@lunora/mail 1.0.0-alpha.61 → 1.0.0-alpha.63

package/dist/inbound/index.d.mts

@@ -193,8 +193,11 @@ type InboundDispatch<TEnv = Record<string, unknown>> = (email: InboundEmail, con
  * Opt-in sender-verification gate. Runs after `parse` and before `dispatch` with
  * the parsed message. Return `false` (or throw) to reject the message before it
  * reaches the privileged dispatch — use it to enforce DKIM/SPF/DMARC via
- * `email.authentication`, an allow-list, etc. Returning `true`/`undefined`
- * proceeds.
+ * `email.authentication`, an allow-list, etc.
+ *
+ * `true` and `undefined` are the ONLY answers that proceed — `undefined` so a
+ * `(): void` hook that rejects by throwing type-checks. Anything else is read as a
+ * rejection: this is the gate whose failure mode would otherwise grant.
  */
 type InboundVerify<TEnv = Record<string, unknown>> = (email: InboundEmail, context: InboundDispatchContext<TEnv>) => Promise<boolean | void> | boolean | void;
 /**
@@ -254,58 +257,6 @@ interface InboundEmailHandlerOptions<TEnv = Record<string, unknown>> {
 }
 /** The `email(message, env, ctx)` callback the factory returns. */
 type InboundEmailHandler<TEnv = Record<string, unknown>> = (message: ForwardableEmailMessageLike, env: TEnv, context: unknown) => Promise<void>;
-/**
- * Build the `email(message, env, ctx)` handler. It (a) reads `message.raw`,
- * (b) parses it via `parse`, (c) runs the optional `verify` gate, then
- * (d) calls `dispatch(parsed, { message, env, ctx })`.
- *
- * The two failure classes are routed differently:
- *
- * - `parse` / `verify` (including a falsy `verify`) → `onError` (default: a
- * generic `message.setReject`). A malformed or unauthenticated message fails
- * the same way on every redelivery, so bouncing it is the honest answer.
- * - `dispatch` (or its transport) → a custom `onError` is called for
- * observability, then the message is handed to `retain` if one is configured
- * (SMTP ACCEPTs — the retry is now owned elsewhere) and otherwise bounced with
- * the same generic reason. A `retain` that throws bounces too.
- *
- * WHY THE RETRY IS ABSORBED IN-WORKER RATHER THAN SIGNALLED OVER SMTP — there is
- * no transient-reject API and no inbound redelivery to appeal to:
- *
- * - `setReject` is documented as a PERMANENT SMTP error
- * (https://developers.cloudflare.com/email-routing/email-workers/runtime-api/),
- * with no "try later" variant.
- * - Cloudflare does not document what an uncaught throw from `email()` does. The
- * full Email Routing and Email Service docs corpora
- * (`developers.cloudflare.com/email-routing/llms-full.txt`,
- * `.../email-service/llms-full.txt`) say nothing about an unhandled exception,
- * and describe NO redelivery mechanism for inbound Email Workers at all. The
- * documented lifecycle
- * (https://developers.cloudflare.com/email-service/concepts/email-lifecycle/)
- * lists exactly three worker outcomes — `forward()`, `reply()`, `setReject()` —
- * with no branch for "the worker threw". (Its 4xx-retry prose is about OUTBOUND
- * delivery to the destination MTA, not about invoking the worker.)
- * - The behaviour reported in practice is a PERMANENT in-session rejection:
- * `521 5.3.0 Upstream error`, i.e. the same permanence as `setReject` but with
- * an opaque reason instead of ours. See
- * https://community.cloudflare.com/t/is-it-possible-to-return-a-transient-failure-from-an-email-worker/599938
- * ("If the email function raises an exception, a permanent failure is returned
- * to the client after the DATA command") — a question Cloudflare never answered
- * — and https://community.cloudflare.com/t/email-worker-upstream-error/457228.
- * Email Routing also states it forwards upstream SMTP errors back to the sender
- * in-session rather than generating a bounce later
- * (https://developers.cloudflare.com/email-service/reference/postmaster/#smtp-errors).
- *
- * So every SMTP-visible outcome is permanent, and the only way not to lose a
- * legitimate message to a two-second shard 502 is to accept it and take durable
- * ownership: that is `retain`. It stays opt-in — with no `retain`, a dispatch
- * failure bounces exactly as before.
- *
- * A dispatch that KNOWS one of its own failures is permanent should call
- * `context.message.setReject(...)` and return normally rather than throw, so it
- * bounces without being handed to `retain` (see `@lunora/agent`'s inbound
- * handler for both cases).
- */
 declare const createInboundEmailHandler: <TEnv = Record<string, unknown>>(options: InboundEmailHandlerOptions<TEnv>) => InboundEmailHandler<TEnv>;
 /** The `RpcEnvelope` shape the runtime's `/_lunora/rpc` path consumes. */
 interface RpcEnvelope {

