Merge pull request 'Port cron-minutely fixes: reactivate tombstoned subs + confirm-email rate limit' (#29) from mailship-fc-merge-cron-fixes-df6 into main

Reviewed-on: #29
Reviewed-by: matt <matt@lorentz.is>

.beads/.gitignore

@@ -71,6 +71,10 @@ backup/
 *.db-shm
 db.sqlite
 bd.db
+
+# Interactions log (runtime, not versioned)
+interactions.jsonl
+
 # NOTE: Do NOT add negation patterns here.
 # They would override fork protection in .git/info/exclude.
 # Config files (metadata.json, config.yaml) are tracked by git by default

.forgejo/workflows/docker-publish.yml

@@ -0,0 +1,36 @@
+# Forgejo Action — build + publish Docker image to Forgejo container registry on merge to main
+---
+name: Docker
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  docker:
+    runs-on: docker-builder
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Forgejo Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: forgejo.lorentz.is
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: |
+            forgejo.lorentz.is/matt/mailship:${{ github.sha }}
+            forgejo.lorentz.is/matt/mailship:latest

Dockerfile

@@ -52,6 +52,12 @@ COPY --from=build /app/src/emails/ ./dist/emails/
 # Create data directory for SQLite
 RUN mkdir -p /data
 
+# Create non-root user for security hardening
+RUN addgroup -S app && adduser -S -G app app
+RUN chown -R app:app /data
+
+USER app
+
 EXPOSE 4738
 
 ENV NODE_ENV=production

README.md

@@ -1,6 +1,8 @@
 # Mailship
 
-A Nostr email notification server. Receives events pushed from relays via NIP-9a, stores them, and sends daily or weekly digest emails.
+A Nostr email notification server. Receives events pushed from relays via [NIP-9a](https://github.com/nostr-protocol/nips/pull/2194), stores them, and sends daily or weekly digest emails.
+
+This repo is a fork of [anchor](https://github.com/coracle-social/anchor). It has been built primarily to support email notifications in [Flotilla](https://flotilla.social), but supports alternate branding and could be set up to work with any Nostr relay supporting NIP-9a.
 
 ## Architecture
 
@@ -49,15 +51,30 @@ Flotilla ──HTTP──▶ Mailship (PUT /subscription/email)
 ### PUT /subscription/email
 Idempotently register or update an email subscription. Re-sends the confirmation
 email only when the subscription is new or the email address changed; a frequency
-change keeps the existing confirmation. The pubkey is extracted from the NIP-98
+or schedule change keeps the existing confirmation. The pubkey is extracted from
-Authorization header — the body does not include a `pubkey` field.
+the NIP-98 Authorization header — the body does not include a `pubkey` field.
 
 ```
-Body: { email, frequency }
+Body: { email, frequency, hour?, minute?, dayOfWeek?, timezone? }
 Auth: NIP-98 (Nostr <base64> Authorization header)
 Response: { key, callback }
 ```
 
+**Optional schedule fields (defaults: `hour=17`, `minute=0`, `timezone="UTC"`):**
+
+| Field | Type | Constraints | Default |
+|---|---|---|---|
+| `hour` | integer | 0–23 | `17` |
+| `minute` | integer | 0–59 | `0` |
+| `dayOfWeek` | integer | 1=Mon … 7=Sun (0 also accepted as Sun); only valid when `frequency="weekly"` | `1` (Monday) for weekly, omitted for daily |
+| `timezone` | string | IANA timezone name, e.g. `"America/New_York"` | `"UTC"` |
+
+When omitted, each field falls back to its default. `dayOfWeek` is silently
+ignored for daily frequency (the stored value is `NULL`).
+
+**DOW convention:** `dayOfWeek` follows cron: 1=Monday, 2=Tuesday, …, 7=Sunday.
+`0` is also accepted as Sunday (standard cron alias).
+
 ### GET /subscription/email
 Look up an existing subscription for the authenticated pubkey, so clients can
 avoid re-registering (and re-confirming) when settings haven't changed.
@@ -65,7 +82,7 @@ Returns 404 if none exists.
 
 ```
 Auth: NIP-98 (Nostr <base64> Authorization header)
-Response: { key, callback, email, frequency, confirmed }
+Response: { key, callback, email, frequency, hour, minute, dayOfWeek, timezone, confirmed }
 ```
 
 ### DELETE /subscription/:key
@@ -77,17 +94,30 @@ Response: { ok: true }
 ```
 
 ### POST /notify/:id
-NIP-9a relay push callback. Called by relays or NPB when matching events are found.
+[NIP-9a](https://github.com/nostr-protocol/nips/pull/2194) relay push callback. Called by relays or NPB when matching events are found.
 
