void 0.20.1 → 0.20.2

package/dist/{inbound-afAcWeQ9.d.mts → inbound-CH5Mksyy.d.mts}

@@ -36,6 +36,12 @@ interface SendEmailOptions {
   bcc?: Address | Array<Address>;
   headers?: Record<string, string>;
   attachments?: Array<Attachment>;
+  /**
+   * Deduplicates a platform send for 30 days. Reuse the same key and message
+   * when checking an uncertain attempt; a changed message is a conflict.
+   * Native Cloudflare bindings do not provide this guarantee.
+   */
+  idempotencyKey?: string;
   /**
    * Per-call escape hatch for local development. When true, bypasses the
    * `void dev` in-memory inbox for this one send.
@@ -52,7 +58,7 @@ interface SendEmailOptions {
    */
   sendInDev?: boolean;
 }
-type SendEmailErrorCode = "BINDING_MISSING" | "INVALID_FROM" | "INVALID_TO" | "UNVERIFIED_DESTINATION" | "MIME_ERROR" | "QUOTA_EXCEEDED" | "UPSTREAM_ERROR";
+type SendEmailErrorCode = "BINDING_MISSING" | "INVALID_FROM" | "INVALID_TO" | "UNVERIFIED_DESTINATION" | "MIME_ERROR" | "QUOTA_EXCEEDED" | "IDEMPOTENCY_CONFLICT" | "OUTCOME_UNKNOWN" | "UPSTREAM_ERROR";
 interface SendEmailError {
   code: SendEmailErrorCode;
   message: string;
@@ -66,7 +72,9 @@ interface SendEmailError {
 interface SendEmailDelivery {
   recipient: string;
   messageId: string;
+  state?: "provider_accepted";
 }
+type EmailDeliveryState = "rejected" | "reserved" | "attempt_started" | "provider_accepted" | "failed" | "outcome_unknown" | "cancelled";
 /**
  * Per-recipient outcome for a multi-recipient send. `ok: true` carries the
  * CF-issued messageId; `ok: false` carries the error for that specific
@@ -76,10 +84,12 @@ type SendEmailRecipientResult = {
   recipient: string;
   ok: true;
   messageId: string;
+  state?: "provider_accepted";
 } | {
   recipient: string;
   ok: false;
   error: SendEmailError;
+  state?: EmailDeliveryState;
 };
 /**
  * Result of `sendEmail`.
@@ -89,25 +99,27 @@ type SendEmailRecipientResult = {
  * `'deliveries' in result` (per-recipient failure, some may have succeeded):
  *
  * - `{ ok: true, ids }`            — every envelope succeeded.
- * - `{ ok: false, error }`         — pre-flight failure (validation, MIME,
- *                                     missing binding); no envelopes attempted.
+ * - `{ ok: false, error }`         — validation or transport failure. An
+ *                                     OUTCOME_UNKNOWN may have been submitted;
+ *                                     never retry it with a new idempotency key.
  * - `{ ok: false, deliveries }`    — sends were attempted; at least one failed.
  *                                     `deliveries` carries the per-recipient
- *                                     outcome so callers can safely retry only
- *                                     the failed ones. There is no aggregate
- *                                     top-level error — distinct recipients can
- *                                     fail with distinct errors, and picking one
- *                                     would be arbitrary.
+ *                                     outcome. Provider acceptance does not
+ *                                     establish mailbox delivery. Unknown
+ *                                     outcomes must not be blindly retried.
  */
 type SendEmailResult = {
   ok: true;
   ids: Array<SendEmailDelivery>;
+  operationId?: string;
 } | {
   ok: false;
   error: SendEmailError;
+  operationId?: string;
 } | {
   ok: false;
   deliveries: Array<SendEmailRecipientResult>;
+  operationId?: string;
 };
 /**
  * Normalized representation produced by validation, consumed by both the
@@ -197,40 +209,24 @@ declare class ParseEmailError extends Error {
  * one-shot.
  */
 declare function parseEmail(message: ForwardableEmailMessage): Promise<ParsedEmail>;
-/**
- * Serialized inbound email message — sent from the platform router to the
- * user worker over RPC. Every field is in workerd's RPC `BaseType`
- * allowlist (string, plain object, ReadableStream<Uint8Array>, number).
