void 0.20.1 → 0.20.3

package/dist/{rollback-Bx85-0xh.mjs → rollback-Dr7u0Ljx.mjs}

@@ -1,6 +1,6 @@
-import { C as cancel, D as log, E as intro, F as isCancel, a as dim, c as import_picocolors, i as createSpinner, j as select, k as outro, o as ensureUtc, r as cliTitle, w as confirm } from "./output-tFQLLj26.mjs";
-import { b as readDeploymentPlatform, c as getToken, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient } from "./client-Clirrol3.mjs";
+import { A as outro, C as cancel, D as log, E as intro, I as isCancel, M as select, a as dim, c as import_picocolors, i as createSpinner, o as ensureUtc, r as cliTitle, w as confirm } from "./output-B0cfNSx5.mjs";
+import { S as readProjectConfig, l as getToken, x as readDeploymentPlatform } from "./auth-DPl6kck4.mjs";
+import { n as PlatformClient } from "./client-BQBrZoCX.mjs";
 //#region src/cli/rollback.ts
 async function runRollbackCommand(root, deployId) {
 	console.log();
@@ -81,7 +81,7 @@ async function runRollbackCommand(root, deployId) {
 	outro(dim("Traffic is now serving the rolled-back deployment."));
 }
 async function runCloudflareRollback(root, deployId) {
-	const { activateCloudflareExistingVersion, readCloudflareWorkerStatus, resolveCloudflareOperationContext } = await import("./cloudflare-operations-CPTpRW6d.mjs").then((n) => n.t);
+	const { activateCloudflareExistingVersion, readCloudflareWorkerStatus, resolveCloudflareOperationContext } = await import("./cloudflare-operations-BzWnlC1_.mjs").then((n) => n.t);
 	const context = resolveCloudflareOperationContext(root);
 	const status = await readCloudflareWorkerStatus(context);
 	const deployedVersionIds = new Set(status.deployedVersionIds);

package/dist/runtime/ai.mjs

@@ -1,4 +1,4 @@
-import { t as cfAccessHeaders } from "../cf-access-AJ1ehiFR.mjs";
+import { t as cfAccessHeaders } from "../cf-access-DRsQRe6k.mjs";
 import { a as getRawRuntimeEnv } from "../env-raw-Cx8ElDdj.mjs";
 //#region src/runtime/ai-types.ts
 /** Maps provider prefix to expected env var name for the API key */
@@ -392,7 +392,8 @@ function makeHttpBackend(token, projectId, runtimeEnv) {
 				action,
 				...body,
 				projectId
-			})
+			}),
+			redirect: "manual"
 		});
 		if (options.throwOnError !== false && !res.ok) {
 			const text = await res.text();

package/dist/runtime/email/testing.d.mts

@@ -1,5 +1,5 @@
 /// <reference types="@cloudflare/workers-types" />
-import { r as EmailHandler } from "../../inbound-afAcWeQ9.mjs";
+import { r as EmailHandler } from "../../inbound-CH5Mksyy.mjs";
 //#region src/runtime/email/dev-inbox.d.ts
 interface CapturedMessage {
   id: string;

package/dist/runtime/email/testing.mjs

@@ -1,7 +1,7 @@
-import { i as normalizeEmail, r as buildMime } from "../../mime-BJD7d_qL.mjs";
-import { y as registerEmailSink } from "../../dev-inbox-DkgRWLkW.mjs";
+import { i as normalizeEmail, r as buildMime } from "../../mime-D5Nmdzf7.mjs";
+import { y as registerEmailSink } from "../../dev-inbox-P0u4tM8Y.mjs";
 import { n as compileEmailPattern, t as compareEmailRoutes } from "../../email-Ce6SQq-i.mjs";
-import { i as createMessageProxy, n as MAX_INBOUND_HEADERS, t as MAX_INBOUND_BYTES } from "../../inbound-2d0zi2yS.mjs";
+import { i as createMessageProxy, n as MAX_INBOUND_HEADERS, t as MAX_INBOUND_BYTES } from "../../inbound-aVHEUhKo.mjs";
 //#region src/runtime/email/testing.ts
 /**
 * Test harnesses for void/email.

