@push.rocks/smartmta 6.5.2 → 8.0.0

package/ts/mail/routing/classes.email.action.executor.ts

@@ -1,4 +1,5 @@
 import { logger } from '../../logger.js';
+import { getErrorMessage } from '../../functions.errors.js';
 import {
   SecurityLogger,
   SecurityLogLevel,
@@ -8,7 +9,12 @@ import type { IEmailAction, IEmailContext } from './interfaces.js';
 import { Email } from '../core/classes.email.js';
 import { BounceManager } from '../core/classes.bouncemanager.js';
 import { UnifiedDeliveryQueue } from '../delivery/classes.delivery.queue.js';
-import type { ISmtpSendResult } from '../../security/classes.rustsecuritybridge.js';
+import { callObserverSafely } from '../delivery/functions.safe-observers.js';
+import {
+  SmtpDeliveryError,
+  type ISmtpRecipientResult,
+  type ISmtpSendResult,
+} from '../../security/classes.rustsecuritybridge.js';
 
 /**
  * Dependencies injected from UnifiedEmailServer to avoid circular imports
@@ -30,6 +36,31 @@ export interface IActionExecutorDeps {
 export class EmailActionExecutor {
   constructor(private deps: IActionExecutorDeps) {}
 
+  private async suppressPermanentRcptFailures(
+    email: Email,
+    results: ISmtpRecipientResult[],
+  ): Promise<void> {
+    for (const result of results) {
+      if (result.accepted || result.responseCode < 500) continue;
+      try {
+        await this.deps.bounceManager.processSmtpFailure(
+          result.recipient,
+          `SMTP recipient rejected with ${result.responseCode}`,
+          {
+            sender: email.from,
+            originalEmailId: email.headers['Message-ID'] as string,
+            statusCode: String(result.responseCode),
+          },
+        );
+      } catch (error) {
+        logger.log(
+          'error',
+          `Failed to persist permanent RCPT failure for ${result.recipient}: ${(error as Error).message}`,
+        );
+      }
+    }
+  }
+
   async executeAction(action: IEmailAction, email: Email, context: IEmailContext): Promise<void> {
     switch (action.type) {
       case 'forward':
@@ -72,13 +103,14 @@ export class EmailActionExecutor {
 
     try {
       // Send email via Rust SMTP client
-      await this.deps.sendOutboundEmail(host, port, email, {
+      const result = await this.deps.sendOutboundEmail(host, port, email, {
         auth: auth as { user: string; pass: string } | undefined,
       });
+      await this.suppressPermanentRcptFailures(email, result.recipientResults || []);
 
       logger.log('info', `Successfully forwarded email to ${host}:${port}`);
 
-      SecurityLogger.getInstance().logEvent({
+      await callObserverSafely('forward success security log', () => SecurityLogger.getInstance().logEvent({
         level: SecurityLogLevel.INFO,
         type: SecurityEventType.EMAIL_FORWARDING,
         message: 'Email forwarded successfully',
@@ -91,11 +123,12 @@ export class EmailActionExecutor {
           recipients: email.to
         },
         success: true
-      });
+      }));
     } catch (error) {
-      logger.log('error', `Failed to forward email: ${error.message}`);
+      const errorMessage = getErrorMessage(error);
+      logger.log('error', `Failed to forward email: ${errorMessage}`);
 
