@lunora/mail 1.0.0-alpha.15 → 1.0.0-alpha.16

package/dist/inbound/index.d.mts

@@ -1,5 +1,5 @@
-import { D as DurableObjectJurisdiction, S as ShardNamespaceLike } from "../packem_shared/shard.d-C4kxvfmd.mjs";
-export type { a as ShardStubLike } from "../packem_shared/shard.d-C4kxvfmd.mjs";
+import { D as DurableObjectJurisdiction, S as ShardNamespaceLike } from "../packem_shared/shard.d-DVADjmEJ.mjs";
+export type { a as ShardStubLike } from "../packem_shared/shard.d-DVADjmEJ.mjs";
 /** A raw RFC 822 message as accepted by the parser. */
 type RawInboundEmail = ArrayBuffer | ReadableStream<Uint8Array> | string | Uint8Array;
 /** One parsed attachment. `content` is preserved as the parser decoded it. */
@@ -16,24 +16,24 @@ interface InboundAttachment {
   mimeType: string;
 }
 /**
-* Sender-authentication verdicts pulled from the `Authentication-Results` header
-* the receiving MX (e.g. Cloudflare Email Routing) stamped on the message.
-*
-* SECURITY: Cloudflare Email Routing authenticates only the *recipient* domain,
-* **not** the sender. The envelope `from` and message content are trivially
-* spoofable, so a downstream handler MUST NOT make trust/authorization decisions
-* on `email.from` alone — gate on these verdicts (or your own policy) instead.
-* Verdicts are best-effort: when the receiving MX did not stamp an
-* `Authentication-Results` header, every field is `null` ("unknown").
-*
-* SECURITY: verdicts are read from the **first/topmost** `Authentication-Results`
-* header in document order. The receiving MX prepends its own genuine header per
-* RFC 8601, so the topmost occurrence is the trustworthy one; any lower
-* occurrences (which an untrusted sender can inject into the raw message) are
-* ignored. As defense-in-depth a consumer may additionally verify the topmost
-* header's `authserv-id` matches its receiving MX (e.g. Cloudflare) — that needs
-* config this runtime-agnostic parser does not carry, so it is left to the host.
-*/
+ * Sender-authentication verdicts pulled from the `Authentication-Results` header
+ * the receiving MX (e.g. Cloudflare Email Routing) stamped on the message.
+ *
+ * SECURITY: Cloudflare Email Routing authenticates only the *recipient* domain,
+ * **not** the sender. The envelope `from` and message content are trivially
+ * spoofable, so a downstream handler MUST NOT make trust/authorization decisions
+ * on `email.from` alone — gate on these verdicts (or your own policy) instead.
+ * Verdicts are best-effort: when the receiving MX did not stamp an
+ * `Authentication-Results` header, every field is `null` ("unknown").
+ *
+ * SECURITY: verdicts are read from the **first/topmost** `Authentication-Results`
+ * header in document order. The receiving MX prepends its own genuine header per
+ * RFC 8601, so the topmost occurrence is the trustworthy one; any lower
+ * occurrences (which an untrusted sender can inject into the raw message) are
+ * ignored. As defense-in-depth a consumer may additionally verify the topmost
+ * header's `authserv-id` matches its receiving MX (e.g. Cloudflare) — that needs
+ * config this runtime-agnostic parser does not carry, so it is left to the host.
+ */
 interface InboundAuthentication {
   /** DKIM verdict (`"pass"`/`"fail"`/…), or `null` when not reported. */
   dkim: string | null;
@@ -47,13 +47,13 @@ interface InboundEmail {
   /** Decoded attachments (empty array when none). */
   attachments: InboundAttachment[];
   /**
-  * Sender-authentication verdicts (DKIM/SPF/DMARC) parsed from the receiving
-  * MX's **first/topmost** `Authentication-Results` header. SECURITY: see
-  * {@link InboundAuthentication} — `from` is spoofable; gate trust on these
-  * verdicts, not on `from`. Reading the raw `headers["authentication-results"]`
-  * map instead exposes last-wins (a lower, potentially attacker-injected)
-  * value — trust `authentication`, not the raw map.
