MailSend/src/server.js

import crypto from 'node:crypto';
import { existsSync, readFileSync, statSync } from 'node:fs';
import { readFile } from 'node:fs/promises';
import http from 'node:http';
import path from 'node:path';
import { fileURLToPath, domainToASCII } from 'node:url';
import {
  authenticateUser,
  approveUser,
  claimLegacyData,
  createApiToken,
  createAccountToken,
  createDomain,
  createInboundMailbox,
  createSendEvent,
  createTrackingLink,
  createUserWithAccountToken,
  createWebhook,
  consumeAccountToken,
  deleteApiToken,
  deleteDnsCredential,
  deleteDomain,
  deleteSmtpCredential,
  deleteWebhook,
  enqueueWebhookTestDelivery,
  getAdminResourceInventory,
  getAdminUser,
  getDnsCredential,
  getDomain,
  getDomainByName,
  getInboundMessage,
  getSendEvent,
  getSendAnalytics,
  getSettings,
  getDefaultSmtpRelay,
  getSmtpRelay,
  getSmtpCredential,
  getSystemEmailSettings,
  getUser,
  getUserByLogin,
  initDatabase,
  invalidateAccountTokens,
  listApiTokens,
  listAuditLogs,
  listDnsCredentials,
  listDomains,
  listInboundMailboxes,
  listInboundMessages,
  listSendEvents,
  listSmtpCredentials,
  listSmtpRelays,
  listUsersWithResourceCounts,
  listWebhookDeliveries,
  listWebhooks,
  logAudit,
  logSendEvent,
  markInboundMessageRead,
  markUserEmailVerified,
  previewUserMerge,
  replayWebhookDelivery,
  rotateWebhookSecret,
  saveDnsCredential,
  saveDomainStatus,
  saveSettings,
  saveSmtpRelay,
  saveSmtpCredential,
  saveSystemEmailSettings,
  seedAdminUser,
  seedSmtpCredential,
  deleteSmtpRelay,
  transferApiTokens,
  transferDnsCredential,
  transferDomain,
  updateDkim,
  updateDomain,
  updateUser,
  updateWebhook,
  executeUserMerge,
  finalizeSendEvent,
  findSendEventByTrackingToken,
  findTrackingLinkByToken,
  recordTrackingEvent,
  verifyApiToken,
  verifyUserCredentials
} from './db.js';
import { applyDnsSetup, testDnsCredential } from './dns-providers.js';
import { startDnsAutoChecker } from './dns-auto-checker.js';
import { startPostfixDeliveryTracker } from './delivery-tracker.js';
import { assertSafeWebhookUrl, startWebhookWorker } from './webhook-dispatcher.js';
import { buildDnsGuide, buildSystemDnsChecks } from './dns-guide.js';
import { createDkimKeyPair } from './dkim.js';
import {
  buildDeliverabilityHeaders,
  buildMessage,
  createFeedbackId,
  domainFromAddress,
  extractAddress,
  parseAddressList,
  resolveEnvelopeSender,
  sendViaSmtp,
  signMessageForDomain
} from './mailer.js';
import {
  parseSubmissionListeners,
  publicSubmissionListeners,
  startSubmissionServer
} from './submission.js';
import {
  buildPasswordResetEmail,
  buildVerificationEmail,
  sendSystemEmail
} from './system-mail.js';
import {
  classifyTrackingSource,
  createTrackingToken,
  decryptTrackingTarget,
  encryptTrackingTarget,
  hashTrackingClientIp,
  instrumentHtml,
  trackingTargetFingerprint,
  trackingReplayKey
} from './tracking.js';
import { startTrackingRetentionWorker } from './tracking-retention.js';

const __dirname = path.dirname(fileURLToPath(import.meta.url));
loadDotEnv();
const fallbackSecret = crypto
  .createHash('sha256')
  .update(`${process.env.ADMIN_PASSWORD || 'change-this-admin-password'}:${process.env.API_TOKEN || ''}`)
  .digest('hex');

const envConfig = {
  port: Number(process.env.PORT || 3000),
  dataDir: process.env.DATA_DIR || path.join(process.cwd(), 'data'),
  adminUser: process.env.ADMIN_USER || 'admin',
  adminEmail: process.env.ADMIN_EMAIL || `${process.env.ADMIN_USER || 'admin'}@mailhub.local`,
  adminPassword: process.env.ADMIN_PASSWORD || 'change-this-admin-password',
  legacyApiToken: process.env.API_TOKEN || '',
  smtpHost: process.env.SMTP_HOST || '',
  smtpPort: Number(process.env.SMTP_PORT || 25),
  smtpSecure: String(process.env.SMTP_SECURE || '').toLowerCase() === 'true',
  smtpUser: process.env.SMTP_USERNAME || '',
  smtpPassword: process.env.SMTP_PASSWORD || '',
  smtpHelo: process.env.SMTP_HELO || process.env.MAIL_HOSTNAME || 'mailhub.local',
  postfixLogFile: process.env.POSTFIX_LOG_FILE || path.join(process.env.DATA_DIR || path.join(process.cwd(), 'data'), 'postfix-logs', 'mail.log'),
  postfixLogPollIntervalMs: Number(process.env.POSTFIX_LOG_POLL_INTERVAL_MS || 5000),
  deliveryTrackingEnabled: String(process.env.DELIVERY_TRACKING_ENABLED || 'true').toLowerCase() !== 'false',
  dnsAutoCheckEnabled: String(process.env.DNS_AUTO_CHECK_ENABLED || 'true').toLowerCase() !== 'false',
  dnsAutoCheckIntervalMs: Number(process.env.DNS_AUTO_CHECK_INTERVAL_MS || 60000),
  dnsAutoCheckLimit: Number(process.env.DNS_AUTO_CHECK_LIMIT || 25),
  webhookWorkerEnabled:
    String(process.env.WEBHOOK_WORKER_ENABLED || 'true').toLowerCase() !== 'false' &&
    String(process.env.WEBHOOK_WORKER_ENABLED || '') !== '0',
  webhookWorkerIntervalMs: Number(process.env.WEBHOOK_WORKER_INTERVAL_MS || 10000),
  webhookWorkerBatchSize: Number(process.env.WEBHOOK_WORKER_BATCH_SIZE || 3),
  submissionEnabled: String(process.env.SUBMISSION_ENABLED || 'true').toLowerCase() !== 'false',
  submissionHost: process.env.SUBMISSION_HOST || process.env.APP_BASE_URL?.replace(/^https?:\/\//, '') || 'localhost',
  submissionListeners: parseSubmissionListeners(process.env.SUBMISSION_PORTS),
  submissionUsername: process.env.SUBMISSION_USERNAME || '',
  submissionPassword: process.env.SUBMISSION_PASSWORD || '',
  submissionAllowInsecureAuth: String(process.env.SUBMISSION_ALLOW_INSECURE_AUTH || '').toLowerCase() === 'true',
  submissionTlsCert: process.env.SUBMISSION_TLS_CERT || '',
  submissionTlsKey: process.env.SUBMISSION_TLS_KEY || '',
  submissionMaxMessageBytes: Number(process.env.SUBMISSION_MAX_MESSAGE_BYTES || 50 * 1024 * 1024),
  inboundEnabled: String(process.env.INBOUND_ENABLED || 'true').toLowerCase() !== 'false',
  sessionSecret: process.env.SESSION_SECRET || fallbackSecret,
  trackingSecret: process.env.TRACKING_SECRET || process.env.SESSION_SECRET || fallbackSecret,
  trustProxy: String(process.env.TRUST_PROXY || '').toLowerCase() === 'true',
  trackingRetentionDays: Math.max(1, Number(process.env.TRACKING_RETENTION_DAYS || 180))
};

const defaultSettings = {
  appBaseUrl: process.env.APP_BASE_URL || 'http://127.0.0.1:3000',
  mailHostname: process.env.MAIL_HOSTNAME || 'mailhub.local',
  sendingIp: process.env.SENDING_IP || '',
  defaultSpfMechanisms: process.env.DEFAULT_SPF_MECHANISMS || 'include:spf.mailjet.com',
  dmarcPolicy: process.env.DMARC_POLICY || 'none',
  dmarcRua: process.env.DMARC_RUA || '',
  sendRequiresVerified: String(process.env.SEND_REQUIRES_VERIFIED || '').toLowerCase() === 'true' ? 'true' : 'false',
  engagementTrackingEnabled:
    String(process.env.ENGAGEMENT_TRACKING_ENABLED || '').toLowerCase() === 'true' ? 'true' : 'false',
  listUnsubscribeMailto: process.env.LIST_UNSUBSCRIBE_MAILTO || '',
  listUnsubscribeUrl: process.env.LIST_UNSUBSCRIBE_URL || '',
  listUnsubscribePostEnabled:
    String(process.env.LIST_UNSUBSCRIBE_POST_ENABLED || '').toLowerCase() === 'true' ? 'true' : 'false',
  feedbackIdEnabled: String(process.env.FEEDBACK_ID_ENABLED || 'true').toLowerCase() === 'false' ? 'false' : 'true',
  reportAbuseTo: process.env.REPORT_ABUSE_TO || '',
  csaComplaintsTo: process.env.CSA_COMPLAINTS_TO || '',
  bounceAddress: process.env.BOUNCE_ADDRESS || '',
  bounceEnvelopeEnabled:
    String(process.env.BOUNCE_ENVELOPE_ENABLED || '').toLowerCase() === 'true' ? 'true' : 'false'
};

const emailVerificationPurpose = 'email_verification';
const passwordResetPurpose = 'password_reset';

initDatabase(envConfig.dataDir, envConfig.sessionSecret);
const admin = seedAdminUser({
  username: envConfig.adminUser,
  email: envConfig.adminEmail,
  password: envConfig.adminPassword
});
claimLegacyData(admin.id);
seedSmtpCredential(admin.id, envConfig.submissionUsername, envConfig.submissionPassword);

