mailery 0.13.0 → 0.15.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { R as RunnerContext, N as NormalizedEvent, C as ContactAdapter, a as Contact, A as AdapterFilter, M as MailProvider, S as SendArgs, b as SendResult, c as MailTesterFeedback, d as Mailer, T as TemplateDoc, e as SuppressionScope, D as DeliveryWindow, F as FlowStep, f as SegmentFilter, P as Predicate } from './null-DDg3ojHe.cjs';
-export { g as AuditLogDoc, B as BroadcastDoc, h as BroadcastStatus, i as CircuitBreakerThresholds, j as Collections, k as ContactTagDoc, E as EventDoc, l as FlowDoc, m as FlowGoal, n as FlowRunDoc, o as FlowRunStatus, p as FlowVersionDoc, H as HealthDoc, q as HealthStatus, L as LeadDoc, r as MailerConfig, s as NullProvider, O as OutboxDoc, t as RESERVED_VAR_KEYS, u as RedisOptions, v as SegmentDefinition, w as SendDoc, x as SendStatus, y as SenderDomainConfig, z as SenderDomainRegistry, G as SenderDomainValidation, I as SubscriptionDoc, J as SubscriptionStatus, K as SuppressionDoc, Q as SuppressionReason, U as TemplateKind, V as TemplateVersionDoc, W as VarsAdapter, X as VarsResolveInfo, Y as WebhookEventDoc, Z as defineVars, _ as ensureIndexes, $ as getCollections, a0 as validateSenderDomain, a1 as varsJsonSchema } from './null-DDg3ojHe.cjs';
+import { R as RunnerContext, N as NormalizedEvent, C as ContactAdapter, a as Contact, A as AdapterFilter, M as MailProvider, S as SendArgs, b as SendResult, c as MailTesterFeedback, d as Mailer, T as TemplateDoc, e as SuppressionScope, D as DeliveryWindow, F as FlowStep, f as SegmentFilter, P as Predicate } from './null-CnhsvKvy.cjs';
+export { g as AuditLogDoc, B as BotFilterConfig, h as BroadcastDoc, i as BroadcastStatus, j as CircuitBreakerThresholds, k as Collections, l as ContactTagDoc, E as EventDoc, m as FlowDoc, n as FlowGoal, o as FlowRunDoc, p as FlowRunStatus, q as FlowVersionDoc, H as HealthDoc, r as HealthStatus, L as LeadDoc, s as MailerConfig, t as NullProvider, O as OutboxDoc, u as RESERVED_VAR_KEYS, v as RedisOptions, w as SegmentDefinition, x as SendDoc, y as SendStatus, z as SenderDomainConfig, G as SenderDomainRegistry, I as SenderDomainValidation, J as SubscriptionDoc, K as SubscriptionStatus, Q as SuppressionDoc, U as SuppressionReason, V as TemplateKind, W as TemplateVersionDoc, X as VarsAdapter, Y as VarsResolveInfo, Z as WebhookEventDoc, _ as defineVars, $ as ensureIndexes, a0 as getCollections, a1 as validateSenderDomain, a2 as varsJsonSchema } from './null-CnhsvKvy.cjs';
 import { ObjectId, Db, Filter } from 'mongodb';
 import { Request, Router } from 'express';
 import Handlebars from 'handlebars';
@@ -54,6 +54,67 @@ declare function sweepStrandedFlowRuns(ctx: RunnerContext): Promise<void>;
 
 declare function applyWebhookEvent(event: NormalizedEvent, ctx: RunnerContext): Promise<void>;
 
+/**
+ * The pending-unsubscribe drain — the second half of INVARIANT 8.
+ *
+ * `POST /m/unsub/:token` journals an opt-out to disk when Mongo is unreachable
+ * (`src/server/unsub-journal.ts`). This replays those entries. It runs from
+ * `runTick`, so it needs no scheduling of its own and inherits the tick's
+ * cadence (`tickIntervalSeconds`, default 60) and its per-runner error
+ * isolation. It is also exported so a host can run it from a script or a
+ * one-shot process.
