mailery 0.4.0 → 0.7.0

package/dist/testing.cjs

@@ -1,13 +1,16 @@
 'use strict';
 
+var zod = require('zod');
 var mongodb = require('mongodb');
 var crypto2 = require('crypto');
 var sgMail = require('@sendgrid/mail');
-var zod = require('zod');
 var IORedis = require('ioredis');
 var Handlebars = require('handlebars');
 var htmlToText = require('html-to-text');
 var mjml2html = require('mjml');
+var dns = require('dns/promises');
+var net = require('net');
+var psl = require('psl');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
@@ -16,6 +19,9 @@ var sgMail__default = /*#__PURE__*/_interopDefault(sgMail);
 var IORedis__default = /*#__PURE__*/_interopDefault(IORedis);
 var Handlebars__default = /*#__PURE__*/_interopDefault(Handlebars);
 var mjml2html__default = /*#__PURE__*/_interopDefault(mjml2html);
+var dns__default = /*#__PURE__*/_interopDefault(dns);
+var net__default = /*#__PURE__*/_interopDefault(net);
+var psl__default = /*#__PURE__*/_interopDefault(psl);
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -57,6 +63,55 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/server/adapters/vars.ts
+var vars_exports = {};
+__export(vars_exports, {
+  RESERVED_VAR_KEYS: () => RESERVED_VAR_KEYS,
+  assertNoReservedVarKeys: () => assertNoReservedVarKeys,
+  defineVars: () => defineVars,
+  resolveVars: () => resolveVars,
+  varsJsonSchema: () => varsJsonSchema
+});
+function defineVars(adapter) {
+  return adapter;
+}
+function assertNoReservedVarKeys(adapter) {
+  const json = varsJsonSchema(adapter);
+  const props = json && typeof json === "object" ? json.properties : void 0;
+  if (!props) return;
+  const clashes = RESERVED_VAR_KEYS.filter((k) => k in props);
+  if (clashes.length > 0) {
+    throw new Error(
+      `varsAdapter schema declares reserved key(s): ${clashes.join(", ")}. These names are provided by mailery itself \u2014 rename them in your schema.`
+    );
+  }
+}
+function varsJsonSchema(adapter) {
+  return zod.z.toJSONSchema(adapter.schema, { io: "output" });
+}
+async function resolveVars(adapter, contact, info) {
+  if (!adapter) return {};
+  const resolved = await adapter.resolve(contact, info);
+  if (!resolved || typeof resolved !== "object") return {};
+  const out = { ...resolved };
+  for (const k of RESERVED_VAR_KEYS) delete out[k];
+  return out;
+}
+var RESERVED_VAR_KEYS;
+var init_vars = __esm({
+  "src/server/adapters/vars.ts"() {
+    RESERVED_VAR_KEYS = [
+      "contact",
+      "vars",
+      "event",
+      "unsubscribeUrl",
+      "viewInBrowserUrl",
+      "preferenceCenterUrl",
+      "senderAddress"
+    ];
+  }
+});
+
 // src/server/adapters/mongo.ts
 var mongo_exports = {};
 __export(mongo_exports, {
@@ -2999,19 +3054,19 @@ var require_range = __commonJS({
     var replaceCaret = (comp, options2) => {
       debug("caret", comp, options2);
       const r = options2.loose ? re[t.CARETLOOSE] : re[t.CARET];
-      const z2 = options2.includePrerelease ? "-0" : "";
+      const z3 = options2.includePrerelease ? "-0" : "";
       return comp.replace(r, (_, M, m, p, pr) => {
         debug("caret", comp, _, M, m, p, pr);
         let ret;
         if (isX(M)) {
           ret = "";
         } else if (isX(m)) {
-          ret = `>=${M}.0.0${z2} <${+M + 1}.0.0-0`;
+          ret = `>=${M}.0.0${z3} <${+M + 1}.0.0-0`;
         } else if (isX(p)) {
           if (M === "0") {
-            ret = `>=${M}.${m}.0${z2} <${M}.${+m + 1}.0-0`;
+            ret = `>=${M}.${m}.0${z3} <${M}.${+m + 1}.0-0`;
           } else {
-            ret = `>=${M}.${m}.0${z2} <${+M + 1}.0.0-0`;
+            ret = `>=${M}.${m}.0${z3} <${+M + 1}.0.0-0`;
           }
         } else if (pr) {
           debug("replaceCaret pr", pr);
@@ -3028,9 +3083,9 @@ var require_range = __commonJS({
           debug("no pr");
           if (M === "0") {
             if (m === "0") {
-              ret = `>=${M}.${m}.${p}${z2} <${M}.${m}.${+p + 1}-0`;
+              ret = `>=${M}.${m}.${p}${z3} <${M}.${m}.${+p + 1}-0`;
             } else {
-              ret = `>=${M}.${m}.${p}${z2} <${M}.${+m + 1}.0-0`;
+              ret = `>=${M}.${m}.${p}${z3} <${M}.${+m + 1}.0-0`;
             }
           } else {
             ret = `>=${M}.${m}.${p} <${+M + 1}.0.0-0`;
@@ -4165,7 +4220,7 @@ var require_getport = __commonJS({
     exports.tryPort = tryPort;
     exports.resetPortsCache = resetPortsCache;
     var tslib_1 = (init_tslib_es6(), __toCommonJS(tslib_es6_exports));
-    var net = tslib_1.__importStar(__require("net"));
+    var net2 = tslib_1.__importStar(__require("net"));
     var debug_1 = tslib_1.__importDefault(require_src());
     var log = (0, debug_1.default)("MongoMS:GetPort");
     exports.MIN_PORT = 1024;
@@ -4213,7 +4268,7 @@ var require_getport = __commonJS({
     }
     function tryPort(port) {
       return new Promise((res, rej) => {
-        const server = net.createServer();
+        const server = net2.createServer();
         if (typeof server.unref === "function") {
           server.unref();
         }
@@ -9179,7 +9234,7 @@ var require_dist = __commonJS({
     };
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.Agent = void 0;
-    var net = __importStar2(__require("net"));
+    var net2 = __importStar2(__require("net"));
     var http = __importStar2(__require("http"));
     var https_1 = __require("https");
     __exportStar2(require_helpers(), exports);
@@ -9219,7 +9274,7 @@ var require_dist = __commonJS({
         if (!this.sockets[name]) {
           this.sockets[name] = [];
         }
-        const fakeSocket = new net.Socket({ writable: false });
+        const fakeSocket = new net2.Socket({ writable: false });
         this.sockets[name].push(fakeSocket);
         this.totalSocketCount++;
         return fakeSocket;
@@ -9429,7 +9484,7 @@ var require_dist2 = __commonJS({
     };
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.HttpsProxyAgent = void 0;
-    var net = __importStar2(__require("net"));
+    var net2 = __importStar2(__require("net"));
     var tls = __importStar2(__require("tls"));
     var assert_1 = __importDefault2(__require("assert"));
     var debug_1 = __importDefault2(require_src());
@@ -9438,7 +9493,7 @@ var require_dist2 = __commonJS({
     var parse_proxy_response_1 = require_parse_proxy_response();
     var debug = (0, debug_1.default)("https-proxy-agent");
     var setServernameFromNonIpHost = (options2) => {
-      if (options2.servername === void 0 && options2.host && !net.isIP(options2.host)) {
+      if (options2.servername === void 0 && options2.host && !net2.isIP(options2.host)) {
         return {
           ...options2,
           servername: options2.host
@@ -9478,10 +9533,10 @@ var require_dist2 = __commonJS({
           socket = tls.connect(setServernameFromNonIpHost(this.connectOpts));
         } else {
           debug("Creating `net.Socket`: %o", this.connectOpts);
-          socket = net.connect(this.connectOpts);
+          socket = net2.connect(this.connectOpts);
         }
         const headers = typeof this.proxyHeaders === "function" ? this.proxyHeaders() : { ...this.proxyHeaders };
-        const host = net.isIPv6(opts.host) ? `[${opts.host}]` : opts.host;
+        const host = net2.isIPv6(opts.host) ? `[${opts.host}]` : opts.host;
         let payload = `CONNECT ${host}:${opts.port} HTTP/1.1\r
 `;
         if (proxy.username || proxy.password) {
@@ -9514,7 +9569,7 @@ var require_dist2 = __commonJS({
           return socket;
         }
         socket.destroy();
-        const fakeSocket = new net.Socket({ writable: false });
+        const fakeSocket = new net2.Socket({ writable: false });
         fakeSocket.readable = true;
         req.once("socket", (s) => {
