mailery 0.14.0 → 0.15.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { ObjectId } from 'mongodb';
-import crypto2 from 'crypto';
+import crypto2, { randomBytes, createHash, timingSafeEqual } from 'crypto';
 import sgMail from '@sendgrid/mail';
 import IORedis from 'ioredis';
 import Handlebars from 'handlebars';
@@ -9,22 +9,22 @@ import mjml2html from 'mjml';
 import dns from 'dns/promises';
 import net from 'net';
 import psl from 'psl';
+import { XMLParser } from 'fast-xml-parser';
+import fs from 'fs';
+import path from 'path';
 import express, { Router } from 'express';
 import multer from 'multer';
-import path from 'path';
 import { fileURLToPath } from 'url';
-import fs from 'fs';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -240,6 +240,31 @@ var init_mongo = __esm({
   }
 });
 
+// src/server/providers/webhook-tolerance.ts
+function resolveWebhookToleranceSeconds(option) {
+  if (option === false || option === 0) return 0;
+  if (option === void 0 || option === null) return DEFAULT_WEBHOOK_TOLERANCE_SECONDS;
+  if (typeof option !== "number" || !Number.isFinite(option) || option < 0) {
+    return DEFAULT_WEBHOOK_TOLERANCE_SECONDS;
+  }
+  return option;
+}
+function isWebhookTimestampFresh(rawTimestamp, toleranceSeconds, now = /* @__PURE__ */ new Date()) {
+  if (toleranceSeconds === 0) return true;
+  if (!rawTimestamp) return false;
+  if (!/^\d{1,15}$/.test(rawTimestamp)) return false;
+  const timestampMs = Number(rawTimestamp) * 1e3;
+  if (!Number.isFinite(timestampMs)) return false;
+  const deltaMs = Math.abs(now.getTime() - timestampMs);
+  return deltaMs <= toleranceSeconds * 1e3;
+}
+var DEFAULT_WEBHOOK_TOLERANCE_SECONDS;
+var init_webhook_tolerance = __esm({
+  "src/server/providers/webhook-tolerance.ts"() {
+    DEFAULT_WEBHOOK_TOLERANCE_SECONDS = 300;
+  }
+});
+
 // src/server/providers/sendgrid.ts
 var sendgrid_exports = {};
 __export(sendgrid_exports, {
@@ -286,6 +311,7 @@ function mapEventType(sgEvent) {
 var SG_SIG_HEADER, SG_TS_HEADER, SendGridProvider;
 var init_sendgrid = __esm({
   "src/server/providers/sendgrid.ts"() {
+    init_webhook_tolerance();
     SG_SIG_HEADER = "x-twilio-email-event-webhook-signature";
     SG_TS_HEADER = "x-twilio-email-event-webhook-timestamp";
     SendGridProvider = class {
@@ -293,10 +319,13 @@ var init_sendgrid = __esm({
         this.opts = opts;
         sgMail.setApiKey(opts.apiKey);
         this.sendRatePerSecond = opts.sendRatePerSecond ?? 10;
+        this.webhookToleranceSeconds = resolveWebhookToleranceSeconds(opts.webhookToleranceSeconds);
       }
       opts;
       name = "sendgrid";
       sendRatePerSecond;
+      /** Resolved replay window in seconds; `0` means the check is disabled. */
+      webhookToleranceSeconds;
       async send(args) {
         const msg = {
           to: args.to,
@@ -336,10 +365,11 @@ var init_sendgrid = __esm({
         try {
           const verifier = crypto2.createVerify("sha256");
           verifier.update(payload);
-          return verifier.verify(this.opts.webhookVerificationKey, sig, "base64");
+          if (!verifier.verify(this.opts.webhookVerificationKey, sig, "base64")) return false;
         } catch {
           return false;
         }
+        return isWebhookTimestampFresh(ts, this.webhookToleranceSeconds);
       }
       parseWebhookEvents(payload) {
         if (!Array.isArray(payload)) return [];
@@ -469,6 +499,10 @@ var flowStepSchema = z.lazy(
     }),
     z.object({
       type: z.literal("webhook"),
+      // `url` is validated for shape only and is deliberately never templated —
+      // see the comment on handleWebhookStep in src/server/runner/step.ts, and
+      // INVARIANT 16. Rendering contact/event data into this field would turn an
+      // admin-authored flow into a server-side request forgery primitive.
       url: z.string().url(),
       method: z.enum(["POST", "PUT"]).optional(),
       payload: z.record(z.string(), z.unknown()).optional(),
@@ -562,6 +596,7 @@ var DEFAULTS = {
   requireDoubleOptIn: false,
   unsubscribeTokenLifetimeDays: 90,
   transactionalRespectUnsubscribe: false,
+  unsubscribeWriteTimeoutMs: 5e3,
   doiTemplateSlug: "doi-confirmation",
   doiTokenLifetimeDays: 7,
   broadcastConfirmationThreshold: 1e3,
@@ -578,7 +613,9 @@ var DEFAULTS = {
   trackOpens: true,
   trackClicks: true,
   storeTrackingIp: false,
-  storeRenderedBody: false
+  storeRenderedBody: false,
+  requireSignedTrackingUrls: false,
+  trackingUrlLifetimeDays: 0
 };
 var CIRCUIT_BREAKER_DEFAULTS = {
   hardBounceRatePctTrip: 2,
@@ -595,6 +632,7 @@ function resolveConfig(c) {
     requireDoubleOptIn: c.requireDoubleOptIn ?? DEFAULTS.requireDoubleOptIn,
     unsubscribeTokenLifetimeDays: c.unsubscribeTokenLifetimeDays ?? DEFAULTS.unsubscribeTokenLifetimeDays,
     transactionalRespectUnsubscribe: c.transactionalRespectUnsubscribe ?? DEFAULTS.transactionalRespectUnsubscribe,
+    unsubscribeWriteTimeoutMs: c.unsubscribeWriteTimeoutMs ?? DEFAULTS.unsubscribeWriteTimeoutMs,
     doiTemplateSlug: c.doiTemplateSlug ?? DEFAULTS.doiTemplateSlug,
     doiTokenLifetimeDays: c.doiTokenLifetimeDays ?? DEFAULTS.doiTokenLifetimeDays,
     broadcastConfirmationThreshold: c.broadcastConfirmationThreshold ?? DEFAULTS.broadcastConfirmationThreshold,
@@ -612,6 +650,8 @@ function resolveConfig(c) {
     trackClicks: c.trackClicks ?? DEFAULTS.trackClicks,
     storeTrackingIp: c.storeTrackingIp ?? DEFAULTS.storeTrackingIp,
     storeRenderedBody: c.storeRenderedBody ?? DEFAULTS.storeRenderedBody,
+    requireSignedTrackingUrls: c.requireSignedTrackingUrls ?? DEFAULTS.requireSignedTrackingUrls,
+    trackingUrlLifetimeDays: c.trackingUrlLifetimeDays ?? DEFAULTS.trackingUrlLifetimeDays,
     circuitBreaker: { ...CIRCUIT_BREAKER_DEFAULTS, ...c.circuitBreaker ?? {} }
   };
 }
@@ -814,6 +854,22 @@ function isoDay(d) {
 function randomId() {
   return crypto2.randomBytes(8).toString("hex");
 }
+
+// src/server/provider-lookup.ts
+var PROVIDER_METHODS = ["send", "verifyWebhook", "parseWebhookEvents"];
+function isMailProvider(candidate) {
+  if (!candidate || typeof candidate !== "object") return false;
+  const p = candidate;
+  return PROVIDER_METHODS.every((m) => typeof p[m] === "function");
+}
+function resolveProvider(providers, name) {
+  if (typeof name !== "string" || !Object.hasOwn(providers, name)) return null;
+  const candidate = providers[name];
+  return isMailProvider(candidate) ? candidate : null;
+}
+function registeredProviderNames(providers) {
+  return Object.keys(providers).filter((name) => resolveProvider(providers, name) !== null).sort();
+}
 function signUnsubscribeToken(payload, secret) {
   const body = JSON.stringify({
     e: payload.email.toLowerCase(),
@@ -852,6 +908,28 @@ function verifyUnsubscribeToken(token, secret, now = /* @__PURE__ */ new Date())
     expiresAt: new Date(body.x)
   };
 }
+var TRACKING_SCOPES = ["open", "click"];
+var TRACKING_SIG_LENGTH = 12;
+function trackingMessage(scope, params) {
+  const tail = params.linkId === void 0 ? "" : `:${params.linkId}`;
+  return `mailery.track.v1:${scope}:${params.sendId}${tail}`;
+}
+function signTrackingToken(scope, params, secret) {
+  if (!TRACKING_SCOPES.includes(scope)) {
