@softure-ai/mailing 0.2.1 → 0.2.2

package/CHANGELOG.md

@@ -4,6 +4,27 @@ Newest first. Each version lists what changed for an app that uses `@softure-ai/
 production, the version gets a line `verified in: <app>@<commit>` ([docs/05](../../docs/05-adoption-playbook.md),
 "Definition of done"). Versions before the first one below are described in their GitHub Releases (`mailing@x.y.z`).
 
+## 0.2.2
+
+- The unsubscribe page no longer posts to the URL that carries the signed token (#556). Its form sends the link in
+  hidden fields to the one-click route's bare path (`routes.oneClick`); `postUnsubscribeRoute` records a POST
+  whose URL has no link and whose URL-encoded body (at most 8 KiB) has one as a `page` opt-out and answers with a
+  303 to the page's outcome (`/unsubscribe?status=done`, `invalid` or `failed`), as the server action did. A mail
+  client's RFC 8058 one-click POST (link in the URL) is unchanged. With JavaScript the page also strips the link's
+  parameters from the address bar after load (`history.replaceState`); without it the page still works.
+- `unsubscribeAction` is unchanged and still exported, but the package page no longer uses it: a server action
+  posts to the page's URL, query included.
+- Migrate an app:
+  1. Using the package page and route (`UnsubscribePage` or `createUnsubscribePage`, `postUnsubscribeRoute` on
+     `routes.oneClick`): nothing to change. The route must stay mounted and public, as before.
+  2. An app that kept its own unsubscribe page only to move the token out of the URL (hidden fields plus
+     `history.replaceState`): delete that page and mount the package page instead
+     (`export { UnsubscribePage as default } from "@softure-ai/mailing/next"`, or `createUnsubscribePage({ Layout })`
+     for the app's frame).
+  3. An app with its own form posting to `unsubscribeAction`: point the form at the route instead
+     (`<form action="/api/mailing/unsubscribe" method="post">` with the link's `r` and `t`, or the legacy
+     parameters, as hidden fields) to keep the token out of the POST URL.
+
 ## 0.2.1
 
 - New entry `@softure-ai/mailing/jobs` (#492), with `@softure-ai/jobs` as an optional peer dependency:

package/README.md

@@ -583,6 +583,16 @@ function AppShell({ title, lead, children }: UnsubscribeLayoutProps) {
 export default createUnsubscribePage({ Layout: AppShell, classNames: { submit: "w-full" } });
 ```
 
+**The token stays out of request lines.** The page's form posts the link in hidden fields to the
+route's bare path (`routes.oneClick`), which records it as a `page` opt-out and answers with a 303
+to the page's outcome (`?status=done`, `invalid` or `failed`). The route tells the two callers
+apart by where the link is: in the URL, a mail client's one-click POST; only in a URL-encoded body
+(at most 8 KiB), the page's form. With JavaScript the page also takes the link out of the address
+bar once loaded (`history.replaceState`), so it does not stay in the tab's history. The page sets
+`<meta name="referrer" content="same-origin">`, so no other site sees it in a `Referer`.
+`unsubscribeAction` stays exported for an app's own form, but a server action posts to the page's
+URL, query included: prefer posting to the route as the package page does.
+
 Both must stay public: keep them out of the auth guard's `protect` list. The route has no per-IP
 rate limit on purpose: mail providers post from a few shared addresses that act for millions of
 people, so a bucket would refuse real unsubscribes; the signature is checked before any database
@@ -651,7 +661,8 @@ None.
 
 ## 8. Appearance
 
-The unsubscribe page is a `Card` from `@softure-ai/ui` with a plain form (no client JavaScript),
+The unsubscribe page is a `Card` from `@softure-ai/ui` with a plain form (it works without client
+JavaScript; one small client component only cleans the address bar),
 styled by the app's tokens. `createUnsubscribePage({ classNames, unstyled, Layout })` adds the app's
 classes or its own layout (section 4).
 

package/dist/index.js

@@ -15,7 +15,7 @@ export const MODULE_ID = "mailing";
 export const mailing = defineModule({
     manifest: {
         id: MODULE_ID,
-        version: "0.2.1",
+        version: "0.2.2",
         dependsOn: { jobs: "*?" },
         dbSchema: "mailing",
         tables: ["suppressions", "campaigns", "deliveries"],

package/dist/next/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/next/actions.ts"],"names":[],"mappings":"AAeA,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBzE"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/next/actions.ts"],"names":[],"mappings":"AAaA,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzE"}

package/dist/next/actions.js

@@ -1,35 +1,17 @@
 "use server";
-// The unsubscribe page's server action. It takes the signed link from the form (the same values
-// the page got in its URL), records the opt-out and redirects to the page's outcome. No session is
-// involved: the signature is the authorization. Next refuses an action whose Origin does not match
-// the host.
