@lunora/mail 1.0.0-alpha.1 → 1.0.0-alpha.10

package/dist/inbound/index.d.mts

@@ -1,3 +1,5 @@
+import { D as DurableObjectJurisdiction, S as ShardNamespaceLike } from "../packem_shared/shard.d-CL2Lmliv.mjs";
+export type { a as ShardStubLike } from "../packem_shared/shard.d-CL2Lmliv.mjs";
 /** A raw RFC 822 message as accepted by the parser. */
 type RawInboundEmail = ArrayBuffer | ReadableStream<Uint8Array> | string | Uint8Array;
 /** One parsed attachment. `content` is preserved as the parser decoded it. */
@@ -68,28 +70,6 @@ interface InboundEmail {
 */
 declare const parseInboundEmail: (raw: RawInboundEmail) => Promise<InboundEmail>;
 /**
-* Structural projections of the `SHARD` Durable Object namespace + one shard
-* stub, shared by the inbound dispatcher. Mirrors the shapes the outbound dev
-* capture sink uses (`packages/mail/src/from-env.ts`) so inbound dispatch routes
-* a parsed message into a Lunora function over the exact same admin-RPC-over-shard
-* path — without importing any Cloudflare types into `@lunora/mail`.
-*/
-/** Structural projection of one shard stub — only `fetch` returning something with `.json()`. */
-interface ShardStubLike {
-  fetch: (input: string, init?: {
-    body?: string;
-    headers?: Record<string, string>;
-    method?: string;
-  }) => Promise<{
-    json: () => Promise<unknown>;
-  }>;
-}
-/** Structural projection of the `SHARD` Durable Object namespace. */
-interface ShardNamespaceLike {
-  get: (id: unknown) => ShardStubLike;
-  idFromName: (name: string) => unknown;
-}
-/**
 * Structural projection of Cloudflare's `ForwardableEmailMessage` (verified
 * against `@cloudflare/workers-types`' `ForwardableEmailMessage`). Only the
 * members the handler touches are modelled, so the host can pass the real
@@ -181,6 +161,12 @@ interface DispatchToLunoraFunctionOptions<TEnv = Record<string, unknown>> {
   /** `functionPath` of the target mutation/action (e.g. `"inbound:onEmail"`). */
   functionPath: string;
   /**
+  * Pin inbound dispatch to a Cloudflare data-residency jurisdiction. Pass the
+  * same value as the worker's `jurisdiction` so inbound mail routes to the
+  * jurisdiction-pinned shard. Omit for the un-pinned global namespace.
+  */
+  jurisdiction?: DurableObjectJurisdiction;
+  /**
   * Map the parsed message into the function's args. Defaults to passing the
   * whole {@link InboundEmail} with binary attachment `content` base64-encoded
   * (see {@link toJsonSafeEmail}) so it survives the JSON-serialised RPC body.
@@ -204,4 +190,4 @@ interface DispatchToLunoraFunctionOptions<TEnv = Record<string, unknown>> {
 * making any trust decision in the target function.
 */
 declare const dispatchToLunoraFunction: <TEnv extends Record<string, unknown> = Record<string, unknown>>(options: DispatchToLunoraFunctionOptions<TEnv>) => InboundDispatch<TEnv>;
-export { type DispatchToLunoraFunctionOptions, type ForwardableEmailMessageLike, type InboundAttachment, type InboundAuthentication, type InboundDispatch, type InboundDispatchContext, type InboundEmail, type InboundEmailHandler, type InboundEmailHandlerOptions, type InboundVerify, type RawInboundEmail, type RpcEnvelope, type ShardNamespaceLike, type ShardStubLike, createInboundEmailHandler, dispatchToLunoraFunction, parseInboundEmail };
+export { type DispatchToLunoraFunctionOptions, type ForwardableEmailMessageLike, type InboundAttachment, type InboundAuthentication, type InboundDispatch, type InboundDispatchContext, type InboundEmail, type InboundEmailHandler, type InboundEmailHandlerOptions, type InboundVerify, type RawInboundEmail, type RpcEnvelope, type ShardNamespaceLike, createInboundEmailHandler, dispatchToLunoraFunction, parseInboundEmail };

