void 0.27.0 → 0.28.0

package/dist/{inbound-PfQDLXc5.mjs → inbound-DmkTQeWp.mjs}

@@ -1,10 +1,10 @@
-import { i as normalizeEmail, n as MimeError, o as validateAddressParts, r as buildMime } from "./mime-DxCznlJq.mjs";
-import { a as getRawRuntimeEnv } from "./env-raw-jZpP5n47.mjs";
+import { t as base64ToBytes } from "./base64-DVrOndmI.mjs";
+import { c as validateAddressParts, i as indexOfControl, n as MimeError, o as normalizeEmail, r as buildMime } from "./mime-srOklVVv.mjs";
+import { a as getRawRuntimeEnv } from "./env-raw-Cklzcde3.mjs";
+import { o as withTimeout } from "./email-protocol-D9nTvhCp.mjs";
 import { EMAIL_MAX_ACTIONS, EMAIL_MAX_INBOUND_BYTES, EMAIL_MAX_INBOUND_HEADERS, EMAIL_MAX_METADATA_BYTES, EMAIL_MAX_REPLY_BYTES, EMAIL_MAX_RESPONSE_BYTES } from "@void/platform/email-protocol";
 //#region src/runtime/email/inbound.ts
-const VALID_SLUG = /^[a-z0-9](?:[a-z0-9-]{0,54}[a-z0-9])?$/;
 const MAX_ACTIONS = EMAIL_MAX_ACTIONS;
-const MAX_ACTION_ADDRESS_LENGTH = 320;
 const MAX_ACTION_METADATA_BYTES = EMAIL_MAX_METADATA_BYTES;
 /** Bounds on a forward's headers. */
 const MAX_FORWARD_HEADERS = 32;
@@ -17,6 +17,8 @@ const MAX_INBOUND_HEADERS = EMAIL_MAX_INBOUND_HEADERS;
 const MAX_REPLY_BYTES = EMAIL_MAX_REPLY_BYTES;
 const EMAIL_STREAM_DEADLINE_MS = 15e3;
 const EMAIL_ACTION_TERMINAL_BYTES = 5;
+const INBOUND_PROVIDER_DEADLINE_MS = 3e4;
+const INBOUND_ACTION_BATCH_DEADLINE_MS = 6e4;
 const actionEncoder = new TextEncoder();
 function emailActionWireSize(action) {
 	return 5 + actionEncoder.encode(JSON.stringify(action.type === "reply" ? {
@@ -25,28 +27,25 @@ function emailActionWireSize(action) {
 		to: action.to
 	} : action)).byteLength + (action.type === "reply" ? 5 + action.raw.byteLength : 0);
 }
-function readRawProjectSlug() {
-	let raw;
+/** The raw env, or `undefined` outside a worker or SSR request. */
+function tryGetRawRuntimeEnv() {
 	try {
-		raw = getRawRuntimeEnv()?.__VOID_PROJECT_SLUG;
+		return getRawRuntimeEnv();
 	} catch {
 		return;
 	}
+}
+/** A non-empty string env var. */
+function readEnvString(name) {
+	const raw = tryGetRawRuntimeEnv()?.[name];
 	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
 }
-function tryReadProjectSlug() {
-	const raw = readRawProjectSlug();
+const VALID_SLUG = /^[a-z0-9](?:[a-z0-9-]{0,54}[a-z0-9])?$/;
+/** `__VOID_PROJECT_SLUG` when it can head a sender address. */
+function readProjectSlug() {
+	const raw = readEnvString("__VOID_PROJECT_SLUG");
 	return raw !== void 0 && VALID_SLUG.test(raw) ? raw : void 0;
 }
-function tryReadEmailDomain() {
-	let raw;
-	try {
-		raw = getRawRuntimeEnv()?.__VOID_EMAIL_DOMAIN;
-	} catch {
-		return;
-	}
-	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
-}
 function readRelayDomain(message) {
 	const raw = message.__voidRelayDomain;
 	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
@@ -71,13 +70,9 @@ var ParseEmailError = class extends Error {
 	}
 };
 /**
-* Parse a `ForwardableEmailMessage` into structured fields. postal-mime is
-* loaded lazily so workers that never call this don't bundle it.
-*
-* For proxy messages (built via `createMessageProxy`) the raw bytes are
-* cached on first read so subsequent `parseEmail`/`message.raw` accesses
-* still work. For real CF `ForwardableEmailMessage`s the raw stream is
-* one-shot.
+* Parse a `ForwardableEmailMessage` into structured fields with postal-mime,
+* loaded on first use. A native Cloudflare message's `raw` stream is
+* one-shot, so parse it once.
