@aglyn/shared-util-email 1.0.0-beta.181 → 1.0.0-beta.182

package/README.md

@@ -76,6 +76,35 @@ this point, so ordinary senders never meet the guard — it is there because
 `RESEND_SEND_ENDPOINT` is exported and a module that fetches it directly
 bypasses every check `sendEmail()` owns.
 
+### The List-Unsubscribe setting
+
+`list-unsubscribe.ts` is the one place the `List-Unsubscribe` /
+`List-Unsubscribe-Post` (RFC 8058) pair is modeled, for every sender that makes
+it a setting — an outreach sequence (default off) and a marketing campaign
+(default on):
+
+```typescript
+import {
+  decideListUnsubscribe,
+  listUnsubscribeHeaders,
+  readListUnsubscribeSetting,
+} from '@aglyn/shared-util-email/list-unsubscribe'
+
+const requested = readListUnsubscribeSetting(stored.listUnsubscribe, true)
+const decision = decideListUnsubscribe({
+  requested,
+  recentVolume, // the organization's campaign messages in the last day
+  sendVolume, // everyone this email will address
+})
+const headers = decision.on ? listUnsubscribeHeaders({ url: oneClickUrl }) : {}
+```
+
+`decideListUnsubscribe` is the bulk-sender guard: with the setting off, a send
+that takes the organization to `EMAIL_LIST_UNSUBSCRIBE_BULK_THRESHOLD` messages
+(default 5,000, Gmail's and Yahoo's line) carries the pair anyway, and the
+decision says it was forced and why. The headers are plain headers, so any
+provider behind `sendEmail` delivers them.
+
 ## Checking configuration
 
 ```typescript

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/shared-util-email",
-  "version": "1.0.0-beta.181",
+  "version": "1.0.0-beta.182",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,8 +25,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/shared-data-enums": "1.0.0-beta.181",
-    "@aglyn/shared-util-http": "1.0.0-beta.181",
+    "@aglyn/shared-data-enums": "1.0.0-beta.182",
+    "@aglyn/shared-util-http": "1.0.0-beta.182",
     "@msgpack/msgpack": "^3.1.3",
     "@swc/helpers": "0.5.23"
   },

package/src/index.d.ts

@@ -19,6 +19,7 @@ export * from './lib/send-rate';
 export * from './lib/sender-reputation';
 export * from './lib/send-ceilings';
 export * from './lib/sending-domain';
+export * from './lib/tracking-host';
 export * from './lib/sending-mailbox';
 export * from './lib/host-sender';
 export * from './lib/platform-sending-domain';
@@ -29,6 +30,7 @@ export * from './lib/host-email-render';
 export * from './lib/email-render';
 export * from './lib/text-email-html';
 export * from './lib/marketing-send';
+export * from './lib/list-unsubscribe';
 export * from './lib/email-delivery-events';
 export * from './lib/received-email';
 export * from './lib/email-revenue-window';

package/src/index.js

@@ -18,6 +18,7 @@ export * from "./lib/send-rate.js";
 export * from "./lib/sender-reputation.js";
 export * from "./lib/send-ceilings.js";
 export * from "./lib/sending-domain.js";
+export * from "./lib/tracking-host.js";
 export * from "./lib/sending-mailbox.js";
 export * from "./lib/host-sender.js";
 export * from "./lib/platform-sending-domain.js";
@@ -28,6 +29,8 @@ export * from "./lib/host-email-render.js";
 export * from "./lib/email-render.js";
 export * from "./lib/text-email-html.js";
 export * from "./lib/marketing-send.js";
+// The List-Unsubscribe setting sequences and campaigns share (AGL-3307).
+export * from "./lib/list-unsubscribe.js";
 export * from "./lib/email-delivery-events.js";
 // The received-mail reader the CRM's capture route files from (AGL-2657).
 // Its neighbor `./lib/svix-signature` is deliberately NOT re-exported here:

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/shared/util/email/src/index.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './lib/send-email'\nexport * from './lib/send-rate'\nexport * from './lib/sender-reputation'\nexport * from './lib/send-ceilings'\nexport * from './lib/sending-domain'\nexport * from './lib/sending-mailbox'\nexport * from './lib/host-sender'\nexport * from './lib/platform-sending-domain'\nexport * from './lib/email-health'\nexport * from './lib/system-email-catalog'\nexport * from './lib/tenant-email-catalog'\nexport * from './lib/host-email-render'\nexport * from './lib/email-render'\nexport * from './lib/text-email-html'\nexport * from './lib/marketing-send'\nexport * from './lib/email-delivery-events'\n// The received-mail reader the CRM's capture route files from (AGL-2657).\n// Its neighbor `./lib/svix-signature` is deliberately NOT re-exported here:\n// it holds a `crypto` HMAC, and this barrel is reached from the browser\n// through `@aglyn/shared-ui-email-campaigns`, so a webhook imports it by its\n// own path — `@aglyn/shared-util-email/svix-signature`.\nexport * from './lib/received-email'\nexport * from './lib/email-revenue-window'\n// Exported so the console drift guard can pin it against @aglyn/aglyn.\nexport * from './lib/email-media-src'\n// Same arrangement, same reason (AGL-1223): a copy of `decodeStoredNodes`\n// this scope:shared lib may not import, pinned by `email-nodes-drift.spec.ts`.\nexport * from './lib/stored-email-nodes'\nexport * from './lib/email-merge'\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,cAAc,sBAAkB;AAChC,cAAc,qBAAiB;AAC/B,cAAc,6BAAyB;AACvC,cAAc,yBAAqB;AACnC,cAAc,0BAAsB;AACpC,cAAc,2BAAuB;AACrC,cAAc,uBAAmB;AACjC,cAAc,mCAA+B;AAC7C,cAAc,wBAAoB;AAClC,cAAc,gCAA4B;AAC1C,cAAc,gCAA4B;AAC1C,cAAc,6BAAyB;AACvC,cAAc,wBAAoB;AAClC,cAAc,2BAAuB;AACrC,cAAc,0BAAsB;AACpC,cAAc,iCAA6B;AAC3C,0EAA0E;AAC1E,4EAA4E;AAC5E,wEAAwE;AACxE,6EAA6E;AAC7E,wDAAwD;AACxD,cAAc,0BAAsB;AACpC,cAAc,gCAA4B;AAC1C,uEAAuE;AACvE,cAAc,2BAAuB;AACrC,0EAA0E;AAC1E,+EAA+E;AAC/E,cAAc,8BAA0B;AACxC,cAAc,uBAAmB"}
