if (eq > 0 && !line.startsWith("#")) {
+        const key = line.slice(0, eq).trim(), value = line.slice(eq + 1).trim();
+        if (!process.env[key])
+          process.env[key] = value;
+      }
+    }
+  }
+  if (!process.env.AWS_ACCESS_KEY_ID || !process.env.AWS_SECRET_ACCESS_KEY) {
+    const awsCredsPath = `${process.env.HOME || process.env.USERPROFILE || ""}/.aws/credentials`;
+    if (existsSync(awsCredsPath)) {
+      const credsContent = readFileSync(awsCredsPath, "utf-8"), profile = process.env.AWS_PROFILE || "default", lines = credsContent.split(`
+`);
+      let inProfile = !1;
+      for (const line of lines) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("[")) {
+          inProfile = trimmed === `[${profile}]`;
+          continue;
+        }
+        if (inProfile && trimmed.includes("=")) {
+          const eq = trimmed.indexOf("="), key = trimmed.slice(0, eq).trim(), value = trimmed.slice(eq + 1).trim();
+          if (key === "aws_access_key_id")
+            process.env.AWS_ACCESS_KEY_ID = value;
+          if (key === "aws_secret_access_key")
+            process.env.AWS_SECRET_ACCESS_KEY = value;
+        }
+      }
+    }
+  }
+}
+function printPort25Status(result, provider, ip) {
+  console.log("");
+  console.log("==========================================================");
+  console.log("  PORT 25 STATUS");
+  console.log("==========================================================");
+  console.log("");
+  console.log(`  Provider:  ${provider}`);
+  console.log(`  Server IP: ${ip}`);
+  if (result.includes("PORT_25_OPEN")) {
+    console.log("  Port 25:   \x1B[32mOPEN\x1B[0m");
+    console.log("");
+    console.log("  Direct SMTP delivery is available!");
+    console.log("  Set SMTP_DELIVERY_METHOD=direct in your server env.");
+  } else {
+    console.log("  Port 25:   \x1B[31mBLOCKED\x1B[0m");
+    console.log("");
+    console.log(`  Run: buddy mail:port25:request --provider ${provider.toLowerCase()}`);
+  }
+  console.log("");
+  console.log("==========================================================");
+  console.log("");
+}
+async function requestAwsPort25(options, domain) {
+  const region = process.env.AWS_REGION || "us-east-1", appName = (process.env.APP_NAME || "stacks").toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  let { instanceId, elasticIp } = options;
+  if (!instanceId || !elasticIp)
+    try {
+      const { EC2Client } = await import("@stacksjs/ts-cloud"), instance = (await new EC2Client(region).describeInstances({
+        Filters: [
+          { Name: "tag:Name", Values: [`${appName}-mail-server`] },
+          { Name: "instance-state-name", Values: ["running"] }
+        ]
+      })).Reservations?.[0]?.Instances?.[0];
+      if (instance) {
+        instanceId = instanceId || instance.InstanceId;
+        elasticIp = elasticIp || instance.PublicIpAddress;
+      }
+    } catch {}
+  const rdns = options.rdns || `mail.${domain}`, useCase = options.useCase || [
+    `We run a self-hosted mail server (mail.${domain}) for our organization.`,
+    "We send transactional emails (account notifications, password resets) and",
+    "occasional team communication. Expected volume: <1000 emails/day.",
+    "We have SPF, DKIM, and DMARC configured. We need outbound port 25",
+    "to deliver email directly to recipient mail servers via MX records."
+  ].join(" ");
+  console.log("");
+  console.log("==========================================================");
+  console.log("  AWS PORT 25 UNBLOCK REQUEST");
+  console.log("==========================================================");
+  console.log("");
+  console.log(`  Instance:    ${instanceId || "(not detected)"}`);
+  console.log(`  Elastic IP:  ${elasticIp || "(not detected)"}`);
+  console.log(`  Reverse DNS: ${rdns}`);
+  console.log(`  Region:      ${region}`);
+  console.log("");
+  try {
+    const result = execSync(`aws support create-case         --subject "Request to remove email sending limitations"         --communication-body "${useCase}
+
+Elastic IP: ${elasticIp || "N/A"}
+Instance ID: ${instanceId || "N/A"}
+Reverse DNS: ${rdns}
+Region: ${region}"         --service-code "amazon-ec2"         --category-code "port-25-throttle"         --severity-code "normal"         --cc-email-addresses ""         --language "en"         --region us-east-1 2>&1`, { encoding: "utf-8" });
+    if (result.includes("caseId"))
+      try {
+        const caseId = JSON.parse(result).caseId;
+        log.success(`Support case created: ${caseId}`);
+        log.info("");
+        log.info("  AWS will process this within 24-48 hours.");
+        log.info("  Check status: aws support describe-cases --region us-east-1");
+        log.info("");
+        process.exit(ExitCode.Success);
+      } catch {
+        log.error("Failed to parse AWS support case response");
+      }
+  } catch {}
+  if (elasticIp) {
+    log.info("Setting up reverse DNS (rDNS) for Elastic IP...");
+    try {
+      const allocResult = execSync(`aws ec2 describe-addresses --public-ips ${elasticIp} --region ${region} --query 'Addresses[0].AllocationId' --output text 2>&1`, { encoding: "utf-8" }).trim();
+      if (allocResult && !allocResult.includes("error")) {
+        execSync(`aws ec2 modify-address-attribute --allocation-id ${allocResult} --domain-name ${rdns} --region ${region} 2>&1`, { encoding: "utf-8" });
