cloudflare-email 0.1.0 → 0.2.0

data/docs/verification/2026-09-11-extraction.md

@@ -0,0 +1,32 @@
+# Preproduction cleanup and reusable event receipts — September 11, 2026
+
+This pass removes v1 ingress and SecureMessageId, adds optional ActiveRecord event
+receipts, and extracts provider acceptance, message-ID normalization and delivery
+ordering helpers. See [architecture](../architecture.md) for the implemented
+boundary and the next outbound-ledger extraction.
+
+## Local checks
+
+| Check | Result |
+| --- | --- |
+| `bundle exec rake test`, Ruby 3.4.1 / Rails 8.1.3.1 | 189 tests, 635 assertions, no failures/errors/skips |
+| Durable event adapter subprocess included in suite | 13 SQLite tests, 56 assertions |
+| `bundle exec ruby script/verify_package.rb` | Isolated Ruby consumer and Rails package checks passed; 48 tests, 235 assertions |
+| `script/verification/install_upgrade.rb` under Ruby 4 / Rails 8.1 | 16 checks passed, including v1 rejection and v2 inbox routing |
+| Local actual workerd → Rails | 19 checks passed using Node 22.23.1 |
+
+Receipt tests exercise the generated migration, account-scoped database uniqueness,
+concurrent duplicate insertion, changed-payload rejection, commit-before-ACK,
+failed persistence preventing ACK, replay, savepoint/handler rollback, and explicit
+handler outcomes. Plain gem loading is checked without ActiveRecord.
+
+The Worker run verifies authenticated SMTP metadata, unchanged MIME and all 256
+binary byte values, same-recipient deduplication, separate Bcc recipient records,
+mailbox-job execution, secret mismatch, redirect rejection, and a real 15-second
+timeout. The first invocation found Node 20 on PATH and failed before Worker
+startup; rerunning with explicit installed Node 22.23.1 passed.
+
+These are local checks using synthetic mail, SQLite and controlled HTTP responses.
+No email was sent, no Worker deployed, and no RubyGem published in this pass.
+PostgreSQL locking and live delivery using this new adapter have not been verified.
+Earlier live reports remain evidence for their dated revisions only.

data/docs/verification/2026-09-11-outbound-ledger.md

@@ -0,0 +1,60 @@
+# Shared outbound ledger verification — September 11, 2026
+
+The optional Rails layer now owns immutable MIME preparation, account-scoped
+operation keys, committed send claims, recipient acceptance evidence, provider
+event projection, and audited reconciliation. The reference inbox consumes these
+tables and services rather than keeping its own transport ledger.
+
+## Local results
+
+| Check | Result |
+| --- | --- |
+| Gem suite, Ruby 3.4.1 / Rails 8.1.3.1 | 191 tests, 637 assertions, no failures/errors/skips |
+| Outbox subprocess included in suite | 21 SQLite tests, 112 assertions |
+| Mail snapshots, jobs, event projection subprocess | 9 SQLite tests, 45 assertions |
+| Existing receipt subprocess | 13 SQLite tests, 56 assertions |
+| Actual PostgreSQL 15 verifier | 9 tests, 45 assertions |
+| Packaged isolated Ruby + Rails install/ingress + outbound checks | 57 tests, 280 assertions; all passed |
+
+The top-level gem counts include subprocess assertions, not their individual
+inner assertions. PostgreSQL 16 verification is added to CI. The PostgreSQL
+driver remains an optional test dependency; the gem has no new runtime database
+or job dependencies for plain Ruby users.
+
+## Failure and concurrency coverage
+
+- Eight concurrent identical operations produce one stored snapshot and one
+  provider request. Conflicting snapshots cannot overwrite the winner.
+- Independent operations reach the controlled provider concurrently.
+- A real SIGKILL after the durable claim leaves the operation blocked after
+  restart. A real PostgreSQL backend termination plus simulated provider timeout
+  also preserves the non-retryable claim.
+- Acceptance followed by database failure does not permit another send.
+- Partial acceptance never resends the whole batch. Unknown recipients can be
+  reconciled independently while known lifecycle states remain intact.
+- Malformed IDs and conflicting per-recipient provider IDs become uncertainty;
+  a valid common ID on a later recipient entry is retained.
+- Event-before-response, duplicate callbacks, concurrent out-of-order events,
+  terminal guards, account mismatch and ambiguous IDs are exercised.
+- Application callback failure rolls back product and recipient writes while
+  retaining the receipt; replay applies it. A send-job retry repairs failed
+  product projection without another provider request.
+- MIME includes a binary attachment containing all 256 byte values and a hidden
+  Bcc envelope recipient. Jobs serialize only the account and operation key.
+- Reconciliation requires actor/reason/evidence and legal unresolved transitions.
+  Sending reconciliation requires a stopped sender confirmation and a minimum
+  claim age. Generated migrations refuse to delete safety evidence on rollback.
+
+## Boundaries
+
+HTTP acceptance and lifecycle payloads use controlled local fixtures. This pass
+does not send live mail, deploy a Worker, publish RubyGems, or prove inbox placement.
+Earlier Cloudflare live reports describe their own revisions. Provider-ID
+correlation assumes Cloudflare assigns unique IDs; pre-existing duplicate matches
+are retained as unmatched for review. The network and database remain separate
+transactions, and the system does not claim exactly-once provider delivery.
+
+The reference inbox has separate HTTP, browser, process-recovery and import
+verification recorded in its `docs/verification/2026-09-11-outbox.md`. Historical
+records preserve available content and audit data; reconstructed imported MIME
+is explicitly marked and is not claimed to reproduce historical wire bytes.