-  */
+   * Sender-authentication verdicts (DKIM/SPF/DMARC) parsed from the receiving
+   * MX's **first/topmost** `Authentication-Results` header. SECURITY: see
+   * {@link InboundAuthentication} — `from` is spoofable; gate trust on these
+   * verdicts, not on `from`. Reading the raw `headers["authentication-results"]`
+   * map instead exposes last-wins (a lower, potentially attacker-injected)
+   * value — trust `authentication`, not the raw map.
+   */
   authentication: InboundAuthentication;
   /** Sender mailbox (`from`), CR/LF-checked. Empty string when the message omitted it. SECURITY: spoofable — do not trust for authorization. */
   from: string;
@@ -75,17 +75,17 @@ interface InboundEmail {
   to: string[];
 }
 /**
-* Parse a raw RFC 822 message into a normalised {@link InboundEmail}. Accepts the
-* shapes a Cloudflare Email Worker can hand off — `ReadableStream`, `ArrayBuffer`,
-* `Uint8Array`, or a decoded string.
-*/
+ * Parse a raw RFC 822 message into a normalised {@link InboundEmail}. Accepts the
+ * shapes a Cloudflare Email Worker can hand off — `ReadableStream`, `ArrayBuffer`,
+ * `Uint8Array`, or a decoded string.
+ */
 declare const parseInboundEmail: (raw: RawInboundEmail) => Promise<InboundEmail>;
 /**
-* Structural projection of Cloudflare's `ForwardableEmailMessage` (verified
-* against `@cloudflare/workers-types`' `ForwardableEmailMessage`). Only the
-* members the handler touches are modelled, so the host can pass the real
-* runtime object without `@lunora/mail` importing `cloudflare:email`.
-*/
+ * Structural projection of Cloudflare's `ForwardableEmailMessage` (verified
+ * against `@cloudflare/workers-types`' `ForwardableEmailMessage`). Only the
+ * members the handler touches are modelled, so the host can pass the real
+ * runtime object without `@lunora/mail` importing `cloudflare:email`.
+ */
 interface ForwardableEmailMessageLike {
   /** Forward this message to a verified destination address. */
   forward: (rcptTo: string, headers?: Headers) => Promise<unknown>;
@@ -118,43 +118,43 @@ interface InboundDispatchContext<TEnv = Record<string, unknown>> {
 /** Routes a parsed message into a Lunora function (or anywhere). */
 type InboundDispatch<TEnv = Record<string, unknown>> = (email: InboundEmail, context: InboundDispatchContext<TEnv>) => Promise<void>;
 /**
-* Opt-in sender-verification gate. Runs after `parse` and before `dispatch` with
-* the parsed message. Return `false` (or throw) to reject the message before it
-* reaches the privileged dispatch — use it to enforce DKIM/SPF/DMARC via
-* `email.authentication`, an allow-list, etc. Returning `true`/`undefined`
-* proceeds.
-*/
+ * Opt-in sender-verification gate. Runs after `parse` and before `dispatch` with
+ * the parsed message. Return `false` (or throw) to reject the message before it
+ * reaches the privileged dispatch — use it to enforce DKIM/SPF/DMARC via
+ * `email.authentication`, an allow-list, etc. Returning `true`/`undefined`
+ * proceeds.
+ */
 type InboundVerify<TEnv = Record<string, unknown>> = (email: InboundEmail, context: InboundDispatchContext<TEnv>) => Promise<boolean | void> | boolean | void;
 /** Options for {@link createInboundEmailHandler}. */
 interface InboundEmailHandlerOptions<TEnv = Record<string, unknown>> {
   /** Routes the parsed message onward (e.g. {@link dispatchToLunoraFunction}). */
   dispatch: InboundDispatch<TEnv>;
   /**
-  * Called when `parse`/`verify`/`dispatch` throws. The default rejects the
-  * message via `message.setReject` so Cloudflare bounces/retries rather than
-  * silently dropping it. SECURITY: the reject reason is delivered to the
-  * (attacker-controlled) sender as a bounce, so the default reason is a fixed,
-  * generic string and the real error is logged server-side. Override to log,
-  * forward, or swallow — but never pass internal error text to `setReject`.
-  */
+   * Called when `parse`/`verify`/`dispatch` throws. The default rejects the
+   * message via `message.setReject` so Cloudflare bounces/retries rather than
+   * silently dropping it. SECURITY: the reject reason is delivered to the
+   * (attacker-controlled) sender as a bounce, so the default reason is a fixed,
+   * generic string and the real error is logged server-side. Override to log,
+   * forward, or swallow — but never pass internal error text to `setReject`.
