cloudflare-email 0.3.0 → 0.4.1

data/templates/worker/docs/durable-inbound.md

@@ -5,12 +5,6 @@ The bundled Worker uses R2 storage, Queue delivery and scheduled recovery by
 default. No enable flag, Rails model, database, or tenancy change is needed.
 Missing infrastructure fails visibly; it never silently downgrades to direct delivery.
 
-Upgrade the Rails gem before deploying this Worker. New messages without a parseable
-Message-ID use a deterministic fallback for deduplication across Rails hosts.
-Older records created before this change use ActionMailbox's hostname-dependent
-fallback; replaying those historical messages after upgrading can create a new
-record. Reconcile any existing archive backlog before replaying it automatically.
-
 ## Set it up
 
 Create a private R2 bucket and a Queue for each environment:
@@ -23,8 +17,7 @@ npx wrangler queues create cloudflare-email-inbound-production
 The bundled `wrangler.toml` already configures these resources for each environment.
 Customize their names if needed. Configure **all three** pieces: the `INBOUND_EMAIL_STORE` R2
 binding, `INBOUND_EMAIL_QUEUE` producer and consumer, and the once-per-minute
-scheduled trigger. Keep `RAILS_INGRESS_URL` and `INGRESS_SECRET` configured as
-before. Deploy with `npm run deploy -- --env production`.
+scheduled trigger. Keep `RAILS_INGRESS_URL` and `INGRESS_SECRET` configured. Deploy with `npm run deploy -- --env production`.
 
 Use separate buckets, queues and secrets for staging and production. Do not add
 an R2 lifecycle rule that expires `cloudflare-email/pending/` objects. Pending
@@ -38,7 +31,7 @@ binding, and minute schedule before changing code or secrets. This check does no
 validate the bucket lifecycle or queue consumer: verify those in your infrastructure
 configuration and live drill. The Ruby task does not provision resources.
 
-## Direct fallback and upgrades
+## Direct fallback
 
 Set `INBOUND_DELIVERY_MODE = "direct"` in the environment's Wrangler vars only when
 you deliberately want a single HTTP handoff. With the Ruby task, pass
@@ -49,15 +42,10 @@ recovery continue draining previously retained mail. To return to durable delive
 remove the Wrangler override or pass `INBOUND_DELIVERY_MODE=durable` to the Ruby task.
 Unknown values fail rather than choosing a transport implicitly.
 
-The old `DURABLE_INBOUND_ENABLED` rollout flag has been removed. Existing direct
-installations must provision the resources before upgrading the Worker, or explicitly
-select `INBOUND_DELIVERY_MODE=direct` before deploying. Upgrading the Ruby gem alone
-does not redeploy a Worker or change live routing.
-
 ## What happens to a message
 
 1. The Worker validates the envelope and actual MIME size. Invalid or oversized
-   mail is permanently rejected, as in direct mode.
+   mail is permanently rejected.
 2. It writes one R2 object containing the exact raw bytes, SMTP envelope, original
    receive time, and optional provider metadata. It waits for the write before
    returning from the Email Worker handler.
@@ -129,7 +117,7 @@ callback is not canceled. Set `archiveTimeoutMs` to an integer from 1 to 120,000
 milliseconds to fit your host's runtime budget. Treat bytes as read-only and never parse the private
 pending frame to build an archive. The primary R2 write is always mandatory.
 Trusted provider metadata is captured once at receipt, never recomputed on replay.
-The existing `relayEmail` archive callback is best effort and does not enable this
+The `relayEmail` archive callback is best effort and does not enable this
 durable protocol automatically.
 
