@push.rocks/smartmta 6.5.1 → 7.0.0

package/ts/mail/delivery/classes.delivery.system.ts

@@ -719,11 +719,13 @@ export class MultiModeDeliverySystem extends EventEmitter {
     const keySelector = mtaOptions.dkimOptions?.keySelector || 'default';
     
     try {
-      // Ensure DKIM keys exist for the domain
-      await this.emailServer.dkimCreator.handleDKIMKeysForDomain(domainName);
+      // Ensure DKIM keys exist for the exact selector advertised in the signature.
+      await this.emailServer.dkimCreator.handleDKIMKeysForSelector(domainName, keySelector);
 
-      // Get the private key
-      const dkimPrivateKey = (await this.emailServer.dkimCreator.readDKIMKeys(domainName)).privateKey;
+      // Load the private key for that same selector.
+      const dkimPrivateKey = (
+        await this.emailServer.dkimCreator.readDKIMKeysForSelector(domainName, keySelector)
+      ).privateKey;
 
       // Convert Email to raw format for signing
       const rawEmail = email.toRFC822String();
@@ -840,4 +842,4 @@ export class MultiModeDeliverySystem extends EventEmitter {
   public getStats(): IDeliveryStats {
     return { ...this.stats };
   }
-}
+}

package/ts/mail/interfaces.storage.ts

@@ -1,13 +1,67 @@
-export interface IStorageManagerLike {
-  get?(key: string): Promise<string | null>;
-  set?(key: string, value: string): Promise<void>;
-  list?(prefix: string): Promise<string[]>;
-  delete?(key: string): Promise<void>;
+/**
+ * Durable storage for SmartMTA's small textual state.
+ *
+ * Implementations are supplied by the embedding application and are expected
+ * to use SmartData, SmartBucket, or another explicitly managed backend.
+ * SmartMTA never falls back to the local filesystem.
+ */
+export interface IStorageManager {
+  get(key: string): Promise<string | null>;
+  set(key: string, value: string): Promise<void>;
+  list(prefix: string): Promise<string[]>;
+  delete(key: string): Promise<void>;
 }
 
-export function hasStorageManagerMethods<T extends keyof IStorageManagerLike>(
-  storageManager: IStorageManagerLike | undefined,
-  methods: T[],
-): storageManager is IStorageManagerLike & Required<Pick<IStorageManagerLike, T>> {
-  return !!storageManager && methods.every((method) => typeof storageManager[method] === 'function');
+/** Blob storage for queued messages and template attachments. */
+export interface IBlobStorageManager {
+  get(key: string): Promise<Buffer | null>;
+  set(key: string, value: Buffer): Promise<void>;
+  list(prefix: string): Promise<string[]>;
+  delete(key: string): Promise<void>;
 }
+
+/** In-memory small-state store for tests and explicitly non-durable runtimes. */
+export class MemoryStorageManager implements IStorageManager {
+  private readonly entries = new Map<string, string>();
+
+  public async get(key: string): Promise<string | null> {
+    return this.entries.get(key) ?? null;
+  }
+
+  public async set(key: string, value: string): Promise<void> {
+    this.entries.set(key, value);
+  }
+
+  public async list(prefix: string): Promise<string[]> {
+    return [...this.entries.keys()].filter((key) => key.startsWith(prefix)).sort();
+  }
+
+  public async delete(key: string): Promise<void> {
+    this.entries.delete(key);
+  }
+}
+
+/** In-memory blob store for tests and explicitly non-durable runtimes. */
+export class MemoryBlobStorageManager implements IBlobStorageManager {
+  private readonly entries = new Map<string, Buffer>();
+
+  public async get(key: string): Promise<Buffer | null> {
+    const value = this.entries.get(key);
+    return value ? Buffer.from(value) : null;
+  }
+
+  public async set(key: string, value: Buffer): Promise<void> {
+    this.entries.set(key, Buffer.from(value));
+  }
+
+  public async list(prefix: string): Promise<string[]> {
+    return [...this.entries.keys()].filter((key) => key.startsWith(prefix)).sort();
+  }
+
+  public async delete(key: string): Promise<void> {
+    this.entries.delete(key);
+  }
+}
+
+/** @deprecated Use IStorageManager. */
+export type IStorageManagerLike = IStorageManager;

package/ts/mail/routing/classes.dkim.manager.ts

@@ -1,13 +1,13 @@
 import { logger } from '../../logger.js';
 import { DKIMCreator } from '../security/classes.dkimcreator.js';
-import { hasStorageManagerMethods, type IStorageManagerLike } from '../interfaces.storage.js';
+import type { IStorageManager } from '../interfaces.storage.js';
 import { DomainRegistry } from './classes.domain.registry.js';
 import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 import { Email } from '../core/classes.email.js';
 
