mailery 0.13.0 → 0.15.0

package/dist/testing.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { MongoClient, ObjectId } from 'mongodb';
-import crypto2 from 'crypto';
+import crypto2, { randomBytes } from 'crypto';
 import sgMail from '@sendgrid/mail';
 import IORedis from 'ioredis';
 import Handlebars from 'handlebars';
@@ -9,6 +9,9 @@ import mjml2html from 'mjml';
 import dns from 'dns/promises';
 import net from 'net';
 import psl from 'psl';
+import 'fast-xml-parser';
+import fs from 'fs';
+import path from 'path';
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -22,11 +25,20 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -259,6 +271,31 @@ var init_mongo = __esm({
   }
 });
 
+// src/server/providers/webhook-tolerance.ts
+function resolveWebhookToleranceSeconds(option) {
+  if (option === false || option === 0) return 0;
+  if (option === void 0 || option === null) return DEFAULT_WEBHOOK_TOLERANCE_SECONDS;
+  if (typeof option !== "number" || !Number.isFinite(option) || option < 0) {
+    return DEFAULT_WEBHOOK_TOLERANCE_SECONDS;
+  }
+  return option;
+}
+function isWebhookTimestampFresh(rawTimestamp, toleranceSeconds, now = /* @__PURE__ */ new Date()) {
+  if (toleranceSeconds === 0) return true;
+  if (!rawTimestamp) return false;
+  if (!/^\d{1,15}$/.test(rawTimestamp)) return false;
+  const timestampMs = Number(rawTimestamp) * 1e3;
+  if (!Number.isFinite(timestampMs)) return false;
+  const deltaMs = Math.abs(now.getTime() - timestampMs);
+  return deltaMs <= toleranceSeconds * 1e3;
+}
+var DEFAULT_WEBHOOK_TOLERANCE_SECONDS;
+var init_webhook_tolerance = __esm({
+  "src/server/providers/webhook-tolerance.ts"() {
+    DEFAULT_WEBHOOK_TOLERANCE_SECONDS = 300;
+  }
+});
+
 // src/server/providers/sendgrid.ts
 var sendgrid_exports = {};
 __export(sendgrid_exports, {
@@ -305,6 +342,7 @@ function mapEventType(sgEvent) {
 var SG_SIG_HEADER, SG_TS_HEADER, SendGridProvider;
 var init_sendgrid = __esm({
   "src/server/providers/sendgrid.ts"() {
+    init_webhook_tolerance();
     SG_SIG_HEADER = "x-twilio-email-event-webhook-signature";
     SG_TS_HEADER = "x-twilio-email-event-webhook-timestamp";
     SendGridProvider = class {
@@ -312,10 +350,13 @@ var init_sendgrid = __esm({
         this.opts = opts;
         sgMail.setApiKey(opts.apiKey);
         this.sendRatePerSecond = opts.sendRatePerSecond ?? 10;
+        this.webhookToleranceSeconds = resolveWebhookToleranceSeconds(opts.webhookToleranceSeconds);
       }
       opts;
       name = "sendgrid";
       sendRatePerSecond;
+      /** Resolved replay window in seconds; `0` means the check is disabled. */
+      webhookToleranceSeconds;
       async send(args) {
         const msg = {
           to: args.to,
@@ -355,10 +396,11 @@ var init_sendgrid = __esm({
         try {
           const verifier = crypto2.createVerify("sha256");
           verifier.update(payload);
-          return verifier.verify(this.opts.webhookVerificationKey, sig, "base64");
+          if (!verifier.verify(this.opts.webhookVerificationKey, sig, "base64")) return false;
         } catch {
           return false;
         }
+        return isWebhookTimestampFresh(ts, this.webhookToleranceSeconds);
       }
       parseWebhookEvents(payload) {
         if (!Array.isArray(payload)) return [];
@@ -797,13 +839,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path, preserveJsx) {
-  if (typeof path === "string" && /^\.\.?\//.test(path)) {
-    return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
+function __rewriteRelativeImportExtension(path2, preserveJsx) {
+  if (typeof path2 === "string" && /^\.\.?\//.test(path2)) {
+    return path2.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : d + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path;
+  return path2;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -1633,7 +1675,7 @@ var require_lib = __commonJS({
   "node_modules/new-find-package-json/lib/index.js"(exports) {
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.findSync = exports.find = exports.findAsync = void 0;
-    var path = __require("path");
+    var path2 = __require("path");
     var fs_1 = __require("fs");
     var debug = require_src();
     var log = debug("new-find-package-json:main");
@@ -1641,14 +1683,14 @@ var require_lib = __commonJS({
       log(`findSync: called with "${input}" and "${base}" and "${fileName}"`);
       base = !!base ? base : "";
       const useFileName = !!fileName ? fileName : "package.json";
-      const useBase = !!base || path.isAbsolute(base) ? base : process.cwd();
-      let testPath = path.resolve(useBase, input);
+      const useBase = !!base || path2.isAbsolute(base) ? base : process.cwd();
+      let testPath = path2.resolve(useBase, input);
       let wasRoot = false;
       while (testPath) {
-        if (testPath === path.parse(testPath).root) {
+        if (testPath === path2.parse(testPath).root) {
           wasRoot = true;
         }
-        const testFile = path.resolve(testPath, useFileName);
+        const testFile = path2.resolve(testPath, useFileName);
         log(`findSync: testing path "${testFile}"`);
         const result = await statPathAsync(testFile);
         if (!!result && result.isFile()) {
@@ -1659,7 +1701,7 @@ var require_lib = __commonJS({
         if (wasRoot) {
           break;
         }
-        testPath = path.resolve(testPath, "..");
+        testPath = path2.resolve(testPath, "..");
       }
     }
     exports.findAsync = findAsync;
@@ -1668,14 +1710,14 @@ var require_lib = __commonJS({
       log(`findSync: called with "${input}" and "${base}" and "${fileName}"`);
       base = !!base ? base : "";
       const useFileName = !!fileName ? fileName : "package.json";
-      const useBase = !!base || path.isAbsolute(base) ? base : process.cwd();
-      let testPath = path.resolve(useBase, input);
+      const useBase = !!base || path2.isAbsolute(base) ? base : process.cwd();
+      let testPath = path2.resolve(useBase, input);
       let wasRoot = false;
       while (testPath) {
-        if (testPath === path.parse(testPath).root) {
+        if (testPath === path2.parse(testPath).root) {
           wasRoot = true;
         }
-        const testFile = path.resolve(testPath, useFileName);
+        const testFile = path2.resolve(testPath, useFileName);
         log(`findSync: testing path "${testFile}"`);
         const result = statPathSync(testFile);
         if (!!result && result.isFile()) {
@@ -1686,14 +1728,14 @@ var require_lib = __commonJS({
         if (wasRoot) {
           break;
         }
-        testPath = path.resolve(testPath, "..");
+        testPath = path2.resolve(testPath, "..");
       }
     }
     exports.findSync = findSync;
-    function statPathSync(path2) {
+    function statPathSync(path3) {
       var _a;
       try {
-        return (0, fs_1.statSync)(path2);
+        return (0, fs_1.statSync)(path3);
       } catch (err) {
         if (err != void 0 && err != null && ((_a = err) === null || _a === void 0 ? void 0 : _a.code) === "ENOENT") {
           return void 0;
@@ -1701,8 +1743,8 @@ var require_lib = __commonJS({
         throw err;
       }
     }
-    async function statPathAsync(path2) {
-      return fs_1.promises.stat(path2).catch((err) => {
+    async function statPathAsync(path3) {
+      return fs_1.promises.stat(path3).catch((err) => {
         if (err.code === "ENOENT") {
           return void 0;
         }
@@ -1821,18 +1863,18 @@ https://typegoose.github.io/mongodb-memory-server/docs/guides/migration/migrate7
     exports.AuthNotObjectError = AuthNotObjectError;
     var InsufficientPermissionsError = class extends Error {
       path;
-      constructor(path) {
-        super(`File "${path}" does not have the required Permissions, required Permissions: "--x"`);
-        this.path = path;
+      constructor(path2) {
+        super(`File "${path2}" does not have the required Permissions, required Permissions: "--x"`);
+        this.path = path2;
       }
     };
     exports.InsufficientPermissionsError = InsufficientPermissionsError;
     var BinaryNotFoundError = class extends Error {
       path;
       extra;
-      constructor(path, extra = "") {
-        super(`No Binary at path "${path}" was found! (ENOENT)${extra}`);
-        this.path = path;
+      constructor(path2, extra = "") {
+        super(`No Binary at path "${path2}" was found! (ENOENT)${extra}`);
+        this.path = path2;
         this.extra = extra;
       }
     };
@@ -3907,7 +3949,7 @@ var require_utils = __commonJS({