+    throw new Error(`signTrackingToken: unknown scope ${String(scope)}`);
+  }
+  const mac = crypto2.createHmac("sha256", secret).update(trackingMessage(scope, params)).digest();
+  return b64url(mac).slice(0, TRACKING_SIG_LENGTH);
+}
+function verifyTrackingToken(token, scope, params, secret) {
+  if (typeof token !== "string") return false;
+  if (!TRACKING_SCOPES.includes(scope)) return false;
+  if (token.length !== TRACKING_SIG_LENGTH) return false;
+  const expected = Buffer.from(signTrackingToken(scope, params, secret), "utf8");
+  const actual = Buffer.from(token, "utf8");
+  if (expected.length !== actual.length) return false;
+  return crypto2.timingSafeEqual(expected, actual);
+}
 function b64url(buf) {
   return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
@@ -895,6 +973,39 @@ function verifyDoiToken(token, secret, now = /* @__PURE__ */ new Date()) {
   if (body.x < now.getTime()) return null;
   return { externalId: body.i, expiresAt: new Date(body.x) };
 }
+
+// src/server/unsubscribe.ts
+async function applyUnsubscribe(collections, input, now = /* @__PURE__ */ new Date()) {
+  const normalized = input.email;
+  await collections.suppressions.updateOne(
+    { email: normalized, scope: input.scope },
+    {
+      $setOnInsert: {
+        email: normalized,
+        emailHash: sha256Hex(normalized),
+        scope: input.scope,
+        // mailer_suppressions canonical reason — see plans/02-data-model.md.
+        reason: "unsubscribed",
+        source: input.source,
+        notes: input.notes ?? null,
+        addedAt: now,
+        expiresAt: null
+      }
+    },
+    { upsert: true }
+  );
+  await collections.subscriptions.updateOne(
+    { emailAtSubscribe: normalized },
+    {
+      $set: {
+        status: "unsubscribed",
+        unsubscribedAt: now,
+        unsubscribeReason: input.reason,
+        updatedAt: now
+      }
+    }
+  );
+}
 var QUEUE_NAMES = {
   tick: "mailer-tick",
   advance: "mailer-advance",
@@ -1727,7 +1838,7 @@ async function suppressOnce(ctx, email, reason, scope) {
 }
 
 // src/server/runner/predicate.ts
-var BOT_UA_RE = /Mimecast|SafeLinks|proofpoint|HeadlessChrome|Googlebot|bingbot/i;
+var DEFAULT_BOT_UA_RE = /Mimecast|SafeLinks|proofpoint|HeadlessChrome|Googlebot|bingbot/i;
 async function evaluatePredicate(predicate, ctx) {
   const p = predicate;
   if ("hasTag" in p) return ctx.contact.tags.includes(p.hasTag);
@@ -1795,17 +1906,35 @@ async function openOrClickCount(ctx, kind, opts, excludeBots) {
     return await ctx.collections.sends.countDocuments(filter);
   }
   const docs = await ctx.collections.sends.find(filter).limit(1e3).toArray();
+  const botRe = ctx.botFilter?.userAgentPattern ?? DEFAULT_BOT_UA_RE;
+  const minOpenDelayMs = ctx.botFilter?.minOpenDelayMs ?? 0;
   let n = 0;
   for (const s of docs) {
-    if (kind === "opened") {
-      n++;
-      continue;
-    }
-    const hasHumanClick = s.clickedLinks?.some((c) => !c.userAgent || !BOT_UA_RE.test(c.userAgent));
-    if (hasHumanClick) n++;
+    const doc = s;
+    const human = kind === "opened" ? hasHumanOpen(doc, botRe, minOpenDelayMs) : (doc.clickedLinks ?? []).some((c) => !isBotUserAgent(c.userAgent, botRe));
+    if (human) n++;
   }
   return n;
 }
+function isBotUserAgent(ua, botRe) {
+  if (typeof ua !== "string" || ua.trim() === "") return false;
+  return botRe.test(ua);
+}
+function hasHumanOpen(send, botRe, minOpenDelayMs) {
+  const opens = send.opens && send.opens.length > 0 ? send.opens : send.openedAt ? [{ openedAt: send.openedAt, userAgent: null }] : [];
+  return opens.some((o) => {
+    if (isBotUserAgent(o.userAgent, botRe)) return false;
+    if (isPrefetchOpen(o.openedAt, send.queuedAt, minOpenDelayMs)) return false;
+    return true;
+  });
+}
+function isPrefetchOpen(openedAt, queuedAt, minOpenDelayMs) {
+  if (!minOpenDelayMs || minOpenDelayMs <= 0) return false;
+  if (!(openedAt instanceof Date) || !(queuedAt instanceof Date)) return false;
+  const delta = openedAt.getTime() - queuedAt.getTime();
+  if (!Number.isFinite(delta) || delta < 0) return false;
+  return delta < minOpenDelayMs;
+}
 function effectiveLowerBound(ctx, opts) {
   const now = ctx.now ?? /* @__PURE__ */ new Date();
   if (opts.sinceFlowStart) return ctx.run.enteredAt;
@@ -1971,12 +2100,14 @@ function applyTracking(html, opts) {
         seen.set(url, linkId);
         links.push({ linkId, url });
       }
-      const newHref = `${opts.publicUrl}/m/click/${opts.sendId}/${linkId}`;
+      const sig = opts.signingSecret ? `/${signTrackingToken("click", { sendId: opts.sendId, linkId }, opts.signingSecret)}` : "";
+      const newHref = `${opts.publicUrl}/m/click/${opts.sendId}/${linkId}${sig}`;
       return `<a${pre}href="${newHref}"${post}>`;
     });
   }
   if (opts.trackOpens) {
-    const pixel = `<img src="${opts.publicUrl}/m/open/${opts.sendId}.png" width="1" height="1" alt="" style="display:block;border:0" />`;
+    const sig = opts.signingSecret ? `.${signTrackingToken("open", { sendId: opts.sendId }, opts.signingSecret)}` : "";
+    const pixel = `<img src="${opts.publicUrl}/m/open/${opts.sendId}${sig}.png" width="1" height="1" alt="" style="display:block;border:0" />`;
     if (/<\/body>/i.test(out)) {
       out = out.replace(/<\/body>/i, `${pixel}</body>`);
     } else {
@@ -1987,14 +2118,22 @@ function applyTracking(html, opts) {
 }
 function shouldSkipClickRewrite(url, preserve, fullTag) {
   if (!url) return true;
-  if (url.startsWith("mailto:")) return true;
-  if (url.startsWith("tel:")) return true;
   if (url.startsWith("#")) return true;
   if (url.startsWith("{{") || url.startsWith("{")) return true;
   if (preserve.has(url.trim())) return true;
   if (/data-mailer-notrack=["']true["']/.test(fullTag)) return true;
+  if (!isHttpUrl(url)) return true;
   return false;
 }
+function isHttpUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url.trim());
+  } catch {
+    return false;
+  }
+  return parsed.protocol === "http:" || parsed.protocol === "https:";
+}
 var NAMED_ENTITIES = {
   amp: "&",
   lt: "<",
@@ -2215,7 +2354,8 @@ async function dispatchSend(sendId, ctx) {
     publicUrl: ctx.config.publicUrl,
     trackOpens: template.trackOpens ?? ctx.config.trackOpens,
     trackClicks: template.trackClicks ?? ctx.config.trackClicks,
-    preserveUrls: [renderCtx.unsubscribeUrl]
+    preserveUrls: [renderCtx.unsubscribeUrl],
+    signingSecret: ctx.config.unsubscribeSecret
   });
   await ctx.collections.sends.updateOne(
     { _id: send._id },
@@ -2233,9 +2373,14 @@ async function dispatchSend(sendId, ctx) {
       }
     }
   );
-  const provider = ctx.providers[send.provider] ?? ctx.providers[ctx.config.defaultProvider];
+  const provider = resolveProvider(ctx.providers, send.provider);
   if (!provider) {
-    await markFailed(send._id, `provider_unknown: ${send.provider}`, ctx);
+    const known = registeredProviderNames(ctx.providers);
+    await markFailed(
+      send._id,
+      `provider_unknown: no provider is registered as "${send.provider}". Registered providers: ${known.length ? known.join(", ") : "(none)"}.`,
+      ctx
+    );
     return;
   }
   const headers = send.kind === "marketing" ? {
