@kurtbruns/kestrel 1.8.0 → 1.9.0

package/dist/worker/index.js

@@ -1,4 +1,661 @@
-// @kurtbruns/kestrel 1.8.0: the Worker, built by scripts/build-package.mjs.
+// @kurtbruns/kestrel 1.9.0: the Worker, built by scripts/build-package.mjs.
+
+// shared/email.ts
+function normalizeEmail(email2) {
+  return email2.trim().toLowerCase();
+}
+function isValidEmail(email2) {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email2);
+}
+
+// shared/imports.ts
+var IMPORT_FORMAT = "kestrel-subscribers/1";
+var IMPORT_FORMAT_VERSIONS = [IMPORT_FORMAT];
+var IMPORT_STATUSES = ["subscribed", "pending", "unsubscribed", "none"];
+var OPT_INS = ["double", "single", "unknown"];
+var SUPPRESSION_CLAIMS = ["bounce", "complaint", "manual", "erased"];
+var PLAIN_LIST_STATUSES = ["subscribed", "unsubscribed", "bounced"];
+var IMPORT_LIMITS = {
+  maxRows: 1e4,
+  maxRowsFree: 1e3,
+  /** The request body, in bytes: 10,000 rows of about 700 bytes, evidence included. */
+  maxBodyBytes: 10 * 1024 * 1024,
+  /** One row's `evidence`, in bytes of its JSON. */
+  maxEvidenceBytes: 500
+};
+var DAILY_WRITES_IMPORT_CONFIRMED = 3e3;
+function dailyWritesImportWarning(confirmed) {
+  return `On the Workers Free plan\u2019s limits, this import leaves ${confirmed.toLocaleString("en-US")} confirmed subscribers. Importing and sending to that many on the same day may use up the database\u2019s daily allowance of writes, which stops this newsletter until midnight UTC. Send your next post tomorrow (UTC), or move to Workers Paid.`;
+}
+var EXPORT_PAGE_ROWS = {
+  paid: 1e4,
+  free: 1e3
+};
+var ORIGIN = /^[a-z0-9][a-z0-9._-]{0,39}$/;
+var INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d{1,9})?)?(Z|[+-]\d{2}:\d{2})$/;
+var IMPORT_COLUMNS = [
+  {
+    name: "email",
+    required: true,
+    values: null,
+    takes: "an email address; trimmed and lowercased before it is matched",
+    meaning: "The address. An invalid one is still a row, counted as invalid and reported, never dropped."
+  },
+  {
+    name: "status",
+    required: true,
+    values: IMPORT_STATUSES,
+    takes: "one of the values",
+    meaning: "The consent claim. `none` is a known address with no consent claim, present only to carry a suppression."
+  },
+  {
+    name: "opt_in",
+    required: true,
+    values: OPT_INS,
+    takes: "one of the values",
+    meaning: "How consent was collected. `unknown` unless the source states it."
+  },
+  {
+    name: "origin",
+    required: true,
+    values: null,
+    takes: "a short lowercase name (letters, digits, `.`, `_`, `-`, up to 40): `sendy`, `mailchimp`, `kestrel`, `unknown`",
+    meaning: "Where consent was first collected, as the file claims it."
+  },
+  {
+    name: "suppression",
+    required: false,
+    values: SUPPRESSION_CLAIMS,
+    takes: "one of the values, or empty",
+    meaning: "A suppression on top of `status`: the address bounced, complained, was suppressed by hand, or was erased."
+  },
+  {
+    name: "subscribed_at",
+    required: false,
+    values: null,
+    takes: "a UTC ISO-8601 instant with its zone (`2024-03-01T09:30:00Z`), or empty",
+    meaning: "When the person subscribed, if the source states it."
+  },
+  {
+    name: "confirmed_at",
+    required: false,
+    values: null,
+    takes: "an instant with its zone, or empty",
+    meaning: "When the person confirmed, if the source states it."
+  },
+  {
+    name: "unsubscribed_at",
+    required: false,
+    values: null,
+    takes: "an instant with its zone, or empty",
+    meaning: "When the person left, if the source states it. A reader who confirmed here after it stays confirmed."
+  },
+  {
+    name: "suppressed_at",
+    required: false,
+    values: null,
+    takes: "an instant with its zone, or empty",
+    meaning: "When the address was suppressed, if the source states it."
+  },
+  {
+    name: "evidence",
+    required: false,
+    values: null,
+    takes: `a JSON object of at most ${IMPORT_LIMITS.maxEvidenceBytes} bytes, or empty`,
+    meaning: "The source\u2019s consent-relevant columns, verbatim (a signup IP, a form name, a confirmation time). Nothing reads it to decide anything: it is the proof of consent and the audit trail of a conversion."
+  },
+  {
+    name: "format",
+    required: false,
+    values: IMPORT_FORMAT_VERSIONS,
+    takes: "the format\u2019s name and version, or empty",
+    meaning: "The version the file is written in. A file without it is read as version 1; a version this release doesn\u2019t know is refused by name."
+  }
+];
+var COLUMN_NAMES = new Set(IMPORT_COLUMNS.map((c) => c.name));
+function fileKindOf(name) {
+  const lower = name.trim().toLowerCase();
+  return lower.endsWith(".csv") ? "csv" : lower.endsWith(".txt") ? "txt" : null;
+}
+function parseImportFile(file, plainListStatus = "subscribed") {
+  const kind = fileKindOf(file.name);
+  if (kind === null) {
+    return refuse(
+      "unrecognized_format",
+      `"${file.name}" is neither a .csv in the ${IMPORT_FORMAT} format nor a .txt plain list of addresses.`
+    );
+  }
+  if (/[�\0]/.test(file.text)) {
+    return refuse(
+      "unrecognized_format",
+      `"${file.name}" isn\u2019t UTF-8 text. Save it as UTF-8 (CSV UTF-8 in a spreadsheet) and choose it again.`
+    );
+  }
+  const text = file.text.startsWith("\uFEFF") ? file.text.slice(1) : file.text;
+  return kind === "csv" ? parseCsvFile(text) : parsePlainList(text, plainListStatus);
+}
+function refuse(code, message2, at = {}) {
+  return { ok: false, error: { code, message: message2, ...at } };
+}
+function parsePlainList(text, declared) {
+  const lines = text.split(/\r\n|\n|\r/);
+  const rows = [];
+  let anyValid = false;
+  for (let i = 0; i < lines.length; i++) {
+    const line = (lines[i] ?? "").trim();
+    if (line === "") {
+      continue;
+    }
+    if (/[,;\t]/.test(line)) {
+      return refuse(
+        "unrecognized_format",
+        `Line ${i + 1} has a comma, tab, or semicolon, so this is a table, not a plain list. Save it as a .csv in the ${IMPORT_FORMAT} format, or keep only the addresses, one per line.`,
+        { row: i + 1 }
+      );
+    }
+    const email2 = normalizeEmail(line);
+    const valid = isValidEmail(email2);
+    anyValid ||= valid;
+    rows.push({
+      row: i + 1,
+      email: valid ? email2 : line,
+      valid,
+      status: declared === "bounced" ? "none" : declared,
+      opt_in: "unknown",
+      origin: "unknown",
+      suppression: declared === "bounced" ? "bounce" : null,
+      subscribed_at: null,
+      confirmed_at: null,
+      unsubscribed_at: null,
+      suppressed_at: null,
+      evidence: null
+    });
+  }
+  if (!anyValid) {
+    return refuse(
+      "unrecognized_format",
+      "There isn\u2019t one valid email address in this file. A plain list is one address per line."
+    );
+  }
+  return { ok: true, file: { kind: "txt", rows } };
+}
+function splitCsv(text) {
+  const records = [];
+  let record = [];
+  let i = 0;
+  const n = text.length;
+  while (i <= n) {
+    if (i === n) {
+      if (record.length > 0) {
+        records.push(record);
+      }
+      break;
+    }
+    let field;
+    if (text.charCodeAt(i) === 34) {
+      let out = "";
+      let j = i + 1;
+      for (; ; ) {
+        const q = text.indexOf('"', j);
+        if (q === -1) {
+          return { unclosed: records.length };
+        }
+        out += text.slice(j, q);
+        if (text.charCodeAt(q + 1) === 34) {
+          out += '"';
+          j = q + 2;
+          continue;
+        }
+        i = q + 1;
+        break;
+      }
+      field = out;
+      const end = nextDelimiter(text, i);
+      field += text.slice(i, end);
+      i = end;
+    } else {
+      const end = nextDelimiter(text, i);
+      field = text.slice(i, end);
+      i = end;
+    }
+    record.push(field);
+    const c = text.charCodeAt(i);
+    if (c === 44) {
+      i += 1;
+      if (i === n) {
+        record.push("");
+      }
+      continue;
+    }
+    records.push(record);
+    record = [];
+    if (c === 13 && text.charCodeAt(i + 1) === 10) {
+      i += 2;
+    } else {
+      i += 1;
+    }
+    if (i >= n) {
+      break;
+    }
+  }
+  return { records };
+}
+function nextDelimiter(text, from) {
+  for (let k = from; k < text.length; k++) {
+    const c = text.charCodeAt(k);
+    if (c === 44 || c === 10 || c === 13) {
+      return k;
+    }
+  }
+  return text.length;
+}
+function parseInstant(value) {
+  if (!INSTANT.test(value)) {
+    return void 0;
+  }
+  const ms = Date.parse(value);
+  return Number.isNaN(ms) ? void 0 : ms;
+}
+function utf8Bytes(s) {
+  return new TextEncoder().encode(s).length;
+}
+function parseCsvFile(text) {
+  const split = splitCsv(text);
+  if ("unclosed" in split) {
+    return refuse(
+      "unrecognized_format",
+      `This isn\u2019t valid CSV: a quoted value that opens in row ${split.unclosed} is never closed.`,
+      { row: split.unclosed }
+    );
+  }
+  const records = split.records.filter((r) => !(r.length === 1 && r[0]?.trim() === ""));
+  const header = records[0];
+  if (!header?.includes("email")) {
+    return refuse(
+      "unrecognized_format",
+      `This isn\u2019t a ${IMPORT_FORMAT} file: its first row must name the columns, including email, status, opt_in, and origin. An export from another service is converted to this format first.`,
+      { row: 0 }
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const name of header) {
+    if (!COLUMN_NAMES.has(name)) {
+      const lower = name.trim().toLowerCase();
+      const hint = COLUMN_NAMES.has(lower) ? ` Column names are written exactly, in lowercase: "${lower}".` : " A source\u2019s other columns belong in evidence, as JSON, not beside it.";
+      return refuse(
+        "invalid_field",
+        `The column "${name}" isn\u2019t part of ${IMPORT_FORMAT}.${hint}`,
+        {
+          row: 0,
+          column: name,
+          allowed: [...COLUMN_NAMES]
+        }
+      );
+    }
+    if (seen.has(name)) {
+      return refuse("invalid_field", `The column "${name}" appears twice in the header.`, {
+        row: 0,
+        column: name
+      });
+    }
+    seen.add(name);
+  }
+  for (const col of IMPORT_COLUMNS) {
+    if (col.required && !seen.has(col.name)) {
+      return refuse("invalid_field", `The required column "${col.name}" is missing.`, {
+        row: 0,
+        column: col.name
+      });
+    }
+  }
+  const at = (name) => header.indexOf(name);
+  const idx = {
+    email: at("email"),
+    status: at("status"),
+    opt_in: at("opt_in"),
+    origin: at("origin"),
+    suppression: at("suppression"),
+    subscribed_at: at("subscribed_at"),
+    confirmed_at: at("confirmed_at"),
+    unsubscribed_at: at("unsubscribed_at"),
+    suppressed_at: at("suppressed_at"),
+    evidence: at("evidence"),
+    format: at("format")
+  };
+  const rows = [];
+  for (let r = 1; r < records.length; r++) {
+    const record = records[r] ?? [];
+    if (record.length !== header.length) {
+      return refuse(
+        "invalid_field",
+        `Row ${r} has ${record.length} values for the header\u2019s ${header.length} columns.`,
+        { row: r }
+      );
+    }
+    const cell = (i) => i < 0 ? "" : unguardFormula((record[i] ?? "").trim());
+    const pick = (name, i, allowed) => {
+      const v2 = cell(i);
+      if (allowed.includes(v2)) {
+        return v2;
+      }
+      throw refuse(
+        "invalid_field",
+        `Row ${r}: ${name} is "${v2}", which isn\u2019t one of ${allowed.join(", ")}.`,
+        { row: r, column: name, allowed }
+      ).error;
+    };
+    const instant = (name, i) => {
+      const v2 = cell(i);
+      if (v2 === "") {
+        return null;
+      }
+      const ms = parseInstant(v2);
+      if (ms === void 0) {
+        throw refuse(
+          "invalid_field",
+          `Row ${r}: ${name} is "${v2}", which isn\u2019t an instant with its zone, such as 2024-03-01T09:30:00Z. A time without a zone is never guessed at.`,
+          { row: r, column: name }
+        ).error;
+      }
+      return ms;
+    };
+    try {
+      const format2 = cell(idx.format);
+      if (format2 !== "" && !IMPORT_FORMAT_VERSIONS.includes(format2)) {
+        return refuse(
+          "unrecognized_format",
+          `Row ${r} is written in "${format2}", a version this release can\u2019t read. It reads ${IMPORT_FORMAT_VERSIONS.join(", ")}.`,
+          { row: r, column: "format", allowed: IMPORT_FORMAT_VERSIONS }
+        );
+      }
+      const origin = cell(idx.origin);
+      if (!ORIGIN.test(origin)) {
+        return refuse(
+          "invalid_field",
+          `Row ${r}: origin is "${origin}", which isn\u2019t a short lowercase name such as sendy, mailchimp, or unknown.`,
+          { row: r, column: "origin" }
+        );
+      }
+      const suppression = cell(idx.suppression);
+      const evidenceText = cell(idx.evidence);
+      let evidence = null;
+      if (evidenceText !== "") {
+        let parsed;
+        try {
+          parsed = JSON.parse(evidenceText);
+        } catch {
+          parsed = void 0;
+        }
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+          return refuse("invalid_field", `Row ${r}: evidence isn\u2019t a JSON object.`, {
+            row: r,
+            column: "evidence"
+          });
+        }
+        evidence = JSON.stringify(parsed);
+        if (utf8Bytes(evidence) > IMPORT_LIMITS.maxEvidenceBytes) {
+          return refuse(
+            "invalid_field",
+            `Row ${r}: evidence is over ${IMPORT_LIMITS.maxEvidenceBytes} bytes. Keep only the source\u2019s consent-relevant columns.`,
+            { row: r, column: "evidence" }
+          );
+        }
+      }
+      const raw = cell(idx.email);
+      const email2 = normalizeEmail(raw);
+      const valid = isValidEmail(email2);
+      rows.push({
+        row: r,
+        email: valid ? email2 : raw,
+        valid,
+        status: pick("status", idx.status, IMPORT_STATUSES),
+        opt_in: pick("opt_in", idx.opt_in, OPT_INS),
+        origin,
+        suppression: suppression === "" ? null : pick("suppression", idx.suppression, SUPPRESSION_CLAIMS),
+        subscribed_at: instant("subscribed_at", idx.subscribed_at),
+        confirmed_at: instant("confirmed_at", idx.confirmed_at),
+        unsubscribed_at: instant("unsubscribed_at", idx.unsubscribed_at),
+        suppressed_at: instant("suppressed_at", idx.suppressed_at),
+        evidence
+      });
+    } catch (err) {
+      return { ok: false, error: err };
+    }
+  }
+  return { ok: true, file: { kind: "csv", rows } };
+}
+var STATUS_RANK = {
+  none: 0,
+  pending: 1,
+  subscribed: 2,
+  unsubscribed: 3
+};
+var SUPPRESSION_RANK = {
+  manual: 0,
+  bounce: 1,
+  complaint: 2,
+  erased: 3
+};
+var OPT_IN_STRENGTH = { unknown: 0, single: 1, double: 2 };
+function earliest(a, b) {
+  return a === null ? b : b === null ? a : Math.min(a, b);
+}
+function latest(a, b) {
+  return a === null ? b : b === null ? a : Math.max(a, b);
+}
+function mergeRows(rows) {
+  const byEmail2 = /* @__PURE__ */ new Map();
+  const out = { rows: [], repeats: [], invalid: [] };
+  for (const row of rows) {
+    if (!row.valid) {
+      out.invalid.push(row);
+      continue;
+    }
+    const held = byEmail2.get(row.email);
+    if (!held) {
+      const copy = { ...row };
+      byEmail2.set(row.email, copy);
+      out.rows.push(copy);
+      continue;
+    }
+    out.repeats.push(row);
+    if (STATUS_RANK[row.status] > STATUS_RANK[held.status]) {
+      held.status = row.status;
+      held.origin = row.origin;
+      held.evidence = row.evidence;
+    }
+    if (row.suppression !== null && (held.suppression === null || SUPPRESSION_RANK[row.suppression] > SUPPRESSION_RANK[held.suppression])) {
+      held.suppression = row.suppression;
+    }
+    if (OPT_IN_STRENGTH[row.opt_in] < OPT_IN_STRENGTH[held.opt_in]) {
+      held.opt_in = row.opt_in;
+    }
+    held.subscribed_at = earliest(held.subscribed_at, row.subscribed_at);
+    held.confirmed_at = earliest(held.confirmed_at, row.confirmed_at);
+    held.unsubscribed_at = latest(held.unsubscribed_at, row.unsubscribed_at);
+    held.suppressed_at = latest(held.suppressed_at, row.suppressed_at);
+  }
+  return out;
+}
+var FORMULA_START = /^[=+\-@\t\r]/;
+function guardFormula(value) {
+  return FORMULA_START.test(value) ? `'${value}` : value;
+}
+function unguardFormula(value) {
+  return value.startsWith("'") && FORMULA_START.test(value.slice(1)) ? value.slice(1) : value;
+}
+function csvField(raw) {
+  const value = guardFormula(raw);
+  return /[",\r\n]/.test(value) || value !== value.trim() ? `"${value.replace(/"/g, '""')}"` : value;
+}
+function toImportCsv(rows) {
+  const names = IMPORT_COLUMNS.map((c) => c.name);
+  const lines = [names.join(",")];
+  for (const row of rows) {
+    lines.push(names.map((name) => csvField(row[name] ?? "")).join(","));
+  }
+  return `${lines.join("\r\n")}\r
+`;
+}
+var TEMPLATE_ROWS = [
+  {
+    email: "ada@example.com",
+    status: "subscribed",
+    opt_in: "double",
+    origin: "sendy",
+    suppression: null,
+    subscribed_at: "2024-03-01T09:30:00Z",
+    confirmed_at: "2024-03-01T09:42:00Z",
+    unsubscribed_at: null,
+    suppressed_at: null,
+    evidence: '{"signup_ip":"203.0.113.7","list":"Field Notes"}',
+    format: IMPORT_FORMAT
+  },
+  {
+    email: "grace@example.com",
+    status: "subscribed",
+    opt_in: "single",
+    origin: "mailchimp",
+    suppression: null,
+    subscribed_at: "2023-11-12T16:05:00Z",
+    confirmed_at: null,
+    unsubscribed_at: null,
+    suppressed_at: null,
+    evidence: null,
+    format: IMPORT_FORMAT
+  },
+  {
+    email: "edsger@example.com",
+    status: "unsubscribed",
+    opt_in: "unknown",
+    origin: "unknown",
+    suppression: null,
+    subscribed_at: null,
+    confirmed_at: null,
+    unsubscribed_at: "2025-01-20T08:00:00Z",
+    suppressed_at: null,
+    evidence: null,
+    format: IMPORT_FORMAT
+  },
+  {
+    email: "bounced@example.com",
+    status: "none",
+    opt_in: "unknown",
+    origin: "unknown",
+    suppression: "bounce",
+    subscribed_at: null,
+    confirmed_at: null,
+    unsubscribed_at: null,
+    suppressed_at: "2025-02-02T12:00:00Z",
+    evidence: null,
+    format: IMPORT_FORMAT
+  }
+];
+var TEMPLATE_CSV = toImportCsv(TEMPLATE_ROWS);
+var TEMPLATE_TXT = "ada@example.com\r\ngrace@example.com\r\nlinus@example.com\r\n";
+var IMPORT_OUTCOMES = [
+  "create_confirmed",
+  "confirm_pending",
+  "unchanged",
+  "mark_unsubscribed",
+  "create_unsubscribed",
+  "kept_confirmed_newer",
+  "kept_unsubscribed",
+  "blocked_by_suppression",
+  "suppression_added",
+  "left_out",
+  "invalid",
+  "merged"
+];
+var IMPORT_OUTCOME_MEANINGS = {
+  create_confirmed: "`subscribed`, with no subscriber and no suppression here: added as confirmed.",
+  confirm_pending: "`subscribed`, and pending here (never confirmed): confirmed, and its confirmation link no longer works.",
+  unchanged: "Already confirmed here, or already in the state the row claims. A subscriber who joined here keeps their own record.",
+  mark_unsubscribed: "`unsubscribed`, and confirmed or pending here, with no confirmation here newer than the row\u2019s `unsubscribed_at`: unsubscribed.",
+  create_unsubscribed: "`unsubscribed`, with no subscriber here: recorded as unsubscribed, so the list remembers they left.",
+  kept_confirmed_newer: "`unsubscribed`, but the reader confirmed here after the source\u2019s `unsubscribed_at`: their newer action stands.",
+  kept_unsubscribed: "`subscribed`, but unsubscribed here, or pending again after leaving until they confirm here themselves. An unsubscribe here is never reversed (I2).",
+  blocked_by_suppression: "`subscribed`, but the address carries a suppression here, a do-not-contact marker included: never added or confirmed.",
+  suppression_added: "The row carries a suppression and the address has none here (or only a do-not-contact marker, which a bounce, a complaint, or a manual suppression replaces), and nothing else changes. Applied whatever the row\u2019s `status`.",
+  left_out: "`pending` or `none` with nothing to apply: counted, never confirmed. An import sends no email.",
+  invalid: "The address isn\u2019t valid.",
+  merged: "A repeat of an address earlier in the file, folded into it."
+};
+var CONFIRMING_OUTCOMES = /* @__PURE__ */ new Set([
+  "create_confirmed",
+  "confirm_pending"
+]);
+var ATTESTATION = {
+  version: 1,
+  text: "Everyone I\u2019m importing as subscribed opted in to receive [publication]. This isn\u2019t a purchased, rented, or scraped list."
+};
+function attestationText(publication) {
+  return ATTESTATION.text.replace("[publication]", publication || "this newsletter");
+}
+var PLAIN_LIST_RULES = [
+  "One address per line. Each line is trimmed, blank lines are skipped, and CRLF line endings and a UTF-8 byte-order mark are accepted.",
+  "A line that isn\u2019t a single valid address (`Name <ada@example.com>`, a typo) is counted as invalid and listed among the rows left out, so one bad line doesn\u2019t sink a list.",
+  "The whole file is refused as `unrecognized_format` when it isn\u2019t a plain list at all: not UTF-8 text, a line with a comma, tab, or semicolon (it\u2019s a table, so a .csv), or not one valid address in it.",
+  "Its rows arrive with `origin: unknown` and `opt_in: unknown`."
+];
+function describeFormat(maxRows, maxRowsReason) {
+  return {
+    format: IMPORT_FORMAT,
+    versions: IMPORT_FORMAT_VERSIONS,
+    preferred: {
+      kind: "csv",
+      why: "The full CSV carries unsubscribes, bounces, and how each person joined; it is what the export writes; and you can open it in a spreadsheet to check it before importing."
+    },
+    files: [
+      {
+        kind: "csv",
+        name: `${IMPORT_FORMAT} (.csv)`,
+        when: "Any list with more than addresses: who unsubscribed or bounced, how and where each person joined, and the evidence. The format the export writes.",
+        loses: [],
+        template: "/api/imports/template.csv"
+      },
+      {
+        kind: "txt",
+        name: "Plain list (.txt)",
+        when: "A list that is only addresses, all of one kind, which you declare: subscribed, unsubscribed, or bounced.",
+        loses: [
+          "How each person joined: their opt-in method and origin are recorded as unknown.",
+          "Any times: when each person subscribed, confirmed, or left.",
+          "The evidence of consent.",
+          "Mixed states: every address in the file is the one kind you declare, so unsubscribes and bounces need a file of their own."
+        ],
+        template: "/api/imports/template.txt"
+      }
+    ],
+    columns: IMPORT_COLUMNS,
+    plain_list: {
+      statuses: [
+        {
+          value: "subscribed",
+          means: "They opted in: imported as confirmed, with your attestation."
+        },
+        {
+          value: "unsubscribed",
+          means: "They left: unsubscribed here, or recorded as unsubscribed."
+        },
+        { value: "bounced", means: "Their mail bounced: suppressed, whatever their state here." }
+      ],
+      default: "subscribed",
+      rules: [...PLAIN_LIST_RULES]
+    },
+    limits: {
+      max_rows: maxRows,
+      max_rows_reason: maxRowsReason,
+      max_body_bytes: IMPORT_LIMITS.maxBodyBytes,
+      max_evidence_bytes: IMPORT_LIMITS.maxEvidenceBytes
+    },
+    outcomes: IMPORT_OUTCOMES.map((outcome) => ({
+      outcome,
+      when: IMPORT_OUTCOME_MEANINGS[outcome]
+    })),
+    attestation: { version: ATTESTATION.version, text: ATTESTATION.text }
+  };
+}
 
 // shared/sends.ts
 var NOT_CONNECTED_ADVICE = {
@@ -9,13 +666,15 @@ var NOT_CONNECTED_ADVICE = {
 function refusalAdvice(cause) {
   switch (cause) {
     case "credentials":
-      return "Replace the SES access key in the deployment's secrets, or give it ses:SendEmail and ses:SendBulkEmail in its IAM policy.";
+      return "Replace the SES access key in the deployment\u2019s secrets, or give it ses:SendEmail and ses:SendBulkEmail in its IAM policy.";
+    case "configuration":
+      return "Check that the SES_CONFIGURATION_SET secret names a configuration set in your SES region, or create the set in the SES console.";
     case "sender":
       return "Verify the sending domain or from-address with the provider.";
     case "quota":
-      return "Wait for SES's 24-hour quota to free up, or ask AWS to raise it in the Service Quotas console.";
+      return "Wait for SES\u2019s 24-hour quota to free up, or ask AWS to raise it in the Service Quotas console.";
     case "suspended":
-      return "Settle the account's standing with the provider (for SES, in the SES console).";
+      return "Settle the account\u2019s standing with the provider (for SES, in the SES console).";
     case "not_connected":
       return `${NOT_CONNECTED_ADVICE.step}${NOT_CONNECTED_ADVICE.guide}${NOT_CONNECTED_ADVICE.after}`;
     default:
@@ -34,16 +693,23 @@ function formatLead(ms) {
   }
   return `${seconds} seconds`;
 }
+function tooSoonMessage(minLeadMs) {
+  return `Pick a time at least ${formatLead(minLeadMs)} from now, so there\u2019s time to cancel.`;
+}
 var BOUNCE_SPIKE_RATE = 0.05;
 var BOUNCE_SPIKE_MIN = 3;
 var BOUNCE_SPIKE_RECENT_MS = 7 * 24 * 60 * 60 * 1e3;
+var DAILY_WRITES_SEND_RECIPIENTS = 5e3;
+function dailyWritesSendWarning(recipients) {
+  return `On the Workers Free plan\u2019s limits, a send to ${recipients.toLocaleString("en-US")} recipients may use up the database\u2019s daily allowance of writes. That stops this newsletter until midnight UTC, the send included. Workers Paid is recommended for a list of more than ${DAILY_WRITES_SEND_RECIPIENTS.toLocaleString("en-US")}.`;
+}
 
 // src/generated/version.ts
 var BUILD_INFO = {
-  version: "1.8.0",
-  sha: "2d1427a",
-  tag: "v1.8.0",
-  buildTime: "2026-10-13T05:06:45.742Z",
+  version: "1.9.0",
+  sha: "7ad2b17",
+  tag: "v1.9.0",
+  buildTime: "2026-10-13T16:35:20.501Z",
   repoUrl: "https://github.com/kurtbruns/kestrel"
 };
 
@@ -127,7 +793,6 @@ var HttpError = class extends Error {
 };
 var badRequest = (message2, details) => new HttpError(400, "bad_request", message2, details);
 var notFound = (message2) => new HttpError(404, "not_found", message2);
-var conflict = (message2) => new HttpError(409, "conflict", message2);
 var refusal = (status, code, message2, details) => new HttpError(status, code, message2, details);
 var unsupportedMediaType = (message2) => new HttpError(415, "unsupported_media_type", message2);
 function json(data, status = 200, headers2) {
@@ -205,6 +870,7 @@ var RESOURCE_TITLES = {
   posts: "Posts",
   sends: "Sends",
   subscribers: "Subscribers",
+  imports: "Imports",
   suppressions: "Suppressions",
   subscriptions: "Subscriptions",
   archive: "Archive",
@@ -348,17 +1014,20 @@ function isRealProvider(name) {
 var REQUIRED_VARS = {
   ses: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION", "SNS_TOPIC_ARN"]
 };
-function isProviderName(v) {
-  return PROVIDER_NAMES.includes(v);
+function isProviderName(v2) {
+  return PROVIDER_NAMES.includes(v2);
 }
 
 // src/env.ts
 var DEFAULT_SES_MAX_SEND_RATE = 14;
 var DEFAULT_SUBREQUEST_BUDGET = 50;
+function onFreePlanLimits(config) {
+  return config.subrequestBudget <= DEFAULT_SUBREQUEST_BUDGET;
+}
 var MIN_SUBREQUEST_BUDGET = 30;
-var orUndefined = (v) => v && v.length > 0 ? v : void 0;
-function normalizeBasePath(v) {
-  const raw = (orUndefined(v) ?? "/archive").trim();
+var orUndefined = (v2) => v2 && v2.length > 0 ? v2 : void 0;
+function normalizeBasePath(v2) {
+  const raw = (orUndefined(v2) ?? "/archive").trim();
   const withLead = raw.startsWith("/") ? raw : `/${raw}`;
   return withLead.length > 1 && withLead.endsWith("/") ? withLead.slice(0, -1) : withLead;
 }
@@ -457,8 +1126,8 @@ function readTeamDomain(raw) {
   }
   return host;
 }
-function readProvider(v) {
-  const raw = orUndefined(v);
+function readProvider(v2) {
+  const raw = orUndefined(v2);
   if (raw === void 0) {
     return "none";
   }
@@ -551,8 +1220,8 @@ function parseHttpUrl(name, raw) {
   }
   return url;
 }
-function readOrigin(name, v) {
-  const raw = orUndefined(v?.trim());
+function readOrigin(name, v2) {
+  const raw = orUndefined(v2?.trim());
   if (raw === void 0) {
     return void 0;
   }
@@ -565,16 +1234,16 @@ function readOrigin(name, v) {
   }
   return url.origin;
 }
-function readBaseUrl(name, v) {
-  const raw = orUndefined(v?.trim());
+function readBaseUrl(name, v2) {
+  const raw = orUndefined(v2?.trim());
   if (raw === void 0) {
     return void 0;
   }
   const url = parseHttpUrl(name, raw);
   return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
 }
-function readPositiveInt(name, v) {
-  const raw = orUndefined(v?.trim());
+function readPositiveInt(name, v2) {
+  const raw = orUndefined(v2?.trim());
   if (raw === void 0) {
     return void 0;
   }
@@ -584,29 +1253,29 @@ function readPositiveInt(name, v) {
   }
   return n;
 }
-function readMinLead(v) {
-  const seconds = readPositiveInt("MIN_LEAD_SECONDS", v);
+function readMinLead(v2) {
+  const seconds = readPositiveInt("MIN_LEAD_SECONDS", v2);
   if (seconds === void 0) {
     return DEFAULT_MIN_LEAD_MS;
   }
   if (seconds * 1e3 < MIN_LEAD_FLOOR_MS) {
     throw new ConfigError(
       "MIN_LEAD_SECONDS",
-      `must be at least ${MIN_LEAD_FLOOR_MS / 1e3}, not "${v?.trim()}": the send sweep runs once a minute, so under ${formatLead(MIN_LEAD_FLOOR_MS)} the tick, not the lead, would decide when a send fires`
+      `must be at least ${MIN_LEAD_FLOOR_MS / 1e3}, not "${v2?.trim()}": the send sweep runs once a minute, so under ${formatLead(MIN_LEAD_FLOOR_MS)} the tick, not the lead, would decide when a send fires`
     );
   }
   if (seconds * 1e3 > MIN_LEAD_CEILING_MS) {
     throw new ConfigError(
       "MIN_LEAD_SECONDS",
-      `must be at most ${MIN_LEAD_CEILING_MS / 1e3} (one day), not "${v?.trim()}": it is in seconds, and it is the least wait before every send, not a limit on how far out one can be scheduled`
+      `must be at most ${MIN_LEAD_CEILING_MS / 1e3} (one day), not "${v2?.trim()}": it is in seconds, and it is the least wait before every send, not a limit on how far out one can be scheduled`
     );
   }
   return seconds * 1e3;
 }
 var SIMULATION_OFF = /* @__PURE__ */ new Set(["", "0", "off", "false", "no"]);
 var SIMULATION_GENERIC = /* @__PURE__ */ new Set(["1", "on", "true", "yes"]);
-function readSimulateSends(v) {
-  const raw = (v ?? "").trim().toLowerCase();
+function readSimulateSends(v2) {
+  const raw = (v2 ?? "").trim().toLowerCase();
   if (SIMULATION_OFF.has(raw)) {
     return null;
   }
@@ -618,16 +1287,16 @@ function readSimulateSends(v) {
   if (rest.length > 0 || !SIMULATION_PROFILES.includes(profile) || !SIMULATION_FAULTS.includes(faults)) {
     throw new ConfigError(
       "SIMULATE_SENDS",
-      `must be off, one of ${SIMULATION_PROFILES.join(", ")} (or 1) optionally followed by :${SIMULATION_FAULTS.join(" or :")}, or not-connected, not "${v?.trim()}"`
+      `must be off, one of ${SIMULATION_PROFILES.join(", ")} (or 1) optionally followed by :${SIMULATION_FAULTS.join(" or :")}, or not-connected, not "${v2?.trim()}"`
     );
   }
   return { profile, faults };
 }
-function parseEmailList(v) {
-  if (!v) {
+function parseEmailList(v2) {
+  if (!v2) {
     return void 0;
   }
-  const list5 = v.split(",").map((e) => e.trim().toLowerCase()).filter(Boolean);
+  const list5 = v2.split(",").map((e) => e.trim().toLowerCase()).filter(Boolean);
   return list5.length ? list5 : void 0;
 }
 
