@lunora/mail 1.0.0-alpha.8 → 1.0.0-alpha.81

package/dist/inbound/index.d.mts

@@ -1,5 +1,5 @@
-import { D as DurableObjectJurisdiction, S as ShardNamespaceLike } from "../packem_shared/shard.d-CL2Lmliv.mjs";
-export type { a as ShardStubLike } from "../packem_shared/shard.d-CL2Lmliv.mjs";
+import { D as DurableObjectJurisdiction, S as ShardNamespaceLike } from "../packem_shared/shard.d-DVADjmEJ.mjs";
+export type { a as ShardStubLike } from "../packem_shared/shard.d-DVADjmEJ.mjs";
 /** A raw RFC 822 message as accepted by the parser. */
 type RawInboundEmail = ArrayBuffer | ReadableStream<Uint8Array> | string | Uint8Array;
 /** One parsed attachment. `content` is preserved as the parser decoded it. */
@@ -15,34 +15,79 @@ interface InboundAttachment {
   /** Declared MIME type (e.g. `image/png`). */
   mimeType: string;
 }
+/** One reported `method=result [ptype.property=value]` clause of an `Authentication-Results` header. */
+interface InboundAuthResult {
+  /**
+   * The identifier the result is about, lowercased — DKIM's signing domain
+   * (`header.d=`), SPF's envelope `MAIL FROM` domain (`smtp.mailfrom=`, local
+   * part dropped) or DMARC's `header.from=`. `null` when the clause reported
+   * none, in which case it cannot be aligned and vouches for nothing.
+   */
+  domain: string | null;
+  /** The result token, lowercased (`"pass"`, `"fail"`, `"none"`, …). */
+  result: string;
+}
 /**
-* Sender-authentication verdicts pulled from the `Authentication-Results` header
-* the receiving MX (e.g. Cloudflare Email Routing) stamped on the message.
-*
-* SECURITY: Cloudflare Email Routing authenticates only the *recipient* domain,
-* **not** the sender. The envelope `from` and message content are trivially
-* spoofable, so a downstream handler MUST NOT make trust/authorization decisions
-* on `email.from` alone — gate on these verdicts (or your own policy) instead.
-* Verdicts are best-effort: when the receiving MX did not stamp an
-* `Authentication-Results` header, every field is `null` ("unknown").
-*/
+ * Sender-authentication verdicts pulled from the `Authentication-Results` header
+ * the receiving MX (e.g. Cloudflare Email Routing) stamped on the message.
+ *
+ * SECURITY: Cloudflare Email Routing authenticates only the *recipient* domain,
+ * **not** the sender. The envelope `from` and message content are trivially
+ * spoofable, so a downstream handler MUST NOT make trust/authorization decisions
+ * on `email.from` alone — gate on these verdicts (or your own policy) instead.
+ * Verdicts are best-effort: when the receiving MX did not stamp an
+ * `Authentication-Results` header, every list is empty ("unknown").
+ *
+ * Each method holds a LIST, because RFC 8601 lets one header report the same
+ * method more than once and real mail does. An ESP-relayed message carries two
+ * DKIM signatures — the relay's and the author domain's — and the MX stamps a
+ * clause per signature in whatever order it verified them. Keeping only the
+ * first threw the aligned one away whenever it was not the one that happened to
+ * come first, and the message was rejected as unauthenticated. A consumer
+ * therefore asks "does ANY reported clause pass and align?", not "did the first
+ * one?".
+ *
+ * SECURITY: a bare `"pass"` is NOT proof the `From` header is genuine. SPF
+ * authenticates the envelope `MAIL FROM` domain and DKIM the signing domain
+ * (`d=`), and an attacker controls both — `spf=pass smtp.mailfrom=evil.example;
+ * dkim=pass header.d=evil.example` is routine for a message whose `From` says
+ * `ceo@victim.example`. Each verdict therefore carries the identifier it is
+ * about ({@link InboundAuthResult.domain}): an SPF or DKIM pass only vouches for
+ * `from` when that domain equals the `From` address's domain (RFC 7489 strict
+ * alignment). Only a DMARC pass already checked alignment for you. A pass with
+ * no identifier reported cannot be aligned and must be treated as
+ * unauthenticated.
+ *
+ * SECURITY: verdicts are read from the **first/topmost** `Authentication-Results`
+ * header in document order. The receiving MX prepends its own genuine header per
+ * RFC 8601, so the topmost occurrence is the trustworthy one; any lower
+ * occurrences (which an untrusted sender can inject into the raw message) are
+ * ignored. As defense-in-depth a consumer may additionally verify the topmost
+ * header's `authserv-id` matches its receiving MX (e.g. Cloudflare) — that needs
+ * config this runtime-agnostic parser does not carry, so it is left to the host.
