Email Guard Bundle Laravel Package

Changed

• Require emailsherlock/email-guard-core: ^0.3, which adds the relay signal (spec 1.2.0). block_on / review_on now accept relay alongside the verdicts to deny or flag relay / forwarding / alias-masking senders (Apple Hide My Email, SimpleLogin, addy.io, Cloudflare Email Routing). No bundle API change: block_on / review_on already pass through to the core library. (EM-1048)

Added

• GuardDecisionEvent (EM-1014): dispatched for every decision (allow, deny, review). Register a listener to handle blocks however you want (own log channel, own store, metrics, webhook). Carries the result, the raw input, and the extracted domain. The raw input is PII and the listener author owns it; the domain is not personal data.

Changed

• The deny-log (0.2.1) moved from inline in the validator into a default listener, GuardDecisionLogListener (same behaviour: logs denies as email_guard.denied, domain only, key-independent). It is now one subscriber on the event, replaceable or removable.
• The validator constructor takes an event dispatcher instead of a logger.

Fixed

• psr/log moved from require-dev to require: VerifiedEmailValidator references Psr\Log\LoggerInterface in src, so it is a runtime dependency (in practice always present transitively via symfony/http-kernel, but now declared correctly).

Added

• Key-independent deny logging (EM-1013): VerifiedEmailValidator logs every blocked decision via an optional PSR-3 logger (autowired in Symfony) as email_guard.denied with domain, verdict, reasons, source. Domain only, never the address. Gives operators visibility into what the local-only guard filters without any API key, credits, or DB.

Added

• Decision-telemetry wiring (EM-1005): registers the core GuardReporter as a service (integration symfony-bundle), injects it into the guard factory so every guard records decisions, and flushes the batch on kernel.terminate via GuardTelemetryFlushListener. Key-gated and fail-silent, so a form submit never waits on or breaks from the report.

Changed

• Requires emailsherlock/email-guard-core ^0.2 (the reporter lives there).

Fixed

• VerifiedEmail no longer passes an options array to the base Constraint constructor (deprecated since symfony/validator 7.3, fatal in 8.0); the constructor now carries #[HasNamedArguments].

First release, built on email-guard-core 0.1 (email-guard-spec 1.0.0).

Added

• VerifiedEmail constraint + validator with per-constraint blockOn / reviewOn overrides.
• 'verify_email' => true form option via form type extension.
• Bundle configuration mirroring the spec config keys (api_key, block_on, review_on, fail_open, timeout_ms).
• EmailGuard and GuardFactory available as services for review flows.