@zintrust/core 0.1.1 → 0.1.2

package/src/tools/mail/drivers/SendGrid.d.ts

@@ -0,0 +1,29 @@
+export type SendGridConfig = {
+    apiKey: string;
+};
+export type MailAddress = {
+    email: string;
+    name?: string;
+};
+export type MailAttachment = {
+    filename: string;
+    content: Buffer;
+};
+export type MailMessage = {
+    to: string | string[];
+    from: MailAddress;
+    subject: string;
+    text: string;
+    html?: string;
+    attachments?: MailAttachment[];
+};
+export type SendResult = {
+    ok: boolean;
+    provider: 'sendgrid';
+    messageId?: string;
+};
+export declare const SendGridDriver: Readonly<{
+    send(config: SendGridConfig, message: MailMessage): Promise<SendResult>;
+}>;
+export default SendGridDriver;
+//# sourceMappingURL=SendGrid.d.ts.map

package/src/tools/mail/drivers/SendGrid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SendGrid.d.ts","sourceRoot":"","sources":["../../../../../src/tools/mail/drivers/SendGrid.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,UAAU,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAIF,eAAO,MAAM,cAAc;iBACN,cAAc,WAAW,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;EAoE7E,CAAC;AAEH,eAAe,cAAc,CAAC"}

package/src/tools/mail/drivers/SendGrid.js

@@ -0,0 +1,57 @@
+import { ErrorFactory } from '../../../exceptions/ZintrustError';
+const normalizeRecipients = (to) => (Array.isArray(to) ? to : [to]);
+export const SendGridDriver = Object.freeze({
+    async send(config, message) {
+        if (config.apiKey.trim() === '') {
+            throw ErrorFactory.createConfigError('SendGrid: missing SENDGRID_API_KEY');
+        }
+        if (message.from.email.trim() === '') {
+            throw ErrorFactory.createConfigError('Mail: missing from.email');
+        }
+        const personalizations = [
+            {
+                to: normalizeRecipients(message.to).map((email) => ({ email })),
+            },
+        ];
+        const content = [
+            { type: 'text/plain', value: message.text },
+        ];
+        if (typeof message.html === 'string' && message.html !== '') {
+            content.push({ type: 'text/html', value: message.html });
+        }
+        const body = {
+            personalizations,
+            from: {
+                email: message.from.email,
+                name: message.from.name?.trim() === '' ? undefined : message.from.name,
+            },
+            subject: message.subject,
+            content,
+        };
+        if (message.attachments && message.attachments.length > 0) {
+            body.attachments = message.attachments.map((a) => ({
+                content: a.content.toString('base64'),
+                filename: a.filename,
+            }));
+        }
+        const res = await fetch('https://api.sendgrid.com/v3/mail/send', {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${config.apiKey}`,
+                'content-type': 'application/json',
+            },
+            body: JSON.stringify(body),
+        });
+        // SendGrid typically returns 202 for success.
+        if (res.status === 202) {
+            const messageId = res.headers.get('x-message-id') ?? undefined;
+            return { ok: true, provider: 'sendgrid', messageId };
+        }
+        const text = await res.text();
+        throw ErrorFactory.createConnectionError(`SendGrid send failed (${res.status})`, {
+            status: res.status,
+            body: text,
+        });
+    },
+});
+export default SendGridDriver;

package/src/tools/mail/drivers/Ses.d.ts

@@ -0,0 +1,24 @@
+export type SesConfig = {
+    region: string;
+};
+export type MailAddress = {
+    email: string;
+    name?: string;
+};
+export type MailMessage = {
+    to: string | string[];
+    from: MailAddress;
+    subject: string;
+    text: string;
+    html?: string;
+};
+export type SendResult = {
+    ok: boolean;
+    provider: 'ses';
+    messageId?: string;
+};
+export declare const SesDriver: Readonly<{
+    send(config: SesConfig, message: MailMessage): Promise<SendResult>;
+}>;
+export default SesDriver;
+//# sourceMappingURL=Ses.d.ts.map

package/src/tools/mail/drivers/Ses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Ses.d.ts","sourceRoot":"","sources":["../../../../../src/tools/mail/drivers/Ses.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,KAAK,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAsGF,eAAO,MAAM,SAAS;iBACD,SAAS,WAAW,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;EAgDxE,CAAC;AAEH,eAAe,SAAS,CAAC"}

