@push.rocks/smartmta 9.4.1 → 9.6.0

package/ts/mail/routing/classes.unified.email.server.ts

@@ -28,6 +28,9 @@ import type {
   IEmailContext,
   IEmailDomainConfig,
   ISmtpAuthAccount,
+  ISmtpAuthAccountScope,
+  ISmtpAuthenticateContext,
+  ISmtpAuthenticateDecision,
   ISmtpScramVerifier,
 } from './interfaces.js';
 import { Email } from '../core/classes.email.js';
@@ -38,6 +41,7 @@ import type { ISmtpSendResult, IOutboundEmail } from '../../security/classes.rus
 import { MultiModeDeliverySystem, type IDeliveryStats, type IMultiModeDeliveryOptions } from '../delivery/classes.delivery.system.js';
 import {
   ACCEPTED_ENVELOPE_IDEMPOTENCY_RETENTION_MS,
+  DEFAULT_MAX_RAW_MESSAGE_BYTES,
   UnifiedDeliveryQueue,
   type IQueueItem,
   type IQueueOptions,
@@ -49,6 +53,20 @@ import type { EmailProcessingMode, ISmtpSession as IBaseSmtpSession } from '../d
 import { EmailActionExecutor } from './classes.email.action.executor.js';
 import { DkimManager } from './classes.dkim.manager.js';
 import { callObserverSafely, emitSafely } from '../delivery/functions.safe-observers.js';
+import {
+  assertCanonicalRawRfc822Message,
+  normalizeRawSmtpEnvelope,
+  type IRawSmtpEnvelope,
+} from '../delivery/functions.raw-email.js';
+import {
+  kQueueCloseAdmission,
+  kQueueEnqueueRaw,
+  kQueueReserveRawAccess,
+} from '../delivery/symbols.delivery.queue.js';
+import {
+  kSendOutboundEmailInternal,
+  kSendRawOutboundEmailInternal,
+} from './symbols.unified.email.server.js';
 
 
 /** External DcRouter interface shape used by UnifiedEmailServer */
@@ -69,7 +87,8 @@ export type TRecipientRejectionReason =
   | 'policy-error'
   | 'sender-scope'
   | 'recipient-scope'
-  | 'account-disabled';
+  | 'account-disabled'
+  | 'auth-scope-expired';
 
 export interface IResolvedRecipientRoute {
   recipient: string;
@@ -282,6 +301,30 @@ export interface IOutboundTopologyIdentity {
   ipAddresses?: string[];
 }
 
+interface IOutboundTransportParameters {
+  host: string;
+  port: number;
+  connectHost?: string;
+  connectPort?: number;
+  secure: boolean;
+  domain: string;
+  auth?: { user: string; pass: string };
+  connectionTimeoutSecs: number;
+  socketTimeoutSecs: number;
+  poolKey: string;
+  maxPoolConnections: number;
+  tlsOpportunistic: boolean;
+  disablePooling?: boolean;
+  outboundAuthenticationCaptureId?: string;
+}
+
+interface IOutboundDkimMaterial {
+  domain: string;
+  selector: string;
+  privateKey: string;
+  keyType: 'rsa' | 'ed25519';
+}
+
 export interface ISelfMxIdentityMatch {
   isSelf: boolean;
   source: 'explicit' | 'dns-derived' | 'dynamic' | null;
@@ -359,6 +402,8 @@ export interface IUnifiedEmailServerOptions {
     tlsTerminatedPorts?: number[];
     /** Timeout for RCPT policy callbacks. Defaults to 5000 ms. */
     recipientValidationTimeoutMs?: number;
+    /** Timeout for `hooks.onAuthenticate` callbacks. Defaults to 5000 ms. */
+    authenticationTimeoutMs?: number;
     /** Timeout for message acceptance callbacks. Defaults to 30000 ms. */
     messageAcceptanceTimeoutMs?: number;
     /** Maximum complete messages concurrently held across Rust and TypeScript. */
@@ -371,6 +416,24 @@ export interface IUnifiedEmailServerOptions {
   };
 
   hooks?: {
+    /**
+     * Async credential verification for PLAIN/LOGIN, letting an embedding
+     * application own dynamic SMTP credentials that no static configuration
+     * can express.
+     *
+     * Consulted only for usernames that `auth.accounts` and `auth.users` do
+     * not declare: configuration always owns the usernames it lists, so a
+     * hook can never override or weaken a configured credential. Configuring
+     * the hook enables SMTP AUTH on the listener even with no accounts.
+     *
+     * The returned `scope` is enforced for that session exactly as a
+     * configured account's scope is. A throw or a
+     * `smtp.authenticationTimeoutMs` timeout fails the attempt closed.
+     *
+     * SCRAM cannot be served from this hook — see `onAuthenticate` notes in
+     * the readme. Hook-owned usernames authenticate over PLAIN/LOGIN only.
+     */
+    onAuthenticate?: (context: ISmtpAuthenticateContext) => Promise<ISmtpAuthenticateDecision>;
     /** Async recipient policy hook that may further restrict an accepted built-in decision. */
     onRcptTo?: (context: IRcptToPolicyContext) => Promise<ISmtpDecision>;
     /** Async message acceptance hook for envelopes with no resolved `store` or `deliver` action. */
@@ -499,12 +562,41 @@ export class UnifiedEmailServer extends EventEmitter {
   private smtpListenerActive = false;
   private smtpListenerShutdown = false;
   private smtpListenerRestartPromise?: Promise<void>;
+  private acceptingOutboundWork = true;
+  private readonly outboundWorkFlights = new Set<Promise<unknown>>();
+  private readonly outboundAuthenticationFlights = new Set<Promise<IOutboundAuthenticationCheck>>();
+  private stopFlight?: Promise<void>;
   private static readonly VERIFIER_DERIVATION_CONCURRENCY = 4;
   private static readonly VERIFIER_DERIVATION_MAX_QUEUE = 32;
   private verifierDerivationActive = 0;
   private verifierDerivationWaiters: Array<() => void> = [];
   /** Compiled scope patterns; keys are config-supplied, bounded by config size. */
   private scopePatternCache: Map<string, RegExp> = new Map();
+  /**
+   * Scopes granted by `hooks.onAuthenticate`, keyed by the session the
+   * credential authenticated. The SMTP listener reports no session-close
+   * event, so entries are bounded by both a TTL and a hard cap rather than
+   * by session lifetime.
+   *
+   * Losing an entry must never widen a session, so the absence of a grant is
+   * not read as "unrestricted": a session authenticated as a username that
+   * configuration does not declare can only have come from the hook, and is
+   * refused with a temporary failure until it authenticates again.
+   */
+  private hookAuthenticatedSessions: Map<
+    string,
+    { username: string; scope?: ISmtpAuthAccountScope; expiresAt: number }
+  > = new Map();
+  private static readonly hookAuthSessionTtlMs = 60 * 60 * 1000;
+  private static readonly hookAuthSessionMax = 4096;
+  private static readonly hookAuthSweepInterval = 256;
+  private hookAuthSweepCountdown = UnifiedEmailServer.hookAuthSweepInterval;
+  /** The Rust listener's fixed AUTH round-trip deadline. */
+  private static readonly listenerAuthDeadlineMs = 5000;
+  /** Leave headroom so a hook answering just in time still beats the listener. */
+  private static readonly authHookMaxTimeoutMs = 4500;
+  private static readonly authHookDefaultTimeoutMs = 4000;
+  private loggedAuthTimeoutClamp = false;
 