     var fs_1 = __require("fs");
     var errors_1 = require_errors();
     var os_1 = __require("os");
-    var path = tslib_1.__importStar(__require("path"));
+    var path2 = tslib_1.__importStar(__require("path"));
     var crypto_1 = __require("crypto");
     var semver = tslib_1.__importStar(require_semver2());
     var log = (0, debug_1.default)("MongoMS:utils");
@@ -3991,16 +4033,16 @@ var require_utils = __commonJS({
         ...opts
       };
     }
-    async function statPath(path2) {
-      return fs_1.promises.stat(path2).catch((err) => {
+    async function statPath(path3) {
+      return fs_1.promises.stat(path3).catch((err) => {
         if (["ENOENT", "EACCES"].includes(err.code)) {
           return void 0;
         }
         throw err;
       });
     }
-    async function pathExists(path2) {
-      return !isNullOrUndefined(await statPath(path2));
+    async function pathExists(path3) {
+      return !isNullOrUndefined(await statPath(path3));
     }
     var ManagerBase = class {
     };
@@ -4008,27 +4050,27 @@ var require_utils = __commonJS({
     var ManagerAdvanced = class extends ManagerBase {
     };
     exports.ManagerAdvanced = ManagerAdvanced;
-    async function checkBinaryPermissions(path2) {
+    async function checkBinaryPermissions(path3) {
       try {
-        await fs_1.promises.access(path2, fs_1.constants.X_OK);
+        await fs_1.promises.access(path3, fs_1.constants.X_OK);
       } catch (err) {
         if (errorWithCode(err)) {
           if (err.code === "EACCES") {
-            throw new errors_1.InsufficientPermissionsError(path2);
+            throw new errors_1.InsufficientPermissionsError(path3);
           }
           if (err.code === "ENOENT") {
-            throw new errors_1.BinaryNotFoundError(path2);
+            throw new errors_1.BinaryNotFoundError(path3);
           }
         }
         throw err;
       }
     }
-    async function mkdir(path2) {
-      await fs_1.promises.mkdir(path2, { recursive: true });
+    async function mkdir(path3) {
+      await fs_1.promises.mkdir(path3, { recursive: true });
     }
     async function createTmpDir(prefix, atPath) {
       const tmpPath = atPath ?? (0, os_1.tmpdir)();
-      return fs_1.promises.mkdtemp(path.join(tmpPath, prefix));
+      return fs_1.promises.mkdtemp(path2.join(tmpPath, prefix));
     }
     async function removeDir(dirPath) {
       const stat = await statPath(dirPath);
@@ -4050,7 +4092,7 @@ var require_utils = __commonJS({
       return md5(await fs_1.promises.readFile(file));
     }
     function lockfilePath(downloadDir, version) {
-      return path.resolve(downloadDir, `${version}.lock`);
+      return path2.resolve(downloadDir, `${version}.lock`);
     }
     function getStorageEngine(storageEngine, coercedVersion) {
       if (storageEngine === "ephemeralForTest" && semver.gte(coercedVersion, "7.0.0")) {
@@ -4084,7 +4126,7 @@ var require_resolveConfig = __commonJS({
     var camelcase_1 = tslib_1.__importDefault(require_camelcase());
     var new_find_package_json_1 = require_lib();
     var debug_1 = tslib_1.__importDefault(require_src());
-    var path = tslib_1.__importStar(__require("path"));
+    var path2 = tslib_1.__importStar(__require("path"));
     var fs_1 = __require("fs");
     var utils_1 = require_utils();
     Symbol.dispose ??= /* @__PURE__ */ Symbol("Symbol.dispose");
@@ -4141,7 +4183,7 @@ var require_resolveConfig = __commonJS({
         const config = readout?.config?.mongodbMemoryServer;
         if (!(0, utils_1.isNullOrUndefined)(config) && Object.keys(config ?? {}).length > 0) {
           log(`findPackageJson: Found package with non-empty config field at "${filename}"`);
-          const filepath = path.dirname(filename);
+          const filepath = path2.dirname(filename);
           packagejson = {
             filePath: filepath,
             config: processConfigOption(config, filepath)
@@ -4161,10 +4203,10 @@ var require_resolveConfig = __commonJS({
       const ccDownloadDir = (0, camelcase_1.default)(ResolveConfigVariables.DOWNLOAD_DIR);
       const ccSystemBinary = (0, camelcase_1.default)(ResolveConfigVariables.SYSTEM_BINARY);
       if (ccDownloadDir in returnobj) {
-        returnobj[ccDownloadDir] = path.resolve(filepath, returnobj[ccDownloadDir]);
+        returnobj[ccDownloadDir] = path2.resolve(filepath, returnobj[ccDownloadDir]);
       }
       if (ccSystemBinary in returnobj) {
-        returnobj[ccSystemBinary] = path.resolve(filepath, returnobj[ccSystemBinary]);
+        returnobj[ccSystemBinary] = path2.resolve(filepath, returnobj[ccSystemBinary]);
       }
       return returnobj;
     }
@@ -4307,7 +4349,7 @@ var require_debug2 = __commonJS({
 var require_follow_redirects = __commonJS({
   "node_modules/follow-redirects/index.js"(exports, module) {
     var url = __require("url");
-    var URL = url.URL;
+    var URL2 = url.URL;
     var http = __require("http");
     var https = __require("https");
     var Writable = __require("stream").Writable;
@@ -4323,7 +4365,7 @@ var require_follow_redirects = __commonJS({
     })();
     var useNativeURL = false;
     try {
-      assert(new URL(""));
+      assert(new URL2(""));
     } catch (error) {
       useNativeURL = error.code === "ERR_INVALID_URL";
     }
@@ -4712,7 +4754,7 @@ var require_follow_redirects = __commonJS({
     function parseUrl(input) {
       var parsed;
       if (useNativeURL) {
-        parsed = new URL(input);
+        parsed = new URL2(input);
       } else {
         parsed = validateUrl(url.parse(input));
         if (!isString(parsed.protocol)) {
@@ -4722,7 +4764,7 @@ var require_follow_redirects = __commonJS({
       return parsed;
     }
     function resolveUrl(relative, base) {
-      return useNativeURL ? new URL(relative, base) : parseUrl(url.resolve(base, relative));
+      return useNativeURL ? new URL2(relative, base) : parseUrl(url.resolve(base, relative));
     }
     function validateUrl(input) {
       if (/^\[/.test(input.hostname) && !/^\[[:0-9a-f]+\]$/i.test(input.hostname)) {
@@ -4804,7 +4846,7 @@ var require_follow_redirects = __commonJS({
       return typeof value === "object" && "length" in value;
     }
     function isURL(value) {
-      return URL && value instanceof URL;
+      return URL2 && value instanceof URL2;
     }
     function escapeRegex(regex) {
       return regex.replace(/[\]\\/()*+?.$]/g, "\\$&");
@@ -7197,7 +7239,7 @@ var require_pend = __commonJS({
 // node_modules/yauzl/fd-slicer.js
 var require_fd_slicer = __commonJS({
   "node_modules/yauzl/fd-slicer.js"(exports) {
-    var fs = __require("fs");
+    var fs2 = __require("fs");
     var util = __require("util");
     var stream = __require("stream");
     var Readable = stream.Readable;
@@ -7222,7 +7264,7 @@ var require_fd_slicer = __commonJS({
     FdSlicer.prototype.read = function(buffer, offset, length, position, callback) {
       var self = this;
       self.pend.go(function(cb) {
-        fs.read(self.fd, buffer, offset, length, position, function(err, bytesRead, buffer2) {
+        fs2.read(self.fd, buffer, offset, length, position, function(err, bytesRead, buffer2) {
           cb();
           callback(err, bytesRead, buffer2);
         });
@@ -7231,7 +7273,7 @@ var require_fd_slicer = __commonJS({
     FdSlicer.prototype.write = function(buffer, offset, length, position, callback) {
       var self = this;
       self.pend.go(function(cb) {
-        fs.write(self.fd, buffer, offset, length, position, function(err, written, buffer2) {
+        fs2.write(self.fd, buffer, offset, length, position, function(err, written, buffer2) {
           cb();
           callback(err, written, buffer2);
         });
@@ -7252,7 +7294,7 @@ var require_fd_slicer = __commonJS({
       if (self.refCount > 0) return;
       if (self.refCount < 0) throw new Error("invalid unref");
       if (self.autoClose) {
-        fs.close(self.fd, onCloseDone);
+        fs2.close(self.fd, onCloseDone);
       }
       function onCloseDone(err) {
         if (err) {
@@ -7289,7 +7331,7 @@ var require_fd_slicer = __commonJS({
       self.context.pend.go(function(cb) {
         if (self.destroyed) return cb();
         var buffer = Buffer.allocUnsafe(toRead);
-        fs.read(self.context.fd, buffer, 0, toRead, self.pos, function(err, bytesRead) {
+        fs2.read(self.context.fd, buffer, 0, toRead, self.pos, function(err, bytesRead) {
           if (err) {
             self.destroy(err);
           } else if (bytesRead === 0) {
@@ -7336,7 +7378,7 @@ var require_fd_slicer = __commonJS({