           debug("Replaying proxy buffer for failed request");
@@ -14150,6 +14205,12 @@ var tagInputSchema = zod.z.object({
   externalId: externalIdSchema,
   tag: zod.z.string().min(1).max(128)
 });
+var abortFlowInputSchema = zod.z.object({
+  flowSlug: slugSchema,
+  externalId: externalIdSchema,
+  reason: zod.z.string().min(1).max(200).optional()
+});
+var abortAllFlowsInputSchema = abortFlowInputSchema.omit({ flowSlug: true });
 var sendOneOffInputSchema = zod.z.object({
   templateSlug: slugSchema,
   externalId: externalIdSchema,
@@ -14179,7 +14240,13 @@ var flowStepSchema = zod.z.lazy(
       type: zod.z.literal("send"),
       templateSlug: slugSchema,
       providerOverride: zod.z.string().optional(),
-      vars: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+      vars: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+      delivery: zod.z.object({
+        weekdaysOnly: zod.z.boolean().optional(),
+        timeOfDay: zod.z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, "expected HH:mm").optional(),
+        useContactTimezone: zod.z.boolean().optional(),
+        timezone: zod.z.string().optional()
+      }).optional()
     }),
     zod.z.object({
       type: zod.z.literal("tag"),
@@ -14263,6 +14330,17 @@ var predicateSchema = zod.z.lazy(
 );
 
 // src/server/config.ts
+var DEFAULT_DOMAIN_DNSBL_LISTS = [
+  { host: "dbl.spamhaus.org", label: "Spamhaus DBL" },
+  { host: "multi.surbl.org", label: "SURBL" },
+  { host: "multi.uribl.com", label: "URIBL" }
+];
+var DEFAULT_IP_DNSBL_LISTS = [
+  { host: "zen.spamhaus.org", label: "Spamhaus ZEN" },
+  { host: "b.barracudacentral.org", label: "Barracuda" },
+  { host: "dnsbl.sorbs.net", label: "SORBS" },
+  { host: "bl.spamcop.net", label: "SpamCop" }
+];
 var DEFAULTS = {
   collectionPrefix: "mailer_",
   requireDoubleOptIn: false,
@@ -14323,6 +14401,10 @@ function resolveConfig(c) {
 }
 
 // src/server/models/index.ts
+var HEALTH_AGG_ID = "agg";
+function healthBucketId(senderDomain, kind) {
+  return `d:${senderDomain ?? "_unknown"}|k:${kind}`;
+}
 function getCollections(db, prefix = "mailer_") {
   return {
     subscriptions: db.collection(`${prefix}subscriptions`),
@@ -14340,7 +14422,14 @@ function getCollections(db, prefix = "mailer_") {
     auditLog: db.collection(`${prefix}audit_log`),
     webhookEvents: db.collection(`${prefix}webhook_events`),
     health: db.collection(`${prefix}health`),
-    contactTags: db.collection(`${prefix}contact_tags`)
+    contactTags: db.collection(`${prefix}contact_tags`),
+    dnsblChecks: db.collection(`${prefix}dnsbl_checks`),
+    postmasterSnapshots: db.collection(`${prefix}postmaster_snapshots`),
+    sndsSnapshots: db.collection(`${prefix}snds_snapshots`),
+    dmarcReports: db.collection(`${prefix}dmarc_reports`),
+    dmarcFailures: db.collection(`${prefix}dmarc_failures`),
+    dmarcSourceTags: db.collection(`${prefix}dmarc_source_tags`),
+    mailTesterScores: db.collection(`${prefix}mail_tester_scores`)
   };
 }
 async function ensureIndexes(db, prefix = "mailer_") {
@@ -14412,8 +14501,58 @@ async function ensureIndexes(db, prefix = "mailer_") {
     c.contactTags.createIndexes([
       { key: { externalId: 1, tag: 1 }, unique: true },
       { key: { tag: 1 } }
+    ]),
+    c.health.createIndexes([
+      { key: { senderDomain: 1, kind: 1 } },
+      { key: { status: 1 } },
+      // setup-status reads the most-recently-touched health doc as a heartbeat.
+      { key: { updatedAt: -1 } }
+    ]),
+    c.dnsblChecks.createIndexes([
+      { key: { target: 1, list: 1 }, unique: true },
+      // Supports the admin /dnsbl GET sort: result asc, then target asc, list asc.
+      { key: { result: 1, target: 1, list: 1 } },
+      // TTL — stale rows for targets the operator removed disappear after
+      // 60 days without manual cleanup. The puller refreshes runAt on
+      // every active target so existing targets stay indefinitely.
+      { key: { runAt: 1 }, expireAfterSeconds: 60 * 24 * 60 * 60 }
+    ]),
+    c.postmasterSnapshots.createIndexes([
+      { key: { domain: 1, date: 1 }, unique: true },
+      { key: { domain: 1, fetchedAt: -1 } },
+      { key: { domainReputation: 1 } }
+    ]),
+    c.sndsSnapshots.createIndexes([
+      { key: { ip: 1, activityStart: 1 }, unique: true },
+      { key: { ip: 1, fetchedAt: -1 } },
+      { key: { filterResult: 1 } }
+    ]),
+    c.dmarcReports.createIndexes([
+      { key: { reportId: 1, orgName: 1 }, unique: true },
+      { key: { domain: 1, rangeEnd: -1 } },
+      // Cross-domain "most recent reports" queries scan a lot without this.
+      { key: { rangeEnd: -1 } },
+      { key: { receivedAt: -1 } }
+    ]),
+    c.dmarcFailures.createIndexes([
+      { key: { reportId: 1, sourceIp: 1 }, unique: true },
+      { key: { domain: 1, day: -1 } },
+      { key: { sourceIp: 1, day: -1 } },
+      { key: { receivedAt: 1 } }
+      // for retention pruning
+    ]),
+    c.dmarcSourceTags.createIndexes([
+      { key: { ip: 1 }, unique: true }
+    ]),
+    c.mailTesterScores.createIndexes([
+      { key: { contentKey: 1 }, unique: true },
+      { key: { templateSlug: 1, fetchedAt: -1 } },
+      // TTL — Mongo auto-deletes expired scores so we never serve stale data.
+      { key: { expiresAt: 1 }, expireAfterSeconds: 0 }
     ])
   ]);
+  await c.health.deleteOne({ _id: "singleton" }).catch(() => {
+  });
 }
 var EventRegistry = class {
   policies = /* @__PURE__ */ new Map();
@@ -14426,6 +14565,9 @@ var EventRegistry = class {
   policy(name) {
     return this.policies.get(name);
   }
+  list() {
+    return Array.from(this.policies, ([name, dedupePolicy]) => ({ name, dedupePolicy }));
+  }
   /**
    * Derive a dedupeKey for an event call. Returns null when no policy is
    * registered AND no key was passed — caller should throw.
@@ -14839,6 +14981,7 @@ async function tryEnterFlow(flow, event, ctx) {
     flowSlug: flow.slug,
     flowVersion: flow.version,
     emailAtEntry: sub.emailAtSubscribe,
+    triggerEvent: { name: event.name, properties: event.properties ?? {}, occurredAt: event.occurredAt },
     enteredAt: /* @__PURE__ */ new Date(),
     status: "active",
     currentStepIndex: 0,
@@ -14936,6 +15079,105 @@ function effectiveLowerBound(ctx, opts) {
   }
   return null;
 }
+
+// src/server/runner/delivery-window.ts
+var TIME_OF_DAY_GRACE_MS = 60 * 6e4;
+function computeDeliveryTime(now, window2, contactTimezone) {
+  const tz = pickTimezone(window2, contactTimezone);
+  let candidate = now;
+  if (window2.timeOfDay) {
+    const [hh, mm] = window2.timeOfDay.split(":").map(Number);
+    const local = localParts(candidate, tz);
+    const todaySlot = utcFromLocal(local.y, local.mo, local.d, hh, mm, tz);
+    if (candidate.getTime() < todaySlot.getTime()) {
+      candidate = todaySlot;
+    } else if (candidate.getTime() - todaySlot.getTime() > TIME_OF_DAY_GRACE_MS) {
+      const next = addLocalDays(local, 1);
+      candidate = utcFromLocal(next.y, next.mo, next.d, hh, mm, tz);
+    }
+  }
+  if (window2.weekdaysOnly) {
+    for (let guard = 0; guard < 3; guard++) {
+      const local = localParts(candidate, tz);
+      if (local.weekday !== "Sat" && local.weekday !== "Sun") break;
+      const shift = local.weekday === "Sat" ? 2 : 1;
+      const moved = addLocalDays(local, shift);
+      candidate = utcFromLocal(moved.y, moved.mo, moved.d, local.hh, local.mi, tz);
+    }
+  }
+  return candidate;
+}
+function pickTimezone(window2, contactTimezone) {
+  const candidates = [
+    window2.useContactTimezone ? contactTimezone : void 0,
+    window2.timezone,
+    "UTC"
+  ];
+  for (const tz of candidates) {
