ghost 6.63.0 → 6.65.0

package/core/server/services/email-service/email-templates/partials/feedback-button.hbs

@@ -1,4 +1,5 @@
-<td dir="ltr" valign="top" align="center" style="display: inline-block; box-sizing: border-box; vertical-align: top; font-family: inherit; text-align: center; padding: 0 4px 4px; cursor: pointer; width: {{#if cellWidth}}{{cellWidth}}{{else}}30%{{/if}};">
+{{!-- Keep the native table-cell display; inline display values make Firefox wrap sibling cells. --}}
+<td dir="ltr" valign="top" align="center" style="box-sizing: border-box; vertical-align: top; font-family: inherit; text-align: center; padding: 0 4px 4px; cursor: pointer; width: {{#if cellWidth}}{{cellWidth}}{{else}}30%{{/if}};">
     <a href="{{href}}" target="_blank">
         <img src={{iconUrl}} border="0" width={{width}} height={{height}} alt="{{buttonText}}" {{#if iconClass}}class="{{iconClass}}"{{/if}}>
         <p class="feedback-button-text">{{t buttonText}}</p>

package/core/server/services/email-service/email-templates/partials/styles.hbs

@@ -1176,12 +1176,6 @@ a[data-flickr-embed] img {
    }
 }
 
-@media all {
-    .subscription-details p.hidden {
-        display: none !important;
-    }
-}
-
 {{#if showBadge}}
     .footer-powered {
         text-align: center;

package/core/server/services/email-service/email-templates/template.hbs

@@ -59,7 +59,7 @@
                                         <table role="presentation" border="0" cellpadding="0" cellspacing="0" width="100%">
                                             <tr>
                                                 <td class="subscription-details">
-                                                    <p class="%%{name_class}%%">{{t 'Name'}}: %%{name, "not provided"}%%</p>
+                                                    <p class="subscription-name">{{t 'Name'}}: %%{name}%%</p>
                                                     <p>{{t 'Email'}}: <a href="#">%%{email}%%</a></p>
                                                     <p>{{t 'Member since'}}: %%{created_at}%%</p>
                                                 </td>

package/core/server/services/email-service/jobs/send-email-job.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const job_1 = require("../../jobs-service/job");
+class SendEmailJob extends job_1.Job {
+    static type = 'send-email';
+    emailId;
+    constructor({ emailId }) {
+        super();
+        this.emailId = emailId;
+    }
+}
+exports.default = SendEmailJob;

package/core/server/services/email-service/mailgun-email-provider.js

@@ -30,7 +30,7 @@ const { escapeExpression } = require('handlebars');
 
 /**
  * @typedef {object} EmailProviderSuccessResponse
- * @prop {string} id
+ * @prop {string|null} id Null when the batch carries a per-recipient Message-Id
  */
 
 class MailgunEmailProvider {
@@ -134,6 +134,11 @@ class MailgunEmailProvider {
         messageData.deliveryTime = options.deliveryTime;
       }
 
+      // only newsletters opt in; automation and gift emails rely on the id Mailgun returns
+      if (this.#config.get('bulkEmail:perRecipientMessageId') === true) {
+        messageData.perRecipientMessageId = true;
+      }
+
       // create recipient data for Mailgun using replacement definitions
       const htmlEscapedIds = new Set(
         replacementDefinitions.filter((def) => !def.trusted).map((def) => def.id),
@@ -163,7 +168,7 @@ class MailgunEmailProvider {
 
       // Return mailgun provider id, trim <> from response
       return {
-        id: response.id.trim().replace(/^<|>$/g, ''),
+        id: response.id === null ? null : response.id.trim().replace(/^<|>$/g, ''),
       };
     } catch (e) {
       let ghostError;

package/core/server/services/email-service/sending-service.js

@@ -59,7 +59,7 @@ const logging = require('@tryghost/logging');
 
