mailery 0.16.6 → 0.16.8

package/dist/index.cjs

@@ -471,6 +471,15 @@ var unsubscribeInputSchema = zod.z.object({
   source: zod.z.string().max(256).default("manual"),
   notes: zod.z.string().max(1024).optional()
 });
+var resubscribeInputSchema = zod.z.object({
+  externalId: externalIdSchema,
+  /** `marketing` clears marketing + all-scope opt-outs; `all` clears every scope. */
+  scope: zod.z.enum(["marketing", "all"]).default("marketing"),
+  source: zod.z.string().min(1).max(256),
+  consentTimestamp: zod.z.date().optional(),
+  consentIp: zod.z.string().optional(),
+  consentUserAgent: zod.z.string().optional()
+});
 var suppressInputSchema = zod.z.object({
   email: emailSchema,
   scope: unsubscribeScopeSchema,
@@ -1032,6 +1041,15 @@ function verifyDoiToken(token, secret, now = /* @__PURE__ */ new Date()) {
 }
 
 // src/server/unsubscribe.ts
+async function clearUnsubscribeSuppressions(collections, email, scope) {
+  const scopes = scope === "all" ? ["all", "marketing", "transactional"] : ["marketing", "all"];
+  const result = await collections.suppressions.deleteMany({
+    email,
+    reason: "unsubscribed",
+    scope: { $in: scopes }
+  });
+  return result.deletedCount ?? 0;
+}
 async function applyUnsubscribe(collections, input, now = /* @__PURE__ */ new Date()) {
   const normalized = input.email;
   await collections.suppressions.updateOne(
@@ -4735,6 +4753,38 @@ var Mailer = class _Mailer {
       }
     }
   }
+  /**
+   * An explicit opt-in from a contact who unsubscribed before.
+   *
+   * `upsertSubscription` alone is not enough: an unsubscribe also writes a
+   * `mailer_suppressions` row, and the suppression check runs at enqueue
+   * time regardless of subscription status — so a contact re-subscribed
+   * through `upsertSubscription` reads as subscribed while every send comes
+   * back `suppressed`. This clears the opt-out rows (only those: a bounce or
+   * complaint is not the contact's to reverse), then upserts the subscription
+   * through the normal path, double opt-in included.
+   *
+   * Deliberately a separate method rather than a side effect of
+   * `upsertSubscription`, so a backfill or a model hook that re-upserts every
+   * account cannot silently resurrect addresses that opted out.
+   */
+  async resubscribe(input) {
+    const parsed = resubscribeInputSchema.parse(input);
+    const contact = await this.adapter.getById(parsed.externalId);
+    if (!contact) throw new Error(`adapter has no contact for externalId ${parsed.externalId}`);
+    const removedSuppressions = await clearUnsubscribeSuppressions(this.collections, contact.email, parsed.scope);
+    const { scope: _scope, ...subscription } = parsed;
+    await this.upsertSubscription(subscription);
+    if (removedSuppressions > 0) {
+      await this.audit({
+        actor: `host:${parsed.source}`,
+        action: "contact.resubscribe",
+        resource: { collection: "mailer_suppressions", id: parsed.externalId },
+        diffSummary: `${contact.email}: removed ${removedSuppressions} unsubscribed suppression${removedSuppressions === 1 ? "" : "s"} (${parsed.scope})`
+      });
+    }
+    return { removedSuppressions };
+  }
   /**
    * The writes live in `server/unsubscribe.ts` so the pending-unsubscribe
    * drain (INVARIANT 8) replays a journaled opt-out through exactly this path
@@ -5226,7 +5276,7 @@ ${input.plainText}`);
       });
     }
   }
-  const offDomain = findOffDomainLinkHosts(input.html, input.fromEmail);
+  const offDomain = findOffDomainLinkHosts(input.html, input.fromEmail, ownHosts(config));
   if (offDomain.majority && offDomain.hosts.length > 0) {
     issues.push({
       rule: "offdomain_links",
@@ -5311,12 +5361,23 @@ function hostnameOf(url) {
   }
 }
 function hasBareUrlInVisibleText(html) {
-  const stripped = html.replace(/<a\b[^>]*>.*?<\/a>/gis, " ").replace(/<style\b[^>]*>.*?<\/style>/gis, " ").replace(/<script\b[^>]*>.*?<\/script>/gis, " ").replace(/<head\b[^>]*>.*?<\/head>/gis, " ");
