cloudflare-email 0.3.0 → 0.4.0

data/templates/worker/docs/domain-setup.md

@@ -0,0 +1,198 @@
+# Set up once, create mailboxes in Rails
+
+Use the same Worker for either address shape:
+
+| Pattern | Example | What changes when a customer joins |
+| --- | --- | --- |
+| One receiving domain | `acme@in.example.com` | Create a mailbox/address in Rails |
+| Organization subdomains | `invoices@acme.in.example.com` | Register the exact organization domain and its mailboxes in Rails, within your verified receiving namespace |
+
+Neither pattern needs a recipient allowlist in the Worker. Rails owns accepted
+addresses and organization membership. Database multi-tenancy remains optional.
+The [Rails hello-world template](https://github.com/cole-robertson/cloudflare-email-rails-starter)
+demonstrates the first pattern with a normal SQLite database and generated login.
+
+## What is verified, and what Cloudflare documents
+
+**Rebulk's existing deployment uses the second pattern:**
+`<site>@<organization>.rebulk.com`, wildcard MX, a catch-all Worker rule, and Rails
+organization/mailbox lookup. New organizations do not need a Worker enrollment
+list or a routine per-organization Cloudflare approval. Its September 2026
+rehearsal checked exact-domain public MX answers and archived SMTP-envelope
+delivery evidence, alongside the global catch-all rule. The apex keeps its
+separate mail provider. Sources (Rebulk repository access required):
+
+- [Worker architecture and organization setup](https://github.com/Rebulk/rebulk-system/blob/1cc26e0076ba0e9157e89f5879604df8c94430bc/cloudflare/README.md).
+- [Wildcard MX observations and limits of zone-level API evidence](https://github.com/Rebulk/rebulk-system/blob/1cc26e0076ba0e9157e89f5879604df8c94430bc/docs/cloudflare-mailbox-onboarding-rehearsal-2026-09-12.md).
+
+This is deployment evidence, not a Cloudflare-wide service guarantee. Cloudflare's
+[subdomain onboarding guide](https://developers.cloudflare.com/email-service/configuration/subdomains/)
+describes adding subdomains explicitly and currently lists a 30-domain combined
+Routing/Sending limit. It does not document arbitrary wildcard Email Routing as
+a way to bypass that limit. Cloudflare separately documents
+[wildcard DNS and exact-record precedence](https://developers.cloudflare.com/dns/manage-dns-records/reference/wildcard-dns-records/).
+Working wildcard DNS alone does not establish Email Routing acceptance. If your
+account does not accept unlisted subdomains, use documented explicit onboarding
+within its limits, or the single-domain pattern. Do not assume that an existing
+Rebulk setup proves a fresh account's behavior.
+
+A fresh [public DNS observation](https://github.com/cole-robertson/cloudflare-email/blob/main/docs/verification/2026-09-13-wildcard-dns.json)
+also records Cloudflare MX answers for `test.rebulk.com` and two random subdomains
+without creating DNS records or adding those labels in Cloudflare. That report
+is public and deliberately marks `delivery_verified: false`; no email was sent
+by this DNS-only check.
+
+## 1. Fill in your setup worksheet
+
+Use a dedicated receiving namespace when the apex already serves Workspace or
+Microsoft 365. Example values:
+
+| Setting | Your example value |
+| --- | --- |
+| Cloudflare zone | `example.com` |
+| Receiving base | `in.example.com` |
+| Organization domain | `acme.in.example.com` |
+| Worker | `cloudflare-email-ingress` |
+| Rails ingress URL | `https://app.example.com/rails/action_mailbox/cloudflare/inbound_emails` |
+| Shared ingress secret | Generate with `openssl rand -hex 32`; save privately in Rails and the Worker |
+
+Keep staging and production Workers, buckets, queues, secrets, and receiving
+namespaces separate. The standalone deploy-button template takes one environment
