@lunora/mail 1.0.0-alpha.13 → 1.0.0-alpha.14

package/dist/inbound/index.d.mts

@@ -1,5 +1,5 @@
-import { D as DurableObjectJurisdiction, S as ShardNamespaceLike } from "../packem_shared/shard.d-CL2Lmliv.mjs";
-export type { a as ShardStubLike } from "../packem_shared/shard.d-CL2Lmliv.mjs";
+import { D as DurableObjectJurisdiction, S as ShardNamespaceLike } from "../packem_shared/shard.d-C4kxvfmd.mjs";
+export type { a as ShardStubLike } from "../packem_shared/shard.d-C4kxvfmd.mjs";
 /** A raw RFC 822 message as accepted by the parser. */
 type RawInboundEmail = ArrayBuffer | ReadableStream<Uint8Array> | string | Uint8Array;
 /** One parsed attachment. `content` is preserved as the parser decoded it. */
@@ -25,6 +25,14 @@ interface InboundAttachment {
 * on `email.from` alone — gate on these verdicts (or your own policy) instead.
 * Verdicts are best-effort: when the receiving MX did not stamp an
 * `Authentication-Results` header, every field is `null` ("unknown").
+*
+* SECURITY: verdicts are read from the **first/topmost** `Authentication-Results`
+* header in document order. The receiving MX prepends its own genuine header per
+* RFC 8601, so the topmost occurrence is the trustworthy one; any lower
+* occurrences (which an untrusted sender can inject into the raw message) are
+* ignored. As defense-in-depth a consumer may additionally verify the topmost
+* header's `authserv-id` matches its receiving MX (e.g. Cloudflare) — that needs
+* config this runtime-agnostic parser does not carry, so it is left to the host.
 */
 interface InboundAuthentication {
   /** DKIM verdict (`"pass"`/`"fail"`/…), or `null` when not reported. */
@@ -40,8 +48,11 @@ interface InboundEmail {
   attachments: InboundAttachment[];
   /**
   * Sender-authentication verdicts (DKIM/SPF/DMARC) parsed from the receiving
-  * MX's `Authentication-Results` header. SECURITY: see {@link InboundAuthentication}
-  * — `from` is spoofable; gate trust on these verdicts, not on `from`.
+  * MX's **first/topmost** `Authentication-Results` header. SECURITY: see
+  * {@link InboundAuthentication} — `from` is spoofable; gate trust on these
+  * verdicts, not on `from`. Reading the raw `headers["authentication-results"]`
+  * map instead exposes last-wins (a lower, potentially attacker-injected)
+  * value — trust `authentication`, not the raw map.
   */
   authentication: InboundAuthentication;
   /** Sender mailbox (`from`), CR/LF-checked. Empty string when the message omitted it. SECURITY: spoofable — do not trust for authorization. */

package/dist/inbound/index.d.ts

@@ -1,5 +1,5 @@
-import { D as DurableObjectJurisdiction, S as ShardNamespaceLike } from "../packem_shared/shard.d-CL2Lmliv.js";
-export type { a as ShardStubLike } from "../packem_shared/shard.d-CL2Lmliv.js";
+import { D as DurableObjectJurisdiction, S as ShardNamespaceLike } from "../packem_shared/shard.d-C4kxvfmd.js";
+export type { a as ShardStubLike } from "../packem_shared/shard.d-C4kxvfmd.js";
 /** A raw RFC 822 message as accepted by the parser. */
 type RawInboundEmail = ArrayBuffer | ReadableStream<Uint8Array> | string | Uint8Array;
 /** One parsed attachment. `content` is preserved as the parser decoded it. */
@@ -25,6 +25,14 @@ interface InboundAttachment {
 * on `email.from` alone — gate on these verdicts (or your own policy) instead.
 * Verdicts are best-effort: when the receiving MX did not stamp an
 * `Authentication-Results` header, every field is `null` ("unknown").
+*
+* SECURITY: verdicts are read from the **first/topmost** `Authentication-Results`
+* header in document order. The receiving MX prepends its own genuine header per
+* RFC 8601, so the topmost occurrence is the trustworthy one; any lower
+* occurrences (which an untrusted sender can inject into the raw message) are
+* ignored. As defense-in-depth a consumer may additionally verify the topmost
+* header's `authserv-id` matches its receiving MX (e.g. Cloudflare) — that needs
+* config this runtime-agnostic parser does not carry, so it is left to the host.
 */
 interface InboundAuthentication {
   /** DKIM verdict (`"pass"`/`"fail"`/…), or `null` when not reported. */
@@ -40,8 +48,11 @@ interface InboundEmail {
   attachments: InboundAttachment[];
   /**
   * Sender-authentication verdicts (DKIM/SPF/DMARC) parsed from the receiving
-  * MX's `Authentication-Results` header. SECURITY: see {@link InboundAuthentication}
-  * — `from` is spoofable; gate trust on these verdicts, not on `from`.
+  * MX's **first/topmost** `Authentication-Results` header. SECURITY: see
+  * {@link InboundAuthentication} — `from` is spoofable; gate trust on these
+  * verdicts, not on `from`. Reading the raw `headers["authentication-results"]`
+  * map instead exposes last-wins (a lower, potentially attacker-injected)
+  * value — trust `authentication`, not the raw map.
   */
   authentication: InboundAuthentication;
   /** Sender mailbox (`from`), CR/LF-checked. Empty string when the message omitted it. SECURITY: spoofable — do not trust for authorization. */