data/docs/verification/2026-09-11-security.md

@@ -0,0 +1,76 @@
+# Security review — 2026-09-11
+
+Reviewed the 0.2.0 gem at baseline `bd83e067938d5c8df5a7a2ced2cf2a74c3f58e06`
+and applied the hardening described below on `security/gem-hardening`.
+This was a defensive source review, dependency audit and local verification.
+No live penetration testing was performed and no production compromise was
+demonstrated. Prior live test reports describe different revisions.
+
+## Findings and fixes
+
+Priorities are contextual review judgments, not CVSS scores.
+
+| Priority | Finding and prerequisite | Remediation |
+| --- | --- | --- |
+| High | The development tunnel exposed the full Rails origin when enabled, including routes unrelated to email. | Force a dedicated origin Host and install a first-position development middleware that permits only the ingress POST. Refuse to start the tunnel unless the running server has the guard. |
+| High | The old Rails 7.1 test stack resolved dependencies with 12 advisory hits, including ActiveStorage CVE-2026-66066. Application exposure depends on its resolved dependencies and feature use. | Remove that unsupported matrix variant; raise Rails/SQLite test floors and audit resolved Ruby matrix locks in CI. Applications must update their own dependencies. |
+| Medium | Inbound MIME was read without an application bound, allowing large requests/messages to consume memory. Upstream limits determine reachability. | Default 25 MiB bound in Rails and Worker, declared-size checks and bounded stream reads. Reject malformed/stale signing headers before Rails reads the body. Full HMAC verification still follows the read. |
+| Medium | Operator-configured remote HTTP endpoints could transmit credentials or mail without TLS. | Require HTTPS for API and ingress endpoints, except literal loopback development hosts. Validate deploy configuration before remote mutations. Endpoint configuration remains trusted. |
+| Medium | Delivery-event validation omitted important field types; original receipt identity/payload could be changed through ordinary model updates. Requires malformed queue input or application writes. | Validate identifiers, recipient, timestamp, terminal boolean and optional detail objects; mark receipt evidence fields read-only. Preserve unknown schema-1 future event types without projecting an unknown lifecycle state. |
+| Low | Client inspection, retry warnings and generated mailbox logs could disclose tokens or private provider/mail details. | Redact client inspection and remove sensitive fields from those default logging paths. Raw errors/responses remain available to applications. |
+| Low | Provider acceptance helpers treated some malformed success fields or message IDs permissively. | Require explicit boolean success when present, successful HTTP status, valid string IDs and array-shaped recipient outcomes. |
+
+Reviewed HMAC v2/envelope handling, recipient-scoped deduplication, transport
+retries, event account/domain checks and ACK ordering, durable outbox claims,
+tenant/account correlation, evidence storage, deployment/generator behavior,
