fix: setup bootstrap race and free-plan sending block

app/features/setup/setup-domain-screen.tsx

@@ -27,6 +27,7 @@ export function DomainStep(props: {
   appHostname: string;
   appSubdomain: string;
   connectionError: string | null;
+  enableSending: boolean;
   errors: DomainErrors;
   isLoading: boolean;
   onBack: () => void;
@@ -38,6 +39,7 @@ export function DomainStep(props: {
   selectedZoneIds: string[];
   selectedZones: CloudflareZone[];
   setAppSubdomain: (value: string) => void;
+  setEnableSending: (value: boolean) => void;
   setPortalZoneId: (value: string) => void;
   zones: CloudflareZone[];
 }): React.ReactElement {
@@ -118,6 +120,26 @@ export function DomainStep(props: {
         onChange={props.setAppSubdomain}
         onDomainChange={props.setPortalZoneId}
       />
+
+      <Field>
+        <label
+          className="flex cursor-pointer items-start gap-2.5 rounded-md px-1 py-1 hover:bg-muted/50"
+          htmlFor="enable-sending"
+        >
+          <Checkbox
+            checked={props.enableSending}
+            id="enable-sending"
+            onCheckedChange={(checked) => props.setEnableSending(checked === true)}
+          />
+          <span className="flex min-w-0 flex-col gap-0.5 text-sm">
+            <span className="font-medium">Enable outbound sending</span>
+            <span className="text-xs text-muted-foreground">
+              Cloudflare Email Sending requires a Workers Paid plan. Leave this off to run a
+              receive-only workspace; you can enable sending later from domain settings.
+            </span>
+          </span>
+        </label>
+      </Field>
     </WizardPanel>
   );
 }
@@ -250,7 +272,7 @@ function describeReadinessFailure(status: CloudflareConfigureResult["status"]):
   if (!status.catchAll.enabled || !status.catchAll.configuredForWorker) {
     issues.push(status.catchAll.error ?? "Catch-all is not routing to this HQBase Worker.");
   }
-  if (!status.sending.enabled) {
+  if (status.sendingRequired && !status.sending.enabled) {
     issues.push(status.sending.error ?? "Email Sending is not enabled.");
   }
   return issues.join(" ") || "Cloudflare has not reported this domain as ready yet.";

app/features/setup/setup-preview-fixtures.tsx

@@ -115,6 +115,7 @@ export function renderPreviewFixture(input: FixtureInput): React.ReactNode {
         connectionError={
           readinessError ? "Cloudflare needs attention on one or more checks below." : null
         }
+        enableSending={true}
         errors={{}}
         isLoading={false}
         onBack={() => undefined}
@@ -130,6 +131,7 @@ export function renderPreviewFixture(input: FixtureInput): React.ReactNode {
         selectedZoneIds={input.selectedZoneIds}
         selectedZones={input.selectedZones}
         setAppSubdomain={input.setAppSubdomain}
+        setEnableSending={() => undefined}
         setPortalZoneId={input.setPortalZoneId}
         zones={zones}
       />
@@ -245,6 +247,7 @@ function readinessFailureFixture(): ConfiguredDomain[] {
             subdomains: [zone.name],
             error: null
           },
+          sendingRequired: true,
           ready: false
         }
       }

app/features/setup/types.ts

@@ -59,6 +59,7 @@ export type CloudflareDomainStatus = {
     subdomains: string[];
     error: string | null;
   };
+  sendingRequired: boolean;
   ready: boolean;
 };
 

app/features/setup/use-setup-cloudflare.ts

@@ -23,6 +23,9 @@ export function useSetupCloudflare(callbacks: {
   const [portalZoneId, setPortalZoneId] = React.useState("");
   const workerName = React.useMemo(() => inferWorkerName(), []);
   const [appSubdomain, setAppSubdomain] = React.useState("hqbase");
+  // Cloudflare Email Sending requires a Workers Paid plan. Operators on the free
+  // plan can still run a receive-only workspace by turning this off.
+  const [enableSending, setEnableSending] = React.useState(true);
   const [domainAttempted, setDomainAttempted] = React.useState(false);
   const [connectionError, setConnectionError] = React.useState<string | null>(null);
   const [results, setResults] = React.useState<ConfiguredDomain[]>([]);
@@ -37,7 +40,8 @@ export function useSetupCloudflare(callbacks: {
     ...selectedZoneIds.slice().sort(),
     portalZoneId,
     appHostname,
-    workerName
+    workerName,
+    String(enableSending)
   ].join(":");
   const domainConnected = Boolean(
     configuredKey === currentConnectionKey &&
@@ -96,7 +100,7 @@ export function useSetupCloudflare(callbacks: {
         const result = await configureCloudflareDomain({
           ...(isPortal ? { appHostname } : {}),
           attachCustomDomain: isPortal,
-          enableSending: true,
+          enableSending,
           workerName: workerName.trim(),
           zoneId: zone.id
         });
@@ -156,6 +160,7 @@ export function useSetupCloudflare(callbacks: {
       appHostname,
       appSubdomain,
       connectionError,
+      enableSending,
       errors: domainErrors,
       isLoading,
       portalZone,
@@ -167,6 +172,7 @@ export function useSetupCloudflare(callbacks: {
       onConnect: () => void handleDomainConnect(),
       onToggleZone: toggleZone,
       setAppSubdomain: (value: string) => update(() => setAppSubdomain(value)),
+      setEnableSending: (value: boolean) => update(() => setEnableSending(value)),
       setPortalZoneId: (value: string) => update(() => setPortalZoneId(value))
     },
     domainConnected,

