@push.rocks/smartmta 9.0.0 → 9.1.1

package/dist_ts/mail/routing/functions.routing.validation.d.ts

@@ -1,3 +1,17 @@
+import type { ISmtpAuthAccount } from './interfaces.js';
+/**
+ * PBKDF2 iteration bounds for SCRAM verifiers. The lower bound is the RFC
+ * 5802 recommended minimum; the upper bound caps per-attempt CPU so a single
+ * AUTH cannot exhaust the Rust bridge's 5s callback window.
+ */
+export declare const SCRAM_MIN_ITERATIONS = 4096;
+export declare const SCRAM_MAX_ITERATIONS = 1000000;
+/**
+ * Loudly reject unusable SMTP auth account configurations. Every failure
+ * mode here would otherwise degrade into a silent deny-all (empty scope
+ * patterns) or a silent authentication failure (malformed verifier keys).
+ */
+export declare function assertValidAuthAccounts(accounts: ISmtpAuthAccount[] | undefined): void;
 /**
  * Reject retention values that cannot be represented and scheduled reliably.
  */

package/dist_ts/mail/routing/functions.routing.validation.js

@@ -1,3 +1,99 @@
+/**
+ * PBKDF2 iteration bounds for SCRAM verifiers. The lower bound is the RFC
+ * 5802 recommended minimum; the upper bound caps per-attempt CPU so a single
+ * AUTH cannot exhaust the Rust bridge's 5s callback window.
+ */
+export const SCRAM_MIN_ITERATIONS = 4096;
+export const SCRAM_MAX_ITERATIONS = 1_000_000;
+const isBase64OfLength = (value, byteLength) => {
+    if (typeof value !== 'string' || value.length === 0)
+        return false;
+    try {
+        const decoded = Buffer.from(value, 'base64');
+        if (decoded.length === 0)
+            return false;
+        // Reject strings that silently drop invalid characters on decode.
+        if (decoded.toString('base64').replace(/=+$/, '') !== value.replace(/=+$/, '')) {
+            return false;
+        }
+        return byteLength === undefined || decoded.length === byteLength;
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Loudly reject unusable SMTP auth account configurations. Every failure
+ * mode here would otherwise degrade into a silent deny-all (empty scope
+ * patterns) or a silent authentication failure (malformed verifier keys).
+ */
+export function assertValidAuthAccounts(accounts) {
+    if (accounts === undefined)
+        return;
+    if (!Array.isArray(accounts)) {
+        throw new Error('auth.accounts must be an array');
+    }
+    const usernames = new Set();
+    for (const account of accounts) {
+        const username = account?.username;
+        if (typeof username !== 'string' || !username.trim()) {
+            throw new Error('auth.accounts entries require a non-empty username');
+        }
+        const owner = `auth account ${username}`;
+        if (usernames.has(username)) {
+            throw new Error(`${owner} is configured more than once`);
+        }
+        usernames.add(username);
+        const credential = account.credential;
+        const hasVerifier = credential?.verifier !== undefined;
+        const hasPassword = credential?.password !== undefined;
+        if (hasVerifier === hasPassword) {
+            throw new Error(`${owner} credential must contain exactly one of verifier or password`);
+        }
+        if (hasPassword && typeof credential.password !== 'string') {
+            throw new Error(`${owner} credential.password must be a string`);
+        }
+        if (hasVerifier) {
+            const verifier = credential.verifier;
+            if (verifier?.algorithm !== 'SCRAM-SHA-256') {
+                throw new Error(`${owner} verifier.algorithm must be SCRAM-SHA-256`);
+            }
+            if (!Number.isInteger(verifier.iterations)
+                || verifier.iterations < SCRAM_MIN_ITERATIONS
+                || verifier.iterations > SCRAM_MAX_ITERATIONS) {
+                throw new Error(`${owner} verifier.iterations must be an integer between ${SCRAM_MIN_ITERATIONS} and ${SCRAM_MAX_ITERATIONS}`);
+            }
+            if (!isBase64OfLength(verifier.salt)) {
+                throw new Error(`${owner} verifier.salt must be non-empty base64`);
+            }
