Version packages

[leoisadev1]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@opencoredev/convex-email@4.0.0

Major Changes

• 32e98c9: Secure exposeApi() with authenticated ownership checks. Unauthenticated callers can no longer send, read, cancel, or retry email records; use authorize for custom tenant or operation policy, and authorizeConfig for explicitly authorized configuration access.

Patch Changes

• 308074d: Prevent stale recovered email workers from overwriting the active worker's result.
• 3e07cf2: Require Email SDK ^1.3.0 for the shared webhook export used by the component. SDK 1.2.0 does not provide this entry point; the accumulated SDK minor changesets introduce it in 1.3.0.
• 3e07cf2: Reuse the SDK webhook normalizer for Resend, Postmark, and Mailgun, reject malformed non-object payloads, and handle Resend delivery headers case-insensitively while preserving optional application verification and generic-provider compatibility.
• bcf0306: Harden remote attachment downloads by validating every redirect, limiting redirects and response size, and applying a fetch timeout.
• Updated dependencies [3e07cf2]
• Updated dependencies [bcf0306]
• Updated dependencies [3e07cf2]
• Updated dependencies [e0827a3]
• Updated dependencies [3e07cf2]
• Updated dependencies [14a6dc0]
  • @opencoredev/email-sdk@2.0.0

@opencoredev/email-sdk@2.0.0

Major Changes

• e0827a3: Replace the hand-rolled SMTP protocol and MIME implementation with Nodemailer-backed delivery, including RFC-safe subject encoding, transfer encoding, and attachments. Add first-class CommonJS entry points alongside ESM. Telemetry remains enabled by default with the existing telemetry: false, EMAIL_SDK_TELEMETRY=0, and DO_NOT_TRACK=1 opt-outs; events use a stable installation identifier and never include message content, addresses, or credentials. Move repository CI workflows to Tenki Cloud runners and add Node 20/22/24 package-compatibility coverage.

Minor Changes

• 3e07cf2: Add opt-in doctor --live, --from, and --json diagnostics with independently reported configuration, authentication, and sender checks. Default doctor stays configuration-only and makes no network request. Live probes use documented non-sending endpoints for Resend, Sequenzy, JetEmail, Primitive, Lettermint, and Lettr; Resend additionally supports paginated sender-domain readiness via --from, while other adapters report sender readiness as unsupported. Results distinguish invalid_credentials, insufficient_permissions, inconclusive, rate_limited, network_failure, timeout, unsupported, and not_ready; generic HTTP 400/422 responses are never treated as authentication success. Probes are bounded by a timeout, reject redirects and non-loopback base URL overrides, and never print credentials, response bodies, or account identifiers. The live verification scripts reuse the same probes.
• 3e07cf2: Add a separate webhooks entry point with Web Crypto Resend and Mailgun signature verification, timestamp checks and key rotation, plus delivery event normalization for Resend, Postmark, and Mailgun.
• 14a6dc0: Allow CommonJS applications on Node.js ^20.19.0 || >=22.12.0 (20.19+ on 20.x, or 22.12+) to load every SDK entry point with require(). ESM imports still support Node.js 20+. Typed CommonJS consumers need TypeScript 5.8+ with module: nodenext, or a compiler supporting module: node20. On older supported runtimes, use dynamic import() instead.

Patch Changes

• bcf0306: Ensure the packaged CLI is executable when builds run with a restrictive file-creation mask.
• 3e07cf2: Correct anonymous usage measurements by separating logical send outcomes, adapter attempts, submitted volume, and explicit provider acceptance. Version the counting schema, replace the misleading delivered_count metric, exclude built-in test adapters from provider volume even when renamed, and preserve acceptance evidence when later middleware fails. Default-on telemetry and existing opt-outs remain unchanged. Document aggregation rules and why provider acceptance does not establish delivery.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
email-sdk-fumadocs	Ready	Preview	Sep 16, 2026 8:50pm UTC

[greptile-apps]

Greptile Summary

The release remains blocked because the SDK is versioned as 2.0.0 while the active documentation configuration still tracks the v1 line. The required documentation-version validation rejects this mismatch, so release CI and package publication cannot complete.

Confidence Score: 4/5

Not safe to merge for release: the unresolved documentation-version mismatch prevents the required release checks from passing.

The outstanding previous finding remains unresolved. packages/email-sdk/package.json declares version 2.0.0, while the active documentation configuration declares v1 as current; the version validator explicitly rejects a package major newer than the active documentation major.

_{Reviews (13): Last reviewed commit: "Version packages" | Re-trigger Greptile}

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

🔴 SMTP replacement missing from release

Installing 2.0.0 leaves smtp on the hand-rolled transport and rejects attachments before connecting. smtp still uses SmtpClient, and the manifest has no Nodemailer dependency.

Learn more

This release consumes the major changeset and publishes the package as 2.0.0. However, the packaged smtp implementation still constructs the hand-written SmtpClient, while its capabilities reject attachments. The package manifest also declares no Nodemailer runtime dependency. The added changelog therefore describes code that the 2.0.0 tarball does not contain.

Example: A consumer upgrades to 2.0.0 and sends { attachments: [{ filename: "invoice.pdf", content: data }] } through smtp. The advertised release accepts and MIME-encodes the attachment, but this package fails validation before opening the SMTP connection.

Recommended fix: Land the Nodemailer-backed SMTP implementation, dependency, capability changes, and tests before versioning. Otherwise remove the unimplemented claims and reconsider the major bump before publishing.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🔍 Major migration paths remain undocumented

The 2.0.0 and 4.0.0 releases lack current migration guides with before-and-after examples. Existing guides cover SDK v0-to-v1 and label exposeApi() as a v3 migration.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[greptile-apps]

Align Docs Major

This release changes the SDK to 2.0.0, but the active documentation configuration still tracks v1. The required documentation-version check rejects that mismatch, so release CI cannot complete and the package cannot be published until the v2 documentation configuration is updated or the v1 line is archived.

Artifacts

Package-version diff

• Compared the supplied SHA with the candidate package and showed the actual package version transition is 1.3.0 to 2.0.0, confirming the supplied SHA does not contain 1.2.0.

Documentation-version gate harness

• Authored and executed this shell harness to run the identical repository gate for the prior SHA’s real package version and the current candidate without modifying repository source, preserving comparable output.

Prior v1 gate output

• Ran the docs-version gate with its supported package-version simulation set to the supplied SHA’s actual 1.3.0 version; it did not report the v2-versus-v1 current-track mismatch.

Current v2 gate output

• Ran the repository docs-version gate against current package metadata and captured its exit-1 major/docs-track error, confirming the candidate is blocked specifically by 2.0.0 exceeding v1.

_{Ran code and verified through T-Rex}