cloudflare-email 0.1.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0f26340bc2629fee65067ec40a1f78ffea475e70a7d102931f3a96ab0f65d621
-  data.tar.gz: 291281b738050c94bc80062a977f0b820178b70e4574f49ed449d737c06aa70c
+  metadata.gz: b8b7e8e8e9c8f102cf640de5aa577092947f829853daea59463263b8729ede21
+  data.tar.gz: 7303add7cb750e309c338132e114ecd40340bf5e9ee39b6b03c3f28acd9887d1
 SHA512:
-  metadata.gz: 62b1afce0f1b6afaa33091a1c9540702f7d09e7b1ecb3a3cd71b11a70fbd52162aeb50dba1696fb6a23799096d88be0a1d06ff804b996191018d4641ca5c68a4
-  data.tar.gz: 2e2210138612fb118ae196f9c97569e3006e6d6f43657efa5be80e5e7636bd55bb112742aaf08df092d4668d66295fa6a5e35df9e9035946897db99ad1c237bc
+  metadata.gz: 77cbd0de1b51f621f834fa9493c31865cc0017e0f221885503ad6c891f783f39b3e0eaf07eaabb148a9e34c694bed9d8e4a0dfa27cd052e70e0d9e17164e9483
+  data.tar.gz: 3e3ee8aa24120e3b264efd7328b18dc3c48ab044656c0e15d0f73a13d2fd18e06247ab7392bc72aba472d37bee1b080a77113e492d4dcbe8c6945e2c5ceeb34a

