TL;DR: Put the email provider at the send boundary. A Node.js marketplace service should own reset tokens, expiry, account policy, and suppression decisions; the provider should own template rendering and delivery attempts. Choose the option that leaves evidence for which recipient was sent, which one bounced, and why the next attempt was blocked.

A password-reset message is small but operationally sharp. A bad link locks out a seller. A retry to a hard-bounced address turns one dirty record into a reputation problem. At 3am, I do not want a green dashboard; I want to know which page fired and whether the audit trail supports the decision.

What should the boundary prove?

The boundary should prove three things: a known template was selected, a send attempt was made, and later bounce or suppression evidence changed recipient state without re-enabling the address accidentally. Keep token generation, single-use enforcement, expiry, and account policy in the application.…