@void/platform 0.20.1 → 0.20.3

package/dist/runtime/proxy/index.js

@@ -1,365 +1,310 @@
-var __create = Object.create;
 var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 
 // ../../home/runner/work/void/void/node_modules/.pnpm/unenv@2.0.0-rc.24/node_modules/unenv/dist/runtime/_internal/utils.mjs
 // @__NO_SIDE_EFFECTS__
 function createNotImplementedError(name) {
   return new Error(`[unenv] ${name} is not implemented yet!`);
 }
-var init_utils = __esm({
-  "../../home/runner/work/void/void/node_modules/.pnpm/unenv@2.0.0-rc.24/node_modules/unenv/dist/runtime/_internal/utils.mjs"() {
-    init_performance2();
-    __name(createNotImplementedError, "createNotImplementedError");
-  }
-});
+__name(createNotImplementedError, "createNotImplementedError");
 
 // ../../home/runner/work/void/void/node_modules/.pnpm/unenv@2.0.0-rc.24/node_modules/unenv/dist/runtime/node/internal/perf_hooks/performance.mjs
-var _timeOrigin, _performanceNow, nodeTiming, PerformanceEntry, PerformanceMark, PerformanceMeasure, PerformanceResourceTiming, PerformanceObserverEntryList, Performance, PerformanceObserver, performance;
-var init_performance = __esm({
-  "../../home/runner/work/void/void/node_modules/.pnpm/unenv@2.0.0-rc.24/node_modules/unenv/dist/runtime/node/internal/perf_hooks/performance.mjs"() {
-    init_performance2();
-    init_utils();
-    _timeOrigin = globalThis.performance?.timeOrigin ?? Date.now();
-    _performanceNow = globalThis.performance?.now ? globalThis.performance.now.bind(globalThis.performance) : () => Date.now() - _timeOrigin;
-    nodeTiming = {
-      name: "node",
-      entryType: "node",
-      startTime: 0,
-      duration: 0,
-      nodeStart: 0,
-      v8Start: 0,
-      bootstrapComplete: 0,
-      environment: 0,
-      loopStart: 0,
-      loopExit: 0,
-      idleTime: 0,
-      uvMetricsInfo: {
-        loopCount: 0,
-        events: 0,
-        eventsWaiting: 0
-      },
-      detail: void 0,
-      toJSON() {
-        return this;
-      }
-    };
-    PerformanceEntry = class {
-      static {
-        __name(this, "PerformanceEntry");
-      }
-      __unenv__ = true;
-      detail;
-      entryType = "event";
-      name;
-      startTime;
-      constructor(name, options) {
-        this.name = name;
-        this.startTime = options?.startTime || _performanceNow();
-        this.detail = options?.detail;
-      }
-      get duration() {
-        return _performanceNow() - this.startTime;
-      }
-      toJSON() {
-        return {
-          name: this.name,
-          entryType: this.entryType,
-          startTime: this.startTime,
-          duration: this.duration,
-          detail: this.detail
-        };
-      }
-    };
-    PerformanceMark = class PerformanceMark2 extends PerformanceEntry {
-      static {
-        __name(this, "PerformanceMark");
-      }
-      entryType = "mark";
-      constructor() {
-        super(...arguments);
-      }
-      get duration() {
-        return 0;
-      }
-    };
-    PerformanceMeasure = class extends PerformanceEntry {
-      static {
-        __name(this, "PerformanceMeasure");
-      }
-      entryType = "measure";
-    };
-    PerformanceResourceTiming = class extends PerformanceEntry {
-      static {
-        __name(this, "PerformanceResourceTiming");
-      }
-      entryType = "resource";
-      serverTiming = [];
-      connectEnd = 0;
-      connectStart = 0;
-      decodedBodySize = 0;
-      domainLookupEnd = 0;
-      domainLookupStart = 0;
-      encodedBodySize = 0;
-      fetchStart = 0;
-      initiatorType = "";
-      name = "";
-      nextHopProtocol = "";
-      redirectEnd = 0;
-      redirectStart = 0;
-      requestStart = 0;
-      responseEnd = 0;
-      responseStart = 0;
-      secureConnectionStart = 0;
-      startTime = 0;
-      transferSize = 0;
-      workerStart = 0;
-      responseStatus = 0;
-    };
-    PerformanceObserverEntryList = class {
-      static {
-        __name(this, "PerformanceObserverEntryList");
-      }
-      __unenv__ = true;
-      getEntries() {
-        return [];
-      }
-      getEntriesByName(_name, _type) {
-        return [];
-      }
-      getEntriesByType(type) {
-        return [];
-      }
-    };
-    Performance = class {
-      static {
-        __name(this, "Performance");
-      }
-      __unenv__ = true;
-      timeOrigin = _timeOrigin;
-      eventCounts = /* @__PURE__ */ new Map();
-      _entries = [];
-      _resourceTimingBufferSize = 0;
-      navigation = void 0;
-      timing = void 0;
-      timerify(_fn, _options) {
-        throw createNotImplementedError("Performance.timerify");
-      }
-      get nodeTiming() {
-        return nodeTiming;
-      }
-      eventLoopUtilization() {
-        return {};
-      }
-      markResourceTiming() {
-        return new PerformanceResourceTiming("");
-      }
-      onresourcetimingbufferfull = null;
-      now() {
-        if (this.timeOrigin === _timeOrigin) {
-          return _performanceNow();
-        }
-        return Date.now() - this.timeOrigin;
-      }
-      clearMarks(markName) {
-        this._entries = markName ? this._entries.filter((e) => e.name !== markName) : this._entries.filter((e) => e.entryType !== "mark");
-      }
-      clearMeasures(measureName) {
-        this._entries = measureName ? this._entries.filter((e) => e.name !== measureName) : this._entries.filter((e) => e.entryType !== "measure");
-      }
-      clearResourceTimings() {
-        this._entries = this._entries.filter((e) => e.entryType !== "resource" || e.entryType !== "navigation");
-      }
-      getEntries() {
-        return this._entries;
-      }
-      getEntriesByName(name, type) {
-        return this._entries.filter((e) => e.name === name && (!type || e.entryType === type));
-      }
-      getEntriesByType(type) {
-        return this._entries.filter((e) => e.entryType === type);
-      }
-      mark(name, options) {
-        const entry = new PerformanceMark(name, options);
-        this._entries.push(entry);
-        return entry;
-      }
-      measure(measureName, startOrMeasureOptions, endMark) {
-        let start;
-        let end;
-        if (typeof startOrMeasureOptions === "string") {
-          start = this.getEntriesByName(startOrMeasureOptions, "mark")[0]?.startTime;
-          end = this.getEntriesByName(endMark, "mark")[0]?.startTime;
-        } else {
-          start = Number.parseFloat(startOrMeasureOptions?.start) || this.now();
-          end = Number.parseFloat(startOrMeasureOptions?.end) || this.now();
-        }
-        const entry = new PerformanceMeasure(measureName, {
-          startTime: start,
-          detail: {
-            start,
-            end
-          }
-        });
-        this._entries.push(entry);
-        return entry;
-      }
-      setResourceTimingBufferSize(maxSize) {
-        this._resourceTimingBufferSize = maxSize;
-      }
-      addEventListener(type, listener, options) {
-        throw createNotImplementedError("Performance.addEventListener");
-      }
-      removeEventListener(type, listener, options) {
-        throw createNotImplementedError("Performance.removeEventListener");
-      }
-      dispatchEvent(event) {
-        throw createNotImplementedError("Performance.dispatchEvent");
-      }
-      toJSON() {
-        return this;
-      }
+var _timeOrigin = globalThis.performance?.timeOrigin ?? Date.now();
+var _performanceNow = globalThis.performance?.now ? globalThis.performance.now.bind(globalThis.performance) : () => Date.now() - _timeOrigin;
+var nodeTiming = {
+  name: "node",
+  entryType: "node",
+  startTime: 0,
+  duration: 0,
+  nodeStart: 0,
+  v8Start: 0,
+  bootstrapComplete: 0,
+  environment: 0,
+  loopStart: 0,
+  loopExit: 0,
+  idleTime: 0,
+  uvMetricsInfo: {
+    loopCount: 0,
+    events: 0,
+    eventsWaiting: 0
+  },
+  detail: void 0,
+  toJSON() {
+    return this;
+  }
+};
+var PerformanceEntry = class {
+  static {
+    __name(this, "PerformanceEntry");
+  }
+  __unenv__ = true;
+  detail;
+  entryType = "event";
+  name;
+  startTime;
+  constructor(name, options) {
+    this.name = name;
+    this.startTime = options?.startTime || _performanceNow();
+    this.detail = options?.detail;
+  }
+  get duration() {
+    return _performanceNow() - this.startTime;
+  }
+  toJSON() {
+    return {
+      name: this.name,
+      entryType: this.entryType,
+      startTime: this.startTime,
+      duration: this.duration,
+      detail: this.detail
     };
-    PerformanceObserver = class {
-      static {
-        __name(this, "PerformanceObserver");
-      }
-      __unenv__ = true;
-      static supportedEntryTypes = [];
-      _callback = null;
-      constructor(callback) {
-        this._callback = callback;
-      }
-      takeRecords() {
-        return [];
-      }
-      disconnect() {
-        throw createNotImplementedError("PerformanceObserver.disconnect");
-      }
-      observe(options) {
-        throw createNotImplementedError("PerformanceObserver.observe");
-      }
-      bind(fn) {
-        return fn;
-      }
-      runInAsyncScope(fn, thisArg, ...args) {
-        return fn.call(thisArg, ...args);
-      }
-      asyncId() {
-        return 0;
-      }
-      triggerAsyncId() {
-        return 0;
-      }
-      emitDestroy() {
-        return this;
+  }
+};
+var PerformanceMark = class PerformanceMark2 extends PerformanceEntry {
+  static {
+    __name(this, "PerformanceMark");
+  }
+  entryType = "mark";
+  constructor() {
+    super(...arguments);
+  }
+  get duration() {
+    return 0;
+  }
+};
+var PerformanceMeasure = class extends PerformanceEntry {
+  static {
+    __name(this, "PerformanceMeasure");
+  }
+  entryType = "measure";
+};
+var PerformanceResourceTiming = class extends PerformanceEntry {
+  static {
+    __name(this, "PerformanceResourceTiming");
+  }
+  entryType = "resource";
+  serverTiming = [];
+  connectEnd = 0;
+  connectStart = 0;
+  decodedBodySize = 0;
+  domainLookupEnd = 0;
+  domainLookupStart = 0;
+  encodedBodySize = 0;
+  fetchStart = 0;
+  initiatorType = "";
+  name = "";
+  nextHopProtocol = "";
+  redirectEnd = 0;
+  redirectStart = 0;
+  requestStart = 0;
+  responseEnd = 0;
+  responseStart = 0;
+  secureConnectionStart = 0;
+  startTime = 0;
+  transferSize = 0;
+  workerStart = 0;
+  responseStatus = 0;
+};
+var PerformanceObserverEntryList = class {
+  static {
+    __name(this, "PerformanceObserverEntryList");
+  }
+  __unenv__ = true;
+  getEntries() {
+    return [];
+  }
+  getEntriesByName(_name, _type) {
+    return [];
+  }
+  getEntriesByType(type) {
+    return [];
+  }
+};
+var Performance = class {
+  static {
+    __name(this, "Performance");
+  }
+  __unenv__ = true;
+  timeOrigin = _timeOrigin;
+  eventCounts = /* @__PURE__ */ new Map();
+  _entries = [];
+  _resourceTimingBufferSize = 0;
+  navigation = void 0;
+  timing = void 0;
+  timerify(_fn, _options) {
+    throw createNotImplementedError("Performance.timerify");
+  }
+  get nodeTiming() {
+    return nodeTiming;
+  }
+  eventLoopUtilization() {
+    return {};
+  }
+  markResourceTiming() {
+    return new PerformanceResourceTiming("");
+  }
+  onresourcetimingbufferfull = null;
+  now() {
+    if (this.timeOrigin === _timeOrigin) {
+      return _performanceNow();
+    }
+    return Date.now() - this.timeOrigin;
+  }
+  clearMarks(markName) {
+    this._entries = markName ? this._entries.filter((e) => e.name !== markName) : this._entries.filter((e) => e.entryType !== "mark");
+  }
+  clearMeasures(measureName) {
+    this._entries = measureName ? this._entries.filter((e) => e.name !== measureName) : this._entries.filter((e) => e.entryType !== "measure");
+  }
+  clearResourceTimings() {
+    this._entries = this._entries.filter((e) => e.entryType !== "resource" || e.entryType !== "navigation");
+  }
+  getEntries() {
+    return this._entries;
+  }
+  getEntriesByName(name, type) {
+    return this._entries.filter((e) => e.name === name && (!type || e.entryType === type));
+  }
+  getEntriesByType(type) {
+    return this._entries.filter((e) => e.entryType === type);
+  }
+  mark(name, options) {
+    const entry = new PerformanceMark(name, options);
+    this._entries.push(entry);
+    return entry;
+  }
+  measure(measureName, startOrMeasureOptions, endMark) {
+    let start;
+    let end;
+    if (typeof startOrMeasureOptions === "string") {
+      start = this.getEntriesByName(startOrMeasureOptions, "mark")[0]?.startTime;
+      end = this.getEntriesByName(endMark, "mark")[0]?.startTime;
+    } else {
+      start = Number.parseFloat(startOrMeasureOptions?.start) || this.now();
+      end = Number.parseFloat(startOrMeasureOptions?.end) || this.now();
+    }
+    const entry = new PerformanceMeasure(measureName, {
+      startTime: start,
+      detail: {
+        start,
+        end
       }
-    };
-    performance = globalThis.performance && "addEventListener" in globalThis.performance ? globalThis.performance : new Performance();
+    });
+    this._entries.push(entry);
+    return entry;
   }
-});
-
-// ../../home/runner/work/void/void/node_modules/.pnpm/unenv@2.0.0-rc.24/node_modules/unenv/dist/runtime/node/perf_hooks.mjs
-var init_perf_hooks = __esm({
-  "../../home/runner/work/void/void/node_modules/.pnpm/unenv@2.0.0-rc.24/node_modules/unenv/dist/runtime/node/perf_hooks.mjs"() {
-    init_performance2();
-    init_performance();
+  setResourceTimingBufferSize(maxSize) {
+    this._resourceTimingBufferSize = maxSize;
   }
-});
+  addEventListener(type, listener, options) {
+    throw createNotImplementedError("Performance.addEventListener");
+  }
+  removeEventListener(type, listener, options) {
+    throw createNotImplementedError("Performance.removeEventListener");
+  }
+  dispatchEvent(event) {
+    throw createNotImplementedError("Performance.dispatchEvent");
+  }
+  toJSON() {
+    return this;
+  }
+};
+var PerformanceObserver = class {
+  static {
+    __name(this, "PerformanceObserver");
+  }
+  __unenv__ = true;
+  static supportedEntryTypes = [];
+  _callback = null;
+  constructor(callback) {
+    this._callback = callback;
+  }
+  takeRecords() {
+    return [];
+  }
+  disconnect() {
+    throw createNotImplementedError("PerformanceObserver.disconnect");
+  }
+  observe(options) {
+    throw createNotImplementedError("PerformanceObserver.observe");
+  }
+  bind(fn) {
+    return fn;
+  }
+  runInAsyncScope(fn, thisArg, ...args) {
+    return fn.call(thisArg, ...args);
+  }
+  asyncId() {
+    return 0;
+  }
+  triggerAsyncId() {
+    return 0;
+  }
+  emitDestroy() {
+    return this;
+  }
+};
+var performance = globalThis.performance && "addEventListener" in globalThis.performance ? globalThis.performance : new Performance();
 
 // ../../home/runner/work/void/void/node_modules/.pnpm/@cloudflare+unenv-preset@2.16.1_unenv@2.0.0-rc.24_workerd@1.20260910.1/node_modules/@cloudflare/unenv-preset/dist/runtime/polyfill/performance.mjs
-var init_performance2 = __esm({
-  "../../home/runner/work/void/void/node_modules/.pnpm/@cloudflare+unenv-preset@2.16.1_unenv@2.0.0-rc.24_workerd@1.20260910.1/node_modules/@cloudflare/unenv-preset/dist/runtime/polyfill/performance.mjs"() {
-    init_perf_hooks();
-    if (!("__unenv__" in performance)) {
-      const proto = Performance.prototype;
-      for (const key of Object.getOwnPropertyNames(proto)) {
-        if (key !== "constructor" && !(key in performance)) {
-          const desc = Object.getOwnPropertyDescriptor(proto, key);
-          if (desc) {
-            Object.defineProperty(performance, key, desc);
-          }
-        }
+if (!("__unenv__" in performance)) {
+  const proto = Performance.prototype;
+  for (const key of Object.getOwnPropertyNames(proto)) {
+    if (key !== "constructor" && !(key in performance)) {
+      const desc = Object.getOwnPropertyDescriptor(proto, key);
+      if (desc) {
+        Object.defineProperty(performance, key, desc);
       }
     }
-    globalThis.performance = performance;
-    globalThis.Performance = Performance;
-    globalThis.PerformanceEntry = PerformanceEntry;
-    globalThis.PerformanceMark = PerformanceMark;
-    globalThis.PerformanceMeasure = PerformanceMeasure;
-    globalThis.PerformanceObserver = PerformanceObserver;
-    globalThis.PerformanceObserverEntryList = PerformanceObserverEntryList;
-    globalThis.PerformanceResourceTiming = PerformanceResourceTiming;
   }
-});
+}
+globalThis.performance = performance;
+globalThis.Performance = Performance;
+globalThis.PerformanceEntry = PerformanceEntry;
+globalThis.PerformanceMark = PerformanceMark;
+globalThis.PerformanceMeasure = PerformanceMeasure;
+globalThis.PerformanceObserver = PerformanceObserver;
+globalThis.PerformanceObserverEntryList = PerformanceObserverEntryList;
+globalThis.PerformanceResourceTiming = PerformanceResourceTiming;
 
-// ../../home/runner/work/void/void/node_modules/.pnpm/email-validator@2.0.4/node_modules/email-validator/index.js
-var require_email_validator = __commonJS({
-  "../../home/runner/work/void/void/node_modules/.pnpm/email-validator@2.0.4/node_modules/email-validator/index.js"(exports) {
-    "use strict";
-    init_performance2();
-    var tester = /^[-!#$%&'*+\/0-9=?A-Z^_a-z{|}~](\.?[-!#$%&'*+\/0-9=?A-Z^_a-z`{|}~])*@[a-zA-Z0-9](-*\.?[a-zA-Z0-9])*\.[a-zA-Z](-?[a-zA-Z0-9])+$/;
-    exports.validate = function(email) {
-      if (!email)
-        return false;
-      if (email.length > 254)
-        return false;
-      var valid = tester.test(email);
-      if (!valid)
-        return false;
-      var parts = email.split("@");
-      if (parts[0].length > 64)
-        return false;
-      var domainParts = parts[1].split(".");
-      if (domainParts.some(function(part) {
-        return part.length > 63;
-      }))
-        return false;
-      return true;
-    };
+// ../../home/runner/work/void/void/packages/platform/dist/email-protocol.mjs
+var encoder = new TextEncoder();
+var decoder = new TextDecoder("utf-8", { fatal: true });
+function unbase64url(value) {
+  if (!/^[A-Za-z0-9_-]+$/.test(value) || value.length > 1024) throw new Error("invalid receipt");
+  const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - value.length % 4) % 4));
+  return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+__name(unbase64url, "unbase64url");
+async function receiptKey(secret, usage) {
+  if (!secret) throw new Error("Email signing key is not configured");
+  return crypto.subtle.importKey("raw", encoder.encode(secret), {
+    name: "HMAC",
+    hash: "SHA-256"
+  }, false, [usage]);
+}
+__name(receiptKey, "receiptKey");
+async function verifyEmailReceipt(token, signingSecret, expected, now = Date.now()) {
+  try {
+    if (token.length > 1536) return null;
+    const parts = token.split(".");
+    if (parts.length !== 2) return null;
+    const payload = unbase64url(parts[0]);
+    const signature = unbase64url(parts[1]);
+    if (payload.byteLength > 768 || signature.byteLength !== 32) return null;
+    if (!await crypto.subtle.verify("HMAC", await receiptKey(signingSecret, "verify"), Uint8Array.from(signature), Uint8Array.from(payload))) return null;
+    const claims = JSON.parse(decoder.decode(payload));
+    if (typeof claims !== "object" || claims === null) return null;
+    const value = claims;
+    if (value.version !== 1 || typeof value.receiptId !== "string" || !/^[a-f0-9-]{16,64}$/.test(value.receiptId) || value.projectId !== expected.projectId || value.deploymentId !== expected.deploymentId || value.recipient !== expected.recipient || typeof value.expiresAt !== "number" || !Number.isSafeInteger(value.expiresAt) || value.expiresAt < now || value.expiresAt > now + 6e4) return null;
+    return value;
+  } catch {
+    return null;
   }
-});
-
-// ../../home/runner/work/void/void/platform/packages/proxy/src/index.ts
-init_performance2();
-
-// ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/index.js
-init_performance2();
-
-// ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/hono.js
-init_performance2();
-
-// ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/hono-base.js
-init_performance2();
+}
+__name(verifyEmailReceipt, "verifyEmailReceipt");
 
 // ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/compose.js
-init_performance2();
 var compose = /* @__PURE__ */ __name((middleware, onError, onNotFound) => {
   return (context, next) => {
     let index = -1;
@@ -404,28 +349,9 @@ var compose = /* @__PURE__ */ __name((middleware, onError, onNotFound) => {
   };
 }, "compose");
 
-// ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/context.js
-init_performance2();
-
-// ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/request.js
-init_performance2();
-
-// ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/http-exception.js
-init_performance2();
-
 // ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/request/constants.js
-init_performance2();
 var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
 
-// ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/utils/body.js
-init_performance2();
-
-// ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/utils/buffer.js
-init_performance2();
-
-// ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/utils/crypto.js
-init_performance2();
-
 // ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/utils/buffer.js
 var bufferToFormData = /* @__PURE__ */ __name((arrayBuffer, contentType) => {
   const response = new Response(arrayBuffer, {
@@ -538,7 +464,6 @@ var throwNestingLimitExceeded = /* @__PURE__ */ __name(() => {
 }, "throwNestingLimitExceeded");
 
 // ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/utils/url.js
-init_performance2();
 var splitPath = /* @__PURE__ */ __name((path) => {
   const paths = path.split("/");
   if (paths[0] === "") {
@@ -591,13 +516,13 @@ var getPattern = /* @__PURE__ */ __name((label, next) => {
   }
   return null;
 }, "getPattern");
-var tryDecode = /* @__PURE__ */ __name((str, decoder2) => {
+var tryDecode = /* @__PURE__ */ __name((str, decoder5) => {
   try {
-    return decoder2(str);
+    return decoder5(str);
   } catch {
     return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match2) => {
       try {
-        return decoder2(match2);
+        return decoder5(match2);
       } catch {
         return match2;
       }
@@ -1029,7 +954,6 @@ var HonoRequest = class {
 };
 
 // ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/utils/html.js
-init_performance2();
 var HtmlEscapedCallbackPhase = {
   Stringify: 1,
   BeforeStream: 2,
@@ -1501,7 +1425,6 @@ var Context = class {
 };
 
 // ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router.js
-init_performance2();
 var METHOD_NAME_ALL = "ALL";
 var METHOD_NAME_ALL_LOWERCASE = "all";
 var METHODS = ["get", "post", "put", "delete", "options", "patch", "query"];
@@ -1513,7 +1436,6 @@ var UnsupportedPathError = class extends Error {
 };
 
 // ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/utils/constants.js
-init_performance2();
 var COMPOSED_HANDLER = "__COMPOSED_HANDLER";
 
 // ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/hono-base.js
@@ -1627,14 +1549,14 @@ var Hono = class _Hono {
    * app.route("/api", app2) // GET /api/user
    * ```
    */
-  route(path, app5) {
+  route(path, app4) {
     const subApp = this.basePath(path);
-    app5.routes.map((r) => {
+    app4.routes.map((r) => {
       let handler;
-      if (app5.errorHandler === errorHandler) {
+      if (app4.errorHandler === errorHandler) {
         handler = r.handler;
       } else {
-        handler = /* @__PURE__ */ __name(async (c, next) => (await compose([], app5.errorHandler)(c, () => r.handler(c, next))).res, "handler");
+        handler = /* @__PURE__ */ __name(async (c, next) => (await compose([], app4.errorHandler)(c, () => r.handler(c, next))).res, "handler");
         handler[COMPOSED_HANDLER] = r.handler;
       }
       subApp.#addRoute(r.method, r.path, handler, r.basePath);
@@ -1897,18 +1819,10 @@ var Hono = class _Hono {
   }, "fire");
 };
 
-// ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/index.js
-init_performance2();
-
-// ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/router.js
-init_performance2();
-
 // ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/utils.js
-init_performance2();
 var createNullObject = /* @__PURE__ */ __name(() => /* @__PURE__ */ Object.create(null), "createNullObject");
 
 // ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/matcher.js
-init_performance2();
 var emptyParam = [];
 function match(method, path) {
   const matchers = this.buildAllMatchers();
@@ -1931,7 +1845,6 @@ function match(method, path) {
 __name(match, "match");
 
 // ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/node.js
-init_performance2();
 var LABEL_REG_EXP_STR = "[^/]+";
 var ONLY_WILDCARD_REG_EXP_STR = ".*";
 var TAIL_WILDCARD_REG_EXP_STR = "(?:|/.*)";
@@ -2043,7 +1956,6 @@ var Node = class _Node {
 };
 
 // ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/trie.js
-init_performance2();
 var Trie = class {
   static {
     __name(this, "Trie");
@@ -2236,14 +2148,7 @@ var RegExpRouter = class {
   }
 };
 
-// ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/prepared-router.js
-init_performance2();
-
-// ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/smart-router/index.js
-init_performance2();
-
 // ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/smart-router/router.js
-init_performance2();
 var SmartRouter = class {
   static {
     __name(this, "SmartRouter");
@@ -2301,14 +2206,7 @@ var SmartRouter = class {
   }
 };
 
-// ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/trie-router/index.js
-init_performance2();
-
-// ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/trie-router/router.js
-init_performance2();
-
 // ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/trie-router/node.js
-init_performance2();
 var emptyParams = createNullObject();
 var order = 0;
 var Node2 = class _Node2 {
@@ -2507,7 +2405,6 @@ var Hono2 = class extends Hono {
 };
 
 // ../../home/runner/work/void/void/node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/middleware/cors/index.js
-init_performance2();
 var cors = /* @__PURE__ */ __name((options) => {
   const opts = {
     origin: "*",
@@ -2593,11 +2490,7 @@ var cors = /* @__PURE__ */ __name((options) => {
   }, "cors2");
 }, "cors");
 
-// ../../home/runner/work/void/void/platform/packages/proxy/src/ai.ts
-init_performance2();
-
 // ../../home/runner/work/void/void/platform/packages/proxy/src/body.ts
-init_performance2();
 function isProxyBody(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -2606,10 +2499,6 @@ function asString(value) {
   return typeof value === "string" ? value : null;
 }
 __name(asString, "asString");
-function asNumber(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : null;
-}
-__name(asNumber, "asNumber");
 function asRecord(value) {
   return isProxyBody(value) ? value : {};
 }
@@ -2984,7 +2873,6 @@ ai.post("/toMarkdown", async (context) => {
 });
 
 // ../../home/runner/work/void/void/platform/packages/proxy/src/capabilities.ts
-init_performance2();
 function proxyCapabilityEnabled(value, capability) {
   if (capability === "sandbox") {
     return false;
@@ -3001,11 +2889,7 @@ function proxyCapabilityEnabled(value, capability) {
 }
 __name(proxyCapabilityEnabled, "proxyCapabilityEnabled");
 
-// ../../home/runner/work/void/void/platform/packages/proxy/src/d1.ts
-init_performance2();
-
 // ../../home/runner/work/void/void/platform/packages/proxy/src/dispatch.ts
-init_performance2();
 async function resolveWorker(api, jwtSecret, projectId) {
   const token = await hmacSign(projectId, jwtSecret);
   const res = await api.fetch(`https://api/internal/resolve-worker/${projectId}`, {
@@ -3066,7 +2950,7 @@ async function dispatchToWorker(env, projectId, path, body, options = {}) {
   }
 }
 __name(dispatchToWorker, "dispatchToWorker");
-var encoder = new TextEncoder();
+var encoder2 = new TextEncoder();
 var cachedSignKey;
 var cachedKeySecret;
 async function getSignKey(secret) {
@@ -3075,7 +2959,7 @@ async function getSignKey(secret) {
   }
   cachedSignKey = await crypto.subtle.importKey(
     "raw",
-    encoder.encode(secret),
+    encoder2.encode(secret),
     { name: "HMAC", hash: "SHA-256" },
     false,
     ["sign"]
@@ -3086,14 +2970,13 @@ async function getSignKey(secret) {
 __name(getSignKey, "getSignKey");
 async function hmacSign(data, secret) {
   const key = await getSignKey(secret);
-  const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
+  const sig = await crypto.subtle.sign("HMAC", key, encoder2.encode(data));
   const binary = String.fromCharCode(...new Uint8Array(sig));
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 __name(hmacSign, "hmacSign");
 
 // ../../home/runner/work/void/void/platform/packages/proxy/src/resolve.ts
-init_performance2();
 var cache = /* @__PURE__ */ new Map();
 async function resolveResource(api, jwtSecret, projectId, type, bindingName) {
   const cacheKey = `${projectId}:${type}:${bindingName}`;
@@ -3119,24 +3002,38 @@ async function resolveResource(api, jwtSecret, projectId, type, bindingName) {
   return data.cf_id;
 }
 __name(resolveResource, "resolveResource");
-async function verifyProjectOwner(api, jwtSecret, projectId, userId) {
+async function verifyProjectDeployAccess(api, jwtSecret, projectId, userId, jwt, accessAssertion, proxyOrigin) {
   try {
-    const token = await hmacSign2(projectId, jwtSecret);
+    if (!proxyOrigin || new URL(proxyOrigin).origin !== proxyOrigin) {
+      return false;
+    }
+    const token = await hmacSign2(ownerVerificationMessage(projectId, proxyOrigin), jwtSecret);
     const res = await api.fetch(`https://api/internal/verify-owner/${projectId}`, {
       method: "POST",
       headers: {
         "content-type": "application/json",
         "x-void-internal": token
       },
-      body: JSON.stringify({ userId })
+      body: JSON.stringify({
+        userId,
+        ...jwt ? { jwt } : {},
+        ...accessAssertion ? { accessAssertion } : {},
+        proxyOrigin
+      })
     });
     return res.ok;
   } catch {
     return false;
   }
 }
-__name(verifyProjectOwner, "verifyProjectOwner");
-async function verifyPrerenderBuild(api, jwtSecret, projectId, buildId) {
+__name(verifyProjectDeployAccess, "verifyProjectDeployAccess");
+function ownerVerificationMessage(projectId, proxyOrigin) {
+  return `void-proxy-owner-v2
+${projectId}
+${proxyOrigin}`;
+}
+__name(ownerVerificationMessage, "ownerVerificationMessage");
+async function verifyPrerenderAuthority(api, jwtSecret, projectId, userId, provenance) {
   try {
     const token = await hmacSign2(projectId, jwtSecret);
     const res = await api.fetch(`https://api/internal/verify-prerender-build/${projectId}`, {
@@ -3145,15 +3042,19 @@ async function verifyPrerenderBuild(api, jwtSecret, projectId, buildId) {
         "content-type": "application/json",
         "x-void-internal": token
       },
-      body: JSON.stringify({ buildId })
+      body: JSON.stringify({ userId, ...provenance })
     });
+    if (res.status === 400 && !provenance.buildId && !provenance.credentialId) {
+      const body = await res.json().catch(() => null);
+      return body?.error === "userId and credential provenance required";
+    }
     return res.ok;
   } catch {
     return false;
   }
 }
-__name(verifyPrerenderBuild, "verifyPrerenderBuild");
-var encoder2 = new TextEncoder();
+__name(verifyPrerenderAuthority, "verifyPrerenderAuthority");
+var encoder3 = new TextEncoder();
 var cachedSignKey2;
 var cachedKeySecret2;
 async function getSignKey2(secret) {
@@ -3162,7 +3063,7 @@ async function getSignKey2(secret) {
   }
   cachedSignKey2 = await crypto.subtle.importKey(
     "raw",
-    encoder2.encode(secret),
+    encoder3.encode(secret),
     { name: "HMAC", hash: "SHA-256" },
     false,
     ["sign"]
@@ -3173,7 +3074,7 @@ async function getSignKey2(secret) {
 __name(getSignKey2, "getSignKey");
 async function hmacSign2(data, secret) {
   const key = await getSignKey2(secret);
-  const sig = await crypto.subtle.sign("HMAC", key, encoder2.encode(data));
+  const sig = await crypto.subtle.sign("HMAC", key, encoder3.encode(data));
   const binary = String.fromCharCode(...new Uint8Array(sig));
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
@@ -3252,95 +3153,478 @@ d1.post("/batch", async (context) => {
   return context.json({ error: "atomic D1 batch unavailable for active deployment" }, 503);
 });
 
-// ../../home/runner/work/void/void/platform/packages/proxy/src/email-relay.ts
-init_performance2();
-
-// ../../home/runner/work/void/void/platform/packages/proxy/src/email-router.ts
-init_performance2();
-
-// ../../home/runner/work/void/void/platform/packages/api/src/reserved-slugs.ts
-init_performance2();
-var EMAIL_RESERVED_SLUGS = /* @__PURE__ */ new Set([
-  "abuse",
-  "bounce",
-  "noreply",
-  "postmaster",
-  "security"
-]);
-function isReservedEmailSlug(slug) {
-  return EMAIL_RESERVED_SLUGS.has(slug);
+// ../../home/runner/work/void/void/platform/packages/proxy/src/email-request-body.ts
+var EMAIL_REQUEST_DEADLINE_MS = 5e3;
+var decoder2 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: false });
+async function beforeDeadline(deadline, run) {
+  const remaining = deadline - Date.now();
+  if (remaining <= 0) {
+    throw new Error("email request timeout");
+  }
+  let timer;
+  return Promise.race([
+    run(),
+    new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error("email request timeout")), remaining);
+    })
+  ]).finally(() => {
+    if (timer !== void 0) {
+      clearTimeout(timer);
+    }
+  });
+}
+__name(beforeDeadline, "beforeDeadline");
+async function readEmailRequestJson(request, maxBytes = 2 * 1024) {
+  const declaredLength = request.headers.get("content-length");
+  if (request.headers.has("content-encoding") || !request.body || declaredLength !== null && (!/^\d+$/.test(declaredLength) || Number(declaredLength) > maxBytes)) {
+    void request.body?.cancel().catch(() => {
+    });
+    throw new Error("invalid email request body");
+  }
+  const expectedLength = declaredLength === null ? null : Number(declaredLength);
+  const reader = request.body.getReader();
+  let bytes = new Uint8Array(Math.min(1024, maxBytes));
+  const deadline = Date.now() + EMAIL_REQUEST_DEADLINE_MS;
+  let size = 0;
+  try {
+    for (; ; ) {
+      const chunk = await beforeDeadline(deadline, () => reader.read());
+      if (chunk.done) {
+        break;
+      }
+      const nextSize = size + chunk.value.byteLength;
+      if (nextSize > maxBytes) {
+        throw new Error("email request body too large");
+      }
+      if (nextSize > bytes.byteLength) {
+        const grown = new Uint8Array(Math.min(maxBytes, Math.max(nextSize, bytes.byteLength * 2)));
+        grown.set(bytes.subarray(0, size));
+        bytes = grown;
+      }
+      bytes.set(chunk.value, size);
+      size = nextSize;
+    }
+  } finally {
+    void reader.cancel().catch(() => {
+    });
+    reader.releaseLock();
+  }
+  if (size === 0 || expectedLength !== null && size !== expectedLength) {
+    throw new Error("invalid email request body length");
+  }
+  return JSON.parse(decoder2.decode(bytes.subarray(0, size)));
 }
-__name(isReservedEmailSlug, "isReservedEmailSlug");
+__name(readEmailRequestJson, "readEmailRequestJson");
 
-// ../../home/runner/work/void/void/platform/packages/proxy/src/email-router.ts
-var import_email_validator = __toESM(require_email_validator(), 1);
-import { EmailMessage as EmailMessage2 } from "cloudflare:email";
+// ../../home/runner/work/void/void/platform/packages/proxy/src/email.ts
+import { EmailMessage } from "cloudflare:email";
 