@@ -2434,7 +2579,7 @@ async function handleWait(run, step, ctx) {
 }
 async function handleCondition(run, step, contact, ctx) {
   if (!contact) return;
-  const result = await evaluatePredicate(step.test, { contact, run, collections: ctx.collections });
+  const result = await evaluatePredicate(step.test, { contact, run, collections: ctx.collections, botFilter: ctx.config.botFilter });
   if (result) {
     await advanceStep(run, ctx, { action: "condition_evaluated", details: { result: true } });
     return;
@@ -2447,7 +2592,7 @@ async function handleCondition(run, step, contact, ctx) {
 }
 async function handleBranch(run, step, contact, ctx) {
   if (!contact) return;
-  const result = await evaluatePredicate(step.test, { contact, run, collections: ctx.collections });
+  const result = await evaluatePredicate(step.test, { contact, run, collections: ctx.collections, botFilter: ctx.config.botFilter });
   const newPath = [...run.currentBranchPath, run.currentStepIndex, result ? "true" : "false", 0];
   const updated = await ctx.collections.flowRuns.findOneAndUpdate(
     { _id: run._id, currentStepIndex: run.currentStepIndex },
@@ -3591,8 +3736,6 @@ function nthSundayOfMonth(year, month0, n) {
   const firstSunday = 1 + (7 - dayOfWeek) % 7;
   return firstSunday + (n - 1) * 7;
 }
-
-// src/server/runner/dmarc.ts
 var MAX_DECOMPRESSED_BYTES = 50 * 1024 * 1024;
 function assertSafeZipEntryName(rawName) {
   if (typeof rawName !== "string" || rawName.length === 0) {
@@ -3666,7 +3809,6 @@ async function extractDmarcXmls(buffer, filename) {
   return [buffer.toString("utf8")];
 }
 function parseDmarcReport(xml) {
-  const { XMLParser } = __require("fast-xml-parser");
   const parser = new XMLParser({
     ignoreAttributes: false,
     parseAttributeValue: false,
@@ -3757,7 +3899,7 @@ function toArray(v) {
   if (v === void 0 || v === null) return [];
   return Array.isArray(v) ? v : [v];
 }
-async function ingestDmarcAttachment(ctx, buffer, filename) {
+async function ingestDmarcAttachment(ctx, buffer, filename, opts = {}) {
   const xmls = await extractDmarcXmls(buffer, filename);
   if (xmls.length === 0) throw new Error("attachment contained no XML payload");
   const results = [];
@@ -3765,6 +3907,9 @@ async function ingestDmarcAttachment(ctx, buffer, filename) {
   for (const xml of xmls) {
     try {
       const parsed = parseDmarcReport(xml);
+      if (opts.allowDomain && !opts.allowDomain(parsed.report.domain)) {
+        throw new Error(`DMARC report is for domain "${parsed.report.domain}", which this deployment does not send from`);
+      }
       results.push(await ingestParsedDmarcReport(ctx, parsed));
     } catch (err) {
       if (!firstError) firstError = err;
@@ -3875,6 +4020,260 @@ function suggestPolicyProgression(input) {
   }
   return null;
 }
+var DRAINING_INFIX = ".draining.";
+var ADOPT_AFTER_MS = 5 * 60 * 1e3;
+var JOURNAL_WARN_BYTES = 8 * 1024 * 1024;
+var O_NOFOLLOW = fs.constants.O_NOFOLLOW ?? 0;
+var APPEND_FLAGS = fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_APPEND | O_NOFOLLOW;
+function appendPendingUnsub(journalPath, entry) {
+  fs.mkdirSync(path.dirname(journalPath), { recursive: true, mode: 448 });
+  const fd = fs.openSync(journalPath, APPEND_FLAGS, 384);
+  try {
+    assertPrivateRegularFile(fd, journalPath);
+    fs.writeSync(fd, serializeEntry(entry));
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+function assertPrivateRegularFile(fd, journalPath) {
+  const st = fs.fstatSync(fd);
+  if (!st.isFile()) {
+    throw new Error(`pending-unsubscribe journal is not a regular file: ${journalPath}`);
+  }
+  if (st.nlink > 1) {
+    throw new Error(`pending-unsubscribe journal has ${st.nlink} hard links: ${journalPath}`);
+  }
+  if ((st.mode & 63) !== 0) fs.fchmodSync(fd, 384);
+}
+function serializeEntry(entry) {
+  return JSON.stringify(entry) + "\n";
+}
+function claimToken() {
+  return `${Date.now().toString(36)}-${randomBytes(6).toString("hex")}`;
+}
+function claimJournal(journalPath) {
+  const claimed = `${journalPath}${DRAINING_INFIX}${claimToken()}`;
+  try {
+    fs.renameSync(journalPath, claimed);
+  } catch (err) {
+    if (isMissing(err)) return null;
+    throw err;
+  }
+  markClaimActive(claimed);
+  return claimed;
+}
+function markClaimActive(claimPath) {
+  const now = /* @__PURE__ */ new Date();
+  try {
+    fs.utimesSync(claimPath, now, now);
+  } catch (err) {
+    if (!isMissing(err)) throw err;
+  }
+}
+function adoptAbandonedClaims(journalPath, opts = {}) {
+  const olderThanMs = opts.olderThanMs ?? ADOPT_AFTER_MS;
+  const now = opts.now ?? Date.now();
+  const dir = path.dirname(journalPath);
+  const prefix = path.basename(journalPath) + DRAINING_INFIX;
+  let names;
+  try {
+    names = fs.readdirSync(dir);
+  } catch (err) {
+    if (isMissing(err)) return [];
+    throw err;
+  }
+  const adopted = [];
+  for (const name of names) {
+    if (!name.startsWith(prefix)) continue;
+    const full = path.join(dir, name);
+    let st;
+    try {
+      st = fs.statSync(full);
+    } catch (err) {
+      if (isMissing(err)) continue;
+      throw err;
+    }
+    if (!st.isFile()) continue;
+    if (now - st.mtimeMs < olderThanMs) continue;
+    const mine = `${journalPath}${DRAINING_INFIX}${claimToken()}`;
+    try {
+      fs.renameSync(full, mine);
+      markClaimActive(mine);
+      adopted.push(mine);
+    } catch (err) {
+      if (!isMissing(err)) throw err;
+    }
+  }
+  return adopted;
+}
+function readClaim(claimPath) {
+  let raw;
+  try {
+    raw = fs.readFileSync(claimPath, "utf8");
+  } catch (err) {
+    if (isMissing(err)) return { entries: [], malformed: [], bytes: 0 };
+    throw err;
+  }
+  const entries = [];
+  const malformed = [];
+  const lines = raw.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.trim() === "") continue;
+    const parsed = parseEntry(line);
+    if (parsed) entries.push(parsed);
+    else malformed.push({ lineNumber: i + 1, preview: line.slice(0, 120) });
+  }
+  return { entries, malformed, bytes: Buffer.byteLength(raw) };
+}
+function parseEntry(line) {
+  let obj;
+  try {
+    obj = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  if (!obj || typeof obj !== "object" || Array.isArray(obj)) return null;
+  const o = obj;
+  const check = unsubscribeInputSchema.safeParse({
+    email: o.email,
+    scope: o.scope,
+    reason: "user_request",
+    source: "one-click"
+  });
+  if (!check.success) return null;
+  const at = typeof o.at === "number" && Number.isFinite(o.at) ? o.at : Date.now();
+  const attempts = typeof o.attempts === "number" && Number.isFinite(o.attempts) && o.attempts > 0 ? Math.floor(o.attempts) : void 0;
+  return {
+    email: check.data.email,
+    scope: check.data.scope,
+    at,
+    ...attempts === void 0 ? {} : { attempts }
+  };
+}
+function entryToInput(entry) {
+  return unsubscribeInputSchema.parse({
+    email: entry.email,
+    scope: entry.scope,
+    reason: "user_request",
+    // Distinguishable in `mailer_suppressions.source` from a live one-click,
+    // but only on rows the drain actually created (the upsert is
+    // `$setOnInsert`, so a row the live path already wrote keeps its own).
