@open-workspace/email 0.0.0-stage → 0.1.1

package/worker/mail/downloads.ts

@@ -0,0 +1,47 @@
+import { eq } from "drizzle-orm";
+import { Hono } from "hono";
+import { createDb } from "@open-workspace/core/worker/db/client.ts";
+import { mailboxes } from "@open-workspace/core/worker/db/schema.ts";
+import type { AppEnv } from "@open-workspace/core/worker/env.ts";
+import { hashToken } from "@open-workspace/core/worker/lib/crypto.ts";
+import { apiError } from "@open-workspace/core/worker/lib/http.ts";
+import { mailboxStub } from "../mailbox";
+
+export const mailDownloadRoutes = new Hono<AppEnv>().get("/mail/:token", async (c) => {
+  const token = c.req.param("token");
+  const [mailboxId, messageId, attachmentId, secret, ...extra] = token.split(".");
+  if (!mailboxId || !messageId || !attachmentId || !secret || extra.length) {
+    return apiError(c, 404, "NOT_FOUND", "Download link is invalid or expired");
+  }
+
+  // Check D1 first so an arbitrary public token cannot instantiate new DOs.
+  const [mailbox] = await createDb(c.env.DB)
+    .select({ id: mailboxes.id })
+    .from(mailboxes)
+    .where(eq(mailboxes.id, mailboxId))
+    .limit(1);
+  if (!mailbox) {
+    return apiError(c, 404, "NOT_FOUND", "Download link is invalid or expired");
+  }
+
+  const file = await mailboxStub(c.env, mailboxId).getAttachment(messageId, attachmentId);
+  const valid = file?.delivery === "download_link"
+    && file.downloadExpiresAt !== null
+    && file.downloadExpiresAt > Date.now()
+    && file.downloadTokenHash !== null
+    && file.downloadTokenHash === await hashToken(token);
+  if (!file || !valid) {
+    return apiError(c, 404, "NOT_FOUND", "Download link is invalid or expired");
+  }
+
+  const object = await c.env.MAIL_STORAGE.get(file.r2Key);
+  if (!object) return apiError(c, 404, "NOT_FOUND", "Attachment data is missing");
+  return new Response(object.body, {
+    headers: {
+      "cache-control": "private, no-store",
+      "content-type": file.contentType,
+      "content-disposition": `attachment; filename*=UTF-8''${encodeURIComponent(file.filename)}`,
+      "x-content-type-options": "nosniff",
+    },
+  });
+});

package/worker/mail/header-metadata.ts

@@ -0,0 +1,77 @@
+import type { InboundAuthentication } from "../../shared/mail-authentication";
+import type { mailboxStub } from "../mailbox";
+import type { Email } from "../mailbox/schema";
+import { inboundHeaderMetadata } from "./auth-headers";
+import { rawHeaderText } from "./inbound";
+import { linkDomains } from "./link-domains";
+import { collectSenderIntel, senderIntelWorthStoring } from "./sender-intel";
+
+const HEADER_RANGE_BYTES = 256 * 1024;
+
+export function headerAuthentication(email: Email): InboundAuthentication | null {
+  const stored = email.authenticationResultsJson;
+  return stored?.source === "headers" && stored.version === 1 ? stored : null;
+}
+
+/**
+ * Messages stored before header parsing (or with legacy Cloudflare analytics)
+ * are parsed from the original's header section on first view, then persisted.
