@molecule/api-emails-inbound-ses 1.0.0

package/dist/provider.js

@@ -0,0 +1,378 @@
+/**
+ * AWS SES inbound-email provider implementation.
+ *
+ * SES Inbound parses received mail upstream and either delivers the message
+ * to S3 or publishes a notification (with the parsed `mail` metadata and
+ * optional base64-encoded raw RFC 822 `content`) to an SNS topic. This
+ * bond handles the SNS-notification path: an HTTPS endpoint subscribed to
+ * the topic receives JSON, validates the SNS signature, and parses the
+ * embedded `content` (RFC 822) into a normalized `InboundEmail`.
+ *
+ * Outbound replies compose onto the bonded `@molecule/api-emails`
+ * transport (typically `@molecule/api-emails-ses`); we never reimplement
+ * SMTP / SES SendEmail here.
+ *
+ * @see https://docs.aws.amazon.com/ses/latest/dg/receiving-email-notifications.html
+ * @see https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message.html
+ *
+ * @module
+ */
+import { Buffer } from 'node:buffer';
+import { createPublicKey, createVerify } from 'node:crypto';
+// Side-effect import: registers this bond's secret definitions so the
+// runtime registry is populated even when provider.js is imported directly
+// (not through the package barrel).
+import './secrets.js';
+import { sendMail } from '@molecule/api-emails';
+import { base64ToBuffer, buildSnsCanonicalString, isAllowedSigningCertUrl, parseJsonBody, parseRawMimeContent, splitReferences, unwrapMessageId, } from './utilities.js';
+/**
+ * Cache of fetched SNS signing certificate PEM bodies, keyed by
+ * `SigningCertURL`. AWS rotates these infrequently and serves them from a
+ * CloudFront-fronted endpoint, so caching reduces per-request latency
+ * without compromising security (the URL itself is allowlisted).
+ */
+const certCache = new Map();
+/**
+ * Timeout (ms) for the (uncached) signing-certificate fetch. Bounds the
+ * worst case so a hanging/slow cert endpoint fails fast into a `false`
+ * verification result instead of stalling the inbound webhook handler for
+ * `fetch`'s much longer default timeout — which otherwise makes inbound
+ * email processing look "frozen" rather than failing (see
+ * integration-audit-findings.md → [email] hostile-default).
+ */
+const CERT_FETCH_TIMEOUT_MS = 5000;
+/**
+ * Resets the cached signing certificates. Exposed for tests.
+ */
+export const _resetSigningCertCache = () => {
+    certCache.clear();
+};
+/**
+ * Fetches an SNS signing certificate. Validates the URL against the
+ * allowlist before performing any network I/O.
+ *
+ * @param url - The `SigningCertURL` from the SNS payload.
+ * @returns The PEM-encoded certificate body, or `undefined` when the URL
+ *   is not allowlisted, the fetch fails, or it does not complete within
+ *   {@link CERT_FETCH_TIMEOUT_MS}.
+ */
+const fetchSigningCert = async (url) => {
+    if (!isAllowedSigningCertUrl(url))
+        return undefined;
+    const cached = certCache.get(url);
+    if (cached !== undefined)
+        return cached;
+    try {
+        const response = await fetch(url, { signal: AbortSignal.timeout(CERT_FETCH_TIMEOUT_MS) });
+        if (!response.ok)
+            return undefined;
+        const pem = await response.text();
+        if (!pem.includes('BEGIN CERTIFICATE'))
+            return undefined;
+        certCache.set(url, pem);
+        return pem;
+    }
+    catch (_error) {
+        // Best-effort fetch — network failures, including our own abort-on-timeout,
+        // are surfaced as `undefined`; the caller treats a missing cert as a
+        // signature-verification failure (false), never a hang.
+        return undefined;
+    }
+};
+/**
+ * Type guard for the subset of {@link SnsNotificationPayload} fields we
+ * rely on. Returns `false` for malformed payloads without throwing.
+ *
+ * @param value - Candidate parsed JSON body.
+ * @returns `true` when `value` looks like an SNS payload.