+        log.success(`Reverse DNS requested: ${elasticIp} -> ${rdns}`);
+        console.log("  (rDNS propagation may take a few minutes)");
+      }
+    } catch (error) {
+      log.warn(`rDNS setup failed: ${getErrorMessage(error)}`);
+      console.log("  You may need to set this up manually in the AWS console.");
+    }
+  }
+  console.log("");
+  console.log("  The Support API requires a Business or Enterprise support plan.");
+  console.log("  Opening the AWS web form instead...");
+  console.log("");
+  console.log("  Fill in these details:");
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(`  Email address:    admin@${domain}`);
+  console.log("  Use case:         Sending outbound email from self-hosted mail server");
+  console.log(`  Elastic IP:       ${elasticIp || "(enter your Elastic IP)"}`);
+  console.log(`  rDNS:             ${rdns}`);
+  console.log(`  Region:           ${region}`);
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log("");
+  const formUrl = "https://console.aws.amazon.com/support/contacts#/rdns-limits";
+  try {
+    execSync(`open "${formUrl}" 2>/dev/null || xdg-open "${formUrl}" 2>/dev/null || echo ""`, { encoding: "utf-8" });
+    log.info(`Opened: ${formUrl}`);
+  } catch {
+    console.log("  Open this URL in your browser:");
+    console.log(`  ${formUrl}`);
+  }
+  console.log("");
+  console.log("  After AWS approves (24-48 hours), verify with:");
+  console.log("    buddy mail:port25:status");
+  console.log("");
+  process.exit(ExitCode.Success);
+}
+async function requestHetznerPort25(options, domain) {
+  const hetznerToken = process.env.HETZNER_API_TOKEN;
+  if (!hetznerToken) {
+    log.error("HETZNER_API_TOKEN not set. Add it to .env or set it as an environment variable.");
+    process.exit(ExitCode.FatalError);
+  }
+  let serverId = options.serverId, serverIp = "", serverName = "";
+  try {
+    const data = await (await fetch("https://api.hetzner.cloud/v1/servers", {
+      headers: { Authorization: `Bearer ${hetznerToken}` }
+    })).json(), mailServer = data.servers?.find((s) => s.name?.includes("mail")) || data.servers?.[0];
+    if (mailServer) {
+      serverId = serverId || String(mailServer.id);
+      serverIp = mailServer.public_net?.ipv4?.ip || "";
+      serverName = mailServer.name || "";
+    }
+  } catch {}
+  const rdns = options.rdns || `mail.${domain}`, useCase = options.useCase || [
+    `Self-hosted mail server for ${domain}.`,
+    "Transactional + team email, <1000 emails/day.",
+    "SPF/DKIM/DMARC configured."
+  ].join(" ");
+  console.log("");
+  console.log("==========================================================");
+  console.log("  HETZNER PORT 25 UNBLOCK REQUEST");
+  console.log("==========================================================");
+  console.log("");
+  console.log(`  Server:     ${serverName} (ID: ${serverId || "unknown"})`);
+  console.log(`  Server IP:  ${serverIp || "(not detected)"}`);
+  console.log(`  rDNS:       ${rdns}`);
+  console.log("");
+  if (serverId && serverIp) {
+    log.info("Setting reverse DNS...");
+    try {
+      const rdnsData = await (await fetch(`https://api.hetzner.cloud/v1/servers/${serverId}/actions/change_dns_ptr`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${hetznerToken}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ ip: serverIp, dns_ptr: rdns })
+      })).json();
+      if (rdnsData.action?.status === "running" || rdnsData.action?.status === "success")
+        log.success(`Reverse DNS set: ${serverIp} -> ${rdns}`);
+      else
+        log.warn(`rDNS response: ${JSON.stringify(rdnsData.error || rdnsData)}`);
+    } catch (error) {
+      log.warn(`rDNS failed: ${getErrorMessage(error)}`);
+    }
+  }
+  console.log("");
+  console.log("  To request port 25 unblock from Hetzner:");
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log("  1. Log in to https://console.hetzner.cloud");
+  console.log(`  2. Select project containing server "${serverName}"`);
+  console.log("  3. Go to Support (left sidebar) -> New support request");
+  console.log("  4. Use this template:");
+  console.log("");
+  console.log("     Subject: Request to unblock outbound port 25 (SMTP)");
+  console.log("");
+  console.log("     Body:");
+  console.log("     \u2500\u2500\u2500\u2500\u2500");
+  console.log(`     Server: ${serverName} (ID: ${serverId}, IP: ${serverIp})`);
+  console.log(`     Use case: ${useCase}`);
+  console.log(`     Reverse DNS: ${serverIp} -> ${rdns}`);
+  console.log("     We comply with all anti-spam regulations (CAN-SPAM, GDPR).");
+  console.log("     Please unblock outbound ports 25 and 465 for this server.");
+  console.log("     \u2500\u2500\u2500\u2500\u2500");
+  console.log("");
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  const consoleUrl = "https://console.hetzner.cloud";
+  try {
+    execSync(`open "${consoleUrl}" 2>/dev/null || xdg-open "${consoleUrl}" 2>/dev/null || echo ""`, { encoding: "utf-8" });
+    log.info(`Opened: ${consoleUrl}`);
+  } catch {
+    console.log(`  Open: ${consoleUrl}`);
+  }
+  console.log("");
+  console.log("  After Hetzner approves, verify with:");
+  console.log("    buddy mail:port25:status --provider hetzner");
+  console.log("");
+  process.exit(ExitCode.Success);
+}