package/dist/inbound/index.mjs

@@ -1,2 +1,2 @@
-export { createInboundEmailHandler, dispatchToLunoraFunction } from '../packem_shared/createInboundEmailHandler-BW_s0-Vc.mjs';
-export { parseInboundEmail } from '../packem_shared/parseInboundEmail-6lafQBT1.mjs';
+export { createInboundEmailHandler, dispatchToLunoraFunction } from '../packem_shared/createInboundEmailHandler-BMB5t-qh.mjs';
+export { parseInboundEmail } from '../packem_shared/parseInboundEmail-DXVOH0wz.mjs';

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { M as MailTransport, L as LunoraMailOptions, a as Mailer, b as MailboxSink, S as SendOptions } from "./packem_shared/capture-transport.d-ChnhdPO2.mjs";
 export { type C as CapturedMail, type Q as QueueLike, type c as SendPayload, d as createCaptureTransport } from "./packem_shared/capture-transport.d-ChnhdPO2.mjs";
-import { D as DurableObjectJurisdiction } from "./packem_shared/shard.d-CL2Lmliv.mjs";
+import { D as DurableObjectJurisdiction } from "./packem_shared/shard.d-C4kxvfmd.mjs";
 import { ReactElement } from 'react';
 /**
 * Sends a raw RFC 822 message through a Worker's Email send binding. The Workers

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { M as MailTransport, L as LunoraMailOptions, a as Mailer, b as MailboxSink, S as SendOptions } from "./packem_shared/capture-transport.d-ChnhdPO2.js";
 export { type C as CapturedMail, type Q as QueueLike, type c as SendPayload, d as createCaptureTransport } from "./packem_shared/capture-transport.d-ChnhdPO2.js";
-import { D as DurableObjectJurisdiction } from "./packem_shared/shard.d-CL2Lmliv.js";
+import { D as DurableObjectJurisdiction } from "./packem_shared/shard.d-C4kxvfmd.js";
 import { ReactElement } from 'react';
 /**
 * Sends a raw RFC 822 message through a Worker's Email send binding. The Workers

package/dist/index.mjs

@@ -1,7 +1,7 @@
 export { createCaptureTransport } from './packem_shared/createCaptureTransport-Crz_8822.mjs';
 export { createCloudflareTransport } from './packem_shared/createCloudflareTransport-DXh1nUNi.mjs';
 export { default as createMailer } from './packem_shared/createMailer-B4Z_Cgiu.mjs';
-export { createCaptureSink, createMailerFromEnv, shouldCaptureMail } from './packem_shared/createCaptureSink-Di-5AJUs.mjs';
+export { createCaptureSink, createMailerFromEnv, shouldCaptureMail } from './packem_shared/createCaptureSink-B0c7fQJf.mjs';
 export { consumeQueuedSend, toQueuedPayload } from './packem_shared/consumeQueuedSend-B9hTDOZ6.mjs';
 export { default as renderEmail } from './packem_shared/renderEmail-hyS1bpVP.mjs';
 export { default as createResendTransport } from './packem_shared/createResendTransport-CMQWjZoi.mjs';

package/dist/packem_shared/{createCaptureSink-Di-5AJUs.mjs → createCaptureSink-B0c7fQJf.mjs}

