cloudflare-email 0.1.0 → 0.2.0

data/lib/cloudflare/email/routing_provisioner.rb

@@ -1,10 +1,11 @@
 require "net/http"
 require "json"
 require "uri"
+require "cloudflare/email/endpoint"
 
 module Cloudflare
   module Email
-    # Provision Cloudflare Email Routing rules via API — no dashboard clicks.
+    # Provision Cloudflare Email Routing rules via API.
     #
     # Looks up the zone ID for a domain, enables Email Routing on the zone
     # (publishing the MX + SPF records Cloudflare needs), and creates/updates
@@ -13,6 +14,8 @@ module Cloudflare
     # Required API token scopes:
     #   Zone → Zone → Read          (to look up zone by name)
     #   Zone → Email Routing → Edit (to enable routing and add rules)
+    #   Zone → DNS → Read           (to check preconfigured subdomains)
+    #   Zone → Zone Settings → Edit (to enable apex routing)
     #
     # Usage:
     #   provisioner = Cloudflare::Email::RoutingProvisioner.new(
@@ -28,7 +31,7 @@ module Cloudflare
       def initialize(api_token:, api_base: API_BASE)
         raise ArgumentError, "api_token is required" if api_token.to_s.empty?
         @api_token = api_token
-        @api_base  = api_base
+        @api_base  = Endpoint.parse(api_base).to_s.delete_suffix("/")
       end
 
       # High-level: given an address + Worker name, do everything needed to
@@ -36,14 +39,22 @@ module Cloudflare
       # is safe and will update the existing rule rather than duplicate it.
       def provision(address:, worker_name:)
         domain   = extract_domain(address)
-        zone_id  = find_zone_id_for(domain)
-        raise Error.new("No Cloudflare zone found for #{domain} — add the domain to your account first") unless zone_id
+        zone = find_zone_for(domain)
+        raise Error.new("No Cloudflare zone found for #{domain} — add the domain to your account first") unless zone
 
-        enable_routing_if_needed(zone_id)
-        upsert_route(zone_id: zone_id, address: address, worker_name: worker_name)
+        if zone["name"] == domain
+          enable_routing_if_needed(zone["id"])
+        else
+          check_subdomain_dns!(zone_id: zone["id"], domain: domain)
+        end
+        upsert_route(zone_id: zone["id"], address: address, worker_name: worker_name)
       end
 
       def find_zone_id_for(domain)
+        find_zone_for(domain)&.fetch("id")
+      end
+
+      def find_zone_for(domain)
         # Try the exact domain, then walk up parent domains until we find a
         # Cloudflare zone. Supports subdomains like "in.example.com" routing
         # to the "example.com" zone.
@@ -52,35 +63,35 @@ module Cloudflare
         candidates.each do |candidate|
           result = api_request(:get, "/zones?name=#{URI.encode_www_form_component(candidate)}")
           zones = Array(result["result"])
-          return zones.first["id"] if zones.any?
+          return zones.first.merge("name" => candidate) if zones.any?
         end
 