package/dist/inbound/index.d.ts

@@ -1,3 +1,5 @@
+import { D as DurableObjectJurisdiction, S as ShardNamespaceLike } from "../packem_shared/shard.d-CL2Lmliv.js";
+export type { a as ShardStubLike } from "../packem_shared/shard.d-CL2Lmliv.js";
 /** A raw RFC 822 message as accepted by the parser. */
 type RawInboundEmail = ArrayBuffer | ReadableStream<Uint8Array> | string | Uint8Array;
 /** One parsed attachment. `content` is preserved as the parser decoded it. */
@@ -68,28 +70,6 @@ interface InboundEmail {
 */
 declare const parseInboundEmail: (raw: RawInboundEmail) => Promise<InboundEmail>;
 /**
-* Structural projections of the `SHARD` Durable Object namespace + one shard
-* stub, shared by the inbound dispatcher. Mirrors the shapes the outbound dev
-* capture sink uses (`packages/mail/src/from-env.ts`) so inbound dispatch routes
-* a parsed message into a Lunora function over the exact same admin-RPC-over-shard
-* path — without importing any Cloudflare types into `@lunora/mail`.
-*/
-/** Structural projection of one shard stub — only `fetch` returning something with `.json()`. */
-interface ShardStubLike {
-  fetch: (input: string, init?: {
-    body?: string;
-    headers?: Record<string, string>;
-    method?: string;
-  }) => Promise<{
-    json: () => Promise<unknown>;
-  }>;
-}
-/** Structural projection of the `SHARD` Durable Object namespace. */
-interface ShardNamespaceLike {
-  get: (id: unknown) => ShardStubLike;
-  idFromName: (name: string) => unknown;
-}
-/**
 * Structural projection of Cloudflare's `ForwardableEmailMessage` (verified
 * against `@cloudflare/workers-types`' `ForwardableEmailMessage`). Only the
 * members the handler touches are modelled, so the host can pass the real
@@ -181,6 +161,12 @@ interface DispatchToLunoraFunctionOptions<TEnv = Record<string, unknown>> {
   /** `functionPath` of the target mutation/action (e.g. `"inbound:onEmail"`). */
   functionPath: string;
   /**
+  * Pin inbound dispatch to a Cloudflare data-residency jurisdiction. Pass the
+  * same value as the worker's `jurisdiction` so inbound mail routes to the
+  * jurisdiction-pinned shard. Omit for the un-pinned global namespace.
+  */
+  jurisdiction?: DurableObjectJurisdiction;
+  /**
   * Map the parsed message into the function's args. Defaults to passing the
   * whole {@link InboundEmail} with binary attachment `content` base64-encoded
   * (see {@link toJsonSafeEmail}) so it survives the JSON-serialised RPC body.
@@ -204,4 +190,4 @@ interface DispatchToLunoraFunctionOptions<TEnv = Record<string, unknown>> {
 * making any trust decision in the target function.
 */
 declare const dispatchToLunoraFunction: <TEnv extends Record<string, unknown> = Record<string, unknown>>(options: DispatchToLunoraFunctionOptions<TEnv>) => InboundDispatch<TEnv>;
-export { type DispatchToLunoraFunctionOptions, type ForwardableEmailMessageLike, type InboundAttachment, type InboundAuthentication, type InboundDispatch, type InboundDispatchContext, type InboundEmail, type InboundEmailHandler, type InboundEmailHandlerOptions, type InboundVerify, type RawInboundEmail, type RpcEnvelope, type ShardNamespaceLike, type ShardStubLike, createInboundEmailHandler, dispatchToLunoraFunction, parseInboundEmail };
+export { type DispatchToLunoraFunctionOptions, type ForwardableEmailMessageLike, type InboundAttachment, type InboundAuthentication, type InboundDispatch, type InboundDispatchContext, type InboundEmail, type InboundEmailHandler, type InboundEmailHandlerOptions, type InboundVerify, type RawInboundEmail, type RpcEnvelope, type ShardNamespaceLike, createInboundEmailHandler, dispatchToLunoraFunction, parseInboundEmail };

package/dist/inbound/index.mjs

@@ -1,2 +1,2 @@
-export { createInboundEmailHandler, dispatchToLunoraFunction } from '../packem_shared/createInboundEmailHandler-Cd8dyzB7.mjs';
-export { parseInboundEmail } from '../packem_shared/parseInboundEmail-Bw9u_1oc.mjs';
+export { createInboundEmailHandler, dispatchToLunoraFunction } from '../packem_shared/createInboundEmailHandler-BW_s0-Vc.mjs';
+export { parseInboundEmail } from '../packem_shared/parseInboundEmail-6lafQBT1.mjs';