+package contents and CI permissions. No additional concrete authentication or
+claim-bypass finding was established in these paths; this is not proof that
+all defects are absent.
+
+## Verification
+
+Final Ruby behavior checks used Ruby 3.4.1 and Rails 8.1.3.1:
+
+- `bundle exec rake test`: **205 tests, 751 assertions**, no failures/errors/skips.
+  Includes real Rails subprocesses, SQLite receipts/outbox and development guard.
+- Worker `npm test`: **28 tests passed**, Node 22.23.1.
+- Worker `npm run check`: Wrangler deployment dry-run passed.
+- `script/verify_package.rb`: isolated plain Ruby consumer, packaged Rails
+  installation/ingress and durable outbound checks passed.
+- `script/verify_local_ingress.rb`: actual local workerd-to-Rails verification
+  passed, including exact MIME/binary attachment preservation, trusted envelope,
+  deduplication and separate recipients, routing, invalid/missing credentials,
+  refused redirects and a stalled upstream aborted after 15 seconds.
+  No real email was sent and no Worker was deployed by this run.
+- `bundler-audit 0.9.3`: no known vulnerabilities in the six supported locally
+  resolved lockfiles (default, local ingress, PostgreSQL, Rails 7.2/8.0/8.1).
+  Advisory database commit: `93b32f641f84282183ce58ab1d7204bee50885bd`.
+- `npm audit --audit-level=low`: **zero known vulnerabilities**.
+- `git diff --check`: passed.
+
+Ruby lockfiles are not committed; audits describe these resolutions and the
+advisory database at review time. CI audits newly resolved Ruby matrix stacks.
+PostgreSQL concurrency execution and the broader Ruby matrix are delegated to
+the PR's CI; their results should be checked separately from the local results.
+
+## Remaining boundaries and rollout
+
+See [SECURITY.md](../../SECURITY.md) for application and deployment controls.
+Upstream request buffering, rate limiting and read deadlines remain external.
+Mail rendering, malware scanning, tenant authorization, encryption and retention
+are application responsibilities. Queue write access is an authenticity boundary;
+account labels are not signatures. Read-only ActiveRecord attributes do not
+prevent privileged SQL changes. Inbound deduplication intentionally keys identical
+MIME by SMTP recipient, retaining the first authenticated envelope sender.
+
+The development Host guard restricts routes, but the allowed ingress still runs
+inside the development application: safe error handling and test-only data are
+required. CI action references use version tags rather than immutable commits;
+pinning them is additional supply-chain hardening still available.
+
+These changes are not yet a RubyGems release or a deployed Worker upgrade. The
+dogfood inbox has not been repinned or live-tested against this security branch.
+Rollout requires updating the gem revision, redeploying the Worker, aligning any
+`MAX_EMAIL_BYTES` override, updating application dependencies and restarting Rails
+before opening a development tunnel. Do not equate the earlier dogfood results
+with verification of this revision in a deployed application.