+ */
+export async function withHeaderMetadata(
+  env: Env,
+  mailbox: ReturnType<typeof mailboxStub>,
+  email: Email,
+): Promise<Email> {
+  if (email.direction !== "incoming" || !email.rawMimeR2Key || headerAuthentication(email)) {
+    return email;
+  }
+  try {
+    const object = await env.MAIL_STORAGE.get(email.rawMimeR2Key, {
+      range: { offset: 0, length: HEADER_RANGE_BYTES },
+    });
+    if (!object) return email;
+    const metadata = inboundHeaderMetadata({
+      rawHeaders: rawHeaderText(await object.arrayBuffer()),
+      fromAddress: email.fromJson[0]?.address ?? null,
+      envelopeFrom: email.envelopeFrom,
+    });
+    await mailbox.setEmailHeaderMetadata(email.id, metadata);
+    return { ...email, ...metadata };
+  } catch (error) {
+    console.error(`Could not parse authentication headers for ${email.id}`, error);
+    return email;
+  }
+}
+
+/**
+ * Messages stored before sender intelligence existed get it on first view,
+ * using the same lookups as ingestion. A result where every lookup failed is
+ * returned for display but not stored, so a later view retries.
+ */
+export async function withSenderIntel(
+  env: Env,
+  mailbox: ReturnType<typeof mailboxStub>,
+  email: Email,
+  context: { bodyHtml: string | null; workspaceDomains: readonly string[]; dqsKey: string | null },
+): Promise<Email> {
+  if (email.direction !== "incoming" || email.senderIntelJson || !headerAuthentication(email)) return email;
+  try {
+    const intel = await collectSenderIntel({
+      authentication: headerAuthentication(email),
+      fromAddress: email.fromJson[0]?.address ?? "",
+      linkDomains: linkDomains({
+        html: context.bodyHtml,
+        text: [email.bodyText, email.quotedText],
+        workspaceDomains: context.workspaceDomains,
+      }),
+      workspaceDomains: context.workspaceDomains,
+      dqsKey: context.dqsKey,
+      bucket: env.MAIL_STORAGE,
+    });
+    if (senderIntelWorthStoring(intel)) await mailbox.setEmailSenderIntel(email.id, intel);
+    return { ...email, senderIntelJson: intel };
+  } catch (error) {
+    console.error(`Could not collect sender intelligence for ${email.id}`, error);
+    return email;
+  }
+}

package/worker/mail/impersonation.ts

@@ -0,0 +1,175 @@
+import { getDomainWithoutSuffix } from "tldts";
+import { organizationalDomain } from "./org-domain";
+
+// --- Punycode (RFC 3492 decoding only) ------------------------------------
+
+const BASE = 36;
+const T_MIN = 1;
+const T_MAX = 26;
+const SKEW = 38;
+const DAMP = 700;
+
+function adapt(delta: number, points: number, first: boolean) {
+  let value = first ? Math.floor(delta / DAMP) : delta >> 1;
+  value += Math.floor(value / points);
+  let k = 0;
+  while (value > ((BASE - T_MIN) * T_MAX) >> 1) {
+    value = Math.floor(value / (BASE - T_MIN));
+    k += BASE;
+  }
+  return k + Math.floor(((BASE - T_MIN + 1) * value) / (value + SKEW));
+}
+
+function digit(code: number) {
+  if (code >= 48 && code <= 57) return code - 22;
+  if (code >= 65 && code <= 90) return code - 65;
+  if (code >= 97 && code <= 122) return code - 97;
+  return BASE;
+}
+
+export function decodePunycodeLabel(input: string) {
+  const delimiter = input.lastIndexOf("-");
+  const output = delimiter > 0 ? [...input.slice(0, delimiter)].map((char) => char.codePointAt(0)!) : [];
+  let n = 128;
+  let i = 0;
+  let bias = 72;
+  for (let index = delimiter > 0 ? delimiter + 1 : 0; index < input.length;) {
+    const oldI = i;
+    for (let w = 1, k = BASE; ; k += BASE) {
+      if (index >= input.length) return null;
+      const value = digit(input.charCodeAt(index++));
+      if (value >= BASE) return null;
+      i += value * w;
