cloudflare-email 0.1.0 → 0.2.0

data/templates/worker/package.json

@@ -1,15 +1,18 @@
 {
   "name": "cloudflare-email-ingress",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": true,
+  "type": "module",
+  "engines": { "node": "^22.12.0 || ^24.0.0 || >=26.0.0" },
   "description": "Cloudflare Email Worker that forwards inbound mail to a Rails ActionMailbox ingress (HMAC-signed).",
   "scripts": {
-    "deploy": "wrangler deploy",
-    "dev": "wrangler dev",
+    "deploy": "node scripts/wrangler.mjs deploy",
+    "dev": "node scripts/wrangler.mjs dev",
+    "check": "wrangler deploy --env development --dry-run",
     "test": "vitest run"
   },
   "devDependencies": {
-    "vitest": "^3.2.0",
-    "wrangler": "^4.0.0"
+    "vitest": "^5.0.0",
+    "wrangler": "^4.131.0"
   }
 }

data/templates/worker/scripts/wrangler.mjs

@@ -0,0 +1,16 @@
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const [command, ...args] = process.argv.slice(2);
+const envIndex = args.indexOf("--env");
+const environment = args[envIndex + 1];
+if (envIndex < 0 || !["development", "staging", "production"].includes(environment)) {
+  console.error("Specify --env development, --env staging, or --env production.");
+  process.exit(1);
+}
+const result = spawnSync(process.execPath, [
+  fileURLToPath(new URL("../node_modules/wrangler/bin/wrangler.js", import.meta.url)),
+  command, ...args,
+], { stdio: "inherit" });
+if (result.error) console.error(result.error.message);
+process.exit(result.status ?? 1);

data/templates/worker/src/index.js

@@ -2,7 +2,7 @@
  * Cloudflare Email Worker → Rails ActionMailbox ingress.
  *
  * Receives mail via Cloudflare Email Routing, signs the raw RFC822 with
- * HMAC-SHA256 over "{timestamp}.{raw_body}", and POSTs it to the Rails
+ * HMAC-SHA256 over "v2.{timestamp}.{encoded_envelope}.{raw_body}", and POSTs it to the Rails
  * ingress controller shipped with the cloudflare-email gem.
  *
  * Required environment variables (set via `wrangler secret put` OR the
@@ -33,6 +33,48 @@ async function sign(secret, data) {
   return toHex(sig);
 }
 
+function validAddress(address, allowEmpty = false) {
+  if (typeof address !== "string" || address.length > 254 || /[^\x21-\x7E]/.test(address)) return false;
+  if (allowEmpty && address === "") return true;
+  const parts = address.split("@");
+  if (parts.length !== 2) return false;
+  const [local, domain] = parts;
+  return local.length <= 64 && /^[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+$/.test(local) &&
+    !local.startsWith(".") && !local.endsWith(".") && !local.includes("..") &&
+    domain.split(".").every(label => /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(label));
+}
+
+function validIngressUrl(value) {
+  try {
+    const url = new URL(value);
+    const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+    return !url.username && !url.password && !url.hash &&
+      (url.protocol === "https:" || (url.protocol === "http:" && loopback));
+  } catch { return false; }
+}
+
+async function readBounded(stream, limit) {
+  const reader = stream.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > limit) {
+        await reader.cancel();
+        throw new Error("message exceeds size limit");
+      }
+      chunks.push(value);
+    }
+  } finally { reader.releaseLock(); }
+  const raw = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) { raw.set(chunk, offset); offset += chunk.byteLength; }
+  return raw;
+}
+
 export default {
   async email(message, env) {
     if (!env.RAILS_INGRESS_URL || !env.INGRESS_SECRET) {
@@ -40,10 +82,38 @@ export default {
       return;
     }
 