 ```
-Body: { id, relay }
+Body: { id, relay, event? }
 Response: { ok: true, stored: boolean }
 Returns 404 if subscription not found or inactive.
 ```
 
-When the event is not found at the relay (e.g. it was deleted or never arrived),
+The optional `event` field supports NIP-98 `include_event` — relays can embed
-the endpoint returns `{ ok: true, stored: false }` — the event is silently skipped
+the full event inline to bypass fetching. When `event` is provided:
-rather than erroring. The `stored` field is always present in a 200 response.
+
+- `event.id` must match the `id` string, **and** the event signature must be
+  cryptographically valid (`verifyEvent` from nostr-tools).
+- If either check fails, the endpoint returns **400** `{ error: 'Invalid event' }`.
+
+When `event` is omitted, the server fetches the event from the relay using
+`id` and `relay`. If the relay has no matching event (deleted, expired, or
+never published), the endpoint returns `{ ok: true, stored: false }` — the
+event is silently skipped rather than erroring.
+
+After obtaining the event (from body or relay), it is stored in the local
+database. If the event is already known (deduplication), `stored` is `false`;
+otherwise `stored` is `true`. The `stored` field is always present in a 200
+response.
 
 ### GET /confirm?token=...
 Confirm email address via link from confirmation email.
@@ -97,6 +127,11 @@ Unsubscribe via link from digest email.
 
 ## Development
 
+**Requirements:** Node >= 22
+
+> **Single instance:** Mailship uses in-process cron jobs for digest scheduling.
+> Running more than one instance concurrently may cause duplicate or missed emails.
+
 ```sh
 pnpm install
 pnpm run build
@@ -141,7 +176,3 @@ pnpm test:unit       # Run unit tests (vitest)
 pnpm test            # Run integration tests (bash E2E)
 pnpm test:server     # Start server for manual testing
 ```
-
-## Forked from Anchor
-
-Mailship is a fork of [Anchor](https://github.com/coracle-social/anchor), stripped of push notification support and adapted for NIP-9a relay push event intake.

build-in-production.sh

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-# Remove link overrides
-node remove-pnpm-overrides.js package.json
-
-# When CI=true as it is on render.com, removing link overrides breaks the lockfile
-pnpm i --no-frozen-lockfile
-
-# Build everything
-pnpm run build

package.json

@@ -18,9 +18,9 @@
     "@eslint/js": "^9.35.0",
     "@types/better-sqlite3": "^7.6.13",
     "@types/express": "^5.0.3",
-    "@types/express-ws": "^3.0.5",
     "@types/mjml": "^4.7.4",
     "@types/mustache": "^4.2.6",
+    "@types/node": "^22.18.1",
     "@types/nodemailer": "^8.0.1",
     "@types/sanitize-html": "^2.16.0",
     "@types/ws": "^8.18.1",
@@ -34,7 +34,6 @@
     "vitest": "^5.0.0"
   },
   "dependencies": {
-    "@types/node": "^22.18.1",
     "@welshman/content": "^0.6.3",
     "@welshman/feeds": "^0.6.3",
     "@welshman/lib": "^0.6.3",
@@ -43,13 +42,11 @@
     "@welshman/signer": "^0.6.3",
     "@welshman/store": "^0.6.3",
     "@welshman/util": "^0.6.3",
-    "bcrypt": "^5.1.1",
     "cron": "^4.3.3",
     "cron-parser": "^5.3.1",
     "dotenv": "^16.6.1",
     "express": "^4.21.2",
     "express-rate-limit": "^7.5.1",
-    "express-ws": "^5.0.2",
     "localstorage-polyfill": "^1.0.1",
     "mjml": "^4.15.3",
     "mustache": "^4.2.0",
@@ -58,12 +55,10 @@
     "sanitize-html": "^2.17.0",
     "sqlite3": "^5.1.7",
     "succinct-async": "^1.0.4",
-    "ts-node-dev": "^2.0.0",
     "ws": "^8.18.3"
   },
   "pnpm": {
     "onlyBuiltDependencies": [
-      "bcrypt",
       "sqlite3"
     ]
   }

script/render-preview.mjs

@@ -24,8 +24,7 @@ const sample = {
       Icon: 'https://i.pravatar.cc/150?img=32',
       Name: 'carol',
       Content: '<p>Does anyone know how relay-based groups work?</p>',
-      Replies: 5,
+      RelayUrl: 'relay.damus.io',
-      Reactions: 8,
     },
     {
       Link: 'https://app.flotilla.social/spaces/nos.lol/community?at=1700000000',
@@ -34,8 +33,7 @@ const sample = {
       Name: 'bob',
       Content:
         '<p>Excited to share our new community space on Flotilla! <a href="https://flotilla.social">Check it out</a>.</p>',
-      Replies: 14,
+      RelayUrl: 'nos.lol',
-      Reactions: 32,
     },
   ],
   unsubscribeUrl: 'https://app.flotilla.social/unsubscribe?token=abc123',

src/actions.ts

@@ -13,17 +13,36 @@ export type RegisterSubscriptionParams = {
   pubkey: string
   email: string
   frequency: string
+  hour?: number
+  minute?: number
+  dayOfWeek?: number
+  timezone?: string
 }
 
+// Floor on how often a confirmation email can be sent for the same subscription.
+// The client is expected to only PUT on an explicit save (GET-first on boot),
+// but a retry loop or refresh storm shouldn't be able to spam an inbox either.
+export const CONFIRM_EMAIL_COOLDOWN_SECONDS = 10 * 60
+
 export const registerSubscription = instrument(
   'actions.registerSubscription',
-  async ({ pubkey, email, frequency }: RegisterSubscriptionParams) => {
+  async ({ pubkey, email, frequency, hour, minute, dayOfWeek, timezone }: RegisterSubscriptionParams) => {
-    const sub = await db.insertSubscription(pubkey, email, frequency)
+    const sub = await db.insertSubscription(pubkey, email, frequency, hour, minute, dayOfWeek, timezone)
     const callback = `${process.env.BASE_URL}/notify/${sub.id}`
 
     if (!sub.confirmed_at) {
-      // New or email-changed subscription — send a confirmation email.
+      // New or email-changed subscription — send a confirmation email, but never
+      // more than once per cooldown window. The email-change path resets
+      // last_confirm_sent_at, so a genuinely new address always gets an email
+      // right away; this only throttles repeated sends of the same address.
+      const lastSent = sub.last_confirm_sent_at
+      const cooldownElapsed =
+        !lastSent || Math.floor(Date.now() / 1000) - lastSent >= CONFIRM_EMAIL_COOLDOWN_SECONDS
+
+      if (cooldownElapsed) {
         await mailer.sendConfirm(sub)
+        await db.markConfirmSent(sub.id)
+      }
     } else {
       // Already confirmed (e.g. frequency-only change) — reschedule the
       // cron job so it uses the new cadence immediately.
@@ -41,13 +60,19 @@ export type ConfirmSubscriptionParams = {
 export const confirmSubscriptionAction = instrument(
   'actions.confirmSubscription',
   async ({ token }: ConfirmSubscriptionParams) => {
-    const sub = await db.confirmSubscription(token)
+    const result = await db.confirmSubscription(token)
 
-    if (!sub) {
+    if (!result) {
       throw new ActionError('That confirmation code is invalid or has expired.')
     }
 
-    worker.registerSubscription(sub)
+    // Only register the cron job when this is a fresh confirmation.
+    // If already confirmed, the job is already running.
+    if (!result.alreadyConfirmed) {
+      worker.registerSubscription(result.sub)
+    }
+
+    return result
   },
 )
 

src/alert.ts

@@ -4,10 +4,15 @@ export type Subscription = {
   pubkey: string
   email: string
   frequency: string
+  hour: number
+  minute: number
+  day_of_week?: number
+  timezone: string
   created_at: number
   confirmed_at?: number
   unsubscribed_at?: number
   last_digest_at?: number
+  last_confirm_sent_at?: number
 }
 
 export const getSubscriptionError = (sub: Subscription) => {
@@ -19,14 +24,39 @@ export const getSubscriptionError = (sub: Subscription) => {
     return 'Frequency must be "daily" or "weekly"'
   }
 
-  // Daily: fire at 17:00 UTC. Weekly: fire Monday at 17:00 UTC.
+  if (sub.hour < 0 || sub.hour > 23 || !Number.isInteger(sub.hour)) {
-  // Validation: just ensure frequency is valid, cron is generated internally.
+    return 'Hour must be an integer between 0 and 23'
+  }
+
+  if (sub.minute < 0 || sub.minute > 59 || !Number.isInteger(sub.minute)) {
+    return 'Minute must be an integer between 0 and 59'
+  }
+
+  if (sub.frequency === 'weekly') {
+    if (sub.day_of_week === undefined || sub.day_of_week === null) {
+      return 'dayOfWeek is required for weekly frequency'
+    }
+    const dow = sub.day_of_week
+    if (dow < 0 || dow > 7 || !Number.isInteger(dow)) {
+      return 'dayOfWeek must be an integer between 0 and 7 (1=Mon, 7=Sun, 0=Sun)'
+    }
+  }
+
+  if (!sub.timezone || typeof sub.timezone !== 'string') {
+    return 'A valid IANA timezone is required'
+  }
+
+  try {
+    Intl.DateTimeFormat(undefined, { timeZone: sub.timezone })
+  } catch {
+    return `"${sub.timezone}" is not a valid IANA timezone`
+  }
 }
 
-export const getCronExpression = (frequency: string, hour = 17, minute = 0) => {
+export const getCronExpression = (frequency: string, hour = 17, minute = 0, dayOfWeek?: number) => {
   if (frequency === 'daily') {
     return `0 ${minute} ${hour} * * *`
   }
-  // Weekly on Monday
+  // Weekly: default to Monday (1) when not specified
-  return `0 ${minute} ${hour} * * 1`
+  return `0 ${minute} ${hour} * * ${dayOfWeek ?? 1}`
 }

src/database.ts

@@ -9,7 +9,7 @@ import type { Subscription } from './alert.js'
 const DATA_DIR = process.env.DATA_DIR || '.'
 const db = new sqlite3.Database(DATA_DIR + '/mailship.db')
 
-type Param = number | string | boolean
+type Param = number | string | boolean | null | undefined
 
 type Row = Record<string, any>
 
@@ -58,10 +58,15 @@ export const migrate = () =>
             pubkey TEXT NOT NULL,
             email TEXT NOT NULL,
             frequency TEXT NOT NULL DEFAULT 'daily',
+            hour INTEGER NOT NULL DEFAULT 17,
+            minute INTEGER NOT NULL DEFAULT 0,
