@lunora/mail 1.0.0-alpha.1 → 1.0.0-alpha.100

package/dist/inbound/index.d.ts

@@ -1,3 +1,5 @@
+import { D as DurableObjectJurisdiction, S as ShardNamespaceLike } from "../packem_shared/shard.d-DVADjmEJ.js";
+export type { a as ShardStubLike } from "../packem_shared/shard.d-DVADjmEJ.js";
 /** A raw RFC 822 message as accepted by the parser. */
 type RawInboundEmail = ArrayBuffer | ReadableStream<Uint8Array> | string | Uint8Array;
 /** One parsed attachment. `content` is preserved as the parser decoded it. */
@@ -13,34 +15,79 @@ interface InboundAttachment {
   /** Declared MIME type (e.g. `image/png`). */
   mimeType: string;
 }
+/** One reported `method=result [ptype.property=value]` clause of an `Authentication-Results` header. */
+interface InboundAuthResult {
+  /**
+   * The identifier the result is about, lowercased — DKIM's signing domain
+   * (`header.d=`), SPF's envelope `MAIL FROM` domain (`smtp.mailfrom=`, local
+   * part dropped) or DMARC's `header.from=`. `null` when the clause reported
+   * none, in which case it cannot be aligned and vouches for nothing.
+   */
+  domain: string | null;
+  /** The result token, lowercased (`"pass"`, `"fail"`, `"none"`, …). */
+  result: string;
+}
 /**
-* Sender-authentication verdicts pulled from the `Authentication-Results` header
-* the receiving MX (e.g. Cloudflare Email Routing) stamped on the message.
-*
-* SECURITY: Cloudflare Email Routing authenticates only the *recipient* domain,
-* **not** the sender. The envelope `from` and message content are trivially
-* spoofable, so a downstream handler MUST NOT make trust/authorization decisions
-* on `email.from` alone — gate on these verdicts (or your own policy) instead.
-* Verdicts are best-effort: when the receiving MX did not stamp an
-* `Authentication-Results` header, every field is `null` ("unknown").
-*/
+ * Sender-authentication verdicts pulled from the `Authentication-Results` header
+ * the receiving MX (e.g. Cloudflare Email Routing) stamped on the message.
+ *
+ * SECURITY: Cloudflare Email Routing authenticates only the *recipient* domain,
+ * **not** the sender. The envelope `from` and message content are trivially
+ * spoofable, so a downstream handler MUST NOT make trust/authorization decisions
+ * on `email.from` alone — gate on these verdicts (or your own policy) instead.
+ * Verdicts are best-effort: when the receiving MX did not stamp an
+ * `Authentication-Results` header, every list is empty ("unknown").
+ *
+ * Each method holds a LIST, because RFC 8601 lets one header report the same
+ * method more than once and real mail does. An ESP-relayed message carries two
+ * DKIM signatures — the relay's and the author domain's — and the MX stamps a
+ * clause per signature in whatever order it verified them. Keeping only the
+ * first threw the aligned one away whenever it was not the one that happened to
+ * come first, and the message was rejected as unauthenticated. A consumer
+ * therefore asks "does ANY reported clause pass and align?", not "did the first
+ * one?".
+ *
+ * SECURITY: a bare `"pass"` is NOT proof the `From` header is genuine. SPF
+ * authenticates the envelope `MAIL FROM` domain and DKIM the signing domain
+ * (`d=`), and an attacker controls both — `spf=pass smtp.mailfrom=evil.example;
+ * dkim=pass header.d=evil.example` is routine for a message whose `From` says
+ * `ceo@victim.example`. Each verdict therefore carries the identifier it is
+ * about ({@link InboundAuthResult.domain}): an SPF or DKIM pass only vouches for
+ * `from` when that domain equals the `From` address's domain (RFC 7489 strict
+ * alignment). Only a DMARC pass already checked alignment for you. A pass with
+ * no identifier reported cannot be aligned and must be treated as
+ * unauthenticated.
