@lunora/mail 1.0.0-alpha.4 → 1.0.0-alpha.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.mts +17 -0
- package/dist/index.d.ts +17 -0
- package/package.json +1 -1
package/dist/index.d.mts
CHANGED
|
@@ -34,6 +34,23 @@ interface CloudflareTransportOptions {
|
|
|
34
34
|
* verified-address constraint never bites the dev loop.
|
|
35
35
|
*/
|
|
36
36
|
declare const createCloudflareTransport: (options: CloudflareTransportOptions) => MailTransport;
|
|
37
|
+
/**
|
|
38
|
+
* Create a mailer bound to a transport.
|
|
39
|
+
*
|
|
40
|
+
* SECURITY — recipient policy and HTML content are the caller's responsibility.
|
|
41
|
+
* The mailer fully blocks header/CRLF/comma injection in addresses
|
|
42
|
+
* (`assertSafeAddresses` / `assertSafeHeaderValue`), but it does NOT decide WHO
|
|
43
|
+
* you may send to or WHAT HTML you render.
|
|
44
|
+
*
|
|
45
|
+
* Open relay: derive `to`/`cc`/`bcc` from server-trusted state, never from raw
|
|
46
|
+
* request input, and prefer a fixed/allowlisted `from` — sending to an arbitrary
|
|
47
|
+
* user-supplied address turns your deployment into a spam relay.
|
|
48
|
+
*
|
|
49
|
+
* Template XSS / content injection: treat template HTML like any other HTML sink
|
|
50
|
+
* — never interpolate untrusted data into raw markup (or a
|
|
51
|
+
* `dangerouslySetInnerHTML`-style template) without escaping. The mailer sends
|
|
52
|
+
* whatever HTML you hand it verbatim.
|
|
53
|
+
*/
|
|
37
54
|
declare const createMailer: (options: LunoraMailOptions) => Mailer;
|
|
38
55
|
/** A Worker `env` projected as a plain record (vars, secrets, and bindings are `unknown`-valued). */
|
|
39
56
|
type MailEnv = Record<string, unknown>;
|
package/dist/index.d.ts
CHANGED
|
@@ -34,6 +34,23 @@ interface CloudflareTransportOptions {
|
|
|
34
34
|
* verified-address constraint never bites the dev loop.
|
|
35
35
|
*/
|
|
36
36
|
declare const createCloudflareTransport: (options: CloudflareTransportOptions) => MailTransport;
|
|
37
|
+
/**
|
|
38
|
+
* Create a mailer bound to a transport.
|
|
39
|
+
*
|
|
40
|
+
* SECURITY — recipient policy and HTML content are the caller's responsibility.
|
|
41
|
+
* The mailer fully blocks header/CRLF/comma injection in addresses
|
|
42
|
+
* (`assertSafeAddresses` / `assertSafeHeaderValue`), but it does NOT decide WHO
|
|
43
|
+
* you may send to or WHAT HTML you render.
|
|
44
|
+
*
|
|
45
|
+
* Open relay: derive `to`/`cc`/`bcc` from server-trusted state, never from raw
|
|
46
|
+
* request input, and prefer a fixed/allowlisted `from` — sending to an arbitrary
|
|
47
|
+
* user-supplied address turns your deployment into a spam relay.
|
|
48
|
+
*
|
|
49
|
+
* Template XSS / content injection: treat template HTML like any other HTML sink
|
|
50
|
+
* — never interpolate untrusted data into raw markup (or a
|
|
51
|
+
* `dangerouslySetInnerHTML`-style template) without escaping. The mailer sends
|
|
52
|
+
* whatever HTML you hand it verbatim.
|
|
53
|
+
*/
|
|
37
54
|
declare const createMailer: (options: LunoraMailOptions) => Mailer;
|
|
38
55
|
/** A Worker `env` projected as a plain record (vars, secrets, and bindings are `unknown`-valued). */
|
|
39
56
|
type MailEnv = Record<string, unknown>;
|