worker/features/setup/cloudflare.ts

@@ -18,6 +18,10 @@ type CloudflareInput = { apiToken: string };
 type CloudflareZoneInput = CloudflareInput & {
   zoneId: string;
   workerName?: string | undefined;
+  // Outbound sending needs a Workers Paid plan. A receive-only workspace is a
+  // valid configuration, so readiness must not demand sending when the operator
+  // deliberately skipped it.
+  requireSending?: boolean | undefined;
 };
 
 type CloudflareConfigureInput = CloudflareZoneInput & {
@@ -124,19 +128,21 @@ export async function inspectCloudflareDomain(
     inspectSending(input.apiToken, zone.id)
   ]);
 
+  const sendingRequired = input.requireSending ?? true;
   const ready =
     zone.status === "active" &&
     routing.enabled &&
     routing.dnsReady &&
     catchAll.enabled &&
     catchAll.configuredForWorker &&
-    sending.enabled;
+    (!sendingRequired || sending.enabled);
 
   return {
     catchAll,
     ready,
     routing,
     sending,
+    sendingRequired,
     workerName,
     zone
   };
@@ -229,14 +235,15 @@ export async function configureCloudflareDomain(
     steps.push({
       id: "sending",
       label: "Enable Email Sending",
-      message: "Skipped by setup option.",
+      message: "Skipped. This workspace receives mail but cannot send it.",
       status: "skipped"
     });
   }
 
   return {
     status: await inspectCloudflareDomain({
       apiToken: input.apiToken,
+      requireSending: input.enableSending,
       workerName,
       zoneId: zone.id
     }),

worker/features/setup/routes.ts

@@ -2,6 +2,7 @@ import { Hono } from "hono";
 import type { HonoApp } from "../../lib/env";
 import { readJson } from "../../lib/json";
 import { parseWith } from "../../lib/validation";
+import { enforceRateLimit } from "../../security/rate-limit";
 import {
   clearRuntimeCloudflareGrantCookie,
   finishRuntimeCloudflareOAuth,
@@ -88,6 +89,13 @@ setupRoutes.post("/cloudflare/configure", async (c) => {
 });
 
 setupRoutes.post("/bootstrap", async (c) => {
+  const ip = c.req.header("cf-connecting-ip") ?? "unknown";
+  await enforceRateLimit(c.env.DB, c.env.BETTER_AUTH_SECRET, {
+    scope: "setup.bootstrap.ip",
+    subject: ip,
+    limit: 5,
+    windowSeconds: 15 * 60
+  });
   const input = parseWith(bootstrapSetupSchema, await readJson(c.req.raw));
   const grant = await resolveRuntimeCloudflareGrant(c.req.raw, c.env);
   const result = await bootstrapSetup(c.env, c.req.raw, input);

worker/features/setup/service.ts

@@ -1,4 +1,5 @@
 import { signUpOwnerUser } from "../../auth/user-actions";
+import { nowIso } from "../../db/client";
 import type { WorkerEnv } from "../../lib/env";
 import { AppError } from "../../lib/errors";
 import { assertLoginEmailOutsideDomains } from "../../security/login-email";
@@ -50,64 +51,90 @@ export async function bootstrapSetup(
     throw new AppError("SETUP_OWNER_EXISTS", "An owner user already exists.", 409);
   }
 
-  const domains = input.emailDomains ?? [{ name: input.primaryDomain ?? "" }];
-  if (!domains[0]?.name) throw new AppError("DOMAIN_REQUIRED", "Choose an email domain.", 400);
-  assertLoginEmailOutsideDomains(
-    input.ownerEmail,
-    domains.map((domain) => domain.name)
-  );
-
-  for (const domain of domains) {
-    await upsertMailDomain(env.DB, {
-      ...domain,
-      receivingStatus: "ready",
-      sendingStatus: "ready",
-      dnsStatus: "ready"
-    });
+  // The userCount check above is check-then-act and not atomic by itself: two
+  // concurrent bootstrap calls against a fresh, unauthenticated instance could
+  // both observe userCount === 0 and each create an independent owner. Claim a
+  // singleton lock row first; the PRIMARY KEY constraint makes only one caller
+  // win regardless of concurrency, so the loser is rejected before it can touch
+  // the user table.
+  const lockTimestamp = nowIso();
+  const claim = await env.DB.prepare(
+    `INSERT INTO app_settings (key, value_json, created_at, updated_at)
+     VALUES ('setup_bootstrap_lock', 'true', ?, ?)
+     ON CONFLICT(key) DO NOTHING`
+  )
+    .bind(lockTimestamp, lockTimestamp)
+    .run();
+  if (!claim.meta.changes) {
+    throw new AppError("SETUP_IN_PROGRESS", "Setup is already being completed.", 409);
   }
 