- */
+/** Inbound message decoded from the authenticated gateway request. */
 interface EmailEnvelope {
   from: string;
   to: string;
-  /** Headers serialized as a plain object so they cross RPC. */
+  /** Decoded header metadata. */
   headers: Record<string, string>;
   /**
-   * Raw RFC 5322 bytes. Pre-buffered by the router so it's replayable on the
-   * receiving side (`parseEmail` consumes the stream once; if the handler
-   * also calls `parseEmail` directly, the platform tee'd a fresh stream per
-   * delivery).
+   * Raw RFC 5322 bytes. The message proxy caches them for repeated reads.
    */
   raw: ReadableStream<Uint8Array> | Uint8Array;
   rawSize: number;
   /**
-   * The registered custom domain this message arrived on, set only by the
-   * platform's relay lane (`POST /email/relay` — design doc 0078, "Custom
-   * domains on Cloudflare"). Undefined on the platform mail zone. A relayed
-   * recipient carries no `<slug>+` prefix, so the generated dispatcher runs
-   * in no-prefix mode for it (Mode B item 4) and `replyEmail` defaults
-   * `from` to the address that received it, on this domain.
+   * Exact custom domain selected by the gateway. Custom-domain recipients
+   * have no project-slug prefix; replies default to the received address.
    */
   viaDomain?: string;
 }
-/**
- * What the user handler decided to do with a message. Returned from the
- * worker's `email(envelope)` RPC method as an array (handlers may chain
- * multiple actions, e.g. forward then reply); the router enacts each on the
- * real `ForwardableEmailMessage` in order.
- */
+/** Handler intents, validated and admitted by the gateway before delivery. */
 type EmailAction = {
   type: "reject";
   reason: string;
@@ -270,7 +266,7 @@ interface CreateMessageProxyOptions {
  * accept a native `EmailMessage` from `cloudflare:email`: that class exposes
  * only `from` and `to` (workers-types declares nothing else, and the body
  * has no public accessor), so its bytes cannot be recorded here, and nothing
- * could carry them over RPC to the platform router. The reply MIME bytes are
+ * could encode them for the gateway. The reply MIME bytes are
  * buffered before being recorded so the action is fully self-contained.
  *
  * When `opts.slug` is provided, `message.to` is rewritten to remove the
@@ -323,8 +319,8 @@ interface ReplyEmailOptions {
 /**
  * Send a threading-aware reply to an inbound message. Builds the reply MIME
  * (correct `In-Reply-To` / `References` / `Subject: Re: …`) and records a
- * reply intent on the message proxy. The platform router enacts the reply
- * via the real `ForwardableEmailMessage.reply()` once the handler returns.
+ * reply intent on the message proxy. Delivery follows handler completion and,
+ * on the platform, authoritative admission.
  *
  * The threading headers are best-effort, since the inbound values they are
  * built from are remote-sender controlled: an id no header line can carry
@@ -333,10 +329,8 @@ interface ReplyEmailOptions {
  */
 declare function replyEmail(message: ForwardableEmailMessage, opts: ReplyEmailOptions): Promise<void>;
 /**
- * Whether `value` is a real `ForwardableEmailMessage` — one Cloudflare
- * delivered to this worker's `email()` directly — rather than an
- * `EmailEnvelope` from the platform router. Functions do not survive RPC,
- * so their presence is the discriminator.
+ * Recognize native email operations. This structural check is not an
+ * authentication boundary; managed entrypoints require receipt authentication.
  */
 declare function isForwardableEmailMessage(value: unknown): value is ForwardableEmailMessage;
 /**
@@ -347,17 +341,9 @@ declare function isForwardableEmailMessage(value: unknown): value is Forwardable
  * duck-typed object — so `cloudflare:email` is loaded here, and only when
  * a reply was recorded.
  *
- * The `new Headers()` below is the one step this loop constructs from
- * handler input, and it cannot fail on a recorded action: the proxy's
- * `forward()` already ran the record through that constructor, so a bad
- * record failed inside the handler, before any replay. (`EmailMessage`
- * construction neither validates nor reads its stream — measured under
- * workerd.) A reject's reason reaches the native `setReject()` as the proxy
- * recorded it — already sliced and stripped the way the platform router
- * would (`normalizeRejectReason`), so the SMTP reply is the same in both
- * deployments. What Cloudflare itself refuses at `forward()` / `reply()`
- * still throws out of the loop, as any native call would.