package/src/tools/mail/drivers/Ses.js

@@ -0,0 +1,116 @@
+import { AwsSigV4 } from '../../../common/index';
+import { ErrorFactory } from '../../../exceptions/ZintrustError';
+const sha256Hex = (data) => AwsSigV4.sha256Hex(data);
+const buildAuthorization = (params) => {
+    const canonicalUri = params.path;
+    const canonicalQueryString = '';
+    const headers = {
+        'content-type': 'application/json',
+        host: params.host,
+        'x-amz-date': params.amzDate,
+    };
+    if (params.credentials.sessionToken !== null && params.credentials.sessionToken !== undefined) {
+        headers['x-amz-security-token'] = params.credentials.sessionToken;
+    }
+    const payloadHash = sha256Hex(params.body);
+    return AwsSigV4.buildAuthorization({
+        method: params.method,
+        canonicalUri,
+        canonicalQueryString,
+        headers,
+        payloadHash,
+        region: params.region,
+        service: 'ses',
+        amzDate: params.amzDate,
+        dateStamp: params.dateStamp,
+        credentials: params.credentials,
+    });
+};
+const ensureRegion = (config) => {
+    const region = typeof config.region === 'string' ? config.region.trim() : '';
+    if (region === '')
+        throw ErrorFactory.createConfigError('SES: missing region in config');
+    return region;
+};
+const ensureCredentials = () => {
+    const accessKeyId = process.env['AWS_ACCESS_KEY_ID'] ?? '';
+    const secretAccessKey = process.env['AWS_SECRET_ACCESS_KEY'] ?? '';
+    const sessionToken = process.env['AWS_SESSION_TOKEN'] ?? undefined;
+    if (accessKeyId.trim() === '' || secretAccessKey.trim() === '') {
+        throw ErrorFactory.createConfigError('SES: missing AWS credentials (set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY)');
+    }
+    return { accessKeyId, secretAccessKey, sessionToken };
+};
+const buildBody = (message) => {
+    const toAddresses = Array.isArray(message.to) ? message.to : [message.to];
+    const body = {
+        FromEmailAddress: message.from.email,
+        Destination: { ToAddresses: toAddresses },
+        Content: {
+            Simple: {
+                Subject: { Data: message.subject },
+                Body: {
+                    Text: { Data: message.text },
+                    ...(typeof message.html === 'string' && message.html !== ''
+                        ? { Html: { Data: message.html } }
+                        : {}),
+                },
+            },
+        },
+    };
+    return JSON.stringify(body);
+};
+const buildHeaders = (amzDate, authorization, sessionToken) => {
+    const headers = {
+        'content-type': 'application/json',
+        'x-amz-date': amzDate,
+        Authorization: authorization,
+    };
+    if (typeof sessionToken === 'string' && sessionToken !== '')
+        headers['x-amz-security-token'] = sessionToken;
+    return headers;
+};
+export const SesDriver = Object.freeze({
+    async send(config, message) {
+        const region = ensureRegion(config);
+        const { accessKeyId, secretAccessKey, sessionToken } = ensureCredentials();
+        const bodyJson = buildBody(message);
+        const host = `email.${region}.amazonaws.com`;
+        const path = '/v2/email/outbound-emails';
+        const url = `https://${host}${path}`;
+        const now = new Date();
+        const { amzDate, dateStamp } = AwsSigV4.toAmzDate(now);
+        const { authorization } = buildAuthorization({
+            method: 'POST',
+            host: host,
+            region,
+            amzDate,
+            dateStamp,
+            credentials: { accessKeyId, secretAccessKey, sessionToken },
+            body: bodyJson,
+            path,
+        });
+        const headers = buildHeaders(amzDate, authorization, sessionToken);
+        const res = await fetch(url, {
+            method: 'POST',
+            headers,
+            body: bodyJson,
+        });
+        if (res.ok) {
+            try {
+                const json = (await res.json());
+                const messageId = typeof json?.['MessageId'] === 'string' ? json['MessageId'] : undefined;
+                return { ok: true, provider: 'ses', messageId };
+            }
+            catch {
+                return { ok: true, provider: 'ses' };
+            }
+        }
+        const text = await res.text();
+        throw ErrorFactory.createConnectionError(`SES send failed (${res.status})`, {
+            status: res.status,
+            body: text,
+        });
+    },
+});
+export default SesDriver;