-// ../../home/runner/work/void/void/platform/packages/proxy/src/email-lease.ts
-init_performance2();
-var LEASE_CACHE_TTL_MS = 45 * 60 * 1e3;
-var leaseCache = /* @__PURE__ */ new Map();
-function dropEmailDomainLease(domain) {
-  leaseCache.delete(domain);
-}
-__name(dropEmailDomainLease, "dropEmailDomainLease");
-function leaseBearer(lease) {
-  return lease.kind === "api_token" ? lease.token : lease.accessToken;
+// ../../home/runner/work/void/void/platform/packages/proxy/src/email-admission.ts
+var encoder4 = new TextEncoder();
+var decoder3 = new TextDecoder();
+var EMAIL_DEFAULT_DEADLINE_MS = 5e3;
+var EMAIL_ACTION_DEADLINE_MS = 15e3;
+var EMAIL_ADMISSION_DEADLINE_MS = 15e3;
+var MAX_ADMISSION_RESPONSE_BYTES = 65536;
+async function sign(data, secret) {
+  if (!secret) {
+    throw new Error("Email signing key is not configured");
+  }
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder4.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const bytes = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder4.encode(data)));
+  return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-__name(leaseBearer, "leaseBearer");
-async function leaseEmailDomainCredential(env, domain) {
-  const cached = leaseCache.get(domain);
-  if (cached && cached.expiresAt > Date.now()) {
-    return cached.lease;
-  }
-  let res;
-  try {
-    const token = await hmacSign3(domain, env.JWT_SECRET);
-    res = await env.API.fetch("https://api/internal/email/domain-credential", {
+__name(sign, "sign");
+async function call(env, path, body, deadlineMs = EMAIL_DEFAULT_DEADLINE_MS) {
+  const controller = new AbortController();
+  const deadline = Date.now() + deadlineMs;
+  const beforeDeadline2 = /* @__PURE__ */ __name(async (run) => {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) {
+      controller.abort();
+      throw new Error("EMAIL_ADMISSION_TIMEOUT");
+    }
+    const promise = run();
+    let timer;
+    try {
+      return await Promise.race([
+        promise,
+        new Promise((_, reject) => {
+          timer = setTimeout(() => {
+            controller.abort();
+            reject(new Error("EMAIL_ADMISSION_TIMEOUT"));
+          }, remaining);
+        })
+      ]);
+    } finally {
+      if (timer !== void 0) {
+        clearTimeout(timer);
+      }
+    }
+  }, "beforeDeadline");
+  const raw2 = JSON.stringify(body);
+  const proof = await sign(raw2, env.EMAIL_SIGNING_SECRET);
+  const response = await beforeDeadline2(
+    () => env.API.fetch(`https://api/internal/email/actions${path}`, {
       method: "POST",
       headers: {
         "content-type": "application/json",
-        "x-void-internal": token
+        "x-void-internal": proof
       },
-      body: JSON.stringify({ domain })
+      body: raw2,
+      signal: controller.signal
+    })
+  );
+  if (!response.ok) {
+    void response.body?.cancel().catch(() => {
     });
-  } catch {
-    return null;
+    if (response.status === 409) {
+      throw new Error("IDEMPOTENCY_CONFLICT");
+    }
+    throw new Error(`EMAIL_ADMISSION_${response.status}`);
   }
-  if (!res.ok) {
-    return null;
+  const reader = response.body?.getReader();
+  if (!reader) {
+    throw new Error("EMAIL_ADMISSION_EMPTY_RESPONSE");
   }
-  let data;
+  const bytes = new Uint8Array(MAX_ADMISSION_RESPONSE_BYTES);
+  let size = 0;
   try {
-    data = await res.json();
-  } catch {
-    return null;
-  }
-  const lease = parseLease(data);
-  if (!lease) {
-    return null;
+    for (; ; ) {
+      const chunk = await beforeDeadline2(() => reader.read());
+      if (chunk.done) {
+        break;
+      }
+      if (size + chunk.value.byteLength > bytes.length) {
+        throw new Error("EMAIL_ADMISSION_RESPONSE_TOO_LARGE");
+      }
+      bytes.set(chunk.value, size);
+      size += chunk.value.byteLength;
+    }
+    return JSON.parse(decoder3.decode(bytes.subarray(0, size)));
+  } finally {
+    void reader.cancel().catch(() => {
+    });
+    try {
+      reader.releaseLock();
+    } catch {
+    }
   }
-  leaseCache.set(domain, { lease, expiresAt: Date.now() + LEASE_CACHE_TTL_MS });
-  return lease;
 }
-__name(leaseEmailDomainCredential, "leaseEmailDomainCredential");
-function parseLease(data) {
-  if (typeof data !== "object" || data === null) {
-    return null;
+__name(call, "call");
+function canonicalizeVoidMime(raw2) {
+  if (findCrlfCrlf(raw2) === -1) {
+    return raw2;
+  }
+  const boundaries = /* @__PURE__ */ new Map();
+  const output = [];
+  let outputBytes = 0;
+  let copyStart = 0;
+  let changed = false;
+  let inHeaders = true;
+  let topHeaders = true;
+  const append = /* @__PURE__ */ __name((bytes) => {
+    if (bytes.byteLength === 0) {
+      return;
+    }
+    output.push(bytes);
+    outputBytes += bytes.byteLength;
+  }, "append");
+  const replace = /* @__PURE__ */ __name((start, end, replacement) => {
+    append(raw2.subarray(copyStart, start));
+    append(replacement);
+    copyStart = end;
+    changed = true;
+  }, "replace");
+  let lineStart = 0;
+  while (lineStart < raw2.byteLength) {
+    const lineEnd = findCrlf(raw2, lineStart);
+    const nextLine = lineEnd === raw2.byteLength ? raw2.byteLength : lineEnd + 2;
+    if (inHeaders) {
+      if (lineEnd === lineStart) {
+        inHeaders = false;
+        topHeaders = false;
+      } else if (topHeaders && (asciiPrefixEquals(raw2, lineStart, lineEnd, "Date: ") || asciiPrefixEquals(raw2, lineStart, lineEnd, "Message-ID: "))) {
+        replace(lineStart, nextLine, new Uint8Array());
+      } else if (isMultipartContentType(raw2, lineStart, lineEnd)) {
+        const line = decoder3.decode(raw2.subarray(lineStart, lineEnd));
+        const normalized2 = line.replace(
+          /boundary="(=_void_(?:mixed|alternative|related)_[A-Za-z0-9_-]+)"/g,
+          (_, token) => {
+            let marker = boundaries.get(token);
+            if (!marker) {
+              marker = `<void-boundary-${boundaries.size}>`;
+              boundaries.set(token, marker);
+            }
+            return `boundary="${marker}"`;
+          }
+        );
+        if (normalized2 !== line) {
+          replace(lineStart, lineEnd, encoder4.encode(normalized2));
+        }
+      }
+    } else if (raw2[lineStart] === 45 && raw2[lineStart + 1] === 45) {
+      const tokenStart = lineStart + 2;
+      const token = isBoundaryToken(raw2, tokenStart, lineEnd) ? decoder3.decode(raw2.subarray(tokenStart, lineEnd)) : void 0;
+      const openingMarker = token === void 0 ? void 0 : boundaries.get(token);
+      if (openingMarker !== void 0) {
+        replace(lineStart, lineEnd, encoder4.encode(`--${openingMarker}`));
+        inHeaders = true;
+      } else if (lineEnd - tokenStart >= 2 && raw2[lineEnd - 2] === 45 && raw2[lineEnd - 1] === 45 && isBoundaryToken(raw2, tokenStart, lineEnd - 2)) {
+        const closingToken = decoder3.decode(raw2.subarray(tokenStart, lineEnd - 2));
+        const closingMarker = boundaries.get(closingToken);
+        if (closingMarker !== void 0) {
+          replace(lineStart, lineEnd, encoder4.encode(`--${closingMarker}--`));
+        }
+      }
+    }
+    lineStart = nextLine;
+  }
+  if (!changed) {
+    return raw2;
+  }
+  append(raw2.subarray(copyStart));
+  const normalized = new Uint8Array(outputBytes);
+  let offset = 0;
+  for (const chunk of output) {
+    normalized.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return normalized;
+}
+__name(canonicalizeVoidMime, "canonicalizeVoidMime");
+function findCrlfCrlf(raw2) {
+  for (let i = 0; i + 3 < raw2.byteLength; i++) {
+    if (raw2[i] === 13 && raw2[i + 1] === 10 && raw2[i + 2] === 13 && raw2[i + 3] === 10) {
+      return i;
+    }
+  }
+  return -1;
+}
+__name(findCrlfCrlf, "findCrlfCrlf");
+function findCrlf(raw2, start) {
+  let cursor = start;
+  while (cursor < raw2.byteLength) {
+    const cr = raw2.indexOf(13, cursor);
+    if (cr === -1) {
+      return raw2.byteLength;
+    }
+    if (raw2[cr + 1] === 10) {
+      return cr;
+    }
+    cursor = cr + 1;
+  }
+  return raw2.byteLength;
+}
+__name(findCrlf, "findCrlf");
+function asciiPrefixEquals(raw2, start, end, expected) {
+  if (end - start < expected.length) {
+    return false;
+  }
+  for (let i = 0; i < expected.length; i++) {
+    const actual = raw2[start + i];
+    const wanted = expected.charCodeAt(i);
+    if ((actual >= 65 && actual <= 90 ? actual + 32 : actual) !== (wanted | 32)) {
+      return false;
+    }
+  }
+  return true;
+}
+__name(asciiPrefixEquals, "asciiPrefixEquals");
+function isMultipartContentType(raw2, start, end) {
+  const field = "Content-Type:";
+  if (!asciiPrefixEquals(raw2, start, end, field)) {
+    return false;
+  }
+  let cursor = start + field.length;
+  while (cursor < end && (raw2[cursor] === 32 || raw2[cursor] === 9 || raw2[cursor] === 11 || raw2[cursor] === 12)) {
+    cursor++;
+  }
+  return asciiPrefixEquals(raw2, cursor, end, "multipart/");
+}
+__name(isMultipartContentType, "isMultipartContentType");
+function isBoundaryToken(raw2, start, end) {
+  if (end <= start) {
+    return false;
+  }
+  for (let i = start; i < end; i++) {
+    const byte = raw2[i];
+    if (!(byte >= 65 && byte <= 90 || byte >= 97 && byte <= 122 || byte >= 48 && byte <= 57 || byte === 95 || byte === 45 || byte === 61)) {
+      return false;
+    }
+  }
+  return true;
+}
+__name(isBoundaryToken, "isBoundaryToken");
+async function emailPayloadDigest(kind, from, recipients, raw2) {
+  const canonical = canonicalizeVoidMime(raw2);
+  const prefix = encoder4.encode(
+    JSON.stringify({
+      kind,
+      from: from.toLowerCase(),
+      recipients: [...new Set(recipients.map((r) => r.toLowerCase()))].sort()
+    })
+  );
+  const input = new Uint8Array(prefix.length + 1 + canonical.length);
+  input.set(prefix);
+  input[prefix.length] = 0;
+  input.set(canonical, prefix.length + 1);
+  return [...new Uint8Array(await crypto.subtle.digest("SHA-256", input))].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+__name(emailPayloadDigest, "emailPayloadDigest");
+function admitEmail(env, body, deadlineMs = EMAIL_ADMISSION_DEADLINE_MS) {
+  return call(env, "/admit", body, Math.min(deadlineMs, EMAIL_ADMISSION_DEADLINE_MS));
+}
+__name(admitEmail, "admitEmail");
+function startEmailAttempt(env, operationId, recipients, deadlineMs = EMAIL_ACTION_DEADLINE_MS) {
+  return call(
+    env,
+    `/${encodeURIComponent(operationId)}/start`,
+    { recipients },
+    Math.min(deadlineMs, EMAIL_ACTION_DEADLINE_MS)
+  );
+}
+__name(startEmailAttempt, "startEmailAttempt");
+function finishEmailAttempt(env, operationId, recipients, state, details = {}, deadlineMs = EMAIL_ACTION_DEADLINE_MS) {
+  return call(
+    env,
+    `/${encodeURIComponent(operationId)}/finish`,
+    { recipients, state, ...details },
+    Math.min(deadlineMs, EMAIL_ACTION_DEADLINE_MS)
+  );
+}
+__name(finishEmailAttempt, "finishEmailAttempt");
+
+// ../../home/runner/work/void/void/platform/packages/proxy/src/email-lease.ts
+var LEASE_DEADLINE_MS = 5e3;
+var MAX_LEASE_RESPONSE_BYTES = 4 * 1024;
+function leaseBearer(lease) {
+  return lease.token;
+}
+__name(leaseBearer, "leaseBearer");
+async function leaseEmailDomainCredential(env, domain, projectId, deadlineMs = LEASE_DEADLINE_MS) {
+  if (!env.EMAIL_SIGNING_SECRET) {
+    return null;
+  }
+  const controller = new AbortController();
+  const deadline = Date.now() + Math.min(deadlineMs, LEASE_DEADLINE_MS);
+  const beforeDeadline2 = /* @__PURE__ */ __name(async (run) => {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) {
+      controller.abort();
+      throw new Error("email credential lease timed out");
+    }
+    const promise = run();
+    let timer;
+    try {
+      return await Promise.race([
+        promise,
+        new Promise((_, reject) => {
+          timer = setTimeout(() => {
+            controller.abort();
+            reject(new Error("email credential lease timed out"));
+          }, remaining);
+        })
+      ]);
+    } finally {
+      if (timer !== void 0) {
+        clearTimeout(timer);
+      }
+    }
+  }, "beforeDeadline");
+  let res;
+  try {
+    const token = await hmacSign3(
+      `email-lease-v1
+${projectId}
+${domain.toLowerCase()}`,
+      env.EMAIL_SIGNING_SECRET
+    );
+    res = await beforeDeadline2(
+      () => env.API.fetch("https://api/internal/email/domain-credential", {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-void-internal": token
+        },
+        body: JSON.stringify({ domain, projectId }),
+        signal: controller.signal
+      })
+    );
+  } catch {
+    return null;
+  }
+  if (!res.ok) {
+    void res.body?.cancel().catch(() => {
+    });
+    return null;
+  }
+  const declared = res.headers.get("content-length");
+  if (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > MAX_LEASE_RESPONSE_BYTES)) {
+    void res.body?.cancel().catch(() => {
+    });
+    return null;
+  }
+  const reader = res.body?.getReader();
+  if (!reader) {
+    return null;
+  }
+  const bytes = new Uint8Array(MAX_LEASE_RESPONSE_BYTES);
+  let size = 0;
+  try {
+    for (; ; ) {
+      const chunk = await beforeDeadline2(() => reader.read());
+      if (chunk.done) {
+        break;
+      }
+      if (size + chunk.value.byteLength > bytes.byteLength) {
+        throw new Error("email credential lease response too large");
+      }
+      bytes.set(chunk.value, size);
+      size += chunk.value.byteLength;
+    }
+    if (declared !== null && size !== Number(declared)) {
+      return null;
+    }
+    const data = JSON.parse(
+      new TextDecoder("utf-8", { fatal: true, ignoreBOM: false }).decode(bytes.subarray(0, size))
+    );
+    return parseLease(data);
+  } catch {
+    return null;
+  } finally {
+    void reader.cancel().catch(() => {
+    });
+    try {
+      reader.releaseLock();
+    } catch {
+    }
+  }
+}
+__name(leaseEmailDomainCredential, "leaseEmailDomainCredential");
+function parseLease(data) {
+  if (typeof data !== "object" || data === null) {
+    return null;
   }
   const kind = data.kind;
+  const accountId = data.accountId;
+  if (typeof accountId !== "string" || !/^[a-zA-Z0-9_-]{1,128}$/.test(accountId)) {
+    return null;
+  }
   if (kind === "api_token") {
     const token = data.token;
-    return typeof token === "string" && token.length > 0 ? { kind, token } : null;
-  }
-  if (kind === "oauth_grant") {
-    const accessToken = data.accessToken;
-    return typeof accessToken === "string" && accessToken.length > 0 ? { kind, accessToken } : null;
+    return typeof token === "string" && token.length > 0 ? { kind, token, accountId } : null;
   }
   return null;
 }
 __name(parseLease, "parseLease");
-var encoder3 = new TextEncoder();
+var encoder5 = new TextEncoder();
 var cachedSignKey3;
 var cachedKeySecret3;
 async function getSignKey3(secret) {
@@ -3349,7 +3633,7 @@ async function getSignKey3(secret) {
   }
   cachedSignKey3 = await crypto.subtle.importKey(
     "raw",
-    encoder3.encode(secret),
+    encoder5.encode(secret),
     { name: "HMAC", hash: "SHA-256" },
     false,
     ["sign"]
@@ -3360,18 +3644,111 @@ async function getSignKey3(secret) {
 __name(getSignKey3, "getSignKey");
 async function hmacSign3(data, secret) {
   const key = await getSignKey3(secret);
-  const sig = await crypto.subtle.sign("HMAC", key, encoder3.encode(data));
+  const sig = await crypto.subtle.sign("HMAC", key, encoder5.encode(data));
   const binary = String.fromCharCode(...new Uint8Array(sig));
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 __name(hmacSign3, "hmacSign");
 
