cloudflare-email 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b8b7e8e8e9c8f102cf640de5aa577092947f829853daea59463263b8729ede21
-  data.tar.gz: 7303add7cb750e309c338132e114ecd40340bf5e9ee39b6b03c3f28acd9887d1
+  metadata.gz: c65b29d22af39c25cb2affb776984bc9a9086bcad75c7388c2017692f61eb9ef
+  data.tar.gz: 2c0d1f15f4159e780257260af62cca8d414c7cc00d7c1c8b2677ac243cf81b04
 SHA512:
-  metadata.gz: 77cbd0de1b51f621f834fa9493c31865cc0017e0f221885503ad6c891f783f39b3e0eaf07eaabb148a9e34c694bed9d8e4a0dfa27cd052e70e0d9e17164e9483
-  data.tar.gz: 3e3ee8aa24120e3b264efd7328b18dc3c48ab044656c0e15d0f73a13d2fd18e06247ab7392bc72aba472d37bee1b080a77113e492d4dcbe8c6945e2c5ceeb34a
+  metadata.gz: 4b76b7c08c99da504f7c90bbfb79f6f3130345e128c0fad9988a1449270d79019ffa5af8fb62a0759ad881c56019ffe6d9f6b967d13136e988b9e98ef6d7043e
+  data.tar.gz: d3f2d2573c6d41140ceff2395c4aa84194eb10ad2c56379df133f1fa1687424b009513800e4c67d1077584750146c2f5b9e0dfedfb53d2b9a351c5f207f80636

data/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 0.4.0 — 2026-09-14
+
+Released alongside Mailbox Kit 0.1.0. Cloudflare installs the core automatically.
+Existing installations should follow the [core upgrade guide](mailbox-kit/docs/upgrading.md).
+
+- Allow receiving domains without a sending account. The upgrade generator
+  preserves existing directory records while making account ownership optional.
+
+- Index inbox memberships by inbound email for recipient isolation checks,
+  retention and purge. New schemas include the index; `mailbox_kit:upgrade`
+  generates a data-preserving migration for existing installations.
+- Delegate shared configuration to Mailbox Kit and isolate Cloudflare session
+  additions in an integration module. Provide a short core quickstart plus
+  packaged integration and upgrade guides.
+
+- Lean on Action Mailbox for original email records, processing and configurable
+  retention. Add idempotent attachment of existing Rails records and source-based
+  receiving that resolves duplicates for inbox membership. Share the persistence
+  bridge with Cloudflare while preserving its signed delivery identity and legacy
+  duplicate return value. Reuse Rails' model load hook for selective retention.
+
+- Extract provider-neutral mailbox storage, recipient routing, optional tenancy,
+  raw-message retention, Rails job context and the server-rendered UI into the
+  sibling `mailbox-kit` gem. Cloudflare APIs, Worker transport, sending outbox and
+  delivery feedback remain in `cloudflare-email`. Preserve existing table names,
+  public constants, job payload keys and mounted Cloudflare engine routes.
+  See [Mailbox Kit](mailbox-kit/README.md) for standalone setup and release order.
+
+- Add a cited one-time domain setup guide for both receiving domains and dynamic
+  organization subdomains, shared between Worker templates. Add a read-only
+  `npm run check:subdomains` DNS helper with named/fresh probes and explicit limits
+  on what DNS can verify. The Worker transport and gem routing behavior are unchanged.
+
 ## 0.3.0 — 2026-09-13
 
 See [upgrading from 0.2](docs/upgrading-0.3.md) before deploying the updated Worker.

data/README.md

@@ -2,7 +2,7 @@
 
 Ruby client for [Cloudflare Email Service](https://developers.cloudflare.com/email-service/), with ActionMailer, authenticated ActionMailbox ingress, a forwarding Worker, and optional durable Rails sending and delivery-event tracking.
 
-Version **0.3.0**. Ruby 3.2+, Rails 7.2–8.1; Ruby 4.0 is tested with Rails 8.1. Supported test floors are Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1. Prefer a maintained Ruby/Rails release for new applications. The plain Ruby client uses Ruby's standard libraries plus the Base64 gem. Node is optional: Worker deployment also works through the included Ruby deployer. See [security guidance](SECURITY.md) for deployment responsibilities.
+Version **0.4.0**, with **Mailbox Kit 0.1.0**. Ruby 3.2+, Rails 7.2–8.1; Ruby 4.0 is tested with Rails 8.1. Supported test floors are Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1. Prefer a maintained Ruby/Rails release for new applications. Rails and database dependencies remain optional for the plain Ruby client. Node is optional: Worker deployment also works through the included Ruby deployer. See [security guidance](SECURITY.md) for deployment responsibilities.
 