+ *
+ * ## Where the drain runs, and why only here
+ *
+ * The tick, not a CLI command. `src/cli/` is a DNS/provider setup tool: it has
+ * no Mongo connection, no contact adapter and no config loader, so a
+ * `mailery drain-unsubs` command would have to invent a whole configuration
+ * story to reach the database. Every deployment that can journal an opt-out is
+ * by definition already running the library, and most run the tick;
+ * `drainPendingUnsubscribes` is exported for the ones that don't.
+ *
+ * ## Guarantees
+ *
+ * - **Idempotent.** Replay goes through `applyUnsubscribe`, whose suppression
+ *   write is a `$setOnInsert` upsert and whose subscription write is a `$set`
+ *   to a terminal state. Draining the same entry twice is indistinguishable
+ *   from draining it once.
+ * - **Nothing is lost to a crash.** A pass claims a batch by renaming the
+ *   journal aside; if it dies, the claim file stays on disk and a later pass
+ *   adopts it. Entries it could not apply are appended back to the live
+ *   journal *before* the claim is unlinked, so the failure window duplicates
+ *   rather than drops.
+ * - **Concurrency-safe.** Claiming and adopting are `rename`, which is atomic
+ *   within a directory. Two processes draining the same journal cannot both
+ *   own the same batch.
+ * - **Fails soft.** A Mongo write failure aborts the pass immediately — the
+ *   database being down is exactly why these entries exist, and hammering it
+ *   with the rest of the batch achieves nothing.
+ */
+
+interface DrainPendingUnsubsResult {
+    /** False when no `pendingUnsubsPath` is configured — the journal is opt-in. */
+    enabled: boolean;
+    applied: number;
+    /** Entries handed back to the journal for a later pass. */
+    deferred: number;
+    /** Lines that could never be applied (torn by a crash, or hand-edited). */
+    malformed: number;
+    /** Claim files processed, including ones adopted from a dead pass. */
+    batches: number;
+}
+interface DrainPendingUnsubsOptions {
+    /** Overrides `config.pendingUnsubsPath`. Mostly for tests. */
+    path?: string;
+    maxEntries?: number;
+    /** Structured sink for diagnostics. Defaults to `console`. */
+    log?: {
+        warn?: (fields: Record<string, unknown>, msg?: string) => void;
+        error?: (fields: Record<string, unknown>, msg?: string) => void;
+    };
+}
+declare function drainPendingUnsubscribes(ctx: RunnerContext, opts?: DrainPendingUnsubsOptions): Promise<DrainPendingUnsubsResult>;
+
 /**
  * MongoContactAdapter — reads contacts directly from the host's `users`
  * collection (read-mostly; optional narrow tag writes). Mailer never
@@ -109,6 +170,12 @@ declare class MongoContactAdapter implements ContactAdapter {
     private removeTagsImpl;
 }
 
+/**
+ * Per-provider tolerance option: seconds, or `0` / `false` to disable the
+ * freshness check entirely.
+ */
+type WebhookToleranceOption = number | false;
+
 /**
  * SendGridProvider — sends mail through @sendgrid/mail, verifies the Event
  * Webhook signature with the ECDSA public key configured in SendGrid, and
@@ -125,6 +192,16 @@ interface SendGridProviderOptions {
     apiKey: string;
     /** ECDSA public key (PEM) from SendGrid → Settings → Mail Settings → Signed Event Webhook. */
     webhookVerificationKey?: string;
+    /**
+     * Replay window for the signed webhook timestamp, in seconds.
+     * Defaults to 300 (5 minutes). A signed payload older — or more than this
+     * far in the future — than the window is rejected, so a captured request
+     * can't be replayed indefinitely.
+     *
+     * Set `0` or `false` to disable the check, for hosts whose proxy or queue
+     * legitimately delays webhook delivery past the window.
