@growth-labs/mailer 0.4.11 → 0.5.1

package/dist/utils/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,SAAS,WAAW,CAAC,MAAgC;IACpD,MAAM,KAAK,GAAG,MAAM,YAAY,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5E,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACjG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAc;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7B,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CAClB,CAAA;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,IAAY;IACnD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7E,OAAO,WAAW,CAAC,SAAS,CAAC,CAAA;AAC9B,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,SAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/F,CAAC;AAQD,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE7C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,OAAqB;IACxE,MAAM,YAAY,GAAG,EAAE,GAAG,OAAO,EAAE,CAAA;IAEnC,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACzE,YAAY,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAA;IAC9C,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC5E,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACpD,OAAO,GAAG,UAAU,IAAI,SAAS,EAAE,CAAA;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,MAAc,EACd,KAAa;IAEb,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAEhC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;IAE3C,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAE1C,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAI7E,CAAA;QAED,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAA;QAEtE,OAAO,OAAO,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,SAAS,WAAW,CAAC,MAAgC;IACpD,MAAM,KAAK,GAAG,MAAM,YAAY,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5E,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACjG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAc;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7B,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CAClB,CAAA;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,IAAY;IACnD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7E,OAAO,WAAW,CAAC,SAAS,CAAC,CAAA;AAC9B,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,SAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/F,CAAC;AASD,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE7C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,OAAqB;IACxE,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IACjD,CAAC;IAED,MAAM,YAAY,GAAG,EAAE,GAAG,OAAO,EAAE,CAAA;IAEnC,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACzE,YAAY,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAA;IAC9C,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC5E,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACpD,OAAO,GAAG,UAAU,IAAI,SAAS,EAAE,CAAA;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,MAAc,EACd,KAAa,EACb,YAAoB;IAEpB,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA;IAEzE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAEhC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;IAE3C,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAE1C,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;QAC7D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAK7E,CAAA;QAED,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAA;QACtE,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAA;QACzE,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,IAAI,CAAA;QAE9C,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC"}

package/dist/utils/urls.d.ts

@@ -1,6 +1,6 @@
 import type { ResolvedMailerOptions } from '../options.js';
 export declare function buildSiteUrl(siteUrl: string, path: string, searchParams?: Record<string, string | boolean | undefined>): string;
-export declare function buildSubscriberManageUrls(options: Pick<ResolvedMailerOptions, 'preferencesPath' | 'siteUrl' | 'signingSecret' | 'unsubscribePath'>, subscriberId?: string): Promise<{
+export declare function buildSubscriberManageUrls(options: Pick<ResolvedMailerOptions, 'preferencesPath' | 'siteUrl' | 'unsubscribePath'>, subscriberId?: string, signingSecret?: string): Promise<{
     preferencesUrl: string;
     unsubscribeUrl: string;
 }>;

package/dist/utils/urls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"urls.d.ts","sourceRoot":"","sources":["../../src/utils/urls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAG1D,wBAAgB,YAAY,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,GACzD,MAAM,CASR;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,IAAI,CACZ,qBAAqB,EACrB,iBAAiB,GAAG,SAAS,GAAG,eAAe,GAAG,iBAAiB,CACnE,EACD,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB7D"}
+{"version":3,"file":"urls.d.ts","sourceRoot":"","sources":["../../src/utils/urls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAI1D,wBAAgB,YAAY,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,GACzD,MAAM,CASR;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,SAAS,GAAG,iBAAiB,CAAC,EACvF,YAAY,CAAC,EAAE,MAAM,EACrB,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CA4B7D"}

package/dist/utils/urls.js

@@ -1,3 +1,4 @@
+import { siteHost } from './runtime-secrets.js';
 import { generateToken } from './tokens.js';
 export function buildSiteUrl(siteUrl, path, searchParams) {
     const url = new URL(path, siteUrl);
@@ -8,18 +9,23 @@ export function buildSiteUrl(siteUrl, path, searchParams) {
     }
     return url.toString();
 }
-export async function buildSubscriberManageUrls(options, subscriberId) {
+export async function buildSubscriberManageUrls(options, subscriberId, signingSecret) {
     if (!subscriberId) {
         return { preferencesUrl: '', unsubscribeUrl: '' };
     }
+    if (!signingSecret)
+        throw new Error('GL_MAILER_SIGNING_UNCONFIGURED');
+    const host = siteHost(options.siteUrl);
     const [unsubscribeToken, preferencesToken] = await Promise.all([
-        generateToken(options.signingSecret, {
+        generateToken(signingSecret, {
             subscriberId,
             action: 'unsubscribe',
+            host,
         }),
-        generateToken(options.signingSecret, {
+        generateToken(signingSecret, {
             subscriberId,
             action: 'preferences',
+            host,
         }),
     ]);
     return {