+// ../../home/runner/work/void/void/platform/packages/proxy/src/email-provider-deadline.ts
+var EMAIL_PROVIDER_DEADLINE_MS = 3e4;
+var EMAIL_PROVIDER_BATCH_DEADLINE_MS = 6e4;
+var EmailProviderTimeoutError = class extends Error {
+  static {
+    __name(this, "EmailProviderTimeoutError");
+  }
+  constructor() {
+    super("email provider outcome unknown after timeout");
+    this.name = "EmailProviderTimeoutError";
+  }
+};
+function createEmailProviderDeadline(totalMs = EMAIL_PROVIDER_BATCH_DEADLINE_MS) {
+  const deadline = Date.now() + totalMs;
+  return {
+    remainingMs(reserveMs = 0) {
+      return Math.max(0, deadline - Date.now() - reserveMs);
+    },
+    expired(reserveMs = 0) {
+      return Date.now() >= deadline - reserveMs;
+    },
+    async run(submit, reserveMs = 0) {
+      const remaining = Math.min(EMAIL_PROVIDER_DEADLINE_MS, deadline - Date.now() - reserveMs);
+      if (remaining <= 0) {
+        throw new EmailProviderTimeoutError();
+      }
+      const work = submit();
+      let timer;
+      try {
+        return await Promise.race([
+          work,
+          new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new EmailProviderTimeoutError()), remaining);
+          })
+        ]);
+      } finally {
+        if (timer !== void 0) {
+          clearTimeout(timer);
+        }
+      }
+    }
+  };
+}
+__name(createEmailProviderDeadline, "createEmailProviderDeadline");
+
 // ../../home/runner/work/void/void/platform/packages/proxy/src/email.ts
-init_performance2();
-import { EmailMessage } from "cloudflare:email";
 var app = new Hono2();
-var MAX_MIME_BYTES = 10 * 1024 * 1024;
-var MAX_RECIPIENTS = 100;
+var EMAIL_SEND_DEADLINE_MS = 5e4;
+var EMAIL_SEND_FINALIZATION_MARGIN_MS = 5e3;
+var MAX_MIME_BYTES = 5 * 1024 * 1024;
+var MAX_CUSTOM_HEADER_BYTES = 16 * 1024;
+var BUILTIN_MIME_HEADERS = /* @__PURE__ */ new Set([
+  "from",
+  "to",
+  "cc",
+  "bcc",
+  "subject",
+  "reply-to",
+  "date",
+  "message-id",
+  "in-reply-to",
+  "references",
+  "mime-version",
+  "content-type",
+  "content-transfer-encoding",
+  "content-disposition"
+]);
+function customMimeHeaderBytesWithinLimit(raw2) {
+  let used = 0;
+  let custom = false;
+  for (let start = 0; start < raw2.byteLength; ) {
+    let end = start;
+    while (end < raw2.byteLength && raw2[end] !== 10) {
+      end++;
+    }
+    const lineEnd = end > start && raw2[end - 1] === 13 ? end - 1 : end;
+    if (lineEnd === start) {
+      return true;
+    }
+    if (raw2[start] !== 32 && raw2[start] !== 9) {
+      let colon = start;
+      while (colon < lineEnd && raw2[colon] !== 58) {
+        colon++;
+      }
+      const name = new TextDecoder().decode(raw2.subarray(start, colon)).toLowerCase();
+      custom = colon < lineEnd && !BUILTIN_MIME_HEADERS.has(name);
+    }
+    if (custom) {
+      used += lineEnd - start + 2;
+      if (used > MAX_CUSTOM_HEADER_BYTES) {
+        return false;
+      }
+    }
+    start = end + 1;
+  }
+  return true;
+}
+__name(customMimeHeaderBytesWithinLimit, "customMimeHeaderBytesWithinLimit");
+var MAX_RECIPIENTS = 50;
 var MAX_RECIPIENT_LENGTH = 320;
 var MAX_SENDER_LENGTH = 320;
 function readSenderDomain(env) {
@@ -3394,12 +3771,11 @@ function strictFromRe(domain) {
   if (cached) {
     return cached;
   }
-  const re = new RegExp(`^[a-z0-9._-]+(?:\\+[a-z0-9._=/-]+)?@${escapeRegExp(domain)}$`);
+  const re = new RegExp(`^[a-z0-9._-]+(?:\\+[a-z0-9._=/-]+)*@${escapeRegExp(domain)}$`);
   strictFromCache.set(domain, re);
   return re;
 }
 __name(strictFromRe, "strictFromRe");
-var SLUG_RE = /^[a-z0-9._-]+$/;
 var CONTROL_CHARS_RE = new RegExp("[\\u0000-\\u001f\\u007f]+", "g");
 function sanitizeForLog(value, maxLen = 200) {
   return value.slice(0, maxLen).replace(CONTROL_CHARS_RE, " ");
@@ -3579,37 +3955,22 @@ function singleMailboxAddrSpec(value) {
   return /^[\x21-\x7e]+$/.test(addrSpec) ? addrSpec : null;
 }
 __name(singleMailboxAddrSpec, "singleMailboxAddrSpec");
-async function readRoutingSuspension(kv2, slug) {
-  const raw2 = await kv2.get(slug);
-  if (!raw2) {
-    return { kind: "absent" };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw2);
-  } catch {
-    return { kind: "corrupt" };
-  }
-  if (typeof parsed !== "object" || parsed === null) {
-    return { kind: "corrupt" };
-  }
-  const suspended = parsed.suspended;
-  if (!suspended) {
-    return { kind: "clear" };
-  }
-  if (typeof suspended !== "string") {
-    return { kind: "corrupt" };
-  }
-  return { kind: "suspended", reason: suspended };
-}
-__name(readRoutingSuspension, "readRoutingSuspension");
 app.post("/send", async (context) => {
+  const sendDeadline = createEmailProviderDeadline(EMAIL_SEND_DEADLINE_MS);
   const projectId = context.get("projectId");
   const body = context.get("body");
   const from = asString(body.from);
   const mimeBase64 = asString(body.mimeBase64);
   const requestIdRaw = asString(body.requestId);
   const requestId = requestIdRaw === null ? "unknown" : sanitizeForLog(requestIdRaw, MAX_REQUEST_ID_LENGTH);
+  const callerKey = asString(body.idempotencyKey);
+  if (callerKey !== null && (callerKey.length === 0 || callerKey.length > 128 || !/^[\x20-\x7e]+$/.test(callerKey))) {
+    return context.json(
+      { ok: false, error: { code: "INVALID_TO", message: "invalid idempotency key" } },
+      400
+    );
+  }
+  const operationKey = callerKey ?? (requestIdRaw && requestIdRaw.length <= 128 && /^[\x20-\x7e]+$/.test(requestIdRaw) ? requestIdRaw : crypto.randomUUID());
   const recipientsRaw = Array.isArray(body.recipients) ? body.recipients : null;
   if (!from || !mimeBase64 || !recipientsRaw) {
     return context.json(
@@ -3654,19 +4015,6 @@ app.post("/send", async (context) => {
       502
     );
   }
-  const sendBinding = context.env.SEND_EMAIL;
-  if (typeof sendBinding?.send !== "function") {
-    return context.json(
-      {
-        ok: false,
-        error: {
-          code: "UPSTREAM_ERROR",
-          message: "email sending is not configured"
-        }
-      },
-      502
-    );
-  }
   const recipients = [];
   const seen = /* @__PURE__ */ new Set();
   for (const r of recipientsRaw) {
@@ -3731,6 +4079,15 @@ app.post("/send", async (context) => {
       413
     );
   }
+  if (!customMimeHeaderBytesWithinLimit(raw2)) {
+    return context.json(
+      {
+        ok: false,
+        error: { code: "MIME_ERROR", message: "custom headers exceed the 16 KiB limit" }
+      },
+      413
+    );
+  }
   const fromAt = from.indexOf("@");
   const fromDomain = fromAt === -1 ? "" : from.slice(fromAt + 1).toLowerCase();
   if (fromDomain !== "" && fromDomain !== senderDomain) {
@@ -3742,49 +4099,25 @@ app.post("/send", async (context) => {
       senderDomain,
       recipients,
       raw2,
-      requestId
-    );
-  }
-  const expectedSlug = await context.env.ROUTING.get(`email-slug:${projectId}`);
-  if (!expectedSlug) {
-    return context.json(
-      {
-        ok: false,
-        error: {
-          code: "UPSTREAM_ERROR",
-          message: "project slug unknown \u2014 refusing to send"
-        }
-      },
-      502
+      requestId,
+      operationKey,
+      sendDeadline
     );
   }
-  if (!SLUG_RE.test(expectedSlug)) {
-    console.error(
-      `[email-send] project ${projectId} slug malformed in KV: ${sanitizeForLog(expectedSlug, 64)}`
-    );
+  const sendBinding = context.env.SEND_EMAIL;
+  if (typeof sendBinding?.send !== "function") {
     return context.json(
       {
         ok: false,
         error: {
           code: "UPSTREAM_ERROR",
-          message: "project slug malformed in routing"
+          message: "email sending is not configured"
         }
       },
       502
     );
   }
-  if (isReservedEmailSlug(expectedSlug)) {
-    return context.json(
-      {
-        ok: false,
-        error: {
-          code: "INVALID_FROM",
-          message: `project slug "${expectedSlug}" is a reserved email identity on ${senderDomain} \u2014 refusing to send`
-        }
-      },
-      403
-    );
-  }
+  const expectedSlug = from.split("@")[0]?.split("+")[0] ?? "";
   if (!/^[\x21-\x7e]+$/.test(from)) {
     return context.json(
       {
@@ -3835,119 +4168,160 @@ app.post("/send", async (context) => {
       403
     );
   }
-  const platformSuspension = await readRoutingSuspension(context.env.ROUTING, expectedSlug);
-  if (platformSuspension.kind === "corrupt") {
-    console.error(
-      `[email-send] project ${projectId} routing blob malformed in KV for slug ${sanitizeForLog(expectedSlug, 64)}`
-    );
-    return context.json(
+  let admission;
+  try {
+    admission = await admitEmail(
+      context.env,
       {
-        ok: false,
-        error: {
-          code: "UPSTREAM_ERROR",
-          message: "project routing entry malformed"
-        }
+        projectId,
+        kind: "direct",
+        key: operationKey,
+        digest: await emailPayloadDigest("direct", from, recipients, raw2),
+        from,
+        recipients,
+        transport: "binding"
       },
-      502
+      sendDeadline.remainingMs(EMAIL_SEND_FINALIZATION_MARGIN_MS)
     );
-  }
-  if (platformSuspension.kind === "suspended") {
+  } catch (error) {
+    const conflict = error instanceof Error && error.message === "IDEMPOTENCY_CONFLICT";
     return context.json(
       {
         ok: false,
         error: {
-          code: "QUOTA_EXCEEDED",
-          message: `project is suspended (${sanitizeForLog(platformSuspension.reason, 64)})`
+          code: conflict ? "IDEMPOTENCY_CONFLICT" : "UPSTREAM_ERROR",
+          message: conflict ? "idempotency key has different content" : "email admission unavailable"
         }
       },
-      200
-    );
-  }
-  if (await context.env.ROUTING.get(`email-suspended:${projectId}`)) {
-    return context.json(
-      { ok: false, error: { code: "QUOTA_EXCEEDED", message: "project email is suspended" } },
-      200
+      conflict ? 409 : 503
     );
   }
-  const allowlist = await readAllowlist(context.env.ROUTING, projectId);
-  const allowed = [];
-  const deliveries = [];
-  for (const r of recipients) {
-    if (allowlist.has(r)) {
-      allowed.push(r);
-    } else {
+  const deliveries = admission.recipients.filter((r) => r.state !== "reserved").map((r) => ({
+    recipient: r.recipient,
+    ok: r.state === "provider_accepted",
+    state: r.state,
+    messageId: r.providerReference ?? void 0,
+    error: r.state === "provider_accepted" ? void 0 : {
+      code: r.errorCode ?? (r.state === "outcome_unknown" || r.state === "attempt_started" ? "OUTCOME_UNKNOWN" : r.state === "cancelled" ? "UPSTREAM_ERROR" : "UNVERIFIED_DESTINATION"),
+      message: r.state === "outcome_unknown" || r.state === "attempt_started" ? "provider outcome unknown; inspect email logs before retrying" : r.state === "cancelled" ? "email attempt was cancelled before provider submission" : "recipient was not admitted"
+    }
+  }));
+  if (admission.replay) {
+    for (const row of admission.recipients.filter((r) => r.state === "reserved")) {
       deliveries.push({
-        recipient: r,
+        recipient: row.recipient,
         ok: false,
+        state: "reserved",
         error: {
-          code: "UNVERIFIED_DESTINATION",
-          message: `recipient '${r}' is not a verified destination for this project`
+          code: "OUTCOME_UNKNOWN",
+          message: "email action remains reserved; inspect email logs before retrying"
         }
       });
     }
-  }
-  if (allowed.length === 0) {
-    return context.json({ ok: false, deliveries }, 200);
-  }
-  const now = /* @__PURE__ */ new Date();
-  const burstKey = `email-burst:${projectId}:${minuteBucket(now)}`;
-  const burstCurrent = readCounter(await context.env.ROUTING.get(burstKey));
-  const burstLimit = await getBurstLimit(context.env.ROUTING, projectId);
-  if (burstCurrent + allowed.length > burstLimit) {
-    return context.json(
-      {
-        ok: false,
-        error: {
-          code: "QUOTA_EXCEEDED",
-          message: `outbound burst limit ${burstLimit}/min exceeded`
-        }
-      },
-      429
-    );
-  }
-  const counterKey = `email-sent:${projectId}:${monthBucket(now)}`;
-  const monthCurrent = readCounter(await context.env.ROUTING.get(counterKey));
-  const monthLimit = await getMonthlyLimit(context.env.ROUTING, projectId);
-  if (monthCurrent + allowed.length > monthLimit) {
-    return context.json(
-      {
+    return emailActionResponse(context, admission.operationId, deliveries);
+  }
+  const allowed = admission.recipients.filter((r) => r.state === "reserved").map((r) => r.recipient);
+  for (let index = 0; index < allowed.length; index++) {
+    const r = allowed[index];
+    if (sendDeadline.expired(EMAIL_SEND_FINALIZATION_MARGIN_MS)) {
+      const unstarted = allowed.slice(index);
+      const cancelled = await cancelUnstartedRecipients(
+        context.env,
+        admission.operationId,
+        unstarted,
+        sendDeadline.remainingMs()
+      );
+      for (const recipient of unstarted) {
+        deliveries.push({
+          recipient,
+          ok: false,
+          state: cancelled ? "cancelled" : "outcome_unknown",
+          error: cancelled ? {
+            code: "UPSTREAM_ERROR",
+            message: "email batch deadline elapsed before provider submission"
+          } : { code: "OUTCOME_UNKNOWN", message: "could not cancel unstarted email attempt" }
+        });
+      }
+      break;
+    }
+    try {
+      await startEmailAttempt(
+        context.env,
+        admission.operationId,
+        [r],
+        sendDeadline.remainingMs(EMAIL_SEND_FINALIZATION_MARGIN_MS)
+      );
+    } catch {
+      const cancelled = await cancelUnstartedRecipients(
+        context.env,
+        admission.operationId,
+        [r],
+        sendDeadline.remainingMs()
+      );
+      deliveries.push({
+        recipient: r,
         ok: false,
-        error: {
-          code: "QUOTA_EXCEEDED",
-          message: `monthly outbound limit ${monthLimit} exceeded`
-        }
-      },
-      429
-    );
-  }
-  await Promise.all([
-    context.env.ROUTING.put(counterKey, String(monthCurrent + allowed.length), {
-      expirationTtl: monthTtlSeconds(now)
-    }).catch((e) => {
-      console.error(`[email-send] monthly counter put failed for ${projectId}:`, e);
-    }),
-    context.env.ROUTING.put(burstKey, String(burstCurrent + allowed.length), {
-      expirationTtl: 5 * 60
-    }).catch((e) => {
-      console.error(`[email-send] burst counter put failed for ${projectId}:`, e);
-    })
-  ]);
-  for (const r of allowed) {
+        state: cancelled ? "cancelled" : "outcome_unknown",
+        error: cancelled ? {
+          code: "UPSTREAM_ERROR",
+          message: "email attempt did not start; reservation cancelled"
+        } : { code: "OUTCOME_UNKNOWN", message: "could not confirm email attempt status" }
+      });
+      continue;
+    }
     try {
       const msg = new EmailMessage(from, r, bytesToStream(raw2));
-      const result = await sendBinding.send(msg);
+      const result = await sendDeadline.run(
+        () => sendBinding.send(msg),
+        EMAIL_SEND_FINALIZATION_MARGIN_MS
+      );
+      const providerReference = typeof result?.messageId === "string" ? result.messageId : "";
+      try {
+        await finishEmailAttempt(
+          context.env,
+          admission.operationId,
+          [r],
+          "provider_accepted",
+          { providerReference },
+          sendDeadline.remainingMs()
+        );
+      } catch {
+        deliveries.push({
+          recipient: r,
+          ok: false,
+          state: "outcome_unknown",
+          error: {
+            code: "OUTCOME_UNKNOWN",
+            message: "provider accepted email but outcome could not be recorded"
+          }
+        });
+        continue;
+      }
       deliveries.push({
         recipient: r,
         ok: true,
-        messageId: typeof result?.messageId === "string" ? result.messageId : ""
+        state: "provider_accepted",
+        messageId: providerReference
       });
-    } catch (e) {
-      deliveries.push({
-        recipient: r,
-        ok: false,
-        error: {
-          code: classifyUpstream(e, projectId),
-          message: e instanceof Error ? e.message : String(e)
+    } catch {
+      try {
+        await finishEmailAttempt(
+          context.env,
+          admission.operationId,
+          [r],
+          "outcome_unknown",
+          { errorCode: "OUTCOME_UNKNOWN" },
+          sendDeadline.remainingMs()
+        );
+      } catch {
+      }
+      deliveries.push({
+        recipient: r,
+        ok: false,
+        state: "outcome_unknown",
+        error: {
+          code: "OUTCOME_UNKNOWN",
+          message: "provider outcome unknown; inspect email logs before retrying"
         }
       });
     }
@@ -3955,29 +4329,166 @@ app.post("/send", async (context) => {
   logSend(projectId, requestId, deliveries);
   const anyFailed = deliveries.some((d) => !d.ok);
   if (anyFailed) {
-    return context.json({ ok: false, deliveries }, 200);
+    return context.json({ ok: false, operationId: admission.operationId, deliveries }, 200);
   }
   return context.json({
     ok: true,
+    operationId: admission.operationId,
     ids: deliveries.map((d) => ({
       recipient: d.recipient,
-      messageId: d.messageId
+      messageId: d.messageId,
+      state: "provider_accepted"
     }))
   });
 });
+var MAX_SEND_RAW_RESPONSE_BYTES = 64 * 1024;
+async function requestSendRaw(input, deadlineMs = EMAIL_PROVIDER_DEADLINE_MS) {
+  const controller = new AbortController();
+  const deadline = Date.now() + Math.min(EMAIL_PROVIDER_DEADLINE_MS, deadlineMs);
+  const requestBody = JSON.stringify({
+    from: input.from,
+    recipients: input.recipients,
+    mime_message: input.mimeMessage
+  });
+  const beforeDeadline2 = /* @__PURE__ */ __name(async (run) => {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) {
+      controller.abort();
+      throw new Error("email sending request timed out");
+    }
+    const promise = run();
+    let timer;
+    try {
+      return await Promise.race([
+        promise,
+        new Promise((_, reject) => {
+          timer = setTimeout(() => {
+            controller.abort();
+            reject(new Error("email sending request timed out"));
+          }, remaining);
+        })
+      ]);
+    } finally {
+      if (timer !== void 0) {
+        clearTimeout(timer);
+      }
+    }
+  }, "beforeDeadline");
+  const response = await beforeDeadline2(
+    () => fetch(
+      `https://api.cloudflare.com/client/v4/accounts/${input.accountId}/email/sending/send_raw`,
+      {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${input.bearer}`,
+          "content-type": "application/json"
+        },
+        body: requestBody,
+        signal: controller.signal
+      }
+    )
+  );
+  if (!response.ok) {
+    void response.body?.cancel().catch(() => {
+    });
+    return { ok: false, status: response.status };
+  }
+  const declared = response.headers.get("content-length");
+  if (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > MAX_SEND_RAW_RESPONSE_BYTES)) {
+    void response.body?.cancel().catch(() => {
+    });
+    throw new Error("email sending API response too large");
+  }
+  const reader = response.body?.getReader();
+  if (!reader) {
+    throw new Error("email sending API response unreadable");
+  }
+  const bytes = new Uint8Array(MAX_SEND_RAW_RESPONSE_BYTES);
+  let size = 0;
+  try {
+    for (; ; ) {
+      const chunk = await beforeDeadline2(() => reader.read());
+      if (chunk.done) {
+        break;
+      }
+      if (size + chunk.value.byteLength > bytes.byteLength) {
+        throw new Error("email sending API response too large");
+      }
+      bytes.set(chunk.value, size);
+      size += chunk.value.byteLength;
+    }
+    if (declared !== null && size !== Number(declared)) {
+      throw new Error("email sending API response length mismatch");
+    }
+    return {
+      ok: true,
+      data: JSON.parse(
+        new TextDecoder("utf-8", { fatal: true, ignoreBOM: false }).decode(bytes.subarray(0, size))
+      )
+    };
+  } finally {
+    void reader.cancel().catch(() => {
+    });
+    try {
+      reader.releaseLock();
+    } catch {
+    }
+  }
+}
+__name(requestSendRaw, "requestSendRaw");
 function readSendRawAddressList(value) {
+  if (!Array.isArray(value)) {
+    return null;
+  }
   const out = /* @__PURE__ */ new Set();
-  if (Array.isArray(value)) {
-    for (const entry of value) {
-      if (typeof entry === "string") {
-        out.add(entry.toLowerCase());
-      }
+  for (const entry of value) {
+    if (typeof entry !== "string") {
+      return null;
     }
+    out.add(entry.toLowerCase());
   }
   return out;
 }
 __name(readSendRawAddressList, "readSendRawAddressList");
-async function sendViaCustomDomain(context, projectId, from, fromDomain, senderDomain, recipients, raw2, requestId) {
+function parseSendRawResult(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  const result = value;
+  const delivered = readSendRawAddressList(result.delivered);
+  const permanentBounces = readSendRawAddressList(result.permanent_bounces);
+  const queued = readSendRawAddressList(result.queued);