@@ -635,8 +1304,8 @@ function parseEmailList(v) {
 function fieldError(field, message2) {
   return badRequest(message2, { field });
 }
-function isObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
+function isObject(v2) {
+  return typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
 }
 function mediaTypeOf(req) {
   const declared = req.headers.get("content-type");
@@ -669,56 +1338,56 @@ function path(key, at) {
   return at ? `${at}.${key}` : key;
 }
 function optString(o, key, at) {
-  const v = o[key];
-  if (v === void 0) {
+  const v2 = o[key];
+  if (v2 === void 0) {
     return void 0;
   }
-  if (typeof v !== "string") {
+  if (typeof v2 !== "string") {
     throw fieldError(path(key, at), `${path(key, at)} must be a string`);
   }
-  return v;
+  return v2;
 }
 function optBoolean(o, key, at) {
-  const v = o[key];
-  if (v === void 0) {
+  const v2 = o[key];
+  if (v2 === void 0) {
     return void 0;
   }
-  if (typeof v !== "boolean") {
+  if (typeof v2 !== "boolean") {
     throw fieldError(path(key, at), `${path(key, at)} must be true or false`);
   }
-  return v;
+  return v2;
 }
 function optStringOrNull(o, key, at) {
-  const v = o[key];
-  if (v === void 0 || v === null || typeof v === "string") {
-    return v;
+  const v2 = o[key];
+  if (v2 === void 0 || v2 === null || typeof v2 === "string") {
+    return v2;
   }
   throw fieldError(path(key, at), `${path(key, at)} must be a string or null`);
 }
 function optStringList(o, key, at) {
-  const v = o[key];
-  if (v === void 0) {
+  const v2 = o[key];
+  if (v2 === void 0) {
     return void 0;
   }
-  if (!Array.isArray(v) || !v.every((item) => typeof item === "string")) {
+  if (!Array.isArray(v2) || !v2.every((item) => typeof item === "string")) {
     throw fieldError(path(key, at), `${path(key, at)} must be a list of strings`);
   }
-  return v;
+  return v2;
 }
 function optObject(o, key, at) {
-  const v = o[key];
-  if (v === void 0) {
+  const v2 = o[key];
+  if (v2 === void 0) {
     return void 0;
   }
-  if (!isObject(v)) {
+  if (!isObject(v2)) {
     throw fieldError(path(key, at), `${path(key, at)} must be an object`);
   }
-  return v;
+  return v2;
 }
 function oneOf(o, key, allowed, at) {
-  const v = o[key];
-  if (typeof v === "string" && allowed.includes(v)) {
-    return v;
+  const v2 = o[key];
+  if (typeof v2 === "string" && allowed.includes(v2)) {
+    return v2;
   }
   const list5 = allowed.map((a) => `'${a}'`).join(" or ");
   throw fieldError(path(key, at), `${path(key, at)} must be ${list5}`);
@@ -1017,20 +1686,20 @@ function archiveIndexPage(opts) {
 
 // src/router.ts
 function param(c, name) {
-  const v = c.params[name];
-  if (v === void 0) {
+  const v2 = c.params[name];
+  if (v2 === void 0) {
     throw badRequest(`missing path parameter: ${name}`);
   }
-  return v;
+  return v2;
 }
 function decodePathParams(groups) {
   const params = {};
-  for (const [k, v] of Object.entries(groups)) {
-    if (v === void 0) {
+  for (const [k, v2] of Object.entries(groups)) {
+    if (v2 === void 0) {
       continue;
     }
     try {
-      params[k] = decodeURIComponent(v);
+      params[k] = decodeURIComponent(v2);
     } catch {
       return { params, error: badRequest(`path parameter ${k} is not validly percent-encoded`) };
     }
@@ -1146,12 +1815,28 @@ var EMPTY_SUBJECT_SLUG = "post";
 
 // src/lib/ids.ts
 var newId = () => crypto.randomUUID();
+var HEX = Array.from({ length: 256 }, (_, b) => b.toString(16).padStart(2, "0"));
 function newToken(bytes = 32) {
   const buf = new Uint8Array(bytes);
   crypto.getRandomValues(buf);
   let out = "";
   for (const b of buf) {
-    out += b.toString(16).padStart(2, "0");
+    out += HEX[b];
+  }
+  return out;
+}
+function newTokens(n, bytes = 32) {
+  const buf = new Uint8Array(n * bytes);
+  for (let at = 0; at < buf.length; at += 65536) {
+    crypto.getRandomValues(buf.subarray(at, Math.min(at + 65536, buf.length)));
+  }
+  const out = new Array(n);
+  for (let t = 0; t < n; t++) {
+    let s = "";
+    for (let k = t * bytes; k < (t + 1) * bytes; k++) {
+      s += HEX[buf[k]];
+    }
+    out[t] = s;
   }
   return out;
 }
@@ -1208,14 +1893,6 @@ function clampInt(field, raw, fallback, min, max) {
   return Math.min(Math.max(n, min), max);
 }
 
-// shared/email.ts
-function normalizeEmail(email2) {
-  return email2.trim().toLowerCase();
-}
-function isValidEmail(email2) {
-  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email2);
-}
-
 // src/db/sends.ts
 function countsOf(send) {
   return {
@@ -1716,18 +2393,19 @@ async function dispatchFresh(db, sendId, lease, handOffs, now) {
   const json2 = JSON.stringify(rows);
   const guard2 = holdsLease(sendId, lease);
   const [moved] = await db.batch([
-    // Rows are found by primary key (the unary `+` keeps SQLite off the (send_id, status)
-    // index, which would walk every pending row of the send for each group), and each
-    // takes its own batch's key.
+    // Driven from the batch: each row is looked up by primary key and takes its own
+    // batch's key, so a row reads its one entry, not the whole batch. The unary `+` keeps
+    // SQLite off the (send_id, status) index, which would walk every pending row of the
+    // send. `json_each` has an `id` column of its own, so the row's is `deliveries.id`.
     db.prepare(
-      `UPDATE deliveries SET status = 'dispatched',
-                dispatch_key = (SELECT json_extract(j.value, '$.k') FROM json_each(?) AS j
-                                 WHERE json_extract(j.value, '$.id') = deliveries.id),
+      `UPDATE deliveries SET status = 'dispatched', dispatch_key = json_extract(j.value, '$.k'),
                 keyed_at = ?, updated_at = ?
-          WHERE id IN (SELECT json_extract(value, '$.id') FROM json_each(?))
-            AND +send_id = ? AND +status = 'pending' AND dispatch_key IS NULL AND ${guard2.sql}
-          RETURNING id, dispatch_key AS key`
-    ).bind(json2, now, now, json2, sendId, ...guard2.binds),
+           FROM json_each(?) AS j
+          WHERE deliveries.id = json_extract(j.value, '$.id')
+            AND +deliveries.send_id = ? AND +deliveries.status = 'pending'
+            AND deliveries.dispatch_key IS NULL AND ${guard2.sql}
+          RETURNING deliveries.id AS id, deliveries.dispatch_key AS key`
+    ).bind(now, now, json2, sendId, ...guard2.binds),
     // After the move, so it counts exactly the rows that took the (new) keys.
     keyedCounterMove(
       db,
@@ -1838,9 +2516,8 @@ async function settleDeliveries(db, sendId, lease, from, outcomes, now, answered
            updated_at = ?
          FROM json_each(?) AS j
          WHERE deliveries.id = json_extract(j.value, '$.id')
-           AND deliveries.id IN (SELECT json_extract(value, '$.id') FROM json_each(?))
            AND +deliveries.send_id = ? AND +deliveries.status = ? AND ${guard2.sql}`
-    ).bind(now, json2, json2, sendId, from, ...guard2.binds),
+    ).bind(now, json2, sendId, from, ...guard2.binds),
     // The column names come from the fixed `CounterCol` union, never user input.
     db.prepare(
       `UPDATE sends SET ${sets.join(", ")}, rev = ${NEXT_REV} WHERE id = ? AND lease_token = ?`
@@ -2172,11 +2849,15 @@ function markdownToHtml(md, ctx) {
         const href = token2.href ?? "";
         const alt = token2.text ?? "";
         if (!alt.trim()) {
-          ctx.warnings.push(`image "${href}" is missing alt text`);
+          ctx.warnings.push(
+            `The image \u201C${href}\u201D has no alt text. Describe it between the square brackets.`
+          );
         }
         const { url, image } = resolveImageSrc(href, ctx.images, ctx.mediaBase);
         if (!image && !/^https?:\/\//i.test(url)) {
-          ctx.warnings.push(`image "${href}" was not found on this post`);
+          ctx.warnings.push(
+            `The image \u201C${href}\u201D isn\u2019t on this post. Upload it, or check the file name.`
+          );
         }
         const size = sizeAttrs(image?.width ?? null, image?.height ?? null, ctx.maxWidth);
         const title = token2.title ? ` title="${escapeHtmlAttr(token2.title)}"` : "";
@@ -2346,7 +3027,7 @@ var MAX_CE_BUTTON = 80;
 var MAX_CE_REASSURANCE = 400;
 function coercePublication(raw) {
   const o = raw && typeof raw === "object" ? raw : {};
-  const str = (v) => typeof v === "string" ? v : "";
+  const str = (v2) => typeof v2 === "string" ? v2 : "";
   const lr = o.logo;
   const key = lr && typeof lr.key === "string" && LOGO_KEY.test(lr.key);
   const logo = lr && typeof lr === "object" && typeof lr.version === "number" ? {
@@ -2363,7 +3044,7 @@ function coercePublication(raw) {
 }
 function coerceConfirmation(raw) {
   const o = raw && typeof raw === "object" ? raw : {};
-  const str = (v) => typeof v === "string" ? v : "";
+  const str = (v2) => typeof v2 === "string" ? v2 : "";
   return {
     subject: str(o.subject).slice(0, MAX_CE_SUBJECT),
     body: str(o.body).slice(0, MAX_CE_BODY),
@@ -2425,7 +3106,7 @@ function parseStored(data) {
   throw new HttpError(
     500,
     "settings_corrupt",
-    "The stored settings can't be read, so they are left as they are and nothing will save over them. The server log (settings.corrupt) says what's wrong."
+    "The stored settings can\u2019t be read, so they are left as they are and nothing will save over them. The server log (settings.corrupt) says what\u2019s wrong."
   );
 }
 async function getSettings(db) {
@@ -2454,7 +3135,7 @@ function persistSettingsStmt(db, next, expected, guard2) {
 var WRITE_RETRIES = 5;
 var SettingsContention = class extends HttpError {
   constructor() {
-    super(409, "conflict", "settings changed concurrently; try again");
+    super(409, "conflict", "The settings were changed at the same moment. Try again.");
   }
 };
 async function updateSettingsWith(db, derive) {
@@ -2493,12 +3174,17 @@ function applyPatch(current2, patch) {
   if (patch.publication !== void 0) {
     const p = patch.publication;
     if (p.name !== void 0) {
-      next.publication.name = normalizeText(p.name, "name", MAX_NAME, "publication.name");
+      next.publication.name = normalizeText(
+        p.name,
+        "The publication name",
+        MAX_NAME,
+        "publication.name"
+      );
     }
     if (p.tagline !== void 0) {
       next.publication.tagline = normalizeText(
         p.tagline,
-        "tagline",
+        "The tagline",
         MAX_TAGLINE,
         "publication.tagline"
       );
@@ -2506,7 +3192,7 @@ function applyPatch(current2, patch) {
     if (p.address !== void 0) {
       next.publication.address = normalizeText(
         p.address,
-        "address",
+        "The mailing address",
         MAX_ADDRESS,
         "publication.address"
       );
@@ -2514,12 +3200,12 @@ function applyPatch(current2, patch) {
   }
   if (patch.emailTemplate !== void 0) {
     if (typeof patch.emailTemplate !== "string") {
-      throw new SettingsFieldError("emailTemplate", "emailTemplate must be a string");
+      throw new SettingsFieldError("emailTemplate", "The email template must be text.");
     }
     if (patch.emailTemplate.length > MAX_TEMPLATE) {
       throw new SettingsFieldError(
         "emailTemplate",
-        `emailTemplate must be ${MAX_TEMPLATE} characters or fewer`
+        `The email template must be ${MAX_TEMPLATE.toLocaleString("en-US")} characters or fewer. Shorten it, then save.`
       );
     }
     next.emailTemplate = patch.emailTemplate;
@@ -2529,7 +3215,7 @@ function applyPatch(current2, patch) {
     if (c.subject !== void 0) {
       next.confirmationEmail.subject = normalizeText(
         c.subject,
-        "subject",
+        "The confirmation subject",
         MAX_CE_SUBJECT,
         "confirmationEmail.subject"
       );
@@ -2537,7 +3223,7 @@ function applyPatch(current2, patch) {
     if (c.body !== void 0) {
       next.confirmationEmail.body = normalizeText(
         c.body,
-        "message",
+        "The confirmation message",
         MAX_CE_BODY,
         "confirmationEmail.body"
       );
@@ -2545,7 +3231,7 @@ function applyPatch(current2, patch) {
     if (c.buttonLabel !== void 0) {
       next.confirmationEmail.buttonLabel = normalizeText(
         c.buttonLabel,
-        "button label",
+        "The button label",
         MAX_CE_BUTTON,
         "confirmationEmail.buttonLabel"
       );
@@ -2553,7 +3239,7 @@ function applyPatch(current2, patch) {
     if (c.reassurance !== void 0) {
       next.confirmationEmail.reassurance = normalizeText(
         c.reassurance,
-        "reassurance line",
+        "The reassurance line",
         MAX_CE_REASSURANCE,
         "confirmationEmail.reassurance"
       );
@@ -2566,11 +3252,14 @@ function applyPatch(current2, patch) {
 }
 function normalizeNotifyTo(raw) {
   if (typeof raw !== "string") {
-    throw new SettingsFieldError("notifications.to", "notifications address must be a string");
+    throw new SettingsFieldError("notifications.to", "The notifications address must be text.");
   }
   const email2 = normalizeEmail(raw);
   if (email2 && !isValidEmail(email2)) {
-    throw new SettingsFieldError("notifications.to", `not a valid email address: ${raw}`);
+    throw new SettingsFieldError(
+      "notifications.to",
+      `\u201C${raw.trim()}\u201D isn\u2019t a valid email address. Fix it, or clear the field to turn notifications off.`
+    );
   }
   return email2;
 }
@@ -2580,31 +3269,37 @@ function withPublicationLogo(current2, logo) {
 async function setPublicationLogo(db, logo) {
   return updateSettingsWith(db, (current2) => withPublicationLogo(current2, logo));
 }
-function normalizeText(v, what, max, field) {
-  if (typeof v !== "string") {
-    throw new SettingsFieldError(field, `${what} must be a string`);
+function normalizeText(v2, what, max, field) {
+  if (typeof v2 !== "string") {
+    throw new SettingsFieldError(field, `${what} must be text.`);
   }
-  return v.trim().slice(0, max);
+  return v2.trim().slice(0, max);
 }
 function normalizeRecipients(input) {
   if (!Array.isArray(input)) {
     throw new SettingsFieldError(
       "testRecipients",
-      "testRecipients must be a list of email addresses"
+      "Test recipients must be a list of email addresses."
     );
   }
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const raw of input) {
     if (typeof raw !== "string") {
-      throw new SettingsFieldError("testRecipients", "each test recipient must be a string");
+      throw new SettingsFieldError(
+        "testRecipients",
+        "Each test recipient must be an email address."
+      );
     }
     const email2 = normalizeEmail(raw);
     if (!email2) {
       continue;
     }
     if (!isValidEmail(email2)) {
-      throw new SettingsFieldError("testRecipients", `not a valid email address: ${raw}`);
+      throw new SettingsFieldError(
+        "testRecipients",
+        `\u201C${raw.trim()}\u201D isn\u2019t a valid email address. Fix or remove it, then save.`
+      );
     }
     if (seen.has(email2)) {
       continue;
@@ -2615,7 +3310,7 @@ function normalizeRecipients(input) {
   if (out.length > MAX_TEST_RECIPIENTS) {
     throw new SettingsFieldError(
       "testRecipients",
-      `at most ${MAX_TEST_RECIPIENTS} test recipients`
+      `There can be at most ${MAX_TEST_RECIPIENTS} test recipients. Remove some, then save.`
     );
   }
   return out;
@@ -2728,7 +3423,7 @@ function regionErrors(html) {
         errors.push("{{ end }} has no {{ if .IsEmail }} to close.");
       } else if (POST_BODY.test(html.slice(openAt, at))) {
         errors.push(
-          "{{ .Post.Body }} can't be inside {{ if .IsEmail }}: the archived post would have no content."
+          "{{ .Post.Body }} can\u2019t be inside {{ if .IsEmail }}: the archived post would have no content."
         );
       }
       openAt = -1;
@@ -2736,10 +3431,10 @@ function regionErrors(html) {
     }
     if (cond !== IS_EMAIL) {
       const tag = cond ? `{{ if ${cond} }}` : "{{ if }}";
-      errors.push(`${tag} isn't supported. The one condition is {{ if .IsEmail }}.`);
+      errors.push(`${tag} isn\u2019t supported. The one condition is {{ if .IsEmail }}.`);
     }
     if (openAt >= 0) {
-      errors.push("An email-only region can't contain another. Close the first with {{ end }}.");
+      errors.push("An email-only region can\u2019t contain another. Close the first with {{ end }}.");
     }
     openAt = at + m[0].length;
   }
@@ -2748,7 +3443,7 @@ function regionErrors(html) {
   }
   if (/\{\{\s*else\s*\}\}/.test(html)) {
     errors.push(
-      "{{ else }} isn't supported. A region is shown in the email and left out of the archived post; there is no alternative."
+      "{{ else }} isn\u2019t supported. A region is shown in the email and left out of the archived post; there is no alternative."
     );
   }
   return errors;
@@ -2776,7 +3471,7 @@ function validateEmailTemplate(html) {
   }
   for (const m of html.replace(REGION_TAG, "").replace(TOKEN2, "").matchAll(/\{\{[^}]*\}\}/g)) {
     if (!/^\{\{\s*else\s*\}\}$/.test(m[0])) {
-      warnings.push(`${m[0]} isn't something Kestrel fills, so it will show as written.`);
+      warnings.push(`${m[0]} isn\u2019t something Kestrel fills, so it will show as written.`);
     }
   }
   if (LOGO_URL_AS_IMG_SRC.test(html)) {
@@ -2785,7 +3480,7 @@ function validateEmailTemplate(html) {
     );
   }
   if (/<script[\s/>]/i.test(html)) {
-    warnings.push("A <script> tag won't run in email and may get the message filtered.");
+    warnings.push("A <script> tag won\u2019t run in email and may get the message filtered.");
   }
   return { errors, warnings };
 }
@@ -2969,14 +3664,18 @@ async function render(input, config, branding = defaultBranding()) {
   const contentText = htmlToText(cleanHtml);
   const hasSubject = meta.subject.trim() !== "";
   if (!hasSubject) {
-    warnings.push('no subject \u2014 the email will show "(no subject)"');
+    warnings.push(
+      "There\u2019s no subject, so the email will show \u201C(no subject)\u201D. Add one before you schedule."
+    );
   }
   const subject = hasSubject ? meta.subject : "(no subject)";
   const viewInBrowserUrl = archiveUrl(config, meta.slug);
   const validation = validateEmailTemplate(branding.template);
   let template = branding.template;
   if (validation.errors.length > 0) {
-    warnings.push(`email template invalid, using the default \u2014 ${validation.errors.join(" ")}`);
+    warnings.push(
+      `The email template can\u2019t be used, so this shows the default template. ${validation.errors.join(" ")}`
+    );
     template = DEFAULT_EMAIL_TEMPLATE;
   } else {
     warnings.push(...validation.warnings);
@@ -2996,7 +3695,7 @@ async function render(input, config, branding = defaultBranding()) {
   let html = await renderWith(template);
   if (template !== DEFAULT_EMAIL_TEMPLATE && !emailOnlyRegionsWhole(html)) {
     warnings.push(
-      "email template's {{ if .IsEmail }} region doesn't wrap whole elements, using the default \u2014 keep each region's {{ if .IsEmail }} and {{ end }} inside the same element, outside any attribute, and not directly inside a <table> or <tr>."
+      "The email template\u2019s {{ if .IsEmail }} region doesn\u2019t wrap whole elements, so this shows the default template. Keep each region\u2019s {{ if .IsEmail }} and {{ end }} inside the same element, outside any attribute, and not directly inside a <table> or <tr>."
     );
     template = DEFAULT_EMAIL_TEMPLATE;
     html = await renderWith(template);
@@ -3312,7 +4011,7 @@ async function claimConfirmation(db, id, now, quietSince) {
 }
 async function armConfirmation(db, id, token2, claimedAt, statusAtClaim) {
   const res = await db.prepare(
-    "UPDATE subscribers SET status = 'pending', confirm_token = ?, confirm_sent_at = ?, confirmed_at = NULL, unsubscribed_at = NULL WHERE id = ? AND confirm_attempt_at = ? AND status = ?"
+    "UPDATE subscribers SET status = 'pending', confirm_token = ?, confirm_sent_at = ?, confirmed_at = NULL WHERE id = ? AND confirm_attempt_at = ? AND status = ?"
   ).bind(token2, claimedAt, id, claimedAt, statusAtClaim).run();
   return (res.meta.changes ?? 0) > 0;
 }
@@ -3326,7 +4025,7 @@ async function releaseConfirmation(db, id, claimedAt, previous, created) {
     "UPDATE subscribers SET confirm_attempt_at = ? WHERE id = ? AND confirm_attempt_at = ?"
   ).bind(previous, id, claimedAt).run();
 }
-async function confirm(db, token2, sentAfter) {
+async function confirm(db, token2, sentAfter, ip) {
   const row = await getByConfirmToken(db, token2);
   if (!row) {
     return null;
@@ -3340,8 +4039,8 @@ async function confirm(db, token2, sentAfter) {
   const confirmedAt = Date.now();
   await db.batch([
     db.prepare(
-      "UPDATE subscribers SET status = 'confirmed', confirmed_at = ? WHERE id = ? AND status = 'pending' AND confirm_token = ?"
-    ).bind(confirmedAt, row.id, token2),
+      "UPDATE subscribers SET status = 'confirmed', confirmed_at = ?, origin = 'kestrel', opt_in = 'double', import_id = NULL, consent_evidence = ? WHERE id = ? AND status = 'pending' AND confirm_token = ?"
+    ).bind(confirmedAt, ip ? JSON.stringify({ confirmed_ip: ip }) : null, row.id, token2),
     db.prepare(
       "DELETE FROM suppressions WHERE email = ? AND reason = ? AND EXISTS (SELECT 1 FROM subscribers WHERE id = ? AND status = 'confirmed' AND confirmed_at = ?)"
     ).bind(row.email, ERASED, row.id, confirmedAt)
@@ -3595,8 +4294,18 @@ var RANK = { action: 0, warn: 1, info: 2 };
 function bySeverity(a, b) {
   return RANK[a.severity] - RANK[b.severity] || (a.since ?? 0) - (b.since ?? 0);
 }
-function sendConditions(send, now) {
+function sendConditions(send, now, freePlan) {
   const out = [];
+  if (freePlan && send.status === "scheduled" && send.recipient_count > DAILY_WRITES_SEND_RECIPIENTS) {
+    out.push({
+      kind: "daily_writes",
+      severity: "warn",
+      since: send.scheduled_at,
+      message: dailyWritesSendWarning(send.recipient_count),
+      action: null,
+      recipients: send.recipient_count
+    });
+  }
   if (send.status === "scheduled" && send.fire_at + MISSED_THRESHOLD_MS < now) {
     out.push({
       kind: "missed",
@@ -3862,7 +4571,7 @@ function buildSendView(send, config, hasRetries, now) {
     delivery: { confirmed, percent_of_accepted: deliveryPercent },
     provider: { name: config.provider, halt },
     phase,
-    conditions: sendConditions(send, now),
+    conditions: sendConditions(send, now, onFreePlanLimits(config)),
     actions: sendActions(send, now),
     next_change_at: nextChangeAt(send, now),
     links: {
@@ -3899,7 +4608,7 @@ async function viewWithCursor(env, id) {
 async function renderPost(env, config, post, branding) {
   const revision = await getCurrentRevision(env.DB, post);
   if (!revision) {
-    throw badRequest("post has no content to send");
+    throw badRequest("This post has no content yet. Write something, then schedule it.");
   }
   const images = await listImages(env.DB, post.id);
   const rendered = await render({ post, revision, images }, config, branding);
@@ -3909,28 +4618,32 @@ var MINUTE_MS = 60 * 1e3;
 function onTheMinute(fireAt) {
   return Math.ceil(fireAt / MINUTE_MS) * MINUTE_MS;
 }
-function acceptFireAt(requested, minLeadMs, { now = Date.now(), hint = "" } = {}) {
+function acceptFireAt(requested, minLeadMs, { now = Date.now() } = {}) {
   if (requested < now + minLeadMs) {
-    throw refusal(
-      400,
-      "fire_at_too_soon",
-      `fire_at must be at least ${formatLead(minLeadMs)} in the future, this deployment's minimum lead${hint}`,
-      { field: "fire_at" }
-    );
+    throw refusal(400, "fire_at_too_soon", tooSoonMessage(minLeadMs), {
+      field: "fire_at"
+    });
   }
   return onTheMinute(requested);
 }
 var FREEZE_RETRIES = 3;
+var ACTIVE_SEND_EXISTS = "This post already has a send scheduled or going out. Reschedule or cancel that send instead.";
 async function freeze(env, config, post, fireAt) {
   const active = await getActiveSendForPost(env.DB, post.id);
   if (active) {
     throw await activeSendExists(env, active);
   }
   if (post.status !== "draft") {
-    throw refusal(409, "post_not_draft", `post is ${post.status}, not a draft`);
+    throw refusal(
+      409,
+      "post_not_draft",
+      post.status === "sent" ? "This post has already been sent, so it can\u2019t be scheduled again." : "This post is already scheduled. Reschedule or cancel its send instead."
+    );
   }
   if (!post.subject.trim()) {
-    throw refusal(400, "subject_required", "add a subject before sending", { field: "subject" });
+    throw refusal(400, "subject_required", "Add a subject before you schedule or send this post.", {
+      field: "subject"
+    });
   }
   for (let attempt = 0; attempt < FREEZE_RETRIES; attempt++) {
     const { settings, version } = await readSettings(env.DB);
@@ -3960,7 +4673,7 @@ async function freeze(env, config, post, fireAt) {
     } catch (err) {
       if (isActiveSendConflict(err)) {
         const winner = await getActiveSendForPost(env.DB, post.id);
-        throw winner ? await activeSendExists(env, winner) : refusal(409, "active_send_exists", "post already has an active send");
+        throw winner ? await activeSendExists(env, winner) : refusal(409, "active_send_exists", ACTIVE_SEND_EXISTS);
       }
       throw err;
     }
@@ -3971,11 +4684,11 @@ async function freeze(env, config, post, fireAt) {
   throw refusal(
     409,
     "settings_changed",
-    "the template or identity changed while scheduling; try again"
+    "The template or the publication\u2019s details changed while this was being scheduled. Try again."
   );
 }
 async function activeSendExists(env, send) {
-  return refusal(409, "active_send_exists", "post already has an active send", {
+  return refusal(409, "active_send_exists", ACTIVE_SEND_EXISTS, {
     send: await viewSend(env, send.id)
   });
 }
@@ -3991,8 +4704,8 @@ async function readForAction(env, sendId) {
   return send;
 }
 async function windowClosed(env, send, what) {
-  const why = send.status === "scheduled" ? "its fire time has passed and it is about to send" : `it is ${send.status}`;
-  return refusal(409, "window_closed", `send can no longer be ${what}: ${why}`, {
+  const why = send.status === "scheduled" ? "its fire time has passed and it\u2019s about to send" : `it\u2019s ${send.status}`;
+  return refusal(409, "window_closed", `This send can no longer be ${what}: ${why}.`, {
     send: await viewSend(env, send.id)
   });
 }
@@ -4000,9 +4713,14 @@ async function reschedule(env, sendId, fireAt, minLeadMs) {
   const send = await readForAction(env, sendId);
   const now = Date.now();
   if (send.status === "canceled") {
-    throw refusal(409, "send_canceled", "send is canceled; schedule the post again instead", {
-      send: await viewSend(env, send.id)
-    });
+    throw refusal(
+      409,
+      "send_canceled",
+      "This send was canceled. Schedule the post again instead.",
+      {
+        send: await viewSend(env, send.id)
+      }
+    );
   }
   if (send.status !== "scheduled" || send.fire_at <= now) {
     throw await windowClosed(env, send, "rescheduled");
@@ -4382,9 +5100,9 @@ function scaledEmailFor(n) {
   const pairIdx = Math.floor(s / (LOCAL_FORMATS.length * DOMAINS.length));
   const given = unwrap(GIVEN_NAMES[pairIdx % GIVEN_NAMES.length], "given name");
   const surname = unwrap(SURNAMES[Math.floor(pairIdx / GIVEN_NAMES.length)], "surname");
-  const format = unwrap(LOCAL_FORMATS[formatIdx], "local-part format");
+  const format2 = unwrap(LOCAL_FORMATS[formatIdx], "local-part format");
   const domain = unwrap(DOMAINS[domainIdx], "email domain");
-  const local = cycle === 0 ? format(given, surname) : `${format(given, surname)}${cycle + 1}`;
+  const local = cycle === 0 ? format2(given, surname) : `${format2(given, surname)}${cycle + 1}`;
   return `${local}@${domain}`;
 }
 function isConfirmedAt(s, t) {
@@ -4921,13 +5639,13 @@ var deploy_default = '# Deploy the app\n\nKestrel runs as one Cloudflare Worker,
 var access_default = '# Lock the dashboard with Access\n\nCloudflare Access puts a login in front of the editor and the API. Kestrel checks every request against that login as well, so a path left out of Access stays locked. The public pages readers see stay public.\n\nIn this guide, you set up Cloudflare Zero Trust, create one Access application that covers the editor and the API, and allow yourself in. Then you give the app two values from that application, and check that the login works.\n\n## 1. Set up Zero Trust\n\nAccess is part of Cloudflare Zero Trust. Your account needs a Zero Trust organization before it can create an Access application. Skip this section if your account already has one.\n\n1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), select **Zero Trust**.\n\n1. Choose a team name. It becomes your team domain, `YOUR_TEAM.cloudflareaccess.com`, where your login page lives.\n\n1. Choose a plan. The Free plan covers a newsletter\'s editors. Cloudflare asks for payment details even on the Free plan, and doesn\'t charge them.\n\n## 2. Create the Access application\n\nThe editor lives under `/dashboard`, and the API under `/api`. One application covers both, so they share one login.\n\n1. In **Zero Trust**, go to **Access controls \u2192 Applications**, and select **Create new application**.\n\n1. Select **Self-hosted and private**.\n\n1. Select **Add public hostname**, and enter your app\'s hostname with the first path:\n\n    - **Subdomain:** `newsletter`\n    - **Domain:** `example.com`\n    - **Path:** `dashboard`\n\n1. Add a second public hostname with the same subdomain and domain, and the path `api`:\n\n    | Path | What it covers |\n    | --- | --- |\n    | `dashboard` | the editor |\n    | `api` | everything the editor and Claude read and change: posts, sends, subscribers, settings, and the in-app docs |\n\n    Each path covers everything under it. Leave every other path out. The landing page, the archive, subscribing, unsubscribing, images, and your email provider\'s webhooks must stay public.\n\n## 3. Allow yourself in\n\nEvery Access application denies everyone until a policy allows them.\n\n1. Under **Access policies**, create a new policy:\n\n    - **Policy name:** `Publishers`\n    - **Action:** Allow\n    - **Include:** the **Emails** selector, with your email address\n\n1. Keep the login method a new Zero Trust organization starts with: you sign in with your Cloudflare account. To sign in another way, such as a one-time code by email, add it under **Zero Trust \u2192 Integrations \u2192 Identity providers** first.\n\n1. Select **Create**.\n\n## 4. Give the app its two values\n\nThe app verifies each login against your team domain, and checks that it was issued for this application.\n\n1. Find your team domain under **Zero Trust \u2192 Settings**. It looks like `YOUR_TEAM.cloudflareaccess.com`.\n\n1. Find the application\'s audience tag. Under **Access controls \u2192 Applications**, select **Configure** on your application. On the **Additional settings** tab, copy the **Application Audience (AUD) Tag**.\n\n1. Store the team domain as a secret. The command prompts you for the value. Enter the hostname alone, without `https://`. If you paste it with `https://` or a trailing slash, the app drops them. Anything else that isn\'t a hostname is refused, naming `ACCESS_TEAM_DOMAIN`:\n\n    ```bash\n    npx wrangler secret put ACCESS_TEAM_DOMAIN --env production\n    ```\n\n1. Store the audience tag the same way:\n\n    ```bash\n    npx wrangler secret put ACCESS_AUD --env production\n    ```\n\n    A secret takes effect as soon as you store it, with no redeploy. The app needs both values. While only one is stored, it refuses its configuration and names the missing one: the editor says so, `/health` answers `500` with `"variable":"ACCESS_AUD"`, and the public pages say the newsletter is temporarily unavailable. Storing the second clears it.\n\n1. **(Optional, recommended)** Limit the editor to named people. The Access policy decides who can sign in. This list keeps that true if the policy is widened later, for another app or by mistake. Enter a comma-separated list of email addresses at the prompt:\n\n    ```bash\n    npx wrangler secret put ACCESS_ALLOWED_EMAILS --env production\n    ```\n\n    Without it, the app lets in anyone your Access policy allows.\n\n## Check it\n\n1. In a private browser window, open `https://newsletter.example.com/dashboard/`. Cloudflare asks you to sign in.\n\n1. Sign in. The editor loads, and its sidebar shows the email address you signed in with.\n\n1. In the same window, open `https://newsletter.example.com/api/whoami`. It shows you as a signed-in person, verified through Access:\n\n    ```\n    {"principal":{"kind":"human","email":"you@example.com"},"auth":{"mode":"access"}}\n    ```\n\n1. The public pages still need no login:\n\n    ```bash\n    curl https://newsletter.example.com/health\n    ```\n\n    ```\n    {"status":"ok","service":"kestrel"}\n    ```\n\nIf the editor says the configuration needs a fix, store the secret it names. If Cloudflare lets you in but the editor answers `401`, check the two secrets for a typo, or `ACCESS_ALLOWED_EMAILS` may leave out your address.\n\nNext, [connect Amazon SES](04-ses.md).\n';
 