package/dist/utils/urls.js.map

@@ -1 +1 @@
-{"version":3,"file":"urls.js","sourceRoot":"","sources":["../../src/utils/urls.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,UAAU,YAAY,CAC3B,OAAe,EACf,IAAY,EACZ,YAA2D;IAE3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAElC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAC9E,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAGC,EACD,YAAqB;IAErB,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAA;IAClD,CAAC;IAED,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9D,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE;YACpC,YAAY;YACZ,MAAM,EAAE,aAAa;SACrB,CAAC;QACF,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE;YACpC,YAAY;YACZ,MAAM,EAAE,aAAa;SACrB,CAAC;KACF,CAAC,CAAA;IAEF,OAAO;QACN,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE;YACtE,KAAK,EAAE,gBAAgB;SACvB,CAAC;QACF,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE;YACtE,KAAK,EAAE,gBAAgB;SACvB,CAAC;KACF,CAAA;AACF,CAAC"}
+{"version":3,"file":"urls.js","sourceRoot":"","sources":["../../src/utils/urls.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,UAAU,YAAY,CAC3B,OAAe,EACf,IAAY,EACZ,YAA2D;IAE3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAElC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAC9E,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAuF,EACvF,YAAqB,EACrB,aAAsB;IAEtB,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAA;IAClD,CAAC;IAED,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACrE,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACtC,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9D,aAAa,CAAC,aAAa,EAAE;YAC5B,YAAY;YACZ,MAAM,EAAE,aAAa;YACrB,IAAI;SACJ,CAAC;QACF,aAAa,CAAC,aAAa,EAAE;YAC5B,YAAY;YACZ,MAAM,EAAE,aAAa;YACrB,IAAI;SACJ,CAAC;KACF,CAAC,CAAA;IAEF,OAAO;QACN,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE;YACtE,KAAK,EAAE,gBAAgB;SACvB,CAAC;QACF,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE;YACtE,KAAK,EAAE,gBAAgB;SACvB,CAAC;KACF,CAAA;AACF,CAAC"}

package/dist/vite-plugin.d.ts

@@ -1,4 +1,5 @@
 import type { Plugin } from 'vite';
 import type { ResolvedMailerOptions } from './options.js';
+export declare function renderMailerConfigModule(config: ResolvedMailerOptions, command: 'build' | 'serve'): string;
 export declare function growthLabsMailerPlugin(config: ResolvedMailerOptions): Plugin;
 //# sourceMappingURL=vite-plugin.d.ts.map

package/dist/vite-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vite-plugin.d.ts","sourceRoot":"","sources":["../src/vite-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAClC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAKzD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAc5E"}
+{"version":3,"file":"vite-plugin.d.ts","sourceRoot":"","sources":["../src/vite-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAClC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAKzD,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,OAAO,GAAG,OAAO,GACxB,MAAM,CAOR;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAmB5E"}

package/dist/vite-plugin.js

@@ -1,8 +1,20 @@
 const VIRTUAL_MODULE_ID = 'virtual:growth-labs/mailer/config';
 const RESOLVED_VIRTUAL_MODULE_ID = `\0${VIRTUAL_MODULE_ID}`;
+export function renderMailerConfigModule(config, command) {
+    const serializableConfig = { ...config };
+    if (command !== 'serve') {
+        delete serializableConfig.turnstileSecretKey;
+        delete serializableConfig.signingSecret;
+    }
+    return `export const config = ${JSON.stringify(serializableConfig)};`;
+}
 export function growthLabsMailerPlugin(config) {
+    let command = 'build';
     return {
         name: 'growth-labs-mailer-config',
+        configResolved(resolvedConfig) {
+            command = resolvedConfig.command;
+        },
         resolveId(id) {
             if (id === VIRTUAL_MODULE_ID) {
                 return RESOLVED_VIRTUAL_MODULE_ID;
@@ -10,7 +22,7 @@ export function growthLabsMailerPlugin(config) {
         },
         load(id) {
             if (id === RESOLVED_VIRTUAL_MODULE_ID) {
-                return `export const config = ${JSON.stringify(config)};`;
+                return renderMailerConfigModule(config, command);
             }
         },
     };