+ *
+ * SECURITY: verdicts are read from the **first/topmost** `Authentication-Results`
+ * header in document order. The receiving MX prepends its own genuine header per
+ * RFC 8601, so the topmost occurrence is the trustworthy one; any lower
+ * occurrences (which an untrusted sender can inject into the raw message) are
+ * ignored. As defense-in-depth a consumer may additionally verify the topmost
+ * header's `authserv-id` matches its receiving MX (e.g. Cloudflare) — that needs
+ * config this runtime-agnostic parser does not carry, so it is left to the host.
+ */
 interface InboundAuthentication {
-  /** DKIM verdict (`"pass"`/`"fail"`/…), or `null` when not reported. */
-  dkim: string | null;
-  /** DMARC verdict (`"pass"`/`"fail"`/…), or `null` when not reported. */
-  dmarc: string | null;
-  /** SPF verdict (`"pass"`/`"fail"`/…), or `null` when not reported. */
-  spf: string | null;
+  /** Every DKIM clause the header reported, in header order; empty when the method was not reported. */
+  dkim: InboundAuthResult[];
+  /** Every DMARC clause the header reported, in header order; empty when the method was not reported. */
+  dmarc: InboundAuthResult[];
+  /** Every SPF clause the header reported, in header order; empty when the method was not reported. */
+  spf: InboundAuthResult[];
 }
 /** Normalised, transport-agnostic view of a received message. */
 interface InboundEmail {
   /** Decoded attachments (empty array when none). */
   attachments: InboundAttachment[];
   /**
-  * Sender-authentication verdicts (DKIM/SPF/DMARC) parsed from the receiving
-  * MX's `Authentication-Results` header. SECURITY: see {@link InboundAuthentication}
-  * — `from` is spoofable; gate trust on these verdicts, not on `from`.
-  */
+   * Sender-authentication verdicts (DKIM/SPF/DMARC) and the domain each is
+   * about, parsed from the receiving MX's **first/topmost**
+   * `Authentication-Results` header. SECURITY: see
+   * {@link InboundAuthentication} — `from` is spoofable, and an SPF/DKIM pass
+   * vouches for it only when that clause's `domain` equals the `From` domain (a
+   * DMARC pass checked that already). Reading the raw `headers["authentication-results"]`
+   * map instead exposes last-wins (a lower, potentially attacker-injected)
+   * value — trust `authentication`, not the raw map.
+   */
   authentication: InboundAuthentication;
   /** Sender mailbox (`from`), CR/LF-checked. Empty string when the message omitted it. SECURITY: spoofable — do not trust for authorization. */
   from: string;
@@ -62,39 +109,48 @@ interface InboundEmail {
   to: string[];
 }
 /**
-* Parse a raw RFC 822 message into a normalised {@link InboundEmail}. Accepts the
-* shapes a Cloudflare Email Worker can hand off — `ReadableStream`, `ArrayBuffer`,
-* `Uint8Array`, or a decoded string.
-*/
+ * Parse a raw RFC 822 message into a normalised {@link InboundEmail}. Accepts the
+ * shapes a Cloudflare Email Worker can hand off — `ReadableStream`, `ArrayBuffer`,
+ * `Uint8Array`, or a decoded string.
+ */
 declare const parseInboundEmail: (raw: RawInboundEmail) => Promise<InboundEmail>;
 /**
-* Structural projections of the `SHARD` Durable Object namespace + one shard
-* stub, shared by the inbound dispatcher. Mirrors the shapes the outbound dev
-* capture sink uses (`packages/mail/src/from-env.ts`) so inbound dispatch routes
-* a parsed message into a Lunora function over the exact same admin-RPC-over-shard
-* path — without importing any Cloudflare types into `@lunora/mail`.