+ */
+const isSnsPayload = (value) => {
+    if (!value || typeof value !== 'object')
+        return false;
+    const v = value;
+    return (typeof v.Type === 'string' &&
+        typeof v.MessageId === 'string' &&
+        typeof v.Message === 'string' &&
+        typeof v.Timestamp === 'string' &&
+        typeof v.Signature === 'string' &&
+        typeof v.SigningCertURL === 'string' &&
+        typeof v.SignatureVersion === 'string');
+};
+/**
+ * Verifies the signature of an SNS notification payload. Implements the
+ * AWS SNS signature-verification flow:
+ *
+ * 1. Parse the JSON body.
+ * 2. Reject if `SigningCertURL` is not from an allowlisted host.
+ * 3. Fetch the X.509 certificate from `SigningCertURL`.
+ * 4. Build the canonical string per AWS docs (field order varies by
+ *    `Type`).
+ * 5. Verify the base64-decoded `Signature` against the canonical string
+ *    using SHA1 (`SignatureVersion === '1'`) or SHA256
+ *    (`SignatureVersion === '2'`).
+ * 6. When `AWS_SES_INBOUND_TOPIC_ARN` is set, also verify the payload's
+ *    `TopicArn` matches.
+ *
+ * Errors NEVER leak signing material; failures simply return `false`.
+ *
+ * @param _headers - HTTP headers (unused — SNS signs the body).
+ * @param body - Raw HTTP request body (JSON).
+ * @returns `true` when the signature is valid, `false` otherwise.
+ */
+export const verifySignature = async (_headers, body) => {
+    let parsed;
+    try {
+        parsed = parseJsonBody(body);
+    }
+    catch (_error) {
+        // Malformed body — not a valid SNS notification; return false (no signature).
+        return false;
+    }
+    if (!isSnsPayload(parsed))
+        return false;
+    const expectedTopic = process.env.AWS_SES_INBOUND_TOPIC_ARN;
+    if (expectedTopic && parsed.TopicArn !== expectedTopic)
+        return false;
+    if (!isAllowedSigningCertUrl(parsed.SigningCertURL))
+        return false;
+    const pem = await fetchSigningCert(parsed.SigningCertURL);
+    if (!pem)
+        return false;
+    const algorithm = parsed.SignatureVersion === '2'
+        ? 'RSA-SHA256'
+        : parsed.SignatureVersion === '1'
+            ? 'RSA-SHA1'
+            : undefined;
+    if (!algorithm)
+        return false;
+    let canonical;
+    try {
+        canonical = buildSnsCanonicalString(parsed);
+    }
+    catch (_error) {
+        // Malformed payload fields — cannot build the canonical string; treat as invalid.
+        return false;
+    }
+    let signatureBuffer;
+    try {
+        signatureBuffer = Buffer.from(parsed.Signature, 'base64');
+    }
+    catch (_error) {
+        // Invalid base64 signature value — cannot decode; treat as invalid.
+        return false;
+    }
+    if (signatureBuffer.length === 0)
+        return false;
+    try {
+        const publicKey = createPublicKey(pem);
+        const verifier = createVerify(algorithm);
+        verifier.update(canonical, 'utf8');
+        verifier.end();
+        return verifier.verify(publicKey, signatureBuffer);
+    }
+    catch (_error) {
+        // Crypto errors (bad PEM, unsupported key, verify failure) — treat as invalid signature.
+        return false;
+    }
+};
+/**
+ * Maps an SES `commonHeaders` block onto the normalized header dict.
+ *
+ * @param mail - The SES `mail` object.
+ * @returns A `Record` of lowercased header names to values.