@@ -1,10 +1,9 @@
 import { LunoraError } from '@lunora/errors';
 import { createCaptureTransport } from './createCaptureTransport-Crz_8822.mjs';
 import createMailer from './createMailer-B4Z_Cgiu.mjs';
-import { a as applyJurisdiction } from './shard-CJ-TvmfT.mjs';
+import { D as DEFAULT_ROOT_SHARD, p as postShardRpc } from './shard-DEDcQoFg.mjs';
 
 const RECORD_MAIL_OP = "__lunora_admin__:recordMail";
-const DEFAULT_ROOT_SHARD = "__root__";
 const DEV_ENVIRONMENT_PATTERN = /^(?:dev(?:elopment)?|local(?:host)?|test)$/iu;
 const ENVIRONMENT_VARS = ["CF_ENV", "ENVIRONMENT", "NODE_ENV", "WORKER_ENV"];
 const requireStringEnv = (env, name) => {
@@ -17,7 +16,16 @@ const requireStringEnv = (env, name) => {
 const shouldCaptureMail = (env) => {
   const flag = env["LUNORA_MAIL_CAPTURE"];
   if (typeof flag === "string") {
-    return flag === "1" || flag.toLowerCase() === "true";
+    const normalized = flag.toLowerCase();
+    if (normalized === "1" || normalized === "true") {
+      return true;
+    }
+    if (normalized === "0" || normalized === "false") {
+      return false;
+    }
+    console.warn(
+      `@lunora/mail: unrecognized LUNORA_MAIL_CAPTURE value "${flag}" — expected "1"/"true" or "0"/"false"; falling back to environment detection.`
+    );
   }
   return ENVIRONMENT_VARS.some((key) => {
     const value = env[key];
@@ -32,15 +40,19 @@ const createCaptureSink = (env, rootShard = DEFAULT_ROOT_SHARD, jurisdiction) =>
       if (binding === void 0 || adminToken === void 0) {
         return { id: "uncaptured" };
       }
-      const namespace = applyJurisdiction(binding, jurisdiction);
-      const stub = namespace.get(namespace.idFromName(rootShard));
-      const response = await stub.fetch("https://shard.internal/rpc", {
-        body: JSON.stringify({ args: mail, functionPath: RECORD_MAIL_OP }),
-        headers: { authorization: `Bearer ${adminToken}`, "content-type": "application/json" },
-        method: "POST"
-      });
-      const body = await response.json();
-      return { id: body.result?.id ?? "captured" };
+      try {
+        const body = await postShardRpc(binding, {
+          adminToken,
+          envelope: { args: mail, functionPath: RECORD_MAIL_OP },
+          jurisdiction,
+          label: "@lunora/mail: recording captured mail",
+          shardKey: rootShard
+        });
+        return { id: body.result?.id ?? "captured" };
+      } catch (error) {
+        console.error("@lunora/mail: failed to record captured mail into the studio inbox —", error);
+        return { id: "uncaptured" };
+      }
     }
   };
 };

package/dist/packem_shared/{createInboundEmailHandler-BW_s0-Vc.mjs → createInboundEmailHandler-BMB5t-qh.mjs}

@@ -1,5 +1,5 @@
 import { LunoraError } from '@lunora/errors';
-import { a as applyJurisdiction } from './shard-CJ-TvmfT.mjs';
+import { p as postShardRpc, D as DEFAULT_ROOT_SHARD } from './shard-DEDcQoFg.mjs';
 