+    if (tz && isValidTimezone(tz)) return tz;
+  }
+  return "UTC";
+}
+var validatedZones = /* @__PURE__ */ new Map();
+function isValidTimezone(tz) {
+  const cached = validatedZones.get(tz);
+  if (cached !== void 0) return cached;
+  let ok = true;
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: tz });
+  } catch {
+    ok = false;
+  }
+  validatedZones.set(tz, ok);
+  return ok;
+}
+var partFormatters = /* @__PURE__ */ new Map();
+function formatterFor(tz) {
+  let f = partFormatters.get(tz);
+  if (!f) {
+    f = new Intl.DateTimeFormat("en-US", {
+      timeZone: tz,
+      year: "numeric",
+      month: "2-digit",
+      day: "2-digit",
+      hour: "2-digit",
+      minute: "2-digit",
+      second: "2-digit",
+      weekday: "short",
+      hour12: false
+    });
+    partFormatters.set(tz, f);
+  }
+  return f;
+}
+function localParts(date, tz) {
+  const parts = {};
+  for (const p of formatterFor(tz).formatToParts(date)) parts[p.type] = p.value;
+  return {
+    y: Number(parts.year),
+    mo: Number(parts.month),
+    d: Number(parts.day),
+    hh: Number(parts.hour) % 24,
+    // Intl emits '24' for midnight in some locales
+    mi: Number(parts.minute),
+    ss: Number(parts.second),
+    weekday: parts.weekday
+  };
+}
+function utcFromLocal(y, mo, d, hh, mi, tz) {
+  let ts = Date.UTC(y, mo - 1, d, hh, mi, 0);
+  for (let i = 0; i < 2; i++) {
+    const p = localParts(new Date(ts), tz);
+    const asUtc = Date.UTC(p.y, p.mo - 1, p.d, p.hh, p.mi, p.ss);
+    const offset = asUtc - ts;
+    ts = Date.UTC(y, mo - 1, d, hh, mi, 0) - offset;
+  }
+  return new Date(ts);
+}
+function addLocalDays(p, days) {
+  const dt = new Date(Date.UTC(p.y, p.mo - 1, p.d + days));
+  return { y: dt.getUTCFullYear(), mo: dt.getUTCMonth() + 1, d: dt.getUTCDate() };
+}
 async function compileTemplate(mjml) {
   const out = await mjml2html__default.default(mjml, { validationLevel: "soft", minify: false });
   const plainText = derivePlaintext(out.html);
@@ -15053,6 +15295,9 @@ function makeHandlebars(extra) {
   return hb;
 }
 
+// src/server/runner/send.ts
+init_vars();
+
 // src/server/runner/suppression.ts
 var SCOPES_BY_KIND = {
   marketing: ["all", "marketing"],
@@ -15075,21 +15320,59 @@ async function isSuppressed(collections, email, kind) {
   return { suppressed: false };
 }
 
+// src/server/templates/sender-domain.ts
+function extractDomain(email) {
+  if (typeof email !== "string") return null;
+  const at = email.lastIndexOf("@");
+  if (at <= 0 || at === email.length - 1) return null;
+  return email.slice(at + 1).toLowerCase().trim();
+}
+
 // src/server/runner/health.ts
-async function recordHealthCounter(ctx, counter2, by = 1) {
+var ZERO_COUNTERS = {
+  sent: 0,
+  delivered: 0,
+  bounced: 0,
+  hardBounced: 0,
+  softBounced: 0,
+  complained: 0,
+  failedToSend: 0
+};
+var ZERO_RATES = {
+  bounceRate: 0,
+  hardBounceRate: 0,
+  complaintRate: 0,
+  failureRate: 0
+};
+async function recordHealthCounter(ctx, counter2, dims, by = 1) {
+  const windowMs = ctx.config.circuitBreaker.windowMinutes * 60 * 1e3;
+  const writes = [];
+  writes.push(upsertCounter(ctx, HEALTH_AGG_ID, null, null, counter2, by, windowMs));
+  if (dims) {
+    const domain = dims.fromEmail ? extractDomain(dims.fromEmail) : null;
+    if (domain) {
+      const id = healthBucketId(domain, dims.kind);
+      writes.push(upsertCounter(ctx, id, domain, dims.kind, counter2, by, windowMs));
+    }
+  }
+  await Promise.all(writes);
+}
+async function upsertCounter(ctx, _id, senderDomain, kind, counter2, by, windowMs) {
   await ctx.collections.health.updateOne(
-    { _id: "singleton" },
+    { _id },
     {
       $inc: { [`counters.${counter2}`]: by },
       $setOnInsert: {
-        _id: "singleton",
+        _id,
+        senderDomain,
+        kind,
         windowStartedAt: /* @__PURE__ */ new Date(),
-        windowDurationMs: ctx.config.circuitBreaker.windowMinutes * 60 * 1e3,
+        windowDurationMs: windowMs,
         status: "healthy",
         trippedAt: null,
         trippedReason: null,
         manuallyResumedAt: null,
-        rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 }
+        rates: { ...ZERO_RATES }
       },
       $set: { updatedAt: /* @__PURE__ */ new Date() }
     },
@@ -15099,73 +15382,107 @@ async function recordHealthCounter(ctx, counter2, by = 1) {
 async function evaluateHealth(ctx) {
   const cb = ctx.config.circuitBreaker;
   const windowMs = cb.windowMinutes * 60 * 1e3;
-  const doc = await ctx.collections.health.findOne({ _id: "singleton" });
-  if (!doc) return;
-  const windowAge = Date.now() - new Date(doc.windowStartedAt).getTime();
-  if (windowAge > windowMs && doc.status !== "tripped") {
-    await ctx.collections.health.updateOne(
-      { _id: "singleton" },
-      {
-        $set: {
-          windowStartedAt: /* @__PURE__ */ new Date(),
-          windowDurationMs: windowMs,
-          counters: { sent: 0, delivered: 0, bounced: 0, hardBounced: 0, softBounced: 0, complained: 0, failedToSend: 0 },
-          rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 },
-          updatedAt: /* @__PURE__ */ new Date()
-        }
-      }
-    );
-    return;
+  const docs = await ctx.collections.health.find({}).toArray();
+  if (docs.length === 0) return;
+  const hasAgg = docs.some((d) => d._id === HEALTH_AGG_ID);
+  if (!hasAgg) {
+    await upsertCounter(ctx, HEALTH_AGG_ID, null, null, "sent", 0, windowMs);
   }
-  const c = doc.counters;
-  const total = c.sent || 1;
-  const rates = {
-    bounceRate: c.bounced / total,
-    hardBounceRate: c.hardBounced / total,
-    complaintRate: c.complained / total,
-    failureRate: c.failedToSend / total
-  };
-  await ctx.collections.health.updateOne(
-    { _id: "singleton" },
-    { $set: { rates, updatedAt: /* @__PURE__ */ new Date() } }
-  );
-  if (c.sent < cb.minSendsBeforeEval) return;
-  if (doc.status === "tripped") return;
-  let trippedReason = null;
-  if (rates.hardBounceRate * 100 >= cb.hardBounceRatePctTrip) {
-    trippedReason = `hard bounce rate ${(rates.hardBounceRate * 100).toFixed(2)}% >= ${cb.hardBounceRatePctTrip}%`;
-  } else if (rates.complaintRate * 100 >= cb.complaintRatePctTrip) {
-    trippedReason = `complaint rate ${(rates.complaintRate * 100).toFixed(2)}% >= ${cb.complaintRatePctTrip}%`;
-  } else if (rates.bounceRate * 100 >= cb.combinedBounceRatePctTrip) {
-    trippedReason = `combined bounce rate ${(rates.bounceRate * 100).toFixed(2)}% >= ${cb.combinedBounceRatePctTrip}%`;
-  }
-  if (trippedReason) {
+  for (const doc of docs) {
+    const isAgg = doc._id === HEALTH_AGG_ID;
+    const windowAge = Date.now() - new Date(doc.windowStartedAt).getTime();
+    if (windowAge > windowMs && doc.status !== "tripped") {
+      await ctx.collections.health.updateOne(
+        { _id: doc._id },
+        {
+          $set: {
+            windowStartedAt: /* @__PURE__ */ new Date(),
+            windowDurationMs: windowMs,
+            counters: { ...ZERO_COUNTERS },
+            rates: { ...ZERO_RATES },
+            status: "healthy",
+            updatedAt: /* @__PURE__ */ new Date()
+          }
+        }
+      );
+      continue;
+    }
+    const c = doc.counters;
+    const total = c.sent || 1;
+    const rates = {
+      bounceRate: c.bounced / total,
+      hardBounceRate: c.hardBounced / total,
+      complaintRate: c.complained / total,
+      failureRate: c.failedToSend / total
+    };
     await ctx.collections.health.updateOne(
-      { _id: "singleton" },
-      { $set: { status: "tripped", trippedAt: /* @__PURE__ */ new Date(), trippedReason, updatedAt: /* @__PURE__ */ new Date() } }
+      { _id: doc._id },
