mailery 0.4.0 → 0.7.0

package/dist/index.cjs

@@ -1,14 +1,18 @@
 'use strict';
 
+var zod = require('zod');
 var mongodb = require('mongodb');
 var crypto2 = require('crypto');
 var sgMail = require('@sendgrid/mail');
-var zod = require('zod');
 var IORedis = require('ioredis');
 var Handlebars = require('handlebars');
 var htmlToText = require('html-to-text');
 var mjml2html = require('mjml');
+var dns = require('dns/promises');
+var net = require('net');
+var psl = require('psl');
 var express = require('express');
+var multer = require('multer');
 var path = require('path');
 var url = require('url');
 var fs = require('fs');
@@ -21,12 +25,22 @@ var sgMail__default = /*#__PURE__*/_interopDefault(sgMail);
 var IORedis__default = /*#__PURE__*/_interopDefault(IORedis);
 var Handlebars__default = /*#__PURE__*/_interopDefault(Handlebars);
 var mjml2html__default = /*#__PURE__*/_interopDefault(mjml2html);
+var dns__default = /*#__PURE__*/_interopDefault(dns);
+var net__default = /*#__PURE__*/_interopDefault(net);
+var psl__default = /*#__PURE__*/_interopDefault(psl);
 var express__default = /*#__PURE__*/_interopDefault(express);
+var multer__default = /*#__PURE__*/_interopDefault(multer);
 var path__default = /*#__PURE__*/_interopDefault(path);
 var fs__default = /*#__PURE__*/_interopDefault(fs);
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -35,6 +49,55 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/server/adapters/vars.ts
+var vars_exports = {};
+__export(vars_exports, {
+  RESERVED_VAR_KEYS: () => exports.RESERVED_VAR_KEYS,
+  assertNoReservedVarKeys: () => assertNoReservedVarKeys,
+  defineVars: () => defineVars,
+  resolveVars: () => resolveVars,
+  varsJsonSchema: () => varsJsonSchema
+});
+function defineVars(adapter) {
+  return adapter;
+}
+function assertNoReservedVarKeys(adapter) {
+  const json = varsJsonSchema(adapter);
+  const props = json && typeof json === "object" ? json.properties : void 0;
+  if (!props) return;
+  const clashes = exports.RESERVED_VAR_KEYS.filter((k) => k in props);
+  if (clashes.length > 0) {
+    throw new Error(
+      `varsAdapter schema declares reserved key(s): ${clashes.join(", ")}. These names are provided by mailery itself \u2014 rename them in your schema.`
+    );
+  }
+}
+function varsJsonSchema(adapter) {
+  return zod.z.toJSONSchema(adapter.schema, { io: "output" });
+}
+async function resolveVars(adapter, contact, info) {
+  if (!adapter) return {};
+  const resolved = await adapter.resolve(contact, info);
+  if (!resolved || typeof resolved !== "object") return {};
+  const out = { ...resolved };
+  for (const k of exports.RESERVED_VAR_KEYS) delete out[k];
+  return out;
+}
+exports.RESERVED_VAR_KEYS = void 0;
+var init_vars = __esm({
+  "src/server/adapters/vars.ts"() {
+    exports.RESERVED_VAR_KEYS = [
+      "contact",
+      "vars",
+      "event",
+      "unsubscribeUrl",
+      "viewInBrowserUrl",
+      "preferenceCenterUrl",
+      "senderAddress"
+    ];
+  }
+});
+
 // src/server/adapters/mongo.ts
 var mongo_exports = {};
 __export(mongo_exports, {
@@ -348,6 +411,12 @@ var tagInputSchema = zod.z.object({
   externalId: externalIdSchema,
   tag: zod.z.string().min(1).max(128)
 });
+var abortFlowInputSchema = zod.z.object({
+  flowSlug: slugSchema,
+  externalId: externalIdSchema,
+  reason: zod.z.string().min(1).max(200).optional()
+});
+var abortAllFlowsInputSchema = abortFlowInputSchema.omit({ flowSlug: true });
 var sendOneOffInputSchema = zod.z.object({
   templateSlug: slugSchema,
   externalId: externalIdSchema,
@@ -377,7 +446,13 @@ var flowStepSchema = zod.z.lazy(
       type: zod.z.literal("send"),
       templateSlug: slugSchema,
       providerOverride: zod.z.string().optional(),
-      vars: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+      vars: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+      delivery: zod.z.object({
+        weekdaysOnly: zod.z.boolean().optional(),
+        timeOfDay: zod.z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, "expected HH:mm").optional(),
+        useContactTimezone: zod.z.boolean().optional(),
+        timezone: zod.z.string().optional()
+      }).optional()
     }),
     zod.z.object({
       type: zod.z.literal("tag"),
@@ -461,6 +536,17 @@ var predicateSchema = zod.z.lazy(
 );
 
 // src/server/config.ts
+var DEFAULT_DOMAIN_DNSBL_LISTS = [
+  { host: "dbl.spamhaus.org", label: "Spamhaus DBL" },
+  { host: "multi.surbl.org", label: "SURBL" },
+  { host: "multi.uribl.com", label: "URIBL" }
+];
+var DEFAULT_IP_DNSBL_LISTS = [
+  { host: "zen.spamhaus.org", label: "Spamhaus ZEN" },
+  { host: "b.barracudacentral.org", label: "Barracuda" },
+  { host: "dnsbl.sorbs.net", label: "SORBS" },
+  { host: "bl.spamcop.net", label: "SpamCop" }
+];
 var DEFAULTS = {
   collectionPrefix: "mailer_",
   requireDoubleOptIn: false,
@@ -521,6 +607,10 @@ function resolveConfig(c) {
 }
 
 // src/server/models/index.ts
+var HEALTH_AGG_ID = "agg";
+function healthBucketId(senderDomain, kind) {
+  return `d:${senderDomain ?? "_unknown"}|k:${kind}`;
+}
 function getCollections(db, prefix = "mailer_") {
   return {
     subscriptions: db.collection(`${prefix}subscriptions`),
@@ -538,7 +628,14 @@ function getCollections(db, prefix = "mailer_") {
     auditLog: db.collection(`${prefix}audit_log`),
     webhookEvents: db.collection(`${prefix}webhook_events`),
     health: db.collection(`${prefix}health`),
-    contactTags: db.collection(`${prefix}contact_tags`)
+    contactTags: db.collection(`${prefix}contact_tags`),
+    dnsblChecks: db.collection(`${prefix}dnsbl_checks`),
+    postmasterSnapshots: db.collection(`${prefix}postmaster_snapshots`),
+    sndsSnapshots: db.collection(`${prefix}snds_snapshots`),
+    dmarcReports: db.collection(`${prefix}dmarc_reports`),
+    dmarcFailures: db.collection(`${prefix}dmarc_failures`),
+    dmarcSourceTags: db.collection(`${prefix}dmarc_source_tags`),
+    mailTesterScores: db.collection(`${prefix}mail_tester_scores`)
   };
 }
 async function ensureIndexes(db, prefix = "mailer_") {
@@ -610,8 +707,58 @@ async function ensureIndexes(db, prefix = "mailer_") {
     c.contactTags.createIndexes([
       { key: { externalId: 1, tag: 1 }, unique: true },
       { key: { tag: 1 } }
+    ]),
+    c.health.createIndexes([
+      { key: { senderDomain: 1, kind: 1 } },
+      { key: { status: 1 } },
+      // setup-status reads the most-recently-touched health doc as a heartbeat.
+      { key: { updatedAt: -1 } }
+    ]),
+    c.dnsblChecks.createIndexes([
+      { key: { target: 1, list: 1 }, unique: true },
+      // Supports the admin /dnsbl GET sort: result asc, then target asc, list asc.
+      { key: { result: 1, target: 1, list: 1 } },
+      // TTL — stale rows for targets the operator removed disappear after
+      // 60 days without manual cleanup. The puller refreshes runAt on
+      // every active target so existing targets stay indefinitely.
+      { key: { runAt: 1 }, expireAfterSeconds: 60 * 24 * 60 * 60 }
+    ]),
+    c.postmasterSnapshots.createIndexes([
+      { key: { domain: 1, date: 1 }, unique: true },
+      { key: { domain: 1, fetchedAt: -1 } },
+      { key: { domainReputation: 1 } }
+    ]),
+    c.sndsSnapshots.createIndexes([
+      { key: { ip: 1, activityStart: 1 }, unique: true },
+      { key: { ip: 1, fetchedAt: -1 } },
+      { key: { filterResult: 1 } }
+    ]),
+    c.dmarcReports.createIndexes([
+      { key: { reportId: 1, orgName: 1 }, unique: true },
+      { key: { domain: 1, rangeEnd: -1 } },
+      // Cross-domain "most recent reports" queries scan a lot without this.
+      { key: { rangeEnd: -1 } },
+      { key: { receivedAt: -1 } }
+    ]),
+    c.dmarcFailures.createIndexes([
+      { key: { reportId: 1, sourceIp: 1 }, unique: true },
+      { key: { domain: 1, day: -1 } },
+      { key: { sourceIp: 1, day: -1 } },
+      { key: { receivedAt: 1 } }
+      // for retention pruning
+    ]),
+    c.dmarcSourceTags.createIndexes([
+      { key: { ip: 1 }, unique: true }
+    ]),
+    c.mailTesterScores.createIndexes([
+      { key: { contentKey: 1 }, unique: true },
+      { key: { templateSlug: 1, fetchedAt: -1 } },
+      // TTL — Mongo auto-deletes expired scores so we never serve stale data.
+      { key: { expiresAt: 1 }, expireAfterSeconds: 0 }
     ])
   ]);
+  await c.health.deleteOne({ _id: "singleton" }).catch(() => {
+  });
 }
 var EventRegistry = class {
   policies = /* @__PURE__ */ new Map();
@@ -624,6 +771,9 @@ var EventRegistry = class {
   policy(name) {
     return this.policies.get(name);
   }
+  list() {
+    return Array.from(this.policies, ([name, dedupePolicy]) => ({ name, dedupePolicy }));
+  }
   /**
    * Derive a dedupeKey for an event call. Returns null when no policy is
    * registered AND no key was passed — caller should throw.
@@ -1092,6 +1242,7 @@ async function tryEnterFlow(flow, event, ctx) {
     flowSlug: flow.slug,
     flowVersion: flow.version,
     emailAtEntry: sub.emailAtSubscribe,
+    triggerEvent: { name: event.name, properties: event.properties ?? {}, occurredAt: event.occurredAt },
     enteredAt: /* @__PURE__ */ new Date(),
     status: "active",
     currentStepIndex: 0,
@@ -1189,6 +1340,105 @@ function effectiveLowerBound(ctx, opts) {
   }
   return null;
 }
+
+// src/server/runner/delivery-window.ts
+var TIME_OF_DAY_GRACE_MS = 60 * 6e4;
+function computeDeliveryTime(now, window, contactTimezone) {
+  const tz = pickTimezone(window, contactTimezone);
+  let candidate = now;
+  if (window.timeOfDay) {
+    const [hh, mm] = window.timeOfDay.split(":").map(Number);
+    const local = localParts(candidate, tz);
+    const todaySlot = utcFromLocal(local.y, local.mo, local.d, hh, mm, tz);
+    if (candidate.getTime() < todaySlot.getTime()) {
+      candidate = todaySlot;
+    } else if (candidate.getTime() - todaySlot.getTime() > TIME_OF_DAY_GRACE_MS) {
+      const next = addLocalDays(local, 1);
+      candidate = utcFromLocal(next.y, next.mo, next.d, hh, mm, tz);
+    }
+  }
+  if (window.weekdaysOnly) {
+    for (let guard = 0; guard < 3; guard++) {
+      const local = localParts(candidate, tz);
+      if (local.weekday !== "Sat" && local.weekday !== "Sun") break;
+      const shift = local.weekday === "Sat" ? 2 : 1;
+      const moved = addLocalDays(local, shift);
+      candidate = utcFromLocal(moved.y, moved.mo, moved.d, local.hh, local.mi, tz);
+    }
+  }
+  return candidate;
+}
+function pickTimezone(window, contactTimezone) {
+  const candidates = [
+    window.useContactTimezone ? contactTimezone : void 0,
+    window.timezone,
+    "UTC"
+  ];
+  for (const tz of candidates) {
+    if (tz && isValidTimezone(tz)) return tz;
+  }
+  return "UTC";
+}
+var validatedZones = /* @__PURE__ */ new Map();
+function isValidTimezone(tz) {
+  const cached = validatedZones.get(tz);
+  if (cached !== void 0) return cached;
+  let ok = true;
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: tz });
+  } catch {
+    ok = false;
+  }
+  validatedZones.set(tz, ok);
+  return ok;
+}
+var partFormatters = /* @__PURE__ */ new Map();
+function formatterFor(tz) {
+  let f = partFormatters.get(tz);
+  if (!f) {
+    f = new Intl.DateTimeFormat("en-US", {
+      timeZone: tz,
+      year: "numeric",
+      month: "2-digit",
+      day: "2-digit",
+      hour: "2-digit",
+      minute: "2-digit",
+      second: "2-digit",
+      weekday: "short",
+      hour12: false
+    });
+    partFormatters.set(tz, f);
+  }
+  return f;
+}
+function localParts(date, tz) {
+  const parts = {};
+  for (const p of formatterFor(tz).formatToParts(date)) parts[p.type] = p.value;
+  return {
+    y: Number(parts.year),
+    mo: Number(parts.month),
+    d: Number(parts.day),
+    hh: Number(parts.hour) % 24,
+    // Intl emits '24' for midnight in some locales
+    mi: Number(parts.minute),
+    ss: Number(parts.second),
+    weekday: parts.weekday
+  };
+}
+function utcFromLocal(y, mo, d, hh, mi, tz) {
+  let ts = Date.UTC(y, mo - 1, d, hh, mi, 0);
+  for (let i = 0; i < 2; i++) {
+    const p = localParts(new Date(ts), tz);
+    const asUtc = Date.UTC(p.y, p.mo - 1, p.d, p.hh, p.mi, p.ss);
+    const offset = asUtc - ts;
+    ts = Date.UTC(y, mo - 1, d, hh, mi, 0) - offset;
+  }
+  return new Date(ts);
+}
+function addLocalDays(p, days) {
+  const dt = new Date(Date.UTC(p.y, p.mo - 1, p.d + days));
+  return { y: dt.getUTCFullYear(), mo: dt.getUTCMonth() + 1, d: dt.getUTCDate() };
+}
 async function compileTemplate(mjml) {
   const out = await mjml2html__default.default(mjml, { validationLevel: "soft", minify: false });
   const plainText = derivePlaintext(out.html);
@@ -1312,6 +1562,9 @@ function makeHandlebars(extra) {
   return hb;
 }
 
+// src/server/runner/send.ts
+init_vars();
+
 // src/server/runner/suppression.ts
 var SCOPES_BY_KIND = {
   marketing: ["all", "marketing"],
@@ -1334,21 +1587,88 @@ async function isSuppressed(collections, email, kind) {
   return { suppressed: false };
 }
 