+  const suppressedRecipients = readSendRawAddressList(result.suppressed_recipients);
+  if (!delivered || !permanentBounces || !queued || !suppressedRecipients || typeof result.message_id !== "string" || result.message_id === "") {
+    return null;
+  }
+  return {
+    delivered,
+    messageId: result.message_id,
+    permanentBounces,
+    queued,
+    suppressedRecipients
+  };
+}
+__name(parseSendRawResult, "parseSendRawResult");
+function classifySendRawRecipient(result, recipient) {
+  const target = recipient.toLowerCase();
+  const classifications = [
+    result.delivered.has(target),
+    result.queued.has(target),
+    result.permanentBounces.has(target),
+    result.suppressedRecipients.has(target)
+  ];
+  if (classifications.filter(Boolean).length !== 1) {
+    return "outcome_unknown";
+  }
+  if (classifications[0] || classifications[1]) {
+    return "provider_accepted";
+  }
+  return classifications[2] ? "permanent_bounce" : "suppressed";
+}
+__name(classifySendRawRecipient, "classifySendRawRecipient");
+async function sendViaCustomDomain(context, projectId, from, fromDomain, senderDomain, recipients, raw2, requestId, operationKey, sendDeadline) {
   if (!/^[\x21-\x7e]+$/.test(from)) {
     return context.json(
       {
@@ -3988,28 +4499,6 @@ async function sendViaCustomDomain(context, projectId, from, fromDomain, senderD
     );
   }
   const fromLower = from.toLowerCase();
-  const mirror = await readEmailDomainMirror(context.env.ROUTING, fromDomain, { cacheTtl: 60 });
-  if (!mirror || mirror.projectId !== projectId || mirror.status !== "active") {
-    return context.json(
-      {
-        ok: false,
-        error: {
-          code: "INVALID_FROM",
-          message: `from address must be on the configured sender domain (${senderDomain}) or a domain registered to this project`
-        }
-      },
-      403
-    );
-  }
-  if (!mirror.accountId) {
-    return context.json(
-      {
-        ok: false,
-        error: { code: "UPSTREAM_ERROR", message: "email domain registration is incomplete" }
-      },
-      502
-    );
-  }
   const mimeFrom = readMimeFromAddrSpec(raw2);
   if (!mimeFrom.ok || mimeFrom.addrSpec.toLowerCase() !== fromLower) {
     const detail = mimeFrom.ok ? "the From header address does not match the envelope sender" : MIME_FROM_REFUSALS[mimeFrom.reason];
@@ -4024,1482 +4513,428 @@ async function sendViaCustomDomain(context, projectId, from, fromDomain, senderD
       403
     );
   }
-  const slug = await context.env.ROUTING.get(`email-slug:${projectId}`);
-  if (!slug) {
+  let mimeMessage;
+  try {
+    mimeMessage = new TextDecoder("utf-8", { fatal: true, ignoreBOM: false }).decode(raw2);
+  } catch {
     return context.json(
-      {
-        ok: false,
-        error: {
-          code: "UPSTREAM_ERROR",
-          message: "project slug unknown \u2014 refusing to send"
-        }
-      },
-      502
+      { ok: false, error: { code: "MIME_ERROR", message: "mime must be valid UTF-8" } },
+      400
     );
   }
-  if (!SLUG_RE.test(slug)) {
-    console.error(
-      `[email-send] project ${projectId} slug malformed in KV: ${sanitizeForLog(slug, 64)}`
-    );
-    return context.json(
+  let admission;
+  try {
+    admission = await admitEmail(
+      context.env,
       {
-        ok: false,
-        error: {
-          code: "UPSTREAM_ERROR",
-          message: "project slug malformed in routing"
-        }
+        projectId,
+        kind: "direct",
+        key: operationKey,
+        digest: await emailPayloadDigest("direct", from, recipients, raw2),
+        from,
+        recipients,
+        transport: "send_raw"
       },
-      502
-    );
-  }
-  const platformSuspension = await readRoutingSuspension(context.env.ROUTING, slug);
-  if (platformSuspension.kind === "corrupt") {
-    console.error(
-      `[email-send] project ${projectId} routing blob malformed in KV for slug ${sanitizeForLog(slug, 64)}`
+      sendDeadline.remainingMs(EMAIL_SEND_FINALIZATION_MARGIN_MS)
     );
+  } catch (error) {
+    const conflict = error instanceof Error && error.message === "IDEMPOTENCY_CONFLICT";
     return context.json(
       {
         ok: false,
         error: {
-          code: "UPSTREAM_ERROR",
-          message: "project routing entry malformed"
+          code: conflict ? "IDEMPOTENCY_CONFLICT" : "UPSTREAM_ERROR",
+          message: conflict ? "idempotency key has different content" : "email admission unavailable"
         }
       },
-      502
+      conflict ? 409 : 503
     );
   }
-  if (platformSuspension.kind === "suspended") {
-    return context.json(
-      {
+  const deliveries = admission.recipients.filter((r) => r.state !== "reserved").map((r) => ({
+    recipient: r.recipient,
+    ok: r.state === "provider_accepted",
+    state: r.state,
+    messageId: r.providerReference ?? void 0,
+    error: r.state === "provider_accepted" ? void 0 : {
+      code: r.errorCode ?? (r.state === "outcome_unknown" || r.state === "attempt_started" ? "OUTCOME_UNKNOWN" : r.state === "cancelled" ? "UPSTREAM_ERROR" : "UNVERIFIED_DESTINATION"),
+      message: r.state === "outcome_unknown" || r.state === "attempt_started" ? "provider outcome unknown; inspect email logs before retrying" : r.state === "cancelled" ? "email attempt was cancelled before provider submission" : "recipient was not admitted"
+    }
+  }));
+  if (admission.replay) {
+    for (const row of admission.recipients.filter((r) => r.state === "reserved")) {
+      deliveries.push({
+        recipient: row.recipient,
         ok: false,
+        state: "reserved",
         error: {
-          code: "QUOTA_EXCEEDED",
-          message: `project is suspended (${sanitizeForLog(platformSuspension.reason, 64)})`
+          code: "OUTCOME_UNKNOWN",
+          message: "email action remains reserved; inspect email logs before retrying"
         }
-      },
-      200
-    );
-  }
-  if (await context.env.ROUTING.get(`email-suspended:${projectId}`)) {
-    return context.json(
-      { ok: false, error: { code: "QUOTA_EXCEEDED", message: "project email is suspended" } },
-      200
-    );
+      });
+    }
+    return emailActionResponse(context, admission.operationId, deliveries);
   }
-  const now = /* @__PURE__ */ new Date();
-  const burstKey = `email-burst:${projectId}:${minuteBucket(now)}`;
-  const burstCurrent = readCounter(await context.env.ROUTING.get(burstKey));
-  const burstLimit = await getBurstLimit(context.env.ROUTING, projectId);
-  if (burstCurrent + recipients.length > burstLimit) {
-    return context.json(
-      {
-        ok: false,
-        error: {
-          code: "QUOTA_EXCEEDED",
-          message: `outbound burst limit ${burstLimit}/min exceeded`
-        }
-      },
-      429
-    );
+  recipients = admission.recipients.filter((r) => r.state === "reserved").map((r) => r.recipient);
+  if (recipients.length === 0) {
+    return emailActionResponse(context, admission.operationId, deliveries);
   }
-  const counterKey = `email-sent:${projectId}:${monthBucket(now)}`;
-  const monthCurrent = readCounter(await context.env.ROUTING.get(counterKey));
-  const monthLimit = await getMonthlyLimit(context.env.ROUTING, projectId);
-  if (monthCurrent + recipients.length > monthLimit) {
+  const lease = await leaseEmailDomainCredential(
+    context.env,
+    fromDomain,
+    projectId,
+    sendDeadline.remainingMs(EMAIL_SEND_FINALIZATION_MARGIN_MS)
+  );
+  if (!lease) {
+    await finishEmailAttempt(
+      context.env,
+      admission.operationId,
+      recipients,
+      "cancelled",
+      {},
+      sendDeadline.remainingMs()
+    ).catch(() => {
+    });
     return context.json(
       {
         ok: false,
-        error: {
-          code: "QUOTA_EXCEEDED",
-          message: `monthly outbound limit ${monthLimit} exceeded`
-        }
+        operationId: admission.operationId,
+        error: { code: "UPSTREAM_ERROR", message: "could not lease the domain credential" }
       },
-      429
-    );
-  }
-  let mimeMessage;
-  try {
-    mimeMessage = new TextDecoder("utf-8", { fatal: true, ignoreBOM: false }).decode(raw2);
-  } catch {
-    return context.json(
-      { ok: false, error: { code: "MIME_ERROR", message: "mime must be valid UTF-8" } },
-      400
+      502
     );
   }
-  const lease = await leaseEmailDomainCredential(context.env, fromDomain);
-  if (!lease) {
+  if (admission.accountId !== lease.accountId) {
+    await finishEmailAttempt(
+      context.env,
+      admission.operationId,
+      recipients,
+      "cancelled",
+      {},
+      sendDeadline.remainingMs()
+    ).catch(() => {
+    });
     return context.json(
       {
         ok: false,
-        error: { code: "UPSTREAM_ERROR", message: "could not lease the domain credential" }
+        operationId: admission.operationId,
+        error: { code: "UPSTREAM_ERROR", message: "email domain changed during admission" }
       },
-      502
+      503
     );
   }
-  await Promise.all([
-    context.env.ROUTING.put(counterKey, String(monthCurrent + recipients.length), {
-      expirationTtl: monthTtlSeconds(now)
-    }).catch((e) => {
-      console.error(`[email-send] monthly counter put failed for ${projectId}:`, e);
-    }),
-    context.env.ROUTING.put(burstKey, String(burstCurrent + recipients.length), {
-      expirationTtl: 5 * 60
-    }).catch((e) => {
-      console.error(`[email-send] burst counter put failed for ${projectId}:`, e);
-    })
-  ]);
-  let failure = null;
-  let messageId = "";
-  let bounced = /* @__PURE__ */ new Set();
-  let suppressed = /* @__PURE__ */ new Set();
-  let cfRes = null;
   try {
-    cfRes = await fetch(
-      `https://api.cloudflare.com/client/v4/accounts/${mirror.accountId}/email/sending/send_raw`,
-      {
-        method: "POST",
-        headers: {
-          authorization: `Bearer ${leaseBearer(lease)}`,
-          "content-type": "application/json"
-        },
-        body: JSON.stringify({ from, recipients, mime_message: mimeMessage })
-      }
+    await startEmailAttempt(
+      context.env,
+      admission.operationId,
+      recipients,
+      sendDeadline.remainingMs(EMAIL_SEND_FINALIZATION_MARGIN_MS)
     );
   } catch {
-    failure = { code: "UPSTREAM_ERROR", message: "email sending request failed" };
-  }
-  if (cfRes) {
-    if (!cfRes.ok) {
-      if (cfRes.status === 401 || cfRes.status === 403) {
-        dropEmailDomainLease(fromDomain);
-      }
-      failure = {
-        code: cfRes.status === 429 ? "QUOTA_EXCEEDED" : "UPSTREAM_ERROR",
-        message: `email sending API returned ${cfRes.status}`
-      };
-    } else {
-      let data = null;
-      try {
-        data = await cfRes.json();
-      } catch {
-        data = null;
-      }
-      const success = typeof data === "object" && data !== null && data.success === true;
-      if (!success) {
-        failure = { code: "UPSTREAM_ERROR", message: "email sending API refused the message" };
-      } else {
-        const result = data.result;
-        const id = result?.message_id;
-        messageId = typeof id === "string" ? id : "";
-        bounced = readSendRawAddressList(result?.permanent_bounces);
-        suppressed = readSendRawAddressList(result?.suppressed_recipients);
-      }
-    }
-  }
-  const deliveries = [];
-  for (const r of recipients) {
-    if (failure) {
-      deliveries.push({ recipient: r, ok: false, error: failure });
-    } else if (bounced.has(r)) {
-      deliveries.push({
-        recipient: r,
-        ok: false,
-        error: {
-          code: "UNVERIFIED_DESTINATION",
-          message: `recipient '${r}' permanently bounced`
-        }
-      });
-    } else if (suppressed.has(r)) {
+    const cancelled = await cancelUnstartedRecipients(
+      context.env,
+      admission.operationId,
+      recipients,
+      sendDeadline.remainingMs()
+    );
+    for (const recipient of recipients) {
       deliveries.push({
-        recipient: r,
+        recipient,
         ok: false,
-        error: {
-          code: "UNVERIFIED_DESTINATION",
-          message: `recipient '${r}' is on the suppression list`
-        }
+        state: cancelled ? "cancelled" : "outcome_unknown",
+        error: cancelled ? {
+          code: "UPSTREAM_ERROR",
+          message: "email attempt did not start; reservation cancelled"
+        } : { code: "OUTCOME_UNKNOWN", message: "could not confirm email attempt status" }
       });
-    } else {
-      deliveries.push({ recipient: r, ok: true, messageId });
-    }
-  }
-  logSend(projectId, requestId, deliveries);
-  if (deliveries.some((d) => !d.ok)) {
-    return context.json({ ok: false, deliveries }, 200);
-  }
-  return context.json({
-    ok: true,
-    ids: deliveries.map((d) => ({
-      recipient: d.recipient,
-      messageId: d.messageId
-    }))
-  });
-}
-__name(sendViaCustomDomain, "sendViaCustomDomain");
-async function recordInboundDelivery(env, projectId, info) {
-  const now = /* @__PURE__ */ new Date();
-  const counterKey = `email-recv:${projectId}:${monthBucket(now)}`;
-  const current = readCounter(await env.ROUTING.get(counterKey));
-  await env.ROUTING.put(counterKey, String(current + 1), {
-    expirationTtl: monthTtlSeconds(now)
-  });
-  console.log(
-    `[email-recv] ${projectId} ${sanitizeForLog(info.from, 320)} -> ${sanitizeForLog(info.to, 320)} ${info.status} (${info.byteSize}B) @${Date.now()} subject="${sanitizeForLog(info.subject)}"`
-  );
-}
-__name(recordInboundDelivery, "recordInboundDelivery");
-var UNVERIFIED_DESTINATION_RE = /^[^\n]{0,200}destination address[^\n]{0,200}not (?:yet )?verified/i;
-function classifyUpstream(e, projectId) {
-  const message = e instanceof Error ? e.message : String(e);
-  const code = typeof e?.code === "string" ? e.code : "";
-  switch (code) {
-    case "E_RECIPIENT_NOT_ALLOWED":
-      return "UNVERIFIED_DESTINATION";
-    case "E_RATE_LIMIT_EXCEEDED":
-    case "E_DAILY_LIMIT_EXCEEDED":
-      return "QUOTA_EXCEEDED";
-    case "E_SENDER_NOT_VERIFIED":
-    case "E_SENDER_DOMAIN_NOT_AVAILABLE":
-      console.error(
-        `[email-send] project ${projectId} send binding refused the platform sender (${code}): ${sanitizeForLog(message)}`
-      );
-      return "UPSTREAM_ERROR";
-    default:
-      break;
-  }
-  if (UNVERIFIED_DESTINATION_RE.test(message)) {
-    return "UNVERIFIED_DESTINATION";
-  }
-  return "UPSTREAM_ERROR";
-}
-__name(classifyUpstream, "classifyUpstream");
-function logSend(projectId, requestId, deliveries) {
-  for (const d of deliveries) {
-    const status = d.ok ? "sent" : d.error?.code ?? "unknown_error";
-    const id = d.messageId ?? "";
-    console.log(
-      `[email-log] ${projectId} ${requestId} ${sanitizeForLog(d.recipient, 320)} ${status} ${id} @${Date.now()}`
-    );
-  }
-}
-__name(logSend, "logSend");
-async function readAllowlist(kv2, projectId) {
-  const raw2 = await kv2.get(`email-allowlist:${projectId}`, { cacheTtl: 60 });
-  if (!raw2) {
-    return /* @__PURE__ */ new Set();
-  }
-  try {
-    const arr = JSON.parse(raw2);
-    if (!Array.isArray(arr)) {
-      return /* @__PURE__ */ new Set();
-    }
-    const out = /* @__PURE__ */ new Set();
-    for (const v of arr) {
-      if (typeof v === "string") {
-        out.add(v.toLowerCase());
-      }
     }
-    return out;
-  } catch {
-    return /* @__PURE__ */ new Set();
-  }
-}
-__name(readAllowlist, "readAllowlist");
-async function readEmailDomainMirror(kv2, domain, options) {
-  const raw2 = await kv2.get(`email-domain:${domain}`, options);
-  if (!raw2) {
-    return null;
+    return emailActionResponse(context, admission.operationId, deliveries);
   }
-  let parsed;
+  let failure = null;
+  let failureState = "failed";
+  let sendRawResult = null;
+  let providerResponse = null;
   try {
-    parsed = JSON.parse(raw2);
+    providerResponse = await requestSendRaw(
+      {
+        accountId: lease.accountId,
+        bearer: leaseBearer(lease),
+        from,
+        recipients,
+        mimeMessage
+      },
+      sendDeadline.remainingMs(EMAIL_SEND_FINALIZATION_MARGIN_MS)
+    );
   } catch {
-    return null;
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    return null;
-  }
-  const entry = parsed;
-  if (typeof entry.projectId !== "string" || entry.projectId === "" || typeof entry.status !== "string" || typeof entry.relaySecretSha256 !== "string") {
-    return null;
-  }
-  return {
-    projectId: entry.projectId,
-    status: entry.status,
-    relaySecretSha256: entry.relaySecretSha256,
-    relayWorkerName: typeof entry.relayWorkerName === "string" ? entry.relayWorkerName : null,
-    accountId: typeof entry.accountId === "string" ? entry.accountId : null,
-    zoneId: typeof entry.zoneId === "string" ? entry.zoneId : null,
-    mode: typeof entry.mode === "string" ? entry.mode : null
-  };
-}
-__name(readEmailDomainMirror, "readEmailDomainMirror");
-function readCounter(raw2) {
-  if (!raw2) {
-    return 0;
-  }
-  const n = parseInt(raw2, 10);
-  return Number.isFinite(n) && n >= 0 ? n : 0;
-}
-__name(readCounter, "readCounter");
-function base64Decode(b64) {
-  const binary = atob(b64);
-  const out = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    out[i] = binary.charCodeAt(i);
-  }
-  return out;
-}
-__name(base64Decode, "base64Decode");
-function monthBucket(now) {
-  return `${now.getUTCFullYear()}-${String(now.getUTCMonth() + 1).padStart(2, "0")}`;
-}
-__name(monthBucket, "monthBucket");
-function minuteBucket(now) {
-  return `${now.getUTCFullYear()}${String(now.getUTCMonth() + 1).padStart(2, "0")}${String(
-    now.getUTCDate()
-  ).padStart(2, "0")}T${String(now.getUTCHours()).padStart(2, "0")}${String(
-    now.getUTCMinutes()
-  ).padStart(2, "0")}`;
-}
-__name(minuteBucket, "minuteBucket");
-function monthTtlSeconds(now) {
-  const endOfMonth = Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1, 0, 0, 0, 0);
-  const seconds = Math.ceil((endOfMonth - now.getTime()) / 1e3) + 60 * 60;
-  return Math.max(60, seconds);
-}
-__name(monthTtlSeconds, "monthTtlSeconds");
-async function getBurstLimit(kv2, projectId) {
-  const raw2 = await kv2.get(`email-burst-limit:${projectId}`, { cacheTtl: 60 });
-  if (raw2) {
-    const n = parseInt(raw2, 10);
-    if (Number.isFinite(n) && n > 0) {
-      return n;
-    }
-  }
-  return 10;
-}
-__name(getBurstLimit, "getBurstLimit");
-async function getMonthlyLimit(kv2, projectId) {
-  const raw2 = await kv2.get(`email-limit:${projectId}`, { cacheTtl: 60 });
-  if (raw2) {
-    const n = parseInt(raw2, 10);
-    if (Number.isFinite(n) && n > 0) {
-      return n;
-    }
-  }
-  return 200;
-}
-__name(getMonthlyLimit, "getMonthlyLimit");
-var INTERNAL_FROM_LOCAL_PART = "noreply";
-app.post("/internal/send", async (context) => {
-  const body = context.get("body");
-  const senderDomain = readSenderDomain(context.env);
-  if (!senderDomain) {
-    return context.json({ ok: false, error: "email sender domain is not configured" }, 502);
-  }
-  const from = asString(body.from);
-  const to = asString(body.to);
-  const mimeBase64 = asString(body.mimeBase64);
-  if (!from || !to || !mimeBase64) {
-    return context.json({ ok: false, error: "invalid body" }, 400);
-  }
-  if (!/^[\x21-\x7e]+$/.test(from)) {
-    return context.json({ ok: false, error: "from not allowed for internal send" }, 403);
-  }
-  if (from.toLowerCase() !== `${INTERNAL_FROM_LOCAL_PART}@${senderDomain}`) {
-    return context.json({ ok: false, error: "from not allowed for internal send" }, 403);
-  }
-  const sendBinding = context.env.SEND_EMAIL;
-  if (typeof sendBinding?.send !== "function") {
-    return context.json({ ok: false, error: "email sending is not configured" }, 502);
-  }
-  let raw2;
-  try {
-    raw2 = base64Decode(mimeBase64);
-  } catch {
-    return context.json({ ok: false, error: "invalid base64 mime" }, 400);
-  }
-  if (raw2.byteLength > MAX_MIME_BYTES) {
-    return context.json({ ok: false, error: "too large" }, 413);
-  }
-  try {
-    const msg = new EmailMessage(from, to, bytesToStream(raw2));
-    await sendBinding.send(msg);
-    return context.json({ ok: true });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    console.error(
-      `[email-internal] send failed from=${sanitizeForLog(from, 320)} to=${sanitizeForLog(to, 320)}: ${sanitizeForLog(message, 320)}`
-    );
-    return context.json({ ok: false, error: "upstream error" }, 502);
-  }
-});
-
-// ../../home/runner/work/void/void/platform/packages/proxy/src/email-router.ts
-var CONTROL_CHARS_RE2 = new RegExp("[\\u0000-\\u001f\\u007f]+", "g");
-function sanitize(value, maxLen) {
-  return value.slice(0, maxLen).replace(CONTROL_CHARS_RE2, " ");
-}
-__name(sanitize, "sanitize");
-function describeUntrusted(value, maxLen) {
-  switch (typeof value) {
-    case "string":
-      return sanitize(value, maxLen);
-    case "number":
-    case "boolean":
-    case "undefined":
-      return String(value);
-    case "object":
-      return value === null ? "null" : sanitize(Object.prototype.toString.call(value), 64);
-    default:
-      return `[${typeof value}]`;
-  }
-}
-__name(describeUntrusted, "describeUntrusted");
-var MAX_INBOUND_BYTES = 10 * 1024 * 1024;
-var MAX_INBOUND_HEADERS = 1024;
-var MAX_REJECT_REASON_LENGTH = 1e3;
-var MAX_ACTIONS = 100;
-var MAX_ACTION_ADDRESS_LENGTH = 320;
-var MAX_FORWARD_HEADERS = 32;