 // docs/get-started/04-ses.md
-var ses_default = '# Connect Amazon SES\n\nKestrel sends your posts through Amazon SES, Amazon\'s email service. SES only delivers the mail: Kestrel keeps your list, each subscriber\'s consent, and the record of every send. AWS reviews your account before it lets you send to anyone but yourself. This page asks for that early, and you test in the sandbox while you wait.\n\nIn this guide, you verify your sending hostname with SES, add a DMARC record, and ask AWS for production access. You also route bounces and complaints to the app through SNS. Then you give the app its AWS credentials, set the provider, and deploy.\n\n## Before you begin\n\n- An [AWS account](https://portal.aws.amazon.com/billing/signup).\n\nTo move an instance that already sends through another provider or another SES account, read [Switch an instance that already sends](#switch-an-instance-that-already-sends) first.\n\n## 1. Verify your sending hostname\n\nSES sends only from an identity you\'ve verified. Verifying the whole hostname, rather than one address, lets any address on it send. It also sets up DKIM, which lets inboxes trust your mail.\n\n1. Open the [SES console](https://console.aws.amazon.com/ses/), and choose the region you send from in the menu at the top right. Any region that offers SES works, so pick one near you. A few newer regions must be [enabled for your account](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-regions.html) before you can use them. SES keeps identities, quotas, and the sandbox separately in each region, so do every step in this one.\n\n1. Note the region\'s code. The menu shows a name, such as Europe (Ireland), but later steps need its code, such as `eu-west-1`. [Amazon SES endpoints](https://docs.aws.amazon.com/general/latest/gr/ses.html) lists each region\'s code beside its name. The MAIL FROM record, the SNS access policy, and `AWS_REGION` all use this one code.\n\n1. Under **Configuration**, choose **Identities**, then **Create identity**.\n\n1. Select **Domain**, and enter `send.example.com`. Keep the default DKIM settings: **Easy DKIM**, with a 2048-bit key. Choose **Create identity**.\n\n1. On the identity\'s **Authentication** tab, expand **Publish DNS records**. It lists three CNAME records.\n\n1. In the Cloudflare dashboard, add each record to your domain\'s DNS records, exactly as SES lists it. Set each one\'s proxy status to **DNS only**. Cloudflare adds your domain to the name, so a name ends in `._domainkey.send`.\n\n1. Wait until SES shows **DKIM configuration** as **Successful** and **Identity status** as **Verified**.\n\n## 2. Add a DMARC record\n\nDMARC tells inboxes what to do with mail that fails its checks, and sends you reports about it. SES doesn\'t add this record, so you add it yourself. It starts in monitor mode, which reports without blocking anything.\n\n1. In the Cloudflare dashboard, open your domain\'s DNS records, and add a record:\n\n    - **Type:** `TXT`\n    - **Name:** `_dmarc.send`\n    - **Content:** `v=DMARC1; p=none; rua=mailto:dmarc@example.com`\n\n1. Replace `dmarc@example.com` with an address that receives mail. Reports arrive there as attachments.\n\n[Sending-domain DNS](../reference/02-sending-domain-dns.md#dmarc-publish-a-policy-and-collect-reports) explains each record, and when to tighten DMARC.\n\n## 3. (Optional) Set a custom MAIL FROM domain\n\nSES sends with its own return path by default, so SPF passes for `amazonses.com` rather than for your hostname. DMARC still passes, through DKIM. A custom MAIL FROM domain makes SPF pass for your hostname too, a second check in your favor.\n\n1. In SES, open the `send.example.com` identity. Under **Custom MAIL FROM domain**, choose **Edit**.\n\n1. Select **Use a custom MAIL FROM domain**, and enter `bounce.send.example.com`. For **Behavior on MX failure**, keep **Use default MAIL FROM domain**. Choose **Save changes**.\n\n1. In Cloudflare, add the two records SES lists. Replace `us-east-1` with your region\'s code from section 1:\n\n    - **Type:** `MX`, **Name:** `bounce.send`, **Mail server:** `feedback-smtp.us-east-1.amazonses.com`, **Priority:** `10`\n    - **Type:** `TXT`, **Name:** `bounce.send`, **Content:** `v=spf1 include:amazonses.com ~all`\n\n1. Wait until SES shows the MAIL FROM domain as **Successful**.\n\n## 4. Request production access\n\nA new SES account starts in the sandbox. It sends only to addresses you\'ve verified in SES, up to 200 emails a day and one a second. Ask AWS to lift those limits now, and test while you wait.\n\n1. Name your publication first, since AWS may visit your website to review the request. In the editor, open **Settings \u2192 Publication identity**, and enter the name and tagline. Until you do, your public pages show the name in your From address. The subscribe form stays closed until section 7 sets the provider.\n\n1. In SES, open the **Account dashboard**, select **View Get set up page**, and then **Request production access**.\n\n1. Fill in the request:\n\n    - **Mail type:** Marketing\n    - **Website URL:** `https://newsletter.example.com/`\n\n1. Check the acknowledgement, and select **Submit request**. AWS Support answers by email, and may ask how you collect addresses and handle bounces.\n\n1. While you wait, verify the two addresses you test with in [Verify it works](05-verify.md#before-you-begin), so the sandbox lets you mail them. For each, under **Identities**, choose **Create identity**, select **Email address**, and follow the link in the email AWS sends.\n\nIf AWS asks for more detail, reply in the support case. If it denies the request, reply there, or open a new request from the **Account dashboard**. Either way, say how Kestrel handles your list:\n\n- Signups use double opt-in: each subscriber confirms by email before joining the list.\n- Every post offers one-click unsubscribe.\n- Bounces and complaints reach the app through SNS, and it stops mailing those addresses automatically.\n- How many subscribers you expect, and how often you send.\n\nYour account stays in the sandbox until AWS grants access, so don\'t go live before then. In the sandbox, a signup from any address you haven\'t verified fails, and a post reaches only your verified addresses.\n\nWhen AWS grants access, the **Account dashboard** shows your daily quota and your maximum send rate. You set the rate in the app in section 7. The rate decides how fast a send goes out, and [As your list grows](06-go-live.md#as-your-list-grows) says when to ask AWS to raise it.\n\n## 5. Send bounces and complaints to SNS\n\nSES reports what happens to each email through SNS, the AWS notification service. A configuration set says which events to report, and an SNS topic carries them to the app.\n\n1. In SES, under **Configuration**, choose **Configuration sets**, then **Create set**. Name it `kestrel-mail`, and choose **Create set**.\n\n1. On the set\'s **Event destinations** tab, choose **Add destination**. Select **Hard bounces**, **Complaints**, **Deliveries**, and **Rendering failures**, and choose **Next**. A rendering failure is an email SES took but couldn\'t build. It shouldn\'t happen, and the app logs it as an error if it does.\n\n1. For **Destination type**, select **Amazon SNS**. Name it `kestrel-sns`, and keep **Event publishing** enabled. Choose **Next**.\n\n1. For **SNS topic**, choose **Create SNS topic**. Make it a **Standard** topic named `kestrel-events`. Choose **Next**, then **Add destination**.\n\n1. Make the set your hostname\'s default, so SES reports on every email sent from it. Open the `send.example.com` identity, and choose the **Configuration set** tab. Under **Default configuration set**, choose **Edit**, select `kestrel-mail`, and save.\n\n1. Open the topic in the [SNS console](https://console.aws.amazon.com/sns/), and copy its ARN. It looks like `arn:aws:sns:us-east-1:111122223333:kestrel-events`. After `sns` comes your region\'s code, then your 12-digit account ID. The account menu at the top right of the console also shows the account ID.\n\n1. Let SES publish to the topic. Choose **Edit**, expand **Access policy**, and add this statement to the `Statement` list:\n\n    ```json\n    {\n      "Effect": "Allow",\n      "Principal": { "Service": "ses.amazonaws.com" },\n      "Action": "sns:Publish",\n      "Resource": "REPLACE_WITH_TOPIC_ARN",\n      "Condition": {\n        "StringEquals": {\n          "AWS:SourceAccount": "REPLACE_WITH_ACCOUNT_ID",\n          "AWS:SourceArn": "arn:aws:ses:us-east-1:REPLACE_WITH_ACCOUNT_ID:configuration-set/kestrel-mail"\n        }\n      }\n    }\n    ```\n\n    Replace the topic ARN, and both copies of the account ID, with the values from your ARN. Replace `us-east-1` with your region\'s code, the same one the ARN shows. Choose **Save changes**.\n\nYou subscribe the app to the topic in section 8, once it runs on SES.\n\n## 6. Create the app\'s AWS key\n\nThe app sends through an IAM user whose key can only send email. That limits the harm if the key ever leaks.\n\n1. In the [IAM console](https://console.aws.amazon.com/iam/), go to **Users**, and choose **Create user**. Name it `kestrel-sender`, and leave console access off.\n\n1. When asked for permissions, choose **Attach policies directly**, then **Create policy**. The policy editor opens in a new browser tab.\n\n1. In the new tab, choose the **JSON** editor, and replace its contents with this policy:\n\n    ```json\n    {\n      "Version": "2012-10-17",\n      "Statement": [\n        {\n          "Effect": "Allow",\n          "Action": ["ses:SendEmail", "ses:SendBulkEmail"],\n          "Resource": "*"\n        }\n      ]\n    }\n    ```\n\n    Choose **Next**, name the policy `kestrel-send-email`, and choose **Create policy**. You can close this tab.\n\n1. Go back to the first tab, where you\'re creating the user. Refresh the policy list, search for `kestrel-send-email`, and select it.\n\n1. Choose **Next**, then **Create user**.\n\n1. Open the user, and on the **Security credentials** tab, choose **Create access key**. For the use case, choose **Application running outside AWS**.\n\n1. Copy the access key ID and the secret access key. AWS shows the secret only once.\n\n## 7. Set the provider and deploy\n\nUntil now the app has run with no email provider connected, refusing to send. Setting `PROVIDER` connects SES. Store the secrets before you set it. With `PROVIDER` set to `ses` and a required secret missing, the app refuses to run, and sends nothing, until you store it. `/health` and the editor\'s **A setting needs fixing** page name the missing secret, and reader pages say the newsletter is temporarily unavailable. `SES_CONFIGURATION_SET` is the one optional secret.\n\n1. Store the access key ID, and paste it at the prompt:\n\n    ```bash\n    npx wrangler secret put AWS_ACCESS_KEY_ID --env production\n    ```\n\n1. Store the secret access key:\n\n    ```bash\n    npx wrangler secret put AWS_SECRET_ACCESS_KEY --env production\n    ```\n\n1. Store the topic ARN from section 5. The app accepts events only from this topic:\n\n    ```bash\n    npx wrangler secret put SNS_TOPIC_ARN --env production\n    ```\n\n1. Store the configuration set\'s name, `kestrel-mail`. It\'s optional but recommended: the app names it on every email, so SES reports on each one even without the default:\n\n    ```bash\n    npx wrangler secret put SES_CONFIGURATION_SET --env production\n    ```\n\n1. In `wrangler.jsonc`, edit the `production` block\'s `vars`. Change `PROVIDER` to `ses` (it\'s `""` on a new instance; add it if your block has none), and add `SES_MAX_SEND_RATE`. Change `AWS_REGION` to your region\'s code from section 1. Your other values stay as they are. The block ends up like this:\n\n    ```jsonc\n    "vars": {\n      "PROVIDER": "ses",             // \u2190 set to ses\n      "APP_ORIGIN": "https://newsletter.example.com",\n      "ARCHIVE_BASE_PATH": "/archive",\n      "SENDING_DOMAIN": "send.example.com",\n      "FROM_ADDRESS": "Newsletter <newsletter@send.example.com>",\n      "AWS_REGION": "us-east-1",     // \u2190 change: your region\'s code\n      "SES_MAX_SEND_RATE": "1"       // \u2190 new: your maximum send rate; 1 in the sandbox\n    }\n    ```\n\n    On Workers Paid, also add `"SUBREQUEST_BUDGET": "10000"`, the plan\'s limit, so each minute sends more. Leave it out on Workers Free. [As your list grows](06-go-live.md#as-your-list-grows) says when the plan is worth it.\n\n    When AWS grants production access, set `SES_MAX_SEND_RATE` to the maximum send rate on the **Account dashboard**, and deploy again. The app keeps to that rate, so SES doesn\'t throttle your send.\n\n1. Commit the change, and push it:\n\n    ```bash\n    git commit -am "Send through Amazon SES"\n    git push\n    ```\n\n1. Deploy:\n\n    ```bash\n    npx wrangler deploy --env production\n    ```\n\n## 8. Subscribe the app to the topic\n\nSNS delivers events only to a subscriber that has confirmed. The app confirms on its own, once it checks that the request came from your topic.\n\n1. In the SNS console, open your topic, and choose **Create subscription**.\n\n1. Set **Protocol** to **HTTPS**, and enter the endpoint:\n\n    ```\n    https://newsletter.example.com/webhooks/ses\n    ```\n\n1. Leave raw message delivery off, and choose **Create subscription**.\n\n1. Reload the subscription. Its status changes to **Confirmed**, with nothing for you to click.\n\nIf it stays **Pending confirmation**, the request never reached the app, or the app refused it. Check, in this order:\n\n- **Access covers `/webhooks/ses`.** If your Access application covers more than `/dashboard` and `/api`, SNS gets the login page instead of the app. Remove that path from your Access application, so only `dashboard` and `api` remain.\n- **`SNS_TOPIC_ARN` matches the topic\'s ARN.**\n- **The deploy in section 7 finished.**\n\nOnce you\'ve fixed the cause, select the subscription, and choose **Request confirmation**. SNS sends the request again, and the app confirms it. SNS doesn\'t let you delete a subscription while it\'s pending, and removes it on its own after 48 hours.\n\n## Switch an instance that already sends\n\nChange `PROVIDER`, or move to another account with the same provider, only while no send is sending. The dashboard lists any send in progress.\n\nWhen a request to a provider gets no answer, Kestrel can\'t know whether its recipients were mailed. Moving to SES, from another provider or another SES account, mails none of them twice. Kestrel never repeats an unanswered request to SES, so those recipients wait for you to decide whether they were mailed. Use **Resolve** on the send\'s page.\n\nKestrel can\'t tell whether those emails went out. SES\'s console shows sent messages only if you\'ve turned on Virtual Deliverability Manager, which this guide doesn\'t set up. So **Assume not sent** is the safe default. Those readers may miss this post, but they get your next one. No one is mailed twice. Choose **Assume sent** only when you know otherwise, such as a reader who says they got it.\n\n## Check it\n\n1. The app answers on your hostname:\n\n    ```bash\n    curl https://newsletter.example.com/health\n    ```\n\n    ```\n    {"status":"ok","service":"kestrel"}\n    ```\n\n1. The webhook is public, and refuses a request that isn\'t from SNS:\n\n    ```bash\n    curl -s -o /dev/null -w "%{http_code}\\n" -X POST https://newsletter.example.com/webhooks/ses\n    ```\n\n    ```\n    400\n    ```\n\n    Any other answer, such as a redirect to your Cloudflare login, means Access covers the webhook. Remove that path from your Access application.\n\n1. The SNS subscription shows **Confirmed**.\n\n1. In the editor, **Settings \u2192 Email sender** shows Amazon SES and your From address, where it said **No email provider connected** before.\n\n1. In a browser, `https://newsletter.example.com/subscribe` shows the subscribe form, where it said signups aren\'t open yet.\n\nThe test sends in the next step prove the rest. In the sandbox, send them only to the addresses you verified in section 4, and to the SES test addresses that page lists.\n\nSES charges for each email it sends, test emails included. [Amazon SES pricing](https://aws.amazon.com/ses/pricing/) lists the rates.\n\nNext, [verify it works](05-verify.md).\n';
+var ses_default = '# Connect Amazon SES\n\nKestrel sends your posts through Amazon SES, Amazon\'s email service. SES only delivers the mail: Kestrel keeps your list, each subscriber\'s consent, and the record of every send. AWS reviews your account before it lets you send to anyone but yourself. This page asks for that early, and you test in the sandbox while you wait.\n\nIn this guide, you verify your sending hostname with SES, add a DMARC record, and ask AWS for production access. You also route bounces and complaints to the app through SNS. Then you give the app its AWS credentials, set the provider, and deploy.\n\n## Before you begin\n\n- An [AWS account](https://portal.aws.amazon.com/billing/signup).\n\nTo move an instance that already sends through another provider or another SES account, read [Switch an instance that already sends](#switch-an-instance-that-already-sends) first.\n\n## 1. Verify your sending hostname\n\nSES sends only from an identity you\'ve verified. Verifying the whole hostname, rather than one address, lets any address on it send. It also sets up DKIM, which lets inboxes trust your mail.\n\n1. Open the [SES console](https://console.aws.amazon.com/ses/), and choose the region you send from in the menu at the top right. Any region that offers SES works, so pick one near you. A few newer regions must be [enabled for your account](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-regions.html) before you can use them. SES keeps identities, quotas, and the sandbox separately in each region, so do every step in this one.\n\n1. Note the region\'s code. The menu shows a name, such as Europe (Ireland), but later steps need its code, such as `eu-west-1`. [Amazon SES endpoints](https://docs.aws.amazon.com/general/latest/gr/ses.html) lists each region\'s code beside its name. The MAIL FROM record, the SNS access policy, and `AWS_REGION` all use this one code.\n\n1. Under **Configuration**, choose **Identities**, then **Create identity**.\n\n1. Select **Domain**, and enter `send.example.com`. Keep the default DKIM settings: **Easy DKIM**, with a 2048-bit key. Choose **Create identity**.\n\n1. On the identity\'s **Authentication** tab, expand **Publish DNS records**. It lists three CNAME records.\n\n1. In the Cloudflare dashboard, add each record to your domain\'s DNS records, exactly as SES lists it. Set each one\'s proxy status to **DNS only**. Cloudflare adds your domain to the name, so a name ends in `._domainkey.send`.\n\n1. Wait until SES shows **DKIM configuration** as **Successful** and **Identity status** as **Verified**.\n\n## 2. Add a DMARC record\n\nDMARC tells inboxes what to do with mail that fails its checks, and sends you reports about it. SES doesn\'t add this record, so you add it yourself. It starts in monitor mode, which reports without blocking anything.\n\n1. In the Cloudflare dashboard, open your domain\'s DNS records, and add a record:\n\n    - **Type:** `TXT`\n    - **Name:** `_dmarc.send`\n    - **Content:** `v=DMARC1; p=none; rua=mailto:dmarc@example.com`\n\n1. Replace `dmarc@example.com` with an address that receives mail. Reports arrive there as attachments.\n\n[Sending-domain DNS](../reference/02-sending-domain-dns.md#dmarc-publish-a-policy-and-collect-reports) explains each record, and when to tighten DMARC.\n\n## 3. (Optional) Set a custom MAIL FROM domain\n\nSES sends with its own return path by default, so SPF passes for `amazonses.com` rather than for your hostname. DMARC still passes, through DKIM. A custom MAIL FROM domain makes SPF pass for your hostname too, a second check in your favor.\n\n1. In SES, open the `send.example.com` identity. Under **Custom MAIL FROM domain**, choose **Edit**.\n\n1. Select **Use a custom MAIL FROM domain**, and enter `bounce.send.example.com`. For **Behavior on MX failure**, keep **Use default MAIL FROM domain**. Choose **Save changes**.\n\n1. In Cloudflare, add the two records SES lists. Replace `us-east-1` with your region\'s code from section 1:\n\n    - **Type:** `MX`, **Name:** `bounce.send`, **Mail server:** `feedback-smtp.us-east-1.amazonses.com`, **Priority:** `10`\n    - **Type:** `TXT`, **Name:** `bounce.send`, **Content:** `v=spf1 include:amazonses.com ~all`\n\n1. Wait until SES shows the MAIL FROM domain as **Successful**.\n\n## 4. Request production access\n\nA new SES account starts in the sandbox. It sends only to addresses you\'ve verified in SES, up to 200 emails a day and one a second. Ask AWS to lift those limits now, and test while you wait.\n\n1. Name your publication first, since AWS may visit your website to review the request. In the editor, open **Settings \u2192 Publication identity**, and enter the name and tagline. Until you do, your public pages show the name in your From address. The subscribe form stays closed until section 7 sets the provider.\n\n1. In SES, open the **Account dashboard**, select **View Get set up page**, and then **Request production access**.\n\n1. Fill in the request:\n\n    - **Mail type:** Marketing\n    - **Website URL:** `https://newsletter.example.com/`\n\n1. Check the acknowledgement, and select **Submit request**. AWS Support answers by email, and may ask how you collect addresses and handle bounces.\n\n1. While you wait, verify the two addresses you test with in [Verify it works](05-verify.md#before-you-begin), so the sandbox lets you mail them. For each, under **Identities**, choose **Create identity**, select **Email address**, and follow the link in the email AWS sends.\n\nIf AWS asks for more detail, reply in the support case. If it denies the request, reply there, or open a new request from the **Account dashboard**. Either way, say how Kestrel handles your list:\n\n- Signups use double opt-in: each subscriber confirms by email before joining the list.\n- Every post offers one-click unsubscribe.\n- Bounces and complaints reach the app through SNS, and it stops mailing those addresses automatically.\n- How many subscribers you expect, and how often you send.\n\nYour account stays in the sandbox until AWS grants access, so don\'t go live before then. In the sandbox, a signup from any address you haven\'t verified fails, and a post reaches only your verified addresses.\n\nWhen AWS grants access, the **Account dashboard** shows your daily quota and your maximum send rate. You set the rate in the app in section 7. The rate decides how fast a send goes out, and [As your list grows](06-go-live.md#as-your-list-grows) says when to ask AWS to raise it.\n\n## 5. Send bounces and complaints to SNS\n\nSES reports what happens to each email through SNS, the AWS notification service. A configuration set says which events to report, and an SNS topic carries them to the app.\n\n1. In SES, under **Configuration**, choose **Configuration sets**, then **Create set**. Name it `kestrel-mail`, and choose **Create set**.\n\n1. On the set\'s **Event destinations** tab, choose **Add destination**. Select **Hard bounces**, **Complaints**, **Deliveries**, and **Rendering failures**, and choose **Next**. A rendering failure is an email SES took but couldn\'t build. It shouldn\'t happen, and the app logs it as an error if it does.\n\n1. For **Destination type**, select **Amazon SNS**. Name it `kestrel-sns`, and keep **Event publishing** enabled. Choose **Next**.\n\n1. For **SNS topic**, choose **Create SNS topic**. Make it a **Standard** topic named `kestrel-events`. Choose **Next**, then **Add destination**.\n\n1. Make the set your hostname\'s default, so SES reports on every email sent from it. Open the `send.example.com` identity, and choose the **Configuration set** tab. Under **Default configuration set**, choose **Edit**, select `kestrel-mail`, and save.\n\n1. Open the topic in the [SNS console](https://console.aws.amazon.com/sns/), and copy its ARN. It looks like `arn:aws:sns:us-east-1:111122223333:kestrel-events`. After `sns` comes your region\'s code, then your 12-digit account ID. The account menu at the top right of the console also shows the account ID.\n\n1. Let SES publish to the topic. Choose **Edit**, expand **Access policy**, and add this statement to the `Statement` list:\n\n    ```json\n    {\n      "Effect": "Allow",\n      "Principal": { "Service": "ses.amazonaws.com" },\n      "Action": "sns:Publish",\n      "Resource": "REPLACE_WITH_TOPIC_ARN",\n      "Condition": {\n        "StringEquals": {\n          "AWS:SourceAccount": "REPLACE_WITH_ACCOUNT_ID",\n          "AWS:SourceArn": "arn:aws:ses:us-east-1:REPLACE_WITH_ACCOUNT_ID:configuration-set/kestrel-mail"\n        }\n      }\n    }\n    ```\n\n    Replace the topic ARN, and both copies of the account ID, with the values from your ARN. Replace `us-east-1` with your region\'s code, the same one the ARN shows. Choose **Save changes**.\n\nYou subscribe the app to the topic in section 8, once it runs on SES.\n\n## 6. Create the app\'s AWS key\n\nThe app sends through an IAM user whose key can only send email. That limits the harm if the key ever leaks.\n\n1. In the [IAM console](https://console.aws.amazon.com/iam/), go to **Users**, and choose **Create user**. Name it `kestrel-sender`, and leave console access off.\n\n1. When asked for permissions, choose **Attach policies directly**, then **Create policy**. The policy editor opens in a new browser tab.\n\n1. In the new tab, choose the **JSON** editor, and replace its contents with this policy:\n\n    ```json\n    {\n      "Version": "2012-10-17",\n      "Statement": [\n        {\n          "Effect": "Allow",\n          "Action": ["ses:SendEmail", "ses:SendBulkEmail"],\n          "Resource": "*"\n        }\n      ]\n    }\n    ```\n\n    Choose **Next**, name the policy `kestrel-send-email`, and choose **Create policy**. You can close this tab.\n\n1. Go back to the first tab, where you\'re creating the user. Refresh the policy list, search for `kestrel-send-email`, and select it.\n\n1. Choose **Next**, then **Create user**.\n\n1. Open the user, and on the **Security credentials** tab, choose **Create access key**. For the use case, choose **Application running outside AWS**.\n\n1. Copy the access key ID and the secret access key. AWS shows the secret only once.\n\n## 7. Set the provider and deploy\n\nUntil now the app has run with no email provider connected, refusing to send. Setting `PROVIDER` connects SES. Store the secrets before you set it. With `PROVIDER` set to `ses` and a required secret missing, the app refuses to run, and sends nothing, until you store it. `/health` and the editor\'s **A setting needs fixing** page name the missing secret, and reader pages say the newsletter is temporarily unavailable. `SES_CONFIGURATION_SET` is the one optional secret.\n\n1. Store the access key ID, and paste it at the prompt:\n\n    ```bash\n    npx wrangler secret put AWS_ACCESS_KEY_ID --env production\n    ```\n\n1. Store the secret access key:\n\n    ```bash\n    npx wrangler secret put AWS_SECRET_ACCESS_KEY --env production\n    ```\n\n1. Store the topic ARN from section 5. The app accepts events only from this topic:\n\n    ```bash\n    npx wrangler secret put SNS_TOPIC_ARN --env production\n    ```\n\n1. Store the configuration set\'s name, `kestrel-mail`. It\'s optional but recommended: the app names it on every email, so SES reports on each one even without the default. Type it exactly as the set is named in this region: if SES can\'t find the set, it refuses every email, and a list send is held until the name is fixed or the set created:\n\n    ```bash\n    npx wrangler secret put SES_CONFIGURATION_SET --env production\n    ```\n\n1. In `wrangler.jsonc`, edit the `production` block\'s `vars`. Change `PROVIDER` to `ses` (it\'s `""` on a new instance; add it if your block has none), and add `SES_MAX_SEND_RATE`. Change `AWS_REGION` to your region\'s code from section 1. Your other values stay as they are. The block ends up like this:\n\n    ```jsonc\n    "vars": {\n      "PROVIDER": "ses",             // \u2190 set to ses\n      "APP_ORIGIN": "https://newsletter.example.com",\n      "ARCHIVE_BASE_PATH": "/archive",\n      "SENDING_DOMAIN": "send.example.com",\n      "FROM_ADDRESS": "Newsletter <newsletter@send.example.com>",\n      "AWS_REGION": "us-east-1",     // \u2190 change: your region\'s code\n      "SES_MAX_SEND_RATE": "1"       // \u2190 new: your maximum send rate; 1 in the sandbox\n    }\n    ```\n\n    On Workers Paid, also add `"SUBREQUEST_BUDGET": "10000"`, the plan\'s limit, so each minute sends more. Leave it out on Workers Free. [As your list grows](06-go-live.md#as-your-list-grows) says when the plan is worth it.\n\n    When AWS grants production access, set `SES_MAX_SEND_RATE` to the maximum send rate on the **Account dashboard**, and deploy again. The app keeps to that rate, so SES doesn\'t throttle your send.\n\n1. Commit the change, and push it:\n\n    ```bash\n    git commit -am "Send through Amazon SES"\n    git push\n    ```\n\n1. Deploy:\n\n    ```bash\n    npx wrangler deploy --env production\n    ```\n\n## 8. Subscribe the app to the topic\n\nSNS delivers events only to a subscriber that has confirmed. The app confirms on its own, once it checks that the request came from your topic.\n\n1. In the SNS console, open your topic, and choose **Create subscription**.\n\n1. Set **Protocol** to **HTTPS**, and enter the endpoint:\n\n    ```\n    https://newsletter.example.com/webhooks/ses\n    ```\n\n1. Leave raw message delivery off, and choose **Create subscription**.\n\n1. Reload the subscription. Its status changes to **Confirmed**, with nothing for you to click.\n\nIf it stays **Pending confirmation**, the request never reached the app, or the app refused it. Check, in this order:\n\n- **Access covers `/webhooks/ses`.** If your Access application covers more than `/dashboard` and `/api`, SNS gets the login page instead of the app. Remove that path from your Access application, so only `dashboard` and `api` remain.\n- **`SNS_TOPIC_ARN` matches the topic\'s ARN.**\n- **The deploy in section 7 finished.**\n\nOnce you\'ve fixed the cause, select the subscription, and choose **Request confirmation**. SNS sends the request again, and the app confirms it. SNS doesn\'t let you delete a subscription while it\'s pending, and removes it on its own after 48 hours.\n\n## Switch an instance that already sends\n\nChange `PROVIDER`, or move to another account with the same provider, only while no send is sending. The dashboard lists any send in progress.\n\nWhen a request to a provider gets no answer, Kestrel can\'t know whether its recipients were mailed. Moving to SES, from another provider or another SES account, mails none of them twice. Kestrel never repeats an unanswered request to SES, so those recipients wait for you to decide whether they were mailed. Use **Resolve** on the send\'s page.\n\nKestrel can\'t tell whether those emails went out. SES\'s console shows sent messages only if you\'ve turned on Virtual Deliverability Manager, which this guide doesn\'t set up. So **Assume not sent** is the safe default. Those readers may miss this post, but they get your next one. No one is mailed twice. Choose **Assume sent** only when you know otherwise, such as a reader who says they got it.\n\n## Check it\n\n1. The app answers on your hostname:\n\n    ```bash\n    curl https://newsletter.example.com/health\n    ```\n\n    ```\n    {"status":"ok","service":"kestrel"}\n    ```\n\n1. The webhook is public, and refuses a request that isn\'t from SNS:\n\n    ```bash\n    curl -s -o /dev/null -w "%{http_code}\\n" -X POST https://newsletter.example.com/webhooks/ses\n    ```\n\n    ```\n    400\n    ```\n\n    Any other answer, such as a redirect to your Cloudflare login, means Access covers the webhook. Remove that path from your Access application.\n\n1. The SNS subscription shows **Confirmed**.\n\n1. In the editor, **Settings \u2192 Email sender** shows Amazon SES and your From address, where it said **No email provider connected** before.\n\n1. In a browser, `https://newsletter.example.com/subscribe` shows the subscribe form, where it said signups aren\'t open yet.\n\nThe test sends in the next step prove the rest. In the sandbox, send them only to the addresses you verified in section 4, and to the SES test addresses that page lists.\n\nSES charges for each email it sends, test emails included. [Amazon SES pricing](https://aws.amazon.com/ses/pricing/) lists the rates.\n\nNext, [verify it works](05-verify.md).\n';
 
