mailery 0.3.2 → 0.5.1

package/dist/index.js

@@ -6,13 +6,23 @@ import IORedis from 'ioredis';
 import Handlebars from 'handlebars';
 import { convert } from 'html-to-text';
 import mjml2html from 'mjml';
+import dns from 'dns/promises';
+import net from 'net';
+import psl from 'psl';
 import express, { Router } from 'express';
+import multer from 'multer';
 import path from 'path';
 import { fileURLToPath } from 'url';
 import fs from 'fs';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -447,6 +457,17 @@ var predicateSchema = z.lazy(
 );
 
 // src/server/config.ts
+var DEFAULT_DOMAIN_DNSBL_LISTS = [
+  { host: "dbl.spamhaus.org", label: "Spamhaus DBL" },
+  { host: "multi.surbl.org", label: "SURBL" },
+  { host: "multi.uribl.com", label: "URIBL" }
+];
+var DEFAULT_IP_DNSBL_LISTS = [
+  { host: "zen.spamhaus.org", label: "Spamhaus ZEN" },
+  { host: "b.barracudacentral.org", label: "Barracuda" },
+  { host: "dnsbl.sorbs.net", label: "SORBS" },
+  { host: "bl.spamcop.net", label: "SpamCop" }
+];
 var DEFAULTS = {
   collectionPrefix: "mailer_",
   requireDoubleOptIn: false,
@@ -507,6 +528,10 @@ function resolveConfig(c) {
 }
 
 // src/server/models/index.ts
+var HEALTH_AGG_ID = "agg";
+function healthBucketId(senderDomain, kind) {
+  return `d:${senderDomain ?? "_unknown"}|k:${kind}`;
+}
 function getCollections(db, prefix = "mailer_") {
   return {
     subscriptions: db.collection(`${prefix}subscriptions`),
@@ -524,7 +549,14 @@ function getCollections(db, prefix = "mailer_") {
     auditLog: db.collection(`${prefix}audit_log`),
     webhookEvents: db.collection(`${prefix}webhook_events`),
     health: db.collection(`${prefix}health`),
-    contactTags: db.collection(`${prefix}contact_tags`)
+    contactTags: db.collection(`${prefix}contact_tags`),
+    dnsblChecks: db.collection(`${prefix}dnsbl_checks`),
+    postmasterSnapshots: db.collection(`${prefix}postmaster_snapshots`),
+    sndsSnapshots: db.collection(`${prefix}snds_snapshots`),
+    dmarcReports: db.collection(`${prefix}dmarc_reports`),
+    dmarcFailures: db.collection(`${prefix}dmarc_failures`),
+    dmarcSourceTags: db.collection(`${prefix}dmarc_source_tags`),
+    mailTesterScores: db.collection(`${prefix}mail_tester_scores`)
   };
 }
 async function ensureIndexes(db, prefix = "mailer_") {
@@ -596,8 +628,58 @@ async function ensureIndexes(db, prefix = "mailer_") {
     c.contactTags.createIndexes([
       { key: { externalId: 1, tag: 1 }, unique: true },
       { key: { tag: 1 } }
+    ]),
+    c.health.createIndexes([
+      { key: { senderDomain: 1, kind: 1 } },
+      { key: { status: 1 } },
+      // setup-status reads the most-recently-touched health doc as a heartbeat.
+      { key: { updatedAt: -1 } }
+    ]),
+    c.dnsblChecks.createIndexes([
+      { key: { target: 1, list: 1 }, unique: true },
+      // Supports the admin /dnsbl GET sort: result asc, then target asc, list asc.
+      { key: { result: 1, target: 1, list: 1 } },
+      // TTL — stale rows for targets the operator removed disappear after
+      // 60 days without manual cleanup. The puller refreshes runAt on
+      // every active target so existing targets stay indefinitely.
+      { key: { runAt: 1 }, expireAfterSeconds: 60 * 24 * 60 * 60 }
+    ]),
+    c.postmasterSnapshots.createIndexes([
+      { key: { domain: 1, date: 1 }, unique: true },
+      { key: { domain: 1, fetchedAt: -1 } },
+      { key: { domainReputation: 1 } }
+    ]),
+    c.sndsSnapshots.createIndexes([
+      { key: { ip: 1, activityStart: 1 }, unique: true },
+      { key: { ip: 1, fetchedAt: -1 } },
+      { key: { filterResult: 1 } }
+    ]),
+    c.dmarcReports.createIndexes([
+      { key: { reportId: 1, orgName: 1 }, unique: true },
+      { key: { domain: 1, rangeEnd: -1 } },
+      // Cross-domain "most recent reports" queries scan a lot without this.
+      { key: { rangeEnd: -1 } },
+      { key: { receivedAt: -1 } }
+    ]),
+    c.dmarcFailures.createIndexes([
+      { key: { reportId: 1, sourceIp: 1 }, unique: true },
+      { key: { domain: 1, day: -1 } },
+      { key: { sourceIp: 1, day: -1 } },
+      { key: { receivedAt: 1 } }
+      // for retention pruning
+    ]),
+    c.dmarcSourceTags.createIndexes([
+      { key: { ip: 1 }, unique: true }
+    ]),
+    c.mailTesterScores.createIndexes([
+      { key: { contentKey: 1 }, unique: true },
+      { key: { templateSlug: 1, fetchedAt: -1 } },
+      // TTL — Mongo auto-deletes expired scores so we never serve stale data.
+      { key: { expiresAt: 1 }, expireAfterSeconds: 0 }
     ])
   ]);
+  await c.health.deleteOne({ _id: "singleton" }).catch(() => {
+  });
 }
 var EventRegistry = class {
   policies = /* @__PURE__ */ new Map();
@@ -610,6 +692,9 @@ var EventRegistry = class {
   policy(name) {
     return this.policies.get(name);
   }
+  list() {
+    return Array.from(this.policies, ([name, dedupePolicy]) => ({ name, dedupePolicy }));
+  }
   /**
    * Derive a dedupeKey for an event call. Returns null when no policy is
    * registered AND no key was passed — caller should throw.
@@ -1320,21 +1405,88 @@ async function isSuppressed(collections, email, kind) {
   return { suppressed: false };
 }
 
+// src/server/templates/sender-domain.ts
+function validateSenderDomain(fromEmail, templateKind, registry) {
+  if (!registry || Object.keys(registry).length === 0) return { ok: true };
+  const domain = extractDomain(fromEmail);
+  if (!domain) {
+    return {
+      ok: false,
+      code: "invalid_email",
+      reason: `invalid fromEmail "${fromEmail}" \u2014 expected "name@domain"`
+    };
+  }
+  const entry = registry[domain];
+  if (!entry) {
+    const known = Object.keys(registry).join(", ");
+    return {
+      ok: false,
+      code: "unregistered_domain",
+      reason: `sender domain "${domain}" is not declared in senderDomains (allowed: ${known})`
+    };
+  }
+  if (entry.kind === "both") return { ok: true };
+  if (entry.kind !== templateKind) {
+    return {
+      ok: false,
+      code: "wrong_kind",
+      reason: `sender domain "${domain}" is configured for ${entry.kind} email, but this template's kind is ${templateKind}`
+    };
+  }
+  return { ok: true };
+}
+function extractDomain(email) {
+  if (typeof email !== "string") return null;
+  const at = email.lastIndexOf("@");
+  if (at <= 0 || at === email.length - 1) return null;
+  return email.slice(at + 1).toLowerCase().trim();
+}
+
 // src/server/runner/health.ts
-async function recordHealthCounter(ctx, counter2, by = 1) {
+var ZERO_COUNTERS = {
+  sent: 0,
+  delivered: 0,
+  bounced: 0,
+  hardBounced: 0,
+  softBounced: 0,
+  complained: 0,
+  failedToSend: 0
+};
+var ZERO_RATES = {
+  bounceRate: 0,
+  hardBounceRate: 0,
+  complaintRate: 0,
+  failureRate: 0
+};
+async function recordHealthCounter(ctx, counter2, dims, by = 1) {
+  const windowMs = ctx.config.circuitBreaker.windowMinutes * 60 * 1e3;
+  const writes = [];
+  writes.push(upsertCounter(ctx, HEALTH_AGG_ID, null, null, counter2, by, windowMs));
+  if (dims) {
+    const domain = dims.fromEmail ? extractDomain(dims.fromEmail) : null;
+    if (domain) {
+      const id = healthBucketId(domain, dims.kind);
+      writes.push(upsertCounter(ctx, id, domain, dims.kind, counter2, by, windowMs));
+    }
+  }
+  await Promise.all(writes);
+}
+async function upsertCounter(ctx, _id, senderDomain, kind, counter2, by, windowMs) {
   await ctx.collections.health.updateOne(
-    { _id: "singleton" },
+    { _id },
     {
       $inc: { [`counters.${counter2}`]: by },
       $setOnInsert: {
-        _id: "singleton",
+        _id,
+        senderDomain,
+        kind,
         windowStartedAt: /* @__PURE__ */ new Date(),
-        windowDurationMs: ctx.config.circuitBreaker.windowMinutes * 60 * 1e3,
+        windowDurationMs: windowMs,
         status: "healthy",
         trippedAt: null,
         trippedReason: null,
         manuallyResumedAt: null,
-        rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 }
+        rates: { ...ZERO_RATES }
       },
       $set: { updatedAt: /* @__PURE__ */ new Date() }
     },
@@ -1344,73 +1496,116 @@ async function recordHealthCounter(ctx, counter2, by = 1) {
 async function evaluateHealth(ctx) {
   const cb = ctx.config.circuitBreaker;
   const windowMs = cb.windowMinutes * 60 * 1e3;
-  const doc = await ctx.collections.health.findOne({ _id: "singleton" });
-  if (!doc) return;
-  const windowAge = Date.now() - new Date(doc.windowStartedAt).getTime();
-  if (windowAge > windowMs && doc.status !== "tripped") {
-    await ctx.collections.health.updateOne(
-      { _id: "singleton" },
-      {
-        $set: {
-          windowStartedAt: /* @__PURE__ */ new Date(),
-          windowDurationMs: windowMs,
-          counters: { sent: 0, delivered: 0, bounced: 0, hardBounced: 0, softBounced: 0, complained: 0, failedToSend: 0 },
-          rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 },
-          updatedAt: /* @__PURE__ */ new Date()
+  const docs = await ctx.collections.health.find({}).toArray();
+  if (docs.length === 0) return;
+  const hasAgg = docs.some((d) => d._id === HEALTH_AGG_ID);
+  if (!hasAgg) {
+    await upsertCounter(ctx, HEALTH_AGG_ID, null, null, "sent", 0, windowMs);
+  }
+  for (const doc of docs) {
+    const isAgg = doc._id === HEALTH_AGG_ID;
+    const windowAge = Date.now() - new Date(doc.windowStartedAt).getTime();
+    if (windowAge > windowMs && doc.status !== "tripped") {
+      await ctx.collections.health.updateOne(
+        { _id: doc._id },
+        {
+          $set: {
+            windowStartedAt: /* @__PURE__ */ new Date(),
+            windowDurationMs: windowMs,
+            counters: { ...ZERO_COUNTERS },
+            rates: { ...ZERO_RATES },
+            status: "healthy",
+            updatedAt: /* @__PURE__ */ new Date()
+          }
         }
-      }
-    );
-    return;
-  }
-  const c = doc.counters;
-  const total = c.sent || 1;
-  const rates = {
-    bounceRate: c.bounced / total,
-    hardBounceRate: c.hardBounced / total,
-    complaintRate: c.complained / total,
-    failureRate: c.failedToSend / total
-  };
-  await ctx.collections.health.updateOne(
-    { _id: "singleton" },
-    { $set: { rates, updatedAt: /* @__PURE__ */ new Date() } }
-  );
-  if (c.sent < cb.minSendsBeforeEval) return;
-  if (doc.status === "tripped") return;
-  let trippedReason = null;
-  if (rates.hardBounceRate * 100 >= cb.hardBounceRatePctTrip) {
-    trippedReason = `hard bounce rate ${(rates.hardBounceRate * 100).toFixed(2)}% >= ${cb.hardBounceRatePctTrip}%`;
-  } else if (rates.complaintRate * 100 >= cb.complaintRatePctTrip) {
-    trippedReason = `complaint rate ${(rates.complaintRate * 100).toFixed(2)}% >= ${cb.complaintRatePctTrip}%`;
-  } else if (rates.bounceRate * 100 >= cb.combinedBounceRatePctTrip) {
-    trippedReason = `combined bounce rate ${(rates.bounceRate * 100).toFixed(2)}% >= ${cb.combinedBounceRatePctTrip}%`;
-  }
-  if (trippedReason) {
+      );
+      continue;
+    }
+    const c = doc.counters;
+    const total = c.sent || 1;
+    const rates = {
+      bounceRate: c.bounced / total,
+      hardBounceRate: c.hardBounced / total,
+      complaintRate: c.complained / total,
+      failureRate: c.failedToSend / total
+    };
     await ctx.collections.health.updateOne(
-      { _id: "singleton" },
-      { $set: { status: "tripped", trippedAt: /* @__PURE__ */ new Date(), trippedReason, updatedAt: /* @__PURE__ */ new Date() } }
+      { _id: doc._id },
+      { $set: { rates, updatedAt: /* @__PURE__ */ new Date() } }
     );
-    if (ctx.config.onCircuitBreakerTrip) {
-      try {
-        await ctx.config.onCircuitBreakerTrip({ reason: trippedReason, rates });
-      } catch {
+    if (isAgg) continue;
+    if (c.sent < cb.minSendsBeforeEval) continue;
+    if (doc.status === "tripped") continue;
+    let trippedReason = null;
+    if (rates.hardBounceRate * 100 >= cb.hardBounceRatePctTrip) {
+      trippedReason = `hard bounce rate ${(rates.hardBounceRate * 100).toFixed(2)}% >= ${cb.hardBounceRatePctTrip}%`;
+    } else if (rates.complaintRate * 100 >= cb.complaintRatePctTrip) {
+      trippedReason = `complaint rate ${(rates.complaintRate * 100).toFixed(2)}% >= ${cb.complaintRatePctTrip}%`;
+    } else if (rates.bounceRate * 100 >= cb.combinedBounceRatePctTrip) {
+      trippedReason = `combined bounce rate ${(rates.bounceRate * 100).toFixed(2)}% >= ${cb.combinedBounceRatePctTrip}%`;
+    }
+    if (trippedReason) {
+      const result = await ctx.collections.health.updateOne(
+        { _id: doc._id, status: { $in: ["healthy", "degraded"] } },
+        { $set: { status: "tripped", trippedAt: /* @__PURE__ */ new Date(), trippedReason, updatedAt: /* @__PURE__ */ new Date() } }
+      );
+      if (result.modifiedCount > 0) {
+        if (ctx.audit) {
+          try {
+            await ctx.audit({
+              actor: "system:circuit-breaker",
+              action: "health.trip",
+              resource: {
+                collection: "mailer_health",
+                id: String(doc._id),
+                slug: `${doc.senderDomain ?? "_unknown"}|${doc.kind}`
+              },
+              diffSummary: trippedReason
+            });
+          } catch {
+          }
+        }
+        if (ctx.config.onCircuitBreakerTrip) {
+          try {
+            await ctx.config.onCircuitBreakerTrip({
+              reason: `[${doc.senderDomain ?? "_unknown"} / ${doc.kind}] ${trippedReason}`,
+              rates
+            });
+          } catch {
+          }
+        }
       }
+      continue;
     }
-    return;
-  }
-  if (rates.failureRate * 100 >= cb.failedToSendRatePctDegrade) {
-    if (doc.status !== "degraded") {
+    if (rates.failureRate * 100 >= cb.failedToSendRatePctDegrade) {
+      if (doc.status !== "degraded") {
+        await ctx.collections.health.updateOne(
+          { _id: doc._id },
+          { $set: { status: "degraded", updatedAt: /* @__PURE__ */ new Date() } }
+        );
+      }
+    } else if (doc.status === "degraded") {
       await ctx.collections.health.updateOne(
-        { _id: "singleton" },
-        { $set: { status: "degraded", updatedAt: /* @__PURE__ */ new Date() } }
+        { _id: doc._id },
+        { $set: { status: "healthy", updatedAt: /* @__PURE__ */ new Date() } }
       );
     }
-  } else if (doc.status === "degraded") {
-    await ctx.collections.health.updateOne(
-      { _id: "singleton" },
-      { $set: { status: "healthy", updatedAt: /* @__PURE__ */ new Date() } }
-    );
   }
 }
+async function getBucketStatus(ctx, fromEmail, kind) {
+  const domain = fromEmail ? extractDomain(fromEmail) : null;
+  const id = healthBucketId(domain, kind);