   constructor(dcRouter: DcRouter, options: IUnifiedEmailServerOptions) {
     super();
@@ -525,113 +617,163 @@ export class UnifiedEmailServer extends EventEmitter {
     // never degrade into silent deny-all scopes or silent auth failures.
     assertValidAuthAccounts(this.options.auth?.accounts);
 
-    // Initialize Rust security bridge (singleton)
-    this.rustBridge = RustSecurityBridge.getInstance();
+    // Subsystem construction below takes ownership of event-loop resources
+    // (the bounce manager and the rate limiter arm cleanup intervals in their
+    // constructors) while later steps still reject invalid configuration by
+    // throwing. A throwing constructor never returns an instance, so nothing
+    // can ever call stop() on it: construction is the only owner that can hand
+    // those resources back.
+    try {
+      // Initialize Rust security bridge (singleton)
+      this.rustBridge = RustSecurityBridge.getInstance();
 
-    // Initialize DKIM creator with storage manager
-    this.dkimCreator = new DKIMCreator(dcRouter.storageManager);
+      // Initialize DKIM creator with storage manager
+      this.dkimCreator = new DKIMCreator(dcRouter.storageManager);
 
-    // Initialize bounce manager with storage manager
-    this.bounceManager = new BounceManager({
-      maxCacheSize: 10000,
-      cacheTTL: 30 * 24 * 60 * 60 * 1000, // 30 days
-      storageManager: dcRouter.storageManager
-    });
+      // Initialize bounce manager with storage manager
+      this.bounceManager = new BounceManager({
+        maxCacheSize: 10000,
+        cacheTTL: 30 * 24 * 60 * 60 * 1000, // 30 days
+        storageManager: dcRouter.storageManager
+      });
 
-    // Initialize domain registry
-    this.domainRegistry = new DomainRegistry(options.domains, options.defaults);
+      // Initialize domain registry
+      this.domainRegistry = new DomainRegistry(options.domains, options.defaults);
 
-    // Initialize email router with routes and storage manager. The action
-    // policy applies to configured, updated, and storage-hydrated routes so
-    // an unservable route set fails loudly at configuration time.
-    this.emailRouter = new EmailRouter(options.routes || [], {
-      storageManager: dcRouter.storageManager,
-      persistChanges: options.persistRoutes ?? true,
-      validateAction: (route) => this.assertRouteActionServable(route),
-    });
+      // Initialize email router with routes and storage manager. The action
+      // policy applies to configured, updated, and storage-hydrated routes so
+      // an unservable route set fails loudly at configuration time.
+      this.emailRouter = new EmailRouter(options.routes || [], {
+        storageManager: dcRouter.storageManager,
+        persistChanges: options.persistRoutes ?? true,
+        validateAction: (route) => this.assertRouteActionServable(route),
+      });
 
-    // Initialize rate limiter
-    this.rateLimiter = new UnifiedRateLimiter(options.rateLimits || {
-      global: {
-        maxConnectionsPerIP: 10,
-        maxMessagesPerMinute: 100,
-        maxRecipientsPerMessage: 50,
-        maxErrorsPerIP: 10,
-        maxAuthFailuresPerIP: 5,
-        blockDuration: 300000 // 5 minutes
-      }
-    });
+      // Initialize rate limiter
+      this.rateLimiter = new UnifiedRateLimiter(options.rateLimits || {
+        global: {
+          maxConnectionsPerIP: 10,
+          maxMessagesPerMinute: 100,
+          maxRecipientsPerMessage: 50,
+          maxErrorsPerIP: 10,
+          maxAuthFailuresPerIP: 5,
+          blockDuration: 300000 // 5 minutes
+        }
+      });
 
-    // Initialize delivery components
-    const queueOptions: IQueueOptions = {
-      maxRetries: 3,
-      baseRetryDelay: 300000, // 5 minutes
-      maxRetryDelay: 3600000, // 1 hour
-      ...options.queue,
-    };
+      // Initialize delivery components
+      const queueOptions: IQueueOptions = {
+        maxRetries: 3,
+        baseRetryDelay: 300000, // 5 minutes
+        maxRetryDelay: 3600000, // 1 hour
+        ...options.queue,
+      };
 
-    this.deliveryQueue = new UnifiedDeliveryQueue(queueOptions);
-
-    const deliveryOptions: IMultiModeDeliveryOptions = {
-      globalRateLimit: 100, // Default to 100 emails per minute
-      concurrentDeliveries: 10,
-      processBounces: true,
-      bounceHandler: {
-        processSmtpFailure: async (recipient, smtpResponse, failureOptions) => {
-          const processed = await this.processSmtpFailure(
-            recipient,
-            smtpResponse,
-            failureOptions,
-          );
-          if (!processed) {
-            throw new Error(`SMTP bounce operation failed for ${recipient}`);
-          }
+      this.deliveryQueue = new UnifiedDeliveryQueue(queueOptions);
+
+      const deliveryOptions: IMultiModeDeliveryOptions = {
+        globalRateLimit: 100, // Default to 100 emails per minute
+        concurrentDeliveries: 10,
+        processBounces: true,
+        bounceHandler: {
+          processSmtpFailure: async (recipient, smtpResponse, failureOptions) => {
+            const processed = await this.processSmtpFailure(
+              recipient,
+              smtpResponse,
+              failureOptions,
+            );
+            if (!processed) {
+              throw new Error(`SMTP bounce operation failed for ${recipient}`);
+            }
+          },
         },
-      },
-      onDeliverySuccess: async (_item, _result) => {
-        // Delivery success recorded via delivery system
-      }
-    };
+        onDeliverySuccess: async (_item, _result) => {
+          // Delivery success recorded via delivery system
+        }
+      };
 