+   */
   onError?: (error: unknown, context: InboundDispatchContext<TEnv>) => Promise<void> | void;
   /** Parses raw bytes into an {@link InboundEmail} (e.g. `parseInboundEmail`). */
   parse: (raw: RawInboundEmail) => Promise<InboundEmail>;
   /**
-  * Opt-in sender-authentication gate run before `dispatch`. SECURITY: inbound
-  * `from` is spoofable and dispatch is privileged — supply this (gating on
-  * `email.authentication`) when an inbound function makes any trust decision.
-  */
+   * Opt-in sender-authentication gate run before `dispatch`. SECURITY: inbound
+   * `from` is spoofable and dispatch is privileged — supply this (gating on
+   * `email.authentication`) when an inbound function makes any trust decision.
+   */
   verify?: InboundVerify<TEnv>;
 }
 /** The `email(message, env, ctx)` callback the factory returns. */
 type InboundEmailHandler<TEnv = Record<string, unknown>> = (message: ForwardableEmailMessageLike, env: TEnv, context: unknown) => Promise<void>;
 /**
-* Build the `email(message, env, ctx)` handler. It (a) reads `message.raw`,
-* (b) parses it via `parse`, (c) runs the optional `verify` gate, then
-* (d) calls `dispatch(parsed, { message, env, ctx })`. Any throw (or a falsy
-* `verify`) routes through `onError` (default: a generic `message.setReject`).
-*/
+ * Build the `email(message, env, ctx)` handler. It (a) reads `message.raw`,
+ * (b) parses it via `parse`, (c) runs the optional `verify` gate, then
+ * (d) calls `dispatch(parsed, { message, env, ctx })`. Any throw (or a falsy
+ * `verify`) routes through `onError` (default: a generic `message.setReject`).
+ */
 declare const createInboundEmailHandler: <TEnv = Record<string, unknown>>(options: InboundEmailHandlerOptions<TEnv>) => InboundEmailHandler<TEnv>;
 /** The `RpcEnvelope` shape the runtime's `/_lunora/rpc` path consumes. */
 interface RpcEnvelope {
@@ -165,23 +165,23 @@ interface RpcEnvelope {
 /** Options for {@link dispatchToLunoraFunction}. */
 interface DispatchToLunoraFunctionOptions<TEnv = Record<string, unknown>> {
   /**
-  * Admin bearer authorizing the shard RPC. Defaults to reading
-  * `env.LUNORA_ADMIN_TOKEN` at dispatch time.
-  */
+   * Admin bearer authorizing the shard RPC. Defaults to reading
+   * `env.LUNORA_ADMIN_TOKEN` at dispatch time.
+   */
   adminToken?: string;
   /** `functionPath` of the target mutation/action (e.g. `"inbound:onEmail"`). */
   functionPath: string;
   /**
-  * Pin inbound dispatch to a Cloudflare data-residency jurisdiction. Pass the
-  * same value as the worker's `jurisdiction` so inbound mail routes to the
-  * jurisdiction-pinned shard. Omit for the un-pinned global namespace.
-  */
+   * Pin inbound dispatch to a Cloudflare data-residency jurisdiction. Pass the
+   * same value as the worker's `jurisdiction` so inbound mail routes to the
+   * jurisdiction-pinned shard. Omit for the un-pinned global namespace.
+   */
   jurisdiction?: DurableObjectJurisdiction;
   /**
-  * Map the parsed message into the function's args. Defaults to passing the
-  * whole {@link InboundEmail} with binary attachment `content` base64-encoded
-  * (see {@link toJsonSafeEmail}) so it survives the JSON-serialised RPC body.
-  */
+   * Map the parsed message into the function's args. Defaults to passing the
+   * whole {@link InboundEmail} with binary attachment `content` base64-encoded
+   * (see {@link toJsonSafeEmail}) so it survives the JSON-serialised RPC body.