startPostfixDeliveryTracker({
  enabled: envConfig.deliveryTrackingEnabled,
  logFile: envConfig.postfixLogFile,
  pollIntervalMs: envConfig.postfixLogPollIntervalMs
});

startDnsAutoChecker({
  enabled: envConfig.dnsAutoCheckEnabled,
  intervalMs: envConfig.dnsAutoCheckIntervalMs,
  limit: envConfig.dnsAutoCheckLimit
});

startWebhookWorker({
  enabled: envConfig.webhookWorkerEnabled,
  intervalMs: envConfig.webhookWorkerIntervalMs,
  batchSize: envConfig.webhookWorkerBatchSize
});

startTrackingRetentionWorker({
  days: envConfig.trackingRetentionDays
});

const server = http.createServer(async (req, res) => {
  try {
    setSecurityHeaders(res);
    if (req.method === 'OPTIONS') return handleOptions(res);
    const url = new URL(req.url, `http://${req.headers.host || 'localhost'}`);
    if (url.pathname === '/healthz') return sendJson(res, 200, { ok: true });
    if (url.pathname.startsWith('/t/') && await handleTrackingRequest(req, res, url)) return;
    if (req.method === 'POST' && (url.pathname === '/api/register' || url.pathname === '/register')) return await handleRegister(req, res);
    if (req.method === 'POST' && (url.pathname === '/api/login' || url.pathname === '/login')) return await handleLogin(req, res);
    if (req.method === 'POST' && url.pathname === '/api/logout') return handleLogout(res);
    if (url.pathname === '/api/auth/verify-email') return await handleVerifyEmail(req, res, url);
    if (req.method === 'POST' && url.pathname === '/api/auth/resend-verification') return await handleResendVerification(req, res);
    if (req.method === 'POST' && url.pathname === '/api/auth/forgot-password') return await handleForgotPassword(req, res);
    if (req.method === 'POST' && url.pathname === '/api/auth/reset-password') return await handleResetPassword(req, res);

    const user = getRequestUser(req, url.pathname);

    if (url.pathname === '/' || url.pathname === '/index.html' || url.pathname === '/landing.html') {
      if (user && (url.pathname === '/' || url.pathname === '/index.html')) {
        return sendStaticFile(res, path.join(__dirname, '..', 'public', 'index.html'), { noStore: true });
      }
      if (!user && (url.pathname === '/' || url.pathname === '/landing.html')) {
        return sendStaticFile(res, path.join(__dirname, '..', 'public', 'landing.html'), { noStore: true });
      }
      if (user && url.pathname === '/landing.html') {
        return redirect(res, '/');
      }
    }

    if (isLoginAsset(url.pathname)) {
      if ((url.pathname === '/login' || url.pathname === '/register') && user) return redirect(res, '/');
      return await serveStatic(req, res, url);
    }

    if (!user) {
      if (url.pathname.startsWith('/api/')) return sendJson(res, 401, { error: 'Authentication required.' });
      return redirect(res, '/login');
    }

    if (url.pathname.startsWith('/api/')) return await handleApi(req, res, url, user);
    return await serveStatic(req, res, url);
  } catch (error) {
    console.error(error);
    return sendJson(res, 500, { error: error.message || 'Internal server error.' });
  }
});

server.listen(envConfig.port, '0.0.0.0', () => {
  console.log(`MailHub listening on 0.0.0.0:${envConfig.port}`);
});

startSubmissionServer({
  enabled: envConfig.submissionEnabled,
  listeners: envConfig.submissionListeners,
  hostname: envConfig.submissionHost,
  allowInsecureAuth: envConfig.submissionAllowInsecureAuth,
  inboundEnabled: envConfig.inboundEnabled,
  maxMessageBytes: envConfig.submissionMaxMessageBytes,
  tlsCertPath: envConfig.submissionTlsCert,
  tlsKeyPath: envConfig.submissionTlsKey,
  relayHost: envConfig.smtpHost,
  relayPort: envConfig.smtpPort,
  relaySecure: envConfig.smtpSecure,
  relayUsername: envConfig.smtpUser,
  relayPassword: envConfig.smtpPassword,
  relayHelo: envConfig.smtpHelo,
  getTrackingSettings() {
    const settings = runtimeSettings();
    return {
      enabled: settings.engagementTrackingEnabled,
      appBaseUrl: settings.appBaseUrl,
      secret: envConfig.trackingSecret
    };
  },
  getDeliverabilitySettings() {
    return {
      ...runtimeSettings(),
      secret: envConfig.trackingSecret
    };
  }
});

async function handleApi(req, res, url, user) {
  const method = req.method || 'GET';
  const pathname = url.pathname;

  if (method === 'GET' && pathname === '/api/me') {
    return sendJson(res, 200, { user });
  }
  if (method === 'GET' && pathname === '/api/config') {
    return sendJson(res, 200, publicConfig(user));
  }
  if (method === 'GET' && pathname === '/api/domains') {
    return sendJson(res, 200, { domains: listDomains(user.id) });
  }
  if (method === 'POST' && pathname === '/api/domains') {
    const body = await readJson(req);
    const settings = runtimeSettings();
    const domain = normalizeDomain(body.domain);
    if (!domain) return sendJson(res, 400, { error: '域名格式不正确。' });
    const selector = normalizeSelector(body.selector || defaultSelector());
    if (!selector) return sendJson(res, 400, { error: 'DKIM selector 格式不正确。' });
    const dnsCredentialId = Number(body.dnsCredentialId || 0) || null;
    if (dnsCredentialId && !getDnsCredential(dnsCredentialId, user.id)) {
      return sendJson(res, 400, { error: 'DNS 凭据不存在。' });
    }
    const smtpRelayId = Number(body.smtpRelayId || 0) || null;
    if (smtpRelayId && !getSmtpRelay(smtpRelayId, user.id)) {
      return sendJson(res, 400, { error: 'SMTP 出口不存在。' });
    }
    const keys = createDkimKeyPair();
    try {
      const row = createDomain(user.id, {
        domain,
        selector,
        dnsCredentialId,
        smtpRelayId,
        verificationToken: crypto.randomBytes(18).toString('hex'),
        dkimPublic: keys.publicKey,
        dkimPrivate: keys.privateKey,
        senderHost: normalizeHostname(body.senderHost || settings.mailHostname),
        sendingIp: String(body.sendingIp || settings.sendingIp).trim(),
        spfExtra: String(body.spfExtra ?? settings.defaultSpfMechanisms).trim(),
        dmarcPolicy: normalizeDmarcPolicy(body.dmarcPolicy || settings.dmarcPolicy),
        dmarcRua: String(body.dmarcRua ?? settings.dmarcRua).trim()
      });
      return sendJson(res, 201, { domain: row });
    } catch (error) {
      if (isUniqueError(error)) return sendJson(res, 409, { error: '该域名已被添加。' });
      throw error;
    }
  }
  if (method === 'GET' && pathname === '/api/events') {
    return sendJson(res, 200, { events: listSendEvents(user.id) });
  }
  if (method === 'GET' && pathname === '/api/inbound-mailboxes') {
    return sendJson(res, 200, { mailboxes: listInboundMailboxes(user.id) });
  }
  if (method === 'POST' && pathname === '/api/inbound-mailboxes') {
    const body = await readJson(req);
    try {
      return sendJson(res, 201, {
        mailbox: createInboundMailbox(user.id, {
          address: body.address,
          displayName: body.displayName
        })
      });
    } catch (error) {
      if (isUniqueError(error)) return sendJson(res, 409, { error: '该收信邮箱已存在。' });
      return sendJson(res, 400, { error: error.message || '收信邮箱创建失败。' });
    }
  }
  if (method === 'GET' && pathname === '/api/inbound-messages') {
    return sendJson(res, 200, {
      messages: listInboundMessages(user.id, {
        mailboxId: Number(url.searchParams.get('mailboxId') || 0) || null
      })
    });
  }
  const inboundMessageMatch = pathname.match(/^\/api\/inbound-messages\/(\d+)$/);
  if (inboundMessageMatch) {
    const id = Number(inboundMessageMatch[1]);
    if (method === 'GET') {
      const message = getInboundMessage(user.id, id);
      return sendJson(res, message ? 200 : 404, { message });
    }
    if (method === 'PATCH') {
      const body = await readJson(req);
      const message = markInboundMessageRead(user.id, id, body.read !== false);
      return sendJson(res, message ? 200 : 404, { message });
    }
  }
  const sendEventMatch = pathname.match(/^\/api\/events\/(\d+)$/);
  if (sendEventMatch && method === 'GET') {
    const event = getSendEvent(user.id, Number(sendEventMatch[1]), { trackingSecret: envConfig.trackingSecret });
    return sendJson(res, event ? 200 : 404, { event });
  }
  if (method === 'GET' && pathname === '/api/analytics') {
    return sendJson(res, 200, {
      analytics: getSendAnalytics(user.id, {
        days: Number(url.searchParams.get('days') || 7),
        trackingSecret: envConfig.trackingSecret
      })
    });
  }
  if (method === 'GET' && pathname === '/api/smtp-credential') {
    return sendJson(res, 200, { credential: getSmtpCredential(user.id, { includePassword: true }) });
  }
  if ((method === 'POST' || method === 'PUT' || method === 'PATCH') && pathname === '/api/smtp-credential') {
    const body = await readJson(req);
    try {
      const current = getSmtpCredential(user.id);
      saveSmtpCredential(user.id, {
        id: current?.id || null,
        username: String(body.username || '').trim(),
        password: String(body.password || '')
      });
    } catch (error) {
      if (isUniqueError(error)) return sendJson(res, 409, { error: 'SMTP 用户名已被占用。' });
      throw error;
    }
    return sendJson(res, 200, { credential: getSmtpCredential(user.id, { includePassword: true }) });
  }
  if (method === 'GET' && pathname === '/api/smtp-credentials') {
    return sendJson(res, 200, { credentials: listSmtpCredentials(user.id, { includePassword: true }) });
  }
  if (method === 'POST' && pathname === '/api/smtp-credentials') {
    const body = await readJson(req);
    try {
      const credential = saveSmtpCredential(user.id, {
        username: String(body.username || '').trim(),
        password: String(body.password || '')
      });
      return sendJson(res, 201, { credential: getSmtpCredential(credential.id, user.id, { includePassword: true }) });
    } catch (error) {
      if (isUniqueError(error)) return sendJson(res, 409, { error: 'SMTP 用户名已被占用。' });
      throw error;
    }
  }
  const smtpCredentialMatch = pathname.match(/^\/api\/smtp-credentials\/(\d+)$/);
  if (smtpCredentialMatch) {
    const id = Number(smtpCredentialMatch[1]);
    if (method === 'GET') {
      const credential = getSmtpCredential(id, user.id, { includePassword: true });
      return sendJson(res, credential ? 200 : 404, { credential });
    }
    if (method === 'PATCH' || method === 'PUT') {
      const body = await readJson(req);
      try {
        const credential = saveSmtpCredential(user.id, {
          id,
          username: String(body.username || '').trim(),
          password: String(body.password || '')
        });
        return sendJson(res, credential ? 200 : 404, {
          credential: credential ? getSmtpCredential(credential.id, user.id, { includePassword: true }) : null
        });
      } catch (error) {
        if (isUniqueError(error)) return sendJson(res, 409, { error: 'SMTP 用户名已被占用。' });
        throw error;
      }
    }
    if (method === 'DELETE') {
      const deleted = deleteSmtpCredential(id, user.id);
      return sendJson(res, deleted ? 200 : 404, { deleted });
    }
  }
  if (method === 'GET' && pathname === '/api/smtp-relays') {
    return sendJson(res, 200, { relays: listSmtpRelays(user.id) });
  }
  if (method === 'POST' && pathname === '/api/smtp-relays') {
    const body = await readJson(req);
    const relay = saveSmtpRelay(user.id, smtpRelayPatch(body));
    return sendJson(res, 201, { relay });
  }
  const smtpRelayMatch = pathname.match(/^\/api\/smtp-relays\/(\d+)$/);
  if (smtpRelayMatch) {
    const id = Number(smtpRelayMatch[1]);
    if (method === 'GET') {
      const relay = getSmtpRelay(id, user.id, { includePassword: true });
      return sendJson(res, relay ? 200 : 404, { relay });
    }
    if (method === 'PATCH' || method === 'PUT') {
      const body = await readJson(req);
      const relay = saveSmtpRelay(user.id, { ...smtpRelayPatch(body), id });
      return sendJson(res, relay ? 200 : 404, { relay });
    }
    if (method === 'DELETE') {
      const deleted = deleteSmtpRelay(id, user.id);
      return sendJson(res, deleted ? 200 : 404, { deleted });
    }
  }
  if (method === 'POST' && pathname === '/api/send') {
    const body = await readJson(req);
    const smtpRelayId = Number(body.smtpRelayId || 0) || null;
    if (smtpRelayId && !getSmtpRelay(smtpRelayId, user.id)) {
      return sendJson(res, 400, { error: 'SMTP 出口不存在。' });
    }
    const result = await sendMailFromBody(body, user);
    return sendJson(res, 202, result);
  }