package/src/tools/mail/drivers/Smtp.d.ts

@@ -0,0 +1,38 @@
+export type SmtpConfig = {
+    host: string;
+    port: number;
+    username?: string;
+    password?: string;
+    secure?: boolean | 'starttls';
+};
+export type MailAddress = {
+    email: string;
+    name?: string;
+};
+export type MailAttachment = {
+    filename: string;
+    content: Buffer;
+};
+export type MailMessage = {
+    to: string | string[];
+    from: MailAddress;
+    subject: string;
+    text: string;
+    html?: string;
+    attachments?: MailAttachment[];
+};
+export type SendResult = {
+    ok: boolean;
+    provider: 'smtp';
+    messageId?: string;
+};
+export declare const SmtpDriver: Readonly<{
+    /**
+     * NOTE: This is a minimal SMTP implementation intended for Node.js runtimes.
+     * - `secure=true` means TLS from the start (SMTPS).
+     * - `secure='starttls'` performs STARTTLS after EHLO.
+     */
+    send(config: SmtpConfig, message: MailMessage): Promise<SendResult>;
+}>;
+export default SmtpDriver;
+//# sourceMappingURL=Smtp.d.ts.map

package/src/tools/mail/drivers/Smtp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Smtp.d.ts","sourceRoot":"","sources":["../../../../../src/tools/mail/drivers/Smtp.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AA0XF,eAAO,MAAM,UAAU;IACrB;;;;OAIG;iBACgB,UAAU,WAAW,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;EAgDzE,CAAC;AAEH,eAAe,UAAU,CAAC"}