+// src/server/templates/sender-domain.ts
+function validateSenderDomain(fromEmail, templateKind, registry) {
+  if (!registry || Object.keys(registry).length === 0) return { ok: true };
+  const domain = extractDomain(fromEmail);
+  if (!domain) {
+    return {
+      ok: false,
+      code: "invalid_email",
+      reason: `invalid fromEmail "${fromEmail}" \u2014 expected "name@domain"`
+    };
+  }
+  const entry = registry[domain];
+  if (!entry) {
+    const known = Object.keys(registry).join(", ");
+    return {
+      ok: false,
+      code: "unregistered_domain",
+      reason: `sender domain "${domain}" is not declared in senderDomains (allowed: ${known})`
+    };
+  }
+  if (entry.kind === "both") return { ok: true };
+  if (entry.kind !== templateKind) {
+    return {
+      ok: false,
+      code: "wrong_kind",
+      reason: `sender domain "${domain}" is configured for ${entry.kind} email, but this template's kind is ${templateKind}`
+    };
+  }
+  return { ok: true };
+}
+function extractDomain(email) {
+  if (typeof email !== "string") return null;
+  const at = email.lastIndexOf("@");
+  if (at <= 0 || at === email.length - 1) return null;
+  return email.slice(at + 1).toLowerCase().trim();
+}
+
 // src/server/runner/health.ts
-async function recordHealthCounter(ctx, counter2, by = 1) {
+var ZERO_COUNTERS = {
+  sent: 0,
+  delivered: 0,
+  bounced: 0,
+  hardBounced: 0,
+  softBounced: 0,
+  complained: 0,
+  failedToSend: 0
+};
+var ZERO_RATES = {
+  bounceRate: 0,
+  hardBounceRate: 0,
+  complaintRate: 0,
+  failureRate: 0
+};
+async function recordHealthCounter(ctx, counter2, dims, by = 1) {
+  const windowMs = ctx.config.circuitBreaker.windowMinutes * 60 * 1e3;
+  const writes = [];
+  writes.push(upsertCounter(ctx, HEALTH_AGG_ID, null, null, counter2, by, windowMs));
+  if (dims) {
+    const domain = dims.fromEmail ? extractDomain(dims.fromEmail) : null;
+    if (domain) {
+      const id = healthBucketId(domain, dims.kind);
+      writes.push(upsertCounter(ctx, id, domain, dims.kind, counter2, by, windowMs));
+    }
+  }
+  await Promise.all(writes);
+}
+async function upsertCounter(ctx, _id, senderDomain, kind, counter2, by, windowMs) {
   await ctx.collections.health.updateOne(
-    { _id: "singleton" },
+    { _id },
     {
       $inc: { [`counters.${counter2}`]: by },
       $setOnInsert: {
-        _id: "singleton",
+        _id,
+        senderDomain,
+        kind,
         windowStartedAt: /* @__PURE__ */ new Date(),
-        windowDurationMs: ctx.config.circuitBreaker.windowMinutes * 60 * 1e3,
+        windowDurationMs: windowMs,
         status: "healthy",
         trippedAt: null,
         trippedReason: null,
         manuallyResumedAt: null,
-        rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 }
+        rates: { ...ZERO_RATES }
       },
       $set: { updatedAt: /* @__PURE__ */ new Date() }
     },
@@ -1358,73 +1678,116 @@ async function recordHealthCounter(ctx, counter2, by = 1) {
 async function evaluateHealth(ctx) {
   const cb = ctx.config.circuitBreaker;
   const windowMs = cb.windowMinutes * 60 * 1e3;
-  const doc = await ctx.collections.health.findOne({ _id: "singleton" });
-  if (!doc) return;
-  const windowAge = Date.now() - new Date(doc.windowStartedAt).getTime();
-  if (windowAge > windowMs && doc.status !== "tripped") {
-    await ctx.collections.health.updateOne(
-      { _id: "singleton" },
-      {
-        $set: {
-          windowStartedAt: /* @__PURE__ */ new Date(),
-          windowDurationMs: windowMs,
-          counters: { sent: 0, delivered: 0, bounced: 0, hardBounced: 0, softBounced: 0, complained: 0, failedToSend: 0 },
-          rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 },
-          updatedAt: /* @__PURE__ */ new Date()
+  const docs = await ctx.collections.health.find({}).toArray();
+  if (docs.length === 0) return;
+  const hasAgg = docs.some((d) => d._id === HEALTH_AGG_ID);
+  if (!hasAgg) {
+    await upsertCounter(ctx, HEALTH_AGG_ID, null, null, "sent", 0, windowMs);
+  }
+  for (const doc of docs) {
+    const isAgg = doc._id === HEALTH_AGG_ID;
+    const windowAge = Date.now() - new Date(doc.windowStartedAt).getTime();
+    if (windowAge > windowMs && doc.status !== "tripped") {
+      await ctx.collections.health.updateOne(
+        { _id: doc._id },
+        {
+          $set: {
+            windowStartedAt: /* @__PURE__ */ new Date(),
+            windowDurationMs: windowMs,
+            counters: { ...ZERO_COUNTERS },
+            rates: { ...ZERO_RATES },
+            status: "healthy",
+            updatedAt: /* @__PURE__ */ new Date()
+          }
         }
-      }
-    );
-    return;
-  }
-  const c = doc.counters;
-  const total = c.sent || 1;
-  const rates = {
-    bounceRate: c.bounced / total,
-    hardBounceRate: c.hardBounced / total,
-    complaintRate: c.complained / total,
-    failureRate: c.failedToSend / total
-  };
-  await ctx.collections.health.updateOne(
-    { _id: "singleton" },
-    { $set: { rates, updatedAt: /* @__PURE__ */ new Date() } }
-  );
-  if (c.sent < cb.minSendsBeforeEval) return;
-  if (doc.status === "tripped") return;
-  let trippedReason = null;
-  if (rates.hardBounceRate * 100 >= cb.hardBounceRatePctTrip) {
-    trippedReason = `hard bounce rate ${(rates.hardBounceRate * 100).toFixed(2)}% >= ${cb.hardBounceRatePctTrip}%`;
-  } else if (rates.complaintRate * 100 >= cb.complaintRatePctTrip) {
-    trippedReason = `complaint rate ${(rates.complaintRate * 100).toFixed(2)}% >= ${cb.complaintRatePctTrip}%`;
-  } else if (rates.bounceRate * 100 >= cb.combinedBounceRatePctTrip) {
-    trippedReason = `combined bounce rate ${(rates.bounceRate * 100).toFixed(2)}% >= ${cb.combinedBounceRatePctTrip}%`;
-  }
-  if (trippedReason) {
+      );
+      continue;
+    }
+    const c = doc.counters;
+    const total = c.sent || 1;
+    const rates = {
+      bounceRate: c.bounced / total,
+      hardBounceRate: c.hardBounced / total,
+      complaintRate: c.complained / total,
+      failureRate: c.failedToSend / total
+    };
     await ctx.collections.health.updateOne(
-      { _id: "singleton" },
-      { $set: { status: "tripped", trippedAt: /* @__PURE__ */ new Date(), trippedReason, updatedAt: /* @__PURE__ */ new Date() } }
+      { _id: doc._id },
+      { $set: { rates, updatedAt: /* @__PURE__ */ new Date() } }
     );
-    if (ctx.config.onCircuitBreakerTrip) {
-      try {
-        await ctx.config.onCircuitBreakerTrip({ reason: trippedReason, rates });
-      } catch {
+    if (isAgg) continue;
+    if (c.sent < cb.minSendsBeforeEval) continue;
+    if (doc.status === "tripped") continue;
+    let trippedReason = null;
+    if (rates.hardBounceRate * 100 >= cb.hardBounceRatePctTrip) {
+      trippedReason = `hard bounce rate ${(rates.hardBounceRate * 100).toFixed(2)}% >= ${cb.hardBounceRatePctTrip}%`;
+    } else if (rates.complaintRate * 100 >= cb.complaintRatePctTrip) {
+      trippedReason = `complaint rate ${(rates.complaintRate * 100).toFixed(2)}% >= ${cb.complaintRatePctTrip}%`;
+    } else if (rates.bounceRate * 100 >= cb.combinedBounceRatePctTrip) {
+      trippedReason = `combined bounce rate ${(rates.bounceRate * 100).toFixed(2)}% >= ${cb.combinedBounceRatePctTrip}%`;
+    }
+    if (trippedReason) {
+      const result = await ctx.collections.health.updateOne(
+        { _id: doc._id, status: { $in: ["healthy", "degraded"] } },
+        { $set: { status: "tripped", trippedAt: /* @__PURE__ */ new Date(), trippedReason, updatedAt: /* @__PURE__ */ new Date() } }
+      );
+      if (result.modifiedCount > 0) {
+        if (ctx.audit) {
+          try {
+            await ctx.audit({
+              actor: "system:circuit-breaker",
+              action: "health.trip",
+              resource: {
+                collection: "mailer_health",
+                id: String(doc._id),
+                slug: `${doc.senderDomain ?? "_unknown"}|${doc.kind}`
+              },
+              diffSummary: trippedReason
+            });
+          } catch {
+          }
+        }
+        if (ctx.config.onCircuitBreakerTrip) {
+          try {
+            await ctx.config.onCircuitBreakerTrip({
+              reason: `[${doc.senderDomain ?? "_unknown"} / ${doc.kind}] ${trippedReason}`,
+              rates
+            });
+          } catch {
+          }
+        }
       }
+      continue;
     }
-    return;
-  }
-  if (rates.failureRate * 100 >= cb.failedToSendRatePctDegrade) {
-    if (doc.status !== "degraded") {
+    if (rates.failureRate * 100 >= cb.failedToSendRatePctDegrade) {
+      if (doc.status !== "degraded") {
+        await ctx.collections.health.updateOne(
+          { _id: doc._id },
+          { $set: { status: "degraded", updatedAt: /* @__PURE__ */ new Date() } }
+        );
+      }
+    } else if (doc.status === "degraded") {
       await ctx.collections.health.updateOne(
-        { _id: "singleton" },
-        { $set: { status: "degraded", updatedAt: /* @__PURE__ */ new Date() } }
+        { _id: doc._id },
+        { $set: { status: "healthy", updatedAt: /* @__PURE__ */ new Date() } }
       );
     }
-  } else if (doc.status === "degraded") {
-    await ctx.collections.health.updateOne(
-      { _id: "singleton" },
-      { $set: { status: "healthy", updatedAt: /* @__PURE__ */ new Date() } }
-    );
   }
 }
+async function getBucketStatus(ctx, fromEmail, kind) {
+  const domain = fromEmail ? extractDomain(fromEmail) : null;
+  const id = healthBucketId(domain, kind);
+  return ctx.collections.health.findOne({ _id: id });
+}
+function effectiveOverallStatus(docs) {
+  const buckets = docs.filter((d) => typeof d._id === "string" && d._id.startsWith("d:"));
+  if (buckets.length === 0) {
+    return docs.length === 0 ? null : "healthy";
+  }
+  if (buckets.some((d) => d.status === "tripped")) return "tripped";
+  if (buckets.some((d) => d.status === "degraded")) return "degraded";
+  return "healthy";
+}
 