package/dist/runtime/email-protocol.d.mts

@@ -0,0 +1,15 @@
+import { EMAIL_PROTOCOL_VERSION, encodeEmailActions, readEmailEnvelope } from "@void/platform/email-protocol";
+//#region src/runtime/email-protocol.d.ts
+type ReceiptVerificationInput = {
+  receipt: string;
+  projectId: string;
+  deploymentId: string;
+  recipient: string;
+};
+type ReceiptVerifier = {
+  fetch(input: string | Request, init?: RequestInit): Promise<Response>;
+};
+/** Validate a gateway receipt without exposing the signing secret to the tenant worker. */
+export declare function verifyEmailReceiptThroughProxy(proxy: ReceiptVerifier, projectToken: string, input: ReceiptVerificationInput): Promise<boolean>;
+//#endregion
+export { EMAIL_PROTOCOL_VERSION, encodeEmailActions, readEmailEnvelope };

package/dist/runtime/email-protocol.mjs

@@ -0,0 +1,70 @@
+import { EMAIL_PROTOCOL_VERSION, encodeEmailActions, readEmailEnvelope } from "@void/platform/email-protocol";
+//#region src/runtime/email-protocol.ts
+const RECEIPT_VERIFICATION_DEADLINE_MS = 5e3;
+const MAX_RECEIPT_VERIFICATION_BYTES = 2048;
+const decoder = new TextDecoder("utf-8", {
+	fatal: true,
+	ignoreBOM: false
+});
+async function beforeDeadline(deadline, run) {
+	const remaining = deadline - Date.now();
+	if (remaining <= 0) throw new Error("email receipt verification timeout");
+	let timer;
+	return Promise.race([run(), new Promise((_, reject) => {
+		timer = setTimeout(() => reject(/* @__PURE__ */ new Error("email receipt verification timeout")), remaining);
+	})]).finally(() => {
+		if (timer !== void 0) clearTimeout(timer);
+	});
+}
+async function readResponseJson(response, deadline) {
+	const declaredLength = response.headers.get("content-length");
+	if (response.headers.has("content-encoding") || !response.body || declaredLength !== null && (!/^\d+$/.test(declaredLength) || Number(declaredLength) > MAX_RECEIPT_VERIFICATION_BYTES)) throw new Error("invalid email receipt verification response");
+	const expectedLength = declaredLength === null ? null : Number(declaredLength);
+	const reader = response.body.getReader();
+	const bytes = new Uint8Array(MAX_RECEIPT_VERIFICATION_BYTES);
+	let size = 0;
+	try {
+		for (;;) {
+			const chunk = await beforeDeadline(deadline, () => reader.read());
+			if (chunk.done) break;
+			const nextSize = size + chunk.value.byteLength;
+			if (nextSize > bytes.byteLength) throw new Error("email receipt verification response too large");
+			bytes.set(chunk.value, size);
+			size = nextSize;
+		}
+	} finally {
+		reader.cancel().catch(() => {});
+		try {
+			reader.releaseLock();
+		} catch {}
+	}
+	if (size === 0 || expectedLength !== null && size !== expectedLength) throw new Error("invalid email receipt verification response length");
+	return JSON.parse(decoder.decode(bytes.subarray(0, size)));
+}
+/** Validate a gateway receipt without exposing the signing secret to the tenant worker. */
+async function verifyEmailReceiptThroughProxy(proxy, projectToken, input) {
+	const deadline = Date.now() + RECEIPT_VERIFICATION_DEADLINE_MS;
+	const controller = new AbortController();
+	let response;
+	try {
+		response = await beforeDeadline(deadline, () => proxy.fetch("https://proxy/email/verify-receipt", {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				"x-void-internal": projectToken
+			},
+			body: JSON.stringify(input),
+			signal: controller.signal
+		}));
+		if (!response.ok) return false;
+		const body = await readResponseJson(response, deadline);
+		return !!body && typeof body === "object" && !Array.isArray(body) && body.valid === true;
+	} catch {
+		return false;
+	} finally {
+		controller.abort();
+		response?.body?.cancel().catch(() => {});
+	}
+}
+//#endregion
+export { EMAIL_PROTOCOL_VERSION, encodeEmailActions, readEmailEnvelope, verifyEmailReceiptThroughProxy };