+  const stripped = html.replace(/<a\b[^>]*>.*?<\/a>/gis, " ").replace(/<style\b[^>]*>.*?<\/style>/gis, " ").replace(/<script\b[^>]*>.*?<\/script>/gis, " ").replace(/<head\b[^>]*>.*?<\/head>/gis, " ").replace(/<[^>]*>/g, " ");
   return /https?:\/\/[^\s<>"']+/i.test(stripped);
 }
-function findOffDomainLinkHosts(html, fromEmail) {
+function ownHosts(config) {
+  const hosts = [];
+  const publicHost = config.publicUrl ? hostnameOf(config.publicUrl) : null;
+  if (publicHost) hosts.push(publicHost);
+  for (const d of config.linkDomains ?? []) {
+    const host = hostnameOf(/^https?:\/\//i.test(d) ? d : `https://${d}`);
+    if (host) hosts.push(host);
+  }
+  return hosts;
+}
+function findOffDomainLinkHosts(html, fromEmail, extraOwnHosts = []) {
   const fromDomain = fromEmail.split("@")[1]?.toLowerCase();
   if (!fromDomain) return { hosts: [], majority: false };
+  const own = [fromDomain, ...extraOwnHosts.map((h) => h.toLowerCase())];
   const hosts = /* @__PURE__ */ new Set();
   let total = 0;
   let off = 0;
@@ -5325,7 +5386,7 @@ function findOffDomainLinkHosts(html, fromEmail) {
     const host = hostnameOf(href);
     if (!host) continue;
     total++;
-    if (sameSite(host, fromDomain)) continue;
+    if (own.some((o) => sameSite(host, o))) continue;
     off++;
     hosts.add(host);
   }
@@ -6389,9 +6450,30 @@ function createAdminApiRouter(mailer, opts = {}) {
       const seenNames = await c.events.distinct("name");
       const known = new Set(registered.map((r2) => r2.name));
       const unregistered = seenNames.filter((n) => n && !known.has(n));
+      const now = Date.now();
+      const d7 = new Date(now - 7 * 864e5);
+      const d30 = new Date(now - 30 * 864e5);
+      const rows = await c.events.aggregate([
+        {
+          $group: {
+            _id: "$name",
+            total: { $sum: 1 },
+            last7d: { $sum: { $cond: [{ $gte: ["$createdAt", d7] }, 1, 0] } },
+            last30d: { $sum: { $cond: [{ $gte: ["$createdAt", d30] }, 1, 0] } },
+            lastAt: { $max: "$createdAt" },
+            firstAt: { $min: "$createdAt" }
+          }
+        }
+      ]).toArray();
+      const stats = {};
+      for (const r2 of rows) {
+        if (!r2._id) continue;
+        stats[r2._id] = { total: r2.total, last7d: r2.last7d, last30d: r2.last30d, firstAt: r2.firstAt, lastAt: r2.lastAt };
+      }
       res.json({
         registered: registered.sort((a, b) => a.name.localeCompare(b.name)),
-        seen: unregistered.sort()
+        seen: unregistered.sort(),
+        stats
       });
     })
   );
@@ -7353,7 +7435,12 @@ function createAdminApiRouter(mailer, opts = {}) {
       if (!plainText && typeof tpl.body?.plainText === "string") plainText = tpl.body.plainText;
       const lint = lintTemplate(
         { subject, preheader, mjml, editorJson, html, plainText, kind, fromEmail },
-        { senderDomains: mailer.config.senderDomains, varsJsonSchema: varsSchema }
+        {
+          senderDomains: mailer.config.senderDomains,
+          varsJsonSchema: varsSchema,
+          publicUrl: mailer.config.publicUrl,
+          linkDomains: mailer.config.linkDomains
+        }
       );
       res.json({ ...lint, compileFailed: false });
     })
@@ -7404,7 +7491,12 @@ function createAdminApiRouter(mailer, opts = {}) {
           kind: tpl.kind,
           fromEmail: tpl.fromEmail
         },
-        { senderDomains: mailer.config.senderDomains, varsJsonSchema: varsSchema }
+        {
+          senderDomains: mailer.config.senderDomains,
+          varsJsonSchema: varsSchema,
+          publicUrl: mailer.config.publicUrl,
+          linkDomains: mailer.config.linkDomains
+        }
       );
       if (lint.errors.length > 0) {
         return res.status(422).json({
@@ -8271,7 +8363,7 @@ function unitToMs2(value, unit) {
 }
 