 // src/server/runner/send.ts
 async function handleSend(run, step, contact, flow, ctx) {
@@ -1508,8 +1871,8 @@ async function dispatchSend(sendId, ctx) {
     return;
   }
   if (send.kind === "marketing") {
-    const health = await ctx.collections.health.findOne({ _id: "singleton" });
-    if (health?.status === "tripped") {
+    const bucket = await getBucketStatus(ctx, send.fromEmail, send.kind);
+    if (bucket?.status === "tripped") {
       await ctx.queues.send.add("send", { sendId: String(send._id) }, { delay: 6e4 });
       return;
     }
@@ -1520,13 +1883,29 @@ async function dispatchSend(sendId, ctx) {
     return;
   }
   const run = send.flowRunId ? await ctx.collections.flowRuns.findOne({ _id: send.flowRunId }) : null;
-  const renderCtx = buildRenderContext(
-    contact,
-    run,
-    send.vars ?? {},
-    ctx
-  );
-  const rendered = await renderTemplate(template, renderCtx, { helpers: ctx.handlebarsHelpers });
+  if (run && run.status === "exited" && run.exitReason?.startsWith("aborted_by_host")) {
+    await ctx.collections.sends.updateOne(
+      { _id: send._id },
+      { $set: { status: "cancelled", errorMessage: `cancelled: ${run.exitReason}`, updatedAt: /* @__PURE__ */ new Date() } }
+    );
+    return;
+  }
+  let renderCtx;
+  let rendered;
+  try {
+    const resolved = await resolveVars(ctx.varsAdapter, contact, {
+      reason: "send",
+      templateSlug: template.slug,
+      flowSlug: run?.flowSlug,
+      eventName: run?.triggerEvent?.name,
+      eventProperties: run?.triggerEvent?.properties
+    });
+    renderCtx = buildRenderContext(contact, run, send.vars ?? {}, ctx, resolved);
+    rendered = await renderTemplate(template, renderCtx, { helpers: ctx.handlebarsHelpers });
+  } catch (err) {
+    await markFailed(send._id, `render error: ${String(err?.message ?? err)}`, ctx);
+    throw err;
+  }
   const tracking = applyTracking(rendered.html, {
     sendId: String(send._id),
     publicUrl: ctx.config.publicUrl,
@@ -1578,13 +1957,13 @@ async function dispatchSend(sendId, ctx) {
         }
       }
     );
-    await recordHealthCounter(ctx, "sent");
+    await recordHealthCounter(ctx, "sent", { fromEmail: send.fromEmail, kind: send.kind });
   } catch (err) {
     await ctx.collections.sends.updateOne(
       { _id: send._id },
       { $set: { status: "failed", errorMessage: String(err?.message ?? err) } }
     );
-    await recordHealthCounter(ctx, "failedToSend");
+    await recordHealthCounter(ctx, "failedToSend", { fromEmail: send.fromEmail, kind: send.kind });
     if (ctx.config.onSendFailure) {
       try {
         await ctx.config.onSendFailure({ send, error: err });
@@ -1602,7 +1981,7 @@ function pickProviderName(stepOverride, tpl, ctx) {
   }
   return ctx.config.defaultProvider;
 }
-function buildRenderContext(contact, run, vars, ctx) {
+function buildRenderContext(contact, run, vars, ctx, resolved = {}) {
   const scope = "marketing";
   const expiresAt = new Date(Date.now() + ctx.config.unsubscribeTokenLifetimeDays * 24 * 60 * 60 * 1e3);
   const token = signUnsubscribeToken(
@@ -1611,8 +1990,10 @@ function buildRenderContext(contact, run, vars, ctx) {
   );
   const unsubscribeUrl = `${ctx.config.publicUrl}/m/unsub/${token}`;
   return {
+    ...resolved,
     contact,
     vars,
+    event: run?.triggerEvent?.properties ?? {},
     unsubscribeUrl,
     senderAddress: ctx.config.senderAddress
   };
@@ -1697,8 +2078,15 @@ async function processOneRunStep(runId, ctx) {
       return handleCondition(run, step, contact, ctx);
     case "branch":
       return handleBranch(run, step, contact, ctx);
-    case "send":
+    case "send": {
+      if (step.delivery) {
+        const deliverAt = computeDeliveryTime(/* @__PURE__ */ new Date(), step.delivery, contact.timezone);
+        if (deliverAt.getTime() > Date.now() + 3e4) {
+          return deferSendForWindow(run, deliverAt, ctx);
+        }
+      }
       return handleSend(run, step, contact, flow, ctx);
+    }
     case "tag":
       return handleTag(run, step, ctx);
     case "fire_event":
@@ -1849,6 +2237,34 @@ async function handleWebhookStep(run, step, ctx) {
     }
   }
 }
+async function deferSendForWindow(run, deliverAt, ctx) {
+  const updated = await ctx.collections.flowRuns.findOneAndUpdate(
+    // Only write once per deferral — if nextActionAt already points at (or
+    // past) the slot, another worker/tick got here first.
+    { _id: run._id, currentStepIndex: run.currentStepIndex, nextActionAt: { $lt: deliverAt } },
+    {
+      $set: { nextActionAt: deliverAt, updatedAt: /* @__PURE__ */ new Date() },
+      $push: {
+        history: {
+          stepIndex: run.currentStepIndex,
+          action: "send_deferred",
+          at: /* @__PURE__ */ new Date(),
+          details: { until: deliverAt }
+        }
+      }
+    },
+    { returnDocument: "after" }
+  );
+  if (!updated) return;
+  await ctx.queues.advance.add(
+    "advance",
+    { flowRunId: String(run._id) },
+    {
+      delay: Math.max(0, deliverAt.getTime() - Date.now()),
+      jobId: `advance:${run._id}:${run.currentStepIndex}:window:${deliverAt.getTime()}`
+    }
+  );
+}
 async function advanceStep(run, ctx, log, opts = {}) {
   const stepInc = opts.stepInc ?? 1;
   const updated = await ctx.collections.flowRuns.findOneAndUpdate(
@@ -2168,7 +2584,15 @@ async function promoteSoftBounces(ctx) {
   const cutoff = new Date(Date.now() - windowDays * 864e5);
   const offenders = await ctx.collections.sends.aggregate([
     { $match: { status: "bounced", bounceType: "soft", queuedAt: { $gt: cutoff } } },
-    { $group: { _id: "$emailAtSend", count: { $sum: 1 } } },
+    { $sort: { queuedAt: 1 } },
+    {
+      $group: {
+        _id: "$emailAtSend",
+        count: { $sum: 1 },
+        lastFromEmail: { $last: "$fromEmail" },
+        lastKind: { $last: "$kind" }
+      }
+    },
     { $match: { count: { $gte: threshold } } },
     { $limit: 200 }
   ]).toArray();
@@ -2200,81 +2624,984 @@ async function promoteSoftBounces(ctx) {
       { emailAtSubscribe: email },
       { $set: { status: "bounced", updatedAt: /* @__PURE__ */ new Date() } }
     );
-    await recordHealthCounter(ctx, "hardBounced");
+    await recordHealthCounter(
+      ctx,
+      "hardBounced",
+      o.lastKind ? { fromEmail: o.lastFromEmail, kind: o.lastKind } : null
+    );
   }
 }
-
-// src/server/runner/tick.ts
-var STRANDED_SEND_THRESHOLD_MS = 5 * 60 * 1e3;
-async function runTick(ctx) {
-  await ctx.collections.health.updateOne(
-    { _id: "singleton" },
-    {
-      $set: { updatedAt: /* @__PURE__ */ new Date() },
-      $setOnInsert: {
-        _id: "singleton",
-        windowStartedAt: /* @__PURE__ */ new Date(),
-        windowDurationMs: ctx.config.circuitBreaker.windowMinutes * 60 * 1e3,
-        status: "healthy",
-        trippedAt: null,
-        trippedReason: null,
-        manuallyResumedAt: null,
-        counters: { sent: 0, delivered: 0, bounced: 0, hardBounced: 0, softBounced: 0, complained: 0, failedToSend: 0 },
-        rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 }
+var REGISTRABLE_ONLY_LISTS = /* @__PURE__ */ new Set(["multi.surbl.org", "multi.uribl.com"]);
+var DNS_CONCURRENCY = 8;
+var defaultResolver = {
+  resolve4: (hostname) => dns__default.default.resolve4(hostname)
+};
+async function runDnsblChecks(ctx, opts = {}) {
+  const cfg = ctx.config.dnsbl ?? {};
+  const intervalHours = cfg.intervalHours ?? 24;
+  if (!opts.force && intervalHours <= 0) {
+    return { ran: false, reason: "disabled" };
+  }
+  const targets = collectTargets(ctx, cfg);
+  if (targets.domains.length === 0 && targets.ips.length === 0) {
+    return { ran: false, reason: "no_targets" };
+  }
+  const resolver = opts.resolver ?? defaultResolver;
+  const domainLists = cfg.domainLists ?? DEFAULT_DOMAIN_DNSBL_LISTS;
+  const ipLists = cfg.ipLists ?? DEFAULT_IP_DNSBL_LISTS;
+  const pairs = [];
+  for (const d of targets.domains) {
+    for (const l of domainLists) pairs.push({ target: d, targetKind: "domain", list: l });
+  }
+  for (const ip of targets.ips) {
+    for (const l of ipLists) pairs.push({ target: ip, targetKind: "ip", list: l });
+  }
+  const throttleCutoff = opts.force ? null : Date.now() - intervalHours * 60 * 60 * 1e3;
+  let duePairs = pairs;
+  if (throttleCutoff != null) {
+    const existing = await ctx.collections.dnsblChecks.find(
+      {
+        $or: pairs.map((p) => ({ target: p.target, list: p.list.host }))
+      },
+      { projection: { target: 1, list: 1, runAt: 1 } }
+    ).toArray();
+    const fresh = /* @__PURE__ */ new Set();
+    for (const e of existing) {
+      if (new Date(e.runAt).getTime() > throttleCutoff) {
+        fresh.add(`${e.target}|${e.list}`);
       }
-    },
-    { upsert: true }
-  ).catch(() => {
-  });
-  await processNewlyFiredEventTriggers(ctx).catch((err) => {
-    console.error("mailery: triggers scan failed", err);
-  });
-  await sweepStrandedFlowRuns(ctx).catch((err) => {
-    console.error("mailery: sweep failed", err);
-  });
-  await sweepStrandedSends(ctx).catch((err) => {
-    console.error("mailery: stranded-send sweep failed", err);
-  });
-  await drainOutbox(ctx).catch((err) => {
-    console.error("mailery: outbox drain failed", err);
-  });
-  await processScheduledBroadcasts2(ctx).catch((err) => {
-    console.error("mailery: broadcast dispatch failed", err);
-  });
-  await evaluateHealth(ctx).catch((err) => {
-    console.error("mailery: health evaluation failed", err);
-  });
-  await promoteSoftBounces(ctx).catch((err) => {
-    console.error("mailery: soft-bounce promotion failed", err);
-  });
-}
-async function sweepStrandedSends(ctx) {
-  const cutoff = new Date(Date.now() - STRANDED_SEND_THRESHOLD_MS);
-  const cursor = ctx.collections.sends.find(
-    { status: "sending", updatedAt: { $lt: cutoff } },
-    { projection: { _id: 1 } }
-  ).limit(500);
-  for await (const row of cursor) {
-    const reset = await ctx.collections.sends.updateOne(
-      { _id: row._id, status: "sending", updatedAt: { $lt: cutoff } },
-      { $set: { status: "queued", updatedAt: /* @__PURE__ */ new Date() } }
+    }
+    duePairs = pairs.filter((p) => !fresh.has(`${p.target}|${p.list.host}`));
+    if (duePairs.length === 0) {
+      return { ran: false, reason: "not_due", totalChecks: 0, listedCount: 0 };
+    }
+  }
+  let listedCount = 0;
+  async function processPair(p) {
+    const queryName = buildQueryName(p.target, p.targetKind, p.list.host);
+    const lookup = queryName ? await queryDnsbl(resolver, queryName) : { result: "error", returnCodes: [], errorMessage: "unsupported target format" };
+    if (lookup.transient) return;
+    if (lookup.result === "listed") listedCount++;
+    await ctx.collections.dnsblChecks.updateOne(
+      { target: p.target, list: p.list.host },
+      {
+        $set: {
+          target: p.target,
+          targetKind: p.targetKind,
+          list: p.list.host,
+          listLabel: p.list.label,
+          result: lookup.result,
+          returnCodes: lookup.returnCodes,
+          errorMessage: lookup.errorMessage,
+          runAt: /* @__PURE__ */ new Date()
+        }
+      },
+      { upsert: true }
     );
-    if (reset.modifiedCount === 0) continue;
-    await ctx.queues.send.add("send", { sendId: String(row._id) }, {
-      attempts: ctx.config.sendRetryAttempts,
-      backoff: { type: "exponential", delay: 6e4 }
-    });
   }
+  let idx = 0;
+  await Promise.all(
+    Array.from({ length: Math.min(DNS_CONCURRENCY, duePairs.length) }, async () => {
+      while (idx < duePairs.length) {
+        const my = idx++;
+        await processPair(duePairs[my]);
+      }
+    })
+  );
+  return { ran: true, totalChecks: duePairs.length, listedCount };
 }
-async function drainOutbox(ctx) {
-  const batch = await ctx.collections.outbox.find({ status: "pending" }).sort({ enqueuedAt: 1 }).limit(200).toArray();
-  for (const row of batch) {
-    try {
-      if (row.payload.type === "event") {
-        try {
-          await ctx.collections.events.insertOne({
-            externalId: row.payload.data.externalId,
-            name: row.payload.data.name,
+function collectTargets(ctx, cfg) {
+  const domains = /* @__PURE__ */ new Set();
+  const registry = ctx.config.senderDomains;
+  if (registry) {
+    for (const d of Object.keys(registry)) domains.add(d.toLowerCase());
+  }
+  const fromDomain = ctx.config.fromDefaults?.email ? extractDomain(ctx.config.fromDefaults.email) : null;
+  if (fromDomain) domains.add(fromDomain);
+  const txnDomain = ctx.config.transactionalFromDefaults?.email ? extractDomain(ctx.config.transactionalFromDefaults.email) : null;
+  if (txnDomain) domains.add(txnDomain);
+  return {
+    domains: Array.from(domains),
+    ips: (cfg.dedicatedIps ?? []).filter((ip) => net__default.default.isIP(ip) !== 0)
+  };
+}
+function buildQueryName(target, kind, listHost) {
+  if (kind === "ip") {
+    const v = net__default.default.isIP(target);
+    if (v === 4) return `${reverseIPv4(target)}.${listHost}`;
+    if (v === 6) return `${reverseIPv6Nibbles(target)}.${listHost}`;
+    return null;
+  }
+  const domain = REGISTRABLE_ONLY_LISTS.has(listHost) ? registrableDomain(target) : target;
+  return `${domain}.${listHost}`;
+}
+var TRANSIENT_DNS_CODES = /* @__PURE__ */ new Set(["ESERVFAIL", "EREFUSED", "ETIMEOUT", "ETIMEDOUT", "ECONNRESET", "ECONNREFUSED"]);
+async function queryDnsbl(resolver, query) {
+  try {
+    const records = await resolver.resolve4(query);
+    return interpretRecords(records);
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOTFOUND" || code === "ENODATA") {
+      return { result: "clean", returnCodes: [], errorMessage: null };
+    }
+    if (code && TRANSIENT_DNS_CODES.has(code)) {
+      return {
+        transient: true,
+        result: "error",
+        returnCodes: [],
+        errorMessage: String(err?.message ?? err)
+      };
+    }
+    return {
+      result: "error",
+      returnCodes: [],
+      errorMessage: String(err?.message ?? err)
+    };
+  }
+}
+function interpretRecords(records) {
+  if (!records || records.length === 0) {
+    return { result: "clean", returnCodes: [], errorMessage: null };
+  }
+  const errorish = records.filter((r) => r.startsWith("127.255.255."));
+  if (errorish.length === records.length) {
+    return {
+      result: "error",
+      returnCodes: records,
+      errorMessage: `list returned reserved code(s): ${records.join(", ")}`
+    };
+  }
+  const listed = records.filter((r) => r.startsWith("127.") && !r.startsWith("127.255.255."));
+  if (listed.length > 0) {
+    return { result: "listed", returnCodes: records, errorMessage: null };
+  }
+  return { result: "clean", returnCodes: records, errorMessage: null };
+}
+function reverseIPv4(ip) {
+  return ip.split(".").reverse().join(".");
+}
+function reverseIPv6Nibbles(ip) {
+  const v4Match = /:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(ip);
+  let normalized = ip;
+  if (v4Match) {
+    const octets = v4Match[1].split(".").map((o) => Number(o));
+    if (octets.length === 4 && octets.every((o) => o >= 0 && o <= 255)) {
+      const hi = (octets[0] << 8 | octets[1]).toString(16).padStart(4, "0");
+      const lo = (octets[2] << 8 | octets[3]).toString(16).padStart(4, "0");
+      normalized = ip.slice(0, v4Match.index) + ":" + hi + ":" + lo;
+    }
+  }
+  const sides = normalized.split("::");
+  let groups;
+  if (sides.length === 1) {
+    groups = sides[0].split(":");
+  } else {
+    const left = sides[0].split(":").filter(Boolean);
+    const right = sides[1].split(":").filter(Boolean);
+    const missing = 8 - left.length - right.length;
+    groups = [...left, ...Array(missing).fill("0"), ...right];
+  }
+  if (groups.length !== 8) {
+    throw new Error(`unexpected IPv6 group count for ${ip}: ${groups.length}`);
+  }
+  const padded = groups.map((g) => g.toLowerCase().padStart(4, "0")).join("");
+  return padded.split("").reverse().join(".");
+}
+function registrableDomain(domain) {
+  const parsed = psl__default.default.parse(domain);
+  if ("domain" in parsed && parsed.domain) return parsed.domain;
+  return domain;
+}
+
+// src/server/runner/postmaster.ts
+var OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
+var POSTMASTER_BASE = "https://gmailpostmastertools.googleapis.com/v1";
+var FETCH_TIMEOUT_MS = 15e3;
+async function fetchWithTimeout(fetcher, url, init = {}, timeoutMs = FETCH_TIMEOUT_MS) {
+  const ctl = new AbortController();
+  const t = setTimeout(() => ctl.abort(), timeoutMs);
+  try {
+    return await fetcher(url, { ...init, signal: ctl.signal });
+  } finally {
+    clearTimeout(t);
+  }
+}
+function createPostmasterClient(cfg, fetcher = globalThis.fetch) {
+  let cached = null;
+  async function getAccessToken() {
+    if (cached && cached.expiresAt > Date.now() + 5 * 60 * 1e3) {
+      return cached.accessToken;
+    }
+    const body = new URLSearchParams({
+      client_id: cfg.clientId,
+      client_secret: cfg.clientSecret,
+      refresh_token: cfg.refreshToken,
+      grant_type: "refresh_token"
+    });
+    const res = await fetchWithTimeout(fetcher, OAUTH_TOKEN_URL, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+    if (!res.ok) {
+      throw new Error(`Postmaster OAuth token refresh failed: ${res.status} ${await safeText(res)}`);
+    }
+    const data = await res.json();
+    cached = {
+      accessToken: data.access_token,
+      expiresAt: Date.now() + data.expires_in * 1e3
+    };
+    return cached.accessToken;
+  }
+  async function authedGet(path3) {
+    const token = await getAccessToken();
+    const res = await fetchWithTimeout(fetcher, `${POSTMASTER_BASE}${path3}`, {
+      method: "GET",
+      headers: { authorization: `Bearer ${token}` }
+    });
+    if (!res.ok) {
+      throw new Error(`Postmaster GET ${path3} failed: ${res.status} ${await safeText(res)}`);
+    }
+    return await res.json();
+  }
+  return {
+    async listDomains() {
+      const data = await authedGet("/domains");
+      return data.domains ?? [];
+    },
+    async getLatestTrafficStats(domain) {
+      const data = await authedGet(
+        `/domains/${encodeURIComponent(domain)}/trafficStats?pageSize=1`
+      );
+      return data.trafficStats?.[0] ?? null;
+    }
+  };
+}
+async function safeText(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "<no body>";
+  }
+}
+async function runPostmasterPull(ctx, opts = {}) {
+  const cfg = ctx.config.postmaster;
+  if (!cfg) return { ran: false, reason: "not_configured" };
+  const intervalHours = cfg.intervalHours ?? 24;
+  if (!opts.force && intervalHours <= 0) {
+    return { ran: false, reason: "disabled" };
+  }
+  const client = opts.client ?? createPostmasterClient(cfg, opts.fetcher);
+  const allDomains = resolveDomains(ctx, cfg);
+  if (allDomains.length === 0) {
+    return { ran: false, reason: "no_domains" };
+  }
+  let domains = allDomains;
+  if (!opts.force) {
+    const cutoff = Date.now() - intervalHours * 60 * 60 * 1e3;
+    const latest = await ctx.collections.postmasterSnapshots.find({ domain: { $in: allDomains } }, { projection: { domain: 1, fetchedAt: 1 } }).sort({ fetchedAt: -1 }).limit(allDomains.length * 8).toArray();
+    const lastByDomain = /* @__PURE__ */ new Map();
+    for (const s of latest) {
+      const ts = new Date(s.fetchedAt).getTime();
+      const cur = lastByDomain.get(s.domain) ?? 0;
+      if (ts > cur) lastByDomain.set(s.domain, ts);
+    }
+    domains = allDomains.filter((d) => (lastByDomain.get(d) ?? 0) < cutoff);
+    if (domains.length === 0) {
+      return { ran: false, reason: "not_due" };
+    }
+  }
+  const fetches = await Promise.all(
+    domains.map(async (domain) => {
+      try {
+        const stat = await client.getLatestTrafficStats(domain);
+        return { domain, stat, error: null };
+      } catch (err) {
+        console.error(`mailery: postmaster fetch failed for ${domain}`, err);
+        return { domain, stat: null, error: err };
+      }
+    })
+  );
+  let fetched = 0;
+  const trippedDomains = [];
+  for (const { domain, stat } of fetches) {
+    if (!stat) continue;
+    const snapshot = toSnapshot(domain, stat);
+    if (!snapshot) continue;
+    fetched++;
+    await ctx.collections.postmasterSnapshots.updateOne(
+      { domain: snapshot.domain, date: snapshot.date },
+      { $set: snapshot },
+      { upsert: true }
+    );
+    if (snapshot.domainReputation === "BAD") {
+      const kindsToTrip = kindsForDomain(ctx, domain);
+      for (const kind of kindsToTrip) {
+        const tripped = await tripBucket(ctx, domain, kind, snapshot);
+        if (tripped) trippedDomains.push(`${domain}|${kind}`);
+      }
+    }
+  }
+  return { ran: true, fetched, trippedDomains };
+}
+function kindsForDomain(ctx, domain) {
+  const registry = ctx.config.senderDomains ?? {};
+  const entry = registry[domain.toLowerCase()];
+  if (!entry) return [];
+  if (entry.kind === "both") return ["marketing", "transactional"];
+  return [entry.kind];
+}
+function resolveDomains(ctx, cfg) {
+  if (cfg.domains && cfg.domains.length > 0) {
+    return cfg.domains.map((d) => d.toLowerCase());
+  }
+  const out = /* @__PURE__ */ new Set();
+  const registry = ctx.config.senderDomains;
+  if (registry) {
+    for (const d of Object.keys(registry)) out.add(d.toLowerCase());
+  }
+  const f = ctx.config.fromDefaults?.email ? extractDomain(ctx.config.fromDefaults.email) : null;
+  if (f) out.add(f);
+  const t = ctx.config.transactionalFromDefaults?.email ? extractDomain(ctx.config.transactionalFromDefaults.email) : null;
+  if (t) out.add(t);
+  return Array.from(out);
+}
+function toSnapshot(domain, stat) {
+  const m = /\/trafficStats\/(\d{8})$/.exec(stat.name ?? "");
+  if (!m) {
+    console.error(`mailery: postmaster snapshot for ${domain} has unrecognized name "${stat.name}" \u2014 skipping`);
+    return null;
+  }
+  const yyyymmdd = m[1];
+  const date = `${yyyymmdd.slice(0, 4)}-${yyyymmdd.slice(4, 6)}-${yyyymmdd.slice(6, 8)}`;
+  return {
+    domain,
+    date,
+    domainReputation: stat.domainReputation ?? null,
+    ipReputations: stat.ipReputations ? stat.ipReputations.map((r) => ({
+      reputation: r.reputation,
+      ipCount: typeof r.ipCount === "string" ? Number(r.ipCount) : r.ipCount
+    })) : null,
+    userReportedSpamRatio: stat.userReportedSpamRatio ?? null,
+    spfSuccessRatio: stat.spfSuccessRatio ?? null,
+    dkimSuccessRatio: stat.dkimSuccessRatio ?? null,
+    dmarcSuccessRatio: stat.dmarcSuccessRatio ?? null,
+    outboundEncryptionRatio: stat.outboundEncryptionRatio ?? null,
+    inboundEncryptionRatio: stat.inboundEncryptionRatio ?? null,
+    deliveryErrors: stat.deliveryErrors ?? null,
+    spammyFeedbackLoops: stat.spammyFeedbackLoops ?? null,
+    fetchedAt: /* @__PURE__ */ new Date()
+  };
+}
+async function tripBucket(ctx, domain, kind, snapshot) {
+  const id = healthBucketId(domain, kind);
+  const reason = `Postmaster Tools reports ${domain} reputation = BAD on ${snapshot.date}`;
+  const prior = await ctx.collections.health.findOne({ _id: id });
+  if (prior?.status === "tripped") {
+    return false;
+  }
+  await ctx.collections.health.updateOne(
+    { _id: id },
+    {
+      $set: {
+        status: "tripped",
+        trippedAt: /* @__PURE__ */ new Date(),
+        trippedReason: reason,
+        updatedAt: /* @__PURE__ */ new Date()
+      },
+      $setOnInsert: {
+        _id: id,
+        senderDomain: domain,
+        kind,
+        windowStartedAt: /* @__PURE__ */ new Date(),
+        windowDurationMs: ctx.config.circuitBreaker.windowMinutes * 60 * 1e3,
+        manuallyResumedAt: null,
+        counters: { sent: 0, delivered: 0, bounced: 0, hardBounced: 0, softBounced: 0, complained: 0, failedToSend: 0 },
+        rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 }
+      }
+    },
+    { upsert: true }
+  );
+  if (ctx.config.onCircuitBreakerTrip) {
+    try {
+      await ctx.config.onCircuitBreakerTrip({ reason, rates: { userReportedSpamRatio: snapshot.userReportedSpamRatio ?? 0 } });
+    } catch {
+    }
+  }
+  return true;
+}
+
+// src/server/runner/snds.ts
+var SNDS_DATA_URL = "https://postmaster.live.com/snds/data.aspx";
+var FETCH_TIMEOUT_MS2 = 3e4;
+async function runSndsPull(ctx, opts = {}) {
+  const cfg = ctx.config.snds;
+  if (!cfg?.accessKey) return { ran: false, reason: "not_configured" };
+  const intervalHours = cfg.intervalHours ?? 24;
+  if (!opts.force && intervalHours <= 0) return { ran: false, reason: "disabled" };
+  if (!opts.force) {
+    const latest = await ctx.collections.sndsSnapshots.find({}).sort({ fetchedAt: -1 }).limit(1).toArray();
+    if (latest[0]) {
+      const ageMs = Date.now() - new Date(latest[0].fetchedAt).getTime();
+      if (ageMs < intervalHours * 60 * 60 * 1e3) {
+        return { ran: false, reason: "not_due" };
+      }
+    }
+  }
+  const fetcher = opts.fetcher ?? globalThis.fetch;
+  const url = `${SNDS_DATA_URL}?key=${encodeURIComponent(cfg.accessKey)}`;
+  const ctl = new AbortController();
+  const t = setTimeout(() => ctl.abort(), FETCH_TIMEOUT_MS2);
+  let res;
+  try {
+    res = await fetcher(url, { method: "GET", signal: ctl.signal });
+  } catch (err) {
+    throw new Error(`SNDS data fetch failed: ${redactKey(String(err?.message ?? err), cfg.accessKey)}`);
+  } finally {
+    clearTimeout(t);
+  }
+  if (!res.ok) {
+    throw new Error(`SNDS data fetch failed: ${res.status} ${redactKey(await safeText2(res), cfg.accessKey)}`);
+  }
+  const csv = await res.text();
+  const rows = parseSndsCsv(csv);
+  const ipFilter = cfg.ips?.length ? new Set(cfg.ips) : null;
+  const now = /* @__PURE__ */ new Date();
+  const ops = rows.filter((row) => !ipFilter || ipFilter.has(row.ip)).map((row) => ({
+    updateOne: {
+      filter: { ip: row.ip, activityStart: row.activityStart },
+      update: { $set: { ...row, fetchedAt: now } },
+      upsert: true
+    }
+  }));
+  let persisted = 0;
+  if (ops.length > 0) {
+    const r = await ctx.collections.sndsSnapshots.bulkWrite(ops, { ordered: false });
+    persisted = (r.modifiedCount ?? 0) + (r.upsertedCount ?? 0);
+  }
+  return { ran: true, rowsParsed: rows.length, rowsPersisted: persisted };
+}
+function redactKey(s, key) {
+  if (!key) return s;
+  return s.split(key).join("<redacted>").split(encodeURIComponent(key)).join("<redacted>");
+}
+async function safeText2(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "<no body>";
+  }
+}
+function parseSndsCsv(csv) {
+  const out = [];
+  for (const raw of csv.split(/\r?\n/)) {
+    if (!raw.trim()) continue;
+    const fields = splitCsvRow(raw);
+    if (fields.length < 7) continue;
+    const parsed = parseRow(fields);
+    if (parsed) out.push(parsed);
+  }
+  return out;
+}
+function splitCsvRow(row) {
+  const out = [];
+  let cur = "";
+  let inQuotes = false;
+  for (let i = 0; i < row.length; i++) {
+    const ch = row[i];
+    if (inQuotes) {
+      if (ch === '"') {
+        if (row[i + 1] === '"') {
+          cur += '"';
+          i++;
+        } else {
+          inQuotes = false;
+        }
+      } else {
+        cur += ch;
+      }
+    } else if (ch === '"') {
+      inQuotes = true;
+    } else if (ch === ",") {
+      out.push(cur);
+      cur = "";
+    } else {
+      cur += ch;
+    }
+  }
+  out.push(cur);
+  return out.map((f) => f.trim());
+}
+function parseRow(fields) {
+  const [
+    ip,
+    activityStart,
+    activityEnd,
+    rcptCommands,
+    dataCommands,
+    messageRecipients,
+    filterResult,
+    complaintRate,
+    trapMessageCount,
+    sampleHelo,
+    sampleMailFrom
+  ] = fields;
+  const start = parseSndsDate(activityStart ?? "");
+  const end = parseSndsDate(activityEnd ?? "");
+  if (!ip || !start || !end) return null;
+  return {
+    ip,
+    activityStart: start,
+    activityEnd: end,
+    rcptCommands: toInt(rcptCommands),
+    dataCommands: toInt(dataCommands),
+    messageRecipients: toInt(messageRecipients),
+    filterResult: normalizeFilter(filterResult ?? ""),
+    complaintRate: parseComplaintRate(complaintRate ?? ""),
+    trapMessageCount: toInt(trapMessageCount),
+    sampleHelo: sampleHelo ? sampleHelo : null,
+    sampleMailFrom: sampleMailFrom ? sampleMailFrom : null
+  };
+}
+function toInt(s) {
+  if (!s) return 0;
+  const n = Number(s.replace(/[^\d-]/g, ""));
+  return Number.isFinite(n) ? n : 0;
+}
+function normalizeFilter(s) {
+  const u = s.toUpperCase().trim();
+  if (u === "GREEN" || u === "YELLOW" || u === "RED") return u;
+  return "UNKNOWN";
+}
+function parseComplaintRate(s) {
+  const trimmed = s.trim();
+  if (!trimmed || trimmed === "-" || /n\/?a/i.test(trimmed)) return null;
+  const cleaned = trimmed.replace(/%/g, "");
+  let m = /^<\s*(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[1]) / 100;
+  m = /^>\s*(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[1]) / 100;
+  m = /^(\d+(?:\.\d+)?)\s*-\s*(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[2]) / 100;
+  m = /^(\d+(?:\.\d+)?)$/.exec(cleaned);
+  if (m) return Number(m[1]) / 100;
+  return null;
+}
+function parseSndsDate(s) {
+  const trimmed = s.trim();
+  if (!trimmed) return null;
+  const m = /^(\d{1,2})\/(\d{1,2})\/(\d{4})\s+(\d{1,2}):(\d{2})(?::(\d{2}))?\s*(AM|PM)?$/i.exec(trimmed);
+  if (m) {
+    const month = Number(m[1]) - 1;
+    const day = Number(m[2]);
+    const year = Number(m[3]);
+    let hour = Number(m[4]);
+    const minute = Number(m[5]);
+    const second = Number(m[6] ?? 0);
+    const meridiem = m[7]?.toUpperCase();
+    if (meridiem === "PM" && hour < 12) hour += 12;
+    if (meridiem === "AM" && hour === 12) hour = 0;
+    const wallMs = Date.UTC(year, month, day, hour, minute, second);
+    if (!Number.isFinite(wallMs)) return null;
+    const offsetHours = isUsPacificDst(year, month, day) ? 7 : 8;
+    return new Date(wallMs + offsetHours * 60 * 60 * 1e3);
+  }
+  const d = new Date(trimmed);
+  if (!isNaN(d.getTime())) return d;
+  return null;
+}
+function isUsPacificDst(year, month0, day) {
+  if (month0 > 2 && month0 < 10) return true;
+  if (month0 < 2 || month0 > 10) return false;
+  if (month0 === 2) {
+    const dst2 = nthSundayOfMonth(year, 2, 2);
+    return day >= dst2;
+  }
+  const dst = nthSundayOfMonth(year, 10, 1);
+  return day < dst;
+}
+function nthSundayOfMonth(year, month0, n) {
+  const first = new Date(Date.UTC(year, month0, 1));
+  const dayOfWeek = first.getUTCDay();
+  const firstSunday = 1 + (7 - dayOfWeek) % 7;
+  return firstSunday + (n - 1) * 7;
+}
+
+// src/server/runner/dmarc.ts
+var MAX_DECOMPRESSED_BYTES = 50 * 1024 * 1024;
+function assertSafeZipEntryName(rawName) {
+  if (typeof rawName !== "string" || rawName.length === 0) {
+    throw new Error(`zip entry has unsafe path: <empty>`);
+  }
+  if (rawName.includes("\0")) {
+    throw new Error(`zip entry has unsafe path: contains null byte`);
+  }
+  if (rawName.startsWith("/") || rawName.startsWith("\\") || /^[a-zA-Z]:[\\/]/.test(rawName)) {
+    throw new Error(`zip entry has unsafe path: ${rawName}`);
+  }
+  const parts = rawName.split(/[/\\]/);
+  if (parts.some((p) => p === "..")) {
+    throw new Error(`zip entry has unsafe path: ${rawName}`);
+  }
+}
+async function extractDmarcXmls(buffer, filename) {
+  const lower = (filename ?? "").toLowerCase();
+  const zlib = await import('zlib');
+  if (lower.endsWith(".gz")) {
+    const xml = await new Promise((resolve, reject) => {
+      const chunks = [];
+      let bytes = 0;
+      const stream = zlib.createGunzip();
+      stream.on("data", (chunk) => {
+        bytes += chunk.length;
+        if (bytes > MAX_DECOMPRESSED_BYTES) {
+          stream.destroy();
+          reject(new Error(`DMARC gzip exceeds ${MAX_DECOMPRESSED_BYTES} bytes (decompression bomb?)`));
+          return;
+        }
+        chunks.push(chunk);
+      });
+      stream.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+      stream.on("error", reject);
+      stream.end(buffer);
+    });
+    return [xml];
+  }
+  if (lower.endsWith(".zip")) {
+    const { default: AdmZip } = await import('adm-zip');
+    const zip = new AdmZip(buffer);
+    const entries = zip.getEntries().filter((e) => !e.isDirectory);
+    if (entries.length === 0) throw new Error("zip contains no files");
+    let total = 0;
+    const pieces = [];
+    for (const entry of entries) {
+      assertSafeZipEntryName(entry.entryName);
+      const declaredSize = entry.header?.size;
+      if (typeof declaredSize !== "number" || declaredSize <= 0) {
+        throw new Error(`zip entry ${entry.entryName} has no declared size (refusing to decompress)`);
+      }
+      if (declaredSize > MAX_DECOMPRESSED_BYTES || total + declaredSize > MAX_DECOMPRESSED_BYTES) {
+        throw new Error(`DMARC zip exceeds ${MAX_DECOMPRESSED_BYTES} bytes (decompression bomb?)`);
+      }
+      const data = entry.getData();
+      total += data.length;
+      if (total > MAX_DECOMPRESSED_BYTES) {
+        throw new Error(`DMARC zip decompressed payload exceeds ${MAX_DECOMPRESSED_BYTES} bytes (forged header?)`);
+      }
+      if (declaredSize > 10 * 1024 && data.length > declaredSize * 64 + 1024) {
+        throw new Error(`DMARC zip entry ${entry.entryName} decompressed size (${data.length}) far exceeds declared (${declaredSize})`);
+      }
+      pieces.push(data.toString("utf8"));
+    }
+    return pieces;
+  }
+  if (buffer.length > MAX_DECOMPRESSED_BYTES) {
+    throw new Error(`DMARC payload exceeds ${MAX_DECOMPRESSED_BYTES} bytes`);
+  }
+  return [buffer.toString("utf8")];
+}
+function parseDmarcReport(xml) {
+  const { XMLParser } = __require("fast-xml-parser");
+  const parser = new XMLParser({
+    ignoreAttributes: false,
+    parseAttributeValue: false,
+    parseTagValue: false,
+    trimValues: true,
+    // RFC 7489 specifies lowercase snake_case tag names, but some
+    // less-careful receivers emit CamelCase. Normalize before lookup.
+    transformTagName: (t) => t.toLowerCase()
+  });
+  const root = parser.parse(xml);
+  const fb = root?.feedback;
+  if (!fb) throw new Error("DMARC XML missing <feedback> root");
+  const meta = fb.report_metadata ?? {};
+  const policy = fb.policy_published ?? {};
+  const reportId = String(meta.report_id ?? "").trim();
+  const orgName = String(meta.org_name ?? "").trim();
+  const email = String(meta.email ?? "").trim();
+  const domain = String(policy.domain ?? "").trim().toLowerCase();
+  const policyP = policy.p ?? "none";
+  const rawPct = Number(policy.pct ?? 100);
+  const policyPct = Number.isFinite(rawPct) ? Math.max(0, Math.min(100, rawPct)) : 100;
+  if (!reportId) throw new Error("DMARC XML missing report_id");
+  if (!domain) throw new Error("DMARC XML missing policy_published.domain");
+  const range = meta.date_range ?? {};
+  const begin = secondsToDate(range.begin);
+  const end = secondsToDate(range.end);
+  if (!begin || !end) throw new Error("DMARC XML missing date_range");
+  const records = toArray(fb.record);
+  const failures = [];
+  let totalMessages = 0;
+  let passCount = 0;
+  let failCount = 0;
+  const midMs = Math.floor((begin.getTime() + end.getTime()) / 2);
+  const day = new Date(midMs).toISOString().slice(0, 10);
+  for (const rec of records) {
+    const row = rec?.row ?? {};
+    const count = Number(row.count ?? 0) || 0;
+    totalMessages += count;
+    const evald = row.policy_evaluated ?? {};
+    const dkim = evald.dkim ?? "none";
+    const spf = evald.spf ?? "none";
+    const aligned = dkim === "pass" || spf === "pass";
+    if (aligned) {
+      passCount += count;
+      continue;
+    }
+    failCount += count;
+    const sourceIp = String(row.source_ip ?? "").trim();
+    if (!sourceIp) continue;
+    const headerFrom = String(rec?.identifiers?.header_from ?? "").toLowerCase();
+    const dispositionApplied = String(evald.disposition ?? "none");
+    failures.push({
+      reportId,
+      domain,
+      sourceIp,
+      count,
+      headerFrom,
+      dkimResult: dkim,
+      spfResult: spf,
+      dispositionApplied,
+      day
+    });
+  }
+  return {
+    report: {
+      reportId,
+      orgName,
+      email,
+      domain,
+      policyP,
+      policyPct,
+      rangeStart: begin,
+      rangeEnd: end,
+      totalMessages,
+      passCount,
+      failCount
+    },
+    failures
+  };
+}
+function secondsToDate(v) {
+  if (v === void 0 || v === null) return null;
+  const n = typeof v === "number" ? v : Number(String(v));
+  if (!Number.isFinite(n) || n <= 0) return null;
+  return new Date(n * 1e3);
+}
+function toArray(v) {
+  if (v === void 0 || v === null) return [];
+  return Array.isArray(v) ? v : [v];
+}
+async function ingestDmarcAttachment(ctx, buffer, filename) {
+  const xmls = await extractDmarcXmls(buffer, filename);
+  if (xmls.length === 0) throw new Error("attachment contained no XML payload");
+  const results = [];
+  let firstError = null;
+  for (const xml of xmls) {
+    try {
+      const parsed = parseDmarcReport(xml);
+      results.push(await ingestParsedDmarcReport(ctx, parsed));
+    } catch (err) {
+      if (!firstError) firstError = err;
+    }
+  }
+  if (results.length === 0) {
+    throw firstError ?? new Error("no parseable DMARC reports in attachment");
+  }
+  return { ...results[0], additionalReports: results.length - 1 };
+}
+async function ingestParsedDmarcReport(ctx, parsed) {
+  const now = /* @__PURE__ */ new Date();
+  const { report, failures } = parsed;
+  let duplicate = false;
+  try {
+    await ctx.collections.dmarcReports.insertOne({ ...report, receivedAt: now });
+  } catch (err) {
+    if (err?.code === 11e3) {
+      duplicate = true;
+    } else {
+      throw err;
+    }
+  }
+  if (!duplicate && failures.length > 0) {
+    try {
+      await ctx.collections.dmarcFailures.insertMany(
+        failures.map((f) => ({ ...f, receivedAt: now })),
+        { ordered: false }
+      );
+    } catch (err) {
+      const writeErrors = err?.writeErrors;
+      if (Array.isArray(writeErrors)) {
+        const nonDup = writeErrors.find((w) => w?.code !== 11e3);
+        if (nonDup) throw err;
+      } else if (err?.code !== 11e3) {
+        throw err;
+      }
+    }
+  }
+  return {
+    ok: true,
+    reportId: report.reportId,
+    domain: report.domain,
+    rangeStart: report.rangeStart,
+    rangeEnd: report.rangeEnd,
+    totalMessages: report.totalMessages,
+    passCount: report.passCount,
+    failCount: report.failCount,
+    duplicate
+  };
+}
+var _lastPruneAt = 0;
+var PRUNE_INTERVAL_MS = 60 * 60 * 1e3;
+async function pruneDmarcFailures(ctx, opts = {}) {
+  const cfg = ctx.config.dmarc;
+  const days = cfg?.retentionDays ?? 90;
+  if (days <= 0) return 0;
+  if (!opts.force && Date.now() - _lastPruneAt < PRUNE_INTERVAL_MS) return 0;
+  _lastPruneAt = Date.now();
+  const cutoff = new Date(Date.now() - days * 864e5);
+  const r = await ctx.collections.dmarcFailures.deleteMany({ receivedAt: { $lt: cutoff } });
+  return r.deletedCount ?? 0;
+}
+async function resolveSourceTags(ctx) {
+  const out = /* @__PURE__ */ new Map();
+  for (const t of ctx.config.dmarc?.knownSources ?? []) {
+    out.set(t.ip, { ip: t.ip, label: t.label, ignored: !!t.ignored, source: "config" });
+  }
+  const dbTags = await ctx.collections.dmarcSourceTags.find({}).toArray();
+  for (const t of dbTags) {
+    out.set(t.ip, { ip: t.ip, label: t.label, ignored: t.ignored, source: "db" });
+  }
+  return out;
+}
+function suggestPolicyProgression(input) {
+  const { reports, failures, knownSourceIps, ignoredSourceIps, currentPolicy, currentPct } = input;
+  if (currentPolicy === "reject") return null;
+  const since30 = Date.now() - 30 * 864e5;
+  const recentReports = reports.filter((r) => r.rangeEnd.getTime() >= since30);
+  const totalMsgs = recentReports.reduce((acc, r) => acc + r.passCount + r.failCount, 0);
+  const totalPass = recentReports.reduce((acc, r) => acc + r.passCount, 0);
+  if (recentReports.length < 30) return null;
+  if (totalMsgs < 1e3) return null;
+  const untaggedFailures = failures.filter(
+    (f) => f.receivedAt.getTime() >= since30 && !knownSourceIps.has(f.sourceIp) && !ignoredSourceIps.has(f.sourceIp)
+  );
+  if (untaggedFailures.length > 0) return null;
+  const alignmentRate = totalMsgs === 0 ? 0 : totalPass / totalMsgs;
+  if (currentPolicy === null || currentPolicy === "none") {
+    if (alignmentRate >= 0.99) {
+      return {
+        policy: "quarantine",
+        pct: 10,
+        reason: `${(alignmentRate * 100).toFixed(2)}% alignment over ${recentReports.length} reports / ${totalMsgs.toLocaleString()} messages, all known sources tagged.`
+      };
+    }
+    return null;
+  }
+  if (currentPolicy === "quarantine") {
+    const pct = currentPct ?? 100;
+    if (alignmentRate < 0.995) return null;
+    if (pct < 25) return { policy: "quarantine", pct: 25, reason: `Alignment held at ${(alignmentRate * 100).toFixed(2)}% \u2014 safe to ramp pct from ${pct} to 25.` };
+    if (pct < 50) return { policy: "quarantine", pct: 50, reason: `Alignment held at ${(alignmentRate * 100).toFixed(2)}% \u2014 safe to ramp pct from ${pct} to 50.` };
+    if (pct < 100) return { policy: "quarantine", pct: 100, reason: `Alignment held at ${(alignmentRate * 100).toFixed(2)}% \u2014 safe to ramp pct from ${pct} to 100.` };
+    if (alignmentRate >= 0.999) {
+      return { policy: "reject", pct: 100, reason: `Alignment at ${(alignmentRate * 100).toFixed(3)}% with policy=quarantine pct=100 \u2014 safe to move to p=reject.` };
+    }
+  }
+  return null;
+}
+
+// src/server/runner/tick.ts
+var STRANDED_SEND_THRESHOLD_MS = 5 * 60 * 1e3;
+async function runTick(ctx) {
+  try {
+    await ctx.collections.health.updateOne(
+      { _id: HEALTH_AGG_ID },
+      {
+        $set: { updatedAt: /* @__PURE__ */ new Date() },
+        $setOnInsert: {
+          _id: HEALTH_AGG_ID,
+          senderDomain: null,
+          kind: null,
+          windowStartedAt: /* @__PURE__ */ new Date(),
+          windowDurationMs: ctx.config.circuitBreaker.windowMinutes * 60 * 1e3,
+          status: "healthy",
+          trippedAt: null,
+          trippedReason: null,
+          manuallyResumedAt: null,
+          counters: { sent: 0, delivered: 0, bounced: 0, hardBounced: 0, softBounced: 0, complained: 0, failedToSend: 0 },
+          rates: { bounceRate: 0, hardBounceRate: 0, complaintRate: 0, failureRate: 0 }
+        }
+      },
+      { upsert: true }
+    );
+  } catch (err) {
+    console.error("mailery: heartbeat write failed", err);
+  }
+  await processNewlyFiredEventTriggers(ctx).catch((err) => {
+    console.error("mailery: triggers scan failed", err);
+  });
+  await sweepStrandedFlowRuns(ctx).catch((err) => {
+    console.error("mailery: sweep failed", err);
+  });
+  await sweepStrandedSends(ctx).catch((err) => {
+    console.error("mailery: stranded-send sweep failed", err);
+  });
+  await drainOutbox(ctx).catch((err) => {
+    console.error("mailery: outbox drain failed", err);
+  });
+  await processScheduledBroadcasts2(ctx).catch((err) => {
+    console.error("mailery: broadcast dispatch failed", err);
+  });
+  await evaluateHealth(ctx).catch((err) => {
+    console.error("mailery: health evaluation failed", err);
+  });
+  await promoteSoftBounces(ctx).catch((err) => {
+    console.error("mailery: soft-bounce promotion failed", err);
+  });
+  await Promise.all([
+    runDnsblChecks(ctx).catch((err) => {
+      console.error("mailery: dnsbl checks failed", err);
+    }),
+    runPostmasterPull(ctx).catch((err) => {
+      console.error("mailery: postmaster pull failed", err);
+    }),
+    runSndsPull(ctx).catch((err) => {
+      console.error("mailery: snds pull failed", err);
+    }),
+    pruneDmarcFailures(ctx).catch((err) => {
+      console.error("mailery: dmarc prune failed", err);
+    })
+  ]);
+}
+async function sweepStrandedSends(ctx) {
+  const cutoff = new Date(Date.now() - STRANDED_SEND_THRESHOLD_MS);
+  const cursor = ctx.collections.sends.find(
+    { status: "sending", updatedAt: { $lt: cutoff } },
+    { projection: { _id: 1 } }
+  ).limit(500);
+  for await (const row of cursor) {
+    const reset = await ctx.collections.sends.updateOne(
+      { _id: row._id, status: "sending", updatedAt: { $lt: cutoff } },
+      { $set: { status: "queued", updatedAt: /* @__PURE__ */ new Date() } }
+    );
+    if (reset.modifiedCount === 0) continue;
+    await ctx.queues.send.add("send", { sendId: String(row._id) }, {
+      attempts: ctx.config.sendRetryAttempts,
+      backoff: { type: "exponential", delay: 6e4 }
+    });
+  }
+}
+async function drainOutbox(ctx) {
+  const batch = await ctx.collections.outbox.find({ status: "pending" }).sort({ enqueuedAt: 1 }).limit(200).toArray();
+  for (const row of batch) {
+    try {
+      if (row.payload.type === "event") {
+        try {
+          await ctx.collections.events.insertOne({
+            externalId: row.payload.data.externalId,
+            name: row.payload.data.name,
             properties: row.payload.data.properties ?? {},
             dedupeKey: row.payload.dedupeKey,
             occurredAt: row.payload.data.occurredAt ?? /* @__PURE__ */ new Date(),
@@ -2304,6 +3631,10 @@ async function processScheduledBroadcasts2(ctx) {
 }
 