         nil
       end
 
       def enable_routing_if_needed(zone_id)
-        # This endpoint requires the "Email Routing Settings" permission group,
-        # which most scoped tokens don't carry. If we can read the setting,
-        # enable when off. If we can't (403), assume the user enabled routing
-        # via the dashboard when they added the subdomain — the subsequent
-        # rule create will fail with a clear error if not.
-        current = raw_api_request(:get, "/zones/#{zone_id}/email/routing")
-        status  = current.code.to_i
-
-        case status
-        when 200
-          body    = parse(current.body)
-          enabled = body.dig("result", "enabled")
-          api_request(:post, "/zones/#{zone_id}/email/routing/enable") unless enabled
-        when 403, 404
-          # Either the token can't read settings or routing isn't set up.
-          # Try to enable optimistically; ignore failure (rule create will
-          # surface a precise error if routing is actually off).
-          attempt = raw_api_request(:post, "/zones/#{zone_id}/email/routing/enable")
-          # Don't fail here even if this also 403s — move on to rule creation.
-        else
-          handle!(current, "GET /zones/#{zone_id}/email/routing")
+        current = api_request(:get, "/zones/#{zone_id}/email/routing")
+        unless [true, false].include?(current.dig("result", "enabled"))
+          raise Error.new("Email Routing settings response did not include an enabled flag; no routing settings were changed")
         end
+        return if current.dig("result", "enabled") == true
+
+        api_request(:post, "/zones/#{zone_id}/email/routing/dns")
+      end
+
+      # Cloudflare's documented subdomain onboarding is dashboard-only. Check
+      # its DNS prerequisites without ever modifying the parent zone's routing.
+      # This checks configured records, not propagation or live delivery.
+      def check_subdomain_dns!(zone_id:, domain:)
+        records = paginated_results("/zones/#{zone_id}/dns_records?name=#{URI.encode_www_form_component(domain)}")
+        mx = records.select { |r| r["type"] == "MX" }.map { |r| r["content"].to_s.downcase.delete_suffix(".") }.uniq.sort
+        expected_mx = (1..3).map { |n| "route#{n}.mx.cloudflare.net" }
+        spf = records.select { |r| r["type"] == "TXT" }.map { |r| r["content"].to_s.delete('"') }.select { |v| v.start_with?("v=spf1 ") }
+        return if mx == expected_mx && spf.size == 1 && spf.first.split.include?("include:_spf.mx.cloudflare.net")
+
+        raise Error.new("Email Routing DNS for #{domain} is missing or conflicts with another mail provider. " \
+          "In Cloudflare, open Email Routing > the apex domain > Settings > Subdomains and onboard #{domain}; " \
+          "then retry after checking its routing MX and SPF records. Parent-zone routing was not changed.")
       end
 
       def upsert_route(zone_id:, address:, worker_name:)
@@ -110,18 +121,14 @@ module Cloudflare
       end
 
       def find_rule_for(zone_id:, address:)
-        result = api_request(:get, "/zones/#{zone_id}/email/routing/rules?per_page=50")
-        rules  = Array(result["result"])
-
-        rules.find do |r|
+        list_rules(zone_id).find do |r|
           matchers = Array(r["matchers"])
-          matchers.any? { |m| m["field"] == "to" && m["value"] == address }
+          matchers.size == 1 && matchers.any? { |m| m["field"] == "to" && m["type"] == "literal" && m["value"] == address }
         end
       end
 
       def list_rules(zone_id)
-        result = api_request(:get, "/zones/#{zone_id}/email/routing/rules?per_page=50")
-        Array(result["result"])
+        paginated_results("/zones/#{zone_id}/email/routing/rules")
       end
 
       # Point the zone's catch-all rule at our Worker. Catch-all matches any
@@ -141,21 +148,40 @@ module Cloudflare
       end
 
       def provision_catch_all_for_domain(domain:, worker_name:)
-        zone_id = find_zone_id_for(domain)
-        raise Error.new("No Cloudflare zone found for #{domain}") unless zone_id
+        domain = domain.to_s.downcase.delete_suffix(".")
+        zone = find_zone_for(domain)
+        raise Error.new("No Cloudflare zone found for #{domain}") unless zone
+        unless zone["name"] == domain
+          raise Error.new("Catch-all rules are zone-wide: #{domain} belongs to zone #{zone['name']}. " \
+            "This task cannot scope a catch-all to a subdomain. Use explicit address routes or configure subdomain handling in the dashboard.")
+        end
 