package/src/tools/mail/drivers/Smtp.js

@@ -0,0 +1,327 @@
+import { generateUuid } from '../../../common/uuid';
+import { ErrorFactory } from '../../../exceptions/ZintrustError';
+import * as net from '../../../node-singletons/net';
+import * as tls from '../../../node-singletons/tls';
+const normalizeRecipients = (to) => (Array.isArray(to) ? to : [to]);
+const toBase64 = (value) => Buffer.from(value, 'utf8').toString('base64');
+const isNodeRuntime = () => typeof process !== 'undefined' && typeof process.versions?.node === 'string';
+const validateConfig = (config) => {
+    if (!isNodeRuntime()) {
+        throw ErrorFactory.createConfigError('SMTP driver requires Node.js runtime');
+    }
+    if (config.host.trim() === '') {
+        throw ErrorFactory.createConfigError('SMTP: missing MAIL_HOST');
+    }
+    if (!Number.isFinite(config.port) || config.port <= 0) {
+        throw ErrorFactory.createConfigError('SMTP: invalid MAIL_PORT');
+    }
+};
+const createSocket = async (config, implicitTls) => {
+    validateConfig(config);
+    return new Promise((resolve, reject) => {
+        const onError = (err) => {
+            reject(ErrorFactory.createConnectionError('SMTP connection failed', {
+                host: config.host,
+                port: config.port,
+                secure: implicitTls,
+                error: err,
+            }));
+        };
+        const socket = implicitTls
+            ? tls.connect({
+                host: config.host,
+                port: config.port,
+                servername: config.host,
+            })
+            : net.connect({ host: config.host, port: config.port });
+        if (implicitTls) {
+            socket.once('secureConnect', () => resolve(socket));
+        }
+        else {
+            socket.once('connect', () => resolve(socket));
+        }
+        socket.once('error', onError);
+    });
+};
+const upgradeToStartTls = async (socket, host) => {
+    return new Promise((resolve, reject) => {
+        const tlsSocket = tls.connect({ socket, servername: host });
+        tlsSocket.once('secureConnect', () => {
+            resolve(tlsSocket);
+        });
+        tlsSocket.once('error', (err) => {
+            reject(ErrorFactory.createConnectionError('SMTP STARTTLS upgrade failed', {
+                host,
+                error: err,
+            }));
+        });
+    });
+};
+const createLineReader = (socket) => {
+    let buffer = '';
+    const waiters = [];
+    const wake = () => {
+        while (waiters.length > 0) {
+            const w = waiters.shift();
+            if (w)
+                w();
+        }
+    };
+    const onData = (data) => {
+        buffer += data.toString('utf8');
+        wake();
+    };
+    socket.on('data', onData);
+    const tryReadLineFromBuffer = () => {
+        const idx = buffer.indexOf('\n');
+        if (idx < 0)
+            return undefined;
+        const line = buffer.slice(0, idx + 1);
+        buffer = buffer.slice(idx + 1);
+        return line.replaceAll(/\r?\n$/, '');
+    };
+    const readLine = async () => {
+        const immediate = tryReadLineFromBuffer();
+        if (typeof immediate === 'string')
+            return immediate;
+        await new Promise((resolve) => waiters.push(resolve));
+        return readLine();
+    };
+    const readMultiline = async (code, message) => {
+        const line = await readLine();
+        const nextCodeStr = line.slice(0, 3);
+        const nextCode = Number.parseInt(nextCodeStr, 10);
+        const nextMsg = line.length > 4 ? line.slice(4) : '';
+        const nextMessage = `${message}\n${nextMsg}`.trim();
+        if (Number.isFinite(nextCode) && nextCode === code && line[3] === ' ')
+            return nextMessage;
+        return readMultiline(code, nextMessage);
+    };
+    const readResponse = async () => {
+        const first = await readLine();
+        const codeStr = first.slice(0, 3);
+        const code = Number.parseInt(codeStr, 10);
+        if (!Number.isFinite(code)) {
+            throw ErrorFactory.createConnectionError('SMTP: invalid response code', { first });
+        }
+        let message = first.length > 4 ? first.slice(4) : '';
+        // Multiline response: "250-..." then "250 ..."
+        if (first[3] === '-') {
+            message = await readMultiline(code, message);
+        }
+        return { code, message };
+    };
+    const close = () => {
+        socket.off('data', onData);
+    };
+    return { readResponse, close };
+};
+const writeLine = async (socket, line) => {
+    return new Promise((resolve, reject) => {
+        socket.write(`${line}\r\n`, (err) => {
+            if (err)
+                reject(err);
+            else
+                resolve();
+        });
+    });
+};
+const assertCode = (res, expected, context) => {
+    const allowed = Array.isArray(expected) ? expected : [expected];
+    if (!allowed.includes(res.code)) {
+        throw ErrorFactory.createConnectionError(`SMTP: unexpected response for ${context}`, {
+            expected: allowed,
+            got: res.code,
+            message: res.message,
+        });
+    }
+};
+const hasCapability = (res, capability) => {
+    const cap = capability.trim().toUpperCase();
+    if (cap === '')
+        return false;
+    return res.message
+        .split('\n')
+        .some((line) => line.trim().toUpperCase().startsWith(cap) || line.trim().toUpperCase().includes(cap));
+};
+const doEhlo = async (socket, reader) => {
+    await writeLine(socket, 'EHLO zintrust');
+    const res = await reader.readResponse();
+    assertCode(res, 250, 'EHLO');
+    return res;
+};
+const doAuthLoginIfNeeded = async (socket, reader, config) => {
+    const username = config.username ?? '';
+    const password = config.password ?? '';
+    const wantsAuth = username.trim() !== '' || password.trim() !== '';
+    if (!wantsAuth)
+        return;
+    if (username.trim() === '' || password.trim() === '') {
+        throw ErrorFactory.createConfigError('SMTP: both MAIL_USERNAME and MAIL_PASSWORD are required');
+    }
+    await writeLine(socket, 'AUTH LOGIN');
+    const auth1 = await reader.readResponse();
+    assertCode(auth1, 334, 'AUTH LOGIN');
+    await writeLine(socket, toBase64(username));
+    const auth2 = await reader.readResponse();
+    assertCode(auth2, 334, 'AUTH username');
+    await writeLine(socket, toBase64(password));
+    const auth3 = await reader.readResponse();
+    assertCode(auth3, 235, 'AUTH password');
+};
+const doMailFrom = async (socket, reader, fromEmail) => {