  if (method === 'GET' && pathname === '/api/api-tokens') {
    return sendJson(res, 200, { tokens: listApiTokens(user.id) });
  }
  if (method === 'POST' && pathname === '/api/api-tokens') {
    const body = await readJson(req);
    return sendJson(res, 201, { token: createApiToken(user.id, body.name) });
  }
  const tokenMatch = pathname.match(/^\/api\/api-tokens\/(\d+)$/);
  if (tokenMatch && method === 'DELETE') {
    const deleted = deleteApiToken(Number(tokenMatch[1]), user.id);
    return sendJson(res, deleted ? 200 : 404, { deleted });
  }

  if (method === 'GET' && pathname === '/api/dns-credentials') {
    return sendJson(res, 200, { credentials: listDnsCredentials(user.id) });
  }
  if (method === 'POST' && pathname === '/api/dns-credentials') {
    const body = await readJson(req);
    const credential = saveDnsCredential(user.id, body);
    return sendJson(res, 201, { credential });
  }
  const dnsMatch = pathname.match(/^\/api\/dns-credentials\/(\d+)(?:\/([a-z-]+))?$/);
  if (dnsMatch) {
    const id = Number(dnsMatch[1]);
    const action = dnsMatch[2] || '';
    if ((method === 'PUT' || method === 'PATCH') && !action) {
      const body = await readJson(req);
      const credential = saveDnsCredential(user.id, { ...body, id });
      return sendJson(res, credential ? 200 : 404, { credential });
    }
    if (method === 'DELETE' && !action) {
      const deleted = deleteDnsCredential(id, user.id);
      return sendJson(res, deleted ? 200 : 404, { deleted });
    }
    if (method === 'POST' && action === 'test') {
      const credential = getDnsCredential(id, user.id, { includeCredentials: true });
      if (!credential) return sendJson(res, 404, { error: 'DNS 凭据不存在。' });
      const result = await testDnsCredential(credential);
      return sendJson(res, result.ok ? 200 : 400, result);
    }
  }

  if (method === 'GET' && pathname === '/api/webhooks') {
    let domainId;
    if (url.searchParams.has('domainId')) {
      const raw = url.searchParams.get('domainId');
      if (raw === '' || raw === 'null') {
        domainId = null;
      } else {
        domainId = Number(raw);
        if (!Number.isInteger(domainId) || domainId <= 0) {
          return sendJson(res, 400, { error: 'domainId 无效。' });
        }
      }
    }
    return sendJson(res, 200, { webhooks: listWebhooks(user.id, { domainId }) });
  }
  if (method === 'POST' && pathname === '/api/webhooks') {
    const body = await readJson(req);
    try {
      await assertSafeWebhookUrl(String(body.url || '').trim());
      const webhook = createWebhook(user.id, {
        name: body.name,
        url: body.url,
        events: body.events,
        domainId: body.domainId === undefined ? null : body.domainId,
        enabled: body.enabled
      });
      return sendJson(res, 201, { webhook });
    } catch (error) {
      return sendJson(res, 400, { error: error.message || 'Webhook 创建失败。' });
    }
  }
  const webhookMatch = pathname.match(/^\/api\/webhooks\/(\d+)(?:\/(rotate-secret|test))?$/);
  if (webhookMatch) {
    const id = Number(webhookMatch[1]);
    const action = webhookMatch[2] || '';
    if (method === 'PATCH' && !action) {
      const body = await readJson(req);
      try {
        if (body.url !== undefined) {
          await assertSafeWebhookUrl(String(body.url || '').trim());
        }
        const patch = {};
        if (body.name !== undefined) patch.name = body.name;
        if (body.url !== undefined) patch.url = body.url;
        if (body.events !== undefined) patch.events = body.events;
        if (body.domainId !== undefined) patch.domainId = body.domainId;
        if (body.enabled !== undefined) patch.enabled = body.enabled;
        const webhook = updateWebhook(user.id, id, patch);
        if (!webhook) return sendJson(res, 404, { error: 'Webhook 不存在。' });
        return sendJson(res, 200, { webhook });
      } catch (error) {
        return sendJson(res, 400, { error: error.message || 'Webhook 更新失败。' });
      }
    }
    if (method === 'DELETE' && !action) {
      const deleted = deleteWebhook(user.id, id);
      return sendJson(res, deleted ? 200 : 404, { deleted });
    }
    if (method === 'POST' && action === 'rotate-secret') {
      const webhook = rotateWebhookSecret(user.id, id);
      if (!webhook) return sendJson(res, 404, { error: 'Webhook 不存在。' });
      return sendJson(res, 200, { webhook });
    }
    if (method === 'POST' && action === 'test') {
      try {
        const delivery = enqueueWebhookTestDelivery(user.id, id);
        if (!delivery) return sendJson(res, 404, { error: 'Webhook 不存在。' });
        return sendJson(res, 202, { delivery });
      } catch (error) {
        return sendJson(res, 400, { error: error.message || 'Webhook 测试失败。' });
      }
    }
  }

  if (method === 'GET' && pathname === '/api/webhook-deliveries') {
    const filters = {};
    if (url.searchParams.has('status')) filters.status = url.searchParams.get('status');
    if (url.searchParams.has('webhookId')) filters.webhookId = Number(url.searchParams.get('webhookId'));
    if (url.searchParams.has('eventType')) filters.eventType = url.searchParams.get('eventType');
    if (url.searchParams.has('limit')) filters.limit = url.searchParams.get('limit');
    return sendJson(res, 200, { deliveries: listWebhookDeliveries(user.id, filters) });
  }
  const webhookDeliveryReplayMatch = pathname.match(/^\/api\/webhook-deliveries\/(\d+)\/replay$/);
  if (webhookDeliveryReplayMatch && method === 'POST') {
    try {
      const delivery = replayWebhookDelivery(user.id, Number(webhookDeliveryReplayMatch[1]));
      if (!delivery) return sendJson(res, 404, { error: 'Webhook 投递记录不存在。' });
      return sendJson(res, 200, { delivery });
    } catch (error) {
      return sendJson(res, 400, { error: error.message || 'Webhook 重放失败。' });
    }
  }