package/dist/index.d.mts

@@ -1,5 +1,6 @@
 import { M as MailTransport, L as LunoraMailOptions, a as Mailer, b as MailboxSink, S as SendOptions } from "./packem_shared/capture-transport.d-ChnhdPO2.mjs";
 export { type C as CapturedMail, type Q as QueueLike, type c as SendPayload, d as createCaptureTransport } from "./packem_shared/capture-transport.d-ChnhdPO2.mjs";
+import { D as DurableObjectJurisdiction } from "./packem_shared/shard.d-CL2Lmliv.mjs";
 import { ReactElement } from 'react';
 /**
 * Sends a raw RFC 822 message through a Worker's Email send binding. The Workers
@@ -33,6 +34,23 @@ interface CloudflareTransportOptions {
 * verified-address constraint never bites the dev loop.
 */
 declare const createCloudflareTransport: (options: CloudflareTransportOptions) => MailTransport;
+/**
+* Create a mailer bound to a transport.
+*
+* SECURITY — recipient policy and HTML content are the caller's responsibility.
+* The mailer fully blocks header/CRLF/comma injection in addresses
+* (`assertSafeAddresses` / `assertSafeHeaderValue`), but it does NOT decide WHO
+* you may send to or WHAT HTML you render.
+*
+* Open relay: derive `to`/`cc`/`bcc` from server-trusted state, never from raw
+* request input, and prefer a fixed/allowlisted `from` — sending to an arbitrary
+* user-supplied address turns your deployment into a spam relay.
+*
+* Template XSS / content injection: treat template HTML like any other HTML sink
+* — never interpolate untrusted data into raw markup (or a
+* `dangerouslySetInnerHTML`-style template) without escaping. The mailer sends
+* whatever HTML you hand it verbatim.
+*/
 declare const createMailer: (options: LunoraMailOptions) => Mailer;
 /** A Worker `env` projected as a plain record (vars, secrets, and bindings are `unknown`-valued). */
 type MailEnv = Record<string, unknown>;
@@ -40,6 +58,12 @@ type MailEnv = Record<string, unknown>;
 interface FromEnvOptions {
   /** RFC 822 send callback bound to the Worker's `send_email` binding (Cloudflare default transport). */
   cloudflareSend?: CloudflareSend;
+  /**
+  * Pin the captured-mail inbox shard to a Cloudflare data-residency
+  * jurisdiction. Pass the same value as the worker's `jurisdiction` so the
+  * dev inbox co-resides with app data. Omit for the un-pinned global namespace.
+  */
+  jurisdiction?: DurableObjectJurisdiction;
   /** Shard the captured-mail inbox lives on; override if your worker sets a custom `defaultShardKey`. */
   rootShard?: string;
 }
@@ -58,7 +82,7 @@ declare const shouldCaptureMail: (env: MailEnv) => boolean;
 * the `SHARD` binding or `LUNORA_ADMIN_TOKEN` it returns a sentinel id so a send
 * never fails for lack of somewhere to record.
 */
-declare const createCaptureSink: (env: MailEnv, rootShard?: string) => MailboxSink;
+declare const createCaptureSink: (env: MailEnv, rootShard?: string, jurisdiction?: DurableObjectJurisdiction) => MailboxSink;
 /**
 * Build a {@link Mailer} from a Worker `env`. In a dev environment every send is
 * captured into the studio's Mail inbox; otherwise it delivers via the supplied

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 import { M as MailTransport, L as LunoraMailOptions, a as Mailer, b as MailboxSink, S as SendOptions } from "./packem_shared/capture-transport.d-ChnhdPO2.js";
 export { type C as CapturedMail, type Q as QueueLike, type c as SendPayload, d as createCaptureTransport } from "./packem_shared/capture-transport.d-ChnhdPO2.js";
+import { D as DurableObjectJurisdiction } from "./packem_shared/shard.d-CL2Lmliv.js";
 import { ReactElement } from 'react';
 /**
 * Sends a raw RFC 822 message through a Worker's Email send binding. The Workers
@@ -33,6 +34,23 @@ interface CloudflareTransportOptions {
 * verified-address constraint never bites the dev loop.
 */
 declare const createCloudflareTransport: (options: CloudflareTransportOptions) => MailTransport;
+/**
+* Create a mailer bound to a transport.
+*
+* SECURITY — recipient policy and HTML content are the caller's responsibility.
+* The mailer fully blocks header/CRLF/comma injection in addresses
+* (`assertSafeAddresses` / `assertSafeHeaderValue`), but it does NOT decide WHO
+* you may send to or WHAT HTML you render.
+*
+* Open relay: derive `to`/`cc`/`bcc` from server-trusted state, never from raw
+* request input, and prefer a fixed/allowlisted `from` — sending to an arbitrary
+* user-supplied address turns your deployment into a spam relay.
+*
+* Template XSS / content injection: treat template HTML like any other HTML sink
+* — never interpolate untrusted data into raw markup (or a
+* `dangerouslySetInnerHTML`-style template) without escaping. The mailer sends
+* whatever HTML you hand it verbatim.
+*/
 declare const createMailer: (options: LunoraMailOptions) => Mailer;
 /** A Worker `env` projected as a plain record (vars, secrets, and bindings are `unknown`-valued). */
 type MailEnv = Record<string, unknown>;
@@ -40,6 +58,12 @@ type MailEnv = Record<string, unknown>;
 interface FromEnvOptions {
   /** RFC 822 send callback bound to the Worker's `send_email` binding (Cloudflare default transport). */
   cloudflareSend?: CloudflareSend;
+  /**
+  * Pin the captured-mail inbox shard to a Cloudflare data-residency
+  * jurisdiction. Pass the same value as the worker's `jurisdiction` so the
+  * dev inbox co-resides with app data. Omit for the un-pinned global namespace.
+  */
+  jurisdiction?: DurableObjectJurisdiction;
   /** Shard the captured-mail inbox lives on; override if your worker sets a custom `defaultShardKey`. */
   rootShard?: string;
 }
@@ -58,7 +82,7 @@ declare const shouldCaptureMail: (env: MailEnv) => boolean;
 * the `SHARD` binding or `LUNORA_ADMIN_TOKEN` it returns a sentinel id so a send
 * never fails for lack of somewhere to record.
 */
-declare const createCaptureSink: (env: MailEnv, rootShard?: string) => MailboxSink;
+declare const createCaptureSink: (env: MailEnv, rootShard?: string, jurisdiction?: DurableObjectJurisdiction) => MailboxSink;
 /**
 * Build a {@link Mailer} from a Worker `env`. In a dev environment every send is
 * captured into the studio's Mail inbox; otherwise it delivers via the supplied