package/dist/vite-plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"vite-plugin.js","sourceRoot":"","sources":["../src/vite-plugin.ts"],"names":[],"mappings":"AAGA,MAAM,iBAAiB,GAAG,mCAAmC,CAAA;AAC7D,MAAM,0BAA0B,GAAG,KAAK,iBAAiB,EAAE,CAAA;AAE3D,MAAM,UAAU,sBAAsB,CAAC,MAA6B;IACnE,OAAO;QACN,IAAI,EAAE,2BAA2B;QACjC,SAAS,CAAC,EAAE;YACX,IAAI,EAAE,KAAK,iBAAiB,EAAE,CAAC;gBAC9B,OAAO,0BAA0B,CAAA;YAClC,CAAC;QACF,CAAC;QACD,IAAI,CAAC,EAAE;YACN,IAAI,EAAE,KAAK,0BAA0B,EAAE,CAAC;gBACvC,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAA;YAC1D,CAAC;QACF,CAAC;KACD,CAAA;AACF,CAAC"}
+{"version":3,"file":"vite-plugin.js","sourceRoot":"","sources":["../src/vite-plugin.ts"],"names":[],"mappings":"AAGA,MAAM,iBAAiB,GAAG,mCAAmC,CAAA;AAC7D,MAAM,0BAA0B,GAAG,KAAK,iBAAiB,EAAE,CAAA;AAE3D,MAAM,UAAU,wBAAwB,CACvC,MAA6B,EAC7B,OAA0B;IAE1B,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,EAAE,CAAA;IACxC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,kBAAkB,CAAC,kBAAkB,CAAA;QAC5C,OAAO,kBAAkB,CAAC,aAAa,CAAA;IACxC,CAAC;IACD,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,GAAG,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAA6B;IACnE,IAAI,OAAO,GAAsB,OAAO,CAAA;IAExC,OAAO;QACN,IAAI,EAAE,2BAA2B;QACjC,cAAc,CAAC,cAAc;YAC5B,OAAO,GAAG,cAAc,CAAC,OAAO,CAAA;QACjC,CAAC;QACD,SAAS,CAAC,EAAE;YACX,IAAI,EAAE,KAAK,iBAAiB,EAAE,CAAC;gBAC9B,OAAO,0BAA0B,CAAA;YAClC,CAAC;QACF,CAAC;QACD,IAAI,CAAC,EAAE;YACN,IAAI,EAAE,KAAK,0BAA0B,EAAE,CAAC;gBACvC,OAAO,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YACjD,CAAC;QACF,CAAC;KACD,CAAA;AACF,CAAC"}

package/migrations/0003_add_delivery_claim_to_email_sends.sql

@@ -0,0 +1,8 @@
+-- WM-01: send-time suppression recheck + a stable per-recipient delivery
+-- claim. delivery_token is minted once at enqueue time and carried in the
+-- queue message; the consumer's claim update matches on it so a message
+-- superseded by a fresh resend cycle (or replayed from before a restore)
+-- can never be actioned against the current row. claimed_at marks the
+-- in-flight window between claiming the row and reconciling its outcome.
+ALTER TABLE gl_email_sends ADD COLUMN delivery_token TEXT;
+ALTER TABLE gl_email_sends ADD COLUMN claimed_at TEXT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@growth-labs/mailer",
-  "version": "0.4.11",
+  "version": "0.5.1",
   "type": "module",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -71,7 +71,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "peerDependencies": {
-    "astro": "^6.1.10"
+    "astro": "^6.1.10 || ^7.0.0"
   },
   "peerDependenciesMeta": {
     "@growth-labs/analytics": {
@@ -85,10 +85,10 @@
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20260402.1",
-    "astro": "^6.1.10",
+    "astro": "7.3.1",
     "drizzle-kit": "^0.30.0",
     "typescript": "^5.7.0",
-    "vite": "^7.3.2",
+    "vite": "8.0.16",
     "vitest": "^4.1.8"
   },
   "scripts": {

package/src/options.ts

@@ -25,14 +25,16 @@ export const mailerOptionsSchema = z.object({
 
 	// ─── Turnstile (subscribe form) ───
 	turnstileSiteKey: z.string(),
-	turnstileSecretKey: z.string(),
+	turnstileSecretBinding: z.string().min(1).default('TURNSTILE_SECRET_KEY'),
+	turnstileSecretKey: z.string().optional(),
 