 // src/server/runner/webhook.ts
+function dimsFromSend(send) {
+  if (!send) return null;
+  return { fromEmail: send.fromEmail, kind: send.kind };
+}
 async function applyWebhookEvent(event, ctx) {
   const send = await ctx.collections.sends.findOne(
     event.providerMessageId ? { $or: [{ providerMessageId: event.providerMessageId }, { emailAtSend: event.email }] } : { emailAtSend: event.email },
@@ -2317,7 +3648,7 @@ async function applyWebhookEvent(event, ctx) {
           { $set: { status: "delivered", deliveredAt: event.occurredAt } }
         );
       }
-      await recordHealthCounter(ctx, "delivered");
+      await recordHealthCounter(ctx, "delivered", dimsFromSend(send));
       break;
     case "open":
       if (send) {
@@ -2372,8 +3703,11 @@ async function applyWebhookEvent(event, ctx) {
           { $set: { status: "bounced", updatedAt: /* @__PURE__ */ new Date() } }
         );
       }
-      await recordHealthCounter(ctx, "bounced");
-      await recordHealthCounter(ctx, bounceType === "hard" ? "hardBounced" : "softBounced");
+      {
+        const dims = dimsFromSend(send);
+        await recordHealthCounter(ctx, "bounced", dims);
+        await recordHealthCounter(ctx, bounceType === "hard" ? "hardBounced" : "softBounced", dims);
+      }
       break;
     }
     case "complaint":
@@ -2389,7 +3723,7 @@ async function applyWebhookEvent(event, ctx) {
         { emailAtSubscribe: event.email },
         { $set: { status: "complained", updatedAt: /* @__PURE__ */ new Date() } }
       );
-      await recordHealthCounter(ctx, "complained");
+      await recordHealthCounter(ctx, "complained", dimsFromSend(send));
       break;
     case "unsubscribe":
       if (send) {
@@ -2455,10 +3789,12 @@ var Mailer = class _Mailer {
       db: this.db,
       collections: this.collections,
       adapter: this.adapter,
+      varsAdapter: this.config.varsAdapter,
       providers: this.providers,
       queues: this.queues,
       config: this.config,
-      handlebarsHelpers: this.config.handlebarsHelpers
+      handlebarsHelpers: this.config.handlebarsHelpers,
+      audit: (entry) => this.audit(entry)
     };
   }
   /**
@@ -2533,6 +3869,10 @@ var Mailer = class _Mailer {
     if (!config.providers[config.defaultProvider]) {
       throw new Error(`defaultProvider "${config.defaultProvider}" not in providers map`);
     }
+    if (config.varsAdapter) {
+      const { assertNoReservedVarKeys: assertNoReservedVarKeys2 } = await Promise.resolve().then(() => (init_vars(), vars_exports));
+      assertNoReservedVarKeys2(config.varsAdapter);
+    }
     const collections = getCollections(config.db, config.collectionPrefix);
     await ensureIndexes(config.db, config.collectionPrefix);
     const queueDriver = await createQueueDriver(config.queue, config.db);
@@ -2740,13 +4080,79 @@ var Mailer = class _Mailer {
       );
     }
   }
-  async untag(externalId, tag) {
-    const parsed = tagInputSchema.parse({ externalId, tag });
-    if (this.adapter.removeTags) {
-      await this.adapter.removeTags(parsed.externalId, [parsed.tag]);
-    } else {
-      await this.collections.contactTags.deleteOne({ externalId: parsed.externalId, tag: parsed.tag });
+  async untag(externalId, tag) {
+    const parsed = tagInputSchema.parse({ externalId, tag });
+    if (this.adapter.removeTags) {
+      await this.adapter.removeTags(parsed.externalId, [parsed.tag]);
+    } else {
+      await this.collections.contactTags.deleteOne({ externalId: parsed.externalId, tag: parsed.tag });
+    }
+  }
+  // -------------------------------------------------------------------------
+  // Flow abort
+  // -------------------------------------------------------------------------
+  /**
+   * Abort every active run of one flow for a contact, immediately. Runs parked
+   * in a `wait` exit too — their delayed wake-up jobs find the run exited and
+   * no-op. Also cancels any of the flow's emails still sitting in the send
+   * queue for this contact (queued or awaiting retry), so an abort means no
+   * further mail, not just no further steps.
+   *
+   * No-op (returns zero counts) when nothing is active. Safe to call from the
+   * same handler that processes the business event ("user upgraded").
+   */
+  async abortFlow(flowSlug, externalId, opts = {}) {
+    const parsed = abortFlowInputSchema.parse({ flowSlug, externalId, reason: opts.reason });
+    const flow = await this.collections.flows.findOne(
+      { slug: parsed.flowSlug },
+      { projection: { _id: 1 } }
+    );
+    if (!flow) throw new Error(`abortFlow: unknown flow slug "${parsed.flowSlug}"`);
+    const result = await this.abortActiveRuns(
+      { externalId: parsed.externalId, flowId: flow._id },
+      parsed.reason ? `aborted_by_host:${parsed.reason}` : "aborted_by_host"
+    );
+    if (result.abortedRuns > 0 || result.cancelledSends > 0) {
+      await this.audit({
+        actor: "host",
+        action: "flow.abort",
+        resource: { collection: "mailer_flow_runs", slug: parsed.flowSlug },
+        diffSummary: `abortFlow slug=${parsed.flowSlug} externalId=${parsed.externalId} runs=${result.abortedRuns} sends=${result.cancelledSends}${parsed.reason ? ` reason=${parsed.reason}` : ""}`
+      });
+    }
+    return result;
+  }
+  /**
+   * Abort every active flow run for a contact across all flows. Same semantics
+   * as `abortFlow` — for "stop everything" events (account deleted, churned).
+   */
+  async abortAllFlows(externalId, opts = {}) {
+    const parsed = abortAllFlowsInputSchema.parse({ externalId, reason: opts.reason });
+    const result = await this.abortActiveRuns(
+      { externalId: parsed.externalId },
+      parsed.reason ? `aborted_by_host:${parsed.reason}` : "aborted_by_host"
+    );
+    if (result.abortedRuns > 0 || result.cancelledSends > 0) {
+      await this.audit({
+        actor: "host",
+        action: "flow.abort_all",
+        resource: { collection: "mailer_flow_runs" },
+        diffSummary: `abortAllFlows externalId=${parsed.externalId} runs=${result.abortedRuns} sends=${result.cancelledSends}${parsed.reason ? ` reason=${parsed.reason}` : ""}`
+      });
+    }
+    return result;
+  }
+  async abortActiveRuns(filter, exitReason) {
+    const runs = await this.collections.flowRuns.find({ ...filter, status: "active" }).toArray();
+    if (runs.length === 0) return { abortedRuns: 0, cancelledSends: 0 };
+    for (const run of runs) {
+      await exitFlowRun(run, exitReason, this.runnerContext);
     }
+    const cancelled = await this.collections.sends.updateMany(
+      { flowRunId: { $in: runs.map((r) => r._id) }, status: { $in: ["queued", "failed"] } },
+      { $set: { status: "cancelled", errorMessage: `cancelled: ${exitReason}`, updatedAt: /* @__PURE__ */ new Date() } }
+    );
+    return { abortedRuns: runs.length, cancelledSends: cancelled.modifiedCount };
   }
   /**
    * GDPR right-to-erasure. Hard-deletes the contact's PII and leaves a hashed
@@ -2948,45 +4354,9 @@ var Mailer = class _Mailer {
   }
 };
 
