@push.rocks/smartmta 8.2.1 → 9.1.0

package/dist_ts/mail/routing/functions.routing.validation.d.ts

@@ -1,3 +1,17 @@
+import type { ISmtpAuthAccount } from './interfaces.js';
+/**
+ * PBKDF2 iteration bounds for SCRAM verifiers. The lower bound is the RFC
+ * 5802 recommended minimum; the upper bound caps per-attempt CPU so a single
+ * AUTH cannot exhaust the Rust bridge's 5s callback window.
+ */
+export declare const SCRAM_MIN_ITERATIONS = 4096;
+export declare const SCRAM_MAX_ITERATIONS = 1000000;
+/**
+ * Loudly reject unusable SMTP auth account configurations. Every failure
+ * mode here would otherwise degrade into a silent deny-all (empty scope
+ * patterns) or a silent authentication failure (malformed verifier keys).
+ */
+export declare function assertValidAuthAccounts(accounts: ISmtpAuthAccount[] | undefined): void;
 /**
  * Reject retention values that cannot be represented and scheduled reliably.
  */

package/dist_ts/mail/routing/functions.routing.validation.js

@@ -1,3 +1,99 @@
+/**
+ * PBKDF2 iteration bounds for SCRAM verifiers. The lower bound is the RFC
+ * 5802 recommended minimum; the upper bound caps per-attempt CPU so a single
+ * AUTH cannot exhaust the Rust bridge's 5s callback window.
+ */
+export const SCRAM_MIN_ITERATIONS = 4096;
+export const SCRAM_MAX_ITERATIONS = 1_000_000;
+const isBase64OfLength = (value, byteLength) => {
+    if (typeof value !== 'string' || value.length === 0)
+        return false;
+    try {
+        const decoded = Buffer.from(value, 'base64');
+        if (decoded.length === 0)
+            return false;
+        // Reject strings that silently drop invalid characters on decode.
+        if (decoded.toString('base64').replace(/=+$/, '') !== value.replace(/=+$/, '')) {
+            return false;
+        }
+        return byteLength === undefined || decoded.length === byteLength;
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Loudly reject unusable SMTP auth account configurations. Every failure
+ * mode here would otherwise degrade into a silent deny-all (empty scope
+ * patterns) or a silent authentication failure (malformed verifier keys).
+ */
+export function assertValidAuthAccounts(accounts) {
+    if (accounts === undefined)
+        return;
+    if (!Array.isArray(accounts)) {
+        throw new Error('auth.accounts must be an array');
+    }
+    const usernames = new Set();
+    for (const account of accounts) {
+        const username = account?.username;
+        if (typeof username !== 'string' || !username.trim()) {
+            throw new Error('auth.accounts entries require a non-empty username');
+        }
+        const owner = `auth account ${username}`;
+        if (usernames.has(username)) {
+            throw new Error(`${owner} is configured more than once`);
+        }
+        usernames.add(username);
+        const credential = account.credential;
+        const hasVerifier = credential?.verifier !== undefined;
+        const hasPassword = credential?.password !== undefined;
+        if (hasVerifier === hasPassword) {
+            throw new Error(`${owner} credential must contain exactly one of verifier or password`);
+        }
+        if (hasPassword && typeof credential.password !== 'string') {
+            throw new Error(`${owner} credential.password must be a string`);
+        }
+        if (hasVerifier) {
+            const verifier = credential.verifier;
+            if (verifier?.algorithm !== 'SCRAM-SHA-256') {
+                throw new Error(`${owner} verifier.algorithm must be SCRAM-SHA-256`);
+            }
+            if (!Number.isInteger(verifier.iterations)
+                || verifier.iterations < SCRAM_MIN_ITERATIONS
+                || verifier.iterations > SCRAM_MAX_ITERATIONS) {
+                throw new Error(`${owner} verifier.iterations must be an integer between ${SCRAM_MIN_ITERATIONS} and ${SCRAM_MAX_ITERATIONS}`);
+            }
+            if (!isBase64OfLength(verifier.salt)) {
+                throw new Error(`${owner} verifier.salt must be non-empty base64`);
+            }
+            if (!isBase64OfLength(verifier.storedKey, 32)) {
+                throw new Error(`${owner} verifier.storedKey must be base64 of a 32-byte key`);
+            }
+            if (!isBase64OfLength(verifier.serverKey, 32)) {
+                throw new Error(`${owner} verifier.serverKey must be base64 of a 32-byte key`);
+            }
+        }
+        const scope = account.scope;
+        if (scope === undefined)
+            continue;
+        if (!Array.isArray(scope.senders)
+            || scope.senders.length === 0
+            || scope.senders.some((pattern) => typeof pattern !== 'string' || !pattern.trim())) {
+            throw new Error(`${owner} scope.senders must be a non-empty array of address patterns`);
+        }
+        if (scope.recipients !== undefined) {
+            if (scope.recipients.mode !== 'any' && scope.recipients.mode !== 'patterns') {
+                throw new Error(`${owner} scope.recipients.mode must be any or patterns`);
+            }
+            if (scope.recipients.mode === 'patterns'
+                && (!Array.isArray(scope.recipients.patterns)
+                    || scope.recipients.patterns.length === 0
+                    || scope.recipients.patterns.some((pattern) => typeof pattern !== 'string' || !pattern.trim()))) {
+                throw new Error(`${owner} scope.recipients.patterns must be a non-empty array when mode is patterns`);
+            }
+        }
+    }
+}
 /**
  * Reject retention values that cannot be represented and scheduled reliably.
  */
@@ -15,4 +111,4 @@ export function assertValidInboundPolicy(inboundPolicy, domain) {
     }
     assertValidRetentionDays(inboundPolicy.retentionDays, `Inbound policy for domain ${domain}`);
