mailery 0.3.2 → 0.5.1

package/dist/testing.cjs

@@ -8,6 +8,9 @@ var IORedis = require('ioredis');
 var Handlebars = require('handlebars');
 var htmlToText = require('html-to-text');
 var mjml2html = require('mjml');
+var dns = require('dns/promises');
+var net = require('net');
+var psl = require('psl');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
@@ -16,6 +19,9 @@ var sgMail__default = /*#__PURE__*/_interopDefault(sgMail);
 var IORedis__default = /*#__PURE__*/_interopDefault(IORedis);
 var Handlebars__default = /*#__PURE__*/_interopDefault(Handlebars);
 var mjml2html__default = /*#__PURE__*/_interopDefault(mjml2html);
+var dns__default = /*#__PURE__*/_interopDefault(dns);
+var net__default = /*#__PURE__*/_interopDefault(net);
+var psl__default = /*#__PURE__*/_interopDefault(psl);
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -4165,7 +4171,7 @@ var require_getport = __commonJS({
     exports.tryPort = tryPort;
     exports.resetPortsCache = resetPortsCache;
     var tslib_1 = (init_tslib_es6(), __toCommonJS(tslib_es6_exports));
-    var net = tslib_1.__importStar(__require("net"));
+    var net2 = tslib_1.__importStar(__require("net"));
     var debug_1 = tslib_1.__importDefault(require_src());
     var log = (0, debug_1.default)("MongoMS:GetPort");
     exports.MIN_PORT = 1024;
@@ -4213,7 +4219,7 @@ var require_getport = __commonJS({
     }
     function tryPort(port) {
       return new Promise((res, rej) => {
-        const server = net.createServer();
+        const server = net2.createServer();
         if (typeof server.unref === "function") {
           server.unref();
         }
@@ -9179,7 +9185,7 @@ var require_dist = __commonJS({
     };
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.Agent = void 0;
-    var net = __importStar2(__require("net"));
+    var net2 = __importStar2(__require("net"));
     var http = __importStar2(__require("http"));
     var https_1 = __require("https");
     __exportStar2(require_helpers(), exports);
@@ -9219,7 +9225,7 @@ var require_dist = __commonJS({
         if (!this.sockets[name]) {
           this.sockets[name] = [];
         }
-        const fakeSocket = new net.Socket({ writable: false });
+        const fakeSocket = new net2.Socket({ writable: false });
         this.sockets[name].push(fakeSocket);
         this.totalSocketCount++;
         return fakeSocket;
@@ -9429,7 +9435,7 @@ var require_dist2 = __commonJS({
     };
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.HttpsProxyAgent = void 0;
-    var net = __importStar2(__require("net"));
+    var net2 = __importStar2(__require("net"));
     var tls = __importStar2(__require("tls"));
     var assert_1 = __importDefault2(__require("assert"));
     var debug_1 = __importDefault2(require_src());
@@ -9438,7 +9444,7 @@ var require_dist2 = __commonJS({
     var parse_proxy_response_1 = require_parse_proxy_response();
     var debug = (0, debug_1.default)("https-proxy-agent");
     var setServernameFromNonIpHost = (options2) => {
-      if (options2.servername === void 0 && options2.host && !net.isIP(options2.host)) {
+      if (options2.servername === void 0 && options2.host && !net2.isIP(options2.host)) {
         return {
           ...options2,
           servername: options2.host
@@ -9478,10 +9484,10 @@ var require_dist2 = __commonJS({
           socket = tls.connect(setServernameFromNonIpHost(this.connectOpts));
         } else {
           debug("Creating `net.Socket`: %o", this.connectOpts);
-          socket = net.connect(this.connectOpts);
+          socket = net2.connect(this.connectOpts);
         }
         const headers = typeof this.proxyHeaders === "function" ? this.proxyHeaders() : { ...this.proxyHeaders };
-        const host = net.isIPv6(opts.host) ? `[${opts.host}]` : opts.host;
+        const host = net2.isIPv6(opts.host) ? `[${opts.host}]` : opts.host;
         let payload = `CONNECT ${host}:${opts.port} HTTP/1.1\r
 `;
         if (proxy.username || proxy.password) {
@@ -9514,7 +9520,7 @@ var require_dist2 = __commonJS({
           return socket;
         }
         socket.destroy();
-        const fakeSocket = new net.Socket({ writable: false });
+        const fakeSocket = new net2.Socket({ writable: false });
         fakeSocket.readable = true;
         req.once("socket", (s) => {
           debug("Replaying proxy buffer for failed request");
@@ -14263,6 +14269,17 @@ var predicateSchema = zod.z.lazy(
 );
 
 // src/server/config.ts
+var DEFAULT_DOMAIN_DNSBL_LISTS = [
+  { host: "dbl.spamhaus.org", label: "Spamhaus DBL" },
+  { host: "multi.surbl.org", label: "SURBL" },
+  { host: "multi.uribl.com", label: "URIBL" }
+];
+var DEFAULT_IP_DNSBL_LISTS = [
+  { host: "zen.spamhaus.org", label: "Spamhaus ZEN" },
+  { host: "b.barracudacentral.org", label: "Barracuda" },
+  { host: "dnsbl.sorbs.net", label: "SORBS" },
+  { host: "bl.spamcop.net", label: "SpamCop" }
+];
 var DEFAULTS = {
   collectionPrefix: "mailer_",
   requireDoubleOptIn: false,
@@ -14323,6 +14340,10 @@ function resolveConfig(c) {
 }
 
 // src/server/models/index.ts
+var HEALTH_AGG_ID = "agg";
+function healthBucketId(senderDomain, kind) {
+  return `d:${senderDomain ?? "_unknown"}|k:${kind}`;
+}
 function getCollections(db, prefix = "mailer_") {
   return {
     subscriptions: db.collection(`${prefix}subscriptions`),
@@ -14340,7 +14361,14 @@ function getCollections(db, prefix = "mailer_") {
     auditLog: db.collection(`${prefix}audit_log`),
     webhookEvents: db.collection(`${prefix}webhook_events`),
     health: db.collection(`${prefix}health`),
-    contactTags: db.collection(`${prefix}contact_tags`)
+    contactTags: db.collection(`${prefix}contact_tags`),
+    dnsblChecks: db.collection(`${prefix}dnsbl_checks`),
+    postmasterSnapshots: db.collection(`${prefix}postmaster_snapshots`),
+    sndsSnapshots: db.collection(`${prefix}snds_snapshots`),
+    dmarcReports: db.collection(`${prefix}dmarc_reports`),
+    dmarcFailures: db.collection(`${prefix}dmarc_failures`),
+    dmarcSourceTags: db.collection(`${prefix}dmarc_source_tags`),
+    mailTesterScores: db.collection(`${prefix}mail_tester_scores`)
   };
 }
 async function ensureIndexes(db, prefix = "mailer_") {
@@ -14412,8 +14440,58 @@ async function ensureIndexes(db, prefix = "mailer_") {
     c.contactTags.createIndexes([
       { key: { externalId: 1, tag: 1 }, unique: true },
       { key: { tag: 1 } }
+    ]),
+    c.health.createIndexes([
+      { key: { senderDomain: 1, kind: 1 } },
+      { key: { status: 1 } },
+      // setup-status reads the most-recently-touched health doc as a heartbeat.