 ## Guarantee boundary

data/templates/worker/package.json

@@ -9,6 +9,7 @@
     "deploy": "node scripts/wrangler.mjs deploy",
     "dev": "node scripts/wrangler.mjs dev",
     "check": "wrangler deploy --env development --dry-run",
+    "check:subdomains": "node scripts/check-subdomains.mjs",
     "test": "vitest run"
   },
   "devDependencies": {

data/templates/worker/scripts/check-subdomains.mjs

@@ -0,0 +1,54 @@
+// Read-only public DNS check. No Cloudflare credentials or configuration writes.
+import { Resolver } from "node:dns/promises";
+import { randomBytes } from "node:crypto";
+import { parseArgs } from "node:util";
+import { fileURLToPath } from "node:url";
+
+const labelPattern = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+
+export async function checkSubdomains({ base, labels = [] }, lookup, randomLabel = () => `cf-probe-${randomBytes(8).toString("hex")}`) {
+  base = String(base || "").trim().toLowerCase();
+  if (base.length > 220 || base.split(".").length < 2 || !base.split(".").every(label => labelPattern.test(label))) {
+    throw new Error("Provide a DNS base such as in.example.com, without @, a scheme, or *.");
+  }
+  if (labels.length > 10 || !labels.every(label => labelPattern.test(label) && `${label}.${base}`.length <= 253)) {
+    throw new Error("Provide at most 10 comma-separated single-label subdomains, such as acme,globex.");
+  }
+  const probes = [randomLabel(), randomLabel()];
+  const names = [...new Set([...labels, ...probes])];
+  const checks = await Promise.all(names.map(async label => {
+    const domain = `${label}.${base}`;
+    try {
+      const mx = (await lookup(domain)).map(record => ({ priority: record.priority, exchange: record.exchange.toLowerCase().replace(/\.$/, "") }));
+      const cloudflare = mx.length > 0 && mx.every(record => record.exchange.endsWith(".mx.cloudflare.net"));
+      return { domain, fresh_probe: probes.includes(label), status: cloudflare ? "cloudflare_mx_observed" : "other_or_missing_mx", mx };
+    } catch (error) {
+      return { domain, fresh_probe: probes.includes(label), status: "unknown", reason: error.code || "DNS_LOOKUP_FAILED" };
+    }
+  }));
+  return {
+    checked_at: new Date().toISOString(),
+    base, dns_observation: checks.every(check => check.status === "cloudflare_mx_observed") ? "cloudflare_mx_observed_for_all_names" : "needs_attention",
+    delivery_verified: false, checks,
+    next_step: "Inspect the catch-all Worker rule, register two exact domains/mailboxes in Rails, and send real test emails. MX answers do not verify account ownership, Email Routing acceptance, Worker delivery, or Rails persistence."
+  };
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  try {
+    const { values } = parseArgs({ options: { base: { type: "string" }, labels: { type: "string" }, help: { type: "boolean" } } });
+    if (values.help) {
+      console.log("npm run check:subdomains -- --base in.example.com [--labels acme,globex]\nRead-only DNS observations, including two fresh labels. This does not verify email delivery.");
+    } else {
+      const resolver = new Resolver({ timeout: 2000, tries: 1 });
+      const labels = values.labels ? values.labels.split(",").map(label => label.trim().toLowerCase()) : [];
+      const report = await checkSubdomains({ base: values.base, labels }, domain => resolver.resolveMx(domain));
+      console.log(JSON.stringify(report, null, 2));
+      if (report.dns_observation === "needs_attention") process.exitCode = 1;
+    }
+  } catch (error) {
+    console.error(error.message);
+    console.error("Usage: npm run check:subdomains -- --base in.example.com [--labels acme,globex]");
+    process.exitCode = 1;
+  }
+}

