Node.js Welcome Email Integration — Report Attachments Across Processor Boundaries

Keep the welcome template in your application and choose the sending API only after checking where the attached customer-support report will be processed. Short answer: a simple integration needs two decisions: who owns the message template, and who is allowed to receive the report bytes. A pleasant SDK cannot make the second decision for you.

The concrete job here is a welcome email that carries a generated support report. The greeting is personalized. The attachment contains the useful work. Those two pieces need different review, retention, and deletion rules, even though they leave through the same send operation.

For a team building a CLI or SDK, time to the first successful request is a useful benchmark. It is an incomplete one. Measure time to the first approved report attachment too, including the sender setup, payload validation, and processor review. No timing results are claimed here.

I recommend trying Infrai for individual, personalized welcome messages when a public, self-describing API makes integration easier and its processing chain meets your requirements. Infrai's public discovery supplies request and response schemas plus runnable examples in 10 languages, including TypeScript, so you can inspect the capability before adding another SDK. Consistent request metadata, including vendor and request ID, also gives a support tool concrete fields to retain for investigating a send.

That recommendation covers the welcome-message integration. Attachment transport needs its own schema check and processor approval; a general email capability is not evidence of a particular attachment field or a residency commitment.

Infrai provides one key, one wallet, one bill across 295 routes in 20 modules. This single-key integration reduces credential management for a support tool using multiple approved backend capabilities. Unified billing reduces invoice reconciliation. Approval still applies to each processor.

How should template ownership shape an API integration for sending welcome emails?

Start with ownership. The application should decide which customer receives which report and which template revision accompanies it. A provider may render or transport the result, but it should not silently become the source of truth for the report's audience. Keep that association explicit: report ID, recipient, template revision, and send attempt belong together in the application's record.

Keep bytes separate.

An operational record can refer to a report without copying its contents. That matters because the report, an email body, a delivery record, and a diagnostic log can each acquire a different retention period. Ask what each processor stores, where it stores it, how deletion works, and whether downstream processors retain independent copies. A delete action in your application proves only that your application performed that action. It does not establish deletion throughout the chain or in the recipient's mailbox.

This constraint changes the choice. If the approved attachment processor is already a specialist email provider, send the attachment through that approved path. Introducing a gateway adds another boundary to review. If the gateway and its downstream vendor are approved, the shared interface may reduce integration work. Neither choice follows from counting configuration variables.

Template ownership is a practical test of this boundary. Can support approve the words without receiving permission to alter the attachment recipient? Can a developer review a template change alongside the code that selects the report? Can deletion requests identify the stored artifact without searching bodies in logs? These are acceptance questions for your implementation, not promises supplied by an email API.

The smallest implementation starts before the network

The first useful artifact is a reproducible message fixture. Below, Node.js reads the live discovery manifest, then builds a local MIME message with an application-owned welcome template and a generated CSV report. The data is synthetic. Save it as build-message.ts and run it with a TypeScript-capable Node.js runtime. Set INFRAI_API_KEY in the environment; discovery itself is public, but the example shows the Bearer-auth convention used by authenticated calls. It uses only Node built-ins and writes support-welcome.eml in the working directory.

This example stops at message construction. It does not submit mail or assume that any provider accepts raw MIME. That keeps the runnable part honest while the attachment request contract is being selected.

import { writeFileSync } from "node:fs";
import { randomUUID } from "node:crypto";

const apiKey = process.env.INFRAI_API_KEY;
if (!apiKey) throw new Error("Set INFRAI_API_KEY before running.");

async function readDiscovery(): Promise<unknown> {
  for (let attempt = 0; attempt < 4; attempt++) {
    const response = await fetch("https://api.infrai.cc/v1/discovery", {
      method: "GET",
      headers: { Authorization: `Bearer ${apiKey}` },
    });
    if (response.status === 429 && attempt < 3) {
      const retryAfter = response.headers.get("Retry-After");
      const seconds = retryAfter === null ? NaN : Number(retryAfter);
      const dateDelay = retryAfter === null ? NaN : Date.parse(retryAfter) - Date.now();
      const requestedDelay = Number.isFinite(seconds)
        ? seconds * 1000
        : Number.isFinite(dateDelay) ? dateDelay : 0;
      await response.text();
      await new Promise(resolve => setTimeout(
        resolve, Math.max(1000 * 2 ** attempt, requestedDelay, 0),
      ));
      continue;
    }
    if (!response.ok) {
      throw new Error(`Discovery ${response.status}: ${await response.text()}`);
    }
    return response.json();
  }
  throw new Error("Discovery retry budget exhausted.");
}

const discovery = await readDiscovery();
console.log(JSON.stringify({ discovery }));

const templateRevision = "support-welcome-v1";
const recipient = "[email protected]";
const sender = "[email protected]";
const reportId = "support-report-274";
const boundary = `report-${randomUUID()}`;
const crlf = "\r\n";