+      { key: { updatedAt: -1 } }
+    ]),
+    c.dnsblChecks.createIndexes([
+      { key: { target: 1, list: 1 }, unique: true },
+      // Supports the admin /dnsbl GET sort: result asc, then target asc, list asc.
+      { key: { result: 1, target: 1, list: 1 } },
+      // TTL — stale rows for targets the operator removed disappear after
+      // 60 days without manual cleanup. The puller refreshes runAt on
+      // every active target so existing targets stay indefinitely.
+      { key: { runAt: 1 }, expireAfterSeconds: 60 * 24 * 60 * 60 }
+    ]),
+    c.postmasterSnapshots.createIndexes([
+      { key: { domain: 1, date: 1 }, unique: true },
+      { key: { domain: 1, fetchedAt: -1 } },
+      { key: { domainReputation: 1 } }
+    ]),
+    c.sndsSnapshots.createIndexes([
+      { key: { ip: 1, activityStart: 1 }, unique: true },
+      { key: { ip: 1, fetchedAt: -1 } },
+      { key: { filterResult: 1 } }
+    ]),
+    c.dmarcReports.createIndexes([
+      { key: { reportId: 1, orgName: 1 }, unique: true },
+      { key: { domain: 1, rangeEnd: -1 } },
+      // Cross-domain "most recent reports" queries scan a lot without this.
+      { key: { rangeEnd: -1 } },
+      { key: { receivedAt: -1 } }
+    ]),
+    c.dmarcFailures.createIndexes([
+      { key: { reportId: 1, sourceIp: 1 }, unique: true },
+      { key: { domain: 1, day: -1 } },
+      { key: { sourceIp: 1, day: -1 } },
+      { key: { receivedAt: 1 } }
+      // for retention pruning
+    ]),
+    c.dmarcSourceTags.createIndexes([
+      { key: { ip: 1 }, unique: true }
+    ]),
+    c.mailTesterScores.createIndexes([
+      { key: { contentKey: 1 }, unique: true },
+      { key: { templateSlug: 1, fetchedAt: -1 } },
+      // TTL — Mongo auto-deletes expired scores so we never serve stale data.
+      { key: { expiresAt: 1 }, expireAfterSeconds: 0 }
     ])
   ]);
+  await c.health.deleteOne({ _id: "singleton" }).catch(() => {
+  });
 }
 var EventRegistry = class {
   policies = /* @__PURE__ */ new Map();
@@ -14426,6 +14504,9 @@ var EventRegistry = class {
   policy(name) {
     return this.policies.get(name);
   }
+  list() {
+    return Array.from(this.policies, ([name, dedupePolicy]) => ({ name, dedupePolicy }));
+  }
   /**
    * Derive a dedupeKey for an event call. Returns null when no policy is
    * registered AND no key was passed — caller should throw.
@@ -15075,21 +15156,59 @@ async function isSuppressed(collections, email, kind) {
   return { suppressed: false };
 }
 
+// src/server/templates/sender-domain.ts
+function extractDomain(email) {
+  if (typeof email !== "string") return null;
+  const at = email.lastIndexOf("@");
+  if (at <= 0 || at === email.length - 1) return null;
+  return email.slice(at + 1).toLowerCase().trim();
+}
+
 // src/server/runner/health.ts
-async function recordHealthCounter(ctx, counter2, by = 1) {
+var ZERO_COUNTERS = {
+  sent: 0,
+  delivered: 0,
+  bounced: 0,
+  hardBounced: 0,
+  softBounced: 0,
+  complained: 0,
+  failedToSend: 0
+};
+var ZERO_RATES = {
+  bounceRate: 0,
+  hardBounceRate: 0,
+  complaintRate: 0,
+  failureRate: 0
+};
+async function recordHealthCounter(ctx, counter2, dims, by = 1) {
+  const windowMs = ctx.config.circuitBreaker.windowMinutes * 60 * 1e3;
+  const writes = [];
+  writes.push(upsertCounter(ctx, HEALTH_AGG_ID, null, null, counter2, by, windowMs));
+  if (dims) {
+    const domain = dims.fromEmail ? extractDomain(dims.fromEmail) : null;
+    if (domain) {
+      const id = healthBucketId(domain, dims.kind);
+      writes.push(upsertCounter(ctx, id, domain, dims.kind, counter2, by, windowMs));
+    }
+  }
+  await Promise.all(writes);
+}
+async function upsertCounter(ctx, _id, senderDomain, kind, counter2, by, windowMs) {
   await ctx.collections.health.updateOne(
-    { _id: "singleton" },
+    { _id },
     {
       $inc: { [`counters.${counter2}`]: by },
       $setOnInsert: {
-        _id: "singleton",
+        _id,
+        senderDomain,
+        kind,
         windowStartedAt: /* @__PURE__ */ new Date(),
-        windowDurationMs: ctx.config.circuitBreaker.windowMinutes * 60 * 1e3,
+        windowDurationMs: windowMs,
         status: "healthy",
         trippedAt: null,
         trippedReason: null,
         manuallyResumedAt: null,
-        rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 }
+        rates: { ...ZERO_RATES }
       },
       $set: { updatedAt: /* @__PURE__ */ new Date() }
     },
@@ -15099,73 +15218,107 @@ async function recordHealthCounter(ctx, counter2, by = 1) {
 async function evaluateHealth(ctx) {
   const cb = ctx.config.circuitBreaker;
   const windowMs = cb.windowMinutes * 60 * 1e3;
-  const doc = await ctx.collections.health.findOne({ _id: "singleton" });
-  if (!doc) return;
-  const windowAge = Date.now() - new Date(doc.windowStartedAt).getTime();
-  if (windowAge > windowMs && doc.status !== "tripped") {
-    await ctx.collections.health.updateOne(
-      { _id: "singleton" },
-      {
-        $set: {
-          windowStartedAt: /* @__PURE__ */ new Date(),
-          windowDurationMs: windowMs,
-          counters: { sent: 0, delivered: 0, bounced: 0, hardBounced: 0, softBounced: 0, complained: 0, failedToSend: 0 },
-          rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 },
-          updatedAt: /* @__PURE__ */ new Date()
-        }
-      }
-    );
-    return;
+  const docs = await ctx.collections.health.find({}).toArray();
+  if (docs.length === 0) return;
+  const hasAgg = docs.some((d) => d._id === HEALTH_AGG_ID);
+  if (!hasAgg) {
+    await upsertCounter(ctx, HEALTH_AGG_ID, null, null, "sent", 0, windowMs);
   }
-  const c = doc.counters;
