memory-journal-mcp 7.7.0 → 8.0.0

package/skills/cloudflare/references/durable-objects/gotchas.md

@@ -0,0 +1,200 @@
+# Durable Objects Gotchas
+
+## Common Errors
+
+### "Hibernation Cleared My In-Memory State"
+
+**Problem:** Variables lost after hibernation  
+**Cause:** DO auto-hibernates when idle; in-memory state not persisted  
+**Solution:** Use `ctx.storage` for critical data, `ws.serializeAttachment()` for per-connection metadata
+
+```typescript
+// ❌ Wrong - lost on hibernation
+private userCount = 0;
+async webSocketMessage(ws: WebSocket, msg: string) {
+  this.userCount++;  // Lost!
+}
+
+// ✅ Right - persisted
+async webSocketMessage(ws: WebSocket, msg: string) {
+  const count = this.ctx.storage.kv.get("userCount") || 0;
+  this.ctx.storage.kv.put("userCount", count + 1);
+}
+```
+
+### "setTimeout Didn't Fire After Restart"
+
+**Problem:** Scheduled work lost on eviction  
+**Cause:** `setTimeout` in-memory only; eviction clears timers  
+**Solution:** Use `ctx.storage.setAlarm()` for reliable scheduling
+
+```typescript
+// ❌ Wrong - lost on eviction
+setTimeout(() => this.cleanup(), 3600000);
+
+// ✅ Right - survives eviction
+await this.ctx.storage.setAlarm(Date.now() + 3600000);
+async alarm() { await this.cleanup(); }
+```
+
+### "Constructor Runs on Every Wake"
+
+**Problem:** Expensive init logic slows all requests  
+**Cause:** Constructor runs on every wake (first request after eviction OR after hibernation)  
+**Solution:** Lazy initialization or cache in storage
+
+**Critical understanding:** Constructor runs in two scenarios:
+
+1. **Cold start** - DO evicted from memory, first request creates new instance
+2. **Wake from hibernation** - DO with WebSockets hibernated, message/alarm wakes it
+
+```typescript
+// ❌ Wrong - expensive on every wake
+constructor(ctx: DurableObjectState, env: Env) {
+  super(ctx, env);
+  this.heavyData = this.loadExpensiveData();  // Slow!
+}
+
+// ✅ Right - lazy load
+private heavyData?: HeavyData;
+private getHeavyData() {
+  if (!this.heavyData) this.heavyData = this.loadExpensiveData();
+  return this.heavyData;
+}
+```
+
+### "Durable Object Overloaded (503 errors)"
+
+**Problem:** 503 errors under load  
+**Cause:** Single DO exceeding ~1K req/s throughput limit  
+**Solution:** Shard across multiple DOs (see [Patterns: Sharding](./patterns.md))
+
+### "Storage Quota Exceeded (Write failures)"
+
+**Problem:** Write operations failing  
+**Cause:** DO storage exceeding 10GB limit or account quota  
+**Solution:** Cleanup with alarms, use `deleteAll()` for old data, upgrade plan
+
+### "CPU Time Exceeded (Terminated)"
+
+**Problem:** Request terminated mid-execution  
+**Cause:** Processing exceeding 30s CPU time default limit  
+**Solution:** Increase `limits.cpu_ms` in wrangler.jsonc (max 300s) or chunk work
+
+### "WebSockets Disconnect on Eviction"
+
+**Problem:** Connections drop unexpectedly  
+**Cause:** DO evicted from memory without hibernation API  
+**Solution:** Use WebSocket hibernation handlers + client reconnection logic
+
+### "Migration Failed (Deploy error)"
+
+**Cause:** Non-unique tags, non-sequential tags, or invalid class names in migration  
+**Solution:** Check tag uniqueness/sequential ordering and verify class names are correct
+
+### "RPC Method Not Found"
+
+**Cause:** compatibility_date < 2024-04-03 preventing RPC usage  
+**Solution:** Update compatibility_date to >= 2024-04-03 or use fetch() instead of RPC
+
+### "Only One Alarm Allowed"
+
+**Cause:** Need multiple scheduled tasks but only one alarm supported per DO  
+**Solution:** Use event queue pattern to schedule multiple tasks with single alarm
+
+### "Race Condition Despite Single-Threading"
+
+**Problem:** Concurrent requests see inconsistent state  
+**Cause:** Async operations allow request interleaving (await = yield point)  
+**Solution:** Use `blockConcurrencyWhile()` for critical sections or atomic storage ops