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLnJvdXRpbmcudmFsaWRhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL21haWwvcm91dGluZy9mdW5jdGlvbnMucm91dGluZy52YWxpZGF0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxVQUFVLHdCQUF3QixDQUN0QyxhQUFzQixFQUN0QixLQUFhO0lBRWIsSUFDRSxPQUFPLGFBQWEsS0FBSyxRQUFRO1dBQzlCLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxhQUFhLENBQUM7V0FDcEMsYUFBYSxJQUFJLENBQUMsRUFDckIsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxLQUFLLGtEQUFrRCxDQUFDLENBQUM7SUFDOUUsQ0FBQztBQUNILENBQUM7QUFFRCxNQUFNLFVBQVUsd0JBQXdCLENBQ3RDLGFBR0MsRUFDRCxNQUFjO0lBRWQsSUFDRSxhQUFhLENBQUMsYUFBYSxLQUFLLE9BQU87V0FDcEMsYUFBYSxDQUFDLGFBQWEsS0FBSyxRQUFRLEVBQzNDLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUNiLDZCQUE2QixNQUFNLHdDQUF3QyxDQUM1RSxDQUFDO0lBQ0osQ0FBQztJQUNELHdCQUF3QixDQUN0QixhQUFhLENBQUMsYUFBYSxFQUMzQiw2QkFBNkIsTUFBTSxFQUFFLENBQ3RDLENBQUM7QUFDSixDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLnJvdXRpbmcudmFsaWRhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL21haWwvcm91dGluZy9mdW5jdGlvbnMucm91dGluZy52YWxpZGF0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUM7QUFDekMsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsU0FBUyxDQUFDO0FBRTlDLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxLQUFjLEVBQUUsVUFBbUIsRUFBVyxFQUFFO0lBQ3hFLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ2xFLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQzdDLElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxDQUFDO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDdkMsa0VBQWtFO1FBQ2xFLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUM7WUFDL0UsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBQ0QsT0FBTyxVQUFVLEtBQUssU0FBUyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssVUFBVSxDQUFDO0lBQ25FLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxVQUFVLHVCQUF1QixDQUNyQyxRQUF3QztJQUV4QyxJQUFJLFFBQVEsS0FBSyxTQUFTO1FBQUUsT0FBTztJQUNuQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQzdCLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUNwQyxLQUFLLE1BQU0sT0FBTyxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQy9CLE1BQU0sUUFBUSxHQUFHLE9BQU8sRUFBRSxRQUFRLENBQUM7UUFDbkMsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQztZQUNyRCxNQUFNLElBQUksS0FBSyxDQUFDLG9EQUFvRCxDQUFDLENBQUM7UUFDeEUsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLGdCQUFnQixRQUFRLEVBQUUsQ0FBQztRQUN6QyxJQUFJLFNBQVMsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUM1QixNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsS0FBSywrQkFBK0IsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFDRCxTQUFTLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRXhCLE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUVkLENBQUM7UUFDZCxNQUFNLFdBQVcsR0FBRyxVQUFVLEVBQUUsUUFBUSxLQUFLLFNBQVMsQ0FBQztRQUN2RCxNQUFNLFdBQVcsR0FBRyxVQUFVLEVBQUUsUUFBUSxLQUFLLFNBQVMsQ0FBQztRQUN2RCxJQUFJLFdBQVcsS0FBSyxXQUFXLEVBQUUsQ0FBQztZQUNoQyxNQUFNLElBQUksS0FBSyxDQUNiLEdBQUcsS0FBSyw4REFBOEQsQ0FDdkUsQ0FBQztRQUNKLENBQUM7UUFDRCxJQUFJLFdBQVcsSUFBSSxPQUFPLFVBQVcsQ0FBQyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDNUQsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUssdUNBQXVDLENBQUMsQ0FBQztRQUNuRSxDQUFDO1FBQ0QsSUFBSSxXQUFXLEVBQUUsQ0FBQztZQUNoQixNQUFNLFFBQVEsR0FBRyxVQUFXLENBQUMsUUFBdUMsQ0FBQztZQUNyRSxJQUFJLFFBQVEsRUFBRSxTQUFTLEtBQUssZUFBZSxFQUFFLENBQUM7Z0JBQzVDLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxLQUFLLDJDQUEyQyxDQUFDLENBQUM7WUFDdkUsQ0FBQztZQUNELElBQ0UsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7bUJBQ25DLFFBQVEsQ0FBQyxVQUFXLEdBQUcsb0JBQW9CO21CQUMzQyxRQUFRLENBQUMsVUFBVyxHQUFHLG9CQUFvQixFQUM5QyxDQUFDO2dCQUNELE1BQU0sSUFBSSxLQUFLLENBQ2IsR0FBRyxLQUFLLG1EQUFtRCxvQkFBb0IsUUFBUSxvQkFBb0IsRUFBRSxDQUM5RyxDQUFDO1lBQ0osQ0FBQztZQUNELElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztnQkFDckMsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUsseUNBQXlDLENBQUMsQ0FBQztZQUNyRSxDQUFDO1lBQ0QsSUFBSSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLEVBQUUsQ0FBQztnQkFDOUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUsscURBQXFELENBQUMsQ0FBQztZQUNqRixDQUFDO1lBQ0QsSUFBSSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLEVBQUUsQ0FBQztnQkFDOUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUsscURBQXFELENBQUMsQ0FBQztZQUNqRixDQUFDO1FBQ0gsQ0FBQztRQUVELE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUM7UUFDNUIsSUFBSSxLQUFLLEtBQUssU0FBUztZQUFFLFNBQVM7UUFDbEMsSUFDRSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQztlQUMxQixLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sS0FBSyxDQUFDO2VBQzFCLEtBQUssQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLE9BQU8sS0FBSyxRQUFRLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUMsRUFDbEYsQ0FBQztZQUNELE1BQU0sSUFBSSxLQUFLLENBQ2IsR0FBRyxLQUFLLDhEQUE4RCxDQUN2RSxDQUFDO1FBQ0osQ0FBQztRQUNELElBQUksS0FBSyxDQUFDLFVBQVUsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNuQyxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUMsSUFBSSxLQUFLLEtBQUssSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDLElBQUksS0FBSyxVQUFVLEVBQUUsQ0FBQztnQkFDNUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUssZ0RBQWdELENBQUMsQ0FBQztZQUM1RSxDQUFDO1lBQ0QsSUFDRSxLQUFLLENBQUMsVUFBVSxDQUFDLElBQUksS0FBSyxVQUFVO21CQUNqQyxDQUNELENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQzt1QkFDdEMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUM7dUJBQ3RDLEtBQUssQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLElBQUksQ0FDL0IsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sT0FBTyxLQUFLLFFBQVEsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsQ0FDNUQsQ0FDRixFQUNELENBQUM7Z0JBQ0QsTUFBTSxJQUFJLEtBQUssQ0FDYixHQUFHLEtBQUssNEVBQTRFLENBQ3JGLENBQUM7WUFDSixDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7QUFDSCxDQUFDO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLFVBQVUsd0JBQXdCLENBQ3RDLGFBQXNCLEVBQ3RCLEtBQWE7SUFFYixJQUNFLE9BQU8sYUFBYSxLQUFLLFFBQVE7V0FDOUIsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLGFBQWEsQ0FBQztXQUNwQyxhQUFhLElBQUksQ0FBQyxFQUNyQixDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUssa0RBQWtELENBQUMsQ0FBQztJQUM5RSxDQUFDO0FBQ0gsQ0FBQztBQUVELE1BQU0sVUFBVSx3QkFBd0IsQ0FDdEMsYUFHQyxFQUNELE1BQWM7SUFFZCxJQUNFLGFBQWEsQ0FBQyxhQUFhLEtBQUssT0FBTztXQUNwQyxhQUFhLENBQUMsYUFBYSxLQUFLLFFBQVEsRUFDM0MsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQ2IsNkJBQTZCLE1BQU0sd0NBQXdDLENBQzVFLENBQUM7SUFDSixDQUFDO0lBQ0Qsd0JBQXdCLENBQ3RCLGFBQWEsQ0FBQyxhQUFhLEVBQzNCLDZCQUE2QixNQUFNLEVBQUUsQ0FDdEMsQ0FBQztBQUNKLENBQUMifQ==