+ */
+const headersFromSesMail = (mail) => {
+    const out = {};
+    if (Array.isArray(mail.headers)) {
+        for (const h of mail.headers) {
+            if (!h || typeof h.name !== 'string' || typeof h.value !== 'string')
+                continue;
+            const lower = h.name.toLowerCase();
+            const existing = out[lower];
+            if (existing === undefined) {
+                out[lower] = h.value;
+            }
+            else if (Array.isArray(existing)) {
+                existing.push(h.value);
+            }
+            else {
+                out[lower] = [existing, h.value];
+            }
+        }
+    }
+    const ch = mail.commonHeaders;
+    if (ch) {
+        if (typeof ch.subject === 'string' && out.subject === undefined)
+            out.subject = ch.subject;
+        if (typeof ch.messageId === 'string' && out['message-id'] === undefined)
+            out['message-id'] = ch.messageId;
+        if (typeof ch.inReplyTo === 'string' && out['in-reply-to'] === undefined)
+            out['in-reply-to'] = ch.inReplyTo;
+        if (typeof ch.references === 'string' && out.references === undefined)
+            out.references = ch.references;
+    }
+    return out;
+};
+/**
+ * Parses an SNS notification carrying an SES inbound-email payload into a
+ * normalized {@link InboundEmail}.
+ *
+ * When the SES `Message.content` field is present, it is base64-decoded
+ * and parsed as RFC 822 via `mailparser`. When `content` is absent
+ * (header-only notifications), we synthesize an `InboundEmail` from the
+ * SES `mail` metadata so the caller can still log/dedupe the message.
+ *
+ * SubscriptionConfirmation messages are returned as a synthetic
+ * `InboundEmail` whose `subject` is `'__sns:SubscriptionConfirmation'` and
+ * whose `headers['x-sns-subscribe-url']` carries the confirmation URL —
+ * applications inspect this so they can subscribe out-of-band.
+ *
+ * @param _headers - HTTP headers (unused).
+ * @param body - Raw HTTP body (SNS JSON).
+ * @returns The normalized inbound email.
+ */
+export const parseWebhookPayload = async (_headers, body) => {
+    let parsed;
+    try {
+        parsed = parseJsonBody(body);
+    }
+    catch (error) {
+        throw new Error('SES inbound webhook body is not valid JSON.', { cause: error });
+    }
+    if (!isSnsPayload(parsed)) {
+        throw new Error('SES inbound webhook body is not an SNS notification payload.');
+    }
+    if (parsed.Type === 'SubscriptionConfirmation' || parsed.Type === 'UnsubscribeConfirmation') {
+        const headers = {};
+        if (typeof parsed.SubscribeURL === 'string')
+            headers['x-sns-subscribe-url'] = parsed.SubscribeURL;
+        return {
+            id: parsed.MessageId,
+            from: '',
+            to: [],
+            subject: `__sns:${parsed.Type}`,
+            headers,
+            receivedAt: new Date(parsed.Timestamp),
+        };
+    }
+    let sesMessage;
+    try {
+        sesMessage = JSON.parse(parsed.Message);
+    }
+    catch (error) {
+        throw new Error('SES inbound notification `Message` is not valid JSON.', { cause: error });
+    }
+    if (!sesMessage || typeof sesMessage !== 'object' || !sesMessage.mail) {
+        throw new Error('SES inbound notification is missing the `mail` field.');
+    }
+    const sesReceivedAt = new Date(sesMessage.mail.timestamp);
+    const sesMessageId = sesMessage.mail.messageId;
+    if (typeof sesMessage.content === 'string' && sesMessage.content.length > 0) {
+        const raw = base64ToBuffer(sesMessage.content);
+        const email = await parseRawMimeContent(raw, {
+            id: sesMessageId,
+            receivedAt: sesReceivedAt,
+        });
+        if (!email.messageId)
+            email.messageId = sesMessageId;
+        return email;
+    }
+    // Header-only notification — synthesize from SES metadata.