+ */
 interface InboundAuthentication {
-  /** DKIM verdict (`"pass"`/`"fail"`/…), or `null` when not reported. */
-  dkim: string | null;
-  /** DMARC verdict (`"pass"`/`"fail"`/…), or `null` when not reported. */
-  dmarc: string | null;
-  /** SPF verdict (`"pass"`/`"fail"`/…), or `null` when not reported. */
-  spf: string | null;
+  /** Every DKIM clause the header reported, in header order; empty when the method was not reported. */
+  dkim: InboundAuthResult[];
+  /** Every DMARC clause the header reported, in header order; empty when the method was not reported. */
+  dmarc: InboundAuthResult[];
+  /** Every SPF clause the header reported, in header order; empty when the method was not reported. */
+  spf: InboundAuthResult[];
 }
 /** Normalised, transport-agnostic view of a received message. */
 interface InboundEmail {
   /** Decoded attachments (empty array when none). */
   attachments: InboundAttachment[];
   /**
-  * Sender-authentication verdicts (DKIM/SPF/DMARC) parsed from the receiving
-  * MX's `Authentication-Results` header. SECURITY: see {@link InboundAuthentication}
-  * — `from` is spoofable; gate trust on these verdicts, not on `from`.
-  */
+   * Sender-authentication verdicts (DKIM/SPF/DMARC) and the domain each is
+   * about, parsed from the receiving MX's **first/topmost**
+   * `Authentication-Results` header. SECURITY: see
+   * {@link InboundAuthentication} — `from` is spoofable, and an SPF/DKIM pass
+   * vouches for it only when that clause's `domain` equals the `From` domain (a
+   * DMARC pass checked that already). Reading the raw `headers["authentication-results"]`
+   * map instead exposes last-wins (a lower, potentially attacker-injected)
+   * value — trust `authentication`, not the raw map.
+   */
   authentication: InboundAuthentication;
   /** Sender mailbox (`from`), CR/LF-checked. Empty string when the message omitted it. SECURITY: spoofable — do not trust for authorization. */
   from: string;
@@ -64,17 +109,48 @@ interface InboundEmail {
   to: string[];
 }
 /**
-* Parse a raw RFC 822 message into a normalised {@link InboundEmail}. Accepts the
-* shapes a Cloudflare Email Worker can hand off — `ReadableStream`, `ArrayBuffer`,
-* `Uint8Array`, or a decoded string.
-*/
+ * Parse a raw RFC 822 message into a normalised {@link InboundEmail}. Accepts the
+ * shapes a Cloudflare Email Worker can hand off — `ReadableStream`, `ArrayBuffer`,
+ * `Uint8Array`, or a decoded string.
+ */
 declare const parseInboundEmail: (raw: RawInboundEmail) => Promise<InboundEmail>;
 /**
-* Structural projection of Cloudflare's `ForwardableEmailMessage` (verified
-* against `@cloudflare/workers-types`' `ForwardableEmailMessage`). Only the
-* members the handler touches are modelled, so the host can pass the real
-* runtime object without `@lunora/mail` importing `cloudflare:email`.
-*/
+ * THE inbound sender-authentication gate: does the receiving MX vouch for this
+ * message's `From` domain? Pass it as the `verify` hook of
+ * `createInboundEmailHandler` (or call it from your own) — it is one exported
+ * helper precisely so the insecure variants cannot be hand-rolled again.
+ *
+ * True when ANY reported DMARC, SPF or DKIM clause both **passes** and names a
+ * `domain` equal to the `From` address's domain. False otherwise — including for
+ * an empty verdict list (the MX stamped no `Authentication-Results` header at
+ * all, which is "unknown", not "fine") and for a `From` with no single mailbox
+ * to align against.
+ *
+ * SECURITY — the two halves are each load-bearing.
+ *
+ * **Alignment.** A bare `pass` proves nothing about `From`. SPF authenticates the
+ * envelope `MAIL FROM` domain and DKIM the signing `d=`, both attacker-chosen, so
+ * `spf=pass`+`dkim=pass` for `evil.example` is routine on a message whose `From`
+ * says `ceo@victim.example`. Only a clause whose own `domain` equals the `From`
+ * domain vouches for it. Alignment is STRICT (RFC 7489): there is no
+ * public-suffix list here, so `mail.example.com` does not vouch for
+ * `example.com`. A pass reporting no domain (`null`) cannot be aligned and is
+ * rejected. A DMARC pass already checked alignment at the MX.