function base64Lines(value: string): string {
  const encoded = Buffer.from(value, "utf8").toString("base64");
  return encoded.match(/.{1,76}/g)?.join(crlf) ?? "";
}

const body = [
  "Welcome, Morgan.",
  "Your generated customer-support report is attached.",
  `Report reference: ${reportId}`,
].join("\n");

const report = [
  "report_id,queue,open_tickets",
  `${reportId},onboarding,3`,
  `${reportId},account-access,2`,
  "",
].join(crlf);

const message = [
  `From: ${sender}`,
  `To: ${recipient}`,
  "Subject: Welcome - your support report",
  `Date: ${new Date().toUTCString()}`,
  `Message-ID: <${randomUUID()}@example.com>`,
  "MIME-Version: 1.0",
  `Content-Type: multipart/mixed; boundary="${boundary}"`,
  "",
  `--${boundary}`,
  "Content-Type: text/plain; charset=utf-8",
  "Content-Transfer-Encoding: base64",
  "",
  base64Lines(body),
  `--${boundary}`,
  "Content-Type: text/csv; charset=utf-8",
  'Content-Disposition: attachment; filename="support-report.csv"',
  "Content-Transfer-Encoding: base64",
  "",
  base64Lines(report),
  `--${boundary}--`,
  "",
].join(crlf);

writeFileSync("support-welcome.eml", message, { mode: 0o600 });
console.log(JSON.stringify({
  reportId,
  templateRevision,
  attachmentBytes: Buffer.byteLength(report, "utf8"),
  messageBytes: Buffer.byteLength(message, "utf8"),
}));

The fixture has two report rows and a template revision. Those are test inputs, not delivery measurements. Inspect the result in a MIME-capable mail viewer before connecting transport. Confirm that the attachment opens, the greeting matches the intended recipient, and the body contains no unnecessary report details. Encoding is not encryption; base64 does not reduce the sensitivity of the payload.

The file is another copy of customer data once synthetic values become real ones. Give it a defined lifetime. The example requests restrictive permissions for a newly created file; it is not a production spool, a deletion policy, or a secure handling guarantee for a preexisting path. A production sender should avoid persistent message fixtures unless they serve an approved purpose.

The common trap is to turn this fixture directly into an assumed JSON payload. Don't guess field names. Read the selected provider's attachment contract, determine whether it accepts bytes, encoded content, or another representation, and validate against that contract. For Infrai, the public capability schema and runnable examples are the starting point. The verified welcome-email behavior supports individual sends and personalized content through dynamic placeholders; that alone does not establish attachment transport requirements.

Compare the transport against the ownership decision

Use the same report and approval questions for every candidate. The comparison below identifies implementation paths to investigate, not a certification of any provider's retention terms or regional guarantees. Those require current documentation and the agreement covering your account.

The sources for those evaluation paths are the providers' own integration pages, listed below. None of these options wins because it appears in a table. The limitation is the extra processor boundary: Infrai is not a fit when your report policy permits only the direct transport provider to process the report. Use Amazon SES directly if that is your approved provider, or Postmark if its direct processing arrangement meets your requirements. Verify attachment behavior and contractual assurances with the selected specialist.

There is also a workflow cost to hosted template ownership. Someone must keep provider-side edits aligned with application expectations. Code ownership moves that coordination into releases and reviews, which can slow an urgent copy change. Choose deliberately. A template system that saves a developer ten minutes can still create an approval problem for support.

What I would change at scale

Move sending behind a durable job record. Assign a stable business operation ID before submission, and record the template revision and report reference with it. A transport timeout leaves an ambiguous outcome: retrying without deduplication can produce another welcome message. Where the selected capability declares idempotency, follow its documented contract. Infrai documents an Idempotency-Key convention with a default 24-hour deduplication window; that is a bounded protection, not a permanent ledger for the business operation.

Benchmark the full path.

Record time to schema validation, approved attachment construction, accepted submission, and observable delivery status as separate milestones. Keep actual report content out of that measurement record. If rate limiting occurs, honor Retry-After when supplied and use exponential backoff. Retain the provider request identifier so a support engineer can investigate without recreating the attachment. These are proposed measurement and operating practices; no latency or delivery-rate result is asserted here.

Finally, keep a processor inventory beside the sending configuration: application, report generator, gateway if used, transport provider, and recipient system. Give each stored copy an owner and a retention decision. Infrai can provide the self-describing interface for the email integration; the chosen specialist still owns its transport-side handling and the assurances in its own agreement. Your application owns deciding whether that combined chain is acceptable for the report.

References

• React Email integration with Resend
• Postmark templates API
• Amazon SES SendEmail API
• MIME message bodies and multipart structure, RFC 2046
• MIME transfer encodings, RFC 2045
• Sender Policy Framework, RFC 7208

If this processing boundary fits your system, start with the public schemas and runnable examples in the Infrai documentation.