+per copy; the regular CLI template uses `--env production` or another explicit env.
+
+## 2. Deploy the shared infrastructure
+
+[![Deploy to Cloudflare](https://deploy.workers.cloudflare.com/button)](https://deploy.workers.cloudflare.com/?url=https://github.com/cole-robertson/cloudflare-email/tree/main/templates/deploy-to-cloudflare)
+
+Deploy Rails with gem 0.3+ first. The button copies the standalone Worker and
+prompts for `RAILS_INGRESS_URL` and `INGRESS_SECRET`. Its configuration includes
+private R2 storage, a Queue producer/consumer, once-per-minute recovery, and logs.
+Cloudflare documents [automatic R2/Queue provisioning and secret prompts](https://developers.cloudflare.com/workers/platform/deploy-buttons/).
+The button does not create email DNS, claim a domain, or register Rails mailboxes.
+
+## 3. Connect DNS and the Worker once
+
+For **one domain**, follow Cloudflare's documented
+[Email Routing onboarding](https://developers.cloudflare.com/email-service/get-started/route-emails/)
+and configure its [catch-all action](https://developers.cloudflare.com/email-service/configuration/email-routing-addresses/#catch-all-rule)
+as **Send to a Worker**, selecting your deployed Worker. This avoids one provider
+rule per local part. Review the actual zone/domain scope and any explicit rules
+that take precedence before saving.
+
+For a **Rebulk-style dynamic namespace**, first establish receiving on your account
+and retain the exact MX targets/priorities assigned by Cloudflare. Then, when
+reproducing and verifying wildcard receiving, the DNS template is:
+
+| DNS type | Name in zone `example.com` | Value |
+| --- | --- | --- |
+| MX | `*.in` | Each Cloudflare-assigned receiving MX target, with its assigned priority |
+
+Create one record per assigned target. Do not invent MX targets, point MX at a
+Worker URL, or replace the apex's existing MX records. Complete the service's
+other required DNS records through its onboarding instructions; do not blindly
+duplicate SPF records. Inspect the account's catch-all **Send to a Worker** rule
+and verify that it actually handles your intended namespace. A Cloudflare Worker
+HTTP route such as `*.example.com/*` is unrelated to email routing.
+
+An explicit DNS name can stop wildcard inheritance **even if its record is TXT
+or A rather than MX**. For example, an existing `acme.in.example.com` record may
+require its own receiving MX records. Test exact customer names as well as fresh
+ones. A wildcard also does not supply MX for the receiving base itself.
+
+## 4. Check without modifying infrastructure
+
+From either current Worker template, run:
+
+```sh
+npm run check:subdomains -- --base in.example.com --labels acme,globex
+```
+
+This requires only Node and DNS access, not a Cloudflare API key. It resolves MX
+for your chosen labels plus two fresh random labels. DNS lookups have bounded
+timeouts. JSON output distinguishes observed Cloudflare MX, other/missing MX, and
+lookup uncertainty. Exit zero means only that all queried names resolved to
+Cloudflare MX; `delivery_verified` remains false. Compare returned targets with
+your account's assigned targets. Existing explicit records can explain differences.
+The command ships in the repository templates; gem 0.3.0's already-published
+template predates it, so refresh your template copy to use it.
+
+For provider rule inspection, the gem also offers:
+
+```sh
+bin/rails cloudflare:email:check_route \
+  ADDRESS=invoices@acme.in.example.com \
+  WORKER_NAME=cloudflare-email-ingress \
+  ACCOUNT_ID=your-cloudflare-account-id
+```
+
+See [diagnostic credentials and limits](https://github.com/cole-robertson/cloudflare-email/blob/main/docs/routing-diagnostics.md).
+That diagnostic inspects exact-domain configured records; it does not resolve
+wildcard DNS inheritance. A working inherited-MX setup can therefore report