+ * The proxy already validated forward headers and normalized reject reasons.
+ * Provider refusals still propagate to the native event caller.
  */
 declare function enactEmailActions(message: ForwardableEmailMessage, actions: ReadonlyArray<EmailAction>): Promise<void>;
 //#endregion
-export { SendEmailRecipientResult as C, SendEmailOptions as S, Attachment as _, MessageProxy as a, SendEmailError as b, ParsedEmail as c, defineEmail as d, enactEmailActions as f, Address as g, replyEmail as h, EmailHandlerInfo as i, ReplyEmailOptions as l, parseEmail as m, EmailEnvelope as n, ParseEmailError as o, isForwardableEmailMessage as p, EmailHandler as r, ParseEmailErrorCode as s, EmailAction as t, createMessageProxy as u, NormalizedEmail as v, SendEmailResult as w, SendEmailErrorCode as x, SendEmailDelivery as y };
+export { SendEmailOptions as C, SendEmailErrorCode as S, SendEmailResult as T, Attachment as _, MessageProxy as a, SendEmailDelivery as b, ParsedEmail as c, defineEmail as d, enactEmailActions as f, Address as g, replyEmail as h, EmailHandlerInfo as i, ReplyEmailOptions as l, parseEmail as m, EmailEnvelope as n, ParseEmailError as o, isForwardableEmailMessage as p, EmailHandler as r, ParseEmailErrorCode as s, EmailAction as t, createMessageProxy as u, EmailDeliveryState as v, SendEmailRecipientResult as w, SendEmailError as x, NormalizedEmail as y };

package/dist/{inbound-2d0zi2yS.mjs → inbound-aVHEUhKo.mjs}

@@ -1,58 +1,28 @@
-import { i as normalizeEmail, n as MimeError, o as validateAddressParts, r as buildMime, t as MAX_MESSAGE_BYTES } from "./mime-BJD7d_qL.mjs";
+import { i as normalizeEmail, n as MimeError, o as validateAddressParts, r as buildMime } from "./mime-D5Nmdzf7.mjs";
 import { a as getRawRuntimeEnv } from "./env-raw-Cx8ElDdj.mjs";
+import { EMAIL_MAX_RESPONSE_BYTES } from "@void/platform/email-protocol";
 //#region src/runtime/email/inbound.ts
 const VALID_SLUG = /^[a-z0-9](?:[a-z0-9-]{0,54}[a-z0-9])?$/;
-/**
-* Guardrails on what one handler may queue.
-*
-* These are NOT the security boundary. Recording happens inside the tenant's
-* own worker, and on the platform a Workers-for-Platforms tenant can ship any
-* `WorkerEntrypoint` whose `email()` returns any array at all, bypassing this
-* file entirely — so the load-bearing caps are the matching ones in the
-* platform router (`MAX_ACTIONS` / `MAX_ACTION_ADDRESS_LENGTH` in
-* `email-router.ts`). What these buy is a fast, precise failure at the call
-* that went wrong, instead of a whole action list silently dropped at the
-* router with only a platform-side log to show for it.
-*/
 const MAX_ACTIONS = 100;
 const MAX_ACTION_ADDRESS_LENGTH = 320;
+const MAX_ACTION_METADATA_BYTES = 8192;
 const MAX_FORWARD_HEADER_LENGTH = 1024;
-/**
-* Cap on a reject reason, restated from the router's
-* `MAX_REJECT_REASON_LENGTH` in `email-router.ts` for the same reason as
-* above, and pinned by the same test. See `normalizeRejectReason`.
-*/
+/** Maximum normalized SMTP rejection reason length. */
 const MAX_REJECT_REASON_LENGTH = 1e3;
-/**
-* The router's ADMISSION bounds — what it refuses BEFORE the handler runs
-* (`MAX_INBOUND_BYTES` / `MAX_INBOUND_HEADERS` in `email-router.ts`,
-* restated for the same reason as above and pinned by the same test).