+    const ch = sesMessage.mail.commonHeaders ?? {};
+    const headers = headersFromSesMail(sesMessage.mail);
+    const messageIdFromCommon = unwrapMessageId(ch.messageId);
+    const inReplyTo = unwrapMessageId(ch.inReplyTo);
+    const references = splitReferences(ch.references).map((ref) => unwrapMessageId(ref) ?? ref);
+    const email = {
+        id: sesMessageId,
+        from: Array.isArray(ch.from) && ch.from.length > 0 ? ch.from[0] : (sesMessage.mail.source ?? ''),
+        to: Array.isArray(ch.to) && ch.to.length > 0
+            ? ch.to.slice()
+            : Array.isArray(sesMessage.mail.destination)
+                ? sesMessage.mail.destination.slice()
+                : [],
+        subject: typeof ch.subject === 'string' ? ch.subject : '',
+        headers,
+        receivedAt: sesReceivedAt,
+    };
+    if (Array.isArray(ch.cc) && ch.cc.length > 0)
+        email.cc = ch.cc.slice();
+    if (messageIdFromCommon)
+        email.messageId = messageIdFromCommon;
+    else
+        email.messageId = sesMessageId;
+    if (inReplyTo)
+        email.inReplyTo = inReplyTo;
+    if (references.length > 0)
+        email.references = references;
+    return email;
+};
+/**
+ * Dispatches an outbound reply through the bonded `@molecule/api-emails`
+ * transport. The reply's `In-Reply-To` and `References` headers are
+ * populated from the original message when present.
+ *
+ * @param email - The original inbound email being replied to.
+ * @param reply - The reply payload.
+ * @returns The reply dispatch result.
+ */
+export const replyTo = async (email, reply) => {
+    const fromAddress = reply.from ?? (email.to.length > 0 ? email.to[0] : undefined);
+    if (!fromAddress) {
+        throw new Error('Cannot dispatch inbound reply: no `from` address was supplied and the original email has no recipient to fall back to.');
+    }
+    const subject = reply.subject ?? `Re: ${email.subject}`;
+    const threadingHeaders = {};
+    if (email.messageId) {
+        threadingHeaders['In-Reply-To'] = `<${email.messageId}>`;
+        const refs = email.references ? [...email.references] : [];
+        refs.push(email.messageId);
+        threadingHeaders.References = refs.map((id) => `<${id}>`).join(' ');
+    }
+    const headers = {
+        ...threadingHeaders,
+        ...(reply.headers ?? {}),
+    };
+    const message = {
+        from: fromAddress,
+        to: email.from,
+        subject,
+        ...(reply.textBody !== undefined ? { text: reply.textBody } : {}),
+        ...(reply.htmlBody !== undefined ? { html: reply.htmlBody } : {}),
+        ...(reply.attachments && reply.attachments.length > 0
+            ? {
+                attachments: reply.attachments.map((a) => ({
+                    filename: a.name,
+                    content: base64ToBuffer(a.contentBase64),
+                    contentType: a.contentType,
+                    ...(a.contentId !== undefined ? { cid: a.contentId } : {}),
+                })),
+            }
+            : {}),
+        ...(Object.keys(headers).length > 0 ? { headers } : {}),
+    };
+    const result = await sendMail(message);
+    return {
+        id: result.messageId ?? '',
+    };
+};
+/**
+ * Indicates that this provider supports outbound reply dispatch via
+ * {@link replyTo}. The reply path requires the outbound
+ * `@molecule/api-emails` bond to be wired with a transport — typically
+ * `@molecule/api-emails-ses`.
+ *
+ * @returns Always `true`.
+ */
+export const supportsReply = () => true;
+/**
+ * The AWS SES inbound-email provider implementing the
+ * {@link InboundEmailProvider} interface.
