feat(email): route write leases through UserMeter

[kentcdodds]

Intent

Complete the expand step for account write-lease authority by moving the final four email call sites onto UserMeter before deleting the legacy D1 path in a follow-up deployment.

Summary

• pass the existing worker env to inbound, inbound-effects, outbound, and inbound-reconciliation lease boundaries
• preserve all email behavior and the legacy D1 lease read/write path during the mixed-version drain
• defer legacy-path deletion until this deploy is verified and D1 active leases drain

Testing

• npm run typecheck — passed
• email workers suites — 3 files, 21 tests passed
• inbound-effects node suite — 1 test passed
• local E2E with fresh disposable D1 — 15/15 passed
• CI rerun after a workerd broken-pipe failure — green
• Cursor Bugbot + CodeRabbit — passed, no actionable comments

System changes

System recap — composes existing primitives (low risk)

Mode: recap · Base: main @ ffb84630 · Head: 8ba23da2

Classification: composes — call-site wiring routes existing email mutations through the existing UserMeter lease authority; no primitive contract changes.

Primitives touched

Primitive	Group	Impact
email	assistant	composes — supplies USER_METER to four existing lease boundaries

System map

Email mutation paths now select the UserMeter branch of the existing write-lease helper while D1 remains a rollout compatibility fence.

Legend: green = composes (wiring only) · amber = extended by this PR · red = new primitive · gray = context (unchanged, included only when an edge crosses it).

flowchart LR
  email["email<br/>Email"]:::touched
  userMeter["user-meter<br/>Per-user quota meter"]:::untouched
  d1["d1-app-db<br/>Application database"]:::untouched
  email -->|"pass env to withAccountWriteLease"| userMeter
  email -->|"retain deleting_at and rollout lease compatibility"| d1
  classDef touched fill:#1a7f37,color:#fff
  classDef extended fill:#9a6700,color:#fff
  classDef added fill:#cf222e,color:#fff
  classDef untouched fill:#57606a,color:#fff

Loading

Invariants

Per-user isolation and account-deletion fencing remain unchanged; this PR only changes which already-existing authority branch the email paths select.

Conductor report

• STATUS: merged and deployed in main 95f2150e at 2026-08-04 01:13Z
• Mailbox coordination: mailbox legacy graph retirement was complete (#1174 / #1189); these were call-site-only changes.
• Drain evidence: at 01:18Z, no D1 lease was acquired after this deploy. The one remaining pre-cutover row dated 2026-08-02 was audited and repaired (e72aac17-b95c-4b3a-8afd-08e3bb9d8893). Follow-up D1 active lease count: 0.
• Parity evidence: repaired user had d1Only=0, legacyWithoutD1=0, deletion tombstone parity true. UserMeter remains authoritative and currently reports active DO leases independently.
• Next step: remove the legacy D1 path and optional-env API from a fresh main-based branch; D1 schema drop remains a separate destructive review PR.
• Destructive work: none.

  

Summary by CodeRabbit

• Bug Fixes
  • Improved reliability when processing inbound and outbound email delivery operations.
  • Ensured email processing retains the correct runtime environment while account updates are performed.

[coderabbitai]

📝 Walkthrough

Walkthrough

Email inbound, outbound, and reconciliation flows now pass their worker environment to withAccountWriteLease.

Changes

Email lease environment propagation

Layer / File(s)	Summary
Update email lease call sites packages/worker/src/email/inbound.ts, packages/worker/src/email/inbound-effects.ts, packages/worker/src/email/reconcile-inbound-deliveries.ts, packages/worker/src/email/outbound.ts	Each email-related withAccountWriteLease call now receives the corresponding worker environment.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• kentcdodds/kody#1123: Adds the environment-aware lease API used by these email call sites.
• kentcdodds/kody#1125: Updates withAccountWriteLease behavior while preserving the email lease path.
• kentcdodds/kody#1128: Adds lease-mirror parity checks related to environment-aware lease handling.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes routing email write leases through UserMeter, which is the main change.
Description check	✅ Passed	The description covers intent, changes, testing, system impact, rollout safety, and deferred legacy-path removal.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/meter-do-38c8

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔎 Preview deployed: https://kody-pr-1197.kody-a99.workers.dev

Worker: kody-pr-1197
D1: kody-pr-1197-db
KV: kody-pr-1197-oauth-kv

Mocks:

• cloudflare: https://kody-pr-1197-mock-cloudflare.kody-a99.workers.dev/__mocks (kody-pr-1197-mock-cloudflare)