-import { errorLogLabel } from "@softure-ai/core";
+// The unsubscribe server action, for an app whose own form posts to it: it takes the signed link
+// from the form body, records the opt-out and redirects to the page's outcome. The package page
+// does not use it: a server action posts to the page's URL, which carries the link, so the page's
+// form posts to the one-click route's bare path instead (route.ts). Next refuses an action whose
+// Origin does not match the host.
 import { getSoftureConfig } from "@softure-ai/core/next";
 import { redirect } from "next/navigation";
-import { getMailingRoutes } from "../server/options.js";
-import { unsubscribe } from "../server/suppressions.js";
-import { getUnsubscribeLinkParams, readUnsubscribeLink } from "../server/unsubscribe-link.js";
+import { readUnsubscribeLink } from "../server/unsubscribe-link.js";
 import { getMailingContext } from "./context.js";
-import { UNSUBSCRIBE_STATUS_PARAM } from "./params.js";
+import { submitPageUnsubscribe } from "./page-submit.js";
 export async function unsubscribeAction(formData) {
     const config = getSoftureConfig();
     const link = readUnsubscribeLink(formData, config);
-    let status;
-    try {
-        const result = await unsubscribe(await getMailingContext(config), link, "page");
-        status = result.ok ? "done" : "invalid";
-    }
-    catch (error) {
-        // The label names the kind of failure, never its text: that can carry the link's values.
-        console.error(`@softure-ai/mailing: unsubscribe failed: ${errorLogLabel(error)}`);
-        status = "failed";
-    }
-    const query = new URLSearchParams({ [UNSUBSCRIBE_STATUS_PARAM]: status });
-    if (status === "failed" && link !== null) {
-        // The form comes back with the same link, so the person can try again.
-        for (const [name, value] of Object.entries(getUnsubscribeLinkParams(link)))
-            query.set(name, value);
-    }
-    redirect(`${getMailingRoutes(config).unsubscribe}?${query.toString()}`);
+    redirect(await submitPageUnsubscribe({ config, link, getContext: () => getMailingContext(config) }));
 }
 //# sourceMappingURL=actions.js.map

package/dist/next/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/next/actions.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,gGAAgG;AAChG,mGAAmG;AACnG,mGAAmG;AACnG,YAAY;AACZ,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAA0B,MAAM,aAAa,CAAC;AAE/E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAkB;IACxD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAChF,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yFAAyF;QACzF,OAAO,CAAC,KAAK,CAAC,4CAA4C,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClF,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1E,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACzC,uEAAuE;QACvE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrG,CAAC;IACD,QAAQ,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/next/actions.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,iGAAiG;AACjG,gGAAgG;AAChG,kGAAkG;AAClG,iGAAiG;AACjG,kCAAkC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAkB;IACxD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,MAAM,qBAAqB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AACvG,CAAC"}

package/dist/next/page-submit.d.ts

@@ -0,0 +1,12 @@
+import { type SoftureConfig } from "@softure-ai/core";
+import { type SuppressionContext } from "../server/suppressions.js";
+import { type UnsubscribeLink } from "../server/unsubscribe-link.js";
+export interface PageSubmit {
+    readonly config: SoftureConfig;
+    readonly link: UnsubscribeLink | null;
+    /** Opens the database; a failure there is a failed submit like any other. */
+    readonly getContext: () => Promise<SuppressionContext>;
+}
+/** Records the link from the page and returns the page's outcome URL (a path with its query). */
+export declare function submitPageUnsubscribe({ config, link, getContext }: PageSubmit): Promise<string>;
+//# sourceMappingURL=page-submit.d.ts.map

package/dist/next/page-submit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"page-submit.d.ts","sourceRoot":"","sources":["../../src/next/page-submit.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAErE,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAG/F,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACxD;AAED,iGAAiG;AACjG,wBAAsB,qBAAqB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBrG"}

package/dist/next/page-submit.js

@@ -0,0 +1,30 @@
+// The page's submit, shared by the route (the package page's form posts there) and the server
+// action (for an app's own form): record the opt-out and name the page's outcome to send the
+// browser to. No session is involved: the signature is the authorization.
+import { errorLogLabel } from "@softure-ai/core";
+import { getMailingRoutes } from "../server/options.js";
+import { unsubscribe } from "../server/suppressions.js";
+import { getUnsubscribeLinkParams } from "../server/unsubscribe-link.js";
+import { UNSUBSCRIBE_STATUS_PARAM } from "./params.js";
+/** Records the link from the page and returns the page's outcome URL (a path with its query). */
+export async function submitPageUnsubscribe({ config, link, getContext }) {
+    let status;
+    try {
+        const result = await unsubscribe(await getContext(), link, "page");
+        status = result.ok ? "done" : "invalid";
+    }
+    catch (error) {
+        // The label names the kind of failure, never its text: that can carry the link's values.
+        console.error(`@softure-ai/mailing: unsubscribe failed: ${errorLogLabel(error)}`);
+        status = "failed";
+    }
+    const query = new URLSearchParams({ [UNSUBSCRIBE_STATUS_PARAM]: status });
+    if (status === "failed" && link !== null) {
+        // The form comes back with the same link, so the person can try again; the page strips it
+        // from the address bar again.