+    source: "one-click-drain"
+  });
+}
+function releaseClaim(journalPath, claimPath, remaining) {
+  if (remaining.length > 0) {
+    fs.mkdirSync(path.dirname(journalPath), { recursive: true, mode: 448 });
+    const fd = fs.openSync(journalPath, APPEND_FLAGS, 384);
+    try {
+      assertPrivateRegularFile(fd, journalPath);
+      fs.writeSync(
+        fd,
+        remaining.map((e) => serializeEntry({ ...e, attempts: (e.attempts ?? 0) + 1 })).join("")
+      );
+    } finally {
+      fs.closeSync(fd);
+    }
+  }
+  try {
+    fs.unlinkSync(claimPath);
+  } catch (err) {
+    if (!isMissing(err)) throw err;
+  }
+}
+function journalExists(journalPath) {
+  try {
+    return fs.statSync(journalPath).isFile();
+  } catch (err) {
+    if (isMissing(err)) return false;
+    throw err;
+  }
+}
+function isMissing(err) {
+  const code = err?.code;
+  return code === "ENOENT" || code === "ENOTDIR";
+}
+
+// src/server/runner/pending-unsubs.ts
+var MAX_ENTRIES_PER_PASS = 1e3;
+var NOISY_AFTER_ATTEMPTS = 10;
+var consoleLog = {
+  warn: (fields, msg) => console.warn(msg ?? "mailery", fields),
+  error: (fields, msg) => console.error(msg ?? "mailery", fields)
+};
+async function drainPendingUnsubscribes(ctx, opts = {}) {
+  const journalPath = opts.path ?? ctx.config.pendingUnsubsPath;
+  const result = {
+    enabled: Boolean(journalPath),
+    applied: 0,
+    deferred: 0,
+    malformed: 0,
+    batches: 0
+  };
+  if (!journalPath) return result;
+  const log = opts.log ?? consoleLog;
+  const budget = opts.maxEntries ?? MAX_ENTRIES_PER_PASS;
+  const claims = [];
+  try {
+    claims.push(...adoptAbandonedClaims(journalPath));
+  } catch (err) {
+    log.error?.({ err, path: journalPath }, "mailery: pending-unsub claim adoption failed");
+  }
+  if (journalExists(journalPath)) {
+    const claimed = claimJournal(journalPath);
+    if (claimed) claims.push(claimed);
+  }
+  if (claims.length === 0) return result;
+  let remainingBudget = budget;
+  for (const claimPath of claims) {
+    result.batches++;
+    const batch = readClaim(claimPath);
+    if (batch.bytes > JOURNAL_WARN_BYTES) {
+      log.warn?.(
+        { path: claimPath, bytes: batch.bytes, entries: batch.entries.length },
+        "mailery: pending-unsubscribe journal is large \u2014 Mongo has been unreachable for a while"
+      );
+    }
+    for (const bad of batch.malformed) {
+      result.malformed++;
+      log.warn?.(
+        { path: claimPath, lineNumber: bad.lineNumber, preview: bad.preview },
+        "mailery: pending-unsubscribe journal line unusable \u2014 skipped"
+      );
+    }
+    const deferred = [];
+    let stop = false;
+    for (let i = 0; i < batch.entries.length; i++) {
+      const entry = batch.entries[i];
+      if (stop || remainingBudget <= 0) {
+        deferred.push(entry);
+        continue;
+      }
+      try {
+        await applyUnsubscribe(ctx.collections, entryToInput(entry));
+        result.applied++;
+        remainingBudget--;
+      } catch (err) {
+        stop = true;
+        deferred.push(entry);
+        const attempts = (entry.attempts ?? 0) + 1;
+        const fields = { err, path: claimPath, attempts, pending: batch.entries.length - i };
+        if (attempts >= NOISY_AFTER_ATTEMPTS) {
+          log.error?.(
+            fields,
+            "mailery: pending unsubscribe still not applied after repeated attempts \u2014 investigate"
+          );
+        } else {
+          log.warn?.(fields, "mailery: pending-unsubscribe replay failed \u2014 deferred to next tick");
+        }
+      }
+    }
+    result.deferred += deferred.length;
+    releaseClaim(journalPath, claimPath, deferred);
+  }
+  return result;
+}
 
 // src/server/runner/tick.ts
 var STRANDED_SEND_THRESHOLD_MS = 5 * 60 * 1e3;
@@ -3916,6 +4315,9 @@ async function runTick(ctx) {
   await drainOutbox(ctx).catch((err) => {
     console.error("mailery: outbox drain failed", err);
   });
+  await drainPendingUnsubscribes(ctx).catch((err) => {
+    console.error("mailery: pending-unsubscribe drain failed", err);
+  });
   await processScheduledBroadcasts2(ctx).catch((err) => {
     console.error("mailery: broadcast dispatch failed", err);
   });
@@ -4048,6 +4450,10 @@ var Mailer = class _Mailer {
    *   MAILER_FROM_NAME / MAILER_FROM_EMAIL
    *   MAILER_DEFAULT_PROVIDER           — defaults to 'sendgrid' if SENDGRID_API_KEY is set
    *   MAILER_SENDGRID_API_KEY / MAILER_SENDGRID_WEBHOOK_KEY
+   *   MAILER_SENDGRID_WEBHOOK_TOLERANCE — signed-webhook replay window, seconds
+   *                                       (default 300; '0' disables the check).
+   *                                       Unparseable values fall back to the
+   *                                       default rather than disabling it.