+     */
+    webhookToleranceSeconds?: WebhookToleranceOption;
     /** Send-rate cap per second (BullMQ group limiter consults this). */
     sendRatePerSecond?: number;
     /** Sandbox mode bypasses actual delivery — useful in dev/test. */
@@ -134,6 +211,8 @@ declare class SendGridProvider implements MailProvider {
     private readonly opts;
     readonly name = "sendgrid";
     readonly sendRatePerSecond: number;
+    /** Resolved replay window in seconds; `0` means the check is disabled. */
+    readonly webhookToleranceSeconds: number;
     constructor(opts: SendGridProviderOptions);
     send(args: SendArgs): Promise<SendResult>;
     verifyWebhook(rawBody: Buffer, headers: Record<string, string>): Promise<boolean>;
@@ -193,6 +272,167 @@ interface AdminRouterOptions {
 }
 declare function createAdminRouter(mailer: Mailer, opts?: AdminRouterOptions): Router;
 
+/**
+ * Async handler wrapper for the *public* router.
+ *
+ * The admin router's `asyncHandler` (`api/admin.ts`) is a plain `.catch(next)`,
+ * which is right there: every admin handler computes first and responds last, so
+ * a rejection always arrives before any header is written and Express can turn
+ * it into a clean JSON 500.
+ *
+ * The public router cannot use that. `/open`, `/click` and `/webhooks` respond
+ * *first* and do their work after — never make a mail client or a provider
+ * wait on our database. By the time those handlers can reject,
+ * `res.headersSent` is already true, and forwarding post-headers makes Express
+ * destroy the socket underneath a response the client has already been
+ * promised.
+ *
+ * (`POST /unsub` used to be in that list. It now awaits its write before
+ * answering, because a response sent first can only ever report success —
+ * see INVARIANT 8 and the route's own comment. It still needs this wrapper for
+ * the pre-headers branch.)
+ *
+ * So this is a log-and-swallow wrapper, ported from featureboard's
+ * `src/server/routes/wrap.js`, with one deliberate difference: featureboard
+ * forwards with `next(err)` on the `headersSent` branch, and here that branch
+ * only logs. See issue #5 — every public route is unauthenticated, and the
+ * failure mode being fixed is precisely "a rejected promise in a public route
+ * takes down the host process".
+ */
+
+/**
+ * Minimal structured-logger shape, compatible with pino/bunyan-style loggers
+ * (`logger.error(fields, message)`). Every method is optional, so `{}` is a
+ * valid silent logger and a bare `console` is not accidentally accepted with
+ * mismatched argument order.
+ */
+interface RouteLogger {
+    error?: (fields: Record<string, unknown>, msg?: string) => void;
+    warn?: (fields: Record<string, unknown>, msg?: string) => void;
+    /**
+     * Routine, high-volume telemetry — currently only "an unsigned (pre-signing)
+     * tracking URL was accepted in grace mode", which is one line per legacy open
+     * and is not a fault. Kept off `warn` deliberately so it can be routed or
+     * dropped separately from things that are.
+     */
+    info?: (fields: Record<string, unknown>, msg?: string) => void;
+}
+
+/**
+ * Inbound DMARC aggregate-report webhook.
+ *
+ * DMARC RUA reports arrive as email. The usual way to turn that email into an
+ * HTTP request is SendGrid Inbound Parse, and until v0.15 the documented setup
+ * pointed Inbound Parse at `/admin/mailer/api/dmarc/upload` — a route behind
+ * the host's `requireAdmin` guard, which Inbound Parse cannot satisfy. So the
+ * documented setup either did not work, or worked because somebody removed the
+ * guard from an admin router. This route replaces that advice.
+ *
+ * ## Read this before enabling it
+ *
+ * **Inbound Parse does not sign its payloads.** The SendGrid *Event Webhook*
+ * does — see `providers/sendgrid.ts`, where signature verification and the
+ * replay window live — but Inbound Parse is a different product and offers no
+ * signature, no HMAC and no verifiable identity. There is nothing to verify.
