淼达Mailda

共享收件箱，知道谁回复了。

淼达把一个邮件地址变成有人负责、有据可查的工作：谁在回复，有没有人回复过，哪条规则扣下了什么、为什么。它运行在你自己的 Cloudflare 账户里，域名、邮件、密钥和账单都归你。没有需要依赖的淼达服务，没有许可证服务器，没有遥测。与我们断开，一切照常运行。

写给所有者 它只需要 Workers Paid 套餐：每月 5 美元，含 3,000 封邮件，超出后每千封 0.35 美元。一个二十人的团队每月发一万封，约付 7.45 美元。收信不限量。不适合群发通讯，也不面向 Outlook。开源，Apache-2.0 许可。

安装 放进你的 AI

41 秒了解淼达 41 秒
画面文字。没有人声，只有音乐。
  1. 你的域名在 Cloudflare 上？
  2. 淼达把它变成你自己的邮件系统。
  3. 寄到你的域名的邮件……保存在你自己的 Cloudflare 账户里……由你的团队一起阅读和回复。
  4. 来自任何人 → 你的 Cloudflare 账户（Email Routing 接收，Worker 运行淼达，D1 和 R2 存储）→ 你的团队：阅读 · 分派 · 回复。
  5. 共享收件箱：分派邮件，看到谁回复了，同一封邮件不会被回复两次。
  6. 与我们断开，照常运行：域名、邮件和密钥都留在你的账户里。不需要淼达账号，没有遥测。
  7. 一条命令安装：运行在 Cloudflare 的 Workers Paid 套餐上，每月 5 美元起，付给 Cloudflare。
  8. 这是真实的应用。点回复就认领了它，不会有人重复回复。每份草稿都保存在你的节点上。
  9. 装进你自己的 Cloudflare 账户：curl -fsSL https://mailda.site/install.sh | bash
  10. mailda.site/zh-cn · 可运行的 alpha 版 · 开源，Apache-2.0 许可

mailda doctor 可运行的 alpha 版 已经建成的、仍然薄弱的，以及为每条说法负责的那一页

  1. ok install 一条命令装进你自己的 Cloudflare 账户：它帮你登录、部署，在同一个终端里认领节点，并用这一次登录配置好收信、发信和投递结果，命令结束时节点已在接收。不用控制台，不用 API 令牌，不用 OAuth 客户端。已在全新账户上演练；同一账户里的第二个节点只是一个名字，更新也只要一条命令。 deploy-drill-live-account.md
  2. ok receiving 带队列的共享收件箱：认领、转交、关闭，每个邮箱一个首次回复计时。会话、标签、已读状态、归档和回收站（可恢复），可搜索主题、发件人和正文。 application-shell.md
  3. ok mail_security 每封邮件都带有接收服务器的 SPF/DKIM/DMARC 判定；附件按文件名和魔数判断；链接对照其显示的文字和你自己的域名判断；隔离和抑制，都按邮箱设置。不用模型。 mail-security.md
  4. ok sending 每次发送先定稿为一份清单，再暂留十五秒，然后移交给邮件服务商。规则、需两人的审批、域名暂停、速率熔断器，以及由服务商自己的退信建立的抑制列表。 send-breakers.md
  5. ok butlers 管家是作用于邮件的程序：确定性执行；运行预算不够的，发布时即被拒绝；出现循环就暂停；任何邮件离开之前都要由人放行。llm.* 步骤类型已声明，并被拒绝。 butler-engine.md
  6. ok your_ai 由契约生成的 SDK、Agent Skill 和 MCP 服务器，全部来自同一份路由注册表。代理持有固定的能力上限，永远无法签发 org.admin。 machine-surfaces.md
  7. ok governance 任何东西都不会删减的审计记录、事项、需两人才能解除的法律保全、留下记录的受监督查阅、执行前须经批准的电子取证导出。 supervised-access.md
  8. ok custody 证据用只有你的节点持有的密钥加密，密钥恢复副本由十个恢复码打开；备份可以离线验证；恢复已演练三次，其中一次一直走到接收邮件。 disaster-recovery.md