-    const raw = new Uint8Array(await new Response(message.raw).arrayBuffer());
+    if (!validIngressUrl(env.RAILS_INGRESS_URL)) {
+      message.setReject("worker requires an HTTPS ingress URL (HTTP allowed only for loopback)");
+      return;
+    }
+    const limit = env.MAX_EMAIL_BYTES === undefined ? 25 * 1024 * 1024 : Number(env.MAX_EMAIL_BYTES);
+    if (!Number.isSafeInteger(limit) || limit <= 0) {
+      message.setReject("worker MAX_EMAIL_BYTES must be a positive integer");
+      return;
+    }
+    if (message.rawSize > limit) {
+      message.setReject("message exceeds size limit");
+      return;
+    }
+
+    if (!validAddress(message.from, true) || !validAddress(message.to)) {
+      message.setReject("worker received invalid SMTP envelope");
+      return;
+    }
+    // Routing metadata comes from the SMTP envelope, never from MIME headers.
+    const envelope = btoa(JSON.stringify({ from: message.from, to: message.to }))
+      .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+
+    let raw;
+    try {
+      raw = await readBounded(message.raw, limit);
+    } catch {
+      message.setReject("message exceeds size limit or could not be read");
+      return;
+    }
     const ts = Math.floor(Date.now() / 1000).toString();
 
-    const tsBytes = new TextEncoder().encode(`${ts}.`);
+    const tsBytes = new TextEncoder().encode(`v2.${ts}.${envelope}.`);
     const signedPayload = new Uint8Array(tsBytes.length + raw.length);
     signedPayload.set(tsBytes, 0);
     signedPayload.set(raw, tsBytes.length);
@@ -51,6 +121,8 @@ export default {
     const signature = await sign(env.INGRESS_SECRET, signedPayload);
 
     let res;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 15_000);
     try {
       res = await fetch(env.RAILS_INGRESS_URL, {
         method: "POST",
@@ -58,12 +130,19 @@ export default {
           "Content-Type": "message/rfc822",
           "X-CF-Email-Timestamp": ts,
           "X-CF-Email-Signature": signature,
+          "X-CF-Email-Signature-Version": "2",
+          "X-CF-Email-Envelope": envelope,
         },
         body: raw,
+        signal: controller.signal,
+        // Workers supports follow/manual; non-2xx handling below rejects redirects.
+        redirect: "manual",
       });
     } catch (err) {
-      message.setReject(`upstream fetch failed: ${err.message}`);
+      message.setReject(controller.signal.aborted ? "upstream fetch timed out" : "upstream fetch failed");
       return;
+    } finally {
+      clearTimeout(timeout);
     }
 
     if (!res.ok) {

data/templates/worker/test/index.test.ts

@@ -19,9 +19,9 @@ function makeMessage(raw: string) {
   };
 }
 
-async function verifyHmac(secret: string, ts: string, body: ArrayBuffer, hex: string) {
+async function verifyHmac(secret: string, ts: string, envelope: string, body: ArrayBuffer, hex: string) {
   const enc = new TextEncoder();
-  const prefix = enc.encode(`${ts}.`);
+  const prefix = enc.encode(`v2.${ts}.${envelope}.`);
   const signed = new Uint8Array(prefix.length + body.byteLength);
   signed.set(prefix, 0);
   signed.set(new Uint8Array(body), prefix.length);
@@ -51,11 +51,13 @@ describe("cloudflare-email Worker", () => {
 
   beforeEach(() => {
     fetchSpy = vi.fn(async () => new Response("", { status: 200 }));
-    globalThis.fetch = fetchSpy as unknown as typeof fetch;
+    vi.stubGlobal("fetch", fetchSpy);
   });
 
   afterEach(() => {
     vi.restoreAllMocks();
+    vi.unstubAllGlobals();
+    vi.useRealTimers();
   });
 