package/dist_ts/mail/routing/interfaces.d.ts

@@ -25,6 +25,11 @@ export interface IEmailMatch {
     clientIp?: string | string[];
     /** Require authentication status */
     authenticated?: boolean;
+    /**
+     * Require the session to be authenticated as this exact username (or one
+     * of these usernames). Unauthenticated sessions never match such routes.
+     */
+    authenticatedUser?: string | string[];
     /** Headers to match */
     headers?: Record<string, string | RegExp>;
     /** Message size range */
@@ -41,9 +46,21 @@ export interface IEmailMatch {
  * Action to take when route matches
  */
 export interface IEmailAction {
-    /** Type of action to perform */
+    /**
+     * Type of action to perform.
+     * - `forward`: relay to a configured SMTP host.
+     * - `process`: queue for scanning and outbound MX delivery.
+     * - `deliver`: terminal local delivery through the durable
+     *   `hooks.onAcceptEnvelope` acceptance path. Never relays.
+     * - `store`: terminal local delivery like `deliver`, with explicit
+     *   retention configuration.
+     * - `reject`: refuse with a configurable SMTP error.
+     */
     type: 'forward' | 'deliver' | 'reject' | 'process' | 'store';
-    /** Explicitly permits this route to relay to non-local recipients. */
+    /**
+     * Explicitly permits this route to relay to non-local recipients.
+     * Ignored for `deliver` actions, which are local-only and never relay.
+     */
     allowRelay?: boolean;
     /** Forward action configuration */
     forward?: {
@@ -116,7 +133,7 @@ export interface IEmailAction {
             [key: string]: any;
         }>;
     };
-    /** Delivery options (applies to forward/process/deliver) */
+    /** Delivery options (applies to the queue-backed forward/process actions) */
     delivery?: {
         /** Rate limit (messages per minute) */
         rateLimit?: number;
@@ -124,6 +141,60 @@ export interface IEmailAction {
         retries?: number;
     };
 }
+/**
+ * Precomputed SCRAM-SHA-256 verifier for an SMTP auth account. Only derived
+ * key material is stored — the plaintext password never has to be persisted.
+ *
+ * Derivation (RFC 5802): SaltedPassword = PBKDF2-HMAC-SHA256(password, salt,
+ * iterations, 32); StoredKey = SHA256(HMAC-SHA256(SaltedPassword, 'Client Key'));
+ * ServerKey = HMAC-SHA256(SaltedPassword, 'Server Key').
+ */
+export interface ISmtpScramVerifier {
+    algorithm: 'SCRAM-SHA-256';
+    /** Base64-encoded PBKDF2 salt. */
+    salt: string;
+    /** PBKDF2 iteration count (4096 to 1000000, validated at configuration time). */
+    iterations: number;
+    /** Base64-encoded StoredKey. */
+    storedKey: string;
+    /** Base64-encoded ServerKey. */
+    serverKey: string;
+}
+/**
+ * Send-authorization scope for an authenticated SMTP account.
+ */
+export interface ISmtpAuthAccountScope {
+    /**
+     * Address patterns ('a@b.com' | '*@b.com') the account may send AS.
+     * Enforced against both the SMTP MAIL FROM envelope sender and the parsed
+     * message header From address.
+     */
+    senders: string[];
+    /** Recipient scope ("send TO who"). Absent or mode 'any' = unrestricted. */
+    recipients?: {
+        mode: 'any' | 'patterns';
+        /** Address patterns enforced for every RCPT TO when mode is 'patterns'. */
+        patterns?: string[];
+    };
+}
+/**
+ * Authenticated SMTP account with hashed credentials and send scopes.
+ */
+export interface ISmtpAuthAccount {
+    username: string;
+    /** Disabled accounts always fail authentication (default: enabled). */
+    enabled?: boolean;
+    /**
+     * Hashed SCRAM-SHA-256 verifier (preferred) or legacy plaintext password.
+     */
+    credential: {
+        verifier: ISmtpScramVerifier;
+    } | {
+        password: string;
+    };
+    /** Absent scope = unrestricted (backwards compatible). */
+    scope?: ISmtpAuthAccountScope;
+}
 /**
  * Context for route evaluation
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartmta",
-  "version": "8.2.1",
+  "version": "9.1.0",
   "description": "A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.",
   "keywords": [
     "mta",
@@ -31,9 +31,9 @@
     ".": "./dist_ts/index.js"
   },
   "devDependencies": {
-    "@git.zone/cli": "^2.23.0",
+    "@git.zone/cli": "^3.0.0",
     "@git.zone/tsbuild": "4.4.2",
-    "@git.zone/tsrust": "^1.6.0",
+    "@git.zone/tsrust": "^1.7.0",
     "@git.zone/tstest": "^3.6.6",
     "@types/mailparser": "^3.4.6",
     "@types/node": "^26.1.1",