-// src/server/templates/sender-domain.ts
-function validateSenderDomain(fromEmail, templateKind, registry) {
-  if (!registry || Object.keys(registry).length === 0) return { ok: true };
-  const domain = extractDomain(fromEmail);
-  if (!domain) {
-    return {
-      ok: false,
-      code: "invalid_email",
-      reason: `invalid fromEmail "${fromEmail}" \u2014 expected "name@domain"`
-    };
-  }
-  const entry = registry[domain];
-  if (!entry) {
-    const known = Object.keys(registry).join(", ");
-    return {
-      ok: false,
-      code: "unregistered_domain",
-      reason: `sender domain "${domain}" is not declared in senderDomains (allowed: ${known})`
-    };
-  }
-  if (entry.kind === "both") return { ok: true };
-  if (entry.kind !== templateKind) {
-    return {
-      ok: false,
-      code: "wrong_kind",
-      reason: `sender domain "${domain}" is configured for ${entry.kind} email, but this template's kind is ${templateKind}`
-    };
-  }
-  return { ok: true };
-}
-function extractDomain(email) {
-  if (typeof email !== "string") return null;
-  const at = email.lastIndexOf("@");
-  if (at <= 0 || at === email.length - 1) return null;
-  return email.slice(at + 1).toLowerCase().trim();
-}
-
 // src/server/index.ts
 init_mongo();
+init_vars();
 
 // src/server/providers/null.ts
 var counter = 0;
@@ -3015,6 +4385,254 @@ var NullProvider = class {
 // src/server/index.ts
 init_sendgrid();
 