+  return ctx.collections.health.findOne({ _id: id });
+}
+function effectiveOverallStatus(docs) {
+  const buckets = docs.filter((d) => typeof d._id === "string" && d._id.startsWith("d:"));
+  if (buckets.length === 0) {
+    return docs.length === 0 ? null : "healthy";
+  }
+  if (buckets.some((d) => d.status === "tripped")) return "tripped";
+  if (buckets.some((d) => d.status === "degraded")) return "degraded";
+  return "healthy";
+}
 
 // src/server/runner/send.ts
 async function handleSend(run, step, contact, flow, ctx) {
@@ -1494,8 +1689,8 @@ async function dispatchSend(sendId, ctx) {
     return;
   }
   if (send.kind === "marketing") {
-    const health = await ctx.collections.health.findOne({ _id: "singleton" });
-    if (health?.status === "tripped") {
+    const bucket = await getBucketStatus(ctx, send.fromEmail, send.kind);
+    if (bucket?.status === "tripped") {
       await ctx.queues.send.add("send", { sendId: String(send._id) }, { delay: 6e4 });
       return;
     }
@@ -1564,13 +1759,13 @@ async function dispatchSend(sendId, ctx) {
         }
       }
     );
-    await recordHealthCounter(ctx, "sent");
+    await recordHealthCounter(ctx, "sent", { fromEmail: send.fromEmail, kind: send.kind });
   } catch (err) {
     await ctx.collections.sends.updateOne(
       { _id: send._id },
       { $set: { status: "failed", errorMessage: String(err?.message ?? err) } }
     );
-    await recordHealthCounter(ctx, "failedToSend");
+    await recordHealthCounter(ctx, "failedToSend", { fromEmail: send.fromEmail, kind: send.kind });
     if (ctx.config.onSendFailure) {
       try {
         await ctx.config.onSendFailure({ send, error: err });
@@ -2154,7 +2349,15 @@ async function promoteSoftBounces(ctx) {
   const cutoff = new Date(Date.now() - windowDays * 864e5);
   const offenders = await ctx.collections.sends.aggregate([
     { $match: { status: "bounced", bounceType: "soft", queuedAt: { $gt: cutoff } } },
-    { $group: { _id: "$emailAtSend", count: { $sum: 1 } } },
+    { $sort: { queuedAt: 1 } },
+    {
+      $group: {
+        _id: "$emailAtSend",
+        count: { $sum: 1 },
+        lastFromEmail: { $last: "$fromEmail" },
+        lastKind: { $last: "$kind" }
+      }
+    },
     { $match: { count: { $gte: threshold } } },
     { $limit: 200 }
   ]).toArray();
@@ -2186,73 +2389,976 @@ async function promoteSoftBounces(ctx) {
       { emailAtSubscribe: email },
       { $set: { status: "bounced", updatedAt: /* @__PURE__ */ new Date() } }
     );
-    await recordHealthCounter(ctx, "hardBounced");
+    await recordHealthCounter(
+      ctx,
+      "hardBounced",
+      o.lastKind ? { fromEmail: o.lastFromEmail, kind: o.lastKind } : null
+    );
+  }
+}
+var REGISTRABLE_ONLY_LISTS = /* @__PURE__ */ new Set(["multi.surbl.org", "multi.uribl.com"]);
+var DNS_CONCURRENCY = 8;
+var defaultResolver = {
+  resolve4: (hostname) => dns.resolve4(hostname)
+};
+async function runDnsblChecks(ctx, opts = {}) {
+  const cfg = ctx.config.dnsbl ?? {};
+  const intervalHours = cfg.intervalHours ?? 24;
+  if (!opts.force && intervalHours <= 0) {
+    return { ran: false, reason: "disabled" };
+  }
+  const targets = collectTargets(ctx, cfg);
+  if (targets.domains.length === 0 && targets.ips.length === 0) {
+    return { ran: false, reason: "no_targets" };
+  }
+  const resolver = opts.resolver ?? defaultResolver;
+  const domainLists = cfg.domainLists ?? DEFAULT_DOMAIN_DNSBL_LISTS;
+  const ipLists = cfg.ipLists ?? DEFAULT_IP_DNSBL_LISTS;
+  const pairs = [];
+  for (const d of targets.domains) {
+    for (const l of domainLists) pairs.push({ target: d, targetKind: "domain", list: l });
+  }
+  for (const ip of targets.ips) {
+    for (const l of ipLists) pairs.push({ target: ip, targetKind: "ip", list: l });
+  }
+  const throttleCutoff = opts.force ? null : Date.now() - intervalHours * 60 * 60 * 1e3;
+  let duePairs = pairs;
+  if (throttleCutoff != null) {
+    const existing = await ctx.collections.dnsblChecks.find(
+      {
+        $or: pairs.map((p) => ({ target: p.target, list: p.list.host }))
+      },
+      { projection: { target: 1, list: 1, runAt: 1 } }
+    ).toArray();
+    const fresh = /* @__PURE__ */ new Set();
+    for (const e of existing) {
+      if (new Date(e.runAt).getTime() > throttleCutoff) {
+        fresh.add(`${e.target}|${e.list}`);
+      }
+    }
+    duePairs = pairs.filter((p) => !fresh.has(`${p.target}|${p.list.host}`));
+    if (duePairs.length === 0) {
+      return { ran: false, reason: "not_due", totalChecks: 0, listedCount: 0 };
+    }
+  }
+  let listedCount = 0;
+  async function processPair(p) {
+    const queryName = buildQueryName(p.target, p.targetKind, p.list.host);
+    const lookup = queryName ? await queryDnsbl(resolver, queryName) : { result: "error", returnCodes: [], errorMessage: "unsupported target format" };
+    if (lookup.transient) return;
+    if (lookup.result === "listed") listedCount++;
+    await ctx.collections.dnsblChecks.updateOne(
+      { target: p.target, list: p.list.host },
+      {
+        $set: {
+          target: p.target,
+          targetKind: p.targetKind,
+          list: p.list.host,
+          listLabel: p.list.label,
+          result: lookup.result,
+          returnCodes: lookup.returnCodes,
+          errorMessage: lookup.errorMessage,
+          runAt: /* @__PURE__ */ new Date()
+        }
+      },
+      { upsert: true }
+    );
+  }
+  let idx = 0;
+  await Promise.all(
+    Array.from({ length: Math.min(DNS_CONCURRENCY, duePairs.length) }, async () => {
+      while (idx < duePairs.length) {
+        const my = idx++;
+        await processPair(duePairs[my]);
+      }
+    })
+  );
+  return { ran: true, totalChecks: duePairs.length, listedCount };
+}
+function collectTargets(ctx, cfg) {
+  const domains = /* @__PURE__ */ new Set();
+  const registry = ctx.config.senderDomains;
+  if (registry) {
+    for (const d of Object.keys(registry)) domains.add(d.toLowerCase());
+  }
+  const fromDomain = ctx.config.fromDefaults?.email ? extractDomain(ctx.config.fromDefaults.email) : null;
+  if (fromDomain) domains.add(fromDomain);
+  const txnDomain = ctx.config.transactionalFromDefaults?.email ? extractDomain(ctx.config.transactionalFromDefaults.email) : null;
+  if (txnDomain) domains.add(txnDomain);
+  return {
+    domains: Array.from(domains),
+    ips: (cfg.dedicatedIps ?? []).filter((ip) => net.isIP(ip) !== 0)
+  };
+}
+function buildQueryName(target, kind, listHost) {
+  if (kind === "ip") {
+    const v = net.isIP(target);
+    if (v === 4) return `${reverseIPv4(target)}.${listHost}`;
+    if (v === 6) return `${reverseIPv6Nibbles(target)}.${listHost}`;
+    return null;
+  }
+  const domain = REGISTRABLE_ONLY_LISTS.has(listHost) ? registrableDomain(target) : target;
+  return `${domain}.${listHost}`;
+}
+var TRANSIENT_DNS_CODES = /* @__PURE__ */ new Set(["ESERVFAIL", "EREFUSED", "ETIMEOUT", "ETIMEDOUT", "ECONNRESET", "ECONNREFUSED"]);
+async function queryDnsbl(resolver, query) {
+  try {
+    const records = await resolver.resolve4(query);
+    return interpretRecords(records);
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOTFOUND" || code === "ENODATA") {
+      return { result: "clean", returnCodes: [], errorMessage: null };
+    }
+    if (code && TRANSIENT_DNS_CODES.has(code)) {
+      return {
+        transient: true,
+        result: "error",
+        returnCodes: [],
+        errorMessage: String(err?.message ?? err)
+      };
+    }
+    return {
+      result: "error",
+      returnCodes: [],
+      errorMessage: String(err?.message ?? err)
+    };
+  }
+}
+function interpretRecords(records) {
+  if (!records || records.length === 0) {
+    return { result: "clean", returnCodes: [], errorMessage: null };
+  }
+  const errorish = records.filter((r) => r.startsWith("127.255.255."));
+  if (errorish.length === records.length) {
+    return {
+      result: "error",
+      returnCodes: records,
+      errorMessage: `list returned reserved code(s): ${records.join(", ")}`
+    };
+  }
+  const listed = records.filter((r) => r.startsWith("127.") && !r.startsWith("127.255.255."));
+  if (listed.length > 0) {
+    return { result: "listed", returnCodes: records, errorMessage: null };
+  }
+  return { result: "clean", returnCodes: records, errorMessage: null };
+}
+function reverseIPv4(ip) {
+  return ip.split(".").reverse().join(".");
+}
+function reverseIPv6Nibbles(ip) {
+  const v4Match = /:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(ip);
+  let normalized = ip;
+  if (v4Match) {
+    const octets = v4Match[1].split(".").map((o) => Number(o));
+    if (octets.length === 4 && octets.every((o) => o >= 0 && o <= 255)) {
+      const hi = (octets[0] << 8 | octets[1]).toString(16).padStart(4, "0");
+      const lo = (octets[2] << 8 | octets[3]).toString(16).padStart(4, "0");
+      normalized = ip.slice(0, v4Match.index) + ":" + hi + ":" + lo;
+    }
   }
+  const sides = normalized.split("::");
+  let groups;
+  if (sides.length === 1) {
+    groups = sides[0].split(":");
+  } else {
+    const left = sides[0].split(":").filter(Boolean);
+    const right = sides[1].split(":").filter(Boolean);
+    const missing = 8 - left.length - right.length;
+    groups = [...left, ...Array(missing).fill("0"), ...right];
+  }
+  if (groups.length !== 8) {
+    throw new Error(`unexpected IPv6 group count for ${ip}: ${groups.length}`);
+  }
+  const padded = groups.map((g) => g.toLowerCase().padStart(4, "0")).join("");
+  return padded.split("").reverse().join(".");
+}
+function registrableDomain(domain) {
+  const parsed = psl.parse(domain);
+  if ("domain" in parsed && parsed.domain) return parsed.domain;
+  return domain;
 }
 
-// src/server/runner/tick.ts
-var STRANDED_SEND_THRESHOLD_MS = 5 * 60 * 1e3;
-async function runTick(ctx) {
+// src/server/runner/postmaster.ts
+var OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
+var POSTMASTER_BASE = "https://gmailpostmastertools.googleapis.com/v1";
+var FETCH_TIMEOUT_MS = 15e3;
+async function fetchWithTimeout(fetcher, url, init = {}, timeoutMs = FETCH_TIMEOUT_MS) {
+  const ctl = new AbortController();
+  const t = setTimeout(() => ctl.abort(), timeoutMs);
+  try {
+    return await fetcher(url, { ...init, signal: ctl.signal });
+  } finally {
+    clearTimeout(t);
+  }
+}
+function createPostmasterClient(cfg, fetcher = globalThis.fetch) {
+  let cached = null;
+  async function getAccessToken() {
+    if (cached && cached.expiresAt > Date.now() + 5 * 60 * 1e3) {
+      return cached.accessToken;
+    }
+    const body = new URLSearchParams({
+      client_id: cfg.clientId,
+      client_secret: cfg.clientSecret,
+      refresh_token: cfg.refreshToken,
+      grant_type: "refresh_token"
+    });
+    const res = await fetchWithTimeout(fetcher, OAUTH_TOKEN_URL, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+    if (!res.ok) {
+      throw new Error(`Postmaster OAuth token refresh failed: ${res.status} ${await safeText(res)}`);
+    }
+    const data = await res.json();
+    cached = {
+      accessToken: data.access_token,
+      expiresAt: Date.now() + data.expires_in * 1e3
+    };
+    return cached.accessToken;
+  }
+  async function authedGet(path3) {
+    const token = await getAccessToken();
+    const res = await fetchWithTimeout(fetcher, `${POSTMASTER_BASE}${path3}`, {
+      method: "GET",
+      headers: { authorization: `Bearer ${token}` }
+    });
+    if (!res.ok) {
+      throw new Error(`Postmaster GET ${path3} failed: ${res.status} ${await safeText(res)}`);
+    }
+    return await res.json();
+  }
+  return {
+    async listDomains() {
+      const data = await authedGet("/domains");
+      return data.domains ?? [];
+    },
+    async getLatestTrafficStats(domain) {
+      const data = await authedGet(
+        `/domains/${encodeURIComponent(domain)}/trafficStats?pageSize=1`
+      );
+      return data.trafficStats?.[0] ?? null;
+    }
+  };
+}
+async function safeText(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "<no body>";
+  }
+}
+async function runPostmasterPull(ctx, opts = {}) {
+  const cfg = ctx.config.postmaster;
+  if (!cfg) return { ran: false, reason: "not_configured" };
+  const intervalHours = cfg.intervalHours ?? 24;
+  if (!opts.force && intervalHours <= 0) {
+    return { ran: false, reason: "disabled" };
+  }
+  const client = opts.client ?? createPostmasterClient(cfg, opts.fetcher);
+  const allDomains = resolveDomains(ctx, cfg);
+  if (allDomains.length === 0) {
+    return { ran: false, reason: "no_domains" };
+  }
+  let domains = allDomains;
+  if (!opts.force) {
+    const cutoff = Date.now() - intervalHours * 60 * 60 * 1e3;
+    const latest = await ctx.collections.postmasterSnapshots.find({ domain: { $in: allDomains } }, { projection: { domain: 1, fetchedAt: 1 } }).sort({ fetchedAt: -1 }).limit(allDomains.length * 8).toArray();
+    const lastByDomain = /* @__PURE__ */ new Map();
+    for (const s of latest) {
+      const ts = new Date(s.fetchedAt).getTime();
+      const cur = lastByDomain.get(s.domain) ?? 0;
+      if (ts > cur) lastByDomain.set(s.domain, ts);
+    }
+    domains = allDomains.filter((d) => (lastByDomain.get(d) ?? 0) < cutoff);
+    if (domains.length === 0) {
+      return { ran: false, reason: "not_due" };
+    }
+  }
+  const fetches = await Promise.all(
+    domains.map(async (domain) => {
+      try {
+        const stat = await client.getLatestTrafficStats(domain);
+        return { domain, stat, error: null };
+      } catch (err) {
+        console.error(`mailery: postmaster fetch failed for ${domain}`, err);
+        return { domain, stat: null, error: err };
+      }
+    })
+  );
+  let fetched = 0;
+  const trippedDomains = [];
+  for (const { domain, stat } of fetches) {
+    if (!stat) continue;
+    const snapshot = toSnapshot(domain, stat);
+    if (!snapshot) continue;
+    fetched++;
+    await ctx.collections.postmasterSnapshots.updateOne(
+      { domain: snapshot.domain, date: snapshot.date },
+      { $set: snapshot },
+      { upsert: true }
+    );
+    if (snapshot.domainReputation === "BAD") {
+      const kindsToTrip = kindsForDomain(ctx, domain);
+      for (const kind of kindsToTrip) {
+        const tripped = await tripBucket(ctx, domain, kind, snapshot);
+        if (tripped) trippedDomains.push(`${domain}|${kind}`);
+      }
+    }
+  }
+  return { ran: true, fetched, trippedDomains };
+}
+function kindsForDomain(ctx, domain) {
+  const registry = ctx.config.senderDomains ?? {};
+  const entry = registry[domain.toLowerCase()];
+  if (!entry) return [];
+  if (entry.kind === "both") return ["marketing", "transactional"];
+  return [entry.kind];
+}
+function resolveDomains(ctx, cfg) {