 /** External DcRouter interface shape used by DkimManager */
 interface DcRouter {
-  storageManager?: IStorageManagerLike;
+  storageManager?: IStorageManager;
   dnsServer?: any;
 }
 
@@ -115,7 +115,7 @@ export class DkimManager {
 
             logger.log('info', `DKIM DNS handler registered for new selector: ${newSelector}._domainkey.${domain}`);
 
-            if (hasStorageManagerMethods(this.dcRouter.storageManager, ['set'])) {
+            if (this.dcRouter.storageManager) {
               await this.dcRouter.storageManager.set(
                 `/email/dkim/${domain}/public.key`,
                 keyPair.publicKey

package/ts/mail/routing/classes.dns.manager.ts

@@ -1,10 +1,10 @@
 import * as plugins from '../../plugins.js';
 import type { IEmailDomainConfig } from './interfaces.js';
-import type { IStorageManagerLike } from '../interfaces.storage.js';
+import type { IStorageManager } from '../interfaces.storage.js';
 import { logger } from '../../logger.js';
 /** External DcRouter interface shape used by DnsManager */
 interface IDcRouterLike {
-  storageManager: IStorageManagerLike;
+  storageManager: IStorageManager;
   dnsServer?: any;
   options?: { dnsNsDomains?: string[]; dnsScopes?: string[] };
 }
@@ -50,7 +50,7 @@ interface IDnsValidationRun {
  */
 export class DnsManager {
   private dcRouter: IDcRouterLike;
-  private storageManager: IStorageManagerLike;
+  private storageManager: IStorageManager;
   private resolverFactory: () => IDnsResolver;
   private activeResolvers = new Set<IDnsResolver>();
   private activeValidation?: IDnsValidationRun;

package/ts/mail/routing/classes.email.router.ts

@@ -1,6 +1,6 @@
 import * as plugins from '../../plugins.js';
 import { EventEmitter } from 'node:events';
-import { hasStorageManagerMethods, type IStorageManagerLike } from '../interfaces.storage.js';
+import type { IStorageManager } from '../interfaces.storage.js';
 import type { IEmailRoute, IEmailMatch, IEmailAction, IEmailContext } from './interfaces.js';
 import type { Email } from '../core/classes.email.js';
 
@@ -10,7 +10,7 @@ import type { Email } from '../core/classes.email.js';
 export class EmailRouter extends EventEmitter {
   private routes: IEmailRoute[];
   private patternCache: Map<string, boolean> = new Map();
-  private storageManager?: IStorageManagerLike;
+  private storageManager?: IStorageManager;
   private persistChanges: boolean;
   
   /**
@@ -19,7 +19,7 @@ export class EmailRouter extends EventEmitter {
    * @param options Router options
    */
   constructor(routes: IEmailRoute[], options?: {
-    storageManager?: IStorageManagerLike;
+    storageManager?: IStorageManager;
     persistChanges?: boolean;
   }) {
     super();
@@ -28,7 +28,7 @@ export class EmailRouter extends EventEmitter {
     this.persistChanges = options?.persistChanges ?? !!this.storageManager;
     
     // If storage manager is provided, try to load persisted routes
-    if (hasStorageManagerMethods(this.storageManager, ['get'])) {
+    if (this.storageManager) {
       this.loadRoutes({ merge: true }).catch(error => {
         console.error(`Failed to load persisted routes: ${error.message}`);
       });
@@ -395,7 +395,7 @@ export class EmailRouter extends EventEmitter {
    * Save current routes to storage
    */
   public async saveRoutes(): Promise<void> {
-    if (!hasStorageManagerMethods(this.storageManager, ['set'])) {
+    if (!this.storageManager) {
       this.emit('persistenceWarning', 'Cannot save routes: StorageManager not configured');
       return;
     }
@@ -426,7 +426,7 @@ export class EmailRouter extends EventEmitter {
     merge?: boolean; // Merge with existing routes
     replace?: boolean; // Replace existing routes
   }): Promise<IEmailRoute[]> {
-    if (!hasStorageManagerMethods(this.storageManager, ['get'])) {
+    if (!this.storageManager) {
       this.emit('persistenceWarning', 'Cannot load routes: StorageManager not configured');
       return [];
     }