package/dist/inbound/index.d.ts

@@ -193,8 +193,11 @@ type InboundDispatch<TEnv = Record<string, unknown>> = (email: InboundEmail, con
  * Opt-in sender-verification gate. Runs after `parse` and before `dispatch` with
  * the parsed message. Return `false` (or throw) to reject the message before it
  * reaches the privileged dispatch — use it to enforce DKIM/SPF/DMARC via
- * `email.authentication`, an allow-list, etc. Returning `true`/`undefined`
- * proceeds.
+ * `email.authentication`, an allow-list, etc.
+ *
+ * `true` and `undefined` are the ONLY answers that proceed — `undefined` so a
+ * `(): void` hook that rejects by throwing type-checks. Anything else is read as a
+ * rejection: this is the gate whose failure mode would otherwise grant.
  */
 type InboundVerify<TEnv = Record<string, unknown>> = (email: InboundEmail, context: InboundDispatchContext<TEnv>) => Promise<boolean | void> | boolean | void;
 /**
@@ -254,58 +257,6 @@ interface InboundEmailHandlerOptions<TEnv = Record<string, unknown>> {
 }
 /** The `email(message, env, ctx)` callback the factory returns. */
 type InboundEmailHandler<TEnv = Record<string, unknown>> = (message: ForwardableEmailMessageLike, env: TEnv, context: unknown) => Promise<void>;
-/**
- * Build the `email(message, env, ctx)` handler. It (a) reads `message.raw`,
- * (b) parses it via `parse`, (c) runs the optional `verify` gate, then
- * (d) calls `dispatch(parsed, { message, env, ctx })`.
- *
- * The two failure classes are routed differently:
- *
- * - `parse` / `verify` (including a falsy `verify`) → `onError` (default: a
- * generic `message.setReject`). A malformed or unauthenticated message fails
- * the same way on every redelivery, so bouncing it is the honest answer.
- * - `dispatch` (or its transport) → a custom `onError` is called for
- * observability, then the message is handed to `retain` if one is configured
- * (SMTP ACCEPTs — the retry is now owned elsewhere) and otherwise bounced with
- * the same generic reason. A `retain` that throws bounces too.
- *
- * WHY THE RETRY IS ABSORBED IN-WORKER RATHER THAN SIGNALLED OVER SMTP — there is
- * no transient-reject API and no inbound redelivery to appeal to:
- *
- * - `setReject` is documented as a PERMANENT SMTP error
- * (https://developers.cloudflare.com/email-routing/email-workers/runtime-api/),
- * with no "try later" variant.
- * - Cloudflare does not document what an uncaught throw from `email()` does. The
- * full Email Routing and Email Service docs corpora
- * (`developers.cloudflare.com/email-routing/llms-full.txt`,
- * `.../email-service/llms-full.txt`) say nothing about an unhandled exception,
- * and describe NO redelivery mechanism for inbound Email Workers at all. The
- * documented lifecycle
- * (https://developers.cloudflare.com/email-service/concepts/email-lifecycle/)
- * lists exactly three worker outcomes — `forward()`, `reply()`, `setReject()` —
- * with no branch for "the worker threw". (Its 4xx-retry prose is about OUTBOUND
- * delivery to the destination MTA, not about invoking the worker.)
- * - The behaviour reported in practice is a PERMANENT in-session rejection:
- * `521 5.3.0 Upstream error`, i.e. the same permanence as `setReject` but with
- * an opaque reason instead of ours. See
- * https://community.cloudflare.com/t/is-it-possible-to-return-a-transient-failure-from-an-email-worker/599938
- * ("If the email function raises an exception, a permanent failure is returned
- * to the client after the DATA command") — a question Cloudflare never answered
- * — and https://community.cloudflare.com/t/email-worker-upstream-error/457228.
- * Email Routing also states it forwards upstream SMTP errors back to the sender
- * in-session rather than generating a bounce later
- * (https://developers.cloudflare.com/email-service/reference/postmaster/#smtp-errors).
- *
- * So every SMTP-visible outcome is permanent, and the only way not to lose a
- * legitimate message to a two-second shard 502 is to accept it and take durable
- * ownership: that is `retain`. It stays opt-in — with no `retain`, a dispatch
- * failure bounces exactly as before.
- *
- * A dispatch that KNOWS one of its own failures is permanent should call
- * `context.message.setReject(...)` and return normally rather than throw, so it
- * bounces without being handed to `retain` (see `@lunora/agent`'s inbound
- * handler for both cases).
- */
 declare const createInboundEmailHandler: <TEnv = Record<string, unknown>>(options: InboundEmailHandlerOptions<TEnv>) => InboundEmailHandler<TEnv>;
 /** The `RpcEnvelope` shape the runtime's `/_lunora/rpc` path consumes. */
 interface RpcEnvelope {