-*/
-/** Structural projection of one shard stub — only `fetch` returning something with `.json()`. */
-interface ShardStubLike {
-  fetch: (input: string, init?: {
-    body?: string;
-    headers?: Record<string, string>;
-    method?: string;
-  }) => Promise<{
-    json: () => Promise<unknown>;
-  }>;
-}
-/** Structural projection of the `SHARD` Durable Object namespace. */
-interface ShardNamespaceLike {
-  get: (id: unknown) => ShardStubLike;
-  idFromName: (name: string) => unknown;
-}
+ * THE inbound sender-authentication gate: does the receiving MX vouch for this
+ * message's `From` domain? Pass it as the `verify` hook of
+ * `createInboundEmailHandler` (or call it from your own) — it is one exported
+ * helper precisely so the insecure variants cannot be hand-rolled again.
+ *
+ * True when ANY reported DMARC, SPF or DKIM clause both **passes** and names a
+ * `domain` equal to the `From` address's domain. False otherwise — including for
+ * an empty verdict list (the MX stamped no `Authentication-Results` header at
+ * all, which is "unknown", not "fine") and for a `From` with no single mailbox
+ * to align against.
+ *
+ * SECURITY — the two halves are each load-bearing.
+ *
+ * **Alignment.** A bare `pass` proves nothing about `From`. SPF authenticates the
+ * envelope `MAIL FROM` domain and DKIM the signing `d=`, both attacker-chosen, so
+ * `spf=pass`+`dkim=pass` for `evil.example` is routine on a message whose `From`
+ * says `ceo@victim.example`. Only a clause whose own `domain` equals the `From`
+ * domain vouches for it. Alignment is STRICT (RFC 7489): there is no
+ * public-suffix list here, so `mail.example.com` does not vouch for
+ * `example.com`. A pass reporting no domain (`null`) cannot be aligned and is
+ * rejected. A DMARC pass already checked alignment at the MX.
+ *
+ * **Every clause, not the first.** One header legitimately reports a method more
+ * than once (an ESP-relayed message is DKIM-signed by both the relay and the
+ * author domain), and the aligned clause is not reliably the first, so reading
+ * only the first bounced fully authenticated mail. "Any clause passes AND aligns"
+ * stays strictly narrower than a bare pass: a clause vouching for some other
+ * domain contributes nothing.
+ */
+declare const authenticatesFrom: (email: InboundEmail) => boolean;
 /**
-* Structural projection of Cloudflare's `ForwardableEmailMessage` (verified
-* against `@cloudflare/workers-types`' `ForwardableEmailMessage`). Only the
-* members the handler touches are modelled, so the host can pass the real
-* runtime object without `@lunora/mail` importing `cloudflare:email`.
-*/
+ * Structural projection of Cloudflare's `ForwardableEmailMessage` (verified
+ * against `@cloudflare/workers-types`' `ForwardableEmailMessage`). Only the
+ * members the handler touches are modelled, so the host can pass the real
+ * runtime object without `@lunora/mail` importing `cloudflare:email`.
+ */
 interface ForwardableEmailMessageLike {
   /** Forward this message to a verified destination address. */
   forward: (rcptTo: string, headers?: Headers) => Promise<unknown>;
@@ -110,7 +166,14 @@ interface ForwardableEmailMessageLike {
     raw: string;
     to: string;
   }) => Promise<unknown>;
-  /** Reject the message with a permanent SMTP error (Cloudflare bounces/retries). */
+  /**
+   * Reject the message with a PERMANENT SMTP error — Cloudflare returns it to
+   * the connecting client with this reason, and it is never redelivered.
+   * Documented at https://developers.cloudflare.com/email-routing/email-workers/runtime-api/
+   * ("Reject this email message by returning a permanent SMTP error back to
+   * the connecting client, including the given reason") and mirrored in
+   * workerd's own `types/defines/email.d.ts`.