 */
 async function parseEmail(message) {
 	if (message.rawSize > MAX_INBOUND_BYTES) throw new ParseEmailError("INBOUND_TOO_LARGE", `parseEmail: message size ${message.rawSize} bytes exceeds maximum of ${MAX_INBOUND_BYTES} bytes.`);
@@ -91,14 +86,7 @@ async function parseEmail(message) {
 	}
 }
 const proxyRawCache = /* @__PURE__ */ new WeakMap();
-/**
-* Remove the platform-injected `<slug>+` prefix from a recipient address.
-* The platform's shared sender (e.g. `mail.example.com`) rewrites every recipient to
-* `<slug>+<tag>@<domain>`; user handlers expect `<tag>@<domain>`. If the
-* slug is unknown, missing, or doesn't match the local-part prefix, the
-* address is returned unchanged so callers without slug context (e.g. the
-* test harness when no slug is set) don't accidentally mangle the address.
-*/
+/** Remove a leading `<slug>+` (case-insensitive) from the local part. */
 function stripSlugFromAddress(address, slug) {
 	if (!slug) return address;
 	const atIdx = address.indexOf("@");
@@ -119,21 +107,16 @@ function queueFull() {
 	return new MimeError("MIME_ERROR", `email: handler queued more than ${MAX_ACTIONS} actions for one message.`);
 }
 function addressTooLong(field, length) {
-	return new MimeError(field === "from" ? "INVALID_FROM" : "INVALID_TO", `${field} address is ${length} characters, over the ${MAX_ACTION_ADDRESS_LENGTH}-character limit.`);
+	return new MimeError(field === "from" ? "INVALID_FROM" : "INVALID_TO", `${field} address is ${length} characters, over the 320-character limit.`);
 }
 function invalidForwardHeaders(cause) {
 	const detail = cause instanceof Error ? cause.message.slice(0, 320) : "not a valid header set";
 	return new MimeError("MIME_ERROR", `forward: invalid header — ${detail}`);
 }
 /**
-* The router's `forwardHeadersWithinBounds`, as a throw. It runs on the
-* record about to be recorded — the very object the router receives, so the
-* count is the router's count: a `Headers` folded its duplicate names before
-* it got here, and a record keeps `X-A` and `x-a` as two, both there and
-* here. Runs after the `new Headers()` validity check, so every name is a
-* token and every value is header-safe; what is left is size. The router
-* drops the WHOLE list on any of these — a handler that passed here and
-* failed there deployed as one whose managed delivery performed no actions.
+* The router's `forwardHeadersWithinBounds`, as a throw: the router drops the
+* whole action list on a violation, so refuse it at the handler's own call.
+* Counts the record as stored (a `Headers` has already folded duplicates).
 */
 function assertForwardHeadersWithinBounds(headers) {
 	const names = Object.keys(headers);
@@ -146,25 +129,9 @@ function assertForwardHeadersWithinBounds(headers) {
 	}
 }
 /**
-* The router's rule for a reject reason (`validateActions` in
-* `email-router.ts`: `sanitize(raw, MAX_REJECT_REASON_LENGTH)`, and
-* `'rejected by handler'` for an empty one), applied when the reason is
-* RECORDED so the native replay carries the string the managed one does.
-*
-* The reason goes into the SMTP reply to the connecting client, and a
-* handler may build it from the inbound message: a remote sender's CRLF is
-* then a line injected into that reply, and a multi-megabyte reason is a
-* transient-heap amplifier. The router already refuses both; normalizing at
-* record time covers the native `setReject()` replay on your own account
-* too. NORMALIZED rather than refused, unlike the forward bounds
-* above: a reject is the handler's terminal decision, and throwing out of
-* it would drop that decision and bounce the message as a dispatch error
-* (see the `MAX_ACTIONS` note in `setReject`). Slice FIRST, then replace: a
-* global replace materializes ~66 bytes per match, so the slice is what
-* bounds the work (see `prefixReplySubject`). The result can be SHORTER
-* than the cap: a run of controls inside the window collapses to one space
-* and the window is not refilled from beyond it — the router's own trade,
-* and it is DSN text.
+* The router's reject-reason rule, applied at record time so native replay
+* sends the same string. Normalized rather than refused, since a throw would
+* drop the reject; slice before replace to bound the work.