+  if (cfg.domains && cfg.domains.length > 0) {
+    return cfg.domains.map((d) => d.toLowerCase());
+  }
+  const out = /* @__PURE__ */ new Set();
+  const registry = ctx.config.senderDomains;
+  if (registry) {
+    for (const d of Object.keys(registry)) out.add(d.toLowerCase());
+  }
+  const f = ctx.config.fromDefaults?.email ? extractDomain(ctx.config.fromDefaults.email) : null;
+  if (f) out.add(f);
+  const t = ctx.config.transactionalFromDefaults?.email ? extractDomain(ctx.config.transactionalFromDefaults.email) : null;
+  if (t) out.add(t);
+  return Array.from(out);
+}
+function toSnapshot(domain, stat) {
+  const m = /\/trafficStats\/(\d{8})$/.exec(stat.name ?? "");
+  if (!m) {
+    console.error(`mailery: postmaster snapshot for ${domain} has unrecognized name "${stat.name}" \u2014 skipping`);
+    return null;
+  }
+  const yyyymmdd = m[1];
+  const date = `${yyyymmdd.slice(0, 4)}-${yyyymmdd.slice(4, 6)}-${yyyymmdd.slice(6, 8)}`;
+  return {
+    domain,
+    date,
+    domainReputation: stat.domainReputation ?? null,
+    ipReputations: stat.ipReputations ? stat.ipReputations.map((r) => ({
+      reputation: r.reputation,
+      ipCount: typeof r.ipCount === "string" ? Number(r.ipCount) : r.ipCount
+    })) : null,
+    userReportedSpamRatio: stat.userReportedSpamRatio ?? null,
+    spfSuccessRatio: stat.spfSuccessRatio ?? null,
+    dkimSuccessRatio: stat.dkimSuccessRatio ?? null,
+    dmarcSuccessRatio: stat.dmarcSuccessRatio ?? null,
+    outboundEncryptionRatio: stat.outboundEncryptionRatio ?? null,
+    inboundEncryptionRatio: stat.inboundEncryptionRatio ?? null,
+    deliveryErrors: stat.deliveryErrors ?? null,
+    spammyFeedbackLoops: stat.spammyFeedbackLoops ?? null,
+    fetchedAt: /* @__PURE__ */ new Date()
+  };
+}
+async function tripBucket(ctx, domain, kind, snapshot) {
+  const id = healthBucketId(domain, kind);
+  const reason = `Postmaster Tools reports ${domain} reputation = BAD on ${snapshot.date}`;
+  const prior = await ctx.collections.health.findOne({ _id: id });
+  if (prior?.status === "tripped") {
+    return false;
+  }
   await ctx.collections.health.updateOne(
-    { _id: "singleton" },
+    { _id: id },
     {
-      $set: { updatedAt: /* @__PURE__ */ new Date() },
+      $set: {
+        status: "tripped",
+        trippedAt: /* @__PURE__ */ new Date(),
+        trippedReason: reason,
+        updatedAt: /* @__PURE__ */ new Date()
+      },
       $setOnInsert: {
-        _id: "singleton",
+        _id: id,
+        senderDomain: domain,
+        kind,
         windowStartedAt: /* @__PURE__ */ new Date(),
         windowDurationMs: ctx.config.circuitBreaker.windowMinutes * 60 * 1e3,
-        status: "healthy",
-        trippedAt: null,
-        trippedReason: null,
         manuallyResumedAt: null,
         counters: { sent: 0, delivered: 0, bounced: 0, hardBounced: 0, softBounced: 0, complained: 0, failedToSend: 0 },
         rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 }
       }
     },
     { upsert: true }
-  ).catch(() => {
-  });
-  await processNewlyFiredEventTriggers(ctx).catch((err) => {
-    console.error("mailery: triggers scan failed", err);
-  });
-  await sweepStrandedFlowRuns(ctx).catch((err) => {
-    console.error("mailery: sweep failed", err);
-  });
-  await sweepStrandedSends(ctx).catch((err) => {
-    console.error("mailery: stranded-send sweep failed", err);
-  });
-  await drainOutbox(ctx).catch((err) => {
-    console.error("mailery: outbox drain failed", err);
-  });
-  await processScheduledBroadcasts2(ctx).catch((err) => {
-    console.error("mailery: broadcast dispatch failed", err);
-  });
-  await evaluateHealth(ctx).catch((err) => {
-    console.error("mailery: health evaluation failed", err);
-  });
-  await promoteSoftBounces(ctx).catch((err) => {
-    console.error("mailery: soft-bounce promotion failed", err);
-  });
+  );
+  if (ctx.config.onCircuitBreakerTrip) {
+    try {
+      await ctx.config.onCircuitBreakerTrip({ reason, rates: { userReportedSpamRatio: snapshot.userReportedSpamRatio ?? 0 } });
+    } catch {
+    }
+  }
+  return true;
 }
-async function sweepStrandedSends(ctx) {
-  const cutoff = new Date(Date.now() - STRANDED_SEND_THRESHOLD_MS);
-  const cursor = ctx.collections.sends.find(
-    { status: "sending", updatedAt: { $lt: cutoff } },
-    { projection: { _id: 1 } }
-  ).limit(500);
-  for await (const row of cursor) {
-    const reset = await ctx.collections.sends.updateOne(
-      { _id: row._id, status: "sending", updatedAt: { $lt: cutoff } },
-      { $set: { status: "queued", updatedAt: /* @__PURE__ */ new Date() } }
-    );
-    if (reset.modifiedCount === 0) continue;
-    await ctx.queues.send.add("send", { sendId: String(row._id) }, {
-      attempts: ctx.config.sendRetryAttempts,
-      backoff: { type: "exponential", delay: 6e4 }
-    });
+
+// src/server/runner/snds.ts
+var SNDS_DATA_URL = "https://postmaster.live.com/snds/data.aspx";
+var FETCH_TIMEOUT_MS2 = 3e4;
+async function runSndsPull(ctx, opts = {}) {
+  const cfg = ctx.config.snds;
+  if (!cfg?.accessKey) return { ran: false, reason: "not_configured" };
+  const intervalHours = cfg.intervalHours ?? 24;
+  if (!opts.force && intervalHours <= 0) return { ran: false, reason: "disabled" };
+  if (!opts.force) {
+    const latest = await ctx.collections.sndsSnapshots.find({}).sort({ fetchedAt: -1 }).limit(1).toArray();
+    if (latest[0]) {
+      const ageMs = Date.now() - new Date(latest[0].fetchedAt).getTime();
+      if (ageMs < intervalHours * 60 * 60 * 1e3) {
+        return { ran: false, reason: "not_due" };
+      }
+    }
   }
+  const fetcher = opts.fetcher ?? globalThis.fetch;
+  const url = `${SNDS_DATA_URL}?key=${encodeURIComponent(cfg.accessKey)}`;
+  const ctl = new AbortController();
+  const t = setTimeout(() => ctl.abort(), FETCH_TIMEOUT_MS2);
+  let res;
+  try {
+    res = await fetcher(url, { method: "GET", signal: ctl.signal });
+  } catch (err) {
+    throw new Error(`SNDS data fetch failed: ${redactKey(String(err?.message ?? err), cfg.accessKey)}`);
+  } finally {
+    clearTimeout(t);
+  }
+  if (!res.ok) {
+    throw new Error(`SNDS data fetch failed: ${res.status} ${redactKey(await safeText2(res), cfg.accessKey)}`);
+  }
+  const csv = await res.text();
+  const rows = parseSndsCsv(csv);
+  const ipFilter = cfg.ips?.length ? new Set(cfg.ips) : null;
+  const now = /* @__PURE__ */ new Date();
+  const ops = rows.filter((row) => !ipFilter || ipFilter.has(row.ip)).map((row) => ({
+    updateOne: {
+      filter: { ip: row.ip, activityStart: row.activityStart },
+      update: { $set: { ...row, fetchedAt: now } },
+      upsert: true
+    }
+  }));
+  let persisted = 0;
+  if (ops.length > 0) {
+    const r = await ctx.collections.sndsSnapshots.bulkWrite(ops, { ordered: false });
+    persisted = (r.modifiedCount ?? 0) + (r.upsertedCount ?? 0);
+  }
+  return { ran: true, rowsParsed: rows.length, rowsPersisted: persisted };
 }
-async function drainOutbox(ctx) {
+function redactKey(s, key) {
+  if (!key) return s;
+  return s.split(key).join("<redacted>").split(encodeURIComponent(key)).join("<redacted>");
+}
+async function safeText2(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "<no body>";
+  }
+}
+function parseSndsCsv(csv) {
+  const out = [];
+  for (const raw of csv.split(/\r?\n/)) {
+    if (!raw.trim()) continue;
+    const fields = splitCsvRow(raw);
+    if (fields.length < 7) continue;
+    const parsed = parseRow(fields);
+    if (parsed) out.push(parsed);
+  }
+  return out;
+}
+function splitCsvRow(row) {
+  const out = [];
+  let cur = "";
+  let inQuotes = false;
+  for (let i = 0; i < row.length; i++) {
+    const ch = row[i];
+    if (inQuotes) {
+      if (ch === '"') {
+        if (row[i + 1] === '"') {
+          cur += '"';
+          i++;
+        } else {
+          inQuotes = false;
+        }
+      } else {
+        cur += ch;
+      }
+    } else if (ch === '"') {
+      inQuotes = true;
+    } else if (ch === ",") {
+      out.push(cur);
+      cur = "";
+    } else {
+      cur += ch;
+    }
+  }
+  out.push(cur);
+  return out.map((f) => f.trim());
+}
+function parseRow(fields) {
+  const [
+    ip,
+    activityStart,
+    activityEnd,
+    rcptCommands,
+    dataCommands,
+    messageRecipients,
+    filterResult,
+    complaintRate,
+    trapMessageCount,
+    sampleHelo,
+    sampleMailFrom
+  ] = fields;
+  const start = parseSndsDate(activityStart ?? "");
+  const end = parseSndsDate(activityEnd ?? "");
+  if (!ip || !start || !end) return null;
+  return {
+    ip,
+    activityStart: start,
+    activityEnd: end,
+    rcptCommands: toInt(rcptCommands),
+    dataCommands: toInt(dataCommands),
+    messageRecipients: toInt(messageRecipients),
+    filterResult: normalizeFilter(filterResult ?? ""),
+    complaintRate: parseComplaintRate(complaintRate ?? ""),
+    trapMessageCount: toInt(trapMessageCount),
+    sampleHelo: sampleHelo ? sampleHelo : null,
+    sampleMailFrom: sampleMailFrom ? sampleMailFrom : null
+  };
+}
+function toInt(s) {
+  if (!s) return 0;
+  const n = Number(s.replace(/[^\d-]/g, ""));
+  return Number.isFinite(n) ? n : 0;
+}
+function normalizeFilter(s) {
+  const u = s.toUpperCase().trim();
+  if (u === "GREEN" || u === "YELLOW" || u === "RED") return u;
+  return "UNKNOWN";
+}
+function parseComplaintRate(s) {
+  const trimmed = s.trim();
+  if (!trimmed || trimmed === "-" || /n\/?a/i.test(trimmed)) return null;
+  const cleaned = trimmed.replace(/%/g, "");
+  let m = /^<\s*(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[1]) / 100;
+  m = /^>\s*(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[1]) / 100;
+  m = /^(\d+(?:\.\d+)?)\s*-\s*(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[2]) / 100;
+  m = /^(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[1]) / 100;
+  return null;
+}
+function parseSndsDate(s) {
+  const trimmed = s.trim();
+  if (!trimmed) return null;
+  const m = /^(\d{1,2})\/(\d{1,2})\/(\d{4})\s+(\d{1,2}):(\d{2})(?::(\d{2}))?\s*(AM|PM)?$/i.exec(trimmed);
+  if (m) {
+    const month = Number(m[1]) - 1;
+    const day = Number(m[2]);
+    const year = Number(m[3]);
+    let hour = Number(m[4]);
+    const minute = Number(m[5]);
+    const second = Number(m[6] ?? 0);
+    const meridiem = m[7]?.toUpperCase();
+    if (meridiem === "PM" && hour < 12) hour += 12;
+    if (meridiem === "AM" && hour === 12) hour = 0;
+    const wallMs = Date.UTC(year, month, day, hour, minute, second);
+    if (!Number.isFinite(wallMs)) return null;
+    const offsetHours = isUsPacificDst(year, month, day) ? 7 : 8;
+    return new Date(wallMs + offsetHours * 60 * 60 * 1e3);
+  }
+  const d = new Date(trimmed);
+  if (!isNaN(d.getTime())) return d;
+  return null;
+}
+function isUsPacificDst(year, month0, day) {
+  if (month0 > 2 && month0 < 10) return true;
+  if (month0 < 2 || month0 > 10) return false;
+  if (month0 === 2) {
+    const dst2 = nthSundayOfMonth(year, 2, 2);
+    return day >= dst2;
+  }
+  const dst = nthSundayOfMonth(year, 10, 1);
+  return day < dst;
+}
+function nthSundayOfMonth(year, month0, n) {
+  const first = new Date(Date.UTC(year, month0, 1));
+  const dayOfWeek = first.getUTCDay();
+  const firstSunday = 1 + (7 - dayOfWeek) % 7;
+  return firstSunday + (n - 1) * 7;
+}
+
+// src/server/runner/dmarc.ts
+var MAX_DECOMPRESSED_BYTES = 50 * 1024 * 1024;
+function assertSafeZipEntryName(rawName) {
+  if (typeof rawName !== "string" || rawName.length === 0) {
+    throw new Error(`zip entry has unsafe path: <empty>`);
+  }
+  if (rawName.includes("\0")) {
+    throw new Error(`zip entry has unsafe path: contains null byte`);
+  }
+  if (rawName.startsWith("/") || rawName.startsWith("\\") || /^[a-zA-Z]:[\\/]/.test(rawName)) {
+    throw new Error(`zip entry has unsafe path: ${rawName}`);
+  }
+  const parts = rawName.split(/[/\\]/);
+  if (parts.some((p) => p === "..")) {
+    throw new Error(`zip entry has unsafe path: ${rawName}`);
+  }
+}
+async function extractDmarcXmls(buffer, filename) {
+  const lower = (filename ?? "").toLowerCase();
+  const zlib = await import('zlib');
+  if (lower.endsWith(".gz")) {
+    const xml = await new Promise((resolve, reject) => {
+      const chunks = [];
+      let bytes = 0;
+      const stream = zlib.createGunzip();
+      stream.on("data", (chunk) => {
+        bytes += chunk.length;
+        if (bytes > MAX_DECOMPRESSED_BYTES) {
+          stream.destroy();
+          reject(new Error(`DMARC gzip exceeds ${MAX_DECOMPRESSED_BYTES} bytes (decompression bomb?)`));
+          return;
+        }
+        chunks.push(chunk);
+      });
+      stream.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+      stream.on("error", reject);
+      stream.end(buffer);
+    });
+    return [xml];
+  }
+  if (lower.endsWith(".zip")) {
+    const { default: AdmZip } = await import('adm-zip');
+    const zip = new AdmZip(buffer);
+    const entries = zip.getEntries().filter((e) => !e.isDirectory);
+    if (entries.length === 0) throw new Error("zip contains no files");
+    let total = 0;
+    const pieces = [];
+    for (const entry of entries) {
+      assertSafeZipEntryName(entry.entryName);
+      const declaredSize = entry.header?.size;
+      if (typeof declaredSize !== "number" || declaredSize <= 0) {
+        throw new Error(`zip entry ${entry.entryName} has no declared size (refusing to decompress)`);
+      }
+      if (declaredSize > MAX_DECOMPRESSED_BYTES || total + declaredSize > MAX_DECOMPRESSED_BYTES) {
+        throw new Error(`DMARC zip exceeds ${MAX_DECOMPRESSED_BYTES} bytes (decompression bomb?)`);
+      }
+      const data = entry.getData();
+      total += data.length;
+      if (total > MAX_DECOMPRESSED_BYTES) {
+        throw new Error(`DMARC zip decompressed payload exceeds ${MAX_DECOMPRESSED_BYTES} bytes (forged header?)`);
+      }
+      if (declaredSize > 10 * 1024 && data.length > declaredSize * 64 + 1024) {
+        throw new Error(`DMARC zip entry ${entry.entryName} decompressed size (${data.length}) far exceeds declared (${declaredSize})`);
+      }
+      pieces.push(data.toString("utf8"));
+    }
+    return pieces;
+  }
+  if (buffer.length > MAX_DECOMPRESSED_BYTES) {
+    throw new Error(`DMARC payload exceeds ${MAX_DECOMPRESSED_BYTES} bytes`);
+  }
+  return [buffer.toString("utf8")];
+}
+function parseDmarcReport(xml) {
+  const { XMLParser } = __require("fast-xml-parser");
+  const parser = new XMLParser({
+    ignoreAttributes: false,
+    parseAttributeValue: false,
+    parseTagValue: false,
+    trimValues: true,
+    // RFC 7489 specifies lowercase snake_case tag names, but some
+    // less-careful receivers emit CamelCase. Normalize before lookup.