-        enable_routing_if_needed(zone_id)
-        provision_catch_all(zone_id: zone_id, worker_name: worker_name)
+        enable_routing_if_needed(zone["id"])
+        provision_catch_all(zone_id: zone["id"], worker_name: worker_name)
       end
 
       private
 
+      def paginated_results(path)
+        records = []
+        page = 1
+        loop do
+          separator = path.include?("?") ? "&" : "?"
+          result = api_request(:get, "#{path}#{separator}per_page=50&page=#{page}")
+          batch = Array(result["result"])
+          records.concat(batch)
+          total_pages = result.dig("result_info", "total_pages")
+          break if batch.empty? || (total_pages ? page >= total_pages.to_i : batch.size < 50)
+          page += 1
+        end
+        records
+      end
+
       def extract_domain(address)
-        if address.include?("@")
-          address.split("@", 2).last
-        else
-          address
+        unless address.to_s.match?(/\A[^\s@]+@[^\s@]+\z/)
+          raise ArgumentError, "address must be a full email address"
         end
+        address.split("@", 2).last.downcase.delete_suffix(".")
       end
 
       # "a.b.c.example.com" → ["a.b.c.example.com", "b.c.example.com", "c.example.com", "example.com"]
@@ -196,9 +222,9 @@ module Cloudflare
 
       def handle!(response, context)
         status = response.code.to_i
-        return if status.between?(200, 299)
-
         body    = parse(response.body)
+        return if status.between?(200, 299) && body.is_a?(Hash) && body["success"] != false && body.key?("result")
+
         errors  = body.is_a?(Hash) ? Array(body["errors"]) : []
         message = errors.map { |e| e.is_a?(Hash) ? e["message"] : e.to_s }.compact.join("; ")
         message = "HTTP #{status}" if message.empty?

data/lib/cloudflare/email/send_job.rb

@@ -0,0 +1,41 @@
+require "active_job"
+require "cloudflare/email/active_record"
+
+module Cloudflare
+  module Email
+    # Serialize only the durable operation identity, never MIME or credentials.
+    # The application's job backend controls scheduling/retries; uncertainty is
+    # never cleared by retrying this job.
+    class SendJob < ::ActiveJob::Base
+      queue_as :mailers
+
+      def perform(account_id, operation_key)
+        delivery = ActiveRecord::OutboundDelivery.find_by!(account_id: account_id, operation_key: operation_key)
+        options = settings&.outbox_client_options || {}
+        client = Client.new(**options.to_h.merge(account_id: Credentials.account_id,
+          api_token: Credentials.api_token, retry_ambiguous: false))
+        ActiveRecord::Outbox.deliver(delivery, client: client)
+        handler = settings&.outbox_delivery_handler
+        # This is product projection after the durable send result. If it fails,
+        # a retry sees the existing accepted operation and cannot send it again.
+        delivery.with_lock { handler.call(delivery) } if handler.respond_to?(:call)
+        recipient_handler = settings&.outbox_recipient_handler
+        if %w[accepted partial].include?(delivery.state) && delivery.provider_message_id
+          ActiveRecord::DeliveryEvents.replay(account_id: account_id,
+            message_id: delivery.provider_message_id,
+            &(recipient_handler.method(:call) if recipient_handler.respond_to?(:call)))
+        end
+        if delivery.state == "unknown"
+          raise ActiveRecord::Outbox::InvalidTransition, "delivery outcome is unknown; reconcile before retrying"
+        end
+        delivery
+      end
+
+      private
+
+      def settings
+        Rails.application.config.x.cloudflare_email if defined?(Rails) && Rails.respond_to?(:application) && Rails.application
+      end
+    end
+  end
+end

data/lib/cloudflare/email/send_test.rb

@@ -1,9 +1,10 @@
 require "cloudflare/email/task_base"
 require "cloudflare/email/client"
+require "time"
 
 module Cloudflare
   module Email
-    # `bin/rails cloudflare:email:send_test TO=... [FROM=...]` — one-shot
+    # `bin/rails cloudflare:email:send_test TO=... FROM=...` — one-shot
     # test send via the current Cloudflare Email config.
     class SendTest < TaskBase
       def self.call(to:, from: nil, io: $stdout)
@@ -17,8 +18,7 @@ module Cloudflare
         require_value!(api_token,  "cloudflare.api_token")
         require_value!(opts[:to],  "TO=recipient@example.com")
 