    *   MAILER_HOST_USERS_COLLECTION (default 'users')
    *   MAILER_HOST_USERS_EMAIL_FIELD (default 'email')
    *   MAILER_HOST_USERS_ID_FIELD (default '_id')
@@ -4082,6 +4488,10 @@ var Mailer = class _Mailer {
       providers.sendgrid = new SendGridProvider2({
         apiKey: env.MAILER_SENDGRID_API_KEY,
         webhookVerificationKey: env.MAILER_SENDGRID_WEBHOOK_KEY,
+        // Left undefined when unset/blank so the provider default (300s) applies.
+        // resolveWebhookToleranceSeconds() rejects NaN back to the default, so a
+        // typo here can never silently switch the replay check off.
+        webhookToleranceSeconds: env.MAILER_SENDGRID_WEBHOOK_TOLERANCE ? Number(env.MAILER_SENDGRID_WEBHOOK_TOLERANCE) : void 0,
         sandbox: env.NODE_ENV !== "production"
       });
     }
@@ -4109,8 +4519,15 @@ var Mailer = class _Mailer {
   }
   static async init(input) {
     const config = resolveConfig(input);
-    if (!config.providers[config.defaultProvider]) {
-      throw new Error(`defaultProvider "${config.defaultProvider}" not in providers map`);
+    if (!resolveProvider(config.providers, config.defaultProvider)) {
+      throw new Error(
+        `defaultProvider "${config.defaultProvider}" is not a registered provider. Registered: ${registeredProviderNames(config.providers).join(", ") || "(none)"}`
+      );
+    }
+    if (config.defaultTransactionalProvider != null && !resolveProvider(config.providers, config.defaultTransactionalProvider)) {
+      throw new Error(
+        `defaultTransactionalProvider "${config.defaultTransactionalProvider}" is not a registered provider. Registered: ${registeredProviderNames(config.providers).join(", ") || "(none)"}`
+      );
     }
     if (config.varsAdapter) {
       const { assertNoReservedVarKeys: assertNoReservedVarKeys2 } = await Promise.resolve().then(() => (init_vars(), vars_exports));
@@ -4252,38 +4669,14 @@ var Mailer = class _Mailer {
       }
     }
   }
+  /**
+   * The writes live in `server/unsubscribe.ts` so the pending-unsubscribe
+   * drain (INVARIANT 8) replays a journaled opt-out through exactly this path
+   * without holding a `Mailer` instance.
+   */
   async unsubscribe(email, opts) {
     const parsed = unsubscribeInputSchema.parse({ email, ...opts });
-    const normalized = parsed.email;
-    const now = /* @__PURE__ */ new Date();
-    await this.collections.suppressions.updateOne(
-      { email: normalized, scope: parsed.scope },
-      {
-        $setOnInsert: {
-          email: normalized,
-          emailHash: sha256Hex(normalized),
-          scope: parsed.scope,
-          // mailer_suppressions canonical reason — see plans/02-data-model.md.
-          reason: "unsubscribed",
-          source: parsed.source,
-          notes: parsed.notes ?? null,
-          addedAt: now,
-          expiresAt: null
-        }
-      },
-      { upsert: true }
-    );
-    await this.collections.subscriptions.updateOne(
-      { emailAtSubscribe: normalized },
-      {
-        $set: {
-          status: "unsubscribed",
-          unsubscribedAt: now,
-          unsubscribeReason: parsed.reason,
-          updatedAt: now
-        }
-      }
-    );
+    await applyUnsubscribe(this.collections, parsed);
   }
   async suppress(email, opts) {
     const parsed = suppressInputSchema.parse({ email, ...opts });
@@ -4619,8 +5012,20 @@ var NullProvider = class {
       status: "accepted"
     };
   }
+  /**
+   * Fails closed. This provider has no signing key, so it can never establish
+   * that an inbound payload is authentic — and a method whose entire job is to
+   * reject unauthenticated input must not answer "yes" by default. Returning
+   * `true` here would mean any unsigned body posted to the webhook route is
+   * accepted as genuine whenever the null provider is registered, which is
+   * exactly the dev/staging configuration where that is easiest to miss.
+   *
+   * Nothing is lost: `parseWebhookEvents()` returns `[]`, so there was never
+   * any inbound behaviour to preserve. To exercise the inbound half locally,
+   * use a provider that actually signs (see `test/README.md`).
+   */
   async verifyWebhook() {
-    return true;
+    return false;
   }
   parseWebhookEvents() {
     return [];
@@ -6762,11 +7167,11 @@ function apiRouter(mailer, opts = {}) {
       if (cached) {
         return res.json({ cached: true, status: "ready", score: cached });
       }
-      const { checkId, emailAddress } = await client.provisionCheck();
-      const provider = mailer.providers[tpl.providerOverride ?? mailer.config.defaultProvider];
+      const provider = resolveProvider(mailer.providers, tpl.providerOverride ?? mailer.config.defaultProvider);
       if (!provider) {
-        return res.status(500).json({ error: "provider_unknown", message: `default provider ${mailer.config.defaultProvider} is not registered` });
+        return res.status(400).json(unknownProviderError(mailer, tpl));
       }
+      const { checkId, emailAddress } = await client.provisionCheck();
       try {
         await provider.send({
           to: emailAddress,
@@ -7115,7 +7520,10 @@ function apiRouter(mailer, opts = {}) {
         trackOpens: false,
         trackClicks: false
       });
-      const provider = mailer.providers[tpl.providerOverride ?? mailer.config.defaultProvider];
+      const provider = resolveProvider(mailer.providers, tpl.providerOverride ?? mailer.config.defaultProvider);
+      if (!provider) {
+        return res.status(400).json(unknownProviderError(mailer, tpl));
+      }
       const result = await provider.send({
         to,
         fromName: rendered.fromName,
@@ -7267,6 +7675,18 @@ function asyncHandler(fn) {
     fn(req, res, next).catch(next);
   };
 }
+function unknownProviderError(mailer, tpl) {
+  const override = tpl.providerOverride ?? null;
+  const name = override ?? mailer.config.defaultProvider;
+  const known = registeredProviderNames(mailer.providers);
+  const source = override ? `template "${tpl.slug ?? "?"}" overrides the provider to "${name}"` : `the configured defaultProvider is "${name}"`;
+  return {
+    error: "provider_unknown",
+    message: `${source}, but no such provider is registered. Registered providers: ${known.length ? known.join(", ") : "(none)"}.`,
+    provider: name,
+    registeredProviders: known
+  };
+}
 async function collectQueueCounts(mailer) {
   const qs = Object.values(mailer.queues);
   const sum = async (key) => {
@@ -7402,13 +7822,227 @@ async function computeBroadcastStats(mailer, idFilter) {
   }
   return out;
 }
+
+// src/server/api/wrap.ts
+var consoleRouteLogger = {
+  error(fields, msg) {
+    console.error(msg ?? "mailery: request failed", fields);
+  },
+  warn(fields, msg) {
+    console.warn(msg ?? "mailery: request warning", fields);
+  },
+  info(fields, msg) {
+    console.info(msg ?? "mailery: request", fields);
+  }
+};
+function wrap(logger, handler) {
+  return async (req, res, next) => {
+    try {
+      await handler(req, res, next);
+    } catch (err) {
+      logger.error?.({ err, path: req.originalUrl }, "mailery: request failed");
+      if (res.headersSent) return;
+      res.status(500).json({ error: "internal_error" });
+    }
+  };
+}
+
+// src/server/api/dmarc-inbound.ts
+var ALLOWED_EXTENSIONS = [".zip", ".gz", ".xml"];
+var DEFAULT_PATH = "/inbound/dmarc";
+var DEFAULT_MAX_FILE_BYTES = 10 * 1024 * 1024;
+var DEFAULT_MAX_FILES = 10;
+function mountDmarcInbound(router, mailer, opts, logger) {
+  const secret = opts?.secret;
+  if (!opts || typeof secret !== "string" || secret.length === 0) return null;
+  const routePath = opts.path ?? DEFAULT_PATH;
+  const parseInbound = opts.parseInbound ?? sendgridInboundParser;
+  const allowedDomains = normalizeDomains(opts.allowedDomains ?? deriveSenderDomains(mailer));
+  if (allowedDomains.size === 0) {
+    logger.warn?.(
+      { path: routePath },
+      "mailery: DMARC inbound route mounted without a domain allowlist \u2014 set senderDomains (or dmarcInbound.allowedDomains) so a leaked secret cannot inject reports for arbitrary domains"
+    );
+  }
+  const upload = multer({
+    storage: multer.memoryStorage(),
+    limits: {
+      fileSize: opts.maxFileSizeBytes ?? DEFAULT_MAX_FILE_BYTES,
+      files: opts.maxFiles ?? DEFAULT_MAX_FILES,
+      // Inbound Parse sends the whole email as form fields (headers, text,
+      // html, ...). We read none of them, but they still have to be bounded.