 [![Deploy to Cloudflare](https://deploy.workers.cloudflare.com/button)](https://deploy.workers.cloudflare.com/?url=https://github.com/cole-robertson/cloudflare-email/tree/main/templates/deploy-to-cloudflare)
 
@@ -10,6 +10,13 @@ Deploy the inbound Worker with guided R2/Queue provisioning and secret setup. [P
 
 ## Start here
 
+**Starting in 0.4.0:** provider-neutral mailbox functionality lives in
+the sibling [Mailbox Kit](mailbox-kit/README.md) gem. Existing Cloudflare setup
+continues to work; the core requires no Cloudflare account. Installing
+`cloudflare-email` also installs `mailbox-kit` 0.1.x.
+Existing mailbox installations should use the [core upgrade guide](mailbox-kit/docs/upgrading.md)
+to add the inbound lookup index without recreating their tables.
+
 **Sending email?** Start with the [step-by-step Rails guide](docs/getting-started.md).
 **Building a mailbox?** Follow the same guide through receiving, the SQLite-compatible outbox, and delivery tracking.
 **Using plain Ruby?** Jump to [Plain Ruby](#plain-ruby); Rails and a database are optional.
@@ -18,6 +25,8 @@ Deploy the inbound Worker with guided R2/Queue provisioning and secret setup. [P
 | --- | --- |
 | [Features at a glance](docs/features.md) | Everything the gem handles, and what your app supplies |
 | [Getting started](docs/getting-started.md) | Install, send your first email, receive replies, and save reliable send operations |
+| [Cloudflare domain setup](templates/worker/docs/domain-setup.md) | Configure once for many mailboxes or dynamic organization subdomains, with a Rebulk example and DNS checks |
+| [Hello-world Rails template](https://github.com/cole-robertson/cloudflare-email-rails-starter) | Clone a minimal SQLite mailbox app using the published gem and its management UI |
 | [Troubleshooting](docs/troubleshooting.md) | What to check when mail or delivery updates do not arrive |
 | [Managed mailboxes](docs/mailboxes.md) | Create inboxes and aliases, read/archive mail, and send from a mailbox |
 | [Management engine](docs/management-engine.md) | Mount an optional server-rendered mailbox UI using your app's authentication |
@@ -29,16 +38,17 @@ Deploy the inbound Worker with guided R2/Queue provisioning and secret setup. [P
 | [SQLite tenant databases](docs/activerecord-tenanted.md) | Give each organization its own SQLite database with `activerecord-tenanted` |
 | [Durable outbox](docs/outbox.md) | Detailed setup, callbacks, retries, and recovery |
 | [Delivery events](docs/delivery-events.md) | Cloudflare Queue setup and recipient status tracking |
-| [Upgrading to 0.3](docs/upgrading-0.3.md) | Changes needed for an existing installation |
+| [Upgrading to 0.4](mailbox-kit/docs/upgrading.md) | Core extraction and data-preserving migrations for existing mailboxes |
+| [Upgrading from 0.2](docs/upgrading-0.3.md) | Additional changes before deploying the durable Worker |
 
 The sections below are the configuration and API reference.
 