+// src/server/templates/linter.ts
+var URL_SHORTENERS = ["bit.ly", "t.co", "tinyurl.com", "goo.gl", "ow.ly"];
+var SPAM_PHRASES = [
+  { pattern: /\bFREE\b/, phrase: "FREE" },
+  { pattern: /\bACT NOW\b/i, phrase: "ACT NOW" },
+  { pattern: /\b100%\s+guaranteed\b/i, phrase: "100% guaranteed" }
+];
+var MARKETING_UNSUBSCRIBE_TAG = /\{\{\s*unsubscribeUrl\s*\}\}/;
+function lintTemplate(rawInput, config = {}) {
+  const input = {
+    subject: typeof rawInput.subject === "string" ? rawInput.subject : "",
+    preheader: typeof rawInput.preheader === "string" ? rawInput.preheader : "",
+    mjml: typeof rawInput.mjml === "string" ? rawInput.mjml : "",
+    editorJson: rawInput.editorJson,
+    html: typeof rawInput.html === "string" ? rawInput.html : "",
+    plainText: typeof rawInput.plainText === "string" ? rawInput.plainText : "",
+    kind: rawInput.kind === "marketing" || rawInput.kind === "transactional" ? rawInput.kind : "transactional",
+    fromEmail: typeof rawInput.fromEmail === "string" ? rawInput.fromEmail : ""
+  };
+  const issues = [];
+  if (!input.plainText || input.plainText.trim().length === 0) {
+    issues.push({
+      rule: "missing_plain_text",
+      severity: "error",
+      message: "Plain-text alternative is empty.",
+      hint: "Email clients and spam filters use the plain-text part. Add visible text content (MJML mj-text blocks, or text content in the Maily editor) \u2014 do not strip plain-text to empty."
+    });
+  }
+  const imageCount = countMatches(input.html, /<img\b/gi);
+  const textLen = input.plainText.trim().length;
+  if (imageCount >= 1 && textLen < 20) {
+    issues.push({
+      rule: "image_only_body",
+      severity: "error",
+      message: "Body is mostly images with little or no text.",
+      hint: "Image-only emails are heavily filtered as spam. Add at least one paragraph of meaningful text."
+    });
+  }
+  const shortenerLinks = findShortenerLinks(input.html);
+  if (shortenerLinks.length > 0) {
+    issues.push({
+      rule: "url_shortener",
+      severity: "error",
+      message: `Link uses a URL shortener: ${shortenerLinks.join(", ")}.`,
+      hint: "URL shorteners are strongly correlated with spam and are routinely blocked. Use a direct link to your domain."
+    });
+  }
+  if (hasBareUrlInVisibleText(input.html)) {
+    issues.push({
+      rule: "bare_url",
+      severity: "warning",
+      message: "A URL appears in the body text without being wrapped in a link.",
+      hint: "Wrap visible URLs in an anchor tag \u2014 bare URLs look like spam template residue and reduce engagement."
+    });
+  }
+  const spam = findSpamSignals(`${input.subject}
+${input.plainText}`);
+  if (spam.length > 0) {
+    issues.push({
+      rule: "spam_phrases",
+      severity: "warning",
+      message: `Content contains spam-flagged phrases: ${spam.join(", ")}.`,
+      hint: "These phrases trigger content filters. Rephrase if possible."
+    });
+  }
+  if (isAllCaps(input.subject)) {
+    issues.push({
+      rule: "all_caps_subject",
+      severity: "warning",
+      message: "Subject line is mostly uppercase.",
+      hint: "All-caps subjects are flagged by spam filters and reduce click-through. Use sentence case."
+    });
+  }
+  if (input.kind === "marketing") {
+    const sources = [input.mjml ?? "", input.html ?? "", JSON.stringify(input.editorJson ?? null)];
+    const hasTag = sources.some((s) => MARKETING_UNSUBSCRIBE_TAG.test(s));
+    if (!hasTag) {
+      issues.push({
+        rule: "missing_unsubscribe_tag",
+        severity: "error",
+        message: "Marketing template is missing the {{unsubscribeUrl}} merge tag.",
+        hint: "CAN-SPAM, GDPR, and Gmail/Yahoo bulk-sender rules all require a working unsubscribe link. Add {{unsubscribeUrl}} somewhere in the body."
+      });
+    }
+  }
+  const senderCheck = validateSenderDomain(input.fromEmail, input.kind, config.senderDomains);
+  if (!senderCheck.ok) {
+    issues.push({
+      rule: "sender_domain_invalid",
+      severity: "error",
+      message: senderCheck.reason,
+      hint: "Edit the template fromEmail to use a domain declared for this kind in senderDomains, or update the registry."
+    });
+  }
+  if (!input.preheader || input.preheader.trim().length === 0) {
+    issues.push({
+      rule: "empty_preheader",
+      severity: "info",
+      message: "No preheader set.",
+      hint: "The preheader shows next to the subject in most inbox previews. A good preheader lifts open rate 5-10%."
+    });
+  }
+  if (input.subject.length > 60) {
+    issues.push({
+      rule: "subject_too_long",
+      severity: "warning",
+      message: `Subject is ${input.subject.length} characters; mobile clients truncate around 60.`,
+      hint: "Front-load the important words so the truncated preview still makes sense."
+    });
+  }
+  if (config.varsJsonSchema) {
+    const sources = [input.subject, input.preheader, input.mjml, JSON.stringify(input.editorJson ?? null)];
+    const unknown = findUnknownVariables(sources.join("\n"), config.varsJsonSchema);
+    if (unknown.length > 0) {
+      issues.push({
+        rule: "unknown_variable",
+        severity: "warning",
+        message: `Template references variable(s) not in the vars schema: ${unknown.join(", ")}.`,
+        hint: "These render as empty strings. Check for typos, or add the key to your varsAdapter schema. Paths inside {{#each}}/{{#with}} blocks are relative and not checked."
+      });
+    }
+  }
+  const linkCount = countMatches(input.html, /<a\s[^>]*\bhref\s*=/gi);
+  if (linkCount > 10) {
+    issues.push({
+      rule: "too_many_links",
+      severity: "warning",
+      message: `${linkCount} links in body; promotional content with many links is flagged by content filters.`,
+      hint: "Consolidate calls-to-action. Aim for one primary action plus a footer link or two."
+    });
+  }
+  return splitBySeverity(issues);
+}
+function splitBySeverity(issues) {
+  const out = { errors: [], warnings: [], infos: [] };
+  for (const i of issues) {
+    if (i.severity === "error") out.errors.push(i);
+    else if (i.severity === "warning") out.warnings.push(i);
+    else out.infos.push(i);
+  }
+  return out;
+}
+function countMatches(s, re) {
+  return (s.match(re) ?? []).length;
+}
+function findShortenerLinks(html) {
+  const hrefs = extractHrefs(html);
+  const hits = /* @__PURE__ */ new Set();
+  for (const href of hrefs) {
+    const domain = hostnameOf(href);
+    if (!domain) continue;
+    if (URL_SHORTENERS.includes(domain)) hits.add(domain);
+  }
+  return Array.from(hits);
+}
+function extractHrefs(html) {
+  const out = [];
+  const re = /<a\s[^>]*\bhref\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
+  let m;
+  while (m = re.exec(html)) {
+    const href = m[1] ?? m[2] ?? m[3];
+    if (href) out.push(href);
+  }
+  return out;
+}
+function hostnameOf(url) {
+  try {
+    return new URL(url).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function hasBareUrlInVisibleText(html) {
+  const stripped = html.replace(/<a\b[^>]*>.*?<\/a>/gis, " ").replace(/<style\b[^>]*>.*?<\/style>/gis, " ").replace(/<script\b[^>]*>.*?<\/script>/gis, " ").replace(/<head\b[^>]*>.*?<\/head>/gis, " ");
+  return /https?:\/\/[^\s<>"']+/i.test(stripped);
+}
+function findSpamSignals(text) {
+  const out = /* @__PURE__ */ new Set();
+  for (const { pattern, phrase } of SPAM_PHRASES) {
+    if (pattern.test(text)) out.add(phrase);
+  }
+  if (/!{3,}/.test(text)) out.add('excessive "!!!"');
+  return Array.from(out);
+}
+var BUILTIN_VAR_ROOTS = /* @__PURE__ */ new Set([
+  "contact",
+  "vars",
+  "event",
+  "unsubscribeUrl",
+  "viewInBrowserUrl",
+  "preferenceCenterUrl",
+  "senderAddress",
+  "this"
+]);
+var PATH_TOKEN = /^@?[A-Za-z_][\w$]*(\.[A-Za-z_][\w$]*)*$/;
+function findUnknownVariables(source, schema) {
+  const hasBlockScopes = /\{\{[#^]\s*(each|with)\b/.test(source);
+  const unknown = /* @__PURE__ */ new Set();
+  const re = /\{\{\{?\s*([^{}]+?)\s*\}?\}\}/g;
+  let m;
+  while (m = re.exec(source)) {
+    const expr = m[1].trim();
+    if (!expr || /^[#^/>!]/.test(expr) || expr === "else") continue;
+    if (expr.includes("(")) continue;
+    const parts = expr.split(/\s+/);
+    const candidates = parts.length > 1 ? parts.slice(1) : parts;
+    for (const raw of candidates) {
+      if (!PATH_TOKEN.test(raw)) continue;
+      if (raw.startsWith("@")) continue;
+      const segments = raw.split(".");
+      if (BUILTIN_VAR_ROOTS.has(segments[0])) continue;
+      if (hasBlockScopes && segments.length === 1) continue;
+      if (!schemaHasPath(schema, segments)) unknown.add(raw);
+    }
+  }
+  return Array.from(unknown);
+}
+function schemaHasPath(node, segments) {
+  if (segments.length === 0) return true;
+  if (!node || typeof node !== "object") return true;
+  const n = node;
+  for (const key of ["anyOf", "oneOf", "allOf"]) {
+    if (Array.isArray(n[key])) {
+      return n[key].some((branch) => schemaHasPath(branch, segments));
+    }
+  }
+  if (Array.isArray(n.type) && n.type.includes("object") && !n.properties) return true;
+  if (n.type === "array") {
+    if (segments[0] === "length") return true;
+    return schemaHasPath(n.items, segments);
+  }
+  const props = n.properties;
+  if (!props || typeof props !== "object") return true;
+  const [head, ...rest] = segments;
+  if (head in props) return schemaHasPath(props[head], rest);
+  if (n.additionalProperties === void 0 || n.additionalProperties === false) return false;
+  return true;
+}
+function isAllCaps(subject) {
+  const letters = subject.replace(/[^a-zA-Z]/g, "");
+  if (letters.length < 5) return false;
+  const upper = subject.replace(/[^A-Z]/g, "").length;
+  return upper / letters.length > 0.5;
+}
+
+// src/server/api/admin.ts
+init_vars();
+
 // src/server/api/setup-status.ts
 async function runSetupChecks(mailer) {
   const checks = [];
@@ -3024,6 +4642,12 @@ async function runSetupChecks(mailer) {
     checks.push(await checkWorkersHeartbeat(mailer));
   }
   checks.push(await checkCircuitBreaker(mailer));
+  checks.push(await checkDnsbl(mailer));
+  checks.push(await checkPostmaster(mailer));
+  checks.push(await checkSnds(mailer));
+  const jmrp = checkJmrp(mailer);
+  if (jmrp) checks.push(jmrp);
+  checks.push(await checkDmarc(mailer));
   checks.push(...checkFromDefaultsAgainstRegistry(mailer));
   checks.push(...await checkPublishedTemplates(mailer));
   checks.push(await checkPostalAddress(mailer));
@@ -3073,7 +4697,10 @@ async function checkQueue(mailer) {
   }
 }
 async function checkWorkersHeartbeat(mailer) {
-  const h = await mailer.collections.health.findOne({ _id: "singleton" });
+  const h = await mailer.collections.health.findOne(
+    {},
+    { sort: { updatedAt: -1 } }
+  );
   const tickIntervalMs = mailer.config.tickIntervalSeconds * 1e3;
   const staleAfterMs = Math.max(tickIntervalMs * 3, 3e4);
   if (!h) {
@@ -3103,25 +4730,264 @@ async function checkWorkersHeartbeat(mailer) {
   };
 }
 async function checkCircuitBreaker(mailer) {
-  const h = await mailer.collections.health.findOne({ _id: "singleton" });
-  if (!h || h.status === "healthy") {
-    return { name: "circuit_breaker", label: "Circuit breaker", severity: "ok", message: "healthy" };
+  const docs = await mailer.collections.health.find({}).toArray();
+  const buckets = docs.filter((d) => d._id !== HEALTH_AGG_ID);
+  if (buckets.length === 0) {
+    return {
+      name: "circuit_breaker",
+      label: "Circuit breaker",
+      severity: "ok",
+      message: "no telemetry yet",
+      hint: "The breaker tracks bounce / complaint rates per (sender domain \xD7 kind) and starts evaluating once enough sends have been recorded. Send some mail to populate."
+    };
+  }
+  const tripped = buckets.filter((d) => d.status === "tripped");
+  if (tripped.length > 0) {
+    const summary = tripped.map((d) => `${d.senderDomain ?? "_unknown"}/${d.kind}`).join(", ");
+    return {
+      name: "circuit_breaker",
+      label: "Circuit breaker",
+      severity: "error",
+      message: `tripped: ${summary}`,
+      hint: "Marketing sends are held for the listed bucket(s). Investigate the underlying bounce / complaint cause, then POST /api/health/resume (with optional senderDomain + kind to resume one bucket)."
+    };
   }
-  if (h.status === "degraded") {
+  const degraded = buckets.filter((d) => d.status === "degraded");
+  if (degraded.length > 0) {
+    const summary = degraded.map((d) => `${d.senderDomain ?? "_unknown"}/${d.kind}`).join(", ");
     return {
       name: "circuit_breaker",
       label: "Circuit breaker",
       severity: "warn",
-      message: "degraded (high failure rate)",
-      hint: "Marketing sends still flow but failure rate is above the degraded threshold. Investigate provider errors before they escalate to tripped."
+      message: `degraded: ${summary}`,
+      hint: "Marketing sends still flow but failure rate is above the degraded threshold for the listed bucket(s). Investigate provider errors before they escalate to tripped."
+    };
+  }
+  return { name: "circuit_breaker", label: "Circuit breaker", severity: "ok", message: "healthy" };
+}
+async function checkDnsbl(mailer) {
+  const docs = await mailer.collections.dnsblChecks.find({}).toArray();
+  if (docs.length === 0) {
+    return {
+      name: "dnsbl",
+      label: "DNS block-list checks",
+      severity: "ok",
+      message: "no checks run yet",
+      hint: "Checks run automatically once per dnsbl.intervalHours (default 24h). To run now, POST /api/dnsbl/recheck."
+    };
+  }
+  const listed = docs.filter((d) => d.result === "listed");
+  if (listed.length > 0) {
+    const summary = listed.map((d) => `${d.target} on ${d.listLabel}`).slice(0, 3).join("; ");
+    const more = listed.length > 3 ? ` (+${listed.length - 3} more)` : "";
+    return {
+      name: "dnsbl",
+      label: "DNS block-list checks",
+      severity: "error",
+      message: `${listed.length} listing(s): ${summary}${more}`,
+      hint: "A sender domain or IP is listed on a public DNSBL. Investigate the listing source \u2014 most lists publish a removal procedure on their website. Mail to the affected (domain, kind) bucket will likely land in spam until delisted."
+    };
+  }
+  const errored = docs.filter((d) => d.result === "error");
+  if (errored.length === docs.length) {
+    return {
+      name: "dnsbl",
+      label: "DNS block-list checks",
+      severity: "warn",
+      message: `all ${docs.length} checks errored`,
+      hint: "Lookups against block lists are failing \u2014 usually a DNS-resolution problem on the host running mailery, or a list rate-limiting your public resolver. Verify outbound DNS works."
     };
   }
   return {
-    name: "circuit_breaker",
-    label: "Circuit breaker",
-    severity: "error",
-    message: `tripped: ${h.trippedReason ?? "unknown reason"}`,
-    hint: "Marketing sends are held. Investigate the underlying bounce / complaint cause, then POST /api/health/resume."
+    name: "dnsbl",
+    label: "DNS block-list checks",
+    severity: "ok",
+    message: `clean (${docs.length} checks)`
+  };
+}
+async function checkPostmaster(mailer) {
+  const cfg = mailer.config.postmaster;
+  if (!cfg?.clientId || !cfg?.clientSecret || !cfg?.refreshToken) {
+    return {
+      name: "postmaster",
+      label: "Google Postmaster Tools",
+      severity: "ok",
+      message: "not configured (optional)",
+      hint: "Set mailer.config.postmaster with an OAuth client + refresh token to pull authoritative Gmail reputation data. Only meaningful at >100 sends/day to Gmail."
+    };
+  }
+  const snapshots = await mailer.collections.postmasterSnapshots.find({}).sort({ fetchedAt: -1 }).toArray();
+  if (snapshots.length === 0) {
+    return {
+      name: "postmaster",
+      label: "Google Postmaster Tools",
+      severity: "warn",
+      message: "configured but no data yet",
+      hint: "A pull runs once per postmaster.intervalHours (default 24h). To run now, POST /api/postmaster/refresh. Postmaster only reports for domains with >100 messages/day to Gmail; smaller senders see empty responses."
+    };
+  }
+  const latestByDomain = /* @__PURE__ */ new Map();
+  for (const s of snapshots) {
+    if (!latestByDomain.has(s.domain)) latestByDomain.set(s.domain, s);
+  }
+  const bad = [];
+  const low = [];
+  for (const s of latestByDomain.values()) {
+    if (s.domainReputation === "BAD") bad.push(s.domain);
+    else if (s.domainReputation === "LOW") low.push(s.domain);
+  }
+  if (bad.length > 0) {
+    return {
+      name: "postmaster",
+      label: "Google Postmaster Tools",
+      severity: "error",
+      message: `BAD reputation on ${bad.join(", ")}`,
+      hint: "Gmail considers these domains spammy. Most mail to Gmail addresses will land in spam folder. Marketing breaker has been tripped for affected domains. See docs/guide/warming.md \xA76 for recovery."
+    };
+  }
+  if (low.length > 0) {
+    return {
+      name: "postmaster",
+      label: "Google Postmaster Tools",
+      severity: "warn",
+      message: `LOW reputation on ${low.join(", ")}`,
+      hint: "Reputation has slipped below Medium. Review recent complaint + bounce activity, slow down marketing volume, and re-engage your most active segment only."
+    };
+  }
+  return {
+    name: "postmaster",
+    label: "Google Postmaster Tools",
+    severity: "ok",
+    // Includes REPUTATION_CATEGORY_UNSPECIFIED ("no data yet") domains —
+    // surface that explicitly so the operator isn't misled.
+    message: (() => {
+      const tiers = new Set(Array.from(latestByDomain.values()).map((d) => d.domainReputation));
+      const hasUnspec = tiers.has("REPUTATION_CATEGORY_UNSPECIFIED");
+      return `${latestByDomain.size} domain(s) tracked${hasUnspec ? " (some have no reputation data yet)" : ", all High/Medium"}`;
+    })()
+  };
+}
+function checkJmrp(mailer) {
+  const hasDedicatedIp = (mailer.config.dnsbl?.dedicatedIps?.length ?? 0) > 0;
+  if (!hasDedicatedIp) return null;
+  return {
+    name: "snds_jmrp",
+    label: "Microsoft JMRP enrolment",
+    severity: "ok",
+    message: "manual setup \u2014 confirm in your runbook",
+    hint: "Outlook spam complaints only land in mailery if you enrol each sending IP in JMRP. Visit https://sendersupport.olc.protection.outlook.com/snds/JMRP.aspx and complete the form for each IP. There is no API to verify completion; mailery shows this reminder whenever dedicatedIps is non-empty."
+  };
+}
+async function checkSnds(mailer) {
+  const cfg = mailer.config.snds;
+  const hasDedicatedIp = (mailer.config.dnsbl?.dedicatedIps?.length ?? 0) > 0;
+  if (!cfg?.accessKey) {
+    if (!hasDedicatedIp) {
+      return {
+        name: "snds",
+        label: "Microsoft SNDS",
+        severity: "ok",
+        message: "not applicable (no dedicated IP)",
+        hint: "SNDS reports IP-level Outlook/Hotmail reputation. Only meaningful when you send from a dedicated IP. Skip unless you do."
+      };
+    }
+    return {
+      name: "snds",
+      label: "Microsoft SNDS",
+      severity: "warn",
+      message: "dedicated IP configured but SNDS access key not set",
+      hint: "Sign in at https://sendersupport.olc.protection.outlook.com/snds/ , request access for your IP(s), then set mailer.config.snds.accessKey to enable daily pulls. Also enrol in JMRP at https://sendersupport.olc.protection.outlook.com/snds/JMRP.aspx so Outlook complaints flow back to your suppression list."
+    };
+  }
+  const snapshots = await mailer.collections.sndsSnapshots.find({}).sort({ fetchedAt: -1 }).toArray();
+  if (snapshots.length === 0) {
+    return {
+      name: "snds",
+      label: "Microsoft SNDS",
+      severity: "warn",
+      message: "configured but no data yet",
+      hint: "A pull runs every snds.intervalHours (default 24h). To run now, POST /api/snds/refresh. If you just enrolled, SNDS data can take 1-2 days to populate."
+    };
+  }
+  const latestByIp = /* @__PURE__ */ new Map();
+  for (const s of snapshots) {
+    if (!latestByIp.has(s.ip)) latestByIp.set(s.ip, s);
+  }
+  const red = [];
+  const yellow = [];
+  for (const s of latestByIp.values()) {
+    if (s.filterResult === "RED") red.push(s.ip);
+    else if (s.filterResult === "YELLOW") yellow.push(s.ip);
+  }
+  if (red.length > 0) {
+    return {
+      name: "snds",
+      label: "Microsoft SNDS",
+      severity: "error",
+      message: `RED filter on ${red.join(", ")}`,
+      hint: "Outlook/Hotmail is filtering mail from these IPs as spam. Reduce volume, audit recent complaints / trap hits, fix any auth alignment problems, and wait for reputation to recover (typically 1-2 weeks)."
+    };
+  }
+  if (yellow.length > 0) {
+    return {
+      name: "snds",
+      label: "Microsoft SNDS",
+      severity: "warn",
+      message: `YELLOW filter on ${yellow.join(", ")}`,
+      hint: "Outlook is putting some mail from these IPs in the junk folder. Investigate recent complaint rate and trap hits before reputation slips to RED."
+    };
+  }
+  return {
+    name: "snds",
+    label: "Microsoft SNDS",
+    severity: "ok",
+    message: `${latestByIp.size} IP(s) tracked, all GREEN`
+  };
+}
+async function checkDmarc(mailer) {
+  const reportCount = await mailer.collections.dmarcReports.estimatedDocumentCount();
+  if (reportCount === 0) {
+    return {
+      name: "dmarc",
+      label: "DMARC RUA reports",
+      severity: "ok",
+      message: "no reports ingested yet",
+      hint: "Publish DMARC `rua=mailto:<your-mailbox>` in DNS, then upload received reports via /admin/mailer/api/dmarc/upload (or drag-drop in the Health screen). RUA tells you who is sending mail as your domain \u2014 both legitimate sources and spoofers."
+    };
+  }
+  const since = new Date(Date.now() - 7 * 864e5);
+  const recent = await mailer.collections.dmarcReports.find({ rangeEnd: { $gte: since } }).toArray();
+  if (recent.length === 0) {
+    return {
+      name: "dmarc",
+      label: "DMARC RUA reports",
+      severity: "warn",
+      message: `no reports in the last 7 days (${reportCount} total)`,
+      hint: "Receivers email RUA reports daily. A gap suggests inbound delivery is broken or the rua= mailbox is no longer monitored. Check inbound mail flow."
+    };
+  }
+  const tagged = await resolveSourceTags(mailer.getRunnerContext());
+  const known = new Set(Array.from(tagged.keys()));
+  const since30 = new Date(Date.now() - 30 * 864e5);
+  const failures = await mailer.collections.dmarcFailures.find({ receivedAt: { $gte: since30 } }).toArray();
+  const unknownFailing = failures.filter((f) => !known.has(f.sourceIp));
+  if (unknownFailing.length === 0) {
+    return {
+      name: "dmarc",
+      label: "DMARC RUA reports",
+      severity: "ok",
+      message: `${recent.length} report(s) this week, no failing unknown sources`
+    };
+  }
+  const totalFailing = unknownFailing.reduce((acc, f) => acc + f.count, 0);
+  const ips = Array.from(new Set(unknownFailing.map((f) => f.sourceIp))).slice(0, 3);
+  const more = unknownFailing.length > 3 ? ` (+${unknownFailing.length - 3} more)` : "";
+  return {
+    name: "dmarc",
+    label: "DMARC RUA reports",
+    severity: "warn",
+    message: `${totalFailing} failing message(s) from ${ips.join(", ")}${more}`,
+    hint: "These IPs sent mail claiming to be from your domain that failed DMARC alignment. Tag known-legit sources in mailer.config.dmarc.knownSources to silence them. Untagged sources are likely either forgotten SaaS tools or active spoofing."
   };
 }
 function checkFromDefaultsAgainstRegistry(mailer) {
@@ -3220,18 +5086,298 @@ async function checkDoiTemplate(mailer) {
     return { name: "doi_template", label: "DOI template", severity: "ok", message: `template "${tpl.slug}" published` };
   }
   return {
-    name: "doi_template",
-    label: "DOI template",
-    severity: "error",
-    message: `requireDoubleOptIn is true but no published template with slug "${mailer.config.doiTemplateSlug}"`,
-    hint: "New subscriptions will silently fail to send confirmation emails. Create and publish a template with this slug, or unset requireDoubleOptIn."
+    name: "doi_template",
+    label: "DOI template",
+    severity: "error",
+    message: `requireDoubleOptIn is true but no published template with slug "${mailer.config.doiTemplateSlug}"`,
+    hint: "New subscriptions will silently fail to send confirmation emails. Create and publish a template with this slug, or unset requireDoubleOptIn."
+  };
+}
+function humanDuration(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  if (ms < 6e4) return `${Math.round(ms / 1e3)}s`;
+  if (ms < 36e5) return `${Math.round(ms / 6e4)}m`;
+  return `${Math.round(ms / 36e5)}h`;
+}
+
+// src/server/runner/hygiene.ts
+var DAY_MS = 864e5;
+var HYGIENE_BUCKETS = [
+  { label: "Engaged (last 30 days)", maxDays: 30 },
+  { label: "Engaged (31-60 days)", minDays: 30, maxDays: 60 },
+  { label: "Engaged (61-90 days)", minDays: 60, maxDays: 90 },
+  { label: "Engaged (91-180 days)", minDays: 90, maxDays: 180 },
+  { label: "Inactive (>180 days)", minDays: 180 },
+  { label: "Never engaged", neverEngaged: true }
+];
+async function computeListHygiene(ctx, opts = {}) {
+  const now = opts.now ?? Date.now();
+  const sunsetDays = opts.sunsetThresholdDays ?? 180;
+  const recentDays = opts.recentWindowDays ?? 90;
+  const recentCutoff = new Date(now - recentDays * DAY_MS);
+  const totalSubscribers = await ctx.collections.subscriptions.countDocuments({ status: "subscribed" });
+  const subscribedIds = /* @__PURE__ */ new Set();
+  {
+    const cursor2 = ctx.collections.subscriptions.find({ status: "subscribed" }, { projection: { externalId: 1 } });
+    for await (const s of cursor2) subscribedIds.add(s.externalId);
+  }
+  const cursor = ctx.collections.sends.aggregate(
+    [
+      {
+        $group: {
+          _id: "$externalId",
+          lastOpened: { $max: "$openedAt" },
+          lastClicked: { $max: "$firstClickAt" },
+          firstSent: { $min: "$queuedAt" },
+          totalSends: { $sum: 1 },
+          bounced: { $sum: { $cond: [{ $eq: ["$status", "bounced"] }, 1, 0] } },
+          hardBounced: {
+            $sum: {
+              $cond: [
+                { $and: [{ $eq: ["$status", "bounced"] }, { $eq: ["$bounceType", "hard"] }] },
+                1,
+                0
+              ]
+            }
+          },
+          complained: { $sum: { $cond: [{ $ne: ["$complainedAt", null] }, 1, 0] } },
+          recentSends: { $sum: { $cond: [{ $gte: ["$queuedAt", recentCutoff] }, 1, 0] } },
+          recentBounced: {
+            $sum: {
+              $cond: [
+                { $and: [{ $eq: ["$status", "bounced"] }, { $gte: ["$queuedAt", recentCutoff] }] },
+                1,
+                0
+              ]
+            }
+          },
+          recentComplained: {
+            $sum: {
+              $cond: [
+                { $and: [{ $ne: ["$complainedAt", null] }, { $gte: ["$queuedAt", recentCutoff] }] },
+                1,
+                0
+              ]
+            }
+          }
+        }
+      }
+    ],
+    { allowDiskUse: true }
+  );
+  const buckets = HYGIENE_BUCKETS.map((b) => ({
+    label: b.label,
+    minDays: "minDays" in b ? b.minDays : null,
+    maxDays: "maxDays" in b ? b.maxDays : null,
+    neverEngaged: "neverEngaged" in b && b.neverEngaged,
+    count: 0,
+    pctOfTotal: 0
+  }));
+  let totalWithSends = 0;
+  let sunsetCount = 0;
+  const cohortLifetimeAcc = { totalSends: 0, bounced: 0, hardBounced: 0, complained: 0 };
+  const cohortRecentAcc = { totalSends: 0, bounced: 0, complained: 0 };
+  for await (const row of cursor) {
+    if (!subscribedIds.has(row._id)) continue;
+    totalWithSends++;
+    const lastOpened = row.lastOpened ? new Date(row.lastOpened).getTime() : null;
+    const lastClicked = row.lastClicked ? new Date(row.lastClicked).getTime() : null;
+    const lastEngaged = lastOpened == null && lastClicked == null ? null : Math.max(lastOpened ?? 0, lastClicked ?? 0);
+    let isSunset = false;
+    if (lastEngaged == null) {
+      const firstSent = row.firstSent ? new Date(row.firstSent).getTime() : null;
+      buckets[5].count++;
+      if (firstSent != null && now - firstSent > sunsetDays * DAY_MS) {
+        isSunset = true;
+      }
+    } else {
+      const daysSince = (now - lastEngaged) / DAY_MS;
+      if (daysSince <= 30) buckets[0].count++;
+      else if (daysSince <= 60) buckets[1].count++;
+      else if (daysSince <= 90) buckets[2].count++;
+      else if (daysSince <= 180) buckets[3].count++;
+      else {
+        buckets[4].count++;
+        isSunset = true;
+      }
+    }
+    if (isSunset) {
+      sunsetCount++;
+      cohortLifetimeAcc.totalSends += row.totalSends;
+      cohortLifetimeAcc.bounced += row.bounced;
+      cohortLifetimeAcc.hardBounced += row.hardBounced;
+      cohortLifetimeAcc.complained += row.complained;
+      cohortRecentAcc.totalSends += row.recentSends;
+      cohortRecentAcc.bounced += row.recentBounced;
+      cohortRecentAcc.complained += row.recentComplained;
+    }
+  }
+  for (const b of buckets) {
+    b.pctOfTotal = totalSubscribers === 0 ? 0 : b.count / totalSubscribers;
+  }
+  const cohortLifetime = cohortLifetimeAcc.totalSends > 0 ? {
+    totalSends: cohortLifetimeAcc.totalSends,
+    bouncedRate: cohortLifetimeAcc.bounced / cohortLifetimeAcc.totalSends,
+    hardBouncedRate: cohortLifetimeAcc.hardBounced / cohortLifetimeAcc.totalSends,
+    complaintRate: cohortLifetimeAcc.complained / cohortLifetimeAcc.totalSends
+  } : null;
+  let projectedImpact = null;
+  const recentAll = await ctx.collections.sends.aggregate([
+    { $match: { queuedAt: { $gte: recentCutoff } } },
+    {
+      $group: {
+        _id: null,
+        totalSends: { $sum: 1 },
+        bounced: { $sum: { $cond: [{ $eq: ["$status", "bounced"] }, 1, 0] } },
+        complained: { $sum: { $cond: [{ $ne: ["$complainedAt", null] }, 1, 0] } }
+      }
+    }
+  ]).toArray();
+  if (recentAll[0] && recentAll[0].totalSends > 0) {
+    const all = recentAll[0];
+    const cohort = cohortRecentAcc;
+    const currentBounceRate = all.bounced / all.totalSends;
+    const currentComplaintRate = all.complained / all.totalSends;
+    const remainingSends = all.totalSends - cohort.totalSends;
+    const remainingBounces = all.bounced - cohort.bounced;
+    const remainingComplaints = all.complained - cohort.complained;
+    const projectedBounceRate = remainingSends > 0 ? remainingBounces / remainingSends : 0;
+    const projectedComplaintRate = remainingSends > 0 ? remainingComplaints / remainingSends : 0;
+    projectedImpact = {
+      recentTotalSends: all.totalSends,
+      recentBounced: all.bounced,
+      recentComplained: all.complained,
+      cohortRecentSends: cohort.totalSends,
+      cohortRecentBounced: cohort.bounced,
+      cohortRecentComplained: cohort.complained,
+      currentOverallBounceRate: currentBounceRate,
+      projectedBounceRate,
+      currentOverallComplaintRate: currentComplaintRate,
+      projectedComplaintRate
+    };
+  }
+  return {
+    totalSubscribers,
+    totalWithSends,
+    buckets,
+    sunsetCandidate: {
+      count: sunsetCount,
+      pctOfTotal: totalSubscribers === 0 ? 0 : sunsetCount / totalSubscribers,
+      cohortLifetime,
+      projectedImpact
+    },
+    computedAt: new Date(now).toISOString()
+  };
+}
+var FETCH_TIMEOUT_MS3 = 15e3;
+function createMailTesterClient(cfg, fetcher = globalThis.fetch) {
+  const base = cfg.baseUrl ?? "https://mail-tester.com/api";
+  function sanitize(s) {
+    if (!cfg.apiKey) return s;
+    return s.split(cfg.apiKey).join("<redacted>").split(encodeURIComponent(cfg.apiKey)).join("<redacted>");
+  }
+  async function call(method, path3, body) {
+    const ctl = new AbortController();
+    const t = setTimeout(() => ctl.abort(), FETCH_TIMEOUT_MS3);
+    let res;
+    try {
+      res = await fetcher(`${base}/${encodeURIComponent(cfg.apiKey)}${path3}`, {
+        method,
+        headers: { "content-type": "application/json" },
+        body: body ? JSON.stringify(body) : void 0,
+        signal: ctl.signal
+      });
+    } catch (err) {
+      throw new Error(`Mail-Tester ${method} ${sanitize(path3)} failed: ${sanitize(String(err?.message ?? err))}`);
+    } finally {
+      clearTimeout(t);
+    }
+    if (!res.ok) {
+      const text = await safeText3(res);
+      throw new Error(`Mail-Tester ${method} ${sanitize(path3)} \u2192 ${res.status}: ${sanitize(text)}`);
+    }
+    return res.json();
+  }
+  return {
+    async provisionCheck() {
+      const data = await call("POST", "/new");
+      const checkId = String(data.check_id ?? data.checkId ?? "");
+      const emailAddress = String(data.email_address ?? data.email ?? "");
+      if (!checkId || !emailAddress) throw new Error("Mail-Tester /new returned an unexpected shape");
+      return { checkId, emailAddress };
+    },
+    async fetchResult(checkId) {
+      const data = await call("GET", `/${encodeURIComponent(checkId)}`);
+      const ready = Boolean(data.ready ?? data.complete ?? data.score != null);
+      const scoreRaw = Number(data.score);
+      const score = Number.isFinite(scoreRaw) ? scoreRaw : 0;
+      const feedback = Array.isArray(data.feedback) ? data.feedback.map(normalizeFeedback) : [];
+      const rawSummary = typeof data.summary === "string" ? data.summary : null;
+      return { ready: ready && Number.isFinite(scoreRaw), score, feedback, rawSummary };
+    }
+  };
+}
+function normalizeFeedback(raw) {
+  const severity = String(raw.severity ?? "info").toLowerCase();
+  return {
+    category: String(raw.category ?? "other"),
+    severity: severity === "error" || severity === "warning" || severity === "info" ? severity : "info",
+    message: String(raw.message ?? "")
   };
 }
-function humanDuration(ms) {
-  if (ms < 1e3) return `${ms}ms`;
-  if (ms < 6e4) return `${Math.round(ms / 1e3)}s`;
-  if (ms < 36e5) return `${Math.round(ms / 6e4)}m`;
-  return `${Math.round(ms / 36e5)}h`;
+async function safeText3(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "<no body>";
+  }
+}
+function mailTesterContentKey(input) {
+  return crypto2__default.default.createHash("sha256").update(`${input.bodyHash}|${input.subject}|${input.fromEmail}`).digest("hex");
+}
+async function findCachedScore(ctx, contentKey) {
+  const doc = await ctx.collections.mailTesterScores.findOne({ contentKey });
+  if (!doc) return null;
+  if (new Date(doc.expiresAt).getTime() < Date.now()) return null;
+  return doc;
+}
+async function persistScore(ctx, input) {
+  const cfg = ctx.config.mailTester;
+  const hours = cfg?.cacheHours ?? 24;
+  const now = /* @__PURE__ */ new Date();
+  const expiresAt = new Date(now.getTime() + hours * 60 * 60 * 1e3);
+  const doc = {
+    templateSlug: input.templateSlug,
+    contentKey: input.contentKey,
+    checkId: input.checkId,
+    score: input.result.score,
+    feedback: input.result.feedback,
+    rawSummary: input.result.rawSummary,
+    fetchedAt: now,
+    expiresAt
+  };
+  await ctx.collections.mailTesterScores.updateOne(
+    { contentKey: input.contentKey },
+    { $set: doc },
+    { upsert: true }
+  );
+  return doc;
+}
+async function evaluateMailTesterGate(ctx, input) {
+  const cfg = ctx.config.mailTester;
+  if (!cfg?.apiKey) return { allowed: true, reason: null, score: null };
+  const minScore = cfg.minScore ?? 8;
+  const key = mailTesterContentKey(input);
+  const cached = await findCachedScore(ctx, key);
+  if (!cached) return { allowed: true, reason: null, score: null };
+  if (cached.score < minScore) {
+    return {
+      allowed: false,
+      reason: `Mail-Tester score ${cached.score.toFixed(1)} is below minimum ${minScore.toFixed(1)}`,
+      score: cached
+    };
+  }
+  return { allowed: true, reason: null, score: cached };
 }
 