-* `routeInbound` rejects a message over either one and never dispatches it,
-* so a handler's behaviour on such a message is unreachable after a managed
-* deploy; the test harness applies both before it invokes the handler.
-*
-* `MAX_INBOUND_BYTES` is NOT `MAX_MESSAGE_BYTES`, though the numbers agree
-* today. That one is Cloudflare's cap on an OUTBOUND message (and the
-* `parseEmail` guard); this one is the router's own heap headroom on an
-* inbound one, set well under Cloudflare's ~25 MB inbound ceiling, and the
-* two can move independently.
-*/
+/** Inbound admission limits also applied by the handler test harness. */
 const MAX_INBOUND_BYTES = 10485760;
 const MAX_INBOUND_HEADERS = 1024;
-/**
-* Cumulative reply-byte budget for ONE dispatch.
-*
-* `MAX_MESSAGE_BYTES` bounds a single `reply()` call, not the queue: N replies
-* at the cap is N x 10 MiB of `Uint8Array` riding one RPC response. workerd
-* caps a serialized RPC payload at 32 MiB, so the queue that clears our
-* per-reply check still fails at the boundary — opaquely. The router cannot
-* tell that failure from any other dispatch error, so the whole message comes
-* back to the sender as a generic "project handler error" reject with nothing
-* in it a handler author could act on. Two full-size replies is already well
-* past any legitimate use, and failing here names the exact call that
-* overran.
-*/
-const MAX_REPLY_BYTES_TOTAL = 2 * MAX_MESSAGE_BYTES;
+const MAX_REPLY_BYTES = 5242880;
+const EMAIL_STREAM_DEADLINE_MS = 15e3;
+const EMAIL_ACTION_TERMINAL_BYTES = 5;
+const actionEncoder = new TextEncoder();
+function emailActionWireSize(action) {
+	return 5 + actionEncoder.encode(JSON.stringify(action.type === "reply" ? {
+		type: action.type,
+		from: action.from,
+		to: action.to
+	} : action)).byteLength + (action.type === "reply" ? 5 + action.raw.byteLength : 0);
+}
 function readRawProjectSlug() {
 	let raw;
 	try {
@@ -108,7 +78,7 @@ var ParseEmailError = class extends Error {
 * one-shot.
 */
 async function parseEmail(message) {
-	if (message.rawSize > 10485760) throw new ParseEmailError("INBOUND_TOO_LARGE", `parseEmail: message size ${message.rawSize} bytes exceeds maximum of ${MAX_MESSAGE_BYTES} bytes.`);
+	if (message.rawSize > 10485760) throw new ParseEmailError("INBOUND_TOO_LARGE", `parseEmail: message size ${message.rawSize} bytes exceeds maximum of ${MAX_INBOUND_BYTES} bytes.`);
 	const { default: PostalMime } = await import("postal-mime");
 	const cached = proxyRawCache.get(message);
 	try {
@@ -138,10 +108,10 @@ function stripSlugFromAddress(address, slug) {
 	return address;
 }
 function replyTooLarge(size) {
-	return new MimeError("MIME_ERROR", `reply: message size ${size} bytes exceeds Cloudflare limit of ${MAX_MESSAGE_BYTES} bytes.`);
+	return new MimeError("MIME_ERROR", `reply: message size ${size} bytes exceeds Void's sending limit of ${MAX_REPLY_BYTES} bytes.`);
 }
 function replyBudgetExhausted(size) {
-	return new MimeError("MIME_ERROR", `reply: cumulative reply size ${size} bytes exceeds this delivery's budget of ${MAX_REPLY_BYTES_TOTAL} bytes.`);
+	return new MimeError("MIME_ERROR", `reply: serialized actions would use ${size} bytes, over this delivery's ${EMAIL_MAX_RESPONSE_BYTES}-byte response budget.`);
 }
 function queueFull() {
 	return new MimeError("MIME_ERROR", `email: handler queued more than ${MAX_ACTIONS} actions for one message.`);
@@ -204,15 +174,29 @@ async function readStreamToBytes(stream, limit = Infinity, onOverflow = replyToo
 	const reader = stream.getReader();
 	const chunks = [];
 	let total = 0;
-	for (;;) {
-		const { value, done } = await reader.read();
-		if (done) break;
-		total += value.byteLength;
-		if (total > limit) {
-			await reader.cancel().catch(() => {});