+            day_of_week INTEGER,
+            timezone TEXT NOT NULL DEFAULT 'UTC',
             created_at INTEGER NOT NULL,
             confirmed_at INTEGER,
             unsubscribed_at INTEGER,
-            last_digest_at INTEGER
+            last_digest_at INTEGER,
+            last_confirm_sent_at INTEGER
           )
         `
         )
@@ -77,6 +82,14 @@ export const migrate = () =>
           )
         `
         )
+        // Add last_confirm_sent_at for existing databases created before the
+        // confirmation-email cooldown migration.
+        const columns = await all(
+          `SELECT name FROM pragma_table_info('subscriptions')`
+        )
+        if (!columns.some((c: any) => c.name === 'last_confirm_sent_at')) {
+          await run(`ALTER TABLE subscriptions ADD COLUMN last_confirm_sent_at INTEGER`)
+        }
         await run(
           `CREATE INDEX IF NOT EXISTS idx_events_subscription_received ON events (subscription_id, received_at)`
         )
@@ -108,6 +121,20 @@ export const migrate = () =>
             WHERE unsubscribed_at IS NULL
         `
         )
+
+        // Idempotent migration: add schedule columns to existing databases.
+        // ALTER TABLE ADD COLUMN fails if the column already exists, so we
+        // run each one and ignore "duplicate column" errors.
+        const addCol = (colDef: string) =>
+          run(`ALTER TABLE subscriptions ADD COLUMN ${colDef}`).catch((err: any) => {
+            if (!err?.message?.includes('duplicate column')) throw err
+          })
+
+        await addCol('hour INTEGER NOT NULL DEFAULT 17')
+        await addCol('minute INTEGER NOT NULL DEFAULT 0')
+        await addCol('day_of_week INTEGER')
+        await addCol("timezone TEXT NOT NULL DEFAULT 'UTC'")
+
         resolve()
       })
     } catch (err) {
@@ -125,54 +152,122 @@ const parseSubscription = (row: any): Subscription | undefined => {
 
 export const updateSubscription = instrument(
   'database.updateSubscription',
-  async (existing: Subscription, email: string, frequency: string) => {
+  async (existing: Subscription, email: string, frequency: string, hour?: number, minute?: number, dayOfWeek?: number, timezone?: string) => {
-    if (existing.email === email && existing.frequency === frequency) {
+    const scheduleChanged =
+      (hour !== undefined && hour !== existing.hour) ||
+      (minute !== undefined && minute !== existing.minute) ||
+      (dayOfWeek !== undefined && dayOfWeek !== existing.day_of_week) ||
+      (timezone !== undefined && timezone !== existing.timezone)
+
+    if (existing.email === email && existing.frequency === frequency && !scheduleChanged) {
       return existing
     }
 
+    const hr = hour ?? existing.hour
+    const mn = minute ?? existing.minute
+    const dow = dayOfWeek ?? existing.day_of_week
+    const tz = timezone ?? existing.timezone
+
     // Update by id, not pubkey, so tombstoned rows for the same account are never
     // re-activated alongside this one (the unique index would reject that anyway).
     if (existing.email === email) {
       return parseSubscription(
         await get(
-          `UPDATE subscriptions SET frequency = ?, unsubscribed_at = NULL
+          `UPDATE subscriptions SET frequency = ?, hour = ?, minute = ?, day_of_week = ?, timezone = ?, unsubscribed_at = NULL
            WHERE id = ? RETURNING *`,
-          [frequency, existing.id]
+          [frequency, hr, mn, dow, tz, existing.id]
         )
       )
     }
 
+    // Address changed: it's a new inbox to verify, so reset the confirm-email
+    // cooldown or the new address would inherit the old one's lockout.
     return parseSubscription(
       await get(
-        `UPDATE subscriptions SET email = ?, frequency = ?, confirmed_at = NULL, unsubscribed_at = NULL
+        `UPDATE subscriptions SET email = ?, frequency = ?, hour = ?, minute = ?, day_of_week = ?, timezone = ?, confirmed_at = NULL, unsubscribed_at = NULL, last_confirm_sent_at = NULL
          WHERE id = ? RETURNING *`,
-        [email, frequency, existing.id]
+        [email, frequency, hr, mn, dow, tz, existing.id]
       )
     )
   }
 )
 
+// Record that a confirmation email was sent, for the send-cooldown.
+export const markConfirmSent = instrument(
+  'database.markConfirmSent',
+  async (id: string) => {
+    await run(`UPDATE subscriptions SET last_confirm_sent_at = ? WHERE id = ?`, [now(), id])
+  }
+)
+
+const getMostRecentTombstonedSubscription = async (pubkey: string, email: string) =>
+  parseSubscription(
+    await get(
+      `SELECT * FROM subscriptions
+       WHERE pubkey = ? AND email = ? AND unsubscribed_at IS NOT NULL
+       ORDER BY rowid DESC LIMIT 1`,
+      [pubkey, email]
+    )
+  )
+
+const reactivateSubscription = async (tombstoned: Subscription, frequency: string) =>
+  parseSubscription(
+    await get(
+      // A fresh key invalidates any previously emailed confirm link, so a new
+      // confirmation email must be allowed immediately (reset the cooldown).
+      `UPDATE subscriptions SET key = ?, frequency = ?, unsubscribed_at = NULL, last_confirm_sent_at = NULL
+       WHERE id = ? RETURNING *`,
+      [crypto.randomBytes(32).toString('hex'), frequency, tombstoned.id]
+    )
+  )
+
 export const insertSubscription = instrument(
   'database.insertSubscription',
-  async (pubkey: string, email: string, frequency: string) => {
+  async (pubkey: string, email: string, frequency: string, hour?: number, minute?: number, dayOfWeek?: number, timezone?: string) => {
     const existing = await getSubscriptionByPubkey(pubkey)
 
     if (existing) {
-      return assertResult(await updateSubscription(existing, email, frequency))
+      return assertResult(await updateSubscription(existing, email, frequency, hour, minute, dayOfWeek, timezone))
+    }
+
+    // No active row. If this account previously subscribed to this email and
+    // was unsubscribed, reactivate the most recent such row instead of inserting
+    // a fresh one. Otherwise every turn-on → turn-off → turn-on cycle would
+    // create a new row, abandoning the confirmed state (and the already-known key).
+    const tombstoned = await getMostRecentTombstonedSubscription(pubkey, email)
+
+    if (tombstoned) {
+      try {
+        return assertResult(await reactivateSubscription(tombstoned, frequency))
+      } catch (err: any) {
+        if (err.message?.includes('UNIQUE constraint')) {
+          const concurrent = await getSubscriptionByPubkey(pubkey)
+
+          if (concurrent) {
+            return assertResult(await updateSubscription(concurrent, email, frequency))
+          }
+        }
+
+        throw err
+      }
     }
 
     try {
       return assertResult(
         parseSubscription(
           await get(
-            `INSERT INTO subscriptions (id, key, pubkey, email, frequency, created_at)
+            `INSERT INTO subscriptions (id, key, pubkey, email, frequency, hour, minute, day_of_week, timezone, created_at)
-             VALUES (?, ?, ?, ?, ?, ?) RETURNING *`,
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`,
             [
               crypto.randomUUID(),
               crypto.randomBytes(32).toString('hex'),
               pubkey,
               email,
               frequency,
+              hour ?? 17,
+              minute ?? 0,
+              dayOfWeek ?? null,
+              timezone ?? 'UTC',
               now(),
             ]
           )
@@ -186,7 +281,7 @@ export const insertSubscription = instrument(
         const concurrent = await getSubscriptionByPubkey(pubkey)
 
         if (concurrent) {
-          return assertResult(await updateSubscription(concurrent, email, frequency))
+          return assertResult(await updateSubscription(concurrent, email, frequency, hour, minute, dayOfWeek, timezone))
         }
       }
 
@@ -195,16 +290,37 @@ export const insertSubscription = instrument(
   }
 )
 
+export type ConfirmResult = {
+  sub: Subscription
+  alreadyConfirmed: boolean
+}
+
 export const confirmSubscription = instrument(
   'database.confirmSubscription',
-  async (key: string) => {
+  async (key: string): Promise<ConfirmResult | undefined> => {
-    return parseSubscription(
+    // Try to update an unconfirmed, active row
+    const updated = parseSubscription(
       await get(
         `UPDATE subscriptions SET confirmed_at = unixepoch()
          WHERE key = ? AND confirmed_at IS NULL AND unsubscribed_at IS NULL RETURNING *`,
         [key]
       )
     )
+
+    if (updated) {
+      return { sub: updated, alreadyConfirmed: false }
+    }
+
+    // No unconfirmed row was updated. Check if the key exists and is
+    // already confirmed — the user is re-clicking a used link. If the row
+    // is unsubscribed, treat it as invalid (expired).
+    const existing = await getSubscriptionByKey(key)
+
+    if (!existing || existing.unsubscribed_at) {
+      return undefined
+    }
+
+    return { sub: existing, alreadyConfirmed: true }
   }
 )
 
@@ -255,6 +371,20 @@ export const getActiveSubscriptions = instrument('database.getActiveSubscription
   return rows.map(parseSubscription) as Subscription[]
 })
 
+// Every row ever created for a pubkey — both active and tombstoned. Exposed
+// primarily for tests asserting re-subscribe never grows the table.
+export const getAllSubscriptionsByPubkey = instrument(
+  'database.getAllSubscriptionsByPubkey',
+  async (pubkey: string) => {
+    const rows = await all<Row>(
+      `SELECT * FROM subscriptions WHERE pubkey = ? ORDER BY created_at`,
+      [pubkey]