 const GENERIC_REJECT_REASON = "message could not be processed";
 const rejectOnError = (error, context) => {
@@ -24,11 +24,11 @@ const createInboundEmailHandler = (options) => {
     }
   };
 };
-const DEFAULT_ROOT_SHARD = "__root__";
+const BASE64_CHUNK = 32768;
 const toBase64 = (bytes) => {
   let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCodePoint(byte);
+  for (let index = 0; index < bytes.length; index += BASE64_CHUNK) {
+    binary += String.fromCharCode(...bytes.subarray(index, index + BASE64_CHUNK));
   }
   return btoa(binary);
 };
@@ -61,23 +61,13 @@ const dispatchToLunoraFunction = (options) => {
       functionPath: options.functionPath,
       shardKey
     };
-    const namespace = applyJurisdiction(options.shard, options.jurisdiction);
-    const stub = namespace.get(namespace.idFromName(shardKey));
-    const response = await stub.fetch("https://shard.internal/rpc", {
-      body: JSON.stringify(envelope),
-      headers: { authorization: `Bearer ${adminToken}`, "content-type": "application/json" },
-      method: "POST"
+    await postShardRpc(options.shard, {
+      adminToken,
+      envelope,
+      jurisdiction: options.jurisdiction,
+      label: `@lunora/mail/inbound: dispatch to \`${options.functionPath}\``,
+      shardKey
     });
-    if (response.ok === false) {
-      throw new LunoraError("INTERNAL", `@lunora/mail/inbound: dispatch to \`${options.functionPath}\` failed (HTTP ${String(response.status ?? "?")}).`);
-    }
-    const body = await response.json();
-    if (typeof body === "object" && body !== null && "error" in body) {
-      const { error } = body;
-      if (error !== void 0 && error !== null) {
-        throw new LunoraError("INTERNAL", `@lunora/mail/inbound: dispatch to \`${options.functionPath}\` returned an error: ${JSON.stringify(error)}`);
-      }
-    }
   };
 };
 

package/dist/packem_shared/{parseInboundEmail-6lafQBT1.mjs → parseInboundEmail-DXVOH0wz.mjs}

@@ -38,6 +38,7 @@ const parseInboundEmail = async (raw) => {
     assertSafeHeaderValue(`inbound header \`${header.key}\``, header.value);
     headers[header.key] = header.value;
   }
+  const topmostAuthResults = parsed.headers.find((header) => header.key === "authentication-results")?.value;
   const to = (parsed.to ?? []).map((entry) => {
     const formatted = formatAddress(entry);
     assertSafeHeaderValue("inbound to", formatted);
@@ -56,7 +57,7 @@ const parseInboundEmail = async (raw) => {
   });
   return {
     attachments,
-    authentication: parseAuthentication(headers["authentication-results"]),
+    authentication: parseAuthentication(topmostAuthResults),
     from,
     headers,
     ...parsed.html === void 0 ? {} : { html: parsed.html },

package/dist/packem_shared/shard-DEDcQoFg.mjs

@@ -0,0 +1,36 @@
+import { LunoraError } from '@lunora/errors';
+
+const DEFAULT_ROOT_SHARD = "__root__";
+const applyJurisdiction = (namespace, jurisdiction) => {
+  if (jurisdiction === void 0) {
+    return namespace;
+  }
+  if (typeof namespace.jurisdiction !== "function") {
+    throw new TypeError(
+      `@lunora/mail: Durable Object namespace does not support jurisdiction("${jurisdiction}") — update @cloudflare/workers-types or remove the jurisdiction option`
+    );
+  }
+  return namespace.jurisdiction(jurisdiction);
+};
+const postShardRpc = async (namespace, options) => {
+  const scoped = applyJurisdiction(namespace, options.jurisdiction);
+  const stub = scoped.get(scoped.idFromName(options.shardKey));
+  const response = await stub.fetch("https://shard.internal/rpc", {
+    body: JSON.stringify(options.envelope),
+    headers: { authorization: `Bearer ${options.adminToken}`, "content-type": "application/json" },
+    method: "POST"
+  });
+  if (response.ok === false) {
+    throw new LunoraError("INTERNAL", `${options.label} failed (HTTP ${String(response.status ?? "?")}).`);
+  }
+  const body = await response.json();
+  if (typeof body === "object" && body !== null && "error" in body) {
+    const { error } = body;
+    if (error !== void 0 && error !== null) {
+      throw new LunoraError("INTERNAL", `${options.label} returned an error: ${JSON.stringify(error)}`);
+    }
+  }
+  return body;
+};
+
+export { DEFAULT_ROOT_SHARD as D, postShardRpc as p };