 // src/server/api/agent.ts
-var VERSION = "0.16.6" ;
+var VERSION = "0.16.8" ;
 var agentTagsInputSchema = zod.z.object({
   add: zod.z.array(zod.z.string().min(1).max(128)).max(25).default([]),
   remove: zod.z.array(zod.z.string().min(1).max(128)).max(25).default([])
@@ -8520,7 +8612,12 @@ function createAgentRouter(mailer, opts) {
           kind: input.kind,
           fromEmail: input.fromEmail
         },
-        { senderDomains: mailer.config.senderDomains, varsJsonSchema: varsSchema }
+        {
+          senderDomains: mailer.config.senderDomains,
+          varsJsonSchema: varsSchema,
+          publicUrl: mailer.config.publicUrl,
+          linkDomains: mailer.config.linkDomains
+        }
       );
       if (lint.errors.length > 0) {
         return res.status(422).json({
@@ -8851,15 +8948,15 @@ function createAgentRouter(mailer, opts) {
       const contact = await loadContact(res, String(req.params.externalId));
       if (!contact) return;
       if (!guardTestContact(res, contact)) return;
-      await mailer.upsertSubscription({ externalId: contact.externalId, source: "agent" });
+      const { removedSuppressions } = await mailer.resubscribe({ externalId: contact.externalId, source: "agent" });
       const sub = await c.subscriptions.findOne({ externalId: contact.externalId });
       await mailer.audit({
         actor: actorOf(req),
         action: "agent.contact.subscribe",
         resource: { collection: "mailer_subscriptions", id: sub?._id },
-        diffSummary: contact.email
+        diffSummary: `${contact.email} (removed ${removedSuppressions} opt-out suppression${removedSuppressions === 1 ? "" : "s"})`
       });
-      res.json({ subscription: sub });
+      res.json({ subscription: sub, removedSuppressions });
     })
   );
   router.post(
@@ -9184,7 +9281,12 @@ async function verifyTemplate(mailer, tpl, contact, opts = {}) {
       kind: tpl.kind,
       fromEmail: tpl.fromEmail
     },
-    { senderDomains: mailer.config.senderDomains, varsJsonSchema: opts.varsSchema ?? null }
+    {
+      senderDomains: mailer.config.senderDomains,
+      varsJsonSchema: opts.varsSchema ?? null,
+      publicUrl: mailer.config.publicUrl,
+      linkDomains: mailer.config.linkDomains
+    }
   );
   push("lint", lint.errors.length ? "fail" : lint.warnings.length ? "warn" : "pass", {
     errors: lint.errors.map((i) => ({ rule: i.rule, message: i.message })),
@@ -9430,7 +9532,7 @@ var ENDPOINTS = [
   { method: "GET", path: "/contacts/:externalId", summary: "Contact with subscription, suppressions, recent events, sends and runs." },
   { method: "GET", path: "/contacts/by-email/:email", summary: "Same, looked up by email." },
   { method: "GET", path: "/contacts/:externalId/unsubscribe-url", summary: "A signed one-click unsubscribe URL for a test contact, to exercise POST /m/unsub/:token.", testContactsOnly: true },
-  { method: "POST", path: "/contacts/:externalId/subscribe", summary: "Subscribe a test contact.", testContactsOnly: true },
+  { method: "POST", path: "/contacts/:externalId/subscribe", summary: "Subscribe a test contact, clearing any opt-out suppression it has (never bounce/complaint rows).", testContactsOnly: true },
   { method: "POST", path: "/contacts/:externalId/unsubscribe", summary: "Unsubscribe a test contact (marketing scope).", testContactsOnly: true },
   { method: "POST", path: "/contacts/:externalId/tags", summary: "Add or remove tags on a test contact ({add: [...], remove: [...]}), so a gated flow lets it through.", testContactsOnly: true },
   { method: "POST", path: "/contacts/:externalId/reset", summary: "Delete a test contact's runs, sends, events ({events: [names]} to narrow) and suppressions, then resubscribe. Each part can be turned off with false.", testContactsOnly: true },
@@ -10149,7 +10251,7 @@ var DEDUPE_POLICIES = [
 ];
 
 // src/server/index.ts
-var VERSION2 = "0.16.6" ;
+var VERSION2 = "0.16.8" ;
 
 exports.DEDUPE_POLICIES = DEDUPE_POLICIES;
 exports.DEFAULT_BOT_UA_RE = DEFAULT_BOT_UA_RE;