+ *
+ * So this is, structurally, an unauthenticated file-accepting endpoint on a
+ * public router, and the design has to own that rather than dress it up:
+ *
+ * 1. **Off unless configured.** No `dmarcInbound.secret`, no route — not a
+ *    404 handler, no route registered at all. An endpoint like this appearing
+ *    on an upgrade because someone shipped a default would be indefensible.
+ * 2. **A shared secret, checked first.** The secret is compared with
+ *    `timingSafeEqual` before multer is allowed to read a single byte of the
+ *    body, so an unauthenticated caller cannot make us buffer 10MB.
+ * 3. **Hard size and count limits**, matching the admin upload's shape.
+ * 4. **A domain cross-check.** A report whose `<policy_published><domain>` is
+ *    not a domain this deployment sends from is rejected. If the secret leaks,
+ *    the attacker gets to inject rows about *your* domains, which is bounded
+ *    and visible, instead of arbitrary garbage.
+ * 5. **The existing parser.** `runner/dmarc.ts` already caps decompressed
+ *    bytes, validates declared-vs-actual sizes, checks compression ratio and
+ *    guards zip-slip. This route does not parse anything itself.
+ *
+ * ## Why a shared secret, and where it goes
+ *
+ * The three options that don't need a signature:
+ *
+ * - **Source IP allowlist.** Rejected as the primary control. SendGrid does
+ *   not publish a stable Inbound Parse egress range, and behind a proxy
+ *   `req.ip` is the proxy's address unless the host has set `trust proxy`
+ *   correctly — which this library cannot verify and must not assume. An
+ *   allowlist that silently matches the wrong address either locks out the
+ *   real sender or admits everyone. Put an allowlist in your ingress if you
+ *   want one; it is a good second layer and a bad only layer.
+ * - **Secret in the path.** Works, and is the fallback, but a URL path is
+ *   logged by every proxy, load balancer and access log between SendGrid and
+ *   you. Supported implicitly: nothing stops you making `path` unguessable.
+ * - **Secret in the `Authorization` header.** The default and the
+ *   recommendation. Inbound Parse cannot set custom headers, but its
+ *   destination URL accepts embedded basic-auth credentials
+ *   (`https://mailery:SECRET@example.com/m/inbound/dmarc`), which travel as an
+ *   `Authorization` header rather than in the request line. `Bearer` is
+ *   accepted too, for hosts forwarding from something other than SendGrid.
+ *
+ * A leaked secret gets an attacker exactly one capability: inserting DMARC
+ * report rows for domains you already send from. No mail is sent, no contact
+ * data is touched, nothing is deleted. Rotate it by changing the config value
+ * and the Inbound Parse destination URL.
+ */
+
+/** One attachment lifted off an inbound request by a `parseInbound` seam. */
+interface InboundAttachment {
+    filename: string;
+    buffer: Buffer;
+}
+/**
+ * Pull DMARC attachments out of a provider's inbound-email payload.
+ *
+ * The seam exists so Mailgun's and Postmark's inbound routes can be added
+ * without touching this route's auth, limits or ingest path. Only the SendGrid
+ * shape is implemented today.
+ */
+type InboundParser = (req: Request) => InboundAttachment[];
+interface DmarcInboundOptions {
+    /**
+     * Shared secret the caller must present. **Absent or empty → the route is
+     * not mounted at all.**
+     *
+     * Accepted as HTTP Basic (any username; the password is compared) or as
+     * `Authorization: Bearer <secret>`. Basic is the one to use with SendGrid
+     * Inbound Parse, since it can be embedded in the destination URL and so
+     * stays out of access logs.
+     */
+    secret?: string;
+    /** Sub-path on the public router. Default `/inbound/dmarc`. */
+    path?: string;
+    /** Per-file cap. Default 10MB, matching the admin upload. */
+    maxFileSizeBytes?: number;
+    /** Attachments accepted per request. Default 10. */
+    maxFiles?: number;
+    /**
+     * Domains whose reports are accepted. Defaults to every domain in
+     * `senderDomains` plus the `fromDefaults` / `transactionalFromDefaults`
+     * addresses. Reports for anything else are rejected.