-      SecurityLogger.getInstance().logEvent({
+      await callObserverSafely('forward failure security log', () => SecurityLogger.getInstance().logEvent({
         level: SecurityLogLevel.ERROR,
         type: SecurityEventType.EMAIL_FORWARDING,
         message: 'Email forwarding failed',
@@ -105,17 +138,31 @@ export class EmailActionExecutor {
           routeName: context.session.matchedRoute?.name,
           targetHost: host,
           targetPort: port,
-          error: error.message
+          error: errorMessage
         },
         success: false
-      });
-
-      // Handle as bounce
-      for (const recipient of email.getAllRecipients()) {
-        await this.deps.bounceManager.processSmtpFailure(recipient, error.message, {
-          sender: email.from,
-          originalEmailId: email.headers['Message-ID'] as string
-        });
+      }));
+
+      const smtpError = SmtpDeliveryError.from(error);
+      if (
+        !smtpError.retryable
+        && smtpError.errorType === 'protocol'
+        && smtpError.phase === 'rcpt_to'
+        && (
+          (typeof smtpError.smtpCode === 'number' && smtpError.smtpCode >= 500)
+          || smtpError.recipientResults.some(
+            (result) => !result.accepted && result.responseCode >= 500,
+          )
+        )
+      ) {
+        const permanentResults = smtpError.recipientResults.length > 0
+          ? smtpError.recipientResults
+          : smtpError.recipients.map((recipient) => ({
+              recipient,
+              accepted: false,
+              responseCode: smtpError.smtpCode!,
+            }));
+        await this.suppressPermanentRcptFailures(email, permanentResults);
       }
       throw error;
     }
@@ -151,7 +198,7 @@ export class EmailActionExecutor {
 
     logger.log('info', `Rejecting email with code ${code}: ${message}`);
 
-    SecurityLogger.getInstance().logEvent({
+    await callObserverSafely('routing rejection security log', () => SecurityLogger.getInstance().logEvent({
       level: SecurityLogLevel.WARN,
       type: SecurityEventType.EMAIL_PROCESSING,
       message: 'Email rejected by routing rule',
@@ -165,7 +212,7 @@ export class EmailActionExecutor {
         to: _email.to
       },
       success: false
-    });
+    }));
 
     // Throw error with SMTP code and message
     const error = new Error(message);

package/ts/mail/routing/classes.email.router.ts

@@ -1,8 +1,9 @@
 import * as plugins from '../../plugins.js';
 import { EventEmitter } from 'node:events';
-import { hasStorageManagerMethods, type IStorageManagerLike } from '../interfaces.storage.js';
+import type { IStorageManager } from '../interfaces.storage.js';
 import type { IEmailRoute, IEmailMatch, IEmailAction, IEmailContext } from './interfaces.js';
 import type { Email } from '../core/classes.email.js';
+import { getErrorMessage } from '../../functions.errors.js';
 
 /**
  * Email router that evaluates routes and determines actions
@@ -10,8 +11,9 @@ import type { Email } from '../core/classes.email.js';
 export class EmailRouter extends EventEmitter {
   private routes: IEmailRoute[];
   private patternCache: Map<string, boolean> = new Map();
-  private storageManager?: IStorageManagerLike;
+  private storageManager?: IStorageManager;
   private persistChanges: boolean;
+  private initializationPromise: Promise<void>;
   
   /**
    * Create a new email router
@@ -19,7 +21,7 @@ export class EmailRouter extends EventEmitter {
    * @param options Router options
    */
   constructor(routes: IEmailRoute[], options?: {
-    storageManager?: IStorageManagerLike;
+    storageManager?: IStorageManager;
     persistChanges?: boolean;
   }) {
     super();
@@ -27,12 +29,17 @@ export class EmailRouter extends EventEmitter {
     this.storageManager = options?.storageManager;
     this.persistChanges = options?.persistChanges ?? !!this.storageManager;
     
-    // If storage manager is provided, try to load persisted routes
-    if (hasStorageManagerMethods(this.storageManager, ['get'])) {
-      this.loadRoutes({ merge: true }).catch(error => {
-        console.error(`Failed to load persisted routes: ${error.message}`);
-      });
-    }
+    // Capture hydration so callers can establish a real readiness barrier before routing.
+    const hydrationPromise = this.storageManager
+      ? this.loadRoutes({ merge: true }).then(() => undefined)
+      : Promise.resolve();
+    hydrationPromise.catch(() => undefined);
+    this.initializationPromise = hydrationPromise;
+  }
+
+  /** Wait until managed routes have been hydrated. */
+  public async initialize(): Promise<void> {
+    await this.initializationPromise;
   }
   