 /**
  * @typedef {object} EmailProviderSuccessResponse
- * @prop {string} id
+ * @prop {string|null} id Null when the batch carries a per-recipient Message-Id
  */
 
 class SendingService {

package/core/server/services/email-service/sending-status.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EmailSendingStatus = exports.SendingStatus = exports.SendingProgress = exports.SendingPhase = void 0;
 exports.buildSendingStatus = buildSendingStatus;
 const zod_1 = require("zod");
-const ETA_COMPLETION_WINDOW = 20;
+const ETA_WINDOW_MS = 60_000;
 const ETA_MIN_INTERVALS = 2;
 exports.SendingPhase = zod_1.z.enum(['preparing', 'submitting']);
 exports.SendingProgress = zod_1.z.object({
@@ -96,12 +96,18 @@ function estimateSecondsRemaining({ remaining, samples, attemptStartedAt, }) {
             completions.push({ ...sample });
         }
     }
-    // Limit usable timestamps, not rows: fast sends may finish many batches per timestamp.
-    const window = completions.slice(-ETA_COMPLETION_WINDOW);
     // Three distinct timestamps provide two measured intervals for an initial rate.
-    if (window.length < ETA_MIN_INTERVALS + 1) {
+    if (completions.length < ETA_MIN_INTERVALS + 1) {
         return null;
     }
+    // Include the baseline at or before the last minute so the first interval's
+    // recipients have their full elapsed time. Sparse sends still need two intervals.
+    const cutoff = completions[completions.length - 1].timestamp - ETA_WINDOW_MS;
+    let baseline = completions.length - 1;
+    while (baseline > 0 && completions[baseline].timestamp > cutoff) {
+        baseline -= 1;
+    }
+    const window = completions.slice(Math.max(0, Math.min(baseline, completions.length - ETA_MIN_INTERVALS - 1)));
     // Measure combined throughput across the window, including overlapping workers.
     // The first completion is only the baseline: its recipients were processed
     // before the measured time span.

package/core/server/services/gifts/gift-email-service.js

@@ -13,6 +13,7 @@ const gift_date_1 = require("./gift-date");
 const DEFAULT_ACCENT_COLOR = '#15212A';
 class GiftEmailService {
     transactionalMailer;
+    config;
     bulkMailer;
     settingsCache;
     urlUtils;
@@ -21,7 +22,8 @@ class GiftEmailService {
     blogIcon;
     renderer;
     t;
-    constructor({ transactionalMailer, bulkMailer, settingsCache, urlUtils, getFromAddress, getReplyToAddress, blogIcon, t, }) {
+    constructor({ config, transactionalMailer, bulkMailer, settingsCache, urlUtils, getFromAddress, getReplyToAddress, blogIcon, t, }) {
+        this.config = config;
         this.transactionalMailer = transactionalMailer;
         this.bulkMailer = bulkMailer;
         this.settingsCache = settingsCache;
@@ -205,6 +207,11 @@ class GiftEmailService {
             buyerName,
             interpolation: { escapeValue: false },
         });
+        const tags = [constants_1.GIFT_DELIVERY_EMAIL_TAG];
+        const mailgunTagFromConfig = this.config.get('bulkEmail:mailgun:tag');
+        if (typeof mailgunTagFromConfig === 'string' && mailgunTagFromConfig.length > 0) {
+            tags.push(mailgunTagFromConfig);
+        }
         if (!this.bulkMailer.isConfigured()) {
             await this.transactionalMailer.send({
                 to: recipientEmail,
@@ -214,7 +221,7 @@ class GiftEmailService {
                 from: this.getFromAddress(),
                 replyTo: this.getReplyToAddress(),
                 forceTextContent: true,
-                tags: [constants_1.GIFT_DELIVERY_EMAIL_TAG],
+                tags,
                 disableTracking: true,
             });
             return { providerMessageId: null };
@@ -225,7 +232,7 @@ class GiftEmailService {
             plaintext: text,
             from: this.getFromAddress(),
             replyTo: this.getReplyToAddress(),
-            tags: [constants_1.GIFT_DELIVERY_EMAIL_TAG],
+            tags,
             disable_tracking: true,
         }, { [recipientEmail]: {} }, []);
         const providerMessageId = (0, mailgun_message_id_1.getMailgunMessageId)(response) ?? null;