package/ts/mail/routing/classes.unified.email.server.ts

@@ -1,5 +1,4 @@
 import * as plugins from '../../plugins.js';
-import * as paths from '../../paths.js';
 import { EventEmitter } from 'events';
 import { logger } from '../../logger.js';
 import {
@@ -8,7 +7,7 @@ import {
   SecurityEventType
 } from '../../security/index.js';
 import { DKIMCreator } from '../security/classes.dkimcreator.js';
-import { hasStorageManagerMethods, type IStorageManagerLike } from '../interfaces.storage.js';
+import type { IStorageManager } from '../interfaces.storage.js';
 import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 import type { IEmailReceivedEvent, IRcptToRequestEvent, IAuthRequestEvent, IScramCredentialRequestEvent } from '../../security/classes.rustsecuritybridge.js';
 import { EmailRouter } from './classes.email.router.js';
@@ -29,7 +28,7 @@ import { DkimManager } from './classes.dkim.manager.js';
 
 /** External DcRouter interface shape used by UnifiedEmailServer */
 interface DcRouter {
-  storageManager: IStorageManagerLike;
+  storageManager: IStorageManager;
   dnsServer?: any;
   options?: any;
 }
@@ -118,9 +117,9 @@ export interface IUnifiedEmailServerOptions {
 
   // TLS options
   tls?: {
-    certPath?: string;
-    keyPath?: string;
-    caPath?: string;
+    certPem?: string;
+    keyPem?: string;
+    caPem?: string;
     minVersion?: string;
     ciphers?: string;
   };
@@ -146,6 +145,8 @@ export interface IUnifiedEmailServerOptions {
     recipientValidationTimeoutMs?: number;
     /** Timeout for message acceptance callbacks. Defaults to 30000 ms. */
     messageAcceptanceTimeoutMs?: number;
+    /** Maximum complete messages concurrently held across Rust and TypeScript. */
+    maxConcurrentMessages?: number;
     /** Require trusted PROXY v1 from the backend proxy before SMTP greeting. */
     proxyProtocol?: {
       required?: boolean;
@@ -179,8 +180,8 @@ export interface IUnifiedEmailServerOptions {
     connectionProxyProvider?: (context: IOutboundConnectionProxyContext) => Promise<IOutboundConnectionProxy | null | undefined>;
   };
 
-  // Delivery queue
-  queue?: IQueueOptions;
+  // Queue persistence must be selected explicitly.
+  queue: IQueueOptions;
 
   // Rate limiting (global limits, can be overridden per domain)
   rateLimits?: IHierarchicalRateLimits;
@@ -283,7 +284,7 @@ export class UnifiedEmailServer extends EventEmitter {
     this.rustBridge = RustSecurityBridge.getInstance();
 
     // Initialize DKIM creator with storage manager
-    this.dkimCreator = new DKIMCreator(paths.keysDir, dcRouter.storageManager);
+    this.dkimCreator = new DKIMCreator(dcRouter.storageManager);
 
     // Initialize bounce manager with storage manager
     this.bounceManager = new BounceManager({
@@ -298,7 +299,7 @@ export class UnifiedEmailServer extends EventEmitter {
     // Initialize email router with routes and storage manager
     this.emailRouter = new EmailRouter(options.routes || [], {
       storageManager: dcRouter.storageManager,
-      persistChanges: options.persistRoutes ?? hasStorageManagerMethods(dcRouter.storageManager, ['get', 'set'])
+      persistChanges: options.persistRoutes ?? true
     });
 
     // Initialize rate limiter
@@ -315,7 +316,6 @@ export class UnifiedEmailServer extends EventEmitter {
 