+     *
+     * If none of those are configured there is nothing to check against, and the
+     * route mounts with the domain gate disabled and a warning — configure
+     * `senderDomains` to get it back.
+     */
+    allowedDomains?: string[];
+    /** Override the inbound payload shape. Defaults to SendGrid Inbound Parse. */
+    parseInbound?: InboundParser;
+}
+/**
+ * SendGrid Inbound Parse: `multipart/form-data` with the message's fields
+ * (`headers`, `from`, `subject`, `text`, ...) plus one file part per
+ * attachment, named `attachment1`, `attachment2`, and so on.
+ *
+ * Read through `multer.any()`, so the field names are not trusted — every file
+ * part is a candidate and the extension gate below decides.
+ */
+declare const sendgridInboundParser: InboundParser;
+
 /**
  * Public router — endpoints that must be reachable by email clients and
  * provider webhooks. Mount under your tracking base path (default `/m`).
@@ -200,19 +440,49 @@ declare function createAdminRouter(mailer: Mailer, opts?: AdminRouterOptions): R
  *   app.use('/m', createPublicRouter(mailer))
  *
  * Routes:
- *   GET  /open/:sendId.png         — open pixel (records open, returns 1×1 PNG)
- *   GET  /click/:sendId/:linkId    — click redirect (records click, 302 → target)
- *   GET  /unsub/:token             — confirmation page (one-click POST link)
- *   POST /unsub/:token             — RFC 8058 one-click unsubscribe
- *   POST /webhooks/:provider       — inbound provider event webhook
+ *   GET  /open/:sendId.:sig.png        — open pixel (records open, returns 1×1 PNG)
+ *   GET  /click/:sendId/:linkId/:sig   — click redirect (records click, 302 → target)
+ *   GET  /unsub/:token                 — confirmation page (one-click POST link)
+ *   POST /unsub/:token                 — RFC 8058 one-click unsubscribe
+ *   POST /webhooks/:provider           — inbound provider event webhook
+ *   POST /inbound/dmarc                — inbound DMARC report (opt-in; see below)
+ *
+ * Every route here is unauthenticated by necessity — mail clients and provider
+ * webhook servers cannot present credentials. The one exception is
+ * `/inbound/dmarc`, which is **not mounted at all** unless a shared secret is
+ * configured; see `api/dmarc-inbound.ts`.
+ *
+ * `:sig` is a 12-character truncated HMAC issued by `applyTracking`. It is
+ * syntactically optional on both tracking routes so that mail delivered before
+ * signing existed keeps working — see `checkTrackingSignature`.
  */
 
 interface PublicRouterOptions {
     /**
-     * Path on disk where unsubscribe events fall back to when Mongo is degraded.
-     * Defaults to /tmp/mailery-pending-unsubs.jsonl.
+     * Overrides `MailerConfig.pendingUnsubsPath` for this router only.
+     *
+     * @deprecated Set `pendingUnsubsPath` in `MailerConfig` instead. The tick
+     * drain (`drainPendingUnsubscribes`) reads the *config* value, so a path set
+     * only here is written but never replayed — which is precisely the bug
+     * INVARIANT 8 was carrying. Setting it here without also setting it in
+     * config logs a warning at construction time.
      */
     pendingUnsubsPath?: string;
+    /**
+     * Structured logger for public-route failures, pino-style
+     * (`logger.error(fields, message)`).
+     *
+     * Defaults to a `console`-backed logger that reproduces the output this
+     * package emitted before the option existed. Pass `{}` to silence.
+     */
+    logger?: RouteLogger;
+    /**
+     * Inbound DMARC aggregate-report webhook (SendGrid Inbound Parse and
+     * friends). **Off unless `secret` is set** — see `api/dmarc-inbound.ts` for
+     * why an endpoint that accepts unsigned file uploads must never appear on an
+     * upgrade by itself.