package/dist/runtime/email.d.mts

@@ -1,5 +1,5 @@
 /// <reference types="@cloudflare/workers-types" />
-import { C as SendEmailRecipientResult, S as SendEmailOptions, _ as Attachment, a as MessageProxy, b as SendEmailError, c as ParsedEmail, d as defineEmail, f as enactEmailActions, g as Address, h as replyEmail, i as EmailHandlerInfo, l as ReplyEmailOptions, m as parseEmail, n as EmailEnvelope, o as ParseEmailError, p as isForwardableEmailMessage, r as EmailHandler, s as ParseEmailErrorCode, t as EmailAction, u as createMessageProxy, v as NormalizedEmail, w as SendEmailResult, x as SendEmailErrorCode, y as SendEmailDelivery } from "../inbound-afAcWeQ9.mjs";
+import { C as SendEmailOptions, S as SendEmailErrorCode, T as SendEmailResult, _ as Attachment, a as MessageProxy, b as SendEmailDelivery, c as ParsedEmail, d as defineEmail, f as enactEmailActions, g as Address, h as replyEmail, i as EmailHandlerInfo, l as ReplyEmailOptions, m as parseEmail, n as EmailEnvelope, o as ParseEmailError, p as isForwardableEmailMessage, r as EmailHandler, s as ParseEmailErrorCode, t as EmailAction, u as createMessageProxy, v as EmailDeliveryState, w as SendEmailRecipientResult, x as SendEmailError, y as NormalizedEmail } from "../inbound-CH5Mksyy.mjs";
 //#region src/runtime/email/mime.d.ts
 type MimeErrorCode = "INVALID_FROM" | "INVALID_TO" | "MIME_ERROR";
 export declare class MimeError extends Error {
@@ -27,4 +27,4 @@ export declare function createEmail(opts: SendEmailOptions): Promise<{
   messageId: string;
 }>;
 //#endregion
-export { type Address, type Attachment, type EmailAction, type EmailEnvelope, type EmailHandler, type EmailHandlerInfo, type MessageProxy, type MimeErrorCode, type NormalizedEmail, ParseEmailError, type ParseEmailErrorCode, type ParsedEmail, type ReplyEmailOptions, type SendEmailDelivery, type SendEmailError, type SendEmailErrorCode, type SendEmailOptions, type SendEmailRecipientResult, type SendEmailResult, createMessageProxy, defineEmail, enactEmailActions, isForwardableEmailMessage, parseEmail, replyEmail };
+export { type Address, type Attachment, type EmailAction, type EmailDeliveryState, type EmailEnvelope, type EmailHandler, type EmailHandlerInfo, type MessageProxy, type MimeErrorCode, type NormalizedEmail, ParseEmailError, type ParseEmailErrorCode, type ParsedEmail, type ReplyEmailOptions, type SendEmailDelivery, type SendEmailError, type SendEmailErrorCode, type SendEmailOptions, type SendEmailRecipientResult, type SendEmailResult, createMessageProxy, defineEmail, enactEmailActions, isForwardableEmailMessage, parseEmail, replyEmail };