+{"version":3,"sources":["../../../../../../libs/shared/util/email/src/index.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './lib/send-email'\nexport * from './lib/send-rate'\nexport * from './lib/sender-reputation'\nexport * from './lib/send-ceilings'\nexport * from './lib/sending-domain'\nexport * from './lib/tracking-host'\nexport * from './lib/sending-mailbox'\nexport * from './lib/host-sender'\nexport * from './lib/platform-sending-domain'\nexport * from './lib/email-health'\nexport * from './lib/system-email-catalog'\nexport * from './lib/tenant-email-catalog'\nexport * from './lib/host-email-render'\nexport * from './lib/email-render'\nexport * from './lib/text-email-html'\nexport * from './lib/marketing-send'\n// The List-Unsubscribe setting sequences and campaigns share (AGL-3307).\nexport * from './lib/list-unsubscribe'\nexport * from './lib/email-delivery-events'\n// The received-mail reader the CRM's capture route files from (AGL-2657).\n// Its neighbor `./lib/svix-signature` is deliberately NOT re-exported here:\n// it holds a `crypto` HMAC, and this barrel is reached from the browser\n// through `@aglyn/shared-ui-email-campaigns`, so a webhook imports it by its\n// own path — `@aglyn/shared-util-email/svix-signature`.\nexport * from './lib/received-email'\nexport * from './lib/email-revenue-window'\n// Exported so the console drift guard can pin it against @aglyn/aglyn.\nexport * from './lib/email-media-src'\n// Same arrangement, same reason (AGL-1223): a copy of `decodeStoredNodes`\n// this scope:shared lib may not import, pinned by `email-nodes-drift.spec.ts`.\nexport * from './lib/stored-email-nodes'\nexport * from './lib/email-merge'\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,cAAc,sBAAkB;AAChC,cAAc,qBAAiB;AAC/B,cAAc,6BAAyB;AACvC,cAAc,yBAAqB;AACnC,cAAc,0BAAsB;AACpC,cAAc,yBAAqB;AACnC,cAAc,2BAAuB;AACrC,cAAc,uBAAmB;AACjC,cAAc,mCAA+B;AAC7C,cAAc,wBAAoB;AAClC,cAAc,gCAA4B;AAC1C,cAAc,gCAA4B;AAC1C,cAAc,6BAAyB;AACvC,cAAc,wBAAoB;AAClC,cAAc,2BAAuB;AACrC,cAAc,0BAAsB;AACpC,yEAAyE;AACzE,cAAc,4BAAwB;AACtC,cAAc,iCAA6B;AAC3C,0EAA0E;AAC1E,4EAA4E;AAC5E,wEAAwE;AACxE,6EAA6E;AAC7E,wDAAwD;AACxD,cAAc,0BAAsB;AACpC,cAAc,gCAA4B;AAC1C,uEAAuE;AACvE,cAAc,2BAAuB;AACrC,0EAA0E;AAC1E,+EAA+E;AAC/E,cAAc,8BAA0B;AACxC,cAAc,uBAAmB"}

package/src/lib/list-unsubscribe.d.ts

@@ -0,0 +1,193 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * THE MAIL-CLIENT UNSUBSCRIBE BUTTON, AS A SETTING (AGL-3296, AGL-3307).
+ *
+ * `List-Unsubscribe` plus `List-Unsubscribe-Post: List-Unsubscribe=One-Click`
+ * (RFC 8058) is what makes Gmail, Yahoo, Apple Mail and Outlook draw their own
+ * Unsubscribe button above a message. It is a per-sender SETTING in two
+ * places, with opposite defaults:
+ *
+ * | Sender | Default | Why |
+ * | --- | --- | --- |
+ * | An outreach sequence | off | one-to-one mail; the header makes it read as a mailing list |
+ * | A marketing campaign | on | bulk mail; Gmail and Yahoo require one-click from bulk senders |
+ *
+ * Everything the two share lives here, so neither keeps a copy: how a stored
+ * value is read ({@link readListUnsubscribeSetting}), how the header pair is
+ * written ({@link listUnsubscribeHeaders}), how a send decides whether it can
+ * carry the pair it promised ({@link resolveListUnsubscribe}), and — for bulk
+ * mail — the guard that turns the header back on when a send makes the
+ * organization a bulk sender ({@link decideListUnsubscribe}).
+ *
+ * ## What the setting never touches
+ *
+ * The visible way out. A campaign's footer link and a sequence's "reply 'no'"
+ * line are in the body whatever this says, because they are what CAN-SPAM
+ * and the recipient rely on; the header is a convenience a mail client may or
+ * may not draw. The routes that answer a one-click POST keep answering every
+ * link already sent, whatever the setting says now.
+ *
+ * ## Provider-neutral
+ *
+ * Nothing here knows who delivers the mail. The pair is two ordinary headers,
+ * handed to whatever transport the deployment runs — `sendEmail`'s provider
+ * seam for campaigns, the mailbox's own API for a sequence — so a self-hosted
+ * deployment on any provider gets the same behavior.
+ */
+/** The one value RFC 8058 defines for `List-Unsubscribe-Post`. */
+export declare const LIST_UNSUBSCRIBE_ONE_CLICK = "List-Unsubscribe=One-Click";
+/**
+ * A stored `listUnsubscribe` setting, read with the sender's own default.