data/docs/verification/2026-09-11-tenant-mailboxes.md

@@ -0,0 +1,75 @@
+# Optional mailboxes and tenant support — 2026-09-11
+
+Implementation source: `4273c5ac10cb87d5e5610acc6a4e69c55d94a42f`.
+The guides and installation pin may receive subsequent documentation-only updates.
+
+## Implemented
+
+- Explicit optional tenant adapter and configurable model base for the existing
+  outbox/receipt models and new tenant mailbox models. Plain Ruby remains independent.
+- Shared receiving-domain directory and tenant mailboxes, aliases, owner references,
+  lifecycle, inbound memberships, read/archive state and explicit purge.
+- Full HMAC verification before recipient-to-tenant resolution, followed by
+  same-connection ActionMailbox/ActiveStorage persistence and membership storage.
+- Scoped mailbox sender checks and identity-only send jobs using the existing
+  immutable outbox, callbacks, reconciliation and conservative retry behavior.
+- Shared event intake before ACK, account/message/recipient correlation to a
+  tenant outbox, tenant commit before shared completion, and bounded recovery jobs.
+- Tenant serialization before framework GlobalID lookup; missing/conflicting
+  tenant metadata rejected. Managed raw mail retained against normal incineration.
+- Composed generator with separate tenant/shared migration paths and optional
+  `activerecord-tenanted` integration guide/bundle/CI job.
+
+## Local verification
+
+Ruby 3.4.1 / Rails 8.1.3.1 unless noted:
+
+| Check | Result |
+| --- | --- |
+| Full `bundle exec rake test` | 212 tests, 758 assertions, no failures/errors/skips |
+| Tenant connection and job subprocess | 11 tests, 54 assertions; physical SQLite shards with overlapping IDs, host-only framework job capture and context restoration |
+| Default job-context subprocess | 3 tests, 7 assertions; ordinary untagged jobs preserved without database tenancy |
+| Mailbox service subprocess | 16 tests, 92 assertions; two fixed SQLite tenant pools plus shared directory |
+| Shared event subprocess | 8 tests, 28 assertions; also checked on Rails 7.2 |
+| Real Rails mailbox ingress subprocess | 4 tests, 29 assertions; signed recipient routing, raw storage, jobs, aliases, deduplication, unavailable destinations, retention and purge |
+| Actual `activerecord-tenanted` 0.8 integration | 3 tests, 23 assertions; real tenant provisioning/migrations, isolation, context and GlobalID checks |
+| Generator checks | Fresh single-DB and separate shared/tenant SQLite installs, migration ordering and initializer syntax |
+| Packaged gem | Isolated Ruby consumer; Rails install/ingress/outbox checks; new tenant ingress, jobs, retention and all mailbox migrations from extracted package |
+| Local workerd → Rails | Existing real runtime fixture passed, including raw bytes, routing, duplicates, invalid credentials, redirects and timeout |
+
+Top-level test totals include subprocess wrapper assertions; detailed subprocess
+counts above describe their internal checks and are not additional top-level tests.
+The service suite includes concurrent claims producing one provider request,
+callback rollback, retry/recovery without resending, reconcile rollback, pagination,
+suspension after enqueue, caller operation-key isolation and sender/account checks.
+Event tests include event-before-response, conflicting identities, cross-tenant
+correlation ambiguity, tenant-commit/shared-failure replay, and callback rollback.
+
+The optional tenant dependency resolution passed bundler-audit. CI additionally
+runs the supported Ruby/Rails matrix, PostgreSQL outbox checks and Worker checks.
+Check the PR's CI for results on its latest revision.
+
+## Operational boundaries
+
+No production Worker, domain/DNS, inbox or Rebulk deployment changed. No real
+email was sent by these checks. The new Worker-to-mailbox path uses the existing
+v2 signature contract; live customer subdomain provisioning was not exercised.
+Rebulk's existing ingest/communication records and sender-authentication policy
+still require a separate, explicit application adoption project.
+
+Directory activation records authorized operator evidence, not independent
+domain verification. Application permissions select tenant and mailbox access;
+raw ActiveRecord and administrative directory methods are privileged interfaces.
+Database keys and queue payloads must come from trusted application state.
+
+Framework records must share the configured tenant connection. Drain old
+ActionMailbox/ActiveStorage jobs before enabling database tenancy because old
+payloads without the new metadata cannot safely be guessed. Mailbox memberships
+retain raw mail until explicit purge, so applications must define a retention
+policy and monitor storage usage.
+
+Queue intake and tenant projection use separate commits with idempotent recovery,
+not a distributed transaction. Schedule polling, shared replay and per-tenant
+recovery. Unknown provider outcomes stay blocked; no exactly-once guarantee or
+automatic resend is added. Existing outbox PostgreSQL behavior remains covered;
+the new mailbox/tenant integration's direct database evidence is SQLite.