package/dist/runtime/email.mjs

@@ -1,7 +1,7 @@
-import { i as normalizeEmail, n as MimeError, r as buildMime } from "../mime-BJD7d_qL.mjs";
-import { a as DEV_INBOX_ENV_VAR, b as serializeCapturedMessage, c as DEV_INBOX_TOKEN_ENV_VAR, d as captureMessage, h as hasActiveSink, i as DEV_INBOX_CAPTURE_URL, p as dispatchToSinks } from "../dev-inbox-DkgRWLkW.mjs";
+import { i as normalizeEmail, n as MimeError, r as buildMime } from "../mime-D5Nmdzf7.mjs";
+import { a as DEV_INBOX_ENV_VAR, b as serializeCapturedMessage, c as DEV_INBOX_TOKEN_ENV_VAR, d as captureMessage, h as hasActiveSink, i as DEV_INBOX_CAPTURE_URL, p as dispatchToSinks } from "../dev-inbox-P0u4tM8Y.mjs";
 import { a as getRawRuntimeEnv } from "../env-raw-Cx8ElDdj.mjs";
-import { a as defineEmail, c as parseEmail, i as createMessageProxy, l as replyEmail, o as enactEmailActions, r as ParseEmailError, s as isForwardableEmailMessage } from "../inbound-2d0zi2yS.mjs";
+import { a as defineEmail, c as parseEmail, i as createMessageProxy, l as replyEmail, o as enactEmailActions, r as ParseEmailError, s as isForwardableEmailMessage } from "../inbound-aVHEUhKo.mjs";
 //#region src/runtime/email.ts
 const VALID_SLUG = /^[a-z0-9](?:[a-z0-9-]{0,54}[a-z0-9])?$/;
 function makeError(code, message, cause) {
@@ -35,6 +35,33 @@ function readEmailFrom() {
 	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
 }
 const SEND_EMAIL_BINDING_NAME = "SEND_EMAIL";
+const EMAIL_PROVIDER_DEADLINE_MS = 3e4;
+const PLATFORM_SEND_DEADLINE_MS = 6e4;
+var EmailBindingTimeoutError = class extends Error {
+	constructor() {
+		super("email binding outcome unknown after timeout");
+		this.name = "EmailBindingTimeoutError";
+	}
+};
+function createBindingSendDeadline() {
+	const deadline = Date.now() + PLATFORM_SEND_DEADLINE_MS;
+	return {
+		expired: () => Date.now() >= deadline,
+		async run(submit) {
+			const remaining = Math.min(EMAIL_PROVIDER_DEADLINE_MS, deadline - Date.now());
+			if (remaining <= 0) throw new EmailBindingTimeoutError();
+			const work = submit();
+			let timer;
+			try {
+				return await Promise.race([work, new Promise((_, reject) => {
+					timer = setTimeout(() => reject(new EmailBindingTimeoutError()), remaining);
+				})]);
+			} finally {
+				if (timer !== void 0) clearTimeout(timer);
+			}
+		}
+	};
+}
 function resolveSendEmailBinding(env) {
 	const binding = env?.[SEND_EMAIL_BINDING_NAME];
 	if (typeof binding !== "object" || binding === null) return;
@@ -47,14 +74,10 @@ function resolveSendEmailBinding(env) {
 * Cloudflare's Workers API reference); the older Email Routing sender
 * throws message-only errors, so the destination-verification phrasing the
 * platform proxy already keys on is kept as a fallback. Anything else is
-* `UPSTREAM_ERROR` with the original error as `cause` — the framework has
-* no way to act on a delivery failure or a service outage beyond
-* reporting it.
+* `OUTCOME_UNKNOWN` with the original error as `cause`: once `send()` has
+* started, an undocumented rejection does not prove the provider declined
+* the message before accepting it.
 *
-* The platform proxy's `classifyUpstream` mirrors this table for its own
-* binding, except the two sender codes: there `from` is pinned to the
-* project sender, so a sender failure is the platform's to fix and stays
-* `UPSTREAM_ERROR`. Keep the recipient and limit rows in lockstep.
 */
 function classifyBindingError(e) {
 	const message = e instanceof Error ? e.message : String(e);
@@ -66,7 +89,7 @@ function classifyBindingError(e) {
 		case "E_DAILY_LIMIT_EXCEEDED": return makeError("QUOTA_EXCEEDED", message, e);
 	}
 	if (UNVERIFIED_DESTINATION_RE.test(message)) return makeError("UNVERIFIED_DESTINATION", message, e);
-	return makeError("UPSTREAM_ERROR", message, e);
+	return makeError("OUTCOME_UNKNOWN", message, e);
 }
 const UNVERIFIED_DESTINATION_RE = /^[^\n]{0,200}destination address[^\n]{0,200}not (?:yet )?verified/i;
 function bytesToReadableStream(bytes) {
@@ -77,10 +100,10 @@ function bytesToReadableStream(bytes) {
 }
 /**
 * Deliver through the worker's own `SEND_EMAIL` binding. One `EmailMessage`