+    await writeLine(socket, `MAIL FROM:<${fromEmail}>`);
+    const mailFrom = await reader.readResponse();
+    assertCode(mailFrom, [250, 251], 'MAIL FROM');
+};
+const doRcptToAll = async (socket, reader, recipients) => {
+    if (recipients.length === 0) {
+        throw ErrorFactory.createValidationError('SMTP: missing recipients');
+    }
+    await recipients.reduce(async (prev, rcpt) => {
+        await prev;
+        await writeLine(socket, `RCPT TO:<${rcpt}>`);
+        const rcptRes = await reader.readResponse();
+        assertCode(rcptRes, [250, 251], 'RCPT TO');
+    }, Promise.resolve());
+};
+const doData = async (socket, reader, message) => {
+    await writeLine(socket, 'DATA');
+    const dataRes = await reader.readResponse();
+    assertCode(dataRes, 354, 'DATA');
+    const raw = buildRfc2822Message(message);
+    const stuffed = dotStuff(raw);
+    await new Promise((resolve, reject) => {
+        socket.write(`${stuffed}\r\n.\r\n`, (err) => {
+            if (err)
+                reject(err);
+            else
+                resolve();
+        });
+    });
+    const queued = await reader.readResponse();
+    assertCode(queued, 250, 'message body');
+};
+const doQuit = async (socket, reader) => {
+    await writeLine(socket, 'QUIT');
+    const quit = await reader.readResponse();
+    assertCode(quit, [221, 250], 'QUIT');
+};
+const buildRfc2822Message = (msg) => {
+    const toList = normalizeRecipients(msg.to);
+    const fromNameRaw = msg.from.name;
+    const fromName = typeof fromNameRaw === 'string' ? fromNameRaw.trim() : '';
+    const fromHeader = fromName === '' ? msg.from.email : `${fromName} <${msg.from.email}>`;
+    const toHeader = toList.join(', ');
+    const subject = msg.subject;
+    const headers = [
+        `From: ${fromHeader}`,
+        `To: ${toHeader}`,
+        `Subject: ${subject}`,
+        'MIME-Version: 1.0',
+    ];
+    const attachParts = (attachments, innerBody) => {
+        const mixedBoundary = `mixed_${generateUuid().replaceAll('-', '')}`;
+        const lines = [];
+        lines.push(`Content-Type: multipart/mixed; boundary="${mixedBoundary}"`, '', `--${mixedBoundary}`, innerBody);
+        // attachments
+        for (const a of attachments) {
+            const b64 = a.content.toString('base64');
+            lines.push(`--${mixedBoundary}`, `Content-Type: application/octet-stream; name="${a.filename}"`, 'Content-Transfer-Encoding: base64', `Content-Disposition: attachment; filename="${a.filename}"`, '');
+            // break base64 into 76 char lines per RFC
+            for (let i = 0; i < b64.length; i += 76) {
+                lines.push(b64.slice(i, i + 76));
+            }
+        }
+        lines.push(`--${mixedBoundary}--`, '');
+        return lines.join('\r\n');
+    };
+    if (typeof msg.html === 'string' && msg.html !== '') {
+        const boundary = `zintrust_${generateUuid().replaceAll('-', '')}`;
+        headers.push(`Content-Type: multipart/alternative; boundary="${boundary}"`);
+        const parts = [
+            `--${boundary}`,
+            'Content-Type: text/plain; charset=utf-8',
+            'Content-Transfer-Encoding: 7bit',
+            '',
+            msg.text,
+            `--${boundary}`,
+            'Content-Type: text/html; charset=utf-8',
+            'Content-Transfer-Encoding: 7bit',
+            '',
+            msg.html,
+            `--${boundary}--`,
+            '',
+        ];
+        const inner = `${parts.join('\r\n')}`;
+        if (msg.attachments && msg.attachments.length > 0) {
+            // wrap in multipart/mixed
+            const mixed = attachParts(msg.attachments, inner);
+            return `${headers.join('\r\n')}\r\n\r\n${mixed}`;
+        }
+        return `${headers.join('\r\n')}\r\n\r\n${inner}`;
+    }
+    // plain text
+    if (msg.attachments && msg.attachments.length > 0) {
+        const inner = ['Content-Type: text/plain; charset=utf-8', '', msg.text, ''].join('\r\n');
+        const mixed = attachParts(msg.attachments, inner);
+        return `${headers.join('\r\n')}\r\n\r\n${mixed}`;
+    }
+    headers.push('Content-Type: text/plain; charset=utf-8');
+    return `${headers.join('\r\n')}\r\n\r\n${msg.text}\r\n`;
+};
+const dotStuff = (data) => data
+    .replaceAll(/\r?\n/g, '\r\n')
+    .split('\r\n')
+    .map((line) => (line.startsWith('.') ? `.${line}` : line))
+    .join('\r\n');
+export const SmtpDriver = Object.freeze({
+    /**
+     * NOTE: This is a minimal SMTP implementation intended for Node.js runtimes.
+     * - `secure=true` means TLS from the start (SMTPS).
+     * - `secure='starttls'` performs STARTTLS after EHLO.
+     */
+    async send(config, message) {
+        let mode = 'none';
+        if (config.secure === true)
+            mode = 'tls';
+        if (config.secure === 'starttls')
+            mode = 'starttls';
+        let socket = await createSocket(config, mode === 'tls');
+        let reader = createLineReader(socket);
+        try {
+            const greeting = await reader.readResponse();
+            assertCode(greeting, 220, 'greeting');
+            const ehlo = await doEhlo(socket, reader);
+            if (mode === 'starttls') {
+                const supportsStartTls = hasCapability(ehlo, 'STARTTLS');
+                if (!supportsStartTls) {
+                    throw ErrorFactory.createConnectionError('SMTP server does not support STARTTLS');
+                }
+                await writeLine(socket, 'STARTTLS');
+                const startTls = await reader.readResponse();
+                assertCode(startTls, 220, 'STARTTLS');
+                // Swap reader/socket to the upgraded TLS stream
+                reader.close();
+                socket = await upgradeToStartTls(socket, config.host);
+                reader = createLineReader(socket);
+                // RFC: EHLO again after STARTTLS
+                await doEhlo(socket, reader);
+            }
+            await doAuthLoginIfNeeded(socket, reader, config);
+            await doMailFrom(socket, reader, message.from.email);
+            await doRcptToAll(socket, reader, normalizeRecipients(message.to));
+            await doData(socket, reader, message);
+            await doQuit(socket, reader);
+            return { ok: true, provider: 'smtp' };
+        }
+        catch (err) {
+            throw ErrorFactory.createConnectionError('SMTP send failed', { error: err });
+        }
+        finally {
+            reader.close();
+            socket.end();
+        }
+    },
+});
+export default SmtpDriver;