       }
       self.context.pend.go(function(cb) {
         if (self.destroyed) return cb();
-        fs.write(self.context.fd, buffer, 0, buffer.length, self.pos, function(err2, bytes) {
+        fs2.write(self.context.fd, buffer, 0, buffer.length, self.pos, function(err2, bytes) {
           if (err2) {
             self.destroy();
             cb();
@@ -7774,7 +7816,7 @@ var require_buffer_crc32 = __commonJS({
 // node_modules/yauzl/index.js
 var require_yauzl = __commonJS({
   "node_modules/yauzl/index.js"(exports) {
-    var fs = __require("fs");
+    var fs2 = __require("fs");
     var zlib = __require("zlib");
     var fd_slicer = require_fd_slicer();
     var crc32 = require_buffer_crc32();
@@ -7795,7 +7837,7 @@ var require_yauzl = __commonJS({
     exports.Entry = Entry;
     exports.LocalFileHeader = LocalFileHeader;
     exports.RandomAccessReader = RandomAccessReader;
-    function open(path, options2, callback) {
+    function open(path2, options2, callback) {
       if (typeof options2 === "function") {
         callback = options2;
         options2 = null;
@@ -7807,10 +7849,10 @@ var require_yauzl = __commonJS({
       if (options2.validateEntrySizes == null) options2.validateEntrySizes = true;
       if (options2.strictFileNames == null) options2.strictFileNames = false;
       if (callback == null) callback = defaultCallback;
-      fs.open(path, "r", function(err, fd) {
+      fs2.open(path2, "r", function(err, fd) {
         if (err) return callback(err);
         fromFd(fd, options2, function(err2, zipfile) {
-          if (err2) fs.close(fd, defaultCallback);
+          if (err2) fs2.close(fd, defaultCallback);
           callback(err2, zipfile);
         });
       });
@@ -7827,7 +7869,7 @@ var require_yauzl = __commonJS({
       if (options2.validateEntrySizes == null) options2.validateEntrySizes = true;
       if (options2.strictFileNames == null) options2.strictFileNames = false;
       if (callback == null) callback = defaultCallback;
-      fs.fstat(fd, function(err, stats) {
+      fs2.fstat(fd, function(err, stats) {
         if (err) return callback(err);
         var reader = fd_slicer.createFromFd(fd, { autoClose: true });
         fromRandomAccessReader(reader, stats.size, options2, callback);
@@ -8610,15 +8652,15 @@ var require_getos = __commonJS({
         id_like: input.match(OSRegex.id_like)?.[1].toLocaleLowerCase().split(" ")
       };
     }
-    async function tryReleaseFile(path, parser) {
+    async function tryReleaseFile(path2, parser) {
       try {
-        const output = await fs_1.promises.readFile(path);
+        const output = await fs_1.promises.readFile(path2);
         return parser(output.toString());
       } catch (err) {
         if ((0, utils_1.errorWithCode)(err) && !["ENOENT", "EACCES"].includes(err.code)) {
           throw err;
         }
-        log(`tryReleaseFile: "${path}" does not exist`);
+        log(`tryReleaseFile: "${path2}" does not exist`);
         return void 0;
       }
     }
@@ -9591,11 +9633,11 @@ var require_dist2 = __commonJS({
 // node_modules/commondir/index.js
 var require_commondir = __commonJS({
   "node_modules/commondir/index.js"(exports, module) {
-    var path = __require("path");
+    var path2 = __require("path");
     module.exports = function(basedir, relfiles) {
       if (relfiles) {
         var files = relfiles.map(function(r) {
-          return path.resolve(basedir, r);
+          return path2.resolve(basedir, r);
         });
       } else {
         var files = basedir;
@@ -9718,12 +9760,12 @@ var require_p_locate = __commonJS({
 // node_modules/locate-path/index.js
 var require_locate_path = __commonJS({
   "node_modules/locate-path/index.js"(exports, module) {
-    var path = __require("path");
-    var fs = __require("fs");
+    var path2 = __require("path");
+    var fs2 = __require("fs");
     var { promisify } = __require("util");
     var pLocate = require_p_locate();
-    var fsStat = promisify(fs.stat);
-    var fsLStat = promisify(fs.lstat);
+    var fsStat = promisify(fs2.stat);
+    var fsLStat = promisify(fs2.lstat);
     var typeMappings = {
       directory: "isDirectory",
       file: "isFile"
@@ -9746,7 +9788,7 @@ var require_locate_path = __commonJS({
       const statFn = options2.allowSymlinks ? fsStat : fsLStat;
       return pLocate(paths, async (path_) => {
         try {
-          const stat = await statFn(path.resolve(options2.cwd, path_));
+          const stat = await statFn(path2.resolve(options2.cwd, path_));
           return matchType(options2.type, stat);
         } catch (_) {
           return false;
@@ -9761,10 +9803,10 @@ var require_locate_path = __commonJS({
         ...options2
       };
       checkType(options2);
-      const statFn = options2.allowSymlinks ? fs.statSync : fs.lstatSync;
+      const statFn = options2.allowSymlinks ? fs2.statSync : fs2.lstatSync;
       for (const path_ of paths) {
         try {
-          const stat = statFn(path.resolve(options2.cwd, path_));
+          const stat = statFn(path2.resolve(options2.cwd, path_));
           if (matchType(options2.type, stat)) {
             return path_;
           }
@@ -9778,20 +9820,20 @@ var require_locate_path = __commonJS({
 // node_modules/path-exists/index.js
 var require_path_exists = __commonJS({
   "node_modules/path-exists/index.js"(exports, module) {
-    var fs = __require("fs");
+    var fs2 = __require("fs");
     var { promisify } = __require("util");
-    var pAccess = promisify(fs.access);
-    module.exports = async (path) => {
+    var pAccess = promisify(fs2.access);
+    module.exports = async (path2) => {
       try {
-        await pAccess(path);
+        await pAccess(path2);
         return true;
       } catch (_) {
         return false;
       }
     };
-    module.exports.sync = (path) => {
+    module.exports.sync = (path2) => {
       try {
-        fs.accessSync(path);
+        fs2.accessSync(path2);
         return true;
       } catch (_) {
         return false;
@@ -9803,13 +9845,13 @@ var require_path_exists = __commonJS({
 // node_modules/find-up/index.js
 var require_find_up = __commonJS({
   "node_modules/find-up/index.js"(exports, module) {
-    var path = __require("path");
+    var path2 = __require("path");
     var locatePath = require_locate_path();
     var pathExists = require_path_exists();
     var stop = /* @__PURE__ */ Symbol("findUp.stop");
     module.exports = async (name, options2 = {}) => {
-      let directory = path.resolve(options2.cwd || "");
-      const { root } = path.parse(directory);
+      let directory = path2.resolve(options2.cwd || "");
+      const { root } = path2.parse(directory);
       const paths = [].concat(name);
       const runMatcher = async (locateOptions) => {
         if (typeof name !== "function") {
@@ -9827,17 +9869,17 @@ var require_find_up = __commonJS({
           return;
         }
         if (foundPath) {
-          return path.resolve(directory, foundPath);
+          return path2.resolve(directory, foundPath);
         }
         if (directory === root) {
           return;
         }
-        directory = path.dirname(directory);
+        directory = path2.dirname(directory);
       }
     };
     module.exports.sync = (name, options2 = {}) => {
-      let directory = path.resolve(options2.cwd || "");
-      const { root } = path.parse(directory);
+      let directory = path2.resolve(options2.cwd || "");
+      const { root } = path2.parse(directory);
       const paths = [].concat(name);
       const runMatcher = (locateOptions) => {
         if (typeof name !== "function") {
@@ -9855,12 +9897,12 @@ var require_find_up = __commonJS({
           return;
         }
         if (foundPath) {
-          return path.resolve(directory, foundPath);
+          return path2.resolve(directory, foundPath);
         }
         if (directory === root) {
           return;
         }
-        directory = path.dirname(directory);
+        directory = path2.dirname(directory);
       }
     };
     module.exports.exists = pathExists;
@@ -9872,17 +9914,17 @@ var require_find_up = __commonJS({
 // node_modules/pkg-dir/index.js
 var require_pkg_dir = __commonJS({
   "node_modules/pkg-dir/index.js"(exports, module) {
-    var path = __require("path");
+    var path2 = __require("path");
     var findUp = require_find_up();
     var pkgDir = async (cwd) => {
       const filePath = await findUp("package.json", { cwd });
-      return filePath && path.dirname(filePath);
+      return filePath && path2.dirname(filePath);