-* per recipient, every recipient attempted, and the same `deliveries` shape
-* the proxy returns so a caller retries the failed ones the same way in both
-* modes. The stream is rebuilt per send because a `ReadableStream` is
-* one-shot.
+* per recipient, within one bounded batch, and the same `deliveries` shape
+* the proxy returns so a caller can inspect each attempted or cancelled
+* outcome in either mode. The stream is rebuilt per send because a
+* `ReadableStream` is one-shot.
 */
 async function sendViaBinding(binding, from, recipients, raw, fallbackId) {
 	let EmailMessage;
@@ -90,20 +113,35 @@ async function sendViaBinding(binding, from, recipients, raw, fallbackId) {
 		return err("UPSTREAM_ERROR", `email: SEND_EMAIL is bound but cloudflare:email could not be loaded: ${e instanceof Error ? e.message : String(e)}`, e);
 	}
 	const deliveries = [];
-	for (const recipient of recipients) try {
-		const result = await binding.send(new EmailMessage(from, recipient, bytesToReadableStream(raw)));
-		const mid = typeof result?.messageId === "string" ? result.messageId : "";
-		deliveries.push({
-			recipient,
-			ok: true,
-			messageId: mid || fallbackId
-		});
-	} catch (e) {
-		deliveries.push({
-			recipient,
-			ok: false,
-			error: classifyBindingError(e)
-		});
+	const deadline = createBindingSendDeadline();
+	for (let index = 0; index < recipients.length; index++) {
+		const recipient = recipients[index];
+		if (deadline.expired()) {
+			for (const unstarted of recipients.slice(index)) deliveries.push({
+				recipient: unstarted,
+				ok: false,
+				state: "cancelled",
+				error: makeError("UPSTREAM_ERROR", "email: batch deadline elapsed before provider submission")
+			});
+			break;
+		}
+		try {
+			const result = await deadline.run(() => binding.send(new EmailMessage(from, recipient, bytesToReadableStream(raw))));
+			const mid = typeof result?.messageId === "string" ? result.messageId : "";
+			deliveries.push({
+				recipient,
+				ok: true,
+				messageId: mid || fallbackId
+			});
+		} catch (e) {
+			const error = e instanceof EmailBindingTimeoutError ? makeError("OUTCOME_UNKNOWN", "email: binding submission timed out; inspect provider logs before retrying", e) : classifyBindingError(e);
+			deliveries.push({
+				recipient,
+				ok: false,
+				...error.code === "OUTCOME_UNKNOWN" ? { state: "outcome_unknown" } : {},
+				error
+			});
+		}
 	}
 	if (deliveries.some((d) => !d.ok)) return {
 		ok: false,
@@ -191,6 +229,8 @@ function coerceErrorCode(code) {
 		"UNVERIFIED_DESTINATION",
 		"MIME_ERROR",
 		"QUOTA_EXCEEDED",
+		"IDEMPOTENCY_CONFLICT",
+		"OUTCOME_UNKNOWN",
 		"UPSTREAM_ERROR"
 	].includes(code) ? code : "UPSTREAM_ERROR";
 }
@@ -216,29 +256,10 @@ function isValidProxyResponse(b) {
 	return false;
 }
 /**
-* Validate a per-recipient list from the proxy against the recipients this
-* send asked for. Both list-bearing responses go through here — `ids` on
-* `ok: true` and `deliveries` on a mid-batch `ok: false` — so the two cannot
-* drift: the proxy builds both from the same per-recipient list, one entry
-* per requested address, and a caller following the documented retry
-* pattern (retry only `ok: false` entries) can act on an outcome only if
-* every recipient has one.
-*
-* The rules shared by both shapes: the count equals the recipients sent;
-* every entry is an object naming a requested recipient exactly once. The
-* list is compared as a set against the unique, lowercased recipients the
-* request carried and returned in the order the proxy gave it — order is
-* not part of the contract (the proxy lists allowlist rejections before the
-* sends it attempted). `readEntry` decides the rest of the entry's shape and
-* returns `undefined` when it does not hold; `shape` names that shape in the
-* reason.
-*
-* Anything else is a schema-skewed or corrupt proxy and is refused as a
-* whole rather than trimmed to the entries that parse: a dropped entry is a
-* recipient whose outcome the caller can neither trust nor retry. Entries