+      fields: 40,
+      fieldSize: 1024 * 1024
+    }
+  });
+  router.post(
+    routePath,
+    wrap(logger, (req, res, next) => {
+      if (!isAuthorized(req, secret)) {
+        logger.warn?.(
+          { path: routePath, ip: req.ip },
+          "mailery: DMARC inbound request rejected \u2014 bad or missing shared secret"
+        );
+        res.status(401).json({ error: "unauthorized" });
+        return;
+      }
+      next();
+    }),
+    (req, res, next) => {
+      upload.any()(req, res, (err) => {
+        if (!err) return next();
+        const code = err?.code;
+        const status = code === "LIMIT_FILE_SIZE" || code === "LIMIT_FILE_COUNT" ? 413 : 400;
+        logger.warn?.({ err, path: routePath }, "mailery: DMARC inbound upload rejected");
+        res.status(status).json({ error: "upload_rejected", message: String(code ?? "malformed_multipart") });
+      });
+    },
+    wrap(logger, async (req, res) => {
+      let attachments;
+      try {
+        attachments = parseInbound(req);
+      } catch (err) {
+        logger.warn?.({ err, path: routePath }, "mailery: DMARC inbound payload unreadable");
+        return res.status(400).json({ error: "bad_payload" });
+      }
+      const candidates = attachments.filter((a) => hasAllowedExtension(a.filename));
+      if (candidates.length === 0) {
+        logger.info?.(
+          { path: routePath, attachments: attachments.length },
+          "mailery: DMARC inbound message carried no report attachment \u2014 ignored"
+        );
+        return res.status(200).json({ ok: true, ingested: 0, ignored: attachments.length });
+      }
+      const ctx = mailer.getRunnerContext();
+      const allowDomain = allowedDomains.size === 0 ? void 0 : (d) => allowedDomains.has(d.toLowerCase());
+      const ingested = [];
+      const rejected = [];
+      for (const file of candidates) {
+        try {
+          const result = await ingestDmarcAttachment(ctx, file.buffer, file.filename, { allowDomain });
+          ingested.push({ reportId: result.reportId, domain: result.domain, duplicate: result.duplicate });
+        } catch (err) {
+          const message = String(err?.message ?? err);
+          rejected.push({ filename: file.filename, message });
+          logger.warn?.(
+            { path: routePath, filename: file.filename, err },
+            "mailery: DMARC inbound attachment rejected"
+          );
+        }
+      }
+      if (ingested.length === 0) {
+        return res.status(400).json({ error: "ingest_failed", rejected });
+      }
+      return res.status(200).json({ ok: true, ingested, rejected });
+    })
+  );
+  return routePath;
+}
+function isAuthorized(req, secret) {
+  const presented = extractPresentedSecret(req);
+  if (presented === null) return false;
+  return constantTimeEquals(presented, secret);
+}
+function extractPresentedSecret(req) {
+  const header = req.headers.authorization;
+  if (typeof header !== "string") return null;
+  const [scheme, ...rest] = header.split(" ");
+  const value = rest.join(" ").trim();
+  if (!scheme || value === "") return null;
+  switch (scheme.toLowerCase()) {
+    case "basic": {
+      let decoded;
+      try {
+        decoded = Buffer.from(value, "base64").toString("utf8");
+      } catch {
+        return null;
+      }
+      const sep = decoded.indexOf(":");
+      return sep === -1 ? null : decoded.slice(sep + 1);
+    }
+    case "bearer":
+      return value;
+    default:
+      return null;
+  }
+}
+function constantTimeEquals(a, b) {
+  const ha = createHash("sha256").update(a, "utf8").digest();
+  const hb = createHash("sha256").update(b, "utf8").digest();
+  return timingSafeEqual(ha, hb);
+}
+var sendgridInboundParser = (req) => {
+  const files = req.files;
+  if (!Array.isArray(files)) return [];
+  return files.filter((f) => Boolean(f) && Buffer.isBuffer(f.buffer)).map((f) => ({ filename: safeFilename(f.originalname), buffer: f.buffer }));
+};
+function safeFilename(raw) {
+  if (typeof raw !== "string") return "";
+  return raw.replace(/[\u0000-\u001f\u007f]/g, "").replace(/[\\/]/g, "_").slice(0, 255);
+}
+function hasAllowedExtension(filename) {
+  const lower = filename.toLowerCase();
+  return ALLOWED_EXTENSIONS.some((ext) => lower.endsWith(ext));
+}
+function normalizeDomains(domains) {
+  const out = /* @__PURE__ */ new Set();
+  for (const d of domains) {
+    if (typeof d !== "string") continue;
+    const trimmed = d.trim().toLowerCase().replace(/^\.+/, "");
+    if (trimmed) out.add(trimmed);
+  }
+  return out;
+}
+function deriveSenderDomains(mailer) {
+  const out = [];
+  const push = (domain) => {
+    if (!domain) return;
+    out.push(domain);
+    const labels = domain.split(".");
+    if (labels.length > 2) out.push(labels.slice(-2).join("."));
+  };
+  for (const domain of Object.keys(mailer.config.senderDomains ?? {})) push(domain.toLowerCase());
+  push(emailDomain(mailer.config.fromDefaults?.email));
+  push(emailDomain(mailer.config.transactionalFromDefaults?.email));
+  push(emailDomain(mailer.config.senderAddress));
+  return out;
+}
+function emailDomain(email) {
+  if (typeof email !== "string") return void 0;
+  const at = email.lastIndexOf("@");
+  if (at === -1) return void 0;
+  const domain = email.slice(at + 1).trim().toLowerCase();
+  return domain || void 0;
+}
+
+// src/server/api/public.ts
 var PIXEL = Buffer.from(
   "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=",
   "base64"
 );
 function createPublicRouter(mailer, opts = {}) {
   const router = Router();
-  const pendingUnsubsPath = opts.pendingUnsubsPath ?? "/tmp/mailery-pending-unsubs.jsonl";
+  const logger = opts.logger ?? consoleRouteLogger;
+  const pendingUnsubsPath = opts.pendingUnsubsPath ?? mailer.config.pendingUnsubsPath ?? null;