+missing exact records. Keep public DNS, provider rule inspection, and actual
+delivery evidence separate; do not force every organization through Cloudflare
+onboarding merely to make that diagnostic green.
+
+## 5. Prove the dynamic path before adopting it
+
+Use two new organization labels that have not been added individually in the
+Cloudflare dashboard:
+
+1. Check their public MX answers with the command above.
+2. Through trusted provisioning code, register both **exact** domains in Rails,
+   each against the correct stable organization key. Create a test mailbox for
+   each. Record your independently checked configuration evidence and activate
+   those test addresses so the gem can receive the verification messages.
+3. Send real email to both addresses from an external mailbox. Confirm the
+   Worker receives each, Rails retains the original message, and each appears
+   only in the correct organization's inbox. Record the message IDs and result.
+4. Repeat with a newly generated label without changing Cloudflare. If delivery
+   fails before the Worker, resolve the Cloudflare acceptance/onboarding issue;
+   changing Rails cannot fix a provider SMTP rejection.
+5. Rehearse Rails being unavailable, then verify retained R2 mail drains after
+   recovery without duplicate app records. Follow the
+   [durable recovery guide](https://github.com/cole-robertson/cloudflare-email/blob/main/templates/worker/docs/durable-inbound.md).
+
+These are deliberate test addresses; no real-email test is sent by the DNS checker.
+Successful tests establish evidence for your receiving namespace, not a guarantee
+that every future DNS change or provider policy will preserve it.
+
+## 6. Create organizations in Rails
+
+Once your namespace policy is verified, use the same gem APIs on organization
+creation. For example, from trusted app code after authorizing the organization:
+
+```ruby
+registry = Cloudflare::Email::Mailboxes
+organization_key = "organization-123" # Trusted stable app identity, not request input.
+domain = registry.register_domain(
+  domain: "acme.in.example.com",
+  tenant_key: organization_key,
+  account_id: Cloudflare::Email::Credentials.account_id
+)
+registry.activate_domain!(domain.id, evidence: verified_namespace_evidence)
+registry.for_tenant(organization_key) do |inboxes|
+  mailbox = inboxes.create(name: "Invoices", address: "invoices@acme.in.example.com",
+    owner_ref: "Organization:123")
+  inboxes.activate_address!(inboxes.addresses(mailbox.id).first.id,
+    evidence: verified_namespace_evidence)
+end
+```
+
+`verified_namespace_evidence` is your stored operator evidence from the setup and
+delivery checks, not a hard-coded claim of success. Make provisioning idempotent
+in your app, validate/reserve slugs, and resolve organization identity from trusted
+records. The gem stores exact domain registrations; it does not accept a `*`
+domain registration or silently authorize an arbitrary recipient from a web form.
+The management engine must obtain allowed domains from your host adapter. The
+hello-world starter intentionally stays single-domain; this recipe is the next
+step for an organization-aware app.
+
+A **Cloudflare routing catch-all** gets mail to the Worker. The gem's optional
+**mailbox catch-all** decides whether unknown local parts enter a mailbox. They
+are separate. Without the latter, unknown/suspended recipients return non-2xx and
+remain in durable pending storage until resolved. Monitor that backlog.
+
+Receiving on dynamic domains does not authorize sending from them. Cloudflare
+[Email Sending onboarding](https://developers.cloudflare.com/email-service/configuration/subdomains/#add-a-subdomain-to-email-sending)
+is separate; keep a verified shared sending domain unless you have explicitly
+onboarded the customer sending domain.