package/readme.md

@@ -29,7 +29,7 @@ After installation, run `pnpm build` to compile the Rust binary (`mailer-bin`).
 | **DKIM** | Key generation, signing, and verification — per domain, with automatic rotation |
 | **SPF** | Full SPF record validation via Rust |
 | **DMARC** | Policy enforcement and verification |
-| **Email Router** | Pattern-based routing with priority, forward/deliver/reject/process actions |
+| **Email Router** | Pattern-based routing with priority, forward/process/reject actions plus terminal local `deliver`/`store` actions |
 | **Bounce Manager** | Automatic bounce detection via Rust, classification (hard/soft), and suppression tracking |
 | **Content Scanner** | Spam, phishing, malware, XSS, and suspicious link detection — powered by Rust |
 | **IP Reputation** | DNSBL checks, proxy/TOR/VPN detection, risk scoring via Rust |
@@ -171,7 +171,8 @@ const emailServer = new UnifiedEmailServer(dcRouterRef, {
     securePort: 465,
     recipientValidationTimeoutMs: 5000,
 
-    // Timeout for hooks.onMessageData before returning a temporary SMTP failure.
+    // Timeout for hooks.onMessageData and hooks.onAcceptEnvelope before
+    // returning a temporary SMTP failure.
     messageAcceptanceTimeoutMs: 30000,
 
     // Set required to true only on backend listeners reached through trusted proxies.
@@ -197,17 +198,36 @@ const emailServer = new UnifiedEmailServer(dcRouterRef, {
       return { accepted: false, smtpCode: 550, smtpMessage: 'Relay not permitted' };
     },
     async onMessageData(context) {
+      // Runs for envelopes WITHOUT a resolved store/deliver action.
       // Return accepted only after the consumer has taken responsibility for the message.
       // await durableStore.save(context.email, context.rawMessage, { signal: context.abortSignal });
       return { accepted: true, continueProcessing: false };
     },
+    async onAcceptEnvelope(context) {
+      // Required terminal durable owner for envelopes with a resolved
+      // `store` or `deliver` action. Durably persist the EXACT raw bytes and
+      // the per-recipient plan before resolving — the SMTP 250 is only sent
+      // after this hook resolves.
+      // const plan = emailServer.createAcceptedEnvelopeDispatchPlan(context, idempotencyKeys);
+      // await durableStore.saveEnvelope(context.rawMessage, plan, { signal: context.abortSignal });
+    },
   },
 
-  // Authentication settings for the SMTP server
+  // Authentication settings for the SMTP server.
+  // Legacy plaintext `users` and hashed `accounts` coexist; accounts win on
+  // username collision. See "Authenticated Accounts And Send Scopes" below.
   auth: {
     required: false,
     methods: ['PLAIN', 'LOGIN'],
     users: [{ username: 'outbound', password: 'secret' }],
+    accounts: [{
+      username: 'newsletter-service',
+      credential: { verifier: storedScramVerifier },
+      scope: {
+        senders: ['newsletter@example.com'],
+        recipients: { mode: 'any' },
+      },
+    }],
   },
 
   // TLS material is provided in memory; SmartMTA does not read certificate files.
@@ -241,7 +261,7 @@ await emailServer.start();
 
 > 🔒 **Note:** `start()` will throw if the Rust binary is not compiled. Run `pnpm build` first.
 >
-> SmartMTA 8 requires Node.js 22 or newer.
+> SmartMTA requires Node.js 22 or newer.
 >
 > `hostname` is the public SMTP identity for greetings and outbound delivery by default. It is not a bind address.
 >
@@ -268,16 +288,75 @@ Bounce delivery is at-least-once. `BounceManager` uses the operation ID as a dur
 
 SmartMTA validates each `RCPT TO` before the client can enter `DATA` by default. The default policy evaluates routes and accepts configured local domains. External recipients are rejected unless the matched route action explicitly sets `allowRelay: true`. Set `smtp.recipientValidation: false` only on fully trusted private listeners where another layer performs recipient and relay policy.
 
