fix(inbox): resolve short ids and html otp codes

fix(ci): use Node 24 to avoid broken npm self-upgrade

Node 22 runner's npm has corrupted internal modules (promise-retry
missing). Node 24 ships with a working npm that supports OIDC
trusted publishing out of the box.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

chore(release): 1.5.3

v1.5.2: escape LIKE wildcards in short id prefix resolution

Follow-up to #6 — the LIKE queries for short id prefix matching
did not escape % and _ wildcards in user input, which could cause
unexpected matches. Use escLike() in db9 and add ESCAPE clause
for sqlite/worker parameterized queries.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

v1.5.1: docs and e2e fixes for OSS send + sync

Real e2e tests verified against deployed test worker: /api/send
outbound recording, /api/sync to local sqlite with search/code/attachments.
Updated skill.md and all 3 READMEs with sync command and /api/send docs.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

docs: add sync command and /api/send to skill.md and all READMEs

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

v1.4.1: full e2e coverage for all 3 providers + README test matrix

Add comprehensive e2e tests: db9 full flow (18 tests), remote OSS/hosted
direction filter + pagination, sqlite CLI integration (11 tests).
Update all 3 READMEs (EN/ZH/JA) with provider e2e coverage matrix.
239 tests total (168 unit + 71 e2e), 0 failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

v1.4.0: storage provider parity — attachments, outbound recording, se…

…arch fix

sqlite & db9: upgrade schema with attachments table and metadata columns
(has_attachments, attachment_count, attachment_names, attachment_search_text,
message_id). saveEmail() now persists attachment records. getEmail() returns
attachment metadata. getAttachment() serves text-extractable attachments.

send(): record outbound emails in local storage (sqlite/db9) after
successful send. Best-effort, skipped for remote provider.

sqlite: fix LIKE wildcard injection — escape % and _ in search queries.

types: add size/disposition aliases to Attachment for mails.dev compat.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

v1.3.0: add attachment download support

Add getAttachment to remote provider — calls /v1/attachment (hosted)
or /api/attachment (self-hosted) to download binary attachments.
CLI inbox detail now shows attachment IDs and supports --save flag
to download all attachments to disk. Inbox list shows +Natt indicator
for emails with attachments.

New e2e tests hit live APIs: OSS worker (test.mails.dev) for attachment
metadata, hosted worker (mails.dev) for binary download via R2.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

v1.2.4: remove device code from headless claim (not supported on curr…

…ent site)

Website redesign removed the device code input. Headless mode now only
shows the full URL with session params — copy-paste it to a browser.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>