-  const owner = await signUpOwnerUser(env, request, {
-    email: input.ownerEmail,
-    name: input.ownerName,
-    password: input.ownerPassword,
-    role: "owner"
-  });
+  try {
+    const domains = input.emailDomains ?? [{ name: input.primaryDomain ?? "" }];
+    if (!domains[0]?.name) throw new AppError("DOMAIN_REQUIRED", "Choose an email domain.", 400);
+    assertLoginEmailOutsideDomains(
+      input.ownerEmail,
+      domains.map((domain) => domain.name)
+    );
+
+    for (const domain of domains) {
+      await upsertMailDomain(env.DB, {
+        ...domain,
+        receivingStatus: "ready",
+        sendingStatus: "ready",
+        dnsStatus: "ready"
+      });
+    }
 
-  await setPrimaryDomain(env.DB, domains[0].name);
-  if (input.portalHostname) {
-    await upsertWorkspaceHost(env.DB, {
-      hostname: input.portalHostname,
-      zoneId:
-        domains.find((domain) => input.portalHostname?.endsWith(`.${domain.name}`))?.zoneId ?? null,
-      kind: "portal",
-      canonical: true
+    const owner = await signUpOwnerUser(env, request, {
+      email: input.ownerEmail,
+      name: input.ownerName,
+      password: input.ownerPassword,
+      role: "owner"
     });
-  }
-  await setChecklistAcknowledged(env.DB, input.checklistAcknowledged);
 
-  const mailboxes: Mailbox[] = [];
-  for (const mailbox of input.mailboxes) {
-    mailboxes.push(await createMailbox(env.DB, mailbox));
-  }
-  const defaultFromMailbox = mailboxes.find(
-    (mailbox) => mailbox.address === input.defaultFromMailboxAddress
-  );
-  if (!defaultFromMailbox) {
-    throw new AppError(
-      "DEFAULT_FROM_MAILBOX_REQUIRED",
-      "Choose one of the setup mailboxes as the default From mailbox.",
-      400
+    await setPrimaryDomain(env.DB, domains[0].name);
+    if (input.portalHostname) {
+      await upsertWorkspaceHost(env.DB, {
+        hostname: input.portalHostname,
+        zoneId:
+          domains.find((domain) => input.portalHostname?.endsWith(`.${domain.name}`))?.zoneId ??
+          null,
+        kind: "portal",
+        canonical: true
+      });
+    }
+    await setChecklistAcknowledged(env.DB, input.checklistAcknowledged);
+
+    const mailboxes: Mailbox[] = [];
+    for (const mailbox of input.mailboxes) {
+      mailboxes.push(await createMailbox(env.DB, mailbox));
+    }
+    const defaultFromMailbox = mailboxes.find(
+      (mailbox) => mailbox.address === input.defaultFromMailboxAddress
     );
-  }
-  await setDefaultFromMailboxId(env.DB, owner.id, defaultFromMailbox.id);
+    if (!defaultFromMailbox) {
+      throw new AppError(
+        "DEFAULT_FROM_MAILBOX_REQUIRED",
+        "Choose one of the setup mailboxes as the default From mailbox.",
+        400
+      );
+    }
+    await setDefaultFromMailboxId(env.DB, owner.id, defaultFromMailbox.id);
 
-  await completeSetupIfReady(env.DB);
+    await completeSetupIfReady(env.DB);
 
-  return {
-    owner,
-    mailboxes,
-    setup: await getSetupStatus(env.DB)
-  };
+    return {
+      owner,
+      mailboxes,
+      setup: await getSetupStatus(env.DB)
+    };
+  } finally {
+    // userCount > 0 guards re-entry permanently once an owner exists; the lock
+    // only needs to live for the duration of one bootstrap attempt so a failed
+    // attempt (validation error, etc.) can be retried.
+    await env.DB.prepare(`DELETE FROM app_settings WHERE key = 'setup_bootstrap_lock'`).run();
+  }
 }
 
 export async function completeSetupIfReady(db: D1Database): Promise<SetupStatus> {

worker/features/setup/types.ts

@@ -73,6 +73,7 @@ export type CloudflareDomainStatus = {
   routing: CloudflareRoutingStatus;
   catchAll: CloudflareCatchAllStatus;
   sending: CloudflareSendingStatus;
+  sendingRequired: boolean;
   ready: boolean;
 };
 

worker/features/setup/validation.ts

@@ -89,6 +89,7 @@ export const verifyCloudflareAccessSchema = z.object({}).strict();
 export const listCloudflareZonesSchema = z.object({}).strict();
 
 export const inspectCloudflareDomainSchema = z.object({
+  requireSending: z.boolean().optional(),
   workerName: z.string().trim().min(1).max(63).optional(),
   zoneId: z.string().trim().min(1).max(64)
 });