-Use `allowRelay` only for intentional relay routes, for example authenticated submission or tightly scoped internal networks. Broad `process` or `deliver` routes do not grant relay permission by themselves.
+Use `allowRelay` only for intentional relay routes, for example authenticated submission or tightly scoped internal networks. Broad `process` routes do not grant relay permission by themselves, and `deliver` routes can never relay — `allowRelay` is ignored for them.
 
-`hooks.onRcptTo` and `hooks.onMessageData` are awaited asynchronously. If a hook throws or times out, SmartMTA returns a temporary SMTP failure. The hook context includes `abortSignal`; long-running consumers should observe it and stop work promptly. A custom `onRcptTo` hook may accept local recipients using application-specific lookup, but external relay is still blocked unless a matched route explicitly sets `allowRelay: true`.
+`hooks.onRcptTo`, `hooks.onMessageData`, and `hooks.onAcceptEnvelope` are awaited asynchronously. If a hook throws or times out, SmartMTA returns a temporary SMTP failure. The hook context includes `abortSignal`; long-running consumers should observe it and stop work promptly. A custom `onRcptTo` hook may accept local recipients using application-specific lookup, but external relay is still blocked unless a matched route explicitly sets `allowRelay: true`.
 
-`hooks.onMessageData` runs after `DATA` and before the final SMTP response. Return `{ accepted: true }` only after your application has accepted responsibility for the message, such as after durable persistence. Set `continueProcessing: false` when the consumer owns all downstream processing.
+`hooks.onMessageData` runs after `DATA` and before the final SMTP response — but only for envelopes with **no** resolved `store` or `deliver` action; terminal local deliveries go through `hooks.onAcceptEnvelope` instead and never invoke `onMessageData`. Return `{ accepted: true }` only after your application has accepted responsibility for the message, such as after durable persistence. Set `continueProcessing: false` when the consumer owns all downstream processing.
+
+`hooks.onAcceptEnvelope` is the terminal durable owner for any envelope containing a resolved `store` or `deliver` action. It receives the exact raw RFC822 bytes (`rawMessage`), the complete per-recipient route resolution (`resolvedRecipientRoutes`), and the Rust security verdicts (`securityResults`). It must durably persist the message before resolving — the SMTP `250` is only sent after the hook resolves. Throwing an `AcceptEnvelopeRejectionError` with a `5xx` code rejects the envelope permanently with that status; any other error or a `smtp.messageAcceptanceTimeoutMs` timeout refuses the envelope with a temporary `451`. Use `createAcceptedEnvelopeDispatchPlan()` inside the hook to snapshot the resolved plan for later replay-safe `dispatchAcceptedEnvelope()` calls. Both `AcceptEnvelopeRejectionError` and `IAcceptEnvelopeContext` are exported.
 
 Use `smtp.securePort` when the implicit TLS listener uses a remapped backend port instead of public `465`; the configured secure port must also be present in `ports`, otherwise `start()` throws.
 
 Trusted PROXY protocol v1 support is configured with `smtp.proxyProtocol`. Only enable `required: true` on backend listeners that are reached through a trusted local or private proxy, and always provide `trustedIps`. Required PROXY mode fails closed when no trusted peers are configured.
 
+### 🔐 Authenticated Accounts And Send Scopes
+
+`auth.accounts` defines authenticated SMTP submission accounts with hashed credentials and per-account send authorization. It coexists with the legacy plaintext `auth.users` array; when both define the same username, the account wins.
+
+```typescript
+import type { ISmtpAuthAccount } from '@push.rocks/smartmta';
+
+const accounts: ISmtpAuthAccount[] = [
+  {
+    username: 'newsletter-service',
+    // Hashed SCRAM-SHA-256 verifier — the plaintext password is never stored.
+    // SaltedPassword = PBKDF2-HMAC-SHA256(password, salt, iterations, 32)
+    // StoredKey = SHA256(HMAC-SHA256(SaltedPassword, 'Client Key'))
+    // ServerKey = HMAC-SHA256(SaltedPassword, 'Server Key')
+    credential: {
+      verifier: {
+        algorithm: 'SCRAM-SHA-256',
+        salt: '<base64 salt>',
+        iterations: 4096, // minimum
+        storedKey: '<base64 StoredKey>',
+        serverKey: '<base64 ServerKey>',
+      },
+    },
+    scope: {
+      // "send AS who": enforced against the SMTP MAIL FROM envelope sender
+      // AND the parsed message header From address.
+      senders: ['newsletter@example.com', '*@mail.example.com'],
+      // "send TO who": optional; absent or mode 'any' = unrestricted.
+      recipients: { mode: 'patterns', patterns: ['*@example.com'] },
+    },
+  },
+  {
+    username: 'trusted-app',
+    // Plaintext credential is supported for migration, but verifiers are preferred.
+    credential: { password: 'app-password' },
+    // No scope: unrestricted, exactly like a legacy auth.users entry.
+  },
+];
+
+server.updateOptions({ auth: { accounts } });
+```
+
+Enforcement semantics:
+
+- **Credentials** — `PLAIN`/`LOGIN` passwords are verified against the stored verifier by deriving `StoredKey` from the presented password (PBKDF2-HMAC-SHA256 on the async crypto threadpool) and comparing in constant time. `SCRAM-SHA-256` clients are served the stored verifier fields directly, so the plaintext never needs to exist server-side. Accounts with `enabled: false` always fail authentication on both mechanisms. Verification is fully in-memory — no I/O inside the Rust auth callback window.
+- **Sender scope ("send AS who")** — enforced twice. At the first `RCPT TO`, an out-of-scope `MAIL FROM` is refused with `553` before any recipient is accepted (with `smtp.recipientValidation: false` this check still runs, but only at `DATA`). At `DATA`, the envelope sender (taken from session envelope truth, never the parsed message alone) is re-checked per recipient, and **every** parsed header `From` mailbox must independently be in scope — header-From spoofing behind an in-scope envelope, including multi-mailbox `From:` headers, is refused with `553`.
+- **Recipient scope ("send TO who")** — with `recipients.mode: 'patterns'`, every `RCPT TO` matching no pattern is refused with `550`. `mode: 'any'` or an absent `recipients` block leaves recipients unrestricted.
+- **Patterns** are exact addresses (`a@b.com`) or glob patterns (`*@b.com`), matched case-insensitively with identical semantics to route matching. A scoped account sending with an empty `MAIL FROM <>` (null sender) is refused unless a pattern explicitly matches — `senders: ['*']` is the documented escape hatch.
+- **Route binding** — a route with `match.authenticatedUser: 'newsletter-service'` (or an array of usernames) matches only sessions authenticated as that account (exact, case-sensitive username comparison), so dedicated processing or relay routes can be attached per account. Unauthenticated sessions never match such routes.
+- **Rejections** surface through `onRecipientRejected` with the reasons `sender-scope`, `recipient-scope`, and `account-disabled`.
+- **Live enablement** — when a configuration update transitions between zero and one-or-more accounts/users, `updateOptions` restarts only the Rust SMTP listener so the `AUTH` capability appears or disappears without a process restart. A failed listener restart logs loudly, emits `smtpListenerRestartFailed`, and leaves `isSmtpListenerActive()` false — surface that next to `getBridgeState()` in health endpoints.
+- An account without a `scope` is authenticated but unrestricted — identical to legacy `auth.users` behavior, which itself is unchanged.
+
+Configuration is validated loudly at construction and `updateOptions` time: unusable accounts (empty `scope.senders`, `mode: 'patterns'` without patterns, both or neither credential kind, malformed base64 keys, `iterations` outside `[4096, 1000000]`, duplicate usernames) throw instead of degrading into silent deny-all or silent auth failure. Note that `updateOptions({ auth })` replaces the whole `auth` block — include `users`, `required`, and `methods` again if they should persist.
+
+Compatibility probe: `smartMtaCapabilities.smtpAuthAccountsAndScopes`.
+
 ### 📧 Sending Emails (Automatic MX Discovery)
 