package/core/server/services/gifts/gift-service.js

@@ -917,15 +917,13 @@ class GiftService {
         }, '[Background Job] clean-gifts finished its cleanup phases');
     }
     async processReminders() {
+        const startedAt = Date.now();
         const now = new Date();
         const toRemind = await this.deps.giftRepository.findPendingReminder({
             now,
             reminderLeadMs: GIFT_REMINDER_LEAD_MS,
             reminderFloorMs: GIFT_REMINDER_FLOOR_MS,
         });
-        if (toRemind.length === 0) {
-            return { remindedCount: 0, skippedCount: 0, failedCount: 0 };
-        }
         let remindedCount = 0;
         let skippedCount = 0;
         let failedCount = 0;
@@ -944,6 +942,17 @@ class GiftService {
                 failedCount += 1;
             }
         }
+        // The jobs service's lifecycle log carries no counts, so the poll reports
+        // its own summary here for the daily job and the exact scheduler alike.
+        logging_1.default.info({
+            system: {
+                event: 'send_gift_reminders.completed',
+                reminded_count: remindedCount,
+                skipped_count: skippedCount,
+                failed_count: failedCount,
+                duration_ms: Date.now() - startedAt,
+            },
+        }, `[Background Job] send-gift-reminders processed reminders: ${remindedCount} sent, ${skippedCount} not due, ${failedCount} rejected`);
         return { remindedCount, skippedCount, failedCount };
     }
     async sendReminderForGift(token) {

package/core/server/services/gifts/index.js

@@ -28,7 +28,6 @@ function init(options) {
     const { SubscriptionActivatedEvent } = require('../../../shared/events');
     const StartGiftReminderFlushEvent = require('./events/start-gift-reminder-flush-event');
     const { StartGiftDeliveryFlushEvent } = require('./events/start-gift-delivery-flush-event');
-    const jobs = require('./jobs');
     const emailAnalyticsJobs = require('../email-analytics/jobs');
     const { GhostMailer } = require('../mail');
     const MailgunClient = require('../lib/mailgun-client');
@@ -52,6 +51,7 @@ function init(options) {
         getStripeApi: () => require('../stripe').api,
     });
     const giftEmailService = new gift_email_service_1.GiftEmailService({
+        config,
         transactionalMailer: new GhostMailer(),
         bulkMailer: new MailgunClient({ config, settings: settingsCache }),
         settingsCache,
@@ -154,7 +154,6 @@ function init(options) {
             logging.error(err, `Failed to process gift delivery ${event.data.deliveryId}`);
         }
     });
-    jobs.scheduleGiftReminderJob();
 }
 // Re-arms future deliveries and retries sends interrupted by a previous
 // shutdown. Runs after all services initialise because recovery sends need

package/core/server/services/gifts/jobs/index.js

@@ -1,9 +1,8 @@
-const path = require('path');
 const logging = require('@tryghost/logging');
-const jobManager = require('../../jobs');
 const CleanGiftsJob = require('./clean-gifts-job').default;
+const SendGiftRemindersJob = require('./send-gift-reminders-job').default;
 
-let hasScheduled = {
+const hasScheduled = {
   cleanup: false,
   reminders: false,
 };
@@ -23,25 +22,6 @@ function randomOffPeakDailyCron() {
   return `${s} ${m} ${h} * * *`;
 }
 
-function scheduleJob(key, name, jobFile) {
-  if (alreadyScheduledOrTest(key)) {
-    return hasScheduled[key];
-  }
-
-  const at = randomOffPeakDailyCron();
-
-  logging.info(`[Background Job] ${name} scheduled at ${at}`);
-  jobManager.addJob({
-    at,
-    job: path.resolve(__dirname, jobFile),
-    name,
-  });
-
-  hasScheduled[key] = true;
-
-  return true;
-}
-
 module.exports = {
   async scheduleGiftCleanupJob(jobsService) {
     if (alreadyScheduledOrTest('cleanup')) {
@@ -55,7 +35,15 @@ module.exports = {
     hasScheduled.cleanup = true;
   },
 