+    transformTagName: (t) => t.toLowerCase()
+  });
+  const root = parser.parse(xml);
+  const fb = root?.feedback;
+  if (!fb) throw new Error("DMARC XML missing <feedback> root");
+  const meta = fb.report_metadata ?? {};
+  const policy = fb.policy_published ?? {};
+  const reportId = String(meta.report_id ?? "").trim();
+  const orgName = String(meta.org_name ?? "").trim();
+  const email = String(meta.email ?? "").trim();
+  const domain = String(policy.domain ?? "").trim().toLowerCase();
+  const policyP = policy.p ?? "none";
+  const rawPct = Number(policy.pct ?? 100);
+  const policyPct = Number.isFinite(rawPct) ? Math.max(0, Math.min(100, rawPct)) : 100;
+  if (!reportId) throw new Error("DMARC XML missing report_id");
+  if (!domain) throw new Error("DMARC XML missing policy_published.domain");
+  const range = meta.date_range ?? {};
+  const begin = secondsToDate(range.begin);
+  const end = secondsToDate(range.end);
+  if (!begin || !end) throw new Error("DMARC XML missing date_range");
+  const records = toArray(fb.record);
+  const failures = [];
+  let totalMessages = 0;
+  let passCount = 0;
+  let failCount = 0;
+  const midMs = Math.floor((begin.getTime() + end.getTime()) / 2);
+  const day = new Date(midMs).toISOString().slice(0, 10);
+  for (const rec of records) {
+    const row = rec?.row ?? {};
+    const count = Number(row.count ?? 0) || 0;
+    totalMessages += count;
+    const evald = row.policy_evaluated ?? {};
+    const dkim = evald.dkim ?? "none";
+    const spf = evald.spf ?? "none";
+    const aligned = dkim === "pass" || spf === "pass";
+    if (aligned) {
+      passCount += count;
+      continue;
+    }
+    failCount += count;
+    const sourceIp = String(row.source_ip ?? "").trim();
+    if (!sourceIp) continue;
+    const headerFrom = String(rec?.identifiers?.header_from ?? "").toLowerCase();
+    const dispositionApplied = String(evald.disposition ?? "none");
+    failures.push({
+      reportId,
+      domain,
+      sourceIp,
+      count,
+      headerFrom,
+      dkimResult: dkim,
+      spfResult: spf,
+      dispositionApplied,
+      day
+    });
+  }
+  return {
+    report: {
+      reportId,
+      orgName,
+      email,
+      domain,
+      policyP,
+      policyPct,
+      rangeStart: begin,
+      rangeEnd: end,
+      totalMessages,
+      passCount,
+      failCount
+    },
+    failures
+  };
+}
+function secondsToDate(v) {
+  if (v === void 0 || v === null) return null;
+  const n = typeof v === "number" ? v : Number(String(v));
+  if (!Number.isFinite(n) || n <= 0) return null;
+  return new Date(n * 1e3);
+}
+function toArray(v) {
+  if (v === void 0 || v === null) return [];
+  return Array.isArray(v) ? v : [v];
+}
+async function ingestDmarcAttachment(ctx, buffer, filename) {
+  const xmls = await extractDmarcXmls(buffer, filename);
+  if (xmls.length === 0) throw new Error("attachment contained no XML payload");
+  const results = [];
+  let firstError = null;
+  for (const xml of xmls) {
+    try {
+      const parsed = parseDmarcReport(xml);
+      results.push(await ingestParsedDmarcReport(ctx, parsed));
+    } catch (err) {
+      if (!firstError) firstError = err;
+    }
+  }
+  if (results.length === 0) {
+    throw firstError ?? new Error("no parseable DMARC reports in attachment");
+  }
+  return { ...results[0], additionalReports: results.length - 1 };
+}
+async function ingestParsedDmarcReport(ctx, parsed) {
+  const now = /* @__PURE__ */ new Date();
+  const { report, failures } = parsed;
+  let duplicate = false;
+  try {
+    await ctx.collections.dmarcReports.insertOne({ ...report, receivedAt: now });
+  } catch (err) {
+    if (err?.code === 11e3) {
+      duplicate = true;
+    } else {
+      throw err;
+    }
+  }
+  if (!duplicate && failures.length > 0) {
+    try {
+      await ctx.collections.dmarcFailures.insertMany(
+        failures.map((f) => ({ ...f, receivedAt: now })),
+        { ordered: false }
+      );
+    } catch (err) {
+      const writeErrors = err?.writeErrors;
+      if (Array.isArray(writeErrors)) {
+        const nonDup = writeErrors.find((w) => w?.code !== 11e3);
+        if (nonDup) throw err;
+      } else if (err?.code !== 11e3) {
+        throw err;
+      }
+    }
+  }
+  return {
+    ok: true,
+    reportId: report.reportId,
+    domain: report.domain,
+    rangeStart: report.rangeStart,
+    rangeEnd: report.rangeEnd,
+    totalMessages: report.totalMessages,
+    passCount: report.passCount,
+    failCount: report.failCount,
+    duplicate
+  };
+}
+var _lastPruneAt = 0;
+var PRUNE_INTERVAL_MS = 60 * 60 * 1e3;
+async function pruneDmarcFailures(ctx, opts = {}) {
+  const cfg = ctx.config.dmarc;
+  const days = cfg?.retentionDays ?? 90;
+  if (days <= 0) return 0;
+  if (!opts.force && Date.now() - _lastPruneAt < PRUNE_INTERVAL_MS) return 0;
+  _lastPruneAt = Date.now();
+  const cutoff = new Date(Date.now() - days * 864e5);
+  const r = await ctx.collections.dmarcFailures.deleteMany({ receivedAt: { $lt: cutoff } });
+  return r.deletedCount ?? 0;
+}
+async function resolveSourceTags(ctx) {
+  const out = /* @__PURE__ */ new Map();
+  for (const t of ctx.config.dmarc?.knownSources ?? []) {
+    out.set(t.ip, { ip: t.ip, label: t.label, ignored: !!t.ignored, source: "config" });
+  }
+  const dbTags = await ctx.collections.dmarcSourceTags.find({}).toArray();
+  for (const t of dbTags) {
+    out.set(t.ip, { ip: t.ip, label: t.label, ignored: t.ignored, source: "db" });
+  }
+  return out;
+}
+function suggestPolicyProgression(input) {
+  const { reports, failures, knownSourceIps, ignoredSourceIps, currentPolicy, currentPct } = input;
+  if (currentPolicy === "reject") return null;
+  const since30 = Date.now() - 30 * 864e5;
+  const recentReports = reports.filter((r) => r.rangeEnd.getTime() >= since30);
+  const totalMsgs = recentReports.reduce((acc, r) => acc + r.passCount + r.failCount, 0);
+  const totalPass = recentReports.reduce((acc, r) => acc + r.passCount, 0);
+  if (recentReports.length < 30) return null;
+  if (totalMsgs < 1e3) return null;
+  const untaggedFailures = failures.filter(
+    (f) => f.receivedAt.getTime() >= since30 && !knownSourceIps.has(f.sourceIp) && !ignoredSourceIps.has(f.sourceIp)
+  );
+  if (untaggedFailures.length > 0) return null;
+  const alignmentRate = totalMsgs === 0 ? 0 : totalPass / totalMsgs;
+  if (currentPolicy === null || currentPolicy === "none") {
+    if (alignmentRate >= 0.99) {
+      return {
+        policy: "quarantine",
+        pct: 10,
+        reason: `${(alignmentRate * 100).toFixed(2)}% alignment over ${recentReports.length} reports / ${totalMsgs.toLocaleString()} messages, all known sources tagged.`
+      };
+    }
+    return null;
+  }
+  if (currentPolicy === "quarantine") {
+    const pct = currentPct ?? 100;
+    if (alignmentRate < 0.995) return null;
+    if (pct < 25) return { policy: "quarantine", pct: 25, reason: `Alignment held at ${(alignmentRate * 100).toFixed(2)}% \u2014 safe to ramp pct from ${pct} to 25.` };
+    if (pct < 50) return { policy: "quarantine", pct: 50, reason: `Alignment held at ${(alignmentRate * 100).toFixed(2)}% \u2014 safe to ramp pct from ${pct} to 50.` };
+    if (pct < 100) return { policy: "quarantine", pct: 100, reason: `Alignment held at ${(alignmentRate * 100).toFixed(2)}% \u2014 safe to ramp pct from ${pct} to 100.` };
+    if (alignmentRate >= 0.999) {
+      return { policy: "reject", pct: 100, reason: `Alignment at ${(alignmentRate * 100).toFixed(3)}% with policy=quarantine pct=100 \u2014 safe to move to p=reject.` };
+    }
+  }
+  return null;
+}
+
+// src/server/runner/tick.ts
+var STRANDED_SEND_THRESHOLD_MS = 5 * 60 * 1e3;
+async function runTick(ctx) {
+  try {
+    await ctx.collections.health.updateOne(
+      { _id: HEALTH_AGG_ID },
+      {
+        $set: { updatedAt: /* @__PURE__ */ new Date() },
+        $setOnInsert: {
+          _id: HEALTH_AGG_ID,
+          senderDomain: null,
+          kind: null,
+          windowStartedAt: /* @__PURE__ */ new Date(),
+          windowDurationMs: ctx.config.circuitBreaker.windowMinutes * 60 * 1e3,
+          status: "healthy",
+          trippedAt: null,
+          trippedReason: null,
+          manuallyResumedAt: null,
+          counters: { sent: 0, delivered: 0, bounced: 0, hardBounced: 0, softBounced: 0, complained: 0, failedToSend: 0 },
+          rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 }
+        }
+      },
+      { upsert: true }
+    );
+  } catch (err) {
+    console.error("mailery: heartbeat write failed", err);
+  }
+  await processNewlyFiredEventTriggers(ctx).catch((err) => {
+    console.error("mailery: triggers scan failed", err);
+  });
+  await sweepStrandedFlowRuns(ctx).catch((err) => {
+    console.error("mailery: sweep failed", err);
+  });
+  await sweepStrandedSends(ctx).catch((err) => {
+    console.error("mailery: stranded-send sweep failed", err);
+  });
+  await drainOutbox(ctx).catch((err) => {
+    console.error("mailery: outbox drain failed", err);
+  });
+  await processScheduledBroadcasts2(ctx).catch((err) => {
+    console.error("mailery: broadcast dispatch failed", err);
+  });
+  await evaluateHealth(ctx).catch((err) => {
+    console.error("mailery: health evaluation failed", err);
+  });
+  await promoteSoftBounces(ctx).catch((err) => {
+    console.error("mailery: soft-bounce promotion failed", err);
+  });
+  await Promise.all([
+    runDnsblChecks(ctx).catch((err) => {
+      console.error("mailery: dnsbl checks failed", err);
+    }),
+    runPostmasterPull(ctx).catch((err) => {
+      console.error("mailery: postmaster pull failed", err);
+    }),
+    runSndsPull(ctx).catch((err) => {
+      console.error("mailery: snds pull failed", err);
+    }),
+    pruneDmarcFailures(ctx).catch((err) => {
+      console.error("mailery: dmarc prune failed", err);
+    })
+  ]);
+}
+async function sweepStrandedSends(ctx) {
+  const cutoff = new Date(Date.now() - STRANDED_SEND_THRESHOLD_MS);
+  const cursor = ctx.collections.sends.find(
+    { status: "sending", updatedAt: { $lt: cutoff } },
+    { projection: { _id: 1 } }
+  ).limit(500);
+  for await (const row of cursor) {
+    const reset = await ctx.collections.sends.updateOne(
+      { _id: row._id, status: "sending", updatedAt: { $lt: cutoff } },
+      { $set: { status: "queued", updatedAt: /* @__PURE__ */ new Date() } }
+    );
+    if (reset.modifiedCount === 0) continue;
+    await ctx.queues.send.add("send", { sendId: String(row._id) }, {
+      attempts: ctx.config.sendRetryAttempts,
+      backoff: { type: "exponential", delay: 6e4 }
+    });
+  }
+}
+async function drainOutbox(ctx) {
   const batch = await ctx.collections.outbox.find({ status: "pending" }).sort({ enqueuedAt: 1 }).limit(200).toArray();
   for (const row of batch) {
     try {
@@ -2290,6 +3396,10 @@ async function processScheduledBroadcasts2(ctx) {
 }
 
 // src/server/runner/webhook.ts
+function dimsFromSend(send) {
+  if (!send) return null;
+  return { fromEmail: send.fromEmail, kind: send.kind };
+}
 async function applyWebhookEvent(event, ctx) {
   const send = await ctx.collections.sends.findOne(
     event.providerMessageId ? { $or: [{ providerMessageId: event.providerMessageId }, { emailAtSend: event.email }] } : { emailAtSend: event.email },
@@ -2303,7 +3413,7 @@ async function applyWebhookEvent(event, ctx) {
           { $set: { status: "delivered", deliveredAt: event.occurredAt } }
         );
       }
-      await recordHealthCounter(ctx, "delivered");
+      await recordHealthCounter(ctx, "delivered", dimsFromSend(send));
       break;
     case "open":
       if (send) {
@@ -2358,8 +3468,11 @@ async function applyWebhookEvent(event, ctx) {
           { $set: { status: "bounced", updatedAt: /* @__PURE__ */ new Date() } }
         );
       }
-      await recordHealthCounter(ctx, "bounced");
-      await recordHealthCounter(ctx, bounceType === "hard" ? "hardBounced" : "softBounced");
+      {
+        const dims = dimsFromSend(send);
+        await recordHealthCounter(ctx, "bounced", dims);
+        await recordHealthCounter(ctx, bounceType === "hard" ? "hardBounced" : "softBounced", dims);
+      }
       break;
     }
     case "complaint":
@@ -2375,7 +3488,7 @@ async function applyWebhookEvent(event, ctx) {
         { emailAtSubscribe: event.email },
         { $set: { status: "complained", updatedAt: /* @__PURE__ */ new Date() } }
       );
-      await recordHealthCounter(ctx, "complained");
+      await recordHealthCounter(ctx, "complained", dimsFromSend(send));
       break;
     case "unsubscribe":
       if (send) {
@@ -2444,7 +3557,8 @@ var Mailer = class _Mailer {
       providers: this.providers,
       queues: this.queues,
       config: this.config,
-      handlebarsHelpers: this.config.handlebarsHelpers
+      handlebarsHelpers: this.config.handlebarsHelpers,
+      audit: (entry) => this.audit(entry)
     };
   }
   /**
@@ -2934,43 +4048,6 @@ var Mailer = class _Mailer {
   }
 };
 
-// src/server/templates/sender-domain.ts
-function validateSenderDomain(fromEmail, templateKind, registry) {
-  if (!registry || Object.keys(registry).length === 0) return { ok: true };
-  const domain = extractDomain(fromEmail);
-  if (!domain) {
-    return {
-      ok: false,
-      code: "invalid_email",
-      reason: `invalid fromEmail "${fromEmail}" \u2014 expected "name@domain"`
-    };
-  }
-  const entry = registry[domain];
-  if (!entry) {
-    const known = Object.keys(registry).join(", ");
-    return {
-      ok: false,
-      code: "unregistered_domain",
-      reason: `sender domain "${domain}" is not declared in senderDomains (allowed: ${known})`
-    };
-  }
-  if (entry.kind === "both") return { ok: true };
-  if (entry.kind !== templateKind) {
-    return {
-      ok: false,
-      code: "wrong_kind",
-      reason: `sender domain "${domain}" is configured for ${entry.kind} email, but this template's kind is ${templateKind}`
-    };
-  }
-  return { ok: true };
-}
-function extractDomain(email) {
-  if (typeof email !== "string") return null;
-  const at = email.lastIndexOf("@");
-  if (at <= 0 || at === email.length - 1) return null;
-  return email.slice(at + 1).toLowerCase().trim();
-}
-
 // src/server/index.ts
 init_mongo();
 
@@ -3001,6 +4078,185 @@ var NullProvider = class {
 // src/server/index.ts
 init_sendgrid();
 
+// src/server/templates/linter.ts
+var URL_SHORTENERS = ["bit.ly", "t.co", "tinyurl.com", "goo.gl", "ow.ly"];
+var SPAM_PHRASES = [
+  { pattern: /\bFREE\b/, phrase: "FREE" },
+  { pattern: /\bACT NOW\b/i, phrase: "ACT NOW" },
+  { pattern: /\b100%\s+guaranteed\b/i, phrase: "100% guaranteed" }
+];
+var MARKETING_UNSUBSCRIBE_TAG = /\{\{\s*unsubscribeUrl\s*\}\}/;
+function lintTemplate(rawInput, config = {}) {
+  const input = {
+    subject: typeof rawInput.subject === "string" ? rawInput.subject : "",
+    preheader: typeof rawInput.preheader === "string" ? rawInput.preheader : "",
+    mjml: typeof rawInput.mjml === "string" ? rawInput.mjml : "",
+    editorJson: rawInput.editorJson,
+    html: typeof rawInput.html === "string" ? rawInput.html : "",
+    plainText: typeof rawInput.plainText === "string" ? rawInput.plainText : "",
+    kind: rawInput.kind === "marketing" || rawInput.kind === "transactional" ? rawInput.kind : "transactional",
+    fromEmail: typeof rawInput.fromEmail === "string" ? rawInput.fromEmail : ""
+  };
+  const issues = [];
+  if (!input.plainText || input.plainText.trim().length === 0) {
+    issues.push({
+      rule: "missing_plain_text",
+      severity: "error",
+      message: "Plain-text alternative is empty.",
+      hint: "Email clients and spam filters use the plain-text part. Add visible text content (MJML mj-text blocks, or text content in the Maily editor) \u2014 do not strip plain-text to empty."
+    });
+  }
+  const imageCount = countMatches(input.html, /<img\b/gi);
+  const textLen = input.plainText.trim().length;
+  if (imageCount >= 1 && textLen < 20) {
+    issues.push({
+      rule: "image_only_body",
+      severity: "error",
+      message: "Body is mostly images with little or no text.",
+      hint: "Image-only emails are heavily filtered as spam. Add at least one paragraph of meaningful text."
+    });
+  }
+  const shortenerLinks = findShortenerLinks(input.html);
+  if (shortenerLinks.length > 0) {
+    issues.push({
+      rule: "url_shortener",
+      severity: "error",
+      message: `Link uses a URL shortener: ${shortenerLinks.join(", ")}.`,
+      hint: "URL shorteners are strongly correlated with spam and are routinely blocked. Use a direct link to your domain."
+    });
+  }
+  if (hasBareUrlInVisibleText(input.html)) {
+    issues.push({
+      rule: "bare_url",
+      severity: "warning",
+      message: "A URL appears in the body text without being wrapped in a link.",
+      hint: "Wrap visible URLs in an anchor tag \u2014 bare URLs look like spam template residue and reduce engagement."
+    });
+  }
+  const spam = findSpamSignals(`${input.subject}
+${input.plainText}`);
+  if (spam.length > 0) {
+    issues.push({
+      rule: "spam_phrases",
+      severity: "warning",
+      message: `Content contains spam-flagged phrases: ${spam.join(", ")}.`,
+      hint: "These phrases trigger content filters. Rephrase if possible."
+    });
+  }
+  if (isAllCaps(input.subject)) {
+    issues.push({
+      rule: "all_caps_subject",
+      severity: "warning",
+      message: "Subject line is mostly uppercase.",
+      hint: "All-caps subjects are flagged by spam filters and reduce click-through. Use sentence case."
+    });
+  }
+  if (input.kind === "marketing") {
+    const sources = [input.mjml ?? "", input.html ?? "", JSON.stringify(input.editorJson ?? null)];
+    const hasTag = sources.some((s) => MARKETING_UNSUBSCRIBE_TAG.test(s));
+    if (!hasTag) {
+      issues.push({
+        rule: "missing_unsubscribe_tag",
+        severity: "error",
+        message: "Marketing template is missing the {{unsubscribeUrl}} merge tag.",
+        hint: "CAN-SPAM, GDPR, and Gmail/Yahoo bulk-sender rules all require a working unsubscribe link. Add {{unsubscribeUrl}} somewhere in the body."
+      });
+    }
+  }
+  const senderCheck = validateSenderDomain(input.fromEmail, input.kind, config.senderDomains);
+  if (!senderCheck.ok) {
+    issues.push({
+      rule: "sender_domain_invalid",
+      severity: "error",
+      message: senderCheck.reason,
+      hint: "Edit the template fromEmail to use a domain declared for this kind in senderDomains, or update the registry."
+    });
+  }
+  if (!input.preheader || input.preheader.trim().length === 0) {
+    issues.push({
+      rule: "empty_preheader",
+      severity: "info",
+      message: "No preheader set.",
+      hint: "The preheader shows next to the subject in most inbox previews. A good preheader lifts open rate 5-10%."
+    });
+  }
+  if (input.subject.length > 60) {
+    issues.push({
+      rule: "subject_too_long",
+      severity: "warning",
+      message: `Subject is ${input.subject.length} characters; mobile clients truncate around 60.`,
+      hint: "Front-load the important words so the truncated preview still makes sense."
+    });
+  }
+  const linkCount = countMatches(input.html, /<a\s[^>]*\bhref\s*=/gi);
+  if (linkCount > 10) {
+    issues.push({
+      rule: "too_many_links",
+      severity: "warning",
+      message: `${linkCount} links in body; promotional content with many links is flagged by content filters.`,
+      hint: "Consolidate calls-to-action. Aim for one primary action plus a footer link or two."