+   */
   resolveArgs?: (email: InboundEmail, context: InboundDispatchContext<TEnv>) => unknown;
   /** The `SHARD` Durable Object namespace. */
   shard: ShardNamespaceLike;
@@ -189,16 +189,16 @@ interface DispatchToLunoraFunctionOptions<TEnv = Record<string, unknown>> {
   shardKey?: string;
 }
 /**
-* Build a {@link InboundDispatch} that posts an {@link RpcEnvelope} to the root
-* shard stub — the same admin-RPC-over-shard path the dev capture sink uses
-* (`from-env.ts`) — routing the parsed message into a named Lunora
-* mutation/action. Throws on a non-2xx RPC or a missing admin token so the
-* handler's `onError` (default `setReject`) bounces the message.
-*
-* SECURITY: the RPC carries the admin bearer, so the target function runs with
-* RLS bypassed over fully attacker-controlled, spoofable input — see the module
-* docstring. Verify the sender (`verify` hook / `email.authentication`) before
-* making any trust decision in the target function.
-*/
+ * Build a {@link InboundDispatch} that posts an {@link RpcEnvelope} to the root
+ * shard stub — the same admin-RPC-over-shard path the dev capture sink uses
+ * (`from-env.ts`) — routing the parsed message into a named Lunora
+ * mutation/action. Throws on a non-2xx RPC or a missing admin token so the
+ * handler's `onError` (default `setReject`) bounces the message.
+ *
+ * SECURITY: the RPC carries the admin bearer, so the target function runs with
+ * RLS bypassed over fully attacker-controlled, spoofable input — see the module
+ * docstring. Verify the sender (`verify` hook / `email.authentication`) before
+ * making any trust decision in the target function.
+ */
 declare const dispatchToLunoraFunction: <TEnv extends Record<string, unknown> = Record<string, unknown>>(options: DispatchToLunoraFunctionOptions<TEnv>) => InboundDispatch<TEnv>;
 export { type DispatchToLunoraFunctionOptions, type ForwardableEmailMessageLike, type InboundAttachment, type InboundAuthentication, type InboundDispatch, type InboundDispatchContext, type InboundEmail, type InboundEmailHandler, type InboundEmailHandlerOptions, type InboundVerify, type RawInboundEmail, type RpcEnvelope, type ShardNamespaceLike, createInboundEmailHandler, dispatchToLunoraFunction, parseInboundEmail };

package/dist/inbound/index.d.ts

@@ -1,5 +1,5 @@
-import { D as DurableObjectJurisdiction, S as ShardNamespaceLike } from "../packem_shared/shard.d-C4kxvfmd.js";
-export type { a as ShardStubLike } from "../packem_shared/shard.d-C4kxvfmd.js";
+import { D as DurableObjectJurisdiction, S as ShardNamespaceLike } from "../packem_shared/shard.d-DVADjmEJ.js";
+export type { a as ShardStubLike } from "../packem_shared/shard.d-DVADjmEJ.js";
 /** A raw RFC 822 message as accepted by the parser. */
 type RawInboundEmail = ArrayBuffer | ReadableStream<Uint8Array> | string | Uint8Array;
 /** One parsed attachment. `content` is preserved as the parser decoded it. */
@@ -16,24 +16,24 @@ interface InboundAttachment {
   mimeType: string;
 }
 /**
-* Sender-authentication verdicts pulled from the `Authentication-Results` header
-* the receiving MX (e.g. Cloudflare Email Routing) stamped on the message.
-*
-* SECURITY: Cloudflare Email Routing authenticates only the *recipient* domain,
-* **not** the sender. The envelope `from` and message content are trivially
-* spoofable, so a downstream handler MUST NOT make trust/authorization decisions
-* on `email.from` alone — gate on these verdicts (or your own policy) instead.
-* Verdicts are best-effort: when the receiving MX did not stamp an
-* `Authentication-Results` header, every field is `null` ("unknown").
-*
-* SECURITY: verdicts are read from the **first/topmost** `Authentication-Results`
-* header in document order. The receiving MX prepends its own genuine header per
-* RFC 8601, so the topmost occurrence is the trustworthy one; any lower
-* occurrences (which an untrusted sender can inject into the raw message) are
-* ignored. As defense-in-depth a consumer may additionally verify the topmost
-* header's `authserv-id` matches its receiving MX (e.g. Cloudflare) — that needs
-* config this runtime-agnostic parser does not carry, so it is left to the host.