+      { $set: { rates, updatedAt: /* @__PURE__ */ new Date() } }
     );
-    if (ctx.config.onCircuitBreakerTrip) {
-      try {
-        await ctx.config.onCircuitBreakerTrip({ reason: trippedReason, rates });
-      } catch {
+    if (isAgg) continue;
+    if (c.sent < cb.minSendsBeforeEval) continue;
+    if (doc.status === "tripped") continue;
+    let trippedReason = null;
+    if (rates.hardBounceRate * 100 >= cb.hardBounceRatePctTrip) {
+      trippedReason = `hard bounce rate ${(rates.hardBounceRate * 100).toFixed(2)}% >= ${cb.hardBounceRatePctTrip}%`;
+    } else if (rates.complaintRate * 100 >= cb.complaintRatePctTrip) {
+      trippedReason = `complaint rate ${(rates.complaintRate * 100).toFixed(2)}% >= ${cb.complaintRatePctTrip}%`;
+    } else if (rates.bounceRate * 100 >= cb.combinedBounceRatePctTrip) {
+      trippedReason = `combined bounce rate ${(rates.bounceRate * 100).toFixed(2)}% >= ${cb.combinedBounceRatePctTrip}%`;
+    }
+    if (trippedReason) {
+      const result = await ctx.collections.health.updateOne(
+        { _id: doc._id, status: { $in: ["healthy", "degraded"] } },
+        { $set: { status: "tripped", trippedAt: /* @__PURE__ */ new Date(), trippedReason, updatedAt: /* @__PURE__ */ new Date() } }
+      );
+      if (result.modifiedCount > 0) {
+        if (ctx.audit) {
+          try {
+            await ctx.audit({
+              actor: "system:circuit-breaker",
+              action: "health.trip",
+              resource: {
+                collection: "mailer_health",
+                id: String(doc._id),
+                slug: `${doc.senderDomain ?? "_unknown"}|${doc.kind}`
+              },
+              diffSummary: trippedReason
+            });
+          } catch {
+          }
+        }
+        if (ctx.config.onCircuitBreakerTrip) {
+          try {
+            await ctx.config.onCircuitBreakerTrip({
+              reason: `[${doc.senderDomain ?? "_unknown"} / ${doc.kind}] ${trippedReason}`,
+              rates
+            });
+          } catch {
+          }
+        }
       }
+      continue;
     }
-    return;
-  }
-  if (rates.failureRate * 100 >= cb.failedToSendRatePctDegrade) {
-    if (doc.status !== "degraded") {
+    if (rates.failureRate * 100 >= cb.failedToSendRatePctDegrade) {
+      if (doc.status !== "degraded") {
+        await ctx.collections.health.updateOne(
+          { _id: doc._id },
+          { $set: { status: "degraded", updatedAt: /* @__PURE__ */ new Date() } }
+        );
+      }
+    } else if (doc.status === "degraded") {
       await ctx.collections.health.updateOne(
-        { _id: "singleton" },
-        { $set: { status: "degraded", updatedAt: /* @__PURE__ */ new Date() } }
+        { _id: doc._id },
+        { $set: { status: "healthy", updatedAt: /* @__PURE__ */ new Date() } }
       );
     }
-  } else if (doc.status === "degraded") {
-    await ctx.collections.health.updateOne(
-      { _id: "singleton" },
-      { $set: { status: "healthy", updatedAt: /* @__PURE__ */ new Date() } }
-    );
   }
 }
+async function getBucketStatus(ctx, fromEmail, kind) {
+  const domain = fromEmail ? extractDomain(fromEmail) : null;
+  const id = healthBucketId(domain, kind);
+  return ctx.collections.health.findOne({ _id: id });
+}
 
 // src/server/runner/send.ts
 async function handleSend(run, step, contact, flow, ctx) {
@@ -15249,8 +15566,8 @@ async function dispatchSend(sendId, ctx) {
     return;
   }
   if (send.kind === "marketing") {
-    const health = await ctx.collections.health.findOne({ _id: "singleton" });
-    if (health?.status === "tripped") {
+    const bucket = await getBucketStatus(ctx, send.fromEmail, send.kind);
+    if (bucket?.status === "tripped") {
       await ctx.queues.send.add("send", { sendId: String(send._id) }, { delay: 6e4 });
       return;
     }
@@ -15261,13 +15578,29 @@ async function dispatchSend(sendId, ctx) {
     return;
   }
   const run = send.flowRunId ? await ctx.collections.flowRuns.findOne({ _id: send.flowRunId }) : null;
-  const renderCtx = buildRenderContext(
-    contact,
-    run,
-    send.vars ?? {},
-    ctx
-  );
-  const rendered = await renderTemplate(template, renderCtx, { helpers: ctx.handlebarsHelpers });
+  if (run && run.status === "exited" && run.exitReason?.startsWith("aborted_by_host")) {
+    await ctx.collections.sends.updateOne(
+      { _id: send._id },
+      { $set: { status: "cancelled", errorMessage: `cancelled: ${run.exitReason}`, updatedAt: /* @__PURE__ */ new Date() } }
+    );
+    return;
+  }
+  let renderCtx;
+  let rendered;
+  try {
+    const resolved = await resolveVars(ctx.varsAdapter, contact, {
+      reason: "send",
+      templateSlug: template.slug,
+      flowSlug: run?.flowSlug,
+      eventName: run?.triggerEvent?.name,
+      eventProperties: run?.triggerEvent?.properties
+    });
+    renderCtx = buildRenderContext(contact, run, send.vars ?? {}, ctx, resolved);
+    rendered = await renderTemplate(template, renderCtx, { helpers: ctx.handlebarsHelpers });
+  } catch (err) {
+    await markFailed(send._id, `render error: ${String(err?.message ?? err)}`, ctx);
+    throw err;
+  }
   const tracking = applyTracking(rendered.html, {
     sendId: String(send._id),
     publicUrl: ctx.config.publicUrl,
@@ -15319,13 +15652,13 @@ async function dispatchSend(sendId, ctx) {
         }
       }
     );
-    await recordHealthCounter(ctx, "sent");
+    await recordHealthCounter(ctx, "sent", { fromEmail: send.fromEmail, kind: send.kind });
   } catch (err) {
     await ctx.collections.sends.updateOne(
       { _id: send._id },
       { $set: { status: "failed", errorMessage: String(err?.message ?? err) } }
     );
-    await recordHealthCounter(ctx, "failedToSend");
+    await recordHealthCounter(ctx, "failedToSend", { fromEmail: send.fromEmail, kind: send.kind });
     if (ctx.config.onSendFailure) {
       try {
         await ctx.config.onSendFailure({ send, error: err });
@@ -15343,7 +15676,7 @@ function pickProviderName(stepOverride, tpl, ctx) {
   }
   return ctx.config.defaultProvider;
 }
-function buildRenderContext(contact, run, vars, ctx) {
+function buildRenderContext(contact, run, vars, ctx, resolved = {}) {
   const scope = "marketing";
   const expiresAt = new Date(Date.now() + ctx.config.unsubscribeTokenLifetimeDays * 24 * 60 * 60 * 1e3);
   const token = signUnsubscribeToken(
@@ -15352,8 +15685,10 @@ function buildRenderContext(contact, run, vars, ctx) {
   );
   const unsubscribeUrl = `${ctx.config.publicUrl}/m/unsub/${token}`;
   return {
+    ...resolved,
     contact,
     vars,
+    event: run?.triggerEvent?.properties ?? {},
     unsubscribeUrl,
     senderAddress: ctx.config.senderAddress
   };
@@ -15438,8 +15773,15 @@ async function processOneRunStep(runId, ctx) {
       return handleCondition(run, step, contact, ctx);
     case "branch":
       return handleBranch(run, step, contact, ctx);
-    case "send":
+    case "send": {
+      if (step.delivery) {
+        const deliverAt = computeDeliveryTime(/* @__PURE__ */ new Date(), step.delivery, contact.timezone);
+        if (deliverAt.getTime() > Date.now() + 3e4) {
+          return deferSendForWindow(run, deliverAt, ctx);
+        }
+      }
       return handleSend(run, step, contact, flow, ctx);
+    }
     case "tag":
       return handleTag(run, step, ctx);
     case "fire_event":
@@ -15590,6 +15932,34 @@ async function handleWebhookStep(run, step, ctx) {
     }
   }
 }
+async function deferSendForWindow(run, deliverAt, ctx) {
+  const updated = await ctx.collections.flowRuns.findOneAndUpdate(
+    // Only write once per deferral — if nextActionAt already points at (or
+    // past) the slot, another worker/tick got here first.