+   */
   setReject: (reason: string) => void;
   /** Envelope `To`. */
   readonly to: string;
@@ -127,43 +190,73 @@ interface InboundDispatchContext<TEnv = Record<string, unknown>> {
 /** Routes a parsed message into a Lunora function (or anywhere). */
 type InboundDispatch<TEnv = Record<string, unknown>> = (email: InboundEmail, context: InboundDispatchContext<TEnv>) => Promise<void>;
 /**
-* Opt-in sender-verification gate. Runs after `parse` and before `dispatch` with
-* the parsed message. Return `false` (or throw) to reject the message before it
-* reaches the privileged dispatch — use it to enforce DKIM/SPF/DMARC via
-* `email.authentication`, an allow-list, etc. Returning `true`/`undefined`
-* proceeds.
-*/
+ * Opt-in sender-verification gate. Runs after `parse` and before `dispatch` with
+ * the parsed message. Return `false` (or throw) to reject the message before it
+ * reaches the privileged dispatch — use it to enforce DKIM/SPF/DMARC via
+ * `email.authentication`, an allow-list, etc.
+ *
+ * `true` and `undefined` are the ONLY answers that proceed — `undefined` so a
+ * `(): void` hook that rejects by throwing type-checks. Anything else is read as a
+ * rejection: this is the gate whose failure mode would otherwise grant.
+ */
 type InboundVerify<TEnv = Record<string, unknown>> = (email: InboundEmail, context: InboundDispatchContext<TEnv>) => Promise<boolean | void> | boolean | void;
+/**
+ * Opt-in durable sink for a failed `dispatch`. Hand the parsed message to
+ * something that owns the retry — a queue producer, a Durable Object, an alarm
+ * — and the handler ACCEPTS the SMTP session instead of bouncing, because the
+ * message is now owned rather than lost. Returning normally means "I have it";
+ * throwing means the hand-off itself failed and the message bounces with the
+ * generic reason (see {@link createInboundEmailHandler}).
+ *
+ * `error` is the dispatch failure, for classification/logging by the sink.
+ *
+ * NOTE: binary attachment `content` is an `ArrayBuffer`/`Uint8Array`, which
+ * survives structured clone (Cloudflare Queues, DO storage) but is corrupted by
+ * `JSON.stringify` — encode it yourself if the sink is JSON-bodied.
+ */
+type InboundRetain<TEnv = Record<string, unknown>> = (email: InboundEmail, context: InboundDispatchContext<TEnv>, error: unknown) => Promise<void> | void;
 /** Options for {@link createInboundEmailHandler}. */
 interface InboundEmailHandlerOptions<TEnv = Record<string, unknown>> {
   /** Routes the parsed message onward (e.g. {@link dispatchToLunoraFunction}). */
   dispatch: InboundDispatch<TEnv>;
   /**
-  * Called when `parse`/`verify`/`dispatch` throws. The default rejects the
-  * message via `message.setReject` so Cloudflare bounces/retries rather than
-  * silently dropping it. SECURITY: the reject reason is delivered to the
-  * (attacker-controlled) sender as a bounce, so the default reason is a fixed,
-  * generic string and the real error is logged server-side. Override to log,
-  * forward, or swallow — but never pass internal error text to `setReject`.
-  */
+   * Called when `parse`, `verify`, or `dispatch` fails — but with two DIFFERENT
+   * contracts, because only the first two decide the message's fate here:
+   *
+   * - `parse` / `verify` — this hook DECIDES the outcome. The default
+   * ({@link rejectOnError}) rejects via `message.setReject`; supplying your own
+   * replaces that, so the message is accepted unless you reject it yourself.
+   * - `dispatch` — this hook is OBSERVABILITY ONLY. It is called for the side
+   * effect (log, alert, forward) and the outcome is then decided by `retain`
+   * (accept) or a generic reject, regardless of what it does; the built-in
+   * default is deliberately NOT applied there. A `setReject` from inside it
+   * still takes effect, which would bounce a message `retain` went on to
+   * accept — almost certainly not what you want. A throw from the hook itself
+   * is logged and swallowed so it cannot mask the original dispatch error.
