@push.rocks/smartmta 9.4.1 → 9.6.0

package/dist_ts/mail/delivery/functions.raw-email.d.ts

@@ -0,0 +1,9 @@
+export interface IRawSmtpEnvelope {
+    from: string;
+    to: string[];
+}
+export declare const MAX_RAW_SMTP_RECIPIENTS = 100;
+export declare const assertCanonicalRawRfc822Message: (rawMessageArg: Buffer) => void;
+export declare const normalizeRawSmtpEnvelope: (envelopeArg: IRawSmtpEnvelope) => IRawSmtpEnvelope;
+export declare const cloneRawSmtpEnvelope: (envelopeArg: IRawSmtpEnvelope) => IRawSmtpEnvelope;
+export declare const createRawQueueFingerprint: (rawMessageArg: Buffer, envelopeArg: IRawSmtpEnvelope) => string;

package/dist_ts/mail/delivery/functions.raw-email.js

@@ -0,0 +1,85 @@
+import { createHash } from 'node:crypto';
+import { domainToASCII } from 'node:url';
+import { Email } from '../core/classes.email.js';
+export const MAX_RAW_SMTP_RECIPIENTS = 100;
+export const assertCanonicalRawRfc822Message = (rawMessageArg) => {
+    if (!Buffer.isBuffer(rawMessageArg) || rawMessageArg.length === 0) {
+        throw new Error('Raw outbound message must be a nonempty Buffer');
+    }
+    for (let index = 0; index < rawMessageArg.length; index++) {
+        const byte = rawMessageArg[index];
+        if (byte === 0x0d && rawMessageArg[index + 1] !== 0x0a) {
+            throw new Error('Raw outbound message must use canonical CRLF line endings');
+        }
+        if (byte === 0x0a && (index === 0 || rawMessageArg[index - 1] !== 0x0d)) {
+            throw new Error('Raw outbound message must use canonical CRLF line endings');
+        }
+    }
+    if (rawMessageArg.length < 2
+        || rawMessageArg[rawMessageArg.length - 2] !== 0x0d
+        || rawMessageArg[rawMessageArg.length - 1] !== 0x0a) {
+        throw new Error('Raw outbound message must end with CRLF');
+    }
+};
+const writeLengthFramed = (hashArg, labelArg, valueArg) => {
+    const label = Buffer.from(labelArg, 'utf8');
+    const labelLength = Buffer.allocUnsafe(4);
+    labelLength.writeUInt32BE(label.length);
+    const valueLength = Buffer.allocUnsafe(8);
+    valueLength.writeBigUInt64BE(BigInt(valueArg.length));
+    hashArg.update(labelLength).update(label).update(valueLength).update(valueArg);
+};
+const normalizeRawMailbox = (valueArg, fieldArg) => {
+    if (typeof valueArg !== 'string' || /[\r\n<>]/.test(valueArg)) {
+        throw new Error(`Raw SMTP envelope ${fieldArg} must be a plain mailbox address`);
+    }
+    const value = valueArg.trim();
+    const atIndex = value.indexOf('@');
+    if (atIndex < 1 || atIndex !== value.lastIndexOf('@') || atIndex === value.length - 1) {
+        throw new Error(`Raw SMTP envelope ${fieldArg} must be a plain mailbox address`);
+    }
+    const asciiDomain = domainToASCII(value.slice(atIndex + 1));
+    if (!asciiDomain) {
+        throw new Error(`Raw SMTP envelope ${fieldArg} has an invalid domain`);
+    }
+    const normalized = `${value.slice(0, atIndex).toLowerCase()}@${asciiDomain.toLowerCase()}`;
+    try {
+        new Email({ from: normalized, to: normalized, subject: '', text: '' });
+    }
+    catch {
+        throw new Error(`Raw SMTP envelope ${fieldArg} must be a valid mailbox address`);
+    }
+    return normalized;
+};
+export const normalizeRawSmtpEnvelope = (envelopeArg) => {
+    if (!envelopeArg || typeof envelopeArg !== 'object') {
+        throw new Error('Raw SMTP envelope is required');
+    }
+    if (!Array.isArray(envelopeArg.to)
+        || envelopeArg.to.length === 0
+        || envelopeArg.to.length > MAX_RAW_SMTP_RECIPIENTS) {
+        throw new Error(`Raw SMTP envelope requires 1 to ${MAX_RAW_SMTP_RECIPIENTS} recipients`);
+    }
+    const from = normalizeRawMailbox(envelopeArg.from, 'sender');
+    const to = envelopeArg.to.map((recipient, index) => (normalizeRawMailbox(recipient, `recipient ${index + 1}`)));
+    if (new Set(to).size !== to.length) {
+        throw new Error('Raw SMTP envelope recipients must be unique after canonicalization');
+    }
+    return { from, to };
+};
+export const cloneRawSmtpEnvelope = (envelopeArg) => ({
+    from: envelopeArg.from,
+    to: [...envelopeArg.to],
+});
+export const createRawQueueFingerprint = (rawMessageArg, envelopeArg) => {
+    const hash = createHash('sha256');
+    hash.update('smartmta:durable-raw-outbound-queue:fingerprint:v1\0');
+    writeLengthFramed(hash, 'raw-rfc822-bytes', rawMessageArg);
+    writeLengthFramed(hash, 'smtp-envelope-from', Buffer.from(envelopeArg.from, 'utf8'));
+    for (const recipient of envelopeArg.to) {
+        writeLengthFramed(hash, 'smtp-envelope-recipient', Buffer.from(recipient, 'utf8'));
+    }
+    writeLengthFramed(hash, 'processing-semantics', Buffer.from('raw-mta;dkim=required-current-sender-domain-key;transform=none', 'utf8'));
+    return hash.digest('hex');