+            if (!isBase64OfLength(verifier.storedKey, 32)) {
+                throw new Error(`${owner} verifier.storedKey must be base64 of a 32-byte key`);
+            }
+            if (!isBase64OfLength(verifier.serverKey, 32)) {
+                throw new Error(`${owner} verifier.serverKey must be base64 of a 32-byte key`);
+            }
+        }
+        const scope = account.scope;
+        if (scope === undefined)
+            continue;
+        if (!Array.isArray(scope.senders)
+            || scope.senders.length === 0
+            || scope.senders.some((pattern) => typeof pattern !== 'string' || !pattern.trim())) {
+            throw new Error(`${owner} scope.senders must be a non-empty array of address patterns`);
+        }
+        if (scope.recipients !== undefined) {
+            if (scope.recipients.mode !== 'any' && scope.recipients.mode !== 'patterns') {
+                throw new Error(`${owner} scope.recipients.mode must be any or patterns`);
+            }
+            if (scope.recipients.mode === 'patterns'
+                && (!Array.isArray(scope.recipients.patterns)
+                    || scope.recipients.patterns.length === 0
+                    || scope.recipients.patterns.some((pattern) => typeof pattern !== 'string' || !pattern.trim()))) {
+                throw new Error(`${owner} scope.recipients.patterns must be a non-empty array when mode is patterns`);
+            }
+        }
+    }
+}
 /**
  * Reject retention values that cannot be represented and scheduled reliably.
  */
@@ -15,4 +111,4 @@ export function assertValidInboundPolicy(inboundPolicy, domain) {
     }
     assertValidRetentionDays(inboundPolicy.retentionDays, `Inbound policy for domain ${domain}`);
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLnJvdXRpbmcudmFsaWRhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL21haWwvcm91dGluZy9mdW5jdGlvbnMucm91dGluZy52YWxpZGF0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxVQUFVLHdCQUF3QixDQUN0QyxhQUFzQixFQUN0QixLQUFhO0lBRWIsSUFDRSxPQUFPLGFBQWEsS0FBSyxRQUFRO1dBQzlCLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxhQUFhLENBQUM7V0FDcEMsYUFBYSxJQUFJLENBQUMsRUFDckIsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxLQUFLLGtEQUFrRCxDQUFDLENBQUM7SUFDOUUsQ0FBQztBQUNILENBQUM7QUFFRCxNQUFNLFVBQVUsd0JBQXdCLENBQ3RDLGFBR0MsRUFDRCxNQUFjO0lBRWQsSUFDRSxhQUFhLENBQUMsYUFBYSxLQUFLLE9BQU87V0FDcEMsYUFBYSxDQUFDLGFBQWEsS0FBSyxRQUFRLEVBQzNDLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUNiLDZCQUE2QixNQUFNLHdDQUF3QyxDQUM1RSxDQUFDO0lBQ0osQ0FBQztJQUNELHdCQUF3QixDQUN0QixhQUFhLENBQUMsYUFBYSxFQUMzQiw2QkFBNkIsTUFBTSxFQUFFLENBQ3RDLENBQUM7QUFDSixDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLnJvdXRpbmcudmFsaWRhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL21haWwvcm91dGluZy9mdW5jdGlvbnMucm91dGluZy52YWxpZGF0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUM7QUFDekMsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsU0FBUyxDQUFDO0FBRTlDLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxLQUFjLEVBQUUsVUFBbUIsRUFBVyxFQUFFO0lBQ3hFLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ2xFLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQzdDLElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxDQUFDO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDdkMsa0VBQWtFO1FBQ2xFLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUM7WUFDL0UsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBQ0QsT0FBTyxVQUFVLEtBQUssU0FBUyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssVUFBVSxDQUFDO0lBQ25FLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxVQUFVLHVCQUF1QixDQUNyQyxRQUF3QztJQUV4QyxJQUFJLFFBQVEsS0FBSyxTQUFTO1FBQUUsT0FBTztJQUNuQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQzdCLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUNwQyxLQUFLLE1BQU0sT0FBTyxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQy9CLE1BQU0sUUFBUSxHQUFHLE9BQU8sRUFBRSxRQUFRLENBQUM7UUFDbkMsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQztZQUNyRCxNQUFNLElBQUksS0FBSyxDQUFDLG9EQUFvRCxDQUFDLENBQUM7UUFDeEUsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLGdCQUFnQixRQUFRLEVBQUUsQ0FBQztRQUN6QyxJQUFJLFNBQVMsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUM1QixNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsS0FBSywrQkFBK0IsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFDRCxTQUFTLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRXhCLE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUVkLENBQUM7UUFDZCxNQUFNLFdBQVcsR0FBRyxVQUFVLEVBQUUsUUFBUSxLQUFLLFNBQVMsQ0FBQztRQUN2RCxNQUFNLFdBQVcsR0FBRyxVQUFVLEVBQUUsUUFBUSxLQUFLLFNBQVMsQ0FBQztRQUN2RCxJQUFJLFdBQVcsS0FBSyxXQUFXLEVBQUUsQ0FBQztZQUNoQyxNQUFNLElBQUksS0FBSyxDQUNiLEdBQUcsS0FBSyw4REFBOEQsQ0FDdkUsQ0FBQztRQUNKLENBQUM7UUFDRCxJQUFJLFdBQVcsSUFBSSxPQUFPLFVBQVcsQ0FBQyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDNUQsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUssdUNBQXVDLENBQUMsQ0FBQztRQUNuRSxDQUFDO1FBQ0QsSUFBSSxXQUFXLEVBQUUsQ0FBQztZQUNoQixNQUFNLFFBQVEsR0FBRyxVQUFXLENBQUMsUUFBdUMsQ0FBQztZQUNyRSxJQUFJLFFBQVEsRUFBRSxTQUFTLEtBQUssZUFBZSxFQUFFLENBQUM7Z0JBQzVDLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxLQUFLLDJDQUEyQyxDQUFDLENBQUM7WUFDdkUsQ0FBQztZQUNELElBQ0UsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7bUJBQ25DLFFBQVEsQ0FBQyxVQUFXLEdBQUcsb0JBQW9CO21CQUMzQyxRQUFRLENBQUMsVUFBVyxHQUFHLG9CQUFvQixFQUM5QyxDQUFDO2dCQUNELE1BQU0sSUFBSSxLQUFLLENBQ2IsR0FBRyxLQUFLLG1EQUFtRCxvQkFBb0IsUUFBUSxvQkFBb0IsRUFBRSxDQUM5RyxDQUFDO1lBQ0osQ0FBQztZQUNELElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztnQkFDckMsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUsseUNBQXlDLENBQUMsQ0FBQztZQUNyRSxDQUFDO1lBQ0QsSUFBSSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLEVBQUUsQ0FBQztnQkFDOUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUsscURBQXFELENBQUMsQ0FBQztZQUNqRixDQUFDO1lBQ0QsSUFBSSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLEVBQUUsQ0FBQztnQkFDOUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUsscURBQXFELENBQUMsQ0FBQztZQUNqRixDQUFDO1FBQ0gsQ0FBQztRQUVELE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUM7UUFDNUIsSUFBSSxLQUFLLEtBQUssU0FBUztZQUFFLFNBQVM7UUFDbEMsSUFDRSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQztlQUMxQixLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sS0FBSyxDQUFDO2VBQzFCLEtBQUssQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLE9BQU8sS0FBSyxRQUFRLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUMsRUFDbEYsQ0FBQztZQUNELE1BQU0sSUFBSSxLQUFLLENBQ2IsR0FBRyxLQUFLLDhEQUE4RCxDQUN2RSxDQUFDO1FBQ0osQ0FBQztRQUNELElBQUksS0FBSyxDQUFDLFVBQVUsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNuQyxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUMsSUFBSSxLQUFLLEtBQUssSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDLElBQUksS0FBSyxVQUFVLEVBQUUsQ0FBQztnQkFDNUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUssZ0RBQWdELENBQUMsQ0FBQztZQUM1RSxDQUFDO1lBQ0QsSUFDRSxLQUFLLENBQUMsVUFBVSxDQUFDLElBQUksS0FBSyxVQUFVO21CQUNqQyxDQUNELENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQzt1QkFDdEMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUM7dUJBQ3RDLEtBQUssQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLElBQUksQ0FDL0IsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sT0FBTyxLQUFLLFFBQVEsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsQ0FDNUQsQ0FDRixFQUNELENBQUM7Z0JBQ0QsTUFBTSxJQUFJLEtBQUssQ0FDYixHQUFHLEtBQUssNEVBQTRFLENBQ3JGLENBQUM7WUFDSixDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7QUFDSCxDQUFDO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLFVBQVUsd0JBQXdCLENBQ3RDLGFBQXNCLEVBQ3RCLEtBQWE7SUFFYixJQUNFLE9BQU8sYUFBYSxLQUFLLFFBQVE7V0FDOUIsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLGFBQWEsQ0FBQztXQUNwQyxhQUFhLElBQUksQ0FBQyxFQUNyQixDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUssa0RBQWtELENBQUMsQ0FBQztJQUM5RSxDQUFDO0FBQ0gsQ0FBQztBQUVELE1BQU0sVUFBVSx3QkFBd0IsQ0FDdEMsYUFHQyxFQUNELE1BQWM7SUFFZCxJQUNFLGFBQWEsQ0FBQyxhQUFhLEtBQUssT0FBTztXQUNwQyxhQUFhLENBQUMsYUFBYSxLQUFLLFFBQVEsRUFDM0MsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQ2IsNkJBQTZCLE1BQU0sd0NBQXdDLENBQzVFLENBQUM7SUFDSixDQUFDO0lBQ0Qsd0JBQXdCLENBQ3RCLGFBQWEsQ0FBQyxhQUFhLEVBQzNCLDZCQUE2QixNQUFNLEVBQUUsQ0FDdEMsQ0FBQztBQUNKLENBQUMifQ==