package/dist/packem_shared/{shard.d-CL2Lmliv.d.mts → shard.d-C4kxvfmd.d.mts}

@@ -1,11 +1,4 @@
-/**
-* Structural projections of the `SHARD` Durable Object namespace + one shard
-* stub, shared by the inbound dispatcher. Mirrors the shapes the outbound dev
-* capture sink uses (`packages/mail/src/from-env.ts`) so inbound dispatch routes
-* a parsed message into a Lunora function over the exact same admin-RPC-over-shard
-* path — without importing any Cloudflare types into `@lunora/mail`.
-*/
-/** Structural projection of one shard stub — only `fetch` returning something with `.json()`. */
+/** Structural projection of one shard stub — only `fetch` returning a Fetch-`Response`-like object. */
 interface ShardStubLike {
   fetch: (input: string, init?: {
     body?: string;
@@ -13,6 +6,8 @@ interface ShardStubLike {
     method?: string;
   }) => Promise<{
     json: () => Promise<unknown>;
+    ok?: boolean;
+    status?: number;
   }>;
 }
 /**

package/dist/packem_shared/{shard.d-CL2Lmliv.d.ts → shard.d-C4kxvfmd.d.ts}

@@ -1,11 +1,4 @@
-/**
-* Structural projections of the `SHARD` Durable Object namespace + one shard
-* stub, shared by the inbound dispatcher. Mirrors the shapes the outbound dev
-* capture sink uses (`packages/mail/src/from-env.ts`) so inbound dispatch routes
-* a parsed message into a Lunora function over the exact same admin-RPC-over-shard
-* path — without importing any Cloudflare types into `@lunora/mail`.
-*/
-/** Structural projection of one shard stub — only `fetch` returning something with `.json()`. */
+/** Structural projection of one shard stub — only `fetch` returning a Fetch-`Response`-like object. */
 interface ShardStubLike {
   fetch: (input: string, init?: {
     body?: string;
@@ -13,6 +6,8 @@ interface ShardStubLike {
     method?: string;
   }) => Promise<{
     json: () => Promise<unknown>;
+    ok?: boolean;
+    status?: number;
   }>;
 }
 /**

package/dist/testing.mjs

@@ -43,6 +43,8 @@ const waitForMail = async (options) => {
   }
 };
 const URL_PATTERN = /https?:\/\/[^\s"'<>)]+/g;
+const AMPERSAND_ENTITY = /&(?:amp|#0*38|#x0*26);/giu;
+const decodeUrlEntities = (url) => url.replaceAll(AMPERSAND_ENTITY, "&");
 const extractLink = (mail, options = {}) => {
   for (const source of [mail.html, mail.text]) {
     if (source === void 0) {
@@ -51,7 +53,7 @@ const extractLink = (mail, options = {}) => {
     const matches = source.match(URL_PATTERN) ?? [];
     const link = matches.find((candidate) => options.match === void 0 || candidate.includes(options.match));
     if (link !== void 0) {
-      return link;
+      return decodeUrlEntities(link);
     }
   }
   throw new LunoraError(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/mail",
-  "version": "1.0.0-alpha.13",
+  "version": "1.0.0-alpha.14",
   "description": "Email for Lunora: Resend adapter, TSX templates, and queue-backed sends",
   "keywords": [
     "cloudflare",
@@ -54,7 +54,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.3",
+    "@lunora/errors": "1.0.0-alpha.4",
     "@react-email/render": "2.0.10",
     "@visulima/email": "1.0.0",
     "postal-mime": "2.7.5"

package/dist/packem_shared/shard-CJ-TvmfT.mjs

@@ -1,13 +0,0 @@
-const applyJurisdiction = (namespace, jurisdiction) => {
-  if (jurisdiction === void 0) {
-    return namespace;
-  }
-  if (typeof namespace.jurisdiction !== "function") {
-    throw new TypeError(
-      `@lunora/mail: Durable Object namespace does not support jurisdiction("${jurisdiction}") — update @cloudflare/workers-types or remove the jurisdiction option`
-    );
-  }
-  return namespace.jurisdiction(jurisdiction);
-};
-
-export { applyJurisdiction as a };