data/templates/worker/package.json

@@ -9,6 +9,7 @@
     "deploy": "node scripts/wrangler.mjs deploy",
     "dev": "node scripts/wrangler.mjs dev",
     "check": "wrangler deploy --env development --dry-run",
+    "check:subdomains": "node scripts/check-subdomains.mjs",
     "test": "vitest run"
   },
   "devDependencies": {

data/templates/worker/scripts/check-subdomains.mjs

@@ -0,0 +1,54 @@
+// Read-only public DNS check. No Cloudflare credentials or configuration writes.
+import { Resolver } from "node:dns/promises";
+import { randomBytes } from "node:crypto";
+import { parseArgs } from "node:util";
+import { fileURLToPath } from "node:url";
+
+const labelPattern = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+
+export async function checkSubdomains({ base, labels = [] }, lookup, randomLabel = () => `cf-probe-${randomBytes(8).toString("hex")}`) {
+  base = String(base || "").trim().toLowerCase();
+  if (base.length > 220 || base.split(".").length < 2 || !base.split(".").every(label => labelPattern.test(label))) {
+    throw new Error("Provide a DNS base such as in.example.com, without @, a scheme, or *.");
+  }
+  if (labels.length > 10 || !labels.every(label => labelPattern.test(label) && `${label}.${base}`.length <= 253)) {
+    throw new Error("Provide at most 10 comma-separated single-label subdomains, such as acme,globex.");
+  }
+  const probes = [randomLabel(), randomLabel()];
+  const names = [...new Set([...labels, ...probes])];
+  const checks = await Promise.all(names.map(async label => {
+    const domain = `${label}.${base}`;
+    try {
+      const mx = (await lookup(domain)).map(record => ({ priority: record.priority, exchange: record.exchange.toLowerCase().replace(/\.$/, "") }));
+      const cloudflare = mx.length > 0 && mx.every(record => record.exchange.endsWith(".mx.cloudflare.net"));
+      return { domain, fresh_probe: probes.includes(label), status: cloudflare ? "cloudflare_mx_observed" : "other_or_missing_mx", mx };
+    } catch (error) {
+      return { domain, fresh_probe: probes.includes(label), status: "unknown", reason: error.code || "DNS_LOOKUP_FAILED" };
+    }
+  }));
+  return {
+    checked_at: new Date().toISOString(),
+    base, dns_observation: checks.every(check => check.status === "cloudflare_mx_observed") ? "cloudflare_mx_observed_for_all_names" : "needs_attention",
+    delivery_verified: false, checks,
+    next_step: "Inspect the catch-all Worker rule, register two exact domains/mailboxes in Rails, and send real test emails. MX answers do not verify account ownership, Email Routing acceptance, Worker delivery, or Rails persistence."
+  };
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  try {
+    const { values } = parseArgs({ options: { base: { type: "string" }, labels: { type: "string" }, help: { type: "boolean" } } });
+    if (values.help) {
+      console.log("npm run check:subdomains -- --base in.example.com [--labels acme,globex]\nRead-only DNS observations, including two fresh labels. This does not verify email delivery.");
+    } else {
+      const resolver = new Resolver({ timeout: 2000, tries: 1 });
+      const labels = values.labels ? values.labels.split(",").map(label => label.trim().toLowerCase()) : [];
+      const report = await checkSubdomains({ base: values.base, labels }, domain => resolver.resolveMx(domain));
+      console.log(JSON.stringify(report, null, 2));
+      if (report.dns_observation === "needs_attention") process.exitCode = 1;
+    }
+  } catch (error) {
+    console.error(error.message);
+    console.error("Usage: npm run check:subdomains -- --base in.example.com [--labels acme,globex]");
+    process.exitCode = 1;
+  }
+}