+    )
+
+    return rows.map(parseSubscription) as Subscription[]
+  }
+)
+
 export const updateLastDigestAt = instrument(
   'database.updateLastDigestAt',
   async (id: string, timestamp: number) => {

src/digest.ts

@@ -1,6 +1,5 @@
 import { neventEncode, decode } from 'nostr-tools/nip19'
 import {
-  spec,
   sortBy,
   groupBy,
   displayList,
@@ -10,7 +9,6 @@ import { parse, truncate, renderAsHtml } from '@welshman/content'
 import {
   TrustedEvent,
   normalizeRelayUrl,
-  getParentId,
   NOTE,
   COMMENT,
   REACTION,
@@ -25,6 +23,7 @@ import { EVENT_VIEWER_URL } from './env.js'
 import {
   profilesByPubkey,
   loadProfile,
+  repository,
 } from './repository.js'
 
 type DigestData = {
@@ -49,23 +48,23 @@ export class Digest {
     const getEventVariables = (event: TrustedEvent) => {
       const parsed = truncate(parse(event), { minLength: 400, maxLength: 800, mediaLength: 50 })
 
+      const relayUrl = data.relayByEventId.get(event.id)
+
       return {
-        Link: buildLink(event, handler, data.relayByEventId.get(event.id)),
+        Link: buildLink(event, handler, relayUrl),
         Timestamp: formatter.format(secondsToDate(event.created_at)),
         Icon: profilesByPubkey.get().get(event.pubkey)?.picture,
         Name: displayProfileByPubkey(event.pubkey),
         Content: renderAsHtml(parsed, { createElement, renderEntity }).toString(),
-        Replies:
+        RelayUrl: relayUrl
-          repliesByParentId.get(event.id)?.filter((e) => [COMMENT, NOTE].includes(e.kind))
+          ? normalizeRelayUrl(relayUrl).replace(/^wss:\/\//, '').replace(/\/$/, '')
-            ?.length || 0,
+          : '',
-        Reactions: repliesByParentId.get(event.id)?.filter(spec({ kind: REACTION }))?.length || 0,
       }
     }
 
-    const { events, context } = data
+    const { events } = data
     const formatter = getFormatter()
     const handler = await this.loadHandler()
-    const repliesByParentId = groupBy(getParentId, context)
     const eventsByPubkey = groupBy((e) => e.pubkey, events)
     const userProfile = profilesByPubkey.get().get(this.sub.pubkey)
     const sorted = sortBy((e) => e.created_at, events).slice(0, 100)
@@ -86,7 +85,6 @@ export class Digest {
 
   sendFromStoredEvents = async (storedEvents: { id: string; event: TrustedEvent; relay: string }[]) => {
     const events = storedEvents.map(se => se.event)
-    const context = [...events] // For now, context == events (no reply loading)
     const relayByEventId = new Map(storedEvents.map(se => [se.event.id, se.relay]))
 
     // Load profiles for event authors
@@ -101,6 +99,13 @@ export class Digest {
       }
     }
 
+    // Load reply/reaction context: events that tag our matched events
+    const eventIds = events.map(e => e.id)
+    const replyEvents = repository.query([
+      { '#e': eventIds, kinds: [NOTE, COMMENT, REACTION] },
+    ])
+    const context = [...events, ...replyEvents]
+
     const data = { events, context, relayByEventId } as DigestData
 
     if (data.events.length > 0) {

src/emails/digest.mjml

@@ -64,10 +64,7 @@
             <div class="event-content">{{{Content}}}</div>
             <div class="event-stats">
               <span class="stat-item">
-                {{Replies}} replies
+                Posted to {{RelayUrl}}
-              </span>
-              <span class="stat-item">
-                {{Reactions}} reactions
               </span>
             </div>
           </div>

src/index.ts

@@ -7,7 +7,9 @@ import { registerSubscription } from './worker/index.js'
 
 process.on('unhandledRejection', (error: Error) => {
   console.error('Unhandled rejection:', error.stack)
-  process.exit(1)
+  // Do not process.exit(1) — an async rejection from a library's internal
+  // timer (e.g. @welshman/net's batcher) would let an attacker crash the
+  // entire server with a single malformed request. Log and continue.
 })
 
 process.on('uncaughtException', (error: Error) => {
@@ -15,6 +17,7 @@ process.on('uncaughtException', (error: Error) => {
   process.exit(1)
 })
 
+
 migrate().then(async () => {
   server.listen(PORT, () => {
     console.log('Running on port', PORT)

src/pages/confirm-already.html

@@ -0,0 +1,62 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Email Already Confirmed</title>
+    <style>
+      * { box-sizing: border-box; }
+      body {
+        font-family: 'Inter', system-ui, -apple-system, sans-serif;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        min-height: 100vh;
+        margin: 0;
+        background: #f0f2f5;
+        color: #1e293b;
+      }
+      .container {
+        width: 100%;
+        max-width: 480px;
+        margin: 16px;
+        text-align: center;
+        padding: 40px 32px;
+        background: #ffffff;
+        border-radius: 12px;
+        border: 1px solid #e2e8f0;
+      }
+      .logo { height: 40px; width: auto; margin: 0 auto 16px; display: block; }
+      .brand {
+        font-size: 24px;
+        font-weight: 700;
+        margin: 0 0 28px;
+        color: {{brandAccent}};
+      }
+      .title {
+        font-size: 20px;
+        font-weight: 700;
+        margin: 0 0 12px;
+        color: #1e293b;
+      }
+      .message {
+        font-size: 15px;
+        line-height: 1.6;
+        color: #64748b;
+        margin: 0;
+      }
+      .message a { color: {{brandAccent}}; text-decoration: none; font-weight: 600; }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      {{#brandLogo}}<img class="logo" src="{{brandLogo}}" alt="{{brandName}}" />{{/brandLogo}}
+      <div class="brand">{{brandName}}</div>
+      <h1 class="title">Email already confirmed</h1>
+      <p class="message">
+        This email address has already been confirmed. You're all set — no further action needed.
+        Visit <a href="{{settingsUrl}}">{{brandName}}</a> to manage your notification settings.
+      </p>
+    </div>
+  </body>
+</html>

src/server.ts

@@ -6,7 +6,7 @@ import { render } from './templates.js'
 import { confirmSubscriptionAction, unsubscribeAction, registerSubscription, ActionError } from './actions.js'
 import { getSubscriptionById, insertEvent, getSubscriptionByKey, getSubscriptionByPubkey } from './database.js'
 import { load } from '@welshman/net'
-import { getIdFilters } from '@welshman/util'
+import { getIdFilters, isRelayUrl } from '@welshman/util'
 import crypto from 'crypto'
 import { verifyEvent } from 'nostr-tools/pure'
 
@@ -83,6 +83,13 @@ const verifyNip98Auth = async (req: Request): Promise<string | null> => {
 
 export const server: express.Application = express()
 
+// Behind a TLS-terminating reverse proxy (traefik in the ansible deploy).
+// Without this, req.protocol stays "http" and verifyNip98Auth builds an
+// expectedUrl of http://…, which no browser client will ever sign (clients
+// sign https://…). Trust one proxy hop so req.protocol honors
+// X-Forwarded-Proto and NIP-98 URL matching works.
+server.set('trust proxy', 1)
+
 // CORS middleware for browser-facing routes only.
 // The browser hits /subscription with an Authorization header and Content-Type:
 // application/json, which triggers a CORS preflight. Answer it and allow the
@@ -179,6 +186,10 @@ addRoute('get', '/subscription/email', async (req: Request, res: Response) => {
     callback,
     email: sub.email,
     frequency: sub.frequency,
+    hour: sub.hour,
+    minute: sub.minute,
+    dayOfWeek: sub.day_of_week,
+    timezone: sub.timezone,
     confirmed: Boolean(sub.confirmed_at),
   })
 })
@@ -187,7 +198,7 @@ addRoute('get', '/subscription/email', async (req: Request, res: Response) => {
 // auth proving the caller controls the pubkey — the pubkey is extracted from
 // the auth event, not from the request body.
 addRoute('put', '/subscription/email', async (req: Request, res: Response) => {
-  const { email, frequency } = req.body
+  const { email, frequency, hour, minute, dayOfWeek, timezone } = req.body
 
   const pubkey = await verifyNip98Auth(req)
 
@@ -203,8 +214,38 @@ addRoute('put', '/subscription/email', async (req: Request, res: Response) => {
     return res.status(400).json({ error: 'Frequency must be "daily" or "weekly"' })
   }
 
+  // Validate optional schedule fields
+  if (hour !== undefined) {
+    if (!Number.isInteger(hour) || hour < 0 || hour > 23) {
+      return res.status(400).json({ error: 'Hour must be an integer between 0 and 23' })
+    }
+  }
+
+  if (minute !== undefined) {
+    if (!Number.isInteger(minute) || minute < 0 || minute > 59) {
+      return res.status(400).json({ error: 'Minute must be an integer between 0 and 59' })
+    }
+  }
+
+  if (dayOfWeek !== undefined) {
+    if (frequency !== 'weekly') {
+      return res.status(400).json({ error: 'dayOfWeek is only valid for weekly frequency' })
+    }
+    if (!Number.isInteger(dayOfWeek) || dayOfWeek < 0 || dayOfWeek > 7) {
+      return res.status(400).json({ error: 'dayOfWeek must be an integer between 0 and 7 (1=Mon, 7=Sun, 0=Sun)' })
+    }
+  }
+
+  if (timezone !== undefined) {
     try {
-    const result = await registerSubscription({ pubkey, email, frequency })
+      Intl.DateTimeFormat(undefined, { timeZone: timezone })
+    } catch {
+      return res.status(400).json({ error: `"${timezone}" is not a valid IANA timezone` })
+    }
+  }
+
+  try {
+    const result = await registerSubscription({ pubkey, email, frequency, hour, minute, dayOfWeek, timezone })
     res.json(result)
   } catch (error: any) {
     // The subscription was still created, but sending the confirmation email