 	// ─── Subscriber lifecycle ───
 	doubleOptIn: z.boolean().default(true),
 	topics: z.array(z.string()).optional(),
 
 	// ─── Token signing ───
-	signingSecret: z.string(),
+	signingSecretBinding: z.string().min(1).default('MAILER_SIGNING_SECRET'),
+	signingSecret: z.string().optional(),
 
 	// ─── Routes ───
 	subscribePath: z.string().default('/api/newsletter/subscribe'),

package/src/queue/consumer.ts

@@ -1,18 +1,82 @@
 import { drizzle } from 'drizzle-orm/d1'
 import { probeMailerSendsSchema } from '../_internal/schema-probe.js'
-import type { EmailQueueMessage, SiteConfigLookup, SiteMailerConfig } from '../types.js'
+import type {
+	EmailQueueMessage,
+	QueueRecipient,
+	SiteConfigLookup,
+	SiteMailerConfig,
+	SubscriberStatusLookup,
+} from '../types.js'
 import { emitMailerAnalyticsEvent } from '../utils/analytics.js'
 import { updateSendStatus } from '../utils/bounce.js'
+import { SUPPRESSED_STATUSES } from '../utils/broadcast.js'
+import { claimDelivery } from '../utils/delivery-claim.js'
 import type { CloudflareEmailSender } from '../utils/providers.js'
 import { CloudflareEmailProvider, sleep } from '../utils/providers.js'
+import { getSubscriberById } from '../utils/subscribers.js'
 
-export type { SiteConfigLookup, SiteMailerConfig } from '../types.js'
+export type { SiteConfigLookup, SiteMailerConfig, SubscriberStatusLookup } from '../types.js'
+
+type DrizzleDB = ReturnType<typeof drizzle>
 
 export interface MailerConsumerOptions {
 	d1Binding: string
 	senderBinding: string
 	analyticsBinding?: string
 	siteConfigLookup: SiteConfigLookup
+	/**
+	 * Recheck a recipient's current suppression status at send admission
+	 * (WM-01). Defaults to querying `gl_subscribers` on `env[d1Binding]` —
+	 * correct for single-tenant sites. A realm consumer whose `d1Binding` D1
+	 * holds `gl_email_sends` only (subscribers live in each site's own D1)
+	 * must supply this for the recheck to be effective; unset in that
+	 * topology, the consumer logs GL_MAILER_SUPPRESSION_CHECK_UNAVAILABLE
+	 * once per instance and falls back to enqueue-time suppression only.
+	 */
+	subscriberStatusLookup?: SubscriberStatusLookup
+}
+
+let subscriberLookupUnavailableLogged = false
+
+/**
+ * True when the recipient's subscriber row currently carries a suppressed
+ * status — rechecked at send admission, not trusted from enqueue time
+ * (WM-01). Falls back to a direct `gl_subscribers` query when no
+ * `subscriberStatusLookup` is configured; a query failure (table absent —
+ * the realm-consumer topology) logs once and fails open rather than
+ * silently blocking every send in a deployment this check can't reach.
+ */
+async function isCurrentlySuppressed(
+	db: DrizzleDB,
+	recipient: QueueRecipient,
+	siteId: string,
+	env: Record<string, unknown>,
+	lookup: SubscriberStatusLookup | undefined,
+): Promise<boolean> {
+	if (lookup) {
+		const status = await lookup(
+			{ subscriberId: recipient.subscriberId, siteId, email: recipient.email },
+			env,
+		)
+		return status !== null && SUPPRESSED_STATUSES.has(status)
+	}
+	try {
+		const subscriber = await getSubscriberById(db, recipient.subscriberId)
+		return subscriber !== null && SUPPRESSED_STATUSES.has(subscriber.status)
+	} catch (err) {
+		if (!subscriberLookupUnavailableLogged) {
+			subscriberLookupUnavailableLogged = true
+			console.error(
+				'[mailer] GL_MAILER_SUPPRESSION_CHECK_UNAVAILABLE: cannot recheck suppression at send ' +
+					"time — gl_subscribers is not queryable on env.<d1Binding> (a realm consumer's " +
+					'd1Binding D1 holds gl_email_sends only; subscribers live in each site D1). Wire ' +
+					'MailerConsumerOptions.subscriberStatusLookup to close this gap. Sending without a ' +
+					'send-time recheck for this Worker instance. ' +
+					(err instanceof Error ? err.message : String(err)),
+			)
+		}
+		return false
+	}
 }
 