data/templates/worker/test/subdomains.test.ts

@@ -0,0 +1,51 @@
+import { describe, it, expect, vi } from "vitest";
+import { checkSubdomains } from "../scripts/check-subdomains.mjs";
+
+function probes() {
+  let id = 0;
+  return () => `fresh-${++id}`;
+}
+const cloudflare = [{ priority: 10, exchange: "route1.mx.cloudflare.net" }];
+
+describe("subdomain setup DNS observations", () => {
+  it("checks chosen exact names plus fresh labels without claiming delivery", async () => {
+    const lookup = vi.fn(async () => cloudflare);
+    const report = await checkSubdomains({ base: "in.example.com", labels: ["acme"] }, lookup, probes());
+    expect(lookup.mock.calls.map(call => call[0])).toEqual(["acme.in.example.com", "fresh-1.in.example.com", "fresh-2.in.example.com"]);
+    expect(report.dns_observation).toBe("cloudflare_mx_observed_for_all_names");
+    expect(report.delivery_verified).toBe(false);
+  });
+
+  it("reports an exact-name exception even when fresh probes resolve", async () => {
+    const report = await checkSubdomains({ base: "in.example.com", labels: ["acme"] }, async domain => {
+      if (domain.startsWith("acme.")) throw Object.assign(new Error("no answer"), { code: "ENODATA" });
+      return cloudflare;
+    }, probes());
+    expect(report.dns_observation).toBe("needs_attention");
+    expect(report.checks[0].status).toBe("unknown");
+  });
+
+  it.each([
+    { mx: [] }, { mx: [{ priority: 0, exchange: "." }] },
+    { mx: [{ priority: 10, exchange: "mx.example.com" }] },
+    { mx: [...cloudflare, { priority: 5, exchange: "mx.other.test" }] }
+  ])("does not accept absent, null, foreign or mixed MX: $mx", async ({ mx }) => {
+    const report = await checkSubdomains({ base: "in.example.com" }, async () => mx, probes());
+    expect(report.dns_observation).toBe("needs_attention");
+  });
+
+  it("preserves DNS timeout uncertainty", async () => {
+    const report = await checkSubdomains({ base: "in.example.com" }, async () => { throw Object.assign(new Error("timeout"), { code: "ETIMEOUT" }); }, probes());
+    expect(report.checks.every(check => check.status === "unknown")).toBe(true);
+    expect(report.delivery_verified).toBe(false);
+  });
+
+  it("rejects malformed domains and nested labels before DNS", async () => {
+    const lookup = vi.fn();
+    for (const base of ["*.example.com", "https://example.com", "a@b.com", "localhost", "a..com"]) {
+      await expect(checkSubdomains({ base }, lookup)).rejects.toThrow();
+    }
+    await expect(checkSubdomains({ base: "example.com", labels: ["nested.acme"] }, lookup)).rejects.toThrow();
+    expect(lookup).not.toHaveBeenCalled();
+  });
+});

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cloudflare-email
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Cole
@@ -9,6 +9,20 @@ bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: mailbox-kit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.1.0
 - !ruby/object:Gem::Dependency
   name: base64
   requirement: !ruby/object:Gem::Requirement
@@ -141,10 +155,6 @@ files:
 - app/controllers/cloudflare/email/ingress_controller.rb
 - app/controllers/cloudflare/email/management/mailboxes_controller.rb
 - app/controllers/cloudflare/email/management/styles_controller.rb
-- app/views/cloudflare/email/management/mailboxes/index.html.erb
-- app/views/cloudflare/email/management/mailboxes/message.html.erb
-- app/views/cloudflare/email/management/mailboxes/show.html.erb
-- app/views/layouts/cloudflare/email/management.html.erb
 - docs/activerecord-tenanted.md
 - docs/architecture.md
 - docs/custom-ingress.md
@@ -171,6 +181,7 @@ files:
 - docs/verification/2026-09-11-security.md
 - docs/verification/2026-09-11-tenant-mailboxes.md
 - docs/verification/2026-09-12-destination-context.md
+- docs/verification/2026-09-13-action-mailbox-core.md
 - docs/verification/2026-09-13-durable-inbound-and-routing.md
 - examples/plain_ruby.rb
 - lib/cloudflare-email.rb
@@ -215,7 +226,6 @@ files:
 - lib/cloudflare/email/management/adapter.rb
 - lib/cloudflare/email/management/configuration.rb
 - lib/cloudflare/email/management/engine.rb
-- lib/cloudflare/email/management/management.css
 - lib/cloudflare/email/management/routes.rb
 - lib/cloudflare/email/message_id.rb
 - lib/cloudflare/email/provider_metadata.rb
@@ -256,23 +266,29 @@ files:
 - templates/deploy-to-cloudflare/.gitignore
 - templates/deploy-to-cloudflare/LICENSE.txt
 - templates/deploy-to-cloudflare/README.md
+- templates/deploy-to-cloudflare/docs/domain-setup.md
 - templates/deploy-to-cloudflare/package-lock.json
 - templates/deploy-to-cloudflare/package.json
+- templates/deploy-to-cloudflare/scripts/check-subdomains.mjs
 - templates/deploy-to-cloudflare/src/index.js
 - templates/deploy-to-cloudflare/test/durable.test.ts
 - templates/deploy-to-cloudflare/test/index.test.ts
 - templates/deploy-to-cloudflare/test/relay.test.ts
+- templates/deploy-to-cloudflare/test/subdomains.test.ts
 - templates/deploy-to-cloudflare/vitest.config.ts
 - templates/deploy-to-cloudflare/wrangler.toml
 - templates/worker/README.md
+- templates/worker/docs/domain-setup.md
 - templates/worker/docs/durable-inbound.md
 - templates/worker/package-lock.json
 - templates/worker/package.json
+- templates/worker/scripts/check-subdomains.mjs
 - templates/worker/scripts/wrangler.mjs
 - templates/worker/src/index.js
 - templates/worker/test/durable.test.ts
 - templates/worker/test/index.test.ts
 - templates/worker/test/relay.test.ts
+- templates/worker/test/subdomains.test.ts
 - templates/worker/vitest.config.ts
 - templates/worker/wrangler.toml
 homepage: https://github.com/cole-robertson/cloudflare-email