+      const t = k <= bias ? T_MIN : k >= bias + T_MAX ? T_MAX : k - bias;
+      if (value < t) break;
+      w *= BASE - t;
+    }
+    bias = adapt(i - oldI, output.length + 1, oldI === 0);
+    n += Math.floor(i / (output.length + 1));
+    i %= output.length + 1;
+    if (n > 0x10ffff) return null;
+    output.splice(i++, 0, n);
+  }
+  return String.fromCodePoint(...output);
+}
+
+/** `xn--` labels decoded to Unicode; other labels unchanged. */
+export function domainToUnicode(domain: string) {
+  return domain.split(".").map((label) =>
+    label.toLocaleLowerCase().startsWith("xn--") ? decodePunycodeLabel(label.slice(4)) ?? label : label
+  ).join(".");
+}
+
+// --- Confusable skeleton (a practical subset of UTS #39) ------------------
+
+const CONFUSABLES: Record<string, string> = {
+  // Cyrillic
+  "а": "a", "в": "b", "е": "e", "ё": "e", "к": "k", "м": "m", "н": "h", "о": "o", "р": "p", "с": "c",
+  "т": "t", "у": "y", "х": "x", "ѕ": "s", "і": "i", "ї": "i", "ј": "j", "ԁ": "d", "һ": "h", "ӏ": "l",
+  "ԛ": "q", "ԝ": "w", "ɡ": "g",
+  // Greek
+  "α": "a", "β": "b", "ε": "e", "η": "n", "ι": "i", "κ": "k", "ν": "v", "ο": "o", "ρ": "p", "τ": "t",
+  "υ": "u", "χ": "x", "ω": "w",
+  // Look-alike digits and symbols
+  "0": "o", "1": "l", "3": "e", "5": "s", "|": "l", "ı": "i", "ł": "l", "ø": "o", "đ": "d",
+};
+
+/** Lowercased, accent-free, confusables folded, with multi-letter look-alikes merged. */
+export function confusableSkeleton(value: string) {
+  const folded = [...value.normalize("NFKD").toLocaleLowerCase()]
+    .filter((char) => !/\p{M}/u.test(char))
+    .map((char) => CONFUSABLES[char] ?? char)
+    .join("");
+  return folded.replaceAll("rn", "m").replaceAll("vv", "w").replaceAll("cl", "d").replace(/i/gu, "l");
+}
+
+export function levenshtein(left: string, right: string) {
+  if (left === right) return 0;
+  let previous = Array.from({ length: right.length + 1 }, (_, index) => index);
+  for (let i = 1; i <= left.length; i += 1) {
+    const current = [i];
+    for (let j = 1; j <= right.length; j += 1) {
+      current[j] = Math.min(
+        current[j - 1]! + 1,
+        previous[j]! + 1,
+        previous[j - 1]! + (left[i - 1] === right[j - 1] ? 0 : 1),
+      );
+    }
+    previous = current;
+  }
+  return previous[right.length]!;
+}
+
+/** Registrable label without the public suffix, e.g. `demo` for `mail.demo.example`. */
+function registrableLabel(domain: string) {
+  return getDomainWithoutSuffix(domain) ?? domain.split(".").at(-2) ?? domain;
+}
+
+function maxEdits(length: number) {
+  if (length < 4) return 0;
+  return length < 7 ? 1 : 2;
+}
+
+/**
+ * The workspace domain that `senderDomain` imitates, if any. Compares the
+ * registrable labels after Unicode/punycode confusable folding, and the
+ * whole registrable name without separators (`demo-examp1e.com` vs `demo.example`).
+ */
+export function lookalikeOf(senderDomain: string | null, workspaceDomains: readonly string[]) {
+  if (!senderDomain) return null;
+  const unicode = domainToUnicode(senderDomain.toLocaleLowerCase());
+  const senderOrg = organizationalDomain(senderDomain) ?? senderDomain;
+  const senderLabel = confusableSkeleton(registrableLabel(domainToUnicode(senderOrg)));
+  const senderFlat = senderLabel.replace(/[^\p{L}\p{N}]/gu, "");
+  for (const workspace of workspaceDomains) {
+    const own = workspace.toLocaleLowerCase();
+    const ownOrg = organizationalDomain(own) ?? own;
+    if (senderOrg === ownOrg) continue;
+    const ownLabel = confusableSkeleton(registrableLabel(ownOrg));
+    const ownFlat = confusableSkeleton(ownOrg).replace(/[^\p{L}\p{N}]/gu, "");
+    if (ownLabel.length < 3) continue;
+    // Same name under another suffix, or a homoglyph/punycode spelling of it.