 /** Effective options for a single message, resolved from `siteConfigLookup`. */
@@ -106,6 +170,56 @@ export async function handleEmailQueue(
 		const effectiveReplyTo = effective.replyTo ?? replyTo
 
 		for (const recipient of recipients) {
+			const claimedAt = new Date().toISOString()
+			const claim = await claimDelivery(
+				db,
+				recipient.trackingId,
+				recipient.deliveryToken,
+				claimedAt,
+			)
+
+			if (claim === 'missing' || claim === 'invalid-authorization') {
+				console.error(
+					`[mailer] Refusing to send trackingId=${recipient.trackingId}: ${claim} — stale, ` +
+						'superseded, or a restore-era replay. Not sending, not touching the record.',
+				)
+				continue
+			}
+
+			if (claim === 'already-terminal') {
+				// Duplicate enqueue or redelivery of an already fully-processed
+				// send — a no-op, not a resend.
+				continue
+			}
+
+			if (claim === 'reconcile-in-flight') {
+				// A prior attempt claimed this row and never reached ack (crash or
+				// timeout before message.ack()). We cannot know whether the
+				// provider call actually completed, but calling it again risks a
+				// duplicate real send — reconcile as sent instead of resending.
+				await updateSendStatus(db, recipient.trackingId, 'sent', {
+					sentAt: new Date().toISOString(),
+				})
+				continue
+			}
+
+			// claim === 'claimed' — this invocation owns the send. Recheck
+			// suppression now: the subscriber's status may have changed since
+			// this message was enqueued.
+			if (type !== 'transactional') {
+				const suppressed = await isCurrentlySuppressed(
+					db,
+					recipient,
+					message.body.siteId,
+					env,
+					options.subscriberStatusLookup,
+				)
+				if (suppressed) {
+					await updateSendStatus(db, recipient.trackingId, 'suppressed', {})
+					continue
+				}
+			}
+
 			let html = htmlTemplate
 			if (type !== 'transactional') {
 				const siteUrl = effective.siteUrl ?? ''

package/src/routes/confirm.ts

@@ -4,6 +4,11 @@ import type { APIRoute } from 'astro'
 import { drizzle } from 'drizzle-orm/d1'
 import { probeMailerSchema, schemaMissingResponse } from '../_internal/schema-probe.js'
 import { emitMailerAnalyticsEvent } from '../utils/analytics.js'
+import {
+	resolveSigningSecret,
+	runtimeSecretErrorResponse,
+	siteHost,
+} from '../utils/runtime-secrets.js'
 import { sendTransactional } from '../utils/send.js'
 import { confirmSubscriber, getSubscriberById } from '../utils/subscribers.js'
 import { verifyToken } from '../utils/tokens.js'
@@ -14,15 +19,17 @@ export const GET: APIRoute = async (context) => {
 	if (!token) {
 		return Response.json({ error: 'Missing token' }, { status: 400 })
 	}
+	const bindingsEnv = cloudflareEnv as Record<string, unknown>
+	const signingSecret = await resolveSigningSecret(bindingsEnv, config, url.toString())
+	if (!signingSecret.ok) return runtimeSecretErrorResponse(signingSecret)
 
 	// Verify token
-	const payload = await verifyToken(config.signingSecret, token)
+	const payload = await verifyToken(signingSecret.secret, token, siteHost(config.siteUrl))
 	if (!payload || payload.action !== 'confirm') {
 		return Response.json({ error: 'Invalid or expired token' }, { status: 400 })
 	}
 
 	// Resolve bindings
-	const bindingsEnv = cloudflareEnv as Record<string, unknown>
 	const d1 = bindingsEnv[config.d1Binding] as D1Database
 
 	// Schema probe — return 503 with GL_MAILER_SCHEMA_MISSING on miss.