 ## Install and send from Rails
 
-Add version 0.3 to your Gemfile. Existing users should follow the [upgrade guide](docs/upgrading-0.3.md), especially before deploying the durable Worker:
+Add version 0.4 to your Gemfile. Existing mailbox users should follow the [core upgrade guide](mailbox-kit/docs/upgrading.md). When upgrading from 0.2, also follow the [durable Worker upgrade guide](docs/upgrading-0.3.md):
 
 ```ruby
-gem "cloudflare-email", "~> 0.3.0"
+gem "cloudflare-email", "~> 0.4.0"
 ```
 
 ```sh

data/app/controllers/cloudflare/email/ingress_controller.rb

@@ -35,9 +35,8 @@ module Cloudflare
             head :payload_too_large
           when :ok
             inbound = if defined?(Cloudflare::Email::Mailboxes) && Cloudflare::Email::Mailboxes.enabled?
-              recipient = result.message.envelope.fetch("to")
               begin
-                Cloudflare::Email::Mailboxes.receive(recipient: recipient) { result.message.persist_action_mailbox! }
+                result.message.receive_into_mailbox!
               rescue Cloudflare::Email::Mailboxes::Unavailable
                 payload[:result] = :unavailable_mailbox
                 next head(:unprocessable_entity)

data/app/controllers/cloudflare/email/management/mailboxes_controller.rb

@@ -1,172 +1,8 @@
+require File.join(MailboxKit::ROOT, "app/controllers/mailbox_kit/management/mailboxes_controller.rb")
 module Cloudflare
   module Email
     module Management
-      class MailboxesController < ActionController::Base
-        layout "layouts/cloudflare/email/management"
-        protect_from_forgery with: :exception
-        self.forgery_protection_origin_check = true
-        around_action :with_host_context
-        helper_method :allowed?, :host_back_path
-
-        class Denied < StandardError; end
-        class InvalidInput < StandardError; end
-
-        rescue_from Denied do
-          head :forbidden
-        end
-        rescue_from "ActiveRecord::RecordNotFound" do
-          head :not_found
-        end
-        rescue_from InvalidInput, "ActiveRecord::RecordInvalid", Cloudflare::Email::Error do
-          redirect_to(@mailbox ? mailbox_path(@mailbox) : root_path,
-            alert: "The changes could not be saved. Check the address, registered domain and required fields.",
-            status: :see_other)
-        end
-        rescue_from Cloudflare::Email::ConfigurationError do
-          head :service_unavailable
-        end
-
-        def index
-          authorize!(:index)
-          @mailboxes = page(scoped_mailboxes)
-          @domains = permitted_domains if allowed?(:create)
-        end
-
-        def show
-          load_mailbox!(:show)
-          @addresses = @session.addresses(@mailbox.id).order(:id).to_a
-          @domains = allowed?(:add_address, @mailbox) ? permitted_domains : []
-          @messages = allowed?(:show_message, @mailbox) ? page(@session.messages(@mailbox.id)) : []
-        end
-
-        def create
-          authorize!(:create)
-          input = params.require(:mailbox)
-          raise InvalidInput unless input.is_a?(ActionController::Parameters)
-          values = input.permit(:name, :address)
-          name = values[:name].to_s.strip
-          raise InvalidInput unless (1..255).cover?(name.length)
-          address = permitted_address!(values[:address])
-          Mailboxes::Mailbox.transaction do
-            @mailbox = @adapter.create_mailbox(@session, name: name, address: address)
-            # A hook cannot turn an arbitrary return value into a readable mailbox.
-            @mailbox = scoped_mailboxes.find(@mailbox.id)
-          end
-          redirect_to mailbox_path(@mailbox), notice: "Mailbox created. Review address setup below.", status: :see_other
-        end
-
-        def add_address
-          load_mailbox!(:add_address)
-          @adapter.add_address(@session, @mailbox, address: permitted_address!(params[:address]))
-          redirect_to mailbox_path(@mailbox), notice: "Address added. Review its setup status.", status: :see_other
-        end
-
-        def suspend
-          load_mailbox!(:suspend)
-          @session.suspend(@mailbox.id)
-          redirect_to mailbox_path(@mailbox), notice: "Mailbox suspended. Messages are retained.", status: :see_other
-        end
-
-        def resume
-          load_mailbox!(:resume)
-          @session.resume(@mailbox.id)
-          redirect_to mailbox_path(@mailbox), notice: "Mailbox resumed. Pending addresses still need setup.", status: :see_other
-        end
-
-        def message
-          load_mailbox!(:show_message)
-          @entry = @session.messages(@mailbox.id).find(params[:message_id])
-          raw = @session.inbound_email(@mailbox.id, @entry.id).mail
-          @subject = raw.subject.to_s
-          @from = Array(raw.from).join(", ")
-          part = raw.text_part || (raw.mime_type == "text/plain" ? raw : nil)
-          @body = part ? part.decoded.to_s.encode("UTF-8", invalid: :replace, undef: :replace).first(100_000) :
-            "This message has no plain-text body. HTML rendering is disabled in this management interface."
-          @attachments = raw.attachments.map { |attachment| attachment.filename.to_s }
-          render :message
-        end
-
-        def mark_read
-          load_mailbox!(:mark_read)
-          @session.mark_read(@mailbox.id, params[:message_id], read: boolean_param(:read))
-          redirect_to mailbox_path(@mailbox), status: :see_other
-        end
-
-        def archive
-          load_mailbox!(:archive)
-          @session.archive(@mailbox.id, params[:message_id], archived: boolean_param(:archived))
-          redirect_to mailbox_path(@mailbox), status: :see_other
-        end
-
-        private
-
-        def with_host_context
-          response.headers["Cache-Control"] = "no-store"
-          response.headers["Referrer-Policy"] = "same-origin"
-          response.headers["X-Content-Type-Options"] = "nosniff"
-          response.headers["Content-Security-Policy"] = "default-src 'none'; style-src 'self'; img-src 'none'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'"
-          factory = Management.configuration.adapter
-          unless factory.respond_to?(:call) && defined?(Mailboxes) && Mailboxes.enabled?
-            return head :service_unavailable
-          end
-          @adapter = factory.call(self)