@@ -256,6 +297,15 @@ addRoute('post', '/notify/:id', async (req: Request, res: Response) => {
     return res.status(400).json({ error: 'id and relay are required' })
   }
 
+  // Reject non-ws:// relay URLs. load() from @welshman/net throws
+  // Invalid relay url asynchronously inside a batcher timer, which
+  // escapes the route's try/catch and becomes an unhandledRejection
+  // that would crash the server. Validate early to avoid calling
+  // load() with an unsupported scheme.
+  if (!isRelayUrl(relay)) {
+    return res.status(400).json({ error: 'Invalid relay URL. Only wss:// or ws:// relays are supported.' })
+  }
+
   const sub = await getSubscriptionById(req.params.id)
 
   if (!sub) {
@@ -299,28 +349,37 @@ addRoute('post', '/notify/:id', async (req: Request, res: Response) => {
   }
 })
 
+// ── Branding helper ──────────────────────────────────────────────────────
+
+const brandingVars = () => ({
+  brandName: BRAND_NAME,
+  brandAccent: BRAND_ACCENT,
+  brandLogo: BRAND_LOGO,
+  settingsUrl: `${EVENT_VIEWER_URL}/settings/alerts`,
+})
+
 // Confirmation
 addRoute('get', '/confirm', async (req: Request, res: Response) => {
   if (typeof req.query.token !== 'string') {
     return res.send(
       await render('pages/confirm-error.html', {
         message: 'No confirmation token was provided. Please check the link in your email and try again.',
-        brandName: BRAND_NAME,
+        ...brandingVars(),
-        brandAccent: BRAND_ACCENT,
-        brandLogo: BRAND_LOGO,
-        settingsUrl: `${EVENT_VIEWER_URL}/settings/alerts`,
       })
     )
   }
 
   try {
-    await confirmSubscriptionAction({ token: req.query.token })
+    const result = await confirmSubscriptionAction({ token: req.query.token })
+
+    if (result.alreadyConfirmed) {
+      return res.send(await render('pages/confirm-already.html', {
+        ...brandingVars(),
+      }))
+    }
 
     res.send(await render('pages/confirm-success.html', {
-      brandName: BRAND_NAME,
+      ...brandingVars(),
-      brandAccent: BRAND_ACCENT,
-      brandLogo: BRAND_LOGO,
-      settingsUrl: `${EVENT_VIEWER_URL}/settings/alerts`,
     }))
   } catch (error) {
     const isActionError = error instanceof ActionError
@@ -328,10 +387,7 @@ addRoute('get', '/confirm', async (req: Request, res: Response) => {
 
     res.send(await render('pages/confirm-error.html', {
       message,
-      brandName: BRAND_NAME,
+      ...brandingVars(),
-      brandAccent: BRAND_ACCENT,
-      brandLogo: BRAND_LOGO,
-      settingsUrl: `${EVENT_VIEWER_URL}/settings/alerts`,
     }))
 
     if (!isActionError) {

src/worker/email.ts

@@ -49,7 +49,7 @@ export const runJob = async (sub: Subscription) => {
 }
 
 const createJob = (sub: Subscription) => {
-  const cron = getCronExpression(sub.frequency)
+  const cron = getCronExpression(sub.frequency, sub.hour, sub.minute, sub.day_of_week)
 
   const run = async () => {
     // Re-fetch the subscription to pick up the latest last_digest_at.
@@ -64,7 +64,7 @@ const createJob = (sub: Subscription) => {
     cronTime: cron,
     onTick: run,
     start: true,
-    timeZone: 'UTC',
+    timeZone: sub.timezone ?? 'UTC',
   })
 }
 

test/confirm-already-confirmed.test.ts

@@ -0,0 +1,44 @@
+import { describe, it, expect, beforeAll } from 'vitest'
+import * as db from '../src/database.js'
+
+const pubkey = 'reconfirm-test-' + Date.now()
+const email = 'reconfirm-test-' + Date.now() + '@example.com'
+let token: string
+
+describe('Confirm link idempotency — already-confirmed token', () => {
+  beforeAll(async () => {
+    await db.migrate()
+  })
+
+  it('creates and confirms a subscription for the first time', async () => {
+    const sub = await db.insertSubscription(pubkey, email, 'daily')
+    expect(sub).toBeTruthy()
+    token = sub.key
+
+    const result = await db.confirmSubscription(token)
+    expect(result).toBeTruthy()
+    expect(result!.sub.confirmed_at).toBeTruthy()
+    expect(result!.alreadyConfirmed).toBe(false)
+  })
+
+  it('returns a distinct result (not undefined) when confirming an already-confirmed token', async () => {
+    // BUG: confirmSubscription used `WHERE confirmed_at IS NULL`, so
+    // re-confirming an already-confirmed token matched zero rows and
+    // the UPDATE returned nothing → parseSubscription returned undefined.
+    // The caller then threw ActionError('invalid or expired') and the
+    // user saw "Email not confirmed" — which is misleading.
+    //
+    // FIX: confirmSubscription now detects the already-confirmed case
+    // and returns { sub, alreadyConfirmed: true } so the handler can
+    // render an "already confirmed" info page instead of an error page.
+    const result = await db.confirmSubscription(token)
+    expect(result).not.toBeUndefined()
+    expect(result!.alreadyConfirmed).toBe(true)
+    expect(result!.sub.confirmed_at).toBeTruthy()
+  })
+
+  it('returns undefined for a nonexistent token', async () => {
+    const result = await db.confirmSubscription('nonexistent-token-' + Date.now())
+    expect(result).toBeUndefined()
+  })
+})

test/confirm-code-on-email-change.test.ts

@@ -0,0 +1,109 @@
+import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest'
+import * as db from '../src/database.js'
+import { registerSubscription } from '../src/actions.js'
+import * as mailer from '../src/mailer.js'
+
+// Regression guards for the row-reactivation fix (src/database.ts):
+//   * same-email re-subscribe → reactivates the SAME row and must NOT email a
+//     stale confirmation code to an unrelated address
+//   * new-email re-subscribe → MUST create a fresh row (fresh key) so the
+//     confirmation email carries a code bound to the new address
+//
+// We mock the mailer so these run hermetically (the unit env's SMTP is a dummy).
+
+vi.mock('../src/mailer.js', async (importOriginal) => {
+  const actual: any = await importOriginal()
+  return { ...actual, sendConfirm: vi.fn(async () => {}) }
+})
+
+const pubkey = 'new-email-' + Date.now() + '-' + Math.random().toString(36).slice(2)
+const oldEmail = `${pubkey}-old@example.com`
+const newEmail = `${pubkey}-new@example.com`
+let subscribedIds: string[] = []
+
+const subscribeIdsFor = async () => {
+  const rows = await db.getAllSubscriptionsByPubkey(pubkey)
+  subscribedIds = rows.map((r: any) => r.id)
+  return rows
+}
+
+describe('Re-subscribe with a NEW email dispatches the correct confirmation code', () => {
+  beforeAll(async () => {
+    await db.migrate()
+    vi.mocked(mailer.sendConfirm).mockClear()
+  })
+
+  afterAll(async () => {
+    const key = (await db.getAllSubscriptionsByPubkey(pubkey))[0]?.key
+    if (key) await db.unsubscribeSubscription(key)
+  })
+
+  it('registers + confirms the original email', async () => {
+    const result = await registerSubscription({ pubkey, email: oldEmail, frequency: 'daily' })
+    expect(result.key).toBeTruthy()
+    await db.confirmSubscription(result.key)
+    expect(vi.mocked(mailer.sendConfirm)).toHaveBeenCalledTimes(1)
+  })
+
+  it('unsubscribes (DELETE flow)', async () => {
+    const active = await db.getSubscriptionByPubkey(pubkey)
+    await db.unsubscribeSubscription(active!.key)
+    expect(await db.getSubscriptionByPubkey(pubkey)).toBeFalsy()
+  })
+
+  it('re-registering with the NEW email creates a fresh row, not a reactivation', async () => {
+    vi.mocked(mailer.sendConfirm).mockClear()
+
+    const result = await registerSubscription({ pubkey, email: newEmail, frequency: 'daily' })
+
+    // A NEW confirmation email was sent — to the NEW address, with the key
+    // returned to the caller (which the caller uses to confirm).
+    const sent = vi.mocked(mailer.sendConfirm).mock.calls[0][0]
+    expect(sent.email).toBe(newEmail)
+    expect(sent.key).toBe(result.key)
+
+    // And that key actually confirms the new-email row (not the old one).
+    const confirmed = await db.confirmSubscription(result.key)
+    expect(confirmed!.sub.email).toBe(newEmail)
+    expect(confirmed!.alreadyConfirmed).toBe(false)
+  })
+
+  it('leaves the old row and new row as distinct rows', async () => {
+    const rows = await subscribeIdsFor()
+    expect(rows).toHaveLength(2)
+    expect(new Set(subscribedIds).size).toBe(2)
+  })
+})
+
+describe('Reactivating the SAME email never emails an unrelated address', () => {
+  const k = 'same-email-' + Date.now() + '-' + Math.random().toString(36).slice(2)
+  const email = `${k}@example.com`
+
+  beforeAll(async () => {
+    vi.mocked(mailer.sendConfirm).mockClear()
+  })
+
+  afterAll(async () => {
+    const key = (await db.getAllSubscriptionsByPubkey(k))[0]?.key
+    if (key) await db.unsubscribeSubscription(key)
+  })
+
+  it('register + confirm + unsubscribe, then re-register the same email', async () => {
+    const r1 = await registerSubscription({ pubkey: k, email, frequency: 'daily' })
+    await db.confirmSubscription(r1.key)
+    const row1 = (await db.getAllSubscriptionsByPubkey(k))[0]
+    await db.unsubscribeSubscription(r1.key)
+
+    vi.mocked(mailer.sendConfirm).mockClear()
+    const r2 = await registerSubscription({ pubkey: k, email, frequency: 'daily' })
+
+    // Same row, still confirmed, but a FRESH key is issued — no new
+    // confirmation email, and old tokens for this row are invalidated.
+    const rows = await db.getAllSubscriptionsByPubkey(k)
+    expect(rows).toHaveLength(1)
+    expect(r2.key).not.toBe(r1.key)
+    expect(rows[0].id).toBe(row1.id)
+    expect(rows[0].confirmed_at).toBeTruthy()
+    expect(vi.mocked(mailer.sendConfirm)).not.toHaveBeenCalled()
+  })
+})

test/confirm-email-cooldown.test.ts