-        sender = opts[:from] || infer_from
-        raise "Missing FROM= and couldn't infer from verified sending domains" if sender.to_s.empty?
+        sender = require_value!(opts[:from], "FROM=sender@your-verified-domain.example")
 
         say "Sending test email:"
         say "  from: #{sender}"
@@ -39,37 +39,13 @@ module Cloudflare
         )
 
         say "  success:   #{response.success?}"
+        say "  message_id: #{response.message_id}" if response.message_id
         say "  delivered: #{response.delivered.inspect}"
         say "  queued:    #{response.queued.inspect}"           if response.queued.any?
         say "  bounces:   #{response.permanent_bounces.inspect}" if response.permanent_bounces.any?
+        say "  suppressed: #{response.suppressed_recipients.inspect}" if response.suppressed_recipients.any?
       end
 
-      private
-
-      def infer_from
-        require "net/http"
-        require "json"
-
-        uri  = URI.parse("https://api.cloudflare.com/client/v4/accounts/#{account_id}/email/sending/domains")
-        http = Net::HTTP.new(uri.host, uri.port)
-        http.use_ssl = true
-        http.open_timeout = 10
-        http.read_timeout = 10
-
-        req = Net::HTTP::Get.new(uri.request_uri)
-        req["Authorization"] = "Bearer #{api_token}"
-        response = http.request(req)
-        return nil unless response.code.to_i.between?(200, 299)
-
-        domains  = JSON.parse(response.body).dig("result") || []
-        verified = domains.find { |d| d["verified"] == true || d["status"] == "verified" }
-        return nil unless verified
-
-        domain = verified["name"] || verified["domain"]
-        domain.to_s.empty? ? nil : "test@#{domain}"
-      rescue StandardError
-        nil
-      end
     end
   end
 end

data/lib/cloudflare/email/signing.rb

@@ -4,8 +4,8 @@ require "openssl"
 module Cloudflare
   module Email
     # Shared cryptographic helpers: HMAC-SHA256, constant-time compare,
-    # base64url encoding. Used by Verification (ingress HMAC) and
-    # SecureMessageId (signed Message-IDs). Keeps every crypto primitive in
+    # base64url encoding. Used by Verification and authenticated envelopes.
+    # Keeps every crypto primitive in
     # one place so the hash algorithm, encoding choice, and compare function
     # can't drift between call sites.
     module Signing

data/lib/cloudflare/email/tenancy.rb

@@ -0,0 +1,78 @@
+require "cloudflare/email/error"
+
+module Cloudflare
+  module Email
+    # An adapter boundary: the host owns tenant discovery and connection switching.
+    # Configure once, before requiring any optional Active Record models.
+    module Tenancy
+      CONTEXT_KEY = :cloudflare_email_tenant_key
+
+      class << self
+        def configure(base_class:, switch:, current:)
+          raise ConfigurationError, "configure tenancy before loading Cloudflare Email models" if @models_loaded
+          raise ConfigurationError, "tenancy is already configured" if enabled?
+          unless base_class.is_a?(Class) && base_class.respond_to?(:abstract_class?) && base_class.abstract_class?
+            raise ConfigurationError, "base_class must be an abstract Active Record class"
+          end
+          unless switch.respond_to?(:call) && current.respond_to?(:call)
+            raise ConfigurationError, "switch and current must be callable"
+          end
+
+          @base_class, @switch, @current = base_class, switch, current
+          self
+        end
+
+        def enabled?
+          !@switch.nil?
+        end
+
+        def model_base(default)
+          @models_loaded = true
+          @base_class || default
+        end
+
+        def current_key
+          Thread.current[CONTEXT_KEY]
+        end
+
+        # Only trusted host integration code should use this to capture new work.
+        # Model access and persisted job deserialization still require explicit
+        # gem context; the adapter must not invent a default tenant here.
+        def host_current_key
+          return unless enabled?
+          key = @current.call
+          normalize_key(key) unless key.nil?
+        end
+
+        def normalize_key(key)
+          unless key.is_a?(String) && !key.empty? && key == key.strip && !key.match?(/[[:cntrl:]]/)
+            raise ConfigurationError, "tenant key must be a nonempty string without surrounding whitespace or control characters"
+          end
+          key.dup.freeze
+        end
+
+        def require_context!
+          key = current_key
+          raise ConfigurationError, "an explicit Cloudflare Email tenant context is required" unless key
+          if enabled? && @current.call != key
+            raise ConfigurationError, "host database tenant does not match Cloudflare Email tenant context"
+          end
+          key
+        end
+
+        def with(key)
+          key = normalize_key(key)
+          previous = current_key
+          run = proc do
+            Thread.current[CONTEXT_KEY] = key
+            require_context!
+            yield
+          ensure
+            Thread.current[CONTEXT_KEY] = previous
+          end
+          enabled? ? @switch.call(key, &run) : run.call
+        end
+      end
+    end
+  end
+end