   /**
@@ -395,7 +402,7 @@ export class EmailRouter extends EventEmitter {
    * Save current routes to storage
    */
   public async saveRoutes(): Promise<void> {
-    if (!hasStorageManagerMethods(this.storageManager, ['set'])) {
+    if (!this.storageManager) {
       this.emit('persistenceWarning', 'Cannot save routes: StorageManager not configured');
       return;
     }
@@ -413,7 +420,7 @@ export class EmailRouter extends EventEmitter {
       
       this.emit('routesPersisted', this.routes.length);
     } catch (error) {
-      console.error(`Failed to save routes: ${error.message}`);
+      console.error(`Failed to save routes: ${getErrorMessage(error)}`);
       throw error;
     }
   }
@@ -426,7 +433,7 @@ export class EmailRouter extends EventEmitter {
     merge?: boolean; // Merge with existing routes
     replace?: boolean; // Replace existing routes
   }): Promise<IEmailRoute[]> {
-    if (!hasStorageManagerMethods(this.storageManager, ['get'])) {
+    if (!this.storageManager) {
       this.emit('persistenceWarning', 'Cannot load routes: StorageManager not configured');
       return [];
     }
@@ -473,7 +480,7 @@ export class EmailRouter extends EventEmitter {
       
       return loadedRoutes;
     } catch (error) {
-      console.error(`Failed to load routes: ${error.message}`);
+      console.error(`Failed to load routes: ${getErrorMessage(error)}`);
       throw error;
     }
   }

package/ts/mail/routing/classes.unified.email.server.ts

@@ -1,14 +1,14 @@
 import * as plugins from '../../plugins.js';
-import * as paths from '../../paths.js';
 import { EventEmitter } from 'events';
 import { logger } from '../../logger.js';
+import { getErrorMessage } from '../../functions.errors.js';
 import {
   SecurityLogger,
   SecurityLogLevel,
   SecurityEventType
 } from '../../security/index.js';
 import { DKIMCreator } from '../security/classes.dkimcreator.js';
-import { hasStorageManagerMethods, type IStorageManagerLike } from '../interfaces.storage.js';
+import type { IStorageManager } from '../interfaces.storage.js';
 import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 import type { IEmailReceivedEvent, IRcptToRequestEvent, IAuthRequestEvent, IScramCredentialRequestEvent } from '../../security/classes.rustsecuritybridge.js';
 import { EmailRouter } from './classes.email.router.js';
@@ -25,11 +25,12 @@ import { SmtpState } from '../delivery/interfaces.js';
 import type { EmailProcessingMode, ISmtpSession as IBaseSmtpSession } from '../delivery/interfaces.js';
 import { EmailActionExecutor } from './classes.email.action.executor.js';
 import { DkimManager } from './classes.dkim.manager.js';
+import { callObserverSafely, emitSafely } from '../delivery/functions.safe-observers.js';
 
 
 /** External DcRouter interface shape used by UnifiedEmailServer */
 interface DcRouter {
-  storageManager: IStorageManagerLike;
+  storageManager: IStorageManager;
   dnsServer?: any;
   options?: any;
 }
@@ -105,6 +106,8 @@ export interface IUnifiedEmailServerOptions {
   domains: IEmailDomainConfig[];  // Domain configurations
   banner?: string;
   debug?: boolean;
+  /** Automatic for standalone use; caller-managed keeps DNS/key ownership with the embedding app. */
+  dkimKeyProvisioning?: 'automatic' | 'caller-managed';
   useSocketHandler?: boolean;  // Use socket-handler mode instead of port listening
   /** Persist router changes back into storage when a storage manager is available. */
   persistRoutes?: boolean;
@@ -118,9 +121,9 @@ export interface IUnifiedEmailServerOptions {
 
   // TLS options
   tls?: {
-    certPath?: string;
-    keyPath?: string;
-    caPath?: string;
+    certPem?: string;
+    keyPem?: string;
+    caPem?: string;
     minVersion?: string;
     ciphers?: string;
   };
@@ -146,6 +149,8 @@ export interface IUnifiedEmailServerOptions {
     recipientValidationTimeoutMs?: number;
     /** Timeout for message acceptance callbacks. Defaults to 30000 ms. */
     messageAcceptanceTimeoutMs?: number;
+    /** Maximum complete messages concurrently held across Rust and TypeScript. */
+    maxConcurrentMessages?: number;
     /** Require trusted PROXY v1 from the backend proxy before SMTP greeting. */
     proxyProtocol?: {
       required?: boolean;
@@ -179,8 +184,8 @@ export interface IUnifiedEmailServerOptions {
     connectionProxyProvider?: (context: IOutboundConnectionProxyContext) => Promise<IOutboundConnectionProxy | null | undefined>;
   };
 