+    });
+  }
+  return splitBySeverity(issues);
+}
+function splitBySeverity(issues) {
+  const out = { errors: [], warnings: [], infos: [] };
+  for (const i of issues) {
+    if (i.severity === "error") out.errors.push(i);
+    else if (i.severity === "warning") out.warnings.push(i);
+    else out.infos.push(i);
+  }
+  return out;
+}
+function countMatches(s, re) {
+  return (s.match(re) ?? []).length;
+}
+function findShortenerLinks(html) {
+  const hrefs = extractHrefs(html);
+  const hits = /* @__PURE__ */ new Set();
+  for (const href of hrefs) {
+    const domain = hostnameOf(href);
+    if (!domain) continue;
+    if (URL_SHORTENERS.includes(domain)) hits.add(domain);
+  }
+  return Array.from(hits);
+}
+function extractHrefs(html) {
+  const out = [];
+  const re = /<a\s[^>]*\bhref\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
+  let m;
+  while (m = re.exec(html)) {
+    const href = m[1] ?? m[2] ?? m[3];
+    if (href) out.push(href);
+  }
+  return out;
+}
+function hostnameOf(url) {
+  try {
+    return new URL(url).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function hasBareUrlInVisibleText(html) {
+  const stripped = html.replace(/<a\b[^>]*>.*?<\/a>/gis, " ").replace(/<style\b[^>]*>.*?<\/style>/gis, " ").replace(/<script\b[^>]*>.*?<\/script>/gis, " ").replace(/<head\b[^>]*>.*?<\/head>/gis, " ");
+  return /https?:\/\/[^\s<>"']+/i.test(stripped);
+}
+function findSpamSignals(text) {
+  const out = /* @__PURE__ */ new Set();
+  for (const { pattern, phrase } of SPAM_PHRASES) {
+    if (pattern.test(text)) out.add(phrase);
+  }
+  if (/!{3,}/.test(text)) out.add('excessive "!!!"');
+  return Array.from(out);
+}
+function isAllCaps(subject) {
+  const letters = subject.replace(/[^a-zA-Z]/g, "");
+  if (letters.length < 5) return false;
+  const upper = subject.replace(/[^A-Z]/g, "").length;
+  return upper / letters.length > 0.5;
+}
+
 // src/server/api/setup-status.ts
 async function runSetupChecks(mailer) {
   const checks = [];
@@ -3010,6 +4266,12 @@ async function runSetupChecks(mailer) {
     checks.push(await checkWorkersHeartbeat(mailer));
   }
   checks.push(await checkCircuitBreaker(mailer));
+  checks.push(await checkDnsbl(mailer));
+  checks.push(await checkPostmaster(mailer));
+  checks.push(await checkSnds(mailer));
+  const jmrp = checkJmrp(mailer);
+  if (jmrp) checks.push(jmrp);
+  checks.push(await checkDmarc(mailer));
   checks.push(...checkFromDefaultsAgainstRegistry(mailer));
   checks.push(...await checkPublishedTemplates(mailer));
   checks.push(await checkPostalAddress(mailer));
@@ -3059,7 +4321,10 @@ async function checkQueue(mailer) {
   }
 }
 async function checkWorkersHeartbeat(mailer) {
-  const h = await mailer.collections.health.findOne({ _id: "singleton" });
+  const h = await mailer.collections.health.findOne(
+    {},
+    { sort: { updatedAt: -1 } }
+  );
   const tickIntervalMs = mailer.config.tickIntervalSeconds * 1e3;
   const staleAfterMs = Math.max(tickIntervalMs * 3, 3e4);
   if (!h) {
@@ -3089,25 +4354,264 @@ async function checkWorkersHeartbeat(mailer) {
   };
 }
 async function checkCircuitBreaker(mailer) {
-  const h = await mailer.collections.health.findOne({ _id: "singleton" });
-  if (!h || h.status === "healthy") {
-    return { name: "circuit_breaker", label: "Circuit breaker", severity: "ok", message: "healthy" };
+  const docs = await mailer.collections.health.find({}).toArray();
+  const buckets = docs.filter((d) => d._id !== HEALTH_AGG_ID);
+  if (buckets.length === 0) {
+    return {
+      name: "circuit_breaker",
+      label: "Circuit breaker",
+      severity: "ok",
+      message: "no telemetry yet",
+      hint: "The breaker tracks bounce / complaint rates per (sender domain \xD7 kind) and starts evaluating once enough sends have been recorded. Send some mail to populate."
+    };
   }
-  if (h.status === "degraded") {
+  const tripped = buckets.filter((d) => d.status === "tripped");
+  if (tripped.length > 0) {
+    const summary = tripped.map((d) => `${d.senderDomain ?? "_unknown"}/${d.kind}`).join(", ");
+    return {
+      name: "circuit_breaker",
+      label: "Circuit breaker",
+      severity: "error",
+      message: `tripped: ${summary}`,
+      hint: "Marketing sends are held for the listed bucket(s). Investigate the underlying bounce / complaint cause, then POST /api/health/resume (with optional senderDomain + kind to resume one bucket)."
+    };
+  }
+  const degraded = buckets.filter((d) => d.status === "degraded");
+  if (degraded.length > 0) {
+    const summary = degraded.map((d) => `${d.senderDomain ?? "_unknown"}/${d.kind}`).join(", ");
     return {
       name: "circuit_breaker",
       label: "Circuit breaker",
       severity: "warn",
-      message: "degraded (high failure rate)",
-      hint: "Marketing sends still flow but failure rate is above the degraded threshold. Investigate provider errors before they escalate to tripped."
+      message: `degraded: ${summary}`,
+      hint: "Marketing sends still flow but failure rate is above the degraded threshold for the listed bucket(s). Investigate provider errors before they escalate to tripped."
+    };
+  }
+  return { name: "circuit_breaker", label: "Circuit breaker", severity: "ok", message: "healthy" };
+}
+async function checkDnsbl(mailer) {
+  const docs = await mailer.collections.dnsblChecks.find({}).toArray();
+  if (docs.length === 0) {
+    return {
+      name: "dnsbl",
+      label: "DNS block-list checks",
+      severity: "ok",
+      message: "no checks run yet",
+      hint: "Checks run automatically once per dnsbl.intervalHours (default 24h). To run now, POST /api/dnsbl/recheck."
+    };
+  }
+  const listed = docs.filter((d) => d.result === "listed");
+  if (listed.length > 0) {
+    const summary = listed.map((d) => `${d.target} on ${d.listLabel}`).slice(0, 3).join("; ");
+    const more = listed.length > 3 ? ` (+${listed.length - 3} more)` : "";
+    return {
+      name: "dnsbl",
+      label: "DNS block-list checks",
+      severity: "error",
+      message: `${listed.length} listing(s): ${summary}${more}`,
+      hint: "A sender domain or IP is listed on a public DNSBL. Investigate the listing source \u2014 most lists publish a removal procedure on their website. Mail to the affected (domain, kind) bucket will likely land in spam until delisted."
+    };
+  }
+  const errored = docs.filter((d) => d.result === "error");
+  if (errored.length === docs.length) {
+    return {
+      name: "dnsbl",
+      label: "DNS block-list checks",
+      severity: "warn",
+      message: `all ${docs.length} checks errored`,
+      hint: "Lookups against block lists are failing \u2014 usually a DNS-resolution problem on the host running mailery, or a list rate-limiting your public resolver. Verify outbound DNS works."
     };
   }
   return {
-    name: "circuit_breaker",
-    label: "Circuit breaker",
-    severity: "error",
-    message: `tripped: ${h.trippedReason ?? "unknown reason"}`,
-    hint: "Marketing sends are held. Investigate the underlying bounce / complaint cause, then POST /api/health/resume."
+    name: "dnsbl",
+    label: "DNS block-list checks",
+    severity: "ok",
+    message: `clean (${docs.length} checks)`
+  };
+}
+async function checkPostmaster(mailer) {
+  const cfg = mailer.config.postmaster;
+  if (!cfg?.clientId || !cfg?.clientSecret || !cfg?.refreshToken) {
+    return {
+      name: "postmaster",
+      label: "Google Postmaster Tools",
+      severity: "ok",
+      message: "not configured (optional)",
+      hint: "Set mailer.config.postmaster with an OAuth client + refresh token to pull authoritative Gmail reputation data. Only meaningful at >100 sends/day to Gmail."
+    };
+  }
+  const snapshots = await mailer.collections.postmasterSnapshots.find({}).sort({ fetchedAt: -1 }).toArray();
+  if (snapshots.length === 0) {
+    return {
+      name: "postmaster",
+      label: "Google Postmaster Tools",
+      severity: "warn",
+      message: "configured but no data yet",
+      hint: "A pull runs once per postmaster.intervalHours (default 24h). To run now, POST /api/postmaster/refresh. Postmaster only reports for domains with >100 messages/day to Gmail; smaller senders see empty responses."
+    };
+  }
+  const latestByDomain = /* @__PURE__ */ new Map();
+  for (const s of snapshots) {
+    if (!latestByDomain.has(s.domain)) latestByDomain.set(s.domain, s);
+  }
+  const bad = [];
+  const low = [];
+  for (const s of latestByDomain.values()) {
+    if (s.domainReputation === "BAD") bad.push(s.domain);
+    else if (s.domainReputation === "LOW") low.push(s.domain);
+  }
+  if (bad.length > 0) {
+    return {
+      name: "postmaster",
+      label: "Google Postmaster Tools",
+      severity: "error",
+      message: `BAD reputation on ${bad.join(", ")}`,
+      hint: "Gmail considers these domains spammy. Most mail to Gmail addresses will land in spam folder. Marketing breaker has been tripped for affected domains. See docs/guide/warming.md \xA76 for recovery."
+    };
+  }
+  if (low.length > 0) {
+    return {
+      name: "postmaster",
+      label: "Google Postmaster Tools",
+      severity: "warn",
+      message: `LOW reputation on ${low.join(", ")}`,
+      hint: "Reputation has slipped below Medium. Review recent complaint + bounce activity, slow down marketing volume, and re-engage your most active segment only."
+    };
+  }
+  return {
+    name: "postmaster",
+    label: "Google Postmaster Tools",
+    severity: "ok",
+    // Includes REPUTATION_CATEGORY_UNSPECIFIED ("no data yet") domains —
+    // surface that explicitly so the operator isn't misled.
+    message: (() => {
+      const tiers = new Set(Array.from(latestByDomain.values()).map((d) => d.domainReputation));
+      const hasUnspec = tiers.has("REPUTATION_CATEGORY_UNSPECIFIED");
+      return `${latestByDomain.size} domain(s) tracked${hasUnspec ? " (some have no reputation data yet)" : ", all High/Medium"}`;
+    })()
+  };
+}
+function checkJmrp(mailer) {
+  const hasDedicatedIp = (mailer.config.dnsbl?.dedicatedIps?.length ?? 0) > 0;
+  if (!hasDedicatedIp) return null;
+  return {
+    name: "snds_jmrp",
+    label: "Microsoft JMRP enrolment",
+    severity: "ok",
+    message: "manual setup \u2014 confirm in your runbook",
+    hint: "Outlook spam complaints only land in mailery if you enrol each sending IP in JMRP. Visit https://sendersupport.olc.protection.outlook.com/snds/JMRP.aspx and complete the form for each IP. There is no API to verify completion; mailery shows this reminder whenever dedicatedIps is non-empty."
+  };
+}
+async function checkSnds(mailer) {
+  const cfg = mailer.config.snds;
+  const hasDedicatedIp = (mailer.config.dnsbl?.dedicatedIps?.length ?? 0) > 0;
+  if (!cfg?.accessKey) {
+    if (!hasDedicatedIp) {
+      return {
+        name: "snds",
+        label: "Microsoft SNDS",
+        severity: "ok",
+        message: "not applicable (no dedicated IP)",
+        hint: "SNDS reports IP-level Outlook/Hotmail reputation. Only meaningful when you send from a dedicated IP. Skip unless you do."
+      };
+    }
+    return {
+      name: "snds",
+      label: "Microsoft SNDS",
+      severity: "warn",
+      message: "dedicated IP configured but SNDS access key not set",
+      hint: "Sign in at https://sendersupport.olc.protection.outlook.com/snds/ , request access for your IP(s), then set mailer.config.snds.accessKey to enable daily pulls. Also enrol in JMRP at https://sendersupport.olc.protection.outlook.com/snds/JMRP.aspx so Outlook complaints flow back to your suppression list."
+    };
+  }
+  const snapshots = await mailer.collections.sndsSnapshots.find({}).sort({ fetchedAt: -1 }).toArray();
+  if (snapshots.length === 0) {
+    return {
+      name: "snds",
+      label: "Microsoft SNDS",
+      severity: "warn",
+      message: "configured but no data yet",
+      hint: "A pull runs every snds.intervalHours (default 24h). To run now, POST /api/snds/refresh. If you just enrolled, SNDS data can take 1-2 days to populate."
+    };
+  }
+  const latestByIp = /* @__PURE__ */ new Map();
+  for (const s of snapshots) {
+    if (!latestByIp.has(s.ip)) latestByIp.set(s.ip, s);
+  }
+  const red = [];
+  const yellow = [];
+  for (const s of latestByIp.values()) {
+    if (s.filterResult === "RED") red.push(s.ip);
+    else if (s.filterResult === "YELLOW") yellow.push(s.ip);
+  }
+  if (red.length > 0) {
+    return {
+      name: "snds",
+      label: "Microsoft SNDS",
+      severity: "error",
+      message: `RED filter on ${red.join(", ")}`,
+      hint: "Outlook/Hotmail is filtering mail from these IPs as spam. Reduce volume, audit recent complaints / trap hits, fix any auth alignment problems, and wait for reputation to recover (typically 1-2 weeks)."
+    };
+  }
+  if (yellow.length > 0) {
+    return {
+      name: "snds",
+      label: "Microsoft SNDS",
+      severity: "warn",
+      message: `YELLOW filter on ${yellow.join(", ")}`,
+      hint: "Outlook is putting some mail from these IPs in the junk folder. Investigate recent complaint rate and trap hits before reputation slips to RED."
+    };
+  }
+  return {
+    name: "snds",
+    label: "Microsoft SNDS",
+    severity: "ok",
+    message: `${latestByIp.size} IP(s) tracked, all GREEN`
+  };
+}
+async function checkDmarc(mailer) {
+  const reportCount = await mailer.collections.dmarcReports.estimatedDocumentCount();
+  if (reportCount === 0) {
+    return {
+      name: "dmarc",
+      label: "DMARC RUA reports",
+      severity: "ok",
+      message: "no reports ingested yet",
+      hint: "Publish DMARC `rua=mailto:<your-mailbox>` in DNS, then upload received reports via /admin/mailer/api/dmarc/upload (or drag-drop in the Health screen). RUA tells you who is sending mail as your domain \u2014 both legitimate sources and spoofers."
+    };
+  }
+  const since = new Date(Date.now() - 7 * 864e5);
+  const recent = await mailer.collections.dmarcReports.find({ rangeEnd: { $gte: since } }).toArray();
+  if (recent.length === 0) {
+    return {
+      name: "dmarc",
+      label: "DMARC RUA reports",
+      severity: "warn",
+      message: `no reports in the last 7 days (${reportCount} total)`,
+      hint: "Receivers email RUA reports daily. A gap suggests inbound delivery is broken or the rua= mailbox is no longer monitored. Check inbound mail flow."
+    };
+  }
+  const tagged = await resolveSourceTags(mailer.getRunnerContext());
+  const known = new Set(Array.from(tagged.keys()));
+  const since30 = new Date(Date.now() - 30 * 864e5);
+  const failures = await mailer.collections.dmarcFailures.find({ receivedAt: { $gte: since30 } }).toArray();
+  const unknownFailing = failures.filter((f) => !known.has(f.sourceIp));
+  if (unknownFailing.length === 0) {
+    return {
+      name: "dmarc",
+      label: "DMARC RUA reports",
+      severity: "ok",
+      message: `${recent.length} report(s) this week, no failing unknown sources`
+    };
+  }
+  const totalFailing = unknownFailing.reduce((acc, f) => acc + f.count, 0);
+  const ips = Array.from(new Set(unknownFailing.map((f) => f.sourceIp))).slice(0, 3);
+  const more = unknownFailing.length > 3 ? ` (+${unknownFailing.length - 3} more)` : "";
+  return {
+    name: "dmarc",
+    label: "DMARC RUA reports",
+    severity: "warn",
+    message: `${totalFailing} failing message(s) from ${ips.join(", ")}${more}`,
+    hint: "These IPs sent mail claiming to be from your domain that failed DMARC alignment. Tag known-legit sources in mailer.config.dmarc.knownSources to silence them. Untagged sources are likely either forgotten SaaS tools or active spoofing."
   };
 }
 function checkFromDefaultsAgainstRegistry(mailer) {
@@ -3213,11 +4717,291 @@ async function checkDoiTemplate(mailer) {
     hint: "New subscriptions will silently fail to send confirmation emails. Create and publish a template with this slug, or unset requireDoubleOptIn."
