Email delivery

file.cheap can receive mail at hello@file.cheap and forward a bounded, rendered copy to one private operator address. This optional hosted path is separate from the local-first CLI and MCP server; saving, searching, and restoring stashes never requires email or a network connection.

POST /api/webhooks/resend is a private provider callback exception outside the public /api/v1 API. Signed email.received events must contain only hello@file.cheap in data.to; optional envelope-recipient metadata is cross-checked when present. Only after that signed-event filter does file.cheap claim a replay lease and fetch authenticated Receiving API metadata; it revalidates the exact recipient there before forwarding content. The route uses a fixed sender, preserves a validated original Reply-To, and blocks loops.

Mail content is untrusted input. file.cheap does not log or store message content, private destinations, or provider IDs. It retains only 90-day, pseudonymized, joinable SHA-256 replay digests instead of plaintext identifiers. Attachments are deliberately omitted; use file.cheap stashes for files instead. Delivery has replay and provider idempotency protection, but distributed systems cannot promise exactly-once delivery. Resend may deliver a webhook up to eight times; the bounded replay ledger covers that provider retry window.

The Resend receiving credential is team-wide full access, not domain-scoped. Current code reads it only in the Production webhook path alongside the endpoint-specific secret and private destination. Vercel Production variables are project/server-runtime scoped, so other same-project server code could access process.env; true route isolation needs a separate deployment or secret broker. Operational setup, DNS, verification, and recovery procedures are maintained in the deployment runbook.