+     */
+    dmarcInbound?: DmarcInboundOptions;
 }
 declare function createPublicRouter(mailer: Mailer, opts?: PublicRouterOptions): Router;
 
@@ -295,6 +565,16 @@ interface TrackingOptions {
     trackClicks: boolean;
     /** URL that must NOT be rewritten (e.g. the resolved unsubscribe URL). */
     preserveUrls?: string[];
+    /**
+     * HMAC key for tracking-URL signatures — pass `config.unsubscribeSecret`.
+     *
+     * When set, every generated `/m/open` and `/m/click` URL carries a truncated
+     * HMAC so it cannot be forged or enumerated from a neighbouring ObjectId.
+     * When omitted the legacy unsigned shape is emitted; that path exists for
+     * preview/test renders that never reach the tracking endpoints, not as a
+     * supported production mode.
+     */
+    signingSecret?: string;
 }
 interface TrackingResult {
     html: string;
@@ -305,9 +585,15 @@ interface TrackingResult {
     }>;
 }
 /**
- * Rewrite `<a href>` in `html` to /m/click/<sendId>/<linkId>?... and append an
- * open pixel. Returns the modified HTML plus the link map to persist on the
- * send document.
+ * Rewrite `<a href>` in `html` to /m/click/<sendId>/<linkId>/<sig> and append
+ * an open pixel at /m/open/<sendId>.<sig>.png. Returns the modified HTML plus
+ * the link map to persist on the send document.
+ *
+ * The `<sig>` components are 12-character truncated HMACs (see
+ * `signTrackingToken`) and are present whenever `opts.signingSecret` is set.
+ * Without them a Mongo ObjectId is the only thing standing between an attacker
+ * and a forged open — and ObjectIds are a timestamp plus a per-process counter,
+ * so one received email hands out its neighbours.
  */
 declare function applyTracking(html: string, opts: TrackingOptions): TrackingResult;
 
@@ -328,11 +614,71 @@ interface UnsubscribeTokenPayload {
 }
 declare function signUnsubscribeToken(payload: UnsubscribeTokenPayload, secret: string): string;
 declare function verifyUnsubscribeToken(token: string, secret: string, now?: Date): UnsubscribeTokenPayload | null;
+/**
+ * Scopes a tracking signature can be issued for. An allowlist, mirroring the
+ * `k: 'doi'` discriminator on the DOI token: the scope is part of the signed
+ * message, so an `/m/open` signature cannot be replayed as an `/m/click` one
+ * even for the same send.
+ */
+type TrackingScope = 'open' | 'click';
+/**
+ * Signature length in base64url characters. 12 chars = 72 bits of the
+ * HMAC-SHA256 digest.
+ *
+ * Truncation is deliberate. These signatures are embedded in every link of
+ * every email, and the pixel URL in particular is parsed by mail clients with
+ * their own length quirks, so bytes are not free. 72 bits is far beyond what an
+ * online forgery attack can reach: an attacker gets no oracle beyond "the open
+ * was counted", each guess is a live HTTP request, and there is no offline
+ * verification step. Nothing here is a bearer credential for anything except
+ * "this recipient was sent this mail".
+ */
+declare const TRACKING_SIG_LENGTH = 12;
+interface TrackingTokenParams {
+    sendId: string;
+    /** Present for `click` scope, absent for `open`. */
+    linkId?: string;
+}
+/**
+ * Sign a tracking URL. Returns `TRACKING_SIG_LENGTH` base64url characters.
+ *
+ * Keyed with `unsubscribeSecret` — the same secret the unsubscribe and DOI
+ * tokens use, so there is exactly one secret to provision
+ * (`MAILER_UNSUBSCRIBE_SECRET`) and one to rotate. The scope prefix keeps the
+ * key domains separate.
+ */
+declare function signTrackingToken(scope: TrackingScope, params: TrackingTokenParams, secret: string): string;
+/**
+ * Verify a tracking-URL signature in constant time.
+ *
+ * The length pre-check before `timingSafeEqual` is required, not defensive:
+ * `crypto.timingSafeEqual` throws on mismatched lengths, and a thrown
+ * verification is a rejection that leaks length through a different channel.
+ * Same shape as `verifyUnsubscribeToken`.