+ *
+ * Only a real boolean is a choice. Anything else — absent on every record
+ * written before the setting existed, `null`, a string — reads as the
+ * default, which is `false` for a sequence and `true` for a campaign. So a
+ * stored sequence never grows a header it did not ask for, and a stored
+ * campaign never loses one.
+ */
+export declare function readListUnsubscribeSetting(raw: unknown, defaultOn: boolean): boolean;
+/**
+ * The `List-Unsubscribe` header pair for one message, or `{}`.
+ *
+ * `url` is the signed HTTPS link a mailbox provider POSTs with nobody present,
+ * and `mailto` an address that unsubscribes whoever writes to it. Either can
+ * stand alone in `List-Unsubscribe`; `List-Unsubscribe-Post` is written only
+ * beside a URL, because advertising one-click with nothing to post to
+ * promises a verb nothing serves.
+ */
+export declare function listUnsubscribeHeaders(input: {
+    url?: string | null;
+    mailto?: string | null;
+}): Record<string, string>;
+/** The pair one send carries, or why it carries none. */
+export type ListUnsubscribeResolution = {
+    status: 'off';
+} | {
+    status: 'unavailable';
+} | {
+    status: 'ready';
+    url: string;
+    mailto: string | null;
+};
+/**
+ * Decides what one send's `List-Unsubscribe` header says.
+ *
+ * `off` unless `enabled` is exactly `true`. On, the URL is minted — and the
+ * mailto too, when the sender has one (`mintMailto` present) — and the result
+ * is `unavailable` when any part cannot be: no signing secret, no HTTPS
+ * origin, no mailbox address. What a caller does with `unavailable` is its
+ * own policy; a sequence holds the send rather than leave without the way out
+ * it promised.
+ */
+export declare function resolveListUnsubscribe(input: {
+    enabled: boolean | null | undefined;
+    mintUrl: () => string | null | undefined;
+    mintMailto?: () => string | null | undefined;
+}): ListUnsubscribeResolution;
+/**
+ * Messages in {@link LIST_UNSUBSCRIBE_BULK_WINDOW_MS} at which an organization
+ * is a bulk sender and a campaign's header is turned back on.
+ *
+ * 5,000 is the figure Gmail and Yahoo publish for their bulk-sender rules, and
+ * one-click unsubscribe is one of those rules: a bulk sender without it is
+ * rejected or foldered as spam. Their count is per mailbox provider, which a
+ * send cannot see (a Google Workspace address is on a company's own domain),
+ * and a count to any one provider can never exceed the organization's total —
+ * so the total is the count, and it is never smaller than the provider's.
+ */
+export declare const LIST_UNSUBSCRIBE_BULK_THRESHOLD_DEFAULT = 5000;
+/** The environment variable a deployment overrides the threshold with. */
+export declare const LIST_UNSUBSCRIBE_BULK_THRESHOLD_ENV = "EMAIL_LIST_UNSUBSCRIBE_BULK_THRESHOLD";
+/** The window the threshold counts over. */
+export declare const LIST_UNSUBSCRIBE_BULK_WINDOW_MS = 86400000;
+/**
+ * The deployment's bulk threshold.
+ *
+ * Unset, blank or unreadable resolves to the published default, never to
+ * something smaller or larger by accident: a typo must not silently move a
+ * deliverability control. A positive whole number is taken as written — a
+ * self-hoster whose provider or audience draws the line elsewhere sets it
+ * lower or higher. There is no value that disables the guard.
+ *
+ * Read per call rather than captured at module load, because these run in
+ * serverless handlers whose module may be evaluated during a build, before
+ * the runtime env exists.
+ */
+export declare function listUnsubscribeBulkThreshold(raw?: unknown): number;
+/** Why a send carries the header its setting turned off. */
+export type ListUnsubscribeForcedReason = 
+/** The send takes the organization to the bulk threshold. */
+'bulk-volume'
+/**
+ * The send leaves on the shared pooled identity, whose reputation is every
+ * site's on it, and which refuses marketing mail without a way out.
+ */
+ | 'pooled-identity'
+/**
+ * The organization's recent volume could not be read, so whether the send
+ * reaches the threshold is unknown — and the header is the safe answer.
+ */
+ | 'volume-unknown';
+/** What one send does with the header, and why. */
+export interface ListUnsubscribeDecision {
+    /** What the sender's setting asked for. */
+    requested: boolean;
+    /** Whether the send carries the header. */
+    on: boolean;
+    /** True when the setting said off and the send carries it anyway. */
+    forced: boolean;
+    /** Why it was forced; null when it was not. */
+    reason: ListUnsubscribeForcedReason | null;
+    /**
+     * The organization's volume the decision was made on: what it had sent in
+     * the window plus what this send will address.
+     */
+    volume: number;
+    /** The threshold it was compared with. */
+    threshold: number;
+}
+/**
+ * Whether one bulk send carries the header, honoring the sender's setting
+ * unless the send would make the organization a bulk sender.
+ *
+ * `recentVolume` is what the organization has already sent in the window and
+ * `sendVolume` what this send will address in total, so the question asked is
+ * the one the rule asks — does the organization reach the threshold — and a
+ * send that starts under it and would finish over it is caught at its start
+ * rather than halfway through. Reaching the threshold counts, because the
+ * rule's line is "5,000 or more".
+ *
+ * `forcedBefore` keeps a decision made for an earlier part of the same send:
+ * a campaign delivered over several batches does not drop the header halfway
+ * through because a day rolled over.
+ */
+export declare function decideListUnsubscribe(input: {
+    requested: boolean;
+    recentVolume: number;
+    sendVolume: number;
+    threshold?: number;
+    pooled?: boolean;
+    forcedBefore?: ListUnsubscribeForcedReason | null;
+}): ListUnsubscribeDecision;
+/**
+ * One sentence for a forced decision, for the page that shows it.