+   *
+   * SECURITY: a reject reason is delivered to the (attacker-controlled) sender
+   * as a bounce, so the default reason is a fixed, generic string and the real
+   * error is logged server-side. Never pass internal error text to `setReject`.
+   */
   onError?: (error: unknown, context: InboundDispatchContext<TEnv>) => Promise<void> | void;
   /** Parses raw bytes into an {@link InboundEmail} (e.g. `parseInboundEmail`). */
   parse: (raw: RawInboundEmail) => Promise<InboundEmail>;
   /**
-  * Opt-in sender-authentication gate run before `dispatch`. SECURITY: inbound
-  * `from` is spoofable and dispatch is privileged — supply this (gating on
-  * `email.authentication`) when an inbound function makes any trust decision.
-  */
+   * Opt-in: take durable ownership of a message whose `dispatch` failed, so a
+   * transient fault (a shard 502, a briefly-absent admin token) is retried
+   * instead of bounced. Omit it and a dispatch failure bounces, as it always
+   * has. See {@link InboundRetain}.
+   */
+  retain?: InboundRetain<TEnv>;
+  /**
+   * Opt-in sender-authentication gate run before `dispatch`. SECURITY: inbound
+   * `from` is spoofable and dispatch is privileged — supply this (gating on
+   * `email.authentication`) when an inbound function makes any trust decision.
+   */
   verify?: InboundVerify<TEnv>;
 }
 /** The `email(message, env, ctx)` callback the factory returns. */
 type InboundEmailHandler<TEnv = Record<string, unknown>> = (message: ForwardableEmailMessageLike, env: TEnv, context: unknown) => Promise<void>;
-/**
-* Build the `email(message, env, ctx)` handler. It (a) reads `message.raw`,
-* (b) parses it via `parse`, (c) runs the optional `verify` gate, then
-* (d) calls `dispatch(parsed, { message, env, ctx })`. Any throw (or a falsy
-* `verify`) routes through `onError` (default: a generic `message.setReject`).
-*/
 declare const createInboundEmailHandler: <TEnv = Record<string, unknown>>(options: InboundEmailHandlerOptions<TEnv>) => InboundEmailHandler<TEnv>;
 /** The `RpcEnvelope` shape the runtime's `/_lunora/rpc` path consumes. */
 interface RpcEnvelope {
@@ -174,17 +267,25 @@ interface RpcEnvelope {
 /** Options for {@link dispatchToLunoraFunction}. */
 interface DispatchToLunoraFunctionOptions<TEnv = Record<string, unknown>> {
   /**
-  * Admin bearer authorizing the shard RPC. Defaults to reading
-  * `env.LUNORA_ADMIN_TOKEN` at dispatch time.
-  */
+   * Admin bearer authorizing the shard RPC. Defaults to reading
+   * `env.LUNORA_ADMIN_TOKEN` at dispatch time.
+   */
   adminToken?: string;
   /** `functionPath` of the target mutation/action (e.g. `"inbound:onEmail"`). */
   functionPath: string;
   /**
-  * Map the parsed message into the function's args. Defaults to passing the
-  * whole {@link InboundEmail} with binary attachment `content` base64-encoded
-  * (see {@link toJsonSafeEmail}) so it survives the JSON-serialised RPC body.
-  */
+   * Pin inbound dispatch to a Cloudflare data-residency jurisdiction. Defaults
+   * to the jurisdiction the schema declares (`.jurisdiction("eu")`), so a
+   * generated app needs nothing here; set it only for a hand-written worker, to
+   * the same value as its `jurisdiction`. A value that contradicts the schema's
+   * throws.
+   */
+  jurisdiction?: DurableObjectJurisdiction;
+  /**
+   * Map the parsed message into the function's args. Defaults to passing the
+   * whole {@link InboundEmail} with binary attachment `content` base64-encoded
+   * (see {@link toJsonSafeEmail}) so it survives the JSON-serialised RPC body.