-var MAX_FORWARD_HEADER_LENGTH = 1024;
-var MAX_REPLY_BYTES = MAX_MIME_BYTES;
-var MAX_REPLY_BYTES_TOTAL = 2 * MAX_REPLY_BYTES;
-var RPC_METHOD_MISSING = /does not implement the method|receiver does not.*method/i;
-var InboundTooLargeError = class extends Error {
-  constructor(size) {
-    super(`inbound message exceeds ${MAX_INBOUND_BYTES} bytes (got ${size})`);
-    this.size = size;
-    this.name = "InboundTooLargeError";
-  }
-  size;
-  static {
-    __name(this, "InboundTooLargeError");
-  }
-};
-var InboundTooManyHeadersError = class extends Error {
-  static {
-    __name(this, "InboundTooManyHeadersError");
-  }
-  constructor() {
-    super(`inbound message carries more than ${MAX_INBOUND_HEADERS} headers`);
-    this.name = "InboundTooManyHeadersError";
-  }
-};
-function isValidEmailAddress(s) {
-  return typeof s === "string" && s.length <= MAX_ACTION_ADDRESS_LENGTH && (0, import_email_validator.validate)(s);
-}
-__name(isValidEmailAddress, "isValidEmailAddress");
-function logAddress(value) {
-  return describeUntrusted(value, MAX_ACTION_ADDRESS_LENGTH);
-}
-__name(logAddress, "logAddress");
-function forwardHeadersWithinBounds(headers) {
-  if (typeof headers !== "object" || headers === null) {
-    console.error("[email-router] action list dropped: forward headers is not a plain object");
-    return false;
-  }
-  const proto = Object.getPrototypeOf(headers);
-  if (proto !== Object.prototype && proto !== null) {
-    console.error("[email-router] action list dropped: forward headers is not a plain object");
-    return false;
-  }
-  const names = Object.keys(headers);
-  if (names.length > MAX_FORWARD_HEADERS) {
-    console.error(
-      `[email-router] action list dropped: forward has ${names.length} headers (max ${MAX_FORWARD_HEADERS})`
-    );
-    return false;
-  }
-  for (const name of names) {
-    const value = headers[name];
-    if (name.length > MAX_FORWARD_HEADER_LENGTH) {
-      console.error(
-        `[email-router] action list dropped: forward header name exceeds ${MAX_FORWARD_HEADER_LENGTH} characters`
-      );
-      return false;
-    }
-    if (typeof value !== "string") {
-      console.error(
-        `[email-router] action list dropped: forward header "${sanitize(name, 64)}" value is not a string`
-      );
-      return false;
-    }
-    if (value.length > MAX_FORWARD_HEADER_LENGTH) {
-      console.error(
-        `[email-router] action list dropped: forward header "${sanitize(name, 64)}" value exceeds ${MAX_FORWARD_HEADER_LENGTH} characters`
-      );
-      return false;
-    }
-  }
-  return true;
-}
-__name(forwardHeadersWithinBounds, "forwardHeadersWithinBounds");
-async function isPermittedReplySender(from, pin) {
-  if (!/^[\x21-\x7e]+$/.test(from)) {
-    return false;
-  }
-  const lower = from.toLowerCase();
-  const at = lower.indexOf("@");
-  if (at <= 0) {
-    return false;
-  }
-  const fromDomain = lower.slice(at + 1);
-  if (fromDomain === pin.domain) {
-    const localPrefix = lower.slice(0, at).split("+")[0] ?? "";
-    if (localPrefix.length > 0 && localPrefix === pin.slug) {
-      return true;
-    }
-  }
-  return isRegisteredDomainSender(fromDomain, pin);
-}
-__name(isPermittedReplySender, "isPermittedReplySender");
-async function isRegisteredDomainSender(fromDomain, pin) {
-  if (!pin.projectId) {
-    return false;
-  }
-  const cached = pin.registeredDomains.get(fromDomain);
-  if (cached !== void 0) {
-    return cached;
-  }
-  const mirror = await readEmailDomainMirror(pin.kv, fromDomain, { cacheTtl: 60 }).catch(
-    () => null
-  );
-  const registered = mirror !== null && mirror.projectId === pin.projectId && mirror.status === "active";
-  pin.registeredDomains.set(fromDomain, registered);
-  return registered;
-}
-__name(isRegisteredDomainSender, "isRegisteredDomainSender");
-function readCounter2(raw2) {
-  if (!raw2) {
-    return 0;
-  }
-  const n = parseInt(raw2, 10);
-  return Number.isFinite(n) && n >= 0 ? n : 0;
-}
-__name(readCounter2, "readCounter");
-function monthBucket2(now) {
-  return `${now.getUTCFullYear()}-${String(now.getUTCMonth() + 1).padStart(2, "0")}`;
-}
-__name(monthBucket2, "monthBucket");
-function minuteBucket2(now) {
-  return `${now.getUTCFullYear()}${String(now.getUTCMonth() + 1).padStart(2, "0")}${String(
-    now.getUTCDate()
-  ).padStart(2, "0")}T${String(now.getUTCHours()).padStart(2, "0")}${String(
-    now.getUTCMinutes()
-  ).padStart(2, "0")}`;
-}
-__name(minuteBucket2, "minuteBucket");
-function monthTtlSeconds2(now) {
-  const endOfMonth = Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1, 0, 0, 0, 0);
-  const seconds = Math.ceil((endOfMonth - now.getTime()) / 1e3) + 60 * 60;
-  return Math.max(60, seconds);
-}
-__name(monthTtlSeconds2, "monthTtlSeconds");
-async function readAllowlist2(kv2, projectId) {
-  const raw2 = await kv2.get(`email-allowlist:${projectId}`, { cacheTtl: 60 });
-  if (!raw2) {
-    return /* @__PURE__ */ new Set();
-  }
-  try {
-    const arr = JSON.parse(raw2);
-    if (!Array.isArray(arr)) {
-      return /* @__PURE__ */ new Set();
-    }
-    const out = /* @__PURE__ */ new Set();
-    for (const v of arr) {
-      if (typeof v === "string") {
-        out.add(v.toLowerCase());
-      }
-    }
-    return out;
-  } catch {
-    return /* @__PURE__ */ new Set();
-  }
-}
-__name(readAllowlist2, "readAllowlist");
-async function getBurstLimit2(kv2, projectId) {
-  const raw2 = await kv2.get(`email-burst-limit:${projectId}`, { cacheTtl: 60 });
-  if (raw2) {
-    const n = parseInt(raw2, 10);
-    if (Number.isFinite(n) && n > 0) {
-      return n;
-    }
-  }
-  return 10;
-}
-__name(getBurstLimit2, "getBurstLimit");
-async function getMonthlyLimit2(kv2, projectId) {
-  const raw2 = await kv2.get(`email-limit:${projectId}`, { cacheTtl: 60 });
-  if (raw2) {
-    const n = parseInt(raw2, 10);
-    if (Number.isFinite(n) && n > 0) {
-      return n;
-    }
-  }
-  return 200;
-}
-__name(getMonthlyLimit2, "getMonthlyLimit");
-async function routeInbound(message, env, ctx) {
-  const label = readSenderDomain(env) ?? "void email";
-  const to = String(message.to ?? "").toLowerCase();
-  const local = to.split("@")[0] ?? "";
-  const plus = local.indexOf("+");
-  const slug = plus === -1 ? local : local.slice(0, plus);
-  const atIdx = to.indexOf("@");
-  const receivedDomain = atIdx === -1 ? "" : to.slice(atIdx + 1);
-  if (!slug) {
-    message.setReject(`${label}: missing project slug in recipient`);
-    return;
-  }
-  if (isReservedEmailSlug(slug)) {
-    message.setReject(`${label}: "${sanitize(slug, 64)}" is a reserved platform address`);
-    return;
-  }
-  const routingJson = await env.ROUTING.get(slug);
-  if (!routingJson) {
-    message.setReject(`${label}: no project found for slug "${sanitize(slug, 64)}"`);
-    return;
-  }
-  let parsedRouting;
-  try {
-    parsedRouting = JSON.parse(routingJson);
-  } catch {
-    message.setReject(`${label}: routing data corrupt`);
-    return;
-  }
-  if (typeof parsedRouting !== "object" || parsedRouting === null) {
-    message.setReject(`${label}: routing data corrupt`);
-    return;
-  }
-  const routing = parsedRouting;
-  if (routing.suspended) {
-    const reason = typeof routing.suspended === "string" ? routing.suspended : "suspended";
-    message.setReject(
-      `${label}: project "${sanitize(slug, 64)}" is suspended (${sanitize(reason, 64)})`
-    );
-    return;
-  }
-  const workerName = routing.workerName;
-  if (!workerName) {
-    message.setReject(`${label}: project "${sanitize(slug, 64)}" has no worker (static deploy)`);
-    return;
-  }
-  if (typeof workerName !== "string") {
-    message.setReject(`${label}: routing data corrupt`);
-    return;
-  }
-  if (typeof routing.projectId !== "string" || routing.projectId === "") {
-    message.setReject(`${label}: routing data corrupt`);
-    return;
-  }
-  if (await env.ROUTING.get(`email-suspended:${routing.projectId}`)) {
-    message.setReject(`${label}: project "${sanitize(slug, 64)}" inbound is suspended`);
-    return;
-  }
-  let stub;
-  try {
-    stub = routing.limits ? env.DISPATCH.get(workerName, {}, { limits: routing.limits }) : env.DISPATCH.get(workerName);
-  } catch (e) {
-    console.error(`[email-router] DISPATCH.get(${sanitize(workerName, 320)}) failed:`, e);
-    message.setReject(`${label}: project worker unavailable`);
-    return;
-  }
-  if (typeof message.rawSize === "number" && message.rawSize > MAX_INBOUND_BYTES) {
-    message.setReject(`${label}: message too large (max ${MAX_INBOUND_BYTES} bytes)`);
-    return;
-  }
-  let envelope;
-  try {
-    envelope = await buildEnvelope(message);
-  } catch (e) {
-    if (e instanceof InboundTooLargeError) {
-      message.setReject(`${label}: message too large (max ${MAX_INBOUND_BYTES} bytes)`);
-      return;
-    }
-    if (e instanceof InboundTooManyHeadersError) {
-      message.setReject(`${label}: too many headers (max ${MAX_INBOUND_HEADERS})`);
-      return;
-    }
-    console.error(`[email-router] failed to read message body for ${sanitize(slug, 64)}:`, e);
-    message.setReject(`${label}: could not read inbound message body`);
-    return;
-  }
-  let gate;
-  try {
-    gate = await loadOutboundGate(env, routing.projectId);
-  } catch (e) {
-    console.error(
-      `[email-router] failed to load outbound gate for ${sanitize(routing.projectId ?? "", 64)}:`,
-      e
-    );
-    gate = {
-      projectId: routing.projectId,
-      skipAllowlist: false,
-      allowlist: /* @__PURE__ */ new Set(),
-      burstKey: "",
-      burstLimit: 0,
-      burstCurrent: 0,
-      monthKey: "",
-      monthLimit: 0,
-      monthCurrent: 0,
-      quotaExhausted: true
-    };
-  }
-  let actions;
-  try {
-    const result = await stub.email(envelope);
-    if (result === void 0 || result === null) {
-      actions = [];
-    } else if (Array.isArray(result)) {
-      actions = result;
-    } else {
-      console.warn(
-        `[email-router] ${sanitize(workerName, 320)} email handler returned non-array; treating as no-op`
-      );
-      actions = [];
-    }
-  } catch (e) {
-    const msg = e instanceof Error ? e.message.slice(0, 320) : describeUntrusted(e, 320);
-    if (RPC_METHOD_MISSING.test(msg)) {
-      console.error(
-        `[email-router] ${sanitize(workerName, 320)} has no .email() (needs redeploy):`,
-        sanitize(msg, 320)
-      );
-      message.setReject(`${label}: project has no email handler`);
-      ctx.waitUntil(
-        logRecv(env, routing.projectId, message, [{ type: "reject", reason: "no-handler" }])
-      );
-      return;
-    }
-    console.error(`[email-router] dispatch to ${sanitize(workerName, 320)} failed:`, msg);
-    message.setReject(`${label}: project handler error`);
-    ctx.waitUntil(
-      logRecv(env, routing.projectId, message, [{ type: "reject", reason: "dispatch-error" }])
-    );
-    return;
-  }
-  await enactActions(env, message, actions, gate, {
-    slug,
-    domain: receivedDomain,
-    projectId: routing.projectId,
-    kv: env.ROUTING,
-    registeredDomains: /* @__PURE__ */ new Map()
-  });
-  ctx.waitUntil(logRecv(env, routing.projectId, message, actions));
-}
-__name(routeInbound, "routeInbound");
-async function routeRelayed(env, ctx, input) {
-  const { projectId, domain, envelope } = input;
-  const slug = await env.ROUTING.get(`email-slug:${projectId}`);
-  if (!slug) {
-    console.error(`[email-relay] no slug mirror for project ${sanitize(projectId, 64)}`);
-    return { reject: true };
-  }
-  const routingJson = await env.ROUTING.get(slug);
-  if (!routingJson) {
-    console.error(
-      `[email-relay] no routing entry for slug ${sanitize(slug, 64)} (project ${sanitize(projectId, 64)})`
-    );
-    return { reject: true };
-  }
-  let parsedRouting;
-  try {
-    parsedRouting = JSON.parse(routingJson);
-  } catch {
-    console.error(`[email-relay] routing data corrupt for slug ${sanitize(slug, 64)}`);
-    return { reject: true };
-  }
-  if (typeof parsedRouting !== "object" || parsedRouting === null) {
-    console.error(`[email-relay] routing data corrupt for slug ${sanitize(slug, 64)}`);
-    return { reject: true };
-  }
-  const routing = parsedRouting;
-  if (routing.projectId !== projectId) {
-    console.error(
-      `[email-relay] routing blob names another project for slug ${sanitize(slug, 64)}`
-    );
-    return { reject: true };
-  }
-  if (routing.suspended) {
-    console.error(`[email-relay] project ${sanitize(projectId, 64)} is suspended`);
-    return { reject: true };
-  }
-  const workerName = routing.workerName;
-  if (!workerName || typeof workerName !== "string") {
-    console.error(`[email-relay] project ${sanitize(projectId, 64)} has no worker (static deploy)`);
-    return { reject: true };
-  }
-  if (await env.ROUTING.get(`email-suspended:${projectId}`)) {
-    console.error(`[email-relay] project ${sanitize(projectId, 64)} inbound is suspended`);
-    return { reject: true };
-  }
-  let stub;
-  try {
-    stub = routing.limits ? env.DISPATCH.get(workerName, {}, { limits: routing.limits }) : env.DISPATCH.get(workerName);
-  } catch (e) {
-    console.error(`[email-relay] DISPATCH.get(${sanitize(workerName, 320)}) failed:`, e);
-    return { reject: true };
-  }
-  const relayed = createRelayedMessage(env, envelope, { domain, projectId });
-  let gate;
-  try {
-    gate = await loadOutboundGate(env, projectId, { skipAllowlist: true });
-  } catch (e) {
-    console.error(`[email-relay] failed to load outbound gate for ${sanitize(projectId, 64)}:`, e);
-    gate = {
-      projectId,
-      skipAllowlist: true,
-      allowlist: /* @__PURE__ */ new Set(),
-      burstKey: "",
-      burstLimit: 0,
-      burstCurrent: 0,
-      monthKey: "",
-      monthLimit: 0,
-      monthCurrent: 0,
-      quotaExhausted: true
-    };
-  }
-  let actions;
-  try {
-    const result = await stub.email(envelope);
-    if (result === void 0 || result === null) {
-      actions = [];
-    } else if (Array.isArray(result)) {
-      actions = result;
-    } else {
-      console.warn(
-        `[email-relay] ${sanitize(workerName, 320)} email handler returned non-array; treating as no-op`
-      );
-      actions = [];
-    }
-  } catch (e) {
-    const msg = e instanceof Error ? e.message.slice(0, 320) : describeUntrusted(e, 320);
-    if (RPC_METHOD_MISSING.test(msg)) {
-      console.error(
-        `[email-relay] ${sanitize(workerName, 320)} has no .email() (needs redeploy):`,
-        sanitize(msg, 320)
-      );
-      ctx.waitUntil(
-        logRecv(env, projectId, relayed.message, [{ type: "reject", reason: "no-handler" }])
-      );
-      return { reject: true };
-    }
-    console.error(`[email-relay] dispatch to ${sanitize(workerName, 320)} failed:`, msg);
-    ctx.waitUntil(
-      logRecv(env, projectId, relayed.message, [{ type: "reject", reason: "dispatch-error" }])
-    );
-    return { reject: true };
-  }
-  await enactActions(env, relayed.message, actions, gate, {
-    slug: slug.toLowerCase(),
-    domain,
-    projectId,
-    kv: env.ROUTING,
-    registeredDomains: /* @__PURE__ */ new Map()
-  });
-  ctx.waitUntil(logRecv(env, projectId, relayed.message, actions));
-  return { reject: relayed.rejectedReason() !== null };
-}
-__name(routeRelayed, "routeRelayed");
-function createRelayedMessage(env, envelope, relay) {
-  let reason = null;
-  async function sendRaw(from, to, raw2) {
-    const senderDomain = from.slice(from.indexOf("@") + 1).toLowerCase();
-    const mirror = await readEmailDomainMirror(env.ROUTING, senderDomain);
-    if (!mirror || mirror.projectId !== relay.projectId || mirror.status !== "active") {
-      throw new Error("email domain registration is no longer active");
-    }
-    if (!mirror.accountId) {
-      throw new Error("email domain registration is incomplete");
-    }
-    const lease = await leaseEmailDomainCredential(env, senderDomain);
-    if (!lease) {
-      throw new Error("could not lease the domain credential");
-    }
-    const mimeMessage = new TextDecoder("utf-8", { fatal: true, ignoreBOM: false }).decode(raw2);
-    let res;
-    try {
-      res = await fetch(
-        `https://api.cloudflare.com/client/v4/accounts/${mirror.accountId}/email/sending/send_raw`,
-        {
-          method: "POST",
-          headers: {
-            authorization: `Bearer ${leaseBearer(lease)}`,
-            "content-type": "application/json"
-          },
-          body: JSON.stringify({ from, recipients: [to], mime_message: mimeMessage })
-        }
-      );
-    } catch {
-      throw new Error("email sending request failed");
-    }
-    if (res.status === 401 || res.status === 403) {
-      dropEmailDomainLease(senderDomain);
-    }
-    if (!res.ok) {
-      throw new Error(`email sending API returned ${res.status}`);
-    }
-    let data = null;
-    try {
-      data = await res.json();
-    } catch {
-      data = null;
-    }
-    const success = typeof data === "object" && data !== null && data.success === true;
-    if (!success) {
-      throw new Error("email sending API refused the message");
-    }
-    const result = data.result;
-    const target = to.toLowerCase();
-    if (readSendRawAddressList(result?.permanent_bounces).has(target)) {
-      throw new Error("recipient permanently bounced");
-    }
-    if (readSendRawAddressList(result?.suppressed_recipients).has(target)) {
-      throw new Error("recipient is on the suppression list");
-    }
-  }
-  __name(sendRaw, "sendRaw");
-  const message = {
-    from: envelope.from,
-    to: envelope.to,
-    rawSize: envelope.rawSize,
-    headers: new Headers(envelope.headers),
-    raw: envelopeRawStream(envelope.raw),
-    setReject(r) {
-      reason = r;
-    },
-    async forward(to, _headers) {
-      await sendRaw(envelope.to, to, envelope.raw);
-    },
-    // The reply channel `enactSanitized` prefers when present. A native
-    // reply needs both the CF email event this lane never had and a genuine
-    // EmailMessage — whose class exposes no body accessor, so the recorded
-    // reply bytes could not cross it anyway; they arrive on the action.
-    async __voidRelayReply(from, to, raw2) {
-      await sendRaw(from, to, raw2);
-    }
-  };
-  return {
-    message,
-    rejectedReason: /* @__PURE__ */ __name(() => reason, "rejectedReason")
-  };
-}
-__name(createRelayedMessage, "createRelayedMessage");
-function envelopeRawStream(bytes) {
-  return new ReadableStream({
-    start(controller) {
-      controller.enqueue(bytes);
-      controller.close();
-    }
-  });
-}
-__name(envelopeRawStream, "envelopeRawStream");
-async function loadOutboundGate(env, projectId, opts) {
-  const skipAllowlist = opts?.skipAllowlist ?? false;
-  if (!projectId) {
-    return {
-      projectId: void 0,
-      skipAllowlist,
-      allowlist: /* @__PURE__ */ new Set(),
-      burstKey: "",
-      burstLimit: 0,
-      burstCurrent: 0,
-      monthKey: "",
-      monthLimit: 0,
-      monthCurrent: 0,
-      quotaExhausted: true
-    };
-  }
-  const allowlist = skipAllowlist ? /* @__PURE__ */ new Set() : await readAllowlist2(env.ROUTING, projectId);
-  const now = /* @__PURE__ */ new Date();
-  const burstKey = `email-burst:${projectId}:${minuteBucket2(now)}`;
-  const monthKey = `email-sent:${projectId}:${monthBucket2(now)}`;
-  const [burstLimit, monthLimit, burstRaw, monthRaw] = await Promise.all([
-    getBurstLimit2(env.ROUTING, projectId),
-    getMonthlyLimit2(env.ROUTING, projectId),
-    env.ROUTING.get(burstKey),
-    env.ROUTING.get(monthKey)
-  ]);
-  return {
-    projectId,
-    skipAllowlist,
-    allowlist,
-    burstKey,
-    burstLimit,
-    burstCurrent: readCounter2(burstRaw),
-    monthKey,
-    monthLimit,
-    monthCurrent: readCounter2(monthRaw),
-    quotaExhausted: false
-  };
-}
-__name(loadOutboundGate, "loadOutboundGate");
-async function commitGateCounters(env, gate) {
-  if (!gate.projectId) {
-    return;
-  }
-  const now = /* @__PURE__ */ new Date();
-  await Promise.all([
-    env.ROUTING.put(gate.monthKey, String(gate.monthCurrent), {
-      expirationTtl: monthTtlSeconds2(now)
-    }).catch((e) => {
-      console.error(
-        `[email-router] monthly counter put failed for ${sanitize(gate.projectId ?? "", 64)}:`,
-        e
-      );
-    }),
-    env.ROUTING.put(gate.burstKey, String(gate.burstCurrent), {
-      expirationTtl: 5 * 60
-    }).catch((e) => {
-      console.error(
-        `[email-router] burst counter put failed for ${sanitize(gate.projectId ?? "", 64)}:`,
-        e
-      );
-    })
-  ]);
-}
-__name(commitGateCounters, "commitGateCounters");
-async function logRecv(env, projectId, message, actions) {
-  if (!projectId) {
-    console.error(
-      `[email-router] cannot log inbound delivery: routing entry has no projectId (to=${sanitize(String(message.to ?? ""), 320)})`
-    );
-    return;
-  }
-  const status = actions.some((a) => a && typeof a === "object" && a.type === "reject") ? "rejected" : actions.length === 0 ? "accepted" : "handled";
-  try {
-    await recordInboundDelivery(env, projectId, {
-      from: String(message.from ?? ""),
-      to: String(message.to ?? ""),
-      // sanitize() in email.ts handles control-char stripping before logging;
-      // don't pre-truncate here so the full subject is available if logging