-    this.deliverySystem = new MultiModeDeliverySystem(this.deliveryQueue, deliveryOptions, this);
+      this.deliverySystem = new MultiModeDeliverySystem(this.deliveryQueue, deliveryOptions, this);
 
-    // Initialize action executor
-    this.actionExecutor = new EmailActionExecutor({
-      sendOutboundEmail: this.sendOutboundEmail.bind(this),
-      bounceManager: this.bounceManager,
-      deliveryQueue: this.deliveryQueue,
-    });
+      // Initialize action executor
+      this.actionExecutor = new EmailActionExecutor({
+        sendOutboundEmail: this.sendOutboundEmail.bind(this),
+        bounceManager: this.bounceManager,
+        deliveryQueue: this.deliveryQueue,
+      });
 
-    // Initialize DKIM manager
-    this.dkimManager = new DkimManager(
-      this.dkimCreator,
-      this.domainRegistry,
-      dcRouter,
-      this.rustBridge,
-      options.dkimKeyProvisioning || 'automatic',
-    );
-    this.dnsManager = new DnsManager(this.dcRouter, undefined, options.dkimKeyProvisioning || 'automatic');
-
-    // Initialize statistics
-    this.stats = {
-      startTime: new Date(),
-      connections: {
-        current: 0,
-        total: 0
-      },
-      messages: {
-        processed: 0,
-        delivered: 0,
-        failed: 0
-      },
-      processingTime: {
-        avg: 0,
-        max: 0,
-        min: 0
+      // Initialize DKIM manager
+      this.dkimManager = new DkimManager(
+        this.dkimCreator,
+        this.domainRegistry,
+        dcRouter,
+        this.rustBridge,
+        options.dkimKeyProvisioning || 'automatic',
+      );
+      this.dnsManager = new DnsManager(this.dcRouter, undefined, options.dkimKeyProvisioning || 'automatic');
+
+      // Initialize statistics
+      this.stats = {
+        startTime: new Date(),
+        connections: {
+          current: 0,
+          total: 0
+        },
+        messages: {
+          processed: 0,
+          delivered: 0,
+          failed: 0
+        },
+        processingTime: {
+          avg: 0,
+          max: 0,
+          min: 0
+        }
+      };
+
+      // We'll create the SMTP servers during the start() method
+    } catch (error) {
+      this.releaseConstructionOwnedResources();
+      throw error;
+    }
+  }
+
+  /**
+   * Hand back every event-loop resource a partially completed construction has
+   * already taken ownership of, so a rejected configuration leaves the process
+   * exactly as it found it.
+   *
+   * Only construction-time owners belong here: the delivery queue and the
+   * delivery system arm their timers in `initialize()` and `start()`, which a
+   * failed construction never reaches, and the Rust bridge is an unstarted
+   * singleton until `start()` spawns it.
+   */
+  private releaseConstructionOwnedResources(): void {
+    const release = (nameArg: string, stepArg: () => void): void => {
+      try {
+        stepArg();
+      } catch (error) {
+        logger.log('warn', `${nameArg}: ${getErrorMessage(error)}`);
       }
     };
+    release('bounce-manager release after failed construction', () => this.bounceManager?.stop());
+    release('rate-limiter release after failed construction', () => this.rateLimiter?.stop());
+  }
 
-    // We'll create the SMTP servers during the start() method
+  private assertAcceptingOutboundWork(): void {
+    if (!this.acceptingOutboundWork) {
+      throw new Error('UnifiedEmailServer is not accepting outbound work');
+    }
+  }
+
+  private trackOutboundWork<T>(operationArg: () => Promise<T>): Promise<T> {
+    let flight: Promise<T>;
+    flight = Promise.resolve()
+      .then(operationArg)
+      .finally(() => {
+        this.outboundWorkFlights.delete(flight);
+      });
+    this.outboundWorkFlights.add(flight);
+    return flight;
   }
 
   public onRecipientRejected(
@@ -890,32 +1032,30 @@ export class UnifiedEmailServer extends EventEmitter {
    * Send an outbound email via the Rust SMTP client.
    * Uses connection pooling in the Rust binary for efficiency.
    */
-  public async sendOutboundEmail(host: string, port: number, email: Email, options?: {
+  public sendOutboundEmail(host: string, port: number, email: Email, options?: {
     auth?: { user: string; pass: string };
     dkimDomain?: string;
     dkimSelector?: string;
     tlsOpportunistic?: boolean;
   }): Promise<ISmtpSendResult> {
-    // Build DKIM config if domain has keys
-    let dkim: {
-      domain: string;
-      selector: string;
-      privateKey: string;
-      keyType: 'rsa' | 'ed25519';
-    } | undefined;
-    if (options?.dkimDomain) {
-      const selector = options.dkimSelector || 'default';
-      const material = await this.dkimCreator.readValidatedDKIMKeysForSelector(
-        options.dkimDomain,
-        selector,
-      );
-      dkim = {
-        domain: options.dkimDomain,
-        selector,
-        privateKey: material.privateKey,
-        keyType: material.keyType,
-      };
-    }
+    this.assertAcceptingOutboundWork();
+    return this.trackOutboundWork(() => this[kSendOutboundEmailInternal](
+      host,
+      port,
+      email,
+      options,
+    ));
+  }
+
+  public async [kSendOutboundEmailInternal](host: string, port: number, email: Email, options?: {
+    auth?: { user: string; pass: string };
+    dkimDomain?: string;
+    dkimSelector?: string;
+    tlsOpportunistic?: boolean;
+  }): Promise<ISmtpSendResult> {
+    const dkim = options?.dkimDomain
+      ? await this.resolveOutboundDkim(options.dkimDomain, options.dkimSelector || 'default')
+      : undefined;
 
     // Serialize the Email to the outbound format
     const outboundEmail: IOutboundEmail = {
@@ -935,18 +1075,170 @@ export class UnifiedEmailServer extends EventEmitter {
       })),
     };
 