+   */
   resolveArgs?: (email: InboundEmail, context: InboundDispatchContext<TEnv>) => unknown;
   /** The `SHARD` Durable Object namespace. */
   shard: ShardNamespaceLike;
@@ -192,16 +293,147 @@ interface DispatchToLunoraFunctionOptions<TEnv = Record<string, unknown>> {
   shardKey?: string;
 }
 /**
-* Build a {@link InboundDispatch} that posts an {@link RpcEnvelope} to the root
-* shard stub — the same admin-RPC-over-shard path the dev capture sink uses
-* (`from-env.ts`) — routing the parsed message into a named Lunora
-* mutation/action. Throws on a non-2xx RPC or a missing admin token so the
-* handler's `onError` (default `setReject`) bounces the message.
-*
-* SECURITY: the RPC carries the admin bearer, so the target function runs with
-* RLS bypassed over fully attacker-controlled, spoofable input — see the module
-* docstring. Verify the sender (`verify` hook / `email.authentication`) before
-* making any trust decision in the target function.
-*/
+ * Build a {@link InboundDispatch} that posts an {@link RpcEnvelope} to the root
+ * shard stub — the same admin-RPC-over-shard path the dev capture sink uses
+ * (`from-env.ts`) — routing the parsed message into a named Lunora
+ * mutation/action. Throws on a non-2xx RPC or a missing admin token — both
+ * transient in principle, so the handler reports it through a custom `onError`
+ * and then hands the message to `retain` if one is configured, bouncing only
+ * when there is nowhere durable to put it (see {@link createInboundEmailHandler}).
+ *
+ * SECURITY: the RPC is marked a trusted system dispatch, so `functionPath` may
+ * (and should) name an `internalMutation`/`internalAction` — a public `mutation`
+ * target is callable by any browser client with a forged message. The input is
+ * fully attacker-controlled and spoofable; verify the sender (`verify` hook /
+ * `email.authentication`) before making any trust decision in the target.
+ */
 declare const dispatchToLunoraFunction: <TEnv extends Record<string, unknown> = Record<string, unknown>>(options: DispatchToLunoraFunctionOptions<TEnv>) => InboundDispatch<TEnv>;
-export { type DispatchToLunoraFunctionOptions, type ForwardableEmailMessageLike, type InboundAttachment, type InboundAuthentication, type InboundDispatch, type InboundDispatchContext, type InboundEmail, type InboundEmailHandler, type InboundEmailHandlerOptions, type InboundVerify, type RawInboundEmail, type RpcEnvelope, type ShardNamespaceLike, type ShardStubLike, createInboundEmailHandler, dispatchToLunoraFunction, parseInboundEmail };
+export {
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type DispatchToLunoraFunctionOptions,
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type ForwardableEmailMessageLike, type InboundAttachment, type InboundAuthResult, type InboundAuthentication,
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type InboundDispatch,
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type InboundDispatchContext, type InboundEmail,
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type InboundEmailHandler,
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type InboundEmailHandlerOptions,
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type InboundVerify, type RawInboundEmail,
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type RpcEnvelope, type ShardNamespaceLike, authenticatesFrom, createInboundEmailHandler, dispatchToLunoraFunction, parseInboundEmail };

package/dist/inbound/index.mjs

@@ -1,2 +1 @@
-export { createInboundEmailHandler, dispatchToLunoraFunction } from '../packem_shared/createInboundEmailHandler-Cd8dyzB7.mjs';
-export { parseInboundEmail } from '../packem_shared/parseInboundEmail-Bw9u_1oc.mjs';
+import{createInboundEmailHandler as n,dispatchToLunoraFunction as r}from"../packem_shared/createInboundEmailHandler-QnZHQZpF.mjs";import{authenticatesFrom as t,parseInboundEmail as i}from"../packem_shared/authenticatesFrom-BOX-Paur.mjs";export{t as authenticatesFrom,n as createInboundEmailHandler,r as dispatchToLunoraFunction,i as parseInboundEmail};