-  // Delivery queue
-  queue?: IQueueOptions;
+  // Queue persistence must be selected explicitly.
+  queue: IQueueOptions;
 
   // Rate limiting (global limits, can be overridden per domain)
   rateLimits?: IHierarchicalRateLimits;
@@ -283,7 +288,7 @@ export class UnifiedEmailServer extends EventEmitter {
     this.rustBridge = RustSecurityBridge.getInstance();
 
     // Initialize DKIM creator with storage manager
-    this.dkimCreator = new DKIMCreator(paths.keysDir, dcRouter.storageManager);
+    this.dkimCreator = new DKIMCreator(dcRouter.storageManager);
 
     // Initialize bounce manager with storage manager
     this.bounceManager = new BounceManager({
@@ -298,7 +303,7 @@ export class UnifiedEmailServer extends EventEmitter {
     // Initialize email router with routes and storage manager
     this.emailRouter = new EmailRouter(options.routes || [], {
       storageManager: dcRouter.storageManager,
-      persistChanges: options.persistRoutes ?? hasStorageManagerMethods(dcRouter.storageManager, ['get', 'set'])
+      persistChanges: options.persistRoutes ?? true
     });
 
     // Initialize rate limiter
@@ -315,7 +320,6 @@ export class UnifiedEmailServer extends EventEmitter {
 
     // Initialize delivery components
     const queueOptions: IQueueOptions = {
-      storageType: 'memory', // Default to memory storage
       maxRetries: 3,
       baseRetryDelay: 300000, // 5 minutes
       maxRetryDelay: 3600000, // 1 hour
@@ -329,7 +333,16 @@ export class UnifiedEmailServer extends EventEmitter {
       concurrentDeliveries: 10,
       processBounces: true,
       bounceHandler: {
-        processSmtpFailure: this.processSmtpFailure.bind(this)
+        processSmtpFailure: async (recipient, smtpResponse, failureOptions) => {
+          const processed = await this.processSmtpFailure(
+            recipient,
+            smtpResponse,
+            failureOptions,
+          );
+          if (!processed) {
+            throw new Error(`SMTP bounce operation failed for ${recipient}`);
+          }
+        },
       },
       onDeliverySuccess: async (_item, _result) => {
         // Delivery success recorded via delivery system
@@ -346,8 +359,14 @@ export class UnifiedEmailServer extends EventEmitter {
     });
 
     // Initialize DKIM manager
-    this.dkimManager = new DkimManager(this.dkimCreator, this.domainRegistry, dcRouter, this.rustBridge);
-    this.dnsManager = new DnsManager(this.dcRouter);
+    this.dkimManager = new DkimManager(
+      this.dkimCreator,
+      this.domainRegistry,
+      dcRouter,
+      this.rustBridge,
+      options.dkimKeyProvisioning || 'automatic',
+    );
+    this.dnsManager = new DnsManager(this.dcRouter, undefined, options.dkimKeyProvisioning || 'automatic');
 
     // Initialize statistics
     this.stats = {
@@ -406,18 +425,24 @@ export class UnifiedEmailServer extends EventEmitter {
     tlsOpportunistic?: boolean;
   }): Promise<ISmtpSendResult> {
     // Build DKIM config if domain has keys
-    let dkim: { domain: string; selector: string; privateKey: string } | undefined;
+    let dkim: {
+      domain: string;
+      selector: string;
+      privateKey: string;
+      keyType: 'rsa' | 'ed25519';
+    } | undefined;
     if (options?.dkimDomain) {
-      try {
-        const selector = options.dkimSelector || 'default';
-        const { privateKey } = await this.dkimCreator.readDKIMKeysForSelector(
-          options.dkimDomain,
-          selector,
-        );
-        dkim = { domain: options.dkimDomain, selector, privateKey };
-      } catch (err) {
-        logger.log('warn', `Failed to read DKIM keys for ${options.dkimDomain}: ${(err as Error).message}`);
-      }
+      const selector = options.dkimSelector || 'default';
+      const material = await this.dkimCreator.readValidatedDKIMKeysForSelector(
+        options.dkimDomain,
+        selector,
+      );
+      dkim = {
+        domain: options.dkimDomain,
+        selector,
+        privateKey: material.privateKey,
+        keyType: material.keyType,
+      };
     }
 