-  scheduleGiftReminderJob() {
-    return scheduleJob('reminders', 'send-gift-reminders', 'send-gift-reminders-job.js');
+  async scheduleGiftReminderJob(jobsService) {
+    if (alreadyScheduledOrTest('reminders')) {
+      return;
+    }
+
+    const cron = randomOffPeakDailyCron();
+    logging.info(`[Background Job] send-gift-reminders scheduled at ${cron}`);
+    await jobsService.scheduleRecurring(new SendGiftRemindersJob(), { cron });
+
+    hasScheduled.reminders = true;
   },
 };

package/core/server/services/gifts/jobs/send-gift-reminders-job.js

@@ -1,47 +1,7 @@
-const { parentPort } = require('node:worker_threads');
-const StartGiftReminderFlushEvent = require('../events/start-gift-reminder-flush-event');
-
-// Recurring job to send gift reminder emails. The actual work runs on the
-// main thread via a domain event so we don't have to re-initialize every
-// service dependency inside this worker
-
-// Exit early when cancelled to prevent stalling shutdown. No cleanup needed
-// when cancelling as everything is idempotent - any gift that hasn't yet had
-// its reminder recorded will be picked up on the next run
-function cancel() {
-  if (parentPort) {
-    parentPort.postMessage('cancelled before completion');
-    parentPort.postMessage('cancelled');
-  } else {
-    setTimeout(() => {
-      process.exit(0);
-    }, 1000);
-  }
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const job_1 = require("../../jobs-service/job");
+class SendGiftRemindersJob extends job_1.Job {
+    static type = 'send-gift-reminders';
 }
-
-if (parentPort) {
-  parentPort.once('message', (message) => {
-    if (message === 'cancel') {
-      return cancel();
-    }
-  });
-}
-
-(async () => {
-  if (parentPort) {
-    // Bounce to the main thread via the JobManager's event bridge - the
-    // gifts service subscribes to this event and runs the work in the
-    // already-initialised main process
-    parentPort.postMessage({
-      event: {
-        type: StartGiftReminderFlushEvent.name,
-      },
-    });
-    parentPort.postMessage('dispatched to main process');
-    parentPort.postMessage('done');
-  } else {
-    setTimeout(() => {
-      process.exit(0);
-    }, 1000);
-  }
-})();
+exports.default = SendGiftRemindersJob;

package/core/server/services/i18n.js

@@ -19,7 +19,7 @@ exports.t = (...args) => {
 };
 
 exports.init = () => {
-  const i18n = require('@tryghost/i18n');
+  const i18n = require('@tryghost/i18n').default;
   const events = require('../lib/common/events');
   const settingsCache = require('../../shared/settings-cache');
 

package/core/server/services/identity-tokens/identity-token-service-wrapper.js

@@ -13,12 +13,11 @@ module.exports = class IdentityTokenServiceWrapper {
     const issuer = urlUtils.urlFor('admin', true);
 
     const settings = require('../../../shared/settings-cache');
-    const jose = require('node-jose');
+    const { getPublicKeyInfo } = require('../../lib/public-jwk');
 
     const privateKey = settings.get('ghost_private_key');
-    const keyStore = jose.JWK.createKeyStore();
-    const key = await keyStore.add(privateKey, 'pem');
+    const { kid } = await getPublicKeyInfo(privateKey);
 
-    IdentityTokenServiceWrapper.instance = new IdentityTokenService(privateKey, issuer, key.kid);
+    IdentityTokenServiceWrapper.instance = new IdentityTokenService(privateKey, issuer, kid);
   }
 };

package/core/server/services/invitations/accept.js

@@ -20,7 +20,7 @@ async function accept(invitation) {
   return models.Base.transaction(async (transacting) => {
     const options = { context: { internal: true }, transacting, forUpdate: true };
 
-    let invite = await models.Invite.findOne({ token: inviteToken, status: 'sent' }, options);
+    const invite = await models.Invite.findOne({ token: inviteToken, status: 'sent' }, options);
 
     if (!invite) {
       throw new errors.NotFoundError({ message: tpl(messages.inviteNotFound) });
@@ -32,7 +32,7 @@ async function accept(invitation) {
 
     const email = invite.get('email');
 
-    let user = await models.User.findOne({ email }, options);
+    const user = await models.User.findOne({ email }, options);
     if (user) {
       throw new errors.ValidationError({
         message: tpl(messages.inviteEmailAlreadyExist.message),

package/core/server/services/jobs/job-service.js

@@ -21,33 +21,6 @@ const workerMessageHandler = ({ name, message }) => {
   }
 };
 