-  const total = c.sent || 1;
-  const rates = {
-    bounceRate: c.bounced / total,
-    hardBounceRate: c.hardBounced / total,
-    complaintRate: c.complained / total,
-    failureRate: c.failedToSend / total
-  };
-  await ctx.collections.health.updateOne(
-    { _id: "singleton" },
-    { $set: { rates, updatedAt: /* @__PURE__ */ new Date() } }
-  );
-  if (c.sent < cb.minSendsBeforeEval) return;
-  if (doc.status === "tripped") return;
-  let trippedReason = null;
-  if (rates.hardBounceRate * 100 >= cb.hardBounceRatePctTrip) {
-    trippedReason = `hard bounce rate ${(rates.hardBounceRate * 100).toFixed(2)}% >= ${cb.hardBounceRatePctTrip}%`;
-  } else if (rates.complaintRate * 100 >= cb.complaintRatePctTrip) {
-    trippedReason = `complaint rate ${(rates.complaintRate * 100).toFixed(2)}% >= ${cb.complaintRatePctTrip}%`;
-  } else if (rates.bounceRate * 100 >= cb.combinedBounceRatePctTrip) {
-    trippedReason = `combined bounce rate ${(rates.bounceRate * 100).toFixed(2)}% >= ${cb.combinedBounceRatePctTrip}%`;
-  }
-  if (trippedReason) {
+  for (const doc of docs) {
+    const isAgg = doc._id === HEALTH_AGG_ID;
+    const windowAge = Date.now() - new Date(doc.windowStartedAt).getTime();
+    if (windowAge > windowMs && doc.status !== "tripped") {
+      await ctx.collections.health.updateOne(
+        { _id: doc._id },
+        {
+          $set: {
+            windowStartedAt: /* @__PURE__ */ new Date(),
+            windowDurationMs: windowMs,
+            counters: { ...ZERO_COUNTERS },
+            rates: { ...ZERO_RATES },
+            status: "healthy",
+            updatedAt: /* @__PURE__ */ new Date()
+          }
+        }
+      );
+      continue;
+    }
+    const c = doc.counters;
+    const total = c.sent || 1;
+    const rates = {
+      bounceRate: c.bounced / total,
+      hardBounceRate: c.hardBounced / total,
+      complaintRate: c.complained / total,
+      failureRate: c.failedToSend / total
+    };
     await ctx.collections.health.updateOne(
-      { _id: "singleton" },
-      { $set: { status: "tripped", trippedAt: /* @__PURE__ */ new Date(), trippedReason, updatedAt: /* @__PURE__ */ new Date() } }
+      { _id: doc._id },
+      { $set: { rates, updatedAt: /* @__PURE__ */ new Date() } }
     );
-    if (ctx.config.onCircuitBreakerTrip) {
-      try {
-        await ctx.config.onCircuitBreakerTrip({ reason: trippedReason, rates });
-      } catch {
+    if (isAgg) continue;
+    if (c.sent < cb.minSendsBeforeEval) continue;
+    if (doc.status === "tripped") continue;
+    let trippedReason = null;
+    if (rates.hardBounceRate * 100 >= cb.hardBounceRatePctTrip) {
+      trippedReason = `hard bounce rate ${(rates.hardBounceRate * 100).toFixed(2)}% >= ${cb.hardBounceRatePctTrip}%`;
+    } else if (rates.complaintRate * 100 >= cb.complaintRatePctTrip) {
+      trippedReason = `complaint rate ${(rates.complaintRate * 100).toFixed(2)}% >= ${cb.complaintRatePctTrip}%`;
+    } else if (rates.bounceRate * 100 >= cb.combinedBounceRatePctTrip) {
+      trippedReason = `combined bounce rate ${(rates.bounceRate * 100).toFixed(2)}% >= ${cb.combinedBounceRatePctTrip}%`;
+    }
+    if (trippedReason) {
+      const result = await ctx.collections.health.updateOne(
+        { _id: doc._id, status: { $in: ["healthy", "degraded"] } },
+        { $set: { status: "tripped", trippedAt: /* @__PURE__ */ new Date(), trippedReason, updatedAt: /* @__PURE__ */ new Date() } }
+      );
+      if (result.modifiedCount > 0) {
+        if (ctx.audit) {
+          try {
+            await ctx.audit({
+              actor: "system:circuit-breaker",
+              action: "health.trip",
+              resource: {
+                collection: "mailer_health",
+                id: String(doc._id),
+                slug: `${doc.senderDomain ?? "_unknown"}|${doc.kind}`
+              },
+              diffSummary: trippedReason
+            });
+          } catch {
+          }
+        }
+        if (ctx.config.onCircuitBreakerTrip) {
+          try {
+            await ctx.config.onCircuitBreakerTrip({
+              reason: `[${doc.senderDomain ?? "_unknown"} / ${doc.kind}] ${trippedReason}`,
+              rates
+            });
+          } catch {
+          }
+        }
       }
+      continue;
     }
-    return;
-  }
-  if (rates.failureRate * 100 >= cb.failedToSendRatePctDegrade) {
-    if (doc.status !== "degraded") {
+    if (rates.failureRate * 100 >= cb.failedToSendRatePctDegrade) {
+      if (doc.status !== "degraded") {
+        await ctx.collections.health.updateOne(
+          { _id: doc._id },
+          { $set: { status: "degraded", updatedAt: /* @__PURE__ */ new Date() } }
+        );
+      }
+    } else if (doc.status === "degraded") {
       await ctx.collections.health.updateOne(
-        { _id: "singleton" },
-        { $set: { status: "degraded", updatedAt: /* @__PURE__ */ new Date() } }
+        { _id: doc._id },
+        { $set: { status: "healthy", updatedAt: /* @__PURE__ */ new Date() } }
       );
     }
-  } else if (doc.status === "degraded") {
-    await ctx.collections.health.updateOne(
-      { _id: "singleton" },
-      { $set: { status: "healthy", updatedAt: /* @__PURE__ */ new Date() } }
-    );
   }
 }
+async function getBucketStatus(ctx, fromEmail, kind) {
+  const domain = fromEmail ? extractDomain(fromEmail) : null;
+  const id = healthBucketId(domain, kind);
+  return ctx.collections.health.findOne({ _id: id });
+}
 
 // src/server/runner/send.ts
 async function handleSend(run, step, contact, flow, ctx) {
@@ -15249,8 +15402,8 @@ async function dispatchSend(sendId, ctx) {
     return;
   }
   if (send.kind === "marketing") {