@@ -0,0 +1,101 @@
+import { describe, it, expect, beforeAll, vi, afterEach, beforeEach } from 'vitest'
+import * as db from '../src/database.js'
+import { registerSubscription, CONFIRM_EMAIL_COOLDOWN_SECONDS } from '../src/actions.js'
+import * as mailer from '../src/mailer.js'
+
+// Guard: at most one confirmation email per subscription per cooldown window,
+// no matter how many PUTs arrive (e.g. a page-refresh storm while unconfirmed).
+
+vi.mock('../src/mailer.js', async (importOriginal) => {
+  const actual: any = await importOriginal()
+  return { ...actual, sendConfirm: vi.fn(async () => {}) }
+})
+
+const unique = (label: string) => `${label}-${Date.now()}-${Math.random().toString(36).slice(2)}`
+const pubkey = unique('cooldown')
+const email = `${unique('cooldown')}@example.com`
+
+const confirmCalls = () => vi.mocked(mailer.sendConfirm).mock.calls.length
+
+describe('Confirmation email cooldown', () => {
+  beforeAll(async () => {
+    await db.migrate()
+  })
+
+  beforeEach(() => {
+    vi.mocked(mailer.sendConfirm).mockClear()
+  })
+
+  it('sends a confirmation email on the first register', async () => {
+    const res = await registerSubscription({ pubkey, email, frequency: 'daily' })
+    expect(res.key).toBeTruthy()
+    expect(confirmCalls()).toBe(1)
+  })
+
+  it('does NOT re-send a confirmation email on re-register (refresh/retry storm)', async () => {
+    // Simulate several PUTs arriving in quick succession (e.g. page reloads).
+    for (let i = 0; i < 5; i++) {
+      await registerSubscription({ pubkey, email, frequency: 'daily' })
+    }
+    expect(confirmCalls()).toBe(0)
+  })
+
+  it('a new frequency (setting change) does not re-send', async () => {
+    await registerSubscription({ pubkey, email, frequency: 'weekly' })
+    expect(confirmCalls()).toBe(0)
+  })
+
+  it('changing the email address sends immediately (cooldown reset)', async () => {
+    const newEmail = `${unique('cooldown')}@example.com`
+    await registerSubscription({ pubkey, email: newEmail, frequency: 'daily' })
+    expect(confirmCalls()).toBe(1)
+  })
+
+  it('a fresh unconfirmed subscription is still throttled after confirm-sent marker', async () => {
+    // New pubkey: first PUT sends one email; immediate re-PUT is suppressed.
+    const pk2 = unique('cooldown2')
+    const em2 = `${unique('cooldown2')}@example.com`
+    await registerSubscription({ pubkey: pk2, email: em2, frequency: 'daily' })
+    await registerSubscription({ pubkey: pk2, email: em2, frequency: 'daily' })
+    expect(confirmCalls()).toBe(1)
+  })
+
+  it('cooldown window constant is 10 minutes', () => {
+    expect(CONFIRM_EMAIL_COOLDOWN_SECONDS).toBe(600)
+  })
+})
+
+describe('Cooldown reset on subscription reactivation (same email, off/on cycle)', () => {
+  const k = unique('cooldown-reactivate')
+  const e = `${unique('cooldown-reactivate')}@example.com`
+
+  beforeAll(async () => {
+    await db.migrate()
+  })
+
+  beforeEach(() => {
+    vi.mocked(mailer.sendConfirm).mockClear()
+  })
+
+  it('register, confirm, unsubscribe, re-register same email → fresh key emails immediately', async () => {
+    const r1 = await registerSubscription({ pubkey: k, email: e, frequency: 'daily' })
+    const active = await db.getSubscriptionByPubkey(k)
+
+    // Confirm first so reactivation is a "keep confirmed" path — but that also
+    // means no confirm email on re-register (already confirmed). Verify the row
+    // is reactivated with a fresh key, not a duplicate.
+    const confirmed = await db.confirmSubscription(active!.key)
+    expect(confirmed).toBeTruthy()
+
+    await db.unsubscribeSubscription(active!.key)
+
+    vi.mocked(mailer.sendConfirm).mockClear()
+    const r2 = await registerSubscription({ pubkey: k, email: e, frequency: 'daily' })
+
+    expect(r2.key).not.toBe(r1.key) // fresh key issued
+    expect(confirmCalls()).toBe(0) // still confirmed → no new email
+
+    const rows = await db.getAllSubscriptionsByPubkey(k)
+    expect(rows).toHaveLength(1)
+  })
+})

test/digest-reply-stats.test.ts

@@ -0,0 +1,164 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import type { TrustedEvent } from '@welshman/util'
+
+// ── Shared state accessible from both vi.mock factories and test body ──────
+const mockRepo = vi.hoisted(() => {
+  const events: TrustedEvent[] = []
+  return {
+    events, // shared mutable array
+    query: vi.fn((filters: any[]) => {
+      return events.filter(e => {
+        for (const f of filters) {
+          // #e filter: event must have an 'e' tag whose value matches one of the filter values
+          if (f['#e']) {
+            const eTagVals = e.tags.filter(t => t[0] === 'e').map(t => t[1])
+            if (!f['#e'].some((id: string) => eTagVals.includes(id))) return false
+          }
+          // kinds filter
+          if (f.kinds && !f.kinds.includes(e.kind)) return false
+        }
+        return true
+      })
+    }),
+    publish: vi.fn((event: TrustedEvent) => {
+      events.push(event)
+      return true
+    }),
+  }
+})
+
+// ── Mocks (hoisted before imports) ─────────────────────────────────────────
+// ── Mock profiles map (pre-populated so waitForProfile doesn't time out) ──
+const mockProfilesMap = vi.hoisted(() => new Map())
+
+vi.mock('../src/repository.js', () => ({
+  profilesByPubkey: { get: () => mockProfilesMap },
+  loadProfile: vi.fn().mockResolvedValue(undefined),
+  repository: mockRepo,
+}))
+
+vi.mock('../src/util.js', () => {
+  const createElementMock = vi.fn().mockImplementation((tagName: string) => {
+    const el: any = { tagName, children: [], innerText: '' }
+    el.appendChild = (child: any) => { el.children.push(child) }
+    el.toString = () =>
+      `<${tagName}>${el.innerText}${el.children.map((c: any) => c.toString()).join('')}</${tagName}>`
+    return el
+  })
+  return {
+    displayDuration: vi.fn().mockReturnValue('1 hour'),
+    createElement: createElementMock,
+  }
+})
+
+// Captured digest parameters (set by the mailer mock)
+let lastDigestParams: Record<string, any> | undefined
+
+vi.mock('../src/mailer.js', () => ({
+  sendDigest: vi.fn((_sub: any, variables: Record<string, any>) => {
+    lastDigestParams = variables
+  }),
+}))
+
+// ── Imports (after mocks) ──────────────────────────────────────────────────
+import { Digest } from '../src/digest.js'
+import type { Subscription } from '../src/alert.js'
+
+// Valid 64-char hex strings for nostr IDs and pubkeys
+const PARENT_ID = 'aaa' + 'a'.repeat(61)  // 64 hex chars
+const REPLY_ID = 'bbb' + 'b'.repeat(61)
+const REACTION_ID = 'ccc' + 'c'.repeat(61)
+const PARENT_PK = 'ddd' + 'd'.repeat(61)
+const REPLIER_PK = 'eee' + 'e'.repeat(61)
+const REACTER_PK = 'fff' + 'f'.repeat(61)
+
+function makeEvent(overrides: Partial<TrustedEvent>): TrustedEvent {
+  const eid = overrides.id || 'a'.repeat(64)
+  return {
+    id: eid,
+    kind: 1,
+    pubkey: PARENT_PK,
+    created_at: Math.floor(Date.now() / 1000),
+    tags: [],
+    content: 'test content',
+    ...overrides,
+    id: eid,
+  } as TrustedEvent
+}
+
+describe('digest reply/reaction stats', () => {
+  let sub: Subscription
+
+  beforeEach(() => {
+    // Reset shared state
+    mockRepo.events.length = 0
+    lastDigestParams = undefined
+
+    sub = {
+      id: 'sub-1',
+      key: 'key-1',
+      pubkey: PARENT_PK,
+      email: 'test@example.com',
+      frequency: 'daily',
+      created_at: Math.floor(Date.now() / 1000) - 3600,
+      confirmed_at: Math.floor(Date.now() / 1000) - 3600,
+    }
+  })
+
+  it('should count replies and reactions loaded from repository context', async () => {
+    // Create a parent event
+    const parentEvent = makeEvent({
+      id: PARENT_ID,
+      kind: 1,
+      pubkey: PARENT_PK,
+      content: 'Hello world, this is the parent event',
+      created_at: Math.floor(Date.now() / 1000) - 600,
+    })
+
+    // Create a reply event referencing the parent via an 'e' tag
+    const replyEvent = makeEvent({
+      id: REPLY_ID,
+      kind: 1,
+      pubkey: REPLIER_PK,
+      content: 'This is a reply to the parent',
+      created_at: Math.floor(Date.now() / 1000) - 500,
+      tags: [['e', PARENT_ID, '', 'root']],
+    })
+
+    // Create a reaction event (kind 7 = REACTION)
+    const reactionEvent = makeEvent({
+      id: REACTION_ID,
+      kind: 7,
+      pubkey: REACTER_PK,
+      content: '+',
+      created_at: Math.floor(Date.now() / 1000) - 400,
+      tags: [['e', PARENT_ID, '', 'root']],
+    })
+
+    // Publish reply/reaction events to the mock repository so the fix can find them
+    mockRepo.publish(replyEvent)
+    mockRepo.publish(reactionEvent)
+
+    // Pre-populate profiles so waitForProfile resolves immediately
+    mockProfilesMap.set(PARENT_PK, { pubkey: PARENT_PK, name: 'parent-user', picture: '' })
+    mockProfilesMap.set(REPLIER_PK, { pubkey: REPLIER_PK, name: 'replier', picture: '' })
+    mockProfilesMap.set(REACTER_PK, { pubkey: REACTER_PK, name: 'reacter', picture: '' })
+
+    const storedEvents = [
+      { id: 'se-1', event: parentEvent, relay: 'wss://relay.example.com' },
+    ]
+
+    const digest = new Digest(sub)
+    await digest.sendFromStoredEvents(storedEvents)
+
+    // sendDigest should have been called with the template parameters
+    expect(lastDigestParams).toBeDefined()
+
+    const latest = lastDigestParams!.Latest
+    expect(latest.length).toBeGreaterThanOrEqual(1)
+
+    const parentEntry = latest[0]
+    // RelayUrl should be the relay domain stripped of protocol and trailing slash
+    expect(parentEntry.RelayUrl).toBe('relay.example.com')