-			throw onOverflow(total);
+	const deadline = Date.now() + EMAIL_STREAM_DEADLINE_MS;
+	try {
+		for (;;) {
+			const remaining = deadline - Date.now();
+			if (remaining <= 0) throw new MimeError("MIME_ERROR", "email stream timed out");
+			let timer;
+			const { value, done } = await Promise.race([reader.read(), new Promise((_, reject) => {
+				timer = setTimeout(() => reject(new MimeError("MIME_ERROR", "email stream timed out")), remaining);
+			})]).finally(() => {
+				if (timer !== void 0) clearTimeout(timer);
+			});
+			if (done) break;
+			total += value.byteLength;
+			if (total > limit) throw onOverflow(total);
+			chunks.push(value);
 		}
-		chunks.push(value);
+	} catch (error) {
+		reader.cancel().catch(() => {});
+		throw error;
+	} finally {
+		try {
+			reader.releaseLock();
+		} catch {}
 	}
 	const out = new Uint8Array(total);
 	let offset = 0;
@@ -239,7 +223,7 @@ function bytesToReadableStream(bytes) {
 * accept a native `EmailMessage` from `cloudflare:email`: that class exposes
 * only `from` and `to` (workers-types declares nothing else, and the body
 * has no public accessor), so its bytes cannot be recorded here, and nothing
-* could carry them over RPC to the platform router. The reply MIME bytes are
+* could encode them for the gateway. The reply MIME bytes are
 * buffered before being recorded so the action is fully self-contained.
 *
 * When `opts.slug` is provided, `message.to` is rewritten to remove the
@@ -270,9 +254,20 @@ function createMessageProxy(envelope, opts = {}) {
 	}
 	if (envelope.raw instanceof Uint8Array) cachedRaw = envelope.raw;
 	let rejected = false;
-	let replyBytesUsed = 0;
-	function assertQueueHasRoom() {
+	let actionWireBytesUsed = EMAIL_ACTION_TERMINAL_BYTES;
+	let pendingReplies = 0;
+	let replyRecordingTail = Promise.resolve();
+	function recordAction(action) {
+		if (rejected) return false;
 		if (actions.length >= MAX_ACTIONS) throw queueFull();
+		const nextSize = actionWireBytesUsed + emailActionWireSize(action);
+		if (nextSize > EMAIL_MAX_RESPONSE_BYTES) throw replyBudgetExhausted(nextSize);
+		actions.push(action);
+		actionWireBytesUsed = nextSize;
+		return true;
+	}
+	function assertQueueHasRoom() {
+		if (actions.length + pendingReplies >= MAX_ACTIONS) throw queueFull();
 	}
 	const message = {
 		from: envelope.from,
@@ -300,10 +295,12 @@ function createMessageProxy(envelope, opts = {}) {
 				}
 			}
 			if (dropped > 0) console.warn(`[void/email] setReject() after ${dropped} forward/reply call(s) — those actions were dropped. CF rejects are terminal: anything queued before setReject() never runs. Move the reject earlier in the handler.`);
-			actions.push({
+			const action = {
 				type: "reject",
 				reason: normalizeRejectReason(reason)
-			});
+			};
+			actions.push(action);
+			actionWireBytesUsed = EMAIL_ACTION_TERMINAL_BYTES + emailActionWireSize(action);
 		},
 		async forward(to, fwdHeaders) {
 			if (rejected) {
@@ -324,11 +321,13 @@ function createMessageProxy(envelope, opts = {}) {
 				headersObj = { ...fwdHeaders };
 			}
 			if (headersObj) assertForwardHeadersWithinBounds(headersObj);
-			actions.push({
+			const action = {
 				type: "forward",
 				to,
 				...headersObj ? { headers: headersObj } : {}
-			});
+			};
+			if (new TextEncoder().encode(JSON.stringify(action)).byteLength > MAX_ACTION_METADATA_BYTES) throw new MimeError("MIME_ERROR", `forward: action metadata exceeds ${MAX_ACTION_METADATA_BYTES} bytes.`);
+			recordAction(action);
 		},
 		async reply(reply) {
 			if (rejected) {
@@ -340,25 +339,47 @@ function createMessageProxy(envelope, opts = {}) {
 			if (reply.to.length > MAX_ACTION_ADDRESS_LENGTH) throw addressTooLong("to", reply.to.length);