+ *
+ * Written here rather than in a component so the send record, the log line
+ * and the campaign page say the same thing.
+ */
+export declare function listUnsubscribeForcedDetail(decision: Pick<ListUnsubscribeDecision, 'reason' | 'volume' | 'threshold'>): string;

package/src/lib/list-unsubscribe.js

@@ -0,0 +1,221 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * THE MAIL-CLIENT UNSUBSCRIBE BUTTON, AS A SETTING (AGL-3296, AGL-3307).
+ *
+ * `List-Unsubscribe` plus `List-Unsubscribe-Post: List-Unsubscribe=One-Click`
+ * (RFC 8058) is what makes Gmail, Yahoo, Apple Mail and Outlook draw their own
+ * Unsubscribe button above a message. It is a per-sender SETTING in two
+ * places, with opposite defaults:
+ *
+ * | Sender | Default | Why |
+ * | --- | --- | --- |
+ * | An outreach sequence | off | one-to-one mail; the header makes it read as a mailing list |
+ * | A marketing campaign | on | bulk mail; Gmail and Yahoo require one-click from bulk senders |
+ *
+ * Everything the two share lives here, so neither keeps a copy: how a stored
+ * value is read ({@link readListUnsubscribeSetting}), how the header pair is
+ * written ({@link listUnsubscribeHeaders}), how a send decides whether it can
+ * carry the pair it promised ({@link resolveListUnsubscribe}), and — for bulk
+ * mail — the guard that turns the header back on when a send makes the
+ * organization a bulk sender ({@link decideListUnsubscribe}).
+ *
+ * ## What the setting never touches
+ *
+ * The visible way out. A campaign's footer link and a sequence's "reply 'no'"
+ * line are in the body whatever this says, because they are what CAN-SPAM
+ * and the recipient rely on; the header is a convenience a mail client may or
+ * may not draw. The routes that answer a one-click POST keep answering every
+ * link already sent, whatever the setting says now.
+ *
+ * ## Provider-neutral
+ *
+ * Nothing here knows who delivers the mail. The pair is two ordinary headers,
+ * handed to whatever transport the deployment runs — `sendEmail`'s provider
+ * seam for campaigns, the mailbox's own API for a sequence — so a self-hosted
+ * deployment on any provider gets the same behavior.
+ */ /** The one value RFC 8058 defines for `List-Unsubscribe-Post`. */ export const LIST_UNSUBSCRIBE_ONE_CLICK = 'List-Unsubscribe=One-Click';
+/*==========================================
+ * THE SETTING.
+ *=========================================*/ /**
+ * A stored `listUnsubscribe` setting, read with the sender's own default.
+ *
+ * Only a real boolean is a choice. Anything else — absent on every record
+ * written before the setting existed, `null`, a string — reads as the
+ * default, which is `false` for a sequence and `true` for a campaign. So a
+ * stored sequence never grows a header it did not ask for, and a stored
+ * campaign never loses one.
+ */ export function readListUnsubscribeSetting(raw, defaultOn) {
+    return typeof raw === 'boolean' ? raw : defaultOn;
+}
+/*==========================================
+ * THE HEADERS.
+ *=========================================*/ /**
+ * The `List-Unsubscribe` header pair for one message, or `{}`.
+ *
+ * `url` is the signed HTTPS link a mailbox provider POSTs with nobody present,
+ * and `mailto` an address that unsubscribes whoever writes to it. Either can
+ * stand alone in `List-Unsubscribe`; `List-Unsubscribe-Post` is written only
+ * beside a URL, because advertising one-click with nothing to post to
+ * promises a verb nothing serves.
+ */ export function listUnsubscribeHeaders(input) {
+    var _input_url, _input_mailto;
+    const url = String((_input_url = input.url) != null ? _input_url : '').trim();
+    const mailto = String((_input_mailto = input.mailto) != null ? _input_mailto : '').trim();
+    const uris = [
+        url,
+        mailto
+    ].filter(Boolean);
+    if (!uris.length) return {};
+    return _extends({
+        'List-Unsubscribe': uris.map((uri)=>`<${uri}>`).join(', ')
+    }, url ? {
+        'List-Unsubscribe-Post': LIST_UNSUBSCRIBE_ONE_CLICK
+    } : {});
+}
+/**
+ * Decides what one send's `List-Unsubscribe` header says.
+ *
+ * `off` unless `enabled` is exactly `true`. On, the URL is minted — and the
+ * mailto too, when the sender has one (`mintMailto` present) — and the result
+ * is `unavailable` when any part cannot be: no signing secret, no HTTPS
+ * origin, no mailbox address. What a caller does with `unavailable` is its
+ * own policy; a sequence holds the send rather than leave without the way out
+ * it promised.
+ */ export function resolveListUnsubscribe(input) {
+    if (input.enabled !== true) return {
+        status: 'off'
+    };
+    const url = input.mintUrl() || '';
+    if (!url) return {
+        status: 'unavailable'
+    };
+    if (!input.mintMailto) return {
+        status: 'ready',
+        url,
+        mailto: null
+    };
+    const mailto = input.mintMailto() || '';
+    return mailto ? {
+        status: 'ready',
+        url,
+        mailto
+    } : {
+        status: 'unavailable'
+    };
+}
+/*==========================================
+ * THE BULK-SENDER GUARD (AGL-3307).
+ *=========================================*/ /**
+ * Messages in {@link LIST_UNSUBSCRIBE_BULK_WINDOW_MS} at which an organization
+ * is a bulk sender and a campaign's header is turned back on.
+ *
+ * 5,000 is the figure Gmail and Yahoo publish for their bulk-sender rules, and
+ * one-click unsubscribe is one of those rules: a bulk sender without it is
+ * rejected or foldered as spam. Their count is per mailbox provider, which a
+ * send cannot see (a Google Workspace address is on a company's own domain),
+ * and a count to any one provider can never exceed the organization's total —
+ * so the total is the count, and it is never smaller than the provider's.