+    if (senderLabel === ownLabel || senderFlat === ownFlat) return { domain: unicode, resembles: own };
+    if (levenshtein(senderLabel, ownLabel) <= maxEdits(ownLabel.length)) return { domain: unicode, resembles: own };
+    if (ownFlat.length >= 6 && levenshtein(senderFlat, ownFlat) <= maxEdits(ownFlat.length)) {
+      return { domain: unicode, resembles: own };
+    }
+  }
+  return null;
+}
+
+// --- Display names ----------------------------------------------------------
+
+export function normalizedPersonName(value: string | null | undefined) {
+  if (!value) return "";
+  return value
+    .normalize("NFKC")
+    .toLocaleLowerCase()
+    .replace(/[^\p{L}\p{N}\s]/gu, " ")
+    .replace(/\s+/gu, " ")
+    .trim();
+}
+
+/** Internal names worth protecting: at least two words, so "Support" alone never matches. */
+export function protectedNames(names: Array<string | null | undefined>) {
+  const result = new Map<string, string>();
+  for (const name of names) {
+    const normalized = normalizedPersonName(name);
+    if (normalized.split(" ").length >= 2 && normalized.length >= 5) result.set(normalized, name!.trim().replace(/\s+/gu, " "));
+  }
+  return result;
+}
+
+/** The internal person an external From display name copies, if any. */
+export function impersonatedName(displayName: string | null | undefined, names: ReadonlyMap<string, string>) {
+  const normalized = normalizedPersonName(displayName);
+  if (!normalized) return null;
+  return names.get(normalized) ?? null;
+}
+
+/** `"ceo@ourco.com" <x@elsewhere.example>`: an address in the name that is not the sender. */
+export function embeddedAddress(displayName: string | null | undefined, fromAddress: string) {
+  const match = displayName?.match(/[^\s<>"'()@]+@[a-z0-9.-]+\.[a-z]{2,}/iu)?.[0];
+  if (!match) return null;
+  return match.toLocaleLowerCase() === fromAddress.toLocaleLowerCase() ? null : match;
+}

package/worker/mail/inbound-delivery.ts

@@ -0,0 +1,22 @@
+import { bytesToBase64Url } from "@open-workspace/core/worker/lib/crypto.ts";
+import { normalizeEmail, normalizeMailboxAddress } from "@open-workspace/core/worker/lib/ids.ts";
+
+export async function inboundDeliveryId(input: {
+  mailboxId: string;
+  envelopeFrom: string;
+  envelopeTo: string;
+  raw: ArrayBuffer;
+}) {
+  const prefix = new TextEncoder().encode([
+    input.mailboxId,
+    normalizeEmail(input.envelopeFrom),
+    normalizeMailboxAddress(input.envelopeTo),
+    "",
+  ].join("\0"));
+  const rawDigest = new Uint8Array(await crypto.subtle.digest("SHA-256", input.raw));
+  const digestInput = new Uint8Array(prefix.byteLength + rawDigest.byteLength);
+  digestInput.set(prefix);
+  digestInput.set(rawDigest, prefix.byteLength);
+  const digest = await crypto.subtle.digest("SHA-256", digestInput);
+  return `in_${bytesToBase64Url(new Uint8Array(digest))}`;
+}

package/worker/mail/inbound-threading.ts

@@ -0,0 +1,48 @@
+import { normalizeEmail } from "@open-workspace/core/worker/lib/ids.ts";
+import type { MailAddress } from "../mailbox/model";
+import type { Email } from "../mailbox/schema";
+import { normalizedParticipantSet } from "./participants";
+
+type ThreadParent = Pick<
+  Email,
+  "listId" | "fromJson" | "toJson" | "ccJson" | "bccJson"
+>;
+
+/**
+ * RFC references still point at the source message, but a private answer to a
+ * visible group belongs to a separate local chat in the messenger model.