-    const secure = port === 465;
-    const tlsOpportunistic = options?.tlsOpportunistic ?? (port === 25);
     const senderDomain = email.getFromDomain()?.toLowerCase() || undefined;
-    const proxy = await this.options.outbound?.connectionProxyProvider?.({
+    return this.sendWithOutboundTransport({
       host,
       port,
+      envelopeFrom: email.from,
+      senderDomain,
+      auth: options?.auth,
+      tlsOpportunistic: options?.tlsOpportunistic,
+      dkim,
+      send: (transport) => this.rustBridge.sendOutboundEmail({
+        ...transport,
+        email: outboundEmail,
+        dkim,
+      }),
+    });
+  }
+
+  /** Send exact RFC822 bytes through the same outbound transport path as structured mail. */
+  public sendRawOutboundEmail(
+    host: string,
+    port: number,
+    rawMessage: Buffer,
+    envelopeArg: IRawSmtpEnvelope,
+    options: {
+      auth?: { user: string; pass: string };
+      dkimDomain: string;
+      dkimSelector: string;
+      tlsOpportunistic?: boolean;
+    },
+  ): Promise<ISmtpSendResult> {
+    this.assertAcceptingOutboundWork();
+    assertCanonicalRawRfc822Message(rawMessage);
+    const maxRawMessageBytes = this.options.queue.maxRawMessageBytes
+      ?? DEFAULT_MAX_RAW_MESSAGE_BYTES;
+    if (rawMessage.length > maxRawMessageBytes) {
+      throw new Error(`Raw outbound message exceeds ${maxRawMessageBytes} bytes`);
+    }
+    const releaseRawReservation = this.deliveryQueue[kQueueReserveRawAccess](rawMessage.length);
+    let exactRawMessage: Buffer;
+    let envelope: IRawSmtpEnvelope;
+    try {
+      exactRawMessage = Buffer.from(rawMessage);
+      assertCanonicalRawRfc822Message(exactRawMessage);
+      envelope = normalizeRawSmtpEnvelope(envelopeArg);
+    } catch (error) {
+      releaseRawReservation();
+      throw error;
+    }
+    const exactOptions = {
+      ...options,
+      ...(options.auth ? { auth: { ...options.auth } } : {}),
+    };
+    return this.trackOutboundWork(async () => {
+      try {
+        return await this[kSendRawOutboundEmailInternal](
+          host,
+          port,
+          exactRawMessage,
+          envelope,
+          exactOptions,
+        );
+      } finally {
+        releaseRawReservation();
+      }
+    });
+  }
+
+  public async [kSendRawOutboundEmailInternal](
+    host: string,
+    port: number,
+    rawMessage: Buffer,
+    envelopeArg: IRawSmtpEnvelope,
+    options: {
+      auth?: { user: string; pass: string };
+      dkimDomain: string;
+      dkimSelector: string;
+      tlsOpportunistic?: boolean;
+    },
+  ): Promise<ISmtpSendResult> {
+    assertCanonicalRawRfc822Message(rawMessage);
+    const maxRawMessageBytes = this.options.queue.maxRawMessageBytes
+      ?? DEFAULT_MAX_RAW_MESSAGE_BYTES;
+    if (rawMessage.length > maxRawMessageBytes) {
+      throw new Error(`Raw outbound message exceeds ${maxRawMessageBytes} bytes`);
+    }
+    const envelope = normalizeRawSmtpEnvelope(envelopeArg);
+    const senderDomain = envelope.from.split('@')[1];
+    const dkimDomain = options.dkimDomain.toLowerCase();
+    if (dkimDomain !== senderDomain) {
+      throw new SmtpDeliveryError({
+        message: `Raw outbound DKIM domain ${dkimDomain} does not match envelope sender domain ${senderDomain}`,
+        errorType: 'dkim',
+        retryable: false,
+        phase: 'message_body',
+        transactionLog: [],
+        recipients: envelope.to,
+      });
+    }
+    const dkim = await this.resolveOutboundDkim(dkimDomain, options.dkimSelector);
+    return this.sendWithOutboundTransport({
+      host,
+      port,
+      envelopeFrom: envelope.from,
+      senderDomain,
+      auth: options.auth,
+      tlsOpportunistic: options.tlsOpportunistic,
+      dkim,
+      send: (transport) => this.rustBridge.sendRawEmail({
+        ...transport,
+        envelopeFrom: envelope.from,
+        envelopeTo: [...envelope.to],
+        rawMessageBase64: rawMessage.toString('base64'),
+        dkim,
+      }),
+    });
+  }
+
+  private async resolveOutboundDkim(
+    domainArg: string,
+    selectorArg: string,
+  ): Promise<IOutboundDkimMaterial> {
+    try {
+      const material = await this.dkimCreator.readValidatedDKIMKeysForSelector(
+        domainArg,
+        selectorArg,
+      );
+      return {
+        domain: domainArg,
+        selector: selectorArg,
+        privateKey: material.privateKey,
+        keyType: material.keyType,
+      };
+    } catch (error) {
+      throw new SmtpDeliveryError({
+        message: getErrorMessage(error),
+        errorType: 'dkim',
+        retryable: false,
+        phase: 'message_body',
+        transactionLog: [],
+        recipients: [],
+      }, error);
+    }
+  }
+
+  private async sendWithOutboundTransport(optionsArg: {
+    host: string;
+    port: number;
+    envelopeFrom: string;
+    senderDomain?: string;
+    auth?: { user: string; pass: string };
+    tlsOpportunistic?: boolean;
+    dkim?: IOutboundDkimMaterial;
+    send: (transport: IOutboundTransportParameters) => Promise<ISmtpSendResult>;
+  }): Promise<ISmtpSendResult> {
+    const secure = optionsArg.port === 465;
+    const tlsOpportunistic = optionsArg.tlsOpportunistic ?? (optionsArg.port === 25);
+    const proxy = await this.options.outbound?.connectionProxyProvider?.({
+      host: optionsArg.host,
+      port: optionsArg.port,
       secure,
       ehloDomain: this.getOutboundHostname(),
       tlsOpportunistic,
-      senderDomain,
+      senderDomain: optionsArg.senderDomain,
     });
-
     const captureId = proxy?.sourceEvidence ? plugins.uuid.v4() : undefined;
     const attachAuthenticationHandle = <T extends ISmtpSendResult | SmtpDeliveryError>(valueArg: T): T => {
       if (!captureId || !proxy?.sourceEvidence) return valueArg;
@@ -954,10 +1246,10 @@ export class UnifiedEmailServer extends EventEmitter {
         captureId,
         sourceEvidence: proxy.sourceEvidence,
         heloDomain: proxy.ehloHostname || this.getOutboundHostname(),
-        receiverHostname: host,
-        envelopeFrom: email.from,
-        dkimDomain: dkim?.domain,
-        dkimSelector: dkim?.selector,
+        receiverHostname: optionsArg.host,
+        envelopeFrom: optionsArg.envelopeFrom,
+        dkimDomain: optionsArg.dkim?.domain,
+        dkimSelector: optionsArg.dkim?.selector,
       });
       Object.defineProperty(valueArg, 'outboundAuthenticationHandle', {
         value: handle,
@@ -968,18 +1260,16 @@ export class UnifiedEmailServer extends EventEmitter {
     };
 