+        for (const [name, value] of Object.entries(getUnsubscribeLinkParams(link)))
+            query.set(name, value);
+    }
+    return `${getMailingRoutes(config).unsubscribe}?${query.toString()}`;
+}
+//# sourceMappingURL=page-submit.js.map

package/dist/next/page-submit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page-submit.js","sourceRoot":"","sources":["../../src/next/page-submit.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,6FAA6F;AAC7F,0EAA0E;AAC1E,OAAO,EAAE,aAAa,EAAsB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,WAAW,EAA2B,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAwB,MAAM,+BAA+B,CAAC;AAC/F,OAAO,EAAE,wBAAwB,EAA0B,MAAM,aAAa,CAAC;AAS/E,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAc;IAClF,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yFAAyF;QACzF,OAAO,CAAC,KAAK,CAAC,4CAA4C,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClF,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1E,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACzC,0FAA0F;QAC1F,8BAA8B;QAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvE,CAAC"}

package/dist/next/pages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pages.d.ts","sourceRoot":"","sources":["../../src/next/pages.tsx"],"names":[],"mappings":"AAQA,OAAO,EAAkD,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAMtD,KAAK,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;AAE3E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;CACtC;AAED,uGAAuG;AACvG,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEtE,gGAAgG;AAChG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;CACzD;AA2CD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B,IACvB,kBAAkB,oBAAoB,0CAGxF;AAED,wBAAsB,eAAe,CAAC,EAAE,YAAY,EAAE,EAAE,oBAAoB,wCAE3E"}
+{"version":3,"file":"pages.d.ts","sourceRoot":"","sources":["../../src/next/pages.tsx"],"names":[],"mappings":"AAUA,OAAO,EAAkD,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAOtD,KAAK,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;AAE3E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;CACtC;AAED,uGAAuG;AACvG,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEtE,gGAAgG;AAChG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;CACzD;AA2CD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B,IACvB,kBAAkB,oBAAoB,0CAGxF;AAED,wBAAsB,eAAe,CAAC,EAAE,YAAY,EAAE,EAAE,oBAAoB,wCAE3E"}

package/dist/next/pages.js

@@ -1,17 +1,20 @@
 import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 // The unsubscribe page, ready to mount with one line:
 // `export { UnsubscribePage as default } from "@softure-ai/mailing/next"`.
-// A server component without client JavaScript: the button is a plain form posting a server
-// action, so it works in any browser a mail client opens. Opening the page changes nothing (mail
-// scanners open links too) and does not check the signature: the submit does. It takes the
+// A server component: the button is a plain form posting the link, in hidden fields, to the
+// one-click route's bare path (route.ts), so it works without JavaScript in any browser a mail
+// client opens and the signed token never sits in a POST's request line. With JavaScript a small
+// client component also takes the link out of the address bar. Opening the page changes nothing
+// (mail scanners open links too) and does not check the signature: the submit does. It takes the
 // module's signed links and, with `mailing({ legacyUnsubscribe })`, the app's older ones: mount it
 // at the old links' path too.
 import { getSoftureConfig } from "@softure-ai/core/next";
 import { Button, Card, createSlotClassGetter, FormError } from "@softure-ai/ui";
+import { getMailingRoutes } from "../server/options.js";
 import { getUnsubscribeLinkParams, readUnsubscribeLink } from "../server/unsubscribe-link.js";
-import { unsubscribeAction } from "./actions.js";
 import { getMailingMessages } from "./messages.js";
 import { UNSUBSCRIBE_STATUS_PARAM } from "./params.js";
+import { StripLinkQuery } from "./strip-link-query.js";
 const DEFAULT_CLASSES = {
     root: "sft:mx-auto sft:box-border sft:w-full sft:sm:max-w-md sft:px-4 sft:py-4",
     card: "",
@@ -60,6 +63,6 @@ async function renderUnsubscribePage(searchParams, options) {
         return _jsx(UnsubscribeLayout, { title: messages.invalidTitle, lead: messages.invalidBody, slot: slot, options: options });
     }
     const submit = slot("submit");
-    return (_jsx(UnsubscribeLayout, { title: messages.title, lead: messages.lead, slot: slot, options: options, children: _jsxs("form", { action: unsubscribeAction, className: slot("form"), children: [Object.entries(linkParams).map(([name, value]) => (_jsx("input", { type: "hidden", name: name, value: value }, name))), _jsx(FormError, { message: status === "failed" ? messages.failed : undefined, unstyled: options.unstyled }), _jsx("div", { children: _jsx(Button, { type: "submit", variant: "primary", unstyled: options.unstyled, ...(submit === undefined ? {} : { classNames: { root: submit } }), children: messages.submit }) })] }) }));
+    return (_jsxs(UnsubscribeLayout, { title: messages.title, lead: messages.lead, slot: slot, options: options, children: [_jsx(StripLinkQuery, { names: Object.keys(linkParams) }), _jsxs("form", { action: getMailingRoutes(config).oneClick, method: "post", className: slot("form"), children: [Object.entries(linkParams).map(([name, value]) => (_jsx("input", { type: "hidden", name: name, value: value }, name))), _jsx(FormError, { message: status === "failed" ? messages.failed : undefined, unstyled: options.unstyled }), _jsx("div", { children: _jsx(Button, { type: "submit", variant: "primary", unstyled: options.unstyled, ...(submit === undefined ? {} : { classNames: { root: submit } }), children: messages.submit }) })] })] }));
 }
 //# sourceMappingURL=pages.js.map

package/dist/next/pages.js.map

@@ -1 +1 @@