+
+```typescript
+// ❌ Wrong - race condition
+async incrementCounter() {
+  const count = await this.ctx.storage.get("count") || 0;
+  // ⚠️ Another request could execute here during await
+  await this.ctx.storage.put("count", count + 1);
+}
+
+// ✅ Right - atomic operation
+async incrementCounter() {
+  return this.ctx.storage.sql.exec(
+    "INSERT INTO counters (id, value) VALUES (1, 1) ON CONFLICT(id) DO UPDATE SET value = value + 1 RETURNING value"
+  ).one().value;
+}
+
+// ✅ Right - explicit locking
+async criticalOperation() {
+  await this.ctx.blockConcurrencyWhile(async () => {
+    const count = await this.ctx.storage.get("count") || 0;
+    await this.ctx.storage.put("count", count + 1);
+  });
+}
+```
+
+### "Migration Rollback Not Supported"
+
+**Cause:** Attempting to rollback a migration after deployment  
+**Solution:** Test with `--dry-run` before deploying; migrations cannot be rolled back
+
+### "deleted_classes Destroys Data"
+
+**Problem:** Migration deleted all data  
+**Cause:** `deleted_classes` migration immediately destroys all DO instances and data  
+**Solution:** Test with `--dry-run`; use `transferred_classes` to preserve data during moves
+
+### "Cold Starts Are Slow"
+
+**Problem:** First request after eviction takes longer  
+**Cause:** DO constructor + initial storage access on cold start  
+**Solution:** Expected behavior; optimize constructor, use connection pooling in clients, consider warming strategy for critical DOs
+
+```typescript
+// Warming strategy (periodically ping critical DOs)
+export default {
+  async scheduled(event: ScheduledEvent, env: Env) {
+    const criticalIds = ['auth', 'sessions', 'locks']
+    await Promise.all(
+      criticalIds.map((name) => {
+        const id = env.MY_DO.idFromName(name)
+        const stub = env.MY_DO.get(id)
+        return stub.ping() // Keep warm
+      })
+    )
+  },
+}
+```
+
+## Limits
+
+| Limit                  | Free      | Paid      | Notes                                 |
+| ---------------------- | --------- | --------- | ------------------------------------- |
+| SQLite storage per DO  | 10 GB     | 10 GB     | Per Durable Object instance           |
+| SQLite total storage   | 5 GB      | Unlimited | Account-wide quota                    |
+| Key+value size         | 2 MB      | 2 MB      | Single KV pair (SQLite/async)         |
+| CPU time default       | 30s       | 30s       | Per request; configurable             |
+| CPU time max           | 300s      | 300s      | Set via `limits.cpu_ms`               |
+| DO classes             | 100       | 500       | Distinct DO class definitions         |
+| SQL columns            | 100       | 100       | Per table                             |
+| SQL statement size     | 100 KB    | 100 KB    | Max SQL query size                    |
+| WebSocket message size | 32 MiB    | 32 MiB    | Per message                           |
+| Request throughput     | ~1K req/s | ~1K req/s | Per DO (soft limit - shard for more)  |
+| Alarms per DO          | 1         | 1         | Use queue pattern for multiple events |
+| Total DOs              | Unlimited | Unlimited | Create as many instances as needed    |
+| WebSockets             | Unlimited | Unlimited | Within 128MB memory limit per DO      |
+| Memory per DO          | 128 MB    | 128 MB    | In-memory state + WebSocket buffers   |
+
+## Hibernation Caveats
+
+1. **Memory cleared** - All in-memory variables lost; reconstruct from storage or `deserializeAttachment()`
+2. **Constructor reruns** - Runs on wake; avoid expensive operations, use lazy initialization
+3. **No guarantees** - DO may evict instead of hibernate; design for both
+4. **Attachment limit** - `serializeAttachment()` data must be JSON-serializable, keep small
+5. **Alarm wakes DO** - Alarm prevents hibernation until handler completes