   };
 }
-function humanDuration(ms) {
-  if (ms < 1e3) return `${ms}ms`;
-  if (ms < 6e4) return `${Math.round(ms / 1e3)}s`;
-  if (ms < 36e5) return `${Math.round(ms / 6e4)}m`;
-  return `${Math.round(ms / 36e5)}h`;
+function humanDuration(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  if (ms < 6e4) return `${Math.round(ms / 1e3)}s`;
+  if (ms < 36e5) return `${Math.round(ms / 6e4)}m`;
+  return `${Math.round(ms / 36e5)}h`;
+}
+
+// src/server/runner/hygiene.ts
+var DAY_MS = 864e5;
+var HYGIENE_BUCKETS = [
+  { label: "Engaged (last 30 days)", maxDays: 30 },
+  { label: "Engaged (31-60 days)", minDays: 30, maxDays: 60 },
+  { label: "Engaged (61-90 days)", minDays: 60, maxDays: 90 },
+  { label: "Engaged (91-180 days)", minDays: 90, maxDays: 180 },
+  { label: "Inactive (>180 days)", minDays: 180 },
+  { label: "Never engaged", neverEngaged: true }
+];
+async function computeListHygiene(ctx, opts = {}) {
+  const now = opts.now ?? Date.now();
+  const sunsetDays = opts.sunsetThresholdDays ?? 180;
+  const recentDays = opts.recentWindowDays ?? 90;
+  const recentCutoff = new Date(now - recentDays * DAY_MS);
+  const totalSubscribers = await ctx.collections.subscriptions.countDocuments({ status: "subscribed" });
+  const subscribedIds = /* @__PURE__ */ new Set();
+  {
+    const cursor2 = ctx.collections.subscriptions.find({ status: "subscribed" }, { projection: { externalId: 1 } });
+    for await (const s of cursor2) subscribedIds.add(s.externalId);
+  }
+  const cursor = ctx.collections.sends.aggregate(
+    [
+      {
+        $group: {
+          _id: "$externalId",
+          lastOpened: { $max: "$openedAt" },
+          lastClicked: { $max: "$firstClickAt" },
+          firstSent: { $min: "$queuedAt" },
+          totalSends: { $sum: 1 },
+          bounced: { $sum: { $cond: [{ $eq: ["$status", "bounced"] }, 1, 0] } },
+          hardBounced: {
+            $sum: {
+              $cond: [
+                { $and: [{ $eq: ["$status", "bounced"] }, { $eq: ["$bounceType", "hard"] }] },
+                1,
+                0
+              ]
+            }
+          },
+          complained: { $sum: { $cond: [{ $ne: ["$complainedAt", null] }, 1, 0] } },
+          recentSends: { $sum: { $cond: [{ $gte: ["$queuedAt", recentCutoff] }, 1, 0] } },
+          recentBounced: {
+            $sum: {
+              $cond: [
+                { $and: [{ $eq: ["$status", "bounced"] }, { $gte: ["$queuedAt", recentCutoff] }] },
+                1,
+                0
+              ]
+            }
+          },
+          recentComplained: {
+            $sum: {
+              $cond: [
+                { $and: [{ $ne: ["$complainedAt", null] }, { $gte: ["$queuedAt", recentCutoff] }] },
+                1,
+                0
+              ]
+            }
+          }
+        }
+      }
+    ],
+    { allowDiskUse: true }
+  );
+  const buckets = HYGIENE_BUCKETS.map((b) => ({
+    label: b.label,
+    minDays: "minDays" in b ? b.minDays : null,
+    maxDays: "maxDays" in b ? b.maxDays : null,
+    neverEngaged: "neverEngaged" in b && b.neverEngaged,
+    count: 0,
+    pctOfTotal: 0
+  }));
+  let totalWithSends = 0;
+  let sunsetCount = 0;
+  const cohortLifetimeAcc = { totalSends: 0, bounced: 0, hardBounced: 0, complained: 0 };
+  const cohortRecentAcc = { totalSends: 0, bounced: 0, complained: 0 };
+  for await (const row of cursor) {
+    if (!subscribedIds.has(row._id)) continue;
+    totalWithSends++;
+    const lastOpened = row.lastOpened ? new Date(row.lastOpened).getTime() : null;
+    const lastClicked = row.lastClicked ? new Date(row.lastClicked).getTime() : null;
+    const lastEngaged = lastOpened == null && lastClicked == null ? null : Math.max(lastOpened ?? 0, lastClicked ?? 0);
+    let isSunset = false;
+    if (lastEngaged == null) {
+      const firstSent = row.firstSent ? new Date(row.firstSent).getTime() : null;
+      buckets[5].count++;
+      if (firstSent != null && now - firstSent > sunsetDays * DAY_MS) {
+        isSunset = true;
+      }
+    } else {
+      const daysSince = (now - lastEngaged) / DAY_MS;
+      if (daysSince <= 30) buckets[0].count++;
+      else if (daysSince <= 60) buckets[1].count++;
+      else if (daysSince <= 90) buckets[2].count++;
+      else if (daysSince <= 180) buckets[3].count++;
+      else {
+        buckets[4].count++;
+        isSunset = true;
+      }
+    }
+    if (isSunset) {
+      sunsetCount++;
+      cohortLifetimeAcc.totalSends += row.totalSends;
+      cohortLifetimeAcc.bounced += row.bounced;
+      cohortLifetimeAcc.hardBounced += row.hardBounced;
+      cohortLifetimeAcc.complained += row.complained;
+      cohortRecentAcc.totalSends += row.recentSends;
+      cohortRecentAcc.bounced += row.recentBounced;
+      cohortRecentAcc.complained += row.recentComplained;
+    }
+  }
+  for (const b of buckets) {
+    b.pctOfTotal = totalSubscribers === 0 ? 0 : b.count / totalSubscribers;
+  }
+  const cohortLifetime = cohortLifetimeAcc.totalSends > 0 ? {
+    totalSends: cohortLifetimeAcc.totalSends,
+    bouncedRate: cohortLifetimeAcc.bounced / cohortLifetimeAcc.totalSends,
+    hardBouncedRate: cohortLifetimeAcc.hardBounced / cohortLifetimeAcc.totalSends,
+    complaintRate: cohortLifetimeAcc.complained / cohortLifetimeAcc.totalSends
+  } : null;
+  let projectedImpact = null;
+  const recentAll = await ctx.collections.sends.aggregate([
+    { $match: { queuedAt: { $gte: recentCutoff } } },
+    {
+      $group: {
+        _id: null,
+        totalSends: { $sum: 1 },
+        bounced: { $sum: { $cond: [{ $eq: ["$status", "bounced"] }, 1, 0] } },
+        complained: { $sum: { $cond: [{ $ne: ["$complainedAt", null] }, 1, 0] } }
+      }
+    }
+  ]).toArray();
+  if (recentAll[0] && recentAll[0].totalSends > 0) {
+    const all = recentAll[0];
+    const cohort = cohortRecentAcc;
+    const currentBounceRate = all.bounced / all.totalSends;
+    const currentComplaintRate = all.complained / all.totalSends;
+    const remainingSends = all.totalSends - cohort.totalSends;
+    const remainingBounces = all.bounced - cohort.bounced;
+    const remainingComplaints = all.complained - cohort.complained;
+    const projectedBounceRate = remainingSends > 0 ? remainingBounces / remainingSends : 0;
+    const projectedComplaintRate = remainingSends > 0 ? remainingComplaints / remainingSends : 0;
+    projectedImpact = {
+      recentTotalSends: all.totalSends,
+      recentBounced: all.bounced,
+      recentComplained: all.complained,
+      cohortRecentSends: cohort.totalSends,
+      cohortRecentBounced: cohort.bounced,
+      cohortRecentComplained: cohort.complained,
+      currentOverallBounceRate: currentBounceRate,
+      projectedBounceRate,
+      currentOverallComplaintRate: currentComplaintRate,
+      projectedComplaintRate
+    };
+  }
+  return {
+    totalSubscribers,
+    totalWithSends,
+    buckets,
+    sunsetCandidate: {
+      count: sunsetCount,
+      pctOfTotal: totalSubscribers === 0 ? 0 : sunsetCount / totalSubscribers,
+      cohortLifetime,
+      projectedImpact
+    },
+    computedAt: new Date(now).toISOString()
+  };
+}
+var FETCH_TIMEOUT_MS3 = 15e3;
+function createMailTesterClient(cfg, fetcher = globalThis.fetch) {
+  const base = cfg.baseUrl ?? "https://mail-tester.com/api";
+  function sanitize(s) {
+    if (!cfg.apiKey) return s;
+    return s.split(cfg.apiKey).join("<redacted>").split(encodeURIComponent(cfg.apiKey)).join("<redacted>");
+  }
+  async function call(method, path3, body) {
+    const ctl = new AbortController();
+    const t = setTimeout(() => ctl.abort(), FETCH_TIMEOUT_MS3);
+    let res;
+    try {
+      res = await fetcher(`${base}/${encodeURIComponent(cfg.apiKey)}${path3}`, {
+        method,
+        headers: { "content-type": "application/json" },
+        body: body ? JSON.stringify(body) : void 0,
+        signal: ctl.signal
+      });
+    } catch (err) {
+      throw new Error(`Mail-Tester ${method} ${sanitize(path3)} failed: ${sanitize(String(err?.message ?? err))}`);
+    } finally {
+      clearTimeout(t);
+    }
+    if (!res.ok) {
+      const text = await safeText3(res);
+      throw new Error(`Mail-Tester ${method} ${sanitize(path3)} \u2192 ${res.status}: ${sanitize(text)}`);
+    }
+    return res.json();
+  }
+  return {
+    async provisionCheck() {
+      const data = await call("POST", "/new");
+      const checkId = String(data.check_id ?? data.checkId ?? "");
+      const emailAddress = String(data.email_address ?? data.email ?? "");
+      if (!checkId || !emailAddress) throw new Error("Mail-Tester /new returned an unexpected shape");
+      return { checkId, emailAddress };
+    },
+    async fetchResult(checkId) {
+      const data = await call("GET", `/${encodeURIComponent(checkId)}`);
+      const ready = Boolean(data.ready ?? data.complete ?? data.score != null);
+      const scoreRaw = Number(data.score);
+      const score = Number.isFinite(scoreRaw) ? scoreRaw : 0;
+      const feedback = Array.isArray(data.feedback) ? data.feedback.map(normalizeFeedback) : [];
+      const rawSummary = typeof data.summary === "string" ? data.summary : null;
+      return { ready: ready && Number.isFinite(scoreRaw), score, feedback, rawSummary };
+    }
+  };
+}
+function normalizeFeedback(raw) {
+  const severity = String(raw.severity ?? "info").toLowerCase();
+  return {
+    category: String(raw.category ?? "other"),
+    severity: severity === "error" || severity === "warning" || severity === "info" ? severity : "info",
+    message: String(raw.message ?? "")
+  };
+}
+async function safeText3(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "<no body>";
+  }
+}
+function mailTesterContentKey(input) {
+  return crypto2.createHash("sha256").update(`${input.bodyHash}|${input.subject}|${input.fromEmail}`).digest("hex");
+}
+async function findCachedScore(ctx, contentKey) {
+  const doc = await ctx.collections.mailTesterScores.findOne({ contentKey });
+  if (!doc) return null;
+  if (new Date(doc.expiresAt).getTime() < Date.now()) return null;
+  return doc;
+}
+async function persistScore(ctx, input) {
+  const cfg = ctx.config.mailTester;
+  const hours = cfg?.cacheHours ?? 24;
+  const now = /* @__PURE__ */ new Date();
+  const expiresAt = new Date(now.getTime() + hours * 60 * 60 * 1e3);
+  const doc = {
+    templateSlug: input.templateSlug,
+    contentKey: input.contentKey,
+    checkId: input.checkId,
+    score: input.result.score,
+    feedback: input.result.feedback,
+    rawSummary: input.result.rawSummary,
+    fetchedAt: now,
+    expiresAt
+  };
+  await ctx.collections.mailTesterScores.updateOne(
+    { contentKey: input.contentKey },
+    { $set: doc },
+    { upsert: true }
+  );
+  return doc;
+}
+async function evaluateMailTesterGate(ctx, input) {
+  const cfg = ctx.config.mailTester;
+  if (!cfg?.apiKey) return { allowed: true, reason: null, score: null };
+  const minScore = cfg.minScore ?? 8;
+  const key = mailTesterContentKey(input);
+  const cached = await findCachedScore(ctx, key);
+  if (!cached) return { allowed: true, reason: null, score: null };
+  if (cached.score < minScore) {
+    return {
+      allowed: false,
+      reason: `Mail-Tester score ${cached.score.toFixed(1)} is below minimum ${minScore.toFixed(1)}`,
+      score: cached
+    };
+  }
+  return { allowed: true, reason: null, score: cached };
 }
 
 // src/server/api/admin.ts
@@ -3243,35 +5027,41 @@ function createAdminRouter(mailer, opts = {}) {
     req.actor = getActor(req);
     next();
   });
-  router.use("/api", apiRouter(mailer));
+  router.use("/api", apiRouter(mailer, opts));
   router.get(/.*/, (_req, res) => {
     res.sendFile(path.join(spaDir, "index.html"));
   });
   return router;
 }
-function apiRouter(mailer) {
+function apiRouter(mailer, opts = {}) {
   const r = Router();
   const c = mailer.collections;
+  function getMailTesterClient() {
+    if (opts.mailTesterClient) return opts.mailTesterClient;
+    const cfg = mailer.config.mailTester;
+    if (!cfg?.apiKey) return null;
+    return createMailTesterClient(cfg);
+  }
   r.get(
     "/me",
     asyncHandler(async (req, res) => {
-      const [flows, templates, broadcasts, contacts, suppressions, health] = await Promise.all([
+      const [flows, templates, broadcasts, contacts, suppressions, healthDocs] = await Promise.all([
         c.flows.estimatedDocumentCount(),
         c.templates.estimatedDocumentCount(),
         c.broadcasts.estimatedDocumentCount(),
         c.subscriptions.countDocuments({ status: "subscribed" }),
         c.suppressions.estimatedDocumentCount(),
-        c.health.findOne({ _id: "singleton" })
+        c.health.find({}).limit(500).toArray()
       ]);
       res.json({
         actor: req.actor,
-        permissions: { canPublish: true, canSendBroadcasts: true, canManageSuppressions: true },
         counts: { flows, templates, broadcasts, contacts, suppressions },
-        health: { status: health?.status ?? "healthy" },
+        health: { status: effectiveOverallStatus(healthDocs) },
         providers: {
           names: Object.keys(mailer.config.providers),
           default: mailer.config.defaultProvider
-        }
+        },
+        broadcastConfirmationThreshold: mailer.config.broadcastConfirmationThreshold
       });
     })
   );
@@ -3333,8 +5123,11 @@ function apiRouter(mailer) {
         if (prevD === 0 || curD === 0) return null;
         return curN / curD - prevN / prevD;
       };
-      const health = await c.health.findOne({ _id: "singleton" });
-      const recentFlows = await c.flows.find({ enabled: true }).limit(5).toArray();
+      const healthDocs = await c.health.find({}).limit(500).toArray();
+      const healthAgg = healthDocs.find((d) => d._id === HEALTH_AGG_ID) ?? null;
+      const recentFlowsRaw = await c.flows.find({ enabled: true }).limit(5).toArray();
+      const flowStatsMap = await computeFlowStats(mailer);
+      const recentFlows = recentFlowsRaw.map((f) => ({ ...f, stats: flowStatsMap.get(f.slug) ?? emptyFlowStats() }));
       const recentSends = await c.sends.find().sort({ queuedAt: -1 }).limit(6).toArray();
       const recentAudit = await c.auditLog.find().sort({ occurredAt: -1 }).limit(5).toArray();
       const queueCounts = await collectQueueCounts(mailer);
@@ -3351,8 +5144,7 @@ function apiRouter(mailer) {
           },
           openRate: {
             value: sentTotal === 0 ? null : openedCount / sentTotal,
-            delta: rateDelta(openedCount, sentTotal, openedPrev, sentPrev),
-            exclBots: false
+            delta: rateDelta(openedCount, sentTotal, openedPrev, sentPrev)
           },
           clickRate: {
             value: sentTotal === 0 ? null : clickedCount / sentTotal,
@@ -3360,7 +5152,16 @@ function apiRouter(mailer) {
           }
         },
         series: { hourly: { sends: sendSeries, opens: openSeries } },
-        health: health ? { status: health.status, rates: health.rates } : { status: "healthy", rates: { hardBounceRate: 0, complaintRate: 0, combinedBounceRate: 0, failureRate: 0 } },
+        health: {
+          status: effectiveOverallStatus(healthDocs),
+          rates: healthAgg?.rates ?? null,
+          thresholds: {
+            hardBounceRatePctTrip: mailer.config.circuitBreaker.hardBounceRatePctTrip,
+            complaintRatePctTrip: mailer.config.circuitBreaker.complaintRatePctTrip,
+            combinedBounceRatePctTrip: mailer.config.circuitBreaker.combinedBounceRatePctTrip,
+            failedToSendRatePctDegrade: mailer.config.circuitBreaker.failedToSendRatePctDegrade
+          }
+        },
         queue: {
           inFlight: queueCounts?.inFlight ?? null,
           delayed: queueCounts?.delayed ?? null,
@@ -3373,11 +5174,25 @@ function apiRouter(mailer) {
       });
     })
   );
+  r.get(
+    "/events",
+    asyncHandler(async (_req, res) => {
+      const registered = mailer.events.list();
+      const seenNames = await c.events.distinct("name");
+      const known = new Set(registered.map((r2) => r2.name));
+      const unregistered = seenNames.filter((n) => n && !known.has(n));
+      res.json({
+        registered: registered.sort((a, b) => a.name.localeCompare(b.name)),
+        seen: unregistered.sort()
+      });
+    })
+  );
   r.get(
     "/flows",
     asyncHandler(async (_req, res) => {
       const flows = await c.flows.find().sort({ updatedAt: -1 }).toArray();
-      res.json(flows);
+      const stats = await computeFlowStats(mailer);
+      res.json(flows.map((f) => ({ ...f, stats: stats.get(f.slug) ?? emptyFlowStats() })));
     })
   );
   r.get(
@@ -3385,7 +5200,8 @@ function apiRouter(mailer) {
     asyncHandler(async (req, res) => {
       const flow = await c.flows.findOne({ slug: req.params.slug });
       if (!flow) return res.status(404).json({ error: "not_found" });
-      return res.json(flow);
+      const stats = (await computeFlowStats(mailer, flow.slug)).get(flow.slug) ?? emptyFlowStats();
+      return res.json({ ...flow, stats });
     })
   );
   r.post(
@@ -3420,7 +5236,8 @@ function apiRouter(mailer) {
     "/templates",
     asyncHandler(async (_req, res) => {
       const templates = await c.templates.find().sort({ updatedAt: -1 }).toArray();
-      res.json(templates);
+      const stats = await computeTemplateStats(mailer);
+      res.json(templates.map((t) => ({ ...t, stats: stats.get(t.slug) ?? emptyTemplateStats() })));
     })
   );
   r.get(
@@ -3428,14 +5245,16 @@ function apiRouter(mailer) {
     asyncHandler(async (req, res) => {
       const template = await c.templates.findOne({ slug: req.params.slug });
       if (!template) return res.status(404).json({ error: "not_found" });
-      return res.json(template);
+      const stats = (await computeTemplateStats(mailer, template.slug)).get(template.slug) ?? emptyTemplateStats();
+      return res.json({ ...template, stats });
     })
   );
   r.get(
     "/broadcasts",
     asyncHandler(async (_req, res) => {
       const broadcasts = await c.broadcasts.find().sort({ createdAt: -1 }).toArray();
-      res.json(broadcasts);
+      const stats = await computeBroadcastStats(mailer);
+      res.json(broadcasts.map((b) => ({ ...b, stats: stats.get(String(b._id)) ?? emptyBroadcastStats() })));
     })
   );
   r.get(
@@ -3443,7 +5262,8 @@ function apiRouter(mailer) {
     asyncHandler(async (req, res) => {
       const broadcast = await c.broadcasts.findOne({ slug: req.params.slug });
       if (!broadcast) return res.status(404).json({ error: "not_found" });
-      return res.json(broadcast);
+      const stats = (await computeBroadcastStats(mailer, broadcast._id)).get(String(broadcast._id)) ?? emptyBroadcastStats();
+      return res.json({ ...broadcast, stats });
     })
   );
   r.get(
@@ -3451,8 +5271,20 @@ function apiRouter(mailer) {
     asyncHandler(async (req, res) => {
       const cursor = typeof req.query.cursor === "string" ? req.query.cursor : void 0;
       const limit = Math.min(Number(req.query.limit ?? 50), 200);
-      const { contacts, nextCursor } = await mailer.adapter.query({}, { limit, cursor });
-      res.json({ contacts, nextCursor });
+      const [{ contacts, nextCursor }, counts] = await Promise.all([
+        mailer.adapter.query({}, { limit, cursor }),
+        (async () => {
+          const rows = await c.subscriptions.aggregate([{ $group: { _id: "$status", n: { $sum: 1 } } }]).toArray();
+          const out = { subscribed: 0, pending_doi: 0, unsubscribed: 0, bounced: 0, complained: 0 };
+          let total = 0;
+          for (const r2 of rows) {
+            if (r2._id) out[r2._id] = r2.n;
+            total += r2.n;
+          }
+          return { ...out, total };
+        })()
+      ]);
+      res.json({ contacts, nextCursor, counts });
     })
   );
   r.get(
@@ -3464,7 +5296,7 @@ function apiRouter(mailer) {
         c.subscriptions.findOne({ externalId }),
         c.events.find({ externalId }).sort({ occurredAt: -1 }).limit(50).toArray(),
         c.sends.find({ externalId }).sort({ queuedAt: -1 }).limit(50).toArray(),
-        c.flowRuns.find({ externalId, status: "active" }).toArray()
+        c.flowRuns.find({ externalId, status: "active" }).sort({ nextActionAt: 1 }).limit(50).toArray()
       ]);
       if (!contact) return res.status(404).json({ error: "not_found" });
       return res.json({ contact, subscription, recentEvents, recentSends, activeRuns });
@@ -3488,7 +5320,7 @@ function apiRouter(mailer) {
       if (!ObjectId.isValid(id)) return res.status(400).json({ error: "bad_id" });
       const send = await c.sends.findOne({ _id: new ObjectId(id) });
       if (!send) return res.status(404).json({ error: "not_found" });
-      const events = send.providerMessageId ? await c.webhookEvents.find({ providerMessageId: send.providerMessageId }).toArray() : [];
+      const events = send.providerMessageId ? await c.webhookEvents.find({ providerMessageId: send.providerMessageId }).sort({ receivedAt: -1 }).limit(100).toArray() : [];
       return res.json({ send, webhookEvents: events });
     })
   );
@@ -3530,17 +5362,29 @@ function apiRouter(mailer) {
   r.get(
     "/health",
     asyncHandler(async (_req, res) => {
-      const h = await c.health.findOne({ _id: "singleton" });
-      res.json(
-        h ?? {
-          _id: "singleton",
-          status: "healthy",
-          windowStartedAt: new Date(Date.now() - 60 * 60 * 1e3),
-          windowDurationMs: 60 * 60 * 1e3,
-          counters: { sent: 0, delivered: 0, bounced: 0, hardBounced: 0, softBounced: 0, complained: 0, failedToSend: 0 },
-          rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 }
-        }
-      );
+      const cb = mailer.config.circuitBreaker;
+      const thresholds = {
+        hardBounceRatePctTrip: cb.hardBounceRatePctTrip,
+        complaintRatePctTrip: cb.complaintRatePctTrip,
+        combinedBounceRatePctTrip: cb.combinedBounceRatePctTrip,
+        failedToSendRatePctDegrade: cb.failedToSendRatePctDegrade
+      };
+      const docs = await c.health.find({}).limit(500).toArray();
+      const aggregate = docs.find((d) => d._id === HEALTH_AGG_ID) ?? null;
+      const buckets = docs.filter((d) => d._id !== HEALTH_AGG_ID);
+      const overall = effectiveOverallStatus(docs);
+      if (docs.length === 0) {
+        res.json({ status: null, rates: null, counters: null, aggregate: null, buckets: [], thresholds });
+        return;
+      }
+      res.json({
+        status: overall,
+        rates: aggregate?.rates ?? null,
+        counters: aggregate?.counters ?? null,
+        aggregate,
+        buckets,
+        thresholds
+      });
     })
   );
   r.get(
@@ -3553,18 +5397,330 @@ function apiRouter(mailer) {
   r.post(
     "/health/resume",
     asyncHandler(async (req, res) => {
-      await c.health.updateOne(
-        { _id: "singleton" },
+      const body = req.body ?? {};
+      if (body.senderDomain != null !== (body.kind != null)) {
+        return res.status(400).json({
+          error: "validation_failed",
+          message: "senderDomain and kind must both be provided to target a single bucket, or both omitted to resume all tripped buckets."