-const initTestMode = () => {
-  // Output job queue length every 5 seconds
-  setInterval(() => {
-    logging.warn(
-      `${jobManager.inlineQueue.length()} jobs in the queue. Idle: ${jobManager.inlineQueue.idle()}`,
-    );
-
-    const runningScheduledjobs = Object.keys(jobManager.bree.workers);
-    if (Object.keys(jobManager.bree.workers).length) {
-      logging.warn(
-        `${Object.keys(jobManager.bree.workers).length} jobs running: ${runningScheduledjobs}`,
-      );
-    }
-
-    const scheduledJobs = Object.keys(jobManager.bree.intervals);
-    if (Object.keys(jobManager.bree.intervals).length) {
-      logging.warn(
-        `${Object.keys(jobManager.bree.intervals).length} scheduled jobs: ${scheduledJobs}`,
-      );
-    }
-
-    if (runningScheduledjobs.length === 0 && scheduledJobs.length === 0) {
-      logging.warn('No scheduled or running jobs');
-    }
-  }, 5000);
-};
-
 const jobManager = new JobManager({
   errorHandler,
   workerMessageHandler,
@@ -58,4 +31,3 @@ const jobManager = new JobManager({
 });
 
 module.exports = jobManager;
-module.exports.initTestMode = initTestMode;

package/core/server/services/jobs-service/jobs-service.js

@@ -68,6 +68,11 @@ class JobsService {
         const queue = this.#queueByType.get(type);
         return queue === undefined ? undefined : { queue };
     }
+    /**
+     * Resolves when the backend's enqueue call completes, without waiting for the
+     * handler to run. Enqueue errors reject this promise. Resolution does not
+     * guarantee execution: the backend controls what happens to work during shutdown.
+     */
     async dispatch(job) {
         const envelope = this.#buildEnvelope(job);
         await this.#backend.enqueue(envelope, this.#routingFor(envelope.type));

package/core/server/services/jobs-service/register-job-handlers.js

@@ -40,12 +40,15 @@ exports.default = registerJobHandlers;
 const clean_tokens_job_1 = __importDefault(require("../members/jobs/clean-tokens-job"));
 const clean_expired_comped_job_1 = __importDefault(require("../members/jobs/clean-expired-comped-job"));
 const clean_gifts_job_1 = __importDefault(require("../gifts/jobs/clean-gifts-job"));
+const send_gift_reminders_job_1 = __importDefault(require("../gifts/jobs/send-gift-reminders-job"));
 const external_media_inliner_job_1 = __importDefault(require("../media-inliner/external-media-inliner-job"));
 const content_csv_import_job_1 = __importDefault(require("../content-import/jobs/content-csv-import-job"));
 const contentImport = __importStar(require("../content-import"));
+const members_import_job_1 = __importDefault(require("../members/jobs/members-import-job"));
 const update_check_job_1 = __importDefault(require("../update-check/jobs/update-check-job"));
 const process_webmention_job_1 = __importDefault(require("../mentions/process-webmention-job"));
 const send_webmentions_job_1 = __importDefault(require("../mentions/send-webmentions-job"));
+const send_email_job_1 = __importDefault(require("../email-service/jobs/send-email-job"));
 const updateCheck = require('../update-check');
 // Webmention processing fetches external pages and is triggered by
 // unauthenticated requests, so webmention jobs run in their own lane where a
@@ -54,7 +57,11 @@ const updateCheck = require('../update-check');
 // this shared declaration so none can declare the queue with a different
 // concurrency.
 const WEBMENTIONS_QUEUE = { queue: 'webmentions', concurrency: 3 };
-function registerJobHandlers({ jobsService, memberJobs, giftService, mediaInliner, mentionsController, mentionsSendingService, }) {
+// Keep newsletter sends independent of imports and other shared work. Two sends
+// can progress at once, each with its own two batch workers, so a long send or
+// retry does not hold up every other newsletter.
+const EMAIL_QUEUE = { queue: 'email', concurrency: 2 };
+function registerJobHandlers({ jobsService, memberJobs, giftService, mediaInliner, mentionsController, mentionsSendingService, membersService, emailService, }) {
     jobsService.handle(clean_tokens_job_1.default, async () => {
         await memberJobs.cleanTokens();
     });
@@ -64,12 +71,18 @@ function registerJobHandlers({ jobsService, memberJobs, giftService, mediaInline
     jobsService.handle(clean_gifts_job_1.default, async () => {
         await giftService.cleanup();
     });
+    jobsService.handle(send_gift_reminders_job_1.default, async () => {
+        await giftService.processReminders();
+    });
     jobsService.handle(external_media_inliner_job_1.default, async (job) => {
         await mediaInliner.inline(job.domains);
     });
     jobsService.handle(content_csv_import_job_1.default, async (job) => {
         await contentImport.handleJob(job);
     });
+    jobsService.handle(members_import_job_1.default, async (job) => {
+        await membersService.handleImportJob(job);
+    });
     jobsService.handle(update_check_job_1.default, async () => {
         await updateCheck({ rethrowErrors: true });
     });
@@ -79,4 +92,7 @@ function registerJobHandlers({ jobsService, memberJobs, giftService, mediaInline
     jobsService.handle(send_webmentions_job_1.default, async (job) => {
         await mentionsSendingService.sendWebmentions(job);
     }, WEBMENTIONS_QUEUE);
+    jobsService.handle(send_email_job_1.default, async (job) => {
+        await emailService.handleSendEmailJob(job);
+    }, EMAIL_QUEUE);
 }