package/dist/index.mjs

@@ -1,7 +1,7 @@
 export { createCaptureTransport } from './packem_shared/createCaptureTransport-Crz_8822.mjs';
-export { createCloudflareTransport } from './packem_shared/createCloudflareTransport-yHOVEsZv.mjs';
-export { default as createMailer } from './packem_shared/createMailer-CMVVTp0F.mjs';
-export { createCaptureSink, createMailerFromEnv, shouldCaptureMail } from './packem_shared/createCaptureSink-CNhqLMZ1.mjs';
-export { consumeQueuedSend, toQueuedPayload } from './packem_shared/toQueuedPayload-BEKOdaxU.mjs';
+export { createCloudflareTransport } from './packem_shared/createCloudflareTransport-DXh1nUNi.mjs';
+export { default as createMailer } from './packem_shared/createMailer-B4Z_Cgiu.mjs';
+export { createCaptureSink, createMailerFromEnv, shouldCaptureMail } from './packem_shared/createCaptureSink-Di-5AJUs.mjs';
+export { consumeQueuedSend, toQueuedPayload } from './packem_shared/consumeQueuedSend-B9hTDOZ6.mjs';
 export { default as renderEmail } from './packem_shared/renderEmail-hyS1bpVP.mjs';
-export { default as createResendTransport } from './packem_shared/createResendTransport-oNIorpzv.mjs';
+export { default as createResendTransport } from './packem_shared/createResendTransport-CMQWjZoi.mjs';

package/dist/packem_shared/{address-fkXxLKza.mjs → address-vSUAVU2T.mjs}

@@ -1,22 +1,24 @@
+import { LunoraError } from '@lunora/errors';
+
 const MAX_EMAIL_LENGTH = 320;
 const MAX_NAME_LENGTH = 256;
 const ADDRESS_PATTERN = /^([^<]*)<([^>]*)>\s*$/;
 const assertSafeAddressField = (field, value) => {
   if (value.includes("\r") || value.includes("\n") || value.includes(",")) {
-    throw new Error(`@lunora/mail: address ${field} must not contain CR, LF, or comma`);
+    throw new LunoraError("INTERNAL", `@lunora/mail: address ${field} must not contain CR, LF, or comma`);
   }
 };
 const assertSafeHeaderValue = (label, value) => {
   if (value.includes("\r") || value.includes("\n")) {
-    throw new Error(`@lunora/mail: ${label} must not contain CR or LF`);
+    throw new LunoraError("INTERNAL", `@lunora/mail: ${label} must not contain CR or LF`);
   }
 };
 const toBracketedAddress = (name, email) => {
   if (name.length > MAX_NAME_LENGTH) {
-    throw new Error(`@lunora/mail: address name must be <= ${String(MAX_NAME_LENGTH)} characters`);
+    throw new LunoraError("INTERNAL", `@lunora/mail: address name must be <= ${String(MAX_NAME_LENGTH)} characters`);
   }
   if (email.length > MAX_EMAIL_LENGTH) {
-    throw new Error(`@lunora/mail: address email must be <= ${String(MAX_EMAIL_LENGTH)} characters`);
+    throw new LunoraError("INTERNAL", `@lunora/mail: address email must be <= ${String(MAX_EMAIL_LENGTH)} characters`);
   }
   if (name) {
     assertSafeAddressField("name", name);
@@ -27,7 +29,7 @@ const toBracketedAddress = (name, email) => {
 const toBareAddress = (input) => {
   const email = input.trim();
   if (email.length > MAX_EMAIL_LENGTH) {
-    throw new Error(`@lunora/mail: address email must be <= ${String(MAX_EMAIL_LENGTH)} characters`);
+    throw new LunoraError("INTERNAL", `@lunora/mail: address email must be <= ${String(MAX_EMAIL_LENGTH)} characters`);
   }
   assertSafeAddressField("email", email);
   return { email };

package/dist/packem_shared/{toQueuedPayload-BEKOdaxU.mjs → consumeQueuedSend-B9hTDOZ6.mjs}