-    const health = await ctx.collections.health.findOne({ _id: "singleton" });
-    if (health?.status === "tripped") {
+    const bucket = await getBucketStatus(ctx, send.fromEmail, send.kind);
+    if (bucket?.status === "tripped") {
       await ctx.queues.send.add("send", { sendId: String(send._id) }, { delay: 6e4 });
       return;
     }
@@ -15319,13 +15472,13 @@ async function dispatchSend(sendId, ctx) {
         }
       }
     );
-    await recordHealthCounter(ctx, "sent");
+    await recordHealthCounter(ctx, "sent", { fromEmail: send.fromEmail, kind: send.kind });
   } catch (err) {
     await ctx.collections.sends.updateOne(
       { _id: send._id },
       { $set: { status: "failed", errorMessage: String(err?.message ?? err) } }
     );
-    await recordHealthCounter(ctx, "failedToSend");
+    await recordHealthCounter(ctx, "failedToSend", { fromEmail: send.fromEmail, kind: send.kind });
     if (ctx.config.onSendFailure) {
       try {
         await ctx.config.onSendFailure({ send, error: err });
@@ -15909,7 +16062,15 @@ async function promoteSoftBounces(ctx) {
   const cutoff = new Date(Date.now() - windowDays * 864e5);
   const offenders = await ctx.collections.sends.aggregate([
     { $match: { status: "bounced", bounceType: "soft", queuedAt: { $gt: cutoff } } },
-    { $group: { _id: "$emailAtSend", count: { $sum: 1 } } },
+    { $sort: { queuedAt: 1 } },
+    {
+      $group: {
+        _id: "$emailAtSend",
+        count: { $sum: 1 },
+        lastFromEmail: { $last: "$fromEmail" },
+        lastKind: { $last: "$kind" }
+      }
+    },
     { $match: { count: { $gte: threshold } } },
     { $limit: 200 }
   ]).toArray();
@@ -15941,32 +16102,649 @@ async function promoteSoftBounces(ctx) {
       { emailAtSubscribe: email },
       { $set: { status: "bounced", updatedAt: /* @__PURE__ */ new Date() } }
     );
-    await recordHealthCounter(ctx, "hardBounced");
+    await recordHealthCounter(
+      ctx,
+      "hardBounced",
+      o.lastKind ? { fromEmail: o.lastFromEmail, kind: o.lastKind } : null
+    );
+  }
+}
+var REGISTRABLE_ONLY_LISTS = /* @__PURE__ */ new Set(["multi.surbl.org", "multi.uribl.com"]);
+var DNS_CONCURRENCY = 8;
+var defaultResolver = {
+  resolve4: (hostname) => dns__default.default.resolve4(hostname)
+};
+async function runDnsblChecks(ctx, opts = {}) {
+  const cfg = ctx.config.dnsbl ?? {};
+  const intervalHours = cfg.intervalHours ?? 24;
+  if (!opts.force && intervalHours <= 0) {
+    return { ran: false, reason: "disabled" };
+  }
+  const targets = collectTargets(ctx, cfg);
+  if (targets.domains.length === 0 && targets.ips.length === 0) {
+    return { ran: false, reason: "no_targets" };
+  }
+  const resolver = opts.resolver ?? defaultResolver;
+  const domainLists = cfg.domainLists ?? DEFAULT_DOMAIN_DNSBL_LISTS;
+  const ipLists = cfg.ipLists ?? DEFAULT_IP_DNSBL_LISTS;
+  const pairs = [];
+  for (const d of targets.domains) {
+    for (const l of domainLists) pairs.push({ target: d, targetKind: "domain", list: l });
+  }
+  for (const ip of targets.ips) {
+    for (const l of ipLists) pairs.push({ target: ip, targetKind: "ip", list: l });
+  }
+  const throttleCutoff = opts.force ? null : Date.now() - intervalHours * 60 * 60 * 1e3;
+  let duePairs = pairs;
+  if (throttleCutoff != null) {
+    const existing = await ctx.collections.dnsblChecks.find(
+      {
+        $or: pairs.map((p) => ({ target: p.target, list: p.list.host }))
+      },
+      { projection: { target: 1, list: 1, runAt: 1 } }
+    ).toArray();
+    const fresh = /* @__PURE__ */ new Set();
+    for (const e of existing) {
+      if (new Date(e.runAt).getTime() > throttleCutoff) {
+        fresh.add(`${e.target}|${e.list}`);
+      }
+    }
+    duePairs = pairs.filter((p) => !fresh.has(`${p.target}|${p.list.host}`));
+    if (duePairs.length === 0) {
+      return { ran: false, reason: "not_due", totalChecks: 0, listedCount: 0 };
+    }
+  }
+  let listedCount = 0;
+  async function processPair(p) {
+    const queryName = buildQueryName(p.target, p.targetKind, p.list.host);
+    const lookup = queryName ? await queryDnsbl(resolver, queryName) : { result: "error", returnCodes: [], errorMessage: "unsupported target format" };
+    if (lookup.transient) return;
+    if (lookup.result === "listed") listedCount++;
+    await ctx.collections.dnsblChecks.updateOne(
+      { target: p.target, list: p.list.host },
+      {
+        $set: {
+          target: p.target,
+          targetKind: p.targetKind,
+          list: p.list.host,
+          listLabel: p.list.label,
+          result: lookup.result,
+          returnCodes: lookup.returnCodes,
+          errorMessage: lookup.errorMessage,
+          runAt: /* @__PURE__ */ new Date()
+        }
+      },
+      { upsert: true }
+    );
+  }
+  let idx = 0;
+  await Promise.all(
+    Array.from({ length: Math.min(DNS_CONCURRENCY, duePairs.length) }, async () => {
+      while (idx < duePairs.length) {
+        const my = idx++;
+        await processPair(duePairs[my]);
+      }
+    })
+  );
+  return { ran: true, totalChecks: duePairs.length, listedCount };
+}
+function collectTargets(ctx, cfg) {
+  const domains = /* @__PURE__ */ new Set();
+  const registry = ctx.config.senderDomains;
+  if (registry) {
+    for (const d of Object.keys(registry)) domains.add(d.toLowerCase());
+  }
+  const fromDomain = ctx.config.fromDefaults?.email ? extractDomain(ctx.config.fromDefaults.email) : null;
+  if (fromDomain) domains.add(fromDomain);
+  const txnDomain = ctx.config.transactionalFromDefaults?.email ? extractDomain(ctx.config.transactionalFromDefaults.email) : null;
+  if (txnDomain) domains.add(txnDomain);
