---

id: 90121d61-86ed-48ff-8c57-b04fb8a3ce5d title: 'Cloudflare: implement Pages Functions + R2 inbox (current deploy has no inbox)' state: closed labels:

• area:inbox assignees: [] milestone: null created: 2026-10-27T17:24:52.330249308Z updated: 2026-10-27T17:45:41.613480095Z

---

What

The Cloudflare target is still incomplete: the repo has no functions/, no R2 code and no Pages deploy path. dist/_headers is emitted, but on Pages the forms POST to /inbox/issue and /inbox/pr-prompt with no Function behind them, so the inbox is dead. Docker/hu13 serve is the only complete target today.

Required parity

Implement Pages Functions for both endpoints with the existing inbox contract:

• urlencoded only (application/x-www-form-urlencoded; reject multipart/JSON), 32 KiB whole-request cap, strict UTF-8, NUL → 400
• strip controls; title ≤300, body/prompt ≤20000; license required; honeypot fake-200 without storing
• same-origin Origin gate, ~500 ms fixed delay, no echo, X-Content-Type-Options: nosniff + Cache-Control: no-store
• ack uuid exactly once
• R2 object per entry with the schema: type/title/body/handle/contact/license_version/received_at/salted_ip_hash
• per-IP rate limit and global quota (or document a verified Cloudflare-native equivalent, e.g. WAF/rate rules + R2 quota check) with 429/503

Deliverables

• functions/inbox/issue.js + functions/inbox/pr-prompt.js (or one shared handler)
• R2 binding docs (INBOX, INBOX_SALT secret) and wrangler/Pages deploy recipe; _routes.json limited to /inbox/*
• Node tests for validation/ack/R2 writes using a fake bucket (no network)
• update .forge/wiki/deploy to describe the Pages path honestly (what works, what needs dashboard config)
• clone URL: document --public-origin so the user-facing git clone <origin>/repo.git is real on Pages

Acceptance: local Node tests pass; the function code is deployable with a documented binding; docs no longer imply the static-only deploy has a working inbox.