 */
 function normalizeRejectReason(reason) {
 	const raw = typeof reason === "string" ? reason : "";
@@ -178,14 +145,7 @@ async function readStreamToBytes(stream, limit = Infinity, onOverflow = replyToo
 	const deadline = Date.now() + EMAIL_STREAM_DEADLINE_MS;
 	try {
 		for (;;) {
-			const remaining = deadline - Date.now();
-			if (remaining <= 0) throw new MimeError("MIME_ERROR", "email stream timed out");
-			let timer;
-			const { value, done } = await Promise.race([reader.read(), new Promise((_, reject) => {
-				timer = setTimeout(() => reject(new MimeError("MIME_ERROR", "email stream timed out")), remaining);
-			})]).finally(() => {
-				if (timer !== void 0) clearTimeout(timer);
-			});
+			const { value, done } = await withTimeout(deadline - Date.now(), () => reader.read(), () => new MimeError("MIME_ERROR", "email stream timed out"));
 			if (done) break;
 			total += value.byteLength;
 			if (total > limit) throw onOverflow(total);
@@ -214,23 +174,10 @@ function bytesToReadableStream(bytes) {
 	} });
 }
 /**
-* Build a proxy `ForwardableEmailMessage` from an envelope. The proxy's
-* `setReject` / `forward` / `reply` methods don't dispatch directly — they
-* record `EmailAction` entries that the router (which holds the real
-* message) enacts after the handler returns.
-*
-* `reply()` accepts a duck-typed `{ from, to, raw }` with `raw` a
-* `Uint8Array` or `ReadableStream` — what `replyEmail()` passes. It does NOT
-* accept a native `EmailMessage` from `cloudflare:email`: that class exposes
-* only `from` and `to` (workers-types declares nothing else, and the body
-* has no public accessor), so its bytes cannot be recorded here, and nothing
-* could encode them for the gateway. The reply MIME bytes are
-* buffered before being recorded so the action is fully self-contained.
-*
-* When `opts.slug` is provided, `message.to` is rewritten to remove the
-* platform-injected `<slug>+` prefix so handlers see `<tag>@<domain>`
-* instead of `<slug>+<tag>@<domain>`. The original wire-form recipient is
-* preserved on a non-enumerable `__voidPlatformTo` property.
+* Build the message a handler sees from an envelope. `setReject`, `forward`
+* and `reply` record `EmailAction`s instead of dispatching; the caller enacts
+* them after the handler returns. `reply()` takes `{ from, to, raw }`, which
+* `replyEmail()` passes: a native `EmailMessage` has no readable body.
 */
 function createMessageProxy(envelope, opts = {}) {
 	const actions = [];
@@ -309,7 +256,7 @@ function createMessageProxy(envelope, opts = {}) {
 				return;
 			}
 			assertQueueHasRoom();
-			if (to.length > MAX_ACTION_ADDRESS_LENGTH) throw addressTooLong("to", to.length);
+			if (to.length > 320) throw addressTooLong("to", to.length);
 			validateAddressParts("to", to);
 			let headersObj;
 			if (fwdHeaders instanceof Headers) headersObj = Object.fromEntries(fwdHeaders.entries());
@@ -336,8 +283,8 @@ function createMessageProxy(envelope, opts = {}) {
 				return;
 			}
 			assertQueueHasRoom();
-			if (reply.from.length > MAX_ACTION_ADDRESS_LENGTH) throw addressTooLong("from", reply.from.length);
-			if (reply.to.length > MAX_ACTION_ADDRESS_LENGTH) throw addressTooLong("to", reply.to.length);
+			if (reply.from.length > 320) throw addressTooLong("from", reply.from.length);
+			if (reply.to.length > 320) throw addressTooLong("to", reply.to.length);
 			validateAddressParts("from", reply.from);
 			validateAddressParts("to", reply.to);
 			pendingReplies++;
@@ -402,11 +349,8 @@ function createMessageProxy(envelope, opts = {}) {
 	};
 }
 /**
-* Whether `Name: value` can be emitted without breaking RFC 5322 §2.1.1.
-*
-* Folding only happens at whitespace (§3.2.2), so the widest unbreakable run
-* is what decides it — a `References` chain of ordinary ids folds fine however
-* long, while one oversized id inside it does not.
+* Whether `Name: value` fits RFC 5322's 998-octet line. Folding happens only
+* at SP or HTAB, so the widest unbroken run decides.
 */
 function fitsHeaderLine(name, value) {
 	if (!value) return false;
@@ -429,36 +373,11 @@ function fitsHeaderLine(name, value) {
 	return true;
 }
 /**
-* Whether `value` carries a C0 control other than HTAB, or DEL. The
-* sibling of `fitsHeaderLine` for the other way a remote-controlled id can
-* be unrepresentable: a threading value is emitted verbatim, so a control
-* inside it would reach the reply's `In-Reply-To` / `References` line raw —
-* `\x01` and DEL pass a WHATWG `Headers`, which refuses only CR, LF and
-* NUL — and an RFC 5322 §3.6.4 `msg-id` is `dot-atom-text`, which admits no
-* control at all. HTAB is not one here: it is the whitespace that separates
-* ids (§3.2.2 FWS), the same break `fitsHeaderLine` and `replyReferences`
-* cut at. One pass, no allocation, so it costs nothing a hostile header can
-* multiply; never a throw, for the same reason as the line guard.