@@ -1,3 +1,5 @@
+import { LunoraError } from '@lunora/errors';
+
 const toQueuedPayload = (options) => {
   return {
     bcc: options.bcc,
@@ -13,7 +15,7 @@ const toQueuedPayload = (options) => {
 };
 const consumeQueuedSend = async (mailer, payload) => {
   if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-    throw new Error("@lunora/mail: queue message body must be an object");
+    throw new LunoraError("INTERNAL", "@lunora/mail: queue message body must be an object");
   }
   const candidate = payload;
   if (typeof candidate.subject !== "string") {
@@ -22,7 +24,7 @@ const consumeQueuedSend = async (mailer, payload) => {
   const recipientIsString = typeof candidate.to === "string";
   const recipientIsStringArray = Array.isArray(candidate.to) && candidate.to.every((value) => typeof value === "string");
   if (!recipientIsString && !recipientIsStringArray) {
-    throw new Error("@lunora/mail: queue message `to` must be a string or string[]");
+    throw new LunoraError("INTERNAL", "@lunora/mail: queue message `to` must be a string or string[]");
   }
   const assertOptionalString = (field, value) => {
     if (value === void 0) {

package/dist/packem_shared/{createCaptureSink-CNhqLMZ1.mjs → createCaptureSink-Di-5AJUs.mjs}

@@ -1,5 +1,7 @@
+import { LunoraError } from '@lunora/errors';
 import { createCaptureTransport } from './createCaptureTransport-Crz_8822.mjs';
-import createMailer from './createMailer-CMVVTp0F.mjs';
+import createMailer from './createMailer-B4Z_Cgiu.mjs';
+import { a as applyJurisdiction } from './shard-CJ-TvmfT.mjs';
 
 const RECORD_MAIL_OP = "__lunora_admin__:recordMail";
 const DEFAULT_ROOT_SHARD = "__root__";
@@ -8,7 +10,7 @@ const ENVIRONMENT_VARS = ["CF_ENV", "ENVIRONMENT", "NODE_ENV", "WORKER_ENV"];
 const requireStringEnv = (env, name) => {
   const value = env[name];
   if (typeof value !== "string" || value === "") {
-    throw new Error(`@lunora/mail: missing env var \`${name}\` — set it in .dev.vars (and \`wrangler secret put ${name}\` for secrets).`);
+    throw new LunoraError("INTERNAL", `@lunora/mail: missing env var \`${name}\` — set it in .dev.vars (and \`wrangler secret put ${name}\` for secrets).`);
   }
   return value;
 };
@@ -22,14 +24,15 @@ const shouldCaptureMail = (env) => {
     return typeof value === "string" && DEV_ENVIRONMENT_PATTERN.test(value);
   });
 };
-const createCaptureSink = (env, rootShard = DEFAULT_ROOT_SHARD) => {
+const createCaptureSink = (env, rootShard = DEFAULT_ROOT_SHARD, jurisdiction) => {
   return {
     record: async (mail) => {
-      const namespace = env["SHARD"];
+      const binding = env["SHARD"];
       const adminToken = typeof env["LUNORA_ADMIN_TOKEN"] === "string" ? env["LUNORA_ADMIN_TOKEN"] : void 0;
-      if (namespace === void 0 || adminToken === void 0) {
+      if (binding === void 0 || adminToken === void 0) {
         return { id: "uncaptured" };
       }
+      const namespace = applyJurisdiction(binding, jurisdiction);
       const stub = namespace.get(namespace.idFromName(rootShard));
       const response = await stub.fetch("https://shard.internal/rpc", {
         body: JSON.stringify({ args: mail, functionPath: RECORD_MAIL_OP }),
@@ -44,7 +47,7 @@ const createCaptureSink = (env, rootShard = DEFAULT_ROOT_SHARD) => {
 const createMailerFromEnv = (env, options = {}) => {
   const from = requireStringEnv(env, "MAIL_FROM");
   if (shouldCaptureMail(env)) {
-    return createMailer({ from, transport: createCaptureTransport(createCaptureSink(env, options.rootShard)) });
+    return createMailer({ from, transport: createCaptureTransport(createCaptureSink(env, options.rootShard, options.jurisdiction)) });
   }
   if (options.cloudflareSend) {
     return createMailer({ cloudflareSend: options.cloudflareSend, from });
@@ -53,7 +56,8 @@ const createMailerFromEnv = (env, options = {}) => {
   if (apiKey !== void 0 && apiKey !== "") {
     return createMailer({ apiKey, from });
   }
-  throw new Error(
+  throw new LunoraError(
+    "INTERNAL",
     "@lunora/mail: no transport configured — provide `cloudflareSend` (a SEND_EMAIL binding) or RESEND_API_KEY, or run in a dev environment to capture."
   );
 };

package/dist/packem_shared/{createCloudflareTransport-yHOVEsZv.mjs → createCloudflareTransport-DXh1nUNi.mjs}