  9. 以下 warn 行是仓库 README 自己的话，保留英文原文。

  10. warn a_restore_has A restore has worked three times, and once through to receiving mail. Three drills (#92): cross-account, then a real backup, then a same-account restore that took a domain, wrote its own routing, and accepted a message from outside. The catalog imports at about a thousand rows a second. README
  11. warn deployment_promotes_on Deployment promotes on its own, measured twice. mailda deploy does expand/contract with a canary and refuses to promote a version whose doctor is worse than the incumbent's (#98). The canary is reached by a version override on the production hostname, because preview URLs do not exist for a Worker with Durable Objects. README
  12. warn mail_security_is Mail security is thin. The receiving server's SPF, DKIM and DMARC verdict is stored; a DMARC failure is shown on the message and its row in the list, and the full verdict is one click away in the message's details. Attachments are judged by name and magic bytes, links by where they really go, and a mailbox can hold back… README
  13. warn english_and_simplified English and Simplified Chinese. The interface's words are a typed catalog per locale (ADR 46): a missing translation does not compile, and a check with the TypeScript checker counts every string not yet in the catalog, file by file, down to zero, which it is. Simplified Chinese (简体中文, the mark 淼达) is offered beside English since… README
  14. report receipts 产品里的每个限额、成本和耗时都有一份测量记录，写明它如何测得、何时过时。缺少测量记录的常量，构建会拒绝。 docs/receipts/

warn 行是 README 自己的话。厂商的页面会把它们删掉。 先读完整的状态说明，再依赖这里的任何内容。

一条命令，一个下午

curl -fsSL https://mailda.site/install.sh | bash

它帮你登录 Cloudflare，部署到你的账户，在同一个终端里认领节点，询问应在哪个域名收信，并用同一次登录启用路由、为发信接入域名、订阅投递结果，每一项都读回核对，缺少记录就拒绝继续。命令结束时，节点已在接收。不用控制台，不用 API 令牌，不用 OAuth 客户端。打开节点：在它有了地址、邮件路由到它之前，它显示下一步和完成这一步的命令，之后才是收件箱。使用你自己的主机名只需再回答一个问题，由部署来绑定。节点自己的凭据（在配置页粘贴一个 API 令牌）是可选的，只用于以后在浏览器里修改这些配置。如果你更想手动安排账户，控制台里的做法也写下来了。 它需要的每项设置，都在一页里。

之后，在同一个目录里运行 curl -fsSL https://mailda.site/update.sh | bash，它会拉取新版本、备份节点、说明数据库结构将有什么变化，然后经由金丝雀版本重新部署。你不需要输入任何 git 命令，用部署按钮创建的节点也一样。