+ */ export const LIST_UNSUBSCRIBE_BULK_THRESHOLD_DEFAULT = 5000;
+/** The environment variable a deployment overrides the threshold with. */ export const LIST_UNSUBSCRIBE_BULK_THRESHOLD_ENV = 'EMAIL_LIST_UNSUBSCRIBE_BULK_THRESHOLD';
+/** The window the threshold counts over. */ export const LIST_UNSUBSCRIBE_BULK_WINDOW_MS = 86400000;
+/**
+ * The deployment's bulk threshold.
+ *
+ * Unset, blank or unreadable resolves to the published default, never to
+ * something smaller or larger by accident: a typo must not silently move a
+ * deliverability control. A positive whole number is taken as written — a
+ * self-hoster whose provider or audience draws the line elsewhere sets it
+ * lower or higher. There is no value that disables the guard.
+ *
+ * Read per call rather than captured at module load, because these run in
+ * serverless handlers whose module may be evaluated during a build, before
+ * the runtime env exists.
+ */ export function listUnsubscribeBulkThreshold(raw = (()=>{
+    var _process_env;
+    return typeof process === 'undefined' ? undefined : (_process_env = process.env) == null ? void 0 : _process_env[LIST_UNSUBSCRIBE_BULK_THRESHOLD_ENV];
+})()) {
+    if (raw === null || raw === undefined || String(raw).trim() === '') {
+        return LIST_UNSUBSCRIBE_BULK_THRESHOLD_DEFAULT;
+    }
+    const value = Number(raw);
+    if (!Number.isFinite(value) || value < 1) {
+        return LIST_UNSUBSCRIBE_BULK_THRESHOLD_DEFAULT;
+    }
+    return Math.floor(value);
+}
+/**
+ * Whether one bulk send carries the header, honoring the sender's setting
+ * unless the send would make the organization a bulk sender.
+ *
+ * `recentVolume` is what the organization has already sent in the window and
+ * `sendVolume` what this send will address in total, so the question asked is
+ * the one the rule asks — does the organization reach the threshold — and a
+ * send that starts under it and would finish over it is caught at its start
+ * rather than halfway through. Reaching the threshold counts, because the
+ * rule's line is "5,000 or more".
+ *
+ * `forcedBefore` keeps a decision made for an earlier part of the same send:
+ * a campaign delivered over several batches does not drop the header halfway
+ * through because a day rolled over.
+ */ export function decideListUnsubscribe(input) {
+    var _input_forcedBefore;
+    const count = (raw)=>Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : 0;
+    const threshold = listUnsubscribeBulkThreshold(input.threshold);
+    const volume = count(input.recentVolume) + count(input.sendVolume);
+    const base = {
+        requested: input.requested,
+        volume,
+        threshold
+    };
+    if (input.requested) {
+        return _extends({}, base, {
+            on: true,
+            forced: false,
+            reason: null
+        });
+    }
+    const reason = input.pooled ? 'pooled-identity' : volume >= threshold ? 'bulk-volume' : (_input_forcedBefore = input.forcedBefore) != null ? _input_forcedBefore : null;
+    return reason ? _extends({}, base, {
+        on: true,
+        forced: true,
+        reason
+    }) : _extends({}, base, {
+        on: false,
+        forced: false,
+        reason: null
+    });
+}
+/**
+ * One sentence for a forced decision, for the page that shows it.
+ *
+ * Written here rather than in a component so the send record, the log line
+ * and the campaign page say the same thing.
+ */ export function listUnsubscribeForcedDetail(decision) {
+    if (decision.reason === 'pooled-identity') {
+        return 'Turned back on because this email left on the shared sending ' + 'address, where every campaign carries it.';
+    }
+    if (decision.reason === 'volume-unknown') {
+        return 'Turned back on because your organization’s sending volume could not ' + 'be read when this email went out, so it could not be shown to be ' + 'under the bulk-sender threshold.';
+    }
+    if (decision.reason === 'bulk-volume') {
+        return `Turned back on because this email took your organization to ` + `${decision.volume.toLocaleString('en-US')} campaign emails in 24 ` + `hours, at or over the ${decision.threshold.toLocaleString('en-US')} ` + 'at which Gmail and Yahoo require a one-click unsubscribe.';
+    }
+    return '';
+}
+
+//# sourceMappingURL=list-unsubscribe.js.map