     };
     module.exports = pkgDir;
     module.exports.default = pkgDir;
     module.exports.sync = (cwd) => {
       const filePath = findUp.sync("package.json", { cwd });
-      return filePath && path.dirname(filePath);
+      return filePath && path2.dirname(filePath);
     };
   }
 });
@@ -11046,14 +11088,14 @@ var require_semver3 = __commonJS({
 // node_modules/make-dir/index.js
 var require_make_dir = __commonJS({
   "node_modules/make-dir/index.js"(exports, module) {
-    var fs = __require("fs");
-    var path = __require("path");
+    var fs2 = __require("fs");
+    var path2 = __require("path");
     var { promisify } = __require("util");
     var semver = require_semver3();
     var useNativeRecursiveOption = semver.satisfies(process.version, ">=10.12.0");
     var checkPath = (pth) => {
       if (process.platform === "win32") {
-        const pathHasInvalidWinCharacters = /[<>:"|?*]/.test(pth.replace(path.parse(pth).root, ""));
+        const pathHasInvalidWinCharacters = /[<>:"|?*]/.test(pth.replace(path2.parse(pth).root, ""));
         if (pathHasInvalidWinCharacters) {
           const error = new Error(`Path contains invalid characters: ${pth}`);
           error.code = "EINVAL";
@@ -11064,7 +11106,7 @@ var require_make_dir = __commonJS({
     var processOptions = (options2) => {
       const defaults = {
         mode: 511,
-        fs
+        fs: fs2
       };
       return {
         ...defaults,
@@ -11084,8 +11126,8 @@ var require_make_dir = __commonJS({
       options2 = processOptions(options2);
       const mkdir = promisify(options2.fs.mkdir);
       const stat = promisify(options2.fs.stat);
-      if (useNativeRecursiveOption && options2.fs.mkdir === fs.mkdir) {
-        const pth = path.resolve(input);
+      if (useNativeRecursiveOption && options2.fs.mkdir === fs2.mkdir) {
+        const pth = path2.resolve(input);
         await mkdir(pth, {
           mode: options2.mode,
           recursive: true
@@ -11101,13 +11143,13 @@ var require_make_dir = __commonJS({
             throw error;
           }
           if (error.code === "ENOENT") {
-            if (path.dirname(pth) === pth) {
+            if (path2.dirname(pth) === pth) {
               throw permissionError(pth);
             }
             if (error.message.includes("null bytes")) {
               throw error;
             }
-            await make(path.dirname(pth));
+            await make(path2.dirname(pth));
             return make(pth);
           }
           try {
@@ -11121,15 +11163,15 @@ var require_make_dir = __commonJS({
           return pth;
         }
       };
-      return make(path.resolve(input));
+      return make(path2.resolve(input));
     };
     module.exports = makeDir;
     module.exports.sync = (input, options2) => {
       checkPath(input);
       options2 = processOptions(options2);
-      if (useNativeRecursiveOption && options2.fs.mkdirSync === fs.mkdirSync) {
-        const pth = path.resolve(input);
-        fs.mkdirSync(pth, {
+      if (useNativeRecursiveOption && options2.fs.mkdirSync === fs2.mkdirSync) {
+        const pth = path2.resolve(input);
+        fs2.mkdirSync(pth, {
           mode: options2.mode,
           recursive: true
         });
@@ -11143,13 +11185,13 @@ var require_make_dir = __commonJS({
             throw error;
           }
           if (error.code === "ENOENT") {
-            if (path.dirname(pth) === pth) {
+            if (path2.dirname(pth) === pth) {
               throw permissionError(pth);
             }
             if (error.message.includes("null bytes")) {
               throw error;
             }
-            make(path.dirname(pth));
+            make(path2.dirname(pth));
             return make(pth);
           }
           try {
@@ -11162,7 +11204,7 @@ var require_make_dir = __commonJS({
         }
         return pth;
       };
-      return make(path.resolve(input));
+      return make(path2.resolve(input));
     };
   }
 });
@@ -11170,15 +11212,15 @@ var require_make_dir = __commonJS({
 // node_modules/find-cache-dir/index.js
 var require_find_cache_dir = __commonJS({
   "node_modules/find-cache-dir/index.js"(exports, module) {
-    var path = __require("path");
-    var fs = __require("fs");
+    var path2 = __require("path");
+    var fs2 = __require("fs");
     var commonDir = require_commondir();
     var pkgDir = require_pkg_dir();
     var makeDir = require_make_dir();
     var { env, cwd } = process;
-    var isWritable = (path2) => {
+    var isWritable = (path3) => {
       try {
-        fs.accessSync(path2, fs.constants.W_OK);
+        fs2.accessSync(path3, fs2.constants.W_OK);
         return true;
       } catch (_) {
         return false;
@@ -11189,20 +11231,20 @@ var require_find_cache_dir = __commonJS({
         makeDir.sync(directory);
       }
       if (options2.thunk) {
-        return (...arguments_) => path.join(directory, ...arguments_);
+        return (...arguments_) => path2.join(directory, ...arguments_);
       }
       return directory;
     }
     function getNodeModuleDirectory(directory) {
-      const nodeModules = path.join(directory, "node_modules");
-      if (!isWritable(nodeModules) && (fs.existsSync(nodeModules) || !isWritable(path.join(directory)))) {
+      const nodeModules = path2.join(directory, "node_modules");
+      if (!isWritable(nodeModules) && (fs2.existsSync(nodeModules) || !isWritable(path2.join(directory)))) {
         return;
       }
       return nodeModules;
     }
     module.exports = (options2 = {}) => {
       if (env.CACHE_DIR && !["true", "false", "1", "0"].includes(env.CACHE_DIR)) {
-        return useDirectory(path.join(env.CACHE_DIR, options2.name), options2);
+        return useDirectory(path2.join(env.CACHE_DIR, options2.name), options2);
       }
       let { cwd: directory = cwd() } = options2;
       if (options2.files) {
@@ -11216,7 +11258,7 @@ var require_find_cache_dir = __commonJS({
       if (!nodeModules) {
         return void 0;
       }
-      return useDirectory(path.join(directory, "node_modules", ".cache", options2.name), options2);
+      return useDirectory(path2.join(directory, "node_modules", ".cache", options2.name), options2);
     };
   }
 });
@@ -11230,7 +11272,7 @@ var require_DryMongoBinary = __commonJS({
     var debug_1 = tslib_1.__importDefault(require_src());
     var resolveConfig_1 = require_resolveConfig();
     var utils_1 = require_utils();
-    var path = tslib_1.__importStar(__require("path"));
+    var path2 = tslib_1.__importStar(__require("path"));
     var os_1 = __require("os");
     var find_cache_dir_1 = tslib_1.__importDefault(require_find_cache_dir());
     var getos_1 = require_getos();
@@ -11251,7 +11293,7 @@ var require_DryMongoBinary = __commonJS({
         const useOpts = await this.generateOptions(opts);
         if (useOpts.systemBinary) {
           log(`locateBinary: env "SYSTEM_BINARY" was provided with value: "${useOpts.systemBinary}"`);
-          const systemReturn = await this.getSystemPath(path.resolve(useOpts.systemBinary));
+          const systemReturn = await this.getSystemPath(path2.resolve(useOpts.systemBinary));
           if ((0, utils_1.isNullOrUndefined)(systemReturn)) {
             throw new errors_1.BinaryNotFoundError(useOpts.systemBinary, " (systemBinary)");
           }
@@ -11268,7 +11310,7 @@ var require_DryMongoBinary = __commonJS({
           log("locateBinary: could not find a existing binary");
           return void 0;
         }
-        if (returnValue[0] && await (0, utils_1.pathExists)((0, utils_1.lockfilePath)(path.dirname(returnValue[1]), useOpts.version))) {
+        if (returnValue[0] && await (0, utils_1.pathExists)((0, utils_1.lockfilePath)(path2.dirname(returnValue[1]), useOpts.version))) {
           log("locateBinary: binary found, but also a download-lock, trying to resolve lock");
           return void 0;
         }
@@ -11299,7 +11341,7 @@ var require_DryMongoBinary = __commonJS({
           arch: ensuredOpts.arch || (0, os_1.arch)(),
           systemBinary: (0, resolveConfig_1.resolveConfig)(resolveConfig_1.ResolveConfigVariables.SYSTEM_BINARY) || ensuredOpts.systemBinary || ""
         };
-        final.downloadDir = path.dirname((await this.generateDownloadPath(final))[1]);
+        final.downloadDir = path2.dirname((await this.generateDownloadPath(final))[1]);
         if ((0, resolveConfig_1.resolveConfig)(resolveConfig_1.ResolveConfigVariables.ARCHIVE_NAME) || (0, resolveConfig_1.resolveConfig)(resolveConfig_1.ResolveConfigVariables.DOWNLOAD_URL)) {