-{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../src/next/pages.tsx"],"names":[],"mappings":";AAAA,sDAAsD;AACtD,2EAA2E;AAC3E,4FAA4F;AAC5F,iGAAiG;AACjG,2FAA2F;AAC3F,mGAAmG;AACnG,8BAA8B;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAmB,MAAM,gBAAgB,CAAC;AAEjG,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AA6BvD,MAAM,eAAe,GAAkD;IACrE,IAAI,EAAE,yEAAyE;IAC/E,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,+CAA+C;IACrD,MAAM,EAAE,EAAE;CACX,CAAC;AAEF,SAAS,SAAS,CAAC,MAAqD,EAAE,IAAY;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAID;;;GAGG;AACH,SAAS,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAmG;IAClK,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CACL,8BACE,eAAM,IAAI,EAAC,UAAU,EAAC,OAAO,EAAC,aAAa,GAAG,EAC9C,KAAC,MAAM,IAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,YAC7B,QAAQ,GACF,IACR,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,CACL,gBAAM,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aAC3B,eAAM,IAAI,EAAC,UAAU,EAAC,OAAO,EAAC,aAAa,GAAG,EAC9C,KAAC,IAAI,IAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAC3H,QAAQ,GACJ,IACF,CACR,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkC,EAAE;IACxE,OAAO,KAAK,UAAU,0BAA0B,CAAC,EAAE,YAAY,EAAwB;QACrF,OAAO,qBAAqB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAE,YAAY,EAAwB;IAC1E,OAAO,qBAAqB,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,YAAsC,EAAE,OAA+B;IAC1G,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC;IACxD,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9H,MAAM,MAAM,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAC3D,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,KAAC,iBAAiB,IAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAI,CAAC;IAEtI,MAAM,IAAI,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACvE,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,EAAE,CAAC;QACrG,OAAO,KAAC,iBAAiB,IAAC,KAAK,EAAE,QAAQ,CAAC,YAAY,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAI,CAAC;IACvH,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,CACL,KAAC,iBAAiB,IAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,YACzF,gBAAM,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aACrD,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CACjD,gBAAkB,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAA5C,IAAI,CAA4C,CAC7D,CAAC,EACF,KAAC,SAAS,IAAC,OAAO,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,GAAI,EACrG,wBACE,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,SAAS,EAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,YACnI,QAAQ,CAAC,MAAM,GACT,GACL,IACD,GACW,CACrB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../src/next/pages.tsx"],"names":[],"mappings":";AAAA,sDAAsD;AACtD,2EAA2E;AAC3E,4FAA4F;AAC5F,+FAA+F;AAC/F,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,mGAAmG;AACnG,8BAA8B;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAmB,MAAM,gBAAgB,CAAC;AAEjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AA6BvD,MAAM,eAAe,GAAkD;IACrE,IAAI,EAAE,yEAAyE;IAC/E,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,+CAA+C;IACrD,MAAM,EAAE,EAAE;CACX,CAAC;AAEF,SAAS,SAAS,CAAC,MAAqD,EAAE,IAAY;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAID;;;GAGG;AACH,SAAS,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAmG;IAClK,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CACL,8BACE,eAAM,IAAI,EAAC,UAAU,EAAC,OAAO,EAAC,aAAa,GAAG,EAC9C,KAAC,MAAM,IAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,YAC7B,QAAQ,GACF,IACR,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,CACL,gBAAM,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aAC3B,eAAM,IAAI,EAAC,UAAU,EAAC,OAAO,EAAC,aAAa,GAAG,EAC9C,KAAC,IAAI,IAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAC3H,QAAQ,GACJ,IACF,CACR,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkC,EAAE;IACxE,OAAO,KAAK,UAAU,0BAA0B,CAAC,EAAE,YAAY,EAAwB;QACrF,OAAO,qBAAqB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAE,YAAY,EAAwB;IAC1E,OAAO,qBAAqB,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,YAAsC,EAAE,OAA+B;IAC1G,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC;IACxD,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9H,MAAM,MAAM,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAC3D,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,KAAC,iBAAiB,IAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAI,CAAC;IAEtI,MAAM,IAAI,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACvE,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,EAAE,CAAC;QACrG,OAAO,KAAC,iBAAiB,IAAC,KAAK,EAAE,QAAQ,CAAC,YAAY,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAI,CAAC;IACvH,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,CACL,MAAC,iBAAiB,IAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,aACzF,KAAC,cAAc,IAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAI,EAClD,gBAAM,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAC,MAAM,EAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aACnF,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CACjD,gBAAkB,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAA5C,IAAI,CAA4C,CAC7D,CAAC,EACF,KAAC,SAAS,IAAC,OAAO,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,GAAI,EACrG,wBACE,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,SAAS,EAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,YACnI,QAAQ,CAAC,MAAM,GACT,GACL,IACD,IACW,CACrB,CAAC;AACJ,CAAC"}

package/dist/next/route.d.ts

@@ -1,10 +1,13 @@
 /**
- * Records the opt-out of the link in the URL. The body (`List-Unsubscribe=One-Click`) is not read:
+ * Records the opt-out of the link in the URL. Its body (`List-Unsubscribe=One-Click`) is not read:
  * anyone can send it, the signature is the proof. 200 once recorded (also again), 400 for a link
  * that does not verify (200 with `mailing({ oneClickInvalidLinkStatus: 200 })`, so the answer never
  * tells whether a token is live), 500 when the database fails: the client may retry, and 200 would
  * claim an opt-out that did not happen. A legacy link (`mailing({ legacyUnsubscribe })`) is handled the same
  * way; mount this route at the old link's path too.
+ *
+ * A POST without a link in the URL is the unsubscribe page's form: its link comes from the form
+ * body, and the answer is a 303 to the page's outcome (`?status=done`, `invalid` or `failed`).