+ */
+export function shouldDetachInboundReply(input: {
+  ownAddress: string;
+  parent: ThreadParent;
+  from: MailAddress[];
+  to: MailAddress[];
+  cc: MailAddress[];
+  listId: string | null;
+}) {
+  const { parent } = input;
+  const normalizedListId = input.listId?.trim().toLocaleLowerCase() ?? null;
+  const parentListId = parent.listId?.trim().toLocaleLowerCase() ?? null;
+  if (parent.listId && parentListId !== normalizedListId) return true;
+
+  const parentParticipants = normalizedParticipantSet(
+    [...parent.fromJson, ...parent.toJson, ...parent.ccJson].map(
+      (participant) => participant.address,
+    ),
+    input.ownAddress,
+  );
+  const incomingParticipants = normalizedParticipantSet(
+    [...input.from, ...input.to, ...input.cc].map(
+      (participant) => participant.address,
+    ),
+    input.ownAddress,
+  );
+  const parentWasGroup = Boolean(parent.listId) || parentParticipants.size > 1;
+  const incomingIsDirect = input.listId === null && incomingParticipants.size === 1;
+  if (parentWasGroup && incomingIsDirect) return true;
+
+  const hiddenRecipients = new Set(
+    parent.bccJson.map((recipient) => normalizeEmail(recipient.address)),
+  );
+  return input.from.some((sender) => hiddenRecipients.has(normalizeEmail(sender.address)));
+}

package/worker/mail/inbound.ts

@@ -0,0 +1,255 @@
+import PostalMime, { type Address, type Email as ParsedEmail } from "postal-mime";
+import { convert } from "html-to-text";
+import { headerValues } from "../../shared/mail-headers";
+import { createId, normalizeMailboxAddress } from "@open-workspace/core/worker/lib/ids.ts";
+import type { MailAddress, StoredAttachment } from "../mailbox/model";
+import type { Email, NewEmail, PendingInbound } from "../mailbox/schema";
+import { inboundHeaderMetadata } from "./auth-headers";
+import { shouldDetachInboundReply } from "./inbound-threading";
+import { linkDomains, MAX_LINK_DOMAINS } from "./link-domains";
+import { parseReplyText } from "./quote-parser";
+import {
+  address,
+  headerValue,
+  listId,
+  listPostAddress,
+  messageIds,
+} from "./rfc";
+
+function flattenAddresses(values: Address[] | undefined): MailAddress[] {
+  return (values ?? []).flatMap((value) =>
+    value.group
+      ? value.group.map((mailbox) => address(mailbox.address, mailbox.name))
+      : value.address
+        ? [address(value.address, value.name)]
+        : [],
+  );
+}
+
+function attachmentBytes(content: ArrayBuffer | Uint8Array | string) {
+  if (typeof content === "string") return new TextEncoder().encode(content);
+  return content instanceof Uint8Array ? content : new Uint8Array(content);
+}
+
+export class UnprocessableInboundEmailError extends Error {
+  constructor(message: string, options?: ErrorOptions) {
+    super(message, options);
+    this.name = "UnprocessableInboundEmailError";
+  }
+}
+
+export class MissingRawMimeError extends Error {
+  constructor() {
+    super("The original message is not available in storage yet");
+    this.name = "MissingRawMimeError";
+  }
+}
+
+const MAX_HEADER_SCAN_BYTES = 256 * 1024;
+
+/** The header section of a raw message as text; bodies are never needed here. */
+export function rawHeaderText(rawMime: ArrayBuffer | Uint8Array) {
+  const bytes = rawMime instanceof Uint8Array ? rawMime : new Uint8Array(rawMime);
+  return new TextDecoder().decode(bytes.subarray(0, MAX_HEADER_SCAN_BYTES));
+}
+