     // Serialize the Email to the outbound format
@@ -476,13 +501,14 @@ export class UnifiedEmailServer extends EventEmitter {
       await this.startDeliveryPipeline();
       await this.startRustBridge();
       await this.initializeDkimAndDns();
+      await this.startDeliveryProcessing();
       this.registerBridgeEventHandlers();
       await this.startSmtpServer();
       this.startDnsValidation();
       logger.log('info', 'UnifiedEmailServer started successfully');
-      this.emit('started');
+      await emitSafely(this, 'started');
     } catch (error) {
-      logger.log('error', `Failed to start UnifiedEmailServer: ${error.message}`);
+      logger.log('error', `Failed to start UnifiedEmailServer: ${getErrorMessage(error)}`);
       try {
         await this.stop();
       } catch (cleanupError) {
@@ -493,10 +519,19 @@ export class UnifiedEmailServer extends EventEmitter {
   }
 
   private async startDeliveryPipeline(): Promise<void> {
-    await this.deliveryQueue.initialize();
+    await Promise.all([
+      this.bounceManager.initialize(),
+      this.emailRouter.initialize(),
+    ]);
+    logger.log('info', 'Managed email routing and suppression state initialized');
+
+    await this.deliveryQueue.initialize({ startProcessing: false });
     logger.log('info', 'Email delivery queue initialized');
+  }
 
+  private async startDeliveryProcessing(): Promise<void> {
     await this.deliverySystem.start();
+    this.deliveryQueue.resume();
     logger.log('info', 'Email delivery system started');
   }
 
@@ -509,9 +544,9 @@ export class UnifiedEmailServer extends EventEmitter {
 
     this.unregisterBridgeStateHandler();
     this.bridgeStateChangeHandler = ({ oldState, newState }: { oldState: string; newState: string }) => {
-      if (newState === 'failed') this.emit('bridgeFailed');
-      else if (newState === 'restarting') this.emit('bridgeRestarting');
-      else if (newState === 'running' && oldState === 'restarting') this.emit('bridgeRecovered');
+      if (newState === 'failed') void emitSafely(this, 'bridgeFailed');
+      else if (newState === 'restarting') void emitSafely(this, 'bridgeRestarting');
+      else if (newState === 'running' && oldState === 'restarting') void emitSafely(this, 'bridgeRecovered');
     };
     this.rustBridge.on('stateChange', this.bridgeStateChangeHandler);
   }
@@ -520,6 +555,15 @@ export class UnifiedEmailServer extends EventEmitter {
     await this.dkimManager.setupDkimForDomains();
     logger.log('info', 'DKIM configuration completed for all domains');
 
+    if (this.options.dkimKeyProvisioning === 'caller-managed') {
+      // Caller-managed mode validates only exact-selector key material. SmartMTA
+      // must not register DNS handlers, generate DNS records, rotate keys, or
+      // mutate any /email/dns/* or /email/dkim/* managed state.
+      this.applyDomainRateLimits();
+      logger.log('info', 'Caller-managed DKIM readiness validated without provisioning');
+      return;
+    }
+
     if (!this.localDnsProvisioned) {
       await this.dnsManager.provisionLocalDnsRecords(
         this.domainRegistry.getAllConfigs(),
@@ -668,20 +712,11 @@ export class UnifiedEmailServer extends EventEmitter {
   }
 