+ *
+ * **Every clause, not the first.** One header legitimately reports a method more
+ * than once (an ESP-relayed message is DKIM-signed by both the relay and the
+ * author domain), and the aligned clause is not reliably the first, so reading
+ * only the first bounced fully authenticated mail. "Any clause passes AND aligns"
+ * stays strictly narrower than a bare pass: a clause vouching for some other
+ * domain contributes nothing.
+ */
+declare const authenticatesFrom: (email: InboundEmail) => boolean;
+/**
+ * Structural projection of Cloudflare's `ForwardableEmailMessage` (verified
+ * against `@cloudflare/workers-types`' `ForwardableEmailMessage`). Only the
+ * members the handler touches are modelled, so the host can pass the real
+ * runtime object without `@lunora/mail` importing `cloudflare:email`.
+ */
 interface ForwardableEmailMessageLike {
   /** Forward this message to a verified destination address. */
   forward: (rcptTo: string, headers?: Headers) => Promise<unknown>;
@@ -90,7 +166,14 @@ interface ForwardableEmailMessageLike {
     raw: string;
     to: string;
   }) => Promise<unknown>;
-  /** Reject the message with a permanent SMTP error (Cloudflare bounces/retries). */
+  /**
+   * Reject the message with a PERMANENT SMTP error — Cloudflare returns it to
+   * the connecting client with this reason, and it is never redelivered.
+   * Documented at https://developers.cloudflare.com/email-routing/email-workers/runtime-api/
+   * ("Reject this email message by returning a permanent SMTP error back to
+   * the connecting client, including the given reason") and mirrored in
+   * workerd's own `types/defines/email.d.ts`.
+   */
   setReject: (reason: string) => void;
   /** Envelope `To`. */
   readonly to: string;
@@ -107,43 +190,73 @@ interface InboundDispatchContext<TEnv = Record<string, unknown>> {
 /** Routes a parsed message into a Lunora function (or anywhere). */
 type InboundDispatch<TEnv = Record<string, unknown>> = (email: InboundEmail, context: InboundDispatchContext<TEnv>) => Promise<void>;
 /**
-* Opt-in sender-verification gate. Runs after `parse` and before `dispatch` with
-* the parsed message. Return `false` (or throw) to reject the message before it
-* reaches the privileged dispatch — use it to enforce DKIM/SPF/DMARC via
-* `email.authentication`, an allow-list, etc. Returning `true`/`undefined`
-* proceeds.
-*/
+ * Opt-in sender-verification gate. Runs after `parse` and before `dispatch` with
+ * the parsed message. Return `false` (or throw) to reject the message before it
+ * reaches the privileged dispatch — use it to enforce DKIM/SPF/DMARC via
+ * `email.authentication`, an allow-list, etc.
+ *
+ * `true` and `undefined` are the ONLY answers that proceed — `undefined` so a
+ * `(): void` hook that rejects by throwing type-checks. Anything else is read as a
+ * rejection: this is the gate whose failure mode would otherwise grant.
+ */
 type InboundVerify<TEnv = Record<string, unknown>> = (email: InboundEmail, context: InboundDispatchContext<TEnv>) => Promise<boolean | void> | boolean | void;
+/**
+ * Opt-in durable sink for a failed `dispatch`. Hand the parsed message to
+ * something that owns the retry — a queue producer, a Durable Object, an alarm
+ * — and the handler ACCEPTS the SMTP session instead of bouncing, because the
+ * message is now owned rather than lost. Returning normally means "I have it";
+ * throwing means the hand-off itself failed and the message bounces with the
+ * generic reason (see {@link createInboundEmailHandler}).
+ *
+ * `error` is the dispatch failure, for classification/logging by the sink.
+ *
+ * NOTE: binary attachment `content` is an `ArrayBuffer`/`Uint8Array`, which
+ * survives structured clone (Cloudflare Queues, DO storage) but is corrupted by
+ * `JSON.stringify` — encode it yourself if the sink is JSON-bodied.
+ */
+type InboundRetain<TEnv = Record<string, unknown>> = (email: InboundEmail, context: InboundDispatchContext<TEnv>, error: unknown) => Promise<void> | void;
 /** Options for {@link createInboundEmailHandler}. */
 interface InboundEmailHandlerOptions<TEnv = Record<string, unknown>> {
   /** Routes the parsed message onward (e.g. {@link dispatchToLunoraFunction}). */
   dispatch: InboundDispatch<TEnv>;
   /**
-  * Called when `parse`/`verify`/`dispatch` throws. The default rejects the
-  * message via `message.setReject` so Cloudflare bounces/retries rather than
-  * silently dropping it. SECURITY: the reject reason is delivered to the
-  * (attacker-controlled) sender as a bounce, so the default reason is a fixed,
-  * generic string and the real error is logged server-side. Override to log,
-  * forward, or swallow — but never pass internal error text to `setReject`.