data/templates/worker/test/subdomains.test.ts

@@ -0,0 +1,51 @@
+import { describe, it, expect, vi } from "vitest";
+import { checkSubdomains } from "../scripts/check-subdomains.mjs";
+
+function probes() {
+  let id = 0;
+  return () => `fresh-${++id}`;
+}
+const cloudflare = [{ priority: 10, exchange: "route1.mx.cloudflare.net" }];
+
+describe("subdomain setup DNS observations", () => {
+  it("checks chosen exact names plus fresh labels without claiming delivery", async () => {
+    const lookup = vi.fn(async () => cloudflare);
+    const report = await checkSubdomains({ base: "in.example.com", labels: ["acme"] }, lookup, probes());
+    expect(lookup.mock.calls.map(call => call[0])).toEqual(["acme.in.example.com", "fresh-1.in.example.com", "fresh-2.in.example.com"]);
+    expect(report.dns_observation).toBe("cloudflare_mx_observed_for_all_names");
+    expect(report.delivery_verified).toBe(false);
+  });
+
+  it("reports an exact-name exception even when fresh probes resolve", async () => {
+    const report = await checkSubdomains({ base: "in.example.com", labels: ["acme"] }, async domain => {
+      if (domain.startsWith("acme.")) throw Object.assign(new Error("no answer"), { code: "ENODATA" });
+      return cloudflare;
+    }, probes());
+    expect(report.dns_observation).toBe("needs_attention");
+    expect(report.checks[0].status).toBe("unknown");
+  });
+
+  it.each([
+    { mx: [] }, { mx: [{ priority: 0, exchange: "." }] },
+    { mx: [{ priority: 10, exchange: "mx.example.com" }] },
+    { mx: [...cloudflare, { priority: 5, exchange: "mx.other.test" }] }
+  ])("does not accept absent, null, foreign or mixed MX: $mx", async ({ mx }) => {
+    const report = await checkSubdomains({ base: "in.example.com" }, async () => mx, probes());
+    expect(report.dns_observation).toBe("needs_attention");
+  });
+
+  it("preserves DNS timeout uncertainty", async () => {
+    const report = await checkSubdomains({ base: "in.example.com" }, async () => { throw Object.assign(new Error("timeout"), { code: "ETIMEOUT" }); }, probes());
+    expect(report.checks.every(check => check.status === "unknown")).toBe(true);
+    expect(report.delivery_verified).toBe(false);
+  });
+
+  it("rejects malformed domains and nested labels before DNS", async () => {
+    const lookup = vi.fn();
+    for (const base of ["*.example.com", "https://example.com", "a@b.com", "localhost", "a..com"]) {
+      await expect(checkSubdomains({ base }, lookup)).rejects.toThrow();
+    }
+    await expect(checkSubdomains({ base: "example.com", labels: ["nested.acme"] }, lookup)).rejects.toThrow();
+    expect(lookup).not.toHaveBeenCalled();
+  });
+});