 // src/server/api/admin.ts
@@ -3257,30 +5403,43 @@ function createAdminRouter(mailer, opts = {}) {
     req.actor = getActor(req);
     next();
   });
-  router.use("/api", apiRouter(mailer));
+  router.use("/api", apiRouter(mailer, opts));
   router.get(/.*/, (_req, res) => {
     res.sendFile(path__default.default.join(spaDir, "index.html"));
   });
   return router;
 }
-function apiRouter(mailer) {
+function apiRouter(mailer, opts = {}) {
   const r = express.Router();
   const c = mailer.collections;
+  const varsSchema = mailer.config.varsAdapter ? varsJsonSchema(mailer.config.varsAdapter) : null;
+  function getMailTesterClient() {
+    if (opts.mailTesterClient) return opts.mailTesterClient;
+    const cfg = mailer.config.mailTester;
+    if (!cfg?.apiKey) return null;
+    return createMailTesterClient(cfg);
+  }
+  r.get(
+    "/vars-schema",
+    asyncHandler(async (_req, res) => {
+      res.json({ schema: varsSchema, builtins: exports.RESERVED_VAR_KEYS });
+    })
+  );
   r.get(
     "/me",
     asyncHandler(async (req, res) => {
-      const [flows, templates, broadcasts, contacts, suppressions, health] = await Promise.all([
+      const [flows, templates, broadcasts, contacts, suppressions, healthDocs] = await Promise.all([
         c.flows.estimatedDocumentCount(),
         c.templates.estimatedDocumentCount(),
         c.broadcasts.estimatedDocumentCount(),
         c.subscriptions.countDocuments({ status: "subscribed" }),
         c.suppressions.estimatedDocumentCount(),
-        c.health.findOne({ _id: "singleton" })
+        c.health.find({}).limit(500).toArray()
       ]);
       res.json({
         actor: req.actor,
         counts: { flows, templates, broadcasts, contacts, suppressions },
-        health: { status: health?.status ?? null },
+        health: { status: effectiveOverallStatus(healthDocs) },
         providers: {
           names: Object.keys(mailer.config.providers),
           default: mailer.config.defaultProvider
@@ -3347,7 +5506,8 @@ function apiRouter(mailer) {
         if (prevD === 0 || curD === 0) return null;
         return curN / curD - prevN / prevD;
       };
-      const health = await c.health.findOne({ _id: "singleton" });
+      const healthDocs = await c.health.find({}).limit(500).toArray();
+      const healthAgg = healthDocs.find((d) => d._id === HEALTH_AGG_ID) ?? null;
       const recentFlowsRaw = await c.flows.find({ enabled: true }).limit(5).toArray();
       const flowStatsMap = await computeFlowStats(mailer);
       const recentFlows = recentFlowsRaw.map((f) => ({ ...f, stats: flowStatsMap.get(f.slug) ?? emptyFlowStats() }));
@@ -3376,8 +5536,8 @@ function apiRouter(mailer) {
         },
         series: { hourly: { sends: sendSeries, opens: openSeries } },
         health: {
-          status: health?.status ?? null,
-          rates: health?.rates ?? null,
+          status: effectiveOverallStatus(healthDocs),
+          rates: healthAgg?.rates ?? null,
           thresholds: {
             hardBounceRatePctTrip: mailer.config.circuitBreaker.hardBounceRatePctTrip,
             complaintRatePctTrip: mailer.config.circuitBreaker.complaintRatePctTrip,
@@ -3397,6 +5557,19 @@ function apiRouter(mailer) {
       });
     })
   );
+  r.get(
+    "/events",
+    asyncHandler(async (_req, res) => {
+      const registered = mailer.events.list();
+      const seenNames = await c.events.distinct("name");
+      const known = new Set(registered.map((r2) => r2.name));
+      const unregistered = seenNames.filter((n) => n && !known.has(n));
+      res.json({
+        registered: registered.sort((a, b) => a.name.localeCompare(b.name)),
+        seen: unregistered.sort()
+      });
+    })
+  );
   r.get(
     "/flows",
     asyncHandler(async (_req, res) => {
@@ -3506,7 +5679,7 @@ function apiRouter(mailer) {
         c.subscriptions.findOne({ externalId }),
         c.events.find({ externalId }).sort({ occurredAt: -1 }).limit(50).toArray(),
         c.sends.find({ externalId }).sort({ queuedAt: -1 }).limit(50).toArray(),
-        c.flowRuns.find({ externalId, status: "active" }).toArray()
+        c.flowRuns.find({ externalId, status: "active" }).sort({ nextActionAt: 1 }).limit(50).toArray()
       ]);
       if (!contact) return res.status(404).json({ error: "not_found" });
       return res.json({ contact, subscription, recentEvents, recentSends, activeRuns });
@@ -3530,7 +5703,7 @@ function apiRouter(mailer) {
       if (!mongodb.ObjectId.isValid(id)) return res.status(400).json({ error: "bad_id" });
       const send = await c.sends.findOne({ _id: new mongodb.ObjectId(id) });
       if (!send) return res.status(404).json({ error: "not_found" });
-      const events = send.providerMessageId ? await c.webhookEvents.find({ providerMessageId: send.providerMessageId }).toArray() : [];
+      const events = send.providerMessageId ? await c.webhookEvents.find({ providerMessageId: send.providerMessageId }).sort({ receivedAt: -1 }).limit(100).toArray() : [];
       return res.json({ send, webhookEvents: events });
     })
   );
@@ -3572,7 +5745,6 @@ function apiRouter(mailer) {
   r.get(
     "/health",
     asyncHandler(async (_req, res) => {
-      const h = await c.health.findOne({ _id: "singleton" });
       const cb = mailer.config.circuitBreaker;
       const thresholds = {
         hardBounceRatePctTrip: cb.hardBounceRatePctTrip,
@@ -3580,11 +5752,22 @@ function apiRouter(mailer) {
         combinedBounceRatePctTrip: cb.combinedBounceRatePctTrip,
         failedToSendRatePctDegrade: cb.failedToSendRatePctDegrade
       };
-      if (!h) {
-        res.json({ status: null, rates: null, counters: null, thresholds });
+      const docs = await c.health.find({}).limit(500).toArray();
+      const aggregate = docs.find((d) => d._id === HEALTH_AGG_ID) ?? null;
+      const buckets = docs.filter((d) => d._id !== HEALTH_AGG_ID);
+      const overall = effectiveOverallStatus(docs);
+      if (docs.length === 0) {
+        res.json({ status: null, rates: null, counters: null, aggregate: null, buckets: [], thresholds });
         return;
       }
-      res.json({ ...h, thresholds });
+      res.json({
+        status: overall,
+        rates: aggregate?.rates ?? null,
+        counters: aggregate?.counters ?? null,
+        aggregate,
+        buckets,
+        thresholds
+      });
     })
   );
   r.get(
@@ -3597,18 +5780,330 @@ function apiRouter(mailer) {
   r.post(
     "/health/resume",
     asyncHandler(async (req, res) => {
-      await c.health.updateOne(
-        { _id: "singleton" },
+      const body = req.body ?? {};
+      if (body.senderDomain != null !== (body.kind != null)) {
+        return res.status(400).json({
+          error: "validation_failed",
+          message: "senderDomain and kind must both be provided to target a single bucket, or both omitted to resume all tripped buckets."
+        });
+      }
+      if (body.kind && !["marketing", "transactional"].includes(body.kind)) {
+        return res.status(400).json({ error: "validation_failed", message: 'kind must be "marketing" or "transactional"' });
+      }
+      const target = body.senderDomain && body.kind ? { _id: healthBucketId(body.senderDomain.toLowerCase(), body.kind) } : { status: "tripped", _id: { $ne: HEALTH_AGG_ID } };
+      const result = await c.health.updateMany(
+        target,
         { $set: { status: "healthy", manuallyResumedAt: /* @__PURE__ */ new Date(), updatedAt: /* @__PURE__ */ new Date() } }
       );
       await mailer.audit({
         actor: req.actor,
         action: "health.resume",
-        resource: { collection: "mailer_health" }
+        resource: {
+          collection: "mailer_health",
+          id: body.senderDomain && body.kind ? `${body.senderDomain}|${body.kind}` : "all-tripped"
+        }
+      });
+      res.json({ ok: true, resumed: result.modifiedCount });
+    })
+  );
+  r.get(
+    "/dnsbl",
+    asyncHandler(async (_req, res) => {
+      const checks = await c.dnsblChecks.find({}).sort({ result: 1, target: 1, list: 1 }).limit(500).toArray();
+      const latestRunAt = checks.reduce((acc, d) => {
+        const t = new Date(d.runAt);
+        return acc && acc.getTime() >= t.getTime() ? acc : t;
+      }, null);
+      res.json({
+        checks,
+        latestRunAt: latestRunAt ? latestRunAt.toISOString() : null,
+        intervalHours: mailer.config.dnsbl?.intervalHours ?? 24
+      });
+    })
+  );
+  r.post(
+    "/dnsbl/recheck",
+    asyncHandler(async (req, res) => {
+      const result = await runDnsblChecks(mailer.getRunnerContext(), { force: true });
+      await mailer.audit({
+        actor: req.actor,
+        action: "dnsbl.recheck",
+        resource: { collection: "mailer_dnsbl_checks" },
+        diffSummary: result.ran ? `${result.totalChecks} checks, ${result.listedCount} listed` : `not run: ${result.reason}`
+      });
+      res.json(result);
+    })
+  );
+  r.get(
+    "/postmaster",
+    asyncHandler(async (_req, res) => {
+      const cfg = mailer.config.postmaster;
+      const configured = !!cfg?.clientId && !!cfg?.clientSecret && !!cfg?.refreshToken;
+      const all = await c.postmasterSnapshots.find({}).sort({ domain: 1, date: -1 }).limit(2e3).toArray();
+      const byDomain = /* @__PURE__ */ new Map();
+      for (const s of all) {
+        const arr = byDomain.get(s.domain) ?? [];
+        if (arr.length < 30) arr.push(s);
+        byDomain.set(s.domain, arr);
+      }
+      const domains = Array.from(byDomain.entries()).map(([domain, snapshots]) => ({
+        domain,
+        latest: snapshots[0] ?? null,
+        history: snapshots
+      }));
+      res.json({
+        configured,
+        intervalHours: cfg?.intervalHours ?? 24,
+        domains
+      });
+    })
+  );
+  r.post(
+    "/postmaster/refresh",
+    asyncHandler(async (req, res) => {
+      const result = await runPostmasterPull(mailer.getRunnerContext(), { force: true });
+      await mailer.audit({
+        actor: req.actor,
+        action: "postmaster.refresh",
+        resource: { collection: "mailer_postmaster_snapshots" },
+        diffSummary: result.ran ? `fetched ${result.fetched ?? 0}, tripped ${(result.trippedDomains ?? []).length}` : `not run: ${result.reason}`
+      });
+      res.json(result);
+    })
+  );
+  let hygieneCache = null;
+  let hygieneInFlight = null;
+  const HYGIENE_CACHE_MS = 6e4;
+  r.get(
+    "/hygiene",
+    asyncHandler(async (req, res) => {
+      const force = req.query.refresh === "1" || req.query.refresh === "true";
+      const now = Date.now();
+      if (!force && hygieneCache && now - hygieneCache.computedAt < HYGIENE_CACHE_MS) {
+        return res.json(hygieneCache.report);
+      }
+      if (!hygieneInFlight) {
+        hygieneInFlight = (async () => {
+          try {
+            const report2 = await computeListHygiene(mailer.getRunnerContext());
+            hygieneCache = { computedAt: Date.now(), report: report2 };
+            return report2;
+          } finally {
+            hygieneInFlight = null;
+          }
+        })();
+      }
+      const report = await hygieneInFlight;
+      res.json(report);
+    })
+  );
+  const dmarcUpload = multer__default.default({
+    storage: multer__default.default.memoryStorage(),
+    limits: { fileSize: 10 * 1024 * 1024 }
+    // 10 MB; reports are typically <100KB
+  });
+  r.post(
+    "/dmarc/upload",
+    dmarcUpload.single("file"),
+    asyncHandler(async (req, res) => {
+      const file = req.file;
+      if (!file) return res.status(400).json({ error: "no_file", message: 'expected a "file" field' });
+      try {
+        const result = await ingestDmarcAttachment(mailer.getRunnerContext(), file.buffer, file.originalname);
+        await mailer.audit({
+          actor: req.actor,
+          action: "dmarc.ingest",
+          resource: { collection: "mailer_dmarc_reports", id: result.reportId },
+          diffSummary: result.duplicate ? `duplicate report ${result.reportId}` : `ingested ${result.totalMessages} msgs (${result.passCount} pass / ${result.failCount} fail) for ${result.domain}`
+        });
+        return res.json(result);
+      } catch (err) {
+        return res.status(400).json({ error: "ingest_failed", message: String(err?.message ?? err) });
+      }
+    })
+  );
+  r.get(
+    "/dmarc",
+    asyncHandler(async (_req, res) => {
+      const ctx = mailer.getRunnerContext();
+      const tagged = await resolveSourceTags(ctx);
+      const reports = await c.dmarcReports.find({}).sort({ rangeEnd: -1 }).limit(200).toArray();
+      const since30 = new Date(Date.now() - 30 * 864e5);
+      const recentFailures = await c.dmarcFailures.find({ receivedAt: { $gte: since30 } }).sort({ receivedAt: -1 }).limit(5e3).toArray();
+      const byDomain = /* @__PURE__ */ new Map();
+      for (const r2 of reports) {
+        const cur = byDomain.get(r2.domain) ?? { passCount: 0, failCount: 0, totalMessages: 0, reportCount: 0, latestRangeEnd: null, latestPolicy: null, latestPct: null, reports: [] };
+        cur.passCount += r2.passCount;
+        cur.failCount += r2.failCount;
+        cur.totalMessages += r2.totalMessages;
+        cur.reportCount += 1;
+        const re = new Date(r2.rangeEnd);
+        if (!cur.latestRangeEnd || re > cur.latestRangeEnd) {
+          cur.latestRangeEnd = re;
+          cur.latestPolicy = r2.policyP;
+          cur.latestPct = r2.policyPct;
+        }
+        cur.reports.push(r2);
+        byDomain.set(r2.domain, cur);
+      }
+      const since14 = Date.now() - 14 * 864e5;
+      const domains = Array.from(byDomain.entries()).map(([domain, s]) => {
+        const dayTotals = /* @__PURE__ */ new Map();
+        for (const r2 of s.reports) {
+          if (new Date(r2.rangeEnd).getTime() < since14) continue;
+          const day = new Date(r2.rangeEnd).toISOString().slice(0, 10);
+          const d = dayTotals.get(day) ?? { pass: 0, total: 0 };
+          d.pass += r2.passCount;
+          d.total += r2.passCount + r2.failCount;
+          dayTotals.set(day, d);
+        }
+        const series = Array.from(dayTotals.entries()).sort((a, b) => a[0].localeCompare(b[0])).map(([day, d]) => ({ day, alignmentRate: d.total === 0 ? null : d.pass / d.total }));
+        const knownIps = new Set(Array.from(tagged.values()).filter((t) => !t.ignored).map((t) => t.ip));
+        const ignoredIps = new Set(Array.from(tagged.values()).filter((t) => t.ignored).map((t) => t.ip));
+        const suggested = suggestPolicyProgression({
+          reports: s.reports.map((r2) => ({ rangeEnd: new Date(r2.rangeEnd), passCount: r2.passCount, failCount: r2.failCount })),
+          failures: recentFailures.filter((f) => f.domain === domain).map((f) => ({ sourceIp: f.sourceIp, count: f.count, receivedAt: new Date(f.receivedAt) })),
+          knownSourceIps: knownIps,
+          ignoredSourceIps: ignoredIps,
+          currentPolicy: s.latestPolicy,
+          currentPct: s.latestPct
+        });
+        return {
+          domain,
+          passCount: s.passCount,
+          failCount: s.failCount,
+          totalMessages: s.totalMessages,
+          reportCount: s.reportCount,
+          latestRangeEnd: s.latestRangeEnd,
+          alignmentRate: s.totalMessages === 0 ? null : s.passCount / s.totalMessages,
+          currentPolicy: s.latestPolicy,
+          currentPct: s.latestPct,
+          progression: suggested ? { ...suggested, current: { policy: s.latestPolicy, pct: s.latestPct } } : null,
+          series
+        };
+      });
+      const topFailures = await c.dmarcFailures.aggregate([
+        { $match: { receivedAt: { $gte: since30 } } },
+        {
+          $group: {
+            _id: { sourceIp: "$sourceIp", domain: "$domain" },
+            total: { $sum: "$count" },
+            days: { $addToSet: "$day" },
+            lastSeen: { $max: "$receivedAt" },
+            sample: { $first: "$$ROOT" }
+          }
+        },
+        { $project: { sourceIp: "$_id.sourceIp", domain: "$_id.domain", total: 1, days: { $size: "$days" }, lastSeen: 1, sample: 1 } },
+        { $sort: { total: -1 } },
+        { $limit: 50 }
+      ]).toArray();
+      const sources = topFailures.map((f) => {
+        const tag = tagged.get(f._id.sourceIp);
+        return {
+          sourceIp: f._id.sourceIp,
+          domain: f._id.domain,
+          totalMessages: f.total,
+          daysSeen: f.days,
+          lastSeen: f.lastSeen,
+          dkimResult: f.sample.dkimResult,
+          spfResult: f.sample.spfResult,
+          dispositionApplied: f.sample.dispositionApplied,
+          label: tag?.label ?? null,
+          ignored: !!tag?.ignored,
+          tagSource: tag?.source ?? null
+        };
+      });
+      res.json({
+        domains,
+        sources,
+        recentReports: reports.slice(0, 30),
+        retentionDays: mailer.config.dmarc?.retentionDays ?? 90
+      });
+    })
+  );
+  r.put(
+    "/dmarc/sources/:ip",
+    asyncHandler(async (req, res) => {
+      const ip = String(req.params.ip ?? "");
+      if (!net__default.default.isIP(ip)) {
+        return res.status(400).json({ error: "validation_failed", message: "invalid IP" });
+      }
+      const body = req.body ?? {};
+      if (!body.label || typeof body.label !== "string") {
+        return res.status(400).json({ error: "validation_failed", message: "label is required" });
+      }
+      const label = body.label.trim().slice(0, 200);
+      if (!label) {
+        return res.status(400).json({ error: "validation_failed", message: "label is required" });
+      }
+      const ignored = !!body.ignored;
+      await c.dmarcSourceTags.updateOne(
+        { ip },
+        { $set: { ip, label, ignored, setBy: req.actor ?? "unknown", setAt: /* @__PURE__ */ new Date() } },
+        { upsert: true }
+      );
+      await mailer.audit({
+        actor: req.actor,
+        action: "dmarc.source_tag.upsert",
+        resource: { collection: "mailer_dmarc_source_tags", id: ip },
+        diffSummary: `${ip} \u2192 "${label}"${ignored ? " (ignored)" : ""}`
       });
       res.json({ ok: true });
     })
   );
+  r.delete(
+    "/dmarc/sources/:ip",
+    asyncHandler(async (req, res) => {
+      const ip = String(req.params.ip ?? "");
+      if (!net__default.default.isIP(ip)) {
+        return res.status(400).json({ error: "validation_failed", message: "invalid IP" });
+      }
+      const result = await c.dmarcSourceTags.deleteOne({ ip });
+      await mailer.audit({
+        actor: req.actor,
+        action: "dmarc.source_tag.delete",
+        resource: { collection: "mailer_dmarc_source_tags", id: ip }
+      });
+      res.json({ ok: true, deleted: result.deletedCount });
+    })
+  );
+  r.get(
+    "/snds",
+    asyncHandler(async (_req, res) => {
+      const cfg = mailer.config.snds;
+      const configured = !!cfg?.accessKey;
+      const all = await c.sndsSnapshots.find({}).sort({ ip: 1, activityStart: -1 }).limit(2e3).toArray();
+      const byIp = /* @__PURE__ */ new Map();
+      for (const s of all) {
+        const arr = byIp.get(s.ip) ?? [];
+        if (arr.length < 30) arr.push(s);
+        byIp.set(s.ip, arr);
+      }
+      const ips = Array.from(byIp.entries()).map(([ip, snapshots]) => ({
+        ip,
+        latest: snapshots[0] ?? null,
+        history: snapshots
+      }));
+      res.json({
+        configured,
+        intervalHours: cfg?.intervalHours ?? 24,
+        ips
+      });
+    })
+  );
+  r.post(
+    "/snds/refresh",
+    asyncHandler(async (req, res) => {
+      const result = await runSndsPull(mailer.getRunnerContext(), { force: true });
+      await mailer.audit({
+        actor: req.actor,
+        action: "snds.refresh",
+        resource: { collection: "mailer_snds_snapshots" },
+        diffSummary: result.ran ? `parsed ${result.rowsParsed ?? 0}, persisted ${result.rowsPersisted ?? 0}` : `not run: ${result.reason}`
+      });
+      res.json(result);
+    })
+  );
   r.post(
     "/flows",
     asyncHandler(async (req, res) => {
@@ -3849,6 +6344,182 @@ function apiRouter(mailer) {
       return res.json({ ok: true });
     })
   );
+  r.get(
+    "/templates/:slug/mail-tester",
+    asyncHandler(async (req, res) => {
+      const cfg = mailer.config.mailTester;
+      const configured = !!cfg?.apiKey;
+      const tpl = await c.templates.findOne({ slug: req.params.slug });
+      if (!tpl) return res.status(404).json({ error: "not_found" });
+      let bodyHash = "";
+      let subject = tpl.subject ?? "";
+      if (tpl.draft) {
+        try {
+          const compiled = tpl.draft.editorJson ? await compileMailyTemplate(tpl.draft.editorJson) : tpl.draft.mjml ? await compileTemplate(tpl.draft.mjml) : null;
+          if (compiled) {
+            bodyHash = sha256Hex(compiled.html);
+            subject = tpl.draft.subject || subject;
+          }
+        } catch {
+        }
+      }
+      if (!bodyHash && tpl.body?.html) {
+        bodyHash = sha256Hex(tpl.body.html);
+      }
+      const key = bodyHash ? mailTesterContentKey({ bodyHash, subject, fromEmail: tpl.fromEmail }) : null;
+      const cached = key ? await findCachedScore(mailer.getRunnerContext(), key) : null;
+      res.json({
+        configured,
+        minScore: cfg?.minScore ?? 8,
+        cacheHours: cfg?.cacheHours ?? 24,
+        score: cached
+      });
+    })
+  );
+  r.post(
+    "/templates/:slug/mail-tester-check",
+    asyncHandler(async (req, res) => {
+      const client = getMailTesterClient();
+      if (!client) {
+        return res.status(400).json({
+          error: "not_configured",
+          message: "Mail-Tester is not configured. Set mailer.config.mailTester.apiKey to enable."
+        });
+      }
+      const tpl = await c.templates.findOne({ slug: req.params.slug });
+      if (!tpl) return res.status(404).json({ error: "not_found" });
+      const draft = tpl.draft;
+      if (!draft) return res.status(400).json({ error: "no_draft", message: "Save a draft before running a deliverability check." });
+      let compiled;
+      try {
+        if (draft.editorJson) compiled = await compileMailyTemplate(draft.editorJson);
+        else if (draft.mjml) compiled = await compileTemplate(draft.mjml);
+        else return res.status(400).json({ error: "empty_draft" });
+      } catch (err) {
+        return res.status(400).json({ error: "compile_failed", message: String(err?.message ?? err) });
+      }
+      const bodyHash = sha256Hex(compiled.html);
+      const contentKey = mailTesterContentKey({ bodyHash, subject: draft.subject, fromEmail: tpl.fromEmail });
+      const ctx = mailer.getRunnerContext();
+      const cached = await findCachedScore(ctx, contentKey);
+      if (cached) {
+        return res.json({ cached: true, status: "ready", score: cached });
+      }
+      const { checkId, emailAddress } = await client.provisionCheck();
+      const provider = mailer.providers[tpl.providerOverride ?? mailer.config.defaultProvider];
+      if (!provider) {
+        return res.status(500).json({ error: "provider_unknown", message: `default provider ${mailer.config.defaultProvider} is not registered` });
+      }
+      try {
+        await provider.send({
+          to: emailAddress,
+          fromName: tpl.fromName,
+          fromEmail: tpl.fromEmail,
+          replyTo: tpl.replyTo ?? void 0,
+          subject: draft.subject,
+          html: compiled.html,
+          text: compiled.plainText,
+          headers: {},
+          messageMeta: { mailTesterCheckId: checkId }
+        });
+      } catch (err) {
+        return res.status(502).json({ error: "send_failed", message: String(err?.message ?? err) });
+      }
+      await mailer.audit({
+        actor: req.actor,
+        action: "mail_tester.check.start",
+        resource: { collection: "mailer_mail_tester_scores", id: contentKey, slug: tpl.slug },
+        diffSummary: `Sent draft to ${emailAddress} for Mail-Tester check ${checkId}`
+      });
+      res.json({
+        cached: false,
+        status: "pending",
+        checkId,
+        contentKey,
+        message: "Test email sent. Poll /mail-tester-result?checkId=...&contentKey=... for the score."
+      });
+    })
+  );
+  r.get(
+    "/templates/:slug/mail-tester-result",
+    asyncHandler(async (req, res) => {
+      const client = getMailTesterClient();
+      if (!client) return res.status(400).json({ error: "not_configured" });
+      const checkId = String(req.query.checkId ?? "");
+      if (!checkId) return res.status(400).json({ error: "validation_failed", message: "checkId is required" });
+      const tpl = await c.templates.findOne({ slug: req.params.slug });
+      if (!tpl) return res.status(404).json({ error: "not_found" });
+      const draft = tpl.draft;
+      if (!draft) return res.status(400).json({ error: "no_draft", message: "Draft no longer exists." });
+      let compiled;
+      try {
+        if (draft.editorJson) compiled = await compileMailyTemplate(draft.editorJson);
+        else if (draft.mjml) compiled = await compileTemplate(draft.mjml);
+        else return res.status(400).json({ error: "empty_draft" });
+      } catch (err) {
+        return res.status(400).json({ error: "compile_failed", message: String(err?.message ?? err) });
+      }
+      const contentKey = mailTesterContentKey({
+        bodyHash: sha256Hex(compiled.html),
+        subject: draft.subject,
+        fromEmail: tpl.fromEmail
+      });
+      const result = await client.fetchResult(checkId);
+      if (!result.ready) {
+        return res.json({ status: "pending", score: null });
+      }
+      const ctx = mailer.getRunnerContext();
+      const persisted = await persistScore(ctx, { templateSlug: tpl.slug, contentKey, checkId, result });
+      await mailer.audit({
+        actor: req.actor,
+        action: "mail_tester.check.complete",
+        resource: { collection: "mailer_mail_tester_scores", id: contentKey, slug: tpl.slug },
+        diffSummary: `Score ${result.score.toFixed(1)}`
+      });
+      res.json({ status: "ready", score: persisted });
+    })
+  );
+  r.post(
+    "/templates/:slug/lint",
+    asyncHandler(async (req, res) => {
+      const tpl = await c.templates.findOne({ slug: req.params.slug });
+      if (!tpl) return res.status(404).json({ error: "not_found" });
+      const body = req.body ?? {};
+      const subject = body.subject ?? tpl.draft?.subject ?? tpl.subject ?? "";
+      const preheader = body.preheader ?? tpl.draft?.preheader ?? tpl.preheader ?? "";
+      const mjml = body.mjml ?? tpl.draft?.mjml ?? tpl.body?.mjml ?? "";
+      const editorJson = body.editorJson !== void 0 ? body.editorJson : tpl.draft?.editorJson ?? tpl.body?.editorJson ?? null;
+      const fromEmail = body.fromEmail ?? tpl.fromEmail;
+      const kind = body.kind === "marketing" || body.kind === "transactional" ? body.kind : tpl.kind;
+      let html = "";
+      let plainText = "";
+      try {
+        if (editorJson) {
+          const compiled = await compileMailyTemplate(editorJson);
+          html = compiled.html;
+          plainText = compiled.plainText;
+        } else if (mjml) {
+          const compiled = await compileTemplate(mjml);
+          html = compiled.html;
+          plainText = compiled.plainText;
+        }
+      } catch (err) {
+        return res.status(200).json({
+          errors: [{ rule: "compile_failed", severity: "error", message: `Compile error: ${String(err?.message ?? err)}` }],
+          warnings: [],
+          infos: [],
+          compileFailed: true
+        });
+      }
+      if (!html && typeof tpl.body?.html === "string") html = tpl.body.html;
+      if (!plainText && typeof tpl.body?.plainText === "string") plainText = tpl.body.plainText;
+      const lint = lintTemplate(
+        { subject, preheader, mjml, editorJson, html, plainText, kind, fromEmail },
+        { senderDomains: mailer.config.senderDomains, varsJsonSchema: varsSchema }
+      );
+      res.json({ ...lint, compileFailed: false });
+    })
+  );
   r.post(
     "/templates/:slug/publish",
     asyncHandler(async (req, res) => {
@@ -3865,12 +6536,60 @@ function apiRouter(mailer) {
         });
       }
       let compiled;
-      if (draft.editorJson) {
-        compiled = await compileMailyTemplate(draft.editorJson);
-      } else if (draft.mjml) {
-        compiled = await compileTemplate(draft.mjml);
-      } else {
-        return res.status(400).json({ error: "empty_draft", message: "draft has no MJML or editorJson content" });
+      try {
+        if (draft.editorJson) {
+          compiled = await compileMailyTemplate(draft.editorJson);
+        } else if (draft.mjml) {
+          compiled = await compileTemplate(draft.mjml);
+        } else {
+          return res.status(400).json({ error: "empty_draft", message: "draft has no MJML or editorJson content" });
+        }
+      } catch (err) {
+        return res.status(422).json({
+          error: "compile_failed",
+          message: String(err?.message ?? err),
+          lint: {
+            errors: [{ rule: "compile_failed", severity: "error", message: `Compile error: ${String(err?.message ?? err)}` }],
+            warnings: [],
+            infos: []
+          }
+        });
+      }
+      const lint = lintTemplate(
+        {
+          subject: draft.subject,
+          preheader: draft.preheader,
+          mjml: draft.mjml ?? "",
+          editorJson: draft.editorJson,
+          html: compiled.html,
+          plainText: compiled.plainText,
+          kind: tpl.kind,
+          fromEmail: tpl.fromEmail
+        },
+        { senderDomains: mailer.config.senderDomains, varsJsonSchema: varsSchema }
+      );
+      if (lint.errors.length > 0) {
+        return res.status(422).json({
+          error: "lint_failed",
+          message: `Template publish blocked by ${lint.errors.length} content issue(s).`,
+          lint
+        });
+      }
+      const bypass = Boolean(req.body?.bypassMailTester);
+      if (!bypass) {
+        const gate = await evaluateMailTesterGate(mailer.getRunnerContext(), {
+          bodyHash: sha256Hex(compiled.html),
+          subject: draft.subject,
+          fromEmail: tpl.fromEmail
+        });
+        if (!gate.allowed) {
+          return res.status(422).json({
+            error: "mail_tester_blocked",
+            message: gate.reason,
+            score: gate.score,
+            hint: "Re-run the deliverability check after fixing the feedback, or POST `bypassMailTester: true` to publish anyway."
+          });
+        }
       }
       const now = /* @__PURE__ */ new Date();
       const nextVersion = await c.templateVersions.countDocuments({ templateId: tpl._id }) + 1;
@@ -3911,7 +6630,13 @@ function apiRouter(mailer) {
         resource: { collection: "mailer_templates", id: tpl._id, slug: tpl.slug },
         diffSummary: `Published v${nextVersion}`
       });
-      return res.json({ ok: true, version: nextVersion, warnings: compiled.errors });
+      return res.json({
+        ok: true,
+        version: nextVersion,
+        warnings: compiled.errors,
+        lint
+        // warnings + infos for UI
+      });
     })
   );
   r.post(
@@ -3933,40 +6658,93 @@ function apiRouter(mailer) {
         html = tpl.body.html;
         plainText = tpl.body.plainText;
       }
-      const sampleContact = req.body?.sampleContact ?? {
-        externalId: "preview-contact",
-        email: "preview@example.com",
-        tags: [],
-        fields: { firstName: "Alex" }
-      };
+      let contact;
+      const contactId = typeof req.body?.contactId === "string" ? req.body.contactId : null;
+      if (contactId) {
+        const found = await mailer.adapter.getById(contactId);
+        if (!found) return res.status(404).json({ error: "contact_not_found", contactId });
+        contact = found;
+      } else {
+        contact = req.body?.sampleContact ?? {
+          externalId: "preview-contact",
+          email: "preview@example.com",
+          tags: [],
+          fields: { firstName: "Alex" }
+        };
+      }
+      const eventProperties = req.body?.eventProperties && typeof req.body.eventProperties === "object" ? req.body.eventProperties : void 0;
+      let resolved = {};
+      try {
+        resolved = await resolveVars(mailer.config.varsAdapter, contact, {
+          reason: "preview",
+          templateSlug: tpl.slug,
+          eventProperties
+        });
+      } catch (err) {
+        return res.status(502).json({
+          error: "vars_resolve_failed",
+          message: `varsAdapter.resolve threw: ${String(err?.message ?? err)}`
+        });
+      }
       const renderCtx = {
-        contact: sampleContact,
+        ...resolved,
+        contact,
         vars: req.body?.vars ?? {},
+        event: eventProperties ?? {},
         unsubscribeUrl: `${mailer.config.publicUrl}/m/unsub/preview`,
         senderAddress: mailer.config.senderAddress
       };
       const previewTpl = { ...tpl, body: { ...tpl.body, html, plainText } };
       const rendered = await renderTemplate(previewTpl, renderCtx, { helpers: mailer.config.handlebarsHelpers });
-      return res.json({ subject: rendered.subject, preheader: rendered.preheader, html: rendered.html, plainText: rendered.plainText });
+      return res.json({
+        subject: rendered.subject,
+        preheader: rendered.preheader,
+        html: rendered.html,
+        plainText: rendered.plainText,
+        contact: { externalId: contact.externalId, email: contact.email }
+      });
     })
   );
   r.post(
     "/templates/:slug/send-test",
     asyncHandler(async (req, res) => {
-      const { to, sampleData } = req.body ?? {};
+      const { to, sampleData, contactId, eventProperties } = req.body ?? {};
       if (!to) return res.status(400).json({ error: "to_required" });
       const tpl = await c.templates.findOne({ slug: req.params.slug });
       if (!tpl) return res.status(404).json({ error: "not_found" });
-      const contact = sampleData?.contact ?? {
-        externalId: "test-recipient",
-        email: to,
-        tags: [],
-        fields: { firstName: "Test" }
-      };
-      contact.email = to;
+      let contact;
+      if (typeof contactId === "string" && contactId) {
+        const found = await mailer.adapter.getById(contactId);
+        if (!found) return res.status(404).json({ error: "contact_not_found", contactId });
+        contact = { ...found, email: to };
+      } else {
+        contact = sampleData?.contact ?? {
+          externalId: "test-recipient",
+          email: to,
+          tags: [],
+          fields: { firstName: "Test" }
+        };
+        contact.email = to;
+      }
+      const evProps = eventProperties && typeof eventProperties === "object" ? eventProperties : void 0;
+      let resolved = {};
+      try {
+        resolved = await resolveVars(mailer.config.varsAdapter, contact, {
+          reason: "test",
+          templateSlug: tpl.slug,
+          eventProperties: evProps
+        });
+      } catch (err) {
+        return res.status(502).json({
+          error: "vars_resolve_failed",
+          message: `varsAdapter.resolve threw: ${String(err?.message ?? err)}`
+        });
+      }
       const renderCtx = {
+        ...resolved,
         contact,
         vars: sampleData?.vars ?? {},
+        event: evProps ?? {},
         unsubscribeUrl: `${mailer.config.publicUrl}/m/unsub/test`,
         senderAddress: mailer.config.senderAddress
       };
@@ -4617,7 +7395,7 @@ var DEDUPE_POLICIES = [
 ];
 