package/src/lib/list-unsubscribe.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/shared/util/email/src/lib/list-unsubscribe.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE MAIL-CLIENT UNSUBSCRIBE BUTTON, AS A SETTING (AGL-3296, AGL-3307).\n *\n * `List-Unsubscribe` plus `List-Unsubscribe-Post: List-Unsubscribe=One-Click`\n * (RFC 8058) is what makes Gmail, Yahoo, Apple Mail and Outlook draw their own\n * Unsubscribe button above a message. It is a per-sender SETTING in two\n * places, with opposite defaults:\n *\n * | Sender | Default | Why |\n * | --- | --- | --- |\n * | An outreach sequence | off | one-to-one mail; the header makes it read as a mailing list |\n * | A marketing campaign | on | bulk mail; Gmail and Yahoo require one-click from bulk senders |\n *\n * Everything the two share lives here, so neither keeps a copy: how a stored\n * value is read ({@link readListUnsubscribeSetting}), how the header pair is\n * written ({@link listUnsubscribeHeaders}), how a send decides whether it can\n * carry the pair it promised ({@link resolveListUnsubscribe}), and — for bulk\n * mail — the guard that turns the header back on when a send makes the\n * organization a bulk sender ({@link decideListUnsubscribe}).\n *\n * ## What the setting never touches\n *\n * The visible way out. A campaign's footer link and a sequence's \"reply 'no'\"\n * line are in the body whatever this says, because they are what CAN-SPAM\n * and the recipient rely on; the header is a convenience a mail client may or\n * may not draw. The routes that answer a one-click POST keep answering every\n * link already sent, whatever the setting says now.\n *\n * ## Provider-neutral\n *\n * Nothing here knows who delivers the mail. The pair is two ordinary headers,\n * handed to whatever transport the deployment runs — `sendEmail`'s provider\n * seam for campaigns, the mailbox's own API for a sequence — so a self-hosted\n * deployment on any provider gets the same behavior.\n */\n\n/** The one value RFC 8058 defines for `List-Unsubscribe-Post`. */\nexport const LIST_UNSUBSCRIBE_ONE_CLICK = 'List-Unsubscribe=One-Click'\n\n/*==========================================\n * THE SETTING.\n *=========================================*/\n\n/**\n * A stored `listUnsubscribe` setting, read with the sender's own default.\n *\n * Only a real boolean is a choice. Anything else — absent on every record\n * written before the setting existed, `null`, a string — reads as the\n * default, which is `false` for a sequence and `true` for a campaign. So a\n * stored sequence never grows a header it did not ask for, and a stored\n * campaign never loses one.\n */\nexport function readListUnsubscribeSetting(\n  raw: unknown,\n  defaultOn: boolean,\n): boolean {\n  return typeof raw === 'boolean' ? raw : defaultOn\n}\n\n/*==========================================\n * THE HEADERS.\n *=========================================*/\n\n/**\n * The `List-Unsubscribe` header pair for one message, or `{}`.\n *\n * `url` is the signed HTTPS link a mailbox provider POSTs with nobody present,\n * and `mailto` an address that unsubscribes whoever writes to it. Either can\n * stand alone in `List-Unsubscribe`; `List-Unsubscribe-Post` is written only\n * beside a URL, because advertising one-click with nothing to post to\n * promises a verb nothing serves.\n */\nexport function listUnsubscribeHeaders(input: {\n  url?: string | null\n  mailto?: string | null\n}): Record<string, string> {\n  const url = String(input.url ?? '').trim()\n  const mailto = String(input.mailto ?? '').trim()\n  const uris = [url, mailto].filter(Boolean)\n  if (!uris.length) return {}\n  return {\n    'List-Unsubscribe': uris.map((uri) => `<${uri}>`).join(', '),\n    ...(url ? { 'List-Unsubscribe-Post': LIST_UNSUBSCRIBE_ONE_CLICK } : {}),\n  }\n}\n\n/*==========================================\n * ONE SEND'S PAIR.\n *=========================================*/\n\n/** The pair one send carries, or why it carries none. */\nexport type ListUnsubscribeResolution =\n  | { status: 'off' }\n  | { status: 'unavailable' }\n  | { status: 'ready'; url: string; mailto: string | null }\n\n/**\n * Decides what one send's `List-Unsubscribe` header says.\n *\n * `off` unless `enabled` is exactly `true`. On, the URL is minted — and the\n * mailto too, when the sender has one (`mintMailto` present) — and the result\n * is `unavailable` when any part cannot be: no signing secret, no HTTPS\n * origin, no mailbox address. What a caller does with `unavailable` is its\n * own policy; a sequence holds the send rather than leave without the way out\n * it promised.\n */\nexport function resolveListUnsubscribe(input: {\n  enabled: boolean | null | undefined\n  mintUrl: () => string | null | undefined\n  mintMailto?: () => string | null | undefined\n}): ListUnsubscribeResolution {\n  if (input.enabled !== true) return { status: 'off' }\n  const url = input.mintUrl() || ''\n  if (!url) return { status: 'unavailable' }\n  if (!input.mintMailto) return { status: 'ready', url, mailto: null }\n  const mailto = input.mintMailto() || ''\n  return mailto ? { status: 'ready', url, mailto } : { status: 'unavailable' }\n}\n\n/*==========================================\n * THE BULK-SENDER GUARD (AGL-3307).\n *=========================================*/\n\n/**\n * Messages in {@link LIST_UNSUBSCRIBE_BULK_WINDOW_MS} at which an organization\n * is a bulk sender and a campaign's header is turned back on.