  if (pathname.startsWith('/api/admin/')) {
    return await handleAdminApi(req, res, url, user);
  }

  const domainMatch = pathname.match(/^\/api\/domains\/(\d+)(?:\/([a-z-]+))?$/);
  if (domainMatch) {
    const id = Number(domainMatch[1]);
    const action = domainMatch[2] || '';
    if (method === 'GET' && !action) {
      const domain = getDomain(id, { userId: user.id });
      if (!domain) return sendJson(res, 404, { error: '域名不存在。' });
      return sendJson(res, 200, { domain });
    }
    if (method === 'PATCH' && !action) {
      const body = await readJson(req);
      const dnsCredentialId = body.dnsCredentialId !== undefined ? Number(body.dnsCredentialId || 0) || null : undefined;
      if (dnsCredentialId && !getDnsCredential(dnsCredentialId, user.id)) {
        return sendJson(res, 400, { error: 'DNS 凭据不存在。' });
      }
      const smtpRelayId = body.smtpRelayId !== undefined ? Number(body.smtpRelayId || 0) || null : undefined;
      if (smtpRelayId && !getSmtpRelay(smtpRelayId, user.id)) {
        return sendJson(res, 400, { error: 'SMTP 出口不存在。' });
      }
      const row = updateDomain(id, user.id, {
        selector: body.selector ? normalizeSelector(body.selector) : undefined,
        dnsCredentialId,
        smtpRelayId,
        senderHost: body.senderHost ? normalizeHostname(body.senderHost) : undefined,
        sendingIp: body.sendingIp !== undefined ? String(body.sendingIp).trim() : undefined,
        spfExtra: body.spfExtra !== undefined ? String(body.spfExtra).trim() : undefined,
        dmarcPolicy: body.dmarcPolicy ? normalizeDmarcPolicy(body.dmarcPolicy) : undefined,
        dmarcRua: body.dmarcRua !== undefined ? String(body.dmarcRua).trim() : undefined
      });
      if (!row) return sendJson(res, 404, { error: '域名不存在。' });
      return sendJson(res, 200, { domain: row });
    }
    if (method === 'DELETE' && !action) {
      const deleted = deleteDomain(id, user.id);
      return sendJson(res, deleted ? 200 : 404, { deleted });
    }
    if (method === 'POST' && action === 'check') {
      const row = getDomain(id, { userId: user.id });
      if (!row) return sendJson(res, 404, { error: '域名不存在。' });
      const guide = await buildDnsGuide(row);
      saveDomainStatus(id, user.id, guide);
      return sendJson(res, 200, { guide, domain: getDomain(id, { userId: user.id }) });
    }
    if (method === 'POST' && action === 'apply-dns') {
      const row = getDomain(id, { userId: user.id, includePrivate: true });
      if (!row) return sendJson(res, 404, { error: '域名不存在。' });
      const credentialId = Number(row.dnsCredentialId || 0);
      const credential = credentialId ? getDnsCredential(credentialId, user.id, { includeCredentials: true }) : null;
      if (!credential) return sendJson(res, 400, { error: '请先为该域名绑定 DNS API 凭据。' });
      const guide = await buildDnsGuide(row);
      const applyResult = await applyDnsSetup(row, credential, guide);
      const checkedGuide = await buildDnsGuideAfterApply(row, applyResult);
      checkedGuide.apply = applyResult;
      saveDomainStatus(id, user.id, checkedGuide);
      return sendJson(res, applyResult.ok ? 200 : 207, {
        apply: applyResult,
        guide: checkedGuide,
        domain: getDomain(id, { userId: user.id })
      });
    }
    if (method === 'POST' && action === 'rotate-dkim') {
      const row = getDomain(id, { userId: user.id });
      if (!row) return sendJson(res, 404, { error: '域名不存在。' });
      const body = await readJson(req).catch(() => ({}));
      const selector = normalizeSelector(body.selector || defaultSelector());
      const next = updateDkim(id, user.id, createDkimKeyPair(), selector);
      return sendJson(res, 200, { domain: next });
    }
    if (method === 'POST' && action === 'test-send') {
      const row = getDomain(id, { userId: user.id });
      if (!row) return sendJson(res, 404, { error: '域名不存在。' });
      const body = await readJson(req);
      const smtpRelayId = Number(body.smtpRelayId || 0) || null;
      if (smtpRelayId && !getSmtpRelay(smtpRelayId, user.id)) {
        return sendJson(res, 400, { error: 'SMTP 出口不存在。' });
      }
      const from = body.from || `noreply@${row.domain}`;
      const result = await sendMailFromBody({
        from,
        to: body.to,
        subject: body.subject || `MailHub test for ${row.domain}`,
        text: body.text || `This is a MailHub test message from ${row.domain}.`,
        html: body.html,
        tracking: body.tracking,
        smtpRelayId: body.smtpRelayId
      }, user);
      return sendJson(res, 202, result);
    }
  }

  return sendJson(res, 404, { error: 'Not found.' });
}

async function handleAdminApi(req, res, url, user) {
  const method = req.method || 'GET';
  const pathname = url.pathname;
  if (!pathname.startsWith('/api/admin/')) return null;
  if (user.role !== 'admin') return sendJson(res, 403, { error: '需要管理员权限。' });
  if (method === 'GET' && pathname === '/api/admin/settings') {
    return sendJson(res, 200, { settings: await adminRuntimeSettings() });
  }
  if (method === 'GET' && pathname === '/api/admin/system-email') {
    return sendJson(res, 200, { settings: getSystemEmailSettings() });
  }
  if (method === 'GET' && pathname === '/api/admin/audit-logs') {
    return sendJson(res, 200, { logs: listAuditLogs(adminAuditFilters(url.searchParams)) });
  }
  if (method === 'GET' && pathname === '/api/admin/resources') {
    return sendJson(res, 200, { inventory: getAdminResourceInventory() });
  }
  const transferDomainMatch = pathname.match(/^\/api\/admin\/resources\/domains\/(\d+)\/transfer$/);
  if (transferDomainMatch && method === 'POST') {
    const body = await readJson(req);
    try {
      const domain = transferDomain({
        actorUserId: user.id,
        domainId: Number(transferDomainMatch[1]),
        targetUserId: body.targetUserId,
        dnsCredentialMode: body.dnsCredentialMode
      });
      return sendJson(res, 200, { domain });
    } catch (error) {
      return sendAdminTransferError(res, error);
    }
  }
  const transferDnsCredentialMatch = pathname.match(/^\/api\/admin\/resources\/dns-credentials\/(\d+)\/transfer$/);
  if (transferDnsCredentialMatch && method === 'POST') {
    const body = await readJson(req);
    try {
      const credential = transferDnsCredential({
        actorUserId: user.id,
        credentialId: Number(transferDnsCredentialMatch[1]),
        targetUserId: body.targetUserId
      });
      return sendJson(res, 200, { credential });
    } catch (error) {
      return sendAdminTransferError(res, error);
    }
  }
  if (method === 'POST' && pathname === '/api/admin/resources/api-tokens/transfer') {
    const body = await readJson(req);
    try {
      const tokens = transferApiTokens({
        actorUserId: user.id,
        tokenIds: body.tokenIds,
        targetUserId: body.targetUserId
      });
      return sendJson(res, 200, { tokens });
    } catch (error) {
      return sendAdminTransferError(res, error);
    }
  }
  if (method === 'POST' && pathname === '/api/admin/migrations/user-merge/preview') {
    const body = await readJson(req);
    try {
      const preview = previewUserMerge({
        sourceUserId: body.sourceUserId,
        targetUserId: body.targetUserId
      });
      return sendJson(res, 200, { preview });
    } catch (error) {
      return sendAdminMigrationError(res, error);
    }
  }
  if (method === 'POST' && pathname === '/api/admin/migrations/user-merge/execute') {
    const body = await readJson(req);
    try {
      const result = executeUserMerge({
        actorUserId: user.id,
        sourceUserId: body.sourceUserId,
        targetUserId: body.targetUserId,
        options: body.options,
        confirmation: body.confirmation
      });
      return sendJson(res, 200, { result });
    } catch (error) {
      return sendAdminMigrationError(res, error);
    }
  }
  if ((method === 'PATCH' || method === 'PUT') && pathname === '/api/admin/system-email') {
    const body = await readJson(req);
    const settings = saveSystemEmailSettings({
      host: body.host,
      port: body.port,
      secure: body.secure,
      username: body.username,
      password: body.password,
      helo: body.helo,
      fromEmail: body.fromEmail,
      fromName: body.fromName,
      testRecipient: body.testRecipient
    });
    logAudit({
      actorUserId: user.id,
      action: 'admin.update_system_email',
      targetType: 'system_email',
      targetId: 'default',
      summary: settings
    });
    return sendJson(res, 200, { settings });
  }
  if (method === 'POST' && pathname === '/api/admin/system-email/test') {
    const body = await readJson(req).catch(() => ({}));
    const settings = systemMailSettingsForSend();
    const to = extractAddress(body.to || settings.testRecipient);
    if (!to) return sendJson(res, 400, { error: '测试收件人地址格式不正确。' });
    const result = await sendSystemEmail(settings, {
      to,
      subject: 'MailHub 系统邮件测试',
      text: '这是一封 MailHub 系统邮件测试。'
    });
    logAudit({
      actorUserId: user.id,
      action: 'admin.test_system_email',
      targetType: 'system_email',
      targetId: 'default',
      summary: {
        to,
        ok: result.ok,
        message: result.message,
        queueId: result.queueId
      }
    });
    return sendJson(res, result.ok ? 202 : 502, { result });
  }
  if ((method === 'PATCH' || method === 'PUT') && pathname === '/api/admin/settings') {
    const body = await readJson(req);
    saveSettings(settingsPatchFromBody(body));
    return sendJson(res, 200, { settings: await adminRuntimeSettings() });
  }
  if (method === 'GET' && pathname === '/api/admin/users') {
    return sendJson(res, 200, { users: listUsersWithResourceCounts() });
  }
  const approveMatch = pathname.match(/^\/api\/admin\/users\/(\d+)\/approve$/);
  if (approveMatch && method === 'POST') {
    const current = getUser(Number(approveMatch[1]));
    if (!current) return sendJson(res, 404, { error: '用户不存在。' });
    if (current.status === 'pending_email') return sendJson(res, 400, { error: '用户尚未验证邮箱。' });
    if (current.status !== 'pending_review') return sendJson(res, 400, { error: '只能审批等待审核的用户。' });
    const target = approveUser(current.id);
    if (!target) return sendJson(res, 404, { error: '用户不存在。' });
    logAudit({
      actorUserId: user.id,
      action: 'admin.approve_user',
      targetType: 'user',
      targetId: String(target.id),
      targetUserId: target.id,
      summary: {
        username: target.username,
        status: target.status
      }
    });
    return sendJson(res, 200, { user: target });
  }
  const resendVerificationMatch = pathname.match(/^\/api\/admin\/users\/(\d+)\/resend-verification$/);
  if (resendVerificationMatch && method === 'POST') {
    const target = getUser(Number(resendVerificationMatch[1]));
    if (!target) return sendJson(res, 404, { error: '用户不存在。' });
    if (target.status !== 'pending_email') return sendJson(res, 400, { error: '用户不需要重新发送验证邮件。' });
    const result = await createAndSendVerificationEmail(target);
    logAudit({
      actorUserId: user.id,
      action: 'admin.resend_verification',
      targetType: 'user',
      targetId: String(target.id),
      targetUserId: target.id,
      summary: {
        username: target.username,
        email: target.email,
        verificationEmailSent: result.ok,
        message: result.message,
        queueId: result.queueId
      }
    });
    return sendJson(res, 202, verificationEmailResponse(result));
  }
  const passwordResetMatch = pathname.match(/^\/api\/admin\/users\/(\d+)\/password-reset$/);
  if (passwordResetMatch && method === 'POST') {
    const target = getUser(Number(passwordResetMatch[1]));
    if (!target) return sendJson(res, 404, { error: '用户不存在。' });
    const result = await createAndSendPasswordResetEmail(target);
    logAudit({
      actorUserId: user.id,
      action: 'admin.password_reset',
      targetType: 'user',
      targetId: String(target.id),
      targetUserId: target.id,
      summary: {
        username: target.username,
        email: target.email,
        ok: result.ok,
        message: result.message,
        queueId: result.queueId
      }
    });
    return sendJson(res, result.ok ? 202 : 502, { result });
  }
  const temporaryPasswordMatch = pathname.match(/^\/api\/admin\/users\/(\d+)\/temporary-password$/);
  if (temporaryPasswordMatch && method === 'POST') {
    const target = getUser(Number(temporaryPasswordMatch[1]));
    if (!target) return sendJson(res, 404, { error: '用户不存在。' });
    const body = await readJson(req);
    let updated;
    try {
      updated = updateUser(target.id, { password: body.password });
    } catch (error) {
      if (error?.message === '密码至少需要 8 位。') return sendJson(res, 400, { error: error.message });
      throw error;
    }
    logAudit({
      actorUserId: user.id,
      action: 'admin.temporary_password',
      targetType: 'user',
      targetId: String(target.id),
      targetUserId: target.id,
      summary: {
        username: target.username,
        email: target.email,
        passwordSet: true
      }
    });
    return sendJson(res, 200, { user: updated });
  }
  const userMatch = pathname.match(/^\/api\/admin\/users\/(\d+)$/);
  if (userMatch && method === 'PATCH') {
    const body = await readJson(req);
    let updated;
    try {
      updated = updateUser(Number(userMatch[1]), {
        role: body.role,
        status: body.status,
        password: body.password
      });
    } catch (error) {
      if (['用户状态不正确。', '密码至少需要 8 位。'].includes(error?.message)) {
        return sendJson(res, 400, { error: error.message });
      }
      throw error;
    }
    return sendJson(res, updated ? 200 : 404, { user: updated });
  }
  return sendJson(res, 404, { error: 'Not found.' });
}

