cloudflare-email 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0f26340bc2629fee65067ec40a1f78ffea475e70a7d102931f3a96ab0f65d621
-  data.tar.gz: 291281b738050c94bc80062a977f0b820178b70e4574f49ed449d737c06aa70c
+  metadata.gz: 5188438b941345c4164baca6ab1400e2fc74259c5fdd209a6d2ed9ac618147b5
+  data.tar.gz: 5e3a6ff25c460c0a73ffb3fdf44dcc62f87679f4278e328c605291d62de35fa9
 SHA512:
-  metadata.gz: 62b1afce0f1b6afaa33091a1c9540702f7d09e7b1ecb3a3cd71b11a70fbd52162aeb50dba1696fb6a23799096d88be0a1d06ff804b996191018d4641ca5c68a4
-  data.tar.gz: 2e2210138612fb118ae196f9c97569e3006e6d6f43657efa5be80e5e7636bd55bb112742aaf08df092d4668d66295fa6a5e35df9e9035946897db99ad1c237bc
+  metadata.gz: 77fe9d9c571311065e9d10d00e2c021156113ff63dec5a970f63456a6cee9d3413bfe157dcfd8e37992e5b747e1ab957d342bfc01a399d41e2c3838462067aa3
+  data.tar.gz: bf580baaec84aa3dc8894f0fbc9b770ca4fe2521a1534b248fe75bd67812a40adaf4538d321a7740b911b1fc42b80e5fd468418c4d804d635f5496710591add6

data/CHANGELOG.md

@@ -1,6 +1,78 @@
 # Changelog
 
-## Unreleased
+## 0.2.0 — 2026-09-11
+
+- Add optional managed mailboxes: domain directory, addresses/aliases, lifecycle,
+  incoming memberships, read/archive/purge APIs and raw-mail retention.
+- Add explicit tenant connections, tenant-aware framework and mailbox jobs,
+  mailbox-authorized outbox sends, shared event intake/correlation and recovery.
+  Verify separate SQLite databases and actual `activerecord-tenanted` integration;
+  no new runtime dependency for plain Ruby consumers.
+- Add a mailbox generator with separate shared/tenant migration paths and
+  user guides for mailbox management and database tenancy.
+
+- Bound Rails and Worker inbound reads to 25 MiB by default; reject malformed or
+  stale signing headers before reading MIME. Require HTTPS remote endpoints.
+- Restrict the development tunnel to email ingress and require a running guard;
+  redact client inspection, retry logs, and generated mailbox logging.
+- Validate delivery-event schemas, preserve receipt evidence through ordinary
+  ActiveRecord updates, and tighten provider acceptance response handling.
+- Remove Rails 7.1 support, update patched Rails/SQLite test floors, and audit
+  resolved Ruby dependencies in CI. See the dated security verification report.
+
+- Add an optional durable Rails outbox: immutable MIME/envelope snapshots,
+  account-scoped operation keys, committed send claims, per-recipient acceptance
+  evidence, blocked uncertain retries, and audited subset reconciliation.
+- Add `Outbox.prepare_mail`, identity-only `SendJob`, replay jobs/tasks and
+  `DeliveryEvents` to correlate provider events and update recipient lifecycle
+  state transactionally. Normalize receipt message IDs for indexed replay.
+- Verify concurrent sends and event projection on PostgreSQL as well as SQLite;
+  include process termination, partial outcomes and post-acceptance persistence
+  failures. The inbox uses the shared ledger with preserved historical records.
+
+- Authenticate SMTP envelope sender/recipient with the Worker's v2 HMAC format,
+  persist trusted metadata before routing, and expose `Envelope.for(inbound_email)`.
+  Preserve raw MIME and scope duplicate detection to the exact SMTP recipient.
+  Require v2 ingress; remove v1 compatibility and the unused signed Message-ID
+  helper. Coordinate Rails and Worker deployment; see docs/upgrading-0.2.md.
+
+- Extract shared provider acceptance, delivery-event ordering, and Message-ID
+  normalization primitives from the inbox application.
+- Add an opt-in ActiveRecord event inbox and `cloudflare:email:tracking` generator:
+  committed receipts before ACK, account/event uniqueness, payload-conflict
+  detection, unmatched replay, and transactional handlers with explicit outcomes.
+
+- Verify actual local workerd-to-Rails delivery in CI. This exposed and fixed an
+  unsupported fetch redirect mode; use `manual` and reject the 3xx response.
+  Add reusable package/fresh-install/task verification and a dated evidence report.
+
+- Add outbound delivery events through Cloudflare Queues HTTP pull, typed event
+  data, account/domain checks, per-message acknowledgement after handler success,
+  and a Rails `consume_events` task. Optional Rails receipts provide durable
+  deduplication; applications supply correlation and processing policy.
+- Expose suppressed recipients and provider message IDs in responses/notifications;
+  support cc/bcc-only structured sends and HTTP-date Retry-After headers.
+- Default to retrying only rate limits and pre-send connection failures. Ambiguous
+  network/5xx retries now require `retry_ambiguous: true` to accept duplication risk.
+- Fix generated ENV credentials, send-only eager boot, duplicate ingress responses,
+  accidental generator deployment tasks, and development environment isolation.
+- Require subdomain routing DNS preflight; refuse misleading subdomain catch-all
+  scope; use current apex DNS API and paginated rule lookup; surface setup failures.
+- Update locked Worker tooling, require explicit Wrangler environments, bound
+  forwarding requests to 15 seconds, and reject redirects. Add scheduled CI,
+  dependency checks, actual Rails integration tests, and Ruby 4 / Rails 8.1 coverage.
+- Require FROM for test sends; remove undocumented sending-domain discovery and
+  misleading diagnostic claims. Update DNS, SMTP, retry, and signed-ID guidance.
+- Bound legacy signed Message-ID output to 900 bytes; reject empty decode secrets.
+  Live Cloudflare testing confirmed custom IDs are replaced; use provider IDs
+  for correlation, not sender authentication. See docs/upgrading-0.2.md.
+- Accept plain JSON queue bodies returned by live Email Sending subscriptions,
+  retaining Base64 compatibility. Verify real delivery-event redelivery and ack.
+
+## 0.1.0 — 2026-04-18
+
+The notes below describe the original April implementation and its historical
+verification. Current compatibility and security guidance is in the 0.2.0 docs.
 
 - **`Cloudflare::Email::SecureMessageId`** — sign the outbound `Message-ID:`
   with HMAC-SHA256. The recipient's reply naturally carries the signed id