data/lib/cloudflare/email/tenant_job_context.rb

@@ -0,0 +1,90 @@
+require "cloudflare/email/tenancy"
+
+module Cloudflare
+  module Email
+    # Opt in with `prepend Cloudflare::Email::TenantJobContext` on jobs whose
+    # arguments or work reference tenant records. Queue payloads must be trusted.
+    module TenantJobContext
+      PAYLOAD_KEY = "cloudflare_email_tenant_key".freeze
+
+      def serialize
+        key = cloudflare_email_job_tenant_key
+        return super unless key
+        Tenancy.with(key) do
+          payload = super
+          verify_cloudflare_email_host_tenant!(key, payload["tenant"])
+          payload.merge(PAYLOAD_KEY => key)
+        end
+      end
+
+      def deserialize(job_data)
+        # Bind before super: host job integrations may deserialize model arguments
+        # eagerly. Never infer a missing tenant from the worker's ambient context.
+        if !job_data.key?(PAYLOAD_KEY) && cloudflare_email_optional_job_context?
+          @cloudflare_email_job_tenant_key = nil
+          return super
+        end
+        @cloudflare_email_job_tenant_key = Tenancy.normalize_key(job_data[PAYLOAD_KEY])
+        verify_cloudflare_email_host_tenant!(@cloudflare_email_job_tenant_key, job_data["tenant"])
+        Tenancy.with(@cloudflare_email_job_tenant_key) { super }
+      end
+
+      def perform_now
+        # Active Job resolves GlobalIDs before around_perform, so that callback
+        # cannot safely implement database tenant selection.
+        key = cloudflare_email_job_tenant_key
+        return super unless key
+        if defined?(::ActiveRecord::Tenanted::Job) && respond_to?(:tenant)
+          verify_cloudflare_email_host_tenant!(key, tenant)
+        end
+        Tenancy.with(key) { super }
+      end
+
+      def self.install_framework_jobs!
+        if defined?(::ActionMailbox)
+          %i[RoutingJob IncinerationJob].each do |name|
+            next unless ::ActionMailbox.const_defined?(name)
+            klass = ::ActionMailbox.const_get(name)
+            klass.define_singleton_method(:cloudflare_email_optional_job_context?) { !Tenancy.enabled? }
+            klass.prepend(self) unless klass.ancestors.include?(self)
+          end
+        end
+        if defined?(::ActiveStorage)
+          %i[BaseJob AnalyzeJob PurgeJob MirrorJob TransformJob PreviewImageJob].each do |name|
+            next unless ::ActiveStorage.const_defined?(name)
+            klass = ::ActiveStorage.const_get(name)
+            klass.define_singleton_method(:cloudflare_email_optional_job_context?) { !Tenancy.enabled? }
+            klass.prepend(self) unless klass.ancestors.include?(self)
+          end
+        end
+      end
+
+      private
+
+      def cloudflare_email_job_tenant_key
+        # Once serialized/deserialized, retries retain their original tenant even
+        # if re-enqueued from a different tenant or outside a tenant context.
+        return @cloudflare_email_job_tenant_key if instance_variable_defined?(:@cloudflare_email_job_tenant_key)
+        return nil if cloudflare_email_optional_job_context? && !Tenancy.current_key
+        # Native uploads/mailbox work may originate in the host's own with_tenant
+        # block. Framework jobs can capture that trusted context on first use.
+        # deserialize never takes this path for missing persisted metadata.
+        if !Tenancy.current_key && self.class.respond_to?(:cloudflare_email_optional_job_context?)
+          key = Tenancy.host_current_key
+          return @cloudflare_email_job_tenant_key = key if key
+        end
+        @cloudflare_email_job_tenant_key = Tenancy.require_context!
+      end
+
+      def cloudflare_email_optional_job_context?
+        self.class.respond_to?(:cloudflare_email_optional_job_context?) && self.class.cloudflare_email_optional_job_context?
+      end
+
+      def verify_cloudflare_email_host_tenant!(key, host_key)
+        if host_key && host_key != key
+          raise ConfigurationError, "job host tenant conflicts with Cloudflare Email tenant context"
+        end
+      end
+    end
+  end
+end