看它如何工作

以下视频为英文。

共享收件箱 63 秒
画面文字。没有人声，只有音乐。
  1. Two people answer the same customer. Nobody can say whether invoices@ got a reply.
  2. Mailda: shared inboxes that know who replied. In your own Cloudflare account.
  3. One queue per mailbox. Who holds each conversation, and for how long. A first-response clock. Overdue says so.
  4. Somebody already answering it? Mailda names who, before you write a word. Take it anyway, and they’re told.
  5. Hand a conversation to a colleague. In their queue now, and the trail names you both.
  6. Reply from the shared address. Every send waits 15 seconds, so you can stop it.
  7. Who can read, send and decide, at a glance.
  8. Install it in your own Cloudflare account: curl -fsSL https://mailda.site/install.sh | bash
  9. mailda.site · Functional alpha · open source, Apache-2.0
管家：不用 AI 的自动化 79 秒
画面文字。没有人声，只有音乐。
  1. Butlers are small programs that act on your mail. They run on your Node, when mail arrives. No AI inside: the same mail gets the same result.
  2. How you set one up: write it, in the editor · save: it is checked · publish: version 1, frozen · give it a mailbox · mail arrives: it runs.
  3. 1 · Write it in the editor, in YAML or JSON. Make a mistake… 2 · Saving checks it: the step, the reason, the fix. 3 · Publish freezes it as version 1. 4 · Give it a mailbox. It never borrows your access.
  4. 5 · An invoice email arrives. It is stored before anything else happens. Filed, then one run starts. Never twice for one message. Each step checks the Butler’s own access. Every effect is recorded, and audited.
  5. The invoice is with Chen. The run says what it did, and what it was refused.
  6. A Butler can propose a reply. It waits, sealed, until a person releases it. A machine never sends on its own.
  7. Whose resources does it use? Yours: your Cloudflare account, your Workers plan. Each step has a ceiling price, in subrequests. A run may spend up to 10,000. A Butler that can’t afford a run is refused when you save it. No AI model is called, so no AI tokens.
  8. A loop pauses it: three runs it caused itself, within an hour. An administrator resumes it, and has to say why. Every version is frozen; every run is on the record.
  9. Install it in your own Cloudflare account: curl -fsSL https://mailda.site/install.sh | bash
  10. mailda.site · Functional alpha · open source, Apache-2.0
在它之上构建：代理、SDK、MCP 和 CLI 67 秒
画面文字。没有人声，只有音乐。
  1. Your app in your AI. Never AI in your app.
  2. How your software reaches it: an agent, your AI with a ceiling · the SDK, typed, from the contract · Skill and MCP, for AI tools · the CLI: run it, and use it.
  3. 1 · Mint an agent: who it acts for, what it may do. 2 · Which mailboxes. Never beyond the person it acts for. 3 · Its token is shown once. Keep it like a password.
  4. Your AI does the thinking, on your AI provider’s bill. It calls your Node with its token. Every call is checked against its ceiling and its sponsor, live. It can draft. Sealing a send is withheld from every machine. Every act is audited: the agent, and the person it acts for.
  5. The SDK: typed, generated from the contract. Every route is a method. A refusal is a MaildaError with its code. @mailda/sdk ships in the repository. It is not on npm yet.
  6. An Agent Skill, generated from the contract: what an agent may call, and why the rest is withheld. An MCP server on your Node, at /mcp. The same agent token, and only the tools it may use.
  7. The CLI runs the Node. Install, upgrade, check it, back it up, verify the backup. And uses it: every route, by the SDK’s names, with an agent token.
  8. Install it in your own Cloudflare account: curl -fsSL https://mailda.site/install.sh | bash
  9. mailda.site · Functional alpha · open source, Apache-2.0
拥有它，运行它 55 秒
画面文字。没有人声，只有音乐。
  1. No Mailda service to depend on. No licence server. No telemetry. Disconnect us and nothing stops working.
  2. mailda install: one command, in your own account. Nothing changes before the deploy step. It receives mail when it ends.
  3. mailda upgrade: every step numbered. Keeps your own domain. Backs up only when a table changes.
  4. Doctor: problems first. What needs you leads. The long detail of what passed folds away.
  5. What it costs: $5 a month. Workers Paid: 3,000 emails included, then $0.35 per thousand. A twenty-person team sending ten thousand a month pays about $7.45. Inbound mail is unlimited. The bill is yours, paid to Cloudflare.
  6. Your keys, your backups: evidence sealed under keys only your Node holds. Escrowed to ten recovery codes. A backup you can verify offline. A restore drilled three times, once through to receiving mail.
  7. Install it in your own Cloudflare account: curl -fsSL https://mailda.site/install.sh | bash
  8. mailda.site · Functional alpha · open source, Apache-2.0
受治理的邮件（alpha） 41 秒
画面文字。没有人声，只有音乐。
  1. Functional alpha · looking for design partners. Who approved that send? Who read that mailbox, and why? Mailda keeps the answer.
  2. A rule: outside mail from Support needs two sign-offs. The approver reads exactly what would leave. One approves. It still waits for the second.
  3. An audit trail nothing trims.
  4. Matters, and legal holds it takes two people to lift.
  5. Also in the box: supervised reads that leave a record. E-discovery exports approved before they run.
  6. Install it in your own Cloudflare account: curl -fsSL https://mailda.site/install.sh | bash
  7. mailda.site · Functional alpha · open source, Apache-2.0