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cloudflare-email
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Cole
@@ -9,6 +9,20 @@ bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: mailbox-kit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.1.0
 - !ruby/object:Gem::Dependency
   name: base64
   requirement: !ruby/object:Gem::Requirement
@@ -141,12 +155,7 @@ files:
 - app/controllers/cloudflare/email/ingress_controller.rb
 - app/controllers/cloudflare/email/management/mailboxes_controller.rb
 - app/controllers/cloudflare/email/management/styles_controller.rb
-- app/views/cloudflare/email/management/mailboxes/index.html.erb
-- app/views/cloudflare/email/management/mailboxes/message.html.erb
-- app/views/cloudflare/email/management/mailboxes/show.html.erb
-- app/views/layouts/cloudflare/email/management.html.erb
 - docs/activerecord-tenanted.md
-- docs/architecture.md
 - docs/custom-ingress.md
 - docs/delivery-events.md
 - docs/features.md
@@ -154,24 +163,11 @@ files:
 - docs/mailboxes.md
 - docs/management-engine.md
 - docs/outbox.md
+- docs/reference.md
 - docs/routing-deliveries.md
 - docs/routing-diagnostics.md
-- docs/tenant-mailboxes-plan.md
 - docs/thread-correlation.md
 - docs/troubleshooting.md
-- docs/upgrading-0.2.md
-- docs/upgrading-0.3.md
-- docs/verification/2026-09-10-followup.md
-- docs/verification/2026-09-10-install-upgrade.md
-- docs/verification/2026-09-10-live.md
-- docs/verification/2026-09-10.md
-- docs/verification/2026-09-11-custom-ingress.md
-- docs/verification/2026-09-11-extraction.md
-- docs/verification/2026-09-11-outbound-ledger.md
-- docs/verification/2026-09-11-security.md
-- docs/verification/2026-09-11-tenant-mailboxes.md
-- docs/verification/2026-09-12-destination-context.md
-- docs/verification/2026-09-13-durable-inbound-and-routing.md
 - examples/plain_ruby.rb
 - lib/cloudflare-email.rb
 - lib/cloudflare/email/active_record.rb
@@ -215,7 +211,6 @@ files:
 - lib/cloudflare/email/management/adapter.rb
 - lib/cloudflare/email/management/configuration.rb
 - lib/cloudflare/email/management/engine.rb
-- lib/cloudflare/email/management/management.css
 - lib/cloudflare/email/management/routes.rb
 - lib/cloudflare/email/message_id.rb
 - lib/cloudflare/email/provider_metadata.rb
@@ -256,23 +251,29 @@ files:
 - templates/deploy-to-cloudflare/.gitignore
 - templates/deploy-to-cloudflare/LICENSE.txt
 - templates/deploy-to-cloudflare/README.md
+- templates/deploy-to-cloudflare/docs/domain-setup.md
 - templates/deploy-to-cloudflare/package-lock.json
 - templates/deploy-to-cloudflare/package.json
+- templates/deploy-to-cloudflare/scripts/check-subdomains.mjs
 - templates/deploy-to-cloudflare/src/index.js
 - templates/deploy-to-cloudflare/test/durable.test.ts
 - templates/deploy-to-cloudflare/test/index.test.ts
 - templates/deploy-to-cloudflare/test/relay.test.ts
+- templates/deploy-to-cloudflare/test/subdomains.test.ts
 - templates/deploy-to-cloudflare/vitest.config.ts
 - templates/deploy-to-cloudflare/wrangler.toml
 - templates/worker/README.md
+- templates/worker/docs/domain-setup.md
 - templates/worker/docs/durable-inbound.md
 - templates/worker/package-lock.json
 - templates/worker/package.json
+- templates/worker/scripts/check-subdomains.mjs
 - templates/worker/scripts/wrangler.mjs
 - templates/worker/src/index.js
 - templates/worker/test/durable.test.ts
 - templates/worker/test/index.test.ts
 - templates/worker/test/relay.test.ts
+- templates/worker/test/subdomains.test.ts
 - templates/worker/vitest.config.ts
 - templates/worker/wrangler.toml
 homepage: https://github.com/cole-robertson/cloudflare-email

data/app/views/cloudflare/email/management/mailboxes/index.html.erb

@@ -1,65 +0,0 @@
-<div class="page-heading">
-  <div>
-    <p class="eyebrow">Email workspace</p>
-    <h1>Mailboxes</h1>
-    <p class="muted">Manage accepted addresses and the messages delivered to them.</p>
-  </div>
-</div>
-
-<div class="workspace-grid">
-  <section class="panel" aria-labelledby="mailboxes-heading">
-    <div class="panel-heading"><h2 id="mailboxes-heading">Your mailboxes</h2></div>
-    <% if @mailboxes.empty? %>
-      <div class="empty-state">
-        <h3>No mailboxes to show</h3>
-        <p>Create a mailbox to give incoming email a home.</p>
-      </div>
-    <% else %>
-      <ul class="record-list">
-        <% @mailboxes.each do |mailbox| %>
-          <li class="record-row">
-            <div class="record-content">
-              <% if allowed?(:show, mailbox) %>
-                <%= link_to mailbox.name, mailbox_path(mailbox.id), class: "record-title" %>
-              <% else %>
-                <span class="record-title"><%= mailbox.name %></span>
-              <% end %>
-              <p class="muted small">Mailbox #<%= mailbox.id %></p>
-            </div>
-            <span class="badge"><%= mailbox.state.capitalize %></span>
-          </li>
-        <% end %>
-      </ul>
-    <% end %>
-    <% if @next_cursor.present? %>
-      <nav class="pagination" aria-label="Mailbox pages">
-        <%= link_to "Next mailboxes →", root_path(after: @next_cursor), class: "button button-secondary" %>
-      </nav>
-    <% end %>
-  </section>
-
-  <% if allowed?(:create) %>
-    <section class="panel" aria-labelledby="create-heading">
-      <div class="panel-heading"><h2 id="create-heading">Create a mailbox</h2></div>
-      <div class="panel-body">
-        <% if @domains.empty? %>
-          <p class="muted">An administrator needs to register an active receiving domain before you can create a mailbox.</p>
-        <% else %>
-          <%= form_with url: mailboxes_path, scope: :mailbox, local: true, class: "stack" do |form| %>
-            <div class="field">
-              <%= form.label :name, "Mailbox name" %>
-              <%= form.text_field :name, required: true, maxlength: 255, placeholder: "Customer support" %>
-            </div>
-            <div class="field">
-              <%= form.label :address, "Email address" %>
-              <%= form.email_field :address, required: true, maxlength: 254, placeholder: "support@#{@domains.first}", aria: { describedby: "create-domains" } %>
-              <p id="create-domains" class="field-help">Available domains: <%= @domains.join(", ") %></p>
-            </div>
-            <p class="field-help">New addresses start pending. Your administrator must confirm their routing before they can receive mail.</p>
-            <%= form.submit "Create mailbox", class: "button" %>
-          <% end %>
-        <% end %>
-      </div>
-    </section>
-  <% end %>
-</div>