  */
 export declare function postUnsubscribeRoute(request: Request): Promise<Response>;
 /**

package/dist/next/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../src/next/route.ts"],"names":[],"mappings":"AAmBA;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAU9E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAG9D"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../src/next/route.ts"],"names":[],"mappings":"AAwBA;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmB9E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAG9D"}

package/dist/next/route.js

@@ -8,25 +8,42 @@
 // purpose: a few provider addresses act for millions of people, so a bucket would refuse real
 // unsubscribes. The link is checked by shape and signature before the database is touched, and
 // the only write is an idempotent insert.
+//
+// The package page's form posts here too, to the bare path with the link in its body, so the
+// signed token never sits in a POST's request line (a server action would post to the page's URL,
+// query included). No Origin check, as for a mail client: the signature is the authorization.
 import { errorLogLabel } from "@softure-ai/core";
 import { getSoftureConfig } from "@softure-ai/core/next";
 import { getMailingOptions, getMailingRoutes } from "../server/options.js";
 import { unsubscribe } from "../server/suppressions.js";
 import { readUnsubscribeLink } from "../server/unsubscribe-link.js";
 import { getMailingContext } from "./context.js";
+import { submitPageUnsubscribe } from "./page-submit.js";
 const NO_STORE = { "cache-control": "no-store" };
 /**
- * Records the opt-out of the link in the URL. The body (`List-Unsubscribe=One-Click`) is not read:
+ * Records the opt-out of the link in the URL. Its body (`List-Unsubscribe=One-Click`) is not read:
  * anyone can send it, the signature is the proof. 200 once recorded (also again), 400 for a link
  * that does not verify (200 with `mailing({ oneClickInvalidLinkStatus: 200 })`, so the answer never
  * tells whether a token is live), 500 when the database fails: the client may retry, and 200 would
  * claim an opt-out that did not happen. A legacy link (`mailing({ legacyUnsubscribe })`) is handled the same
  * way; mount this route at the old link's path too.
+ *
+ * A POST without a link in the URL is the unsubscribe page's form: its link comes from the form
+ * body, and the answer is a 303 to the page's outcome (`?status=done`, `invalid` or `failed`).
  */
 export async function postUnsubscribeRoute(request) {
+    const config = getSoftureConfig();
+    const { searchParams } = new URL(request.url);
+    if (readUnsubscribeLink(searchParams, config) === null) {
+        const formLink = await readFormLink(request, config);
+        if (formLink !== null) {
+            const location = await submitPageUnsubscribe({ config, link: formLink, getContext: () => getMailingContext(config) });
+            return new Response(null, { status: 303, headers: { ...NO_STORE, location } });
+        }
+    }
     try {
         const ctx = await getMailingContext();
-        const link = readUnsubscribeLink(new URL(request.url).searchParams, ctx.config);
+        const link = readUnsubscribeLink(searchParams, ctx.config);
         const result = await unsubscribe(ctx, link, "one-click");
         return new Response(null, { status: result.ok ? 200 : getMailingOptions(ctx.config).oneClickInvalidLinkStatus, headers: NO_STORE });
     }
@@ -44,4 +61,43 @@ export function getUnsubscribeRoute(request) {
     const { search } = new URL(request.url);
     return new Response(null, { status: 303, headers: { ...NO_STORE, location: `${getMailingRoutes(getSoftureConfig()).unsubscribe}${search}` } });
 }
+/**
+ * The page's form is URL-encoded and small (a signed link is about 100 bytes; a legacy one at most a few 512-character
+ * values). A larger body is no page submit, and is not read past this size.
+ */
+const MAX_FORM_BYTES = 8192;
+const FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
+/** The link in a URL-encoded form body, or null for any other body. */
+async function readFormLink(request, config) {
+    if (request.headers.get("content-type")?.toLowerCase().startsWith(FORM_CONTENT_TYPE) !== true)
+        return null;
+    const body = await readBoundedText(request, MAX_FORM_BYTES);
+    return body === null ? null : readUnsubscribeLink(new URLSearchParams(body), config);
+}
+/** The body as text, or null when it is longer than `maxBytes` (the rest is not read) or cannot be read. */
+async function readBoundedText(request, maxBytes) {
+    if (request.body === null)
+        return "";
+    const reader = request.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > maxBytes) {
+                await reader.cancel();
+                return null;
+            }
+            chunks.push(value);
+        }
+    }
+    catch {
+        // A client that drops the connection mid-body: no form to read.
+        return null;
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
 //# sourceMappingURL=route.js.map

package/dist/next/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../src/next/route.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,wCAAwC;AACxC,yGAAyG;AACzG,EAAE;AACF,6FAA6F;AAC7F,gGAAgG;AAChG,0FAA0F;AAC1F,8FAA8F;AAC9F,+FAA+F;AAC/F,0CAA0C;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAgB;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,yBAAyB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,sDAAsD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5F,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,gBAAgB,EAAE,CAAC,CAAC,WAAW,GAAG,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AACjJ,CAAC"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../src/next/route.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,wCAAwC;AACxC,yGAAyG;AACzG,EAAE;AACF,6FAA6F;AAC7F,gGAAgG;AAChG,0FAA0F;AAC1F,8FAA8F;AAC9F,+FAA+F;AAC/F,0CAA0C;AAC1C,EAAE;AACF,6FAA6F;AAC7F,kGAAkG;AAClG,8FAA8F;AAC9F,OAAO,EAAE,aAAa,EAAsB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAwB,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAgB;IACzD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,mBAAmB,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,mBAAmB,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,yBAAyB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,sDAAsD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5F,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,gBAAgB,EAAE,CAAC,CAAC,WAAW,GAAG,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AACjJ,CAAC;AAED;;;GAGG;AACH,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,MAAM,iBAAiB,GAAG,mCAAmC,CAAC;AAE9D,uEAAuE;AACvE,KAAK,UAAU,YAAY,CAAC,OAAgB,EAAE,MAAqB;IACjE,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3G,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC5D,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AACvF,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,QAAgB;IAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACxC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC"}

package/dist/next/strip-link-query.d.ts

@@ -0,0 +1,11 @@
+export interface StripLinkQueryProps {
+    /** The query parameters that carry the link. */
+    readonly names: readonly string[];
+}
+export declare function StripLinkQuery({ names }: StripLinkQueryProps): null;
+/**
+ * Replaces the current history entry with the URL minus `names`. The current `history.state` goes
+ * along: it carries Next's own marker, so its router lets the call through without a navigation.