package/dist_ts/mail/routing/index.d.ts

@@ -5,3 +5,4 @@ export * from './interfaces.js';
 export * from './classes.domain.registry.js';
 export * from './classes.email.action.executor.js';
 export * from './classes.dkim.manager.js';
+export * from './functions.routing.validation.js';

package/dist_ts/mail/routing/index.js

@@ -6,4 +6,5 @@ export * from './interfaces.js';
 export * from './classes.domain.registry.js';
 export * from './classes.email.action.executor.js';
 export * from './classes.dkim.manager.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi90cy9tYWlsL3JvdXRpbmcvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsMkJBQTJCO0FBQzNCLGNBQWMsMkJBQTJCLENBQUM7QUFDMUMsY0FBYyxtQ0FBbUMsQ0FBQztBQUNsRCxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyw4QkFBOEIsQ0FBQztBQUM3QyxjQUFjLG9DQUFvQyxDQUFDO0FBQ25ELGNBQWMsMkJBQTJCLENBQUMifQ==
+export * from './functions.routing.validation.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi90cy9tYWlsL3JvdXRpbmcvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsMkJBQTJCO0FBQzNCLGNBQWMsMkJBQTJCLENBQUM7QUFDMUMsY0FBYyxtQ0FBbUMsQ0FBQztBQUNsRCxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyw4QkFBOEIsQ0FBQztBQUM3QyxjQUFjLG9DQUFvQyxDQUFDO0FBQ25ELGNBQWMsMkJBQTJCLENBQUM7QUFDMUMsY0FBYyxtQ0FBbUMsQ0FBQyJ9