+ */
+export const provider = {
+    parseWebhookPayload,
+    verifySignature,
+    replyTo,
+    supportsReply,
+};
+//# sourceMappingURL=provider.js.map

package/dist/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE3D,sEAAsE;AACtE,2EAA2E;AAC3E,oCAAoC;AACpC,OAAO,cAAc,CAAA;AAErB,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAU/C,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,uBAAuB,EACvB,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,eAAe,GAChB,MAAM,gBAAgB,CAAA;AAEvB;;;;;GAKG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAA;AAE3C;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,IAAI,CAAA;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAS,EAAE;IAC/C,SAAS,CAAC,KAAK,EAAE,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAW,EAA+B,EAAE;IAC1E,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAEnD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IAEvC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAA;QACzF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,SAAS,CAAA;QAClC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,OAAO,SAAS,CAAA;QACxD,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACvB,OAAO,GAAG,CAAA;IACZ,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,4EAA4E;QAC5E,qEAAqE;QACrE,wDAAwD;QACxD,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,CAAC,KAAc,EAAmC,EAAE;IACvE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ;QACpC,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,CACvC,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,QAAuD,EACvD,IAAqB,EACH,EAAE;IACpB,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,8EAA8E;QAC9E,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAEvC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAA;IAC3D,IAAI,aAAa,IAAI,MAAM,CAAC,QAAQ,KAAK,aAAa;QAAE,OAAO,KAAK,CAAA;IAEpE,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAA;IAEjE,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAEtB,MAAM,SAAS,GACb,MAAM,CAAC,gBAAgB,KAAK,GAAG;QAC7B,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,MAAM,CAAC,gBAAgB,KAAK,GAAG;YAC/B,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,SAAS,CAAA;IACjB,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,IAAI,SAAiB,CAAA;IACrB,IAAI,CAAC;QACH,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,kFAAkF;QAClF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,eAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC3D,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,oEAAoE;QACpE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAE9C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;QACxC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAClC,QAAQ,CAAC,GAAG,EAAE,CAAA;QACd,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IACpD,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,yFAAyF;QACzF,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,CACzB,IAA2C,EACR,EAAE;IACrC,MAAM,GAAG,GAAsC,EAAE,CAAA;IACjD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAAE,SAAQ;YAC7E,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;YAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;YAC3B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;YACtB,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;YACxB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAA;IAC7B,IAAI,EAAE,EAAE,CAAC;QACP,IAAI,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAA;QACzF,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS;YACrE,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,SAAS,CAAA;QAClC,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,SAAS;YACtE,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,SAAS,CAAA;QACnC,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;YACnE,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC,UAAU,CAAA;IAClC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,QAAuD,EACvD,IAA+C,EACxB,EAAE;IACzB,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;IACjF,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,0BAA0B,IAAI,MAAM,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;QAC5F,MAAM,OAAO,GAAsC,EAAE,CAAA;QACrD,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YACzC,OAAO,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAC,YAAY,CAAA;QACtD,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,SAAS;YACpB,IAAI,EAAE,EAAE;YACR,EAAE,EAAE,EAAE;YACN,OAAO,EAAE,SAAS,MAAM,CAAC,IAAI,EAAE;YAC/B,OAAO;YACP,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SACvC,CAAA;IACH,CAAC;IAED,IAAI,UAAyC,CAAA;IAC7C,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAkC,CAAA;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uDAAuD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACzD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAA;IAE9C,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5E,MAAM,GAAG,GAAG,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAC9C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE;YAC3C,EAAE,EAAE,YAAY;YAChB,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,YAAY,CAAA;QACpD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,2DAA2D;IAC3D,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAA;IAC9C,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACnD,MAAM,mBAAmB,GAAG,eAAe,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;IACzD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;IAC/C,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAA;IAE3F,MAAM,KAAK,GAAiB;QAC1B,EAAE,EAAE,YAAY;QAChB,IAAI,EACF,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QAC7F,EAAE,EACA,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC;YACtC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE;YACf,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC1C,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE;gBACrC,CAAC,CAAC,EAAE;QACV,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACzD,OAAO;QACP,UAAU,EAAE,aAAa;KAC1B,CAAA;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IACtE,IAAI,mBAAmB;QAAE,KAAK,CAAC,SAAS,GAAG,mBAAmB,CAAA;;QACzD,KAAK,CAAC,SAAS,GAAG,YAAY,CAAA;IACnC,IAAI,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAA;IAC1C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,UAAU,GAAG,UAAU,CAAA;IAExD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,EAC1B,KAAmB,EACnB,KAAwB,EACU,EAAE;IACpC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACjF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,EAAE,CAAA;IAEvD,MAAM,gBAAgB,GAA2B,EAAE,CAAA;IACnD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,gBAAgB,CAAC,aAAa,CAAC,GAAG,IAAI,KAAK,CAAC,SAAS,GAAG,CAAA;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC1D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC1B,gBAAgB,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,GAAG,gBAAgB;QACnB,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;KACzB,CAAA;IAED,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,WAAW;QACjB,EAAE,EAAE,KAAK,CAAC,IAAI;QACd,OAAO;QACP,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YACnD,CAAC,CAAC;gBACE,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAyB,EAAE,EAAE,CAAC,CAAC;oBACjE,QAAQ,EAAE,CAAC,CAAC,IAAI;oBAChB,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC;oBACxC,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D,CAAC,CAAC;aACJ;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAA;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAyC,CAAC,CAAA;IAExE,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;KAC3B,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAY,EAAE,CAAC,IAAI,CAAA;AAEhD;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAyB;IAC5C,mBAAmB;IACnB,eAAe;IACf,OAAO;IACP,aAAa;CACd,CAAA"}

package/dist/secrets.d.ts

@@ -0,0 +1,16 @@
+/**
+ * AWS SES inbound-email secret definitions — self-registered at import time so the
+ * runtime secrets registry (`@molecule/api-secrets`) can drive boot-time
+ * configuration reports and actionable "not configured" errors.