+  if (opts.pendingUnsubsPath && !mailer.config.pendingUnsubsPath) {
+    logger.warn?.(
+      { path: opts.pendingUnsubsPath },
+      "mailery: pendingUnsubsPath set on the public router but not in MailerConfig \u2014 the tick drain will not replay this journal"
+    );
+  }
+  if (!pendingUnsubsPath) {
+    logger.warn?.(
+      {},
+      "mailery: no pendingUnsubsPath configured \u2014 POST /unsub answers 503 when Mongo is unreachable instead of journaling the opt-out"
+    );
+  }
+  const dmarcInboundPath = mountDmarcInbound(router, mailer, opts.dmarcInbound, logger);
+  if (dmarcInboundPath) {
+    logger.info?.(
+      { path: dmarcInboundPath },
+      "mailery: DMARC inbound route mounted (shared-secret auth; SendGrid Inbound Parse does not sign payloads)"
+    );
+  }
   router.use(
     "/webhooks",
     express.json({
@@ -7419,42 +8053,96 @@ function createPublicRouter(mailer, opts = {}) {
     })
   );
   router.use("/unsub", express.urlencoded({ extended: false }));
-  router.get("/open/:sendId.png", async (req, res) => {
+  router.get("/open/:sendId.png", wrap(logger, async (req, res) => {
     res.setHeader("Content-Type", "image/png");
     res.setHeader("Content-Length", String(PIXEL.length));
     res.setHeader("Cache-Control", "no-store, no-cache, must-revalidate, max-age=0");
     res.status(200).end(PIXEL);
-    const id = req.params.sendId;
+    const parsed = splitOpenParam(req.params.sendId);
+    if (!parsed) return;
+    const { id, sig } = parsed;
     if (!ObjectId.isValid(id)) return;
     const sendId = new ObjectId(id);
+    const verdict = checkTrackingSignature({
+      scope: "open",
+      params: { sendId: id },
+      sig,
+      secret: mailer.config.unsubscribeSecret,
+      requireSigned: mailer.config.requireSignedTrackingUrls,
+      logger,
+      fields: { sendId: id }
+    });
+    if (verdict === "rejected") return;
     try {
-      const send = await mailer.collections.sends.findOne({ _id: sendId }, { projection: { openedAt: 1 } });
+      const send = await mailer.collections.sends.findOne(
+        { _id: sendId },
+        { projection: { openedAt: 1, queuedAt: 1 } }
+      );
       if (!send) return;
+      if (isTrackingExpired(send, mailer.config.trackingUrlLifetimeDays)) {
+        logger.warn?.({ sendId: id }, "mailery: open ignored \u2014 tracking URL past trackingUrlLifetimeDays");
+        return;
+      }
+      const now = /* @__PURE__ */ new Date();
       await mailer.collections.sends.updateOne(
         { _id: sendId },
         {
           $set: {
-            openedAt: send.openedAt ?? /* @__PURE__ */ new Date(),
+            openedAt: send.openedAt ?? now,
             status: "delivered"
           },
-          $inc: { openCount: 1 }
+          $inc: { openCount: 1 },
+          // Per-open user agent, so `hasOpenedExcludingBots` has a signal to
+          // filter on. Capped: an open pixel can be re-fetched indefinitely
+          // (every time the recipient re-opens the mail) and an unbounded
+          // array would eventually run the send document into the 16MB limit.
+          $push: {
+            opens: {
+              $each: [{ openedAt: now, userAgent: requestUserAgent(req) }],
+              $slice: -MAX_TRACKED_OPENS
+            }
+          }
         }
       );
     } catch (err) {
-      console.error("mailery: open pixel update failed", err);
+      logger.error?.({ err, sendId: id }, "mailery: open pixel update failed");
     }
-  });
-  router.get("/click/:sendId/:linkId", async (req, res) => {
-    const { sendId: sendIdStr, linkId } = req.params;
+  }));
+  router.get("/click/:sendId/:linkId{/:sig}", wrap(logger, async (req, res) => {
+    const { sendId: sendIdStr, linkId, sig } = req.params;
     if (!ObjectId.isValid(sendIdStr)) return res.status(400).end();
     const sendId = new ObjectId(sendIdStr);
+    const verdict = checkTrackingSignature({
+      scope: "click",
+      params: { sendId: sendIdStr, linkId },
+      sig,
+      secret: mailer.config.unsubscribeSecret,
+      requireSigned: mailer.config.requireSignedTrackingUrls,
+      logger,
+      fields: { sendId: sendIdStr, linkId }
+    });
+    if (verdict === "rejected") return res.status(404).end();
     const send = await mailer.collections.sends.findOne(
       { _id: sendId },
-      { projection: { links: 1, firstClickAt: 1 } }
+      { projection: { links: 1, firstClickAt: 1, queuedAt: 1 } }
     );
     if (!send) return res.status(404).end();
+    if (isTrackingExpired(send, mailer.config.trackingUrlLifetimeDays)) {
+      logger.warn?.(
+        { sendId: sendIdStr, linkId },
+        "mailery: click rejected \u2014 tracking URL past trackingUrlLifetimeDays"
+      );
+      return res.status(404).end();
+    }
     const link = (send.links ?? []).find((l) => l.linkId === linkId);
     if (!link) return res.status(404).end();
+    if (!isSafeRedirectTarget(link.url)) {
+      logger.warn?.(
+        { sendId: sendIdStr, linkId, url: link.url },
+        "mailery: click redirect blocked \u2014 disallowed URL scheme"
+      );
+      return res.status(400).type("html").send("<!doctype html><html><body><p>This link cannot be opened.</p></body></html>");
+    }
     res.redirect(302, link.url);
     try {
       await mailer.collections.sends.updateOne(
@@ -7466,16 +8154,19 @@ function createPublicRouter(mailer, opts = {}) {
             clickedLinks: {
               url: link.url,
               linkId,
-              clickedAt: /* @__PURE__ */ new Date()
+              clickedAt: /* @__PURE__ */ new Date(),
+              // The bot filter has always read `clickedLinks[].userAgent`; until
+              // now nothing ever wrote it, so every click scored as human.