+  return {
+    domains: Array.from(domains),
+    ips: (cfg.dedicatedIps ?? []).filter((ip) => net__default.default.isIP(ip) !== 0)
+  };
+}
+function buildQueryName(target, kind, listHost) {
+  if (kind === "ip") {
+    const v = net__default.default.isIP(target);
+    if (v === 4) return `${reverseIPv4(target)}.${listHost}`;
+    if (v === 6) return `${reverseIPv6Nibbles(target)}.${listHost}`;
+    return null;
   }
+  const domain = REGISTRABLE_ONLY_LISTS.has(listHost) ? registrableDomain(target) : target;
+  return `${domain}.${listHost}`;
+}
+var TRANSIENT_DNS_CODES = /* @__PURE__ */ new Set(["ESERVFAIL", "EREFUSED", "ETIMEOUT", "ETIMEDOUT", "ECONNRESET", "ECONNREFUSED"]);
+async function queryDnsbl(resolver, query) {
+  try {
+    const records = await resolver.resolve4(query);
+    return interpretRecords(records);
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOTFOUND" || code === "ENODATA") {
+      return { result: "clean", returnCodes: [], errorMessage: null };
+    }
+    if (code && TRANSIENT_DNS_CODES.has(code)) {
+      return {
+        transient: true,
+        result: "error",
+        returnCodes: [],
+        errorMessage: String(err?.message ?? err)
+      };
+    }
+    return {
+      result: "error",
+      returnCodes: [],
+      errorMessage: String(err?.message ?? err)
+    };
+  }
+}
+function interpretRecords(records) {
+  if (!records || records.length === 0) {
+    return { result: "clean", returnCodes: [], errorMessage: null };
+  }
+  const errorish = records.filter((r) => r.startsWith("127.255.255."));
+  if (errorish.length === records.length) {
+    return {
+      result: "error",
+      returnCodes: records,
+      errorMessage: `list returned reserved code(s): ${records.join(", ")}`
+    };
+  }
+  const listed = records.filter((r) => r.startsWith("127.") && !r.startsWith("127.255.255."));
+  if (listed.length > 0) {
+    return { result: "listed", returnCodes: records, errorMessage: null };
+  }
+  return { result: "clean", returnCodes: records, errorMessage: null };
+}
+function reverseIPv4(ip) {
+  return ip.split(".").reverse().join(".");
+}
+function reverseIPv6Nibbles(ip) {
+  const v4Match = /:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(ip);
+  let normalized = ip;
+  if (v4Match) {
+    const octets = v4Match[1].split(".").map((o) => Number(o));
+    if (octets.length === 4 && octets.every((o) => o >= 0 && o <= 255)) {
+      const hi = (octets[0] << 8 | octets[1]).toString(16).padStart(4, "0");
+      const lo = (octets[2] << 8 | octets[3]).toString(16).padStart(4, "0");
+      normalized = ip.slice(0, v4Match.index) + ":" + hi + ":" + lo;
+    }
+  }
+  const sides = normalized.split("::");
+  let groups;
+  if (sides.length === 1) {
+    groups = sides[0].split(":");
+  } else {
+    const left = sides[0].split(":").filter(Boolean);
+    const right = sides[1].split(":").filter(Boolean);
+    const missing = 8 - left.length - right.length;
+    groups = [...left, ...Array(missing).fill("0"), ...right];
+  }
+  if (groups.length !== 8) {
+    throw new Error(`unexpected IPv6 group count for ${ip}: ${groups.length}`);
+  }
+  const padded = groups.map((g) => g.toLowerCase().padStart(4, "0")).join("");
+  return padded.split("").reverse().join(".");
+}
+function registrableDomain(domain) {
+  const parsed = psl__default.default.parse(domain);
+  if ("domain" in parsed && parsed.domain) return parsed.domain;
+  return domain;
 }
 
-// src/server/runner/tick.ts
-var STRANDED_SEND_THRESHOLD_MS = 5 * 60 * 1e3;
-async function runTick(ctx) {
+// src/server/runner/postmaster.ts
+var OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
+var POSTMASTER_BASE = "https://gmailpostmastertools.googleapis.com/v1";
+var FETCH_TIMEOUT_MS = 15e3;
+async function fetchWithTimeout(fetcher, url, init = {}, timeoutMs = FETCH_TIMEOUT_MS) {
+  const ctl = new AbortController();
+  const t = setTimeout(() => ctl.abort(), timeoutMs);
+  try {
+    return await fetcher(url, { ...init, signal: ctl.signal });
+  } finally {
+    clearTimeout(t);
+  }
+}
+function createPostmasterClient(cfg, fetcher = globalThis.fetch) {
+  let cached = null;
+  async function getAccessToken() {
+    if (cached && cached.expiresAt > Date.now() + 5 * 60 * 1e3) {
+      return cached.accessToken;
+    }
+    const body = new URLSearchParams({
+      client_id: cfg.clientId,
+      client_secret: cfg.clientSecret,
+      refresh_token: cfg.refreshToken,
+      grant_type: "refresh_token"
+    });
+    const res = await fetchWithTimeout(fetcher, OAUTH_TOKEN_URL, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+    if (!res.ok) {
+      throw new Error(`Postmaster OAuth token refresh failed: ${res.status} ${await safeText(res)}`);
+    }
+    const data = await res.json();
+    cached = {
+      accessToken: data.access_token,
+      expiresAt: Date.now() + data.expires_in * 1e3
+    };
+    return cached.accessToken;
+  }
+  async function authedGet(path) {
+    const token = await getAccessToken();
+    const res = await fetchWithTimeout(fetcher, `${POSTMASTER_BASE}${path}`, {
+      method: "GET",
+      headers: { authorization: `Bearer ${token}` }
+    });
+    if (!res.ok) {
+      throw new Error(`Postmaster GET ${path} failed: ${res.status} ${await safeText(res)}`);
+    }
+    return await res.json();
+  }
+  return {
+    async listDomains() {
+      const data = await authedGet("/domains");
+      return data.domains ?? [];
+    },
+    async getLatestTrafficStats(domain) {
+      const data = await authedGet(
+        `/domains/${encodeURIComponent(domain)}/trafficStats?pageSize=1`
+      );
+      return data.trafficStats?.[0] ?? null;