+ */
+export declare function stripQueryParams(names: readonly string[]): void;
+//# sourceMappingURL=strip-link-query.d.ts.map

package/dist/next/strip-link-query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strip-link-query.d.ts","sourceRoot":"","sources":["../../src/next/strip-link-query.tsx"],"names":[],"mappings":"AAOA,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,wBAAgB,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,mBAAmB,QAK5D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAM/D"}

package/dist/next/strip-link-query.js

@@ -0,0 +1,25 @@
+"use client";
+// Takes the unsubscribe link's parameters out of the address bar once the page has loaded, so the
+// signed token does not stay in the tab's URL and the browser history. It renders nothing; without
+// JavaScript the address bar keeps the link, and the form still works.
+import { useEffect } from "react";
+export function StripLinkQuery({ names }) {
+    useEffect(() => {
+        stripQueryParams(names);
+    }, [names]);
+    return null;
+}
+/**
+ * Replaces the current history entry with the URL minus `names`. The current `history.state` goes
+ * along: it carries Next's own marker, so its router lets the call through without a navigation.
+ */
+export function stripQueryParams(names) {
+    const url = new URL(location.href);
+    const present = names.filter((name) => url.searchParams.has(name));
+    if (present.length === 0)
+        return;
+    for (const name of present)
+        url.searchParams.delete(name);
+    history.replaceState(history.state, "", `${url.pathname}${url.search}${url.hash}`);
+}
+//# sourceMappingURL=strip-link-query.js.map

package/dist/next/strip-link-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strip-link-query.js","sourceRoot":"","sources":["../../src/next/strip-link-query.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,kGAAkG;AAClG,mGAAmG;AACnG,uEAAuE;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAOlC,MAAM,UAAU,cAAc,CAAC,EAAE,KAAK,EAAuB;IAC3D,SAAS,CAAC,GAAG,EAAE;QACb,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,KAAK,MAAM,IAAI,IAAI,OAAO;QAAE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACrF,CAAC"}

package/module.json

@@ -1,6 +1,6 @@
 {
   "id": "mailing",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "dependsOn": { "jobs": "*?" },
   "dbSchema": "mailing",
   "tables": ["suppressions", "campaigns", "deliveries"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softure-ai/mailing",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "SOFTURE AI mailing module: sendMail over a provider adapter (Resend first) with plain-text and HTML bodies, sender and reply-to from config, idempotency keys, a timeout and a typed result; signed one-click unsubscribe (RFC 8058) with a suppression list for list mail; an exactly-once delivery ledger, campaigns sent from a content file by the softure-mail command, and a sender DNS check; a fake provider for tests.",
   "license": "MIT",
   "type": "module",

package/src/index.ts

@@ -17,7 +17,7 @@ export const MODULE_ID = "mailing";
 export const mailing = defineModule({
   manifest: {
     id: MODULE_ID,
-    version: "0.2.1",
+    version: "0.2.2",
     dependsOn: { jobs: "*?" },
     dbSchema: "mailing",
     tables: ["suppressions", "campaigns", "deliveries"],

package/src/next/actions.ts

@@ -1,34 +1,18 @@
 "use server";
 
-// The unsubscribe page's server action. It takes the signed link from the form (the same values
-// the page got in its URL), records the opt-out and redirects to the page's outcome. No session is
-// involved: the signature is the authorization. Next refuses an action whose Origin does not match
-// the host.
-import { errorLogLabel } from "@softure-ai/core";
+// The unsubscribe server action, for an app whose own form posts to it: it takes the signed link
+// from the form body, records the opt-out and redirects to the page's outcome. The package page
+// does not use it: a server action posts to the page's URL, which carries the link, so the page's
+// form posts to the one-click route's bare path instead (route.ts). Next refuses an action whose
+// Origin does not match the host.
 import { getSoftureConfig } from "@softure-ai/core/next";
 import { redirect } from "next/navigation";
-import { getMailingRoutes } from "../server/options.js";
-import { unsubscribe } from "../server/suppressions.js";
-import { getUnsubscribeLinkParams, readUnsubscribeLink } from "../server/unsubscribe-link.js";
+import { readUnsubscribeLink } from "../server/unsubscribe-link.js";
 import { getMailingContext } from "./context.js";
-import { UNSUBSCRIBE_STATUS_PARAM, type UnsubscribeStatus } from "./params.js";
+import { submitPageUnsubscribe } from "./page-submit.js";
 
 export async function unsubscribeAction(formData: FormData): Promise<void> {
   const config = getSoftureConfig();
   const link = readUnsubscribeLink(formData, config);
-  let status: UnsubscribeStatus;
-  try {
-    const result = await unsubscribe(await getMailingContext(config), link, "page");
-    status = result.ok ? "done" : "invalid";
-  } catch (error) {
-    // The label names the kind of failure, never its text: that can carry the link's values.