package/src/routes/preferences.astro

@@ -8,6 +8,11 @@ import {
 	unsubscribeSubscriber,
 	updatePreferences,
 } from "../utils/subscribers.js";
+import {
+	resolveSigningSecret,
+	runtimeSecretErrorResponse,
+	siteHost,
+} from "../utils/runtime-secrets.js";
 import { generateToken, verifyToken } from "../utils/tokens.js";
 import { buildSiteUrl } from "../utils/urls.js";
 
@@ -27,15 +32,20 @@ if (!token) {
 	return new Response("Missing token", { status: 400 });
 }
 
-const payload = await verifyToken(config.signingSecret, token);
+const bindingsEnv = cloudflareEnv as Record<string, unknown>;
+const signingSecret = await resolveSigningSecret(bindingsEnv, config, Astro.request.url);
+if (!signingSecret.ok) return runtimeSecretErrorResponse(signingSecret);
+
+const payload = await verifyToken(signingSecret.secret, token, siteHost(config.siteUrl));
 if (!payload || !["preferences", "unsubscribe"].includes(payload.action)) {
 	return new Response("Invalid or expired token", { status: 400 });
 }
 
 if (Astro.request.method === "GET" && payload.action === "unsubscribe") {
-	const preferencesToken = await generateToken(config.signingSecret, {
+	const preferencesToken = await generateToken(signingSecret.secret, {
 		subscriberId: payload.subscriberId,
 		action: "preferences",
+		host: siteHost(config.siteUrl),
 	});
 
 	return Astro.redirect(
@@ -51,7 +61,6 @@ if (Astro.request.method === "POST" && payload.action !== "preferences") {
 	return new Response("Invalid or expired token", { status: 400 });
 }
 
-const bindingsEnv = cloudflareEnv as Record<string, unknown>;
 const d1 = bindingsEnv[config.d1Binding] as D1Database;
 if (!d1) {
 	return new Response("D1 binding not available", { status: 500 });

package/src/routes/subscribe.ts

@@ -4,6 +4,12 @@ import type { APIRoute } from 'astro'
 import { drizzle } from 'drizzle-orm/d1'
 import { probeMailerSchema, schemaMissingResponse } from '../_internal/schema-probe.js'
 import { emitMailerAnalyticsEvent } from '../utils/analytics.js'
+import {
+	resolveSigningSecret,
+	resolveTurnstileSecret,
+	runtimeSecretErrorResponse,
+	siteHost,
+} from '../utils/runtime-secrets.js'
 import { sendTransactional } from '../utils/send.js'
 import { createSubscriber } from '../utils/subscribers.js'
 import { generateToken } from '../utils/tokens.js'
@@ -29,6 +35,12 @@ export const POST: APIRoute = async (context) => {
 		return Response.json({ error: 'Invalid email format' }, { status: 400 })
 	}
 
+	const bindingsEnv = cloudflareEnv as Record<string, unknown>
+	const turnstileSecret = await resolveTurnstileSecret(bindingsEnv, config, request.url)
+	if (!turnstileSecret.ok) return runtimeSecretErrorResponse(turnstileSecret)
+	const signingSecret = await resolveSigningSecret(bindingsEnv, config, request.url)
+	if (!signingSecret.ok) return runtimeSecretErrorResponse(signingSecret)
+
 	// 4. Validate Turnstile token
 	const turnstileResponse = await fetch(
 		'https://challenges.cloudflare.com/turnstile/v0/siteverify',
@@ -36,7 +48,7 @@ export const POST: APIRoute = async (context) => {
 			method: 'POST',
 			headers: { 'Content-Type': 'application/json' },
 			body: JSON.stringify({
-				secret: config.turnstileSecretKey,
+				secret: turnstileSecret.secret,
 				response: body.turnstileToken,
 				remoteip: request.headers.get('cf-connecting-ip') ?? undefined,
 			}),
@@ -50,7 +62,6 @@ export const POST: APIRoute = async (context) => {
 	}
 
 	// 5. Resolve bindings
-	const bindingsEnv = cloudflareEnv as Record<string, unknown>
 	const d1 = bindingsEnv[config.d1Binding] as D1Database
 
 	// 5a. Schema probe — runs once per Worker instance. On miss, return 503
@@ -72,9 +83,10 @@ export const POST: APIRoute = async (context) => {
 