+    }
+  };
+}
+async function safeText(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "<no body>";
+  }
+}
+async function runPostmasterPull(ctx, opts = {}) {
+  const cfg = ctx.config.postmaster;
+  if (!cfg) return { ran: false, reason: "not_configured" };
+  const intervalHours = cfg.intervalHours ?? 24;
+  if (!opts.force && intervalHours <= 0) {
+    return { ran: false, reason: "disabled" };
+  }
+  const client = opts.client ?? createPostmasterClient(cfg, opts.fetcher);
+  const allDomains = resolveDomains(ctx, cfg);
+  if (allDomains.length === 0) {
+    return { ran: false, reason: "no_domains" };
+  }
+  let domains = allDomains;
+  if (!opts.force) {
+    const cutoff = Date.now() - intervalHours * 60 * 60 * 1e3;
+    const latest = await ctx.collections.postmasterSnapshots.find({ domain: { $in: allDomains } }, { projection: { domain: 1, fetchedAt: 1 } }).sort({ fetchedAt: -1 }).limit(allDomains.length * 8).toArray();
+    const lastByDomain = /* @__PURE__ */ new Map();
+    for (const s of latest) {
+      const ts = new Date(s.fetchedAt).getTime();
+      const cur = lastByDomain.get(s.domain) ?? 0;
+      if (ts > cur) lastByDomain.set(s.domain, ts);
+    }
+    domains = allDomains.filter((d) => (lastByDomain.get(d) ?? 0) < cutoff);
+    if (domains.length === 0) {
+      return { ran: false, reason: "not_due" };
+    }
+  }
+  const fetches = await Promise.all(
+    domains.map(async (domain) => {
+      try {
+        const stat = await client.getLatestTrafficStats(domain);
+        return { domain, stat, error: null };
+      } catch (err) {
+        console.error(`mailery: postmaster fetch failed for ${domain}`, err);
+        return { domain, stat: null, error: err };
+      }
+    })
+  );
+  let fetched = 0;
+  const trippedDomains = [];
+  for (const { domain, stat } of fetches) {
+    if (!stat) continue;
+    const snapshot = toSnapshot(domain, stat);
+    if (!snapshot) continue;
+    fetched++;
+    await ctx.collections.postmasterSnapshots.updateOne(
+      { domain: snapshot.domain, date: snapshot.date },
+      { $set: snapshot },
+      { upsert: true }
+    );
+    if (snapshot.domainReputation === "BAD") {
+      const kindsToTrip = kindsForDomain(ctx, domain);
+      for (const kind of kindsToTrip) {
+        const tripped = await tripBucket(ctx, domain, kind, snapshot);
+        if (tripped) trippedDomains.push(`${domain}|${kind}`);
+      }
+    }
+  }
+  return { ran: true, fetched, trippedDomains };
+}
+function kindsForDomain(ctx, domain) {
+  const registry = ctx.config.senderDomains ?? {};
+  const entry = registry[domain.toLowerCase()];
+  if (!entry) return [];
+  if (entry.kind === "both") return ["marketing", "transactional"];
+  return [entry.kind];
+}
+function resolveDomains(ctx, cfg) {
+  if (cfg.domains && cfg.domains.length > 0) {
+    return cfg.domains.map((d) => d.toLowerCase());
+  }
+  const out = /* @__PURE__ */ new Set();
+  const registry = ctx.config.senderDomains;
+  if (registry) {
+    for (const d of Object.keys(registry)) out.add(d.toLowerCase());
+  }
+  const f = ctx.config.fromDefaults?.email ? extractDomain(ctx.config.fromDefaults.email) : null;
+  if (f) out.add(f);
+  const t = ctx.config.transactionalFromDefaults?.email ? extractDomain(ctx.config.transactionalFromDefaults.email) : null;
+  if (t) out.add(t);
+  return Array.from(out);
+}
+function toSnapshot(domain, stat) {
+  const m = /\/trafficStats\/(\d{8})$/.exec(stat.name ?? "");
+  if (!m) {
+    console.error(`mailery: postmaster snapshot for ${domain} has unrecognized name "${stat.name}" \u2014 skipping`);
+    return null;
+  }
+  const yyyymmdd = m[1];
+  const date = `${yyyymmdd.slice(0, 4)}-${yyyymmdd.slice(4, 6)}-${yyyymmdd.slice(6, 8)}`;
+  return {
+    domain,
+    date,
+    domainReputation: stat.domainReputation ?? null,
+    ipReputations: stat.ipReputations ? stat.ipReputations.map((r) => ({
+      reputation: r.reputation,
+      ipCount: typeof r.ipCount === "string" ? Number(r.ipCount) : r.ipCount
+    })) : null,
+    userReportedSpamRatio: stat.userReportedSpamRatio ?? null,
+    spfSuccessRatio: stat.spfSuccessRatio ?? null,
+    dkimSuccessRatio: stat.dkimSuccessRatio ?? null,
+    dmarcSuccessRatio: stat.dmarcSuccessRatio ?? null,
+    outboundEncryptionRatio: stat.outboundEncryptionRatio ?? null,
+    inboundEncryptionRatio: stat.inboundEncryptionRatio ?? null,
+    deliveryErrors: stat.deliveryErrors ?? null,
+    spammyFeedbackLoops: stat.spammyFeedbackLoops ?? null,
+    fetchedAt: /* @__PURE__ */ new Date()
+  };
+}
+async function tripBucket(ctx, domain, kind, snapshot) {
+  const id = healthBucketId(domain, kind);
+  const reason = `Postmaster Tools reports ${domain} reputation = BAD on ${snapshot.date}`;
+  const prior = await ctx.collections.health.findOne({ _id: id });
+  if (prior?.status === "tripped") {
+    return false;
+  }
   await ctx.collections.health.updateOne(
-    { _id: "singleton" },
+    { _id: id },
     {
-      $set: { updatedAt: /* @__PURE__ */ new Date() },
+      $set: {
+        status: "tripped",
+        trippedAt: /* @__PURE__ */ new Date(),
+        trippedReason: reason,
+        updatedAt: /* @__PURE__ */ new Date()
+      },
       $setOnInsert: {
-        _id: "singleton",
+        _id: id,
+        senderDomain: domain,
+        kind,
         windowStartedAt: /* @__PURE__ */ new Date(),
         windowDurationMs: ctx.config.circuitBreaker.windowMinutes * 60 * 1e3,
-        status: "healthy",
-        trippedAt: null,
-        trippedReason: null,
         manuallyResumedAt: null,