data/app/views/cloudflare/email/management/mailboxes/message.html.erb

@@ -1,34 +0,0 @@
-<nav class="breadcrumbs" aria-label="Breadcrumb">
-  <%= link_to "Mailboxes", root_path %> <span aria-hidden="true">/</span>
-  <%= link_to @mailbox.name, mailbox_path(@mailbox.id) %> <span aria-hidden="true">/</span>
-  <span>Message</span>
-</nav>
-<div class="page-heading">
-  <div><p class="eyebrow">Received message</p><h1><%= @subject.presence || "(No subject)" %></h1></div>
-  <div class="actions">
-    <% if allowed?(:mark_read, @mailbox) %>
-      <%= button_to(@entry.read_at ? "Mark unread" : "Mark read", mark_read_mailbox_path(@mailbox.id), method: :post, params: { message_id: @entry.id, read: @entry.read_at ? "false" : "true" }, class: "button button-secondary") %>
-    <% end %>
-    <% if allowed?(:archive, @mailbox) %>
-      <%= button_to(@entry.archived_at ? "Unarchive" : "Archive", archive_mailbox_path(@mailbox.id), method: :post, params: { message_id: @entry.id, archived: @entry.archived_at ? "false" : "true" }, class: "button button-secondary") %>
-    <% end %>
-  </div>
-</div>
-<article class="panel" aria-label="Email message">
-  <div class="panel-body">
-    <dl class="message-metadata">
-      <dt>From</dt><dd><%= @from.presence || "(Unknown sender)" %></dd>
-      <dt>To</dt><dd><%= @entry.recipient %></dd>
-      <dt>Received</dt><dd><time datetime="<%= @entry.created_at.iso8601 %>"><%= @entry.created_at.utc.strftime("%b %-d, %Y · %H:%M UTC") %></time></dd>
-      <dt>Status</dt><dd><%= @entry.read_at ? "Read" : "Unread" %><%= " · Archived" if @entry.archived_at %></dd>
-    </dl>
-  </div>
-  <div class="message-body"><pre><%= @body.presence || "No text content is available for this message." %></pre></div>
-  <% if @attachments.any? %>
-    <section class="panel-body attachments" aria-labelledby="attachments-heading">
-      <h2 id="attachments-heading">Attachments</h2>
-      <p class="field-help">File names are shown for reference. Downloads are not available in this dashboard.</p>
-      <ul><% @attachments.each do |filename| %><li><%= filename.presence || "Unnamed attachment" %></li><% end %></ul>
-    </section>
-  <% end %>
-</article>