@@ -1,5 +1,6 @@
+import { LunoraError } from '@lunora/errors';
 import { cloudflareEmailProvider } from '@visulima/email/providers/cloudflare-email';
-import { r as requireRecipients, t as toProviderEmail, i as interpretSendResult } from './provider-transport-C5CVbjRF.mjs';
+import { r as requireRecipients, t as toProviderEmail, i as interpretSendResult } from './provider-transport-C0xHi3oy.mjs';
 
 const createCloudflareTransport = (options) => {
   const provider = cloudflareEmailProvider({ send: options.send });
@@ -9,11 +10,12 @@ const createCloudflareTransport = (options) => {
       const hasCc = payload.cc !== void 0 && payload.cc.length > 0;
       const hasBcc = payload.bcc !== void 0 && payload.bcc.length > 0;
       if (hasCc || hasBcc) {
-        throw new Error("@lunora/mail: Cloudflare Email Workers does not support cc/bcc — fan out one send per recipient instead");
+        throw new LunoraError("INTERNAL", "@lunora/mail: Cloudflare Email Workers does not support cc/bcc — fan out one send per recipient instead");
       }
       const { first, list } = requireRecipients(payload.to);
       if (list.length > 1) {
-        throw new Error(
+        throw new LunoraError(
+          "INTERNAL",
           `@lunora/mail: Cloudflare Email Workers is single-recipient but received ${String(list.length)} \`to\` addresses — fan out one send per recipient instead`
         );
       }

package/dist/packem_shared/{createInboundEmailHandler-Cd8dyzB7.mjs → createInboundEmailHandler-BW_s0-Vc.mjs}

@@ -1,3 +1,6 @@
+import { LunoraError } from '@lunora/errors';
+import { a as applyJurisdiction } from './shard-CJ-TvmfT.mjs';
+
 const GENERIC_REJECT_REASON = "message could not be processed";
 const rejectOnError = (error, context) => {
   console.error("@lunora/mail/inbound: dropping message —", error);
@@ -12,7 +15,7 @@ const createInboundEmailHandler = (options) => {
       if (options.verify) {
         const verified = await options.verify(parsed, context);
         if (verified === false) {
-          throw new Error("@lunora/mail/inbound: sender verification rejected the message");
+          throw new LunoraError("INTERNAL", "@lunora/mail/inbound: sender verification rejected the message");
         }
       }
       await options.dispatch(parsed, context);
@@ -51,27 +54,28 @@ const dispatchToLunoraFunction = (options) => {
   return async (email, context) => {
     const adminToken = options.adminToken ?? (typeof context.env["LUNORA_ADMIN_TOKEN"] === "string" ? context.env["LUNORA_ADMIN_TOKEN"] : void 0);
     if (adminToken === void 0 || adminToken === "") {
-      throw new Error("@lunora/mail/inbound: missing LUNORA_ADMIN_TOKEN — cannot authorize inbound dispatch to the shard RPC.");
+      throw new LunoraError("INTERNAL", "@lunora/mail/inbound: missing LUNORA_ADMIN_TOKEN — cannot authorize inbound dispatch to the shard RPC.");
     }
     const envelope = {
       args: resolveArgs(email, context),
       functionPath: options.functionPath,
       shardKey
     };
-    const stub = options.shard.get(options.shard.idFromName(shardKey));
+    const namespace = applyJurisdiction(options.shard, options.jurisdiction);
+    const stub = namespace.get(namespace.idFromName(shardKey));
     const response = await stub.fetch("https://shard.internal/rpc", {
       body: JSON.stringify(envelope),
       headers: { authorization: `Bearer ${adminToken}`, "content-type": "application/json" },
       method: "POST"
     });
     if (response.ok === false) {
-      throw new Error(`@lunora/mail/inbound: dispatch to \`${options.functionPath}\` failed (HTTP ${String(response.status ?? "?")}).`);
+      throw new LunoraError("INTERNAL", `@lunora/mail/inbound: dispatch to \`${options.functionPath}\` failed (HTTP ${String(response.status ?? "?")}).`);
     }
     const body = await response.json();
     if (typeof body === "object" && body !== null && "error" in body) {
       const { error } = body;
       if (error !== void 0 && error !== null) {
-        throw new Error(`@lunora/mail/inbound: dispatch to \`${options.functionPath}\` returned an error: ${JSON.stringify(error)}`);
+        throw new LunoraError("INTERNAL", `@lunora/mail/inbound: dispatch to \`${options.functionPath}\` returned an error: ${JSON.stringify(error)}`);
       }
     }
   };

package/dist/packem_shared/{createMailer-CMVVTp0F.mjs → createMailer-B4Z_Cgiu.mjs}

@@ -1,9 +1,10 @@
-import { a as assertSafeHeaderValue, b as assertSafeAddresses } from './address-fkXxLKza.mjs';
+import { LunoraError } from '@lunora/errors';
+import { a as assertSafeHeaderValue, b as assertSafeAddresses } from './address-vSUAVU2T.mjs';
 import { isCaptureTransport } from './createCaptureTransport-Crz_8822.mjs';
-import { createCloudflareTransport } from './createCloudflareTransport-yHOVEsZv.mjs';
-import { toQueuedPayload } from './toQueuedPayload-BEKOdaxU.mjs';
+import { createCloudflareTransport } from './createCloudflareTransport-DXh1nUNi.mjs';
+import { toQueuedPayload } from './consumeQueuedSend-B9hTDOZ6.mjs';
 import renderEmail from './renderEmail-hyS1bpVP.mjs';
-import createResendTransport from './createResendTransport-oNIorpzv.mjs';
+import createResendTransport from './createResendTransport-CMQWjZoi.mjs';
 