           const input = (0, resolveConfig_1.resolveConfig)(resolveConfig_1.ResolveConfigVariables.DOWNLOAD_URL) || (0, resolveConfig_1.resolveConfig)(resolveConfig_1.ResolveConfigVariables.ARCHIVE_NAME);
           log(`generateOptions: ARCHIVE_NAME or DOWNLOAD_URL defined, generating options based on that (input: "${input}")`);
@@ -11346,7 +11388,7 @@ var require_DryMongoBinary = __commonJS({
         let binaryName;
         if ((0, resolveConfig_1.envToBool)((0, resolveConfig_1.resolveConfig)(resolveConfig_1.ResolveConfigVariables.USE_ARCHIVE_NAME_FOR_BINARY_NAME))) {
           const archiveName = await new MongoBinaryDownloadUrl_1.MongoBinaryDownloadUrl(opts).getArchiveName();
-          binaryName = path.parse(archiveName).name;
+          binaryName = path2.parse(archiveName).name;
         } else {
           const addExe = opts.platform === "win32" ? ".exe" : "";
           const dist = (0, getos_1.isLinuxOS)(opts.os) ? opts.os.dist : opts.os.os;
@@ -11359,7 +11401,7 @@ var require_DryMongoBinary = __commonJS({
        */
       static combineBinaryName(basePath, binaryName) {
         log("combineBinaryName");
-        return path.resolve(basePath, binaryName);
+        return path2.resolve(basePath, binaryName);
       }
       /**
        * Probe if the provided "systemBinary" is an existing path
@@ -11394,11 +11436,11 @@ ${err instanceof Error ? err.message : err}`);
         };
         const binaryName = await this.getBinaryName(opts);
         let nodeModulesDLDir = process.env["INIT_CWD"] || process.cwd();
-        while (nodeModulesDLDir.includes(`node_modules${path.sep}mongodb-memory-server`)) {
-          nodeModulesDLDir = path.resolve(nodeModulesDLDir, "..", "..");
+        while (nodeModulesDLDir.includes(`node_modules${path2.sep}mongodb-memory-server`)) {
+          nodeModulesDLDir = path2.resolve(nodeModulesDLDir, "..", "..");
         }
         const configPackagePath = (0, resolveConfig_1.packageJsonPath)();
-        if (configPackagePath && await (0, utils_1.pathExists)(path.resolve(configPackagePath, "node_modules"))) {
+        if (configPackagePath && await (0, utils_1.pathExists)(path2.resolve(configPackagePath, "node_modules"))) {
           nodeModulesDLDir = configPackagePath;
         }
         const tmpModulesCache = (0, find_cache_dir_1.default)({
@@ -11406,16 +11448,16 @@ ${err instanceof Error ? err.message : err}`);
           cwd: nodeModulesDLDir
         });
         if (!(0, utils_1.isNullOrUndefined)(tmpModulesCache)) {
-          final.modulesCache = this.combineBinaryName(path.resolve(tmpModulesCache), binaryName);
+          final.modulesCache = this.combineBinaryName(path2.resolve(tmpModulesCache), binaryName);
         }
-        const homeCache = path.resolve(this.homedir(), ".cache/mongodb-binaries");
+        const homeCache = path2.resolve(this.homedir(), ".cache/mongodb-binaries");
         final.homeCache = this.combineBinaryName(homeCache, binaryName);
         const resolveConfigValue = opts.downloadDir || (0, resolveConfig_1.resolveConfig)(resolveConfig_1.ResolveConfigVariables.DOWNLOAD_DIR);
         if (!(0, utils_1.isNullOrUndefined)(resolveConfigValue) && resolveConfigValue.length > 0) {
           log(`generatePaths: resolveConfigValue is not empty`);
           final.resolveConfig = this.combineBinaryName(resolveConfigValue, binaryName);
         }
-        final.relative = this.combineBinaryName(path.resolve(process.cwd(), "mongodb-binaries"), binaryName);
+        final.relative = this.combineBinaryName(path2.resolve(process.cwd(), "mongodb-binaries"), binaryName);
         return final;
       }
       /**
@@ -12378,7 +12420,7 @@ var require_lockfile = __commonJS({
     var events_1 = __require("events");
     var utils = tslib_1.__importStar(require_utils());
     var debug_1 = tslib_1.__importDefault(require_src());
-    var path = tslib_1.__importStar(__require("path"));
+    var path2 = tslib_1.__importStar(__require("path"));
     var fs_1 = __require("fs");
     var async_mutex_1 = require_lib2();
     var errors_1 = require_errors();
@@ -12418,7 +12460,7 @@ var require_lockfile = __commonJS({
       static async lock(file) {
         await utils.ensureAsync();
         log(`lock: Locking file "${file}"`);
-        const useFile = path.resolve(file.trim());
+        const useFile = path2.resolve(file.trim());
         utils.assertion(useFile.length > 0, new Error("Provided Path for lock file is length of 0"));
         const status = await this.checkLock(useFile);
         switch (status) {
@@ -12519,7 +12561,7 @@ var require_lockfile = __commonJS({
               log(`createLock: Map already has file "${file}"`);
               throw new RepeatError(true);
             }
-            await utils.mkdir(path.dirname(file));
+            await utils.mkdir(path2.dirname(file));
             await fs_1.promises.writeFile(file, `${process.pid.toString()} ${uuid}`);
             this.files.add(file);
             this.events.emit(LockFileEvents.lock, file);
@@ -12705,7 +12747,7 @@ var require_MongoInstance = __commonJS({
     exports.MongoInstance = exports.MongoInstanceEvents = void 0;
     var tslib_1 = (init_tslib_es6(), __toCommonJS(tslib_es6_exports));
     var child_process_1 = __require("child_process");
-    var path = tslib_1.__importStar(__require("path"));
+    var path2 = tslib_1.__importStar(__require("path"));
     var MongoBinary_1 = require_MongoBinary();
     var debug_1 = tslib_1.__importDefault(require_src());
     var utils_1 = require_utils();
@@ -12942,7 +12984,7 @@ var require_MongoInstance = __commonJS({
        */
       _launchMongod(mongoBin) {
         this.debug("_launchMongod: Launching Mongod Process");
-        const childProcess = (0, child_process_1.spawn)(path.resolve(mongoBin), this.prepareCommandArgs(), {
+        const childProcess = (0, child_process_1.spawn)(path2.resolve(mongoBin), this.prepareCommandArgs(), {
           ...this.spawnOpts,
           stdio: "pipe"
           // ensure that stdio is always an pipe, regardless of user input
@@ -12952,7 +12994,7 @@ var require_MongoInstance = __commonJS({
         childProcess.on("close", this.closeHandler.bind(this));
         childProcess.on("error", this.errorHandler.bind(this));
         if ((0, utils_1.isNullOrUndefined)(childProcess.pid)) {
-          throw new errors_1.StartBinaryFailedError(path.resolve(mongoBin));
+          throw new errors_1.StartBinaryFailedError(path2.resolve(mongoBin));
         }
         childProcess.unref();
         this.emit(MongoInstanceEvents.instanceLaunched);
@@ -12966,7 +13008,7 @@ var require_MongoInstance = __commonJS({
        */
       _launchKiller(parentPid, childPid) {
         this.debug(`_launchKiller: Launching Killer Process (parent: ${parentPid}, child: ${childPid})`);
-        const killer = (0, child_process_1.fork)(path.resolve(__dirname, "../../scripts/mongo_killer.js"), [parentPid.toString(), childPid.toString()], {
+        const killer = (0, child_process_1.fork)(path2.resolve(__dirname, "../../scripts/mongo_killer.js"), [parentPid.toString(), childPid.toString()], {
           execArgv: [],
           detached: true,
           stdio: "ignore"
@@ -14137,8 +14179,20 @@ var NullProvider = class {
       status: "accepted"
     };
   }
+  /**
+   * Fails closed. This provider has no signing key, so it can never establish
+   * that an inbound payload is authentic — and a method whose entire job is to
+   * reject unauthenticated input must not answer "yes" by default. Returning
+   * `true` here would mean any unsigned body posted to the webhook route is
+   * accepted as genuine whenever the null provider is registered, which is
+   * exactly the dev/staging configuration where that is easiest to miss.
+   *
+   * Nothing is lost: `parseWebhookEvents()` returns `[]`, so there was never
+   * any inbound behaviour to preserve. To exercise the inbound half locally,
+   * use a provider that actually signs (see `test/README.md`).
+   */
   async verifyWebhook() {
-    return true;
+    return false;
   }
   parseWebhookEvents() {
     return [];
@@ -14268,6 +14322,10 @@ var flowStepSchema = z.lazy(
     }),
     z.object({
       type: z.literal("webhook"),
+      // `url` is validated for shape only and is deliberately never templated —
+      // see the comment on handleWebhookStep in src/server/runner/step.ts, and
+      // INVARIANT 16. Rendering contact/event data into this field would turn an
+      // admin-authored flow into a server-side request forgery primitive.