package/dist/inbound/index.mjs

@@ -1 +1 @@
-import{createInboundEmailHandler as n,dispatchToLunoraFunction as r}from"../packem_shared/createInboundEmailHandler-vXSNL5mZ.mjs";import{authenticatesFrom as t,parseInboundEmail as i}from"../packem_shared/authenticatesFrom-xpKAFMRN.mjs";export{t as authenticatesFrom,n as createInboundEmailHandler,r as dispatchToLunoraFunction,i as parseInboundEmail};
+import{createInboundEmailHandler as n,dispatchToLunoraFunction as r}from"../packem_shared/createInboundEmailHandler-Bh10YPyJ.mjs";import{authenticatesFrom as t,parseInboundEmail as i}from"../packem_shared/authenticatesFrom-xpKAFMRN.mjs";export{t as authenticatesFrom,n as createInboundEmailHandler,r as dispatchToLunoraFunction,i as parseInboundEmail};

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { M as MailTransport, L as LunoraMailOptions, a as Mailer, b as MailboxSink, S as SendOptions } from "./packem_shared/capture-transport.d-8CDAv51Z.mjs";
-export { type C as CapturedMail, type Q as QueueLike, type c as SendPayload, d as createCaptureTransport } from "./packem_shared/capture-transport.d-8CDAv51Z.mjs";
+import { M as MailTransport, L as LunoraMailOptions, a as Mailer, b as MailboxSink, S as SendOptions } from "./packem_shared/capture-transport.d-BD67fxbB.mjs";
+export { type C as CapturedMail, type Q as QueueLike, type c as SendPayload, d as createCaptureTransport } from "./packem_shared/capture-transport.d-BD67fxbB.mjs";
 import { D as DurableObjectJurisdiction } from "./packem_shared/shard.d-DVADjmEJ.mjs";
 import { ReactElement } from 'react';
 /**
@@ -80,7 +80,7 @@ declare const shouldCaptureMail: (env: MailEnv) => boolean;
  * root-shard inbox via the reserved `recordMail` admin RPC — the same
  * worker→root-shard path the runtime uses for auth events. Best-effort: without
  * the `SHARD` binding or `LUNORA_ADMIN_TOKEN` it returns a sentinel id so a send
- * never fails for lack of somewhere to record.
+ * never fails for lack of somewhere to record — but it says so first (see below).
  */
 declare const createCaptureSink: (env: MailEnv, rootShard?: string, jurisdiction?: DurableObjectJurisdiction) => MailboxSink;
 /**
@@ -122,12 +122,33 @@ declare const toQueuedPayload: (options: SendOptions) => QueuedSend;
  * to a configured `Mailer.send()`. Use this inside your Worker's `queue()`
  * handler.
  *
+ * DEDUPE IS THE CONSUMER'S JOB, and this helper does not do it. The payload's
+ * `idempotencyKey` was minted once at enqueue time so it survives redelivery, but
+ * nothing downstream reads it: no transport forwards it to the provider (Resend
+ * dedupes on an `Idempotency-Key` REQUEST header, which the provider client offers
+ * no hook for — its `headers` field becomes message headers in the body). A
+ * consumer that only acks is correct for the failure the ack covers and sends a
+ * duplicate for the one it does not: the provider accepted the message and the
+ * worker died before acking.
+ *
+ * The recipe below NARROWS that window; it does not close it, and nothing on
+ * this path can. The mark is written after the provider accepted the message, so
+ * a crash in between still redelivers and resends, and a KV read is eventually
+ * consistent — a redelivery seconds later can miss a mark that was written.
+ * Delivery is at-least-once end to end. An app that must not double-send needs a
+ * strongly-consistent mark taken BEFORE the send (a Durable Object or D1 row
+ * claimed by this key, released on failure), and even then the send-then-crash
+ * window is only ever traded for a send-that-may-not-have-happened one.
+ *
  * ```ts
  * export default {
  *   queue: async (batch, env) => {
  *     const mailer = createMailer({ apiKey: env.RESEND_API_KEY, from: "..." });