 const buildDefaultTransport = (options) => {
   if (options.cloudflareSend) {
@@ -12,11 +13,14 @@ const buildDefaultTransport = (options) => {
   if (options.apiKey) {
     return createResendTransport(options.apiKey, options.from);
   }
-  throw new Error("@lunora/mail: a transport is required — pass `transport`, `cloudflareSend` (Cloudflare Email Workers, the default), or `apiKey` (Resend)");
+  throw new LunoraError(
+    "INTERNAL",
+    "@lunora/mail: a transport is required — pass `transport`, `cloudflareSend` (Cloudflare Email Workers, the default), or `apiKey` (Resend)"
+  );
 };
 const createMailer = (options) => {
   if (!options.from) {
-    throw new Error("@lunora/mail: `from` is required");
+    throw new LunoraError("INTERNAL", "@lunora/mail: `from` is required");
   }
   const transport = options.transport ?? buildDefaultTransport(options);
   const buildPayload = async (options_) => {
@@ -65,7 +69,7 @@ const createMailer = (options) => {
         await transport.send(captured);
         return { queued: true };
       }
-      throw new Error("@lunora/mail: `queue` binding is required for mailer.queue()");
+      throw new LunoraError("INTERNAL", "@lunora/mail: `queue` binding is required for mailer.queue()");
     }
     const payload = await buildPayload(options_);
     await options.queue.send(toQueuedPayload(payload));

package/dist/packem_shared/{createResendTransport-oNIorpzv.mjs → createResendTransport-CMQWjZoi.mjs}

@@ -1,5 +1,5 @@
 import { resendProvider } from '@visulima/email/providers/resend';
-import { r as requireRecipients, t as toProviderEmail, i as interpretSendResult } from './provider-transport-C5CVbjRF.mjs';
+import { r as requireRecipients, t as toProviderEmail, i as interpretSendResult } from './provider-transport-C0xHi3oy.mjs';
 
 const createResendTransport = (apiKey, defaultFrom) => {
   const provider = resendProvider({ apiKey });

package/dist/packem_shared/{parseInboundEmail-Bw9u_1oc.mjs → parseInboundEmail-6lafQBT1.mjs}

@@ -1,5 +1,5 @@
 import PostalMime from 'postal-mime';
-import { a as assertSafeHeaderValue } from './address-fkXxLKza.mjs';
+import { a as assertSafeHeaderValue } from './address-vSUAVU2T.mjs';
 
 const safe = (label, value) => {
   if (value === void 0) {

package/dist/packem_shared/{provider-transport-C5CVbjRF.mjs → provider-transport-C0xHi3oy.mjs}

@@ -1,4 +1,5 @@
-import { t as toAddressList, c as toAddress } from './address-fkXxLKza.mjs';
+import { LunoraError } from '@lunora/errors';
+import { t as toAddressList, c as toAddress } from './address-vSUAVU2T.mjs';
 
 const reasonOf = (rawError) => {
   if (rawError instanceof Error) {
@@ -19,7 +20,7 @@ const requireRecipients = (to) => {
   const list = toAddressList(to);
   const [first] = list ?? [];
   if (!list || first === void 0) {
-    throw new Error("@lunora/mail: at least one recipient is required");
+    throw new LunoraError("INTERNAL", "@lunora/mail: at least one recipient is required");
   }
   return { first, list };
 };
@@ -39,7 +40,7 @@ const toProviderEmail = (payload, defaultFrom, to) => {
 const interpretSendResult = (result) => {
   if (!result.success || !result.data) {
     console.error(`@lunora/mail: send failed: ${reasonOf(result.error)}`);
-    throw new Error("@lunora/mail: send failed");
+    throw new LunoraError("INTERNAL", "@lunora/mail: send failed");
   }
   return { id: result.data.messageId };
 };

package/dist/packem_shared/shard-CJ-TvmfT.mjs

@@ -0,0 +1,13 @@
+const applyJurisdiction = (namespace, jurisdiction) => {
+  if (jurisdiction === void 0) {
+    return namespace;
+  }
+  if (typeof namespace.jurisdiction !== "function") {
+    throw new TypeError(
+      `@lunora/mail: Durable Object namespace does not support jurisdiction("${jurisdiction}") — update @cloudflare/workers-types or remove the jurisdiction option`
+    );
+  }
+  return namespace.jurisdiction(jurisdiction);
+};
+
+export { applyJurisdiction as a };