data/app/views/cloudflare/email/management/mailboxes/index.html.erb

@@ -1,65 +0,0 @@
-<div class="page-heading">
-  <div>
-    <p class="eyebrow">Email workspace</p>
-    <h1>Mailboxes</h1>
-    <p class="muted">Manage accepted addresses and the messages delivered to them.</p>
-  </div>
-</div>
-
-<div class="workspace-grid">
-  <section class="panel" aria-labelledby="mailboxes-heading">
-    <div class="panel-heading"><h2 id="mailboxes-heading">Your mailboxes</h2></div>
-    <% if @mailboxes.empty? %>
-      <div class="empty-state">
-        <h3>No mailboxes to show</h3>
-        <p>Create a mailbox to give incoming email a home.</p>
-      </div>
-    <% else %>
-      <ul class="record-list">
-        <% @mailboxes.each do |mailbox| %>
-          <li class="record-row">
-            <div class="record-content">
-              <% if allowed?(:show, mailbox) %>
-                <%= link_to mailbox.name, mailbox_path(mailbox.id), class: "record-title" %>
-              <% else %>
-                <span class="record-title"><%= mailbox.name %></span>
-              <% end %>
-              <p class="muted small">Mailbox #<%= mailbox.id %></p>
-            </div>
-            <span class="badge"><%= mailbox.state.capitalize %></span>
-          </li>
-        <% end %>
-      </ul>
-    <% end %>
-    <% if @next_cursor.present? %>
-      <nav class="pagination" aria-label="Mailbox pages">
-        <%= link_to "Next mailboxes →", root_path(after: @next_cursor), class: "button button-secondary" %>
-      </nav>
-    <% end %>
-  </section>
-
-  <% if allowed?(:create) %>
-    <section class="panel" aria-labelledby="create-heading">
-      <div class="panel-heading"><h2 id="create-heading">Create a mailbox</h2></div>
-      <div class="panel-body">
-        <% if @domains.empty? %>
-          <p class="muted">An administrator needs to register an active receiving domain before you can create a mailbox.</p>
-        <% else %>
-          <%= form_with url: mailboxes_path, scope: :mailbox, local: true, class: "stack" do |form| %>
-            <div class="field">
-              <%= form.label :name, "Mailbox name" %>
-              <%= form.text_field :name, required: true, maxlength: 255, placeholder: "Customer support" %>
-            </div>
-            <div class="field">
-              <%= form.label :address, "Email address" %>
-              <%= form.email_field :address, required: true, maxlength: 254, placeholder: "support@#{@domains.first}", aria: { describedby: "create-domains" } %>
-              <p id="create-domains" class="field-help">Available domains: <%= @domains.join(", ") %></p>
-            </div>
-            <p class="field-help">New addresses start pending. Your administrator must confirm their routing before they can receive mail.</p>
-            <%= form.submit "Create mailbox", class: "button" %>
-          <% end %>
-        <% end %>
-      </div>
-    </section>
-  <% end %>
-</div>