     try {
-      const result = await this.rustBridge.sendOutboundEmail({
-        host,
-        port,
+      const result = await optionsArg.send({
+        host: optionsArg.host,
+        port: optionsArg.port,
         ...(proxy ? { connectHost: proxy.connectHost, connectPort: proxy.connectPort } : {}),
         secure,
         domain: proxy?.ehloHostname || this.getOutboundHostname(),
-        auth: options?.auth,
-        email: outboundEmail,
-        dkim,
+        auth: optionsArg.auth,
         connectionTimeoutSecs: Math.floor((this.options.outbound?.connectionTimeout || 30000) / 1000),
         socketTimeoutSecs: Math.floor((this.options.outbound?.socketTimeout || 120000) / 1000),
-        poolKey: proxy?.poolKey || `${host}:${port}`,
+        poolKey: proxy?.poolKey || `${optionsArg.host}:${optionsArg.port}`,
         maxPoolConnections: this.options.outbound?.maxConnections || 10,
         tlsOpportunistic,
         ...(proxy ? { disablePooling: true } : {}),
@@ -1015,7 +1305,8 @@ export class UnifiedEmailServer extends EventEmitter {
       checkedAt: new Date().toISOString(),
       error: errorArg,
     });
-    const result = (async (): Promise<IOutboundAuthenticationCheck> => {
+    let result: Promise<IOutboundAuthenticationCheck>;
+    result = (async (): Promise<IOutboundAuthenticationCheck> => {
       let timeout: ReturnType<typeof setTimeout> | undefined;
       try {
         const sourceEvidence = await new Promise<IOutboundConnectionSourceEvidence | null>((resolve, reject) => {
@@ -1071,7 +1362,10 @@ export class UnifiedEmailServer extends EventEmitter {
       } finally {
         if (timeout) clearTimeout(timeout);
       }
-    })();
+    })().finally(() => {
+      this.outboundAuthenticationFlights.delete(result);
+    });
+    this.outboundAuthenticationFlights.add(result);
     return { pending, result };
   }
 
@@ -1392,11 +1686,16 @@ export class UnifiedEmailServer extends EventEmitter {
     return resolved;
   }
 
-  /** Whether the current options require SMTP AUTH support on the listener. */
+  /**
+   * Whether the current options require SMTP AUTH support on the listener.
+   * A configured `hooks.onAuthenticate` counts on its own: its whole purpose
+   * is to own credentials that no static account list contains.
+   */
   private isAuthConfigured(options: IUnifiedEmailServerOptions): boolean {
     return !!options.auth?.required
       || !!options.auth?.users?.length
-      || !!options.auth?.accounts?.length;
+      || !!options.auth?.accounts?.length
+      || !!options.hooks?.onAuthenticate;
   }
 
   /**
@@ -1442,18 +1741,46 @@ export class UnifiedEmailServer extends EventEmitter {
   /**
    * Stop the unified email server
    */
-  public async stop(): Promise<void> {
+  public stop(): Promise<void> {
+    if (this.stopFlight) return this.stopFlight;
     logger.log('info', 'Stopping UnifiedEmailServer');
+    this.acceptingOutboundWork = false;
+    this.deliveryQueue[kQueueCloseAdmission]();
+    this.stopFlight = this.stopOnce();
+    return this.stopFlight;
+  }
 
-    try {
+  private async stopOnce(): Promise<void> {
+    const errors: Error[] = [];
+    const runStep = async (nameArg: string, stepArg: () => Promise<void> | void): Promise<void> => {
+      try {
+        await stepArg();
+      } catch (error) {
+        const wrapped = new Error(`${nameArg}: ${getErrorMessage(error)}`, { cause: error });
+        errors.push(wrapped);
+        logger.log('error', wrapped.message);
+      }
+    };
+    const runBestEffortStep = async (
+      nameArg: string,
+      stepArg: () => Promise<void> | void,
+    ): Promise<void> => {
+      try {
+        await stepArg();
+      } catch (error) {
+        logger.log('warn', `${nameArg}: ${getErrorMessage(error)}`);
+      }
+    };
+
+    await runStep('accepted-envelope cleanup drain failed', async () => {
       if (this.acceptedEnvelopeDispatchCleanupTimer) {
         clearInterval(this.acceptedEnvelopeDispatchCleanupTimer);
         this.acceptedEnvelopeDispatchCleanupTimer = undefined;
       }
       await this.acceptedEnvelopeDispatchCleanupPromise;
-      // Prevent new listener restarts from being scheduled or executed
-      // during shutdown, then drain any in-flight reconfiguration before
-      // tearing down (the chain may be extended while awaited).
+    });
+
+    await runStep('SMTP listener reconfiguration drain failed', async () => {
       this.smtpListenerShutdown = true;
       this.smtpListenerActive = false;
       while (this.smtpListenerRestartPromise) {
@@ -1463,55 +1790,49 @@ export class UnifiedEmailServer extends EventEmitter {
           this.smtpListenerRestartPromise = undefined;
         }
       }
-      await this.stopDnsValidation();
-
-      // Stop the Rust SMTP server first
-      try {
-        await this.rustBridge.stopSmtpServer();
-        logger.log('info', 'Rust SMTP server stopped');
-      } catch (err) {
-        logger.log('warn', `Error stopping Rust SMTP server: ${(err as Error).message}`);
-      }
-      this.smtpListenerActive = false;
-
-      // Clear the servers array - servers will be garbage collected
-      this.servers = [];
+    });
+    await runStep('DNS validation shutdown failed', () => this.stopDnsValidation());
 
-      this.unregisterBridgeEventHandlers();
-      this.unregisterBridgeStateHandler();
-      await this.rustBridge.stop();
+    await runBestEffortStep(
+      'Rust SMTP listener shutdown skipped or failed',
+      () => this.rustBridge.stopSmtpServer(),
+    );
+    this.smtpListenerActive = false;
+    this.servers = [];
 