 			validateAddressParts("from", reply.from);
 			validateAddressParts("to", reply.to);
-			const remaining = MAX_REPLY_BYTES_TOTAL - replyBytesUsed;
-			let rawBytes;
-			if (reply.raw instanceof Uint8Array) {
-				if (reply.raw.byteLength > 10485760) throw replyTooLarge(reply.raw.byteLength);
-				if (reply.raw.byteLength > remaining) throw replyBudgetExhausted(replyBytesUsed + reply.raw.byteLength);
-				rawBytes = reply.raw;
-			} else {
-				const raw = reply.raw;
-				if (typeof raw !== "object" || raw === null || typeof raw.getReader !== "function") throw new MimeError("MIME_ERROR", "reply: expected { from, to, raw } with raw as a Uint8Array or ReadableStream. A native EmailMessage cannot be replayed from a Void handler — its body has no public accessor. Use replyEmail() from void/email, or pass the MIME bytes as raw.");
-				const limit = Math.min(MAX_MESSAGE_BYTES, remaining);
-				rawBytes = await readStreamToBytes(reply.raw, limit, (total) => limit === 10485760 ? replyTooLarge(total) : replyBudgetExhausted(replyBytesUsed + total));
-			}
-			replyBytesUsed += rawBytes.byteLength;
-			actions.push({
-				type: "reply",
-				from: reply.from,
-				to: reply.to,
-				raw: rawBytes
+			pendingReplies++;
+			const previousReply = replyRecordingTail;
+			let releaseReply;
+			replyRecordingTail = new Promise((resolve) => {
+				releaseReply = resolve;
 			});
+			await previousReply;
+			try {
+				if (rejected) {
+					console.warn("[void/email] reply() completed after setReject() — ignored. CF rejects are terminal: nothing else runs once setReject fires.");
+					return;
+				}
+				const replyFrameBytes = emailActionWireSize({
+					type: "reply",
+					from: reply.from,
+					to: reply.to,
+					raw: /* @__PURE__ */ new Uint8Array()
+				});
+				const remaining = EMAIL_MAX_RESPONSE_BYTES - actionWireBytesUsed - replyFrameBytes;
+				if (remaining < 0) throw replyBudgetExhausted(EMAIL_MAX_RESPONSE_BYTES - remaining);
+				let rawBytes;
+				if (reply.raw instanceof Uint8Array) {
+					if (reply.raw.byteLength > MAX_REPLY_BYTES) throw replyTooLarge(reply.raw.byteLength);
+					if (reply.raw.byteLength > remaining) throw replyBudgetExhausted(actionWireBytesUsed + replyFrameBytes + reply.raw.byteLength);
+					rawBytes = reply.raw;
+				} else {
+					const raw = reply.raw;
+					if (typeof raw !== "object" || raw === null || typeof raw.getReader !== "function") throw new MimeError("MIME_ERROR", "reply: expected { from, to, raw } with raw as a Uint8Array or ReadableStream. A native EmailMessage cannot be replayed from a Void handler — its body has no public accessor. Use replyEmail() from void/email, or pass the MIME bytes as raw.");
+					const limit = Math.min(MAX_REPLY_BYTES, remaining);
+					rawBytes = await readStreamToBytes(reply.raw, limit, (total) => limit === MAX_REPLY_BYTES ? replyTooLarge(total) : replyBudgetExhausted(actionWireBytesUsed + replyFrameBytes + total));
+				}
+				if (!recordAction({
+					type: "reply",
+					from: reply.from,
+					to: reply.to,
+					raw: rawBytes
+				})) console.warn("[void/email] reply() completed after setReject() — ignored. CF rejects are terminal: nothing else runs once setReject fires.");
+			} finally {
+				pendingReplies--;
+				releaseReply();
+			}
 		}
 	};
 	if (envelope.to !== userVisibleTo) Object.defineProperty(message, "__voidPlatformTo", {
@@ -641,8 +662,8 @@ async function buildReplyMessage(message, opts) {
 /**
 * Send a threading-aware reply to an inbound message. Builds the reply MIME
 * (correct `In-Reply-To` / `References` / `Subject: Re: …`) and records a
-* reply intent on the message proxy. The platform router enacts the reply
-* via the real `ForwardableEmailMessage.reply()` once the handler returns.