  *     for (const message of batch.messages) {
+ *       const { idempotencyKey } = message.body;
+ *       if (await env.SENT.get(idempotencyKey)) { message.ack(); continue; }
  *       await consumeQueuedSend(mailer, message.body);
+ *       await env.SENT.put(idempotencyKey, "1", { expirationTtl: 86_400 });
  *       message.ack();
  *     }
  *   },

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { M as MailTransport, L as LunoraMailOptions, a as Mailer, b as MailboxSink, S as SendOptions } from "./packem_shared/capture-transport.d-8CDAv51Z.js";
-export { type C as CapturedMail, type Q as QueueLike, type c as SendPayload, d as createCaptureTransport } from "./packem_shared/capture-transport.d-8CDAv51Z.js";
+import { M as MailTransport, L as LunoraMailOptions, a as Mailer, b as MailboxSink, S as SendOptions } from "./packem_shared/capture-transport.d-BD67fxbB.js";
+export { type C as CapturedMail, type Q as QueueLike, type c as SendPayload, d as createCaptureTransport } from "./packem_shared/capture-transport.d-BD67fxbB.js";
 import { D as DurableObjectJurisdiction } from "./packem_shared/shard.d-DVADjmEJ.js";
 import { ReactElement } from 'react';
 /**
@@ -80,7 +80,7 @@ declare const shouldCaptureMail: (env: MailEnv) => boolean;
  * root-shard inbox via the reserved `recordMail` admin RPC — the same
  * worker→root-shard path the runtime uses for auth events. Best-effort: without
  * the `SHARD` binding or `LUNORA_ADMIN_TOKEN` it returns a sentinel id so a send
- * never fails for lack of somewhere to record.
+ * never fails for lack of somewhere to record — but it says so first (see below).
  */
 declare const createCaptureSink: (env: MailEnv, rootShard?: string, jurisdiction?: DurableObjectJurisdiction) => MailboxSink;
 /**
@@ -122,12 +122,33 @@ declare const toQueuedPayload: (options: SendOptions) => QueuedSend;
  * to a configured `Mailer.send()`. Use this inside your Worker's `queue()`
  * handler.
  *
+ * DEDUPE IS THE CONSUMER'S JOB, and this helper does not do it. The payload's
+ * `idempotencyKey` was minted once at enqueue time so it survives redelivery, but
+ * nothing downstream reads it: no transport forwards it to the provider (Resend
+ * dedupes on an `Idempotency-Key` REQUEST header, which the provider client offers
+ * no hook for — its `headers` field becomes message headers in the body). A
+ * consumer that only acks is correct for the failure the ack covers and sends a
+ * duplicate for the one it does not: the provider accepted the message and the
+ * worker died before acking.
+ *
+ * The recipe below NARROWS that window; it does not close it, and nothing on
+ * this path can. The mark is written after the provider accepted the message, so
+ * a crash in between still redelivers and resends, and a KV read is eventually
+ * consistent — a redelivery seconds later can miss a mark that was written.
+ * Delivery is at-least-once end to end. An app that must not double-send needs a
+ * strongly-consistent mark taken BEFORE the send (a Durable Object or D1 row
+ * claimed by this key, released on failure), and even then the send-then-crash
+ * window is only ever traded for a send-that-may-not-have-happened one.
+ *
  * ```ts
  * export default {
  *   queue: async (batch, env) => {
  *     const mailer = createMailer({ apiKey: env.RESEND_API_KEY, from: "..." });
  *     for (const message of batch.messages) {
+ *       const { idempotencyKey } = message.body;
+ *       if (await env.SENT.get(idempotencyKey)) { message.ack(); continue; }
  *       await consumeQueuedSend(mailer, message.body);
+ *       await env.SENT.put(idempotencyKey, "1", { expirationTtl: 86_400 });
  *       message.ack();
  *     }
  *   },