-      // Stop the delivery system
-      if (this.deliverySystem) {
-        await this.deliverySystem.stop();
-        logger.log('info', 'Email delivery system stopped');
-      }
+    await runStep('delivery-system drain failed', async () => {
+      await this.deliverySystem?.stop();
+    });
 
-      // Shut down the delivery queue
-      if (this.deliveryQueue) {
-        await this.deliveryQueue.shutdown();
-        logger.log('info', 'Email delivery queue shut down');
-      }
+    while (this.outboundWorkFlights.size > 0) {
+      await Promise.allSettled([...this.outboundWorkFlights]);
+    }
+    while (this.outboundAuthenticationFlights.size > 0) {
+      await Promise.allSettled([...this.outboundAuthenticationFlights]);
+    }
 
-      this.bounceManager.stop();
-      logger.log('info', 'Bounce manager stopped');
+    await runStep('delivery-queue shutdown failed', async () => {
+      await this.deliveryQueue?.shutdown();
+    });
 
-      this.rateLimiter.stop();
-      logger.log('info', 'Rate limiter stopped');
+    await runStep('bounce-manager shutdown failed', () => this.bounceManager.stop());
+    await runStep('rate-limiter shutdown failed', () => this.rateLimiter.stop());
+    await runBestEffortStep(
+      'SMTP pool shutdown skipped or failed',
+      () => this.rustBridge.closeSmtpPool(),
+    );
 
-      // Close all Rust SMTP client connection pools
-      try {
-        await this.rustBridge.closeSmtpPool();
-      } catch {
-        // Bridge may already be stopped
-      }
+    await runStep('Rust bridge shutdown failed', async () => {
+      this.unregisterBridgeEventHandlers();
+      this.unregisterBridgeStateHandler();
+      await this.rustBridge.stop();
+    });
 
-      logger.log('info', 'UnifiedEmailServer stopped successfully');
-      await emitSafely(this, 'stopped');
-    } catch (error) {
-      logger.log('error', `Error stopping UnifiedEmailServer: ${getErrorMessage(error)}`);
-      throw error;
+    await emitSafely(this, 'stopped');
+    if (errors.length > 0) {
+      throw new AggregateError(errors, 'UnifiedEmailServer shutdown completed with errors');
     }
+    logger.log('info', 'UnifiedEmailServer stopped successfully');
   }
 
   // -----------------------------------------------------------------------
@@ -1599,6 +1920,7 @@ export class UnifiedEmailServer extends EventEmitter {
       context.authenticatedUser,
       context.mailFrom,
       context.rcptTo,
+      context.sessionId,
     );
     if (scopeViolation) {
       const scopeRecipientDomain = this.getAddressDomain(context.rcptTo);
@@ -1882,6 +2204,115 @@ export class UnifiedEmailServer extends EventEmitter {
     );
   }
 