+ *
+ * Content is derived MECHANICALLY from this package's mlcl registry secrets
+ * entry (label/instructions/setupUrl/example) via the fleet formula, so
+ * packages sharing a key register byte-identical definitions and
+ * registration order never matters.
+ *
+ * @module
+ */
+import type { SecretDefinition } from '@molecule/api-secrets';
+/** Secret definitions required by the AWS SES inbound-email bond. */
+export declare const emailsInboundSesSecretDefinitions: SecretDefinition[];
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAG7D,qEAAqE;AACrE,eAAO,MAAM,iCAAiC,EAAE,gBAAgB,EAuC/D,CAAA"}

package/dist/secrets.js

@@ -0,0 +1,51 @@
+/**
+ * AWS SES inbound-email secret definitions — self-registered at import time so the
+ * runtime secrets registry (`@molecule/api-secrets`) can drive boot-time
+ * configuration reports and actionable "not configured" errors.
+ *
+ * Content is derived MECHANICALLY from this package's mlcl registry secrets
+ * entry (label/instructions/setupUrl/example) via the fleet formula, so
+ * packages sharing a key register byte-identical definitions and
+ * registration order never matters.
+ *
+ * @module
+ */
+import { registerSecrets } from '@molecule/api-secrets';
+/** Secret definitions required by the AWS SES inbound-email bond. */
+export const emailsInboundSesSecretDefinitions = [
+    {
+        key: 'AWS_ACCESS_KEY_ID',
+        description: 'AWS access key ID — Create an IAM user with the needed policy (SES/S3/SQS) and create an access key under Security credentials.',
+        helpUrl: 'https://console.aws.amazon.com/iam/',
+        required: true,
+        example: 'AKIA...',
+    },
+    {
+        key: 'AWS_SECRET_ACCESS_KEY',
+        description: 'AWS secret access key — Shown once when creating the IAM access key — store it immediately.',
+        helpUrl: 'https://console.aws.amazon.com/iam/',
+        required: true,
+    },
+    {
+        key: 'AWS_SES_REGION',
+        description: 'AWS SES region — The AWS region where SES is set up (and out of sandbox for production sending).',
+        required: true,
+        example: 'us-east-1',
+    },
+    {
+        key: 'AWS_SES_INBOUND_TOPIC_ARN',
+        description: 'SES inbound SNS topic ARN — ARN of the SNS topic your SES receipt rule publishes inbound mail to.',
+        helpUrl: 'https://console.aws.amazon.com/ses/',
+        required: false,
+        example: 'arn:aws:sns:us-east-1:123456789012:ses-inbound',
+    },
+    {
+        key: 'AWS_SNS_SIGNING_CERT_HOSTNAME_SUFFIXES',
+        description: 'SNS signing-cert hostname allowlist — Comma-separated hostname suffixes allowed for SNS signature certificates; the default (.amazonaws.com) is fine.',
+        required: false,
+        example: '.amazonaws.com',
+        default: '.amazonaws.com',
+    },
+];
+registerSecrets(emailsInboundSesSecretDefinitions);
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,qEAAqE;AACrE,MAAM,CAAC,MAAM,iCAAiC,GAAuB;IACnE;QACE,GAAG,EAAE,mBAAmB;QACxB,WAAW,EACT,iIAAiI;QACnI,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,SAAS;KACnB;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,WAAW,EACT,6FAA6F;QAC/F,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,IAAI;KACf;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,WAAW,EACT,kGAAkG;QACpG,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,WAAW;KACrB;IACD;QACE,GAAG,EAAE,2BAA2B;QAChC,WAAW,EACT,mGAAmG;QACrG,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,gDAAgD;KAC1D;IACD;QACE,GAAG,EAAE,wCAAwC;QAC7C,WAAW,EACT,uJAAuJ;QACzJ,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,gBAAgB;QACzB,OAAO,EAAE,gBAAgB;KAC1B;CACF,CAAA;AAED,eAAe,CAAC,iCAAiC,CAAC,CAAA"}

package/dist/types.d.ts

@@ -0,0 +1,121 @@
+/**
+ * Type definitions for the AWS SES inbound-emails provider.