data/app/views/cloudflare/email/management/mailboxes/show.html.erb

@@ -1,86 +0,0 @@
-<nav class="breadcrumbs" aria-label="Breadcrumb"><%= link_to "Mailboxes", root_path %> <span aria-hidden="true">/</span> <span><%= @mailbox.name %></span></nav>
-<div class="page-heading">
-  <div>
-    <p class="eyebrow">Mailbox</p>
-    <h1><%= @mailbox.name %></h1>
-    <p class="muted"><%= @mailbox.state == "suspended" ? "Receiving is paused for every address in this mailbox." : "Addresses receive mail when both their address and domain are active." %></p>
-  </div>
-  <div class="actions">
-    <span class="badge"><%= @mailbox.state.capitalize %></span>
-    <% if @mailbox.state == "active" && allowed?(:suspend, @mailbox) %>
-      <%= button_to "Suspend mailbox", suspend_mailbox_path(@mailbox.id), method: :post, class: "button button-secondary" %>
-    <% elsif @mailbox.state == "suspended" && allowed?(:resume, @mailbox) %>
-      <%= button_to "Resume mailbox", resume_mailbox_path(@mailbox.id), method: :post, class: "button" %>
-    <% end %>
-  </div>
-</div>
-
-<div class="workspace-grid">
-  <section class="panel" aria-labelledby="messages-heading">
-    <div class="panel-heading"><h2 id="messages-heading">Received messages</h2><p class="muted small">Includes archived messages</p></div>
-    <% if @messages.empty? %>
-      <div class="empty-state"><h3>No messages to show</h3><p>Messages appear here after delivery to an active address.</p></div>
-    <% else %>
-      <ul class="record-list">
-        <% @messages.each do |entry| %>
-          <li class="record-row">
-            <div class="record-content">
-              <% if allowed?(:show_message, @mailbox) %>
-                <%= link_to "Message to #{entry.recipient}", message_mailbox_path(@mailbox.id, message_id: entry.id), class: "record-title" %>
-              <% else %>
-                <span class="record-title">Message to <%= entry.recipient %></span>
-              <% end %>
-              <p class="muted small"><time datetime="<%= entry.created_at.iso8601 %>"><%= entry.created_at.utc.strftime("%b %-d, %Y · %H:%M UTC") %></time></p>
-            </div>
-            <div class="status-list">
-              <span class="badge"><%= entry.read_at ? "Read" : "Unread" %></span>
-              <% if entry.archived_at %><span class="badge">Archived</span><% end %>
-            </div>
-          </li>
-        <% end %>
-      </ul>
-    <% end %>
-    <% if @next_cursor.present? %>
-      <nav class="pagination" aria-label="Message pages"><%= link_to "Next messages →", mailbox_path(@mailbox.id, after: @next_cursor), class: "button button-secondary" %></nav>
-    <% end %>
-  </section>
-
-  <div class="stack">
-    <section class="panel" aria-labelledby="addresses-heading">
-      <div class="panel-heading"><h2 id="addresses-heading">Addresses</h2></div>
-      <ul class="record-list">
-        <% @addresses.each do |address| %>
-          <% receiving = @mailbox.state == "active" && address.state == "active" && address.receiving_domain&.state == "active" %>
-          <li class="record-row address-row">
-            <span class="record-title"><%= address.address %></span>
-            <% if address.has_attribute?(:catch_all) && address[:catch_all] %>
-              <span class="badge">Domain catch-all configured</span>
-            <% end %>
-            <span class="badge"><%= receiving ? "Accepting mail" : address.state == "pending" ? "Pending setup" : "Receiving paused" %></span>
-          </li>
-        <% end %>
-      </ul>
-      <div class="panel-body"><p class="field-help">Pending addresses need routing confirmation from your administrator. Resuming a mailbox preserves each address’s existing setup state.</p></div>
-    </section>
-
-    <% if allowed?(:add_address, @mailbox) %>
-      <section class="panel" aria-labelledby="alias-heading">
-        <div class="panel-heading"><h2 id="alias-heading">Add an alias</h2></div>
-        <div class="panel-body">
-          <% if @domains.empty? %>
-            <p class="muted">No active receiving domains are available. Contact your administrator.</p>
-          <% else %>
-            <%= form_with url: aliases_mailbox_path(@mailbox.id), local: true, class: "stack" do |form| %>
-              <div class="field">
-                <%= form.label :address, "Alias email address" %>
-                <%= form.email_field :address, required: true, maxlength: 254, aria: { describedby: "alias-domains" } %>
-                <p id="alias-domains" class="field-help">Available domains: <%= @domains.join(", ") %>. Messages to this alias will appear in this mailbox.</p>
-              </div>
-              <%= form.submit "Add alias", class: "button" %>
-            <% end %>
-          <% end %>
-        </div>
-      </section>
-    <% end %>
-  </div>
-</div>