function adminAuditFilters(searchParams) {
  const requested = {
    actorUserId: auditUserIdParam(searchParams.get('actorUserId'), { allowSystem: true }),
    targetUserId: auditUserIdParam(searchParams.get('targetUserId')),
    action: auditTextParam(searchParams.get('action')),
    from: auditDateParam(searchParams.get('from')),
    to: auditDateParam(searchParams.get('to'))
  };
  return Object.fromEntries(
    ['actorUserId', 'targetUserId', 'action', 'from', 'to']
      .filter((key) => requested[key] !== undefined)
      .map((key) => [key, requested[key]])
  );
}

function sendAdminTransferError(res, error) {
  if (['域名不存在。', 'DNS 凭据不存在。', 'API Token 不存在。'].includes(error?.message)) {
    return sendJson(res, 404, { error: error.message });
  }
  if (['目标用户不可用。', 'DNS 凭据归属不一致。'].includes(error?.message)) {
    return sendJson(res, 400, { error: error.message });
  }
  throw error;
}

function sendAdminMigrationError(res, error) {
  if (['源用户不存在。'].includes(error?.message)) return sendJson(res, 404, { error: error.message });
  if ([
    '目标用户不可用。',
    '源用户和目标用户不能相同。',
    '确认文本不匹配。'
  ].includes(error?.message)) {
    return sendJson(res, 400, { error: error.message });
  }
  throw error;
}

function auditUserIdParam(value, { allowSystem = false } = {}) {
  if (value === null) return undefined;
  const text = String(value).trim();
  if (!text) return undefined;
  if (allowSystem && ['system', 'null'].includes(text.toLowerCase())) return null;
  return /^[1-9]\d*$/.test(text) ? Number(text) : undefined;
}

function auditTextParam(value) {
  const text = String(value || '').trim();
  return text || undefined;
}

function auditDateParam(value) {
  const text = String(value || '').trim();
  if (!text) return undefined;
  const dateOnly = text.match(/^(\d{4})-(\d{2})-(\d{2})$/);
  if (dateOnly) {
    const year = Number(dateOnly[1]);
    const month = Number(dateOnly[2]);
    const day = Number(dateOnly[3]);
    const date = new Date(Date.UTC(year, month - 1, day));
    if (
      date.getUTCFullYear() === year &&
      date.getUTCMonth() === month - 1 &&
      date.getUTCDate() === day
    ) {
      return date.toISOString();
    }
    return undefined;
  }
  if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(text)) return undefined;
  const date = new Date(text);
  return !Number.isNaN(date.getTime()) && date.toISOString() === text ? text : undefined;
}

async function sendMailFromBody(body, user) {
  const settings = runtimeSettings();
  const from = extractAddress(body.from);
  if (!from) throw new Error('发件人地址格式不正确。');
  const recipients = parseAddressList(body.to);
  if (!recipients.length) throw new Error('收件人地址格式不正确。');
  const fromDomain = domainFromAddress(from);
  const domain = getDomainByName(fromDomain, { userId: user.id, includePrivate: true });
  if (!domain) throw new Error(`发件域名 ${fromDomain} 不属于当前用户或尚未添加。`);
  if (settings.sendRequiresVerified && !domain.status?.verified) {
    throw new Error(`发件域名 ${fromDomain} 尚未完成验证。`);
  }

  const smtpTransport = smtpTransportForSend(body, domain, user);
  const subject = body.subject || '(no subject)';
  const tracking = resolveSendTracking(body, settings, recipients);
  const openToken = tracking.opens ? createTrackingToken() : '';
  const eventId = createSendEvent({
    userId: user.id,
    domainId: domain.id,
    smtpRelayId: smtpTransport.smtpRelayId,
    sender: from,
    recipients,
    subject,
    trackingToken: openToken,
    trackingOpens: tracking.opens,
    trackingClicks: tracking.clicks
  });
  let actualTracking = {
    ...tracking,
    enabled: false,
    opens: false,
    clicks: false
  };
  try {
    let html = body.html || '';
    if (tracking.enabled) {
      const result = instrumentHtml(html, {
        openPixelUrl: tracking.opens ? trackingOpenUrl(settings.appBaseUrl, openToken) : '',
        createClickUrl: tracking.clicks
          ? (target) => createTrackedClickUrl({
              appBaseUrl: settings.appBaseUrl,
              userId: user.id,
              eventId,
              target
            })
          : null
      });
      html = result.html;
      actualTracking = {
        ...tracking,
        enabled: (tracking.opens && result.pixelAdded) || (tracking.clicks && result.linkCount > 0),
        opens: tracking.opens && result.pixelAdded,
        clicks: tracking.clicks && result.linkCount > 0
      };
    }
    const rawMessage = buildMessage({
      from,
      to: recipients,
      subject,
      text: body.text || '',
      html,
      baseUrl: settings.appBaseUrl,
      headers: buildDeliverabilityHeaders({
        from,
        listUnsubscribeMailto: settings.listUnsubscribeMailto,
        listUnsubscribeUrl: settings.listUnsubscribeUrl,
        listUnsubscribePostEnabled: settings.listUnsubscribePostEnabled,
        feedbackId: settings.feedbackIdEnabled
          ? createFeedbackId({
              userId: user.id,
              domainId: domain.id,
              eventId,
              secret: envConfig.trackingSecret
            })
          : '',
        reportAbuseTo: settings.reportAbuseTo,
        csaComplaintsTo: settings.csaComplaintsTo,
        context: {
          eventId,
          userId: user.id,
          domain: fromDomain,
          sender: from,
          recipient: recipients.length === 1 ? recipients[0] : ''
        }
      })
    });
    const signed = signMessageForDomain(rawMessage, domain);
    const smtpResult = await sendViaSmtp({
      host: smtpTransport.host,
      port: smtpTransport.port,
      secure: smtpTransport.secure,
      username: smtpTransport.username,
      password: smtpTransport.password,
      helo: smtpTransport.helo,
      mailFrom: resolveEnvelopeSender(settings, from),
      recipients,
      rawMessage: signed
    });
    finalizeSendEvent(eventId, user.id, {
      smtpRelayId: smtpTransport.smtpRelayId,
      status: 'queued',
      detail: smtpResult.message,
      queueId: smtpResult.queueId,
      deliveryLog: smtpResult.deliveryLog,
      trackingOpens: actualTracking.opens,
      trackingClicks: actualTracking.clicks
    });
    return {
      eventId,
      queued: true,
      domain: domain.domain,
      recipients,
      smtp: smtpResult.message,
      queueId: smtpResult.queueId,
      smtpRelayId: smtpTransport.smtpRelayId,
      tracking: actualTracking
    };
  } catch (error) {
    finalizeSendEvent(eventId, user.id, {
      smtpRelayId: smtpTransport.smtpRelayId,
      status: 'failed',
      detail: error.message,
      deliveryLog: deliveryLogFromError(error),
      trackingOpens: actualTracking.opens,
      trackingClicks: actualTracking.clicks
    });
    throw error;
  }
}