+        });
+      }
+      if (body.kind && !["marketing", "transactional"].includes(body.kind)) {
+        return res.status(400).json({ error: "validation_failed", message: 'kind must be "marketing" or "transactional"' });
+      }
+      const target = body.senderDomain && body.kind ? { _id: healthBucketId(body.senderDomain.toLowerCase(), body.kind) } : { status: "tripped", _id: { $ne: HEALTH_AGG_ID } };
+      const result = await c.health.updateMany(
+        target,
         { $set: { status: "healthy", manuallyResumedAt: /* @__PURE__ */ new Date(), updatedAt: /* @__PURE__ */ new Date() } }
       );
       await mailer.audit({
         actor: req.actor,
         action: "health.resume",
-        resource: { collection: "mailer_health" }
+        resource: {
+          collection: "mailer_health",
+          id: body.senderDomain && body.kind ? `${body.senderDomain}|${body.kind}` : "all-tripped"
+        }
+      });
+      res.json({ ok: true, resumed: result.modifiedCount });
+    })
+  );
+  r.get(
+    "/dnsbl",
+    asyncHandler(async (_req, res) => {
+      const checks = await c.dnsblChecks.find({}).sort({ result: 1, target: 1, list: 1 }).limit(500).toArray();
+      const latestRunAt = checks.reduce((acc, d) => {
+        const t = new Date(d.runAt);
+        return acc && acc.getTime() >= t.getTime() ? acc : t;
+      }, null);
+      res.json({
+        checks,
+        latestRunAt: latestRunAt ? latestRunAt.toISOString() : null,
+        intervalHours: mailer.config.dnsbl?.intervalHours ?? 24
+      });
+    })
+  );
+  r.post(
+    "/dnsbl/recheck",
+    asyncHandler(async (req, res) => {
+      const result = await runDnsblChecks(mailer.getRunnerContext(), { force: true });
+      await mailer.audit({
+        actor: req.actor,
+        action: "dnsbl.recheck",
+        resource: { collection: "mailer_dnsbl_checks" },
+        diffSummary: result.ran ? `${result.totalChecks} checks, ${result.listedCount} listed` : `not run: ${result.reason}`
+      });
+      res.json(result);
+    })
+  );
+  r.get(
+    "/postmaster",
+    asyncHandler(async (_req, res) => {
+      const cfg = mailer.config.postmaster;
+      const configured = !!cfg?.clientId && !!cfg?.clientSecret && !!cfg?.refreshToken;
+      const all = await c.postmasterSnapshots.find({}).sort({ domain: 1, date: -1 }).limit(2e3).toArray();
+      const byDomain = /* @__PURE__ */ new Map();
+      for (const s of all) {
+        const arr = byDomain.get(s.domain) ?? [];
+        if (arr.length < 30) arr.push(s);
+        byDomain.set(s.domain, arr);
+      }
+      const domains = Array.from(byDomain.entries()).map(([domain, snapshots]) => ({
+        domain,
+        latest: snapshots[0] ?? null,
+        history: snapshots
+      }));
+      res.json({
+        configured,
+        intervalHours: cfg?.intervalHours ?? 24,
+        domains
+      });
+    })
+  );
+  r.post(
+    "/postmaster/refresh",
+    asyncHandler(async (req, res) => {
+      const result = await runPostmasterPull(mailer.getRunnerContext(), { force: true });
+      await mailer.audit({
+        actor: req.actor,
+        action: "postmaster.refresh",
+        resource: { collection: "mailer_postmaster_snapshots" },
+        diffSummary: result.ran ? `fetched ${result.fetched ?? 0}, tripped ${(result.trippedDomains ?? []).length}` : `not run: ${result.reason}`
+      });
+      res.json(result);
+    })
+  );
+  let hygieneCache = null;
+  let hygieneInFlight = null;
+  const HYGIENE_CACHE_MS = 6e4;
+  r.get(
+    "/hygiene",
+    asyncHandler(async (req, res) => {
+      const force = req.query.refresh === "1" || req.query.refresh === "true";
+      const now = Date.now();
+      if (!force && hygieneCache && now - hygieneCache.computedAt < HYGIENE_CACHE_MS) {
+        return res.json(hygieneCache.report);
+      }
+      if (!hygieneInFlight) {
+        hygieneInFlight = (async () => {
+          try {
+            const report2 = await computeListHygiene(mailer.getRunnerContext());
+            hygieneCache = { computedAt: Date.now(), report: report2 };
+            return report2;
+          } finally {
+            hygieneInFlight = null;
+          }
+        })();
+      }
+      const report = await hygieneInFlight;
+      res.json(report);
+    })
+  );
+  const dmarcUpload = multer({
+    storage: multer.memoryStorage(),
+    limits: { fileSize: 10 * 1024 * 1024 }
+    // 10 MB; reports are typically <100KB
+  });
+  r.post(
+    "/dmarc/upload",
+    dmarcUpload.single("file"),
+    asyncHandler(async (req, res) => {
+      const file = req.file;
+      if (!file) return res.status(400).json({ error: "no_file", message: 'expected a "file" field' });
+      try {
+        const result = await ingestDmarcAttachment(mailer.getRunnerContext(), file.buffer, file.originalname);
+        await mailer.audit({
+          actor: req.actor,
+          action: "dmarc.ingest",
+          resource: { collection: "mailer_dmarc_reports", id: result.reportId },
+          diffSummary: result.duplicate ? `duplicate report ${result.reportId}` : `ingested ${result.totalMessages} msgs (${result.passCount} pass / ${result.failCount} fail) for ${result.domain}`
+        });
+        return res.json(result);
+      } catch (err) {
+        return res.status(400).json({ error: "ingest_failed", message: String(err?.message ?? err) });
+      }
+    })
+  );
+  r.get(
+    "/dmarc",
+    asyncHandler(async (_req, res) => {
+      const ctx = mailer.getRunnerContext();
+      const tagged = await resolveSourceTags(ctx);
+      const reports = await c.dmarcReports.find({}).sort({ rangeEnd: -1 }).limit(200).toArray();
+      const since30 = new Date(Date.now() - 30 * 864e5);
+      const recentFailures = await c.dmarcFailures.find({ receivedAt: { $gte: since30 } }).sort({ receivedAt: -1 }).limit(5e3).toArray();
+      const byDomain = /* @__PURE__ */ new Map();
+      for (const r2 of reports) {
+        const cur = byDomain.get(r2.domain) ?? { passCount: 0, failCount: 0, totalMessages: 0, reportCount: 0, latestRangeEnd: null, latestPolicy: null, latestPct: null, reports: [] };
+        cur.passCount += r2.passCount;
+        cur.failCount += r2.failCount;
+        cur.totalMessages += r2.totalMessages;
+        cur.reportCount += 1;
+        const re = new Date(r2.rangeEnd);
+        if (!cur.latestRangeEnd || re > cur.latestRangeEnd) {
+          cur.latestRangeEnd = re;
+          cur.latestPolicy = r2.policyP;
+          cur.latestPct = r2.policyPct;
+        }
+        cur.reports.push(r2);
+        byDomain.set(r2.domain, cur);
+      }
+      const since14 = Date.now() - 14 * 864e5;
+      const domains = Array.from(byDomain.entries()).map(([domain, s]) => {
+        const dayTotals = /* @__PURE__ */ new Map();
+        for (const r2 of s.reports) {
+          if (new Date(r2.rangeEnd).getTime() < since14) continue;
+          const day = new Date(r2.rangeEnd).toISOString().slice(0, 10);
+          const d = dayTotals.get(day) ?? { pass: 0, total: 0 };
+          d.pass += r2.passCount;
+          d.total += r2.passCount + r2.failCount;
+          dayTotals.set(day, d);
+        }
+        const series = Array.from(dayTotals.entries()).sort((a, b) => a[0].localeCompare(b[0])).map(([day, d]) => ({ day, alignmentRate: d.total === 0 ? null : d.pass / d.total }));
+        const knownIps = new Set(Array.from(tagged.values()).filter((t) => !t.ignored).map((t) => t.ip));
+        const ignoredIps = new Set(Array.from(tagged.values()).filter((t) => t.ignored).map((t) => t.ip));
+        const suggested = suggestPolicyProgression({
+          reports: s.reports.map((r2) => ({ rangeEnd: new Date(r2.rangeEnd), passCount: r2.passCount, failCount: r2.failCount })),
+          failures: recentFailures.filter((f) => f.domain === domain).map((f) => ({ sourceIp: f.sourceIp, count: f.count, receivedAt: new Date(f.receivedAt) })),
+          knownSourceIps: knownIps,
+          ignoredSourceIps: ignoredIps,
+          currentPolicy: s.latestPolicy,
+          currentPct: s.latestPct
+        });
+        return {
+          domain,
+          passCount: s.passCount,
+          failCount: s.failCount,
+          totalMessages: s.totalMessages,
+          reportCount: s.reportCount,
+          latestRangeEnd: s.latestRangeEnd,
+          alignmentRate: s.totalMessages === 0 ? null : s.passCount / s.totalMessages,
+          currentPolicy: s.latestPolicy,
+          currentPct: s.latestPct,
+          progression: suggested ? { ...suggested, current: { policy: s.latestPolicy, pct: s.latestPct } } : null,
+          series
+        };
+      });
+      const topFailures = await c.dmarcFailures.aggregate([
+        { $match: { receivedAt: { $gte: since30 } } },
+        {
+          $group: {
+            _id: { sourceIp: "$sourceIp", domain: "$domain" },
+            total: { $sum: "$count" },
+            days: { $addToSet: "$day" },
+            lastSeen: { $max: "$receivedAt" },
+            sample: { $first: "$$ROOT" }
+          }
+        },
+        { $project: { sourceIp: "$_id.sourceIp", domain: "$_id.domain", total: 1, days: { $size: "$days" }, lastSeen: 1, sample: 1 } },
+        { $sort: { total: -1 } },
+        { $limit: 50 }
+      ]).toArray();
+      const sources = topFailures.map((f) => {
+        const tag = tagged.get(f._id.sourceIp);
+        return {
+          sourceIp: f._id.sourceIp,
+          domain: f._id.domain,
+          totalMessages: f.total,
+          daysSeen: f.days,
+          lastSeen: f.lastSeen,
+          dkimResult: f.sample.dkimResult,
+          spfResult: f.sample.spfResult,
+          dispositionApplied: f.sample.dispositionApplied,
+          label: tag?.label ?? null,
+          ignored: !!tag?.ignored,
+          tagSource: tag?.source ?? null
+        };
+      });
+      res.json({
+        domains,
+        sources,
+        recentReports: reports.slice(0, 30),
+        retentionDays: mailer.config.dmarc?.retentionDays ?? 90
+      });
+    })
+  );
+  r.put(
+    "/dmarc/sources/:ip",
+    asyncHandler(async (req, res) => {
+      const ip = String(req.params.ip ?? "");
+      if (!net.isIP(ip)) {
+        return res.status(400).json({ error: "validation_failed", message: "invalid IP" });
+      }
+      const body = req.body ?? {};
+      if (!body.label || typeof body.label !== "string") {
+        return res.status(400).json({ error: "validation_failed", message: "label is required" });
+      }
+      const label = body.label.trim().slice(0, 200);
+      if (!label) {
+        return res.status(400).json({ error: "validation_failed", message: "label is required" });
+      }
+      const ignored = !!body.ignored;
+      await c.dmarcSourceTags.updateOne(
+        { ip },
+        { $set: { ip, label, ignored, setBy: req.actor ?? "unknown", setAt: /* @__PURE__ */ new Date() } },
+        { upsert: true }
+      );
+      await mailer.audit({
+        actor: req.actor,
+        action: "dmarc.source_tag.upsert",
+        resource: { collection: "mailer_dmarc_source_tags", id: ip },
+        diffSummary: `${ip} \u2192 "${label}"${ignored ? " (ignored)" : ""}`
       });
       res.json({ ok: true });
     })
   );
+  r.delete(
+    "/dmarc/sources/:ip",
+    asyncHandler(async (req, res) => {
+      const ip = String(req.params.ip ?? "");
+      if (!net.isIP(ip)) {
+        return res.status(400).json({ error: "validation_failed", message: "invalid IP" });
+      }
+      const result = await c.dmarcSourceTags.deleteOne({ ip });
+      await mailer.audit({
+        actor: req.actor,
+        action: "dmarc.source_tag.delete",
+        resource: { collection: "mailer_dmarc_source_tags", id: ip }
+      });
+      res.json({ ok: true, deleted: result.deletedCount });
+    })
+  );
+  r.get(
+    "/snds",
+    asyncHandler(async (_req, res) => {
+      const cfg = mailer.config.snds;
+      const configured = !!cfg?.accessKey;
+      const all = await c.sndsSnapshots.find({}).sort({ ip: 1, activityStart: -1 }).limit(2e3).toArray();
+      const byIp = /* @__PURE__ */ new Map();
+      for (const s of all) {
+        const arr = byIp.get(s.ip) ?? [];
+        if (arr.length < 30) arr.push(s);
+        byIp.set(s.ip, arr);
+      }
+      const ips = Array.from(byIp.entries()).map(([ip, snapshots]) => ({
+        ip,
+        latest: snapshots[0] ?? null,
+        history: snapshots
+      }));
+      res.json({
+        configured,
+        intervalHours: cfg?.intervalHours ?? 24,
+        ips
+      });
+    })
+  );
+  r.post(
+    "/snds/refresh",
+    asyncHandler(async (req, res) => {
+      const result = await runSndsPull(mailer.getRunnerContext(), { force: true });
+      await mailer.audit({
+        actor: req.actor,
+        action: "snds.refresh",
+        resource: { collection: "mailer_snds_snapshots" },
+        diffSummary: result.ran ? `parsed ${result.rowsParsed ?? 0}, persisted ${result.rowsPersisted ?? 0}` : `not run: ${result.reason}`
+      });
+      res.json(result);
+    })
+  );
   r.post(
     "/flows",
     asyncHandler(async (req, res) => {
@@ -3805,6 +5961,180 @@ function apiRouter(mailer) {
       return res.json({ ok: true });
     })
   );
+  r.get(
+    "/templates/:slug/mail-tester",
+    asyncHandler(async (req, res) => {
+      const cfg = mailer.config.mailTester;
+      const configured = !!cfg?.apiKey;
+      const tpl = await c.templates.findOne({ slug: req.params.slug });
+      if (!tpl) return res.status(404).json({ error: "not_found" });
+      let bodyHash = "";
+      let subject = tpl.subject ?? "";
+      if (tpl.draft) {
+        try {
+          const compiled = tpl.draft.editorJson ? await compileMailyTemplate(tpl.draft.editorJson) : tpl.draft.mjml ? await compileTemplate(tpl.draft.mjml) : null;
+          if (compiled) {
+            bodyHash = sha256Hex(compiled.html);
+            subject = tpl.draft.subject || subject;
+          }
+        } catch {
+        }
+      }
+      if (!bodyHash && tpl.body?.html) {
+        bodyHash = sha256Hex(tpl.body.html);
+      }
+      const key = bodyHash ? mailTesterContentKey({ bodyHash, subject, fromEmail: tpl.fromEmail }) : null;
+      const cached = key ? await findCachedScore(mailer.getRunnerContext(), key) : null;
+      res.json({
+        configured,
+        minScore: cfg?.minScore ?? 8,
+        cacheHours: cfg?.cacheHours ?? 24,
+        score: cached
+      });
+    })
+  );
+  r.post(
+    "/templates/:slug/mail-tester-check",
+    asyncHandler(async (req, res) => {
+      const client = getMailTesterClient();
+      if (!client) {
+        return res.status(400).json({
+          error: "not_configured",
+          message: "Mail-Tester is not configured. Set mailer.config.mailTester.apiKey to enable."