   it("POSTs raw MIME with HMAC signature and timestamp", async () => {
@@ -71,6 +73,11 @@ describe("cloudflare-email Worker", () => {
     expect(opts.headers["Content-Type"]).toBe("message/rfc822");
     const ts = opts.headers["X-CF-Email-Timestamp"];
     const sig = opts.headers["X-CF-Email-Signature"];
+    const envelope = opts.headers["X-CF-Email-Envelope"];
+    expect(opts.headers["X-CF-Email-Signature-Version"]).toBe("2");
+    expect(JSON.parse(atob(envelope.replace(/-/g, "+").replace(/_/g, "/")))).toEqual({
+      from: "sender@external.test", to: "inbox@trial.test",
+    });
     expect(ts).toMatch(/^\d+$/);
     expect(sig).toMatch(/^[0-9a-f]{64}$/);
 
@@ -79,10 +86,50 @@ describe("cloudflare-email Worker", () => {
     expect(new TextDecoder().decode(sentBytes)).toBe(RAW);
 
     // And the signature verifies against the input.
-    const ok = await verifyHmac(SECRET, ts, sentBytes.buffer, sig);
+    const ok = await verifyHmac(SECRET, ts, envelope, sentBytes.buffer, sig);
     expect(ok).toBe(true);
   });
 
+  it.each(["http://rails.test/inbound", "https://user:password@rails.test/inbound", "https://rails.test/inbound#fragment", "invalid"])(
+    "rejects invalid ingress URL %j before reading mail", async (url) => {
+      const { message, rejects } = makeMessage(RAW);
+      await worker.email(message as any, { RAILS_INGRESS_URL: url, INGRESS_SECRET: SECRET });
+      expect(rejects).toHaveLength(1);
+      expect(fetchSpy).not.toHaveBeenCalled();
+      expect(message.raw.locked).toBe(false);
+    },
+  );
+
+  it("allows loopback HTTP for local verification", async () => {
+    const { message, rejects } = makeMessage(RAW);
+    await worker.email(message as any, { RAILS_INGRESS_URL: "http://127.0.0.1:3000/inbound", INGRESS_SECRET: SECRET });
+    expect(rejects).toEqual([]);
+    expect(fetchSpy).toHaveBeenCalledOnce();
+  });
+
+  it("accepts mail at the configured size boundary", async () => {
+    const { message, rejects } = makeMessage(RAW);
+    await worker.email(message as any, { RAILS_INGRESS_URL: URL_, INGRESS_SECRET: SECRET, MAX_EMAIL_BYTES: String(message.rawSize) });
+    expect(rejects).toEqual([]);
+    expect(fetchSpy).toHaveBeenCalledOnce();
+  });
+
+  it.each([true, false])("enforces size limit with accurate rawSize=%j", async (accurate) => {
+    const { message, rejects } = makeMessage(RAW);
+    if (!accurate) message.rawSize = 0;
+    await worker.email(message as any, { RAILS_INGRESS_URL: URL_, INGRESS_SECRET: SECRET, MAX_EMAIL_BYTES: "16" });
+    expect(rejects).toHaveLength(1);
+    expect(rejects[0]).toMatch(/size limit/);
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("rejects invalid size configuration", async () => {
+    const { message, rejects } = makeMessage(RAW);
+    await worker.email(message as any, { RAILS_INGRESS_URL: URL_, INGRESS_SECRET: SECRET, MAX_EMAIL_BYTES: "0" });
+    expect(rejects).toHaveLength(1);
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
   it("rejects the message when upstream returns non-2xx", async () => {
     fetchSpy.mockResolvedValueOnce(new Response("server error", { status: 503 }));
     const env = { RAILS_INGRESS_URL: URL_, INGRESS_SECRET: SECRET };
@@ -93,6 +140,39 @@ describe("cloudflare-email Worker", () => {
     expect(rejects).toEqual(["upstream returned 503"]);
   });
 