function resolveSendTracking(body, settings, recipients) {
  if (!body.html) return { enabled: false, opens: false, clicks: false, messageLevel: recipients.length > 1 };
  const configured = Boolean(settings.engagementTrackingEnabled);
  const requested = body.tracking;
  let opens = configured;
  let clicks = configured;
  if (typeof requested === 'boolean') {
    opens = requested;
    clicks = requested;
  } else if (requested && typeof requested === 'object') {
    if (Object.hasOwn(requested, 'opens')) opens = Boolean(requested.opens);
    if (Object.hasOwn(requested, 'clicks')) clicks = Boolean(requested.clicks);
  }
  return {
    enabled: opens || clicks,
    opens,
    clicks,
    messageLevel: recipients.length > 1
  };
}

function createTrackedClickUrl({ appBaseUrl, userId, eventId, target }) {
  const normalizedTarget = new URL(target).toString();
  const token = createTrackingToken();
  createTrackingLink(userId, eventId, {
    token,
    targetCiphertext: encryptTrackingTarget(normalizedTarget, envConfig.trackingSecret),
    targetFingerprint: trackingTargetFingerprint(normalizedTarget, envConfig.trackingSecret),
    targetOrigin: new URL(normalizedTarget).origin
  });
  return `${trackingUrlBase(appBaseUrl)}/t/c/${token}`;
}

function trackingOpenUrl(appBaseUrl, token) {
  return `${trackingUrlBase(appBaseUrl)}/t/o/${token}.gif`;
}

function trackingUrlBase(appBaseUrl) {
  return String(appBaseUrl || '').replace(/\/+$/, '');
}

function deliveryLogFromError(error) {
  if (Array.isArray(error?.deliveryLog)) return error.deliveryLog;
  return [{
    at: new Date().toISOString(),
    phase: 'error',
    direction: 'system',
    message: error?.message || 'Unknown SMTP delivery error',
    ok: false
  }];
}

function smtpTransportForSend(body, domain, user) {
  const requestedRelayId = Number(body.smtpRelayId || 0) || null;
  if (requestedRelayId) {
    const relay = getSmtpRelay(requestedRelayId, user.id, { includePassword: true });
    if (!relay) throw new Error('SMTP 出口不存在。');
    return smtpTransportFromRelay(relay);
  }
  if (domain.smtpRelayId) {
    const relay = getSmtpRelay(domain.smtpRelayId, user.id, { includePassword: true });
    if (!relay) throw new Error('SMTP 出口不存在。');
    return smtpTransportFromRelay(relay);
  }
  const defaultRelay = getDefaultSmtpRelay(user.id, { includePassword: true });
  if (defaultRelay) return smtpTransportFromRelay(defaultRelay);
  return {
    smtpRelayId: null,
    host: envConfig.smtpHost,
    port: envConfig.smtpPort,
    secure: envConfig.smtpSecure,
    username: envConfig.smtpUser,
    password: envConfig.smtpPassword,
    helo: envConfig.smtpHelo
  };
}

function smtpTransportFromRelay(relay) {
  return {
    smtpRelayId: relay.id,
    host: relay.host,
    port: relay.port,
    secure: relay.secure,
    username: relay.username,
    password: relay.password || '',
    helo: relay.helo || envConfig.smtpHelo
  };
}

function runBackground(promise) {
  promise.catch((error) => console.error(error));
}

async function handleRegister(req, res) {
  const body = await readJson(req);
  try {
    const { user, accountToken } = createUserWithAccountToken({
      username: body.username,
      email: body.email,
      password: body.password,
      status: 'pending_email'
    }, emailVerificationPurpose, { ttlMinutes: 24 * 60 });
    const emailResult = await sendVerificationEmail(user, accountToken.token);
    return sendRegisterSuccess(req, res, user, emailResult);
  } catch (error) {
    if (isUniqueError(error)) return sendAuthError(req, res, 409, '用户名或邮箱已被注册。', '/register');
    return sendAuthError(req, res, 400, error.message || '注册失败。', '/register');
  }
}

async function handleResendVerification(req, res) {
  const body = await readJson(req);
  const user = getUserByLogin(body.email);
  if (user?.status === 'pending_email') {
    runBackground(createAndSendVerificationEmail(user));
  }
  return sendJson(res, 202, publicVerificationResendResponse());
}

async function handleForgotPassword(req, res) {
  const body = await readJson(req);
  const user = getUserByLogin(body.email);
  if (user) runBackground(createAndSendPasswordResetEmail(user));
  return sendJson(res, 202, publicForgotPasswordResponse());
}

async function handleResetPassword(req, res) {
  const body = await readJson(req);
  if (String(body.password || '').length < 8) return sendJson(res, 400, { error: '密码至少需要 8 位。' });
  const consumed = consumeAccountToken(body.token, passwordResetPurpose);
  if (!consumed) return sendJson(res, 400, { error: '重置链接无效或已过期。' });
  updateUser(consumed.userId, { password: body.password });
  return sendJson(res, 200, { message: '密码已重置，请使用新密码登录。' });
}

async function handleVerifyEmail(req, res, url) {
  if ((req.method || 'GET') !== 'GET') return sendJson(res, 404, { error: 'Not found.' });
  const token = String(url.searchParams.get('token') || '').trim();
  if (!token) return sendJson(res, 400, { error: '验证链接无效或已过期。' });
  const consumed = consumeAccountToken(token, emailVerificationPurpose);
  if (!consumed) return sendJson(res, 400, { error: '验证链接无效或已过期。' });
  const user = markUserEmailVerified(consumed.userId);
  if (!user) return sendJson(res, 400, { error: '验证链接无效或已过期。' });
  return sendJson(res, 200, {
    user,
    message: '邮箱验证成功，请等待管理员审核。'
  });
}

async function createAndSendVerificationEmail(user) {
  const settings = systemMailSettingsForSend();
  if (!systemMailConfigured(settings)) return { ok: false, message: '系统邮件未配置。' };
  invalidateAccountTokens(user.id, emailVerificationPurpose);
  const accountToken = createAccountToken(user.id, emailVerificationPurpose, { ttlMinutes: 24 * 60 });
  const result = await sendVerificationEmailWithSettings(user, accountToken.token, settings);
  if (!result.ok) invalidateAccountTokens(user.id, emailVerificationPurpose);
  return result;
}

async function createAndSendPasswordResetEmail(user) {
  const settings = systemMailSettingsForSend();
  if (!systemMailConfigured(settings)) return { ok: false, message: '系统邮件未配置。' };
  invalidateAccountTokens(user.id, passwordResetPurpose);
  const accountToken = createAccountToken(user.id, passwordResetPurpose, { ttlMinutes: 60 });
  const result = await sendSystemEmail(settings, buildPasswordResetEmail({
    appBaseUrl: settings.appBaseUrl,
    to: user.email,
    token: accountToken.token,
    fromEmail: settings.fromEmail,
    fromName: settings.fromName
  }));
  if (!result.ok) invalidateAccountTokens(user.id, passwordResetPurpose);
  return result;
}

async function sendVerificationEmail(user, token) {
  const settings = systemMailSettingsForSend();
  if (!systemMailConfigured(settings)) {
    return { ok: false, message: '系统邮件未配置。' };
  }
  return await sendVerificationEmailWithSettings(user, token, settings);
}

async function sendVerificationEmailWithSettings(user, token, settings) {
  return await sendSystemEmail(settings, buildVerificationEmail({
    appBaseUrl: settings.appBaseUrl,
    to: user.email,
    token,
    fromEmail: settings.fromEmail,
    fromName: settings.fromName
  }));
}

function systemMailConfigured(settings) {
  return Boolean(settings.host && extractAddress(settings.fromEmail));
}

function systemMailSettingsForSend() {
  return {
    ...getSystemEmailSettings({ includeSecret: true }),
    appBaseUrl: runtimeSettings().appBaseUrl
  };
}

function publicVerificationResendResponse() {
  return {
    message: '如果账号需要验证，我们会发送验证邮件。'
  };
}

function publicForgotPasswordResponse() {
  return {
    message: '如果邮箱存在，我们会发送密码重置邮件。'
  };
}

function verificationEmailResponse(result) {
  return {
    verificationEmailSent: Boolean(result.ok),
    message: result.ok ? '验证邮件已发送。' : '验证邮件暂未发送，请稍后重试或联系管理员。',
    result: {
      ok: Boolean(result.ok),
      message: result.message || '',
      queueId: result.queueId || ''
    }
  };
}