-      // ever moves to structured storage.
-      subject: message.headers.get("Subject") ?? "",
-      byteSize: message.rawSize ?? 0,
-      status
-    });
-  } catch (e) {
-    console.error("[email-router] log-recv failed:", e);
-  }
-}
-__name(logRecv, "logRecv");
-async function buildEnvelope(message) {
-  const entries = [];
-  for (const entry of message.headers) {
-    if (entries.length >= MAX_INBOUND_HEADERS) {
-      throw new InboundTooManyHeadersError();
-    }
-    entries.push(entry);
-  }
-  const raw2 = await readStreamToBytes(message.raw);
-  const headers = Object.fromEntries(entries);
-  return {
-    from: String(message.from ?? ""),
-    to: String(message.to ?? ""),
-    headers,
-    raw: raw2,
-    rawSize: message.rawSize ?? raw2.byteLength
-  };
-}
-__name(buildEnvelope, "buildEnvelope");
-async function readStreamToBytes(stream) {
-  const reader = stream.getReader();
-  const chunks = [];
-  let total = 0;
-  for (; ; ) {
-    const { value, done } = await reader.read();
-    if (done) {
-      break;
-    }
-    total += value.byteLength;
-    if (total > MAX_INBOUND_BYTES) {
-      try {
-        await reader.cancel();
-      } catch {
-      }
-      throw new InboundTooLargeError(total);
-    }
-    chunks.push(value);
-  }
-  const out = new Uint8Array(total);
-  let offset = 0;
-  for (const c of chunks) {
-    out.set(c, offset);
-    offset += c.byteLength;
-  }
-  return out;
-}
-__name(readStreamToBytes, "readStreamToBytes");
-async function validateActions(actions, replySender) {
-  if (actions.length > MAX_ACTIONS) {
-    console.error(
-      `[email-router] action list dropped: ${actions.length} actions returned (max ${MAX_ACTIONS})`
-    );
-    return null;
-  }
-  const out = [];
-  let replyBytesUsed = 0;
-  for (const action of actions) {
-    if (!action || typeof action !== "object") {
-      console.error(`[email-router] dropping non-object action: ${describeUntrusted(action, 320)}`);
-      continue;
-    }
-    if (action.type === "reject") {
-      const raw2 = typeof action.reason === "string" ? action.reason : "";
-      const reason = raw2.length > 0 ? sanitize(raw2, MAX_REJECT_REASON_LENGTH) : "rejected by handler";
-      out.push({ type: "reject", reason });
-      return out;
-    }
-    if (action.type === "forward") {
-      if (!isValidEmailAddress(action.to)) {
-        console.error(
-          `[email-router] forward dropped: invalid "to" address ${logAddress(action.to)}`
-        );
-        continue;
-      }
-      let headers;
-      if (action.headers) {
-        if (!forwardHeadersWithinBounds(action.headers)) {
-          return null;
-        }
-        try {
-          headers = new Headers(action.headers);
-        } catch (e) {
-          console.error(
-            `[email-router] action list dropped: forward headers invalid:`,
-            e instanceof Error ? sanitize(e.message, 320) : sanitize(String(e), 320)
-          );
-          return null;
-        }
-      }
-      out.push({ type: "forward", to: action.to, headers });
-    } else if (action.type === "reply") {
-      if (!isValidEmailAddress(action.from) || !isValidEmailAddress(action.to)) {
-        console.error(
-          `[email-router] reply dropped: invalid address (from=${logAddress(action.from)} to=${logAddress(action.to)})`
-        );
-        continue;
-      }
-      if (!await isPermittedReplySender(action.from, replySender)) {
-        console.error(
-          `[email-router] reply dropped: sender not owned by project "${sanitize(replySender.slug, 64)}" (from=${logAddress(action.from)})`
-        );
-        continue;
-      }
-      if (!(action.raw instanceof Uint8Array)) {
-        console.error(
-          `[email-router] reply dropped: raw is not a Uint8Array (from=${logAddress(action.from)})`
-        );
-        continue;
-      }
-      const replyBytes = action.raw.byteLength;
-      if (replyBytes > MAX_REPLY_BYTES) {
-        console.error(
-          `[email-router] reply dropped: raw is ${replyBytes} bytes (max ${MAX_REPLY_BYTES}) (from=${logAddress(action.from)})`
-        );
-        continue;
-      }
-      if (replyBytesUsed + replyBytes > MAX_REPLY_BYTES_TOTAL) {
-        console.error(
-          `[email-router] reply dropped: cumulative reply bytes ${replyBytesUsed + replyBytes} exceed this delivery's budget of ${MAX_REPLY_BYTES_TOTAL} (from=${logAddress(action.from)})`
-        );
-        continue;
-      }
-      const mimeFrom = readMimeFromAddrSpec(action.raw);
-      if (!mimeFrom.ok || mimeFrom.addrSpec.toLowerCase() !== action.from.toLowerCase()) {
-        console.error(
-          `[email-router] reply dropped: MIME From is not the envelope sender (from=${logAddress(action.from)}, ${mimeFrom.ok ? "header names another address" : mimeFrom.reason})`
-        );
-        continue;
-      }
-      replyBytesUsed += replyBytes;
-      out.push({ type: "reply", from: action.from, to: action.to, raw: action.raw });
+    failure = { code: "UPSTREAM_ERROR", message: "email sending request failed" };
+    failureState = "outcome_unknown";
+  }
+  if (providerResponse) {
+    if (!providerResponse.ok) {
+      failure = {
+        code: providerResponse.status === 429 ? "QUOTA_EXCEEDED" : "UPSTREAM_ERROR",
+        message: `email sending API returned ${providerResponse.status}`
+      };
+      failureState = providerResponse.status >= 500 || providerResponse.status === 408 ? "outcome_unknown" : "failed";
     } else {
-      console.warn(
-        `[email-router] dropping unknown action type: ${describeUntrusted(action.type, 320)}`
-      );
+      const data = providerResponse.data;
+      const success = typeof data === "object" && data !== null ? data.success : void 0;
+      if (success === false) {
+        failure = { code: "UPSTREAM_ERROR", message: "email sending API refused the message" };
+      } else if (success !== true) {
+        failure = { code: "OUTCOME_UNKNOWN", message: "email sending API response invalid" };
+        failureState = "outcome_unknown";
+      } else {
+        sendRawResult = parseSendRawResult(data.result);
+        if (!sendRawResult) {
+          failure = { code: "OUTCOME_UNKNOWN", message: "email sending API response invalid" };
+          failureState = "outcome_unknown";
+        }
+      }
     }
   }
-  return out;
-}
-__name(validateActions, "validateActions");
-async function enactActions(env, message, actions, gate, replySender) {
-  const sanitized = await validateActions(actions, replySender);
-  if (sanitized === null) {
-    return;
-  }
-  await enactSanitized(env, message, sanitized, gate);
-}
-__name(enactActions, "enactActions");
-async function enactSanitized(env, message, actions, gate) {
-  let counterDirty = false;
-  for (const action of actions) {
-    if (action.type === "reject") {
-      message.setReject(action.reason);
-      if (counterDirty) {
-        await commitGateCounters(env, gate);
-      }
-      return;
+  for (const r of recipients) {
+    if (failure) {
+      deliveries.push({ recipient: r, ok: false, state: failureState, error: failure });
+      continue;
     }
-    if (action.type === "forward") {
-      if (!checkOutboundGate(gate, action.to, "forward")) {
-        continue;
-      }
-      try {
-        await message.forward(action.to, action.headers);
-        gate.burstCurrent += 1;
-        gate.monthCurrent += 1;
-        counterDirty = true;
-      } catch (e) {
-        console.error(
-          `[email-router] forward to ${sanitize(action.to, 320)} failed:`,
-          e instanceof Error ? sanitize(e.message, 320) : sanitize(String(e), 320)
-        );
-      }
-    } else if (action.type === "reply") {
-      if (!checkOutboundGate(gate, action.to, "reply")) {
-        continue;
-      }
-      try {
-        const relayReply = message.__voidRelayReply;
-        if (relayReply !== void 0) {
-          await relayReply(action.from, action.to, action.raw);
-        } else {
-          const stream = new ReadableStream({
-            start(controller) {
-              controller.enqueue(action.raw);
-              controller.close();
-            }
-          });
-          const reply = new EmailMessage2(action.from, action.to, stream);
-          await message.reply(reply);
+    const outcome = classifySendRawRecipient(sendRawResult, r);
+    if (outcome === "permanent_bounce") {
+      deliveries.push({
+        recipient: r,
+        ok: false,
+        state: "failed",
+        error: {
+          code: "UNVERIFIED_DESTINATION",
+          message: `recipient '${r}' permanently bounced`
         }
-        gate.burstCurrent += 1;
-        gate.monthCurrent += 1;
-        counterDirty = true;
-      } catch (e) {
-        console.error(
-          `[email-router] reply ${sanitize(action.from, 320)}->${sanitize(action.to, 320)} failed:`,
-          e instanceof Error ? sanitize(e.message, 320) : sanitize(String(e), 320)
-        );
+      });
+    } else if (outcome === "suppressed") {
+      deliveries.push({
+        recipient: r,
+        ok: false,
+        state: "failed",
+        error: {
+          code: "UNVERIFIED_DESTINATION",
+          message: `recipient '${r}' is on the suppression list`
+        }
+      });
+    } else if (outcome === "outcome_unknown") {
+      deliveries.push({
+        recipient: r,
+        ok: false,
+        state: "outcome_unknown",
+        error: {
+          code: "OUTCOME_UNKNOWN",
+          message: "email sending API did not classify the recipient"
+        }
+      });
+    } else {
+      deliveries.push({
+        recipient: r,
+        ok: true,
+        state: "provider_accepted",
+        messageId: sendRawResult.messageId
+      });
+    }
+  }
+  for (const delivery of deliveries.filter(
+    (d) => admission.recipients.some((r) => r.recipient === d.recipient && r.state === "reserved")
+  )) {
+    try {
+      await finishEmailAttempt(
+        context.env,
+        admission.operationId,
+        [delivery.recipient],
+        delivery.ok ? "provider_accepted" : delivery.state === "outcome_unknown" ? "outcome_unknown" : "failed",
+        {
+          providerReference: delivery.messageId,
+          errorCode: delivery.ok ? void 0 : delivery.state === "outcome_unknown" ? "OUTCOME_UNKNOWN" : failure?.code ?? delivery.error?.code
+        },
+        sendDeadline.remainingMs()
+      );
+      delivery.state = delivery.ok ? "provider_accepted" : delivery.state === "outcome_unknown" ? "outcome_unknown" : "failed";
+      if (delivery.state === "outcome_unknown" && !delivery.ok) {
+        delivery.error = {
+          code: "OUTCOME_UNKNOWN",
+          message: "provider outcome unknown; inspect email logs before retrying"
+        };
       }
+    } catch {
+      delivery.ok = false;
+      delivery.state = "outcome_unknown";
+      delivery.error = {
+        code: "OUTCOME_UNKNOWN",
+        message: "provider outcome could not be recorded"
+      };
     }
   }
-  if (counterDirty) {
-    await commitGateCounters(env, gate);
+  logSend(projectId, requestId, deliveries);
+  if (deliveries.some((d) => !d.ok)) {
+    return context.json({ ok: false, operationId: admission.operationId, deliveries }, 200);
   }
+  return context.json({
+    ok: true,
+    operationId: admission.operationId,
+    ids: deliveries.map((d) => ({
+      recipient: d.recipient,
+      messageId: d.messageId,
+      state: "provider_accepted"
+    }))
+  });
 }
-__name(enactSanitized, "enactSanitized");
-function checkOutboundGate(gate, target, kind) {
-  if (gate.quotaExhausted) {
-    console.error(
-      `[email-router] ${kind} dropped: project quota exhausted (target=${sanitize(target, 320)})`
+__name(sendViaCustomDomain, "sendViaCustomDomain");
+async function cancelUnstartedRecipients(env, operationId, recipients, deadlineMs) {
+  try {
+    const result = await finishEmailAttempt(
+      env,
+      operationId,
+      recipients,
+      "cancelled",
+      {},
+      deadlineMs
     );
-    return false;
-  }
-  if (!gate.projectId) {
-    console.error(
-      `[email-router] ${kind} dropped: no projectId on routing entry (target=${sanitize(target, 320)})`
+    return recipients.every(
+      (recipient) => result.recipients.some((row) => row.recipient === recipient && row.state === "cancelled")
     );
+  } catch {
     return false;
   }
-  const lowered = target.toLowerCase();
-  if (!gate.skipAllowlist && !gate.allowlist.has(lowered)) {
-    console.error(
-      `[email-router] ${kind} dropped: recipient not in project allowlist (target=${sanitize(target, 320)})`
+}
+__name(cancelUnstartedRecipients, "cancelUnstartedRecipients");
+function emailActionResponse(context, operationId, deliveries) {
+  if (deliveries.length === 0) {
+    return context.json(
+      {
+        ok: false,
+        operationId,
+        error: { code: "OUTCOME_UNKNOWN", message: "email action remains reserved" }
+      },
+      200
     );
-    return false;
-  }
-  if (gate.burstCurrent + 1 > gate.burstLimit) {
-    console.error(`[email-router] ${kind} dropped: burst limit ${gate.burstLimit}/min exceeded`);
-    gate.quotaExhausted = true;
-    return false;
   }
-  if (gate.monthCurrent + 1 > gate.monthLimit) {
-    console.error(`[email-router] ${kind} dropped: monthly limit ${gate.monthLimit} exceeded`);
-    gate.quotaExhausted = true;
-    return false;
+  if (deliveries.some((d) => !d.ok)) {
+    return context.json({ ok: false, operationId, deliveries }, 200);
   }
-  return true;
-}
-__name(checkOutboundGate, "checkOutboundGate");
-
-// ../../home/runner/work/void/void/platform/packages/proxy/src/email-relay.ts
-var app2 = new Hono2();
-app2.post("/relay", async (context) => {
-  const projectId = context.get("projectId");
-  const from = context.req.header("X-Void-Email-From") ?? "";
-  const to = context.req.header("X-Void-Email-To") ?? "";
-  const domain = to.slice(to.lastIndexOf("@") + 1).toLowerCase();
-  const body = context.req.raw.body;
-  if (!body) {
-    return context.json({ error: "mime body required" }, 400);
-  }
-  const raw2 = await readMimeBody(body);
-  if (raw2 === null) {
-    return context.json({ error: "mime too large" }, 413);
-  }
-  const headers = parseRelayedHeaders(raw2);
-  if (headers === null) {
-    return context.json({ error: "too many headers" }, 413);
-  }
-  const envelope = {
-    from,
-    to,
-    headers,
-    raw: raw2,
-    rawSize: raw2.byteLength,
-    viaDomain: domain
-  };
-  const pending = [];
-  let ctx = {
-    waitUntil(p) {
-      pending.push(p);
+  return context.json(
+    {
+      ok: true,
+      operationId,
+      ids: deliveries.map((d) => ({
+        recipient: d.recipient,
+        messageId: d.messageId ?? "",
+        state: d.state
+      }))
     },
-    passThroughOnException() {
-    }
-  };
-  try {
-    ctx = context.executionCtx;
-  } catch {
-  }
-  const outcome = await routeRelayed(context.env, ctx, { projectId, domain, envelope });
-  if (pending.length > 0) {
-    await Promise.allSettled(pending);
-  }
-  if (outcome.reject) {
-    return context.json({ error: "message rejected" }, 403);
-  }
-  return context.json({ ok: true });
-});
-async function readMimeBody(stream) {
-  const reader = stream.getReader();
-  const chunks = [];
-  let total = 0;
-  for (; ; ) {
-    const { value, done } = await reader.read();
-    if (done) {
-      break;
-    }
-    total += value.byteLength;
-    if (total > MAX_MIME_BYTES) {
-      try {
-        await reader.cancel();
-      } catch {
-      }
-      return null;
-    }
-    chunks.push(value);
+    200
+  );
+}
+__name(emailActionResponse, "emailActionResponse");
+function logSend(projectId, requestId, deliveries) {
+  for (const d of deliveries) {
+    const status = d.ok ? "sent" : d.error?.code ?? "unknown_error";
+    const id = d.messageId ?? "";
+    console.log(
+      `[email-log] ${projectId} ${requestId} ${sanitizeForLog(d.recipient, 320)} ${status} ${id} @${Date.now()}`
+    );
   }
-  const out = new Uint8Array(total);
-  let offset = 0;
-  for (const c of chunks) {
-    out.set(c, offset);
-    offset += c.byteLength;
+}
+__name(logSend, "logSend");
+function base64Decode(b64) {
+  const binary = atob(b64);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    out[i] = binary.charCodeAt(i);
   }
   return out;
 }
-__name(readMimeBody, "readMimeBody");
-var LF2 = 10;
-var CR2 = 13;
-var HEADER_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9a-z]+$/;
-var MAX_INBOUND_HEADER_LINES = 4096;
-function parseRelayedHeaders(raw2) {
-  const block = new TextDecoder().decode(raw2.subarray(0, headerBlockEnd(raw2)));
-  const folded = /* @__PURE__ */ new Map();
-  let totalPieces = 0;
-  let current = null;
-  let pos = 0;
-  while (pos < block.length) {
-    let nl = block.indexOf("\n", pos);
-    if (nl === -1) {
-      nl = block.length;
-    }
-    let line = block.slice(pos, nl);
-    pos = nl + 1;
-    if (line.endsWith("\r")) {
-      line = line.slice(0, -1);
-    }
-    if (line === "") {
-      break;
-    }
-    if (line.startsWith(" ") || line.startsWith("	")) {
-      if (current !== null && headerValueSafe(line)) {
-        totalPieces += 1;
-        if (totalPieces > MAX_INBOUND_HEADER_LINES) {
-          return null;
-        }
-        const pieces2 = folded.get(current) ?? [];
-        pieces2.push(` ${line.trim()}`);
-        folded.set(current, pieces2);
-      }
-      continue;
-    }
-    const colon = line.indexOf(":");
-    if (colon === -1) {
-      current = null;
-      continue;
-    }
-    const name = line.slice(0, colon).trim().toLowerCase();
-    const value = line.slice(colon + 1).trim();
-    if (!HEADER_NAME_RE.test(name) || !headerValueSafe(value)) {
-      current = null;
-      continue;
+__name(base64Decode, "base64Decode");
+
+// ../../home/runner/work/void/void/platform/packages/proxy/src/human-stream.ts
+function guardHumanStream(source, validate, signal) {
+  const reader = source.getReader();
+  let closed = false;
+  let timer;
+  let controller;
+  const cleanup = /* @__PURE__ */ __name(() => {
+    closed = true;
+    if (timer !== void 0) {
+      clearTimeout(timer);
+    }
+    signal?.removeEventListener("abort", abort);
+  }, "cleanup");
+  const stop = /* @__PURE__ */ __name(() => {
+    if (closed) {
+      return;
     }
-    const pieces = folded.get(name);
-    totalPieces += 1;
-    if (totalPieces > MAX_INBOUND_HEADER_LINES) {
-      return null;
+    cleanup();
+    controller.error(new Error("Authentication expired or was revoked. Sign in again."));
+    void reader.cancel().catch(() => {
+    });
+  }, "stop");
+  const abort = /* @__PURE__ */ __name(() => stop(), "abort");
+  const check = /* @__PURE__ */ __name(async () => {
+    if (closed) {
+      return false;
     }
-    if (pieces !== void 0) {
-      pieces.push(`, ${value}`);
-    } else {
-      if (folded.size >= MAX_INBOUND_HEADERS) {
-        return null;
+    try {
+      if (await validate()) {
+        return !closed;
       }
-      folded.set(name, [value]);
+    } catch {
     }
-    current = name;
-  }
-  return Object.fromEntries(
-    Array.from(folded, ([name, pieces]) => [name, pieces.join("")])
+    stop();
+    return false;
+  }, "check");
+  const schedule = /* @__PURE__ */ __name(() => {
+    timer = setTimeout(async () => {
+      if (await check()) {
+        schedule();
+      }
+    }, 15e3);
+  }, "schedule");
+  return new ReadableStream(
+    {
+      start(target) {
+        controller = target;
+        signal?.addEventListener("abort", abort, { once: true });
+        if (signal?.aborted) {
+          stop();
+        } else {
+          schedule();
+        }
+      },
+      async pull(target) {
+        try {
+          const chunk = await reader.read();
+          if (closed) {
+            return;
+          }
+          if (chunk.done) {
+            cleanup();
+            target.close();
+          } else if (await check()) {
+            target.enqueue(chunk.value);
+          }
+        } catch (error) {
+          if (!closed) {
+            cleanup();
+            target.error(error);
+            void reader.cancel().catch(() => {
+            });
+          }
+        }
+      },
+      async cancel(reason) {
+        cleanup();
+        await reader.cancel(reason);
+      }
+    },
+    { highWaterMark: 0 }
   );
 }
-__name(parseRelayedHeaders, "parseRelayedHeaders");
-function headerBlockEnd(raw2) {
-  let lineStart = 0;
-  while (lineStart < raw2.length) {
-    const lf = raw2.indexOf(LF2, lineStart);
-    const lineEnd = lf === -1 ? raw2.length : lf;
-    let contentEnd = lineEnd;
-    if (contentEnd > lineStart && raw2[contentEnd - 1] === CR2) {
-      contentEnd--;
-    }
-    if (contentEnd === lineStart) {
-      return lineStart;
-    }
-    lineStart = lf === -1 ? raw2.length : lf + 1;
-  }
-  return raw2.length;
-}
-__name(headerBlockEnd, "headerBlockEnd");
-function headerValueSafe(value) {
-  for (let i = 0; i < value.length; i++) {
-    const code = value.charCodeAt(i);
-    if (code === 9) {
-      continue;
-    }
-    if (code < 32 || code === 127 || code > 255) {
-      return false;
-    }
-  }
-  return true;
-}
-__name(headerValueSafe, "headerValueSafe");
+__name(guardHumanStream, "guardHumanStream");
 