data/examples/plain_ruby.rb

@@ -0,0 +1,24 @@
+#!/usr/bin/env ruby
+# Plain Ruby example — no Rails required.
+#
+# Usage:
+#   CLOUDFLARE_ACCOUNT_ID=... CLOUDFLARE_API_TOKEN=... ruby examples/plain_ruby.rb
+
+$LOAD_PATH.unshift File.expand_path("../lib", __dir__)
+require "cloudflare-email"
+
+client = Cloudflare::Email::Client.new(
+  account_id: ENV.fetch("CLOUDFLARE_ACCOUNT_ID"),
+  api_token:  ENV.fetch("CLOUDFLARE_API_TOKEN"),
+)
+
+response = client.send(
+  from:    { address: "agent@example.com", name: "Demo Agent" },
+  to:      "you@example.com",
+  subject: "Hello from cloudflare-email",
+  text:    "It works!",
+  html:    "<p><strong>It works!</strong></p>",
+)
+
+puts "delivered: #{response.delivered.inspect}"
+puts "message_id: #{response.message_id}"

data/lib/cloudflare/email/active_record/base.rb

@@ -0,0 +1,48 @@
+require "active_record"
+require "cloudflare/email/tenancy"
+
+module Cloudflare
+  module Email
+    module ActiveRecord
+      # Uses the host's abstract tenant connection owner when explicitly configured.
+      class Base < Tenancy.model_base(::ActiveRecord::Base)
+        self.abstract_class = true
+
+        class << self
+          def connection_pool
+            Tenancy.require_context! if Tenancy.enabled?
+            super
+          end
+        end
+
+        before_validation :verify_cloudflare_email_tenant!
+        before_save :verify_cloudflare_email_tenant!
+        before_destroy :verify_cloudflare_email_tenant!
+
+        # These methods can bypass callbacks or load a different row with the same ID.
+        %i[reload update_columns delete touch increment! decrement! association].each do |method_name|
+          define_method(method_name) do |*args, **kwargs, &block|
+            verify_cloudflare_email_tenant!
+            super(*args, **kwargs, &block)
+          end
+        end
+
+        private
+
+        # Both new construction and persisted-row instantiation call this before
+        # assigning inverse associations (which precede after_initialize).
+        def init_internals
+          super
+          @cloudflare_email_tenant_key = Tenancy.require_context! if Tenancy.enabled?
+        end
+
+        def verify_cloudflare_email_tenant!
+          return unless Tenancy.enabled?
+          unless @cloudflare_email_tenant_key == Tenancy.require_context!
+            raise ConfigurationError, "record belongs to a different tenant context"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/cloudflare/email/active_record/delivery_events.rb

@@ -0,0 +1,72 @@
+require "cloudflare/email/active_record/event_inbox"
+require "cloudflare/email/active_record/outbox"
+require "time"
+
+module Cloudflare
+  module Email
+    module ActiveRecord
+      # Durable receipt + recipient projection. Application callbacks may update
+      # product records on this connection; external effects need their own outbox.
+      class DeliveryEvents
+        class << self
+          def record(event, &on_change)
+            validate!(event)
+            receipt = EventInbox.record(event)
+            EventInbox.apply(receipt) { |stored| project(stored, &on_change) }
+          end
+
+          def replay(account_id:, message_id: nil, batch_size: 100, &on_change)
+            raise ArgumentError, "account_id is required" if account_id.to_s.empty?
+            EventInbox.replay(account_id: account_id, message_id: message_id,
+                              batch_size: batch_size) { |event| project(event, &on_change) }
+          end
+
+          private
+
+          def validate!(event)
+            raise ValidationError, "delivery event recipient is required" unless event.recipient.is_a?(String) && !event.recipient.strip.empty?
+            Time.iso8601(event.occurred_at.to_s)
+          rescue ArgumentError
+            raise ValidationError, "delivery event timestamp must be ISO8601"
+          end
+
+          def project(event)
+            validate!(event)
+            return :unmatched unless event.known?
+
+            # Refuse ambiguous correlation instead of picking the newest record.
+            ids = OutboundDelivery.where(account_id: event.account_id,
+              provider_message_id: MessageId.normalize(event.message_id),
+              state: %w[accepted partial]).limit(2).pluck(:id)
+            return :unmatched unless ids.length == 1
+
+            delivery = OutboundDelivery.find(ids.first)
+            outcome = :unmatched
+            delivery.with_lock do
+              next unless %w[accepted partial].include?(delivery.state)
+              recipient = delivery.outbound_recipients.find_by(
+                recipient: Outbox.normalize_recipient(event.recipient))
+              next unless recipient
+
+              if event.supersedes?(occurred_at: recipient.occurred_at, terminal: recipient.terminal?)
+                attributes = { state: event.status, occurred_at: Time.iso8601(event.occurred_at), terminal: event.terminal? }
+                # A correlated lifecycle event proves Cloudflare processed this
+                # recipient even if its initial response omitted the outcome.
+                if recipient.acceptance_state == "unknown"
+                  attributes[:acceptance_state] = "accepted"
+                end
+                recipient.update!(attributes)
+                if attributes[:acceptance_state]
+                  delivery.update!(state: Outbox.acceptance_state(delivery.outbound_recipients.pluck(:acceptance_state)))
+                end
+                yield delivery, recipient if block_given?
+              end
+              outcome = :applied
+            end
+            outcome
+          end
+        end
+      end
+    end
+  end
+end