-*/
+ * Sender-authentication verdicts pulled from the `Authentication-Results` header
+ * the receiving MX (e.g. Cloudflare Email Routing) stamped on the message.
+ *
+ * SECURITY: Cloudflare Email Routing authenticates only the *recipient* domain,
+ * **not** the sender. The envelope `from` and message content are trivially
+ * spoofable, so a downstream handler MUST NOT make trust/authorization decisions
+ * on `email.from` alone — gate on these verdicts (or your own policy) instead.
+ * Verdicts are best-effort: when the receiving MX did not stamp an
+ * `Authentication-Results` header, every field is `null` ("unknown").
+ *
+ * SECURITY: verdicts are read from the **first/topmost** `Authentication-Results`
+ * header in document order. The receiving MX prepends its own genuine header per
+ * RFC 8601, so the topmost occurrence is the trustworthy one; any lower
+ * occurrences (which an untrusted sender can inject into the raw message) are
+ * ignored. As defense-in-depth a consumer may additionally verify the topmost
+ * header's `authserv-id` matches its receiving MX (e.g. Cloudflare) — that needs
+ * config this runtime-agnostic parser does not carry, so it is left to the host.
+ */
 interface InboundAuthentication {
   /** DKIM verdict (`"pass"`/`"fail"`/…), or `null` when not reported. */
   dkim: string | null;
@@ -47,13 +47,13 @@ interface InboundEmail {
   /** Decoded attachments (empty array when none). */
   attachments: InboundAttachment[];
   /**
-  * Sender-authentication verdicts (DKIM/SPF/DMARC) parsed from the receiving
-  * MX's **first/topmost** `Authentication-Results` header. SECURITY: see
-  * {@link InboundAuthentication} — `from` is spoofable; gate trust on these
-  * verdicts, not on `from`. Reading the raw `headers["authentication-results"]`
-  * map instead exposes last-wins (a lower, potentially attacker-injected)
-  * value — trust `authentication`, not the raw map.
-  */
+   * Sender-authentication verdicts (DKIM/SPF/DMARC) parsed from the receiving
+   * MX's **first/topmost** `Authentication-Results` header. SECURITY: see
+   * {@link InboundAuthentication} — `from` is spoofable; gate trust on these
+   * verdicts, not on `from`. Reading the raw `headers["authentication-results"]`
+   * map instead exposes last-wins (a lower, potentially attacker-injected)
+   * value — trust `authentication`, not the raw map.
+   */
   authentication: InboundAuthentication;
   /** Sender mailbox (`from`), CR/LF-checked. Empty string when the message omitted it. SECURITY: spoofable — do not trust for authorization. */
   from: string;
@@ -75,17 +75,17 @@ interface InboundEmail {
   to: string[];
 }
 /**
-* Parse a raw RFC 822 message into a normalised {@link InboundEmail}. Accepts the
-* shapes a Cloudflare Email Worker can hand off — `ReadableStream`, `ArrayBuffer`,
-* `Uint8Array`, or a decoded string.
-*/
+ * Parse a raw RFC 822 message into a normalised {@link InboundEmail}. Accepts the
+ * shapes a Cloudflare Email Worker can hand off — `ReadableStream`, `ArrayBuffer`,
+ * `Uint8Array`, or a decoded string.
+ */
 declare const parseInboundEmail: (raw: RawInboundEmail) => Promise<InboundEmail>;
 /**
-* Structural projection of Cloudflare's `ForwardableEmailMessage` (verified
-* against `@cloudflare/workers-types`' `ForwardableEmailMessage`). Only the
-* members the handler touches are modelled, so the host can pass the real
-* runtime object without `@lunora/mail` importing `cloudflare:email`.
-*/
+ * Structural projection of Cloudflare's `ForwardableEmailMessage` (verified
+ * against `@cloudflare/workers-types`' `ForwardableEmailMessage`). Only the
+ * members the handler touches are modelled, so the host can pass the real
+ * runtime object without `@lunora/mail` importing `cloudflare:email`.