data/app/views/cloudflare/email/management/mailboxes/message.html.erb

@@ -1,34 +0,0 @@
-<nav class="breadcrumbs" aria-label="Breadcrumb">
-  <%= link_to "Mailboxes", root_path %> <span aria-hidden="true">/</span>
-  <%= link_to @mailbox.name, mailbox_path(@mailbox.id) %> <span aria-hidden="true">/</span>
-  <span>Message</span>
-</nav>
-<div class="page-heading">
-  <div><p class="eyebrow">Received message</p><h1><%= @subject.presence || "(No subject)" %></h1></div>
-  <div class="actions">
-    <% if allowed?(:mark_read, @mailbox) %>
-      <%= button_to(@entry.read_at ? "Mark unread" : "Mark read", mark_read_mailbox_path(@mailbox.id), method: :post, params: { message_id: @entry.id, read: @entry.read_at ? "false" : "true" }, class: "button button-secondary") %>
-    <% end %>
-    <% if allowed?(:archive, @mailbox) %>
-      <%= button_to(@entry.archived_at ? "Unarchive" : "Archive", archive_mailbox_path(@mailbox.id), method: :post, params: { message_id: @entry.id, archived: @entry.archived_at ? "false" : "true" }, class: "button button-secondary") %>
-    <% end %>
-  </div>
-</div>
-<article class="panel" aria-label="Email message">
-  <div class="panel-body">
-    <dl class="message-metadata">
-      <dt>From</dt><dd><%= @from.presence || "(Unknown sender)" %></dd>
-      <dt>To</dt><dd><%= @entry.recipient %></dd>
-      <dt>Received</dt><dd><time datetime="<%= @entry.created_at.iso8601 %>"><%= @entry.created_at.utc.strftime("%b %-d, %Y · %H:%M UTC") %></time></dd>
-      <dt>Status</dt><dd><%= @entry.read_at ? "Read" : "Unread" %><%= " · Archived" if @entry.archived_at %></dd>
-    </dl>
-  </div>
-  <div class="message-body"><pre><%= @body.presence || "No text content is available for this message." %></pre></div>
-  <% if @attachments.any? %>
-    <section class="panel-body attachments" aria-labelledby="attachments-heading">
-      <h2 id="attachments-heading">Attachments</h2>
-      <p class="field-help">File names are shown for reference. Downloads are not available in this dashboard.</p>
-      <ul><% @attachments.each do |filename| %><li><%= filename.presence || "Unnamed attachment" %></li><% end %></ul>
-    </section>
-  <% end %>
-</article>