package/core/server/services/lib/mailgun-client.js

@@ -3,6 +3,11 @@ const debug = require('@tryghost/debug');
 const logging = require('@tryghost/logging');
 const metrics = require('@tryghost/metrics');
 const errors = require('@tryghost/errors');
+const {
+  addRecipientMessageIds,
+  isTemplatedRecipientMessageId,
+  RECIPIENT_MESSAGE_ID_VARIABLE,
+} = require('./mailgun-recipient-message-id');
 
 const DEFAULT_BATCH_SIZE = 1000;
 
@@ -19,6 +24,7 @@ module.exports = class MailgunClient {
    * Creates the data payload and sends to Mailgun
    *
    * @param {Object} message
+   * @param {boolean} [message.perRecipientMessageId] Give every recipient its own Message-Id header
    * @param {Object} recipientData
    * @param {Array<Object>} replacements
    *
@@ -118,6 +124,14 @@ module.exports = class MailgunClient {
       // Use overriden domain if specified in message
       const mailDomain = message.domainOverride ? message.domainOverride : mailgunConfig.domain;
 
+      if (message.perRecipientMessageId === true) {
+        // one Message-Id per recipient, referenced from a recipient variable like List-Unsubscribe above
+        messageData['recipient-variables'] = JSON.stringify(
+          addRecipientMessageIds(recipientData, { emailId: message.id, domain: mailDomain }),
+        );
+        messageData['h:Message-Id'] = `<%recipient.${RECIPIENT_MESSAGE_ID_VARIABLE}%>`;
+      }
+
       const response = await mailgunInstance.messages.create(mailDomain, messageData);
       metrics.metric('mailgun-send-mail', {
         value: Date.now() - startTime,
@@ -125,7 +139,8 @@ module.exports = class MailgunClient {
       });
 
       return {
-        id: response.id,
+        // a batch of per-recipient Message-Ids has no single provider id
+        id: isTemplatedRecipientMessageId(response.id) ? null : response.id,
       };
     } catch (error) {
       logging.error(error);