data/app/views/layouts/cloudflare/email/management.html.erb

@@ -1,29 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>Mailbox management</title>
-    <%= csrf_meta_tags %>
-    <%= stylesheet_link_tag style_path %>
-  </head>
-  <body>
-    <a class="skip-link" href="#main">Skip to content</a>
-    <header class="site-header">
-      <div class="shell header-content">
-        <%= link_to "Mailbox management", root_path, class: "brand" %>
-        <span class="header-caption">Cloudflare Email</span>
-        <% if host_back_path %><%= link_to "Back to app", host_back_path %><% end %>
-      </div>
-    </header>
-    <main id="main" class="shell" tabindex="-1">
-      <% if flash[:notice].present? %>
-        <div class="notice" role="status"><%= flash[:notice] %></div>
-      <% end %>
-      <% if flash[:alert].present? %>
-        <div class="notice notice-error" role="alert"><%= flash[:alert] %></div>
-      <% end %>
-      <%= yield %>
-    </main>
-  </body>
-</html>

data/docs/architecture.md

@@ -1,105 +0,0 @@
-# Gem and inbox responsibilities
-
-The Cloudflare gem supplies email transport and reusable delivery infrastructure.
-The inbox application supplies a product built on that infrastructure. Plain Ruby
-users should not need Rails or a database. Rails users should be able to opt into
-durable infrastructure without copying the reference inbox's models and services.
-
-## Implemented in this extraction
-
-| Gem capability | Application responsibility |
-| --- | --- |
-| Optional mailbox/address directory and tenant connection adapter | Authorize domain ownership, provision tenant databases and grant user access |
-| Mailbox memberships, read/archive state and retained raw mail | Inbox UI, retention schedule and explicit purge policy |
-| Shared event intake, tenant correlation and tenant-aware jobs | Durable queue workers, scheduled recovery and schema rollout to every tenant |
-| Structured/raw sending and ActionMailer transport | Compose UI, recipients and send authorization |
-| `Response#accepted?`, plus individual recipient outcomes | Handle partial acceptance without resending accepted recipients |
-| Authenticated ingress (default v2; opt-in v3 [metadata](custom-ingress.md)) and context-scoped deduplication | Map trusted recipient to an authorized mailbox; apply sender and document policy |
-| `MessageId.normalize` and returned provider IDs | Store conversation membership and scope reply lookups |
-| Queue decoding, validation and ACK | Queue/subscription setup and recurring execution |
-| Optional ActiveRecord event receipts, deduplication and indexed replay | Configure queue polling and receipt retention |
-| Immutable outbox snapshots, send claims, per-recipient outcomes | Authorize sending and choose a stable operation key |
-| `DeliveryEvents` account/message/recipient correlation and ordering | Transactional callback to update product records |
-| Send/replay jobs, recovery tasks and audited reconciliation | Authorize operators and provide evidence of provider outcome |
-
-The ActiveRecord adapter is explicit opt-in. Its generator installs a receipt table
-and initializer; the default plain Ruby client does not load ActiveRecord. Its
-handler applies application writes on the same database connection as the receipt.
-It does not wrap HTTP calls or other external effects in a database transaction.
-
-Version 0.2 is a preproduction break: v1 ingress and signed Message-ID tokens are
-removed. Cloudflare's documented queue encodings and recipient-response forms are
-provider contracts, so accepting them is not obsolete application compatibility.
-Historical verification reports describe their dated runs, not the current API.
-
-## Implemented: durable outbound delivery
-
-The inbox now uses the gem's ledger tables and orchestration. Its model subclasses
-add application message associations and display snapshots; they do not maintain
-a second sending ledger. See the [outbox guide](outbox.md) for installation and API.
-
-1. Claim an application-supplied operation key scoped to an account using a unique
-   index before sending; repeated or concurrent calls cannot silently resend.