-  */
+   * Called when `parse`, `verify`, or `dispatch` fails — but with two DIFFERENT
+   * contracts, because only the first two decide the message's fate here:
+   *
+   * - `parse` / `verify` — this hook DECIDES the outcome. The default
+   * ({@link rejectOnError}) rejects via `message.setReject`; supplying your own
+   * replaces that, so the message is accepted unless you reject it yourself.
+   * - `dispatch` — this hook is OBSERVABILITY ONLY. It is called for the side
+   * effect (log, alert, forward) and the outcome is then decided by `retain`
+   * (accept) or a generic reject, regardless of what it does; the built-in
+   * default is deliberately NOT applied there. A `setReject` from inside it
+   * still takes effect, which would bounce a message `retain` went on to
+   * accept — almost certainly not what you want. A throw from the hook itself
+   * is logged and swallowed so it cannot mask the original dispatch error.
+   *
+   * SECURITY: a reject reason is delivered to the (attacker-controlled) sender
+   * as a bounce, so the default reason is a fixed, generic string and the real
+   * error is logged server-side. Never pass internal error text to `setReject`.
+   */
   onError?: (error: unknown, context: InboundDispatchContext<TEnv>) => Promise<void> | void;
   /** Parses raw bytes into an {@link InboundEmail} (e.g. `parseInboundEmail`). */
   parse: (raw: RawInboundEmail) => Promise<InboundEmail>;
   /**
-  * Opt-in sender-authentication gate run before `dispatch`. SECURITY: inbound
-  * `from` is spoofable and dispatch is privileged — supply this (gating on
-  * `email.authentication`) when an inbound function makes any trust decision.
-  */
+   * Opt-in: take durable ownership of a message whose `dispatch` failed, so a
+   * transient fault (a shard 502, a briefly-absent admin token) is retried
+   * instead of bounced. Omit it and a dispatch failure bounces, as it always
+   * has. See {@link InboundRetain}.
+   */
+  retain?: InboundRetain<TEnv>;
+  /**
+   * Opt-in sender-authentication gate run before `dispatch`. SECURITY: inbound
+   * `from` is spoofable and dispatch is privileged — supply this (gating on
+   * `email.authentication`) when an inbound function makes any trust decision.
+   */
   verify?: InboundVerify<TEnv>;
 }
 /** The `email(message, env, ctx)` callback the factory returns. */
 type InboundEmailHandler<TEnv = Record<string, unknown>> = (message: ForwardableEmailMessageLike, env: TEnv, context: unknown) => Promise<void>;
-/**
-* Build the `email(message, env, ctx)` handler. It (a) reads `message.raw`,
-* (b) parses it via `parse`, (c) runs the optional `verify` gate, then
-* (d) calls `dispatch(parsed, { message, env, ctx })`. Any throw (or a falsy
-* `verify`) routes through `onError` (default: a generic `message.setReject`).
-*/
 declare const createInboundEmailHandler: <TEnv = Record<string, unknown>>(options: InboundEmailHandlerOptions<TEnv>) => InboundEmailHandler<TEnv>;
 /** The `RpcEnvelope` shape the runtime's `/_lunora/rpc` path consumes. */
 interface RpcEnvelope {
@@ -154,23 +267,23 @@ interface RpcEnvelope {
 /** Options for {@link dispatchToLunoraFunction}. */
 interface DispatchToLunoraFunctionOptions<TEnv = Record<string, unknown>> {
   /**
-  * Admin bearer authorizing the shard RPC. Defaults to reading
-  * `env.LUNORA_ADMIN_TOKEN` at dispatch time.
-  */
+   * Admin bearer authorizing the shard RPC. Defaults to reading
+   * `env.LUNORA_ADMIN_TOKEN` at dispatch time.
+   */
   adminToken?: string;
   /** `functionPath` of the target mutation/action (e.g. `"inbound:onEmail"`). */
   functionPath: string;
   /**
-  * Pin inbound dispatch to a Cloudflare data-residency jurisdiction. Pass the
-  * same value as the worker's `jurisdiction` so inbound mail routes to the
-  * jurisdiction-pinned shard. Omit for the un-pinned global namespace.