package/dist/index.mjs

@@ -1 +1 @@
-import{createCaptureTransport as a}from"./packem_shared/createCaptureTransport-CKc6NpZR.mjs";import{createCloudflareTransport as t}from"./packem_shared/createCloudflareTransport-DpfCxn16.mjs";import{default as u}from"./packem_shared/createMailer-CjQmT7Ln.mjs";import{createCaptureSink as f,createMailerFromEnv as l,shouldCaptureMail as m}from"./packem_shared/createCaptureSink-wbDNGuA-.mjs";import{consumeQueuedSend as s,toQueuedPayload as c}from"./packem_shared/consumeQueuedSend-CRfALnCU.mjs";import{default as i}from"./packem_shared/renderEmail-BOUnr6i3.mjs";import{default as M}from"./packem_shared/createResendTransport-DDkOitck.mjs";export{s as consumeQueuedSend,f as createCaptureSink,a as createCaptureTransport,t as createCloudflareTransport,u as createMailer,l as createMailerFromEnv,M as createResendTransport,i as renderEmail,m as shouldCaptureMail,c as toQueuedPayload};
+import{createCaptureTransport as a}from"./packem_shared/createCaptureTransport-CKc6NpZR.mjs";import{createCloudflareTransport as t}from"./packem_shared/createCloudflareTransport-DpfCxn16.mjs";import{default as u}from"./packem_shared/createMailer-CjQmT7Ln.mjs";import{createCaptureSink as f,createMailerFromEnv as l,shouldCaptureMail as m}from"./packem_shared/createCaptureSink-CeV0DSsT.mjs";import{consumeQueuedSend as s,toQueuedPayload as c}from"./packem_shared/consumeQueuedSend-CRfALnCU.mjs";import{default as i}from"./packem_shared/renderEmail-BOUnr6i3.mjs";import{default as M}from"./packem_shared/createResendTransport-DDkOitck.mjs";export{s as consumeQueuedSend,f as createCaptureSink,a as createCaptureTransport,t as createCloudflareTransport,u as createMailer,l as createMailerFromEnv,M as createResendTransport,i as renderEmail,m as shouldCaptureMail,c as toQueuedPayload};

package/dist/packem_shared/{capture-transport.d-8CDAv51Z.d.mts → capture-transport.d-BD67fxbB.d.mts}

@@ -39,8 +39,12 @@ interface SendOptions {
    * redelivery. Only meaningful for `mailer.queue()` — `mailer.send()` ignores it.
    * When omitted, `queue()` generates one at enqueue time so it survives redelivery
    * (a key minted in the consumer would change on every retry, defeating the point).
-   * Not forwarded to the mail provider — a consumer wanting exactly-once delivery
-   * must dedupe against its own store using this key.
+   * Not forwarded to the mail provider, and no transport can: Resend dedupes on an
+   * `Idempotency-Key` REQUEST header, and the provider client exposes no hook for
+   * one (its own `headers` field becomes message headers in the JSON body). So a
+   * consumer that wants to collapse redeliveries MUST dedupe against its own store
+   * using this key — see `consumeQueuedSend` for the shape, and for why that is a
+   * narrowed at-least-once rather than exactly-once.
    */
   idempotencyKey?: string;
   react?: ReactElement;

package/dist/packem_shared/{capture-transport.d-8CDAv51Z.d.ts → capture-transport.d-BD67fxbB.d.ts}