+/** The Message-ID of a raw message, read from its headers alone. */
+export function rawMessageId(rawMime: ArrayBuffer | Uint8Array) {
+  return messageIds(headerValues(rawHeaderText(rawMime), "message-id")[0])[0] ?? null;
+}
+
+/** RFC 2919 list identifier: design@example.com is design.example.com. */
+export function listIdFor(address: string) {
+  return normalizeMailboxAddress(address).replace("@", ".");
+}
+
+export function inboundMessageId(deliveryId: string) {
+  return `msg_${deliveryId.replaceAll(/[^a-zA-Z0-9_-]/gu, "_")}`;
+}
+
+async function parseMime(bytes: ArrayBuffer): Promise<ParsedEmail> {
+  try {
+    return await PostalMime.parse(bytes);
+  } catch (error) {
+    throw new UnprocessableInboundEmailError(
+      "The original message could not be parsed",
+      { cause: error },
+    );
+  }
+}
+
+export async function readInboundRawMime(env: Env, job: PendingInbound) {
+  const raw = await env.MAIL_STORAGE.get(job.rawObjectKey);
+  if (!raw) {
+    // The durable queue is committed before the R2 upload, so an alarm can
+    // briefly win that race. Missing storage remains retryable.
+    throw new MissingRawMimeError();
+  }
+  return raw.arrayBuffer();
+}
+
+export function prepareUnprocessableInboundEmail(input: {
+  job: PendingInbound;
+  reason: string;
+  rawMimeR2Key: string | null;
+}): NewEmail {
+  const messageId = inboundMessageId(input.job.id);
+  const fromAddress = input.job.envelopeFrom || "unknown@invalid";
+  return {
+    id: messageId,
+    conversationId: createId("conv"),
+    direction: "incoming",
+    messageIdHeader: null,
+    inReplyToJson: [],
+    referencesJson: [],
+    fromJson: [address(fromAddress)],
+    replyToJson: [],
+    toJson: [address(input.job.envelopeTo)],
+    ccJson: [],
+    bccJson: [],
+    subject: "(unreadable message)",
+    preview: input.reason,
+    bodyText: [
+      input.reason,
+      "",
+      input.rawMimeR2Key
+        ? "The original MIME message was preserved for diagnostics."
+        : "The original MIME message is not available.",
+    ].join("\n"),
+    quotedText: null,
+    bodyHtmlR2Key: null,
+    rawMimeR2Key: input.rawMimeR2Key,
+    attachmentsJson: [],
+    listId: null,
+    listPostAddress: null,
+    envelopeFrom: input.job.envelopeFrom || null,
+    envelopeTo: input.job.envelopeTo || null,
+    timelineAt: input.job.receivedAt,
+    transportState: "received",
+    deliveryStatusJson: [],
+  };
+}
+
+export async function prepareInboundEmail(input: {
+  env: Env;
+  mailboxId: string;
+  job: PendingInbound;
+  rawMime: ArrayBuffer;
+  resolveParent: (inReplyTo: string[], references: string[]) => Email | null;
+}): Promise<{ email: NewEmail; linkDomains: string[] }> {
+  const { job } = input;
+  const parsed = await parseMime(input.rawMime);
+  const inReplyTo = messageIds(parsed.inReplyTo);
+  const references = messageIds(parsed.references);
+  const parent = input.resolveParent(inReplyTo, references);
+  const recipient = normalizeMailboxAddress(job.envelopeTo);
+  const from = flattenAddresses(parsed.from ? [parsed.from] : []);
+  if (!from.length) from.push(address(job.envelopeFrom || "unknown@invalid"));
+  const to = flattenAddresses(parsed.to);
+  const cc = flattenAddresses(parsed.cc);
+  const bcc = flattenAddresses(parsed.bcc);
+  const replyTo = flattenAddresses(parsed.replyTo);
+  // A workspace mailing list is the latest list hop, so it names the list.