+ */
 interface ForwardableEmailMessageLike {
   /** Forward this message to a verified destination address. */
   forward: (rcptTo: string, headers?: Headers) => Promise<unknown>;
@@ -118,43 +118,43 @@ interface InboundDispatchContext<TEnv = Record<string, unknown>> {
 /** Routes a parsed message into a Lunora function (or anywhere). */
 type InboundDispatch<TEnv = Record<string, unknown>> = (email: InboundEmail, context: InboundDispatchContext<TEnv>) => Promise<void>;
 /**
-* Opt-in sender-verification gate. Runs after `parse` and before `dispatch` with
-* the parsed message. Return `false` (or throw) to reject the message before it
-* reaches the privileged dispatch — use it to enforce DKIM/SPF/DMARC via
-* `email.authentication`, an allow-list, etc. Returning `true`/`undefined`
-* proceeds.
-*/
+ * Opt-in sender-verification gate. Runs after `parse` and before `dispatch` with
+ * the parsed message. Return `false` (or throw) to reject the message before it
+ * reaches the privileged dispatch — use it to enforce DKIM/SPF/DMARC via
+ * `email.authentication`, an allow-list, etc. Returning `true`/`undefined`
+ * proceeds.
+ */
 type InboundVerify<TEnv = Record<string, unknown>> = (email: InboundEmail, context: InboundDispatchContext<TEnv>) => Promise<boolean | void> | boolean | void;
 /** Options for {@link createInboundEmailHandler}. */
 interface InboundEmailHandlerOptions<TEnv = Record<string, unknown>> {
   /** Routes the parsed message onward (e.g. {@link dispatchToLunoraFunction}). */
   dispatch: InboundDispatch<TEnv>;
   /**
-  * Called when `parse`/`verify`/`dispatch` throws. The default rejects the
-  * message via `message.setReject` so Cloudflare bounces/retries rather than
-  * silently dropping it. SECURITY: the reject reason is delivered to the
-  * (attacker-controlled) sender as a bounce, so the default reason is a fixed,
-  * generic string and the real error is logged server-side. Override to log,
-  * forward, or swallow — but never pass internal error text to `setReject`.
-  */
+   * Called when `parse`/`verify`/`dispatch` throws. The default rejects the
+   * message via `message.setReject` so Cloudflare bounces/retries rather than
+   * silently dropping it. SECURITY: the reject reason is delivered to the
+   * (attacker-controlled) sender as a bounce, so the default reason is a fixed,
+   * generic string and the real error is logged server-side. Override to log,
+   * forward, or swallow — but never pass internal error text to `setReject`.
+   */
   onError?: (error: unknown, context: InboundDispatchContext<TEnv>) => Promise<void> | void;
   /** Parses raw bytes into an {@link InboundEmail} (e.g. `parseInboundEmail`). */
   parse: (raw: RawInboundEmail) => Promise<InboundEmail>;
   /**
-  * Opt-in sender-authentication gate run before `dispatch`. SECURITY: inbound
-  * `from` is spoofable and dispatch is privileged — supply this (gating on
-  * `email.authentication`) when an inbound function makes any trust decision.
-  */
+   * Opt-in sender-authentication gate run before `dispatch`. SECURITY: inbound
+   * `from` is spoofable and dispatch is privileged — supply this (gating on
+   * `email.authentication`) when an inbound function makes any trust decision.
+   */
   verify?: InboundVerify<TEnv>;
 }
 /** The `email(message, env, ctx)` callback the factory returns. */
 type InboundEmailHandler<TEnv = Record<string, unknown>> = (message: ForwardableEmailMessageLike, env: TEnv, context: unknown) => Promise<void>;
 /**
-* Build the `email(message, env, ctx)` handler. It (a) reads `message.raw`,
-* (b) parses it via `parse`, (c) runs the optional `verify` gate, then
-* (d) calls `dispatch(parsed, { message, env, ctx })`. Any throw (or a falsy
-* `verify`) routes through `onError` (default: a generic `message.setReject`).
-*/
+ * Build the `email(message, env, ctx)` handler. It (a) reads `message.raw`,
+ * (b) parses it via `parse`, (c) runs the optional `verify` gate, then
+ * (d) calls `dispatch(parsed, { message, env, ctx })`. Any throw (or a falsy
+ * `verify`) routes through `onError` (default: a generic `message.setReject`).
