The same parsed receive→reply loop — with no mail server to keep alive.

// Postal must return 200 within 5s or it retries and eventually bounces.
import express from "express";
const app = express();
app.use(express.json({ limit: "50mb" })); // attachments arrive base64-inline

app.post("/postal/incoming", async (req, res) => {
  const m = req.body; // { rcpt_to, mail_from, subject, plain_body, html_body,
                      //   spam_status, attachments: [{ filename, content_type, data }] }

  // No SPF/DKIM/DMARC verdict block — the aligned result lives in the raw
  // Authentication-Results headers, so you parse it yourself.
  const trusted = m.spam_status === "NotSpam"; // weaker than a real auth verdict

  // Attachments are base64 inline — decode each one yourself.
  const files = (m.attachments ?? []).map((a) => ({
    filename: a.filename, buffer: Buffer.from(a.data, "base64"),
  }));

  const answer = await runAgent({ task: m.plain_body, from: m.mail_from, trusted });

  // Reply via YOUR Postal box — you host the auth, the IP, and the server behind it.
  await fetch("https://postal.yourco.dev/api/v1/send/message", {
    method: "POST",
    headers: { "X-Server-API-Key": process.env.POSTAL_API_KEY, "Content-Type": "application/json" },
    body: JSON.stringify({ to: [m.mail_from], from: m.rcpt_to, subject: `Re: ${m.subject}`, html_body: answer.html }),
  });
  res.sendStatus(200); // must be fast, or Postal retries
});

POST /your-webhook   Content-Type: application/json
x-mailkite-signature: t=…,v1=…   (HMAC-SHA256 — verify locally)

{
  "id": "msg_2Hk9…",
  "type": "email.received",
  "from": { "address": "ada@example.com" },
  "to": [{ "address": "support@myapp.ai" }],
  "subject": "Re: invoice #1042",
  "text": "Looks good — approved!",
  "html": "<p>Looks good — approved!</p>",
  "threadId": "<a1b2c3@mail.example.com>",
  "auth": { "spf": "pass", "dkim": "pass", "dmarc": "pass", "spam": "ham" },
  "attachments": [
    { "filename": "po.pdf", "contentType": "application/pdf",
      "size": 18213, "url": "https://api.mailkite.dev/att/2Hk9…/0?sig=…" }
  ]
}