async function handleLogin(req, res) {
  const body = await readJson(req);
  const user = verifyUserCredentials(body.username || body.email, body.password);
  if (!user) return sendAuthError(req, res, 401, '账号或密码不正确。', '/login');
  if (user.status !== 'active') return sendAuthError(req, res, 403, loginStatusMessage(user.status), '/login');
  return sendAuthSuccess(req, res, 200, user);
}

function sendRegisterSuccess(req, res, user, emailResult = { ok: false }) {
  const message = emailResult.ok
    ? '注册成功，验证邮件已发送，请先验证邮箱，验证后等待管理员审核。'
    : '注册成功，请先验证邮箱；验证邮件暂未发送，请联系管理员或稍后重试。';
  if (wantsHtmlRedirect(req)) return redirect(res, `/login?error=${encodeURIComponent(message)}`, 303);
  return sendJson(res, 201, {
    user,
    message,
    verificationEmailSent: Boolean(emailResult.ok)
  });
}

function sendAuthSuccess(req, res, status, user) {
  const token = createSessionToken(user);
  const cookie = sessionCookie(token);
  if (wantsHtmlRedirect(req)) return redirect(res, '/', 303, { 'Set-Cookie': cookie });
  res.writeHead(status, {
    'Content-Type': 'application/json; charset=utf-8',
    'Set-Cookie': cookie
  });
  res.end(JSON.stringify({ user }));
}

function sendAuthError(req, res, status, message, fallbackPath) {
  if (wantsHtmlRedirect(req)) return redirect(res, `${fallbackPath}?error=${encodeURIComponent(message)}`, 303);
  return sendJson(res, status, { error: message });
}

function loginStatusMessage(status) {
  if (status === 'pending_email') return '请先验证邮箱。';
  if (status === 'pending_review') return '账号正在等待管理员审核。';
  if (status === 'disabled') return '账号已被禁用。';
  return '账号或密码不正确。';
}

function handleLogout(res) {
  res.writeHead(200, {
    'Content-Type': 'application/json; charset=utf-8',
    'Set-Cookie': 'mailhub_session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0'
  });
  res.end(JSON.stringify({ ok: true }));
}

function getRequestUser(req, pathname) {
  const sessionUser = getSessionUser(req);
  if (sessionUser) return sessionUser;
  const auth = req.headers.authorization || '';
  if (auth.startsWith('Basic ')) {
    const decoded = Buffer.from(auth.slice(6), 'base64').toString('utf8');
    const index = decoded.indexOf(':');
    const user = authenticateUser(decoded.slice(0, index), decoded.slice(index + 1));
    if (user) return user;
  }
  if (pathname === '/api/send' && auth.startsWith('Bearer ')) {
    const token = auth.slice(7);
    const user = verifyApiToken(token);
    if (user) return user;
    if (envConfig.legacyApiToken && safeEqual(token, envConfig.legacyApiToken)) return getAdminUser();
  }
  return null;
}

function getSessionUser(req) {
  const token = parseCookies(req.headers.cookie || '').mailhub_session;
  if (!token || !token.includes('.')) return null;
  const [payload, signature] = token.split('.');
  if (!payload || !signature || !safeEqual(signature, signSessionPayload(payload))) return null;
  try {
    const data = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
    if (Number(data.exp) <= Date.now()) return null;
    const user = getUser(Number(data.uid));
    return user?.status === 'active' ? user : null;
  } catch {
    return null;
  }
}

function createSessionToken(user) {
  const payload = Buffer.from(JSON.stringify({
    uid: user.id,
    exp: Date.now() + 12 * 60 * 60 * 1000,
    nonce: crypto.randomBytes(10).toString('hex')
  })).toString('base64url');
  return `${payload}.${signSessionPayload(payload)}`;
}

function signSessionPayload(payload) {
  return crypto.createHmac('sha256', envConfig.sessionSecret).update(payload).digest('base64url');
}

function sessionCookie(token) {
  return [`mailhub_session=${token}`, 'Path=/', 'HttpOnly', 'SameSite=Lax', 'Max-Age=43200'].join('; ');
}

function publicConfig(user) {
  const settings = runtimeSettings();
  const smtpCredential = getSmtpCredential(user.id);
  return {
    ...settings,
    smtpHost: envConfig.smtpHost ? 'configured' : '',
    submission: {
      enabled: envConfig.submissionEnabled,
      host: envConfig.submissionHost,
      ports: publicSubmissionListeners(envConfig.submissionListeners),
      username: smtpCredential?.username || '',
      passwordSet: Boolean(smtpCredential?.passwordSet),
      inboundEnabled: envConfig.inboundEnabled,
      tls: Boolean(envConfig.submissionTlsCert && envConfig.submissionTlsKey),
      requireTlsForAuth: !envConfig.submissionAllowInsecureAuth
    },
    apiTokenSet: Boolean(envConfig.legacyApiToken),
    usingDefaultAdminPassword: user.role === 'admin' && envConfig.adminPassword === 'change-this-admin-password'
  };
}

function runtimeSettings() {
  const settings = getSettings(defaultSettings);
  return {
    appBaseUrl: settings.appBaseUrl,
    mailHostname: settings.mailHostname,
    sendingIp: settings.sendingIp,
    defaultSpfMechanisms: settings.defaultSpfMechanisms,
    dmarcPolicy: normalizeDmarcPolicy(settings.dmarcPolicy),
    dmarcRua: settings.dmarcRua,
    sendRequiresVerified: String(settings.sendRequiresVerified).toLowerCase() === 'true',
    engagementTrackingEnabled: String(settings.engagementTrackingEnabled).toLowerCase() === 'true',
    listUnsubscribeMailto: settings.listUnsubscribeMailto,
    listUnsubscribeUrl: settings.listUnsubscribeUrl,
    listUnsubscribePostEnabled: String(settings.listUnsubscribePostEnabled).toLowerCase() === 'true',
    feedbackIdEnabled: String(settings.feedbackIdEnabled).toLowerCase() !== 'false',
    reportAbuseTo: settings.reportAbuseTo,
    csaComplaintsTo: settings.csaComplaintsTo,
    bounceAddress: settings.bounceAddress,
    bounceEnvelopeEnabled: String(settings.bounceEnvelopeEnabled).toLowerCase() === 'true'
  };
}

async function adminRuntimeSettings() {
  const settings = runtimeSettings();
  return {
    ...settings,
    systemChecks: await buildSystemDnsChecks(settings)
  };
}

async function serveStatic(req, res, url) {
  const publicDir = path.join(__dirname, '..', 'public');
  const pathname = decodeURIComponent(resolveStaticPathname(url.pathname));
  const filePath = path.normalize(path.join(publicDir, pathname));
  if (!filePath.startsWith(publicDir) || !existsSync(filePath) || statSync(filePath).isDirectory()) {
    return sendStaticFile(res, path.join(publicDir, 'index.html'), { noStore: true });
  }
  const noStore = path.extname(filePath) === '.html';
  return sendStaticFile(res, filePath, { noStore });
}

async function sendStaticFile(res, filePath, { noStore = false } = {}) {
  const ext = path.extname(filePath);
  const contentType = {
    '.html': 'text/html; charset=utf-8',
    '.css': 'text/css; charset=utf-8',
    '.js': 'application/javascript; charset=utf-8',
    '.json': 'application/json; charset=utf-8',
    '.svg': 'image/svg+xml'
  }[ext] || 'application/octet-stream';
  const headers = { 'Content-Type': contentType };
  if (noStore || ext === '.html') {
    headers['Cache-Control'] = 'private, no-store';
  }
  res.writeHead(200, headers);
  res.end(await readFile(filePath));
}

async function readJson(req) {
  const chunks = [];
  for await (const chunk of req) chunks.push(chunk);
  if (!chunks.length) return {};
  const raw = Buffer.concat(chunks).toString('utf8');
  const contentType = String(req.headers['content-type'] || '').toLowerCase();
  if (contentType.includes('application/x-www-form-urlencoded')) {
    return Object.fromEntries(new URLSearchParams(raw).entries());
  }
  return JSON.parse(raw);
}

const trackingPixel = Buffer.from(
  'R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7',
  'base64'
);

async function handleTrackingRequest(req, res, url) {
  const openMatch = url.pathname.match(/^\/t\/o\/([A-Za-z0-9_-]{20,128})\.gif$/);
  if (openMatch) {
    if (!['GET', 'HEAD'].includes(req.method)) return sendTrackingStatus(res, 405, 'Method not allowed.');
    if (req.method === 'GET') {
      const sendEvent = findSendEventByTrackingToken(openMatch[1]);
      if (sendEvent?.tracking?.opens) {
        recordPublicTrackingEvent(req, {
          sendEvent,
          eventType: 'open'
        });
      }
    }
    return sendTrackingPixel(res, req.method === 'HEAD');
  }
  if (url.pathname.startsWith('/t/o/')) {
    if (!['GET', 'HEAD'].includes(req.method)) return sendTrackingStatus(res, 405, 'Method not allowed.');
    return sendTrackingPixel(res, req.method === 'HEAD');
  }