package/dist_ts/mail/routing/interfaces.d.ts

@@ -25,6 +25,11 @@ export interface IEmailMatch {
     clientIp?: string | string[];
     /** Require authentication status */
     authenticated?: boolean;
+    /**
+     * Require the session to be authenticated as this exact username (or one
+     * of these usernames). Unauthenticated sessions never match such routes.
+     */
+    authenticatedUser?: string | string[];
     /** Headers to match */
     headers?: Record<string, string | RegExp>;
     /** Message size range */
@@ -136,6 +141,60 @@ export interface IEmailAction {
         retries?: number;
     };
 }
+/**
+ * Precomputed SCRAM-SHA-256 verifier for an SMTP auth account. Only derived
+ * key material is stored — the plaintext password never has to be persisted.
+ *
+ * Derivation (RFC 5802): SaltedPassword = PBKDF2-HMAC-SHA256(password, salt,
+ * iterations, 32); StoredKey = SHA256(HMAC-SHA256(SaltedPassword, 'Client Key'));
+ * ServerKey = HMAC-SHA256(SaltedPassword, 'Server Key').
+ */
+export interface ISmtpScramVerifier {
+    algorithm: 'SCRAM-SHA-256';
+    /** Base64-encoded PBKDF2 salt. */
+    salt: string;
+    /** PBKDF2 iteration count (4096 to 1000000, validated at configuration time). */
+    iterations: number;
+    /** Base64-encoded StoredKey. */
+    storedKey: string;
+    /** Base64-encoded ServerKey. */
+    serverKey: string;
+}
+/**
+ * Send-authorization scope for an authenticated SMTP account.
+ */
+export interface ISmtpAuthAccountScope {
+    /**
+     * Address patterns ('a@b.com' | '*@b.com') the account may send AS.
+     * Enforced against both the SMTP MAIL FROM envelope sender and the parsed
+     * message header From address.
+     */
+    senders: string[];
+    /** Recipient scope ("send TO who"). Absent or mode 'any' = unrestricted. */
+    recipients?: {
+        mode: 'any' | 'patterns';
+        /** Address patterns enforced for every RCPT TO when mode is 'patterns'. */
+        patterns?: string[];
+    };
+}
+/**
+ * Authenticated SMTP account with hashed credentials and send scopes.
+ */
+export interface ISmtpAuthAccount {
+    username: string;
+    /** Disabled accounts always fail authentication (default: enabled). */
+    enabled?: boolean;
+    /**
+     * Hashed SCRAM-SHA-256 verifier (preferred) or legacy plaintext password.
+     */
+    credential: {
+        verifier: ISmtpScramVerifier;
+    } | {
+        password: string;
+    };
+    /** Absent scope = unrestricted (backwards compatible). */
+    scope?: ISmtpAuthAccountScope;
+}
 /**
  * Context for route evaluation
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartmta",
-  "version": "9.0.0",
+  "version": "9.1.1",
   "description": "A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.",
   "keywords": [
     "mta",

package/readme.md

@@ -213,11 +213,21 @@ const emailServer = new UnifiedEmailServer(dcRouterRef, {
     },
   },
 
-  // Authentication settings for the SMTP server
+  // Authentication settings for the SMTP server.
+  // Legacy plaintext `users` and hashed `accounts` coexist; accounts win on
+  // username collision. See "Authenticated Accounts And Send Scopes" below.
   auth: {
     required: false,
     methods: ['PLAIN', 'LOGIN'],
     users: [{ username: 'outbound', password: 'secret' }],
+    accounts: [{
+      username: 'newsletter-service',
+      credential: { verifier: storedScramVerifier },
+      scope: {
+        senders: ['newsletter@example.com'],
+        recipients: { mode: 'any' },
+      },
+    }],
   },
 
   // TLS material is provided in memory; SmartMTA does not read certificate files.
@@ -290,6 +300,63 @@ Use `smtp.securePort` when the implicit TLS listener uses a remapped backend por
 
 Trusted PROXY protocol v1 support is configured with `smtp.proxyProtocol`. Only enable `required: true` on backend listeners that are reached through a trusted local or private proxy, and always provide `trustedIps`. Required PROXY mode fails closed when no trusted peers are configured.
 