@@ -39,8 +39,12 @@ interface SendOptions {
    * redelivery. Only meaningful for `mailer.queue()` — `mailer.send()` ignores it.
    * When omitted, `queue()` generates one at enqueue time so it survives redelivery
    * (a key minted in the consumer would change on every retry, defeating the point).
-   * Not forwarded to the mail provider — a consumer wanting exactly-once delivery
-   * must dedupe against its own store using this key.
+   * Not forwarded to the mail provider, and no transport can: Resend dedupes on an
+   * `Idempotency-Key` REQUEST header, and the provider client exposes no hook for
+   * one (its own `headers` field becomes message headers in the JSON body). So a
+   * consumer that wants to collapse redeliveries MUST dedupe against its own store
+   * using this key — see `consumeQueuedSend` for the shape, and for why that is a
+   * narrowed at-least-once rather than exactly-once.
    */
   idempotencyKey?: string;
   react?: ReactElement;

package/dist/packem_shared/createCaptureSink-CeV0DSsT.mjs

@@ -0,0 +1 @@
+import{createCaptureTransport as l}from"./createCaptureTransport-CKc6NpZR.mjs";import"./createCloudflareTransport-DpfCxn16.mjs";import n from"./createMailer-CjQmT7Ln.mjs";import{LunoraError as u}from"@lunora/errors";import{D as c,p as E}from"./shard-CRhAKK93.mjs";import"./consumeQueuedSend-CRfALnCU.mjs";import"./renderEmail-BOUnr6i3.mjs";import"./createResendTransport-DDkOitck.mjs";const p="__lunora_admin__:recordMail",N=/^(?:dev(?:elopment)?|local(?:host)?|test)$/iu,_=["CF_ENV","ENVIRONMENT","NODE_ENV","WORKER_ENV"],f=(e,t)=>{const r=e[t];if(typeof r!="string"||r==="")throw new u("INTERNAL",`@lunora/mail: missing env var \`${t}\` — set it in .dev.vars (and \`wrangler secret put ${t}\` for secrets).`);return r},m=e=>{const t=e.LUNORA_MAIL_CAPTURE;if(typeof t=="string"){const r=t.toLowerCase();if(r==="1"||r==="true")return!0;if(r==="0"||r==="false")return!1;console.warn(`@lunora/mail: unrecognized LUNORA_MAIL_CAPTURE value "${t}" — expected "1"/"true" or "0"/"false"; falling back to environment detection.`)}return _.some(r=>{const o=e[r];return typeof o=="string"&&N.test(o)})};let d=!1;const A=(e,t=c,r)=>({record:async o=>{const i=e.SHARD,a=typeof e.LUNORA_ADMIN_TOKEN=="string"?e.LUNORA_ADMIN_TOKEN:void 0;if(i===void 0||a===void 0)return d||(d=!0,console.warn("@lunora/mail: capturing mail but there is nowhere to record it — the `SHARD` binding and/or `LUNORA_ADMIN_TOKEN` is missing, so every captured message is discarded. Set both to see mail in the studio inbox, or set LUNORA_MAIL_CAPTURE=0 to deliver for real.")),{id:"uncaptured"};try{return{id:(await E(i,{adminToken:a,envelope:{args:o,functionPath:p},jurisdiction:r,label:"@lunora/mail: recording captured mail",shardKey:t})).result?.id??"captured"}}catch(s){return console.error("@lunora/mail: failed to record captured mail into the studio inbox —",s),{id:"uncaptured"}}}}),h=(e,t={})=>{const r=f(e,"MAIL_FROM");if(m(e))return n({from:r,transport:l(A(e,t.rootShard,t.jurisdiction))});if(t.cloudflareSend)return n({cloudflareSend:t.cloudflareSend,from:r});const o=typeof e.RESEND_API_KEY=="string"?e.RESEND_API_KEY:void 0;if(o!==void 0&&o!=="")return n({apiKey:o,from:r});throw new u("INTERNAL","@lunora/mail: no transport configured — provide `cloudflareSend` (a SEND_EMAIL binding) or RESEND_API_KEY, or run in a dev environment to capture.")};export{A as createCaptureSink,h as createMailerFromEnv,m as shouldCaptureMail};