\n *\n * 5,000 is the figure Gmail and Yahoo publish for their bulk-sender rules, and\n * one-click unsubscribe is one of those rules: a bulk sender without it is\n * rejected or foldered as spam. Their count is per mailbox provider, which a\n * send cannot see (a Google Workspace address is on a company's own domain),\n * and a count to any one provider can never exceed the organization's total —\n * so the total is the count, and it is never smaller than the provider's.\n */\nexport const LIST_UNSUBSCRIBE_BULK_THRESHOLD_DEFAULT = 5_000\n\n/** The environment variable a deployment overrides the threshold with. */\nexport const LIST_UNSUBSCRIBE_BULK_THRESHOLD_ENV =\n  'EMAIL_LIST_UNSUBSCRIBE_BULK_THRESHOLD'\n\n/** The window the threshold counts over. */\nexport const LIST_UNSUBSCRIBE_BULK_WINDOW_MS = 86_400_000\n\n/**\n * The deployment's bulk threshold.\n *\n * Unset, blank or unreadable resolves to the published default, never to\n * something smaller or larger by accident: a typo must not silently move a\n * deliverability control. A positive whole number is taken as written — a\n * self-hoster whose provider or audience draws the line elsewhere sets it\n * lower or higher. There is no value that disables the guard.\n *\n * Read per call rather than captured at module load, because these run in\n * serverless handlers whose module may be evaluated during a build, before\n * the runtime env exists.\n */\nexport function listUnsubscribeBulkThreshold(\n  raw: unknown = typeof process === 'undefined'\n    ? undefined\n    : process.env?.[LIST_UNSUBSCRIBE_BULK_THRESHOLD_ENV],\n): number {\n  if (raw === null || raw === undefined || String(raw).trim() === '') {\n    return LIST_UNSUBSCRIBE_BULK_THRESHOLD_DEFAULT\n  }\n  const value = Number(raw)\n  if (!Number.isFinite(value) || value < 1) {\n    return LIST_UNSUBSCRIBE_BULK_THRESHOLD_DEFAULT\n  }\n  return Math.floor(value)\n}\n\n/** Why a send carries the header its setting turned off. */\nexport type ListUnsubscribeForcedReason =\n  /** The send takes the organization to the bulk threshold. */\n  | 'bulk-volume'\n  /**\n   * The send leaves on the shared pooled identity, whose reputation is every\n   * site's on it, and which refuses marketing mail without a way out.\n   */\n  | 'pooled-identity'\n  /**\n   * The organization's recent volume could not be read, so whether the send\n   * reaches the threshold is unknown — and the header is the safe answer.\n   */\n  | 'volume-unknown'\n\n/** What one send does with the header, and why. */\nexport interface ListUnsubscribeDecision {\n  /** What the sender's setting asked for. */\n  requested: boolean\n  /** Whether the send carries the header. */\n  on: boolean\n  /** True when the setting said off and the send carries it anyway. */\n  forced: boolean\n  /** Why it was forced; null when it was not. */\n  reason: ListUnsubscribeForcedReason | null\n  /**\n   * The organization's volume the decision was made on: what it had sent in\n   * the window plus what this send will address.\n   */\n  volume: number\n  /** The threshold it was compared with. */\n  threshold: number\n}\n\n/**\n * Whether one bulk send carries the header, honoring the sender's setting\n * unless the send would make the organization a bulk sender.\n *\n * `recentVolume` is what the organization has already sent in the window and\n * `sendVolume` what this send will address in total, so the question asked is\n * the one the rule asks — does the organization reach the threshold — and a\n * send that starts under it and would finish over it is caught at its start\n * rather than halfway through. Reaching the threshold counts, because the\n * rule's line is \"5,000 or more\".\n *\n * `forcedBefore` keeps a decision made for an earlier part of the same send:\n * a campaign delivered over several batches does not drop the header halfway\n * through because a day rolled over.\n */\nexport function decideListUnsubscribe(input: {\n  requested: boolean\n  recentVolume: number\n  sendVolume: number\n  threshold?: number\n  pooled?: boolean\n  forcedBefore?: ListUnsubscribeForcedReason | null\n}): ListUnsubscribeDecision {\n  const count = (raw: number) =>\n    Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : 0\n  const threshold = listUnsubscribeBulkThreshold(input.threshold)\n  const volume = count(input.recentVolume) + count(input.sendVolume)\n  const base = { requested: input.requested, volume, threshold }\n  if (input.requested) {\n    return { ...base, on: true, forced: false, reason: null }\n  }\n  const reason: ListUnsubscribeForcedReason | null = input.pooled\n    ? 'pooled-identity'\n    : volume >= threshold\n      ? 'bulk-volume'\n      : (input.forcedBefore ?? null)\n  return reason\n    ? { ...base, on: true, forced: true, reason }\n    : { ...base, on: false, forced: false, reason: null }\n}\n\n/**\n * One sentence for a forced decision, for the page that shows it.\n *\n * Written here rather than in a component so the send record, the log line\n * and the campaign page say the same thing.