 The recommended way to send email is `sendEmail()`. It defaults to **MTA mode**, which automatically resolves MX records for each recipient domain via DNS — you don't need to know the destination mail server:
@@ -344,6 +423,8 @@ public async sendEmail(
 
 **Self-MX loop guard:** MTA delivery refuses any MX host that equals the server's own hostname (`hostname` or `outbound.hostname`). A domain whose MX record points back at this server would otherwise re-enter the inbound pipeline on every delivery attempt — an infinite mail loop. Such deliveries fail with `MX for <domain> points back at this server — refusing self-delivery to avoid a mail loop`. The comparison is hostname-based; if a target only reveals the loop at the IP level (e.g. an A-record fallback), embedders should add an IP-level guard in their `connectionProxyProvider`.
 
+Routes with action `deliver` never enter MTA mode: they are terminal local deliveries through the durable acceptance path (see Route Action Types below), so the self-MX guard is structurally unreachable for them. Pre-9.x persisted queue items that still carry a `deliver` action fail loudly at delivery time with error type `deliver_action_relay_unsupported` (failure class `localTopology`) instead of being relayed or bounced as a misleading self-MX loop.
+
 ### 📬 Direct SMTP Delivery (Low-Level)
 
 For cases where you know the exact target SMTP server (e.g. relaying to a specific host), use the lower-level `sendOutboundEmail()`:
@@ -426,8 +507,9 @@ When `UnifiedEmailServer.start()` is called:
 - With `dkimKeyProvisioning: 'caller-managed'`, SmartMTA only loads the requested selector from managed storage; it never generates or rotates keys.
 - A requested missing or invalid key fails closed before SMTP delivery. SmartMTA never falls back to unsigned delivery.
 - Signing is applied exactly once, by the Rust SMTP client at final outbound transmission.
+- When a route enables signing without explicit `dkimOptions`, the selector is resolved from the sending domain's registry configuration (`domains[].dkim.selector`); the hardcoded `'default'` selector is only the last fallback.
 
-Embedders can check `smartMtaCapabilities.selectorCorrectDkimSigning`, `callerManagedDkimKeys`, `structuredSmtpTransactions`, and `typedDeliveryFailures` as compatibility probes.
+Embedders can check `smartMtaCapabilities.selectorCorrectDkimSigning`, `callerManagedDkimKeys`, `structuredSmtpTransactions`, `typedDeliveryFailures`, `terminalLocalDeliverActions` (deliver routes are terminal local deliveries through the durable acceptance path), and `smtpAuthAccountsAndScopes` (authenticated accounts with hashed credentials and send scopes) as compatibility probes.
 
