feat(core): built-in SMTP email transport for generic SMTP credentials

Adds an email:deliver provider that works with any standard SMTP server
(Brevo relay, Office365, Fastmail, Amazon SES, self-hosted Postfix) via
raw TCP — the one network primitive sandboxed plugins cannot use.

Configuration is env-only (EMAIL_SMTP_HOST/PORT/USER/PASS/FROM). Supports
STARTTLS (587) and implicit TLS (465); port 25 is refused because
Cloudflare blocks it. TLS is always required. Works on Cloudflare Workers
(cloudflare:sockets) and Node (node:net/node:tls).

Registered as a built-in plugin so it participates in exclusive hook
resolution like any other provider — explicitly selected plugin transports
still take precedence.

Closes #1541

Author: swissky

.changeset/smtp-email-transport.md

@@ -0,0 +1,5 @@
+---
+"emdash": minor
+---
+
+Adds a built-in SMTP email transport for generic SMTP credentials (Brevo relay, Office365, Fastmail, Amazon SES, self-hosted Postfix). Configure via `EMAIL_SMTP_HOST`, `EMAIL_SMTP_PORT`, `EMAIL_SMTP_USER`, `EMAIL_SMTP_PASS`, and optional `EMAIL_SMTP_FROM` env vars. Supports STARTTLS (port 587) and implicit TLS (port 465); port 25 is refused with a clear error because Cloudflare blocks it. Works on Cloudflare Workers (via `cloudflare:sockets`) and Node (via `node:net`/`node:tls`). Sandboxed plugins cannot open TCP sockets, so this lives in core — explicitly selected plugin transports still take precedence.

docs/src/content/docs/deployment/cloudflare.mdx

@@ -274,6 +274,44 @@ the provider under **Settings → Email**.
 	Email.
 </Aside>
 
+### Built-in SMTP transport
+
+If you don't want to use Cloudflare Email Sending (e.g. you already have SMTP
+credentials for Brevo relay, Office365, Fastmail, Amazon SES, or a self-hosted
+Postfix relay), EmDash includes a built-in SMTP transport that works with any
+standard SMTP server. Sandboxed plugins cannot open TCP sockets, so this lives
+in core and uses `cloudflare:sockets` on Workers or `node:net`/`node:tls` on
+Node.
+
+Configure via environment variables:
+
+```bash title=".env"
+EMAIL_SMTP_HOST=smtp-relay.brevo.com
+EMAIL_SMTP_PORT=587
+EMAIL_SMTP_USER=you@example.com
+EMAIL_SMTP_PASS=xsmtpsib-your-key-here
+EMAIL_SMTP_FROM="My Site <noreply@example.com>"
+```
+
+| Variable          | Example                        | Notes                                                     |
+| ----------------- | ------------------------------ | --------------------------------------------------------- |
+| `EMAIL_SMTP_HOST` | `smtp-relay.brevo.com`         | Any SMTP server reachable from your deployment            |
+| `EMAIL_SMTP_PORT` | `587` or `465`                 | 587 = STARTTLS, 465 = implicit TLS. Port 25 is refused.   |
+| `EMAIL_SMTP_USER` | `you@example.com`              | SMTP auth username                                        |
+| `EMAIL_SMTP_PASS` | `xsmtpsib-…`                   | SMTP auth password (store as a secret)                    |
+| `EMAIL_SMTP_FROM` | `My Site <noreply@example.com>` | Optional default sender; falls back to `EMAIL_SMTP_USER` |
+
+<Aside type="caution">
+	Cloudflare blocks outbound port 25. This transport only supports submission
+	ports 587 (STARTTLS) and 465 (implicit TLS), and refuses port 25 with a clear
+	error. TLS is always required — plaintext auth is never attempted.
+</Aside>
+
+When configured, the SMTP transport registers as a built-in `email:deliver`
+provider. Explicitly selected plugin transports (like `cloudflareEmail()`) still
+take precedence — the built-in SMTP provider only wins when it's the sole
+registered provider or when you explicitly select it under **Settings → Email**.
+
 ## Environment Variables
 
 ### Recommended: encryption key

packages/core/src/emdash-runtime.ts

@@ -172,6 +172,7 @@ import { getDb } from "./loader.js";
 import { CronExecutor, type InvokeCronHookFn } from "./plugins/cron.js";
 import { definePlugin } from "./plugins/define-plugin.js";
 import { DEV_CONSOLE_EMAIL_PLUGIN_ID, devConsoleEmailDeliver } from "./plugins/email-console.js";
+import { createSmtpEmailDeliver, loadSmtpConfigFromEnv, SMTP_EMAIL_PLUGIN_ID } from "./plugins/email-smtp.js";
 import { EmailPipeline } from "./plugins/email.js";
 import {
 	createHookPipeline,
@@ -1298,6 +1299,33 @@ export class EmDashRuntime {
 			}
 		}
 
+		// Register built-in SMTP email provider when EMAIL_SMTP_* env vars are
+		// present. This is the only transport that works with generic SMTP
+		// credentials (Brevo relay, Office365, Fastmail, self-hosted Postfix)
+		// because sandboxed plugins cannot open TCP sockets. Registered as a
+		// built-in so it participates in exclusive hook resolution like any
+		// other provider — explicitly-selected plugin transports still win.
+		const smtpConfig = loadSmtpConfigFromEnv();
+		if (smtpConfig) {
+			try {
+				const smtpPlugin = definePlugin({
+					id: SMTP_EMAIL_PLUGIN_ID,
+					version: "1.0.0",
+					capabilities: ["hooks.email-transport:register"],
+					hooks: {
+						"email:deliver": {
+							exclusive: true,
+							handler: createSmtpEmailDeliver(smtpConfig),
+						},
+					},
+				});
+				allPipelinePlugins.push(smtpPlugin);
+				enabledPlugins.add(smtpPlugin.id);
+			} catch (error) {
+				console.warn("[email] Failed to register SMTP email provider:", error);
+			}
+		}
+
 		// Register built-in default comment moderator.
 		// Always present — auto-selected as the sole comment:moderate provider
 		// unless a plugin (e.g. AI moderation) provides its own.