+              userAgent: requestUserAgent(req)
             }
           }
         }
       );
     } catch (err) {
-      console.error("mailery: click recording failed", err);
+      logger.error?.({ err, sendId: sendIdStr, linkId }, "mailery: click recording failed");
     }
-  });
-  router.get("/unsub/:token", (req, res) => {
+  }));
+  router.get("/unsub/:token", wrap(logger, (req, res) => {
     const decoded = verifyUnsubscribeToken(req.params.token, mailer.config.unsubscribeSecret);
     if (!decoded) return sendUnsubError(res, "Invalid or expired link.");
     res.status(200).type("html").send(`<!doctype html>
@@ -7490,32 +8181,55 @@ function createPublicRouter(mailer, opts = {}) {
     <button type="submit">Unsubscribe</button>
   </form>
 </body></html>`);
-  });
-  router.post("/unsub/:token", async (req, res) => {
+  }));
+  router.post("/unsub/:token", wrap(logger, async (req, res) => {
     const decoded = verifyUnsubscribeToken(req.params.token, mailer.config.unsubscribeSecret);
     if (!decoded) {
       res.status(200).end();
       return;
     }
-    res.status(200).type("html").send("<!doctype html><html><body><p>You are unsubscribed.</p></body></html>");
+    const write = mailer.unsubscribe(decoded.email, {
+      scope: decoded.scope,
+      reason: "user_request",
+      source: "one-click"
+    });
+    let dbError = null;
     try {
-      await mailer.unsubscribe(decoded.email, {
-        scope: decoded.scope,
-        reason: "user_request",
-        source: "one-click"
-      });
+      await withTimeout(write, mailer.config.unsubscribeWriteTimeoutMs);
     } catch (err) {
+      dbError = err ?? new Error("unsubscribe write failed");
+      void write.catch(() => {
+      });
+    }
+    if (dbError) {
+      if (!pendingUnsubsPath) {
+        logger.error?.(
+          { err: dbError },
+          "mailery: unsubscribe write failed and no pendingUnsubsPath is configured \u2014 answering 503"
+        );
+        return sendUnsubUnavailable(res);
+      }
       try {
-        fs.appendFileSync(
-          pendingUnsubsPath,
-          JSON.stringify({ email: decoded.email, scope: decoded.scope, at: Date.now() }) + "\n"
+        appendPendingUnsub(pendingUnsubsPath, {
+          email: decoded.email,
+          scope: decoded.scope,
+          at: Date.now()
+        });
+        logger.warn?.(
+          { err: dbError, path: pendingUnsubsPath },
+          "mailery: unsubscribe journaled to disk \u2014 will be replayed by the tick drain"
         );
       } catch (diskErr) {
-        console.error("mailery: unsub disk fallback failed", { err, diskErr });
+        logger.error?.(
+          { err: dbError, diskErr, path: pendingUnsubsPath },
+          "mailery: unsub disk fallback failed \u2014 answering 503"
+        );
+        return sendUnsubUnavailable(res);
       }
     }
-  });
-  router.get("/confirm-doi/:token", async (req, res) => {
+    res.status(200).type("html").send("<!doctype html><html><body><p>You are unsubscribed.</p></body></html>");
+  }));
+  router.get("/confirm-doi/:token", wrap(logger, async (req, res) => {
     const token = req.params.token;
     const decoded = verifyDoiToken(token, mailer.config.unsubscribeSecret);
     if (!decoded) {
@@ -7543,10 +8257,10 @@ function createPublicRouter(mailer, opts = {}) {
     } catch {
     }
     return res.status(200).type("html").send("<!doctype html><html><body><p>Thanks \u2014 you're subscribed.</p></body></html>");
-  });
-  router.post("/webhooks/:provider", async (req, res) => {
+  }));
+  router.post("/webhooks/:provider", wrap(logger, async (req, res) => {
     const providerName = req.params.provider;
-    const provider = mailer.providers[providerName];
+    const provider = resolveProvider(mailer.providers, providerName);
     if (!provider) return res.status(404).end();
     const rawBody = req.rawBody;
     if (!rawBody) return res.status(400).end();
@@ -7577,7 +8291,10 @@ function createPublicRouter(mailer, opts = {}) {
           { upsert: true }
         );
       } catch (err) {
-        console.error("mailery: webhook dedupe insert failed", err);
+        logger.error?.(
+          { err, provider: providerName, providerEventId: evt.providerEventId },
+          "mailery: webhook dedupe insert failed"
+        );
       }
     }
     if (events.length > 0) {
@@ -7586,15 +8303,94 @@ function createPublicRouter(mailer, opts = {}) {
       } catch {
       }
     }
-  });
+  }));
   return router;
 }
+var MAX_TRACKED_OPENS = 50;
+var MAX_UA_LENGTH = 256;
+function requestUserAgent(req) {
+  const ua = req.headers["user-agent"];
+  if (typeof ua !== "string" || ua.trim() === "") return null;
+  return ua.slice(0, MAX_UA_LENGTH);
+}
+function splitOpenParam(raw) {
+  if (typeof raw !== "string") return null;
+  const parts = raw.split(".");
+  if (parts.length === 1) return { id: parts[0] };
+  if (parts.length === 2) return { id: parts[0], sig: parts[1] };
+  return null;
+}
+function checkTrackingSignature(args) {
+  const { sig, logger, fields, scope } = args;
+  if (sig === void 0 || sig === "") {
+    if (args.requireSigned) {
+      logger.warn?.(
+        { ...fields, scope },
+        "mailery: unsigned tracking URL rejected (requireSignedTrackingUrls)"
+      );
+      return "rejected";
+    }
+    logger.info?.(
+      { ...fields, scope },
+      "mailery: unsigned tracking URL accepted \u2014 legacy grace mode"
+    );
+    return "legacy";
+  }
+  if (!verifyTrackingToken(sig, scope, args.params, args.secret)) {
+    logger.warn?.({ ...fields, scope }, "mailery: tracking URL signature invalid");
+    return "rejected";
+  }
+  return "signed";
+}
+function isTrackingExpired(send, lifetimeDays, now = /* @__PURE__ */ new Date()) {
+  if (!lifetimeDays || lifetimeDays <= 0) return false;
+  const queuedAt = send.queuedAt;
+  if (!(queuedAt instanceof Date) || Number.isNaN(queuedAt.getTime())) return false;
+  return now.getTime() - queuedAt.getTime() > lifetimeDays * 24 * 60 * 60 * 1e3;
+}
 function sendUnsubError(res, msg) {
   return res.status(400).type("html").send(`<!doctype html><html><body><p>${escapeHtml(msg)}</p></body></html>`);
 }
+function sendUnsubUnavailable(res) {
+  return res.status(503).set("Retry-After", "60").type("html").send(
+    "<!doctype html><html><body><p>We could not record your unsubscribe right now, so you are <strong>not</strong> unsubscribed yet. Please try again in a minute.</p></body></html>"
+  );
+}
+function withTimeout(p, ms) {
+  if (!Number.isFinite(ms) || ms <= 0) return p;
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error(`timed out after ${ms}ms`));
+    }, ms);
+    if (typeof timer.unref === "function") timer.unref();
+    p.then(
+      (v) => {
+        clearTimeout(timer);
+        resolve(v);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err);
+      }
+    );
+  });
+}
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
+var ALLOWED_REDIRECT_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+function isSafeRedirectTarget(raw) {
+  if (typeof raw !== "string") return false;
+  const trimmed = raw.trim();
+  if (trimmed === "") return false;
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return false;
+  }
+  return ALLOWED_REDIRECT_PROTOCOLS.has(parsed.protocol);
+}
 function lowercaseHeaders(h) {
   const out = {};
   for (const k of Object.keys(h)) {
@@ -7763,8 +8559,8 @@ var DEDUPE_POLICIES = [
 ];
 
 // src/server/index.ts
-var VERSION = "0.14.0" ;
+var VERSION = "0.15.0" ;
 
-export { DEDUPE_POLICIES, FLOW_STEP_KINDS, Mailer, MongoContactAdapter, NullProvider, PREDICATE_KINDS, RESERVED_VAR_KEYS, SEGMENT_FILTER_KINDS, SendGridProvider, VERSION, applyTracking, applyWebhookEvent, compileMailyTemplate, compileTemplate, computeDeliveryTime, createAdminRouter, createPublicRouter, defaultFlowStep, defaultPredicate, defaultSegmentFilter, defineVars, derivePlaintext, dispatchSend, ensureIndexes, getCollections, predicateKind, processNewlyFiredEventTriggers, processOneRunStep, renderTemplate, runTick, sha256Hex, signUnsubscribeToken, sweepStrandedFlowRuns, validateSenderDomain, varsJsonSchema, verifyUnsubscribeToken };
+export { DEDUPE_POLICIES, DEFAULT_BOT_UA_RE, FLOW_STEP_KINDS, Mailer, MongoContactAdapter, NullProvider, PREDICATE_KINDS, RESERVED_VAR_KEYS, SEGMENT_FILTER_KINDS, SendGridProvider, TRACKING_SIG_LENGTH, VERSION, applyTracking, applyWebhookEvent, compileMailyTemplate, compileTemplate, computeDeliveryTime, createAdminRouter, createPublicRouter, defaultFlowStep, defaultPredicate, defaultSegmentFilter, defineVars, derivePlaintext, dispatchSend, drainPendingUnsubscribes, ensureIndexes, getCollections, predicateKind, processNewlyFiredEventTriggers, processOneRunStep, renderTemplate, runTick, sendgridInboundParser, sha256Hex, signTrackingToken, signUnsubscribeToken, sweepStrandedFlowRuns, validateSenderDomain, varsJsonSchema, verifyTrackingToken, verifyUnsubscribeToken };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map