@push.rocks/smartmta 12.0.0 → 13.0.1

package/ts/security/classes.rustsecuritybridge.ts

@@ -435,7 +435,10 @@ interface IVerifyCapturedOutboundEmailResult {
   result?: IEmailSecurityResult;
 }
 
-interface ISmtpSendRawOptions {
+/** How a raw outbound message is signed. */
+type TSmtpRawSigningMode = 'dkim' | 'unsignedRelay';
+
+interface ISmtpSendRawTransportOptions {
   host: string;
   port: number;
   connectHost?: string;
@@ -446,7 +449,6 @@ interface ISmtpSendRawOptions {
   envelopeFrom: string;
   envelopeTo: string[];
   rawMessageBase64: string;
-  dkim: { domain: string; selector: string; privateKey: string; keyType?: string };
   connectionTimeoutSecs?: number;
   socketTimeoutSecs?: number;
   poolKey?: string;
@@ -456,6 +458,25 @@ interface ISmtpSendRawOptions {
   outboundAuthenticationCaptureId?: string;
 }
 
+/** A raw send signed with caller-supplied DKIM material, the default. */
+interface ISmtpSendRawOptions extends ISmtpSendRawTransportOptions {
+  signing?: 'dkim';
+  dkim: { domain: string; selector: string; privateKey: string; keyType?: string };
+}
+
+/**
+ * A raw send that relays the exact received bytes without a signature, for a
+ * backup MX forwarding third parties' mail to the primary. It must be
+ * requested explicitly and carries no DKIM material; the Rust engine refuses
+ * a request that mixes the two.
+ */
+interface ISmtpSendRawUnsignedRelayOptions extends ISmtpSendRawTransportOptions {
+  signing: 'unsignedRelay';
+  dkim?: never;
+}
+
+type TSmtpSendRawOptions = ISmtpSendRawOptions | ISmtpSendRawUnsignedRelayOptions;
+
 interface ISmtpVerifyOptions {
   host: string;
   port: number;
@@ -674,7 +695,7 @@ type TMailerCommands = {
     result: ISmtpSendResult;
   };
   sendRawEmail: {
-    params: ISmtpSendRawOptions;
+    params: TSmtpSendRawOptions;
     result: ISmtpSendResult;
   };
   verifyCapturedOutboundEmail: {
@@ -764,14 +785,16 @@ export class RustSecurityBridge extends EventEmitter {
   private _smtpServerConfig: ISmtpServerConfig | null = null;
 
   /**
-   * Map Node.js process.platform / process.arch to the tsrust-style suffix
-   * used for cross-compiled binaries, e.g. mailer-bin_linux_amd64.
+   * Map Node.js process.platform / process.arch to the tsrust target suffix
+   * of the shipped binaries. Linux binaries are static musl builds, e.g.
+   * mailer-bin_linux_amd64_musl.
    */
   private static getPlatformSuffix(): string | null {
     const archMap: Record<string, string> = { x64: 'amd64', arm64: 'arm64' };
     const os = process.platform;   // 'linux', 'darwin', 'win32', …
     const arch = archMap[process.arch];
     if (!arch) return null;
+    if (os === 'linux') return `linux_${arch}_musl`;
     return `${os}_${arch}`;
   }
 
@@ -1241,8 +1264,11 @@ export class RustSecurityBridge extends EventEmitter {
     }
   }
 
-  /** Send a pre-formatted raw email via the Rust SMTP client. */
-  public async sendRawEmail(opts: ISmtpSendRawOptions): Promise<ISmtpSendResult> {
+  /**
+   * Send a pre-formatted raw email via the Rust SMTP client. It is DKIM-signed
+   * with `opts.dkim` unless `opts.signing` is explicitly `'unsignedRelay'`.
+   */
+  public async sendRawEmail(opts: TSmtpSendRawOptions): Promise<ISmtpSendResult> {
     this.ensureRunning();
     try {
       const result = await this.bridge.sendCommand('sendRawEmail', opts);
@@ -1454,6 +1480,9 @@ export type {
   ISmtpRecipientResult,
   ISmtpSendOptions,
   ISmtpSendRawOptions,
+  ISmtpSendRawUnsignedRelayOptions,
+  TSmtpSendRawOptions,
+  TSmtpRawSigningMode,
   ISmtpVerifyOptions,
   ISmtpVerifyResult,
   ISmtpPoolStatus,

package/ts/security/index.ts

@@ -42,6 +42,10 @@ export {
   type ISmtpSendResult,
   type ISmtpRecipientResult,
   type ISmtpSendOptions,
+  type ISmtpSendRawOptions,
+  type ISmtpSendRawUnsignedRelayOptions,
+  type TSmtpSendRawOptions,
+  type TSmtpRawSigningMode,
   type ISmtpVerifyResult,
   type ISmtpPoolStatus,
 } from './classes.rustsecuritybridge.js';

package/dist_rust/mailer-bin_linux_amd64.tsrust-build.json

@@ -1,14 +0,0 @@
-{
-  "format": "tsrust.build-provenance.v2",
-  "binarySha256": "d698d8d0af565269b930e9af77e6046ca80d5c159e5aca55d2e2aa0c73a96f14",
-  "buildInfo": {
-    "projectName": "@push.rocks/smartmta",
-    "projectVersion": "12.0.0",
-    "gitCommit": "b1d1024df37a33ff14a0e46195c500f11161fb17",
-    "gitDirty": false,
-    "builtAt": "2026-10-15T06:23:07.408Z",
-    "tsrustVersion": "4.6.0",
-    "binary": "mailer-bin",
-    "target": "linux_amd64"
-  }
-}

package/dist_rust/mailer-bin_linux_arm64.tsrust-build.json

@@ -1,14 +0,0 @@
-{
-  "format": "tsrust.build-provenance.v2",
-  "binarySha256": "2e5502aaff345b35f16840f14c28e7b50c13b45f7015025021913006d6774f1c",
-  "buildInfo": {
-    "projectName": "@push.rocks/smartmta",
-    "projectVersion": "12.0.0",
-    "gitCommit": "b1d1024df37a33ff14a0e46195c500f11161fb17",
-    "gitDirty": false,
-    "builtAt": "2026-10-15T06:25:31.432Z",
-    "tsrustVersion": "4.6.0",
-    "binary": "mailer-bin",
-    "target": "linux_arm64"
-  }
-}