-    console.error(`@softure-ai/mailing: unsubscribe failed: ${errorLogLabel(error)}`);
-    status = "failed";
-  }
-  const query = new URLSearchParams({ [UNSUBSCRIBE_STATUS_PARAM]: status });
-  if (status === "failed" && link !== null) {
-    // The form comes back with the same link, so the person can try again.
-    for (const [name, value] of Object.entries(getUnsubscribeLinkParams(link))) query.set(name, value);
-  }
-  redirect(`${getMailingRoutes(config).unsubscribe}?${query.toString()}`);
+  redirect(await submitPageUnsubscribe({ config, link, getContext: () => getMailingContext(config) }));
 }

package/src/next/page-submit.ts

@@ -0,0 +1,35 @@
+// The page's submit, shared by the route (the package page's form posts there) and the server
+// action (for an app's own form): record the opt-out and name the page's outcome to send the
+// browser to. No session is involved: the signature is the authorization.
+import { errorLogLabel, type SoftureConfig } from "@softure-ai/core";
+import { getMailingRoutes } from "../server/options.js";
+import { unsubscribe, type SuppressionContext } from "../server/suppressions.js";
+import { getUnsubscribeLinkParams, type UnsubscribeLink } from "../server/unsubscribe-link.js";
+import { UNSUBSCRIBE_STATUS_PARAM, type UnsubscribeStatus } from "./params.js";
+
+export interface PageSubmit {
+  readonly config: SoftureConfig;
+  readonly link: UnsubscribeLink | null;
+  /** Opens the database; a failure there is a failed submit like any other. */
+  readonly getContext: () => Promise<SuppressionContext>;
+}
+
+/** Records the link from the page and returns the page's outcome URL (a path with its query). */
+export async function submitPageUnsubscribe({ config, link, getContext }: PageSubmit): Promise<string> {
+  let status: UnsubscribeStatus;
+  try {
+    const result = await unsubscribe(await getContext(), link, "page");
+    status = result.ok ? "done" : "invalid";
+  } catch (error) {
+    // The label names the kind of failure, never its text: that can carry the link's values.
+    console.error(`@softure-ai/mailing: unsubscribe failed: ${errorLogLabel(error)}`);
+    status = "failed";
+  }
+  const query = new URLSearchParams({ [UNSUBSCRIBE_STATUS_PARAM]: status });
+  if (status === "failed" && link !== null) {
+    // The form comes back with the same link, so the person can try again; the page strips it
+    // from the address bar again.
+    for (const [name, value] of Object.entries(getUnsubscribeLinkParams(link))) query.set(name, value);
+  }
+  return `${getMailingRoutes(config).unsubscribe}?${query.toString()}`;
+}

package/src/next/pages.tsx

@@ -1,17 +1,20 @@
 // The unsubscribe page, ready to mount with one line:
 // `export { UnsubscribePage as default } from "@softure-ai/mailing/next"`.
-// A server component without client JavaScript: the button is a plain form posting a server
-// action, so it works in any browser a mail client opens. Opening the page changes nothing (mail
-// scanners open links too) and does not check the signature: the submit does. It takes the
+// A server component: the button is a plain form posting the link, in hidden fields, to the
+// one-click route's bare path (route.ts), so it works without JavaScript in any browser a mail
+// client opens and the signed token never sits in a POST's request line. With JavaScript a small
+// client component also takes the link out of the address bar. Opening the page changes nothing
+// (mail scanners open links too) and does not check the signature: the submit does. It takes the
 // module's signed links and, with `mailing({ legacyUnsubscribe })`, the app's older ones: mount it
 // at the old links' path too.
 import { getSoftureConfig } from "@softure-ai/core/next";
 import { Button, Card, createSlotClassGetter, FormError, type ClassNames } from "@softure-ai/ui";
 import type { ComponentType, ReactNode } from "react";
+import { getMailingRoutes } from "../server/options.js";
 import { getUnsubscribeLinkParams, readUnsubscribeLink } from "../server/unsubscribe-link.js";
-import { unsubscribeAction } from "./actions.js";
 import { getMailingMessages } from "./messages.js";
 import { UNSUBSCRIBE_STATUS_PARAM } from "./params.js";
+import { StripLinkQuery } from "./strip-link-query.js";
 
 type SearchParams = Promise<Record<string, string | string[] | undefined>>;
 
@@ -111,7 +114,8 @@ async function renderUnsubscribePage(searchParams: SearchParams | undefined, opt
   const submit = slot("submit");
   return (
     <UnsubscribeLayout title={messages.title} lead={messages.lead} slot={slot} options={options}>
-      <form action={unsubscribeAction} className={slot("form")}>
+      <StripLinkQuery names={Object.keys(linkParams)} />
+      <form action={getMailingRoutes(config).oneClick} method="post" className={slot("form")}>
         {Object.entries(linkParams).map(([name, value]) => (
           <input key={name} type="hidden" name={name} value={value} />
         ))}

package/src/next/route.ts

@@ -8,27 +8,44 @@
 // purpose: a few provider addresses act for millions of people, so a bucket would refuse real
 // unsubscribes. The link is checked by shape and signature before the database is touched, and
 // the only write is an idempotent insert.