+  })
+})

test/duplicate-subscription.test.ts

@@ -0,0 +1,50 @@
+import { describe, it, expect, beforeAll } from 'vitest'
+import * as db from '../src/database.js'
+
+const pubkey = 'dup-test-' + Date.now()
+const email = 'dup-test-' + Date.now() + '@example.com'
+let token: string
+
+describe('Duplicate subscription prevention — idempotent re-register after confirm', () => {
+  beforeAll(async () => {
+    await db.migrate()
+  })
+
+  it('registers a subscription (fresh)', async () => {
+    const sub = await db.insertSubscription(pubkey, email, 'daily')
+    expect(sub).toBeTruthy()
+    expect(sub!.confirmed_at).toBeFalsy()
+    expect(sub!.unsubscribed_at).toBeFalsy()
+    token = sub!.key
+  })
+
+  it('confirms the subscription', async () => {
+    const result = await db.confirmSubscription(token)
+    expect(result).toBeTruthy()
+    expect(result!.alreadyConfirmed).toBe(false)
+    expect(result!.sub.confirmed_at).toBeTruthy()
+  })
+
+  it('re-registers with the same email and frequency (idempotent PUT)', async () => {
+    // This simulates a second PUT from the client with identical params.
+    // The bug would create a second active row + send a new confirmation email.
+    const sub = await db.insertSubscription(pubkey, email, 'daily')
+    expect(sub).toBeTruthy()
+    // Must return the existing confirmed row, NOT a fresh unconfirmed row
+    expect(sub!.confirmed_at).toBeTruthy()
+    expect(sub!.unsubscribed_at).toBeFalsy()
+
+    // The key must remain unchanged — a new row would have a different key
+    expect(sub!.key).toBe(token)
+  })
+
+  it('has exactly one active row for this pubkey', async () => {
+    // getSubscriptionByPubkey filters by unsubscribed_at IS NULL and
+    // returns at most one row (enforced by the partial unique index).
+    // If a second active row exists, the index is absent or bypassed.
+    const active = await db.getSubscriptionByPubkey(pubkey)
+    expect(active).toBeTruthy()
+    expect(active!.confirmed_at).toBeTruthy()
+    expect(active!.key).toBe(token)
+  })
+})

test/event-arrival-race.test.ts

@@ -24,7 +24,7 @@ describe('Event-arrival race in digest job', () => {
     expect(s).toBeTruthy()
     const confirmed = await db.confirmSubscription(s.key)
     expect(confirmed).toBeTruthy()
-    sub = confirmed
+    sub = confirmed!.sub
 
     // Set last_digest_at to 60 seconds ago (the "since" value runJob would use)
     since = Math.floor(Date.now() / 1000) - 60

test/integration.sh

@@ -266,6 +266,31 @@ echo "14. Delete without auth returns 401"
 DEL_NO_AUTH=$(curl -s "$BASE_URL/subscription/$KEY" -X DELETE)
 check_field "No-auth DELETE returns 401" "$DEL_NO_AUTH" "error" "NIP-98 authorization required"
 
+# Test 15: Re-subscribe after delete reactivates the same row (no duplicate)
+# Regression: DELETE tombstones the row; re-subscribing with the SAME pubkey +
+# email must reactivate it, not insert a second row (off/on cycle previously
+# accumulated one row per cycle).
+echo ""
+echo "15. Re-subscribe after delete (de-dupe regression)"
+OLD_ID=$(sqlite3 "$DB_PATH" "SELECT id FROM subscriptions WHERE pubkey='$CLIENT_PUBKEY' AND unsubscribed_at IS NOT NULL ORDER BY created_at DESC LIMIT 1;" 2>/dev/null)
+AUTH_RE=$(nip98_auth "$BASE_URL/subscription/email" PUT '{"email":"test@example.com","frequency":"daily"}')
+RE_REG=$(curl -s "$BASE_URL/subscription/email" -X PUT -H "Content-Type: application/json" \
+  -H "Authorization: $AUTH_RE" \
+  -d '{"email":"test@example.com","frequency":"daily"}')
+NEW_ID=$(sqlite3 "$DB_PATH" "SELECT id FROM subscriptions WHERE pubkey='$CLIENT_PUBKEY' AND unsubscribed_at IS NULL LIMIT 1;" 2>/dev/null)
+if [ -n "$OLD_ID" ] && [ "$NEW_ID" = "$OLD_ID" ]; then
+  pass "Re-subscribe reactivates the same row"
+else
+  fail "Re-subscribe created a duplicate row (old=$OLD_ID, new=$NEW_ID)"
+fi
+
+TOTAL_ROWS=$(sqlite3 "$DB_PATH" "SELECT COUNT(*) FROM subscriptions WHERE pubkey='$CLIENT_PUBKEY';" 2>/dev/null)
+if [ "$TOTAL_ROWS" = "1" ]; then
+  pass "Exactly one row for this pubkey"
+else
+  fail "Expected 1 row for this pubkey, got $TOTAL_ROWS"
+fi
+
 # Summary
 echo ""
 echo "========================================="

test/notify-non-wss-relay-crash.test.ts

@@ -0,0 +1,82 @@
+// POST /notify with non-wss relay URL crashes the server (remote DoS)
+//
+// Bug: When POST /notify/:id receives a relay URL with a non-wss scheme
+// (e.g. http://…), the handler calls `load()` from @welshman/net. Inside
+// `load`, the batcher schedules an async `_execute` via setTimeout(200ms).
+// When `getAdapter` throws `Invalid relay url`, the error escapes as an
+// unhandledPromiseRejection because the batcher's `_execute` async function
+// is called from setTimeout with no `.catch()`. The global
+// `process.on('unhandledRejection')` handler in `src/index.ts` then calls
+// `process.exit(1)`, killing the entire server.
+//
+// Fix applied (2 of 3 fixes):
+//   1. Validate relay scheme before calling load() — the route handler now
+//      checks isRelayUrl() and returns 400 for non-ws:// schemes.
+//   2. Don't process.exit(1) on unhandledRejection — log and continue
+//      (defence in depth for any other async edge-case).
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest'
+import * as db from '../src/database.js'
+import { server } from '../src/server.js'
+import { createServer, type Server } from 'http'
+
+// Partially mock @welshman/net so that `load()` returns an empty array,
+// preventing real relay connections during the test, while preserving all
+// other exports from the library.
+vi.mock('@welshman/net', async (importOriginal) => {
+  const actual = await importOriginal()
+  return {
+    ...(actual as Record<string, unknown>),
+    load: vi.fn().mockResolvedValue([]),
+  }
+})
+
+describe('notify_non_wss_relay', () => {
+  let httpServer: Server
+  let baseUrl: string
+  let subId: string
+
+  beforeAll(async () => {
+    await db.migrate()
+
+    // Create and confirm a subscription we can use for the notify call
+    const pubkey = 'nws-test-pk-' + Date.now()
+    const email = 'nws-test-' + Date.now() + '@example.com'
+    const sub = await db.insertSubscription(pubkey, email, 'daily')
+    const confirmed = await db.confirmSubscription(sub.key)
+    subId = confirmed.id
+
+    // Start the express server on a random available port
+    await new Promise<void>((resolve) => {
+      httpServer = createServer(server)
+      httpServer.listen(0, () => {
+        const addr = httpServer.address()
+        if (addr && typeof addr === 'object') {
+          baseUrl = `http://localhost:${addr.port}`
+        }
+        resolve()
+      })
+    })
+  })
+
+  afterAll(async () => {
+    httpServer?.close()
+  })
+
+  it('rejects non-wss relay URL with 400 instead of crashing the server', async () => {
+    const res = await fetch(`${baseUrl}/notify/${subId}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        id: 'nonexistent-' + Date.now(),
+        relay: 'http://127.0.0.1:9',
+      }),
+    })
+
+    expect(res.status).toBe(400)
+
+    const body = await res.json()
+    expect(body).toHaveProperty('error')
+    expect(body.error).toMatch(/Invalid relay/)
+  })
+})

test/notify-response-shape.test.ts

@@ -37,7 +37,7 @@ describe('notify_response_shape', () => {
     const email = 'shape-test-' + Date.now() + '@example.com'
     const sub = await db.insertSubscription(pubkey, email, 'daily')
     const confirmed = await db.confirmSubscription(sub.key)
-    subId = confirmed.id
+    subId = confirmed!.sub.id
 
     // Start the express server on a random available port
     await new Promise<void>((resolve) => {

test/reschedule-on-frequency-change.test.ts

@@ -20,7 +20,7 @@ describe('Frequency change reschedules cron job', () => {
 
     const confirmed = await db.confirmSubscription(sub.key)
     expect(confirmed).toBeTruthy()
-    sub = confirmed
+    sub = confirmed!.sub
   })
 
   it('registers cron job with daily frequency', () => {

test/resubscribe-reactivates.test.ts

@@ -0,0 +1,188 @@
+import { describe, it, expect, beforeAll } from 'vitest'
+import * as db from '../src/database.js'
+
+// Regression test for the "two rows created when turning email alerts back on" bug.
+//
+// Decoded production sequence (Sep 18 2026):
+//   13:42:05 register  → row 1 (unconfirmed), confirm email #1
+//   13:44:35 DELETE    → row 1 tombstoned (unsubscribed_at set)
+//   13:44:36 register  → OLD BUG: a brand-new row 2 was inserted, confirm email #2
+//   14:02:32 confirm   → row 2 finally confirmed
+//
+// Fix: when the same pubkey re-subscribes to the same email after being
+// unsubscribed, reactivate the tombstoned row instead of inserting a new one,
+// preserving the existing confirmed state and key.
+
+const unique = (label: string) => `${label}-${Date.now()}-${Math.random().toString(36).slice(2)}`
+
+describe('Re-subscribe after DELETE reactivates the same subscription (off/on cycle)', () => {
+  const pubkey = unique('resub')
+  const email = `${unique('resub')}@example.com`
+
+  beforeAll(async () => {
+    await db.migrate()
+  })
+
+  it('creates an unconfirmed subscription', async () => {
+    const sub = await db.insertSubscription(pubkey, email, 'daily')
+    expect(sub).toBeTruthy()
+    expect(sub.confirmed_at).toBeFalsy()
+    expect(sub.unsubscribed_at).toBeFalsy()
+  })
+
+  it('confirms it (user clicks the confirm link)', async () => {
+    const active = await db.getSubscriptionByPubkey(pubkey)
+    const result = await db.confirmSubscription(active!.key)
+    expect(result).toBeTruthy()