+* reply intent on the message proxy. Delivery follows handler completion and,
+* on the platform, authoritative admission.
 *
 * The threading headers are best-effort, since the inbound values they are
 * built from are remote-sender controlled: an id no header line can carry
@@ -658,16 +679,32 @@ async function replyEmail(message, opts) {
 	});
 }
 /**
-* Whether `value` is a real `ForwardableEmailMessage` — one Cloudflare
-* delivered to this worker's `email()` directly — rather than an
-* `EmailEnvelope` from the platform router. Functions do not survive RPC,
-* so their presence is the discriminator.
+* Recognize native email operations. This structural check is not an
+* authentication boundary; managed entrypoints require receipt authentication.
 */
 function isForwardableEmailMessage(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const m = value;
 	return typeof m.setReject === "function" && typeof m.forward === "function" && typeof m.reply === "function";
 }
+const INBOUND_PROVIDER_DEADLINE_MS = 3e4;
+const INBOUND_ACTION_BATCH_DEADLINE_MS = 6e4;
+function createInboundProviderDeadline() {
+	const deadline = Date.now() + INBOUND_ACTION_BATCH_DEADLINE_MS;
+	return { async run(submit) {
+		const remaining = Math.min(INBOUND_PROVIDER_DEADLINE_MS, deadline - Date.now());
+		if (remaining <= 0) throw new Error("email action batch deadline elapsed before provider submission");
+		const work = submit();
+		let timer;
+		try {
+			return await Promise.race([work, new Promise((_, reject) => {
+				timer = setTimeout(() => reject(/* @__PURE__ */ new Error("email action provider timed out; outcome unknown, do not retry automatically")), remaining);
+			})]);
+		} finally {
+			if (timer !== void 0) clearTimeout(timer);
+		}
+	} };
+}
 /**
 * Replay recorded `EmailAction`s on a real `ForwardableEmailMessage`, in
 * order. The proxy already made `setReject` terminal (earlier forward/reply
@@ -676,28 +713,21 @@ function isForwardableEmailMessage(value) {
 * duck-typed object — so `cloudflare:email` is loaded here, and only when
 * a reply was recorded.
 *
-* The `new Headers()` below is the one step this loop constructs from
-* handler input, and it cannot fail on a recorded action: the proxy's
-* `forward()` already ran the record through that constructor, so a bad
-* record failed inside the handler, before any replay. (`EmailMessage`
-* construction neither validates nor reads its stream — measured under
-* workerd.) A reject's reason reaches the native `setReject()` as the proxy
-* recorded it — already sliced and stripped the way the platform router
-* would (`normalizeRejectReason`), so the SMTP reply is the same in both
-* deployments. What Cloudflare itself refuses at `forward()` / `reply()`
-* still throws out of the loop, as any native call would.
+* The proxy already validated forward headers and normalized reject reasons.
+* Provider refusals still propagate to the native event caller.
 */
 async function enactEmailActions(message, actions) {
+	const providerDeadline = createInboundProviderDeadline();
 	for (const action of actions) switch (action.type) {
 		case "reject":
 			message.setReject(action.reason);
 			break;
 		case "forward":
-			await message.forward(action.to, action.headers ? new Headers(action.headers) : void 0);
+			await providerDeadline.run(() => message.forward(action.to, action.headers ? new Headers(action.headers) : void 0));
 			break;
 		case "reply": {
 			const { EmailMessage } = await import("cloudflare:email");
-			await message.reply(new EmailMessage(action.from, action.to, bytesToReadableStream(action.raw)));
+			await providerDeadline.run(() => message.reply(new EmailMessage(action.from, action.to, bytesToReadableStream(action.raw))));
 			break;
 		}
 	}