-*/
-function hasControl(value) {
-	for (let i = 0; i < value.length; i++) {
-		const c = value.charCodeAt(i);
-		if (c < 32 && c !== 9 || c === 127) return true;
-	}
-	return false;
-}
-/**
-* `chain` without any id that `hasControl` refuses, the rest in their order
-* and joined by single spaces; the chain itself when there is nothing to
-* drop, without allocating. Only ONE id is lost — the others still thread —
-* whereas an id no line can carry drops the whole chain for the parent's id
-* (`replyReferences`), because that guard is about the rendered line and
-* this one is about one token. Called only on a chain already cut to
-* `MAX_REPLY_REFERENCES_CHARS`, so the per-id slices in the rare bad case
-* are bounded by that budget, not by the header a remote sender delivered.
+* `chain` without the ids that hold a control character, joined by single
+* spaces. Called only on a chain already cut to `MAX_REPLY_REFERENCES_CHARS`.
 */
 function dropControlIds(chain) {
-	if (!hasControl(chain)) return chain;
+	if (indexOfControl(chain) === -1) return chain;
 	const kept = [];
 	let start = -1;
 	let tainted = false;
@@ -476,21 +395,9 @@ function dropControlIds(chain) {
 	return kept.join(" ");
 }
 /**
-* Longest decoded inbound `Subject` the default reply subject is built from;
-* anything longer falls back to a bare `Re:`.
-*
-* RFC 5322 §2.1.1 caps a header LINE at 998 octets, and only folding lets a
-* header run past it — so a subject is something that fits on a line or
-* two. Real ones are tens to hundreds of characters; the longest automated
-* ones (a ticket title under a stack of list tags) reach a few hundred, and
-* Exchange rejects past 255. Four thousand keeps every one of those with an
-* order of magnitude to spare and refuses the shape that is only a subject
-* in name. What the bound buys is proportional cost: the control-character
-* replacements below cost 66 bytes of heap per match, so at this size they
-* cost at most 135 KB, and the reply's own `Subject` line is at most ~20 KB
-* — 4096 code units x 3 UTF-8 octets, base64'd in 45-octet encoded-words
-* with their framing — against a `MAX_MESSAGE_BYTES` of 5 MiB, so the
-* subject alone can never push the reply over the limit.
+* Longest decoded inbound subject the default reply subject is built from;
+* longer falls back to a bare `Re:`. Real subjects are far shorter, and the
+* bound keeps the control-character replacement cheap.
 */
 const MAX_REPLY_SUBJECT_CHARS = 4096;
 function prefixReplySubject(original) {
@@ -503,36 +410,15 @@ function prefixReplySubject(original) {
 	return prefixed;
 }
 /**
-* Longest `References` value a reply carries, in UTF-16 code units — the
-* measure `MAX_REPLY_SUBJECT_CHARS` uses. It is checked on `length` alone,
-* so a chain the size of the inbound message costs one property read before
-* anything is scanned or sliced.
-*
-* RFC 5322 puts no limit on the field, but everything downstream does. RFC
-* 5537 §3.4.4 has a followup agent trim it to 998 characters, and Postfix's
-* `header_size_limit` discards header bytes past 100 KiB. A message-id is
-* tens of characters, so 8 KiB carries a chain over a hundred replies deep
-* with every id intact — an order of magnitude past any conversation — and
-* a value this size, folded and encoded, is at most ~25 KB of a 5 MiB
-* reply, so the chain alone can never push the reply over the limit.
-* Unbounded, it could: the inbound header can be the whole 10 MiB message,
-* and short ids pass the line guard — every id folds — yet `foldHeader`'s
-* continuations would put the rendered reply over `MAX_MESSAGE_BYTES`.
-*
-* Past the bound the NEWEST ids are kept, whole, and the parent's id still
-* ends the chain. That is what a mail client threads on: it links the reply
-* under any id it recognises, and the parent is also `In-Reply-To`. The
-* root id RFC 5537 keeps is a Netnews convention (a newsreader identifies a
-* thread by it); in mail it would spend the budget on an id older than
-* every client in the conversation.
+* Longest `References` value a reply carries, in UTF-16 code units. 8 KiB
+* keeps any real thread whole; past it the newest ids are kept, since mail
+* clients thread on any id they recognise and the parent is `In-Reply-To`.