+  const parsedListId = job.listAddress
+    ? listIdFor(job.listAddress)
+    : listId(parsed.headers);
+  const parsedListPost = job.listAddress ?? listPostAddress(
+    headerValue(parsed.headers, "list-post"),
+  );
+  const detached = parent
+    ? shouldDetachInboundReply({
+        ownAddress: recipient,
+        parent,
+        from,
+        to,
+        cc,
+        listId: parsedListId,
+      })
+    : false;
+  const messageId = inboundMessageId(job.id);
+  const plainBody = parsed.text?.trim()
+    ? parsed.text
+    : parsed.html
+      ? convert(parsed.html, {
+          wordwrap: false,
+          selectors: [
+            { selector: "img", format: "skip" },
+            { selector: "style", format: "skip" },
+          ],
+        })
+      : "";
+  const replyText = parseReplyText(plainBody);
+  const bodyHtmlR2Key = parsed.html
+    ? `mailboxes/${input.mailboxId}/messages/${messageId}/body.html`
+    : null;
+  if (bodyHtmlR2Key && parsed.html) {
+    await input.env.MAIL_STORAGE.put(bodyHtmlR2Key, parsed.html, {
+      httpMetadata: { contentType: "text/html; charset=utf-8" },
+    });
+  }
+
+  const attachments: StoredAttachment[] = [];
+  for (const [index, file] of parsed.attachments.entries()) {
+    const id = `att_${messageId}_${index}`;
+    const r2Key =
+      `mailboxes/${input.mailboxId}/messages/${messageId}/attachments/${id}`;
+    const bytes = attachmentBytes(file.content);
+    await input.env.MAIL_STORAGE.put(r2Key, bytes, {
+      httpMetadata: { contentType: file.mimeType },
+    });
+    attachments.push({
+      id,
+      r2Key,
+      filename: file.filename || "attachment",
+      contentType: file.mimeType,
+      size: bytes.byteLength,
+      contentId: file.contentId ?? null,
+      disposition: file.disposition === "inline" ? "inline" : "attachment",
+      delivery: "attached",
+      downloadTokenHash: null,
+      downloadExpiresAt: null,
+    });
+  }
+
+  const email: NewEmail = {
+    id: messageId,
+    conversationId: parent && !detached ? parent.conversationId : createId("conv"),
+    direction: "incoming",
+    messageIdHeader: messageIds(parsed.messageId)[0] ?? null,
+    inReplyToJson: inReplyTo,
+    referencesJson: references,
+    fromJson: from,
+    replyToJson: replyTo,
+    toJson: to,
+    ccJson: cc,
+    bccJson: bcc,
+    subject: parsed.subject?.trim() || "(no subject)",
+    preview: replyText.bodyText.replace(/\s+/gu, " ").trim().slice(0, 220),
+    bodyText: replyText.bodyText,
+    quotedText: replyText.quotedText,
+    bodyHtmlR2Key,
+    rawMimeR2Key: job.rawObjectKey,
+    attachmentsJson: attachments,
+    listId: parsedListId,
+    listPostAddress: parsedListPost,
+    ...inboundHeaderMetadata({
+      rawHeaders: rawHeaderText(input.rawMime),
+      fromAddress: from[0]?.address ?? null,
+      envelopeFrom: job.envelopeFrom || null,
+    }),
+    envelopeFrom: job.envelopeFrom || null,
+    envelopeTo: job.envelopeTo || null,
+    timelineAt: job.receivedAt,
+    transportState: "received",
+    deliveryStatusJson: [],
+  };
+  return {
+    email,
+    // Over-collect: workspace domains are filtered out once D1 has been read.
+    linkDomains: linkDomains({
+      html: parsed.html,
+      text: [parsed.text],
+      limit: MAX_LINK_DOMAINS * 2,
+    }),
+  };
+}