  const clickMatch = url.pathname.match(/^\/t\/c\/([A-Za-z0-9_-]{20,128})$/);
  if (!clickMatch) {
    if (url.pathname.startsWith('/t/c/')) return sendTrackingStatus(res, 404, 'Not found.');
    return false;
  }
  if (req.method !== 'GET') return sendTrackingStatus(res, 405, 'Method not allowed.');
  const link = findTrackingLinkByToken(clickMatch[1]);
  if (!link?.trackingClicks) return sendTrackingStatus(res, 404, 'Not found.');
  let target;
  try {
    target = decryptTrackingTarget(link.targetCiphertext, envConfig.trackingSecret);
  } catch {
    return sendTrackingStatus(res, 410, 'Link is no longer available.');
  }
  recordPublicTrackingEvent(req, {
    sendEvent: {
      id: link.sendEventId,
      userId: link.userId
    },
    eventType: 'click',
    trackingLinkId: link.id
  });
  res.writeHead(302, {
    Location: target,
    'Cache-Control': 'private, no-store, no-cache, max-age=0',
    Pragma: 'no-cache',
    'Referrer-Policy': 'no-referrer'
  });
  res.end();
  return true;
}

function recordPublicTrackingEvent(req, { sendEvent, eventType, trackingLinkId = null }) {
  const occurredAt = new Date().toISOString();
  const userAgent = String(req.headers['user-agent'] || '').slice(0, 500);
  const source = classifyTrackingSource(userAgent);
  const ipHash = hashTrackingClientIp({
    ip: requestClientIp(req),
    secret: envConfig.trackingSecret,
    userId: sendEvent.userId,
    sendEventId: sendEvent.id,
    occurredAt
  });
  const replayKey = trackingReplayKey({
    secret: envConfig.trackingSecret,
    sendEventId: sendEvent.id,
    eventType,
    trackingLinkId,
    ipHash,
    userAgent,
    occurredAt
  });
  try {
    recordTrackingEvent({
      sendEventId: sendEvent.id,
      trackingLinkId,
      eventType,
      source,
      occurredAt,
      userAgent,
      ipHash,
      replayKey
    });
  } catch (error) {
    console.warn(`Tracking event could not be recorded: ${error.message}`);
  }
}

function requestClientIp(req) {
  if (envConfig.trustProxy) {
    const forwarded = String(req.headers['x-forwarded-for'] || '').split(',')[0].trim();
    if (forwarded) return forwarded;
  }
  return req.socket?.remoteAddress || '';
}

function sendTrackingPixel(res, headOnly = false) {
  res.writeHead(200, {
    'Content-Type': 'image/gif',
    'Content-Length': String(trackingPixel.length),
    'Cache-Control': 'private, no-store, no-cache, max-age=0',
    Pragma: 'no-cache',
    Expires: '0',
    'Referrer-Policy': 'no-referrer'
  });
  res.end(headOnly ? undefined : trackingPixel);
  return true;
}

function sendTrackingStatus(res, status, message) {
  res.writeHead(status, {
    'Content-Type': 'text/plain; charset=utf-8',
    'Cache-Control': 'private, no-store, no-cache, max-age=0',
    Pragma: 'no-cache',
    'Referrer-Policy': 'no-referrer'
  });
  res.end(message);
  return true;
}

function sendJson(res, status, payload) {
  res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8' });
  res.end(JSON.stringify(payload));
}

function redirect(res, location, status = 302, headers = {}) {
  res.writeHead(status, { ...headers, Location: location });
  res.end();
}

function wantsHtmlRedirect(req) {
  const contentType = String(req.headers['content-type'] || '').toLowerCase();
  const accept = String(req.headers.accept || '').toLowerCase();
  return contentType.includes('application/x-www-form-urlencoded') && accept.includes('text/html');
}

function setSecurityHeaders(res) {
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('X-Frame-Options', 'DENY');
  res.setHeader('Referrer-Policy', 'same-origin');
}

function handleOptions(res) {
  res.writeHead(204, {
    'Access-Control-Allow-Origin': '*',
    'Access-Control-Allow-Methods': 'GET,POST,PUT,PATCH,DELETE,OPTIONS',
    'Access-Control-Allow-Headers': 'Content-Type, Authorization'
  });
  res.end();
}

function parseCookies(header) {
  const cookies = {};
  for (const part of String(header || '').split(';')) {
    const index = part.indexOf('=');
    if (index === -1) continue;
    cookies[part.slice(0, index).trim()] = part.slice(index + 1).trim();
  }
  return cookies;
}

function safeEqual(actual, expected) {
  const a = Buffer.from(String(actual || ''));
  const b = Buffer.from(String(expected || ''));
  if (a.length !== b.length) return false;
  return crypto.timingSafeEqual(a, b);
}

function normalizeDomain(input) {
  const raw = String(input || '').trim().toLowerCase().replace(/^https?:\/\//, '').replace(/\/.*$/, '').replace(/\.$/, '');
  const ascii = domainToASCII(raw);
  if (!ascii || ascii.length > 253) return '';
  if (!/^(?!-)(?:[a-z0-9-]{1,63}\.)+[a-z]{2,63}$/.test(ascii)) return '';
  return ascii;
}

function normalizeHostname(input) {
  return normalizeDomain(input) || String(input || '').trim().toLowerCase();
}

function normalizeSelector(input) {
  const value = String(input || '').trim().toLowerCase();
  return /^[a-z0-9][a-z0-9-]{0,62}$/.test(value) ? value : '';
}

function normalizeDmarcPolicy(input) {
  const value = String(input || '').trim().toLowerCase();
  return ['none', 'quarantine', 'reject'].includes(value) ? value : 'none';
}

function smtpRelayPatch(body) {
  const patch = {};
  for (const key of ['name', 'host', 'port', 'secure', 'username', 'password', 'helo', 'isDefault']) {
    if (Object.hasOwn(body, key)) patch[key] = body[key];
  }
  return patch;
}

function settingsPatchFromBody(body) {
  const patch = {};
  for (const key of [
    'appBaseUrl',
    'mailHostname',
    'sendingIp',
    'defaultSpfMechanisms',
    'dmarcRua',
    'listUnsubscribeMailto',
    'listUnsubscribeUrl',
    'reportAbuseTo',
    'csaComplaintsTo',
    'bounceAddress'
  ]) {
    if (Object.hasOwn(body, key)) patch[key] = body[key];
  }
  if (Object.hasOwn(body, 'dmarcPolicy')) patch.dmarcPolicy = normalizeDmarcPolicy(body.dmarcPolicy);
  if (Object.hasOwn(body, 'sendRequiresVerified')) patch.sendRequiresVerified = boolString(body.sendRequiresVerified);
  if (Object.hasOwn(body, 'engagementTrackingEnabled')) {
    patch.engagementTrackingEnabled = boolString(body.engagementTrackingEnabled);
  }
  if (Object.hasOwn(body, 'listUnsubscribePostEnabled')) {
    patch.listUnsubscribePostEnabled = boolString(body.listUnsubscribePostEnabled);
  }
  if (Object.hasOwn(body, 'feedbackIdEnabled')) {
    patch.feedbackIdEnabled = boolString(body.feedbackIdEnabled);
  }
  if (Object.hasOwn(body, 'bounceEnvelopeEnabled')) {
    patch.bounceEnvelopeEnabled = boolString(body.bounceEnvelopeEnabled);
  }
  return patch;
}

function boolString(value) {
  return String(value).toLowerCase() === 'true' || value === true ? 'true' : 'false';
}

function defaultSelector() {
  const d = new Date();
  return `mh${d.getUTCFullYear()}${String(d.getUTCMonth() + 1).padStart(2, '0')}`;
}

async function buildDnsGuideAfterApply(domain, applyResult) {
  const appliedKeys = new Set((applyResult.results || [])
    .filter((result) => result.ok && !result.skipped)
    .map((result) => result.key));
  let guide = await buildDnsGuide(domain);
  for (let attempt = 0; attempt < 2 && hasUnpropagatedAppliedRecords(guide, appliedKeys); attempt += 1) {
    await sleep(1800);
    guide = await buildDnsGuide(domain);
  }
  return markUnpropagatedAppliedRecords(guide, appliedKeys);
}

function hasUnpropagatedAppliedRecords(guide, appliedKeys) {
  return (guide.records || []).some((record) => appliedKeys.has(record.key) && record.status !== 'ok');
}

function markUnpropagatedAppliedRecords(guide, appliedKeys) {
  const records = (guide.records || []).map((record) => {
    if (!appliedKeys.has(record.key) || record.status === 'ok') return record;
    return {
      ...record,
      status: 'pending',
      warnings: [
        ...(record.warnings || []),
        '已提交到 DNS 服务商，正在等待公共 DNS 传播；稍后点击“立即检查”刷新。'
      ]
    };
  });
  return {
    ...guide,
    records,
    warnings: collectGuideWarnings(records)
  };
}

function collectGuideWarnings(records) {
  return records.flatMap((record) => record.warnings || []);
}

function sleep(ms) {
  return new Promise((resolve) => setTimeout(resolve, ms));
}

function isUniqueError(error) {
  return /UNIQUE constraint failed/i.test(String(error?.message || ''));
}

function isLoginAsset(pathname) {
  return pathname.startsWith('/assets/')
    || [
      '/login',
      '/register',
      '/forgot-password',
      '/resend-verification',
      '/reset-password',
      '/login.html',
      '/login.css',
      '/login.js',
      '/landing.html'
    ].includes(pathname);
}

function resolveStaticPathname(pathname) {
  if (pathname === '/') return '/landing.html';
  if (['/login', '/register', '/forgot-password', '/resend-verification', '/reset-password'].includes(pathname)) return '/login.html';
  return pathname;
}

function loadDotEnv() {
  const file = path.join(process.cwd(), '.env');
  if (!existsSync(file)) return;
  const lines = readFileSync(file, 'utf8').split(/\r?\n/);
  for (const line of lines) {
    const trimmed = line.trim();
    if (!trimmed || trimmed.startsWith('#')) continue;
    const index = trimmed.indexOf('=');
    if (index === -1) continue;
    const key = trimmed.slice(0, index).trim();
    let value = trimmed.slice(index + 1).trim();
    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
    if (!(key in process.env)) process.env[key] = value;
  }
}