-          authenticated = @adapter.authenticate!
-          return if performed?
-          return head :unauthorized unless authenticated == true
-          Mailboxes.for_tenant(@adapter.tenant_key) do |session|
-            @session = session
-            yield
-          end
-        end
-
-        def allowed?(action, mailbox = nil)
-          @adapter.allowed?(action, mailbox) == true
-        end
-
-        def authorize!(action, mailbox = nil)
-          raise Denied unless allowed?(action, mailbox)
-        end
-
-        def scoped_mailboxes
-          # Always retain the gem's tenant condition even if a host scope omits it.
-          @session.mailboxes.where(id: @adapter.mailboxes(@session).reselect(:id))
-        end
-
-        def load_mailbox!(action)
-          @mailbox = scoped_mailboxes.find(params[:id])
-          authorize!(action, @mailbox)
-        end
-
-        def permitted_domains
-          granted = Array(@adapter.domains(@session)).map(&:to_s)
-          Mailboxes::ReceivingDomain.active.where(tenant_key: @session.tenant_key, domain: granted).order(:domain).pluck(:domain)
-        end
-
-        def permitted_address!(value)
-          address = Mailboxes.canonical_address(value)
-          raise InvalidInput unless permitted_domains.include?(address.split("@", 2).last)
-          address
-        end
-
-        def page(relation)
-          cursor = params[:after].to_s
-          raise InvalidInput unless cursor.empty? || cursor.match?(/\A[0-9]{1,18}\z/)
-          rows = relation.where("id > ?", cursor.to_i).order(:id).limit(51).to_a
-          @next_cursor = rows.length > 50 ? rows[49].id : nil
-          rows.first(50)
-        end
-
-        def boolean_param(key)
-          value = params[key]
-          raise InvalidInput unless %w[true false].include?(value)
-          value == "true"
-        end
-
-        def host_back_path
-          callback = Management.configuration.back_path
-          value = callback.call(self) if callback.respond_to?(:call)
-          value if value.is_a?(String) && value.start_with?("/") && !value.start_with?("//") && !value.match?(/[\\\r\n]/)
-        end
+      class MailboxesController < MailboxKit::Management::MailboxesController
       end
     end
   end

data/app/controllers/cloudflare/email/management/styles_controller.rb

@@ -1,12 +1,8 @@
+require File.join(MailboxKit::ROOT, "app/controllers/mailbox_kit/management/styles_controller.rb")
 module Cloudflare
   module Email
     module Management
-      class StylesController < ActionController::Base
-        def show
-          response.headers["X-Content-Type-Options"] = "nosniff"
-          send_data File.binread(File.expand_path("../../../../../lib/cloudflare/email/management/management.css", __dir__)),
-            type: "text/css; charset=utf-8", disposition: "inline"
-        end
+      class StylesController < MailboxKit::Management::StylesController
       end
     end
   end

data/docs/custom-ingress.md

@@ -42,6 +42,10 @@ class InboundEmailsController < ActionController::API
 
     verified = result.message
 
+    # If no custom acceptance/processing record is needed, this is sufficient:
+    # verified.receive_into_mailbox!
+    # It also repairs missing membership on duplicate delivery without rerouting.
+
     Cloudflare::Email::Mailboxes.receive(
       recipient: verified.envelope.fetch("to")
     ) do |destination|
@@ -64,7 +68,7 @@ Mount this controller at your own route and point your existing Worker there. Th
 
 Do not use the MIME `To` header or an unauthenticated URL subdomain to select storage. `verified.envelope.fetch("to")` is the signed SMTP recipient. `Mailboxes.receive` checks that its domain, mailbox, and accepted address are active before entering the persistence block.
 
-`persist_action_mailbox!` stores the verified raw bytes and metadata in Action Mailbox. The receiving block adds mailbox membership in the same tenant transaction. Rails schedules normal routing after the transaction commits. Apply policies that must stop processing before calling persistence; a check performed after receiving returns can be too late.
+`persist_action_mailbox!` delegates verified raw bytes and metadata to the core's Rails persistence bridge. It preserves the existing new-record-or-`nil` return convention; the block example therefore does no new work for a duplicate. The default `receive_into_mailbox!` bridge also attaches the existing record, repairing a missing membership without reprocessing. Rails schedules normal routing only for newly created records after the transaction commits. Apply policies that must stop processing before calling persistence; a check performed after receiving returns can be too late.
 
 For an application that owns a different raw-email store, use `verified.body`, `verified.envelope`, `verified.provider_metadata`, `verified.message_checksum`, and `verified.storage_metadata` with your own persistence/transaction system. `Mailboxes.receive` specifically expects an Action Mailbox inbound email record (or nil) from its block; do not pass an unrelated processing record. The gem does not choose your archive retention, held-message model, or document queue.
 

data/docs/features.md

@@ -5,7 +5,7 @@ services. You can use just the sending client, add incoming mail, or build a
 mailbox on top of the optional database-backed delivery tools.
 
 Start with [Getting started](getting-started.md) for working examples. These
-features are available in **0.3.0**. Database multi-tenancy is **off by default**:
+features are available in **0.4.0**, which includes **Mailbox Kit 0.1.0**. Database multi-tenancy is **off by default**:
 the optional mailbox module works in one database unless you explicitly configure
 a tenant connection adapter. A mailbox tenant key alone does not switch databases.
 

data/docs/getting-started.md

@@ -18,11 +18,12 @@ not need to be the same domain as your Rails application's web address.
 
 ### Install the current code
 
-Add version 0.3 to your app's `Gemfile`. If upgrading an existing installation, read the
-[upgrade guide](upgrading-0.3.md) before changing an existing Worker deployment:
+Add version 0.4 to your app's `Gemfile`. Existing mailbox installations should read
+the [core upgrade guide](../mailbox-kit/docs/upgrading.md). When upgrading from 0.2,
+also read the [Worker upgrade guide](upgrading-0.3.md):
 