+6. **WebSocket state not automatic** - Must explicitly persist with `serializeAttachment()` or storage
+
+## See Also
+
+- **[Patterns](./patterns.md)** - Workarounds for common limitations
+- **[API](./api.md)** - Storage limits and quotas
+- **[Configuration](./configuration.md)** - Setting CPU limits

package/skills/cloudflare/references/durable-objects/patterns.md

@@ -0,0 +1,205 @@
+# Durable Objects Patterns
+
+## When to Use Which Pattern
+
+| Need                   | Pattern            | ID Strategy              |
+| ---------------------- | ------------------ | ------------------------ |
+| Rate limit per user/IP | Rate Limiting      | `idFromName(identifier)` |
+| Mutual exclusion       | Distributed Lock   | `idFromName(resource)`   |
+| >1K req/s throughput   | Sharding           | `newUniqueId()` or hash  |
+| Real-time updates      | WebSocket Collab   | `idFromName(room)`       |
+| User sessions          | Session Management | `idFromName(sessionId)`  |
+| Background cleanup     | Alarm-based        | Any                      |
+
+## RPC vs fetch()
+
+**RPC** (compat ≥2024-04-03): Type-safe, simpler, default for new projects  
+**fetch()**: Legacy compat, HTTP semantics, proxying
+
+```typescript
+const count = await stub.increment() // RPC
+const count = await (await stub.fetch(req)).json() // fetch()
+```
+
+## Sharding (High Throughput)
+
+Single DO ~1K req/s max. Shard for higher throughput:
+
+```typescript
+export default {
+  async fetch(req: Request, env: Env): Promise<Response> {
+    const userId = new URL(req.url).searchParams.get('user')
+    const hash = hashCode(userId) % 100 // 100 shards
+    const id = env.COUNTER.idFromName(`shard:${hash}`)
+    return env.COUNTER.get(id).fetch(req)
+  },
+}
+
+function hashCode(str: string): number {
+  let hash = 0
+  for (let i = 0; i < str.length; i++) hash = (hash << 5) - hash + str.charCodeAt(i)
+  return Math.abs(hash)
+}
+```
+
+**Decisions:**
+
+- **Shard count**: 10-1000 typical (start with 100, measure, adjust)
+- **Shard key**: User ID, IP, session - must distribute evenly (use hash)
+- **Aggregation**: Coordinator DO or external system (D1, R2)
+
+## Rate Limiting
+
+```typescript
+async checkLimit(key: string, limit: number, windowMs: number): Promise<boolean> {
+  const req = this.ctx.storage.sql.exec("SELECT COUNT(*) as count FROM requests WHERE key = ? AND timestamp > ?", key, Date.now() - windowMs).one();
+  if (req.count >= limit) return false;
+  this.ctx.storage.sql.exec("INSERT INTO requests (key, timestamp) VALUES (?, ?)", key, Date.now());
+  return true;
+}
+```
+
+## Distributed Lock
+
+```typescript
+private held = false;
+async acquire(timeoutMs = 5000): Promise<boolean> {
+  if (this.held) return false;
+  this.held = true;
+  await this.ctx.storage.setAlarm(Date.now() + timeoutMs);
+  return true;
+}
+async release() { this.held = false; await this.ctx.storage.deleteAlarm(); }
+async alarm() { this.held = false; }  // Auto-release on timeout
+```
+
+## Hibernation-Aware Pattern
+
+Preserve state across hibernation:
+
+```typescript
+async fetch(req: Request): Promise<Response> {
+  const [client, server] = Object.values(new WebSocketPair());
+  const userId = new URL(req.url).searchParams.get("user");
+  server.serializeAttachment({ userId });  // Survives hibernation
+  this.ctx.acceptWebSocket(server, ["room:lobby"]);
+  server.send(JSON.stringify({ type: "init", state: this.ctx.storage.kv.get("state") }));
+  return new Response(null, { status: 101, webSocket: client });
+}
+
+async webSocketMessage(ws: WebSocket, msg: string) {
+  const { userId } = ws.deserializeAttachment();  // Retrieve after wake
+  const state = this.ctx.storage.kv.get("state") || {};
+  state[userId] = JSON.parse(msg);
+  this.ctx.storage.kv.put("state", state);
+  for (const c of this.ctx.getWebSockets("room:lobby")) c.send(msg);
+}
+```
+
+## Real-time Collaboration