+ */
 declare const createInboundEmailHandler: <TEnv = Record<string, unknown>>(options: InboundEmailHandlerOptions<TEnv>) => InboundEmailHandler<TEnv>;
 /** The `RpcEnvelope` shape the runtime's `/_lunora/rpc` path consumes. */
 interface RpcEnvelope {
@@ -165,23 +165,23 @@ interface RpcEnvelope {
 /** Options for {@link dispatchToLunoraFunction}. */
 interface DispatchToLunoraFunctionOptions<TEnv = Record<string, unknown>> {
   /**
-  * Admin bearer authorizing the shard RPC. Defaults to reading
-  * `env.LUNORA_ADMIN_TOKEN` at dispatch time.
-  */
+   * Admin bearer authorizing the shard RPC. Defaults to reading
+   * `env.LUNORA_ADMIN_TOKEN` at dispatch time.
+   */
   adminToken?: string;
   /** `functionPath` of the target mutation/action (e.g. `"inbound:onEmail"`). */
   functionPath: string;
   /**
-  * Pin inbound dispatch to a Cloudflare data-residency jurisdiction. Pass the
-  * same value as the worker's `jurisdiction` so inbound mail routes to the
-  * jurisdiction-pinned shard. Omit for the un-pinned global namespace.
-  */
+   * Pin inbound dispatch to a Cloudflare data-residency jurisdiction. Pass the
+   * same value as the worker's `jurisdiction` so inbound mail routes to the
+   * jurisdiction-pinned shard. Omit for the un-pinned global namespace.
+   */
   jurisdiction?: DurableObjectJurisdiction;
   /**
-  * Map the parsed message into the function's args. Defaults to passing the
-  * whole {@link InboundEmail} with binary attachment `content` base64-encoded
-  * (see {@link toJsonSafeEmail}) so it survives the JSON-serialised RPC body.
-  */
+   * Map the parsed message into the function's args. Defaults to passing the
+   * whole {@link InboundEmail} with binary attachment `content` base64-encoded
+   * (see {@link toJsonSafeEmail}) so it survives the JSON-serialised RPC body.
+   */
   resolveArgs?: (email: InboundEmail, context: InboundDispatchContext<TEnv>) => unknown;
   /** The `SHARD` Durable Object namespace. */
   shard: ShardNamespaceLike;
@@ -189,16 +189,16 @@ interface DispatchToLunoraFunctionOptions<TEnv = Record<string, unknown>> {
   shardKey?: string;
 }
 /**
-* Build a {@link InboundDispatch} that posts an {@link RpcEnvelope} to the root
-* shard stub — the same admin-RPC-over-shard path the dev capture sink uses
-* (`from-env.ts`) — routing the parsed message into a named Lunora
-* mutation/action. Throws on a non-2xx RPC or a missing admin token so the
-* handler's `onError` (default `setReject`) bounces the message.
-*
-* SECURITY: the RPC carries the admin bearer, so the target function runs with
-* RLS bypassed over fully attacker-controlled, spoofable input — see the module
-* docstring. Verify the sender (`verify` hook / `email.authentication`) before
-* making any trust decision in the target function.
-*/
+ * Build a {@link InboundDispatch} that posts an {@link RpcEnvelope} to the root
+ * shard stub — the same admin-RPC-over-shard path the dev capture sink uses
+ * (`from-env.ts`) — routing the parsed message into a named Lunora
+ * mutation/action. Throws on a non-2xx RPC or a missing admin token so the
+ * handler's `onError` (default `setReject`) bounces the message.
+ *
+ * SECURITY: the RPC carries the admin bearer, so the target function runs with
+ * RLS bypassed over fully attacker-controlled, spoofable input — see the module
+ * docstring. Verify the sender (`verify` hook / `email.authentication`) before
+ * making any trust decision in the target function.
+ */
 declare const dispatchToLunoraFunction: <TEnv extends Record<string, unknown> = Record<string, unknown>>(options: DispatchToLunoraFunctionOptions<TEnv>) => InboundDispatch<TEnv>;
 export { type DispatchToLunoraFunctionOptions, type ForwardableEmailMessageLike, type InboundAttachment, type InboundAuthentication, type InboundDispatch, type InboundDispatchContext, type InboundEmail, type InboundEmailHandler, type InboundEmailHandlerOptions, type InboundVerify, type RawInboundEmail, type RpcEnvelope, type ShardNamespaceLike, createInboundEmailHandler, dispatchToLunoraFunction, parseInboundEmail };