 ```ruby
-gem "cloudflare-email", "~> 0.3.0"
+gem "cloudflare-email", "~> 0.4.0"
 ```
 
 ```sh

data/docs/mailboxes.md

@@ -5,7 +5,7 @@ mail into them, track read/archive state, and send through the durable outbox.
 It works in one SQLite database or with a separate database per organization.
 It supplies models and services; your app supplies permissions and the UI.
 
-This module is available since version 0.2.0. Install `gem "cloudflare-email", "~> 0.3.0"` for the latest features.
+This module is available since version 0.2.0. Install `gem "cloudflare-email", "~> 0.4.0"` for the latest features, including the provider-neutral Mailbox Kit core.
 
 **Database multi-tenancy is off by default.** The mailbox generator works with
 one ordinary database. Calling `for_tenant` groups and scopes mailbox records;
@@ -45,6 +45,13 @@ use the same tenant connection as the mailbox tables for atomic incoming storage
 
 ## Register an organization's domain
 
+For addresses such as `invoices@acme.in.example.com`, follow the
+[Cloudflare domain setup guide](../templates/worker/docs/domain-setup.md).
+It covers Rebulk's existing wildcard receiving pattern, one-time infrastructure
+verification, and exact organization-domain registration in Rails. The gem does
+not require a per-organization Worker allowlist or Cloudflare approval once that
+receiving infrastructure is established; new accounts must verify the provider behavior.
+
 Run directory management from your authorized administration/provisioning code.
 Do not expose arbitrary domain claims to customers without ownership checks.
 

data/docs/routing-diagnostics.md

@@ -6,6 +6,13 @@ A mailbox registered in Rails is not proof that Cloudflare can deliver to it.
 Use this read-only check when onboarding a receiving domain, investigating a
 missing message, or checking an existing catch-all before activating addresses.
 