data/lib/cloudflare/email/active_record/event_inbox.rb

@@ -0,0 +1,77 @@
+require "active_record"
+require "cloudflare/email/error"
+require "cloudflare/email/delivery_event"
+require "cloudflare/email/message_id"
+require "cloudflare/email/active_record/event_receipt"
+
+module Cloudflare
+  module Email
+    module ActiveRecord
+      # Optional durable boundary between queue acknowledgment and application work.
+      # Keep handler database writes on EventReceipt's connection; external effects
+      # cannot be rolled back and should use an application outbox.
+      class EventInbox
+        class << self
+          # Use directly in EventConsumer#poll. A returned receipt has committed,
+          # so the queue can ACK even when its message has not been matched yet.
+          def record(event)
+            if EventReceipt.connection.transaction_open?
+              raise ArgumentError, "record must run outside an existing database transaction before queue acknowledgment"
+            end
+
+            event = DeliveryEvent.new(event.raw)
+            receipt = EventReceipt.create_or_find_by!(account_id: event.account_id, event_id: event.event_id) do |row|
+              row.message_id = MessageId.normalize(event.message_id)
+              row.payload_json = JSON.generate(event.raw)
+              row.state = "pending"
+            end
+            unless receipt.event.raw == event.raw
+              raise ValidationError, "event ID already recorded with a different payload"
+            end
+            receipt
+          end
+
+          # The handler must explicitly return :applied or :unmatched. Exceptions
+          # roll back both its database writes and the receipt transition.
+          def apply(receipt)
+            raise ArgumentError, "an event handler block is required" unless block_given?
+            raise ArgumentError, "expected a persisted EventReceipt" unless receipt.is_a?(EventReceipt) && receipt.persisted?
+
+            completed = false
+            receipt.with_lock(requires_new: true) do
+              if receipt.state == "applied"
+                completed = true
+                next
+              end
+              outcome = yield receipt.event
+              unless [:applied, :unmatched].include?(outcome)
+                raise ArgumentError, "event handler must return :applied or :unmatched"
+              end
+              receipt.update!(state: outcome.to_s, applied_at: outcome == :applied ? Time.now.utc : nil)
+              completed = true
+            end
+            raise ArgumentError, "event handler rolled back instead of returning an outcome" unless completed
+            receipt
+          end
+
+          # Replay pending/unmatched receipts after correlating provider IDs, or
+          # from a recurring job. Ordering policy belongs to the application.
+          def replay(account_id: nil, message_id: nil, batch_size: 100, &handler)
+            raise ArgumentError, "an event handler block is required" unless handler
+            raise ArgumentError, "batch_size must be positive" unless batch_size.is_a?(Integer) && batch_size.positive?
+
+            scope = EventReceipt.where(state: ["pending", "unmatched"])
+            scope = scope.where(account_id: account_id) if account_id
+            scope = scope.where(message_id: MessageId.normalize(message_id)) if message_id
+            count = 0
+            scope.find_each(batch_size: batch_size) do |receipt|
+              apply(receipt, &handler)
+              count += 1
+            end
+            count
+          end
+        end
+      end
+    end
+  end
+end