       url: z.string().url(),
       method: z.enum(["POST", "PUT"]).optional(),
       payload: z.record(z.string(), z.unknown()).optional(),
@@ -14361,6 +14419,7 @@ var DEFAULTS = {
   requireDoubleOptIn: false,
   unsubscribeTokenLifetimeDays: 90,
   transactionalRespectUnsubscribe: false,
+  unsubscribeWriteTimeoutMs: 5e3,
   doiTemplateSlug: "doi-confirmation",
   doiTokenLifetimeDays: 7,
   broadcastConfirmationThreshold: 1e3,
@@ -14377,7 +14436,9 @@ var DEFAULTS = {
   trackOpens: true,
   trackClicks: true,
   storeTrackingIp: false,
-  storeRenderedBody: false
+  storeRenderedBody: false,
+  requireSignedTrackingUrls: false,
+  trackingUrlLifetimeDays: 0
 };
 var CIRCUIT_BREAKER_DEFAULTS = {
   hardBounceRatePctTrip: 2,
@@ -14394,6 +14455,7 @@ function resolveConfig(c) {
     requireDoubleOptIn: c.requireDoubleOptIn ?? DEFAULTS.requireDoubleOptIn,
     unsubscribeTokenLifetimeDays: c.unsubscribeTokenLifetimeDays ?? DEFAULTS.unsubscribeTokenLifetimeDays,
     transactionalRespectUnsubscribe: c.transactionalRespectUnsubscribe ?? DEFAULTS.transactionalRespectUnsubscribe,
+    unsubscribeWriteTimeoutMs: c.unsubscribeWriteTimeoutMs ?? DEFAULTS.unsubscribeWriteTimeoutMs,
     doiTemplateSlug: c.doiTemplateSlug ?? DEFAULTS.doiTemplateSlug,
     doiTokenLifetimeDays: c.doiTokenLifetimeDays ?? DEFAULTS.doiTokenLifetimeDays,
     broadcastConfirmationThreshold: c.broadcastConfirmationThreshold ?? DEFAULTS.broadcastConfirmationThreshold,
@@ -14411,6 +14473,8 @@ function resolveConfig(c) {
     trackClicks: c.trackClicks ?? DEFAULTS.trackClicks,
     storeTrackingIp: c.storeTrackingIp ?? DEFAULTS.storeTrackingIp,
     storeRenderedBody: c.storeRenderedBody ?? DEFAULTS.storeRenderedBody,
+    requireSignedTrackingUrls: c.requireSignedTrackingUrls ?? DEFAULTS.requireSignedTrackingUrls,
+    trackingUrlLifetimeDays: c.trackingUrlLifetimeDays ?? DEFAULTS.trackingUrlLifetimeDays,
     circuitBreaker: { ...CIRCUIT_BREAKER_DEFAULTS, ...c.circuitBreaker ?? {} }
   };
 }
@@ -14613,6 +14677,22 @@ function isoDay(d) {
 function randomId() {
   return crypto2.randomBytes(8).toString("hex");
 }
+
+// src/server/provider-lookup.ts
+var PROVIDER_METHODS = ["send", "verifyWebhook", "parseWebhookEvents"];
+function isMailProvider(candidate) {
+  if (!candidate || typeof candidate !== "object") return false;
+  const p = candidate;
+  return PROVIDER_METHODS.every((m) => typeof p[m] === "function");
+}
+function resolveProvider(providers, name) {
+  if (typeof name !== "string" || !Object.hasOwn(providers, name)) return null;
+  const candidate = providers[name];
+  return isMailProvider(candidate) ? candidate : null;
+}
+function registeredProviderNames(providers) {
+  return Object.keys(providers).filter((name) => resolveProvider(providers, name) !== null).sort();
+}
 function signUnsubscribeToken(payload, secret) {
   const body = JSON.stringify({
     e: payload.email.toLowerCase(),
@@ -14623,6 +14703,19 @@ function signUnsubscribeToken(payload, secret) {
   const hmac = crypto2.createHmac("sha256", secret).update(bodyB64).digest();
   return `${bodyB64}.${b64url(hmac)}`;
 }
+var TRACKING_SCOPES = ["open", "click"];
+var TRACKING_SIG_LENGTH = 12;
+function trackingMessage(scope, params) {
+  const tail = params.linkId === void 0 ? "" : `:${params.linkId}`;
+  return `mailery.track.v1:${scope}:${params.sendId}${tail}`;
+}
+function signTrackingToken(scope, params, secret) {
+  if (!TRACKING_SCOPES.includes(scope)) {
+    throw new Error(`signTrackingToken: unknown scope ${String(scope)}`);
+  }
+  const mac = crypto2.createHmac("sha256", secret).update(trackingMessage(scope, params)).digest();
+  return b64url(mac).slice(0, TRACKING_SIG_LENGTH);
+}
 function b64url(buf) {
   return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
@@ -14639,6 +14732,39 @@ function signDoiToken(payload, secret) {
   const hmac = crypto2.createHmac("sha256", secret).update(bodyB64).digest();
   return `${bodyB64}.${b64url(hmac)}`;
 }
+
+// src/server/unsubscribe.ts
+async function applyUnsubscribe(collections, input, now = /* @__PURE__ */ new Date()) {
+  const normalized = input.email;
+  await collections.suppressions.updateOne(
+    { email: normalized, scope: input.scope },
+    {
+      $setOnInsert: {
+        email: normalized,
+        emailHash: sha256Hex(normalized),
+        scope: input.scope,
+        // mailer_suppressions canonical reason — see plans/02-data-model.md.
+        reason: "unsubscribed",
+        source: input.source,
+        notes: input.notes ?? null,
+        addedAt: now,
+        expiresAt: null
+      }
+    },
+    { upsert: true }
+  );
+  await collections.subscriptions.updateOne(
+    { emailAtSubscribe: normalized },
+    {
+      $set: {
+        status: "unsubscribed",
+        unsubscribedAt: now,
+        unsubscribeReason: input.reason,
+        updatedAt: now
+      }
+    }
+  );
+}
 var QUEUE_NAMES = {
   tick: "mailer-tick",
   advance: "mailer-advance",
@@ -15433,7 +15559,7 @@ async function suppressOnce(ctx, email, reason, scope) {
 }
 
 // src/server/runner/predicate.ts
-var BOT_UA_RE = /Mimecast|SafeLinks|proofpoint|HeadlessChrome|Googlebot|bingbot/i;
+var DEFAULT_BOT_UA_RE = /Mimecast|SafeLinks|proofpoint|HeadlessChrome|Googlebot|bingbot/i;
 async function evaluatePredicate(predicate, ctx) {
   const p = predicate;
   if ("hasTag" in p) return ctx.contact.tags.includes(p.hasTag);
@@ -15501,17 +15627,35 @@ async function openOrClickCount(ctx, kind, opts, excludeBots) {
     return await ctx.collections.sends.countDocuments(filter);
   }
   const docs = await ctx.collections.sends.find(filter).limit(1e3).toArray();
+  const botRe = ctx.botFilter?.userAgentPattern ?? DEFAULT_BOT_UA_RE;
+  const minOpenDelayMs = ctx.botFilter?.minOpenDelayMs ?? 0;
   let n = 0;
   for (const s of docs) {
-    if (kind === "opened") {
-      n++;
-      continue;
-    }
-    const hasHumanClick = s.clickedLinks?.some((c) => !c.userAgent || !BOT_UA_RE.test(c.userAgent));
-    if (hasHumanClick) n++;
+    const doc = s;
+    const human = kind === "opened" ? hasHumanOpen(doc, botRe, minOpenDelayMs) : (doc.clickedLinks ?? []).some((c) => !isBotUserAgent(c.userAgent, botRe));
+    if (human) n++;
   }
   return n;
 }
+function isBotUserAgent(ua, botRe) {
+  if (typeof ua !== "string" || ua.trim() === "") return false;
+  return botRe.test(ua);
+}
+function hasHumanOpen(send, botRe, minOpenDelayMs) {
+  const opens = send.opens && send.opens.length > 0 ? send.opens : send.openedAt ? [{ openedAt: send.openedAt, userAgent: null }] : [];
+  return opens.some((o) => {
+    if (isBotUserAgent(o.userAgent, botRe)) return false;
+    if (isPrefetchOpen(o.openedAt, send.queuedAt, minOpenDelayMs)) return false;
+    return true;
+  });
+}
+function isPrefetchOpen(openedAt, queuedAt, minOpenDelayMs) {
+  if (!minOpenDelayMs || minOpenDelayMs <= 0) return false;
+  if (!(openedAt instanceof Date) || !(queuedAt instanceof Date)) return false;
+  const delta = openedAt.getTime() - queuedAt.getTime();
+  if (!Number.isFinite(delta) || delta < 0) return false;
+  return delta < minOpenDelayMs;
+}
 function effectiveLowerBound(ctx, opts) {
   const now = ctx.now ?? /* @__PURE__ */ new Date();
   if (opts.sinceFlowStart) return ctx.run.enteredAt;
@@ -15633,6 +15777,7 @@ function derivePlaintext(html) {
     ]
   }).trim();
 }
+var PLAIN_TEXT = { noEscape: true };
 async function renderTemplate(template, ctx, opts = {}) {
   const hb = makeHandlebars(opts.helpers);
   const subject = hb.compile(template.subject)(ctx);
@@ -15644,7 +15789,7 @@ async function renderTemplate(template, ctx, opts = {}) {
     const compiled = await compileTemplate(template.body.mjml);
     html = hb.compile(compiled.html)(ctx);
   }
-  const plainText = template.body.plainText ? hb.compile(template.body.plainText)(ctx) : derivePlaintext(html);
+  const plainText = template.body.plainText ? hb.compile(template.body.plainText, PLAIN_TEXT)(ctx) : derivePlaintext(html);
   return {
     subject,
     preheader,
@@ -15670,12 +15815,14 @@ function applyTracking(html, opts) {
         seen.set(url, linkId);
         links.push({ linkId, url });
       }
-      const newHref = `${opts.publicUrl}/m/click/${opts.sendId}/${linkId}`;
+      const sig = opts.signingSecret ? `/${signTrackingToken("click", { sendId: opts.sendId, linkId }, opts.signingSecret)}` : "";
+      const newHref = `${opts.publicUrl}/m/click/${opts.sendId}/${linkId}${sig}`;
       return `<a${pre}href="${newHref}"${post}>`;
     });
   }
   if (opts.trackOpens) {
