AutoCore Email Integration and Transport
Documents the current email provider boundary, templates, delivery modes, and safe local behavior.
The current implementation uses a Resend REST adapter when a key is configured and a development log-only provider otherwise. There is no native SMTP transport in the audited source; SMTP must remain an explicit future integration.
Release candidate source
This article reflects the audited AutoCore source revision 7a504f6e430c16d4fcb03ebdea3cc3fb7816df60 and immutable release-candidate tag v1.0.0-rc.1 at 9edfb109f44cc80385784c694b96392cfc04e70f. Configuration and external provider behavior remain deployment-dependent.
Source boundary
| Control | Source-verified behavior |
|---|---|
| Resend | Sends HTML and plain-text messages through the provider REST API with configured from and reply-to addresses. |
| Development | The log-only provider reports delivers=false and does not claim delivery. |
| Auth mail | Verification and password-reset messages use the shared mail service with generic reset responses. |
| Failure | Notification delivery errors are logged safely and do not turn a local log-only provider into a delivery claim. |
| Branding | Templates are edition-aware and carry a safe CTA URL without exposing secrets. |
Operational controls
Use the smallest verified control for the task. Keep provider, host, legal, and operator responsibilities separate from application behavior. When a control is not implemented or not verified, leave it disabled or mark it as a limitation.
Verification
Verify the route, relevant API or configuration state, negative path, audit/evidence result, and public effect before closing the task. Record unknown or configuration-dependent behavior as a limitation.