data/app/views/cloudflare/email/management/mailboxes/show.html.erb

@@ -1,86 +0,0 @@
-<nav class="breadcrumbs" aria-label="Breadcrumb"><%= link_to "Mailboxes", root_path %> <span aria-hidden="true">/</span> <span><%= @mailbox.name %></span></nav>
-<div class="page-heading">
-  <div>
-    <p class="eyebrow">Mailbox</p>
-    <h1><%= @mailbox.name %></h1>
-    <p class="muted"><%= @mailbox.state == "suspended" ? "Receiving is paused for every address in this mailbox." : "Addresses receive mail when both their address and domain are active." %></p>
-  </div>
-  <div class="actions">
-    <span class="badge"><%= @mailbox.state.capitalize %></span>
-    <% if @mailbox.state == "active" && allowed?(:suspend, @mailbox) %>
-      <%= button_to "Suspend mailbox", suspend_mailbox_path(@mailbox.id), method: :post, class: "button button-secondary" %>
-    <% elsif @mailbox.state == "suspended" && allowed?(:resume, @mailbox) %>
-      <%= button_to "Resume mailbox", resume_mailbox_path(@mailbox.id), method: :post, class: "button" %>
-    <% end %>
-  </div>
-</div>
-
-<div class="workspace-grid">
-  <section class="panel" aria-labelledby="messages-heading">
-    <div class="panel-heading"><h2 id="messages-heading">Received messages</h2><p class="muted small">Includes archived messages</p></div>
-    <% if @messages.empty? %>
-      <div class="empty-state"><h3>No messages to show</h3><p>Messages appear here after delivery to an active address.</p></div>
-    <% else %>
-      <ul class="record-list">
-        <% @messages.each do |entry| %>
-          <li class="record-row">
-            <div class="record-content">
-              <% if allowed?(:show_message, @mailbox) %>
-                <%= link_to "Message to #{entry.recipient}", message_mailbox_path(@mailbox.id, message_id: entry.id), class: "record-title" %>
-              <% else %>
-                <span class="record-title">Message to <%= entry.recipient %></span>
-              <% end %>
-              <p class="muted small"><time datetime="<%= entry.created_at.iso8601 %>"><%= entry.created_at.utc.strftime("%b %-d, %Y · %H:%M UTC") %></time></p>
-            </div>
-            <div class="status-list">
-              <span class="badge"><%= entry.read_at ? "Read" : "Unread" %></span>
-              <% if entry.archived_at %><span class="badge">Archived</span><% end %>
-            </div>
-          </li>
-        <% end %>
-      </ul>
-    <% end %>
-    <% if @next_cursor.present? %>
-      <nav class="pagination" aria-label="Message pages"><%= link_to "Next messages →", mailbox_path(@mailbox.id, after: @next_cursor), class: "button button-secondary" %></nav>
-    <% end %>
-  </section>
-
-  <div class="stack">
-    <section class="panel" aria-labelledby="addresses-heading">
-      <div class="panel-heading"><h2 id="addresses-heading">Addresses</h2></div>
-      <ul class="record-list">
-        <% @addresses.each do |address| %>
-          <% receiving = @mailbox.state == "active" && address.state == "active" && address.receiving_domain&.state == "active" %>
-          <li class="record-row address-row">
-            <span class="record-title"><%= address.address %></span>
-            <% if address.has_attribute?(:catch_all) && address[:catch_all] %>
-              <span class="badge">Domain catch-all configured</span>
-            <% end %>
-            <span class="badge"><%= receiving ? "Accepting mail" : address.state == "pending" ? "Pending setup" : "Receiving paused" %></span>
-          </li>
-        <% end %>
-      </ul>
-      <div class="panel-body"><p class="field-help">Pending addresses need routing confirmation from your administrator. Resuming a mailbox preserves each address’s existing setup state.</p></div>
-    </section>
-
-    <% if allowed?(:add_address, @mailbox) %>
-      <section class="panel" aria-labelledby="alias-heading">
-        <div class="panel-heading"><h2 id="alias-heading">Add an alias</h2></div>
-        <div class="panel-body">
-          <% if @domains.empty? %>
-            <p class="muted">No active receiving domains are available. Contact your administrator.</p>
-          <% else %>
-            <%= form_with url: aliases_mailbox_path(@mailbox.id), local: true, class: "stack" do |form| %>
-              <div class="field">
-                <%= form.label :address, "Alias email address" %>
-                <%= form.email_field :address, required: true, maxlength: 254, aria: { describedby: "alias-domains" } %>
-                <p id="alias-domains" class="field-help">Available domains: <%= @domains.join(", ") %>. Messages to this alias will appear in this mailbox.</p>
-              </div>
-              <%= form.submit "Add alias", class: "button" %>
-            <% end %>
-          <% end %>
-        </div>
-      </section>
-    <% end %>
-  </div>
-</div>

data/app/views/layouts/cloudflare/email/management.html.erb

@@ -1,29 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>Mailbox management</title>
-    <%= csrf_meta_tags %>
-    <%= stylesheet_link_tag style_path %>
-  </head>
-  <body>
-    <a class="skip-link" href="#main">Skip to content</a>
-    <header class="site-header">
-      <div class="shell header-content">
-        <%= link_to "Mailbox management", root_path, class: "brand" %>
-        <span class="header-caption">Cloudflare Email</span>
-        <% if host_back_path %><%= link_to "Back to app", host_back_path %><% end %>
-      </div>
-    </header>
-    <main id="main" class="shell" tabindex="-1">
-      <% if flash[:notice].present? %>
-        <div class="notice" role="status"><%= flash[:notice] %></div>
-      <% end %>
-      <% if flash[:alert].present? %>
-        <div class="notice notice-error" role="alert"><%= flash[:alert] %></div>
-      <% end %>
-      <%= yield %>
-    </main>
-  </body>
-</html>