   private async startSmtpServer(): Promise<void> {
-    const hasTlsConfig = this.options.tls?.keyPath && this.options.tls?.certPath;
-    let tlsCertPem: string | undefined;
-    let tlsKeyPem: string | undefined;
-
-    if (hasTlsConfig) {
-      try {
-        tlsKeyPem = plugins.fs.readFileSync(this.options.tls.keyPath!, 'utf8');
-        tlsCertPem = plugins.fs.readFileSync(this.options.tls.certPath!, 'utf8');
-        logger.log('info', 'TLS certificates loaded successfully');
-      } catch (error) {
-        logger.log('warn', `Failed to load TLS certificates: ${error.message}`);
-      }
+    const tlsCertPem = this.options.tls?.certPem;
+    const tlsKeyPem = this.options.tls?.keyPem;
+    if ((tlsCertPem && !tlsKeyPem) || (!tlsCertPem && tlsKeyPem)) {
+      throw new Error('SMTP TLS requires both certPem and keyPem');
     }
-
     const configuredSecurePort = this.options.smtp?.securePort;
     if (configuredSecurePort !== undefined && !(this.options.ports as number[]).includes(configuredSecurePort)) {
       throw new Error(`Configured SMTP securePort ${configuredSecurePort} is not included in ports`);
@@ -708,6 +743,7 @@ export class UnifiedEmailServer extends EventEmitter {
       processingTimeoutSecs: this.options.hooks?.onMessageData
         ? Math.ceil(this.getMessageAcceptanceTimeoutMs() / 1000) + 1
         : 30,
+      maxConcurrentMessages: this.options.smtp?.maxConcurrentMessages ?? 4,
       recipientValidationEnabled: this.isRecipientValidationEnabled(),
       recipientValidationTimeoutSecs: this.options.smtp?.recipientValidationTimeoutMs
         ? Math.ceil(this.options.smtp.recipientValidationTimeoutMs / 1000)
@@ -775,9 +811,9 @@ export class UnifiedEmailServer extends EventEmitter {
       }
 
       logger.log('info', 'UnifiedEmailServer stopped successfully');
-      this.emit('stopped');
+      await emitSafely(this, 'stopped');
     } catch (error) {
-      logger.log('error', `Error stopping UnifiedEmailServer: ${error.message}`);
+      logger.log('error', `Error stopping UnifiedEmailServer: ${getErrorMessage(error)}`);
       throw error;
     }
   }
@@ -959,24 +995,7 @@ export class UnifiedEmailServer extends EventEmitter {
     logger.log('info', `Rust SMTP received email from=${mailFrom} to=${rcptTo.join(',')} remote=${remoteAddr}`);
 
     try {
-      // Decode the email data
-      let rawMessageBuffer: Buffer;
-      if (data.data.type === 'inline' && data.data.base64) {
-        rawMessageBuffer = Buffer.from(data.data.base64, 'base64');
-      } else if (data.data.type === 'file' && data.data.path) {
-        try {
-          rawMessageBuffer = plugins.fs.readFileSync(data.data.path);
-        } finally {
-          try {
-            plugins.fs.unlinkSync(data.data.path);
-          } catch {
-            // Ignore cleanup errors
-          }
-        }
-      } else {
-        throw new Error('Invalid email data transport');
-      }
-
+      const rawMessageBuffer = Buffer.from(data.data.base64, 'base64');
       // Build a session-like object for processEmailByMode
       const session: IExtendedSmtpSession = {
         id: data.sessionId || 'rust-' + Math.random().toString(36).substring(2),
@@ -1592,18 +1611,12 @@ export class UnifiedEmailServer extends EventEmitter {
         }
       }
 
-      // Sign with DKIM if configured
-      if (mode === 'mta' && route?.action.options?.mtaOptions?.dkimSign) {
-        const domain = email.from.split('@')[1];
-        await this.dkimManager.handleDkimSigning(email, domain, route.action.options.mtaOptions.dkimOptions?.keySelector || 'default');
-      }
-
       const id = await this.deliveryQueue.enqueue(email, mode, route);
 
       logger.log('info', `Email queued with ID: ${id}`);
       return id;
     } catch (error) {
-      logger.log('error', `Failed to send email: ${error.message}`);
+      logger.log('error', `Failed to send email: ${getErrorMessage(error)}`);
       throw error;
     }
   }
@@ -1624,9 +1637,9 @@ export class UnifiedEmailServer extends EventEmitter {
           bounceCategory: bounceRecord.bounceCategory
         });
 