+    { _id: run._id, currentStepIndex: run.currentStepIndex, nextActionAt: { $lt: deliverAt } },
+    {
+      $set: { nextActionAt: deliverAt, updatedAt: /* @__PURE__ */ new Date() },
+      $push: {
+        history: {
+          stepIndex: run.currentStepIndex,
+          action: "send_deferred",
+          at: /* @__PURE__ */ new Date(),
+          details: { until: deliverAt }
+        }
+      }
+    },
+    { returnDocument: "after" }
+  );
+  if (!updated) return;
+  await ctx.queues.advance.add(
+    "advance",
+    { flowRunId: String(run._id) },
+    {
+      delay: Math.max(0, deliverAt.getTime() - Date.now()),
+      jobId: `advance:${run._id}:${run.currentStepIndex}:window:${deliverAt.getTime()}`
+    }
+  );
+}
 async function advanceStep(run, ctx, log, opts = {}) {
   const stepInc = opts.stepInc ?? 1;
   const updated = await ctx.collections.flowRuns.findOneAndUpdate(
@@ -15909,7 +16279,15 @@ async function promoteSoftBounces(ctx) {
   const cutoff = new Date(Date.now() - windowDays * 864e5);
   const offenders = await ctx.collections.sends.aggregate([
     { $match: { status: "bounced", bounceType: "soft", queuedAt: { $gt: cutoff } } },
-    { $group: { _id: "$emailAtSend", count: { $sum: 1 } } },
+    { $sort: { queuedAt: 1 } },
+    {
+      $group: {
+        _id: "$emailAtSend",
+        count: { $sum: 1 },
+        lastFromEmail: { $last: "$fromEmail" },
+        lastKind: { $last: "$kind" }
+      }
+    },
     { $match: { count: { $gte: threshold } } },
     { $limit: 200 }
   ]).toArray();
@@ -15941,32 +16319,649 @@ async function promoteSoftBounces(ctx) {
       { emailAtSubscribe: email },
       { $set: { status: "bounced", updatedAt: /* @__PURE__ */ new Date() } }
     );
-    await recordHealthCounter(ctx, "hardBounced");
+    await recordHealthCounter(
+      ctx,
+      "hardBounced",
+      o.lastKind ? { fromEmail: o.lastFromEmail, kind: o.lastKind } : null
+    );
+  }
+}
+var REGISTRABLE_ONLY_LISTS = /* @__PURE__ */ new Set(["multi.surbl.org", "multi.uribl.com"]);
+var DNS_CONCURRENCY = 8;
+var defaultResolver = {
+  resolve4: (hostname) => dns__default.default.resolve4(hostname)
+};
+async function runDnsblChecks(ctx, opts = {}) {
+  const cfg = ctx.config.dnsbl ?? {};
+  const intervalHours = cfg.intervalHours ?? 24;
+  if (!opts.force && intervalHours <= 0) {
+    return { ran: false, reason: "disabled" };
+  }
+  const targets = collectTargets(ctx, cfg);
+  if (targets.domains.length === 0 && targets.ips.length === 0) {
+    return { ran: false, reason: "no_targets" };
+  }
+  const resolver = opts.resolver ?? defaultResolver;
+  const domainLists = cfg.domainLists ?? DEFAULT_DOMAIN_DNSBL_LISTS;
+  const ipLists = cfg.ipLists ?? DEFAULT_IP_DNSBL_LISTS;
+  const pairs = [];
+  for (const d of targets.domains) {
+    for (const l of domainLists) pairs.push({ target: d, targetKind: "domain", list: l });
+  }
+  for (const ip of targets.ips) {
+    for (const l of ipLists) pairs.push({ target: ip, targetKind: "ip", list: l });
+  }
+  const throttleCutoff = opts.force ? null : Date.now() - intervalHours * 60 * 60 * 1e3;
+  let duePairs = pairs;
+  if (throttleCutoff != null) {
+    const existing = await ctx.collections.dnsblChecks.find(
+      {
+        $or: pairs.map((p) => ({ target: p.target, list: p.list.host }))
+      },
+      { projection: { target: 1, list: 1, runAt: 1 } }
+    ).toArray();
+    const fresh = /* @__PURE__ */ new Set();
+    for (const e of existing) {
+      if (new Date(e.runAt).getTime() > throttleCutoff) {
+        fresh.add(`${e.target}|${e.list}`);
+      }
+    }
+    duePairs = pairs.filter((p) => !fresh.has(`${p.target}|${p.list.host}`));
+    if (duePairs.length === 0) {
+      return { ran: false, reason: "not_due", totalChecks: 0, listedCount: 0 };
+    }
+  }
+  let listedCount = 0;
+  async function processPair(p) {
+    const queryName = buildQueryName(p.target, p.targetKind, p.list.host);
+    const lookup = queryName ? await queryDnsbl(resolver, queryName) : { result: "error", returnCodes: [], errorMessage: "unsupported target format" };
+    if (lookup.transient) return;
+    if (lookup.result === "listed") listedCount++;
+    await ctx.collections.dnsblChecks.updateOne(
+      { target: p.target, list: p.list.host },
+      {
+        $set: {
+          target: p.target,
+          targetKind: p.targetKind,
+          list: p.list.host,
+          listLabel: p.list.label,
+          result: lookup.result,
+          returnCodes: lookup.returnCodes,
+          errorMessage: lookup.errorMessage,
+          runAt: /* @__PURE__ */ new Date()
+        }
+      },
+      { upsert: true }
+    );
+  }
+  let idx = 0;
+  await Promise.all(
+    Array.from({ length: Math.min(DNS_CONCURRENCY, duePairs.length) }, async () => {
+      while (idx < duePairs.length) {
+        const my = idx++;
+        await processPair(duePairs[my]);
+      }
+    })
+  );
+  return { ran: true, totalChecks: duePairs.length, listedCount };
+}
+function collectTargets(ctx, cfg) {
+  const domains = /* @__PURE__ */ new Set();
+  const registry = ctx.config.senderDomains;
+  if (registry) {
+    for (const d of Object.keys(registry)) domains.add(d.toLowerCase());
+  }
+  const fromDomain = ctx.config.fromDefaults?.email ? extractDomain(ctx.config.fromDefaults.email) : null;
+  if (fromDomain) domains.add(fromDomain);
+  const txnDomain = ctx.config.transactionalFromDefaults?.email ? extractDomain(ctx.config.transactionalFromDefaults.email) : null;
+  if (txnDomain) domains.add(txnDomain);
+  return {
+    domains: Array.from(domains),
+    ips: (cfg.dedicatedIps ?? []).filter((ip) => net__default.default.isIP(ip) !== 0)
+  };
+}
+function buildQueryName(target, kind, listHost) {
+  if (kind === "ip") {
+    const v = net__default.default.isIP(target);
+    if (v === 4) return `${reverseIPv4(target)}.${listHost}`;
+    if (v === 6) return `${reverseIPv6Nibbles(target)}.${listHost}`;
+    return null;
+  }
+  const domain = REGISTRABLE_ONLY_LISTS.has(listHost) ? registrableDomain(target) : target;
+  return `${domain}.${listHost}`;
+}
+var TRANSIENT_DNS_CODES = /* @__PURE__ */ new Set(["ESERVFAIL", "EREFUSED", "ETIMEOUT", "ETIMEDOUT", "ECONNRESET", "ECONNREFUSED"]);
+async function queryDnsbl(resolver, query) {
+  try {
+    const records = await resolver.resolve4(query);
+    return interpretRecords(records);
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOTFOUND" || code === "ENODATA") {
+      return { result: "clean", returnCodes: [], errorMessage: null };
+    }
+    if (code && TRANSIENT_DNS_CODES.has(code)) {
+      return {
+        transient: true,
+        result: "error",
+        returnCodes: [],
+        errorMessage: String(err?.message ?? err)
+      };
+    }
+    return {
+      result: "error",
+      returnCodes: [],
+      errorMessage: String(err?.message ?? err)
+    };
+  }
+}
+function interpretRecords(records) {
+  if (!records || records.length === 0) {
+    return { result: "clean", returnCodes: [], errorMessage: null };
+  }
+  const errorish = records.filter((r) => r.startsWith("127.255.255."));
+  if (errorish.length === records.length) {
+    return {
+      result: "error",
+      returnCodes: records,
+      errorMessage: `list returned reserved code(s): ${records.join(", ")}`
+    };
   }
+  const listed = records.filter((r) => r.startsWith("127.") && !r.startsWith("127.255.255."));
+  if (listed.length > 0) {
+    return { result: "listed", returnCodes: records, errorMessage: null };
+  }
+  return { result: "clean", returnCodes: records, errorMessage: null };
+}
+function reverseIPv4(ip) {
+  return ip.split(".").reverse().join(".");
+}
+function reverseIPv6Nibbles(ip) {
+  const v4Match = /:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(ip);
+  let normalized = ip;
+  if (v4Match) {
+    const octets = v4Match[1].split(".").map((o) => Number(o));
+    if (octets.length === 4 && octets.every((o) => o >= 0 && o <= 255)) {
+      const hi = (octets[0] << 8 | octets[1]).toString(16).padStart(4, "0");
+      const lo = (octets[2] << 8 | octets[3]).toString(16).padStart(4, "0");