package/core/server/services/lib/mailgun-recipient-message-id.js

@@ -0,0 +1,49 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RECIPIENT_MESSAGE_ID_VARIABLE = void 0;
+exports.buildRecipientMessageId = buildRecipientMessageId;
+exports.isTemplatedRecipientMessageId = isTemplatedRecipientMessageId;
+exports.addRecipientMessageIds = addRecipientMessageIds;
+/**
+ * Per-recipient Message-Id values for Mailgun batch sends. Mailgun mints one Message-Id per
+ * API call, so without these every recipient shares it and readers' replies thread together.
+ * Not to be confused with `./mailgun-message-id`, which normalizes the id Mailgun returns.
+ */
+const node_crypto_1 = __importDefault(require("node:crypto"));
+exports.RECIPIENT_MESSAGE_ID_VARIABLE = 'message_id';
+/**
+ * Deterministic per (email, recipient) so a resubmitted batch reuses the same ids; the address
+ * is hashed rather than exposed. Test emails have no email id and get a random prefix instead.
+ * No angle brackets: the header template adds them.
+ */
+function buildRecipientMessageId({ emailId, recipientEmail, domain, }) {
+    const prefix = emailId || node_crypto_1.default.randomUUID();
+    const digest = node_crypto_1.default
+        .createHash('sha256')
+        .update(`${prefix}:${recipientEmail}`)
+        .digest('hex')
+        .slice(0, 32);
+    return `${prefix}.${digest}@${domain}`;
+}
+/**
+ * Mailgun returns the Message-Id it was given, so when the header is a per-recipient template it
+ * comes back unsubstituted and identifies nothing.
+ */
+function isTemplatedRecipientMessageId(messageId) {
+    return (typeof messageId === 'string' &&
+        messageId.includes(`%recipient.${exports.RECIPIENT_MESSAGE_ID_VARIABLE}%`));
+}
+/** Returns a new recipient-variables map with a `message_id` per recipient; the input is not mutated */
+function addRecipientMessageIds(recipientData, { emailId, domain }) {
+    const result = {};
+    for (const [recipientEmail, variables] of Object.entries(recipientData)) {
+        result[recipientEmail] = {
+            ...variables,
+            [exports.RECIPIENT_MESSAGE_ID_VARIABLE]: buildRecipientMessageId({ emailId, recipientEmail, domain }),
+        };
+    }
+    return result;
+}

package/core/server/services/limits.js

@@ -2,8 +2,8 @@ const errors = require('@tryghost/errors');
 const config = require('../../shared/config');
 const db = require('../data/db');
 const logging = require('@tryghost/logging');
-const LimitService = require('@tryghost/limit-service');
-let limitService = new LimitService();
+const { LimitService } = require('@tryghost/limit-service');
+const limitService = new LimitService();
 
 const init = () => {
   let helpLink;
@@ -47,6 +47,22 @@ const init = () => {
   }
 };
 
+/**
+ * Route guard for a feature a host can switch off, for the routes that exist only to
+ * change it. Answers 403 with the host's own wording, which is a different thing to tell a
+ * caller than the 404 a labs flag gives: the feature exists, this plan does not include it.
+ */
+const requireFeature = (limitName) =>
+  async function requireFeatureMw(req, res, next) {
+    try {
+      await limitService.errorIfWouldGoOverLimit(limitName);
+      next();
+    } catch (err) {
+      next(err);
+    }
+  };
+
 module.exports = limitService;
 
 module.exports.init = init;
+module.exports.requireFeature = requireFeature;

package/core/server/services/mail/ghost-mailer.js

@@ -105,7 +105,7 @@ function createMailError({ message, err, ignoreDefaultMessage } = { message: ''
   const defaultErrorMessage = tpl(messages.failedSendingEmailError);
 
   const fullErrorMessage = defaultErrorMessage + message;
-  let statusCode = err && err.name === 'RecipientError' ? 400 : 500;
+  const statusCode = err && err.name === 'RecipientError' ? 400 : 500;
   return new errors.EmailError({
     message: ignoreDefaultMessage ? message : fullErrorMessage,
     err: err,

package/core/server/services/member-attribution/member-attribution-service.js

@@ -34,7 +34,7 @@ class MemberAttributionService {
 
     // We consider only select internal context sources
     if (['import', 'api', 'admin'].includes(source)) {
-      let attribution = {
+      const attribution = {
         id: null,
         type: null,
         url: null,

package/core/server/services/member-attribution/referrer-translator.js

@@ -76,7 +76,7 @@ class ReferrerTranslator {
 
     // In finding the 'content' that got the user to sign up, we want the latest entry with referrer data
     for (const item of history) {
-      let refUrl = this.getUrlFromStr(item.referrerUrl);
+      const refUrl = this.getUrlFromStr(item.referrerUrl);
       if (refUrl?.hostname === 'checkout.stripe.com') {
         // Ignore stripe, because second try payments should not be attributed to Stripe
         continue;