+        });
+      }
+      const tpl = await c.templates.findOne({ slug: req.params.slug });
+      if (!tpl) return res.status(404).json({ error: "not_found" });
+      const draft = tpl.draft;
+      if (!draft) return res.status(400).json({ error: "no_draft", message: "Save a draft before running a deliverability check." });
+      let compiled;
+      try {
+        if (draft.editorJson) compiled = await compileMailyTemplate(draft.editorJson);
+        else if (draft.mjml) compiled = await compileTemplate(draft.mjml);
+        else return res.status(400).json({ error: "empty_draft" });
+      } catch (err) {
+        return res.status(400).json({ error: "compile_failed", message: String(err?.message ?? err) });
+      }
+      const bodyHash = sha256Hex(compiled.html);
+      const contentKey = mailTesterContentKey({ bodyHash, subject: draft.subject, fromEmail: tpl.fromEmail });
+      const ctx = mailer.getRunnerContext();
+      const cached = await findCachedScore(ctx, contentKey);
+      if (cached) {
+        return res.json({ cached: true, status: "ready", score: cached });
+      }
+      const { checkId, emailAddress } = await client.provisionCheck();
+      const provider = mailer.providers[tpl.providerOverride ?? mailer.config.defaultProvider];
+      if (!provider) {
+        return res.status(500).json({ error: "provider_unknown", message: `default provider ${mailer.config.defaultProvider} is not registered` });
+      }
+      try {
+        await provider.send({
+          to: emailAddress,
+          fromName: tpl.fromName,
+          fromEmail: tpl.fromEmail,
+          replyTo: tpl.replyTo ?? void 0,
+          subject: draft.subject,
+          html: compiled.html,
+          text: compiled.plainText,
+          headers: {},
+          messageMeta: { mailTesterCheckId: checkId }
+        });
+      } catch (err) {
+        return res.status(502).json({ error: "send_failed", message: String(err?.message ?? err) });
+      }
+      await mailer.audit({
+        actor: req.actor,
+        action: "mail_tester.check.start",
+        resource: { collection: "mailer_mail_tester_scores", id: contentKey, slug: tpl.slug },
+        diffSummary: `Sent draft to ${emailAddress} for Mail-Tester check ${checkId}`
+      });
+      res.json({
+        cached: false,
+        status: "pending",
+        checkId,
+        contentKey,
+        message: "Test email sent. Poll /mail-tester-result?checkId=...&contentKey=... for the score."
+      });
+    })
+  );
+  r.get(
+    "/templates/:slug/mail-tester-result",
+    asyncHandler(async (req, res) => {
+      const client = getMailTesterClient();
+      if (!client) return res.status(400).json({ error: "not_configured" });
+      const checkId = String(req.query.checkId ?? "");
+      if (!checkId) return res.status(400).json({ error: "validation_failed", message: "checkId is required" });
+      const tpl = await c.templates.findOne({ slug: req.params.slug });
+      if (!tpl) return res.status(404).json({ error: "not_found" });
+      const draft = tpl.draft;
+      if (!draft) return res.status(400).json({ error: "no_draft", message: "Draft no longer exists." });
+      let compiled;
+      try {
+        if (draft.editorJson) compiled = await compileMailyTemplate(draft.editorJson);
+        else if (draft.mjml) compiled = await compileTemplate(draft.mjml);
+        else return res.status(400).json({ error: "empty_draft" });
+      } catch (err) {
+        return res.status(400).json({ error: "compile_failed", message: String(err?.message ?? err) });
+      }
+      const contentKey = mailTesterContentKey({
+        bodyHash: sha256Hex(compiled.html),
+        subject: draft.subject,
+        fromEmail: tpl.fromEmail
+      });
+      const result = await client.fetchResult(checkId);
+      if (!result.ready) {
+        return res.json({ status: "pending", score: null });
+      }
+      const ctx = mailer.getRunnerContext();
+      const persisted = await persistScore(ctx, { templateSlug: tpl.slug, contentKey, checkId, result });
+      await mailer.audit({
+        actor: req.actor,
+        action: "mail_tester.check.complete",
+        resource: { collection: "mailer_mail_tester_scores", id: contentKey, slug: tpl.slug },
+        diffSummary: `Score ${result.score.toFixed(1)}`
+      });
+      res.json({ status: "ready", score: persisted });
+    })
+  );
+  r.post(
+    "/templates/:slug/lint",
+    asyncHandler(async (req, res) => {
+      const tpl = await c.templates.findOne({ slug: req.params.slug });
+      if (!tpl) return res.status(404).json({ error: "not_found" });
+      const body = req.body ?? {};
+      const subject = body.subject ?? tpl.draft?.subject ?? tpl.subject ?? "";
+      const preheader = body.preheader ?? tpl.draft?.preheader ?? tpl.preheader ?? "";
+      const mjml = body.mjml ?? tpl.draft?.mjml ?? tpl.body?.mjml ?? "";
+      const editorJson = body.editorJson !== void 0 ? body.editorJson : tpl.draft?.editorJson ?? tpl.body?.editorJson ?? null;
+      const fromEmail = body.fromEmail ?? tpl.fromEmail;
+      const kind = body.kind === "marketing" || body.kind === "transactional" ? body.kind : tpl.kind;
+      let html = "";
+      let plainText = "";
+      try {
+        if (editorJson) {
+          const compiled = await compileMailyTemplate(editorJson);
+          html = compiled.html;
+          plainText = compiled.plainText;
+        } else if (mjml) {
+          const compiled = await compileTemplate(mjml);
+          html = compiled.html;
+          plainText = compiled.plainText;
+        }
+      } catch (err) {
+        return res.status(200).json({
+          errors: [{ rule: "compile_failed", severity: "error", message: `Compile error: ${String(err?.message ?? err)}` }],
+          warnings: [],
+          infos: [],
+          compileFailed: true
+        });
+      }
+      const lint = lintTemplate(
+        { subject, preheader, mjml, editorJson, html, plainText, kind, fromEmail },
+        { senderDomains: mailer.config.senderDomains }
+      );
+      res.json({ ...lint, compileFailed: false });
+    })
+  );
   r.post(
     "/templates/:slug/publish",
     asyncHandler(async (req, res) => {
@@ -3821,12 +6151,60 @@ function apiRouter(mailer) {
         });
       }
       let compiled;
-      if (draft.editorJson) {
-        compiled = await compileMailyTemplate(draft.editorJson);
-      } else if (draft.mjml) {
-        compiled = await compileTemplate(draft.mjml);
-      } else {
-        return res.status(400).json({ error: "empty_draft", message: "draft has no MJML or editorJson content" });
+      try {
+        if (draft.editorJson) {
+          compiled = await compileMailyTemplate(draft.editorJson);
+        } else if (draft.mjml) {
+          compiled = await compileTemplate(draft.mjml);
+        } else {
+          return res.status(400).json({ error: "empty_draft", message: "draft has no MJML or editorJson content" });
+        }
+      } catch (err) {
+        return res.status(422).json({
+          error: "compile_failed",
+          message: String(err?.message ?? err),
+          lint: {
+            errors: [{ rule: "compile_failed", severity: "error", message: `Compile error: ${String(err?.message ?? err)}` }],
+            warnings: [],
+            infos: []
+          }
+        });
+      }
+      const lint = lintTemplate(
+        {
+          subject: draft.subject,
+          preheader: draft.preheader,
+          mjml: draft.mjml ?? "",
+          editorJson: draft.editorJson,
+          html: compiled.html,
+          plainText: compiled.plainText,
+          kind: tpl.kind,
+          fromEmail: tpl.fromEmail
+        },
+        { senderDomains: mailer.config.senderDomains }
+      );
+      if (lint.errors.length > 0) {
+        return res.status(422).json({
+          error: "lint_failed",
+          message: `Template publish blocked by ${lint.errors.length} content issue(s).`,
+          lint
+        });
+      }
+      const bypass = Boolean(req.body?.bypassMailTester);
+      if (!bypass) {
+        const gate = await evaluateMailTesterGate(mailer.getRunnerContext(), {
+          bodyHash: sha256Hex(compiled.html),
+          subject: draft.subject,
+          fromEmail: tpl.fromEmail
+        });
+        if (!gate.allowed) {
+          return res.status(422).json({
+            error: "mail_tester_blocked",
+            message: gate.reason,
+            score: gate.score,
+            hint: "Re-run the deliverability check after fixing the feedback, or POST `bypassMailTester: true` to publish anyway."
+          });
+        }
       }
       const now = /* @__PURE__ */ new Date();
       const nextVersion = await c.templateVersions.countDocuments({ templateId: tpl._id }) + 1;
@@ -3867,7 +6245,13 @@ function apiRouter(mailer) {
         resource: { collection: "mailer_templates", id: tpl._id, slug: tpl.slug },
         diffSummary: `Published v${nextVersion}`
       });
-      return res.json({ ok: true, version: nextVersion, warnings: compiled.errors });
+      return res.json({
+        ok: true,
+        version: nextVersion,
+        warnings: compiled.errors,
+        lint
+        // warnings + infos for UI
+      });
     })
   );
   r.post(
@@ -3883,6 +6267,9 @@ function apiRouter(mailer) {
         html = compiled.html;
         plainText = compiled.plainText;
       } else {
+        if (!tpl.body?.html) {
+          return res.status(409).json({ error: "not_published", message: "Template has not been published yet." });
+        }
         html = tpl.body.html;
         plainText = tpl.body.plainText;
       }
@@ -4014,8 +6401,15 @@ function apiRouter(mailer) {
         if (f.kind === "hasTag") hostFilter.hasTag = f.tag;
         if (f.kind === "fieldEquals") hostFilter.fieldEquals = { field: f.field, value: f.value };
       }
-      const stageA = await mailer.adapter.count(hostFilter);
-      return res.json({ stageA, stageB: stageA, afterSuppression: stageA, computedMs: Date.now() - t0 });
+      const hasMailerFilters = segmentDefinition.filters.some(
+        (f) => ["subscriptionStatus", "firedEvent", "notFiredEvent", "notHasTag", "opened", "notOpened", "subscribedAfter", "subscribedBefore"].includes(f.kind)
+      );
+      const upperBound = await mailer.adapter.count(hostFilter);
+      return res.json({
+        upperBound,
+        approximate: hasMailerFilters,
+        computedMs: Date.now() - t0
+      });
     })
   );
   r.post(
@@ -4095,6 +6489,119 @@ async function collectQueueCounts(mailer) {
   const [inFlight, delayed] = await Promise.all([sum("getInFlightCount"), sum("getDelayedCount")]);
   return { inFlight, delayed };
 }
+function emptyFlowStats() {
+  return { activeRuns: 0, completedRuns: 0, sendsLast7Days: 0, sendsTotal: 0 };
+}
+async function computeFlowStats(mailer, slugFilter) {
+  const out = /* @__PURE__ */ new Map();
+  const match = slugFilter ? { flowSlug: slugFilter } : {};
+  const runRows = await mailer.collections.flowRuns.aggregate([
+    { $match: match },
+    { $group: { _id: { flowSlug: "$flowSlug", status: "$status" }, count: { $sum: 1 } } }
+  ]).toArray();
+  for (const row of runRows) {
+    const slug = row._id.flowSlug;
+    if (!slug) continue;
+    const cur = out.get(slug) ?? emptyFlowStats();
+    if (row._id.status === "active") cur.activeRuns += row.count;
+    else if (row._id.status === "completed") cur.completedRuns += row.count;
+    out.set(slug, cur);
+  }
+  const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1e3);
+  const sendRows = await mailer.collections.sends.aggregate([
+    { $match: { flowRunId: { $ne: null } } },
+    {
+      $lookup: {
+        from: mailer.collections.flowRuns.collectionName,
+        localField: "flowRunId",
+        foreignField: "_id",
+        as: "run",
+        pipeline: slugFilter ? [{ $match: { flowSlug: slugFilter } }, { $project: { flowSlug: 1 } }] : [{ $project: { flowSlug: 1 } }]
+      }
+    },
+    { $unwind: "$run" },
+    {
+      $group: {
+        _id: "$run.flowSlug",
+        total: { $sum: 1 },
+        last7: { $sum: { $cond: [{ $gte: ["$queuedAt", sevenDaysAgo] }, 1, 0] } }
+      }
+    }
+  ]).toArray();
+  for (const row of sendRows) {
+    if (!row._id) continue;
+    const cur = out.get(row._id) ?? emptyFlowStats();
+    cur.sendsTotal = row.total;
+    cur.sendsLast7Days = row.last7;
+    out.set(row._id, cur);
+  }
+  return out;
+}
+function emptyTemplateStats() {
+  return { sent: 0, opened: 0, clicked: 0, bounced: 0, sentLast7Days: 0, lastSentAt: null };
+}
+async function computeTemplateStats(mailer, slugFilter) {
+  const out = /* @__PURE__ */ new Map();
+  const match = {};
+  if (slugFilter) match.templateSlug = slugFilter;
+  const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1e3);
+  const rows = await mailer.collections.sends.aggregate([
+    { $match: match },
+    {
+      $group: {
+        _id: "$templateSlug",
+        sent: { $sum: 1 },
+        opened: { $sum: { $cond: [{ $ifNull: ["$openedAt", false] }, 1, 0] } },
+        clicked: { $sum: { $cond: [{ $ifNull: ["$firstClickAt", false] }, 1, 0] } },
+        bounced: { $sum: { $cond: [{ $eq: ["$status", "bounced"] }, 1, 0] } },
+        sentLast7Days: { $sum: { $cond: [{ $gte: ["$queuedAt", sevenDaysAgo] }, 1, 0] } },
+        lastSentAt: { $max: "$queuedAt" }
+      }
+    }
+  ]).toArray();
+  for (const row of rows) {
+    if (!row._id) continue;
+    out.set(row._id, {
+      sent: row.sent,
+      opened: row.opened,
+      clicked: row.clicked,
+      bounced: row.bounced,
+      sentLast7Days: row.sentLast7Days,
+      lastSentAt: row.lastSentAt ?? null
+    });
+  }
+  return out;
+}
+function emptyBroadcastStats() {
+  return { delivered: 0, opened: 0, clicked: 0, bounced: 0 };
+}
+async function computeBroadcastStats(mailer, idFilter) {
+  const out = /* @__PURE__ */ new Map();
+  const match = { broadcastId: { $ne: null } };
+  if (idFilter) match.broadcastId = idFilter;
+  const rows = await mailer.collections.sends.aggregate([
+    { $match: match },
+    {
+      $group: {
+        _id: "$broadcastId",
+        delivered: { $sum: { $cond: [{ $eq: ["$status", "delivered"] }, 1, 0] } },
+        opened: { $sum: { $cond: [{ $ifNull: ["$openedAt", false] }, 1, 0] } },
+        clicked: { $sum: { $cond: [{ $ifNull: ["$firstClickAt", false] }, 1, 0] } },
+        bounced: { $sum: { $cond: [{ $eq: ["$status", "bounced"] }, 1, 0] } }
+      }
+    }
+  ]).toArray();
+  for (const row of rows) {
+    if (!row._id) continue;
+    out.set(String(row._id), {
+      delivered: row.delivered,
+      opened: row.opened,
+      clicked: row.clicked,
+      bounced: row.bounced
+    });
+  }
+  return out;
+}
 var PIXEL = Buffer.from(
   "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=",
   "base64"