+ *
+ * @module
+ */
+export type { InboundEmail, InboundEmailAttachment, InboundEmailProvider, InboundEmailReply, InboundEmailReplyResult, } from '@molecule/api-emails-inbound';
+/**
+ * Allowed hostname suffixes for the SNS `SigningCertURL`. AWS SNS only
+ * publishes signing certificates from `*.amazonaws.com`; any URL outside
+ * this allowlist MUST be rejected to defend against SSRF and certificate
+ * substitution attacks.
+ *
+ * Exposed for unit-testing; not part of the public bond surface.
+ */
+export declare const SNS_SIGNING_CERT_HOSTNAME_SUFFIXES: readonly string[];
+/**
+ * Shape of an Amazon SNS notification (or SubscriptionConfirmation /
+ * UnsubscribeConfirmation) payload, as POSTed to a subscribed HTTPS
+ * endpoint. Only the fields used by this bond are typed here.
+ *
+ * @see https://docs.aws.amazon.com/sns/latest/dg/sns-message-and-json-formats.html
+ */
+export interface SnsNotificationPayload {
+    /**
+     * Discriminates the kind of message: `Notification`,
+     * `SubscriptionConfirmation`, or `UnsubscribeConfirmation`.
+     */
+    Type: string;
+    /** A unique UUID for the message. */
+    MessageId: string;
+    /** The notification topic ARN. */
+    TopicArn?: string;
+    /**
+     * Subject line as supplied by the publisher. Optional for notifications.
+     */
+    Subject?: string;
+    /** Message payload (string). For SES notifications this is JSON. */
+    Message: string;
+    /** ISO 8601 timestamp when the message was published. */
+    Timestamp: string;
+    /** Signature version. AWS SNS supports `1` (SHA1) and `2` (SHA256). */
+    SignatureVersion: string;
+    /** Base64-encoded signature over the canonical string. */
+    Signature: string;
+    /** URL of the X.509 PEM cert used to sign the message. */
+    SigningCertURL: string;
+    /** Confirmation token (only on SubscriptionConfirmation messages). */
+    Token?: string;
+    /** Subscribe URL (only on SubscriptionConfirmation messages). */
+    SubscribeURL?: string;
+    /** Unsubscribe URL (only on Notification / UnsubscribeConfirmation). */
+    UnsubscribeURL?: string;
+}
+/**
+ * Shape of the JSON payload SES publishes to SNS for inbound-email
+ * notifications. Only the fields used by this bond are typed; SES emits a
+ * superset including `verdicts`, `dkim`, etc.
+ *
+ * @see https://docs.aws.amazon.com/ses/latest/dg/receiving-email-notifications-contents.html
+ */
+export interface SesInboundNotificationMessage {
+    /** Notification kind. We expect `Received` for inbound mail. */
+    notificationType: string;
+    /** Metadata about the SES `mail` object. */
+    mail: {
+        /** ISO timestamp SES received the message. */
+        timestamp: string;
+        /** Sender as decoded by SES. */
+        source: string;
+        /** SES-assigned message ID. */
+        messageId: string;
+        /** Envelope-recipient list. */
+        destination: string[];
+        /** Common headers SES extracts from the message. */
+        commonHeaders?: {
+            from?: string[];
+            to?: string[];
+            cc?: string[];
+            bcc?: string[];
+            subject?: string;
+            messageId?: string;
+            inReplyTo?: string;
+            references?: string;
+        };
+        /**
+         * All raw headers SES extracted, when `headersTruncated` is `false`.