data/lib/cloudflare/email/verification.rb

@@ -1,4 +1,5 @@
 require "cloudflare/email/signing"
+require "cloudflare/email/envelope"
 
 module Cloudflare
   module Email
@@ -6,17 +7,38 @@ module Cloudflare
     # Cloudflare Email Worker. Pure-Ruby and Rails-free so it can be
     # unit-tested in isolation.
     #
-    # Worker signs: HMAC-SHA256(secret, "{timestamp}.{raw_body}")
+    # Worker signs: HMAC-SHA256(secret, "v2.{timestamp}.{encoded_envelope}.{raw_body}")
     # Worker sends:
     #   X-CF-Email-Timestamp: <unix seconds>
     #   X-CF-Email-Signature: <hex digest>
+    #   X-CF-Email-Signature-Version: 2
+    #   X-CF-Email-Envelope: <unpadded base64url JSON from/to>
+    # The version and authenticated SMTP envelope are required.
     module Verification
       DEFAULT_WINDOW = 5 * 60 # seconds
 
       # Returns :ok, :bad_signature, or :stale.
       # Returns :bad_signature for any malformed input.
-      def self.verify(secret:, body:, timestamp:, signature:, window: DEFAULT_WINDOW, now: Time.now.to_i)
-        return :bad_signature if blank?(secret) || blank?(body) || blank?(timestamp) || blank?(signature)
+      def self.verify(secret:, body:, timestamp:, signature:, version: nil, envelope: nil, window: DEFAULT_WINDOW, now: Time.now.to_i)
+        return :bad_signature if blank?(body)
+        timestamp = timestamp.to_s if timestamp.is_a?(Integer)
+        preflight = verify_headers(secret: secret, timestamp: timestamp, signature: signature,
+          version: version, envelope: envelope, window: window, now: now)
+        return preflight unless preflight == :ok
+
+        expected = sign(secret: secret, body: body, timestamp: Integer(timestamp, 10), version: version, envelope: envelope)
+        return :bad_signature unless Signing.secure_compare(expected, signature)
+
+        :ok
+      end
+
+      # Reject malformed/stale requests before the controller reads MIME bytes.
+      # This is only a preflight: authentication still requires verify(body: ...).
+      def self.verify_headers(secret:, timestamp:, signature:, version:, envelope:, window: DEFAULT_WINDOW, now: Time.now.to_i)
+        return :bad_signature if blank?(secret)
+        return :bad_signature unless timestamp.is_a?(String) && /\A[0-9]{1,20}\z/.match?(timestamp)
+        return :bad_signature unless signature.is_a?(String) && /\A[0-9a-f]{64}\z/.match?(signature)
+        return :bad_signature unless version == "2" && Envelope.decode(envelope)
 