         counters: { sent: 0, delivered: 0, bounced: 0, hardBounced: 0, softBounced: 0, complained: 0, failedToSend: 0 },
         rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 }
       }
     },
     { upsert: true }
-  ).catch(() => {
-  });
+  );
+  if (ctx.config.onCircuitBreakerTrip) {
+    try {
+      await ctx.config.onCircuitBreakerTrip({ reason, rates: { userReportedSpamRatio: snapshot.userReportedSpamRatio ?? 0 } });
+    } catch {
+    }
+  }
+  return true;
+}
+
+// src/server/runner/snds.ts
+var SNDS_DATA_URL = "https://postmaster.live.com/snds/data.aspx";
+var FETCH_TIMEOUT_MS2 = 3e4;
+async function runSndsPull(ctx, opts = {}) {
+  const cfg = ctx.config.snds;
+  if (!cfg?.accessKey) return { ran: false, reason: "not_configured" };
+  const intervalHours = cfg.intervalHours ?? 24;
+  if (!opts.force && intervalHours <= 0) return { ran: false, reason: "disabled" };
+  if (!opts.force) {
+    const latest = await ctx.collections.sndsSnapshots.find({}).sort({ fetchedAt: -1 }).limit(1).toArray();
+    if (latest[0]) {
+      const ageMs = Date.now() - new Date(latest[0].fetchedAt).getTime();
+      if (ageMs < intervalHours * 60 * 60 * 1e3) {
+        return { ran: false, reason: "not_due" };
+      }
+    }
+  }
+  const fetcher = opts.fetcher ?? globalThis.fetch;
+  const url = `${SNDS_DATA_URL}?key=${encodeURIComponent(cfg.accessKey)}`;
+  const ctl = new AbortController();
+  const t = setTimeout(() => ctl.abort(), FETCH_TIMEOUT_MS2);
+  let res;
+  try {
+    res = await fetcher(url, { method: "GET", signal: ctl.signal });
+  } catch (err) {
+    throw new Error(`SNDS data fetch failed: ${redactKey(String(err?.message ?? err), cfg.accessKey)}`);
+  } finally {
+    clearTimeout(t);
+  }
+  if (!res.ok) {
+    throw new Error(`SNDS data fetch failed: ${res.status} ${redactKey(await safeText2(res), cfg.accessKey)}`);
+  }
+  const csv = await res.text();
+  const rows = parseSndsCsv(csv);
+  const ipFilter = cfg.ips?.length ? new Set(cfg.ips) : null;
+  const now = /* @__PURE__ */ new Date();
+  const ops = rows.filter((row) => !ipFilter || ipFilter.has(row.ip)).map((row) => ({
+    updateOne: {
+      filter: { ip: row.ip, activityStart: row.activityStart },
+      update: { $set: { ...row, fetchedAt: now } },
+      upsert: true
+    }
+  }));
+  let persisted = 0;
+  if (ops.length > 0) {
+    const r = await ctx.collections.sndsSnapshots.bulkWrite(ops, { ordered: false });
+    persisted = (r.modifiedCount ?? 0) + (r.upsertedCount ?? 0);
+  }
+  return { ran: true, rowsParsed: rows.length, rowsPersisted: persisted };
+}
+function redactKey(s, key) {
+  if (!key) return s;
+  return s.split(key).join("<redacted>").split(encodeURIComponent(key)).join("<redacted>");
+}
+async function safeText2(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "<no body>";
+  }
+}
+function parseSndsCsv(csv) {
+  const out = [];
+  for (const raw of csv.split(/\r?\n/)) {
+    if (!raw.trim()) continue;
+    const fields = splitCsvRow(raw);
+    if (fields.length < 7) continue;
+    const parsed = parseRow(fields);
+    if (parsed) out.push(parsed);
+  }
+  return out;
+}
+function splitCsvRow(row) {
+  const out = [];
+  let cur = "";
+  let inQuotes = false;
+  for (let i = 0; i < row.length; i++) {
+    const ch = row[i];
+    if (inQuotes) {
+      if (ch === '"') {
+        if (row[i + 1] === '"') {
+          cur += '"';
+          i++;
+        } else {
+          inQuotes = false;
+        }
+      } else {
+        cur += ch;
+      }
+    } else if (ch === '"') {
+      inQuotes = true;
+    } else if (ch === ",") {
+      out.push(cur);
+      cur = "";
+    } else {
+      cur += ch;
+    }
+  }
+  out.push(cur);
+  return out.map((f) => f.trim());
+}
+function parseRow(fields) {
+  const [
+    ip,
+    activityStart,
+    activityEnd,
+    rcptCommands,
+    dataCommands,
+    messageRecipients,
+    filterResult,
+    complaintRate,
+    trapMessageCount,
+    sampleHelo,
+    sampleMailFrom
+  ] = fields;
+  const start = parseSndsDate(activityStart ?? "");
+  const end = parseSndsDate(activityEnd ?? "");
+  if (!ip || !start || !end) return null;
+  return {
+    ip,
+    activityStart: start,
+    activityEnd: end,
+    rcptCommands: toInt(rcptCommands),
+    dataCommands: toInt(dataCommands),
+    messageRecipients: toInt(messageRecipients),
+    filterResult: normalizeFilter(filterResult ?? ""),
+    complaintRate: parseComplaintRate(complaintRate ?? ""),
+    trapMessageCount: toInt(trapMessageCount),
+    sampleHelo: sampleHelo ? sampleHelo : null,
+    sampleMailFrom: sampleMailFrom ? sampleMailFrom : null
+  };
+}
+function toInt(s) {
+  if (!s) return 0;
+  const n = Number(s.replace(/[^\d-]/g, ""));
+  return Number.isFinite(n) ? n : 0;
+}
+function normalizeFilter(s) {
+  const u = s.toUpperCase().trim();
+  if (u === "GREEN" || u === "YELLOW" || u === "RED") return u;
+  return "UNKNOWN";
+}
+function parseComplaintRate(s) {
+  const trimmed = s.trim();
+  if (!trimmed || trimmed === "-" || /n\/?a/i.test(trimmed)) return null;
+  const cleaned = trimmed.replace(/%/g, "");
+  let m = /^<\s*(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[1]) / 100;
+  m = /^>\s*(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[1]) / 100;
+  m = /^(\d+(?:\.\d+)?)\s*-\s*(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[2]) / 100;
+  m = /^(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[1]) / 100;
+  return null;
+}
+function parseSndsDate(s) {
+  const trimmed = s.trim();
+  if (!trimmed) return null;
+  const m = /^(\d{1,2})\/(\d{1,2})\/(\d{4})\s+(\d{1,2}):(\d{2})(?::(\d{2}))?\s*(AM|PM)?$/i.exec(trimmed);
+  if (m) {
+    const month = Number(m[1]) - 1;
+    const day = Number(m[2]);