+  it("authenticates SMTP recipients independently of sender-controlled To headers", async () => {
+    vi.spyOn(Date, "now").mockReturnValue(1_750_000_000_000);
+    const env = { RAILS_INGRESS_URL: URL_, INGRESS_SECRET: SECRET };
+    await worker.email(makeMessage(RAW).message as any, env);
+    const other = makeMessage(RAW);
+    other.message.to = "bcc@trial.test";
+    await worker.email(other.message as any, env);
+    const first = fetchSpy.mock.calls[0][1];
+    const second = fetchSpy.mock.calls[1][1];
+    expect(second.body).toEqual(first.body);
+    expect(second.headers["X-CF-Email-Signature"]).not.toBe(first.headers["X-CF-Email-Signature"]);
+    expect(await verifyHmac(SECRET, first.headers["X-CF-Email-Timestamp"], second.headers["X-CF-Email-Envelope"],
+      first.body.buffer, first.headers["X-CF-Email-Signature"])).toBe(false);
+  });
+
+  it("allows the empty SMTP reverse path used by bounce messages", async () => {
+    const { message, rejects } = makeMessage(RAW);
+    message.from = "";
+    await worker.email(message as any, { RAILS_INGRESS_URL: URL_, INGRESS_SECRET: SECRET });
+    expect(rejects).toEqual([]);
+    expect(fetchSpy).toHaveBeenCalledOnce();
+  });
+
+  it.each(["", "Name <recipient@test.example>", "bad\r\n@test.example", "bad\n@test.example", "x@test.example\n", "x@-bad.example", "x@bad..example", "a".repeat(65) + "@example.com"])(
+    "rejects invalid SMTP recipient %j before posting", async (address) => {
+      const { message, rejects } = makeMessage(RAW);
+      message.to = address;
+      await worker.email(message as any, { RAILS_INGRESS_URL: URL_, INGRESS_SECRET: SECRET });
+      expect(rejects).toEqual(["worker received invalid SMTP envelope"]);
+      expect(fetchSpy).not.toHaveBeenCalled();
+    },
+  );
+
   it("rejects the message when RAILS_INGRESS_URL is missing", async () => {
     const env = { RAILS_INGRESS_URL: "", INGRESS_SECRET: SECRET };
     const { message, rejects } = makeMessage(RAW);
@@ -120,7 +200,39 @@ describe("cloudflare-email Worker", () => {
 
     await worker.email(message as any, env);
 
-    expect(rejects[0]).toMatch(/upstream fetch failed: DNS fail/);
+    expect(rejects).toEqual(["upstream fetch failed"]);
+  });
+
+  it("aborts a stalled ingress request after 15 seconds", async () => {
+    vi.useFakeTimers();
+    fetchSpy.mockImplementationOnce((_url, options) => new Promise((_resolve, reject) => {
+      options.signal.addEventListener("abort", () => reject(new Error("aborted")));
+    }));
+    const { message, rejects } = makeMessage(RAW);
+    const delivery = worker.email(message as any, { RAILS_INGRESS_URL: URL_, INGRESS_SECRET: SECRET });
+    // Signing uses async Web Crypto, so wait until fetch starts before advancing timers.
+    await vi.waitFor(() => expect(fetchSpy).toHaveBeenCalledOnce());
+    await vi.advanceTimersByTimeAsync(15_000);
+    await delivery;
+    expect(fetchSpy.mock.calls[0][1].signal.aborted).toBe(true);
+    expect(rejects).toEqual(["upstream fetch timed out"]);
+  });
+
+  it("refuses redirects and clears the timeout after delivery", async () => {
+    vi.useFakeTimers();
+    await worker.email(makeMessage(RAW).message as any, { RAILS_INGRESS_URL: URL_, INGRESS_SECRET: SECRET });
+    const options = fetchSpy.mock.calls[0][1];
+    expect(options.redirect).toBe("manual");
+    await vi.advanceTimersByTimeAsync(15_000);
+    expect(options.signal.aborted).toBe(false);
+  });
+
+  it("rejects an ingress redirect response", async () => {
+    fetchSpy.mockResolvedValueOnce(new Response(null, { status: 302, headers: { Location: "https://other.test" } }));
+    const { message, rejects } = makeMessage(RAW);
+    await worker.email(message as any, { RAILS_INGRESS_URL: URL_, INGRESS_SECRET: SECRET });
+    expect(rejects).toEqual(["upstream returned 302"]);
+    expect(fetchSpy).toHaveBeenCalledOnce();
   });
 