+      normalized = ip.slice(0, v4Match.index) + ":" + hi + ":" + lo;
+    }
+  }
+  const sides = normalized.split("::");
+  let groups;
+  if (sides.length === 1) {
+    groups = sides[0].split(":");
+  } else {
+    const left = sides[0].split(":").filter(Boolean);
+    const right = sides[1].split(":").filter(Boolean);
+    const missing = 8 - left.length - right.length;
+    groups = [...left, ...Array(missing).fill("0"), ...right];
+  }
+  if (groups.length !== 8) {
+    throw new Error(`unexpected IPv6 group count for ${ip}: ${groups.length}`);
+  }
+  const padded = groups.map((g) => g.toLowerCase().padStart(4, "0")).join("");
+  return padded.split("").reverse().join(".");
+}
+function registrableDomain(domain) {
+  const parsed = psl__default.default.parse(domain);
+  if ("domain" in parsed && parsed.domain) return parsed.domain;
+  return domain;
 }
 
-// src/server/runner/tick.ts
-var STRANDED_SEND_THRESHOLD_MS = 5 * 60 * 1e3;
-async function runTick(ctx) {
+// src/server/runner/postmaster.ts
+var OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
+var POSTMASTER_BASE = "https://gmailpostmastertools.googleapis.com/v1";
+var FETCH_TIMEOUT_MS = 15e3;
+async function fetchWithTimeout(fetcher, url, init = {}, timeoutMs = FETCH_TIMEOUT_MS) {
+  const ctl = new AbortController();
+  const t = setTimeout(() => ctl.abort(), timeoutMs);
+  try {
+    return await fetcher(url, { ...init, signal: ctl.signal });
+  } finally {
+    clearTimeout(t);
+  }
+}
+function createPostmasterClient(cfg, fetcher = globalThis.fetch) {
+  let cached = null;
+  async function getAccessToken() {
+    if (cached && cached.expiresAt > Date.now() + 5 * 60 * 1e3) {
+      return cached.accessToken;
+    }
+    const body = new URLSearchParams({
+      client_id: cfg.clientId,
+      client_secret: cfg.clientSecret,
+      refresh_token: cfg.refreshToken,
+      grant_type: "refresh_token"
+    });
+    const res = await fetchWithTimeout(fetcher, OAUTH_TOKEN_URL, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+    if (!res.ok) {
+      throw new Error(`Postmaster OAuth token refresh failed: ${res.status} ${await safeText(res)}`);
+    }
+    const data = await res.json();
+    cached = {
+      accessToken: data.access_token,
+      expiresAt: Date.now() + data.expires_in * 1e3
+    };
+    return cached.accessToken;
+  }
+  async function authedGet(path) {
+    const token = await getAccessToken();
+    const res = await fetchWithTimeout(fetcher, `${POSTMASTER_BASE}${path}`, {
+      method: "GET",
+      headers: { authorization: `Bearer ${token}` }
+    });
+    if (!res.ok) {
+      throw new Error(`Postmaster GET ${path} failed: ${res.status} ${await safeText(res)}`);
+    }
+    return await res.json();
+  }
+  return {
+    async listDomains() {
+      const data = await authedGet("/domains");
+      return data.domains ?? [];
+    },
+    async getLatestTrafficStats(domain) {
+      const data = await authedGet(
+        `/domains/${encodeURIComponent(domain)}/trafficStats?pageSize=1`
+      );
+      return data.trafficStats?.[0] ?? null;
+    }
+  };
+}
+async function safeText(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "<no body>";
+  }
+}
+async function runPostmasterPull(ctx, opts = {}) {
+  const cfg = ctx.config.postmaster;
+  if (!cfg) return { ran: false, reason: "not_configured" };
+  const intervalHours = cfg.intervalHours ?? 24;
+  if (!opts.force && intervalHours <= 0) {
+    return { ran: false, reason: "disabled" };
+  }
+  const client = opts.client ?? createPostmasterClient(cfg, opts.fetcher);
+  const allDomains = resolveDomains(ctx, cfg);
+  if (allDomains.length === 0) {
+    return { ran: false, reason: "no_domains" };
+  }
+  let domains = allDomains;
+  if (!opts.force) {
+    const cutoff = Date.now() - intervalHours * 60 * 60 * 1e3;
+    const latest = await ctx.collections.postmasterSnapshots.find({ domain: { $in: allDomains } }, { projection: { domain: 1, fetchedAt: 1 } }).sort({ fetchedAt: -1 }).limit(allDomains.length * 8).toArray();
+    const lastByDomain = /* @__PURE__ */ new Map();
+    for (const s of latest) {
+      const ts = new Date(s.fetchedAt).getTime();
+      const cur = lastByDomain.get(s.domain) ?? 0;
+      if (ts > cur) lastByDomain.set(s.domain, ts);
+    }
+    domains = allDomains.filter((d) => (lastByDomain.get(d) ?? 0) < cutoff);
+    if (domains.length === 0) {
+      return { ran: false, reason: "not_due" };
+    }
+  }
+  const fetches = await Promise.all(
+    domains.map(async (domain) => {
+      try {
+        const stat = await client.getLatestTrafficStats(domain);
+        return { domain, stat, error: null };
+      } catch (err) {
+        console.error(`mailery: postmaster fetch failed for ${domain}`, err);
+        return { domain, stat: null, error: err };
+      }
+    })
+  );
+  let fetched = 0;
+  const trippedDomains = [];
+  for (const { domain, stat } of fetches) {
+    if (!stat) continue;
+    const snapshot = toSnapshot(domain, stat);
+    if (!snapshot) continue;
+    fetched++;
+    await ctx.collections.postmasterSnapshots.updateOne(
+      { domain: snapshot.domain, date: snapshot.date },
+      { $set: snapshot },
+      { upsert: true }
+    );
+    if (snapshot.domainReputation === "BAD") {
+      const kindsToTrip = kindsForDomain(ctx, domain);
+      for (const kind of kindsToTrip) {
+        const tripped = await tripBucket(ctx, domain, kind, snapshot);
+        if (tripped) trippedDomains.push(`${domain}|${kind}`);
+      }
+    }
+  }
+  return { ran: true, fetched, trippedDomains };
+}
+function kindsForDomain(ctx, domain) {
+  const registry = ctx.config.senderDomains ?? {};
+  const entry = registry[domain.toLowerCase()];
+  if (!entry) return [];
+  if (entry.kind === "both") return ["marketing", "transactional"];
+  return [entry.kind];
+}
+function resolveDomains(ctx, cfg) {
+  if (cfg.domains && cfg.domains.length > 0) {
+    return cfg.domains.map((d) => d.toLowerCase());
+  }
+  const out = /* @__PURE__ */ new Set();
+  const registry = ctx.config.senderDomains;
+  if (registry) {
+    for (const d of Object.keys(registry)) out.add(d.toLowerCase());
+  }
+  const f = ctx.config.fromDefaults?.email ? extractDomain(ctx.config.fromDefaults.email) : null;
+  if (f) out.add(f);
+  const t = ctx.config.transactionalFromDefaults?.email ? extractDomain(ctx.config.transactionalFromDefaults.email) : null;
+  if (t) out.add(t);
+  return Array.from(out);
+}
+function toSnapshot(domain, stat) {
+  const m = /\/trafficStats\/(\d{8})$/.exec(stat.name ?? "");
+  if (!m) {
+    console.error(`mailery: postmaster snapshot for ${domain} has unrecognized name "${stat.name}" \u2014 skipping`);
+    return null;
+  }
+  const yyyymmdd = m[1];
+  const date = `${yyyymmdd.slice(0, 4)}-${yyyymmdd.slice(4, 6)}-${yyyymmdd.slice(6, 8)}`;
+  return {
+    domain,
+    date,
+    domainReputation: stat.domainReputation ?? null,
+    ipReputations: stat.ipReputations ? stat.ipReputations.map((r) => ({
+      reputation: r.reputation,
+      ipCount: typeof r.ipCount === "string" ? Number(r.ipCount) : r.ipCount
+    })) : null,
+    userReportedSpamRatio: stat.userReportedSpamRatio ?? null,
+    spfSuccessRatio: stat.spfSuccessRatio ?? null,
+    dkimSuccessRatio: stat.dkimSuccessRatio ?? null,
+    dmarcSuccessRatio: stat.dmarcSuccessRatio ?? null,
+    outboundEncryptionRatio: stat.outboundEncryptionRatio ?? null,
+    inboundEncryptionRatio: stat.inboundEncryptionRatio ?? null,
+    deliveryErrors: stat.deliveryErrors ?? null,
+    spammyFeedbackLoops: stat.spammyFeedbackLoops ?? null,
+    fetchedAt: /* @__PURE__ */ new Date()
+  };
+}
+async function tripBucket(ctx, domain, kind, snapshot) {
+  const id = healthBucketId(domain, kind);
+  const reason = `Postmaster Tools reports ${domain} reputation = BAD on ${snapshot.date}`;
+  const prior = await ctx.collections.health.findOne({ _id: id });
+  if (prior?.status === "tripped") {
+    return false;
+  }
   await ctx.collections.health.updateOne(
-    { _id: "singleton" },
+    { _id: id },
     {
-      $set: { updatedAt: /* @__PURE__ */ new Date() },
+      $set: {
+        status: "tripped",