-import { errorLogLabel } from "@softure-ai/core";
+//
+// The package page's form posts here too, to the bare path with the link in its body, so the
+// signed token never sits in a POST's request line (a server action would post to the page's URL,
+// query included). No Origin check, as for a mail client: the signature is the authorization.
+import { errorLogLabel, type SoftureConfig } from "@softure-ai/core";
 import { getSoftureConfig } from "@softure-ai/core/next";
 import { getMailingOptions, getMailingRoutes } from "../server/options.js";
 import { unsubscribe } from "../server/suppressions.js";
-import { readUnsubscribeLink } from "../server/unsubscribe-link.js";
+import { readUnsubscribeLink, type UnsubscribeLink } from "../server/unsubscribe-link.js";
 import { getMailingContext } from "./context.js";
+import { submitPageUnsubscribe } from "./page-submit.js";
 
 const NO_STORE = { "cache-control": "no-store" };
 
 /**
- * Records the opt-out of the link in the URL. The body (`List-Unsubscribe=One-Click`) is not read:
+ * Records the opt-out of the link in the URL. Its body (`List-Unsubscribe=One-Click`) is not read:
  * anyone can send it, the signature is the proof. 200 once recorded (also again), 400 for a link
  * that does not verify (200 with `mailing({ oneClickInvalidLinkStatus: 200 })`, so the answer never
  * tells whether a token is live), 500 when the database fails: the client may retry, and 200 would
  * claim an opt-out that did not happen. A legacy link (`mailing({ legacyUnsubscribe })`) is handled the same
  * way; mount this route at the old link's path too.
+ *
+ * A POST without a link in the URL is the unsubscribe page's form: its link comes from the form
+ * body, and the answer is a 303 to the page's outcome (`?status=done`, `invalid` or `failed`).
  */
 export async function postUnsubscribeRoute(request: Request): Promise<Response> {
+  const config = getSoftureConfig();
+  const { searchParams } = new URL(request.url);
+  if (readUnsubscribeLink(searchParams, config) === null) {
+    const formLink = await readFormLink(request, config);
+    if (formLink !== null) {
+      const location = await submitPageUnsubscribe({ config, link: formLink, getContext: () => getMailingContext(config) });
+      return new Response(null, { status: 303, headers: { ...NO_STORE, location } });
+    }
+  }
   try {
     const ctx = await getMailingContext();
-    const link = readUnsubscribeLink(new URL(request.url).searchParams, ctx.config);
+    const link = readUnsubscribeLink(searchParams, ctx.config);
     const result = await unsubscribe(ctx, link, "one-click");
     return new Response(null, { status: result.ok ? 200 : getMailingOptions(ctx.config).oneClickInvalidLinkStatus, headers: NO_STORE });
   } catch (error) {
@@ -46,3 +63,41 @@ export function getUnsubscribeRoute(request: Request): Response {
   const { search } = new URL(request.url);
   return new Response(null, { status: 303, headers: { ...NO_STORE, location: `${getMailingRoutes(getSoftureConfig()).unsubscribe}${search}` } });
 }
+
+/**
+ * The page's form is URL-encoded and small (a signed link is about 100 bytes; a legacy one at most a few 512-character
+ * values). A larger body is no page submit, and is not read past this size.
+ */
+const MAX_FORM_BYTES = 8192;
+const FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
+
+/** The link in a URL-encoded form body, or null for any other body. */
+async function readFormLink(request: Request, config: SoftureConfig): Promise<UnsubscribeLink | null> {
+  if (request.headers.get("content-type")?.toLowerCase().startsWith(FORM_CONTENT_TYPE) !== true) return null;
+  const body = await readBoundedText(request, MAX_FORM_BYTES);
+  return body === null ? null : readUnsubscribeLink(new URLSearchParams(body), config);
+}
+
+/** The body as text, or null when it is longer than `maxBytes` (the rest is not read) or cannot be read. */
+async function readBoundedText(request: Request, maxBytes: number): Promise<string | null> {
+  if (request.body === null) return "";
+  const reader = request.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > maxBytes) {
+        await reader.cancel();
+        return null;
+      }
+      chunks.push(value);
+    }
+  } catch {
+    // A client that drops the connection mid-body: no form to read.
+    return null;
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}

package/src/next/strip-link-query.tsx

@@ -0,0 +1,30 @@
+"use client";
+
+// Takes the unsubscribe link's parameters out of the address bar once the page has loaded, so the
+// signed token does not stay in the tab's URL and the browser history. It renders nothing; without
+// JavaScript the address bar keeps the link, and the form still works.
+import { useEffect } from "react";
+
+export interface StripLinkQueryProps {
+  /** The query parameters that carry the link. */
+  readonly names: readonly string[];
+}
+
+export function StripLinkQuery({ names }: StripLinkQueryProps) {
+  useEffect(() => {
+    stripQueryParams(names);
+  }, [names]);
+  return null;
+}
+
+/**
+ * Replaces the current history entry with the URL minus `names`. The current `history.state` goes
+ * along: it carries Next's own marker, so its router lets the call through without a navigation.
+ */
+export function stripQueryParams(names: readonly string[]): void {
+  const url = new URL(location.href);
+  const present = names.filter((name) => url.searchParams.has(name));
+  if (present.length === 0) return;
+  for (const name of present) url.searchParams.delete(name);
+  history.replaceState(history.state, "", `${url.pathname}${url.search}${url.hash}`);
+}