-    const pixel = `<img src="${opts.publicUrl}/m/open/${opts.sendId}.png" width="1" height="1" alt="" style="display:block;border:0" />`;
+    const sig = opts.signingSecret ? `.${signTrackingToken("open", { sendId: opts.sendId }, opts.signingSecret)}` : "";
+    const pixel = `<img src="${opts.publicUrl}/m/open/${opts.sendId}${sig}.png" width="1" height="1" alt="" style="display:block;border:0" />`;
     if (/<\/body>/i.test(out)) {
       out = out.replace(/<\/body>/i, `${pixel}</body>`);
     } else {
@@ -15686,14 +15833,22 @@ function applyTracking(html, opts) {
 }
 function shouldSkipClickRewrite(url, preserve, fullTag) {
   if (!url) return true;
-  if (url.startsWith("mailto:")) return true;
-  if (url.startsWith("tel:")) return true;
   if (url.startsWith("#")) return true;
   if (url.startsWith("{{") || url.startsWith("{")) return true;
   if (preserve.has(url.trim())) return true;
   if (/data-mailer-notrack=["']true["']/.test(fullTag)) return true;
+  if (!isHttpUrl(url)) return true;
   return false;
 }
+function isHttpUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url.trim());
+  } catch {
+    return false;
+  }
+  return parsed.protocol === "http:" || parsed.protocol === "https:";
+}
 var NAMED_ENTITIES = {
   amp: "&",
   lt: "<",
@@ -15914,7 +16069,8 @@ async function dispatchSend(sendId, ctx) {
     publicUrl: ctx.config.publicUrl,
     trackOpens: template.trackOpens ?? ctx.config.trackOpens,
     trackClicks: template.trackClicks ?? ctx.config.trackClicks,
-    preserveUrls: [renderCtx.unsubscribeUrl]
+    preserveUrls: [renderCtx.unsubscribeUrl],
+    signingSecret: ctx.config.unsubscribeSecret
   });
   await ctx.collections.sends.updateOne(
     { _id: send._id },
@@ -15932,9 +16088,14 @@ async function dispatchSend(sendId, ctx) {
       }
     }
   );
-  const provider = ctx.providers[send.provider] ?? ctx.providers[ctx.config.defaultProvider];
+  const provider = resolveProvider(ctx.providers, send.provider);
   if (!provider) {
-    await markFailed(send._id, `provider_unknown: ${send.provider}`, ctx);
+    const known = registeredProviderNames(ctx.providers);
+    await markFailed(
+      send._id,
+      `provider_unknown: no provider is registered as "${send.provider}". Registered providers: ${known.length ? known.join(", ") : "(none)"}.`,
+      ctx
+    );
     return;
   }
   const headers = send.kind === "marketing" ? {
@@ -16133,7 +16294,7 @@ async function handleWait(run, step2, ctx) {
 }
 async function handleCondition(run, step2, contact, ctx) {
   if (!contact) return;
-  const result = await evaluatePredicate(step2.test, { contact, run, collections: ctx.collections });
+  const result = await evaluatePredicate(step2.test, { contact, run, collections: ctx.collections, botFilter: ctx.config.botFilter });
   if (result) {
     await advanceStep(run, ctx, { action: "condition_evaluated", details: { result: true } });
     return;
@@ -16146,7 +16307,7 @@ async function handleCondition(run, step2, contact, ctx) {
 }
 async function handleBranch(run, step2, contact, ctx) {
   if (!contact) return;
-  const result = await evaluatePredicate(step2.test, { contact, run, collections: ctx.collections });
+  const result = await evaluatePredicate(step2.test, { contact, run, collections: ctx.collections, botFilter: ctx.config.botFilter });
   const newPath = [...run.currentBranchPath, run.currentStepIndex, result ? "true" : "false", 0];
   const updated = await ctx.collections.flowRuns.findOneAndUpdate(
     { _id: run._id, currentStepIndex: run.currentStepIndex },
@@ -16917,14 +17078,14 @@ function createPostmasterClient(cfg, fetcher = globalThis.fetch) {
     };
     return cached.accessToken;
   }
-  async function authedGet(path) {
+  async function authedGet(path2) {
     const token = await getAccessToken();
-    const res = await fetchWithTimeout(fetcher, `${POSTMASTER_BASE}${path}`, {
+    const res = await fetchWithTimeout(fetcher, `${POSTMASTER_BASE}${path2}`, {
       method: "GET",
       headers: { authorization: `Bearer ${token}` }
     });
     if (!res.ok) {
-      throw new Error(`Postmaster GET ${path} failed: ${res.status} ${await safeText(res)}`);
+      throw new Error(`Postmaster GET ${path2} failed: ${res.status} ${await safeText(res)}`);
     }
     return await res.json();
   }
@@ -17302,6 +17463,250 @@ async function pruneDmarcFailures(ctx, opts = {}) {
   const r = await ctx.collections.dmarcFailures.deleteMany({ receivedAt: { $lt: cutoff } });
   return r.deletedCount ?? 0;
 }
+var DRAINING_INFIX = ".draining.";
+var ADOPT_AFTER_MS = 5 * 60 * 1e3;
+var JOURNAL_WARN_BYTES = 8 * 1024 * 1024;
+var O_NOFOLLOW = fs.constants.O_NOFOLLOW ?? 0;
+var APPEND_FLAGS = fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_APPEND | O_NOFOLLOW;
+function assertPrivateRegularFile(fd, journalPath) {
+  const st = fs.fstatSync(fd);
+  if (!st.isFile()) {
+    throw new Error(`pending-unsubscribe journal is not a regular file: ${journalPath}`);
+  }
+  if (st.nlink > 1) {
+    throw new Error(`pending-unsubscribe journal has ${st.nlink} hard links: ${journalPath}`);
+  }
+  if ((st.mode & 63) !== 0) fs.fchmodSync(fd, 384);
+}
+function serializeEntry(entry) {
+  return JSON.stringify(entry) + "\n";
+}
+function claimToken() {
+  return `${Date.now().toString(36)}-${randomBytes(6).toString("hex")}`;
+}
+function claimJournal(journalPath) {
+  const claimed = `${journalPath}${DRAINING_INFIX}${claimToken()}`;
+  try {
+    fs.renameSync(journalPath, claimed);
+  } catch (err) {
+    if (isMissing(err)) return null;
+    throw err;
+  }
+  markClaimActive(claimed);
+  return claimed;
+}
+function markClaimActive(claimPath) {
+  const now = /* @__PURE__ */ new Date();
+  try {
+    fs.utimesSync(claimPath, now, now);
+  } catch (err) {
+    if (!isMissing(err)) throw err;
+  }
+}
+function adoptAbandonedClaims(journalPath, opts = {}) {
+  const olderThanMs = opts.olderThanMs ?? ADOPT_AFTER_MS;
+  const now = opts.now ?? Date.now();
+  const dir = path.dirname(journalPath);
+  const prefix = path.basename(journalPath) + DRAINING_INFIX;
+  let names;
+  try {
+    names = fs.readdirSync(dir);
+  } catch (err) {
+    if (isMissing(err)) return [];
+    throw err;
+  }
+  const adopted = [];
+  for (const name of names) {
+    if (!name.startsWith(prefix)) continue;
+    const full = path.join(dir, name);
+    let st;
+    try {
+      st = fs.statSync(full);
+    } catch (err) {
+      if (isMissing(err)) continue;
+      throw err;
+    }
+    if (!st.isFile()) continue;
+    if (now - st.mtimeMs < olderThanMs) continue;
+    const mine = `${journalPath}${DRAINING_INFIX}${claimToken()}`;
+    try {
+      fs.renameSync(full, mine);
+      markClaimActive(mine);
+      adopted.push(mine);
+    } catch (err) {
+      if (!isMissing(err)) throw err;
+    }
+  }
+  return adopted;
+}
+function readClaim(claimPath) {
+  let raw;
+  try {
+    raw = fs.readFileSync(claimPath, "utf8");
+  } catch (err) {
+    if (isMissing(err)) return { entries: [], malformed: [], bytes: 0 };
+    throw err;
+  }
+  const entries = [];
+  const malformed = [];
+  const lines = raw.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.trim() === "") continue;
+    const parsed = parseEntry(line);
+    if (parsed) entries.push(parsed);
+    else malformed.push({ lineNumber: i + 1, preview: line.slice(0, 120) });
+  }
+  return { entries, malformed, bytes: Buffer.byteLength(raw) };
+}
+function parseEntry(line) {
+  let obj;
+  try {
+    obj = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  if (!obj || typeof obj !== "object" || Array.isArray(obj)) return null;
+  const o = obj;
+  const check = unsubscribeInputSchema.safeParse({
+    email: o.email,
+    scope: o.scope,
+    reason: "user_request",
+    source: "one-click"
+  });
+  if (!check.success) return null;
+  const at = typeof o.at === "number" && Number.isFinite(o.at) ? o.at : Date.now();
+  const attempts = typeof o.attempts === "number" && Number.isFinite(o.attempts) && o.attempts > 0 ? Math.floor(o.attempts) : void 0;
+  return {
+    email: check.data.email,
+    scope: check.data.scope,
+    at,
+    ...attempts === void 0 ? {} : { attempts }
+  };
+}
+function entryToInput(entry) {
+  return unsubscribeInputSchema.parse({
+    email: entry.email,
+    scope: entry.scope,
+    reason: "user_request",
+    // Distinguishable in `mailer_suppressions.source` from a live one-click,
+    // but only on rows the drain actually created (the upsert is
+    // `$setOnInsert`, so a row the live path already wrote keeps its own).