+        trippedAt: /* @__PURE__ */ new Date(),
+        trippedReason: reason,
+        updatedAt: /* @__PURE__ */ new Date()
+      },
       $setOnInsert: {
-        _id: "singleton",
+        _id: id,
+        senderDomain: domain,
+        kind,
         windowStartedAt: /* @__PURE__ */ new Date(),
         windowDurationMs: ctx.config.circuitBreaker.windowMinutes * 60 * 1e3,
-        status: "healthy",
-        trippedAt: null,
-        trippedReason: null,
         manuallyResumedAt: null,
         counters: { sent: 0, delivered: 0, bounced: 0, hardBounced: 0, softBounced: 0, complained: 0, failedToSend: 0 },
         rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 }
       }
     },
     { upsert: true }
-  ).catch(() => {
-  });
+  );
+  if (ctx.config.onCircuitBreakerTrip) {
+    try {
+      await ctx.config.onCircuitBreakerTrip({ reason, rates: { userReportedSpamRatio: snapshot.userReportedSpamRatio ?? 0 } });
+    } catch {
+    }
+  }
+  return true;
+}
+
+// src/server/runner/snds.ts
+var SNDS_DATA_URL = "https://postmaster.live.com/snds/data.aspx";
+var FETCH_TIMEOUT_MS2 = 3e4;
+async function runSndsPull(ctx, opts = {}) {
+  const cfg = ctx.config.snds;
+  if (!cfg?.accessKey) return { ran: false, reason: "not_configured" };
+  const intervalHours = cfg.intervalHours ?? 24;
+  if (!opts.force && intervalHours <= 0) return { ran: false, reason: "disabled" };
+  if (!opts.force) {
+    const latest = await ctx.collections.sndsSnapshots.find({}).sort({ fetchedAt: -1 }).limit(1).toArray();
+    if (latest[0]) {
+      const ageMs = Date.now() - new Date(latest[0].fetchedAt).getTime();
+      if (ageMs < intervalHours * 60 * 60 * 1e3) {
+        return { ran: false, reason: "not_due" };
+      }
+    }
+  }
+  const fetcher = opts.fetcher ?? globalThis.fetch;
+  const url = `${SNDS_DATA_URL}?key=${encodeURIComponent(cfg.accessKey)}`;
+  const ctl = new AbortController();
+  const t = setTimeout(() => ctl.abort(), FETCH_TIMEOUT_MS2);
+  let res;
+  try {
+    res = await fetcher(url, { method: "GET", signal: ctl.signal });
+  } catch (err) {
+    throw new Error(`SNDS data fetch failed: ${redactKey(String(err?.message ?? err), cfg.accessKey)}`);
+  } finally {
+    clearTimeout(t);
+  }
+  if (!res.ok) {
+    throw new Error(`SNDS data fetch failed: ${res.status} ${redactKey(await safeText2(res), cfg.accessKey)}`);
+  }
+  const csv = await res.text();
+  const rows = parseSndsCsv(csv);
+  const ipFilter = cfg.ips?.length ? new Set(cfg.ips) : null;
+  const now = /* @__PURE__ */ new Date();
+  const ops = rows.filter((row) => !ipFilter || ipFilter.has(row.ip)).map((row) => ({
+    updateOne: {
+      filter: { ip: row.ip, activityStart: row.activityStart },
+      update: { $set: { ...row, fetchedAt: now } },
+      upsert: true
+    }
+  }));
+  let persisted = 0;
+  if (ops.length > 0) {
+    const r = await ctx.collections.sndsSnapshots.bulkWrite(ops, { ordered: false });
+    persisted = (r.modifiedCount ?? 0) + (r.upsertedCount ?? 0);
+  }
+  return { ran: true, rowsParsed: rows.length, rowsPersisted: persisted };
+}
+function redactKey(s, key) {
+  if (!key) return s;
+  return s.split(key).join("<redacted>").split(encodeURIComponent(key)).join("<redacted>");
+}
+async function safeText2(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "<no body>";
+  }
+}
+function parseSndsCsv(csv) {
+  const out = [];
+  for (const raw of csv.split(/\r?\n/)) {
+    if (!raw.trim()) continue;
+    const fields = splitCsvRow(raw);
+    if (fields.length < 7) continue;
+    const parsed = parseRow(fields);
+    if (parsed) out.push(parsed);
+  }
+  return out;
+}
+function splitCsvRow(row) {
+  const out = [];
+  let cur = "";
+  let inQuotes = false;
+  for (let i = 0; i < row.length; i++) {
+    const ch = row[i];
+    if (inQuotes) {
+      if (ch === '"') {
+        if (row[i + 1] === '"') {
+          cur += '"';
+          i++;
+        } else {
+          inQuotes = false;
+        }
+      } else {
+        cur += ch;
+      }
+    } else if (ch === '"') {
+      inQuotes = true;
+    } else if (ch === ",") {
+      out.push(cur);
+      cur = "";
+    } else {
+      cur += ch;
+    }
+  }
+  out.push(cur);
+  return out.map((f) => f.trim());
+}
+function parseRow(fields) {
+  const [
+    ip,
+    activityStart,
+    activityEnd,
+    rcptCommands,
+    dataCommands,
+    messageRecipients,
+    filterResult,
+    complaintRate,
+    trapMessageCount,
+    sampleHelo,
+    sampleMailFrom
+  ] = fields;
+  const start = parseSndsDate(activityStart ?? "");
+  const end = parseSndsDate(activityEnd ?? "");
+  if (!ip || !start || !end) return null;
+  return {
+    ip,
+    activityStart: start,
+    activityEnd: end,
+    rcptCommands: toInt(rcptCommands),
+    dataCommands: toInt(dataCommands),
+    messageRecipients: toInt(messageRecipients),
+    filterResult: normalizeFilter(filterResult ?? ""),
+    complaintRate: parseComplaintRate(complaintRate ?? ""),
+    trapMessageCount: toInt(trapMessageCount),
+    sampleHelo: sampleHelo ? sampleHelo : null,
+    sampleMailFrom: sampleMailFrom ? sampleMailFrom : null
+  };
+}
+function toInt(s) {
+  if (!s) return 0;
+  const n = Number(s.replace(/[^\d-]/g, ""));
+  return Number.isFinite(n) ? n : 0;
+}
+function normalizeFilter(s) {
+  const u = s.toUpperCase().trim();
+  if (u === "GREEN" || u === "YELLOW" || u === "RED") return u;
+  return "UNKNOWN";
+}
+function parseComplaintRate(s) {
+  const trimmed = s.trim();
+  if (!trimmed || trimmed === "-" || /n\/?a/i.test(trimmed)) return null;
+  const cleaned = trimmed.replace(/%/g, "");
+  let m = /^<\s*(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[1]) / 100;
+  m = /^>\s*(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[1]) / 100;
+  m = /^(\d+(?:\.\d+)?)\s*-\s*(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[2]) / 100;
+  m = /^(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[1]) / 100;
+  return null;
+}
+function parseSndsDate(s) {
+  const trimmed = s.trim();
+  if (!trimmed) return null;
+  const m = /^(\d{1,2})\/(\d{1,2})\/(\d{4})\s+(\d{1,2}):(\d{2})(?::(\d{2}))?\s*(AM|PM)?$/i.exec(trimmed);
+  if (m) {
+    const month = Number(m[1]) - 1;
+    const day = Number(m[2]);
+    const year = Number(m[3]);
+    let hour = Number(m[4]);
+    const minute = Number(m[5]);
+    const second = Number(m[6] ?? 0);
+    const meridiem = m[7]?.toUpperCase();
+    if (meridiem === "PM" && hour < 12) hour += 12;
+    if (meridiem === "AM" && hour === 12) hour = 0;
+    const wallMs = Date.UTC(year, month, day, hour, minute, second);
+    if (!Number.isFinite(wallMs)) return null;
+    const offsetHours = isUsPacificDst(year, month, day) ? 7 : 8;
+    return new Date(wallMs + offsetHours * 60 * 60 * 1e3);
+  }
+  const d = new Date(trimmed);
+  if (!isNaN(d.getTime())) return d;
+  return null;
+}
+function isUsPacificDst(year, month0, day) {
+  if (month0 > 2 && month0 < 10) return true;
+  if (month0 < 2 || month0 > 10) return false;
+  if (month0 === 2) {
+    const dst2 = nthSundayOfMonth(year, 2, 2);
+    return day >= dst2;
+  }
+  const dst = nthSundayOfMonth(year, 10, 1);
+  return day < dst;
+}
+function nthSundayOfMonth(year, month0, n) {
+  const first = new Date(Date.UTC(year, month0, 1));
+  const dayOfWeek = first.getUTCDay();
+  const firstSunday = 1 + (7 - dayOfWeek) % 7;
+  return firstSunday + (n - 1) * 7;
+}
+var _lastPruneAt = 0;
+var PRUNE_INTERVAL_MS = 60 * 60 * 1e3;
+async function pruneDmarcFailures(ctx, opts = {}) {
+  const cfg = ctx.config.dmarc;
+  const days = cfg?.retentionDays ?? 90;
+  if (days <= 0) return 0;
+  if (!opts.force && Date.now() - _lastPruneAt < PRUNE_INTERVAL_MS) return 0;
+  _lastPruneAt = Date.now();
+  const cutoff = new Date(Date.now() - days * 864e5);
+  const r = await ctx.collections.dmarcFailures.deleteMany({ receivedAt: { $lt: cutoff } });
+  return r.deletedCount ?? 0;
+}
+
+// src/server/runner/tick.ts
+var STRANDED_SEND_THRESHOLD_MS = 5 * 60 * 1e3;
+async function runTick(ctx) {
+  try {
+    await ctx.collections.health.updateOne(
+      { _id: HEALTH_AGG_ID },
+      {
+        $set: { updatedAt: /* @__PURE__ */ new Date() },