-* are named by index only — the body is attached as `cause`, and a recipient
-* string from a corrupt response is not a value to interpolate into an
-* error message.
+* Require exactly one valid outcome per requested recipient in either list
+* shape. A missing, duplicate, or foreign entry makes the whole result unknown;
+* trimming it could hide a submission. Order is not part of the contract.
+* Diagnostics identify entries by index rather than echoing corrupt addresses.
 */
 function readRecipientList(raw, recipients, shape, readEntry) {
 	if (raw.length !== recipients.length) return {
@@ -277,81 +298,149 @@ function readRecipientList(raw, recipients, shape, readEntry) {
 	};
 }
 /**
-* The `ids` list of an `ok: true` response. The proxy answers `ok: true`
-* only once every requested recipient passed its allowlist and
-* `SEND_EMAIL.send()` confirmed each one, so every entry is
-* `{ recipient, messageId }` with `messageId` always a string (`''` when
-* Cloudflare returned none; that is the proxy's explicit convention, and the
-* framework's own Message-ID stands in for it). An `ok: true` with a
-* delivery missing would tell the caller a send was confirmed when it never
-* was, and a success carries no per-recipient failure to retry from.
+* The `ids` list of an `ok: true` response. The proxy answers `ok: true` only
+* after every requested recipient has an accepted provider outcome. Each entry
+* is `{ recipient, messageId }`; the framework's own Message-ID stands in for
+* an empty provider reference. A missing delivery would leave no safe retry
+* decision, so the whole response is rejected as malformed.
 */
 function readDeliveryList(raw, recipients, fallbackId) {
 	return readRecipientList(raw, recipients, "{ recipient: string, messageId: string }", (entry, recipient) => typeof entry.messageId === "string" ? {
 		recipient,
-		messageId: entry.messageId || fallbackId
+		messageId: entry.messageId || fallbackId,
+		...entry.state === "provider_accepted" ? { state: "provider_accepted" } : {}
 	} : void 0);
 }
 /**
-* The `deliveries` list of a mid-batch `ok: false` response. Each entry is
-* either a confirmed send (`ok: true`, `messageId` a string with the same
-* `''` convention as above) or a failure (`ok: false`, `error` with a string
-* `message`; the code is coerced, unknown values become `UPSTREAM_ERROR`).
-* Both are the proxy's own outcome for that recipient; `ok` is what the
-* caller retries on, so an entry that does not state it is not an outcome
-* at all — treating it as failed would retry a recipient that may have been
-* delivered, and treating it as delivered would silently lose one.
+* Preserve each recipient's acceptance or error and recorded state. `ok: false`
+* alone does not establish that retrying is safe: submission may be unresolved.
 */
 function readFailureDeliveries(raw, recipients, fallbackId) {
 	return readRecipientList(raw, recipients, "{ recipient: string, ok: true, messageId: string } | { recipient: string, ok: false, error: { message: string } }", (entry, recipient) => {
 		if (entry.ok === true) return typeof entry.messageId === "string" ? {
 			recipient,
 			ok: true,
-			messageId: entry.messageId || fallbackId
+			messageId: entry.messageId || fallbackId,
+			...entry.state === "provider_accepted" ? { state: "provider_accepted" } : {}
 		} : void 0;
 		if (entry.ok === false) {
 			const error = entry.error;
 			return typeof error === "object" && error !== null && typeof error.message === "string" ? {
 				recipient,
 				ok: false,
-				error: makeError(coerceErrorCode(error.code), error.message)
+				error: makeError(coerceErrorCode(error.code), error.message),
+				...readDeliveryState(entry.state) ? { state: readDeliveryState(entry.state) } : {}
 			} : void 0;
 		}
 	});
 }
-async function readResponseAsResult(res, recipients, fallbackId) {
+function readDeliveryState(value) {
+	return [
+		"rejected",
+		"reserved",
+		"attempt_started",
+		"provider_accepted",
+		"failed",
+		"outcome_unknown",
+		"cancelled"
+	].find((state) => state === value);
+}
+const MAX_PROXY_RESPONSE_BYTES = 65536;