 		// 7. Send confirmation or welcome email
 		if (config.doubleOptIn && (isNew || subscriber.status === 'pending')) {
-			const confirmToken = await generateToken(config.signingSecret, {
+			const confirmToken = await generateToken(signingSecret.secret, {
 				subscriberId: subscriber.id,
 				action: 'confirm',
+				host: siteHost(config.siteUrl),
 			})
 			const confirmUrl = `${config.siteUrl}${config.confirmPath}?token=${confirmToken}`
 

package/src/routes/unsubscribe.ts

@@ -4,6 +4,11 @@ import type { APIRoute } from 'astro'
 import { drizzle } from 'drizzle-orm/d1'
 import { probeMailerSchema, schemaMissingResponse } from '../_internal/schema-probe.js'
 import { emitMailerAnalyticsEvent } from '../utils/analytics.js'
+import {
+	resolveSigningSecret,
+	runtimeSecretErrorResponse,
+	siteHost,
+} from '../utils/runtime-secrets.js'
 import { sendTransactional } from '../utils/send.js'
 import { getSubscriberById, unsubscribeSubscriber } from '../utils/subscribers.js'
 import { generateToken, verifyToken } from '../utils/tokens.js'
@@ -14,14 +19,18 @@ async function processUnsubscribe(
 	context?: Parameters<APIRoute>[0],
 	request?: Request,
 ) {
+	const bindingsEnv = cloudflareEnv as Record<string, unknown>
+	const requestUrl = request?.url ?? context?.url.toString() ?? config.siteUrl
+	const signingSecret = await resolveSigningSecret(bindingsEnv, config, requestUrl)
+	if (!signingSecret.ok) return { secretFailure: signingSecret }
+
 	// Verify token
-	const payload = await verifyToken(config.signingSecret, token)
+	const payload = await verifyToken(signingSecret.secret, token, siteHost(config.siteUrl))
 	if (!payload || payload.action !== 'unsubscribe') {
 		return { error: 'Invalid or expired token', status: 400 }
 	}
 
 	// Resolve bindings
-	const bindingsEnv = cloudflareEnv as Record<string, unknown>
 	const d1 = bindingsEnv[config.d1Binding] as D1Database
 
 	// Schema probe — short-circuit with a Response on miss; both GET and POST
@@ -66,6 +75,7 @@ async function processUnsubscribe(
 	return {
 		success: true,
 		subscriberId: payload.subscriberId,
+		signingSecret: signingSecret.secret,
 	}
 }
 
@@ -78,15 +88,17 @@ export const GET: APIRoute = async (context) => {
 	}
 
 	const result = await processUnsubscribe(token, context, request)
+	if (result.secretFailure) return runtimeSecretErrorResponse(result.secretFailure)
 	if ('schemaMissing' in result) return schemaMissingResponse()
 	if ('error' in result) {
 		return Response.json({ error: result.error }, { status: result.status })
 	}
 
 	// Generate preferences token for the redirect
-	const preferencesToken = await generateToken(config.signingSecret, {
+	const preferencesToken = await generateToken(result.signingSecret, {
 		subscriberId: result.subscriberId,
 		action: 'preferences',
+		host: siteHost(config.siteUrl),
 	})
 	const preferencesUrl = buildSiteUrl(config.siteUrl, config.preferencesPath, {
 		token: preferencesToken,
@@ -111,6 +123,7 @@ export const POST: APIRoute = async (context) => {
 	}
 
 	const result = await processUnsubscribe(token, context, request)
+	if (result.secretFailure) return runtimeSecretErrorResponse(result.secretFailure)
 	if ('schemaMissing' in result) return schemaMissingResponse()
 	if ('error' in result) {
 		return new Response(result.error, { status: result.status })

package/src/schema/sends.ts

@@ -19,6 +19,8 @@ export const emailSends = sqliteTable(
 		bounceType: text('bounce_type'),
 		complainedAt: text('complained_at'),
 		trackingId: text('tracking_id').notNull().unique(),
+		deliveryToken: text('delivery_token'),
+		claimedAt: text('claimed_at'),
 		createdAt: text('created_at').notNull(),
 	},
 	(table) => [

package/src/types.ts

@@ -82,12 +82,33 @@ export type SiteConfigLookup = (
 	env: Record<string, unknown>,
 ) => Promise<SiteMailerConfig | null>
 