+ */
+declare function verifyTrackingToken(token: unknown, scope: TrackingScope, params: TrackingTokenParams, secret: string): boolean;
 /**
  * sha256 hex digest, used for storing email hashes (GDPR forget) and dedup helpers.
  */
 declare function sha256Hex(input: string): string;
 
+/**
+ * Predicate evaluator. Resolves all Predicate variants from `shared/types.ts`
+ * against a Contact (host-side fields/tags) + mailer state (events, sends,
+ * subscription).
+ *
+ * Network calls hit Mongo. Cache the Contact at the call site if you evaluate
+ * many predicates in a row.
+ */
+
+/**
+ * User agents treated as automated unless the host overrides
+ * `botFilter.userAgentPattern`. Deliberately short: these are the scanners that
+ * announce themselves. Anything that impersonates a browser is not catchable
+ * from the UA string and is out of scope here — see INVARIANT 7.
+ */
+declare const DEFAULT_BOT_UA_RE: RegExp;
+
 /**
  * Delivery-window math. Pure — no I/O, no Date.now(); callers pass `now`.
  *
@@ -404,4 +750,4 @@ declare const DEDUPE_POLICIES: readonly DedupePolicyOption[];
  */
 declare const VERSION: string;
 
-export { AdapterFilter, type AdminRouterOptions, Contact, ContactAdapter, DEDUPE_POLICIES, type DedupePolicyOption, DeliveryWindow, FLOW_STEP_KINDS, FlowStep, type FlowStepKindOption, MailProvider, Mailer, MongoContactAdapter, type MongoContactAdapterOptions, NormalizedEvent, PREDICATE_KINDS, Predicate, type PredicateKind, type PredicateKindOption, type PublicRouterOptions, SEGMENT_FILTER_KINDS, SegmentFilter, type SegmentFilterKind, type SegmentFilterKindOption, SendArgs, SendGridProvider, type SendGridProviderOptions, SendResult, SuppressionScope, TemplateDoc, VERSION, applyTracking, applyWebhookEvent, compileMailyTemplate, compileTemplate, computeDeliveryTime, createAdminRouter, createPublicRouter, defaultFlowStep, defaultPredicate, defaultSegmentFilter, derivePlaintext, dispatchSend, predicateKind, processNewlyFiredEventTriggers, processOneRunStep, renderTemplate, runTick, sha256Hex, signUnsubscribeToken, sweepStrandedFlowRuns, verifyUnsubscribeToken };
+export { AdapterFilter, type AdminRouterOptions, Contact, ContactAdapter, DEDUPE_POLICIES, DEFAULT_BOT_UA_RE, type DedupePolicyOption, DeliveryWindow, type DmarcInboundOptions, type DrainPendingUnsubsOptions, type DrainPendingUnsubsResult, FLOW_STEP_KINDS, FlowStep, type FlowStepKindOption, type InboundAttachment, type InboundParser, MailProvider, Mailer, MongoContactAdapter, type MongoContactAdapterOptions, NormalizedEvent, PREDICATE_KINDS, Predicate, type PredicateKind, type PredicateKindOption, type PublicRouterOptions, type RouteLogger, SEGMENT_FILTER_KINDS, SegmentFilter, type SegmentFilterKind, type SegmentFilterKindOption, SendArgs, SendGridProvider, type SendGridProviderOptions, SendResult, SuppressionScope, TRACKING_SIG_LENGTH, TemplateDoc, type TrackingScope, type TrackingTokenParams, VERSION, applyTracking, applyWebhookEvent, compileMailyTemplate, compileTemplate, computeDeliveryTime, createAdminRouter, createPublicRouter, defaultFlowStep, defaultPredicate, defaultSegmentFilter, derivePlaintext, dispatchSend, drainPendingUnsubscribes, predicateKind, processNewlyFiredEventTriggers, processOneRunStep, renderTemplate, runTick, sendgridInboundParser, sha256Hex, signTrackingToken, signUnsubscribeToken, sweepStrandedFlowRuns, verifyTrackingToken, verifyUnsubscribeToken };