+
+Broadcast updates to all connected clients:
+
+```typescript
+async webSocketMessage(ws: WebSocket, msg: string) {
+  const data = JSON.parse(msg);
+  this.ctx.storage.kv.put("doc", data.content);  // Persist
+  for (const c of this.ctx.getWebSockets()) if (c !== ws) c.send(msg);  // Broadcast
+}
+```
+
+### WebSocket Reconnection
+
+**Client-side** (exponential backoff):
+
+```typescript
+class ResilientWS {
+  private delay = 1000
+  connect(url: string) {
+    const ws = new WebSocket(url)
+    ws.onclose = () =>
+      setTimeout(() => {
+        this.connect(url)
+        this.delay = Math.min(this.delay * 2, 30000)
+      }, this.delay)
+  }
+}
+```
+
+**Server-side** (cleanup on close):
+
+```typescript
+async webSocketClose(ws: WebSocket, code: number, reason: string, wasClean: boolean) {
+  const { userId } = ws.deserializeAttachment();
+  this.ctx.storage.sql.exec("UPDATE users SET online = false WHERE id = ?", userId);
+  for (const c of this.ctx.getWebSockets()) c.send(JSON.stringify({ type: "user_left", userId }));
+}
+```
+
+## Session Management
+
+```typescript
+async createSession(userId: string, data: object): Promise<string> {
+  const id = crypto.randomUUID(), exp = Date.now() + 86400000;
+  this.ctx.storage.sql.exec("INSERT INTO sessions VALUES (?, ?, ?, ?)", id, userId, JSON.stringify(data), exp);
+  await this.ctx.storage.setAlarm(exp);
+  return id;
+}
+
+async getSession(id: string): Promise<object | null> {
+  const row = this.ctx.storage.sql.exec("SELECT data FROM sessions WHERE id = ? AND expires_at > ?", id, Date.now()).one();
+  return row ? JSON.parse(row.data) : null;
+}
+
+async alarm() { this.ctx.storage.sql.exec("DELETE FROM sessions WHERE expires_at <= ?", Date.now()); }
+```
+
+## Multiple Events (Single Alarm)
+
+Queue pattern to schedule multiple events:
+
+```typescript
+async scheduleEvent(id: string, runAt: number) {
+  await this.ctx.storage.put(`event:${id}`, { id, runAt });
+  const curr = await this.ctx.storage.getAlarm();
+  if (!curr || runAt < curr) await this.ctx.storage.setAlarm(runAt);
+}
+
+async alarm() {
+  const events = await this.ctx.storage.list({ prefix: "event:" }), now = Date.now();
+  let next = null;
+  for (const [key, ev] of events) {
+    if (ev.runAt <= now) {
+      await this.processEvent(ev);
+      await this.ctx.storage.delete(key);
+    } else if (!next || ev.runAt < next) next = ev.runAt;
+  }
+  if (next) await this.ctx.storage.setAlarm(next);
+}
+```
+
+## Graceful Cleanup
+
+Use `ctx.waitUntil()` to complete work after response:
+
+```typescript
+async myMethod() {
+  const response = { success: true };
+  this.ctx.waitUntil(this.ctx.storage.sql.exec("DELETE FROM old_data WHERE timestamp < ?", cutoff));
+  return response;
+}
+```
+
+## Best Practices
+
+- **Design**: Use `idFromName()` for coordination, `newUniqueId()` for sharding, minimize constructor work
+- **Storage**: Prefer SQLite, batch with transactions, set alarms for cleanup, use PITR before risky ops
+- **Performance**: ~1K req/s per DO max - shard for more, cache in memory, use alarms for deferred work
+- **Reliability**: Handle 503 with retry+backoff, design for cold starts, test migrations with `--dry-run`
+- **Security**: Validate inputs in Workers, rate limit DO creation, use jurisdiction for compliance
+
+## See Also
+
+- **[API](./api.md)** - ctx methods, WebSocket handlers
+- **[Gotchas](./gotchas.md)** - Hibernation caveats, common errors
+- **[DO Storage](../do-storage/README.md)** - Storage patterns and transactions

package/skills/cloudflare/references/email-routing/README.md

@@ -0,0 +1,89 @@
+# Cloudflare Email Routing Skill Reference
+
+## Overview
+
+Cloudflare Email Routing enables custom email addresses for your domain that route to verified destination addresses. It's free, privacy-focused (no storage/access), and includes Email Workers for programmatic email processing.