   it("signature covers tampered bodies differently", async () => {

data/templates/worker/wrangler.toml

@@ -1,10 +1,19 @@
-name = "cloudflare-email-ingress"
+name = "cloudflare-email-ingress-unconfigured"
 main = "src/index.js"
-compatibility_date = "2026-04-01"
+compatibility_date = "2026-09-10"
 
-# Required secrets (set via `wrangler secret put`):
+[env.development]
+name = "cloudflare-email-ingress-development"
+
+[env.staging]
+name = "cloudflare-email-ingress-staging"
+
+[env.production]
+name = "cloudflare-email-ingress-production"
+
+# Required secrets (set via `npx wrangler secret put NAME --env production`):
 #   RAILS_INGRESS_URL  - https://your-rails-app.example.com/rails/action_mailbox/cloudflare/inbound_emails
 #   INGRESS_SECRET     - shared secret matching cloudflare.ingress_secret in Rails credentials
 
 # After deploying, in the Cloudflare dashboard:
-#   Email Routing -> Routes -> "Send to a Worker" -> select cloudflare-email-ingress
+#   Email Routing -> Routes -> "Send to a Worker" -> select the matching environment Worker

metadata

@@ -1,14 +1,34 @@
 --- !ruby/object:Gem::Specification
 name: cloudflare-email
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Cole
 bindir: bin
 cert_chain: []
-date: 2026-04-18 00:00:00.000000000 Z
+date: 2026-09-11 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
@@ -57,7 +77,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: 7.2.3.2
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -67,7 +87,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: 7.2.3.2
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -85,6 +105,26 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.1'
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 description: A Ruby client and Rails integration for Cloudflare's Email Service. Send
   mail via an ActionMailer delivery method, receive mail via an ActionMailbox ingress
   backed by a shipped Cloudflare Email Worker template.
@@ -97,33 +137,94 @@ files:
 - CHANGELOG.md
 - LICENSE.txt
 - README.md
+- SECURITY.md
 - app/controllers/cloudflare/email/ingress_controller.rb
+- docs/activerecord-tenanted.md
+- docs/architecture.md
+- docs/delivery-events.md
+- docs/features.md
+- docs/getting-started.md
+- docs/mailboxes.md
+- docs/outbox.md
+- docs/tenant-mailboxes-plan.md
+- docs/thread-correlation.md
+- docs/troubleshooting.md
+- docs/upgrading-0.2.md
+- docs/verification/2026-09-10-followup.md
+- docs/verification/2026-09-10-install-upgrade.md
+- docs/verification/2026-09-10-live.md
+- docs/verification/2026-09-10.md
+- docs/verification/2026-09-11-extraction.md
+- docs/verification/2026-09-11-outbound-ledger.md
+- docs/verification/2026-09-11-security.md
+- docs/verification/2026-09-11-tenant-mailboxes.md
+- examples/plain_ruby.rb
 - lib/cloudflare-email.rb
+- lib/cloudflare/email/active_record.rb
+- lib/cloudflare/email/active_record/base.rb
+- lib/cloudflare/email/active_record/delivery_events.rb
+- lib/cloudflare/email/active_record/event_inbox.rb
+- lib/cloudflare/email/active_record/event_receipt.rb
+- lib/cloudflare/email/active_record/mail_snapshot.rb
+- lib/cloudflare/email/active_record/outbound_delivery.rb