+         */
+        headers?: Array<{
+            name: string;
+            value: string;
+        }>;
+    };
+    /**
+     * Raw RFC 822 message content, base64-encoded, present when the SES
+     * receipt rule includes the message content. Absent for header-only
+     * notifications.
+     */
+    content?: string;
+}
+declare global {
+    namespace NodeJS {
+        /**
+         * Process Env interface — AWS SES Inbound shares credentials with the
+         * outbound `@molecule/api-emails-ses` bond. The SNS signing certificate
+         * is fetched at verification time; no signing key is held locally.
+         */
+        interface ProcessEnv {
+            /**
+             * Allowlist of hostname suffixes (comma-separated) accepted for the
+             * SNS `SigningCertURL`. Defaults to `.amazonaws.com` when unset.
+             */
+            AWS_SNS_SIGNING_CERT_HOSTNAME_SUFFIXES?: string;
+            /**
+             * Optional explicit SNS topic ARN. When set, notifications whose
+             * `TopicArn` does not match are rejected.
+             */
+            AWS_SES_INBOUND_TOPIC_ARN?: string;
+        }
+    }
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EACV,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,8BAA8B,CAAA;AAErC;;;;;;;GAOG;AACH,eAAO,MAAM,kCAAkC,EAAE,SAAS,MAAM,EAAuB,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IAEZ,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAA;IAEjB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAA;IAEf,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IAEjB,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAA;IAExB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAA;IAEjB,0DAA0D;IAC1D,cAAc,EAAE,MAAM,CAAA;IAEtB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC5C,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,CAAA;IAExB,4CAA4C;IAC5C,IAAI,EAAE;QACJ,8CAA8C;QAC9C,SAAS,EAAE,MAAM,CAAA;QACjB,gCAAgC;QAChC,MAAM,EAAE,MAAM,CAAA;QACd,+BAA+B;QAC/B,SAAS,EAAE,MAAM,CAAA;QACjB,+BAA+B;QAC/B,WAAW,EAAE,MAAM,EAAE,CAAA;QACrB,oDAAoD;QACpD,aAAa,CAAC,EAAE;YACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;YACf,EAAE,CAAC,EAAE,MAAM,EAAE,CAAA;YACb,EAAE,CAAC,EAAE,MAAM,EAAE,CAAA;YACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;YACd,OAAO,CAAC,EAAE,MAAM,CAAA;YAChB,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,UAAU,CAAC,EAAE,MAAM,CAAA;SACpB,CAAA;QACD;;WAEG;QACH,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KACjD,CAAA;IAED;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,MAAM,CAAC;QACf;;;;WAIG;QACH,UAAiB,UAAU;YACzB;;;eAGG;YACH,sCAAsC,CAAC,EAAE,MAAM,CAAA;YAE/C;;;eAGG;YACH,yBAAyB,CAAC,EAAE,MAAM,CAAA;SACnC;KACF;CACF"}

package/dist/types.js

@@ -0,0 +1,15 @@
+/**
+ * Type definitions for the AWS SES inbound-emails provider.
+ *
+ * @module
+ */
+/**
+ * Allowed hostname suffixes for the SNS `SigningCertURL`. AWS SNS only
+ * publishes signing certificates from `*.amazonaws.com`; any URL outside
+ * this allowlist MUST be rejected to defend against SSRF and certificate
+ * substitution attacks.
+ *
+ * Exposed for unit-testing; not part of the public bond surface.
+ */
+export const SNS_SIGNING_CERT_HOSTNAME_SUFFIXES = ['.amazonaws.com'];
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAsB,CAAC,gBAAgB,CAAC,CAAA"}