+
+**Available to all Cloudflare customers using Cloudflare as authoritative nameserver.**
+
+## Quick Start
+
+```typescript
+// Basic email handler
+export default {
+  async email(message, env, ctx) {
+    // CRITICAL: Must consume stream before response
+    const parser = new PostalMime.default()
+    const email = await parser.parse(await message.raw.arrayBuffer())
+
+    // Process email
+    console.log(`From: ${message.from}, Subject: ${email.subject}`)
+
+    // Forward or reject
+    await message.forward('verified@destination.com')
+  },
+} satisfies ExportedHandler<Env>
+```
+
+## Reading Order
+
+**Start here based on your goal:**
+
+1. **New to Email Routing?** → [configuration.md](configuration.md) → [patterns.md](patterns.md)
+2. **Adding Workers?** → [api.md](api.md) § Worker Runtime API → [patterns.md](patterns.md)
+3. **Sending emails?** → [api.md](api.md) § SendEmail Binding
+4. **Managing via API?** → [api.md](api.md) § REST API Operations
+5. **Debugging issues?** → [gotchas.md](gotchas.md)
+
+## Decision Tree
+
+```
+Need to receive emails?
+├─ Simple forwarding only? → Dashboard rules (configuration.md)
+├─ Complex logic/filtering? → Email Workers (api.md + patterns.md)
+└─ Parse attachments/body? → postal-mime library (patterns.md § Parse Email)
+
+Need to send emails?
+├─ From Worker? → SendEmail binding (api.md § SendEmail)
+└─ From external app? → Use external SMTP/API service
+
+Having issues?
+├─ Email not arriving? → gotchas.md § Mail Authentication
+├─ Worker crashing? → gotchas.md § Stream Consumption
+└─ Forward failing? → gotchas.md § Destination Verification
+```
+
+## Key Concepts
+
+**Routing Rules**: Pattern-based forwarding configured via Dashboard/API. Simple but limited.
+
+**Email Workers**: Custom TypeScript handlers with full email access. Handles complex logic, parsing, storage, rejection.
+
+**SendEmail Binding**: Outbound email API for Workers. Transactional email only (no marketing/bulk).
+
+**ForwardableEmailMessage**: Runtime interface for incoming emails. Provides headers, raw stream, forward/reject methods.
+
+## In This Reference
+
+- **[configuration.md](configuration.md)** - Setup, deployment, wrangler config
+- **[api.md](api.md)** - REST API + Worker runtime API + types
+- **[patterns.md](patterns.md)** - Common patterns with working examples
+- **[gotchas.md](gotchas.md)** - Critical pitfalls, troubleshooting, limits
+
+## Architecture
+
+```
+Internet → MX Records → Cloudflare Email Routing
+                            ├─ Routing Rules (dashboard)
+                            └─ Email Worker (your code)
+                                ├─ Forward to destination
+                                ├─ Reject with reason
+                                ├─ Store in R2/KV/D1
+                                └─ Send outbound (SendEmail)
+```
+
+## See Also
+
+- [Cloudflare Docs: Email Routing](https://developers.cloudflare.com/email-routing/)
+- [Cloudflare Docs: Email Workers](https://developers.cloudflare.com/email-routing/email-workers/)
+- [postal-mime npm package](https://www.npmjs.com/package/postal-mime)

package/skills/cloudflare/references/email-routing/api.md

@@ -0,0 +1,192 @@
+# Email Routing API Reference
+
+## Worker Runtime API
+
+### Email Handler Interface
+
+```typescript
+interface ExportedHandler<Env = unknown> {
+  email?(message: ForwardableEmailMessage, env: Env, ctx: ExecutionContext): void | Promise<void>
+}
+```
+
+### ForwardableEmailMessage
+
+Main interface for incoming emails:
+
+```typescript
+interface ForwardableEmailMessage {
+  readonly from: string // Envelope sender (e.g., "sender@example.com")
+  readonly to: string // Envelope recipient (e.g., "you@yourdomain.com")
+  readonly headers: Headers // Web API Headers object
+  readonly raw: ReadableStream // Raw MIME message stream
+
+  setReject(reason: string): void
+  forward(rcptTo: string, headers?: Headers): Promise<void>
+}
+```
+
+**Key Properties:**
+
+| Property  | Type             | Description                                  |
+| --------- | ---------------- | -------------------------------------------- |
+| `from`    | `string`         | Envelope sender (MAIL FROM), not header From |
+| `to`      | `string`         | Envelope recipient (RCPT TO), not header To  |
+| `headers` | `Headers`        | Email headers (Subject, From, To, etc.)      |
+| `raw`     | `ReadableStream` | Raw MIME message (consume once only)         |
+
+**Methods:**
+
+- `setReject(reason)`: Reject email with bounce message
+- `forward(rcptTo, headers?)`: Forward to verified destination, optionally add headers
+
+### Headers Object
+
+Standard Web API Headers interface:
+
+```typescript
+// Access headers
+const subject = message.headers.get('subject')
+const from = message.headers.get('from')
+const messageId = message.headers.get('message-id')
+
+// Check spam score
+const spamScore = parseFloat(message.headers.get('x-cf-spamh-score') || '0')
+if (spamScore > 5) {
+  message.setReject('Spam detected')
+}
+```
+
+### Common Headers
+
+`subject`, `from`, `to`, `x-cf-spamh-score` (spam score), `message-id` (deduplication), `dkim-signature` (auth)
+
+### Envelope vs Header Addresses
+
+**Critical distinction:**
+
+```typescript
+// Envelope addresses (routing, auth checks)
+message.from // "bounce@sender.com" (actual sender)
+message.to // "you@yourdomain.com" (your address)
+
+// Header addresses (display, user-facing)
+message.headers.get('from') // "Alice <alice@sender.com>"
+message.headers.get('to') // "Bob <you@yourdomain.com>"
+```
+
+**Use envelope addresses for:**
+
+- Authentication/SPF checks
+- Routing decisions
+- Bounce handling
+
+**Use header addresses for:**
+
+- Display to users
+- Reply-To logic
+- User-facing filtering
+
+## SendEmail Binding
+
+Outbound email API for transactional messages.
