Hardening + message rename, and a backend-update refresh prompt

[akazwz]

What

Two commits from a review/hardening pass plus one new feature.

fix: — correctness + hardening + naming (11a6616)

Bug fixes

• DO RPC error status (the big one): an AppError thrown inside a Durable Object loses its class identity and its status property crossing the RPC boundary — only message survives (Cloudflare RPC error-handling docs). So instanceof AppError in onError was always false and every DO error returned 500. An expired/invalid mailbox therefore returned 500, the frontend's 401/403 recovery never fired, and a returning user got stuck on a dead inbox. Recovered via httpStatusForError (message → status).
• Stale auth: getToken/getAddress now prefer the in-memory copy, so a failed localStorage.setItem (quota / private mode) can't leave a stale token authenticating against the old mailbox.
• Silent mail loss: re-throw on a failed message store instead of accepting-and-dropping; bounce oversized mail below the SQLite row limit.
• CLI: surface a timeout (not status text) when an error-body read aborts; loadConfig throws on a corrupt config and --force recovers from it.
• Frontend: roll back the optimistic "read" on load failure; clear the saved mailbox only on 401/403, not transient errors; detach socket handlers before close.

Refactor / naming

• Standardize the data/RPC/storage layer on "message": DO init→create, receiveEmail→receiveMessage, broadcastNewEmail→broadcastNewMessage; WS payload new_email→new_message; frontend types Email/EmailDetail→Message/MessageDetail (drop the never-returned preview); CLI flag --new→--force.
• Dedupe: shared CLI createMailbox helper (CLI + MCP); shared content-page components (Breadcrumb, CheckList, NumberedSteps, FaqSection, CtaSection, JsonLd) and SEO helpers (pageMeta, breadcrumbList, faqPage); drop a write-only domain put, a needless useMemo, and duplicated WS teardown; encodeURIComponent parity between the two API clients.

feat: — prompt to refresh when the backend redeploys (5ca018e)

Stamps every API response with the current deploy id (version_metadata binding → X-Smails-Version). The frontend compares it against the id first seen this session; on a change it shows a persistent "refresh" toast. Piggybacks on existing API traffic — no polling, no new endpoint.

⚠️ Decision for review: two breaking renames

These are intentional (pre-1.0, all first-party consumers updated in lockstep), but they break previously-documented public contracts. The version-prompt feature mitigates the WS one (stale tabs get prompted to refresh rather than silently failing). Flagging in case you'd rather keep back-compat aliases:

• WS new_email → new_message — open tabs on the old bundle stop reacting until refreshed.
• CLI --new → --force — create --new now no-ops the replace. A --new alias would be a one-liner if any scripts rely on it.

Note on deploy

Merging to main triggers a Workers Builds production deploy. The rename means the worker (emits new_message) and the frontend (listens for new_message) must ship together — they do, in this PR.

Verification

Biome ✅ · worker tsc ✅ · CLI tsc ✅ · frontend typecheck ✅ · frontend build (5 pages prerendered) ✅ · wrangler dev confirmed the X-Smails-Version header is emitted.

https://claude.ai/code/session_01SjtGZgvWwgF6oEZRhiqz3F