+    expect(result!.alreadyConfirmed).toBe(false)
+    expect(result!.sub.confirmed_at).toBeTruthy()
+  })
+
+  it('unsubscribes it (the flotilla DELETE path)', async () => {
+    const active = await db.getSubscriptionByPubkey(pubkey)
+    const gone = await db.unsubscribeSubscription(active!.key)
+    expect(gone).toBeTruthy()
+    expect(gone!.unsubscribed_at).toBeTruthy()
+    expect(await db.getSubscriptionByPubkey(pubkey)).toBeFalsy()
+  })
+
+  it('re-registers the SAME email — must reactivate row, NOT create a second row', async () => {
+    const resigned = await db.insertSubscription(pubkey, email, 'daily')
+
+    // Restores the very same row
+    const active = await db.getSubscriptionByPubkey(pubkey)
+    expect(active).toBeTruthy()
+    expect(active!.key).toBe(resigned.key)
+    expect(active!.unsubscribed_at).toBeFalsy()
+
+    // Confirmed state is preserved — no second confirmation email needed
+    expect(active!.confirmed_at).toBeTruthy()
+
+    // Exhaustive: there exists exactly one row total for this pubkey
+    const rows = await db.getAllSubscriptionsByPubkey(pubkey)
+    expect(rows).toHaveLength(1)
+    expect(rows[0].id).toBe(active!.id)
+  })
+})
+
+describe('Re-subscribe after DELETE before ever confirming', () => {
+  const pubkey = unique('resub-unconfirmed')
+  const email = `${unique('resub-unconfirmed')}@example.com`
+
+  beforeAll(async () => {
+    await db.migrate()
+  })
+
+  it('registers then unsubscribes without confirming', async () => {
+    const sub = await db.insertSubscription(pubkey, email, 'daily')
+    await db.unsubscribeSubscription(sub.key)
+    expect(await db.getSubscriptionByPubkey(pubkey)).toBeFalsy()
+  })
+
+  it('re-registers the same email — reactivates same row, still unconfirmed', async () => {
+    const resigned = await db.insertSubscription(pubkey, email, 'daily')
+    const active = await db.getSubscriptionByPubkey(pubkey)
+
+    expect(active!.key).toBe(resigned.key)
+    expect(active!.id).toBe(resigned.id)
+    expect(active!.unsubscribed_at).toBeFalsy()
+    // Was never confirmed, and re-subscribing does not skip confirmation
+    expect(active!.confirmed_at).toBeFalsy()
+
+    const rows = await db.getAllSubscriptionsByPubkey(pubkey)
+    expect(rows).toHaveLength(1)
+  })
+})
+
+describe('Re-subscribe with a DIFFERENT email after DELETE', () => {
+  const pubkey = unique('resub-2')
+  const email = `${unique('resub-2')}@example.com`
+
+  beforeAll(async () => {
+    await db.migrate()
+  })
+
+  it('registers, confirms, and unsubscribes', async () => {
+    const sub = await db.insertSubscription(pubkey, email, 'daily')
+    await db.confirmSubscription(sub.key)
+    await db.unsubscribeSubscription(sub.key)
+    expect(await db.getSubscriptionByPubkey(pubkey)).toBeFalsy()
+  })
+
+  it('a new email creates a new row, leaving the old one tombstoned', async () => {
+    const newEmail = `${unique('resub-2-new')}@example.com`
+    const resigned = await db.insertSubscription(pubkey, newEmail, 'daily')
+
+    expect(resigned.email).toBe(newEmail)
+    expect(resigned.confirmed_at).toBeFalsy() // new address must re-confirm
+
+    const rows = await db.getAllSubscriptionsByPubkey(pubkey)
+    expect(rows).toHaveLength(2)
+    expect(rows[0].email).toBe(email) // old, tombstoned
+    expect(rows[0].unsubscribed_at).toBeTruthy()
+    expect(rows[1].email).toBe(newEmail) // new, active
+    expect(rows[1].unsubscribed_at).toBeFalsy()
+  })
+})
+
+describe('Re-subscribe with a changed frequency reactivates and updates cadence', () => {
+  const pubkey = unique('resub-freq')
+  const email = `${unique('resub-freq')}@example.com`
+
+  beforeAll(async () => {
+    await db.migrate()
+  })
+
+  it('registers confirm-free, unsubscribes', async () => {
+    const sub = await db.insertSubscription(pubkey, email, 'daily')
+    await db.unsubscribeSubscription(sub.key)
+  })
+
+  it('re-registers with weekly — reactivates the same row at the new cadence', async () => {
+    const resigned = await db.insertSubscription(pubkey, email, 'weekly')
+    const active = await db.getSubscriptionByPubkey(pubkey)
+
+    expect(active!.key).toBe(resigned.key)
+    expect(active!.frequency).toBe('weekly')
+    expect(active!.unsubscribed_at).toBeFalsy()
+
+    const rows = await db.getAllSubscriptionsByPubkey(pubkey)
+    expect(rows).toHaveLength(1)
+  })
+})
+
+describe('Re-subscribe with mixed emails for one pubkey picks the right row', () => {
+  const pubkey = unique('resub-mixed')
+  const emailA = `${unique('resub-mixed-a')}@example.com`
+  const emailB = `${unique('resub-mixed-b')}@example.com`
+
+  beforeAll(async () => {
+    await db.migrate()
+  })
+
+  it('creates and tombstones two different emails, then re-subscribes email B', async () => {
+    // Email A cycle
+    const subA = await db.insertSubscription(pubkey, emailA, 'daily')
+    await db.unsubscribeSubscription(subA.key)
+
+    // Email B cycle
+    const subB = await db.insertSubscription(pubkey, emailB, 'daily')
+    const bId = subB!.id
+    await db.unsubscribeSubscription(subB.key)
+
+    // Re-subscribe with email B — must reactivate B's own row, not A's,
+    // and must not resurrect the wrong email.
+    const resigned = await db.insertSubscription(pubkey, emailB, 'daily')
+    const active = await db.getSubscriptionByPubkey(pubkey)
+
+    expect(active!.id).toBe(bId)
+    expect(active!.id).not.toBe(subA!.id)
+    expect(active!.email).toBe(emailB)
+    expect(active!.unsubscribed_at).toBeFalsy()
+
+    const rows = await db.getAllSubscriptionsByPubkey(pubkey)
+    expect(rows).toHaveLength(2)
+    expect(rows.filter(r => r.email === emailA)).toHaveLength(1)
+    expect(rows.filter(r => r.email === emailB)).toHaveLength(1)
+  })
+})

test/schedule-fields.test.ts

@@ -0,0 +1,97 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest'
+import * as db from '../src/database.js'
+import { registerSubscription } from '../src/actions.js'
+import { getCronExpression } from '../src/alert.js'
+import { getJobCronSource, removeJob } from '../src/worker/email.js'
+import { registerSubscription as regSub } from '../src/worker/index.js'
+
+const pubkey = 'schedule-test-' + Date.now()
+const email = 'schedule-test-' + Date.now() + '@example.com'
+let sub: any = null
+
+describe('Schedule fields', () => {
+  beforeAll(async () => {
+    await db.migrate()
+  })
+
+  it('inserts subscription with custom hour/minute/timezone', async () => {
+    const s = await db.insertSubscription(pubkey, email, 'daily', 7, 30, undefined, 'America/New_York')
+    expect(s).toBeTruthy()
+    expect(s!.hour).toBe(7)
+    expect(s!.minute).toBe(30)
+    expect(s!.timezone).toBe('America/New_York')
+    expect(s!.day_of_week).toBeNull()
+    sub = s
+  })
+
+  it('inserts subscription with custom weekly dayOfWeek', async () => {
+    const pk2 = 'schedule-test-weekly-' + Date.now()
+    const em2 = pk2 + '@example.com'
+    const s = await db.insertSubscription(pk2, em2, 'weekly', 9, 0, 6, 'UTC')
+    expect(s).toBeTruthy()
+    expect(s!.hour).toBe(9)
+    expect(s!.minute).toBe(0)
+    expect(s!.day_of_week).toBe(6)
+    expect(s!.timezone).toBe('UTC')
+  })
+
+  it('inserts subscription with defaults when schedule omitted', async () => {
+    const pk3 = 'schedule-test-defaults-' + Date.now()
+    const em3 = pk3 + '@example.com'
+    const s = await db.insertSubscription(pk3, em3, 'daily')
+    expect(s).toBeTruthy()
+    expect(s!.hour).toBe(17)
+    expect(s!.minute).toBe(0)
+    expect(s!.timezone).toBe('UTC')
+    expect(s!.day_of_week).toBeNull()
+  })
+
+  it('getCronExpression returns daily with custom hour/minute', () => {
+    expect(getCronExpression('daily', 7, 30)).toBe('0 30 7 * * *')
+  })
+
+  it('getCronExpression returns weekly with custom dayOfWeek', () => {
+    expect(getCronExpression('weekly', 9, 0, 6)).toBe('0 0 9 * * 6')
+  })
+
+  it('getCronExpression defaults to Monday for weekly', () => {
+    expect(getCronExpression('weekly', 17, 0)).toBe('0 0 17 * * 1')
+  })
+
+  it('confirms and registers job with custom schedule', async () => {
+    // Confirm the daily subscription created above
+    const confirmed = await db.confirmSubscription(sub.key)
+    expect(confirmed).toBeTruthy()
+    sub = confirmed!.sub
+
+    regSub(sub)
+    const dailySource = getJobCronSource(sub.id)
+    // Expect 0 30 7 * * * (from custom hour=7, minute=30)
+    expect(dailySource).toBe('0 30 7 * * *')
+  })
+
+  it('updateSubscription preserves schedule fields through frequency change', async () => {
+    const updated = await db.updateSubscription(sub, email, 'weekly', undefined, undefined, 2, undefined)
+    expect(updated).toBeTruthy()
+    expect(updated!.frequency).toBe('weekly')
+    // hour/minute should keep the previously set values (7/30) since we passed undefined
+    expect(updated!.hour).toBe(7)
+    expect(updated!.minute).toBe(30)
+    expect(updated!.day_of_week).toBe(2)
+    expect(updated!.timezone).toBe('America/New_York')
+  })
+
+  it('registerSubscription preserves schedule fields', async () => {
+    await registerSubscription({ pubkey, email, frequency: 'daily', hour: 10, minute: 15, timezone: 'Europe/London' })
+    const reloaded = await db.getSubscriptionByPubkey(pubkey)
+    expect(reloaded).toBeTruthy()
+    expect(reloaded!.hour).toBe(10)
+    expect(reloaded!.minute).toBe(15)
+    expect(reloaded!.timezone).toBe('Europe/London')
+  })
+})
+
+afterAll(async () => {
+  const updated = await db.getSubscriptionByPubkey(pubkey)
+  if (updated) removeJob(updated)
+})