+- lib/cloudflare/email/active_record/outbound_recipient.rb
+- lib/cloudflare/email/active_record/outbound_reconciliation.rb
+- lib/cloudflare/email/active_record/outbox.rb
+- lib/cloudflare/email/active_record/outbox_notifications.rb
 - lib/cloudflare/email/client.rb
+- lib/cloudflare/email/consume_events_task.rb
 - lib/cloudflare/email/credentials.rb
+- lib/cloudflare/email/delivery_event.rb
 - lib/cloudflare/email/delivery_method.rb
 - lib/cloudflare/email/deploy_worker_task.rb
+- lib/cloudflare/email/dev_ingress_guard.rb
 - lib/cloudflare/email/dev_tunnel.rb
 - lib/cloudflare/email/doctor.rb
+- lib/cloudflare/email/endpoint.rb
 - lib/cloudflare/email/engine.rb
+- lib/cloudflare/email/envelope.rb
 - lib/cloudflare/email/error.rb
+- lib/cloudflare/email/event_consumer.rb
+- lib/cloudflare/email/mailboxes.rb
+- lib/cloudflare/email/mailboxes/configuration.rb
+- lib/cloudflare/email/mailboxes/events.rb
+- lib/cloudflare/email/mailboxes/inbound_retention.rb
+- lib/cloudflare/email/mailboxes/jobs.rb
+- lib/cloudflare/email/mailboxes/models.rb
+- lib/cloudflare/email/mailboxes/provider_correlation.rb
+- lib/cloudflare/email/mailboxes/service.rb
+- lib/cloudflare/email/mailboxes/shared_event_receipt.rb
+- lib/cloudflare/email/message_id.rb
 - lib/cloudflare/email/provision_catchall_task.rb
 - lib/cloudflare/email/provision_route_task.rb
+- lib/cloudflare/email/replay_events_job.rb
 - lib/cloudflare/email/response.rb
 - lib/cloudflare/email/routing_provisioner.rb
-- lib/cloudflare/email/secure_message_id.rb
+- lib/cloudflare/email/send_job.rb
 - lib/cloudflare/email/send_test.rb
 - lib/cloudflare/email/signing.rb
 - lib/cloudflare/email/task_base.rb
+- lib/cloudflare/email/tenancy.rb
+- lib/cloudflare/email/tenant_job_context.rb
 - lib/cloudflare/email/verification.rb
 - lib/cloudflare/email/version.rb
 - lib/cloudflare/email/worker_deployer.rb
 - lib/generators/cloudflare/email/install_generator.rb
+- lib/generators/cloudflare/email/mailboxes/mailboxes_generator.rb
+- lib/generators/cloudflare/email/mailboxes/templates/create_cloudflare_email_mailboxes.rb
+- lib/generators/cloudflare/email/mailboxes/templates/create_cloudflare_email_receiving_domains.rb
+- lib/generators/cloudflare/email/mailboxes/templates/create_cloudflare_email_shared_events.rb
+- lib/generators/cloudflare/email/outbox/outbox_generator.rb
+- lib/generators/cloudflare/email/outbox/templates/create_cloudflare_email_outbox.rb
 - lib/generators/cloudflare/email/templates/initializer.rb
 - lib/generators/cloudflare/email/templates/main_mailbox.rb
+- lib/generators/cloudflare/email/tracking/templates/create_cloudflare_email_event_receipts.rb
+- lib/generators/cloudflare/email/tracking/tracking_generator.rb
 - lib/tasks/cloudflare_email.rake
 - templates/worker/README.md
+- templates/worker/package-lock.json
 - templates/worker/package.json
+- templates/worker/scripts/wrangler.mjs
 - templates/worker/src/index.js
 - templates/worker/test/index.test.ts
 - templates/worker/vitest.config.ts
@@ -142,7 +243,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.1'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="