 */
 const MAX_REPLY_REFERENCES_CHARS = 8192;
 /**
-* The `References` value a reply carries, or `''` when nothing can be
-* threaded. In order: the whole inbound chain continued by the parent's
-* `messageId` when it fits `MAX_REPLY_REFERENCES_CHARS`; otherwise the
-* newest ids of the chain that fit, none of them split; and the parent's id
-* alone (which may be empty) when even those hold an id no line can carry.
+* The reply's `References`, or `''`: the inbound chain plus the parent's id,
+* trimmed to its newest whole ids, or the parent's id alone when an id
+* cannot fit a line.
 */
 function replyReferences(originalReferences, messageId) {
 	const parent = messageId ? ` ${messageId}` : "";
@@ -552,15 +438,8 @@ function replyReferences(originalReferences, messageId) {
 	return fitsHeaderLine("References", chain) ? chain : messageId;
 }
 /**
-* Minimal RFC 2047 encoded-word decoder. Handles `=?charset?B?base64?=`
-* and `=?charset?Q?quoted-printable?=` segments separated by optional
-* whitespace. Unknown charsets pass through (best-effort UTF-8 decode);
-* malformed inputs return the original.
-*
-* Scope is intentionally narrow — used only for cosmetic subject
-* normalization in `prefixReplySubject`. Anything that needs robust
-* decoding (e.g. searching subject text) should use postal-mime's
-* parsed view via `parseEmail`.
+* Minimal RFC 2047 decoder for the reply subject: B and Q encoded-words,
+* unknown charsets read as UTF-8, malformed input returned unchanged.
 */
 function decodeRfc2047(value) {
 	if (!value.includes("=?")) return value;
@@ -569,7 +448,7 @@ function decodeRfc2047(value) {
 		let last = 0;
 		for (const m of value.matchAll(/=\?([\w-]+)\?([BbQq])\?([^?]*)\?=(?:\s+(?==\?))?/g)) {
 			const [match, charset, enc, payload] = m;
-			const bytes = enc.toUpperCase() === "B" ? base64Decode(payload) : quotedPrintableDecode(payload);
+			const bytes = enc.toUpperCase() === "B" ? base64ToBytes(payload) : quotedPrintableDecode(payload);
 			let decoder;
 			try {
 				decoder = new TextDecoder(charset || "utf-8", { fatal: false });
@@ -585,12 +464,6 @@ function decodeRfc2047(value) {
 		return value;
 	}
 }
-function base64Decode(b64) {
-	const binary = atob(b64);
-	const out = new Uint8Array(binary.length);
-	for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
-	return out;
-}
 function quotedPrintableDecode(qp) {
 	const out = new Uint8Array(qp.length);
 	let kept = 0;
@@ -608,13 +481,8 @@ function quotedPrintableDecode(qp) {
 	return out.subarray(0, kept);
 }
 /**
-* Pure helper: build the reply MIME from an inbound message + reply opts,
-* with `Subject: Re: …` (no double-prefix), `In-Reply-To`, and `References`
-* threaded from the original. Threading is best-effort (the inbound values
-* are remote-sender controlled): an id no header line can carry is dropped,
-* and a `References` chain over `MAX_REPLY_REFERENCES_CHARS` is trimmed to
-* its newest ids. Exposed separately so the dispatch step (`message.reply`)
-* can be tested without `cloudflare:email`.
+* Build the reply MIME for `replyEmail`: `Re:` subject and best-effort
+* `In-Reply-To` / `References` threading from the inbound message.