         ts = begin
           Integer(timestamp.to_s, 10)
@@ -26,14 +48,14 @@ module Cloudflare
 
         return :stale if (now - ts).abs > window
 
-        expected = Signing.hmac_hex(secret, "#{ts}.#{body}")
-        return :bad_signature unless Signing.secure_compare(expected, signature.to_s)
-
         :ok
       end
 
-      def self.sign(secret:, body:, timestamp:)
-        Signing.hmac_hex(secret, "#{timestamp}.#{body}")
+      def self.sign(secret:, body:, timestamp:, envelope:, version: "2")
+        raise ArgumentError, "unsupported signature version" unless version == "2"
+        raise ArgumentError, "invalid SMTP envelope" unless Envelope.decode(envelope)
+        prefix = "v2.#{timestamp}.#{envelope}."
+        Signing.hmac_hex(secret, prefix.b + body.b)
       end
 
       def self.blank?(v)

data/lib/cloudflare/email/version.rb

@@ -1,5 +1,5 @@
 module Cloudflare
   module Email
-    VERSION = "0.1.0"
+    VERSION = "0.2.0"
   end
 end

data/lib/cloudflare/email/worker_deployer.rb

@@ -1,6 +1,7 @@
 require "net/http"
 require "json"
 require "securerandom"
+require "cloudflare/email/endpoint"
 
 module Cloudflare
   module Email
@@ -19,7 +20,7 @@ module Cloudflare
     #   deployer.put_secret("RAILS_INGRESS_URL", "https://...")
     class WorkerDeployer
       SCRIPT_NAME_PREFIX         = "cloudflare-email-ingress".freeze
-      DEFAULT_COMPATIBILITY_DATE = "2026-04-01".freeze
+      DEFAULT_COMPATIBILITY_DATE = "2026-09-10".freeze
       API_BASE                   = "https://api.cloudflare.com/client/v4".freeze
 
       attr_reader :script_name
@@ -49,7 +50,7 @@ module Cloudflare
         @api_token          = api_token
         @script_name        = script_name
         @compatibility_date = compatibility_date
-        @api_base           = api_base
+        @api_base           = Endpoint.parse(api_base).to_s.delete_suffix("/")
       end
 
       # Uploads/updates the Worker script. Accepts either `script_path:` (a
@@ -71,6 +72,7 @@ module Cloudflare
 
       # Set/update a Worker secret.
       def put_secret(name, value)
+        Endpoint.parse(value) if name.to_s == "RAILS_INGRESS_URL"
         request(
           method: :put,
           path:   "/accounts/#{@account_id}/workers/scripts/#{@script_name}/secrets",
@@ -160,7 +162,7 @@ module Cloudflare
         status = response.code.to_i
         body   = parse(response.body)
 
-        return body if status.between?(200, 299)
+        return body if status.between?(200, 299) && body.is_a?(Hash) && body["success"] == true
 
         errors  = body.is_a?(Hash) ? Array(body["errors"]) : []
         message = errors.map { |e| e.is_a?(Hash) ? e["message"] : e.to_s }.compact.join("; ")

data/lib/cloudflare-email.rb

@@ -2,8 +2,11 @@ require "cloudflare/email/version"
 require "cloudflare/email/error"
 require "cloudflare/email/response"
 require "cloudflare/email/signing"
+require "cloudflare/email/envelope"
 require "cloudflare/email/credentials"
 require "cloudflare/email/client"
-require "cloudflare/email/secure_message_id"
+require "cloudflare/email/message_id"
+require "cloudflare/email/delivery_event"
+require "cloudflare/email/event_consumer"
 
 require "cloudflare/email/engine" if defined?(::Rails::Engine)