package/src/tools/mail/templates/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Mail Templates (Core)
+ *
+ * This folder contains reusable email templates used by core mail tooling.
+ * Templates may be organized into subfolders (e.g., `auth/`, `orders/`) with
+ * both rich HTML and plain-text variants.
+ */
+export type MailTemplate = {
+    subject: string;
+    text: string;
+    html?: string;
+};
+export type MailTemplateRegistry = Record<string, unknown>;
+export declare const MailTemplateRenderer: Readonly<{
+    renderString: (template: string, data: Record<string, unknown>) => string;
+    render(template: MailTemplate, data: Record<string, unknown>): MailTemplate;
+}>;
+export declare const MailTemplates: Readonly<{
+    auth: Readonly<{
+        welcome: Readonly<{
+            subject: string;
+            text: string;
+            html: string;
+        }>;
+    }>;
+}>;
+//# sourceMappingURL=index.d.ts.map

package/src/tools/mail/templates/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/tools/mail/templates/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAW3D,eAAO,MAAM,oBAAoB;6BATD,MAAM,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM;qBAY3D,YAAY,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY;EAO3E,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;;;;EASO,CAAC"}

package/src/tools/mail/templates/index.js

@@ -0,0 +1,35 @@
+/**
+ * Mail Templates (Core)
+ *
+ * This folder contains reusable email templates used by core mail tooling.
+ * Templates may be organized into subfolders (e.g., `auth/`, `orders/`) with
+ * both rich HTML and plain-text variants.
+ */
+const renderString = (template, data) => {
+    let out = template;
+    for (const [key, value] of Object.entries(data)) {
+        const replacement = value === null || value === undefined ? '' : String(value);
+        out = out.replaceAll(new RegExp(String.raw `{{\s*${key}\s*}}`, 'g'), replacement);
+    }
+    return out;
+};
+export const MailTemplateRenderer = Object.freeze({
+    renderString,
+    render(template, data) {
+        return {
+            subject: renderString(template.subject, data),
+            text: renderString(template.text, data),
+            html: typeof template.html === 'string' ? renderString(template.html, data) : undefined,
+        };
+    },
+});
+export const MailTemplates = Object.freeze({
+    auth: Object.freeze({
+        // Example template. Apps can add their own workflows under app/Toolkit/Mail.
+        welcome: Object.freeze({
+            subject: 'Welcome, {{name}}!',
+            text: 'Hi {{name}},\n\nWelcome to Zintrust.',
+            html: '<p>Hi {{name}},</p><p>Welcome to Zintrust.</p>',
+        }),
+    }),
+});