+### 🔐 Authenticated Accounts And Send Scopes
+
+`auth.accounts` defines authenticated SMTP submission accounts with hashed credentials and per-account send authorization. It coexists with the legacy plaintext `auth.users` array; when both define the same username, the account wins.
+
+```typescript
+import type { ISmtpAuthAccount } from '@push.rocks/smartmta';
+
+const accounts: ISmtpAuthAccount[] = [
+  {
+    username: 'newsletter-service',
+    // Hashed SCRAM-SHA-256 verifier — the plaintext password is never stored.
+    // SaltedPassword = PBKDF2-HMAC-SHA256(password, salt, iterations, 32)
+    // StoredKey = SHA256(HMAC-SHA256(SaltedPassword, 'Client Key'))
+    // ServerKey = HMAC-SHA256(SaltedPassword, 'Server Key')
+    credential: {
+      verifier: {
+        algorithm: 'SCRAM-SHA-256',
+        salt: '<base64 salt>',
+        iterations: 4096, // minimum
+        storedKey: '<base64 StoredKey>',
+        serverKey: '<base64 ServerKey>',
+      },
+    },
+    scope: {
+      // "send AS who": enforced against the SMTP MAIL FROM envelope sender
+      // AND the parsed message header From address.
+      senders: ['newsletter@example.com', '*@mail.example.com'],
+      // "send TO who": optional; absent or mode 'any' = unrestricted.
+      recipients: { mode: 'patterns', patterns: ['*@example.com'] },
+    },
+  },
+  {
+    username: 'trusted-app',
+    // Plaintext credential is supported for migration, but verifiers are preferred.
+    credential: { password: 'app-password' },
+    // No scope: unrestricted, exactly like a legacy auth.users entry.
+  },
+];
+
+server.updateOptions({ auth: { accounts } });
+```
+
+Enforcement semantics:
+
+- **Credentials** — `PLAIN`/`LOGIN` passwords are verified against the stored verifier by deriving `StoredKey` from the presented password (PBKDF2-HMAC-SHA256 on the async crypto threadpool) and comparing in constant time. `SCRAM-SHA-256` clients are served the stored verifier fields directly, so the plaintext never needs to exist server-side. Accounts with `enabled: false` always fail authentication on both mechanisms. Verification is fully in-memory — no I/O inside the Rust auth callback window.
+- **Sender scope ("send AS who")** — enforced twice. At the first `RCPT TO`, an out-of-scope `MAIL FROM` is refused with `553` before any recipient is accepted (with `smtp.recipientValidation: false` this check still runs, but only at `DATA`). At `DATA`, the envelope sender (taken from session envelope truth, never the parsed message alone) is re-checked per recipient, and **every** parsed header `From` mailbox must independently be in scope — header-From spoofing behind an in-scope envelope, including multi-mailbox `From:` headers, is refused with `553`.
+- **Recipient scope ("send TO who")** — with `recipients.mode: 'patterns'`, every `RCPT TO` matching no pattern is refused with `550`. `mode: 'any'` or an absent `recipients` block leaves recipients unrestricted.
+- **Patterns** are exact addresses (`a@b.com`) or glob patterns (`*@b.com`), matched case-insensitively with identical semantics to route matching. A scoped account sending with an empty `MAIL FROM <>` (null sender) is refused unless a pattern explicitly matches — `senders: ['*']` is the documented escape hatch.
+- **Route binding** — a route with `match.authenticatedUser: 'newsletter-service'` (or an array of usernames) matches only sessions authenticated as that account (exact, case-sensitive username comparison), so dedicated processing or relay routes can be attached per account. Unauthenticated sessions never match such routes.
+- **Rejections** surface through `onRecipientRejected` with the reasons `sender-scope`, `recipient-scope`, and `account-disabled`.
+- **Live enablement** — when a configuration update transitions between zero and one-or-more accounts/users, `updateOptions` restarts only the Rust SMTP listener so the `AUTH` capability appears or disappears without a process restart. A failed listener restart logs loudly, emits `smtpListenerRestartFailed`, and leaves `isSmtpListenerActive()` false — surface that next to `getBridgeState()` in health endpoints.
+- An account without a `scope` is authenticated but unrestricted — identical to legacy `auth.users` behavior, which itself is unchanged.
+
+Configuration is validated loudly at construction and `updateOptions` time: unusable accounts (empty `scope.senders`, `mode: 'patterns'` without patterns, both or neither credential kind, malformed base64 keys, `iterations` outside `[4096, 1000000]`, duplicate usernames) throw instead of degrading into silent deny-all or silent auth failure. Note that `updateOptions({ auth })` replaces the whole `auth` block — include `users`, `required`, and `methods` again if they should persist.
+
+Compatibility probe: `smartMtaCapabilities.smtpAuthAccountsAndScopes`.
+
 ### 📧 Sending Emails (Automatic MX Discovery)
 
 The recommended way to send email is `sendEmail()`. It defaults to **MTA mode**, which automatically resolves MX records for each recipient domain via DNS — you don't need to know the destination mail server:
@@ -440,8 +507,9 @@ When `UnifiedEmailServer.start()` is called:
 - With `dkimKeyProvisioning: 'caller-managed'`, SmartMTA only loads the requested selector from managed storage; it never generates or rotates keys.
 - A requested missing or invalid key fails closed before SMTP delivery. SmartMTA never falls back to unsigned delivery.
 - Signing is applied exactly once, by the Rust SMTP client at final outbound transmission.
+- When a route enables signing without explicit `dkimOptions`, the selector is resolved from the sending domain's registry configuration (`domains[].dkim.selector`); the hardcoded `'default'` selector is only the last fallback.
 