+For wildcard organization subdomains, also use the
+[domain setup guide and public DNS checker](../templates/worker/docs/domain-setup.md).
+This API inspects exact-domain configured records and does not resolve wildcard
+inheritance. Missing exact records can therefore coexist with working inherited
+MX. Public DNS and real delivery checks provide separate evidence; this diagnostic
+is not a requirement to manually onboard every organization in Cloudflare.
+
 ```sh
 bin/rails cloudflare:email:check_route \
   ADDRESS=houston@customer.example.com \

data/docs/troubleshooting.md

@@ -9,7 +9,7 @@ into public logs or issues.
 
 | What you see | What to check next |
 | --- | --- |
-| New generator or API is missing | Check `Gemfile.lock`. The new features require the [0.2 commit](getting-started.md#install-the-current-code); published 0.1.0 lacks them. |
+| New generator or API is missing | Check `Gemfile.lock`. Use cloudflare-email 0.4.x with mailbox-kit 0.1.x; follow the [installation guide](getting-started.md#install-the-current-code). |
 | Credentials appear to be ignored | Nonempty Rails credentials override environment variables. Check the Rails environment and restart the app after changes. |
 | Authentication or domain error | Run `bin/rails cloudflare:email:doctor`; check account ID, token permissions and sending-domain verification. |
 | `doctor` reports limited read access | A send token may lack diagnostic read permissions. Review the specific result; diagnostics alone cannot prove whether sending works. |

data/docs/verification/2026-09-13-action-mailbox-core.md

@@ -0,0 +1,96 @@
+# Action Mailbox composition verification
+
+## Independent review follow-up
+
+The independent architecture review of `63660eb` confirmed the Rails/core/provider
+split and reproduced a missing inbound membership index with SQLite's query planner.
+The follow-up adds that index to both installers and supplies `mailbox_kit:upgrade`
+for existing schemas. The generator fixture verifies indexed lookup, existing
+membership preservation and repeat application. It passes 4 tests / 27 assertions.
+
+Cloudflare configuration now delegates shared validation to the core, and its
+session behavior is an explicit integration module. Handler overrides retain
+their existing extension point. The short core README links to packaged
+integration and upgrade guides.
+
+After these changes, the full suite passes 289 tests / 1,151 assertions. Package
+verification passes for Rails-free Cloudflare, packaged ingress/outbound/tenancy,
+and an independent Rails consumer without Cloudflare in its bundle.
+
+This is local/package verification, not a Rebulk production rollout. Automatic
+model-owner lifecycle bindings and a universal outbound adapter framework remain
+outside this change. Existing application acceptance, ownership and business
+processing claims must be retained.
+
+Mailbox Kit now treats `ActionMailbox::InboundEmail` as the original email record.
+The kit's `Message` remains an inbox membership with read/archive state; no new
+raw-email table, parser, routing job or processing-status model was introduced.
+
+## Verified behavior
+
+- `Mailboxes.receive(recipient:, source:)` resolves the trusted receiving scope
+  before Rails persistence, and attaches the existing record on source replay.
+  Identical source in two inboxes of one tenant produces one Rails email, two
+  memberships and one routing job. Read state remains independent per inbox.
+- Identical source in different tenants sharing a database produces distinct
+  Rails records/jobs. `Session#attach` rejects a row already associated with a
+  different tenant, and resolves IDs only inside the selected connection.
+- `Session#attach(recipient:, inbound_email_id:)` supports already-stored Rails
+  mail. It is idempotent per mailbox/email, preserves alias reservations and
+  refuses suspended addresses or missing records.
+- The stock Rails Postmark ingress was exercised through HTTP in the isolated
+  Rails fixture. Duplicate webhook payloads produced one Rails email; explicit
+  host-authorized attachment created its inbox membership without reprocessing.
+- Cloudflare retains its prior authenticated envelope/metadata identity and
+  stable Message-ID fallback. Its controller uses `receive_into_mailbox!` and