data/lib/cloudflare/email/secure_message_id.rb

@@ -1,89 +0,0 @@
-require "json"
-require "cloudflare/email/signing"
-
-module Cloudflare
-  module Email
-    # Signed outbound Message-IDs for reply authentication.
-    #
-    # Sign the outbound Message-ID with HMAC-SHA256. The recipient's reply
-    # naturally carries the signed id in `In-Reply-To:`, which your mailbox
-    # verifies and decodes to recover the original thread state.
-    #
-    # See README's "Signed replies" section for a full usage example.
-    module SecureMessageId
-      InvalidToken = Class.new(Cloudflare::Email::Error)
-
-      DEFAULT_PREFIX  = "msg".freeze
-      DEFAULT_MAX_AGE = 30 * 24 * 60 * 60   # 30 days
-      EPOCH_OFFSET    = Time.utc(2026, 1, 1).to_i.freeze
-
-      class << self
-        # Build a signed Message-ID carrying `payload`. Returns the bare
-        # Message-ID without angle brackets — SMTP/Mail adds them.
-        def encode(payload:, domain:, secret:, prefix: DEFAULT_PREFIX, now: Time.now.to_i)
-          raise ArgumentError, "secret must not be empty" if secret.to_s.empty?
-          raise ArgumentError, "domain must not be empty" if domain.to_s.empty?
-
-          iat_offset = now.to_i - EPOCH_OFFSET
-          raise ArgumentError, "timestamp out of 32-bit range" if iat_offset.negative? || iat_offset >= (1 << 32)
-
-          packed = [iat_offset].pack("N") + JSON.generate(payload)
-          b64    = Signing.base64url_encode(packed)
-          mac    = Signing.hmac_hex(secret, b64)
-
-          "#{prefix}.#{b64}.#{mac}@#{domain}"
-        end
-
-        # Decode a Message-ID produced by encode. Accepts `<bracketed>` form
-        # too. Returns parsed payload or raises InvalidToken.
-        def decode(message_id, secret:, max_age: DEFAULT_MAX_AGE, now: Time.now.to_i)
-          raise InvalidToken, "message-id is empty" if message_id.to_s.empty?
-
-          id = strip_brackets(message_id.to_s).strip
-          local, domain = id.split("@", 2)
-          raise InvalidToken, "missing @ in message-id" unless local && domain
-
-          _prefix, b64, mac = local.split(".", 3)
-          raise InvalidToken, "malformed message-id" unless b64 && mac && !b64.empty? && !mac.empty?
-
-          expected = Signing.hmac_hex(secret, b64)
-          raise InvalidToken, "signature mismatch" unless Signing.secure_compare(expected, mac)
-
-          packed = begin
-            Signing.base64url_decode(b64)
-          rescue StandardError
-            raise InvalidToken, "base64 decode failed"
-          end
-          raise InvalidToken, "truncated packed bytes" if packed.bytesize < 4
-
-          iat_offset   = packed.byteslice(0, 4).unpack1("N")
-          iat          = iat_offset + EPOCH_OFFSET
-          payload_json = packed.byteslice(4..)
-
-          raise InvalidToken, "token expired"                 if now - iat > max_age
-          raise InvalidToken, "token timestamp in the future" if iat - now > 5 * 60
-
-          JSON.parse(payload_json.to_s)
-        rescue JSON::ParserError
-          raise InvalidToken, "payload not valid JSON"
-        end
-
-        # Cheap heuristic — does this look like one of our signed Message-IDs?
-        def match?(message_id, prefix: DEFAULT_PREFIX)
-          id = strip_brackets(message_id.to_s).strip
-          local, domain = id.split("@", 2)
-          return false unless local && domain
-          p, b64, mac = local.split(".", 3)
-          return false unless p && b64 && mac
-          p == prefix && !b64.empty? && mac.match?(/\A[0-9a-f]{64}\z/)
-        end
-
-        private
-
-        def strip_brackets(s)
-          s.start_with?("<") && s.end_with?(">") ? s[1..-2] : s
-        end
-      end
-    end
-  end
-end