+/**
+ * Recheck a recipient's current suppression status at send admission
+ * (WM-01). The default consumer implementation queries `gl_subscribers` on
+ * `env[d1Binding]`, which is correct for single-tenant sites. A realm
+ * consumer whose `d1Binding` D1 holds `gl_email_sends` only — subscribers
+ * live in each site's own D1 — must supply this to make the recheck
+ * effective for real; see MailerConsumerOptions.subscriberStatusLookup.
+ */
+export type SubscriberStatusLookup = (
+	params: { subscriberId: string; siteId: string; email: string },
+	env: Record<string, unknown>,
+) => Promise<SubscriberStatus | null>
+
 export interface QueueRecipient {
 	email: string
 	subscriberId: string
 	trackingId: string
 	unsubscribeToken: string
 	preferencesToken: string
+	/**
+	 * Minted once at enqueue time and carried through to the consumer (WM-01).
+	 * The consumer's delivery claim matches this against the current
+	 * `gl_email_sends` row before sending, so a message superseded by a later
+	 * resend cycle — or replayed from before a restore — can't act on a row
+	 * it no longer authorizes.
+	 */
+	deliveryToken: string
 }
 
 // ─── Email send record ───
@@ -113,12 +134,14 @@ export interface EmailSend {
 
 export type EmailSendStatus =
 	| 'queued'
+	| 'sending'
 	| 'sent'
 	| 'delivered'
 	| 'opened'
 	| 'clicked'
 	| 'bounced'
 	| 'complained'
+	| 'suppressed'
 
 // ─── Email provider interface ───
 

package/src/utils/broadcast.ts

@@ -6,6 +6,7 @@ import { emailSends } from '../schema/sends.js'
 import { subscribers } from '../schema/subscribers.js'
 import type { EmailQueueMessage, QueueRecipient, SubscriberStatus } from '../types.js'
 import { sleep } from './providers.js'
+import { resolveSigningSecret, siteHost } from './runtime-secrets.js'
 import type { MailerEnv } from './send.js'
 import { generateToken } from './tokens.js'
 import { injectTrackingPixel, rewriteLinksForTracking } from './tracking.js'
@@ -18,8 +19,11 @@ type DrizzleDB = ReturnType<typeof drizzle>
  * the ONLY sendable status; everything else (including `pending`, i.e. an
  * unconfirmed double-opt-in subscriber) is suppressed so a one-off blast can
  * never re-permission or re-mail a suppressed address.
+ *
+ * Exported so the queue consumer can recheck against the same set at send
+ * admission (WM-01) — the same statuses that block enqueue must block send.
  */
-const SUPPRESSED_STATUSES: ReadonlySet<SubscriberStatus> = new Set<SubscriberStatus>([
+export const SUPPRESSED_STATUSES: ReadonlySet<SubscriberStatus> = new Set<SubscriberStatus>([
 	'unsubscribed',
 	'bounced',
 	'complained',
@@ -330,6 +334,10 @@ export async function sendBroadcast(
 			dryRun: false,
 		}
 	}
+	const signingSecretResult = await resolveSigningSecret(env, options, options.siteUrl)
+	if (!signingSecretResult.ok) throw new Error(signingSecretResult.code)
+	const signingSecret = signingSecretResult.secret
+	const host = siteHost(options.siteUrl)
 
 	const html = prepareBroadcastHtml(params.html, options)
 	const now = new Date().toISOString()
@@ -338,14 +346,17 @@ export async function sendBroadcast(
 	const queueRecipients: QueueRecipient[] = []
 	for (const recipient of fresh) {
 		const trackingId = ulid()
+		const deliveryToken = ulid()
 		const [unsubscribeToken, preferencesToken] = await Promise.all([
-			generateToken(options.signingSecret, {
+			generateToken(signingSecret, {
 				subscriberId: recipient.subscriberId,
 				action: 'unsubscribe',
+				host,
 			}),
-			generateToken(options.signingSecret, {
+			generateToken(signingSecret, {
 				subscriberId: recipient.subscriberId,
 				action: 'preferences',
+				host,
 			}),
 		])
 
@@ -359,6 +370,7 @@ export async function sendBroadcast(
 			type: 'broadcast',
 			status: 'queued',
 			trackingId,
+			deliveryToken,
 			createdAt: now,
 		})
 
@@ -368,6 +380,7 @@ export async function sendBroadcast(
 			trackingId,
 			unsubscribeToken,
 			preferencesToken,
+			deliveryToken,
 		})
 	}