+  repairs missing membership on replay without re-enqueueing Rails routing.
+  The older `persist_action_mailbox!` still returns nil on duplicate delivery.
+- Rails' `incinerate = false` prevents automatic cleanup scheduling without a
+  membership. With normal cleanup enabled, aged processed unassociated mail is
+  removed while inbox-associated mail survives. The guard uses Rails' public
+  inbound-email load hook and the same row lock as attachment and purge.
+- Removing one of two memberships preserves the shared raw email; removing the
+  last through explicit purge removes it. Failed membership persistence rolls
+  back Rails database records and prevents a routing enqueue.
+- PostgreSQL deliveries were synchronized at Rails creation to force a unique
+  conflict. Both calls completed with one inbound record, one membership, one
+  Active Storage blob record and one routing job. A savepoint rollback keeps the
+  losing transaction usable before looking up the winning record.
+
+## Checks
+
+- Full Ruby suite: 289 top-level tests, 1,151 assertions passed. Integration
+  subprocesses exercise the additional Rails behavior rather than inflating these
+  top-level counts.
+- `script/verify_package.rb`: both gem archives built; Rails-free Cloudflare
+  consumer, packaged Cloudflare integration and independent core-only Rails
+  consumer passed. The independent bundle contains no Cloudflare gem.
+- PostgreSQL inbound suite: 25 tests, 273 assertions passed on a disposable local
+  PostgreSQL 15 instance. CI runs the same suite against PostgreSQL 16 alongside
+  the existing outbox tests.
+- SQLite core/compatibility, separate-tenant ingress and custom ingress regression
+  suites were exercised locally. CI covers the supported Ruby/Rails matrix.
+
+Run the PostgreSQL check only against a disposable database:
+
+```sh
+BUNDLE_GEMFILE=gemfiles/postgres.gemfile \
+POSTGRES_TEST_URL=postgres://localhost/cloudflare_email_test \
+bundle exec ruby script/verify_postgres_inbound.rb
+```
+
+The script creates a unique schema and drops that schema when its fixture exits.
+
+## Limits
+
+The Postmark test is a fixed, authorized single-database route, not a live
+Postmark deployment or a complete dynamic-tenant provider adapter. The caller
+must authenticate ingress and authorize the envelope recipient and inbound ID;
+MIME To/X-Original-To headers are not tenant entitlement. Tenant selection after
+ingress cannot relocate raw mail already persisted to another database.
+
+Raw blob uploads and external side effects are not made transactional by Active
+Record. This check does not establish exactly-once business effects, provider
+outage recovery, lost-job recovery, or live delivery. Existing Cloudflare durable
+transport remains responsible for its outage/retry behavior. Owner lifecycle
+macros and a general outbound adapter framework are separate work.

data/lib/cloudflare/email/active_record/base.rb

@@ -1,60 +1,10 @@
-require "active_record"
 require "cloudflare/email/tenancy"
-
+require "mailbox_kit/active_record/base"
 module Cloudflare
   module Email
     module ActiveRecord
-      # Rails may inspect every model's pool while preloading schema metadata
-      # before any request has selected a tenant. Report an unavailable
-      # connection using Rails' error hierarchy so boot can recover, while
-      # retaining the same fail-closed guard for every caller.
-      class TenantConnectionUnavailable < ::ActiveRecord::ConnectionNotEstablished; end
-
-      # Uses the host's abstract tenant connection owner when explicitly configured.
-      class Base < Tenancy.model_base(::ActiveRecord::Base)
-        self.abstract_class = true
-
-        class << self
-          def connection_pool
-            if Tenancy.enabled?
-              begin
-                Tenancy.require_context!
-              rescue ConfigurationError => error
-                raise TenantConnectionUnavailable, error.message
-              end
-            end
-            super
-          end
-        end
-
-        before_validation :verify_cloudflare_email_tenant!
-        before_save :verify_cloudflare_email_tenant!
-        before_destroy :verify_cloudflare_email_tenant!
-