 // docs/get-started/05-verify.md
 var verify_default = "# Verify it works\n\nSome things only show up with real email: whether inboxes trust your mail, how it looks in a real mail client, and whether bounces and unsubscribes come back to the app. Check them now, while your list is empty and every email goes only to you.\n\nIn this guide, you send yourself a test email and check that it passes authentication. Then you set up your notifications, send a real post to yourself as a subscriber, and unsubscribe. Finally, you check that bounces and complaints reach the app, and read the app's logs.\n\n## Before you begin\n\n- Two email addresses you own, such as a personal address and a work address. Some steps use both. While your SES account is in the sandbox, verify both in SES first, as [Connect Amazon SES](04-ses.md#4-request-production-access) describes.\n- A Gmail address, or another mail client that shows a message's original source and an **Unsubscribe** button.\n\n## 1. Send yourself a test email\n\nA test email goes through the same code as a real send. If the test looks right, the real send looks the same.\n\n1. In the editor at `https://newsletter.example.com/dashboard/`, create a post with a subject, a short body, and an image.\n\n1. Select **Send test email**, enter your address, and send it.\n\n1. Open the email. It should arrive in your inbox, not in spam. The image loads and the subject reads as you wrote it. Its **View in browser** link opens \"Nothing here yet\" until the post goes out, and its unsubscribe link opens the page a subscriber sees, marked as a test and showing a sample address. Its button walks through to the confirmation, but a test email unsubscribes no one. Section 5 unsubscribes for real.\n\n## 2. Check that it passes authentication\n\nInboxes trust mail that passes DKIM and DMARC for the domain it's from. Passing both is the best single sign that your mail reaches the inbox.\n\n1. Open the test email's original source. In Gmail, open the message's menu and select **Show original**.\n\n1. Find the `Authentication-Results` header. It shows:\n\n    - `dkim=pass` for `send.example.com`\n    - `dmarc=pass` for `send.example.com`\n    - `spf=pass`, for a hostname under `send.example.com`\n\n    With no custom MAIL FROM domain, SPF passes for `amazonses.com` instead. That's expected, and DMARC still passes.\n\nIf a check fails, compare your DNS records with the ones in [Connect Amazon SES](04-ses.md#1-verify-your-sending-hostname). [Sending-domain DNS](../reference/02-sending-domain-dns.md#verify-alignment) explains each result.\n\n## 3. Set up your notifications\n\nKestrel emails you when a send finishes, and right away when one runs into a problem. Notifications go through your email provider. To send them through Cloudflare instead, see [Notifications through Cloudflare's email](../guides/03-notifications.md).\n\n1. In the editor, open **Settings \u2192 Notifications**.\n\n1. Enter your address, and select **Save**.\n\n1. Select **Send a test notification**. It arrives at that address.\n\n## 4. Send a real post to yourself\n\nThis is a real send, to a list of one. It proves the whole path: subscribing, confirming, scheduling, and sending.\n\n1. Open `https://newsletter.example.com/subscribe`, and subscribe with your second address.\n\n1. Open the confirmation email, follow its link, and select **Confirm**. In the editor, **Subscribers** shows the address as **Confirmed**.\n\n1. Open your post, select **Schedule**, and then **Send now**. Every send waits at least five minutes before it goes out, so you can cancel a mistake.\n\n1. Cancel the send, to see that canceling stops it. Then select **Send now** again, and let it go.\n\n1. When the send finishes, the post arrives at your second address. A notification arrives at your first, with the subject `Sent:` and the post's title.\n\n## 5. Unsubscribe\n\nEvery email carries an unsubscribe link, and a header that lets mail clients show their own **Unsubscribe** button. Both work in one step, with no login.\n\n1. Open the post from section 4 in your mail client. It shows an **Unsubscribe** button next to the sender.\n\n1. Select it. In the editor, **Subscribers** shows the address as **Unsubscribed**, and later sends leave it out.\n\n## 6. Check that bounces and complaints come back\n\nWhen an address bounces or marks your mail as spam, SES tells the app through SNS. The app then stops mailing that address. SES has test addresses that act out each case without reaching a real person, and the sandbox lets you mail them.\n\n1. Open `https://newsletter.example.com/subscribe`, and subscribe each test address:\n\n    - `bounce@simulator.amazonses.com`, which bounces\n    - `complaint@simulator.amazonses.com`, which marks your mail as spam\n\n    Each one gets a confirmation email, which bounces or is marked as spam.\n\n1. In the editor, **Subscribers** lists both addresses as **Pending**, each with a **Suppressed** flag. The app never mails a suppressed address again.\n\nIf an address has no flag, SES's events aren't reaching the app. Check the configuration set and the SNS subscription in [Connect Amazon SES](04-ses.md#5-send-bounces-and-complaints-to-sns).\n\n## 7. Read the logs\n\nThe app writes a log line for each thing it does, and Cloudflare keeps them for a few days. Nothing else tells you if the once-a-minute schedule that sends your posts stops, so it's worth knowing where to look.\n\n1. In the Cloudflare dashboard, go to **Workers & Pages**, select `kestrel-production`, and select **Observability**.\n\n1. Filter on `event` equal to `sweep.tick`. A line arrives every minute.\n\n1. Filter on `event` equal to `send.completed`. Your send from section 4 is there.\n\n1. Filter on `level` equal to `error`. A healthy instance shows nothing.\n\nWhen every section gives the result it describes, your instance is ready for subscribers.\n\nNext, [go live](06-go-live.md).\n";
 
 // docs/get-started/06-go-live.md
-var go_live_default = "# Go live\n\nThis last step makes the newsletter yours, and tells people where to subscribe.\n\nIn this guide, you check your publication's name, add a logo, and share your subscribe link. You also see what to change as your list grows.\n\n## Before you begin\n\n- SES production access, granted in the region the app sends from. [Connect Amazon SES](04-ses.md#4-request-production-access) asks for it.\n- `SES_MAX_SEND_RATE` set to the maximum send rate on the SES **Account dashboard**, and deployed. [Connect Amazon SES](04-ses.md#7-set-the-provider-and-deploy) sets it to `1` for the sandbox.\n\nIn the sandbox, SES refuses the confirmation email to any address you haven't verified, so those signups fail. A post reaches only the addresses you verified in SES.\n\n## 1. Name your publication\n\nYour publication's name, tagline, and logo appear on the public pages readers see, and in every email. You named it in [Connect Amazon SES](04-ses.md#4-request-production-access). Check those, and add a logo before anyone sees your pages.\n\n1. In the editor, open **Settings \u2192 Publication identity**.\n\n1. Check the name and tagline, and upload a logo.\n\n1. **(Optional)** Select **Add a mailing address**. US law asks for a postal address in promotional email, and a P.O. box works. The built-in email template prints it in every email's footer.\n\n## 2. Share your subscribe link\n\nReaders subscribe on a page the app hosts. Every signup confirms by email before it joins your list.\n\n1. In the editor, open **Settings \u2192 Ways to subscribe**.\n\n1. Copy your subscribe page's link, `https://newsletter.example.com/subscribe`, and share it.\n\n1. **(Optional)** To take signups on your own website, copy the embeddable subscribe form from the same page, and paste it into your site.\n\n1. **(Optional)** Cap how often one visitor can submit the form. The app already sends any one address at most one confirmation every 15 minutes. A Cloudflare rule can also limit each visitor, and the Free plan includes one. See [Rate-limit the subscribe form](../guides/05-rate-limit.md).\n\n## As your list grows\n\nA new instance runs on Cloudflare's free Workers plan. As your list grows, two limits come into play.\n\n- **Your SES quota.** AWS caps how many emails your account sends a day. A send that hits the cap waits, and the app emails you. It resumes on its own once the quota frees up, or after AWS raises it.\n- **How fast a send goes out.** A send goes out a slice at a time, one slice a minute. SES takes one request a second, of up to 50 recipients, and no more recipients a second than your account's maximum send rate. So each request carries one second of that rate, up to 50.\n\nThe free Workers plan sends four requests a minute. At 14 messages a second, a common starting rate, that's 56 recipients a minute, and 1,000 subscribers take about 18 minutes. At 50 a second or more, it's 200 a minute.\n\nTo send faster, first ask AWS to raise your maximum send rate to 50, which costs nothing, then set [`SES_MAX_SEND_RATE`](../reference/01-configuration.md#ses_max_send_rate) to match, and deploy again. A rate above 50 adds nothing on the free plan, where a rate of 50 sends a list of about 12,000 in an hour. If a send still takes longer than you want, move to the $5 Workers Paid plan, and set [`SUBREQUEST_BUDGET`](../reference/01-configuration.md#subrequest_budget) to `10000`. It sends about 50 requests a minute: about 700 recipients at 14 a second, and about 2,500 at 50 or more.\n\n## Check it\n\n1. The SES **Account dashboard**, in the region the app sends from, no longer says your account is in the sandbox.\n\n1. `https://newsletter.example.com/subscribe` shows your publication's name and logo.\n\n1. `https://newsletter.example.com/` shows your publication's name, and the post you sent yourself in [Verify it works](05-verify.md#4-send-a-real-post-to-yourself).\n\n## What's next\n\nEach of these guides stands on its own. Pick the ones you want.\n\n- [Connect Claude to the API](../guides/01-connect-claude.md), so Claude can draft, proofread, and schedule posts through the same API the editor uses.\n- [Notifications through Cloudflare's email](../guides/03-notifications.md), so you hear about problems even when your email provider has stopped sending.\n\nWhen a new release comes out, [Upgrade to a new release](../guides/07-upgrade.md) shows how to move to it.\n";
+var go_live_default = "# Go live\n\nThis last step makes the newsletter yours, and tells people where to subscribe.\n\nIn this guide, you check your publication's name, add a logo, and share your subscribe link. You also see what to change as your list grows.\n\n## Before you begin\n\n- SES production access, granted in the region the app sends from. [Connect Amazon SES](04-ses.md#4-request-production-access) asks for it.\n- `SES_MAX_SEND_RATE` set to the maximum send rate on the SES **Account dashboard**, and deployed. [Connect Amazon SES](04-ses.md#7-set-the-provider-and-deploy) sets it to `1` for the sandbox.\n\nIn the sandbox, SES refuses the confirmation email to any address you haven't verified, so those signups fail. A post reaches only the addresses you verified in SES.\n\n## 1. Name your publication\n\nYour publication's name, tagline, and logo appear on the public pages readers see, and in every email. You named it in [Connect Amazon SES](04-ses.md#4-request-production-access). Check those, and add a logo before anyone sees your pages.\n\n1. In the editor, open **Settings \u2192 Publication identity**.\n\n1. Check the name and tagline, and upload a logo.\n\n1. **(Optional)** Select **Add a mailing address**. US law asks for a postal address in promotional email, and a P.O. box works. The built-in email template prints it in every email's footer.\n\n## 2. Share your subscribe link\n\nReaders subscribe on a page the app hosts. Every signup confirms by email before it joins your list.\n\n1. In the editor, open **Settings \u2192 Ways to subscribe**.\n\n1. Copy your subscribe page's link, `https://newsletter.example.com/subscribe`, and share it.\n\n1. **(Optional)** To take signups on your own website, copy the embeddable subscribe form from the same page, and paste it into your site.\n\n1. **(Optional)** Cap how often one visitor can submit the form. The app already sends any one address at most one confirmation every 15 minutes. A Cloudflare rule can also limit each visitor, and the Free plan includes one. See [Rate-limit the subscribe form](../guides/05-rate-limit.md).\n\n## As your list grows\n\nA new instance runs on Cloudflare's free Workers plan. As your list grows, three limits come into play.\n\n- **Your SES quota.** AWS caps how many emails your account sends a day. A send that hits the cap waits, and the app emails you. It resumes on its own once the quota frees up, or after AWS raises it.\n- **How fast a send goes out.** A send goes out a slice at a time, one slice a minute. SES takes one request a second, of up to 50 recipients, and no more recipients a second than your account's maximum send rate. So each request carries one second of that rate, up to 50.\n- **Your database's daily writes.** On the free plan, D1, the database the app runs on, allows 100,000 rows written a day. Past that, it refuses every query until midnight UTC, and the whole app stops: sends, signups, the public pages, and the editor.\n\nIt's recommended to move to the $5 Workers Paid plan from about 5,000 subscribers. A send writes about 14 database rows a recipient, delivery receipts included. So one send uses up the free plan's day at about 7,000 recipients, and sooner when an import or anything else writes that day. Workers Paid counts [D1's writes](https://developers.cloudflare.com/d1/platform/pricing/) by the month instead, with 50 million included, and never stops the database for them. On the free plan, the app warns you before a send to more than 5,000 recipients, in the Schedule dialog and on the scheduled post. It never stops you, since your account may already be on Workers Paid.\n\nThe free Workers plan sends four requests a minute. At 14 messages a second, a common starting rate, that's 56 recipients a minute, and 1,000 subscribers take about 18 minutes. At 50 a second or more, it's 200 a minute.\n\nTo send faster, first ask AWS to raise your maximum send rate to 50, which costs nothing, then set [`SES_MAX_SEND_RATE`](../reference/01-configuration.md#ses_max_send_rate) to match, and deploy again. A rate above 50 adds nothing on the free plan, where a rate of 50 sends 5,000 subscribers in about 25 minutes. A larger list belongs on Workers Paid for its database writes anyway. On Workers Paid, set [`SUBREQUEST_BUDGET`](../reference/01-configuration.md#subrequest_budget) to `10000`. It sends about 50 requests a minute: about 700 recipients at 14 a second, and about 2,500 at 50 or more.\n\n## Check it\n\n1. The SES **Account dashboard**, in the region the app sends from, no longer says your account is in the sandbox.\n\n1. `https://newsletter.example.com/subscribe` shows your publication's name and logo.\n\n1. `https://newsletter.example.com/` shows your publication's name, and the post you sent yourself in [Verify it works](05-verify.md#4-send-a-real-post-to-yourself).\n\n## What's next\n\nEach of these guides stands on its own. Pick the ones you want.\n\n- [Connect Claude to the API](../guides/01-connect-claude.md), so Claude can draft, proofread, and schedule posts through the same API the editor uses.\n- [Notifications through Cloudflare's email](../guides/03-notifications.md), so you hear about problems even when your email provider has stopped sending.\n\nWhen a new release comes out, [Upgrade to a new release](../guides/07-upgrade.md) shows how to move to it.\n";
 
 // docs/guides/01-connect-claude.md
 var connect_claude_default = '# Connect Claude to the API\n\nClaude Code can draft, edit, proofread, and schedule your posts through the same API the editor uses. It has its own Cloudflare Access credential, so its changes show as Claude\'s, not yours. Anything it schedules waits out the review window, where you can still cancel it.\n\nIn this guide, you create a service token for Claude Code, and add a policy for it to your Access application. Then you store the token where Claude Code reads it, check that it works, and point Claude at the API reference.\n\n## Before you begin\n\nYou need:\n\n- The dashboard locked with Access, from [Lock the dashboard with Access](../get-started/03-access.md).\n- [Claude Code](https://code.claude.com/docs/en/overview), run from your instance\'s repository.\n\n## 1. Create a service token\n\nA service token is a Client ID and a Client Secret that a program sends with each request. It carries no email, so the app tells it apart from your own login.\n\n1. In **Zero Trust**, go to **Access controls \u2192 Service credentials \u2192 Service Tokens**, and select **Create Service Token**.\n\n1. Name it `kestrel-claude`, and choose a **Service Token Duration**. A year is a good default.\n\n1. Select **Generate token**.\n\n1. Copy the **Client ID** and the **Client Secret**. Cloudflare shows the secret only once.\n\n## 2. Add a policy for the token\n\nYour application lets in only the people its `Publishers` policy names. A token needs a policy of its own, on the same application, because the app accepts only logins issued for that application.\n\n1. Under **Access controls \u2192 Applications**, select **Configure** on the application from [Lock the dashboard with Access](../get-started/03-access.md#2-create-the-access-application).\n\n1. Add a policy:\n\n    - **Policy name:** `Claude`\n    - **Action:** Service Auth\n    - **Include:** the **Service Token** selector, with `kestrel-claude`\n\n1. Save the application.\n\n`ACCESS_ALLOWED_EMAILS` doesn\'t apply to the token, since it has no email. This policy is the only thing that lets it in.\n\n## 3. Store the token for Claude Code\n\nClaude Code loads the `env` block of `.claude/settings.local.json` into every session. That file stays on your computer: your repository\'s `.gitignore` keeps it out of git.\n\n1. Open `.claude/settings.local.json` in your instance\'s repository. Create it if it doesn\'t exist.\n\n1. Add an `env` block, beside anything already in the file:\n\n    ```json\n    {\n      "env": {\n        "KESTREL_URL": "https://newsletter.example.com",\n        "CF_ACCESS_CLIENT_ID": "REPLACE_WITH_CLIENT_ID",\n        "CF_ACCESS_CLIENT_SECRET": "REPLACE_WITH_CLIENT_SECRET"\n      }\n    }\n    ```\n\n    `KESTREL_URL` is your app\'s address. The other two are the Client ID and Client Secret from section 1.\n\n1. Start a new Claude Code session, so it loads the values.\n\nNever put the secret in `.claude/settings.json`. That file is committed.\n\n## 4. Point Claude at the API\n\nKestrel has no plugin or connector for Claude. Claude calls the HTTP API directly, and the API reference describes every route: its method and path, the body it takes, and an example. The editor\'s **API** tab shows the same reference.\n\nYour instance\'s `.claude/CLAUDE.md` already tells Claude Code how to call the API, so a session in your instance\'s repository reads the reference before its first call. If it doesn\'t, a prompt like this one points it there:\n\n```\nKestrel\'s API is at $KESTREL_URL. Send the CF-Access-Client-Id and\nCF-Access-Client-Secret headers from your environment with every request.\nRead GET /api/reference first, and use it for every call.\n```\n\nClaude reads the reference, and from there can list your posts, write a draft, and schedule it. The reference lists the body types each route takes. Most take JSON, sent with `Content-Type: application/json`. An image upload takes a multipart form, or the image file itself.\n\n## Check it\n\n1. Ask Claude to call `GET /api/whoami`. The app answers with a program\'s identity, not yours:\n\n    ```\n    {"principal":{"kind":"service"},"auth":{"mode":"access"}}\n    ```\n\n1. Ask Claude to list your posts. It answers with the posts the editor shows.\n\n1. Open a draft in the editor, and ask Claude to change a word in it. The editor shows that the draft was changed elsewhere, last edited by **Claude**.\n\nIf Claude gets a `401`, a `403`, or a login page, check the policy from section 2, and the token\'s two values in `.claude/settings.local.json`. Check that the token hasn\'t expired, too.\n';
@@ -4945,14 +5663,17 @@ var upgrade_default = "# Upgrade to a new release\n\nA new release of Kestrel is
 var try_locally_default = "# Try Kestrel locally first\n\nYou can run Kestrel on your own computer to look around before you deploy it. It needs no Cloudflare account and no Git host. Email goes to a stand-in on your computer, so nothing reaches a real inbox.\n\nIn this guide, you write a new instance into an empty folder, start the app, and open the editor. Then you fill it with a demo publication, and empty it again. The folder can become your instance's repository later.\n\n## Before you begin\n\n- [Node.js](https://nodejs.org/) 22 or later\n\n## 1. Write a new instance\n\nAn instance is a small folder of your own. It holds the instance's settings and names the release of Kestrel it runs, which installs from npm as `@kurtbruns/kestrel`.\n\n1. Make an empty folder, and go into it:\n\n    ```bash\n    mkdir newsletter\n    cd newsletter\n    ```\n\n1. Write a new instance into it:\n\n    ```bash\n    npx @kurtbruns/kestrel init\n    ```\n\n    It writes the instance's files, and lists the commands to run next. The folder doesn't need to be a Git repository.\n\n1. Install the release and its tools:\n\n    ```bash\n    npm install\n    ```\n\n## 2. Start the app\n\n1. Copy the local settings:\n\n    ```bash\n    cp .dev.vars.example .dev.vars\n    ```\n\n    They're for your computer only, and send email to the stand-in.\n\n1. Start the app:\n\n    ```bash\n    npm run dev\n    ```\n\n    The first time, it creates the local database and asks you to confirm its migrations. Answer yes. The server keeps running in this terminal, and its output ends with the address it's ready on.\n\n1. Open http://localhost:8787/dashboard/ to see the editor. There's nothing to sign in with on your computer. If another app already uses port 8787, Kestrel picks a free port instead, and the `Ready on` line shows it.\n\n## 3. Load the demo publication\n\nThe demo fills the editor with posts, subscribers, and sends that already went out, so you can see the app in use.\n\n1. In a second terminal, in the same folder, load the demo:\n\n    ```bash\n    npm run seed\n    ```\n\n    It replaces everything in the local database, and lists links to the editor and the demo's published posts.\n\n1. To empty the local database again, and see the app as a new instance starts:\n\n    ```bash\n    npm run reset\n    ```\n\n1. To stop the server, press <kbd>Ctrl</kbd>+<kbd>C</kbd> in its terminal. Your local content stays for the next `npm run dev`.\n\n## Check it\n\n1. The app answers. If `npm run dev` picked another port, use the one on its `Ready on` line here and below:\n\n    ```bash\n    curl http://localhost:8787/health\n    ```\n\n    ```\n    {\"status\":\"ok\",\"service\":\"kestrel\"}\n    ```\n\n1. After `npm run seed`, http://localhost:8787/ shows the demo publication's public landing page, with its posts.\n\n## Keep the folder for your instance\n\nIf you came here from Deploy the app, your folder is already a repository: go back to [Sign in to Cloudflare](../get-started/02-deploy.md#2-sign-in-to-cloudflare).\n\nWhen you're ready to deploy, this folder can be your instance's repository. You need [Git](https://git-scm.com/) and a GitHub account for this part. The folder's `.gitignore` already keeps your local settings, the local database, and the installed packages out of it.\n\n1. On GitHub, [create a new repository](https://github.com/new) named `newsletter`. It can be private. Leave it empty, with no README, license, or `.gitignore`.\n\n1. Make the folder a repository, and commit the instance. Replace `YOUR_USERNAME` with your GitHub username:\n\n    ```bash\n    git init\n    git add -A\n    git commit -m \"Start a Kestrel instance\"\n    git remote add origin https://github.com/YOUR_USERNAME/newsletter.git\n    git push -u origin HEAD\n    ```\n\nThen check [what deploying needs](../get-started/02-deploy.md#before-you-begin) and [choose your hostnames](../get-started/02-deploy.md#choose-your-hostnames). Then [deploy the app](../get-started/02-deploy.md#2-sign-in-to-cloudflare) from signing in to Cloudflare onward.\n";
 
 // docs/README.md
-var README_default = "# Set up and run Kestrel\n\nThese guides deploy and run your own instance of Kestrel, from an empty repository to a newsletter on your own Cloudflare account.\n\n## Get started\n\nFollow these steps, from an empty repository to a live newsletter. Each one ends with a check, so you know it worked before you move on.\n\n1. [Deploy the app](get-started/02-deploy.md)\n1. [Lock the dashboard with Access](get-started/03-access.md)\n1. [Connect Amazon SES](get-started/04-ses.md)\n1. [Verify it works](get-started/05-verify.md)\n1. [Go live](get-started/06-go-live.md)\n\n## Guides\n\nEach one stands on its own. Pick the ones you need.\n\n- [Connect Claude to the API](guides/01-connect-claude.md)\n- [Try Kestrel locally first](guides/08-try-locally.md)\n- [Notifications through Cloudflare's email](guides/03-notifications.md)\n- [Rate-limit the subscribe form](guides/05-rate-limit.md)\n- [Upgrade to a new release](guides/07-upgrade.md)\n\n## Reference\n\nThe detail behind the steps, for when you need it.\n\n- [Configuration](reference/01-configuration.md)\n- [Sending-domain DNS](reference/02-sending-domain-dns.md)\n";
+var README_default = "# Set up and run Kestrel\n\nThese guides deploy and run your own instance of Kestrel, from an empty repository to a newsletter on your own Cloudflare account.\n\n## Get started\n\nFollow these steps, from an empty repository to a live newsletter. Each one ends with a check, so you know it worked before you move on.\n\n1. [Deploy the app](get-started/02-deploy.md)\n1. [Lock the dashboard with Access](get-started/03-access.md)\n1. [Connect Amazon SES](get-started/04-ses.md)\n1. [Verify it works](get-started/05-verify.md)\n1. [Go live](get-started/06-go-live.md)\n\n## Guides\n\nEach one stands on its own. Pick the ones you need.\n\n- [Connect Claude to the API](guides/01-connect-claude.md)\n- [Try Kestrel locally first](guides/08-try-locally.md)\n- [Notifications through Cloudflare's email](guides/03-notifications.md)\n- [Rate-limit the subscribe form](guides/05-rate-limit.md)\n- [Upgrade to a new release](guides/07-upgrade.md)\n\n## Reference\n\nThe detail behind the steps, for when you need it.\n\n- [Configuration](reference/01-configuration.md)\n- [Sending-domain DNS](reference/02-sending-domain-dns.md)\n- [Import format](reference/03-import-format.md)\n";
 