 // src/server/index.ts
-var VERSION = "0.1.0";
+var VERSION = "0.7.0";
 
 exports.DEDUPE_POLICIES = DEDUPE_POLICIES;
 exports.FLOW_STEP_KINDS = FLOW_STEP_KINDS;
@@ -4630,11 +7408,13 @@ exports.applyTracking = applyTracking;
 exports.applyWebhookEvent = applyWebhookEvent;
 exports.compileMailyTemplate = compileMailyTemplate;
 exports.compileTemplate = compileTemplate;
+exports.computeDeliveryTime = computeDeliveryTime;
 exports.createAdminRouter = createAdminRouter;
 exports.createPublicRouter = createPublicRouter;
 exports.defaultFlowStep = defaultFlowStep;
 exports.defaultPredicate = defaultPredicate;
 exports.defaultSegmentFilter = defaultSegmentFilter;
+exports.defineVars = defineVars;
 exports.derivePlaintext = derivePlaintext;
 exports.dispatchSend = dispatchSend;
 exports.ensureIndexes = ensureIndexes;
@@ -4648,6 +7428,7 @@ exports.sha256Hex = sha256Hex;
 exports.signUnsubscribeToken = signUnsubscribeToken;
 exports.sweepStrandedFlowRuns = sweepStrandedFlowRuns;
 exports.validateSenderDomain = validateSenderDomain;
+exports.varsJsonSchema = varsJsonSchema;
 exports.verifyUnsubscribeToken = verifyUnsubscribeToken;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map