-Embedders can check `smartMtaCapabilities.selectorCorrectDkimSigning`, `callerManagedDkimKeys`, `structuredSmtpTransactions`, `typedDeliveryFailures`, and `terminalLocalDeliverActions` (deliver routes are terminal local deliveries through the durable acceptance path) as compatibility probes.
+Embedders can check `smartMtaCapabilities.selectorCorrectDkimSigning`, `callerManagedDkimKeys`, `structuredSmtpTransactions`, `typedDeliveryFailures`, `terminalLocalDeliverActions` (deliver routes are terminal local deliveries through the durable acceptance path), and `smtpAuthAccountsAndScopes` (authenticated accounts with hashed credentials and send scopes) as compatibility probes.
 
 ### 🛡️ Email Authentication (SPF, DKIM, DMARC)
 
@@ -547,6 +615,7 @@ Every action can include `allowRelay?: boolean`. It defaults to `false`. Non-loc
 | `senders` | Glob patterns for sender addresses |
 | `clientIp` | IP addresses or CIDR ranges |
 | `authenticated` | Require authentication status |
+| `authenticatedUser` | Require the session to be authenticated as this exact username (string or array of usernames) |
 | `headers` | Match specific headers (string or RegExp) |
 | `sizeRange` | Message size constraints (`{ min?, max? }`) |
 | `subject` | Subject line pattern (string or RegExp) |
@@ -697,7 +766,7 @@ The Rust `mailer-bin` process is supervised by `RustSecurityBridge`:
 - **Health checks** — a `ping` every 30 s; two consecutive failures kill and restart the process.
 - **Auto-restart** — any unexpected exit triggers restart with exponential backoff (1 s → 30 s). After `maxRestartAttempts` fast attempts the bridge enters the `failed` state but keeps retrying at the slow cadence forever — it never silently stays dead.
 - **SMTP server restore** — after a restart the SMTP listener is restored; if the restore fails, the process is killed and the restart cycle continues rather than reporting a half-alive bridge.
-- **State surface** — `UnifiedEmailServer.getBridgeState()` returns `'idle' | 'starting' | 'running' | 'restarting' | 'failed' | 'stopped'`; the server emits `bridgeFailed`, `bridgeRestarting`, and `bridgeRecovered` events for embedders' alerting.
+- **State surface** — `UnifiedEmailServer.getBridgeState()` returns `'idle' | 'starting' | 'running' | 'restarting' | 'failed' | 'stopped'`; the server emits `bridgeFailed`, `bridgeRestarting`, and `bridgeRecovered` events for embedders' alerting. `isSmtpListenerActive()` reports whether the Rust SMTP listener is accepting connections, and a failed listener reconfiguration emits `smtpListenerRestartFailed`.
 
 Tune with `RustSecurityBridge.configure({ maxRestartAttempts, healthCheckIntervalMs, healthCheckTimeoutMs, restartBackoffBaseMs, restartBackoffMaxMs })`.
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartmta',
-  version: '9.0.0',
+  version: '9.1.1',
   description: 'A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.'
 }

package/ts/index.ts

@@ -15,4 +15,5 @@ export const smartMtaCapabilities = Object.freeze({
   durableDeliveryFailureOutbox: true,
   exactAcceptedEnvelopeDispatch: true,
   terminalLocalDeliverActions: true,
+  smtpAuthAccountsAndScopes: true,
 } as const);

package/ts/mail/delivery/classes.delivery.system.ts

@@ -778,7 +778,7 @@ export class MultiModeDeliverySystem extends EventEmitter {
       const dkimDomain = item.route?.action.options?.mtaOptions?.dkimSign
         ? (item.route.action.options.mtaOptions.dkimOptions?.domainName || email.getFromDomain() || undefined)
         : undefined;
-      const dkimSelector = item.route?.action.options?.mtaOptions?.dkimOptions?.keySelector || 'default';
+      const dkimSelector = this.resolveDkimSelector(item, dkimDomain);
 