 */
 async function buildReplyMessage(message, opts) {
 	const headers = message.headers;
@@ -625,18 +493,18 @@ async function buildReplyMessage(message, opts) {
 	if (opts.from !== void 0) fromAddr = opts.from;
 	else if (readRelayDomain(message) !== void 0) fromAddr = message.to;
 	else {
-		const slug = tryReadProjectSlug();
+		const slug = readProjectSlug();
 		if (slug) {
-			const domain = tryReadEmailDomain();
+			const domain = readEnvString("__VOID_EMAIL_DOMAIN");
 			if (!domain) throw new Error("replyEmail: 'from' is required when __VOID_PROJECT_SLUG is set but __VOID_EMAIL_DOMAIN is not. Set `from` explicitly, or deploy via Void so the platform-injected __VOID_PROJECT_SLUG and __VOID_EMAIL_DOMAIN can default it to <slug>+noreply@<domain>.");
 			fromAddr = `${slug}+noreply@${domain}`;
-		} else if (readRawProjectSlug() !== void 0) throw new Error("replyEmail: 'from' is required — this project's slug cannot build a default reply sender (`<slug>+noreply@<domain>` must stay within the 64-octet local part, so the slug must be at most 56 characters). Set `from` explicitly.");
+		} else if (readEnvString("__VOID_PROJECT_SLUG") !== void 0) throw new Error("replyEmail: 'from' is required — this project's slug cannot build a default reply sender (`<slug>+noreply@<domain>` must stay within the 64-octet local part, so the slug must be at most 56 characters). Set `from` explicitly.");
 		else fromAddr = message.to;
 	}
 	const toAddr = opts.to ?? message.from;
 	const subject = opts.subject ?? prefixReplySubject(originalSubject);
 	const threading = {};
-	const messageId = fitsHeaderLine("In-Reply-To", originalMessageId) && !hasControl(originalMessageId) ? originalMessageId : "";
+	const messageId = fitsHeaderLine("In-Reply-To", originalMessageId) && indexOfControl(originalMessageId) === -1 ? originalMessageId : "";
 	if (messageId) threading.inReplyTo = messageId;
 	const references = replyReferences(originalReferences, messageId);
 	if (references) threading.references = references;
@@ -686,50 +554,31 @@ function isForwardableEmailMessage(value) {
 	const m = value;
 	return typeof m.setReject === "function" && typeof m.forward === "function" && typeof m.reply === "function";
 }
-const INBOUND_PROVIDER_DEADLINE_MS = 3e4;
-const INBOUND_ACTION_BATCH_DEADLINE_MS = 6e4;
-function createInboundProviderDeadline() {
-	const deadline = Date.now() + INBOUND_ACTION_BATCH_DEADLINE_MS;
-	return { async run(submit) {
-		const remaining = Math.min(INBOUND_PROVIDER_DEADLINE_MS, deadline - Date.now());
-		if (remaining <= 0) throw new Error("email action batch deadline elapsed before provider submission");
-		const work = submit();
-		let timer;
-		try {
-			return await Promise.race([work, new Promise((_, reject) => {
-				timer = setTimeout(() => reject(/* @__PURE__ */ new Error("email action provider timed out; outcome unknown, do not retry automatically")), remaining);
-			})]);
-		} finally {
-			if (timer !== void 0) clearTimeout(timer);
-		}
-	} };
-}
 /**
-* Replay recorded `EmailAction`s on a real `ForwardableEmailMessage`, in
-* order. The proxy already made `setReject` terminal (earlier forward/reply
-* entries are purged, later ones dropped), so a reject is never followed by
-* anything. `reply` needs a genuine `EmailMessage` — Cloudflare rejects a
-* duck-typed object — so `cloudflare:email` is loaded here, and only when
-* a reply was recorded.
-*
-* The proxy already validated forward headers and normalized reject reasons.
-* Provider refusals still propagate to the native event caller.
+* Replay recorded actions on a native message, in order. The proxy already
+* made `setReject` terminal and validated the rest. `reply` needs a real
+* `EmailMessage`, so `cloudflare:email` loads only when one was recorded.
 */
 async function enactEmailActions(message, actions) {
-	const providerDeadline = createInboundProviderDeadline();
+	const deadline = Date.now() + INBOUND_ACTION_BATCH_DEADLINE_MS;
+	const submit = async (run) => {
+		const remaining = Math.min(INBOUND_PROVIDER_DEADLINE_MS, deadline - Date.now());
+		if (remaining <= 0) throw new Error("email action batch deadline elapsed before provider submission");
+		return withTimeout(remaining, run, () => /* @__PURE__ */ new Error("email action provider timed out; outcome unknown, do not retry automatically"));
+	};
 	for (const action of actions) switch (action.type) {
 		case "reject":
 			message.setReject(action.reason);
 			break;
 		case "forward":
-			await providerDeadline.run(() => message.forward(action.to, action.headers ? new Headers(action.headers) : void 0));
+			await submit(() => message.forward(action.to, action.headers ? new Headers(action.headers) : void 0));
 			break;
 		case "reply": {
 			const { EmailMessage } = await import("cloudflare:email");
-			await providerDeadline.run(() => message.reply(new EmailMessage(action.from, action.to, bytesToReadableStream(action.raw))));
+			await submit(() => message.reply(new EmailMessage(action.from, action.to, bytesToReadableStream(action.raw))));
 			break;
 		}
 	}
 }
 //#endregion
-export { createMessageProxy as a, isForwardableEmailMessage as c, bytesToReadableStream as i, parseEmail as l, MAX_INBOUND_HEADERS as n, defineEmail as o, ParseEmailError as r, enactEmailActions as s, MAX_INBOUND_BYTES as t, replyEmail as u };
+export { createMessageProxy as a, isForwardableEmailMessage as c, readProjectSlug as d, replyEmail as f, bytesToReadableStream as i, parseEmail as l, MAX_INBOUND_HEADERS as n, defineEmail as o, tryGetRawRuntimeEnv as p, ParseEmailError as r, enactEmailActions as s, MAX_INBOUND_BYTES as t, readEnvString as u };

package/dist/{inbound-CH5Mksyy.d.mts → inbound-brj2-TM5.d.mts}

@@ -1,3 +1,4 @@
+import { EmailWireAction } from "@void/platform/email-protocol";
 import { Email } from "postal-mime";
 //#region src/runtime/email/types.d.ts
 /**
@@ -19,12 +20,11 @@ interface Attachment {
 }
 interface SendEmailOptions {
   /**
-   * Sender envelope address. Optional — when omitted, the framework
-   * substitutes `<__VOID_PROJECT_SLUG>+noreply@<__VOID_EMAIL_DOMAIN>`
-   * from the two platform-injected bindings (the project slug and the
-   * mail domain configured for this environment). Outside a deployed
-   * worker, or whenever either binding is missing, `sendEmail` returns
-   * `INVALID_FROM` — it never falls back to a baked-in domain.
