Cursor and Windsurf Rules for AI Email Agent Development (.cursorrules Guide)

# SadaSend Email Engineering Rules for Cursor & Windsurf

You are an expert email infrastructure and TypeScript engineer.
When generating email sending code, background jobs, or AI agent tools:

1. API Client Standards:
   - Always use native `fetch` or `sadasend` with strict TypeScript types.
   - Enforce cryptographic idempotency keys on every outbound send (`Idempotency-Key: <uuid>`).
   - Wrap all API requests with explicit error handling for 403 (Allowlist Denied) and 429 (Rate Limited).

2. Security & Guardrails:
   - Never hardcode API keys or secret tokens. Access via `process.env.SADASEND_AGENT_KEY`.
   - Ensure all email tools validate recipient input with Zod or Pydantic before network dispatch.
   - Enforce the Human-in-the-Loop pattern: isolate drafting logic from execution logic.

3. Deliverability Compliance:
   - When generating marketing or digest emails, always include `List-Unsubscribe` and `List-Unsubscribe-Post` headers (RFC 8058).
   - Ensure multipart alternative plain-text bodies are generated alongside HTML bodies.

// Example type-safe tool generated by Cursor following the rules:
import { z } from 'zod';

export const SendEmailToolSchema = z.object({
  to: z.string().email(),
  subject: z.string().min(5).max(100),
  html: z.string().min(10),
  text: z.string().min(10),
});

export async function executeSendEmail(input: z.infer<typeof SendEmailToolSchema>) {
  const res = await fetch('https://api.sadasend.com/emails', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.SADASEND_AGENT_KEY}`,
      'Content-Type': 'application/json',
      'Idempotency-Key': crypto.randomUUID(),
    },
    body: JSON.stringify(input),
  });
  return res.json();
}