+    source: "one-click-drain"
+  });
+}
+function releaseClaim(journalPath, claimPath, remaining) {
+  if (remaining.length > 0) {
+    fs.mkdirSync(path.dirname(journalPath), { recursive: true, mode: 448 });
+    const fd = fs.openSync(journalPath, APPEND_FLAGS, 384);
+    try {
+      assertPrivateRegularFile(fd, journalPath);
+      fs.writeSync(
+        fd,
+        remaining.map((e) => serializeEntry({ ...e, attempts: (e.attempts ?? 0) + 1 })).join("")
+      );
+    } finally {
+      fs.closeSync(fd);
+    }
+  }
+  try {
+    fs.unlinkSync(claimPath);
+  } catch (err) {
+    if (!isMissing(err)) throw err;
+  }
+}
+function journalExists(journalPath) {
+  try {
+    return fs.statSync(journalPath).isFile();
+  } catch (err) {
+    if (isMissing(err)) return false;
+    throw err;
+  }
+}
+function isMissing(err) {
+  const code = err?.code;
+  return code === "ENOENT" || code === "ENOTDIR";
+}
+
+// src/server/runner/pending-unsubs.ts
+var MAX_ENTRIES_PER_PASS = 1e3;
+var NOISY_AFTER_ATTEMPTS = 10;
+var consoleLog = {
+  warn: (fields, msg) => console.warn(msg ?? "mailery", fields),
+  error: (fields, msg) => console.error(msg ?? "mailery", fields)
+};
+async function drainPendingUnsubscribes(ctx, opts = {}) {
+  const journalPath = opts.path ?? ctx.config.pendingUnsubsPath;
+  const result = {
+    enabled: Boolean(journalPath),
+    applied: 0,
+    deferred: 0,
+    malformed: 0,
+    batches: 0
+  };
+  if (!journalPath) return result;
+  const log = opts.log ?? consoleLog;
+  const budget = opts.maxEntries ?? MAX_ENTRIES_PER_PASS;
+  const claims = [];
+  try {
+    claims.push(...adoptAbandonedClaims(journalPath));
+  } catch (err) {
+    log.error?.({ err, path: journalPath }, "mailery: pending-unsub claim adoption failed");
+  }
+  if (journalExists(journalPath)) {
+    const claimed = claimJournal(journalPath);
+    if (claimed) claims.push(claimed);
+  }
+  if (claims.length === 0) return result;
+  let remainingBudget = budget;
+  for (const claimPath of claims) {
+    result.batches++;
+    const batch = readClaim(claimPath);
+    if (batch.bytes > JOURNAL_WARN_BYTES) {
+      log.warn?.(
+        { path: claimPath, bytes: batch.bytes, entries: batch.entries.length },
+        "mailery: pending-unsubscribe journal is large \u2014 Mongo has been unreachable for a while"
+      );
+    }
+    for (const bad of batch.malformed) {
+      result.malformed++;
+      log.warn?.(
+        { path: claimPath, lineNumber: bad.lineNumber, preview: bad.preview },
+        "mailery: pending-unsubscribe journal line unusable \u2014 skipped"
+      );
+    }
+    const deferred = [];
+    let stop = false;
+    for (let i = 0; i < batch.entries.length; i++) {
+      const entry = batch.entries[i];
+      if (stop || remainingBudget <= 0) {
+        deferred.push(entry);
+        continue;
+      }
+      try {
+        await applyUnsubscribe(ctx.collections, entryToInput(entry));
+        result.applied++;
+        remainingBudget--;
+      } catch (err) {
+        stop = true;
+        deferred.push(entry);
+        const attempts = (entry.attempts ?? 0) + 1;
+        const fields = { err, path: claimPath, attempts, pending: batch.entries.length - i };
+        if (attempts >= NOISY_AFTER_ATTEMPTS) {
+          log.error?.(
+            fields,
+            "mailery: pending unsubscribe still not applied after repeated attempts \u2014 investigate"
+          );
+        } else {
+          log.warn?.(fields, "mailery: pending-unsubscribe replay failed \u2014 deferred to next tick");
+        }
+      }
+    }
+    result.deferred += deferred.length;
+    releaseClaim(journalPath, claimPath, deferred);
+  }
+  return result;
+}
 
 // src/server/runner/tick.ts
 var STRANDED_SEND_THRESHOLD_MS = 5 * 60 * 1e3;
@@ -17343,6 +17748,9 @@ async function runTick(ctx) {
   await drainOutbox(ctx).catch((err) => {
     console.error("mailery: outbox drain failed", err);
   });
+  await drainPendingUnsubscribes(ctx).catch((err) => {
+    console.error("mailery: pending-unsubscribe drain failed", err);
+  });
   await processScheduledBroadcasts2(ctx).catch((err) => {
     console.error("mailery: broadcast dispatch failed", err);
   });
@@ -17475,6 +17883,10 @@ var Mailer = class _Mailer {
    *   MAILER_FROM_NAME / MAILER_FROM_EMAIL
    *   MAILER_DEFAULT_PROVIDER           — defaults to 'sendgrid' if SENDGRID_API_KEY is set
    *   MAILER_SENDGRID_API_KEY / MAILER_SENDGRID_WEBHOOK_KEY
+   *   MAILER_SENDGRID_WEBHOOK_TOLERANCE — signed-webhook replay window, seconds
+   *                                       (default 300; '0' disables the check).
+   *                                       Unparseable values fall back to the
+   *                                       default rather than disabling it.
    *   MAILER_HOST_USERS_COLLECTION (default 'users')
    *   MAILER_HOST_USERS_EMAIL_FIELD (default 'email')
    *   MAILER_HOST_USERS_ID_FIELD (default '_id')
@@ -17509,6 +17921,10 @@ var Mailer = class _Mailer {
       providers.sendgrid = new SendGridProvider2({
         apiKey: env.MAILER_SENDGRID_API_KEY,
         webhookVerificationKey: env.MAILER_SENDGRID_WEBHOOK_KEY,
+        // Left undefined when unset/blank so the provider default (300s) applies.
+        // resolveWebhookToleranceSeconds() rejects NaN back to the default, so a
+        // typo here can never silently switch the replay check off.
+        webhookToleranceSeconds: env.MAILER_SENDGRID_WEBHOOK_TOLERANCE ? Number(env.MAILER_SENDGRID_WEBHOOK_TOLERANCE) : void 0,
         sandbox: env.NODE_ENV !== "production"
       });
     }
@@ -17536,8 +17952,15 @@ var Mailer = class _Mailer {
   }
   static async init(input) {
     const config = resolveConfig(input);
-    if (!config.providers[config.defaultProvider]) {
-      throw new Error(`defaultProvider "${config.defaultProvider}" not in providers map`);
+    if (!resolveProvider(config.providers, config.defaultProvider)) {
+      throw new Error(
+        `defaultProvider "${config.defaultProvider}" is not a registered provider. Registered: ${registeredProviderNames(config.providers).join(", ") || "(none)"}`
+      );
+    }
+    if (config.defaultTransactionalProvider != null && !resolveProvider(config.providers, config.defaultTransactionalProvider)) {
+      throw new Error(
+        `defaultTransactionalProvider "${config.defaultTransactionalProvider}" is not a registered provider. Registered: ${registeredProviderNames(config.providers).join(", ") || "(none)"}`
+      );
     }
     if (config.varsAdapter) {
       const { assertNoReservedVarKeys: assertNoReservedVarKeys2 } = await Promise.resolve().then(() => (init_vars(), vars_exports));
@@ -17679,38 +18102,14 @@ var Mailer = class _Mailer {
       }
     }
   }
+  /**
+   * The writes live in `server/unsubscribe.ts` so the pending-unsubscribe
+   * drain (INVARIANT 8) replays a journaled opt-out through exactly this path
+   * without holding a `Mailer` instance.
+   */
   async unsubscribe(email, opts) {
     const parsed = unsubscribeInputSchema.parse({ email, ...opts });
-    const normalized = parsed.email;
-    const now = /* @__PURE__ */ new Date();
-    await this.collections.suppressions.updateOne(
-      { email: normalized, scope: parsed.scope },
-      {
-        $setOnInsert: {
-          email: normalized,
-          emailHash: sha256Hex(normalized),
-          scope: parsed.scope,
-          // mailer_suppressions canonical reason — see plans/02-data-model.md.
-          reason: "unsubscribed",
-          source: parsed.source,
-          notes: parsed.notes ?? null,
-          addedAt: now,
-          expiresAt: null
-        }
-      },
-      { upsert: true }
-    );
-    await this.collections.subscriptions.updateOne(
-      { emailAtSubscribe: normalized },
-      {
-        $set: {
-          status: "unsubscribed",
-          unsubscribedAt: now,
-          unsubscribeReason: parsed.reason,
-          updatedAt: now
-        }
-      }
-    );
+    await applyUnsubscribe(this.collections, parsed);
   }
   async suppress(email, opts) {
     const parsed = suppressInputSchema.parse({ email, ...opts });
@@ -18315,7 +18714,7 @@ async function createTestMailer(opts = {}) {
   const db = client.db("mailery-test");
   const memoryAdapter = opts.adapter ? null : new MemoryContactAdapter(opts.seedContacts ?? []);
   const adapter = opts.adapter ?? memoryAdapter;
-  const provider = new RecordingProvider(await resolveProvider(opts.provider ?? "null"));
+  const provider = new RecordingProvider(await resolveProvider2(opts.provider ?? "null"));
   const mailer = await Mailer.init({
     db,
     adapter,
@@ -18377,7 +18776,7 @@ async function createTestMailer(opts = {}) {
   };
   return harness;
 }
-async function resolveProvider(spec) {
+async function resolveProvider2(spec) {
   if (typeof spec !== "string") return spec;
   if (spec === "null") return new NullProvider();
   const apiKey = process.env.SENDGRID_API_KEY;