\n */\nexport function listUnsubscribeForcedDetail(\n  decision: Pick<ListUnsubscribeDecision, 'reason' | 'volume' | 'threshold'>,\n): string {\n  if (decision.reason === 'pooled-identity') {\n    return (\n      'Turned back on because this email left on the shared sending ' +\n      'address, where every campaign carries it.'\n    )\n  }\n  if (decision.reason === 'volume-unknown') {\n    return (\n      'Turned back on because your organization’s sending volume could not ' +\n      'be read when this email went out, so it could not be shown to be ' +\n      'under the bulk-sender threshold.'\n    )\n  }\n  if (decision.reason === 'bulk-volume') {\n    return (\n      `Turned back on because this email took your organization to ` +\n      `${decision.volume.toLocaleString('en-US')} campaign emails in 24 ` +\n      `hours, at or over the ${decision.threshold.toLocaleString('en-US')} ` +\n      'at which Gmail and Yahoo require a one-click unsubscribe.'\n    )\n  }\n  return ''\n}\n"],"names":["LIST_UNSUBSCRIBE_ONE_CLICK","readListUnsubscribeSetting","raw","defaultOn","listUnsubscribeHeaders","input","url","String","trim","mailto","uris","filter","Boolean","length","map","uri","join","resolveListUnsubscribe","enabled","status","mintUrl","mintMailto","LIST_UNSUBSCRIBE_BULK_THRESHOLD_DEFAULT","LIST_UNSUBSCRIBE_BULK_THRESHOLD_ENV","LIST_UNSUBSCRIBE_BULK_WINDOW_MS","listUnsubscribeBulkThreshold","process","undefined","env","value","Number","isFinite","Math","floor","decideListUnsubscribe","count","threshold","volume","recentVolume","sendVolume","base","requested","on","forced","reason","pooled","forcedBefore","listUnsubscribeForcedDetail","decision","toLocaleString"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GAED,gEAAgE,GAChE,OAAO,MAAMA,6BAA6B,6BAA4B;AAEtE;;2CAE2C,GAE3C;;;;;;;;CAQC,GACD,OAAO,SAASC,2BACdC,GAAY,EACZC,SAAkB;IAElB,OAAO,OAAOD,QAAQ,YAAYA,MAAMC;AAC1C;AAEA;;2CAE2C,GAE3C;;;;;;;;CAQC,GACD,OAAO,SAASC,uBAAuBC,KAGtC;QACoBA,YACGA;IADtB,MAAMC,MAAMC,QAAOF,aAAAA,MAAMC,GAAG,YAATD,aAAa,IAAIG,IAAI;IACxC,MAAMC,SAASF,QAAOF,gBAAAA,MAAMI,MAAM,YAAZJ,gBAAgB,IAAIG,IAAI;IAC9C,MAAME,OAAO;QAACJ;QAAKG;KAAO,CAACE,MAAM,CAACC;IAClC,IAAI,CAACF,KAAKG,MAAM,EAAE,OAAO,CAAC;IAC1B,OAAO;QACL,oBAAoBH,KAAKI,GAAG,CAAC,CAACC,MAAQ,CAAC,CAAC,EAAEA,IAAI,CAAC,CAAC,EAAEC,IAAI,CAAC;OACnDV,MAAM;QAAE,yBAAyBN;IAA2B,IAAI,CAAC;AAEzE;AAYA;;;;;;;;;CASC,GACD,OAAO,SAASiB,uBAAuBZ,KAItC;IACC,IAAIA,MAAMa,OAAO,KAAK,MAAM,OAAO;QAAEC,QAAQ;IAAM;IACnD,MAAMb,MAAMD,MAAMe,OAAO,MAAM;IAC/B,IAAI,CAACd,KAAK,OAAO;QAAEa,QAAQ;IAAc;IACzC,IAAI,CAACd,MAAMgB,UAAU,EAAE,OAAO;QAAEF,QAAQ;QAASb;QAAKG,QAAQ;IAAK;IACnE,MAAMA,SAASJ,MAAMgB,UAAU,MAAM;IACrC,OAAOZ,SAAS;QAAEU,QAAQ;QAASb;QAAKG;IAAO,IAAI;QAAEU,QAAQ;IAAc;AAC7E;AAEA;;2CAE2C,GAE3C;;;;;;;;;;CAUC,GACD,OAAO,MAAMG,0CAA0C,KAAK;AAE5D,wEAAwE,GACxE,OAAO,MAAMC,sCACX,wCAAuC;AAEzC,0CAA0C,GAC1C,OAAO,MAAMC,kCAAkC,SAAU;AAEzD;;;;;;;;;;;;CAYC,GACD,OAAO,SAASC,6BACdvB;QAEIwB;WAFW,OAAOA,YAAY,cAC9BC,aACAD,eAAAA,QAAQE,GAAG,qBAAXF,YAAa,CAACH,oCAAoC;IAAA;IAEtD,IAAIrB,QAAQ,QAAQA,QAAQyB,aAAapB,OAAOL,KAAKM,IAAI,OAAO,IAAI;QAClE,OAAOc;IACT;IACA,MAAMO,QAAQC,OAAO5B;IACrB,IAAI,CAAC4B,OAAOC,QAAQ,CAACF,UAAUA,QAAQ,GAAG;QACxC,OAAOP;IACT;IACA,OAAOU,KAAKC,KAAK,CAACJ;AACpB;AAoCA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASK,sBAAsB7B,KAOrC;QAaQA;IAZP,MAAM8B,QAAQ,CAACjC,MACb4B,OAAOC,QAAQ,CAAC7B,QAAQA,MAAM,IAAI8B,KAAKC,KAAK,CAAC/B,OAAO;IACtD,MAAMkC,YAAYX,6BAA6BpB,MAAM+B,SAAS;IAC9D,MAAMC,SAASF,MAAM9B,MAAMiC,YAAY,IAAIH,MAAM9B,MAAMkC,UAAU;IACjE,MAAMC,OAAO;QAAEC,WAAWpC,MAAMoC,SAAS;QAAEJ;QAAQD;IAAU;IAC7D,IAAI/B,MAAMoC,SAAS,EAAE;QACnB,OAAO,aAAKD;YAAME,IAAI;YAAMC,QAAQ;YAAOC,QAAQ;;IACrD;IACA,MAAMA,SAA6CvC,MAAMwC,MAAM,GAC3D,oBACAR,UAAUD,YACR,iBACC/B,sBAAAA,MAAMyC,YAAY,YAAlBzC,sBAAsB;IAC7B,OAAOuC,SACH,aAAKJ;QAAME,IAAI;QAAMC,QAAQ;QAAMC;SACnC,aAAKJ;QAAME,IAAI;QAAOC,QAAQ;QAAOC,QAAQ;;AACnD;AAEA;;;;;CAKC,GACD,OAAO,SAASG,4BACdC,QAA0E;IAE1E,IAAIA,SAASJ,MAAM,KAAK,mBAAmB;QACzC,OACE,kEACA;IAEJ;IACA,IAAII,SAASJ,MAAM,KAAK,kBAAkB;QACxC,OACE,yEACA,sEACA;IAEJ;IACA,IAAII,SAASJ,MAAM,KAAK,eAAe;QACrC,OACE,CAAC,4DAA4D,CAAC,GAC9D,GAAGI,SAASX,MAAM,CAACY,cAAc,CAAC,SAAS,uBAAuB,CAAC,GACnE,CAAC,sBAAsB,EAAED,SAASZ,SAAS,CAACa,cAAc,CAAC,SAAS,CAAC,CAAC,GACtE;IAEJ;IACA,OAAO;AACT"}

package/src/lib/marketing-send.js

@@ -70,6 +70,7 @@
  * jest.
  */ import { escapeEmailHtml } from "./email-render.js";
 import { resolveSendPriority } from "./send-rate.js";
+import { listUnsubscribeHeaders } from "./list-unsubscribe.js";
 /**
  * Whether a message is MARKETING, derived from what it already carries.
  *
@@ -395,10 +396,9 @@ export const MARKETING_SUNSET_MAX_DAYS = 3650;
  * verb nothing serves.
  */ export function unsubscribeHeaders(unsubscribeUrl) {
     if (!unsubscribeUrl) return {};
-    return {
-        'List-Unsubscribe': `<${unsubscribeUrl}>`,
-        'List-Unsubscribe-Post': 'List-Unsubscribe=One-Click'
-    };
+    return listUnsubscribeHeaders({
+        url: unsubscribeUrl
+    });
 }
 /**
  * What the visible opt-out is CALLED, in every part of every message.