-        this.emit('bounceProcessed', bounceRecord);
+        await emitSafely(this, 'bounceProcessed', bounceRecord);
 
-        SecurityLogger.getInstance().logEvent({
+        await callObserverSafely('bounce security log', () => SecurityLogger.getInstance().logEvent({
           level: SecurityLogLevel.INFO,
           type: SecurityEventType.EMAIL_VALIDATION,
           message: `Bounce notification processed for recipient`,
@@ -1637,7 +1650,7 @@ export class UnifiedEmailServer extends EventEmitter {
             bounceCategory: bounceRecord.bounceCategory
           },
           success: true
-        });
+        }));
 
         return true;
       } else {
@@ -1645,15 +1658,16 @@ export class UnifiedEmailServer extends EventEmitter {
         return false;
       }
     } catch (error) {
-      logger.log('error', `Error processing bounce notification: ${error.message}`);
+      const errorMessage = getErrorMessage(error);
+      logger.log('error', `Error processing bounce notification: ${errorMessage}`);
 
-      SecurityLogger.getInstance().logEvent({
+      await callObserverSafely('bounce failure security log', () => SecurityLogger.getInstance().logEvent({
         level: SecurityLogLevel.ERROR,
         type: SecurityEventType.EMAIL_VALIDATION,
         message: 'Failed to process bounce notification',
-        details: { error: error.message, subject: bounceEmail.subject },
+        details: { error: errorMessage, subject: bounceEmail.subject },
         success: false
-      });
+      }));
 
       return false;
     }
@@ -1662,7 +1676,13 @@ export class UnifiedEmailServer extends EventEmitter {
   public async processSmtpFailure(
     recipient: string,
     smtpResponse: string,
-    options: { sender?: string; originalEmailId?: string; statusCode?: string; headers?: Record<string, string> } = {}
+    options: {
+      operationId?: string;
+      sender?: string;
+      originalEmailId?: string;
+      statusCode?: string;
+      headers?: Record<string, string>;
+    } = {}
   ): Promise<boolean> {
     logger.log('info', `Processing SMTP failure for ${recipient}: ${smtpResponse}`);
 
@@ -1673,9 +1693,9 @@ export class UnifiedEmailServer extends EventEmitter {
         bounceType: bounceRecord.bounceType
       });
 
-      this.emit('bounceProcessed', bounceRecord);
+      await emitSafely(this, 'bounceProcessed', bounceRecord);
 
-      SecurityLogger.getInstance().logEvent({
+      await callObserverSafely('SMTP failure security log', () => SecurityLogger.getInstance().logEvent({
         level: SecurityLogLevel.INFO,
         type: SecurityEventType.EMAIL_VALIDATION,
         message: `SMTP failure processed for recipient`,
@@ -1687,19 +1707,20 @@ export class UnifiedEmailServer extends EventEmitter {
           smtpResponse
         },
         success: true
-      });
+      }));
 
       return true;
     } catch (error) {
-      logger.log('error', `Error processing SMTP failure: ${error.message}`);
+      const errorMessage = getErrorMessage(error);
+      logger.log('error', `Error processing SMTP failure: ${errorMessage}`);
 
-      SecurityLogger.getInstance().logEvent({
+      await callObserverSafely('SMTP failure security log', () => SecurityLogger.getInstance().logEvent({
         level: SecurityLogLevel.ERROR,
         type: SecurityEventType.EMAIL_VALIDATION,
         message: 'Failed to process SMTP failure',
-        details: { recipient, smtpResponse, error: error.message },
+        details: { recipient, smtpResponse, error: errorMessage },
         success: false
-      });
+      }));
 
       return false;
     }

package/ts/mail/routing/interfaces.ts

@@ -89,7 +89,6 @@ export interface IEmailAction {
     mtaOptions?: {
       domain?: string;
       allowLocalDelivery?: boolean;
-      localDeliveryPath?: string;
       dkimSign?: boolean;
       dkimOptions?: {
         domainName: string;
@@ -99,7 +98,6 @@ export interface IEmailAction {
       smtpBanner?: string;
       maxConnections?: number;
       connTimeout?: number;
-      spoolDir?: string;
     };
     /** Content scanning configuration */
     contentScanning?: boolean;