 // docs/reference/01-configuration.md
-var configuration_default = "# Configuration\n\nEvery deploy-time setting: what it does, its default, and what the app refuses. Each environment's settings live in its block under `env` in `wrangler.jsonc`, and its secrets in Cloudflare.\n\n- **Vars** are public values in the block's `vars`, safe to commit. A change takes effect when you deploy.\n- **Secrets** are stored with `npx wrangler secret put NAME --env production`, and never committed. A secret takes effect as soon as you store it, with no redeploy.\n- **Bindings and triggers** connect the Worker to its database, its image bucket, and its schedule.\n\nIn local development, `npm run dev` reads the top level of `wrangler.jsonc` and `.dev.vars`, which you copy from `.dev.vars.example`. Restart it after you change either.\n\nNone of these can be read or changed from inside the app, by the editor or by Claude. Settings in the editor shows the public ones, read-only.\n\n## Vars\n\n| Var | What it is | Default |\n| --- | --- | --- |\n| `PROVIDER` | the email provider: `ses`, or `fake` for local development | none: no provider connected |\n| `APP_ORIGIN` | the origin the app is served from: scheme and host, no path | required |\n| `ARCHIVE_BASE_PATH` | the path the archive lives under | `/archive` |\n| `FROM_ADDRESS` | the `From:` of every email | required with a real provider |\n| `SENDING_DOMAIN` | the sending domain, shown in Settings | none |\n| `AWS_REGION` | the SES region | `us-east-1` in the template, required with SES |\n| `SES_MAX_SEND_RATE` | your SES account's maximum send rate, in messages a second | `14` |\n| `SUBREQUEST_BUDGET` | how many subrequests one minute's send work may use | `50` |\n| `MIN_LEAD_SECONDS` | the least time every send stays cancelable before it goes out | `300` |\n| `ARCHIVE_ORIGIN` | the origin archive links use, to put the archive on your website | `APP_ORIGIN` |\n| `MEDIA_PUBLIC_BASE` | the base URL images are served from | `APP_ORIGIN` + `/media` |\n| `NOTIFY_FROM` | the sender of notifications through Cloudflare's email | `Kestrel <kestrel@` + the app's hostname + `>` |\n| `ALLOW_FAKE_PROVIDER` | `true` lets `fake` run on a real hostname, for a demo that mails no one on purpose | unset |\n\n### `PROVIDER`\n\nUntil it's set, or while it's empty, the app runs with no provider connected. You can write and preview posts, but everything that would send email is refused: scheduling, sending now, test emails, and the confirmation emails that signups need. The subscribe page says signups aren't open yet, and Settings shows **No email provider connected**. Setting it to `none` means the same. A new instance's `production` block declares it empty, `\"PROVIDER\": \"\"`, so wrangler doesn't warn that the top level's value is missing there. [Connect Amazon SES](../get-started/04-ses.md) changes it to `ses`.\n\n`fake` delivers nothing. It records a send as if every recipient accepted it. Local development runs on it, and names it on purpose in the top level of `wrangler.jsonc`. Never copy it into `production`, whatever wrangler suggests: every subscriber would be recorded as sent the post, and never get it. The app refuses `fake` unless `APP_ORIGIN` is on `localhost` or `127.0.0.1`. A hosted demo that runs `fake` on a real hostname on purpose sets `ALLOW_FAKE_PROVIDER` to `true`, which no other deployment needs, and which no other provider reads.\n\n### `FROM_ADDRESS` and `SENDING_DOMAIN`\n\n`FROM_ADDRESS` is the only address mail is sent from, and the identity your provider authenticates. `SENDING_DOMAIN` is for display: Settings shows it beside the From address. The app never checks that the two match, so set `SENDING_DOMAIN` to the part of `FROM_ADDRESS` after the `@`.\n\nNeither one is your publication's name, tagline, or logo. You set those in the editor, under **Settings \u2192 Publication identity**. Until you do, the From address's display name stands in for the name, and with neither, your emails and reader pages show no name at all.\n\n### `ARCHIVE_BASE_PATH`\n\nEvery post you send carries its archive link, `ARCHIVE_BASE_PATH` followed by the post's slug, and those links are permanent. Changing the prefix later breaks every link already mailed, so pick it before your first send. To keep links from an older install working, set it to the prefix they use, such as `/newsletter`.\n\nA missing leading slash is added, and a trailing slash is dropped.\n\n### `SES_MAX_SEND_RATE`\n\nThe app sends SES one request a second, the most SES takes, and each request carries one second of this rate, up to 50 recipients. Set it to the maximum send rate on your SES **Account dashboard**. To send faster, ask AWS to raise that rate to 50 before you move to Workers Paid: on Workers Free, a rate of 50 sends nearly four times as many recipients a minute as 14, and a higher rate adds nothing there. That's `1` in the sandbox, and whatever AWS grants after that. The default, 14, is a common starting rate, not your account's.\n\nA rate set too high only means SES throttles some requests. Those recipients wait for the next minute, and no one is mailed twice.\n\n### `SUBREQUEST_BUDGET`\n\nCloudflare caps how many subrequests one run of a Worker may make. Database queries and outbound requests both count. It also caps database queries alone: 50 a run on Workers Free, and 1,000 on Workers Paid. Each minute's send work is one run, so a large send goes out over several minutes, each stopping short of both caps.\n\nThis setting is the subrequest cap. The app keeps database queries under theirs on its own.\n\n- **The default, 50,** is the Workers Free limit, and safe on any plan. A minute sends four SES requests: 56 recipients at a send rate of 14, and 200 at a rate of 50 or more.\n- **On Workers Paid,** which allows 10,000, set `\"SUBREQUEST_BUDGET\": \"10000\"`. A minute then sends about 50 SES requests, one a second: about 700 recipients at a rate of 14, and about 2,500 at 50 or more.\n- **If you raised the Worker's own limit** with `limits.subrequests`, you may set this to match.\n\nNever set it above your plan's limit. A minute that hits the cap is cut off mid-batch, and the send stalls until a later minute picks it up. A value below 30 is raised to 30, the least a minute needs to send anything and still send a notification.\n\n### `MIN_LEAD_SECONDS`\n\nEvery send stays visible and cancelable for at least this long before it goes out, whether it's scheduled, sent now, or moved. It's the window to catch a mistake, including one in a send Claude prepared.\n\nThe floor is 60, since sends go out from a once-a-minute schedule. The ceiling is 86400, one day. It's the least wait before every send, not a limit on how far ahead you can schedule. It lives in deploy config on purpose, so neither the editor nor Claude can shorten it.\n\n### `ARCHIVE_ORIGIN` and `MEDIA_PUBLIC_BASE`\n\nLeave them unset to keep everything on the app's own hostname.\n\n`ARCHIVE_ORIGIN` points archive links at another origin, such as your website, `https://example.com`. The app doesn't answer there on its own. A Worker route on that domain, such as `example.com/archive*` in the environment's `routes`, sends the archive path to the app. Links already mailed keep working, since the app still answers on its own hostname.\n\n`MEDIA_PUBLIC_BASE` serves images from another base URL, such as a custom domain on the image bucket. The app's own `/media` path sends `Content-Security-Policy: sandbox` and `X-Content-Type-Options: nosniff` with every file, so a file in the bucket never runs as a page. A bucket's custom domain sends neither, so add both with a Response Header Transform Rule on that hostname.\n\n### `NOTIFY_FROM`\n\nUsed only with the `NOTIFY` binding. It must be an address on a domain set up for Cloudflare's email. Without the binding, notifications come from `FROM_ADDRESS`, through your email provider.\n\n## Secrets\n\n| Secret | What it is | Needed for |\n| --- | --- | --- |\n| `ACCESS_TEAM_DOMAIN` | your Zero Trust team domain, such as `your-team.cloudflareaccess.com`; an `https://` or trailing slash is dropped | every deployment |\n| `ACCESS_AUD` | the Access application's audience tag | every deployment |\n| `ACCESS_ALLOWED_EMAILS` | a comma-separated list of the people allowed to sign in | optional |\n| `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` | the IAM user's access key | SES |\n| `SNS_TOPIC_ARN` | the SNS topic the SES webhook accepts; it refuses every other topic | SES |\n| `SES_CONFIGURATION_SET` | the configuration set named on every email, so SES reports bounces and complaints | SES, recommended |\n\n`ACCESS_ALLOWED_EMAILS` applies to people only. A service token, such as the one Claude uses, carries no email, so the Access policy alone decides whether it gets in.\n\nNever set `DEV_AUTH_SECRET` on a deployed environment. It's local development's stand-in for Access, and a deployed instance ignores it anyway. The app honors it only when the environment looks like local development: `PROVIDER` is `fake`, Access isn't set up, and `APP_ORIGIN` is on `localhost` or `127.0.0.1`. A real provider, Access, or a real hostname each turns it off, and Access becomes the only way in.\n\n## Bindings and triggers\n\nWrangler doesn't carry bindings or vars over from the top level of `wrangler.jsonc` to an environment. Each environment's block declares its own.\n\n| Setting | What it is | Default |\n| --- | --- | --- |\n| `name` | the Worker's name, such as `kestrel-production` | required |\n| `routes` | the app's hostname, attached on deploy, and any route on your website | required |\n| `workers_dev`, `preview_urls` | the Worker's `workers.dev` and preview addresses | `false` in the template |\n| `triggers.crons` | the once-a-minute schedule, `* * * * *` | required |\n| `observability` | Workers Logs, where the app's log lines land | on |\n| `d1_databases`, binding `DB` | the database: posts, subscribers, sends, and settings | required |\n| `r2_buckets`, binding `MEDIA` | the bucket for images and your logo | required |\n| `send_email`, binding `NOTIFY` | Cloudflare's email, for notifications | none |\n\n### `routes`, `workers_dev`, and `preview_urls`\n\nThe template turns off the `workers.dev` addresses, so the app answers only on your hostname. That's where your Access application and any rate-limiting rule apply. Each deploy replaces the Worker's routes with the ones in the file, so add a route here, never in the dashboard.\n\n### `triggers.crons`\n\nThe schedule runs every minute. It sends whatever is due, and the notifications about it. Without it, nothing scheduled ever goes out.\n\n### `observability`\n\nEvery invocation is logged, with no sampling. Sampling could drop the one minute that reports a stuck or missed send.\n\n### `NOTIFY`\n\nWhen declared, notifications go through Cloudflare's email instead of your provider, so they still arrive when your provider refuses your account. Local development ignores it, and sends notifications to a stand-in that delivers nothing.\n\n## What the app refuses\n\nThe app checks its configuration on every request. It refuses to run on one that would do the wrong thing quietly:\n\n- `PROVIDER`, when set, must be exactly `ses`, `fake`, or `none`. A misspelling, or `SES`, is refused, never taken for another. `resend`, which earlier releases supported, is refused with a pointer to [Connect Amazon SES](../get-started/04-ses.md#switch-an-instance-that-already-sends).\n- `fake` runs only when `APP_ORIGIN` is on `localhost` or `127.0.0.1`, unless `ALLOW_FAKE_PROVIDER` is `true`. On a real hostname it would open signups whose confirmations go nowhere, and record every send as delivered. With `fake`, `ALLOW_FAKE_PROVIDER`, when set, must be `true`; every other provider ignores it.\n- `APP_ORIGIN` must be a plain `http` or `https` origin, with no path. So must `ARCHIVE_ORIGIN`, when set. `MEDIA_PUBLIC_BASE`, when set, must be a plain `http` or `https` URL, and may have a path. A trailing slash is dropped from each.\n- A real provider needs `FROM_ADDRESS`, and every secret the table marks for it. SES also needs `AWS_REGION`. `FROM_ADDRESS` must then be an email address, optionally with a display name in front, like `Name <address>`.\n- None of `APP_ORIGIN`, `ARCHIVE_ORIGIN`, `MEDIA_PUBLIC_BASE`, `SENDING_DOMAIN`, or `FROM_ADDRESS` may still be on `example.com` or a name under it, the template's placeholder. That holds with no provider connected too, since every link the app builds would name it. Only `fake` allows it.\n- `SUBREQUEST_BUDGET`, `MIN_LEAD_SECONDS`, and `SES_MAX_SEND_RATE` must be whole numbers above zero. `MIN_LEAD_SECONDS` must also be within its bounds. Any other value is refused, never adjusted. The one exception is a `SUBREQUEST_BUDGET` below 30, which is raised to 30.\n- In local development, `SIMULATE_SENDS` must be off (`off`, `0`, `false`, `no`, or empty), `not-connected` to run as a deployment with no email provider yet, or the provider a local send models: `ses` or `generic` (also `1`, `on`, `true`, or `yes`), optionally followed by `:none` for no injected failures or `:realistic`, the default. Case doesn't matter. A deployed instance ignores it.\n- `ACCESS_TEAM_DOMAIN` and `ACCESS_AUD` are set together or not at all. With only one, the app could verify no sign-in and would let no one into the editor, so it refuses and names the missing one. `ACCESS_TEAM_DOMAIN` must be your team's hostname, such as `your-team.cloudflareaccess.com`. An `https://` or `http://` in front and a trailing slash are dropped, but anything else, such as a path or a port, is refused, since it would fail every sign-in.\n\nUntil it's fixed, no sends go out, and each place says what its reader can act on:\n\n- **The editor** shows a page naming the setting, what's wrong with it, and how to fix it, with a link to its section here. Its own Docs tab can't load until then, so the link opens the project's site.\n- **The API**, `/health`, and the webhooks answer `500` with a body naming the variable, such as `{\"error\":\"invalid_config\",\"message\":\u2026,\"variable\":\"APP_ORIGIN\"}`.\n- **The public pages readers see** answer `503` with a page saying the newsletter is temporarily unavailable. It names no setting.\n- **The Worker's log** records it as `config.invalid`.\n";
+var configuration_default = "# Configuration\n\nEvery deploy-time setting: what it does, its default, and what the app refuses. Each environment's settings live in its block under `env` in `wrangler.jsonc`, and its secrets in Cloudflare.\n\n- **Vars** are public values in the block's `vars`, safe to commit. A change takes effect when you deploy.\n- **Secrets** are stored with `npx wrangler secret put NAME --env production`, and never committed. A secret takes effect as soon as you store it, with no redeploy.\n- **Bindings and triggers** connect the Worker to its database, its image bucket, and its schedule.\n\nIn local development, `npm run dev` reads the top level of `wrangler.jsonc` and `.dev.vars`, which you copy from `.dev.vars.example`. Restart it after you change either.\n\nNone of these can be read or changed from inside the app, by the editor or by Claude. Settings in the editor shows the public ones, read-only.\n\n## Vars\n\n| Var | What it is | Default |\n| --- | --- | --- |\n| `PROVIDER` | the email provider: `ses`, or `fake` for local development | none: no provider connected |\n| `APP_ORIGIN` | the origin the app is served from: scheme and host, no path | required |\n| `ARCHIVE_BASE_PATH` | the path the archive lives under | `/archive` |\n| `FROM_ADDRESS` | the `From:` of every email | required with a real provider |\n| `SENDING_DOMAIN` | the sending domain, shown in Settings | none |\n| `AWS_REGION` | the SES region | `us-east-1` in the template, required with SES |\n| `SES_MAX_SEND_RATE` | your SES account's maximum send rate, in messages a second | `14` |\n| `SUBREQUEST_BUDGET` | how many subrequests one minute's send work may use | `50` |\n| `MIN_LEAD_SECONDS` | the least time every send stays cancelable before it goes out | `300` |\n| `ARCHIVE_ORIGIN` | the origin archive links use, to put the archive on your website | `APP_ORIGIN` |\n| `MEDIA_PUBLIC_BASE` | the base URL images are served from | `APP_ORIGIN` + `/media` |\n| `NOTIFY_FROM` | the sender of notifications through Cloudflare's email | `Kestrel <kestrel@` + the app's hostname + `>` |\n| `ALLOW_FAKE_PROVIDER` | `true` lets `fake` run on a real hostname, for a demo that mails no one on purpose | unset |\n\n### `PROVIDER`\n\nUntil it's set, or while it's empty, the app runs with no provider connected. You can write and preview posts, but everything that would send email is refused: scheduling, sending now, test emails, and the confirmation emails that signups need. The subscribe page says signups aren't open yet, and Settings shows **No email provider connected**. Setting it to `none` means the same. A new instance's `production` block declares it empty, `\"PROVIDER\": \"\"`, so wrangler doesn't warn that the top level's value is missing there. [Connect Amazon SES](../get-started/04-ses.md) changes it to `ses`.\n\n`fake` delivers nothing. It records a send as if every recipient accepted it. Local development runs on it, and names it on purpose in the top level of `wrangler.jsonc`. Never copy it into `production`, whatever wrangler suggests: every subscriber would be recorded as sent the post, and never get it. The app refuses `fake` unless `APP_ORIGIN` is on `localhost` or `127.0.0.1`. A hosted demo that runs `fake` on a real hostname on purpose sets `ALLOW_FAKE_PROVIDER` to `true`, which no other deployment needs, and which no other provider reads.\n\n### `FROM_ADDRESS` and `SENDING_DOMAIN`\n\n`FROM_ADDRESS` is the only address mail is sent from, and the identity your provider authenticates. `SENDING_DOMAIN` is for display: Settings shows it beside the From address. The app never checks that the two match, so set `SENDING_DOMAIN` to the part of `FROM_ADDRESS` after the `@`.\n\nNeither one is your publication's name, tagline, or logo. You set those in the editor, under **Settings \u2192 Publication identity**. Until you do, the From address's display name stands in for the name, and with neither, your emails and reader pages show no name at all.\n\n### `ARCHIVE_BASE_PATH`\n\nEvery post you send carries its archive link, `ARCHIVE_BASE_PATH` followed by the post's slug, and those links are permanent. Changing the prefix later breaks every link already mailed, so pick it before your first send. To keep links from an older install working, set it to the prefix they use, such as `/newsletter`.\n\nA missing leading slash is added, and a trailing slash is dropped.\n\n### `SES_MAX_SEND_RATE`\n\nThe app sends SES one request a second, the most SES takes, and each request carries one second of this rate, up to 50 recipients. Set it to the maximum send rate on your SES **Account dashboard**. To send faster, ask AWS to raise that rate to 50 before you move to Workers Paid: on Workers Free, a rate of 50 sends nearly four times as many recipients a minute as 14, and a higher rate adds nothing there. That's `1` in the sandbox, and whatever AWS grants after that. The default, 14, is a common starting rate, not your account's.\n\nA rate set too high only means SES throttles some requests. Those recipients wait for the next minute, and no one is mailed twice.\n\n### `SUBREQUEST_BUDGET`\n\nCloudflare caps how many subrequests one run of a Worker may make. Database queries and outbound requests both count. It also caps database queries alone: 50 a run on Workers Free, and 1,000 on Workers Paid. Each minute's send work is one run, so a large send goes out over several minutes, each stopping short of both caps.\n\nThis setting is the subrequest cap. The app keeps database queries under theirs on its own.\n\n- **The default, 50,** is the Workers Free limit, and safe on any plan. A minute sends four SES requests: 56 recipients at a send rate of 14, and 200 at a rate of 50 or more.\n- **On Workers Paid,** which allows 10,000, set `\"SUBREQUEST_BUDGET\": \"10000\"`. A minute then sends about 50 SES requests, one a second: about 700 recipients at a rate of 14, and about 2,500 at 50 or more.\n- **If you raised the Worker's own limit** with `limits.subrequests`, you may set this to match.\n\nIt's also how the app tells Workers Free from Workers Paid. At the default, the app runs on Free's limits:\n\n- One import takes up to 1,000 rows, since Free's 10 ms of CPU a request can't plan and commit more. Above it, up to 10,000 ([Import format](03-import-format.md#limits)).\n- An export reads 1,000 rows a page. Above it, 10,000.\n- The app warns before a send to more than 5,000 recipients, and after an import plan that leaves more than 3,000 confirmed subscribers. Either may use up D1's daily allowance of 100,000 rows written, which stops the app until midnight UTC ([As your list grows](../get-started/06-go-live.md#as-your-list-grows)). Neither warning stops you. Above the default, neither appears.\n\nNever set it above your plan's limit. A minute that hits the cap is cut off mid-batch, and the send stalls until a later minute picks it up. A value below 30 is raised to 30, the least a minute needs to send anything and still send a notification.\n\n### `MIN_LEAD_SECONDS`\n\nEvery send stays visible and cancelable for at least this long before it goes out, whether it's scheduled, sent now, or moved. It's the window to catch a mistake, including one in a send Claude prepared.\n\nThe floor is 60, since sends go out from a once-a-minute schedule. The ceiling is 86400, one day. It's the least wait before every send, not a limit on how far ahead you can schedule. It lives in deploy config on purpose, so neither the editor nor Claude can shorten it.\n\n### `ARCHIVE_ORIGIN` and `MEDIA_PUBLIC_BASE`\n\nLeave them unset to keep everything on the app's own hostname.\n\n`ARCHIVE_ORIGIN` points archive links at another origin, such as your website, `https://example.com`. The app doesn't answer there on its own. A Worker route on that domain, such as `example.com/archive*` in the environment's `routes`, sends the archive path to the app. Links already mailed keep working, since the app still answers on its own hostname.\n\n`MEDIA_PUBLIC_BASE` serves images from another base URL, such as a custom domain on the image bucket. The app's own `/media` path sends `Content-Security-Policy: sandbox` and `X-Content-Type-Options: nosniff` with every file, so a file in the bucket never runs as a page. A bucket's custom domain sends neither, so add both with a Response Header Transform Rule on that hostname.\n\n### `NOTIFY_FROM`\n\nUsed only with the `NOTIFY` binding. It must be an address on a domain set up for Cloudflare's email. Without the binding, notifications come from `FROM_ADDRESS`, through your email provider.\n\n## Secrets\n\n| Secret | What it is | Needed for |\n| --- | --- | --- |\n| `ACCESS_TEAM_DOMAIN` | your Zero Trust team domain, such as `your-team.cloudflareaccess.com`; an `https://` or trailing slash is dropped | every deployment |\n| `ACCESS_AUD` | the Access application's audience tag | every deployment |\n| `ACCESS_ALLOWED_EMAILS` | a comma-separated list of the people allowed to sign in | optional |\n| `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` | the IAM user's access key | SES |\n| `SNS_TOPIC_ARN` | the SNS topic the SES webhook accepts; it refuses every other topic | SES |\n| `SES_CONFIGURATION_SET` | the configuration set named on every email, so SES reports bounces and complaints; a name SES can't find in the region holds every list send until it's fixed | SES, recommended |\n\n`ACCESS_ALLOWED_EMAILS` applies to people only. A service token, such as the one Claude uses, carries no email, so the Access policy alone decides whether it gets in.\n\nNever set `DEV_AUTH_SECRET` on a deployed environment. It's local development's stand-in for Access, and a deployed instance ignores it anyway. The app honors it only when the environment looks like local development: `PROVIDER` is `fake`, Access isn't set up, and `APP_ORIGIN` is on `localhost` or `127.0.0.1`. A real provider, Access, or a real hostname each turns it off, and Access becomes the only way in.\n\n## Bindings and triggers\n\nWrangler doesn't carry bindings or vars over from the top level of `wrangler.jsonc` to an environment. Each environment's block declares its own.\n\n| Setting | What it is | Default |\n| --- | --- | --- |\n| `name` | the Worker's name, such as `kestrel-production` | required |\n| `routes` | the app's hostname, attached on deploy, and any route on your website | required |\n| `workers_dev`, `preview_urls` | the Worker's `workers.dev` and preview addresses | `false` in the template |\n| `triggers.crons` | the once-a-minute schedule, `* * * * *` | required |\n| `observability` | Workers Logs, where the app's log lines land | on |\n| `d1_databases`, binding `DB` | the database: posts, subscribers, sends, and settings | required |\n| `r2_buckets`, binding `MEDIA` | the bucket for images and your logo | required |\n| `send_email`, binding `NOTIFY` | Cloudflare's email, for notifications | none |\n\n### `routes`, `workers_dev`, and `preview_urls`\n\nThe template turns off the `workers.dev` addresses, so the app answers only on your hostname. That's where your Access application and any rate-limiting rule apply. Each deploy replaces the Worker's routes with the ones in the file, so add a route here, never in the dashboard.\n\n### `triggers.crons`\n\nThe schedule runs every minute. It sends whatever is due, and the notifications about it. Without it, nothing scheduled ever goes out.\n\n### `observability`\n\nEvery invocation is logged, with no sampling. Sampling could drop the one minute that reports a stuck or missed send.\n\n### `NOTIFY`\n\nWhen declared, notifications go through Cloudflare's email instead of your provider, so they still arrive when your provider refuses your account. Local development ignores it, and sends notifications to a stand-in that delivers nothing.\n\n## What the app refuses\n\nThe app checks its configuration on every request. It refuses to run on one that would do the wrong thing quietly:\n\n- `PROVIDER`, when set, must be exactly `ses`, `fake`, or `none`. A misspelling, or `SES`, is refused, never taken for another. `resend`, which earlier releases supported, is refused with a pointer to [Connect Amazon SES](../get-started/04-ses.md#switch-an-instance-that-already-sends).\n- `fake` runs only when `APP_ORIGIN` is on `localhost` or `127.0.0.1`, unless `ALLOW_FAKE_PROVIDER` is `true`. On a real hostname it would open signups whose confirmations go nowhere, and record every send as delivered. With `fake`, `ALLOW_FAKE_PROVIDER`, when set, must be `true`; every other provider ignores it.\n- `APP_ORIGIN` must be a plain `http` or `https` origin, with no path. So must `ARCHIVE_ORIGIN`, when set. `MEDIA_PUBLIC_BASE`, when set, must be a plain `http` or `https` URL, and may have a path. A trailing slash is dropped from each.\n- A real provider needs `FROM_ADDRESS`, and every secret the table marks for it. SES also needs `AWS_REGION`. `FROM_ADDRESS` must then be an email address, optionally with a display name in front, like `Name <address>`.\n- None of `APP_ORIGIN`, `ARCHIVE_ORIGIN`, `MEDIA_PUBLIC_BASE`, `SENDING_DOMAIN`, or `FROM_ADDRESS` may still be on `example.com` or a name under it, the template's placeholder. That holds with no provider connected too, since every link the app builds would name it. Only `fake` allows it.\n- `SUBREQUEST_BUDGET`, `MIN_LEAD_SECONDS`, and `SES_MAX_SEND_RATE` must be whole numbers above zero. `MIN_LEAD_SECONDS` must also be within its bounds. Any other value is refused, never adjusted. The one exception is a `SUBREQUEST_BUDGET` below 30, which is raised to 30.\n- In local development, `SIMULATE_SENDS` must be off (`off`, `0`, `false`, `no`, or empty), `not-connected` to run as a deployment with no email provider yet, or the provider a local send models: `ses` or `generic` (also `1`, `on`, `true`, or `yes`), optionally followed by `:none` for no injected failures or `:realistic`, the default. Case doesn't matter. A deployed instance ignores it.\n- `ACCESS_TEAM_DOMAIN` and `ACCESS_AUD` are set together or not at all. With only one, the app could verify no sign-in and would let no one into the editor, so it refuses and names the missing one. `ACCESS_TEAM_DOMAIN` must be your team's hostname, such as `your-team.cloudflareaccess.com`. An `https://` or `http://` in front and a trailing slash are dropped, but anything else, such as a path or a port, is refused, since it would fail every sign-in.\n\nUntil it's fixed, no sends go out, and each place says what its reader can act on:\n\n- **The editor** shows a page naming the setting, what's wrong with it, and how to fix it, with a link to its section here. Its own Docs tab can't load until then, so the link opens the project's site.\n- **The API**, `/health`, and the webhooks answer `500` with a body naming the variable, such as `{\"error\":\"invalid_config\",\"message\":\u2026,\"variable\":\"APP_ORIGIN\"}`.\n- **The public pages readers see** answer `503` with a page saying the newsletter is temporarily unavailable. It names no setting.\n- **The Worker's log** records it as `config.invalid`.\n";
 
 // docs/reference/02-sending-domain-dns.md
 var sending_domain_dns_default = "# Sending-domain DNS\n\nInboxes decide whether to trust your mail by checking records in the DNS of the domain it comes from. This page explains the three checks they run: SPF, DKIM, and DMARC. It covers the records [Connect Amazon SES](../get-started/04-ses.md) has you add, what each proves, how to check them, and when to tighten DMARC.\n\n## Why all three\n\nGmail requires every sender to pass SPF or DKIM. A sender of more than 5,000 messages a day to Gmail must have all three:\n\n- SPF and DKIM, both passing.\n- A DMARC record, with a policy of at least `p=none`.\n- Alignment: the domain in the `From:` header matches the SPF domain or the DKIM domain.\n\nGmail also requires one-click unsubscribe for such senders. Kestrel adds the `List-Unsubscribe` and `List-Unsubscribe-Post` headers to every email, so that part needs nothing from you. [Google's sender guidelines](https://support.google.com/a/answer/81126) list the rest.\n\nA small list may never reach 5,000 a day, but the same checks decide whether mail lands in the inbox. Make sure all three pass from the start.\n\n## Choose your sending name\n\n- **Send from a subdomain.** It's recommended to send from a subdomain such as `send.example.com`, rather than from `example.com` itself. Your apex domain carries the reputation of your regular email, and a newsletter shouldn't put that at risk.\n- **Keep the app's name and the mail's name distinct.** The app and its public pages live at `newsletter.example.com`, and mail comes from `send.example.com`. Avoid `mail.` as the sending name, since mail servers read `mail.example.com` as a host that receives mail.\n\n## The records\n\nEvery record lives in your domain's DNS, `example.com`, under the sending name. In Cloudflare, a record's name leaves off your domain, so `_dmarc.send.example.com` is entered as `_dmarc.send`.\n\nSES generates the DKIM values. Copy them exactly as SES lists them, since they differ by account and region. You write the DMARC record yourself.\n\nSPF needs no record of yours on SES's default path, since it passes for a subdomain of `amazonses.com`. An SPF record, at `bounce.send`, comes only with the optional custom MAIL FROM domain.\n\n### SPF: authorize the return path\n\nSPF checks the message's return path, the address bounces go back to, not its `From:` header. DMARC passes when SPF or DKIM passes and aligns with the `From:` domain. DKIM aligns, so an aligned SPF is a second check in your favor, not a requirement.\n\nSES uses a subdomain of its own domain, `amazonses.com`, as the return path by default. SPF then passes for it but doesn't align, and DMARC passes through DKIM alone. A custom MAIL FROM domain, such as `bounce.send.example.com`, aligns SPF too. [Connect Amazon SES](../get-started/04-ses.md#3-optional-set-a-custom-mail-from-domain) sets one up, with an MX record that names your region and an SPF record:\n\n```\nbounce.send.example.com.  MX   10 feedback-smtp.us-east-1.amazonses.com.\nbounce.send.example.com.  TXT  \"v=spf1 include:amazonses.com ~all\"\n```\n\nA name holds one SPF record. If one already exists there, add `include:amazonses.com` to it rather than adding a second.\n\n### DKIM: let the provider sign\n\nDKIM signs each message with a key your DNS publishes. An inbox checks the signature to tell the message came from you, unchanged.\n\nSES lists three `CNAME` records, each at `TOKEN._domainkey.send.example.com`. Their targets depend on your region and account, so copy them as SES lists them.\n\nIn Cloudflare, set every `CNAME` for DKIM to **DNS only**, not proxied. SES reports the domain as verified only once the records resolve.\n\n### DMARC: publish a policy and collect reports\n\nDMARC tells an inbox what to do with mail that fails both SPF and DKIM, and asks it to send you reports. It's a `TXT` record at `_dmarc.send.example.com`:\n\n```\n_dmarc.send.example.com.  TXT  \"v=DMARC1; p=none; rua=mailto:dmarc@example.com\"\n```\n\n- **`p=none`** is monitor mode. Inboxes report on failing mail, but deliver it as usual.\n- **`rua`** is where reports go. They arrive as attachments, usually one a day from each inbox provider.\n\nLeave alignment relaxed, the default, with no `aspf=s` or `adkim=s`. With a custom MAIL FROM domain, your return path is a subdomain of your sending name, so strict SPF alignment would fail.\n\nOnce the reports show your sends passing and aligned, tighten the policy to `p=quarantine`, which sends failing mail to spam. Later, tighten it to `p=reject`, which refuses it.\n\n## Verify alignment\n\nA test email proves alignment better than any DNS lookup. Send yourself one, as in [Verify it works](../get-started/05-verify.md#2-check-that-it-passes-authentication), and read its `Authentication-Results` header. In Gmail, open the message's menu, and select **Show original**. Expect:\n\n- `dkim=pass` for `send.example.com`.\n- `dmarc=pass` for `send.example.com`.\n- `spf=pass`. With a custom MAIL FROM domain, its domain is under `send.example.com`. Without one, it's a subdomain of `amazonses.com`. That's expected, and DMARC still passes.\n";
 
+// docs/reference/03-import-format.md
+var import_format_default = "# Import format\n\nKestrel imports a subscriber list in one documented format, `kestrel-subscribers/1`, and exports the whole list in the same format. This page describes the format, what an import does to each address, and the limits.\n\nKestrel never guesses what another service's export means, because a wrong guess about who agreed to be emailed can't be taken back. An export from Sendy, Mailchimp, or anywhere else is converted to this format first, by Claude or by hand. The API serves everything on this page at `GET /api/imports/format`, generated from the same definition the importer reads with, along with a CSV template at `GET /api/imports/template.csv` and a plain-list template at `GET /api/imports/template.txt`.\n\n## Two kinds of file\n\n- **The full CSV (preferred).** It carries unsubscribes, bounces, and how each person joined. It's what the export writes, and you can open it in a spreadsheet to check it before importing.\n- **A plain list (`.txt`).** One address per line, for a list that is only addresses. You say what they all are: subscribed (the default), unsubscribed, or bounced. It loses how each person joined, any times, the evidence of consent, and mixed states.\n\nThe file's name decides which it is: `.csv` or `.txt`. Anything else is refused.\n\n## The CSV\n\nA CSV file (RFC 4180, UTF-8) with a header row of the column names below, in any order, then one row per address. Column names are written exactly, in lowercase. A row records what the source claims, never what Kestrel will do: the import decides that, under the rules further down.\n\n| Column | Required | Values | Meaning |\n| --- | --- | --- | --- |\n| `email` | yes | an email address | The address, trimmed and lowercased before it is matched. An invalid one is still a row, counted as invalid and reported, never dropped. |\n| `status` | yes | `subscribed`, `pending`, `unsubscribed`, `none` | The consent claim. `none` is a known address with no consent claim, present only to carry a suppression. |\n| `opt_in` | yes | `double`, `single`, `unknown` | How consent was collected. `unknown` unless the source states it. |\n| `origin` | yes | a short lowercase name | Where consent was first collected, as the file claims it: `sendy`, `mailchimp`, `kestrel`, or `unknown`. |\n| `suppression` | no | `bounce`, `complaint`, `manual`, `erased` | A suppression on top of `status`: the address bounced, complained, was suppressed by hand, or was erased. |\n| `subscribed_at` | no | an instant with its zone | When the person subscribed, if the source states it. |\n| `confirmed_at` | no | an instant with its zone | When the person confirmed, if the source states it. |\n| `unsubscribed_at` | no | an instant with its zone | When the person left, if the source states it. A reader who confirmed in Kestrel after it stays confirmed. |\n| `suppressed_at` | no | an instant with its zone | When the address was suppressed, if the source states it. |\n| `evidence` | no | a JSON object, at most 500 bytes | The source's consent-relevant columns, verbatim, such as a signup IP or a form name. Nothing reads it to decide anything: it is the proof of consent and the audit trail of a conversion. |\n| `format` | no | `kestrel-subscribers/1` | The version the file is written in. A file without it is read as version 1. |\n\nAn instant is a UTC ISO-8601 time with its zone, such as `2024-03-01T09:30:00Z` or `2024-03-01T10:30:00+01:00`. A time without a zone is refused, never interpreted. An optional column may be left out, or left empty on a row.\n\nAny other column is refused, naming it. A source's other columns belong in `evidence`, as JSON. A file whose header names none of these columns isn't in the format at all, and is refused as such.\n\nHere is a small file:\n\n```\nemail,status,opt_in,origin,suppression,unsubscribed_at,evidence\nada@example.com,subscribed,double,sendy,,,\"{\"\"signup_ip\"\":\"\"203.0.113.7\"\"}\"\ngrace@example.com,subscribed,single,mailchimp,,,\nedsger@example.com,unsubscribed,unknown,unknown,,2025-01-20T08:00:00Z,\nbounced@example.com,none,unknown,unknown,bounce,,\n```\n\n**Versions.** Adding an optional column keeps the version. Changing what a column means makes a new version. Kestrel reads every version it has published, and refuses one it doesn't know, by name.\n\n## The plain list\n\n- One address per line. Each line is trimmed, blank lines are skipped, and CRLF line endings and a UTF-8 byte-order mark are accepted.\n- A line that isn't a single valid address, such as `Name <ada@example.com>` or a typo, is counted as invalid and listed among the rows left out. One bad line doesn't sink a list.\n- The whole file is refused when it isn't a plain list at all: not UTF-8 text, a line with a comma, tab, or semicolon (it's a table, so a `.csv`), or not one valid address in it.\n- Its rows arrive with `origin: unknown` and `opt_in: unknown`.\n\n## Plan, then commit\n\nAn import happens in two steps. Planning shows what the import would do to every row, against your list as it stands, and changes nothing, so you can plan a file as often as you need. Committing applies the plan, all of it or none of it, and sends no email.\n\nThe commit needs two things from you when they apply:\n\n- **Your attestation,** when anyone would be confirmed: \"Everyone I'm importing as subscribed opted in to receive [your publication]. This isn't a purchased, rented, or scraped list.\" It is kept with the import, with who gave it and when. An import that only unsubscribes or suppresses needs none.\n- **Each send that would grow,** acknowledged by a person. A post goes to the list as it stands when it fires, so an import can add to the audience of a scheduled send, or of one that has just fired and not yet fixed its audience. Claude can attest for you, but can't acknowledge a growing send: you finish that import in the dashboard.\n\nIf another import is committed after you plan, plan again. If your list changes between the plan and the commit in any other way, such as a reader unsubscribing, the commit still goes ahead. Every write checks the list as it stands, and the answer reports any row that turned out differently.\n\n## What an import does to each address\n\nEach row gets exactly one outcome. A row that both changes its status and adds a suppression reports its status outcome, and says it added a suppression too.\n\n| Outcome | When |\n| --- | --- |\n| `create_confirmed` | `subscribed`, with no subscriber and no suppression in Kestrel: added as confirmed. |\n| `confirm_pending` | `subscribed`, and pending in Kestrel (never confirmed): confirmed, and its confirmation link no longer works. |\n| `unchanged` | Already confirmed in Kestrel, or already in the state the row claims. A subscriber who joined through Kestrel keeps their own record. |\n| `mark_unsubscribed` | `unsubscribed`, and confirmed or pending in Kestrel, with no confirmation in Kestrel newer than the row's `unsubscribed_at`: unsubscribed. |\n| `create_unsubscribed` | `unsubscribed`, with no subscriber in Kestrel: recorded as unsubscribed, so the list remembers they left. |\n| `kept_confirmed_newer` | `unsubscribed`, but the reader confirmed in Kestrel after the source's `unsubscribed_at`: their newer action stands. |\n| `kept_unsubscribed` | `subscribed`, but unsubscribed in Kestrel, or pending again after leaving until they confirm in Kestrel themselves. An unsubscribe is never reversed. |\n| `blocked_by_suppression` | `subscribed`, but the address carries a suppression in Kestrel, a do-not-contact marker included: never added or confirmed. |\n| `suppression_added` | The row carries a suppression and the address has none in Kestrel, or only a do-not-contact marker, and nothing else changes. Applied whatever the row's `status`. |\n| `left_out` | `pending` or `none` with nothing to apply: counted, never confirmed. An import sends no email, so it can't start a confirmation either. |\n| `invalid` | The address isn't valid. |\n| `merged` | A repeat of an address earlier in the file, folded into it. |\n\nA suppression already in Kestrel is never replaced, with one exception: a bounce, a complaint, or a manual suppression replaces a do-not-contact marker left by an erasure, so a known bad address still gets no confirmation. An imported bounce or complaint is kept apart from one Kestrel saw itself, so the list says where each came from.\n\nAnyone can type an address into your subscribe form, which puts a reader who left back to pending until they confirm. An import treats such a reader as unsubscribed, so it never confirms someone who left in Kestrel.\n\n**Repeats of an address** are folded into one row first. Its status is the first of unsubscribed, subscribed, pending, and none that any repeat claims, and its suppression the first of erased, complaint, bounce, and manual. Its opt-in is the weakest claim. It keeps the earliest consent times and the latest unsubscribe and suppression times, and the origin and evidence of the row whose status won.\n\n## How imported subscribers read\n\nA subscriber an import confirmed is **confirmed**, like anyone who confirmed in Kestrel, and gets your posts. How they joined shows beside their state: imported, with the origin and opt-in method the file claimed, and the evidence. That holds even when the file says they confirmed through Kestrel itself. Only a confirmation Kestrel recorded reads as Kestrel's double opt-in, and a subscriber who later confirms in Kestrel becomes Kestrel's own.\n\n## Limits\n\n- **Rows:** up to 10,000 in one import. On the Workers Free plan's limits (`SUBREQUEST_BUDGET` unset), up to 1,000, since Free's 10 ms of CPU a request can't plan and commit more. Set [`SUBREQUEST_BUDGET`](01-configuration.md#subrequest_budget) on Workers Paid to take 10,000. Split a larger list into several files.\n- **Size:** a request of at most 10 MB, and `evidence` of at most 500 bytes a row.\n- **Database writes on Workers Free:** D1's free plan allows 100,000 rows written a day, and refuses every query past that until midnight UTC. Each new subscriber an import brings in writes about 7, and a send writes about 14 a recipient. So when an import leaves more than about 3,000 confirmed subscribers on Workers Free, import on one day and send on the next, by UTC. The plan says so when it applies, and never refuses. One import of 1,000 rows uses about 7% of a day's writes.\n\n## Exporting\n\nThe export reads your whole list out in this format, a page at a time, at `GET /api/subscribers/export`. Each page holds up to 1,000 rows on the Workers Free plan's limits, or 10,000 otherwise, and its `next` value asks for the page after it. Following `next` until it's `null` gives every address exactly once, even if the list changes while you read. An address added or removed partway through may or may not appear. To make one CSV in this format, write the pages' rows under a single header. In the CSV, a value that starts with `=`, `+`, `-`, or `@` is written with an apostrophe before it, so a spreadsheet shows it as text rather than running it as a formula; an import takes the apostrophe off again. It includes every subscriber with how they joined, their evidence, and their suppression, and every address suppressed with no subscriber behind it, written as `status: none`. A confirmed subscriber is written as `subscribed`. Importing an export into another Kestrel carries the list over: the same states and suppressions, with every confirmation arriving as imported, carrying its original evidence. Pending subscribers are left out on the way in, since an import sends no confirmation.\n";
+
 // src/docs/index.ts
 var PAGES = {
   "get-started/02-deploy.md": deploy_default,
@@ -4966,7 +5687,8 @@ var PAGES = {
   "guides/07-upgrade.md": upgrade_default,
   "guides/08-try-locally.md": try_locally_default,
   "reference/01-configuration.md": configuration_default,
-  "reference/02-sending-domain-dns.md": sending_domain_dns_default
+  "reference/02-sending-domain-dns.md": sending_domain_dns_default,
+  "reference/03-import-format.md": import_format_default
 };
 var PAGE_PATH = /^([a-z0-9-]+)\/\d{2}-([a-z0-9-]+)\.md$/;
 function linksIn(tokens) {
@@ -5062,33 +5784,207 @@ function list(_c) {
   return json(renderDocs());
 }
 