-        # These methods can bypass callbacks or load a different row with the same ID.
-        %i[reload update_columns delete touch increment! decrement! association].each do |method_name|
-          define_method(method_name) do |*args, **kwargs, &block|
-            verify_cloudflare_email_tenant!
-            super(*args, **kwargs, &block)
-          end
-        end
-
-        private
-
-        # Both new construction and persisted-row instantiation call this before
-        # assigning inverse associations (which precede after_initialize).
-        def init_internals
-          super
-          @cloudflare_email_tenant_key = Tenancy.require_context! if Tenancy.enabled?
-        end
-
-        def verify_cloudflare_email_tenant!
-          return unless Tenancy.enabled?
-          unless @cloudflare_email_tenant_key == Tenancy.require_context!
-            raise ConfigurationError, "record belongs to a different tenant context"
-          end
-        end
-      end
+      Base = MailboxKit::ActiveRecord::Base
+      TenantConnectionUnavailable = MailboxKit::ActiveRecord::TenantConnectionUnavailable
     end
   end
 end

data/lib/cloudflare/email/engine.rb

@@ -1,4 +1,5 @@
 require "rails/engine"
+require "mailbox_kit/railtie"
 require "cloudflare/email/dev_ingress_guard"
 
 # Register the delivery method at engine load time (not inside an initializer)
@@ -18,19 +19,6 @@ module Cloudflare
         app.middleware.insert_before 0, DevIngressGuard if Rails.env.development?
       end
 
-      config.to_prepare do
-        if (defined?(Cloudflare::Email::Tenancy) && Cloudflare::Email::Tenancy.enabled?) ||
-            (defined?(Cloudflare::Email::Mailboxes) && Cloudflare::Email::Mailboxes.enabled?)
-          require "cloudflare/email/tenant_job_context"
-          Cloudflare::Email::TenantJobContext.install_framework_jobs!
-        end
-        if defined?(Cloudflare::Email::Mailboxes) && Cloudflare::Email::Mailboxes.enabled? && defined?(::ActionMailbox::Engine)
-          require "cloudflare/email/mailboxes/inbound_retention"
-          ::ActionMailbox::InboundEmail.prepend(Cloudflare::Email::Mailboxes::InboundRetention) unless
-            ::ActionMailbox::InboundEmail.ancestors.include?(Cloudflare::Email::Mailboxes::InboundRetention)
-        end
-      end
-
       config.before_initialize do
         unless defined?(Cloudflare::Email::Management::Engine)
           Rails.autoloaders.main.ignore(

data/lib/cloudflare/email/envelope.rb

@@ -1,3 +1,4 @@
+require "mailbox_kit/address_syntax"
 require "json"
 require "cloudflare/email/signing"
 
@@ -8,19 +9,8 @@ module Cloudflare
     module Envelope
       METADATA_KEY = "cloudflare_email_envelope".freeze
       MAX_ENCODED_BYTES = 1024
-      LOCAL_PART = /\A[A-Za-z0-9.!#$%&'*+\/=\?^_`{|}~-]+\z/
-      DOMAIN_LABEL = /\A[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\z/
-
       def self.valid_address?(address, allow_empty: false)
-        return false unless address.is_a?(String) && address.ascii_only?
-        return true if allow_empty && address.empty?
-        return false if address.bytesize > 254
-        parts = address.split("@", -1)
-        return false unless parts.size == 2
-        local, domain = parts
-        local.bytesize <= 64 && LOCAL_PART.match?(local) &&
-          !local.start_with?(".") && !local.end_with?(".") && !local.include?("..") &&
-          domain.split(".", -1).all? { |label| DOMAIN_LABEL.match?(label) }
+        MailboxKit::AddressSyntax.valid_address?(address, allow_empty: allow_empty)
       end
 
       def self.valid?(value)

data/lib/cloudflare/email/error.rb

@@ -1,18 +1,11 @@
+require "mailbox_kit/error"
+
 module Cloudflare
   module Email
-    class Error < StandardError
-      attr_reader :response, :status
-
-      def initialize(message = nil, status: nil, response: nil)
-        super(message)
-        @status   = status
-        @response = response
-      end
-    end
-
-    class ConfigurationError < Error; end
+    Error = MailboxKit::Error
+    ConfigurationError = MailboxKit::ConfigurationError
     class AuthenticationError < Error; end
-    class ValidationError < Error; end
+    ValidationError = MailboxKit::ValidationError
     class RateLimitError < Error; end
     class ServerError < Error; end
     class NetworkError < Error; end