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLnJhdy1lbWFpbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL21haWwvZGVsaXZlcnkvZnVuY3Rpb25zLnJhdy1lbWFpbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsVUFBVSxFQUFhLE1BQU0sYUFBYSxDQUFDO0FBQ3BELE9BQU8sRUFBRSxhQUFhLEVBQUUsTUFBTSxVQUFVLENBQUM7QUFFekMsT0FBTyxFQUFFLEtBQUssRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBT2pELE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLEdBQUcsQ0FBQztBQUUzQyxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxDQUFDLGFBQXFCLEVBQVEsRUFBRTtJQUM3RSxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsSUFBSSxhQUFhLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2xFLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0RBQWdELENBQUMsQ0FBQztJQUNwRSxDQUFDO0lBQ0QsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLGFBQWEsQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUMxRCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDbEMsSUFBSSxJQUFJLEtBQUssSUFBSSxJQUFJLGFBQWEsQ0FBQyxLQUFLLEdBQUcsQ0FBQyxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDdkQsTUFBTSxJQUFJLEtBQUssQ0FBQywyREFBMkQsQ0FBQyxDQUFDO1FBQy9FLENBQUM7UUFDRCxJQUFJLElBQUksS0FBSyxJQUFJLElBQUksQ0FBQyxLQUFLLEtBQUssQ0FBQyxJQUFJLGFBQWEsQ0FBQyxLQUFLLEdBQUcsQ0FBQyxDQUFDLEtBQUssSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUN4RSxNQUFNLElBQUksS0FBSyxDQUFDLDJEQUEyRCxDQUFDLENBQUM7UUFDL0UsQ0FBQztJQUNILENBQUM7SUFDRCxJQUNFLGFBQWEsQ0FBQyxNQUFNLEdBQUcsQ0FBQztXQUNyQixhQUFhLENBQUMsYUFBYSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsS0FBSyxJQUFJO1dBQ2hELGFBQWEsQ0FBQyxhQUFhLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxLQUFLLElBQUksRUFDbkQsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMseUNBQXlDLENBQUMsQ0FBQztJQUM3RCxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLE9BQWEsRUFBRSxRQUFnQixFQUFFLFFBQWdCLEVBQVEsRUFBRTtJQUNwRixNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUM1QyxNQUFNLFdBQVcsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzFDLFdBQVcsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3hDLE1BQU0sV0FBVyxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDMUMsV0FBVyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUN0RCxPQUFPLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQ2pGLENBQUMsQ0FBQztBQUVGLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxRQUFnQixFQUFFLFFBQWdCLEVBQVUsRUFBRTtJQUN6RSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxVQUFVLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDOUQsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQkFBcUIsUUFBUSxrQ0FBa0MsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFDRCxNQUFNLEtBQUssR0FBRyxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDOUIsTUFBTSxPQUFPLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNuQyxJQUFJLE9BQU8sR0FBRyxDQUFDLElBQUksT0FBTyxLQUFLLEtBQUssQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLElBQUksT0FBTyxLQUFLLEtBQUssQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdEYsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQkFBcUIsUUFBUSxrQ0FBa0MsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFDRCxNQUFNLFdBQVcsR0FBRyxhQUFhLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxPQUFPLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM1RCxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDakIsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQkFBcUIsUUFBUSx3QkFBd0IsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFDRCxNQUFNLFVBQVUsR0FBRyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxDQUFDLFdBQVcsRUFBRSxJQUFJLFdBQVcsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDO0lBQzNGLElBQUksQ0FBQztRQUNILElBQUksS0FBSyxDQUFDLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxFQUFFLEVBQUUsVUFBVSxFQUFFLE9BQU8sRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE1BQU0sSUFBSSxLQUFLLENBQUMscUJBQXFCLFFBQVEsa0NBQWtDLENBQUMsQ0FBQztJQUNuRixDQUFDO0lBQ0QsT0FBTyxVQUFVLENBQUM7QUFDcEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxXQUE2QixFQUFvQixFQUFFO0lBQzFGLElBQUksQ0FBQyxXQUFXLElBQUksT0FBTyxXQUFXLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDcEQsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO0lBQ25ELENBQUM7SUFDRCxJQUNFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1dBQzNCLFdBQVcsQ0FBQyxFQUFFLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDM0IsV0FBVyxDQUFDLEVBQUUsQ0FBQyxNQUFNLEdBQUcsdUJBQXVCLEVBQ2xELENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUNiLG1DQUFtQyx1QkFBdUIsYUFBYSxDQUN4RSxDQUFDO0lBQ0osQ0FBQztJQUNELE1BQU0sSUFBSSxHQUFHLG1CQUFtQixDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDN0QsTUFBTSxFQUFFLEdBQUcsV0FBVyxDQUFDLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxTQUFTLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUNsRCxtQkFBbUIsQ0FBQyxTQUFTLEVBQUUsYUFBYSxLQUFLLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FDekQsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxJQUFJLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxJQUFJLEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25DLE1BQU0sSUFBSSxLQUFLLENBQUMsb0VBQW9FLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBQ0QsT0FBTyxFQUFFLElBQUksRUFBRSxFQUFFLEVBQUUsQ0FBQztBQUN0QixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxDQUFDLFdBQTZCLEVBQW9CLEVBQUUsQ0FBQyxDQUFDO0lBQ3hGLElBQUksRUFBRSxXQUFXLENBQUMsSUFBSTtJQUN0QixFQUFFLEVBQUUsQ0FBQyxHQUFHLFdBQVcsQ0FBQyxFQUFFLENBQUM7Q0FDeEIsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUcsQ0FDdkMsYUFBcUIsRUFDckIsV0FBNkIsRUFDckIsRUFBRTtJQUNWLE1BQU0sSUFBSSxHQUFHLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNsQyxJQUFJLENBQUMsTUFBTSxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDcEUsaUJBQWlCLENBQUMsSUFBSSxFQUFFLGtCQUFrQixFQUFFLGFBQWEsQ0FBQyxDQUFDO0lBQzNELGlCQUFpQixDQUFDLElBQUksRUFBRSxvQkFBb0IsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUNyRixLQUFLLE1BQU0sU0FBUyxJQUFJLFdBQVcsQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUN2QyxpQkFBaUIsQ0FBQyxJQUFJLEVBQUUseUJBQXlCLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsaUJBQWlCLENBQ2YsSUFBSSxFQUNKLHNCQUFzQixFQUN0QixNQUFNLENBQUMsSUFBSSxDQUFDLGdFQUFnRSxFQUFFLE1BQU0sQ0FBQyxDQUN0RixDQUFDO0lBQ0YsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0FBQzVCLENBQUMsQ0FBQyJ9