+
+### Configuration
+
+```jsonc
+// wrangler.jsonc
+{
+  "send_email": [{ "name": "EMAIL" }],
+}
+```
+
+### TypeScript Types
+
+```typescript
+interface Env {
+  EMAIL: SendEmail
+}
+
+interface SendEmail {
+  send(message: EmailMessage): Promise<void>
+}
+
+interface EmailMessage {
+  from: string | { name?: string; email: string }
+  to: string | { name?: string; email: string } | Array<string | { name?: string; email: string }>
+  subject: string
+  text?: string
+  html?: string
+  headers?: Headers
+  reply_to?: string | { name?: string; email: string }
+}
+```
+
+### Send Email Example
+
+```typescript
+interface Env {
+  EMAIL: SendEmail
+}
+
+export default {
+  async fetch(request, env, ctx): Promise<Response> {
+    await env.EMAIL.send({
+      from: { name: 'Acme Corp', email: 'noreply@yourdomain.com' },
+      to: [{ name: 'Alice', email: 'alice@example.com' }, 'bob@example.com'],
+      subject: 'Your order #12345 has shipped',
+      text: 'Track your package at: https://track.example.com/12345',
+      html: "<p>Track your package at: <a href='https://track.example.com/12345'>View tracking</a></p>",
+      reply_to: { name: 'Support', email: 'support@yourdomain.com' },
+    })
+
+    return new Response('Email sent')
+  },
+} satisfies ExportedHandler<Env>
+```
+
+### SendEmail Constraints
+
+- **From address**: Must be on verified domain (your domain with Email Routing enabled)
+- **Volume limits**: Transactional only, no bulk/marketing email
+- **Rate limits**: 100 emails/minute on Free plan, higher on Paid
+- **No attachments**: Use links to hosted files instead
+- **No DKIM control**: Cloudflare signs automatically
+
+## REST API Operations
+
+Base URL: `https://api.cloudflare.com/client/v4`
+
+### Authentication
+
+```bash
+curl -H "Authorization: Bearer $API_TOKEN" https://api.cloudflare.com/client/v4/...
+```
+
+### Key Endpoints
+
+| Operation          | Method | Endpoint                                   |
+| ------------------ | ------ | ------------------------------------------ |
+| Enable routing     | POST   | `/zones/{zone_id}/email/routing/enable`    |
+| Disable routing    | POST   | `/zones/{zone_id}/email/routing/disable`   |
+| List rules         | GET    | `/zones/{zone_id}/email/routing/rules`     |
+| Create rule        | POST   | `/zones/{zone_id}/email/routing/rules`     |
+| Verify destination | POST   | `/zones/{zone_id}/email/routing/addresses` |
+| List destinations  | GET    | `/zones/{zone_id}/email/routing/addresses` |
+
+### Create Routing Rule Example
+
+```bash
+curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/email/routing/rules" \
+  -H "Authorization: Bearer $API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "enabled": true,
+    "name": "Forward sales",
+    "matchers": [{"type": "literal", "field": "to", "value": "sales@yourdomain.com"}],
+    "actions": [{"type": "forward", "value": ["alice@company.com"]}],
+    "priority": 0
+  }'
+```
+
+Matcher types: `literal` (exact match), `all` (catch-all).