+    const year = Number(m[3]);
+    let hour = Number(m[4]);
+    const minute = Number(m[5]);
+    const second = Number(m[6] ?? 0);
+    const meridiem = m[7]?.toUpperCase();
+    if (meridiem === "PM" && hour < 12) hour += 12;
+    if (meridiem === "AM" && hour === 12) hour = 0;
+    const wallMs = Date.UTC(year, month, day, hour, minute, second);
+    if (!Number.isFinite(wallMs)) return null;
+    const offsetHours = isUsPacificDst(year, month, day) ? 7 : 8;
+    return new Date(wallMs + offsetHours * 60 * 60 * 1e3);
+  }
+  const d = new Date(trimmed);
+  if (!isNaN(d.getTime())) return d;
+  return null;
+}
+function isUsPacificDst(year, month0, day) {
+  if (month0 > 2 && month0 < 10) return true;
+  if (month0 < 2 || month0 > 10) return false;
+  if (month0 === 2) {
+    const dst2 = nthSundayOfMonth(year, 2, 2);
+    return day >= dst2;
+  }
+  const dst = nthSundayOfMonth(year, 10, 1);
+  return day < dst;
+}
+function nthSundayOfMonth(year, month0, n) {
+  const first = new Date(Date.UTC(year, month0, 1));
+  const dayOfWeek = first.getUTCDay();
+  const firstSunday = 1 + (7 - dayOfWeek) % 7;
+  return firstSunday + (n - 1) * 7;
+}
+var _lastPruneAt = 0;
+var PRUNE_INTERVAL_MS = 60 * 60 * 1e3;
+async function pruneDmarcFailures(ctx, opts = {}) {
+  const cfg = ctx.config.dmarc;
+  const days = cfg?.retentionDays ?? 90;
+  if (days <= 0) return 0;
+  if (!opts.force && Date.now() - _lastPruneAt < PRUNE_INTERVAL_MS) return 0;
+  _lastPruneAt = Date.now();
+  const cutoff = new Date(Date.now() - days * 864e5);
+  const r = await ctx.collections.dmarcFailures.deleteMany({ receivedAt: { $lt: cutoff } });
+  return r.deletedCount ?? 0;
+}
+
+// src/server/runner/tick.ts
+var STRANDED_SEND_THRESHOLD_MS = 5 * 60 * 1e3;
+async function runTick(ctx) {
+  try {
+    await ctx.collections.health.updateOne(
+      { _id: HEALTH_AGG_ID },
+      {
+        $set: { updatedAt: /* @__PURE__ */ new Date() },
+        $setOnInsert: {
+          _id: HEALTH_AGG_ID,
+          senderDomain: null,
+          kind: null,
+          windowStartedAt: /* @__PURE__ */ new Date(),
+          windowDurationMs: ctx.config.circuitBreaker.windowMinutes * 60 * 1e3,
+          status: "healthy",
+          trippedAt: null,
+          trippedReason: null,
+          manuallyResumedAt: null,
+          counters: { sent: 0, delivered: 0, bounced: 0, hardBounced: 0, softBounced: 0, complained: 0, failedToSend: 0 },
+          rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 }
+        }
+      },
+      { upsert: true }
+    );
+  } catch (err) {
+    console.error("mailery: heartbeat write failed", err);
+  }
   await processNewlyFiredEventTriggers(ctx).catch((err) => {
     console.error("mailery: triggers scan failed", err);
   });
@@ -15988,6 +16766,20 @@ async function runTick(ctx) {
   await promoteSoftBounces(ctx).catch((err) => {
     console.error("mailery: soft-bounce promotion failed", err);
   });
+  await Promise.all([
+    runDnsblChecks(ctx).catch((err) => {
+      console.error("mailery: dnsbl checks failed", err);
+    }),
+    runPostmasterPull(ctx).catch((err) => {
+      console.error("mailery: postmaster pull failed", err);
+    }),
+    runSndsPull(ctx).catch((err) => {
+      console.error("mailery: snds pull failed", err);
+    }),
+    pruneDmarcFailures(ctx).catch((err) => {
+      console.error("mailery: dmarc prune failed", err);
+    })
+  ]);
 }
 async function sweepStrandedSends(ctx) {
   const cutoff = new Date(Date.now() - STRANDED_SEND_THRESHOLD_MS);
@@ -16045,6 +16837,10 @@ async function processScheduledBroadcasts2(ctx) {
 }
 
 // src/server/runner/webhook.ts
+function dimsFromSend(send) {
+  if (!send) return null;
+  return { fromEmail: send.fromEmail, kind: send.kind };
+}
 async function applyWebhookEvent(event, ctx) {
   const send = await ctx.collections.sends.findOne(
     event.providerMessageId ? { $or: [{ providerMessageId: event.providerMessageId }, { emailAtSend: event.email }] } : { emailAtSend: event.email },
@@ -16058,7 +16854,7 @@ async function applyWebhookEvent(event, ctx) {
           { $set: { status: "delivered", deliveredAt: event.occurredAt } }
         );
       }
-      await recordHealthCounter(ctx, "delivered");
+      await recordHealthCounter(ctx, "delivered", dimsFromSend(send));
       break;
     case "open":
       if (send) {
@@ -16113,8 +16909,11 @@ async function applyWebhookEvent(event, ctx) {
           { $set: { status: "bounced", updatedAt: /* @__PURE__ */ new Date() } }
         );
       }
-      await recordHealthCounter(ctx, "bounced");
-      await recordHealthCounter(ctx, bounceType === "hard" ? "hardBounced" : "softBounced");
+      {
+        const dims = dimsFromSend(send);
+        await recordHealthCounter(ctx, "bounced", dims);
+        await recordHealthCounter(ctx, bounceType === "hard" ? "hardBounced" : "softBounced", dims);
+      }
       break;
     }
     case "complaint":
@@ -16130,7 +16929,7 @@ async function applyWebhookEvent(event, ctx) {
         { emailAtSubscribe: event.email },
         { $set: { status: "complained", updatedAt: /* @__PURE__ */ new Date() } }
       );
-      await recordHealthCounter(ctx, "complained");
+      await recordHealthCounter(ctx, "complained", dimsFromSend(send));
       break;
     case "unsubscribe":
       if (send) {
@@ -16199,7 +16998,8 @@ var Mailer = class _Mailer {
       providers: this.providers,
       queues: this.queues,
       config: this.config,
-      handlebarsHelpers: this.config.handlebarsHelpers
+      handlebarsHelpers: this.config.handlebarsHelpers,
+      audit: (entry) => this.audit(entry)
     };
   }
   /**