+function createPlatformSendDeadline() {
+	const controller = new AbortController();
+	const deadline = Date.now() + PLATFORM_SEND_DEADLINE_MS;
+	return {
+		signal: controller.signal,
+		async beforeDeadline(run) {
+			const remaining = deadline - Date.now();
+			if (remaining <= 0) {
+				controller.abort();
+				throw new Error("email platform send timed out");
+			}
+			const promise = run();
+			let timer;
+			try {
+				return await Promise.race([promise, new Promise((_, reject) => {
+					timer = setTimeout(() => {
+						controller.abort();
+						reject(/* @__PURE__ */ new Error("email platform send timed out"));
+					}, remaining);
+				})]);
+			} finally {
+				if (timer !== void 0) clearTimeout(timer);
+			}
+		}
+	};
+}
+async function readBoundedProxyJson(response, beforeDeadline) {
+	const declared = response.headers.get("content-length");
+	if (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > MAX_PROXY_RESPONSE_BYTES)) {
+		response.body?.cancel().catch(() => {});
+		throw new Error("email proxy response too large");
+	}
+	const reader = response.body?.getReader();
+	if (!reader) throw new Error("email proxy response is empty");
+	const bytes = new Uint8Array(MAX_PROXY_RESPONSE_BYTES);
+	let size = 0;
+	try {
+		for (;;) {
+			const chunk = await beforeDeadline(() => reader.read());
+			if (chunk.done) break;
+			if (size + chunk.value.byteLength > bytes.byteLength) throw new Error("email proxy response too large");
+			bytes.set(chunk.value, size);
+			size += chunk.value.byteLength;
+		}
+		if (declared !== null && size !== Number(declared)) throw new Error("email proxy response length mismatch");
+		return JSON.parse(new TextDecoder("utf-8", {
+			fatal: true,
+			ignoreBOM: false
+		}).decode(bytes.subarray(0, size)));
+	} finally {
+		reader.cancel().catch(() => {});
+		try {
+			reader.releaseLock();
+		} catch {}
+	}
+}
+async function readResponseAsResult(res, recipients, fallbackId, beforeDeadline) {
 	try {
 		let body;
 		try {
-			body = await res.json();
+			body = await readBoundedProxyJson(res, beforeDeadline);
 		} catch {
-			return err("UPSTREAM_ERROR", `email: proxy returned ${res.status} with non-JSON body`);
+			return err("OUTCOME_UNKNOWN", `email: could not establish the send outcome (status ${res.status}); check email logs or repeat the same idempotency key`);
 		}
 		if (!isValidProxyResponse(body)) {
 			const refusal = readProxyRefusal(body);
 			if (!res.ok && refusal !== null) return err("UPSTREAM_ERROR", `email: proxy returned ${res.status}: ${refusal}`, body);
-			return err("UPSTREAM_ERROR", `email: proxy returned malformed response (status ${res.status})`, body);
+			return err("OUTCOME_UNKNOWN", `email: proxy returned malformed response (status ${res.status})`, body);
 		}
-		const malformedList = (reason) => err("UPSTREAM_ERROR", `email: proxy returned a malformed delivery list (${reason})`, body);
+		const malformedList = (reason) => err("OUTCOME_UNKNOWN", `email: proxy returned a malformed delivery list (${reason}); do not retry with a new idempotency key`, body);
+		const operation = typeof body.operationId === "string" && body.operationId.length <= 128 ? { operationId: body.operationId } : {};
 		if (body.ok === true) {
 			const list = readDeliveryList(body.ids, recipients, fallbackId);
 			return list.ok ? {
 				ok: true,
-				ids: list.entries
+				ids: list.entries,
+				...operation
 			} : malformedList(list.reason);
 		}
 		const failure = body;
-		if ("error" in failure && failure.error) {
-			const e = failure.error;
-			return err(coerceErrorCode(e.code), typeof e.message === "string" ? e.message : "email: upstream send failed");
+		if (Array.isArray(failure.deliveries)) {
+			const list = readFailureDeliveries(failure.deliveries, recipients, fallbackId);
+			return list.ok ? {
+				ok: false,
+				deliveries: list.entries,
+				...operation
+			} : malformedList(list.reason);
 		}
-		const list = readFailureDeliveries(failure.deliveries, recipients, fallbackId);
-		return list.ok ? {
-			ok: false,
-			deliveries: list.entries