 // ../../home/runner/work/void/void/platform/packages/proxy/src/kv.ts
-init_performance2();
 var CF_API2 = "https://api.cloudflare.com/client/v4";
 var kv = new Hono2();
 kv.post("/get", async (context) => {
@@ -5681,12 +5116,10 @@ kv.post("/list", async (context) => {
 });
 
 // ../../home/runner/work/void/void/platform/packages/proxy/src/platform-lifecycle.ts
-init_performance2();
 var PLATFORM_DISABLED_KEY = "__void/platform/disabled/v1";
 var PLATFORM_DISABLED_VALUE = "disabled";
 
 // ../../home/runner/work/void/void/platform/packages/proxy/src/r2.ts
-init_performance2();
 var CF_API3 = "https://api.cloudflare.com/client/v4";
 var r2 = new Hono2();
 function cfHeaders(token) {
@@ -5948,9 +5381,8 @@ r2.post("/head", async (context) => {
 });
 
 // ../../home/runner/work/void/void/platform/packages/proxy/src/revalidate.ts
-init_performance2();
-var app3 = new Hono2();
-app3.post("/", async (context) => {
+var app2 = new Hono2();
+app2.post("/", async (context) => {
   const projectId = context.get("projectId");
   const body = context.get("body");
   const response = await context.env.API.fetch(`https://api/internal/revalidate/${projectId}`, {
@@ -5971,8 +5403,8 @@ app3.post("/", async (context) => {
 });
 
 // ../../home/runner/work/void/void/platform/packages/proxy/src/index.ts
-var app4 = new Hono2();
-app4.use("/*", async (context, next) => {
+var app3 = new Hono2();
+app3.use("/*", async (context, next) => {
   const healthProbeToken = context.env.PLATFORM_HEALTH_PROBE_TOKEN;
   const installerProbe = healthProbeToken !== void 0 && healthProbeToken !== "" && context.req.path === "/health" && context.req.header("X-Void-Platform-Probe") === healthProbeToken;
   if (!installerProbe && (context.env.PLATFORM_TRAFFIC_STATE === "staging" || context.env.PLATFORM_TRAFFIC_STATE === "sandbox-drain" || context.env.PLATFORM_INSTALLATION_ID && await context.env.ROUTING.get(PLATFORM_DISABLED_KEY) === PLATFORM_DISABLED_VALUE)) {
@@ -5980,7 +5412,7 @@ app4.use("/*", async (context, next) => {
   }
   await next();
 });
-app4.use(
+app3.use(
   "/*",
   cors({
     origin: "*",
@@ -5988,7 +5420,7 @@ app4.use(
     allowHeaders: ["content-type", "authorization"]
   })
 );
-app4.get(
+app3.get(
   "/health",
   (context) => context.json({
     ok: true,
@@ -6002,66 +5434,64 @@ app4.get(
     }
   })
 );
-app4.all("/*", async (context, next) => {
+app3.all("/*", async (context, next) => {
   if (context.req.method !== "POST") {
     return context.json({ error: "method not allowed" }, 405);
   }
   await next();
 });
-var PLATFORM_INTERNAL_EMAIL_SENTINEL = "void-platform-internal-email-v1";
-var MAX_PLATFORM_MIME_BASE64_LENGTH = Math.ceil(10 * 1024 * 1024 * 4 / 3) + 4;
-var PLATFORM_TOKEN_MAX_SKEW_SECONDS = 5 * 60;
-var PLATFORM_TOKEN_LENGTH = 43;
-app4.post("/*", async (context, next) => {
-  const path = new URL(context.req.url).pathname;
-  if (path === "/email/relay") {
-    const relayDomain = context.req.header("X-Void-Email-Domain");
-    const relayFrom = context.req.header("X-Void-Email-From");
-    const relayTo = context.req.header("X-Void-Email-To");
-    const relayAuth = context.req.header("Authorization");
-    if (!relayDomain || !relayFrom || !relayTo || !relayAuth) {
-      return context.json({ error: "relay envelope required" }, 400);
-    }
-    if (relayDomain.length > 256 || relayFrom.length > 256 || relayTo.length > 256 || relayAuth.length > 256) {
-      return context.json({ error: "relay envelope required" }, 400);
-    }
-    const contentLengthRaw = context.req.header("content-length");
-    if (!contentLengthRaw) {
-      return context.json({ error: "content-length required" }, 400);
-    }
-    const contentLength = Number(contentLengthRaw);
-    if (!Number.isInteger(contentLength) || contentLength < 0) {
-      return context.json({ error: "content-length required" }, 400);
-    }
-    if (contentLength > MAX_MIME_BYTES) {
-      return context.json({ error: "mime too large" }, 413);
-    }
-    const relaySecret = relayAuth.startsWith("Bearer ") ? relayAuth.slice(7) : null;
-    if (!relaySecret) {
-      return context.json({ error: "invalid relay credentials" }, 403);
-    }
-    const recipientDomain = relayTo.slice(relayTo.lastIndexOf("@") + 1).toLowerCase();
-    if (recipientDomain.length === 0 || recipientDomain !== relayDomain.toLowerCase()) {
-      return context.json({ error: "relay domain mismatch" }, 403);
-    }
-    const mirror = await readEmailDomainMirror(context.env.ROUTING, recipientDomain);
-    if (!mirror) {
-      return context.json({ error: "invalid relay credentials" }, 403);
-    }
-    const presented = await sha256Hex(relaySecret);
-    if (!constantTimeEqual(presented, mirror.relaySecretSha256)) {
-      return context.json({ error: "invalid relay credentials" }, 403);
-    }
-    if (mirror.status !== "active") {
-      return context.json({ error: "email domain is not active" }, 403);
-    }
-    context.set("projectId", mirror.projectId);
-    await next();
-    return;
+async function hmacSign4(data, secret) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const bytes = new Uint8Array(
+    await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data))
+  );
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+__name(hmacSign4, "hmacSign");
+app3.post("/email/verify-receipt", async (context) => {
+  let body;
+  try {
+    body = await readEmailRequestJson(context.req.raw);
+  } catch {
+    return context.json({ valid: false }, 400);
+  }
+  if (!body || typeof body !== "object") {
+    return context.json({ valid: false }, 400);
+  }
+  const input = body;
+  if (typeof input.projectId !== "string" || input.projectId.length > 128 || typeof input.deploymentId !== "string" || input.deploymentId.length > 128 || typeof input.recipient !== "string" || input.recipient.length > 320 || typeof input.receipt !== "string" || input.receipt.length > 1536) {
+    return context.json({ valid: false }, 400);
   }
+  const projectToken = await hmacSign4(input.projectId, context.env.JWT_SECRET);
+  if (context.req.header("x-void-internal") !== projectToken) {
+    return context.json({ valid: false }, 403);
+  }
+  if (!context.env.EMAIL_SIGNING_SECRET) {
+    return context.json({ valid: false }, 503);
+  }
+  const claims = await verifyEmailReceipt(input.receipt, context.env.EMAIL_SIGNING_SECRET, {
+    projectId: input.projectId,
+    deploymentId: input.deploymentId,
+    recipient: input.recipient
+  });
+  return context.json({ valid: claims !== null, receiptId: claims?.receiptId });
+});
+app3.post("/email/relay", (context) => context.json({ error: "not found" }, 404));
+app3.post("/*", async (context, next) => {
+  const path = new URL(context.req.url).pathname;
   let body;
   try {
-    const json = await context.req.json();
+    const json = path === "/email" || path.startsWith("/email/") ? await readEmailRequestJson(context.req.raw, 8 * 1024 * 1024) : await context.req.json();
     if (!isProxyBody(json)) {
       return context.json({ error: "invalid JSON body" }, 400);
     }
@@ -6070,45 +5500,19 @@ app4.post("/*", async (context, next) => {
     return context.json({ error: "invalid JSON body" }, 400);
   }
   context.set("body", body);
-  if (path.startsWith("/email/internal/")) {
-    const platformToken = asString(body.platformToken);
-    const platformTimestamp = asNumber(body.platformTimestamp);
-    if (!platformToken || platformTimestamp === null) {
-      return context.json({ error: "platform token required" }, 403);
-    }
-    if (platformToken.length !== PLATFORM_TOKEN_LENGTH) {
-      return context.json({ error: "invalid platform token" }, 403);
-    }
-    const nowSec = Math.floor(Date.now() / 1e3);
-    if (Math.abs(nowSec - platformTimestamp) > PLATFORM_TOKEN_MAX_SKEW_SECONDS) {
-      return context.json({ error: "invalid platform token" }, 403);
-    }
-    const bindingFrom = asString(body.from);
-    const bindingTo = asString(body.to);
-    const bindingMime = asString(body.mimeBase64);
-    if (!bindingFrom || !bindingTo || !bindingMime) {
-      return context.json({ error: "invalid platform token" }, 403);
-    }
-    if (bindingMime.length > MAX_PLATFORM_MIME_BASE64_LENGTH) {
-      return context.json({ error: "invalid platform token" }, 403);
-    }
-    if (bindingFrom.length > MAX_SENDER_LENGTH || bindingTo.length > MAX_RECIPIENT_LENGTH) {
-      return context.json({ error: "invalid platform token" }, 403);
-    }
-    const contentHash = await sha256Hex(`${bindingFrom}|${bindingTo}|${bindingMime}`);
-    const signed = `${PLATFORM_INTERNAL_EMAIL_SENTINEL}.${platformTimestamp}.${contentHash}`;
-    if (!await verifyHmac(signed, platformToken, context.env.JWT_SECRET)) {
-      return context.json({ error: "invalid platform token" }, 403);
-    }
-    await next();
-    return;
-  }
+  let revalidateHuman;
   const authHeader = context.req.header("authorization");
   if (authHeader?.startsWith("Bearer ")) {
     const token = authHeader.slice(7);
     const payload = await verifyJwt(token, context.env.JWT_SECRET);
     if (!payload) {
-      return context.json({ error: "invalid or expired token" }, 401);
+      return context.json(
+        {
+          error: "invalid or expired token",
+          message: "This proxy credential is invalid or expired. Sign in to the connected platform again for remote development, or restart the build to obtain a fresh prerender token."
+        },
+        401
+      );
     }
     const projectId = asString(body.projectId);
     if (!projectId) {
@@ -6116,25 +5520,52 @@ app4.post("/*", async (context, next) => {
     }
     if (payload.aud === "prerender") {
       if (!payload.project || payload.project !== projectId) {
-        return context.json({ error: "forbidden" }, 403);
+        return context.json(
+          {
+            error: "forbidden",
+            message: "This prerender token does not match the requested project. Restart the build with a prerender token issued for the selected project."
+          },
+          403
+        );
       }
-      if (payload.build && !await verifyPrerenderBuild(
+      const active = await verifyPrerenderAuthority(
         context.env.API,
         context.env.JWT_SECRET,
         projectId,
-        payload.build
-      )) {
-        return context.json({ error: "prerender token build is no longer active" }, 403);
+        payload.sub,
+        {
+          ...payload.build ? { buildId: payload.build } : {},
+          ...payload.credential ? { credentialId: payload.credential } : {}
+        }
+      );
+      if (!active) {
+        return context.json(
+          {
+            error: payload.credential ? "prerender token credential is no longer active" : payload.build ? "prerender token build is no longer active" : "prerender token authority is no longer active",
+            message: payload.credential ? "The deploy credential used for prerendering is no longer authorized. Ask the project owner for an active deploy credential, then restart the build." : payload.build ? "This build is no longer authorized to prerender. Start a new build to obtain a fresh prerender token." : "This prerender token is no longer authorized. Confirm your project access with a project admin or owner, then restart the build to obtain a fresh token."
+          },
+          403
+        );
       }
     } else {
-      const owns = await verifyProjectOwner(
+      const checkOwner = /* @__PURE__ */ __name(() => verifyProjectDeployAccess(
         context.env.API,
         context.env.JWT_SECRET,
         projectId,
-        payload.sub
-      );
-      if (!owns) {
-        return context.json({ error: "forbidden" }, 403);
+        payload.sub,
+        token,
+        context.req.header("Cf-Access-Jwt-Assertion"),
+        new URL(context.req.url).origin
+      ), "checkOwner");
+      revalidateHuman = /* @__PURE__ */ __name(async () => payload.exp > Date.now() / 1e3 && await checkOwner(), "revalidateHuman");
+      if (!await revalidateHuman()) {
+        return context.json(
+          {
+            error: "forbidden",
+            message: "Remote access could not be authorized. Check the selected platform and project, then ask a project admin or owner to confirm your access. If your access is correct, retry shortly."
+          },
+          403
+        );
       }
     }
     context.set("projectId", projectId);
@@ -6150,14 +5581,20 @@ app4.post("/*", async (context, next) => {
     context.set("projectId", projectId);
   }
   await next();
+  if (revalidateHuman && context.res.body && (context.res.headers.get("content-type")?.includes("text/event-stream") || path.startsWith("/ai/") || path === "/r2/get")) {
+    context.res = new Response(
+      guardHumanStream(context.res.body, revalidateHuman, context.req.raw.signal),
+      context.res
+    );
+  }
 });
-app4.post("/ai/*", async (context, next) => {
+app3.post("/ai/*", async (context, next) => {
   if (await context.env.ROUTING.get(`ai-block:${context.get("projectId")}`, { cacheTtl: 60 })) {
     return context.json({ error: "AI usage limit exceeded" }, 429);
   }
   await next();
 });
-app4.post(
+app3.post(
   "/sandbox/*",
   (context) => context.json(
     {
@@ -6168,7 +5605,7 @@ app4.post(
     501
   )
 );
-app4.post("/email/*", async (context, next) => {
+app3.post("/email/*", async (context, next) => {
   if (!proxyCapabilityEnabled(context.env.PLATFORM_CAPABILITIES, "email")) {
     return context.json(
       {
@@ -6181,25 +5618,15 @@ app4.post("/email/*", async (context, next) => {
   }
   await next();
 });
-app4.route("/ai", ai);
-app4.route("/d1", d1);
-app4.route("/kv", kv);
-app4.route("/r2", r2);
-app4.route("/revalidate", app3);
-app4.route("/email", app);
-app4.route("/email", app2);
-var index_default = {
-  fetch: app4.fetch,
-  /**
-   * Inbound email entry point — bound as the catch-all CF Email Routing rule
-   * on the platform mail zone. See `email-router.ts`.
-   */
-  async email(message, env, ctx) {
-    await routeInbound(message, env, ctx);
-  }
-};
-var encoder4 = new TextEncoder();
-var decoder = new TextDecoder();
+app3.route("/ai", ai);
+app3.route("/d1", d1);
+app3.route("/kv", kv);
+app3.route("/r2", r2);
+app3.route("/revalidate", app2);
+app3.route("/email", app);
+var index_default = { fetch: app3.fetch };
+var encoder6 = new TextEncoder();
+var decoder4 = new TextDecoder();
 var cachedVerifyKey;
 var cachedKeySecret4;
 async function getVerifyKey(secret) {
@@ -6208,7 +5635,7 @@ async function getVerifyKey(secret) {
   }
   cachedVerifyKey = await crypto.subtle.importKey(
     "raw",
-    encoder4.encode(secret),
+    encoder6.encode(secret),
     { name: "HMAC", hash: "SHA-256" },
     false,
     ["verify"]
@@ -6217,32 +5644,11 @@ async function getVerifyKey(secret) {
   return cachedVerifyKey;
 }
 __name(getVerifyKey, "getVerifyKey");
-async function sha256Hex(input) {
-  const digest = await crypto.subtle.digest("SHA-256", encoder4.encode(input));
-  const bytes = new Uint8Array(digest);
-  let out = "";
-  for (const b of bytes) {
-    out += b.toString(16).padStart(2, "0");
-  }
-  return out;
-}
-__name(sha256Hex, "sha256Hex");
-function constantTimeEqual(a, b) {
-  if (a.length !== b.length) {
-    return false;
-  }
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) {
-    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return diff === 0;
-}
-__name(constantTimeEqual, "constantTimeEqual");
 async function verifyHmac(data, signature, secret) {
   try {
     const key = await getVerifyKey(secret);
     const sigBytes = base64urlDecode(signature);
-    return crypto.subtle.verify("HMAC", key, sigBytes.buffer, encoder4.encode(data));
+    return crypto.subtle.verify("HMAC", key, sigBytes.buffer, encoder6.encode(data));
   } catch {
     return false;
   }
@@ -6267,12 +5673,12 @@ async function verifyJwt(token, secret) {
       "HMAC",
       key,
       sigBytes.buffer,
-      encoder4.encode(`${header}.${body}`)
+      encoder6.encode(`${header}.${body}`)
     );
     if (!valid) {
       return null;
     }
-    const payload = JSON.parse(decoder.decode(base64urlDecode(body)));
+    const payload = JSON.parse(decoder4.decode(base64urlDecode(body)));
     const now = Math.floor(Date.now() / 1e3);
     if (payload.exp <= now) {
       return null;