-// src/routes/images.ts
-var MAX_POST_IMAGE_BYTES = 5 * 1024 * 1024;
-function storageKey(postId, filename) {
-  return `posts/${postId}/${filename}`;
-}
-function baseName(name) {
-  const parts = name.split(/[\\/]/);
-  return parts[parts.length - 1] ?? "";
+// src/routes/posts.ts
+function author(c) {
+  return c.principal?.email ?? c.principal?.kind ?? null;
 }
-function publicImage(c, row) {
+async function readBody(c, opts = {}) {
+  const raw = await readJsonObject(c, opts);
+  const slug = optString(raw, "slug");
+  const slugAuto = optBoolean(raw, "slug_auto");
+  if (slug !== void 0 && slugAuto === true) {
+    throw fieldError("slug", "slug cannot be set while slug_auto is true");
+  }
   return {
-    filename: row.filename,
-    content_type: row.content_type,
-    width: row.width,
-    height: row.height,
-    url: `${c.config.mediaPublicBase}/${row.storage_key}`
+    input: {
+      subject: optString(raw, "subject"),
+      slug,
+      slug_auto: slugAuto,
+      markdown: optString(raw, "markdown")
+    },
+    base_revision: optStringOrNull(raw, "base_revision") ?? null
   };
 }
+function baseRevision(c, body) {
+  const header = c.req.headers.get("If-Match");
+  if (header && header !== "*") {
+    return header.replace(/^"(.*)"$/, "$1");
+  }
+  return body.base_revision;
+}
+function revisionHeaders(post) {
+  return post.current_revision ? { ETag: `"${post.current_revision}"` } : void 0;
+}
 async function requireDraft(c) {
   const post = await getPost(c.env.DB, param(c, "id"));
   if (!post) {
     throw notFound("post");
   }
-  if (post.status !== "draft") {
-    throw conflict("post is not a draft \u2014 cancel the schedule to edit");
+  if (post.status === "sent") {
+    throw refusal(409, "post_not_draft", "This post has been sent, so it can\u2019t be changed.");
   }
-  return post;
+  if (post.status !== "draft") {
+    const active = await getActiveSendForPost(c.env.DB, post.id);
+    throw refusal(
+      409,
+      "post_not_draft",
+      active?.status === "sending" ? "This post is being sent, so it can\u2019t be changed." : "This post is scheduled, so it\u2019s locked. Cancel the schedule to edit it."
+    );
+  }
+  return post;
+}
+async function createPost2(c) {
+  const { input } = await readBody(c, { optional: true });
+  const { post, revision } = await createPost(c.env.DB, input, author(c));
+  const body = { post, revision_id: revision.id };
+  return json(body, 201, revisionHeaders(post));
+}
+var POST_STATUSES = ["draft", "scheduled", "sent"];
+function parseStatusFilter(raw) {
+  if (!raw) {
+    return void 0;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const part of raw.split(",")) {
+    const s = part.trim();
+    if (POST_STATUSES.includes(s)) {
+      seen.add(s);
+    }
+  }
+  const list5 = [...seen];
+  return list5.length === 0 ? void 0 : list5.length === 1 ? list5[0] : list5;
+}
+async function listPosts2(c) {
+  const status = parseStatusFilter(c.url.searchParams.get("status"));
+  const search = c.url.searchParams.get("search") ?? void 0;
+  const filter = { status, search };
+  const page = parseListParams(c.url, POST_LIST_SPEC);
+  const now = Date.now();
+  const seq = await currentSendSeq(c.env.DB);
+  const [total, rows] = await Promise.all([
+    countPosts(c.env.DB, filter),
+    listPosts(c.env.DB, filter, page)
+  ]);
+  const body = {
+    posts: rows,
+    page: listPage(total, page),
+    cursor: encodeSendCursor({ seq, at: now })
+  };
+  return json(body);
+}
+async function getPost2(c) {
+  const post = await getPost(c.env.DB, param(c, "id"));
+  if (!post) {
+    throw notFound("post");
+  }
+  const revision = await getCurrentRevision(c.env.DB, post);
+  const active = post.status === "scheduled" ? await getActiveSendForPost(c.env.DB, post.id) : null;
+  const sent = post.status === "sent" ? await latestSentSendForPost(c.env.DB, post.id) : null;
+  const body = {
+    post,
+    markdown: revision?.markdown ?? "",
+    author: revision?.author ?? null,
+    // who wrote the current revision — the freshness poll names them
+    // `remade_at`: when a template or identity change last re-made the frozen email
+    // (SPEC §8), so the editor can say the earlier test no longer stands.
+    scheduled: active && active.status === "scheduled" ? { id: active.id, fire_at: active.fire_at, remade_at: active.remade_at } : null,
+    sending: active && active.status === "sending" ? { id: active.id } : null,
+    sent: sent ? { id: sent.id } : null
+  };
+  return json(body, 200, revisionHeaders(post));
+}
+async function updatePost2(c) {
+  const post = await requireDraft(c);
+  const body = await readBody(c);
+  const base = baseRevision(c, body);
+  if (!base) {
+    const required = {
+      error: "base_required",
+      message: "A save must name the revision it was based on. Read the post, then save with its current_revision as base_revision or If-Match.",
+      field: "base_revision",
+      post
+    };
+    return json(required, 428, revisionHeaders(post));
+  }
+  if (post.current_revision && base !== post.current_revision) {
+    const current2 = await getCurrentRevision(c.env.DB, post);
+    const stale = {
+      error: "stale_revision",
+      message: "This draft changed since you loaded it. Read it again before saving.",
+      current_revision: post.current_revision,
+      updated_at: post.updated_at,
+      author: current2?.author ?? null
+    };
+    return json(stale, 409, revisionHeaders(post));
+  }
+  const { post: updated, revision } = await updatePost(c.env.DB, post, body.input, author(c));
+  const saved = { post: updated, revision_id: revision.id };
+  return json(saved, 200, revisionHeaders(updated));
+}
+async function deletePost2(c) {
+  const post = await requireDraft(c);
+  const imgs = await listImages(c.env.DB, post.id);
+  await Promise.all(imgs.map((i) => c.env.MEDIA.delete(i.storage_key)));
+  await deletePost(c.env.DB, post.id);
+  return json({ deleted: true });
+}
+async function listRevisions2(c) {
+  const post = await getPost(c.env.DB, param(c, "id"));
+  if (!post) {
+    throw notFound("post");
+  }
+  const revs = await listRevisions(c.env.DB, post.id);
+  return json({
+    revisions: revs.map((r, i) => ({
+      n: i + 1,
+      id: r.id,
+      author: r.author,
+      created_at: r.created_at,
+      is_current: r.id === post.current_revision,
+      metadata: JSON.parse(r.metadata)
+    }))
+  });
+}
+async function getRevision(c) {
+  const post = await getPost(c.env.DB, param(c, "id"));
+  if (!post) {
+    throw notFound("post");
+  }
+  const n = Number(param(c, "n"));
+  if (!Number.isInteger(n) || n < 1) {
+    throw badRequest("revision index must be a positive integer");
+  }
+  const rev = await getRevisionByIndex(c.env.DB, post.id, n);
+  if (!rev) {
+    throw notFound("revision");
+  }
+  return json({
+    n,
+    id: rev.id,
+    author: rev.author,
+    created_at: rev.created_at,
+    markdown: rev.markdown,
+    metadata: JSON.parse(rev.metadata)
+  });
+}
+
+// src/routes/images.ts
+var MAX_POST_IMAGE_BYTES = 5 * 1024 * 1024;
+function storageKey(postId, filename) {
+  return `posts/${postId}/${filename}`;
+}
+function baseName(name) {
+  const parts = name.split(/[\\/]/);
+  return parts[parts.length - 1] ?? "";
+}
+function publicImage(c, row) {
+  return {
+    filename: row.filename,
+    content_type: row.content_type,
+    width: row.width,
+    height: row.height,
+    url: `${c.config.mediaPublicBase}/${row.storage_key}`
+  };
 }
 async function uploadImage(c) {
   const post = await requireDraft(c);
@@ -5120,13 +6016,13 @@ async function uploadImage(c) {
     throw badRequest("a filename is required");
   }
   if (!RASTER_IMAGE_TYPES.includes(contentType)) {
-    throw badRequest("an image must be a PNG, JPEG, WebP, or GIF");
+    throw badRequest("An image must be a PNG, JPEG, WebP, or GIF.");
   }
   if (bytes.byteLength === 0) {
-    throw badRequest("the image file is empty");
+    throw badRequest("The image file is empty.");
   }
   if (bytes.byteLength > MAX_POST_IMAGE_BYTES) {
-    throw badRequest(`an image must be ${MAX_POST_IMAGE_BYTES / (1024 * 1024)} MB or smaller`);
+    throw badRequest(`An image must be ${MAX_POST_IMAGE_BYTES / (1024 * 1024)} MB or smaller.`);
   }
   const key = storageKey(post.id, filename);
   await c.env.MEDIA.put(key, bytes, { httpMetadata: { contentType } });
@@ -5180,180 +6076,899 @@ async function serveMedia(c) {
   return new Response(obj.body, { headers: headers2 });
 }
 
-// src/routes/posts.ts
-function author(c) {
-  return c.principal?.email ?? c.principal?.kind ?? null;
+// src/db/notifications.ts
+function importNotice(db, importId, now) {
+  return db.prepare(
+    "INSERT INTO notifications (send_id, import_id, kind, episode, created_at, updated_at) VALUES (NULL, ?, 'import', 0, ?, ?)"
+  ).bind(importId, now, now);
 }
-async function readBody(c, opts = {}) {
-  const raw = await readJsonObject(c, opts);
-  const slug = optString(raw, "slug");
-  const slugAuto = optBoolean(raw, "slug_auto");
-  if (slug !== void 0 && slugAuto === true) {
-    throw fieldError("slug", "slug cannot be set while slug_auto is true");
-  }
+async function recordNotifications(db, now) {
+  await db.prepare(
+    `INSERT OR IGNORE INTO notifications (send_id, kind, episode, created_at, updated_at)
+         SELECT id, 'finished', 0, ?1, ?1 FROM sends
+          WHERE status = 'sent' AND completed_at >= ?2
+         UNION ALL
+         SELECT id, 'refused', halted_at, ?1, ?1 FROM sends
+          WHERE status = 'sending' AND halt_reason = 'account' AND halted_at IS NOT NULL
+         UNION ALL
+         SELECT id, 'missed', 0, ?1, ?1 FROM sends
+          WHERE (status = 'scheduled' AND fire_at < ?1 - ?3)
+             OR (status IN ('sending', 'sent') AND started_at >= ?2 AND started_at - fire_at > ?3)
+         UNION ALL
+         SELECT id, 'wedged', 0, ?1, ?1 FROM sends WHERE ${WEDGED_SEND}
+         UNION ALL
+         SELECT id, 'stuck', 0, ?1, ?1 FROM sends
+          WHERE status = 'sending' AND started_at < ?1 - ?4
+            AND halt_reason IS NOT 'account' AND NOT (${WEDGED_SEND})
+            AND NOT EXISTS (SELECT 1 FROM notifications r
+                             WHERE r.send_id = sends.id AND r.kind = 'refused')`
+  ).bind(now, now - NOTIFY_HORIZON_MS, MISSED_THRESHOLD_MS, STUCK_THRESHOLD_MS).run();
+}
+async function dueNotifications(db, limit) {
+  const { results } = await db.prepare(
+    `SELECT n.send_id, n.import_id, n.kind, n.episode, n.attempts,
+              s.subject, s.status AS send_status, s.fire_at, s.started_at, s.completed_at,
+              s.locked_until, s.halt_reason, s.halted_at, s.halt_cause, s.halt_error, s.c_pending, s.c_in_flight, s.c_accepted,
+              s.c_delivered, s.c_bounced, s.c_complained, s.c_skipped, s.c_unsent,
+              i.file_name, i.created_at, i.attestation_version, i.counts, i.suppressions_added
+         FROM notifications n
+         LEFT JOIN sends s ON s.id = n.send_id
+         LEFT JOIN imports i ON i.id = n.import_id
+        WHERE n.status = 'pending' AND (s.id IS NOT NULL OR i.id IS NOT NULL)
+        ORDER BY n.created_at ASC, n.send_id ASC, n.kind ASC
+        LIMIT ?`
+  ).bind(limit).all();
+  return results.map((r) => {
+    if (r.kind === "import") {
+      return {
+        send_id: null,
+        import_id: r.import_id,
+        kind: "import",
+        episode: 0,
+        attempts: r.attempts,
+        file_name: r.file_name,
+        created_at: r.created_at,
+        attestation_version: r.attestation_version,
+        counts: r.counts,
+        suppressions_added: r.suppressions_added
+      };
+    }
+    return r;
+  });
+}
+var IN_KEYS = `EXISTS (SELECT 1 FROM json_each(?) k
+                  WHERE json_extract(k.value, '$[0]') IS notifications.send_id
+                    AND json_extract(k.value, '$[3]') IS notifications.import_id
+                    AND json_extract(k.value, '$[1]') = notifications.kind
+                    AND json_extract(k.value, '$[2]') = notifications.episode)`;
+async function claimNotifications(db, keys, now) {
+  await db.prepare(
+    `UPDATE notifications SET attempts = attempts + 1, updated_at = ?
+        WHERE status = 'pending' AND ${IN_KEYS}`
+  ).bind(now, JSON.stringify(keys.map((k) => [k.send_id, k.kind, k.episode, k.import_id ?? null]))).run();
+}
+async function recordNotificationOutcome(db, key, outcome, now) {
+  const status = outcome.status === "unsent" ? outcome.giveUp ? "failed" : "pending" : outcome.status;
+  const error = outcome.status === "unsent" ? outcome.error : null;
+  await db.prepare(
+    `UPDATE notifications SET status = ?, error = ?, updated_at = ?
+        WHERE send_id IS ? AND import_id IS ? AND kind = ? AND episode = ?`
+  ).bind(status, error, now, key.send_id, key.import_id ?? null, key.kind, key.episode).run();
+}
+async function recordNotificationTest(db, error, now) {
+  await db.batch([
+    db.prepare("DELETE FROM notifications WHERE kind = 'test'"),
+    db.prepare(
+      `INSERT INTO notifications (send_id, kind, episode, status, attempts, error, created_at, updated_at)
+         VALUES (NULL, 'test', 0, ?, 1, ?, ?, ?)`
+    ).bind(error === null ? "sent" : "failed", error, now, now)
+  ]);
+}
+async function closeUnaddressed(db, now) {
+  await db.prepare(
+    "UPDATE notifications SET status = 'unaddressed', updated_at = ? WHERE status = 'pending'"
+  ).bind(now).run();
+}
+async function notificationStatus(db) {
+  const { results } = await db.prepare(
+    `SELECT * FROM (
+         SELECT 'sent' AS which, n.kind, COALESCE(s.subject, i.file_name, '') AS subject,
+                n.updated_at AS at, NULL AS error
+           FROM notifications n LEFT JOIN sends s ON s.id = n.send_id
+           LEFT JOIN imports i ON i.id = n.import_id
+          WHERE n.status = 'sent' ORDER BY n.updated_at DESC LIMIT 1)
+       UNION ALL
+       SELECT * FROM (
+         SELECT 'failed' AS which, n.kind, COALESCE(s.subject, i.file_name, '') AS subject,
+                n.updated_at AS at, n.error
+           FROM notifications n LEFT JOIN sends s ON s.id = n.send_id
+           LEFT JOIN imports i ON i.id = n.import_id
+          WHERE n.error IS NOT NULL AND n.status IN ('pending', 'failed')
+          ORDER BY n.updated_at DESC LIMIT 1)`
+  ).all();
+  const sent = results.find((r) => r.which === "sent");
+  const failed = results.find((r) => r.which === "failed");
   return {
-    input: {
-      subject: optString(raw, "subject"),
-      slug,
-      slug_auto: slugAuto,
-      markdown: optString(raw, "markdown")
-    },
-    base_revision: optStringOrNull(raw, "base_revision") ?? null
+    lastSent: sent ? { kind: sent.kind, subject: sent.subject, at: sent.at } : null,
+    lastFailure: failed && (!sent || failed.at > sent.at) ? { kind: failed.kind, subject: failed.subject, at: failed.at, error: failed.error ?? "" } : null
   };
 }
-function baseRevision(c, body) {
-  const header = c.req.headers.get("If-Match");
-  if (header && header !== "*") {
-    return header.replace(/^"(.*)"$/, "$1");
-  }
-  return body.base_revision;
+
+// src/db/imports.ts
+var MAX_VALUE_BYTES = 1e6;
+var encoder = new TextEncoder();
+var NON_ASCII = /[\u0080-\uffff]/;
+function jsonChunks(items, maxBytes = MAX_VALUE_BYTES) {
+  const chunks = [];
+  let parts = [];
+  let bytes = 2;
+  for (const item of items) {
+    const part = JSON.stringify(item);
+    const size = (NON_ASCII.test(part) ? encoder.encode(part).length : part.length) + 1;
+    if (parts.length > 0 && bytes + size > maxBytes) {
+      chunks.push(`[${parts.join(",")}]`);
+      parts = [];
+      bytes = 2;
+    }
+    parts.push(part);
+    bytes += size;
+  }
+  if (parts.length > 0) {
+    chunks.push(`[${parts.join(",")}]`);
+  }
+  return chunks;
+}
+async function readListState(db, emails) {
+  const state = { subscribers: /* @__PURE__ */ new Map(), suppressions: /* @__PURE__ */ new Map() };
+  const chunks = jsonChunks(emails);
+  if (chunks.length === 0) {
+    return state;
+  }
+  const statements = chunks.flatMap((chunk3) => [
+    db.prepare(
+      "SELECT email, status, import_id, confirmed_at, unsubscribed_at FROM subscribers WHERE email IN (SELECT value FROM json_each(?))"
+    ).bind(chunk3),
+    db.prepare(
+      "SELECT email, reason FROM suppressions WHERE email IN (SELECT value FROM json_each(?))"
+    ).bind(chunk3)
+  ]);
+  const results = await db.batch(statements);
+  results.forEach((res, i) => {
+    for (const r of res.results) {
+      if (i % 2 === 0) {
+        state.subscribers.set(r.email, {
+          status: r.status,
+          import_id: r.import_id,
+          confirmed_at: r.confirmed_at,
+          unsubscribed_at: r.unsubscribed_at
+        });
+      } else {
+        state.suppressions.set(r.email, r.reason);
+      }
+    }
+  });
+  return state;
 }
-function revisionHeaders(post) {
-  return post.current_revision ? { ETag: `"${post.current_revision}"` } : void 0;
+async function scheduledSends(db) {
+  const { results } = await db.prepare(
+    `SELECT id, subject, fire_at FROM sends
+        WHERE status = 'scheduled' OR (status = 'sending' AND audience_resolved_at IS NULL)
+        ORDER BY fire_at ASC, id ASC`
+  ).all();
+  return results;
 }
-async function requireDraft2(c) {
-  const post = await getPost(c.env.DB, param(c, "id"));
-  if (!post) {
-    throw notFound("post");
+function toRecord(row) {
+  return {
+    id: row.id,
+    created_at: row.created_at,
+    principal: { kind: row.principal_kind, email: row.principal_email },
+    attestation_version: row.attestation_version,
+    file_name: row.file_name,
+    file_sha256: row.file_sha256,
+    plan_hash: row.plan_hash,
+    counts: JSON.parse(row.counts),
+    suppressions_added: row.suppressions_added
+  };
+}
+async function latestImportId(db) {
+  const row = await db.prepare("SELECT id FROM imports ORDER BY created_at DESC, id DESC LIMIT 1").first();
+  return row?.id ?? null;
+}
+async function getImportByPlanHash(db, planHash) {
+  const row = await db.prepare("SELECT * FROM imports WHERE plan_hash = ?").bind(planHash).first();
+  return row ? toRecord(row) : null;
+}
+var v = (field) => `json_extract(j.value, '$.${field}')`;
+async function applyImport(db, writes, suppressionDetail) {
+  const r = writes.record;
+  const now = r.created_at;
+  const statements = [
+    db.prepare(
+      `INSERT INTO imports (id, created_at, principal_kind, principal_email, attestation_version,
+                              file_name, file_sha256, plan_hash, counts, suppressions_added)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    ).bind(
+      r.id,
+      now,
+      r.principal_kind,
+      r.principal_email,
+      r.attestation_version,
+      r.file_name,
+      r.file_sha256,
+      r.plan_hash,
+      JSON.stringify(r.counts),
+      r.suppressions_added
+    )
+  ];
+  const kinds = [];
+  const add2 = (kind, sql, rows, ...binds) => {
+    for (const chunk3 of jsonChunks(rows)) {
+      statements.push(db.prepare(sql).bind(chunk3, ...binds));
+      kinds.push(kind);
+    }
+  };
+  add2(
+    "unsubscribed",
+    `UPDATE subscribers SET status = 'unsubscribed', unsubscribed_at = COALESCE(${v("uat")}, ?2)
+       FROM json_each(?1) AS j
+      WHERE subscribers.email = ${v("e")}
+        AND subscribers.status IN ('pending', 'confirmed')
+        AND NOT (subscribers.status = 'confirmed' AND subscribers.import_id IS NULL
+                 AND ${v("uat")} IS NOT NULL AND COALESCE(subscribers.confirmed_at, 0) > ${v("uat")})
+      RETURNING email`,
+    writes.unsubscribe,
+    now
+  );
+  add2(
+    "addedUnsubscribed",
+    `INSERT INTO subscribers (id, email, status, unsub_token, created_at, confirmed_at, unsubscribed_at,
+                              origin, opt_in, consent_evidence, import_id)
+     SELECT ${v("id")}, ${v("e")}, 'unsubscribed', ${v("tok")}, ?2, ${v("cat")}, COALESCE(${v("uat")}, ?2),
+            ${v("org")}, ${v("opt")}, ${v("ev")}, ?3
+       FROM json_each(?1) AS j WHERE true
+     ON CONFLICT (email) DO NOTHING
+     RETURNING email`,
+    writes.addUnsubscribed,
+    now,
+    r.id
+  );
+  add2(
+    "confirmed",
+    `UPDATE subscribers SET status = 'confirmed', confirmed_at = ${v("cat")}, confirm_token = NULL,
+                            origin = ${v("org")}, opt_in = ${v("opt")}, consent_evidence = ${v("ev")},
+                            import_id = ?2
+       FROM json_each(?1) AS j
+      WHERE subscribers.email = ${v("e")} AND subscribers.status = 'pending'
+        AND subscribers.unsubscribed_at IS NULL
+        AND NOT EXISTS (SELECT 1 FROM suppressions s WHERE s.email = subscribers.email)
+      RETURNING email`,
+    [...writes.confirm, ...writes.addConfirmed],
+    r.id
+  );
+  add2(
+    "addedConfirmed",
+    `INSERT INTO subscribers (id, email, status, unsub_token, created_at, confirmed_at,
+                              origin, opt_in, consent_evidence, import_id)
+     SELECT ${v("id")}, ${v("e")}, 'confirmed', ${v("tok")}, ?2, ${v("cat")},
+            ${v("org")}, ${v("opt")}, ${v("ev")}, ?3
+       FROM json_each(?1) AS j
+      WHERE NOT EXISTS (SELECT 1 FROM suppressions s WHERE s.email = ${v("e")})
+     ON CONFLICT (email) DO NOTHING
+     RETURNING email`,
+    writes.addConfirmed,
+    now,
+    r.id
+  );
+  add2(
+    "suppressed",
+    `INSERT INTO suppressions (email, reason, detail, created_at)
+     SELECT ${v("e")}, ${v("r")}, ?2, COALESCE(${v("at")}, ?3) FROM json_each(?1) AS j WHERE true
+     ON CONFLICT (email) DO UPDATE SET reason = excluded.reason, detail = excluded.detail,
+                                       created_at = excluded.created_at
+      WHERE suppressions.reason = 'erased' AND excluded.reason <> 'erased'
+     RETURNING email`,
+    writes.suppress,
+    suppressionDetail,
+    now
+  );
+  if (writes.notice) {
+    statements.push(importNotice(db, r.id, now));
+  }
+  const results = await db.batch(statements);
+  const applied = {
+    unsubscribed: /* @__PURE__ */ new Set(),
+    addedUnsubscribed: /* @__PURE__ */ new Set(),
+    confirmed: /* @__PURE__ */ new Set(),
+    addedConfirmed: /* @__PURE__ */ new Set(),
+    suppressed: /* @__PURE__ */ new Set()
+  };
+  kinds.forEach((kind, i) => {
+    for (const row of results[i + 1]?.results ?? []) {
+      applied[kind].add(row.email);
+    }
+  });
+  return applied;
+}
+async function setImportCounts(db, id, counts2, suppressionsAdded) {
+  await db.prepare("UPDATE imports SET counts = ?, suppressions_added = ? WHERE id = ?").bind(JSON.stringify(counts2), suppressionsAdded, id).run();
+}
+async function listForExport(db, after, limit) {
+  const { results } = await db.prepare(
+    `SELECT * FROM (
+         SELECT s.email, s.status, s.opt_in, s.origin, s.consent_evidence, s.created_at,
+                s.confirmed_at, s.unsubscribed_at, p.reason, p.created_at AS suppressed_at
+           FROM subscribers s LEFT JOIN suppressions p ON p.email = s.email
+          WHERE s.email > ?1 ORDER BY s.email LIMIT ?2)
+       UNION ALL
+       SELECT * FROM (
+         SELECT p.email, NULL, NULL, NULL, NULL, NULL, NULL, NULL, p.reason, p.created_at
+           FROM suppressions p
+          WHERE p.email > ?1 AND NOT EXISTS (SELECT 1 FROM subscribers s WHERE s.email = p.email)
+          ORDER BY p.email LIMIT ?2)
+       ORDER BY 1 LIMIT ?2`
+  ).bind(after ?? "", limit).all();
+  return results;
+}
+
+// src/services/imports.ts
+function maxImportRows(subrequestBudget) {
+  return onFreePlanLimits({ subrequestBudget }) ? {
+    maxRows: IMPORT_LIMITS.maxRowsFree,
+    reason: `This deployment runs on the Workers Free plan\u2019s limits (SUBREQUEST_BUDGET unset), whose 10 ms of CPU per request can plan and commit about ${IMPORT_LIMITS.maxRowsFree.toLocaleString("en-US")} rows; on Workers Paid, set SUBREQUEST_BUDGET to take up to ${IMPORT_LIMITS.maxRows.toLocaleString("en-US")}.`
+  } : { maxRows: IMPORT_LIMITS.maxRows, reason: null };
+}
+function exportPageRows(subrequestBudget) {
+  return onFreePlanLimits({ subrequestBudget }) ? EXPORT_PAGE_ROWS.free : EXPORT_PAGE_ROWS.paid;
+}
+function emptyCounts() {
+  return Object.fromEntries(IMPORT_OUTCOMES.map((o) => [o, 0]));
+}
+var WRITE_OUTCOMES = /* @__PURE__ */ new Set([
+  "create_confirmed",
+  "confirm_pending",
+  "mark_unsubscribed",
+  "create_unsubscribed"
+]);
+function classify(row, here, suppressionHere) {
+  const suppressionAdded = row.suppression !== null && (suppressionHere === void 0 || suppressionHere === "erased" && row.suppression !== "erased");
+  const leftHere = here?.status === "unsubscribed" || here?.status === "pending" && here.unsubscribed_at !== null;
+  let outcome;
+  if (row.status === "subscribed") {
+    outcome = suppressionHere !== void 0 ? "blocked_by_suppression" : here === void 0 ? "create_confirmed" : leftHere ? "kept_unsubscribed" : here.status === "pending" ? "confirm_pending" : "unchanged";
+  } else if (row.status === "unsubscribed") {
+    const confirmedHereSince = here?.status === "confirmed" && here.import_id === null && row.unsubscribed_at !== null && (here.confirmed_at ?? 0) > row.unsubscribed_at;
+    outcome = here === void 0 ? "create_unsubscribed" : here.status === "unsubscribed" ? "unchanged" : confirmedHereSince ? "kept_confirmed_newer" : "mark_unsubscribed";
+  } else {
+    outcome = "left_out";
   }
-  if (post.status !== "draft") {
-    throw conflict("post is not a draft \u2014 cancel the schedule to edit");
+  if (suppressionAdded && (outcome === "unchanged" || outcome === "left_out")) {
+    outcome = "suppression_added";
   }
-  return post;
+  return { outcome, suppressionAdded };
 }
-async function createPost2(c) {
-  const { input } = await readBody(c, { optional: true });
-  const { post, revision } = await createPost(c.env.DB, input, author(c));
-  const body = { post, revision_id: revision.id };
-  return json(body, 201, revisionHeaders(post));
+async function sha256Hex(data) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(data));
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
-var POST_STATUSES = ["draft", "scheduled", "sent"];
-function parseStatusFilter(raw) {
-  if (!raw) {
-    return void 0;
+function fileSha256(text) {
+  return sha256Hex(text);
+}
+function fileRefusal(error) {
+  const { code, message: message2, ...at } = error;
+  return new HttpError(400, code, message2, { field: "file", ...at });
+}
+async function planImport(db, input, {
+  maxRows,
+  maxRowsReason,
+  publication,
+  freePlan = false
+}) {
+  const tooMany = (rows2) => new HttpError(
+    400,
+    "too_many_rows",
+    `The file has ${rows2} rows; one import takes at most ${maxRows.toLocaleString("en-US")}.${maxRowsReason ? ` ${maxRowsReason}` : ""} Split it into files of up to ${maxRows.toLocaleString("en-US")} rows.`,
+    { field: "file", limit: maxRows }
+  );
+  let lines = 1;
+  for (let at = input.text.indexOf("\n"); at !== -1; at = input.text.indexOf("\n", at + 1)) {
+    lines += 1;
   }
-  const seen = /* @__PURE__ */ new Set();
-  for (const part of raw.split(",")) {
-    const s = part.trim();
-    if (POST_STATUSES.includes(s)) {
-      seen.add(s);
+  if (lines > 2 * (maxRows + 1)) {
+    throw tooMany(`about ${lines.toLocaleString("en-US")}`);
+  }
+  const parsed = parseImportFile(
+    { name: input.name, text: input.text },
+    input.plainListStatus ?? "subscribed"
+  );
+  if (!parsed.ok) {
+    throw fileRefusal(parsed.error);
+  }
+  const { kind, rows } = parsed.file;
+  if (kind === "csv" && input.plainListStatus !== null) {
+    throw new HttpError(
+      400,
+      "bad_request",
+      "plain_list_status is for a plain list (.txt); a CSV says each row\u2019s status itself",
+      { field: "plain_list_status" }
+    );
+  }
+  if (rows.length > maxRows) {
+    throw tooMany(rows.length.toLocaleString("en-US"));
+  }
+  const merged = mergeRows(rows);
+  const state = await readListState(
+    db,
+    merged.rows.map((r) => r.email)
+  );
+  const planned = merged.rows.map((row) => ({
+    row,
+    ...classify(row, state.subscribers.get(row.email), state.suppressions.get(row.email))
+  }));
+  const counts2 = emptyCounts();
+  const confirmed = {
+    opt_in: { double: 0, single: 0, unknown: 0 },
+    origin: {}
+  };
+  let suppressionsAdded = 0;
+  let gains = 0;
+  for (const p of planned) {
+    counts2[p.outcome] += 1;
+    suppressionsAdded += p.suppressionAdded ? 1 : 0;
+    if (CONFIRMING_OUTCOMES.has(p.outcome)) {
+      confirmed.opt_in[p.row.opt_in] += 1;
+      confirmed.origin[p.row.origin] = (confirmed.origin[p.row.origin] ?? 0) + 1;
+      gains += p.row.suppression === null ? 1 : 0;
+    }
+  }
+  counts2.merged = merged.repeats.length;
+  counts2.invalid = merged.invalid.length;
+  const sendsGrowing = gains === 0 ? [] : (await scheduledSends(db)).map((s) => ({ ...s, gains }));
+  const after = await latestImportId(db);
+  const needsAttestation = counts2.create_confirmed + counts2.confirm_pending > 0;
+  const sha = await fileSha256(input.text);
+  const confirmedAfter = freePlan ? await audienceCount(db) + gains : 0;
+  const planHash = await sha256Hex(
+    JSON.stringify([
+      "kestrel-import-plan/1",
+      kind,
+      sha,
+      input.plainListStatus,
+      needsAttestation,
+      sendsGrowing.map((s) => s.id).sort(),
+      after
+    ])
+  );
+  return {
+    input,
+    kind,
+    fileSha256: sha,
+    rowCount: rows.length,
+    merged,
+    planned,
+    counts: counts2,
+    suppressionsAdded,
+    confirmed,
+    sendsGrowing,
+    attestation: needsAttestation ? { version: ATTESTATION.version, text: attestationText(publication) } : null,
+    planHash,
+    dailyWritesWarning: confirmedAfter > DAILY_WRITES_IMPORT_CONFIRMED ? dailyWritesImportWarning(confirmedAfter) : null
+  };
+}
+function notConfirmedRows(planned, merged) {
+  const out = [];
+  for (const p of planned) {
+    if (!CONFIRMING_OUTCOMES.has(p.outcome)) {
+      out.push({
+        row: p.row.row,
+        email: p.row.email,
+        outcome: p.outcome,
+        suppression_added: p.suppressionAdded
+      });
     }
   }
-  const list5 = [...seen];
-  return list5.length === 0 ? void 0 : list5.length === 1 ? list5[0] : list5;
+  for (const r of merged.repeats) {
+    out.push({ row: r.row, email: r.email, outcome: "merged", suppression_added: false });
+  }
+  for (const r of merged.invalid) {
+    out.push({ row: r.row, email: r.email, outcome: "invalid", suppression_added: false });
+  }
+  return out.sort((a, b) => a.row - b.row);
 }
-async function listPosts2(c) {
-  const status = parseStatusFilter(c.url.searchParams.get("status"));
-  const search = c.url.searchParams.get("search") ?? void 0;
-  const filter = { status, search };
-  const page = parseListParams(c.url, POST_LIST_SPEC);
-  const now = Date.now();
-  const seq = await currentSendSeq(c.env.DB);
-  const [total, rows] = await Promise.all([
-    countPosts(c.env.DB, filter),
-    listPosts(c.env.DB, filter, page)
-  ]);
-  const body = {
-    posts: rows,
-    page: listPage(total, page),
-    cursor: encodeSendCursor({ seq, at: now })
+function planResponse(plan2) {
+  return {
+    file: {
+      name: plan2.input.name,
+      kind: plan2.kind,
+      rows: plan2.rowCount,
+      addresses: plan2.merged.rows.length,
+      plain_list_status: plan2.input.plainListStatus
+    },
+    counts: plan2.counts,
+    suppressions_added: plan2.suppressionsAdded,
+    confirmed: plan2.confirmed,
+    rows: notConfirmedRows(plan2.planned, plan2.merged),
+    sends_growing: plan2.sendsGrowing,
+    attestation: plan2.attestation,
+    plan_hash: plan2.planHash,
+    daily_writes_warning: plan2.dailyWritesWarning
   };
-  return json(body);
 }
-async function getPost2(c) {
-  const post = await getPost(c.env.DB, param(c, "id"));
-  if (!post) {
-    throw notFound("post");
+var SUPPRESSION_REASON = {
+  bounce: "import_bounce",
+  complaint: "import_complaint",
+  manual: "manual",
+  erased: "erased"
+};
+function replayResponse(record) {
+  return {
+    import: record,
+    counts: record.counts,
+    suppressions_added: record.suppressions_added,
+    rows: [],
+    differed: [],
+    replayed: true
+  };
+}
+async function commitImport(db, plan2, principal, now) {
+  const id = newId();
+  const writes = {
+    record: {
+      id,
+      created_at: now,
+      principal_kind: principal.kind,
+      principal_email: principal.kind === "human" ? (principal.email ?? "").toLowerCase() : null,
+      attestation_version: plan2.attestation ? plan2.attestation.version : null,
+      file_name: plan2.input.name,
+      file_sha256: plan2.fileSha256,
+      plan_hash: plan2.planHash,
+      counts: plan2.counts,
+      suppressions_added: plan2.suppressionsAdded
+    },
+    unsubscribe: [],
+    addUnsubscribed: [],
+    confirm: [],
+    addConfirmed: [],
+    suppress: [],
+    notice: principal.kind === "service"
+  };
+  const tokens = newTokens(plan2.counts.create_confirmed + plan2.counts.create_unsubscribed);
+  const token2 = () => tokens.pop() ?? "";
+  for (const { row, outcome, suppressionAdded } of plan2.planned) {
+    const consent = {
+      e: row.email,
+      opt: row.opt_in,
+      org: row.origin,
+      ev: row.evidence,
+      cat: row.confirmed_at ?? row.subscribed_at
+    };
+    if (outcome === "create_confirmed") {
+      writes.addConfirmed.push({ ...consent, id: newId(), tok: token2(), uat: null });
+    } else if (outcome === "confirm_pending") {
+      writes.confirm.push(consent);
+    } else if (outcome === "mark_unsubscribed") {
+      writes.unsubscribe.push({ e: row.email, uat: row.unsubscribed_at });
+    } else if (outcome === "create_unsubscribed") {
+      writes.unsubscribe.push({ e: row.email, uat: row.unsubscribed_at });
+      writes.addUnsubscribed.push({
+        ...consent,
+        cat: row.confirmed_at,
+        id: newId(),
+        tok: token2(),
+        uat: row.unsubscribed_at
+      });
+    }
+    if (suppressionAdded && row.suppression !== null) {
+      writes.suppress.push({
+        e: row.email,
+        r: SUPPRESSION_REASON[row.suppression],
+        at: row.suppressed_at
+      });
+    }
   }
-  const revision = await getCurrentRevision(c.env.DB, post);
-  const active = post.status === "scheduled" ? await getActiveSendForPost(c.env.DB, post.id) : null;
-  const sent = post.status === "sent" ? await latestSentSendForPost(c.env.DB, post.id) : null;
-  const body = {
-    post,
-    markdown: revision?.markdown ?? "",
-    author: revision?.author ?? null,
-    // who wrote the current revision — the freshness poll names them
-    // `remade_at`: when a template or identity change last re-made the frozen email
-    // (SPEC §8), so the editor can say the earlier test no longer stands.
-    scheduled: active && active.status === "scheduled" ? { id: active.id, fire_at: active.fire_at, remade_at: active.remade_at } : null,
-    sending: active && active.status === "sending" ? { id: active.id } : null,
-    sent: sent ? { id: sent.id } : null
+  let applied;
+  try {
+    applied = await applyImport(db, writes, `imported from ${plan2.input.name}`);
+  } catch (err) {
+    const raced = await getImportByPlanHash(db, plan2.planHash);
+    if (raced) {
+      return replayResponse(raced);
+    }
+    throw err;
+  }
+  const actual = [];
+  const unsettled = [];
+  for (const p of plan2.planned) {
+    const e = p.row.email;
+    const outcome = applied.confirmed.has(e) ? "confirm_pending" : applied.addedConfirmed.has(e) ? "create_confirmed" : applied.unsubscribed.has(e) ? "mark_unsubscribed" : applied.addedUnsubscribed.has(e) ? "create_unsubscribed" : WRITE_OUTCOMES.has(p.outcome) ? void 0 : p.outcome;
+    const suppressionAdded = applied.suppressed.has(e);
+    if (outcome === void 0 || p.outcome === "suppression_added" && !suppressionAdded) {
+      unsettled.push({ ...p, suppressionAdded });
+      continue;
+    }
+    actual.push({ ...p, outcome, suppressionAdded });
+  }
+  if (unsettled.length > 0) {
+    let state = { subscribers: /* @__PURE__ */ new Map(), suppressions: /* @__PURE__ */ new Map() };
+    try {
+      state = await readListState(
+        db,
+        unsettled.map((p) => p.row.email)
+      );
+    } catch (err) {
+      log.error("import.incomplete", { importId: id, step: "reread", error: errorText(err) });
+    }
+    for (const p of unsettled) {
+      const e = p.row.email;
+      const { outcome } = classify(
+        { ...p.row, suppression: null },
+        state.subscribers.get(e),
+        applied.suppressed.has(e) ? void 0 : state.suppressions.get(e)
+      );
+      actual.push({ ...p, outcome: WRITE_OUTCOMES.has(outcome) ? "unchanged" : outcome });
+    }
+  }
+  const counts2 = emptyCounts();
+  let suppressionsAdded = 0;
+  for (const p of actual) {
+    counts2[p.outcome] += 1;
+    suppressionsAdded += p.suppressionAdded ? 1 : 0;
+  }
+  counts2.merged = plan2.counts.merged;
+  counts2.invalid = plan2.counts.invalid;
+  const byEmail2 = new Map(plan2.planned.map((p) => [p.row.email, p]));
+  const differed = [];
+  for (const p of actual) {
+    const was = byEmail2.get(p.row.email);
+    if (was && (was.outcome !== p.outcome || was.suppressionAdded !== p.suppressionAdded)) {
+      differed.push({
+        row: p.row.row,
+        email: p.row.email,
+        planned: was.outcome,
+        applied: p.outcome
+      });
+    }
+  }
+  differed.sort((a, b) => a.row - b.row);
+  if (differed.length > 0) {
+    try {
+      await setImportCounts(db, id, counts2, suppressionsAdded);
+    } catch (err) {
+      log.error("import.incomplete", { importId: id, step: "counts", error: errorText(err) });
+    }
+  }
+  return {
+    import: {
+      id,
+      created_at: now,
+      principal: { kind: writes.record.principal_kind, email: writes.record.principal_email },
+      attestation_version: writes.record.attestation_version,
+      file_name: writes.record.file_name,
+      file_sha256: writes.record.file_sha256,
+      plan_hash: writes.record.plan_hash,
+      counts: counts2,
+      suppressions_added: suppressionsAdded
+    },
+    counts: counts2,
+    suppressions_added: suppressionsAdded,
+    rows: notConfirmedRows(actual, plan2.merged),
+    differed,
+    replayed: false
   };
-  return json(body, 200, revisionHeaders(post));
 }
-async function updatePost2(c) {
-  const post = await requireDraft2(c);
-  const body = await readBody(c);
-  const base = baseRevision(c, body);
-  if (!base) {
-    const required = {
-      error: "base_required",
-      message: "a save must name the revision it was based on: read the post, then save with its current_revision as base_revision or If-Match",
-      field: "base_revision",
-      post
-    };
-    return json(required, 428, revisionHeaders(post));
-  }
-  if (post.current_revision && base !== post.current_revision) {
-    const current2 = await getCurrentRevision(c.env.DB, post);
-    const stale = {
-      error: "stale_revision",
-      message: "this draft changed since you loaded it",
-      current_revision: post.current_revision,
-      updated_at: post.updated_at,
-      author: current2?.author ?? null
-    };
-    return json(stale, 409, revisionHeaders(post));
+function planStale() {
+  return refusal(
+    409,
+    "plan_stale",
+    "The import would no longer do what its plan said: the file, its declared meaning, whether an attestation is needed, or the scheduled sends it would grow have changed, or another import was committed since. Plan it again and review the new plan."
+  );
+}
+
+// src/routes/imports.ts
+function format(c) {
+  const { maxRows, reason } = maxImportRows(c.config.subrequestBudget);
+  return json(describeFormat(maxRows, reason));
+}
+function download(body, type, filename) {
+  return new Response(body, {
+    headers: {
+      "content-type": `${type}; charset=utf-8`,
+      "content-disposition": `attachment; filename="${filename}"`
+    }
+  });
+}
+function templateCsv() {
+  return download(TEMPLATE_CSV, "text/csv", "kestrel-subscribers.csv");
+}
+function templateTxt() {
+  return download(TEMPLATE_TXT, "text/plain", "email-list.txt");
+}
+function refuseOversize(c, bytes) {
+  const declared = Number(c.req.headers.get("content-length") ?? "0");
+  if ((bytes ?? declared) > IMPORT_LIMITS.maxBodyBytes) {
+    throw new HttpError(
+      413,
+      "body_too_large",
+      `The request is over ${IMPORT_LIMITS.maxBodyBytes / (1024 * 1024)} MB. Split the file into smaller imports.`
+    );
   }
-  const { post: updated, revision } = await updatePost(c.env.DB, post, body.input, author(c));
-  const saved = { post: updated, revision_id: revision.id };
-  return json(saved, 200, revisionHeaders(updated));
 }
-async function deletePost2(c) {
-  const post = await requireDraft2(c);
-  const imgs = await listImages(c.env.DB, post.id);
-  await Promise.all(imgs.map((i) => c.env.MEDIA.delete(i.storage_key)));
-  await deletePost(c.env.DB, post.id);
-  return json({ deleted: true });
+function readInput(body) {
+  const file = optObject(body, "file");
+  if (!file) {
+    throw fieldError("file", "file is required, as { name, text }");
+  }
+  const name = optString(file, "name", "file");
+  if (!name) {
+    throw fieldError("file.name", "file.name is required: the file\u2019s name, ending .csv or .txt");
+  }
+  const text = optString(file, "text", "file");
+  if (text === void 0) {
+    throw fieldError("file.text", "file.text is required: the file\u2019s contents as UTF-8 text");
+  }
+  const declared = body.plain_list_status === void 0 ? null : oneOf(body, "plain_list_status", PLAIN_LIST_STATUSES);
+  return {
+    name,
+    text,
+    plainListStatus: declared ?? (fileKindOf(name) === "txt" ? "subscribed" : null)
+  };
 }
-async function listRevisions2(c) {
-  const post = await getPost(c.env.DB, param(c, "id"));
-  if (!post) {
-    throw notFound("post");
+async function plan(c, input) {
+  if (new TextEncoder().encode(input.text).length > IMPORT_LIMITS.maxBodyBytes) {
+    refuseOversize(c, IMPORT_LIMITS.maxBodyBytes + 1);
   }
-  const revs = await listRevisions(c.env.DB, post.id);
-  return json({
-    revisions: revs.map((r, i) => ({
-      n: i + 1,
-      id: r.id,
-      author: r.author,
-      created_at: r.created_at,
-      is_current: r.id === post.current_revision,
-      metadata: JSON.parse(r.metadata)
-    }))
+  const { maxRows, reason } = maxImportRows(c.config.subrequestBudget);
+  const settings = await getSettings(c.env.DB);
+  return planImport(c.env.DB, input, {
+    maxRows,
+    maxRowsReason: reason,
+    publication: settings.publication.name,
+    freePlan: onFreePlanLimits(c.config)
   });
 }
-async function getRevision(c) {
-  const post = await getPost(c.env.DB, param(c, "id"));
-  if (!post) {
-    throw notFound("post");
+async function planRoute(c) {
+  refuseOversize(c);
+  const input = readInput(await readJsonObject(c));
+  return json(planResponse(await plan(c, input)));
+}
+async function commit(c) {
+  refuseOversize(c);
+  const body = await readJsonObject(c);
+  const input = readInput(body);
+  const planHash = optString(body, "plan_hash");
+  if (!planHash) {
+    throw fieldError("plan_hash", "plan_hash is required: the hash of the plan being committed");
   }
-  const n = Number(param(c, "n"));
-  if (!Number.isInteger(n) || n < 1) {
-    throw badRequest("revision index must be a positive integer");
+  const attestation = optObject(body, "attestation");
+  if (attestation && (typeof attestation.version !== "number" || attestation.accepted !== true)) {
+    throw fieldError(
+      "attestation",
+      "attestation must be { version, accepted: true }, with the version the plan returned"
+    );
   }
-  const rev = await getRevisionByIndex(c.env.DB, post.id, n);
-  if (!rev) {
-    throw notFound("revision");
+  const acknowledged = new Set(optStringList(body, "acknowledge_sends") ?? []);
+  const principal = c.principal;
+  if (!principal) {
+    throw badRequest("no principal");
   }
-  return json({
-    n,
-    id: rev.id,
-    author: rev.author,
-    created_at: rev.created_at,
-    markdown: rev.markdown,
-    metadata: JSON.parse(rev.metadata)
+  const done = await getImportByPlanHash(c.env.DB, planHash);
+  if (done && done.file_sha256 === await fileSha256(input.text)) {
+    return json(replayResponse(done));
+  }
+  const p = await plan(c, input);
+  if (p.planHash !== planHash) {
+    throw planStale();
+  }
+  if (p.attestation && !(attestation?.accepted === true && attestation.version === p.attestation.version)) {
+    throw refusal(
+      409,
+      "attestation_required",
+      `This import confirms ${p.counts.create_confirmed + p.counts.confirm_pending} subscribers, so it needs the publisher\u2019s attestation: "${p.attestation.text}" Send attestation: { version: ${ATTESTATION.version}, accepted: true } once they have given it.`,
+      { attestation: p.attestation }
+    );
+  }
+  if (p.sendsGrowing.length > 0) {
+    if (principal.kind === "service") {
+      throw refusal(
+        409,
+        "sends_acknowledgement_required",
+        "This import would add people to the audience of a scheduled send, which only a person can acknowledge. Ask the publisher to finish it in the dashboard (Subscribers, Import), choosing the same file: the same plan appears there.",
+        { sends: p.sendsGrowing }
+      );
+    }
+    const missing = p.sendsGrowing.filter((s) => !acknowledged.has(s.id));
+    if (missing.length > 0) {
+      throw refusal(
+        409,
+        "sends_acknowledgement_required",
+        `This import would add ${p.sendsGrowing[0]?.gains ?? 0} people to the audience of ${missing.length === 1 ? "a scheduled send" : `${missing.length} scheduled sends`} not yet acknowledged. Acknowledge each one by its id in acknowledge_sends.`,
+        { sends: missing }
+      );
+    }
+  }
+  const result = await commitImport(c.env.DB, p, principal, Date.now());
+  if (result.replayed) {
+    return json(result);
+  }
+  log.info("import.committed", {
+    importId: result.import.id,
+    principal: principal.kind,
+    rows: p.rowCount,
+    confirmed: result.counts.create_confirmed + result.counts.confirm_pending,
+    unsubscribed: result.counts.mark_unsubscribed + result.counts.create_unsubscribed,
+    suppressed: result.suppressions_added,
+    differed: result.differed.length
   });
+  return json(result, 201);
+}
+var STATUS_CLAIM = {
+  confirmed: "subscribed",
+  pending: "pending",
+  unsubscribed: "unsubscribed"
+};
+var SUPPRESSION_CLAIM = {
+  bounce: "bounce",
+  import_bounce: "bounce",
+  complaint: "complaint",
+  import_complaint: "complaint",
+  manual: "manual",
+  erased: "erased"
+};
+var iso = (ms) => ms === null ? null : new Date(ms).toISOString();
+function encodeExportCursor(cursor) {
+  const bytes = new TextEncoder().encode(JSON.stringify({ v: 1, ...cursor }));
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function decodeExportCursor(raw) {
+  try {
+    const binary = atob(raw.replace(/-/g, "+").replace(/_/g, "/"));
+    const bytes = Uint8Array.from(binary, (ch) => ch.charCodeAt(0));
+    const value = JSON.parse(
+      new TextDecoder("utf-8", { fatal: true, ignoreBOM: false }).decode(bytes)
+    );
+    if (typeof value !== "object" || value === null) {
+      return null;
+    }
+    const { v: v2, after, at } = value;
+    return v2 === 1 && typeof after === "string" && after !== "" && Number.isSafeInteger(at) ? { after, at } : null;
+  } catch {
+    return null;
+  }
+}
+async function exportList(c) {
+  const raw = c.url.searchParams.get("after");
+  const cursor = raw === null ? null : decodeExportCursor(raw);
+  if (raw !== null && cursor === null) {
+    throw fieldError("after", "after must be the next value a page of this export returned");
+  }
+  const at = cursor?.at ?? Date.now();
+  const size = exportPageRows(c.config.subrequestBudget);
+  const read = await listForExport(c.env.DB, cursor?.after ?? null, size + 1);
+  const page = read.slice(0, size);
+  const last = page.at(-1);
+  const rows = page.map((r) => ({
+    email: r.email,
+    status: r.status === null ? "none" : STATUS_CLAIM[r.status] ?? "none",
+    opt_in: r.opt_in ?? "unknown",
+    origin: r.origin ?? "unknown",
+    suppression: r.reason === null ? null : SUPPRESSION_CLAIM[r.reason] ?? "manual",
+    subscribed_at: iso(r.created_at),
+    confirmed_at: iso(r.confirmed_at),
+    unsubscribed_at: iso(r.unsubscribed_at),
+    suppressed_at: iso(r.suppressed_at),
+    evidence: r.consent_evidence,
+    format: IMPORT_FORMAT
+  }));
+  const body = {
+    format: IMPORT_FORMAT,
+    exported_at: at,
+    subscribers: rows,
+    next: read.length > size && last ? encodeExportCursor({ after: last.email, at }) : null
+  };
+  return json(body);
 }
 