 ### 🛡️ Email Authentication (SPF, DKIM, DMARC)
 
@@ -460,6 +542,8 @@ const router = new EmailRouter([
       authenticated: true,
     },
     action: {
+      // Terminal local delivery. In UnifiedEmailServer this requires a
+      // configured hooks.onAcceptEnvelope durable local-delivery owner.
       type: 'deliver',
     },
   },
@@ -505,11 +589,23 @@ const matchedRoute = await router.evaluateRoutes(emailContext);
 | Action | Description |
 |---|---|
 | `forward` | Forward the email to another SMTP server via the Rust SMTP client |
-| `deliver` | Queue for local MTA delivery |
-| `process` | Queue for processing (with optional content scanning and DKIM signing) |
+| `deliver` | **Terminal local delivery.** The envelope is durably accepted through `hooks.onAcceptEnvelope` before the SMTP 250; nothing is enqueued for outbound MX relay. |
+| `store` | Terminal local delivery like `deliver`, with explicit retention configuration (`store.retentionDays`) |
+| `process` | Queue for processing (with optional content scanning and DKIM signing), then deliver via automatic MX resolution |
 | `reject` | Reject with a configurable SMTP error code and message |
 
-Every action can include `allowRelay?: boolean`. It defaults to `false`. Non-local recipients are accepted only when the matched action explicitly sets `allowRelay: true`; configured local domains remain eligible for inbound delivery without relay permission.
+##### Local delivery: `deliver` and `store`
+
+`deliver` and `store` are the two terminal local-delivery actions. An envelope that resolves to either goes through the durable acceptance path: SmartMTA calls `hooks.onAcceptEnvelope` with the exact raw message and the complete per-recipient plan, and only sends the SMTP `250` after the hook resolves — the consumer's durably persisted copy IS the delivery. In `dispatchAcceptedEnvelope`, both report `status: 'stored'` with no `queueId`; the `actionType` field distinguishes them.
+
+- A `deliver` route **requires** a configured `hooks.onAcceptEnvelope`. Without it the configuration is unservable and is rejected loudly whenever routes are supplied or loaded: the constructor, `updateEmailRoutes`, `updateOptions` calls that include `routes`, and persisted-route hydration all throw. If hook state is nevertheless broken at runtime (for example an `updateOptions` call that replaces `hooks` without passing `routes`), deliver recipients are refused with a temporary `451 Local delivery temporarily unavailable` at `RCPT TO`/`DATA`. Mail is never accepted and then destroyed.
+- `deliver` never relays. Non-local recipients matched by a deliver route are refused with `550` at `RCPT TO`, and `allowRelay` is ignored for deliver actions.
+- `deliver` envelopes skip `hooks.onMessageData`, bounce-notification detection, and the inbound `processEmailByMode` pipeline — exactly like `store` envelopes. Rust-computed security verdicts are still delivered in the acceptance context.
+- `deliver` carries no retention metadata; the consumer owns retention for delivered messages. Use `store` with `store.retentionDays` when retention must be explicit.
+
+> ⚠️ **Changed in v9:** before v9, `deliver` silently meant "relay via MX discovery". On a domain whose MX points back at this server, that accepted mail with `250` and then terminally bounced it on the self-MX loop guard — destroying mail. `deliver` now delivers locally, and configurations that cannot do so fail at config/accept time.
+
+Every action can include `allowRelay?: boolean`. It defaults to `false`. Non-local recipients are accepted only when the matched action explicitly sets `allowRelay: true`; configured local domains remain eligible for inbound delivery without relay permission. `allowRelay` has no effect on `deliver` actions.
 
 #### Match Criteria
 
@@ -519,6 +615,7 @@ Every action can include `allowRelay?: boolean`. It defaults to `false`. Non-loc
 | `senders` | Glob patterns for sender addresses |
 | `clientIp` | IP addresses or CIDR ranges |
 | `authenticated` | Require authentication status |
+| `authenticatedUser` | Require the session to be authenticated as this exact username (string or array of usernames) |
 | `headers` | Match specific headers (string or RegExp) |
 | `sizeRange` | Message size constraints (`{ min?, max? }`) |
 | `subject` | Subject line pattern (string or RegExp) |
@@ -669,7 +766,7 @@ The Rust `mailer-bin` process is supervised by `RustSecurityBridge`:
 - **Health checks** — a `ping` every 30 s; two consecutive failures kill and restart the process.
 - **Auto-restart** — any unexpected exit triggers restart with exponential backoff (1 s → 30 s). After `maxRestartAttempts` fast attempts the bridge enters the `failed` state but keeps retrying at the slow cadence forever — it never silently stays dead.
 - **SMTP server restore** — after a restart the SMTP listener is restored; if the restore fails, the process is killed and the restart cycle continues rather than reporting a half-alive bridge.
-- **State surface** — `UnifiedEmailServer.getBridgeState()` returns `'idle' | 'starting' | 'running' | 'restarting' | 'failed' | 'stopped'`; the server emits `bridgeFailed`, `bridgeRestarting`, and `bridgeRecovered` events for embedders' alerting.
+- **State surface** — `UnifiedEmailServer.getBridgeState()` returns `'idle' | 'starting' | 'running' | 'restarting' | 'failed' | 'stopped'`; the server emits `bridgeFailed`, `bridgeRestarting`, and `bridgeRecovered` events for embedders' alerting. `isSmtpListenerActive()` reports whether the Rust SMTP listener is accepting connections, and a failed listener reconfiguration emits `smtpListenerRestartFailed`.
 
 Tune with `RustSecurityBridge.configure({ maxRestartAttempts, healthCheckIntervalMs, healthCheckTimeoutMs, restartBackoffBaseMs, restartBackoffMaxMs })`.
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartmta',
-  version: '8.2.1',
+  version: '9.1.0',
   description: 'A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.'
 }

package/ts/index.ts

@@ -14,4 +14,6 @@ export const smartMtaCapabilities = Object.freeze({
   topologyAwareSelfMx: true,
   durableDeliveryFailureOutbox: true,
   exactAcceptedEnvelopeDispatch: true,
+  terminalLocalDeliverActions: true,
+  smtpAuthAccountsAndScopes: true,
 } as const);