       // Build auth options from route forward config
       const auth = route?.action.forward?.auth as { user: string; pass: string } | undefined;
@@ -850,6 +850,20 @@ export class MultiModeDeliverySystem extends EventEmitter {
     }
   }
   
+  /**
+   * Resolve the DKIM selector for signed delivery. Without explicit route
+   * dkimOptions the selector comes from the domain registry's per-domain
+   * configuration (which key rotation keeps current), not a hardcoded
+   * 'default'; 'default' remains only the last fallback.
+   */
+  private resolveDkimSelector(item: IQueueItem, dkimDomain: string | undefined): string {
+    return item.route?.action.options?.mtaOptions?.dkimOptions?.keySelector
+      || (dkimDomain
+        ? this.emailServer?.getDomainRegistry?.()?.getDomainConfig(dkimDomain)?.dkim?.selector
+        : undefined)
+      || 'default';
+  }
+
   /**
    * Resolve MX records for a domain, sorted by priority (lowest first).
    * Falls back to the domain itself as an A record per RFC 5321.
@@ -956,7 +970,7 @@ export class MultiModeDeliverySystem extends EventEmitter {
     const dkimDomain = effectiveDkimSigning
       ? (item.route?.action.options?.mtaOptions?.dkimOptions?.domainName || email.getFromDomain() || undefined)
       : undefined;
-    const dkimSelector = item.route?.action.options?.mtaOptions?.dkimOptions?.keySelector || 'default';
+    const dkimSelector = this.resolveDkimSelector(item, dkimDomain);
 
     const allRecipients = email.getAllRecipients();
     if (allRecipients.length === 0) {

package/ts/mail/routing/classes.email.router.ts

@@ -6,6 +6,21 @@ import type { Email } from '../core/classes.email.js';
 import { getErrorMessage } from '../../functions.errors.js';
 import { assertValidRetentionDays } from './functions.routing.validation.js';
 
+/**
+ * Convert an address glob pattern ('a@b.com' | '*@b.com' | 'admin@*') into a
+ * case-insensitive full-match RegExp. Shared by route matching and auth
+ * account scope enforcement so both use identical pattern semantics.
+ */
+export function addressGlobToRegExp(pattern: string): RegExp {
+  // Escape special regex characters except * and ?
+  const regexString = pattern
+    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+    .replace(/\*/g, '.*')
+    .replace(/\?/g, '.');
+
+  return new RegExp(`^${regexString}$`, 'i');
+}
+
 /**
  * Email router that evaluates routes and determines actions
  */
@@ -185,11 +200,17 @@ export class EmailRouter extends EventEmitter {
     }
     
     // Check authentication
-    if (match.authenticated !== undefined && 
+    if (match.authenticated !== undefined &&
         context.session.authenticated !== match.authenticated) {
       return false;
     }
-    
+
+    // Check authenticated username binding
+    if (match.authenticatedUser !== undefined &&
+        !this.matchesAuthenticatedUser(context.session, match.authenticatedUser)) {
+      return false;
+    }
+
     // Check headers
     if (match.headers && !this.matchesHeaders(context.email, match.headers)) {
       return false;
@@ -253,6 +274,25 @@ export class EmailRouter extends EventEmitter {
     return false;
   }
   
+  /**
+   * Check if the session is authenticated as one of the required usernames.
+   * Unauthenticated sessions never match.
+   * @param session SMTP session
+   * @param usernames Required username or usernames
+   * @returns True if the session's authenticated username is in the set
+   */
+  private matchesAuthenticatedUser(
+    session: IEmailContext['session'],
+    usernames: string | string[],
+  ): boolean {
+    const username = session.user?.username;
+    if (!username) {
+      return false;
+    }
+    const allowed = Array.isArray(usernames) ? usernames : [usernames];
+    return allowed.includes(username);
+  }
+
   /**
    * Check if client IP matches patterns
    * @param context Email context
@@ -374,13 +414,7 @@ export class EmailRouter extends EventEmitter {
    * @returns Regular expression
    */
   private globToRegExp(pattern: string): RegExp {
-    // Escape special regex characters except * and ?
-    let regexString = pattern
-      .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-      .replace(/\*/g, '.*')
-      .replace(/\?/g, '.');
-    
-    return new RegExp(`^${regexString}$`, 'i');
+    return addressGlobToRegExp(pattern);
   }
   
   /**