+   * Sender envelope address. Optional. When omitted, `void dev` and
+   * `void deploy --platform cloudflare` use `email.from` from void.config.ts,
+   * and a Void platform deploy uses `<project-slug>+noreply@<mail-domain>`.
+   * Without either, `sendEmail` returns `INVALID_FROM`; it never falls back
+   * to a baked-in domain.
    */
   from?: Address;
   to: Address | Array<Address>;
@@ -200,13 +200,9 @@ declare class ParseEmailError extends Error {
   });
 }
 /**
- * Parse a `ForwardableEmailMessage` into structured fields. postal-mime is
- * loaded lazily so workers that never call this don't bundle it.
- *
- * For proxy messages (built via `createMessageProxy`) the raw bytes are
- * cached on first read so subsequent `parseEmail`/`message.raw` accesses
- * still work. For real CF `ForwardableEmailMessage`s the raw stream is
- * one-shot.
+ * Parse a `ForwardableEmailMessage` into structured fields with postal-mime,
+ * loaded on first use. A native Cloudflare message's `raw` stream is
+ * one-shot, so parse it once.
  */
 declare function parseEmail(message: ForwardableEmailMessage): Promise<ParsedEmail>;
 /** Inbound message decoded from the authenticated gateway request. */
@@ -227,52 +223,23 @@ interface EmailEnvelope {
   viaDomain?: string;
 }
 /** Handler intents, validated and admitted by the gateway before delivery. */
-type EmailAction = {
-  type: "reject";
-  reason: string;
-} | {
-  type: "forward";
-  to: string;
-  headers?: Record<string, string>;
-} | {
-  type: "reply";
-  from: string;
-  to: string;
-  raw: Uint8Array;
-};
+type EmailAction = EmailWireAction;
 interface MessageProxy {
   message: ForwardableEmailMessage;
   getActions(): Array<EmailAction>;
 }
 interface CreateMessageProxyOptions {
   /**
-   * Project slug stripped from the `<slug>+<tag>` recipient by the
-   * dispatcher. When set, `message.to` is rewritten to the bare
-   * `<tag>@<domain>` form so user handlers see clean addresses (the slug
-   * is platform-internal). The original `<slug>+<tag>@<domain>` is
-   * preserved on a non-enumerable `__voidPlatformTo` property for
-   * diagnostics.
+   * Project slug the platform prefixes recipients with
+   * (`<slug>+<tag>@<domain>`). When set, `message.to` drops the `<slug>+`.
    */
   slug?: string;
 }
 /**
- * Build a proxy `ForwardableEmailMessage` from an envelope. The proxy's
- * `setReject` / `forward` / `reply` methods don't dispatch directly — they
- * record `EmailAction` entries that the router (which holds the real
- * message) enacts after the handler returns.
- *
- * `reply()` accepts a duck-typed `{ from, to, raw }` with `raw` a
- * `Uint8Array` or `ReadableStream` — what `replyEmail()` passes. It does NOT
- * accept a native `EmailMessage` from `cloudflare:email`: that class exposes
- * only `from` and `to` (workers-types declares nothing else, and the body
- * has no public accessor), so its bytes cannot be recorded here, and nothing
- * could encode them for the gateway. The reply MIME bytes are
- * buffered before being recorded so the action is fully self-contained.