+  /** Whether the legacy `auth.users` array declares this username. */
+  private hasLegacyAuthUser(username: string): boolean {
+    return (this.options.auth?.users || []).some((user) => user.username === username);
+  }
+
+  /**
+   * Whether configuration claims this username, for the purpose of deciding
+   * that `hooks.onAuthenticate` must not see it.
+   *
+   * Deliberately case-insensitive, while credential verification itself stays
+   * exact. Otherwise `Tenant-A` would slip past an operator's configured
+   * `tenant-a` — including a `tenant-a` the operator had set `enabled: false`
+   * — and reach a hook that may well resolve names case-insensitively.
+   * Configuration owning a name means owning every casing of it: a casing that
+   * matches no exact credential simply fails, and never reaches the hook.
+   */
+  private declaresUsername(username: string): boolean {
+    const normalized = username.toLowerCase();
+    const accounts = this.options.auth?.accounts || [];
+    if (accounts.some((account) => account.username.toLowerCase() === normalized)) return true;
+    const users = this.options.auth?.users || [];
+    return users.some((user) => user.username.toLowerCase() === normalized);
+  }
+
+  /**
+   * Hook timeout, clamped below the Rust listener's own AUTH deadline.
+   *
+   * The listener waits a fixed 5 s for the TypeScript answer
+   * (`rust/crates/mailer-smtp/src/connection.rs`), so a larger value here
+   * could never take effect: the listener would already have failed the
+   * attempt and reset the session while the hook was still running. Clamping
+   * keeps the configured number meaningful instead of silently unreachable.
+   */
+  private getAuthenticationTimeoutMs(): number {
+    const configured = this.options.smtp?.authenticationTimeoutMs;
+    if (!configured) return UnifiedEmailServer.authHookDefaultTimeoutMs;
+    if (configured <= UnifiedEmailServer.authHookMaxTimeoutMs) return configured;
+    if (!this.loggedAuthTimeoutClamp) {
+      this.loggedAuthTimeoutClamp = true;
+      logger.log(
+        'warn',
+        `smtp.authenticationTimeoutMs ${configured} exceeds the SMTP listener's `
+          + `${UnifiedEmailServer.listenerAuthDeadlineMs}ms AUTH deadline; `
+          + `clamping to ${UnifiedEmailServer.authHookMaxTimeoutMs}ms`,
+      );
+    }
+    return UnifiedEmailServer.authHookMaxTimeoutMs;
+  }
+
+  /**
+   * Enforce the hard cap oldest-first, and sweep expired grants periodically.
+   *
+   * The cap is what bounds memory, and it is O(1) amortised because Map
+   * preserves insertion order. The TTL sweep is hygiene on top — expiry is
+   * always enforced on read — so it runs every `hookAuthSweepInterval`
+   * insertions rather than walking the whole table on every authentication.
+   */
+  private pruneHookAuthSessions(): void {
+    while (this.hookAuthenticatedSessions.size > UnifiedEmailServer.hookAuthSessionMax) {
+      const oldest = this.hookAuthenticatedSessions.keys().next();
+      if (oldest.done) break;
+      this.hookAuthenticatedSessions.delete(oldest.value);
+    }
+    this.hookAuthSweepCountdown -= 1;
+    if (this.hookAuthSweepCountdown > 0) return;
+    this.hookAuthSweepCountdown = UnifiedEmailServer.hookAuthSweepInterval;
+    const now = Date.now();
+    for (const [sessionId, grant] of this.hookAuthenticatedSessions) {
+      if (grant.expiresAt <= now) {
+        this.hookAuthenticatedSessions.delete(sessionId);
+      }
+    }
+  }
+
+  /** Record the scope a hook granted, replacing any earlier grant for the session. */
+  private rememberHookAuthGrant(
+    sessionId: string,
+    username: string,
+    scope: ISmtpAuthAccountScope | undefined,
+  ): void {
+    this.hookAuthenticatedSessions.delete(sessionId);
+    this.hookAuthenticatedSessions.set(sessionId, {
+      username,
+      scope,
+      expiresAt: Date.now() + UnifiedEmailServer.hookAuthSessionTtlMs,
+    });
+    this.pruneHookAuthSessions();
+  }
+
+  /**
+   * Live hook grant for a session, or undefined when none is held. The
+   * username must match the grant: a session may not present one username to
+   * the listener and inherit another's scope.
+   */
+  private findHookAuthGrant(
+    sessionId: string | null | undefined,
+    username: string,
+  ): { username: string; scope?: ISmtpAuthAccountScope } | undefined {
+    if (!sessionId) return undefined;
+    const grant = this.hookAuthenticatedSessions.get(sessionId);
+    if (!grant) return undefined;
+    if (grant.expiresAt <= Date.now()) {
+      this.hookAuthenticatedSessions.delete(sessionId);
+      return undefined;
+    }
+    if (grant.username !== username) return undefined;
+    return grant;
+  }
+
   private normalizeScopeAddress(addressArg: string | null | undefined): string {
     return (addressArg || '').trim().replace(/^<|>$/g, '').toLowerCase();
   }
@@ -1910,16 +2341,25 @@ export class UnifiedEmailServer extends EventEmitter {
   /**
    * Envelope-level scope decision for an authenticated session. Returns null
    * when the envelope is permitted (unauthenticated sessions, usernames with
-   * no configured account, and accounts without a scope are unrestricted).
+   * no configured account and no `hooks.onAuthenticate`, and accounts without
+   * a scope are unrestricted).
    */
   private resolveAuthAccountScopeDecision(
     authenticatedUser: string | null,
     mailFrom: string,
     rcptTo: string,
+    sessionId?: string | null,
   ): { decision: ISmtpDecision; rejectionReason: TRecipientRejectionReason } | null {
     if (!authenticatedUser) return null;
     const account = this.findAuthAccount(authenticatedUser);
-    if (!account) return null;
+    if (!account) {
+      return this.resolveHookAuthScopeDecision(
+        authenticatedUser,
+        mailFrom,
+        rcptTo,
+        sessionId,
+      );
+    }
     if (account.enabled === false) {
       // The account was disabled after authentication succeeded; the session
       // must not be able to send anything.
@@ -1932,7 +2372,53 @@ export class UnifiedEmailServer extends EventEmitter {
         rejectionReason: 'account-disabled',
       };
     }
-    const scope = account.scope;
+    return this.applyScopeToEnvelope(account.scope, authenticatedUser, mailFrom, rcptTo);
+  }
+
+  /**
+   * Envelope-level scope decision for a session authenticated by
+   * `hooks.onAuthenticate`. Reached only for usernames no configured account
+   * declares, so when a hook is configured the session must hold a live
+   * grant; a missing grant is refused temporarily rather than treated as
+   * unrestricted. With no hook configured the pre-existing behaviour stands:
+   * legacy users and unknown usernames are unscoped.
+   */
+  private resolveHookAuthScopeDecision(
+    authenticatedUser: string,
+    mailFrom: string,
+    rcptTo: string,
+    sessionId?: string | null,
+  ): { decision: ISmtpDecision; rejectionReason: TRecipientRejectionReason } | null {
+    const resolved = this.resolveSessionSenderScope(authenticatedUser, sessionId);
+    if (resolved.kind === 'unrestricted') return null;
+    if (resolved.kind === 'refused') {
+      return {
+        decision: UnifiedEmailServer.authScopeUnavailableDecision(),
+        rejectionReason: 'auth-scope-expired',
+      };
+    }
+    return this.applyScopeToEnvelope(resolved.scope, authenticatedUser, mailFrom, rcptTo);
+  }
+
+  /** Temporary refusal for a session whose hook grant is not available. */
+  private static authScopeUnavailableDecision(): ISmtpDecision {
+    return {
+      accepted: false,
+      smtpCode: 451,
+      smtpMessage: '4.7.1 Authentication scope unavailable; authenticate again',
+    };
+  }
+
+  /**
+   * Shared sender/recipient scope enforcement. An absent scope is
+   * unrestricted, matching `ISmtpAuthAccount.scope`.
+   */
+  private applyScopeToEnvelope(
+    scope: ISmtpAuthAccountScope | undefined,
+    authenticatedUser: string,
+    mailFrom: string,
+    rcptTo: string,
+  ): { decision: ISmtpDecision; rejectionReason: TRecipientRejectionReason } | null {
     if (!scope) return null;
     if (!this.matchesScopePatterns(mailFrom, scope.senders)) {
       return {
@@ -1960,6 +2446,34 @@ export class UnifiedEmailServer extends EventEmitter {
     return null;
   }
 