 // src/emails/system.ts
@@ -5588,12 +7203,12 @@ function canonicalString(msg) {
   const fields = msg;
   let out = "";
   for (const k of keys) {
-    const v = fields[k];
-    if (v === void 0 || v === null) {
+    const v2 = fields[k];
+    if (v2 === void 0 || v2 === null) {
       continue;
     }
     out += `${k}
-${String(v)}
+${String(v2)}
 `;
   }
   return out;
@@ -5812,6 +7427,13 @@ var ACCOUNT_ERROR_TYPES = /* @__PURE__ */ new Map([
   ["SendingPausedException", "suspended"],
   ["AccountSuspendedException", "suspended"],
   ["MailFromDomainNotVerifiedException", "sender"],
+  // A resource the request names doesn't exist. Kestrel names only its configuration set
+  // (SES_CONFIGURATION_SET), so this is a typo, a set deleted after setup, or the wrong
+  // region: the deployment's to fix, and the same for every recipient, so it holds the send
+  // rather than marking each one failed. Without a configuration set the request names no
+  // resource that could be missing, so a 404 then isn't expected, and the advice still points
+  // at the one setting that would cause it.
+  ["NotFoundException", "configuration"],
   // The credentials themselves: unknown, wrongly signed, expired, or not permitted (a key
   // whose policy lacks `ses:SendBulkEmail` among them).
   ["UnrecognizedClientException", "credentials"],
@@ -5822,7 +7444,7 @@ var ACCOUNT_ERROR_TYPES = /* @__PURE__ */ new Map([
 ]);
 function classifySesError(status, type, message2 = "", senderUnverified = false) {
   const throttled = status === 429 || /throttl|toomany/i.test(type);
-  const cause = ACCOUNT_ERROR_TYPES.get(type) ?? (senderUnverified ? "sender" : throttled && /daily message quota/i.test(message2) ? "quota" : void 0);
+  const cause = ACCOUNT_ERROR_TYPES.get(type) ?? (status === 404 ? "configuration" : void 0) ?? (senderUnverified ? "sender" : throttled && /daily message quota/i.test(message2) ? "quota" : void 0);
   if (cause || status === 401 || status === 403) {
     return { reason: "account", cause: cause ?? "credentials" };
   }
@@ -5848,11 +7470,11 @@ var ENTRY_HALTS = /* @__PURE__ */ new Map([
   ["CONFIGURATION_SET_SENDING_PAUSED", account("suspended")],
   ["MAIL_FROM_DOMAIN_NOT_VERIFIED", account("sender")],
   ["ACCOUNT_DAILY_QUOTA_EXCEEDED", account("quota")],
-  ["CONFIGURATION_SET_DOES_NOT_EXIST", account("credentials")],
-  ["CONFIGURATION_SET_NOT_FOUND", account("credentials")],
-  ["INVALID_SENDING_POOL_NAME", account("credentials")],
-  ["TEMPLATE_DOES_NOT_EXIST", account("credentials")],
-  ["TEMPLATE_NOT_FOUND", account("credentials")],
+  ["CONFIGURATION_SET_DOES_NOT_EXIST", account("configuration")],
+  ["CONFIGURATION_SET_NOT_FOUND", account("configuration")],
+  ["INVALID_SENDING_POOL_NAME", account("configuration")],
+  ["TEMPLATE_DOES_NOT_EXIST", account("configuration")],
+  ["TEMPLATE_NOT_FOUND", account("configuration")],
   ["ACCOUNT_THROTTLED", unavailable("rate_limit")],
   ["TRANSIENT_FAILURE", unavailable("outage")]
 ]);
@@ -6720,8 +8342,8 @@ async function confirmLinkState(db, token2) {
   }
   return linkIsLive(row) ? { kind: "ready", subscriber: row } : { kind: "expired", subscriber: row };
 }
-async function confirmSubscription2(db, token2) {
-  const row = token2 ? await confirm(db, token2, Date.now() - CONFIRM_LINK_TTL_MS) : null;
+async function confirmSubscription2(db, token2, ip) {
+  const row = token2 ? await confirm(db, token2, Date.now() - CONFIRM_LINK_TTL_MS, ip) : null;
   if (row?.status === "confirmed") {
     return { kind: "confirmed", subscriber: row };
   }
@@ -6749,8 +8371,8 @@ async function readEmail(c) {
   }
   if (ct.includes("form")) {
     const f = await c.req.formData();
-    const v = f.get("email");
-    return typeof v === "string" ? v : null;
+    const v2 = f.get("email");
+    return typeof v2 === "string" ? v2 : null;
   }
   return c.url.searchParams.get("email");
 }
@@ -6763,9 +8385,9 @@ async function readToken(c) {
   if (ct.includes("form")) {
     try {
       const f = await c.req.formData();
-      const v = f.get("token");
-      if (typeof v === "string") {
-        return v;
+      const v2 = f.get("token");
+      if (typeof v2 === "string") {
+        return v2;
       }
     } catch {
     }
@@ -6848,7 +8470,8 @@ async function confirmLanding(c) {
 }
 async function confirm2(c) {
   const token2 = await readToken(c);
-  return confirmStatePage(c, await confirmSubscription2(c.env.DB, token2), token2);
+  const ip = c.req.headers.get("cf-connecting-ip");
+  return confirmStatePage(c, await confirmSubscription2(c.env.DB, token2, ip), token2);
 }
 async function confirmStatePage(c, state, token2) {
   const eyebrow = "Newsletter";
@@ -7068,7 +8691,7 @@ async function loadRenderInput(c) {
   }
   const revision = await getCurrentRevision(c.env.DB, post);
   if (!revision) {
-    throw badRequest("post has no content yet");
+    throw badRequest("This post has no content yet. Write something, then try again.");
   }
   const imgs = await listImages(c.env.DB, post.id);
   return { post, revision, images: imgs };
@@ -7131,9 +8754,13 @@ async function webPage(c) {
   );
 }
 async function test(c) {
-  const to = normalizeEmail(optString(await readJsonObject(c), "to") ?? "");
+  const raw = optString(await readJsonObject(c), "to") ?? "";
+  const to = normalizeEmail(raw);
   if (!isValidEmail(to)) {
-    throw fieldError("to", "to must be an email address");
+    throw fieldError(
+      "to",
+      to ? `\u201C${raw.trim()}\u201D isn\u2019t a valid email address. Fix it, then send again.` : "Enter the email address to send the test to."
+    );
   }
   requireConnectedProvider(c.config);
   const readAt = Date.now();
@@ -7215,14 +8842,14 @@ function resolveTestRecipients(body, defaults) {
   const out = [];
   for (const item of input) {
     if (typeof item !== "string") {
-      throw fieldError("to", "each recipient must be an email address");
+      throw fieldError("to", "Each recipient must be an email address.");
     }
     const email2 = normalizeEmail(item);
     if (!email2) {
       continue;
     }
     if (!isValidEmail(email2)) {
-      throw badRequest(`not a valid email address: ${item}`);
+      throw fieldError("to", `\u201C${item.trim()}\u201D isn\u2019t a valid email address. Fix or remove it.`);
     }
     if (seen.has(email2)) {
       continue;
@@ -7237,12 +8864,16 @@ async function templateTest(c) {
   const body = await readJsonObject(c, { optional: true });
   const recipients = resolveTestRecipients(body, settings.testRecipients);
   if (recipients.length === 0) {
-    throw badRequest(
-      "no recipients \u2014 pass a 'to' address, or set default test recipients in Settings"
+    throw fieldError(
+      "to",
+      "There\u2019s no one to send the test to. Enter an address, or set default test recipients in Settings."
     );
   }
   if (recipients.length > MAX_TEMPLATE_TEST_RECIPIENTS) {
-    throw badRequest(`at most ${MAX_TEMPLATE_TEST_RECIPIENTS} recipients per test`);
+    throw fieldError(
+      "to",
+      `A test can go to at most ${MAX_TEMPLATE_TEST_RECIPIENTS} addresses. Remove some, then send again.`
+    );
   }
   requireConnectedProvider(c.config);
   const result = await render(sampleRenderInput(), c.config, resolveBranding(settings, c.config));
@@ -7398,15 +9029,15 @@ function parseFireAt(input) {
     if (input.trim() !== "" && Number.isFinite(n)) {
       return n;
     }
-    const iso = Date.parse(input);
-    if (!Number.isNaN(iso)) {
+    const iso2 = Date.parse(input);
+    if (!Number.isNaN(iso2)) {
       if (!ISO_WITH_OFFSET.test(input.trim())) {
         throw fieldError(
           "fire_at",
           "fire_at must name its timezone: an ISO-8601 timestamp ending in Z or an offset like +02:00, or epoch milliseconds"
         );
       }
-      return iso;
+      return iso2;
     }
   }
   throw fieldError(
@@ -7414,9 +9045,8 @@ function parseFireAt(input) {
     "fire_at must be an ISO-8601 timestamp with a Z or \xB1hh:mm offset, or epoch milliseconds"
   );
 }
-function parseFutureFireAt(input, minLeadMs, immediateHint = false) {
-  const hint = immediateHint ? "; use POST /api/posts/:id/send for the soonest send" : "";
-  return acceptFireAt(parseFireAt(input), minLeadMs, { hint });
+function parseFutureFireAt(input, minLeadMs) {
+  return acceptFireAt(parseFireAt(input), minLeadMs);
 }
 function rejectStrayTemplateChoice(body) {
   if (body && typeof body === "object" && "template_revision" in body) {
@@ -7434,7 +9064,7 @@ async function schedule(c) {
   const body = await readJsonObject(c);
   rejectStrayTemplateChoice(body);
   requireConnectedProvider(c.config);
-  const fireAt = parseFutureFireAt(body.fire_at, c.config.minLeadMs, true);
+  const fireAt = parseFutureFireAt(body.fire_at, c.config.minLeadMs);
   const send = await freeze(c.env, c.config, post, fireAt);
   const frozen = unwrap(await viewWithCursor(c.env, send.id), "send");
   return json(frozen, 201);
@@ -7476,34 +9106,39 @@ async function repeatAnswer(c, sendId) {
 }
 
 // src/send/resolve.ts
+var NOT_SENDING = {
+  scheduled: "hasn\u2019t started",
+  sent: "has finished",
+  canceled: "was canceled"
+};
 async function resolveStuckSend(env, sendId, outcome, actor) {
   const send = await getSend(env.DB, sendId);
   if (!send) {
     throw notFound("send");
   }
-  const refuse = async (code, message2) => refusal(409, code, message2, { send: await viewSend(env, send.id) });
+  const refuse2 = async (code, message2) => refusal(409, code, message2, { send: await viewSend(env, send.id) });
   const now = Date.now();
   if (send.status === "sending" && send.locked_until !== null && send.locked_until > now) {
-    throw await refuse(
+    throw await refuse2(
       "run_in_progress",
-      "this send is being worked on right now; try Resolve again in a moment"
+      "This send is being worked on right now. Try Resolve again in a moment."
     );
   }
   if (!isWedged(send)) {
-    throw await refuse(
+    throw await refuse2(
       "not_wedged",
-      send.status === "sending" ? "send is not wedged: it still has recipients to hand off, or a run has yet to look at those in flight" : `send is ${send.status}, with no ambiguous deliveries to resolve`
+      send.status === "sending" ? "Nothing on this send needs resolving: it still has recipients to hand off, or a run has yet to look at those in flight." : `This send ${NOT_SENDING[send.status]}, so there\u2019s nothing to resolve.`
     );
   }
   const lease = await acquireLease(env.DB, sendId, now, LEASE_TTL_MS);
   if (!lease) {
     const current2 = await getSend(env.DB, sendId);
     if (!current2 || !isWedged(current2)) {
-      throw await refuse("not_wedged", "send is no longer wedged");
+      throw await refuse2("not_wedged", "Nothing on this send needs resolving any more.");
     }
-    throw await refuse(
+    throw await refuse2(
       "run_in_progress",
-      "this send is being worked on right now; try Resolve again in a moment"
+      "This send is being worked on right now. Try Resolve again in a moment."
     );
   }
   const note = outcome === "unsent" ? `operator adjudication: assumed NOT delivered (${actor})` : `operator adjudication: assumed delivered (${actor})`;
@@ -7580,15 +9215,15 @@ async function get(c) {
   return json(body, 200, headers2);
 }
 async function email(c) {
-  const format = c.url.searchParams.get("format") ?? "html";
-  if (format !== "html" && format !== "text") {
+  const format2 = c.url.searchParams.get("format") ?? "html";
+  if (format2 !== "html" && format2 !== "text") {
     throw badRequest("format must be html or text", { field: "format" });
   }
   const send = await getSend(c.env.DB, param(c, "id"));
   if (!send) {
     throw notFound("send");
   }
-  return format === "html" ? new Response(send.rendered_html, {
+  return format2 === "html" ? new Response(send.rendered_html, {
     headers: { ...POST_PAGE_SECURITY_HEADERS, "content-type": "text/html; charset=utf-8" }
   }) : new Response(send.rendered_text, {
     headers: {
@@ -7649,7 +9284,11 @@ async function feed(c) {
     now
   );
   const conditions = read.open.flatMap(
-    (s) => sendConditions(s, now).map((cond) => ({ ...cond, send_id: s.id, subject: s.subject }))
+    (s) => sendConditions(s, now, onFreePlanLimits(c.config)).map((cond) => ({
+      ...cond,
+      send_id: s.id,
+      subject: s.subject
+    }))
   ).sort(bySeverity);
   const body = {
     now,
@@ -7758,97 +9397,6 @@ async function resolve(c) {
   return json(body);
 }
 