- *
- * When `opts.slug` is provided, `message.to` is rewritten to remove the
- * platform-injected `<slug>+` prefix so handlers see `<tag>@<domain>`
- * instead of `<slug>+<tag>@<domain>`. The original wire-form recipient is
- * preserved on a non-enumerable `__voidPlatformTo` property.
+ * Build the message a handler sees from an envelope. `setReject`, `forward`
+ * and `reply` record `EmailAction`s instead of dispatching; the caller enacts
+ * them after the handler returns. `reply()` takes `{ from, to, raw }`, which
+ * `replyEmail()` passes: a native `EmailMessage` has no readable body.
  */
 declare function createMessageProxy(envelope: EmailEnvelope, opts?: CreateMessageProxyOptions): MessageProxy;
 interface ReplyEmailOptions {
@@ -334,15 +301,9 @@ declare function replyEmail(message: ForwardableEmailMessage, opts: ReplyEmailOp
  */
 declare function isForwardableEmailMessage(value: unknown): value is ForwardableEmailMessage;
 /**
- * Replay recorded `EmailAction`s on a real `ForwardableEmailMessage`, in
- * order. The proxy already made `setReject` terminal (earlier forward/reply
- * entries are purged, later ones dropped), so a reject is never followed by
- * anything. `reply` needs a genuine `EmailMessage` — Cloudflare rejects a
- * duck-typed object — so `cloudflare:email` is loaded here, and only when
- * a reply was recorded.
- *
- * The proxy already validated forward headers and normalized reject reasons.
- * Provider refusals still propagate to the native event caller.
+ * Replay recorded actions on a native message, in order. The proxy already
+ * made `setReject` terminal and validated the rest. `reply` needs a real
+ * `EmailMessage`, so `cloudflare:email` loads only when one was recorded.
  */
 declare function enactEmailActions(message: ForwardableEmailMessage, actions: ReadonlyArray<EmailAction>): Promise<void>;
 //#endregion

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { n as HeadDescriptor } from "./head-C8K_iGe6.mjs";
 import { r as AuthUser } from "./auth-DkcFflXV.mjs";
-import { C as defer, E as ValidatorSlots, S as InferProps, T as HandlerInput, _ as defineQueue, a as CloudEnv, b as Deferred, c as QueueRetryOptions, d as TypedQueueHandler, f as VoidAssetRewriteError, g as defineMiddleware, h as defineHead, i as CloudContextVariables, l as RenderAssetTags, m as defineHandler, o as QueueBatch, p as basicAuth, r as CloudContext, s as QueueMessage, t as BasicAuthOptions, u as TypedHandler, v as defineRender, x as DeferredState, y as defineScheduled } from "./handler-CNAwjRcW.mjs";
+import { C as defer, E as ValidatorSlots, S as InferProps, T as HandlerInput, _ as defineQueue, a as CloudEnv, b as Deferred, c as QueueRetryOptions, d as TypedQueueHandler, f as VoidAssetRewriteError, g as defineMiddleware, h as defineHead, i as CloudContextVariables, l as RenderAssetTags, m as defineHandler, o as QueueBatch, p as basicAuth, r as CloudContext, s as QueueMessage, t as BasicAuthOptions, u as TypedHandler, v as defineRender, x as DeferredState, y as defineScheduled } from "./handler-_PqY82xe.mjs";
 import { t as QueueMap } from "./queues-BWKt1Xo4.mjs";
 import { PluginConfig } from "@cloudflare/vite-plugin";
 import { Plugin } from "vite";
@@ -49,23 +49,7 @@ export declare function shouldBindWorkersAi(command: string, needsAI: boolean, r
 export declare function resolveWorkersAiBindingName(resolvedAi: unknown, configuredName?: string): string;
 //#endregion
 //#region src/index.d.ts
-/**
- * Void plugin — the main entry point.
- *
- * Composes:
- * 1. Routing plugin (file-based routing from routes/ and middleware/)
- * 2. Migration plugin (auto-apply .sql migrations on dev startup)
- * 3. @cloudflare/vite-plugin (workerd runtime, HMR, builds)
- *
- * Binding inference runs synchronously here so results are available
- * before the Cloudflare plugin initializes.
- *
- * The Cloudflare plugin reads Void's generated config and provides it to our
- * config function. Bindings already defined there (with real IDs for
- * production deployment) are preserved — we only add inferred bindings
- * that are missing. This allows `vite build && wrangler deploy` to work
- * for deploying directly to Cloudflare without the Void platform.
- */
+/** Returns the Vite plugins that build and serve a Void app for its configured target. */
 export declare function voidPlugin(options?: {
   persistTo?: string;
   auxiliaryWorkers?: PluginConfig["auxiliaryWorkers"];