+  /**
+   * Sender scope in force for a session.
+   *
+   * The three outcomes are kept distinct on purpose. Collapsing `refused` into
+   * "no scope" would make a session whose hook grant is gone look unrestricted
+   * to any caller that only asks "is there a scope?", which is the opposite of
+   * what a missing grant means.
+   */
+  private resolveSessionSenderScope(
+    username: string,
+    sessionId?: string | null,
+  ):
+    | { kind: 'unrestricted' }
+    | { kind: 'scope'; scope: ISmtpAuthAccountScope }
+    | { kind: 'refused' } {
+    const account = this.findAuthAccount(username);
+    if (account) {
+      if (account.enabled === false || !account.scope) return { kind: 'unrestricted' };
+      return { kind: 'scope', scope: account.scope };
+    }
+    if (!this.options.hooks?.onAuthenticate) return { kind: 'unrestricted' };
+    // Legacy users and other configuration-owned names are unscoped by design.
+    if (this.declaresUsername(username)) return { kind: 'unrestricted' };
+    const grant = this.findHookAuthGrant(sessionId, username);
+    if (!grant) return { kind: 'refused' };
+    return grant.scope ? { kind: 'scope', scope: grant.scope } : { kind: 'unrestricted' };
+  }
+
   /**
    * Extract every mailbox address from the parsed From header. The Email
    * abstraction keeps only the first From mailbox, which is not sufficient
@@ -1993,10 +2507,15 @@ export class UnifiedEmailServer extends EventEmitter {
   ): Promise<ISmtpDecision | null> {
     const username = session.user?.username;
     if (!username) return null;
-    const account = this.findAuthAccount(username);
     // Disabled accounts and envelope violations are rejected by
-    // resolveRecipientPolicy; this check only adds header alignment.
-    if (!account || account.enabled === false || !account.scope) return null;
+    // resolveRecipientPolicy; this check adds header alignment, for configured
+    // accounts and hook grants alike. A session whose hook grant is gone is
+    // refused here in its own right rather than relying on the envelope check
+    // having run first.
+    const resolved = this.resolveSessionSenderScope(username, session.id);
+    if (resolved.kind === 'unrestricted') return null;
+    if (resolved.kind === 'refused') return UnifiedEmailServer.authScopeUnavailableDecision();
+    const scope = resolved.scope;
     let fromMailboxes: string[];
     try {
       fromMailboxes = await this.parseHeaderFromMailboxes(rawMessage);
@@ -2009,7 +2528,7 @@ export class UnifiedEmailServer extends EventEmitter {
       fromMailboxes = [email.getFromAddress()];
     }
     const outOfScope = fromMailboxes.find(
-      (mailbox) => !this.matchesScopePatterns(mailbox, account.scope!.senders),
+      (mailbox) => !this.matchesScopePatterns(mailbox, scope.senders),
     );
     if (outOfScope === undefined) {
       return null;
@@ -3185,12 +3704,13 @@ export class UnifiedEmailServer extends EventEmitter {
    * always fail.
    */
   private async handleRustAuthRequest(data: IAuthRequestEvent): Promise<void> {
-    const { correlationId, username, password, remoteAddr } = data;
+    const { correlationId, sessionId, username, password, remoteAddr } = data;
 
     logger.log('info', `Rust SMTP auth request for user=${username} from=${remoteAddr}`);
 
     const account = this.findAuthAccount(username);
     let success = false;
+    let failureMessage: string | undefined;
     if (account) {
       if (account.enabled === false) {
         success = false;
@@ -3199,12 +3719,27 @@ export class UnifiedEmailServer extends EventEmitter {
       } else {
         success = this.timingSafeStringEqual(account.credential.password, password);
       }
-    } else {
+    } else if (this.hasLegacyAuthUser(username)) {
       // Legacy users array keeps its existing behavior.
       const users = this.options.auth?.users || [];
       success = users.some(
         u => u.username === username && u.password === password
       );
+    } else if (this.options.hooks?.onAuthenticate && !this.declaresUsername(username)) {
+      // Only usernames configuration does not declare reach the hook. A casing
+      // variant of a configured name is owned by configuration too, so it
+      // falls through here and fails rather than reaching the hook.
+      const outcome = await this.runHookAuthentication({
+        username,
+        password,
+        sessionId,
+        remoteAddress: remoteAddr,
+      });
+      success = outcome.accepted;
+      failureMessage = outcome.message;
+      if (outcome.accepted) {
+        this.rememberHookAuthGrant(sessionId, username, outcome.scope);
+      }
     }
 
     if (success) {
@@ -3213,19 +3748,62 @@ export class UnifiedEmailServer extends EventEmitter {
         success: true,
       });
     } else {
-      logger.log('warn', `Auth failed for user=${username} from=${remoteAddr}`);
+      // The listener answers every failed AUTH with the same 535, so a hook's
+      // reason is recorded here rather than disclosed to the client.
+      logger.log(
+        'warn',
+        `Auth failed for user=${username} from=${remoteAddr}`
+          + (failureMessage ? `: ${failureMessage}` : ''),
+      );
       await this.rustBridge.sendAuthResult({
         correlationId,
         success: false,
-        message: 'Invalid credentials',
+        message: failureMessage || 'Invalid credentials',
       });
     }
   }
 
+  /**
+   * Run `hooks.onAuthenticate` under the configured timeout. Any throw, any
+   * timeout and any non-object result fail the attempt closed — an embedder
+   * that cannot answer must never widen access.
+   */
+  private async runHookAuthentication(
+    context: Omit<ISmtpAuthenticateContext, 'abortSignal'>,
+  ): Promise<ISmtpAuthenticateDecision> {
+    try {
+      const decision = await this.runHookWithTimeout(
+        this.getAuthenticationTimeoutMs(),
+        'Authentication hook timeout',
+        (abortSignal) => this.options.hooks!.onAuthenticate!({ ...context, abortSignal }),
+      );
+      if (!decision || typeof decision !== 'object') {
+        logger.log(
+          'error',
+          `Authentication hook returned no decision for user=${context.username}`,
+        );
+        return { accepted: false };
+      }
+      return decision;
+    } catch (error) {
+      logger.log(
+        'error',
+        `Authentication hook failed for user=${context.username}: ${getErrorMessage(error)}`,
+      );
+      return { accepted: false };
+    }
+  }
+
   /**
    * Handle a SCRAM credential request from the Rust SMTP server.
    * Verifier accounts return their stored fields directly; plaintext
    * credentials (accounts or legacy users) derive fields on the fly.
+   *
+   * Usernames owned by `hooks.onAuthenticate` fall through to `found: false`:
+   * SCRAM requires the server to hold the salt, iteration count, stored key
+   * and server key, and a hook that verifies an opaque credential (argon2id,
+   * a remote authority) cannot produce them. Those usernames authenticate
+   * over PLAIN/LOGIN only, which is why the hook receives the password.
    */
   private async handleScramCredentialRequest(data: { correlationId: string; username: string; remoteAddr: string }): Promise<void> {
     const { correlationId, username, remoteAddr } = data;
@@ -3663,6 +4241,15 @@ export class UnifiedEmailServer extends EventEmitter {
   /**
    * Send an email through the delivery system
    */
+  public async enqueueRawEmail(
+    rawMessage: Buffer,
+    envelope: IRawSmtpEnvelope,
+    idempotencyKey: string,
+  ): Promise<string> {
+    this.assertAcceptingOutboundWork();
+    return this.deliveryQueue[kQueueEnqueueRaw]({ rawMessage, envelope, idempotencyKey });
+  }
+
   public async sendEmail(
     email: Email,
     mode: EmailProcessingMode = 'mta',
@@ -3673,6 +4260,7 @@ export class UnifiedEmailServer extends EventEmitter {
       isTransactional?: boolean;
     }
   ): Promise<string> {
+    this.assertAcceptingOutboundWork();
     logger.log('info', `Sending email: ${email.subject} to ${email.to.join(', ')}`);
 
     try {