package/dist/packem_shared/createInboundEmailHandler-Bh10YPyJ.mjs

@@ -0,0 +1 @@
+import{LunoraError as d}from"@lunora/errors";import{D as h,p as l}from"./shard-CRhAKK93.mjs";const f=r=>{let n="";for(let e=0;e<r.length;e+=32768)n+=String.fromCharCode(...r.subarray(e,e+32768));return btoa(n)},E="message could not be processed",u=(r,n)=>{console.error("@lunora/mail/inbound: dropping message —",r),n.message.setReject(E)},m=r=>r===!0||r===void 0,A=r=>{const n=r.onError??u;return async(t,e,c)=>{const a={ctx:c,env:e,message:t};let i;try{if(i=await r.parse(t.raw),r.verify){const o=await r.verify(i,a);if(!m(o))throw new d("INTERNAL","@lunora/mail/inbound: sender verification rejected the message")}}catch(o){await n(o,a);return}try{await r.dispatch(i,a)}catch(o){if(r.onError)try{await r.onError(o,a)}catch(s){console.error("@lunora/mail/inbound: onError threw while reporting a dispatch failure —",s)}if(r.retain)try{await r.retain(i,a,o);return}catch(s){console.error("@lunora/mail/inbound: retain failed to take ownership of the message —",s)}u(o,a)}}},y=r=>r.attachments.length===0?r:{...r,attachments:r.attachments.map(n=>{const{content:t}=n;if(typeof t=="string")return n;const e=t instanceof Uint8Array?t:new Uint8Array(t);return{...n,content:f(e),encoding:"base64"}})},N=r=>{const n=r.shardKey??h,t=r.resolveArgs??(e=>y(e));return async(e,c)=>{const a=r.adminToken??(typeof c.env.LUNORA_ADMIN_TOKEN=="string"?c.env.LUNORA_ADMIN_TOKEN:void 0);if(a===void 0||a==="")throw new d("INTERNAL","@lunora/mail/inbound: missing LUNORA_ADMIN_TOKEN — cannot authorize inbound dispatch to the shard RPC.");const i={args:t(e,c),functionPath:r.functionPath,shardKey:n};await l(r.shard,{adminToken:a,envelope:i,jurisdiction:r.jurisdiction,label:`@lunora/mail/inbound: dispatch to \`${r.functionPath}\``,shardKey:n})}};export{A as createInboundEmailHandler,N as dispatchToLunoraFunction};

package/dist/testing.d.mts

@@ -1,4 +1,4 @@
-import { C as CapturedMail } from "./packem_shared/capture-transport.d-8CDAv51Z.mjs";
+import { C as CapturedMail } from "./packem_shared/capture-transport.d-BD67fxbB.mjs";
 import 'react';
 /** Minimal `fetch` projection so a test can inject a stub. */
 type FetchLike = (input: string, init?: {

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { C as CapturedMail } from "./packem_shared/capture-transport.d-8CDAv51Z.js";
+import { C as CapturedMail } from "./packem_shared/capture-transport.d-BD67fxbB.js";
 import 'react';
 /** Minimal `fetch` projection so a test can inject a stub. */
 type FetchLike = (input: string, init?: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/mail",
-  "version": "1.0.0-alpha.61",
+  "version": "1.0.0-alpha.63",
   "description": "Email for Lunora: Resend adapter, TSX templates, and queue-backed sends",
   "keywords": [
     "cloudflare",
@@ -54,7 +54,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.30",
+    "@lunora/errors": "1.0.0-alpha.31",
     "@react-email/render": "2.1.0",
     "@visulima/email": "2.1.8",
     "postal-mime": "2.7.6"