-		} : malformedList(list.reason);
+		const e = failure.error;
+		return {
+			...err(coerceErrorCode(e.code), typeof e.message === "string" ? e.message : "email: upstream send failed"),
+			...operation
+		};
 	} catch (e) {
-		return err("UPSTREAM_ERROR", `email: failed to parse proxy response (status ${res.status}): ${e instanceof Error ? e.message : String(e)}`, e);
+		return err("OUTCOME_UNKNOWN", `email: failed to parse proxy response (status ${res.status}): ${e instanceof Error ? e.message : String(e)}`, e);
 	}
 }
 /**
@@ -488,6 +577,7 @@ function capturedResult(normalized, captureId) {
 * override for a single call.
 */
 async function sendEmail(opts) {
+	if (opts.idempotencyKey !== void 0 && (typeof opts.idempotencyKey !== "string" || !/^[\x21-\x7e]{1,128}$/.test(opts.idempotencyKey))) return err("MIME_ERROR", "email: idempotencyKey must contain 1–128 printable non-space ASCII characters.");
 	const resolvedOpts = resolveDefaultFrom(opts);
 	if (resolvedOpts.from === void 0) return err("INVALID_FROM", "email: 'from' is required. Set it explicitly or deploy via Void so the platform-injected __VOID_PROJECT_SLUG and __VOID_EMAIL_DOMAIN can default it to <slug>+noreply@<domain>.");
 	const optsWithFrom = resolvedOpts;
@@ -526,36 +616,39 @@ async function sendEmail(opts) {
 	const recipients = uniqueRecipients(normalized);
 	if (recipients.length === 0) return err("INVALID_TO", "email: 'to' must include at least one recipient.");
 	const sendBinding = resolveSendEmailBinding(rawEnv);
-	if (sendBinding) return sendViaBinding(sendBinding, normalized.from.email, recipients, raw, messageId);
+	if (sendBinding) {
+		if (opts.idempotencyKey !== void 0) return err("MIME_ERROR", "email: idempotencyKey requires a Void platform; the native Cloudflare binding cannot deduplicate sends.");
+		return sendViaBinding(sendBinding, normalized.from.email, recipients, raw, messageId);
+	}
 	const env = rawEnv;
 	const proxy = env?.__VOID_PROXY;
 	const projectId = env?.__PROJECT_ID;
 	const proxyToken = env?.__VOID_PROXY_TOKEN;
 	if (!proxy || !projectId || !proxyToken) return err("BINDING_MISSING", "email: neither SEND_EMAIL nor __VOID_PROXY is available, so nothing was sent. Deploy via Void to bind the platform proxy, or set `email.from` in void.json so `void deploy --platform cloudflare` provisions the SEND_EMAIL binding. Under `void dev` messages are captured by the local inbox at /__void/inbox instead — reaching this error there means that path was bypassed (`sendInDev: true`, which does not deliver: `void dev` binds no send transport at all, so there is nothing to fall through to) or unavailable (the worker has no assets binding to reach the dev server through).");
 	const requestId = newRequestId();
-	const fromDomain = normalized.from.email.split("@")[1] ?? "";
 	const body = {
 		projectId,
 		aiToken: proxyToken,
-		proxyToken,
 		from: normalized.from.email,
 		recipients,
 		mimeBase64: bytesToBase64(raw),
-		byteSize: raw.byteLength,
 		requestId,
-		fromDomain
+		...opts.idempotencyKey === void 0 ? {} : { idempotencyKey: opts.idempotencyKey }
 	};
+	const requestBody = JSON.stringify(body);
+	const deadline = createPlatformSendDeadline();
 	let res;
 	try {
-		res = await proxy.fetch("https://email-proxy/email/send", {
+		res = await deadline.beforeDeadline(() => proxy.fetch("https://email-proxy/email/send", {
 			method: "POST",
 			headers: { "content-type": "application/json" },
-			body: JSON.stringify(body)
-		});
+			body: requestBody,
+			signal: deadline.signal
+		}));
 	} catch (e) {
-		return err("UPSTREAM_ERROR", `email: proxy unreachable: ${e instanceof Error ? e.message : String(e)}`, e);
+		return err("OUTCOME_UNKNOWN", `email: send outcome is unknown: ${e instanceof Error ? e.message : String(e)}. Check email logs or repeat the same idempotency key; do not create a new send.`, e);
 	}
-	return readResponseAsResult(res, recipients, messageId);
+	return readResponseAsResult(res, recipients, messageId, deadline.beforeDeadline);
 }
 /**
 * Build a normalized email + raw MIME for advanced callers who want to feed