+        $setOnInsert: {
+          _id: HEALTH_AGG_ID,
+          senderDomain: null,
+          kind: null,
+          windowStartedAt: /* @__PURE__ */ new Date(),
+          windowDurationMs: ctx.config.circuitBreaker.windowMinutes * 60 * 1e3,
+          status: "healthy",
+          trippedAt: null,
+          trippedReason: null,
+          manuallyResumedAt: null,
+          counters: { sent: 0, delivered: 0, bounced: 0, hardBounced: 0, softBounced: 0, complained: 0, failedToSend: 0 },
+          rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 }
+        }
+      },
+      { upsert: true }
+    );
+  } catch (err) {
+    console.error("mailery: heartbeat write failed", err);
+  }
   await processNewlyFiredEventTriggers(ctx).catch((err) => {
     console.error("mailery: triggers scan failed", err);
   });
@@ -15988,6 +16983,20 @@ async function runTick(ctx) {
   await promoteSoftBounces(ctx).catch((err) => {
     console.error("mailery: soft-bounce promotion failed", err);
   });
+  await Promise.all([
+    runDnsblChecks(ctx).catch((err) => {
+      console.error("mailery: dnsbl checks failed", err);
+    }),
+    runPostmasterPull(ctx).catch((err) => {
+      console.error("mailery: postmaster pull failed", err);
+    }),
+    runSndsPull(ctx).catch((err) => {
+      console.error("mailery: snds pull failed", err);
+    }),
+    pruneDmarcFailures(ctx).catch((err) => {
+      console.error("mailery: dmarc prune failed", err);
+    })
+  ]);
 }
 async function sweepStrandedSends(ctx) {
   const cutoff = new Date(Date.now() - STRANDED_SEND_THRESHOLD_MS);
@@ -16045,6 +17054,10 @@ async function processScheduledBroadcasts2(ctx) {
 }
 
 // src/server/runner/webhook.ts
+function dimsFromSend(send) {
+  if (!send) return null;
+  return { fromEmail: send.fromEmail, kind: send.kind };
+}
 async function applyWebhookEvent(event, ctx) {
   const send = await ctx.collections.sends.findOne(
     event.providerMessageId ? { $or: [{ providerMessageId: event.providerMessageId }, { emailAtSend: event.email }] } : { emailAtSend: event.email },
@@ -16058,7 +17071,7 @@ async function applyWebhookEvent(event, ctx) {
           { $set: { status: "delivered", deliveredAt: event.occurredAt } }
         );
       }
-      await recordHealthCounter(ctx, "delivered");
+      await recordHealthCounter(ctx, "delivered", dimsFromSend(send));
       break;
     case "open":
       if (send) {
@@ -16113,8 +17126,11 @@ async function applyWebhookEvent(event, ctx) {
           { $set: { status: "bounced", updatedAt: /* @__PURE__ */ new Date() } }
         );
       }
-      await recordHealthCounter(ctx, "bounced");
-      await recordHealthCounter(ctx, bounceType === "hard" ? "hardBounced" : "softBounced");
+      {
+        const dims = dimsFromSend(send);
+        await recordHealthCounter(ctx, "bounced", dims);
+        await recordHealthCounter(ctx, bounceType === "hard" ? "hardBounced" : "softBounced", dims);
+      }
       break;
     }
     case "complaint":
@@ -16130,7 +17146,7 @@ async function applyWebhookEvent(event, ctx) {
         { emailAtSubscribe: event.email },
         { $set: { status: "complained", updatedAt: /* @__PURE__ */ new Date() } }
       );
-      await recordHealthCounter(ctx, "complained");
+      await recordHealthCounter(ctx, "complained", dimsFromSend(send));
       break;
     case "unsubscribe":
       if (send) {
@@ -16196,10 +17212,12 @@ var Mailer = class _Mailer {
       db: this.db,
       collections: this.collections,
       adapter: this.adapter,
+      varsAdapter: this.config.varsAdapter,
       providers: this.providers,
       queues: this.queues,
       config: this.config,
-      handlebarsHelpers: this.config.handlebarsHelpers
+      handlebarsHelpers: this.config.handlebarsHelpers,
+      audit: (entry) => this.audit(entry)
     };
   }
   /**
@@ -16274,6 +17292,10 @@ var Mailer = class _Mailer {
     if (!config.providers[config.defaultProvider]) {
       throw new Error(`defaultProvider "${config.defaultProvider}" not in providers map`);
     }
+    if (config.varsAdapter) {
+      const { assertNoReservedVarKeys: assertNoReservedVarKeys2 } = await Promise.resolve().then(() => (init_vars(), vars_exports));
+      assertNoReservedVarKeys2(config.varsAdapter);
+    }
     const collections = getCollections(config.db, config.collectionPrefix);
     await ensureIndexes(config.db, config.collectionPrefix);
     const queueDriver = await createQueueDriver(config.queue, config.db);
@@ -16489,6 +17511,72 @@ var Mailer = class _Mailer {
       await this.collections.contactTags.deleteOne({ externalId: parsed.externalId, tag: parsed.tag });
     }
   }
+  // -------------------------------------------------------------------------
+  // Flow abort
+  // -------------------------------------------------------------------------
+  /**
+   * Abort every active run of one flow for a contact, immediately. Runs parked
+   * in a `wait` exit too — their delayed wake-up jobs find the run exited and
+   * no-op. Also cancels any of the flow's emails still sitting in the send
+   * queue for this contact (queued or awaiting retry), so an abort means no
+   * further mail, not just no further steps.
+   *
+   * No-op (returns zero counts) when nothing is active. Safe to call from the
+   * same handler that processes the business event ("user upgraded").
+   */
+  async abortFlow(flowSlug, externalId, opts = {}) {
+    const parsed = abortFlowInputSchema.parse({ flowSlug, externalId, reason: opts.reason });
+    const flow = await this.collections.flows.findOne(
+      { slug: parsed.flowSlug },
+      { projection: { _id: 1 } }
+    );
+    if (!flow) throw new Error(`abortFlow: unknown flow slug "${parsed.flowSlug}"`);
+    const result = await this.abortActiveRuns(
+      { externalId: parsed.externalId, flowId: flow._id },
+      parsed.reason ? `aborted_by_host:${parsed.reason}` : "aborted_by_host"
+    );
+    if (result.abortedRuns > 0 || result.cancelledSends > 0) {
+      await this.audit({
+        actor: "host",
+        action: "flow.abort",
+        resource: { collection: "mailer_flow_runs", slug: parsed.flowSlug },
+        diffSummary: `abortFlow slug=${parsed.flowSlug} externalId=${parsed.externalId} runs=${result.abortedRuns} sends=${result.cancelledSends}${parsed.reason ? ` reason=${parsed.reason}` : ""}`
+      });
+    }
+    return result;
+  }
+  /**
+   * Abort every active flow run for a contact across all flows. Same semantics
+   * as `abortFlow` — for "stop everything" events (account deleted, churned).
+   */
+  async abortAllFlows(externalId, opts = {}) {
+    const parsed = abortAllFlowsInputSchema.parse({ externalId, reason: opts.reason });
+    const result = await this.abortActiveRuns(
+      { externalId: parsed.externalId },
+      parsed.reason ? `aborted_by_host:${parsed.reason}` : "aborted_by_host"
+    );
+    if (result.abortedRuns > 0 || result.cancelledSends > 0) {
+      await this.audit({
+        actor: "host",
+        action: "flow.abort_all",
+        resource: { collection: "mailer_flow_runs" },
+        diffSummary: `abortAllFlows externalId=${parsed.externalId} runs=${result.abortedRuns} sends=${result.cancelledSends}${parsed.reason ? ` reason=${parsed.reason}` : ""}`
+      });
+    }
+    return result;
+  }
+  async abortActiveRuns(filter, exitReason) {
+    const runs = await this.collections.flowRuns.find({ ...filter, status: "active" }).toArray();
+    if (runs.length === 0) return { abortedRuns: 0, cancelledSends: 0 };
+    for (const run of runs) {
+      await exitFlowRun(run, exitReason, this.runnerContext);
+    }
+    const cancelled = await this.collections.sends.updateMany(
+      { flowRunId: { $in: runs.map((r) => r._id) }, status: { $in: ["queued", "failed"] } },
+      { $set: { status: "cancelled", errorMessage: `cancelled: ${exitReason}`, updatedAt: /* @__PURE__ */ new Date() } }
+    );
+    return { abortedRuns: runs.length, cancelledSends: cancelled.modifiedCount };
+  }
   /**
    * GDPR right-to-erasure. Hard-deletes the contact's PII and leaves a hashed
    * suppression row to block re-import. INVARIANT 9.