v0.1.2

What's Changed

• Backend by @roshansingh in #1
• Add Claude Code GitHub Workflow by @roshansingh in #3
• Add Claude Code GitHub Workflow by @roshansingh in #4
• Email automations editor, API, and deployment workflow by @roshansingh in #2
• feat: async webhook processing with BullMQ queue and worker by @roshansingh in #12
• feat: API key authentication for email inbox and message endpoints by @roshansingh in #14
• feat: add production-ready Pino logger with structured logging by @roshansingh in #15
• Phase 1: Commercial layer infrastructure and UI improvements by @roshansingh in #16
• Remove sms by @roshansingh in #17
• Llm integration by @roshansingh in #18
• Cursor pagination for inbox messages (hard switch) by @roshansingh in #64
• fix: schema review CRITICAL + HIGH findings (F1, F4–F8, F25) by @roshansingh in #65
• fix: schema review MEDIUM findings — indexes, timestamps, type standardization by @roshansingh in #69
• fix: concurrency findings F17, F19, F28 by @roshansingh in #70
• feat: migrate all generated IDs to UUIDv7 in native uuid columns by @roshansingh in #76
• fix: pin Postgres session timezone to UTC by @roshansingh in #75
• test: comprehensive API integration test suite (real Postgres) + 4 bug fixes by @roshansingh in #77
• fix(security): sandbox untrusted email HTML to stop stored XSS (#36) by @roshansingh in #78
• fix(security): fail closed when JWT_SECRET is unset (#38) by @roshansingh in #79
• fix(security): default automation replay to dry-run and rate limit it (#40) by @roshansingh in #80
• fix(security): normalize inbox addresses to close case-variant cross-tenant email interception (#37) by @roshansingh in #81
• fix(security): clamp pagination params and bound the grouped message query (#43) by @roshansingh in #82
• fix(security): run the app as a least-privileged Postgres role (#41) by @roshansingh in #83
• fix(security): block SSRF and response-body exfiltration in send_webhook (#39) by @roshansingh in #84
• feat: serve Resend ingest at /api/webhooks/email (API split PR 0) by @roshansingh in #88
• chore: remove /api/v1/webhooks/email compatibility alias (API split PR 0b) by @roshansingh in #90
• feat: auth foundation for the internal/external API split (Phase 1) by @roshansingh in #91
• feat: service layer and serializers for the API split (Phase 2) by @roshansingh in #92
• feat: split emailInbox into read-only /api/v1 and dashboard /api/app (Tasks 24+25) by @roshansingh in #93
• feat: move remaining dashboard routes to /api/app, guards at full scope (Tasks 26-30) by @roshansingh in #94
• feat: gate owner-only UI actions, delete the superseded auth layer, update docs (Tasks 31-34) by @roshansingh in #96
• feat(config): centralized zod-validated config manager by @roshansingh in #99
• Restrict inbox creation to configured domains + impersonation blocklist (#98) by @roshansingh in #100
• fix(security): rate limit login and registration (#42) by @roshansingh in #85
• feat: cap inbox local part at 50 and display name at 100 characters by @roshansingh in #101
• feat: email verification at signup behind ENABLE_EMAIL_VERIFICATION by @roshansingh in #103
• docs: rename InboxUI to ProgrammableInbox in prose by @roshansingh in #105
• feat: password reset by signed JWT by @roshansingh in #107
• fix: make the password-reset pages reachable, and the limiter usable on its first request by @roshansingh in #110
• chore(security): gitleaks config, CI secret scan, and pre-commit hook by @roshansingh in #109
• feat: full-text search on email messages (#106) by @roshansingh in #108
• fix(test): load .env.test automatically, make integration secrets harness-owned by @roshansingh in #111
• feat(mcp): expose the read-only email surface over MCP at POST /api/mcp by @roshansingh in #112
• Namespace API key scopes for SMS, add granular email_inboxes create/update/delete scopes, and expose inbox writes on /api/v1 + MCP by @roshansingh in #114
• fix: 400 a malformed PATCH address, and correct the v1 inbox error docs by @roshansingh in #115
• Split email_inboxes:write into create/update/delete, and add DELETE /api/v1/emailInbox/{id} by @roshansingh in #116
• feat(commercial): USE_COMMERCIAL plan engine with count caps (#117, PR 1/2) by @roshansingh in #118
• feat(commercial): per-period meters, outbound gating and usage UI (#117, PR 2/2) by @roshansingh in #119
• docs: OSS license placeholders, README rewrite, split architecture docs by @roshansingh in #121
• feat(billing): Stripe Checkout, portal and subscription webhooks for the pro plan (#120) by @roshansingh in #122
• Apply Iris color palette to light/dark theme tokens by @roshansingh in #123
• Generate client SDKs (Python, Go, TypeScript, Java, C#) from the v1 OpenAPI spec by @roshansingh in #127
• Add message search to inbox top bar; move Inbox/N messages next to email by @roshansingh in #126
• Hide Webhooks from left nav by @roshansingh in #128
• fix: run LLM enrichment in the sync webhook path by @roshansingh in #129
• Add EE observability: log search + OpenTelemetry tracing by @roshansingh in #131
• fix(email): preserve compose state and received timestamps by @marutilai in #132
• Ship EE logs via a Docker-stdout-scraping otel-collector by @roshansingh in #133
• otel-collector: fix deploy sync, log-loss bug, and force-recreate docs by @roshansingh in #134
• Fix OTP enrichment on HTML-only mail; rework the OTP API and v1 org scoping by @roshansingh in #135
• Log finish_reason/refusal when OpenAI-compat enrichment result may be empty by @roshansingh in #136
• Simplify automation UI and fix Dry Run's stale-config gap by @roshansingh in #137
• Add unread/read status for email messages by @roshansingh in #149
• Regenerate SDKs for isRead field by @roshansingh in #150
• Add a dashboard billing page with a Free/Pro plan picker by @roshansingh in #151
• Instrument PostHog for product analytics by @roshansingh in #153
• Add tag-triggered release pipeline: CE tarball, CE docker image, SDK publishing by @roshansingh in #155

New Contributors

• @marutilai made their first contribution in #132

Full Changelog: https://github.com/roshansingh/programmableinbox/commits/v0.1.2

Community Edition

• docker: ghcr.io/roshansingh/programmableinbox-ce:v0.1.2 (linux/amd64, linux/arm64)

SDKs

• csharp 0.1.2: published
• go 0.1.2: published
• java 0.1.2: published
• python 0.1.2: published
• **typescript...