     // Initialize delivery components
     const queueOptions: IQueueOptions = {
-      storageType: 'memory', // Default to memory storage
       maxRetries: 3,
       baseRetryDelay: 300000, // 5 minutes
       maxRetryDelay: 3600000, // 1 hour
@@ -409,8 +409,12 @@ export class UnifiedEmailServer extends EventEmitter {
     let dkim: { domain: string; selector: string; privateKey: string } | undefined;
     if (options?.dkimDomain) {
       try {
-        const { privateKey } = await this.dkimCreator.readDKIMKeys(options.dkimDomain);
-        dkim = { domain: options.dkimDomain, selector: options.dkimSelector || 'default', privateKey };
+        const selector = options.dkimSelector || 'default';
+        const { privateKey } = await this.dkimCreator.readDKIMKeysForSelector(
+          options.dkimDomain,
+          selector,
+        );
+        dkim = { domain: options.dkimDomain, selector, privateKey };
       } catch (err) {
         logger.log('warn', `Failed to read DKIM keys for ${options.dkimDomain}: ${(err as Error).message}`);
       }
@@ -664,20 +668,11 @@ export class UnifiedEmailServer extends EventEmitter {
   }
 
   private async startSmtpServer(): Promise<void> {
-    const hasTlsConfig = this.options.tls?.keyPath && this.options.tls?.certPath;
-    let tlsCertPem: string | undefined;
-    let tlsKeyPem: string | undefined;
-
-    if (hasTlsConfig) {
-      try {
-        tlsKeyPem = plugins.fs.readFileSync(this.options.tls.keyPath!, 'utf8');
-        tlsCertPem = plugins.fs.readFileSync(this.options.tls.certPath!, 'utf8');
-        logger.log('info', 'TLS certificates loaded successfully');
-      } catch (error) {
-        logger.log('warn', `Failed to load TLS certificates: ${error.message}`);
-      }
+    const tlsCertPem = this.options.tls?.certPem;
+    const tlsKeyPem = this.options.tls?.keyPem;
+    if ((tlsCertPem && !tlsKeyPem) || (!tlsCertPem && tlsKeyPem)) {
+      throw new Error('SMTP TLS requires both certPem and keyPem');
     }
-
     const configuredSecurePort = this.options.smtp?.securePort;
     if (configuredSecurePort !== undefined && !(this.options.ports as number[]).includes(configuredSecurePort)) {
       throw new Error(`Configured SMTP securePort ${configuredSecurePort} is not included in ports`);
@@ -704,6 +699,7 @@ export class UnifiedEmailServer extends EventEmitter {
       processingTimeoutSecs: this.options.hooks?.onMessageData
         ? Math.ceil(this.getMessageAcceptanceTimeoutMs() / 1000) + 1
         : 30,
+      maxConcurrentMessages: this.options.smtp?.maxConcurrentMessages ?? 4,
       recipientValidationEnabled: this.isRecipientValidationEnabled(),
       recipientValidationTimeoutSecs: this.options.smtp?.recipientValidationTimeoutMs
         ? Math.ceil(this.options.smtp.recipientValidationTimeoutMs / 1000)
@@ -955,24 +951,7 @@ export class UnifiedEmailServer extends EventEmitter {
     logger.log('info', `Rust SMTP received email from=${mailFrom} to=${rcptTo.join(',')} remote=${remoteAddr}`);
 
     try {
-      // Decode the email data
-      let rawMessageBuffer: Buffer;
-      if (data.data.type === 'inline' && data.data.base64) {
-        rawMessageBuffer = Buffer.from(data.data.base64, 'base64');
-      } else if (data.data.type === 'file' && data.data.path) {
-        try {
-          rawMessageBuffer = plugins.fs.readFileSync(data.data.path);
-        } finally {
-          try {
-            plugins.fs.unlinkSync(data.data.path);
-          } catch {
-            // Ignore cleanup errors
-          }
-        }
-      } else {
-        throw new Error('Invalid email data transport');
-      }
-
+      const rawMessageBuffer = Buffer.from(data.data.base64, 'base64');
       // Build a session-like object for processEmailByMode
       const session: IExtendedSmtpSession = {
         id: data.sessionId || 'rust-' + Math.random().toString(36).substring(2),

package/ts/mail/routing/interfaces.ts

@@ -89,7 +89,6 @@ export interface IEmailAction {
     mtaOptions?: {
       domain?: string;
       allowLocalDelivery?: boolean;
-      localDeliveryPath?: string;
       dkimSign?: boolean;
       dkimOptions?: {
         domainName: string;
@@ -99,7 +98,6 @@ export interface IEmailAction {
       smtpBanner?: string;
       maxConnections?: number;
       connTimeout?: number;
-      spoolDir?: string;
     };
     /** Content scanning configuration */
     contentScanning?: boolean;