-  */
+   * Pin inbound dispatch to a Cloudflare data-residency jurisdiction. Pass the
+   * same value as the worker's `jurisdiction` so inbound mail routes to the
+   * jurisdiction-pinned shard. Omit for the un-pinned global namespace.
+   */
   jurisdiction?: DurableObjectJurisdiction;
   /**
-  * Map the parsed message into the function's args. Defaults to passing the
-  * whole {@link InboundEmail} with binary attachment `content` base64-encoded
-  * (see {@link toJsonSafeEmail}) so it survives the JSON-serialised RPC body.
-  */
+   * Map the parsed message into the function's args. Defaults to passing the
+   * whole {@link InboundEmail} with binary attachment `content` base64-encoded
+   * (see {@link toJsonSafeEmail}) so it survives the JSON-serialised RPC body.
+   */
   resolveArgs?: (email: InboundEmail, context: InboundDispatchContext<TEnv>) => unknown;
   /** The `SHARD` Durable Object namespace. */
   shard: ShardNamespaceLike;
@@ -178,16 +291,147 @@ interface DispatchToLunoraFunctionOptions<TEnv = Record<string, unknown>> {
   shardKey?: string;
 }
 /**
-* Build a {@link InboundDispatch} that posts an {@link RpcEnvelope} to the root
-* shard stub — the same admin-RPC-over-shard path the dev capture sink uses
-* (`from-env.ts`) — routing the parsed message into a named Lunora
-* mutation/action. Throws on a non-2xx RPC or a missing admin token so the
-* handler's `onError` (default `setReject`) bounces the message.
-*
-* SECURITY: the RPC carries the admin bearer, so the target function runs with
-* RLS bypassed over fully attacker-controlled, spoofable input — see the module
-* docstring. Verify the sender (`verify` hook / `email.authentication`) before
-* making any trust decision in the target function.
-*/
+ * Build a {@link InboundDispatch} that posts an {@link RpcEnvelope} to the root
+ * shard stub — the same admin-RPC-over-shard path the dev capture sink uses
+ * (`from-env.ts`) — routing the parsed message into a named Lunora
+ * mutation/action. Throws on a non-2xx RPC or a missing admin token — both
+ * transient in principle, so the handler reports it through a custom `onError`
+ * and then hands the message to `retain` if one is configured, bouncing only
+ * when there is nowhere durable to put it (see {@link createInboundEmailHandler}).
+ *
+ * SECURITY: the RPC is marked a trusted system dispatch, so `functionPath` may
+ * (and should) name an `internalMutation`/`internalAction` — a public `mutation`
+ * target is callable by any browser client with a forged message. The input is
+ * fully attacker-controlled and spoofable; verify the sender (`verify` hook /
+ * `email.authentication`) before making any trust decision in the target.
+ */
 declare const dispatchToLunoraFunction: <TEnv extends Record<string, unknown> = Record<string, unknown>>(options: DispatchToLunoraFunctionOptions<TEnv>) => InboundDispatch<TEnv>;
-export { type DispatchToLunoraFunctionOptions, type ForwardableEmailMessageLike, type InboundAttachment, type InboundAuthentication, type InboundDispatch, type InboundDispatchContext, type InboundEmail, type InboundEmailHandler, type InboundEmailHandlerOptions, type InboundVerify, type RawInboundEmail, type RpcEnvelope, type ShardNamespaceLike, createInboundEmailHandler, dispatchToLunoraFunction, parseInboundEmail };
+export {
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type DispatchToLunoraFunctionOptions,
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type ForwardableEmailMessageLike, type InboundAttachment, type InboundAuthResult, type InboundAuthentication,
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type InboundDispatch,
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type InboundDispatchContext, type InboundEmail,
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type InboundEmailHandler,
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type InboundEmailHandlerOptions,
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type InboundVerify, type RawInboundEmail,
+/**
+ * `@lunora/mail/inbound` — inbound Email Routing support.
+ *
+ * Wire a Cloudflare Email Worker entry to route received mail into a Lunora
+ * mutation/action:
+ *
+ * ```ts
+ * import { createInboundEmailHandler, parseInboundEmail, dispatchToLunoraFunction } from "@lunora/mail/inbound";
+ *
+ * export const email = createInboundEmailHandler({
+ *     parse: parseInboundEmail,
+ *     dispatch: dispatchToLunoraFunction({ shard: env.SHARD, functionPath: "inbound:onEmail" }),
+ * });
+ * ```
+ */
+type RpcEnvelope, type ShardNamespaceLike, authenticatesFrom, createInboundEmailHandler, dispatchToLunoraFunction, parseInboundEmail };