data/lib/cloudflare/email/active_record/event_receipt.rb

@@ -0,0 +1,17 @@
+require "cloudflare/email/active_record/base"
+
+module Cloudflare
+  module Email
+    module ActiveRecord
+      class EventReceipt < Base
+        self.table_name = "cloudflare_email_event_receipts"
+        attr_readonly :account_id, :event_id, :message_id, :payload_json
+
+        # JSON text avoids a dependency on database-specific JSON column types.
+        def event
+          DeliveryEvent.new(JSON.parse(payload_json))
+        end
+      end
+    end
+  end
+end

data/lib/cloudflare/email/active_record/mail_snapshot.rb

@@ -0,0 +1,24 @@
+require "cloudflare/email/active_record/outbox"
+
+module Cloudflare
+  module Email
+    module ActiveRecord
+      class Outbox
+        # Render before preparing. Delivery callbacks are intentionally not run:
+        # the worker sends the immutable snapshot, never a regenerated mailer.
+        def self.prepare_mail(account_id:, operation_key:, mail:)
+          mail = mail.message if mail.respond_to?(:message) && !mail.respond_to?(:encoded)
+          raise ValidationError, "mail must be a rendered Mail message" unless mail.respond_to?(:encoded)
+          if mail.respond_to?(:perform_deliveries) && !mail.perform_deliveries
+            raise ValidationError, "email delivery is disabled"
+          end
+
+          from = mail.respond_to?(:smtp_envelope_from) ? mail.smtp_envelope_from : Array(mail.from).first
+          recipients = mail.respond_to?(:smtp_envelope_to) ? mail.smtp_envelope_to : [mail.to, mail.cc, mail.bcc].flatten.compact
+          prepare(account_id: account_id, operation_key: operation_key, from: from,
+                  recipients: Array(recipients), mime_message: mail.encoded)
+        end
+      end
+    end
+  end
+end

data/lib/cloudflare/email/active_record/outbound_delivery.rb

@@ -0,0 +1,22 @@
+require "cloudflare/email/active_record/base"
+
+module Cloudflare
+  module Email
+    module ActiveRecord
+      class OutboundDelivery < Base
+        self.table_name = "cloudflare_email_outbound_deliveries"
+        has_many :outbound_recipients, class_name: "Cloudflare::Email::ActiveRecord::OutboundRecipient", dependent: :restrict_with_exception
+        has_many :outbound_reconciliations, class_name: "Cloudflare::Email::ActiveRecord::OutboundReconciliation", dependent: :restrict_with_exception
+        attr_readonly :account_id, :operation_key, :from_address, :recipients_json, :mime_message, :snapshot_digest
+
+        def recipients
+          JSON.parse(recipients_json)
+        end
+
+        def response
+          Response.new(JSON.parse(response_json)) if response_json
+        end
+      end
+    end
+  end
+end

data/lib/cloudflare/email/active_record/outbound_recipient.rb

@@ -0,0 +1,13 @@
+require "cloudflare/email/active_record/base"
+
+module Cloudflare
+  module Email
+    module ActiveRecord
+      class OutboundRecipient < Base
+        self.table_name = "cloudflare_email_outbound_recipients"
+        belongs_to :outbound_delivery, class_name: "Cloudflare::Email::ActiveRecord::OutboundDelivery"
+        attr_readonly :outbound_delivery_id, :recipient
+      end
+    end
+  end
+end

data/lib/cloudflare/email/active_record/outbound_reconciliation.rb

@@ -0,0 +1,15 @@
+require "cloudflare/email/active_record/base"
+
+module Cloudflare
+  module Email
+    module ActiveRecord
+      class OutboundReconciliation < Base
+        self.table_name = "cloudflare_email_outbound_reconciliations"
+        belongs_to :outbound_delivery, class_name: "Cloudflare::Email::ActiveRecord::OutboundDelivery"
+        def readonly?
+          persisted?
+        end
+      end
+    end
+  end
+end