data/CHANGELOG.md

@@ -1,6 +1,154 @@
 # Changelog
 
-## Unreleased
+## 0.3.0 — 2026-09-13
+
+See [upgrading from 0.2](docs/upgrading-0.3.md) before deploying the updated Worker.
+
+- Add a standalone Deploy to Cloudflare template with R2/Queue provisioning,
+  secret prompts, scheduled recovery, and logs. CI checks runtime/configuration
+  synchronization with the gem's Worker and tests an isolated template copy.
+
+- Make durable inbound delivery the Worker default, with explicit direct fallback: commit original mail and envelope context
+  to R2 before Worker acceptance, deliver queue pointers with fresh signatures,
+  and recover pending mail through a bounded scheduled sweep. Rails errors,
+  lost responses, enqueue failures and exhausted queue retries retain pending
+  mail. Provisioning, protected storage and monitoring remain explicit.
+- Make missing Message-ID fallback deterministic across Rails hosts so replay
+  after a deployment does not create another inbound record. Original MIME and
+  parseable provider Message-IDs remain unchanged.
+- Add optional authenticated Routing analytics delivery confirmation with
+  encrypted immutable receipts, strict single-envelope-recipient correlation,
+  replay and transactional callbacks. Sending acceptance remains unchanged;
+  missing or ambiguous evidence never authorizes a resend.
+- Bound shared sending/queue HTTP responses by streamed bytes and a total
+  per-attempt deadline; disable implicit HTTP retries and sanitize transport
+  failures. Sending and queue acknowledgement ambiguity stays safe to replay
+  through durable receipts rather than resending accepted email.
+- Document verified Routing destinations, separate analytics credentials and
+  explicit system-mail storage with optional SQLite tenancy.
+
+- Add optional domain catch-all receiving on an existing active mailbox address,
+  with explicit verification evidence and a unique active catch-all constraint.
+  Exact registered addresses always win, including rejected inactive addresses;
+  unknown local parts retain their actual envelope recipient without new aliases.
+  Destination snapshots identify fallback, while sending stays exact-address only.
+  A separate generator upgrades existing mailbox schemas; catch-all is never
+  enabled automatically.
+
+- Allow production Rails schema preloading to boot without a selected tenant.
+  Tenant model pool access still fails closed with
+  `Cloudflare::Email::ActiveRecord::TenantConnectionUnavailable`, an
+  `ActiveRecord::ConnectionNotEstablished` error retaining the original
+  `ConfigurationError` as its cause. No default tenant is selected.
+
+- Add a reusable Worker `relayEmail` pipeline with host backend/header policies,
+  bounded raw reads, optional fail-open archive hooks, safe HTTP outcomes and
+  deadlines. `archiveEmail` writes raw bytes and envelope metadata to an optional
+  R2 bucket. Default and custom forwarding share the same HTTP transport.
+- Keep provider authentication interpretation, archive keys, retry decisions and
+  fallback destinations with the host; existing default v2/v3 forwarding remains
+  compatible. Archive deadlines bound waiting but cannot cancel an in-flight write.
+
+- Add `Mailboxes.with_recipient` for active-address resolution and immutable
+  destination context with host-owned persistence, without ActionMailbox.
+- Yield the same destination from `Mailboxes.receive` so apps can link their
+  business records while retaining gem-managed raw email, metadata and membership
+  persistence. Host exceptions propagate instead of being reported as missing
+  mailbox records; existing no-argument receive blocks continue to work.
+
+- Add a bounded, Rails-independent `Ingress.verify` API for existing ingestion
+  pipelines, with optional ActionMailbox persistence and tenant registry routing.
+- Add opt-in v3 signatures for provider metadata supplied by custom Workers.
+  Metadata is authenticated transport evidence, not proof of sender authenticity.
+  Default Worker forwarding remains v2; upgrade Rails before enabling v3.
+- Verify signatures against exact timestamp header bytes; decimal parsing is
+  used only for freshness. The bundled Worker's timestamp format is unchanged.
+- Add GET-only `cloudflare:email:check_route` diagnostics for exact receiving-domain
+  DNS and Worker routing. Reports uncertainty without changing configuration or
+  claiming live delivery is verified.
+
+- Add an opt-in server-rendered mailbox management engine with host authentication,
+  mailbox/domain scoping and per-action permissions. Manage mailboxes and aliases,
+  suspend/resume, preview plain-text messages and mark read/archive without
+  JavaScript or asset pipeline dependencies. The engine is never mounted by default.
+
+- Fix managed domain and address activation in Rails apps with strict readonly
+  attributes enabled. Normalize immutable identities only when creating records;
+  later lifecycle updates retain the original domain and address.
+
+## 0.2.0 — 2026-09-11
+
+- Add optional managed mailboxes: domain directory, addresses/aliases, lifecycle,
+  incoming memberships, read/archive/purge APIs and raw-mail retention.
+- Add explicit tenant connections, tenant-aware framework and mailbox jobs,
+  mailbox-authorized outbox sends, shared event intake/correlation and recovery.
+  Verify separate SQLite databases and actual `activerecord-tenanted` integration;
+  no new runtime dependency for plain Ruby consumers.
+- Add a mailbox generator with separate shared/tenant migration paths and
+  user guides for mailbox management and database tenancy.
+
+- Bound Rails and Worker inbound reads to 25 MiB by default; reject malformed or
+  stale signing headers before reading MIME. Require HTTPS remote endpoints.
+- Restrict the development tunnel to email ingress and require a running guard;
+  redact client inspection, retry logs, and generated mailbox logging.
+- Validate delivery-event schemas, preserve receipt evidence through ordinary
+  ActiveRecord updates, and tighten provider acceptance response handling.
+- Remove Rails 7.1 support, update patched Rails/SQLite test floors, and audit
+  resolved Ruby dependencies in CI. See the dated security verification report.
+
+- Add an optional durable Rails outbox: immutable MIME/envelope snapshots,
+  account-scoped operation keys, committed send claims, per-recipient acceptance
+  evidence, blocked uncertain retries, and audited subset reconciliation.
+- Add `Outbox.prepare_mail`, identity-only `SendJob`, replay jobs/tasks and
+  `DeliveryEvents` to correlate provider events and update recipient lifecycle
+  state transactionally. Normalize receipt message IDs for indexed replay.
+- Verify concurrent sends and event projection on PostgreSQL as well as SQLite;
+  include process termination, partial outcomes and post-acceptance persistence
+  failures. The inbox uses the shared ledger with preserved historical records.
+
+- Authenticate SMTP envelope sender/recipient with the Worker's v2 HMAC format,
+  persist trusted metadata before routing, and expose `Envelope.for(inbound_email)`.
+  Preserve raw MIME and scope duplicate detection to the exact SMTP recipient.
+  Require v2 ingress; remove v1 compatibility and the unused signed Message-ID
+  helper. Coordinate Rails and Worker deployment; see docs/upgrading-0.2.md.
+
+- Extract shared provider acceptance, delivery-event ordering, and Message-ID
+  normalization primitives from the inbox application.
+- Add an opt-in ActiveRecord event inbox and `cloudflare:email:tracking` generator:
+  committed receipts before ACK, account/event uniqueness, payload-conflict
+  detection, unmatched replay, and transactional handlers with explicit outcomes.
+
+- Verify actual local workerd-to-Rails delivery in CI. This exposed and fixed an
+  unsupported fetch redirect mode; use `manual` and reject the 3xx response.
+  Add reusable package/fresh-install/task verification and a dated evidence report.
+
+- Add outbound delivery events through Cloudflare Queues HTTP pull, typed event
+  data, account/domain checks, per-message acknowledgement after handler success,
+  and a Rails `consume_events` task. Optional Rails receipts provide durable
+  deduplication; applications supply correlation and processing policy.
+- Expose suppressed recipients and provider message IDs in responses/notifications;
+  support cc/bcc-only structured sends and HTTP-date Retry-After headers.
+- Default to retrying only rate limits and pre-send connection failures. Ambiguous
+  network/5xx retries now require `retry_ambiguous: true` to accept duplication risk.
+- Fix generated ENV credentials, send-only eager boot, duplicate ingress responses,
+  accidental generator deployment tasks, and development environment isolation.
+- Require subdomain routing DNS preflight; refuse misleading subdomain catch-all
+  scope; use current apex DNS API and paginated rule lookup; surface setup failures.
+- Update locked Worker tooling, require explicit Wrangler environments, bound
+  forwarding requests to 15 seconds, and reject redirects. Add scheduled CI,
+  dependency checks, actual Rails integration tests, and Ruby 4 / Rails 8.1 coverage.
+- Require FROM for test sends; remove undocumented sending-domain discovery and
+  misleading diagnostic claims. Update DNS, SMTP, retry, and signed-ID guidance.
+- Bound legacy signed Message-ID output to 900 bytes; reject empty decode secrets.
+  Live Cloudflare testing confirmed custom IDs are replaced; use provider IDs
+  for correlation, not sender authentication. See docs/upgrading-0.2.md.
+- Accept plain JSON queue bodies returned by live Email Sending subscriptions,
+  retaining Base64 compatibility. Verify real delivery-event redelivery and ack.
+
+## 0.1.0 — 2026-04-18
+
+The notes below describe the original April implementation and its historical
+verification. Current compatibility and security guidance is in the 0.2.0 docs.
 
 - **`Cloudflare::Email::SecureMessageId`** — sign the outbound `Message-ID:`
   with HMAC-SHA256. The recipient's reply naturally carries the signed id