package/ts/mail/delivery/classes.delivery.system.ts

@@ -675,7 +675,10 @@ export class MultiModeDeliverySystem extends EventEmitter {
       const transition = await this.queue.markFailedWithTransition(item.id, deliveryError.message, {
         retryable: deliveryError.retryable,
         terminalFailure: {
-          failureClass: deliveryError.errorType.startsWith('self_mx_')
+          failureClass: (
+            deliveryError.errorType.startsWith('self_mx_')
+            || deliveryError.errorType === 'deliver_action_relay_unsupported'
+          )
             ? 'localTopology'
             : 'transport',
           ...(deliveryError.smtpCode !== undefined ? { smtpCode: deliveryError.smtpCode } : {}),
@@ -775,7 +778,7 @@ export class MultiModeDeliverySystem extends EventEmitter {
       const dkimDomain = item.route?.action.options?.mtaOptions?.dkimSign
         ? (item.route.action.options.mtaOptions.dkimOptions?.domainName || email.getFromDomain() || undefined)
         : undefined;
-      const dkimSelector = item.route?.action.options?.mtaOptions?.dkimOptions?.keySelector || 'default';
+      const dkimSelector = this.resolveDkimSelector(item, dkimDomain);
 
       // Build auth options from route forward config
       const auth = route?.action.forward?.auth as { user: string; pass: string } | undefined;
@@ -847,6 +850,20 @@ export class MultiModeDeliverySystem extends EventEmitter {
     }
   }
   
+  /**
+   * Resolve the DKIM selector for signed delivery. Without explicit route
+   * dkimOptions the selector comes from the domain registry's per-domain
+   * configuration (which key rotation keeps current), not a hardcoded
+   * 'default'; 'default' remains only the last fallback.
+   */
+  private resolveDkimSelector(item: IQueueItem, dkimDomain: string | undefined): string {
+    return item.route?.action.options?.mtaOptions?.dkimOptions?.keySelector
+      || (dkimDomain
+        ? this.emailServer?.getDomainRegistry?.()?.getDomainConfig(dkimDomain)?.dkim?.selector
+        : undefined)
+      || 'default';
+  }
+
   /**
    * Resolve MX records for a domain, sorted by priority (lowest first).
    * Falls back to the domain itself as an A record per RFC 5321.
@@ -926,6 +943,22 @@ export class MultiModeDeliverySystem extends EventEmitter {
 
     const email = item.processingResult as Email;
 
+    // Structural invariant: `deliver` actions are terminal local deliveries
+    // and must never reach outbound MX relay (and thus never the self-MX
+    // guard below). Items carrying a deliver action can only be pre-9.x
+    // persisted queue state or a direct-enqueue misuse; both fail loudly
+    // here instead of relaying or bouncing as a misleading self-MX loop.
+    if (item.route?.action.type === 'deliver') {
+      throw new SmtpDeliveryError({
+        message: `Queue item ${item.id} carries a 'deliver' action; deliver is a terminal local delivery and cannot be relayed via MX`,
+        errorType: 'deliver_action_relay_unsupported',
+        retryable: false,
+        phase: 'connect',
+        transactionLog: [],
+        recipients: email.getAllRecipients(),
+      });
+    }
+
     if (!this.emailServer) {
       throw new Error('No email server available for MTA delivery');
     }
@@ -937,7 +970,7 @@ export class MultiModeDeliverySystem extends EventEmitter {
     const dkimDomain = effectiveDkimSigning
       ? (item.route?.action.options?.mtaOptions?.dkimOptions?.domainName || email.getFromDomain() || undefined)
       : undefined;
-    const dkimSelector = item.route?.action.options?.mtaOptions?.dkimOptions?.keySelector || 'default';
+    const dkimSelector = this.resolveDkimSelector(item, dkimDomain);
 
     const allRecipients = email.getAllRecipients();
     if (allRecipients.length === 0) {

package/ts/mail/routing/classes.email.action.executor.ts

@@ -47,7 +47,10 @@ export interface IActionExecutionResult {
 }
 
 /**
- * Executes email routing actions (forward, process, deliver, reject)
+ * Executes queue-backed and rejecting email routing actions (forward,
+ * process, reject). Terminal local-delivery actions (`deliver`, `store`) are
+ * owned by the durable `hooks.onAcceptEnvelope` acceptance path and are
+ * refused here.
  */
 export class EmailActionExecutor {
   constructor(private deps: IActionExecutorDeps) {}
@@ -97,7 +100,9 @@ export class EmailActionExecutor {
       case 'process':
         return this.handleProcessAction(action, email, context, options);
       case 'deliver':
-        return this.handleDeliverAction(action, email, context, options);
+        throw new Error(
+          'Deliver actions are terminal local deliveries and require the durable hooks.onAcceptEnvelope acceptance path; they never enqueue outbound MX relay',
+        );
       case 'store':
         throw new Error(
           'Store actions require raw SMTP context and an awaited hooks.onAcceptEnvelope handler',
@@ -250,32 +255,6 @@ export class EmailActionExecutor {
     return { outcome: 'queued', queueId };
   }
 
-  private async handleDeliverAction(
-    _action: IEmailAction,
-    email: Email,
-    context: IEmailContext,
-    options: IActionExecutionOptions,
-  ): Promise<IActionExecutionResult> {
-    logger.log('info', `Delivering email locally`);
-
-    // Queue for local delivery
-    const queueId = await this.deps.deliveryQueue.enqueue(
-      email,
-      'mta',
-      context.session.matchedRoute!,
-      options.durableQueue
-        ? {
-            idempotencyKey: options.durableQueue.idempotencyKey,
-            idempotencyFingerprint: options.durableQueue.fingerprint,
-            requireDurable: true,
-          }
-        : {},
-    );
-
-    logger.log('info', 'Email queued for local delivery');
-    return { outcome: 'queued', queueId };
-  }
-
   private async handleRejectAction(action: IEmailAction, _email: Email, context: IEmailContext): Promise<void> {
     const code = action.reject?.code || 550;
     const message = action.reject?.message || 'Message rejected';