-// src/db/notifications.ts
-async function recordNotifications(db, now) {
-  await db.prepare(
-    `INSERT OR IGNORE INTO notifications (send_id, kind, episode, created_at, updated_at)
-         SELECT id, 'finished', 0, ?1, ?1 FROM sends
-          WHERE status = 'sent' AND completed_at >= ?2
-         UNION ALL
-         SELECT id, 'refused', halted_at, ?1, ?1 FROM sends
-          WHERE status = 'sending' AND halt_reason = 'account' AND halted_at IS NOT NULL
-         UNION ALL
-         SELECT id, 'missed', 0, ?1, ?1 FROM sends
-          WHERE (status = 'scheduled' AND fire_at < ?1 - ?3)
-             OR (status IN ('sending', 'sent') AND started_at >= ?2 AND started_at - fire_at > ?3)
-         UNION ALL
-         SELECT id, 'wedged', 0, ?1, ?1 FROM sends WHERE ${WEDGED_SEND}
-         UNION ALL
-         SELECT id, 'stuck', 0, ?1, ?1 FROM sends
-          WHERE status = 'sending' AND started_at < ?1 - ?4
-            AND halt_reason IS NOT 'account' AND NOT (${WEDGED_SEND})
-            AND NOT EXISTS (SELECT 1 FROM notifications r
-                             WHERE r.send_id = sends.id AND r.kind = 'refused')`
-  ).bind(now, now - NOTIFY_HORIZON_MS, MISSED_THRESHOLD_MS, STUCK_THRESHOLD_MS).run();
-}
-async function dueNotifications(db, limit) {
-  const { results } = await db.prepare(
-    `SELECT n.send_id, n.kind, n.episode, n.attempts,
-              s.subject, s.status AS send_status, s.fire_at, s.started_at, s.completed_at,
-              s.locked_until, s.halt_reason, s.halted_at, s.halt_cause, s.halt_error, s.c_pending, s.c_in_flight, s.c_accepted,
-              s.c_delivered, s.c_bounced, s.c_complained, s.c_skipped, s.c_unsent
-         FROM notifications n JOIN sends s ON s.id = n.send_id
-        WHERE n.status = 'pending'
-        ORDER BY n.created_at ASC, n.send_id ASC, n.kind ASC
-        LIMIT ?`
-  ).bind(limit).all();
-  return results;
-}
-var IN_KEYS = `EXISTS (SELECT 1 FROM json_each(?) k
-                  WHERE json_extract(k.value, '$[0]') = notifications.send_id
-                    AND json_extract(k.value, '$[1]') = notifications.kind
-                    AND json_extract(k.value, '$[2]') = notifications.episode)`;
-async function claimNotifications(db, keys, now) {
-  await db.prepare(
-    `UPDATE notifications SET attempts = attempts + 1, updated_at = ?
-        WHERE status = 'pending' AND ${IN_KEYS}`
-  ).bind(now, JSON.stringify(keys.map((k) => [k.send_id, k.kind, k.episode]))).run();
-}
-async function recordNotificationOutcome(db, key, outcome, now) {
-  const status = outcome.status === "unsent" ? outcome.giveUp ? "failed" : "pending" : outcome.status;
-  const error = outcome.status === "unsent" ? outcome.error : null;
-  await db.prepare(
-    `UPDATE notifications SET status = ?, error = ?, updated_at = ?
-        WHERE send_id = ? AND kind = ? AND episode = ?`
-  ).bind(status, error, now, key.send_id, key.kind, key.episode).run();
-}
-async function recordNotificationTest(db, error, now) {
-  await db.batch([
-    db.prepare("DELETE FROM notifications WHERE kind = 'test'"),
-    db.prepare(
-      `INSERT INTO notifications (send_id, kind, episode, status, attempts, error, created_at, updated_at)
-         VALUES (NULL, 'test', 0, ?, 1, ?, ?, ?)`
-    ).bind(error === null ? "sent" : "failed", error, now, now)
-  ]);
-}
-async function closeUnaddressed(db, now) {
-  await db.prepare(
-    "UPDATE notifications SET status = 'unaddressed', updated_at = ? WHERE status = 'pending'"
-  ).bind(now).run();
-}
-async function notificationStatus(db) {
-  const { results } = await db.prepare(
-    `SELECT * FROM (
-         SELECT 'sent' AS which, n.kind, COALESCE(s.subject, '') AS subject,
-                n.updated_at AS at, NULL AS error
-           FROM notifications n LEFT JOIN sends s ON s.id = n.send_id
-          WHERE n.status = 'sent' ORDER BY n.updated_at DESC LIMIT 1)
-       UNION ALL
-       SELECT * FROM (
-         SELECT 'failed' AS which, n.kind, COALESCE(s.subject, '') AS subject,
-                n.updated_at AS at, n.error
-           FROM notifications n LEFT JOIN sends s ON s.id = n.send_id
-          WHERE n.error IS NOT NULL AND n.status IN ('pending', 'failed')
-          ORDER BY n.updated_at DESC LIMIT 1)`
-  ).all();
-  const sent = results.find((r) => r.which === "sent");
-  const failed = results.find((r) => r.which === "failed");
-  return {
-    lastSent: sent ? { kind: sent.kind, subject: sent.subject, at: sent.at } : null,
-    lastFailure: failed && (!sent || failed.at > sent.at) ? { kind: failed.kind, subject: failed.subject, at: failed.at, error: failed.error ?? "" } : null
-  };
-}
-
 // src/notify/channel.ts
 function getNotifier(config, env) {
   switch (config.notifyChannel) {
@@ -8003,6 +9551,23 @@ function composeNotification(n, config) {
     }
   }
 }
+function composeImportNotification(n, config) {
+  const counts2 = JSON.parse(n.counts);
+  const c = (k) => counts2[k] ?? 0;
+  const confirmed = c("create_confirmed") + c("confirm_pending");
+  const unsubscribed = c("mark_unsubscribed") + c("create_unsubscribed");
+  const notImported = c("blocked_by_suppression") + c("kept_unsubscribed") + c("kept_confirmed_newer") + c("left_out") + c("invalid");
+  return message(
+    `Claude imported ${confirmed} subscribers from ${n.file_name}`,
+    [
+      `Claude imported "${n.file_name}" into your list at ${when(n.created_at)}, through the API with its service token.`,
+      `Confirmed as subscribers: ${confirmed}. Unsubscribed: ${unsubscribed}. Suppressions added: ${n.suppressions_added}. Not imported as subscribers (suppressed here, unsubscribed here, invalid, or with no consent claim): ${notImported}. Already on your list as the file says: ${c("unchanged")}.`,
+      n.attestation_version === null ? "No one was confirmed, so no attestation was needed." : "Claude attested for you that everyone imported as subscribed opted in to receive your newsletter, and that the list isn\u2019t purchased, rented, or scraped. If that isn\u2019t so, remove those subscribers before your next post goes out.",
+      "Nobody was emailed by the import."
+    ],
+    dashboardLink(config.appOrigin, "/subscribers")
+  );
+}
 function sampleNotification(config) {
   return message(
     "Test: notifications from Kestrel",
@@ -8026,7 +9591,7 @@ function remakeRequired(sends) {
   return new HttpError(
     409,
     "remake_required",
-    `saving this change re-makes ${n} scheduled email${n === 1 ? "" : "s"}; pass their ids in \`remake\` to confirm`,
+    `Saving this change re-makes ${n} scheduled email${n === 1 ? "" : "s"}. Pass their ids in \`remake\` to confirm.`,
     details
   );
 }
@@ -8036,7 +9601,7 @@ function remakeTooClose(sends, retryAfter, now) {
   return new HttpError(
     409,
     "remake_too_close",
-    `"${first.subject}" sends in ${minutes3} minute${minutes3 === 1 ? "" : "s"}; try again once it has sent`,
+    `\u201C${first.subject}\u201D sends in ${minutes3} minute${minutes3 === 1 ? "" : "s"}. Try again once it has sent.`,
     { retry_after: retryAfter, sends }
   );
 }
@@ -8143,7 +9708,10 @@ function deploymentView(cfg, principal) {
     simulation: cfg.simulation,
     // Whether `provider: "none"` is local dev's preview of not connected, so the editor
     // words its way out as a restart rather than a deploy; false in every deployed env.
-    notConnectedPreview: cfg.notConnectedPreview
+    notConnectedPreview: cfg.notConnectedPreview,
+    // Whether the deployment runs on Workers Free's limits, so the Schedule dialog can warn
+    // before a send D1's daily writes may not cover, in the words the send's condition uses.
+    freePlanLimits: onFreePlanLimits(cfg)
   };
 }
 function publicationView(settings, cfg) {
@@ -8172,7 +9740,7 @@ function settingsView(settings, cfg) {
 function renderedIdentityFields(settings, cfg) {
   return identityFieldsInUse(resolveBranding(settings, cfg).template);
 }
-var ADDRESS_NOT_PRINTED = "You've added a mailing address in Settings, but this template doesn't include the {{ .Publication.Address }} field. If you send promotional email, add it to the footer. If you've written your address into the template yourself, or don't need to provide one, you can ignore this or remove the address in Settings.";
+var ADDRESS_NOT_PRINTED = "You\u2019ve added a mailing address in Settings, but this template doesn\u2019t include the {{ .Publication.Address }} field. If you send promotional email, add it to the footer. If you\u2019ve written your address into the template yourself, or don\u2019t need to provide one, you can ignore this or remove the address in Settings.";
 async function inUseView(db, settings, cfg) {
   const sends = await listScheduledSends(db);
   return {
@@ -8194,7 +9762,9 @@ async function get2(c) {
 async function notificationTest(c) {
   const { to } = (await getSettings(c.env.DB)).notifications;
   if (!to) {
-    throw badRequest("set a notifications address first", { field: "notifications.to" });
+    throw badRequest("Add a notifications address first, then send a test.", {
+      field: "notifications.to"
+    });
   }
   if (c.config.notifyChannel === "provider") {
     requireConnectedProvider(c.config);
@@ -8227,11 +9797,11 @@ async function update(c) {
   const ack = readAck(body);
   let warnings = [];
   if (patch.emailTemplate !== void 0) {
-    const v = validateEmailTemplate(patch.emailTemplate);
-    if (v.errors.length > 0) {
-      throw badRequest(v.errors.join(" "));
+    const v2 = validateEmailTemplate(patch.emailTemplate);
+    if (v2.errors.length > 0) {
+      throw badRequest(v2.errors.join(" "));
     }
-    warnings = v.warnings;
+    warnings = v2.warnings;
   }
   const current2 = await getSettings(c.env.DB);
   try {
@@ -8270,14 +9840,14 @@ async function uploadLogo(c) {
   }
   const type = mediaType(file.type);
   if (!RASTER_IMAGE_TYPES.includes(type)) {
-    throw badRequest("The logo must be a PNG, JPEG, WebP, or GIF. Most email apps don't show SVG.");
+    throw badRequest("The logo must be a PNG, JPEG, WebP, or GIF. Most email apps don\u2019t show SVG.");
   }
   const bytes = await file.arrayBuffer();
   if (bytes.byteLength === 0) {
-    throw badRequest("the logo file is empty");
+    throw badRequest("The logo file is empty.");
   }
   if (bytes.byteLength > MAX_LOGO_BYTES) {
-    throw badRequest("logo must be 512 KB or smaller");
+    throw badRequest("The logo must be 512 KB or smaller.");
   }
   const version = Date.now();
   const key = newLogoKey(version);
@@ -8319,9 +9889,9 @@ function readPatch(o) {
   if (p !== void 0) {
     const pub = {};
     for (const k of ["name", "tagline", "address"]) {
-      const v = optString(p, k, "publication");
-      if (v !== void 0) {
-        pub[k] = v;
+      const v2 = optString(p, k, "publication");
+      if (v2 !== void 0) {
+        pub[k] = v2;
       }
     }
     patch.publication = pub;
@@ -8334,9 +9904,9 @@ function readPatch(o) {
   if (ceBody !== void 0) {
     const ce = {};
     for (const k of ["subject", "body", "buttonLabel", "reassurance"]) {
-      const v = optString(ceBody, k, "confirmationEmail");
-      if (v !== void 0) {
-        ce[k] = v;
+      const v2 = optString(ceBody, k, "confirmationEmail");
+      if (v2 !== void 0) {
+        ce[k] = v2;
       }
     }
     patch.confirmationEmail = ce;
@@ -8354,7 +9924,7 @@ async function create(c) {
   const raw = optString(await readJsonObject(c), "email");
   const email2 = raw === void 0 ? "" : normalizeEmail(raw);
   if (!email2 || !isValidEmail(email2)) {
-    throw fieldError("email", "a valid email is required");
+    throw fieldError("email", "Enter a valid email address.");
   }
   const outcome = await requestSubscription(c, email2);
   if (outcome.kind === "failed") {
@@ -8494,7 +10064,7 @@ function createRouter({
 }) {
   const devOnly = (...defs) => devMode ? defs : [];
   const lead = `${formatLead(minLeadMs)} on this deployment (\`deployment.minLeadMs\` in \`GET /api/settings\`); a deployment sets it with \`MIN_LEAD_SECONDS\`, never below ${formatLead(MIN_LEAD_FLOOR_MS)}`;
-  const conditionsText = `\`conditions\` is what is wrong with the send, or worth knowing, now (SPEC \xA78, \xA712), derived by the server from the send and the same on every route, most severe first: \`missed\` (still scheduled ${MISSED_THRESHOLD_MS / 6e4} minutes past its fire time: the sweep is not running), \`stuck\` (still sending ${STUCK_THRESHOLD_MS / 6e4} minutes after it started, whatever the cause), \`wedged\` (\`count\` recipients whose delivery is unknown, settled by Resolve), \`refused\` (the provider refusing the account, with its \`cause\`, its own words as \`error\`, the \`advice\` for the fix, which is outside this API, and \`retry_at\`; the send resumes on its own once the account is fixed, having consumed no one), \`provider_unavailable\` (an outage or a rate limit, retried on its own at \`retry_at\`), \`bounce_spike\` (a send finished within ${BOUNCE_SPIKE_RECENT_MS / 864e5} days whose confirmed bounces reached ${BOUNCE_SPIKE_RATE * 100}% of its audience at fire, at least ${BOUNCE_SPIKE_MIN}; \`bounced\` and \`rate\`), and \`remade\` (a template or identity change re-made the scheduled email after its last test, \`tested_at\`; a test of the post clears it). Each has a \`severity\` (\`action\`: a person must act; \`warn\`: worth a look; \`info\`), \`since\` (null when the record does not say), a \`message\` to show or relay as it stands, and the \`action\` that settles it, if any. \`actions\` is exactly what the server would accept on the send now, each \`{name, method, path}\`: \`cancel\` and \`reschedule\` while it is scheduled and its fire time is still ahead, \`resolve\` while it is wedged.`;
+  const conditionsText = `\`conditions\` is what is wrong with the send, or worth knowing, now (SPEC \xA78, \xA712), derived by the server from the send and the same on every route, most severe first: \`missed\` (still scheduled ${MISSED_THRESHOLD_MS / 6e4} minutes past its fire time: the sweep is not running), \`stuck\` (still sending ${STUCK_THRESHOLD_MS / 6e4} minutes after it started, whatever the cause), \`wedged\` (\`count\` recipients whose delivery is unknown, settled by Resolve), \`refused\` (the provider refusing the account, with its \`cause\`, its own words as \`error\`, the \`advice\` for the fix, which is outside this API, and \`retry_at\`; the send resumes on its own once the account is fixed, having consumed no one), \`provider_unavailable\` (an outage or a rate limit, retried on its own at \`retry_at\`), \`bounce_spike\` (a send finished within ${BOUNCE_SPIKE_RECENT_MS / 864e5} days whose confirmed bounces reached ${BOUNCE_SPIKE_RATE * 100}% of its audience at fire, at least ${BOUNCE_SPIKE_MIN}; \`bounced\` and \`rate\`), \`remade\` (a template or identity change re-made the scheduled email after its last test, \`tested_at\`; a test of the post clears it), and \`daily_writes\` (on the Workers Free plan's limits, a scheduled send to more than ${DAILY_WRITES_SEND_RECIPIENTS.toLocaleString("en-US")} recipients, which may spend D1's daily allowance of written rows and stop the instance until midnight UTC; \`recipients\`; a warning, never a refusal). Each has a \`severity\` (\`action\`: a person must act; \`warn\`: worth a look; \`info\`), \`since\` (null when the record does not say), a \`message\` to show or relay as it stands, and the \`action\` that settles it, if any. \`actions\` is exactly what the server would accept on the send now, each \`{name, method, path}\`: \`cancel\` and \`reschedule\` while it is scheduled and its fire time is still ahead, \`resolve\` while it is wedged.`;
   const notConnected = "Refused with 409 `provider_not_connected` while no email provider is connected (SPEC \xA79), since nothing can be sent.";
   const actionText = "An act carries no precondition on the send you read: it applies to the send as it stands, within the rules above, and the answer shows the result. An `If-Match` header is ignored. Every refusal carries the send as it stands in `send`, in the `GET /api/sends` row shape.";
   const sendExample = (over = {}) => ({
@@ -8663,7 +10233,7 @@ function createRouter({
       access: "admin",
       resource: "settings",
       summary: "Runtime preferences, a read-only reflection of deploy config (no secrets), and `inUse`: the scheduled sends a template or identity change would re-make.",
-      description: "`deployment.provider` is `ses`; `fake`, a stand-in that records a send and delivers nothing (local development, a demo); or `none` while no email provider is connected (SPEC \xA79), when everything that would send is refused with 409 `provider_not_connected`. `deployment.notConnectedPreview` is true when that `none` is local development previewing the state (SPEC \xA710), whose way out is a restart rather than a deploy; it is false once deployed. `inUse.sends` is every scheduled send, soonest first; `inUse.retry_after` is the moment after which a save is no longer refused for the minimum lead (null when none is inside it); `inUse.identityFields` is the identity fields the current template renders, the only ones whose change reaches the email.",
+      description: "`deployment.provider` is `ses`; `fake`, a stand-in that records a send and delivers nothing (local development, a demo); or `none` while no email provider is connected (SPEC \xA79), when everything that would send is refused with 409 `provider_not_connected`. `deployment.notConnectedPreview` is true when that `none` is local development previewing the state (SPEC \xA710), whose way out is a restart rather than a deploy; it is false once deployed. `deployment.freePlanLimits` is true on the Workers Free plan's limits (`SUBREQUEST_BUDGET` unset), where a scheduled send to more than 5,000 recipients carries the `daily_writes` condition. `inUse.sends` is every scheduled send, soonest first; `inUse.retry_after` is the moment after which a save is no longer refused for the minimum lead (null when none is inside it); `inUse.identityFields` is the identity fields the current template renders, the only ones whose change reaches the email.",
       example: {
         response: {
           settings: { emailTemplate: "\u2026", publication: { name: "Marsh Lane" } },
@@ -8832,7 +10402,7 @@ function createRouter({
       accepts: JSON_BODY,
       resource: "posts",
       summary: "Update a draft. Send the revision you read as `base_revision` (or If-Match): a save without one is a 428 `base_required` carrying the post as it stands, and one whose base is no longer current is a 409 `stale_revision`.",
-      description: "Only a draft is editable; a scheduled post is soft-locked until its schedule is canceled. While the post's slug follows the subject (`slug_auto: true`), every save derives it from the subject again and numbers it if another post holds it, so take the slug from the answer. Sending `slug` sets it by hand and turns `slug_auto` off; `slug_auto: true` has it follow the subject again. Sending both is a 400 naming `slug`.",
+      description: "Only a draft is editable; a scheduled post is soft-locked until its schedule is canceled, and a save to a post that is not a draft is a 409 `post_not_draft` (its message says whether canceling the schedule would unlock it). While the post's slug follows the subject (`slug_auto: true`), every save derives it from the subject again and numbers it if another post holds it, so take the slug from the answer. Sending `slug` sets it by hand and turns `slug_auto` off; `slug_auto: true` has it follow the subject again. Sending both is a 400 naming `slug`.",
       example: {
         request: {
           subject: "Hello again, world",
@@ -8856,7 +10426,7 @@ function createRouter({
       path: "/api/posts/:id",
       access: "admin",
       resource: "posts",
-      summary: "Delete a draft and its revisions (drafts only).",
+      summary: "Delete a draft and its revisions (drafts only; any other post is a 409 `post_not_draft`).",
       handler: deletePost2
     },
     {
@@ -8882,7 +10452,7 @@ function createRouter({
       access: "admin",
       accepts: [...FORM_UPLOAD, ...RASTER_IMAGE_TYPES],
       resource: "posts",
-      summary: "Upload an image to a post (multipart form field `file`).",
+      summary: "Upload an image to a draft (multipart form field `file`); a post that is not a draft is a 409 `post_not_draft`.",
       handler: uploadImage
     },
     {
@@ -8898,7 +10468,7 @@ function createRouter({
       path: "/api/posts/:id/images/:filename",
       access: "admin",
       resource: "posts",
-      summary: "Delete one image from a post.",
+      summary: "Delete one image from a draft; a post that is not a draft is a 409 `post_not_draft`.",
       handler: deleteImage
     },
     // --- render: preview + test (authed); all go through the one render path ---
@@ -8985,7 +10555,7 @@ function createRouter({
       accepts: JSON_BODY,
       resource: "posts",
       summary: `Freeze the render and schedule the send for a future time (at least ${formatLead(minLeadMs)} out).`,
-      description: "Freezes the current draft, with the template and identity as they stand, onto a send row and soft-locks the post; cancelable until its fire time. A later template or identity change re-makes that frozen email after the publisher confirms it (SPEC \xA76); there is no per-send template to name, and a `template_revision` field is a 400. `fire_at` is epoch milliseconds or an ISO-8601 timestamp with a `Z` or `\xB1hh:mm` offset; a timestamp without one is a 400, since the Worker cannot know which local time was meant. `fire_at` must be at least the minimum lead out, a 400 `fire_at_too_soon` otherwise: " + lead + ". The time is then rounded up to the next whole minute (one already on the minute stays), since the sweep fires sends on the minute; the lead is checked on the time as requested, so rounding only lengthens the window. Answers with the new send's view (as `GET /api/sends/:id` describes it) and a `cursor` to follow it from. Refusals: 409 `active_send_exists` when the post already has its one active send (carried as `send`), 409 `post_not_draft`, 400 `subject_required` for an empty subject, 409 `settings_changed` when a template or identity save kept landing while it froze (try again), and 409 `provider_not_connected` while no email provider is connected (SPEC \xA79).",
+      description: "Freezes the current draft, with the template and identity as they stand, onto a send row and soft-locks the post; cancelable until its fire time. A later template or identity change re-makes that frozen email after the publisher confirms it (SPEC \xA76); there is no per-send template to name, and a `template_revision` field is a 400. `fire_at` is epoch milliseconds or an ISO-8601 timestamp with a `Z` or `\xB1hh:mm` offset; a timestamp without one is a 400, since the Worker cannot know which local time was meant. `fire_at` must be at least the minimum lead out, a 400 `fire_at_too_soon` otherwise (for the soonest send, use Send now, `POST /api/posts/:id/send`): " + lead + ". The time is then rounded up to the next whole minute (one already on the minute stays), since the sweep fires sends on the minute; the lead is checked on the time as requested, so rounding only lengthens the window. Answers with the new send's view (as `GET /api/sends/:id` describes it) and a `cursor` to follow it from. Refusals: 409 `active_send_exists` when the post already has its one active send (carried as `send`), 409 `post_not_draft`, 400 `subject_required` for an empty subject, 409 `settings_changed` when a template or identity save kept landing while it froze (try again), and 409 `provider_not_connected` while no email provider is connected (SPEC \xA79).",
       example: {
         request: { fire_at: "2026-01-16T09:00:00Z" },
         response: { send: scheduledExample, cursor: "57.1768467610000" }
@@ -9011,7 +10581,7 @@ function createRouter({
       access: "admin",
       resource: "sends",
       summary: "List sends with delivery progress. Filter, sort, and paginate via query params; returns a `page` envelope. Each row is the send's view, the same shape `GET /api/sends/:id`, the feed, and every action answer with (see `GET /api/sends/:id`), read at the same moment, so a list row and the watch never read a send differently. A row's `rev` rises with every change a reader could see (a cancel, a move, a re-make, dispatch progress, a receipt), ordered across all sends. The response's `cursor` marks where this read stood among those changes: `<seq>.<at>`, the change sequence at the read and the server's time of it (epoch milliseconds), both decimal; pass it to `GET /api/sends/feed` as `since`. `audience.count` is a snapshot of the audience while a send is scheduled; once it fires (`audience.fixed`), it is the audience fixed at fire, which never grows.",
-      description: "`provider.halt` describes a `sending` send whose provider refused its last batch as a whole (SPEC \xA712), and is null otherwise: its `reason`, `cause`, the provider's own words as `error`, and `since`. The send retries on its own, spaced out the longer the halt lasts: `retries` counts the halted attempts in a row and `retry_at` is when the next is due, up to an hour apart, and both reset the moment a batch is answered. `unavailable` is an outage or a rate limit, retried " + retrySchedule(HALT_BACKOFF_MS.unavailable) + ", and worth raising only once the send carries the `stuck` condition. `account` is the provider refusing the account itself, retried " + retrySchedule(HALT_BACKOFF_MS.account) + "; `cause` names what (`credentials`, `sender`, `quota`, `suspended`, or `not_connected`, a deployment with no provider connected). Either way no recipient has been consumed. The fix for `account` is outside this API (the provider's dashboard, or the deployment's secrets, which the API never exposes, SPEC \xA79), and once it lands the send resumes by itself at its next retry, so it is never rescheduled or sent again. There is no API action to retry sooner. " + conditionsText + " An unknown `status`, `failures`, `sort`, or `dir`, or a `limit` or `offset` that is not a whole number, is a 400 naming the field.",
+      description: "`provider.halt` describes a `sending` send whose provider refused its last batch as a whole (SPEC \xA712), and is null otherwise: its `reason`, `cause`, the provider's own words as `error`, and `since`. The send retries on its own, spaced out the longer the halt lasts: `retries` counts the halted attempts in a row and `retry_at` is when the next is due, up to an hour apart, and both reset the moment a batch is answered. `unavailable` is an outage or a rate limit, retried " + retrySchedule(HALT_BACKOFF_MS.unavailable) + ", and worth raising only once the send carries the `stuck` condition. `account` is the provider refusing the account itself, retried " + retrySchedule(HALT_BACKOFF_MS.account) + "; `cause` names what (`credentials`, `configuration`, `sender`, `quota`, `suspended`, or `not_connected`, a deployment with no provider connected). Either way no recipient has been consumed. The fix for `account` is outside this API (the provider's dashboard, or the deployment's secrets, which the API never exposes, SPEC \xA79), and once it lands the send resumes by itself at its next retry, so it is never rescheduled or sent again. There is no API action to retry sooner. " + conditionsText + " An unknown `status`, `failures`, `sort`, or `dir`, or a `limit` or `offset` that is not a whole number, is a 400 naming the field.",
       query: [
         {
           name: "status",
@@ -9285,6 +10855,44 @@ function createRouter({
       ],
       handler: list3
     },
+    {
+      // Before `/api/subscribers/:id`, which would otherwise take `export` as an id.
+      method: "GET",
+      path: "/api/subscribers/export",
+      access: "admin",
+      resource: "subscribers",
+      summary: "The whole list in the import format (`kestrel-subscribers/1`, SPEC \xA77), a page at a time.",
+      description: "Every subscriber (`confirmed` is written as `status: subscribed`) with how they joined, their evidence, and their suppression, plus every address suppressed with no subscriber behind it (`status: none`), an erased one as `suppression: erased`. An imported bounce or complaint is written as `bounce` or `complaint`. Times are UTC ISO-8601. Importing it into another instance carries the list over, every confirmation arriving as imported. Pages run in address order, and following `next` until it is `null` reads every address on the list for the whole export exactly once; one added or removed partway through may or may not appear. The server sets the page size: 1,000 rows on the Workers Free plan's limits (`SUBREQUEST_BUDGET` unset), 10,000 otherwise. `exported_at` is when the first page was read, the same on every page. For a CSV, write the pages' rows as the format's CSV, its header once: a value starting with `=`, `+`, `-`, or `@` carries a leading `'` so a spreadsheet won't run it as a formula, and the importer removes it.",
+      query: [
+        {
+          name: "after",
+          description: "The `next` a page returned, for the page after it; leave it out for the first. A value this server didn't issue is a 400 naming the field."
+        }
+      ],
+      example: {
+        response: {
+          format: "kestrel-subscribers/1",
+          exported_at: 17684676e5,
+          subscribers: [
+            {
+              email: "ada@example.com",
+              status: "subscribed",
+              opt_in: "double",
+              origin: "kestrel",
+              suppression: null,
+              subscribed_at: "2026-01-02T09:30:00.000Z",
+              confirmed_at: "2026-01-02T09:42:00.000Z",
+              unsubscribed_at: null,
+              suppressed_at: null,
+              evidence: '{"confirmed_ip":"203.0.113.7"}',
+              format: "kestrel-subscribers/1"
+            }
+          ],
+          next: "eyJ2IjoxLCJhZnRlciI6ImFkYUBleGFtcGxlLmNvbSIsImF0IjoxNzY4NDY3NjAwMDAwfQ"
+        }
+      },
+      handler: exportList
+    },
     {
       method: "GET",
       path: "/api/subscribers/:id",
@@ -9301,6 +10909,109 @@ function createRouter({
       summary: "Unsubscribe a subscriber (admin-initiated).",
       handler: unsubscribe2
     },
+    // --- imports (authed admin) ---
+    {
+      method: "GET",
+      path: "/api/imports/format",
+      access: "admin",
+      resource: "imports",
+      summary: "Everything about the import format (SPEC \xA77), generated from the definition the importer reads with: the preferred file and why, each accepted file with when to use it and what it loses, the columns, the plain list's rules, this deployment's limits, the outcomes, and the attestation.",
+      description: "Read it before converting a list. The full CSV (`kestrel-subscribers/1`) is preferred: it carries unsubscribes, bounces, and how each person joined, and it is what the export writes. A plain `.txt` list of addresses is the fallback for a list that is only addresses. Another service's export is converted to the format first; nothing is guessed. `limits.max_rows` is what this deployment takes, with `max_rows_reason` when it is below the format's own limit.",
+      handler: format
+    },
+    {
+      method: "GET",
+      path: "/api/imports/template.csv",
+      access: "admin",
+      resource: "imports",
+      summary: "A CSV template in the import format, showing its cases; uploaded unchanged it plans cleanly.",
+      handler: templateCsv
+    },
+    {
+      method: "GET",
+      path: "/api/imports/template.txt",
+      access: "admin",
+      resource: "imports",
+      summary: "A plain-list template: one address per line.",
+      handler: templateTxt
+    },
+    {
+      method: "POST",
+      path: "/api/imports/plan",
+      access: "admin",
+      accepts: JSON_BODY,
+      resource: "imports",
+      summary: "Plan an import: what it would do to every row against the list as it stands. Writes nothing, so call it as often as a file needs.",
+      description: `Body \`{ file: { name, text }, plain_list_status? }\`: the file's name (\`.csv\` for the format, \`.txt\` for a plain list) and its contents as UTF-8 text, and for a plain list what its addresses are, \`subscribed\` (the default), \`unsubscribed\`, or \`bounced\` (a 400 naming the field on a CSV, whose rows say). Answers \`counts\` (every row once, by outcome, summing to \`file.rows\`), \`suppressions_added\`, \`confirmed\` (the rows to be confirmed, by \`opt_in\` and \`origin\`), \`rows\` (each row that won't be confirmed, with its outcome), \`sends_growing\` (each send whose audience would grow, with \`gains\`: a scheduled one, or one that fired but hasn't fixed its audience yet), \`attestation\` (\`{ version, text }\` when anyone would be confirmed, else null), \`plan_hash\`, and \`daily_writes_warning\` (on the Workers Free plan's limits, the server's words when the list the import leaves holds more than ${DAILY_WRITES_IMPORT_CONFIRMED.toLocaleString("en-US")} confirmed subscribers, too many to import and send to on one day within D1's daily allowance of written rows; else null; never a refusal, and outside the hash). The outcomes and when each applies are in \`GET /api/imports/format\`. Refusals name what was wrong and what was expected: 400 \`unrecognized_format\` (not a file in the format at all, with \`row\` where it shows), 400 \`invalid_field\` (a column or value the format doesn't take, with \`row\`, \`column\`, and \`allowed\` where the values are a set), 400 \`too_many_rows\` (over this deployment's \`limit\`), and 413 \`body_too_large\` (over ${IMPORT_LIMITS.maxBodyBytes / (1024 * 1024)} MB).`,
+      example: {
+        request: {
+          file: {
+            name: "subscribers.csv",
+            text: "email,status,opt_in,origin\r\nada@example.com,subscribed,double,sendy\r\nedsger@example.com,unsubscribed,unknown,sendy\r\n"
+          }
+        },
+        response: {
+          file: {
+            name: "subscribers.csv",
+            kind: "csv",
+            rows: 2,
+            addresses: 2,
+            plain_list_status: null
+          },
+          counts: {
+            create_confirmed: 1,
+            confirm_pending: 0,
+            unchanged: 0,
+            mark_unsubscribed: 0,
+            create_unsubscribed: 1,
+            kept_confirmed_newer: 0,
+            kept_unsubscribed: 0,
+            blocked_by_suppression: 0,
+            suppression_added: 0,
+            left_out: 0,
+            invalid: 0,
+            merged: 0
+          },
+          suppressions_added: 0,
+          confirmed: { opt_in: { double: 1, single: 0, unknown: 0 }, origin: { sendy: 1 } },
+          rows: [
+            {
+              row: 2,
+              email: "edsger@example.com",
+              outcome: "create_unsubscribed",
+              suppression_added: false
+            }
+          ],
+          sends_growing: [
+            { id: "s_xyz789", subject: "Spring migration", fire_at: 1768554e6, gains: 1 }
+          ],
+          attestation: {
+            version: 1,
+            text: "Everyone I'm importing as subscribed opted in to receive Field Notes. This isn't a purchased, rented, or scraped list."
+          },
+          plan_hash: "9f2c\u2026"
+        }
+      },
+      handler: planRoute
+    },
+    {
+      method: "POST",
+      path: "/api/imports",
+      access: "admin",
+      accepts: JSON_BODY,
+      resource: "imports",
+      summary: "Commit a plan: apply it all, or nothing, in one batch, and keep the import's record. Never sends an email.",
+      description: "The plan's body plus `plan_hash`, `attestation: { version, accepted: true }` when the plan returned one, and `acknowledge_sends`: the id of every send in `sends_growing`. It plans again and refuses 409 `plan_stale` when the hash differs (the file, its declared meaning, whether an attestation is needed, or the growing sends changed, or another import was committed since; plan again). The list moving in between is not refused: every write re-checks the list as it stands, so a reader who unsubscribed meanwhile stays unsubscribed, and `differed` lists each row whose result differs from the commit's own plan. 409 `attestation_required` (with the `attestation` to show) when the plan confirms anyone and none was given. 409 `sends_acknowledgement_required` (with the `sends`) when a send that would grow isn't acknowledged, and always for a service token, which can't acknowledge one: the publisher finishes that import in the dashboard. A service token may attest; the record says so, and the publisher is emailed the counts. Answers 201 with the `import` record (never an address), `counts` and `suppressions_added` as applied, `rows` (those not confirmed, as applied), `differed`, and `replayed: false`. A commit repeated with the same plan and file answers 200 with the stored record and `replayed: true`, applying nothing twice. The plan route's refusals apply too.",
+      example: {
+        request: {
+          file: { name: "subscribers.csv", text: "email,status,opt_in,origin\r\n\u2026" },
+          plan_hash: "9f2c\u2026",
+          attestation: { version: 1, accepted: true },
+          acknowledge_sends: ["s_xyz789"]
+        }
+      },
+      handler: commit
+    },
     // --- suppressions (authed admin) ---
     {
       method: "GET",
@@ -9478,7 +11189,9 @@ var SHIPPED_MIGRATIONS = [
   "0001_init.sql",
   "0002_sends_since_1_0.sql",
   "0003_post_slug_auto.sql",
-  "0004_keyed_pending_to_resolve.sql"
+  "0004_keyed_pending_to_resolve.sql",
+  "0005_imports.sql",
+  "0006_deliveries_fewer_indexes.sql"
 ];
 async function missingMigrations(db) {
   let applied;
@@ -9616,6 +11329,8 @@ var NOTIFY_RESERVE = OPEN_COST + EACH_COST;
 var MAX_PER_TICK = 10;
 function stillHolds(n, now) {
   switch (n.kind) {
+    case "import":
+      return true;
     case "finished":
       return true;
     case "refused":
@@ -9657,17 +11372,19 @@ async function notifyPublisher(env, budget) {
       await recordNotificationOutcome(db, n, { status: "cleared" }, Date.now());
       continue;
     }
-    const key = `${n.send_id}-${n.kind}-${n.episode}`;
+    const about = n.kind === "import" ? { importId: n.import_id } : { sendId: n.send_id };
+    const key = `${n.send_id ?? n.import_id}-${n.kind}-${n.episode}`;
     budget.request();
     try {
-      await notifier.send(to, composeNotification(n, config), key);
+      const email2 = n.kind === "import" ? composeImportNotification(n, config) : composeNotification(n, config);
+      await notifier.send(to, email2, key);
       await recordNotificationOutcome(db, n, { status: "sent" }, Date.now());
-      log.info("notify.sent", { sendId: n.send_id, kind: n.kind, channel: notifier.channel });
+      log.info("notify.sent", { ...about, kind: n.kind, channel: notifier.channel });
     } catch (err) {
       const error = errorText(err);
       const giveUp = n.attempts + 1 >= MAX_NOTIFY_ATTEMPTS;
       log.warn("notify.failed", {
-        sendId: n.send_id,
+        ...about,
         kind: n.kind,
         channel: notifier.channel,
         error,