package/dist/packem_shared/shard.d-CL2Lmliv.d.mts

@@ -0,0 +1,39 @@
+/**
+* Structural projections of the `SHARD` Durable Object namespace + one shard
+* stub, shared by the inbound dispatcher. Mirrors the shapes the outbound dev
+* capture sink uses (`packages/mail/src/from-env.ts`) so inbound dispatch routes
+* a parsed message into a Lunora function over the exact same admin-RPC-over-shard
+* path — without importing any Cloudflare types into `@lunora/mail`.
+*/
+/** Structural projection of one shard stub — only `fetch` returning something with `.json()`. */
+interface ShardStubLike {
+  fetch: (input: string, init?: {
+    body?: string;
+    headers?: Record<string, string>;
+    method?: string;
+  }) => Promise<{
+    json: () => Promise<unknown>;
+  }>;
+}
+/**
+* Cloudflare Durable Object data-residency jurisdiction. Widening union —
+* Cloudflare adds values over time.
+* @see https://developers.cloudflare.com/durable-objects/reference/data-location/
+*/
+type DurableObjectJurisdiction = "eu" | "fedramp" | "us";
+/** Structural projection of the `SHARD` Durable Object namespace. */
+interface ShardNamespaceLike {
+  get: (id: unknown) => ShardStubLike;
+  idFromName: (name: string) => unknown;
+  /**
+  * Derive a jurisdiction-restricted subnamespace. Optional because older
+  * workers-types releases (and test doubles) may not expose it.
+  */
+  jurisdiction?: (jurisdiction: DurableObjectJurisdiction) => ShardNamespaceLike;
+}
+/**
+* Return a jurisdiction-restricted view of `namespace`, or `namespace`
+* unchanged when no jurisdiction is configured. Fail-closed when the binding
+* lacks `.jurisdiction()` so a residency constraint is never silently dropped.
+*/
+export { DurableObjectJurisdiction as D, ShardNamespaceLike as S, ShardStubLike as a };

package/dist/packem_shared/shard.d-CL2Lmliv.d.ts

@@ -0,0 +1,39 @@
+/**
+* Structural projections of the `SHARD` Durable Object namespace + one shard
+* stub, shared by the inbound dispatcher. Mirrors the shapes the outbound dev
+* capture sink uses (`packages/mail/src/from-env.ts`) so inbound dispatch routes
+* a parsed message into a Lunora function over the exact same admin-RPC-over-shard
+* path — without importing any Cloudflare types into `@lunora/mail`.
+*/
+/** Structural projection of one shard stub — only `fetch` returning something with `.json()`. */
+interface ShardStubLike {
+  fetch: (input: string, init?: {
+    body?: string;
+    headers?: Record<string, string>;
+    method?: string;
+  }) => Promise<{
+    json: () => Promise<unknown>;
+  }>;
+}
+/**
+* Cloudflare Durable Object data-residency jurisdiction. Widening union —
+* Cloudflare adds values over time.
+* @see https://developers.cloudflare.com/durable-objects/reference/data-location/
+*/
+type DurableObjectJurisdiction = "eu" | "fedramp" | "us";
+/** Structural projection of the `SHARD` Durable Object namespace. */
+interface ShardNamespaceLike {
+  get: (id: unknown) => ShardStubLike;
+  idFromName: (name: string) => unknown;
+  /**
+  * Derive a jurisdiction-restricted subnamespace. Optional because older
+  * workers-types releases (and test doubles) may not expose it.
+  */
+  jurisdiction?: (jurisdiction: DurableObjectJurisdiction) => ShardNamespaceLike;
+}
+/**
+* Return a jurisdiction-restricted view of `namespace`, or `namespace`
+* unchanged when no jurisdiction is configured. Fail-closed when the binding
+* lacks `.jurisdiction()` so a residency constraint is never silently dropped.
+*/
+export { DurableObjectJurisdiction as D, ShardNamespaceLike as S, ShardStubLike as a };

package/dist/testing.mjs

@@ -1,3 +1,5 @@
+import { LunoraError } from '@lunora/errors';
+
 const GET_CAPTURED_MAIL_OP = "__lunora_admin__:getCapturedMail";
 const DEFAULT_RPC_PATH = "/_lunora/rpc";
 const TRAILING_SLASH = /\/$/;
@@ -14,7 +16,7 @@ const listCapturedMail = async (options) => {
     method: "POST"
   });
   if (!response.ok) {
-    throw new Error(`@lunora/mail/testing: getCapturedMail failed (HTTP ${String(response.status)})`);
+    throw new LunoraError("INTERNAL", `@lunora/mail/testing: getCapturedMail failed (HTTP ${String(response.status)})`);
   }
   const body = await response.json();
   return body.result?.entries ?? [];
@@ -32,7 +34,8 @@ const waitForMail = async (options) => {
       return match;
     }
     if (Date.now() >= deadline) {
-      throw new Error(
+      throw new LunoraError(
+        "INTERNAL",
         `@lunora/mail/testing: no mail to "${options.to}"${options.subjectMatch === void 0 ? "" : ` matching "${options.subjectMatch}"`} within ${String(timeoutMs)}ms`
       );
     }
@@ -51,7 +54,10 @@ const extractLink = (mail, options = {}) => {
       return link;
     }
   }
-  throw new Error(`@lunora/mail/testing: no link${options.match === void 0 ? "" : ` containing "${options.match}"`} found in the captured message`);
+  throw new LunoraError(
+    "INTERNAL",
+    `@lunora/mail/testing: no link${options.match === void 0 ? "" : ` containing "${options.match}"`} found in the captured message`
+  );
 };
 
 export { extractLink, listCapturedMail, waitForMail };