-2. Persist immutable rendered MIME and envelope recipients before the network
-   request. Track each recipient separately, including partial acceptance.
-3. Separate preparation failures from ambiguous outcomes. A timeout, process death
-   or persistence failure after acceptance keeps the operation blocked. An elapsed
-   timeout alone never proves the message was not sent.
-4. Persist validated provider IDs and recipient acceptance outcomes separately
-   from later lifecycle events. Replay correlates account, message and recipient;
-   conflicting IDs remain uncertain. The network and database are not atomic.
-5. Expose audited reconciliation with caller-supplied actor/reason and evidence.
-   The application authorizes the operator; the gem enforces legal transitions.
-6. Provide jobs/tasks and notifications that preserve the same claim on retries.
-   Include migration/import support for the reference inbox's existing attempts.
-
-The suite exercises concurrent senders, actual process termination, acceptance
-followed by persistence failure, partial recipients, event-before-response,
-out-of-order events, callbacks that roll back, and recovery without a duplicate
-send. PostgreSQL and SQLite run separate concurrency checks. Inbox HTTP and browser
-workflows use the shared implementation, with controlled local provider responses.
-
-Historic attempts did not preserve rendered MIME. Their import retains available
-bodies, IDs, outcomes and operator evidence and marks reconstructed snapshots.
-Unknown historical outcomes remain blocked. No migration claims to recreate the
-exact bytes of a previously sent message.
-
-## Operational completion
-
-The reference inbox supplies a functional mailbox product over these APIs. Before
-production use, configure sending DNS and receiving routes, queue subscriptions
-and dead-letter handling, durable Rails jobs, receipt/MIME retention and backups,
-and monitoring for prepared/sending/unknown/partial operations. Exercise live
-external mailbox delivery and recovery with the deployed revision. Installation
-does not automatically provision domains or deploy infrastructure.
-
-Current limitations are deliberate and visible: no provider exactly-once API,
-no automatic resend of uncertain or rejected operations, no multi-provider-ID
-operation (conflicting IDs require review). Direct inbound forwarding can reject
-mail during a Rails outage. The default [durable Worker path](../templates/worker/README.md#durable-inbound-delivery)
-commits raw mail and stable envelope context to R2 before returning successfully.
-Queue handoffs and a scheduled recovery pass retry pending mail; a Rails 2xx
-allows removal from the pending store. Queue expiration does not remove R2 mail.
-This boundary requires durable Rails persistence before 2xx, idempotent replay,
-private R2 storage without expiration of pending objects, and operational
-monitoring. It cannot guarantee acceptance when Cloudflare itself cannot store
-the incoming message.
-A prepared operation can be dispatched using its existing identity after a job
-enqueue failure; sending/unknown operations require evidence-based reconciliation.
-Notifications indicate method execution and may run inside an outer transaction;
-the durable database record is authoritative.
-
-## Keep in the inbox product
-
-Users, tenancy, mailbox ownership, conversations, folders, search and UI remain in
-the inbox. AI context, review flags, approval thresholds, auto-send policy and
-operator permissions also stay there. Suppression/unsubscribe requirements depend
-on message purpose and application policy; expose provider outcomes, but do not
-silently impose a marketing subscription model on transactional mail.
-
-The optional [mailbox module](mailboxes.md) now packages mailbox persistence and
-address management over the existing transport/receipt APIs. It includes a
-[tenant adapter](activerecord-tenanted.md), without adding a tenant library to
-the plain Ruby client. The optional [management engine](management-engine.md)
-consumes these same APIs with host-supplied authentication and authorization.
-Full inbox products can continue using them through their own frontends.