package/dist/packem_shared/createCaptureSink-wbDNGuA-.mjs

@@ -1 +0,0 @@
-import{createCaptureTransport as d}from"./createCaptureTransport-CKc6NpZR.mjs";import"./createCloudflareTransport-DpfCxn16.mjs";import n from"./createMailer-CjQmT7Ln.mjs";import{LunoraError as c}from"@lunora/errors";import{D as s,p as l}from"./shard-CRhAKK93.mjs";import"./consumeQueuedSend-CRfALnCU.mjs";import"./renderEmail-BOUnr6i3.mjs";import"./createResendTransport-DDkOitck.mjs";const E="__lunora_admin__:recordMail",p=/^(?:dev(?:elopment)?|local(?:host)?|test)$/iu,f=["CF_ENV","ENVIRONMENT","NODE_ENV","WORKER_ENV"],_=(t,e)=>{const r=t[e];if(typeof r!="string"||r==="")throw new c("INTERNAL",`@lunora/mail: missing env var \`${e}\` — set it in .dev.vars (and \`wrangler secret put ${e}\` for secrets).`);return r},N=t=>{const e=t.LUNORA_MAIL_CAPTURE;if(typeof e=="string"){const r=e.toLowerCase();if(r==="1"||r==="true")return!0;if(r==="0"||r==="false")return!1;console.warn(`@lunora/mail: unrecognized LUNORA_MAIL_CAPTURE value "${e}" — expected "1"/"true" or "0"/"false"; falling back to environment detection.`)}return f.some(r=>{const o=t[r];return typeof o=="string"&&p.test(o)})},m=(t,e=s,r)=>({record:async o=>{const i=t.SHARD,a=typeof t.LUNORA_ADMIN_TOKEN=="string"?t.LUNORA_ADMIN_TOKEN:void 0;if(i===void 0||a===void 0)return{id:"uncaptured"};try{return{id:(await l(i,{adminToken:a,envelope:{args:o,functionPath:E},jurisdiction:r,label:"@lunora/mail: recording captured mail",shardKey:e})).result?.id??"captured"}}catch(u){return console.error("@lunora/mail: failed to record captured mail into the studio inbox —",u),{id:"uncaptured"}}}}),L=(t,e={})=>{const r=_(t,"MAIL_FROM");if(N(t))return n({from:r,transport:d(m(t,e.rootShard,e.jurisdiction))});if(e.cloudflareSend)return n({cloudflareSend:e.cloudflareSend,from:r});const o=typeof t.RESEND_API_KEY=="string"?t.RESEND_API_KEY:void 0;if(o!==void 0&&o!=="")return n({apiKey:o,from:r});throw new c("INTERNAL","@lunora/mail: no transport configured — provide `cloudflareSend` (a SEND_EMAIL binding) or RESEND_API_KEY, or run in a dev environment to capture.")};export{m as createCaptureSink,L as createMailerFromEnv,N as shouldCaptureMail};

package/dist/packem_shared/createInboundEmailHandler-vXSNL5mZ.mjs

@@ -1 +0,0 @@
-import{LunoraError as d}from"@lunora/errors";import{D as h,p as l}from"./shard-CRhAKK93.mjs";const f=r=>{let n="";for(let e=0;e<r.length;e+=32768)n+=String.fromCharCode(...r.subarray(e,e+32768));return btoa(n)},E="message could not be processed",u=(r,n)=>{console.error("@lunora/mail/inbound: dropping message —",r),n.message.setReject(E)},y=r=>{const n=r.onError??u;return async(t,e,c)=>{const a={ctx:c,env:e,message:t};let o;try{if(o=await r.parse(t.raw),r.verify&&await r.verify(o,a)===!1)throw new d("INTERNAL","@lunora/mail/inbound: sender verification rejected the message")}catch(i){await n(i,a);return}try{await r.dispatch(o,a)}catch(i){if(r.onError)try{await r.onError(i,a)}catch(s){console.error("@lunora/mail/inbound: onError threw while reporting a dispatch failure —",s)}if(r.retain)try{await r.retain(o,a,i);return}catch(s){console.error("@lunora/mail/inbound: retain failed to take ownership of the message —",s)}u(i,a)}}},m=r=>r.attachments.length===0?r:{...r,attachments:r.attachments.map(n=>{const{content:t}=n;if(typeof t=="string")return n;const e=t instanceof Uint8Array?t:new Uint8Array(t);return{...n,content:f(e),encoding:"base64"}})},A=r=>{const n=r.shardKey??h,t=r.resolveArgs??(e=>m(e));return async(e,c)=>{const a=r.adminToken??(typeof c.env.LUNORA_ADMIN_TOKEN=="string"?c.env.LUNORA_ADMIN_TOKEN:void 0);if(a===void 0||a==="")throw new d("INTERNAL","@lunora/mail/inbound: missing LUNORA_ADMIN_TOKEN — cannot authorize inbound dispatch to the shard RPC.");const o={args:t(e,c),functionPath:r.functionPath,shardKey:n};await l(r.shard,{adminToken:a,envelope:o,jurisdiction:r.jurisdiction,label:`@lunora/mail/inbound: dispatch to \`${r.functionPath}\``,shardKey:n})}};export{y as createInboundEmailHandler,A as dispatchToLunoraFunction};