package/dist_ts/mail/delivery/symbols.delivery.queue.d.ts

@@ -0,0 +1,6 @@
+export declare const kQueueCloseAdmission: unique symbol;
+export declare const kQueueCreateItemSnapshot: unique symbol;
+export declare const kQueueEnqueueRaw: unique symbol;
+export declare const kQueueReserveRawAccess: unique symbol;
+export declare const kQueueSetReadyItemsHandler: unique symbol;
+export declare const kQueueWithRawMessage: unique symbol;

package/dist_ts/mail/delivery/symbols.delivery.queue.js

@@ -0,0 +1,7 @@
+export const kQueueCloseAdmission = Symbol('smartmta.queue.closeAdmission');
+export const kQueueCreateItemSnapshot = Symbol('smartmta.queue.createItemSnapshot');
+export const kQueueEnqueueRaw = Symbol('smartmta.queue.enqueueRaw');
+export const kQueueReserveRawAccess = Symbol('smartmta.queue.reserveRawAccess');
+export const kQueueSetReadyItemsHandler = Symbol('smartmta.queue.setReadyItemsHandler');
+export const kQueueWithRawMessage = Symbol('smartmta.queue.withRawMessage');
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3ltYm9scy5kZWxpdmVyeS5xdWV1ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL21haWwvZGVsaXZlcnkvc3ltYm9scy5kZWxpdmVyeS5xdWV1ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBa0IsTUFBTSxDQUFDLCtCQUErQixDQUFDLENBQUM7QUFDM0YsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQWtCLE1BQU0sQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO0FBQ25HLE1BQU0sQ0FBQyxNQUFNLGdCQUFnQixHQUFrQixNQUFNLENBQUMsMkJBQTJCLENBQUMsQ0FBQztBQUNuRixNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBa0IsTUFBTSxDQUFDLGlDQUFpQyxDQUFDLENBQUM7QUFDL0YsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQWtCLE1BQU0sQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO0FBQ3ZHLE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFrQixNQUFNLENBQUMsK0JBQStCLENBQUMsQ0FBQyJ9

package/dist_ts/mail/index.d.ts

@@ -2,6 +2,7 @@ export * from './interfaces.storage.js';
 export * from './routing/index.js';
 export * from './security/index.js';
 export type { ISmtpTransactionAttempt } from './delivery/interfaces.js';
+export type { IRawSmtpEnvelope } from './delivery/functions.raw-email.js';
 import * as Core from './core/index.js';
 import * as Delivery from './delivery/index.js';
 export { Core, Delivery };

package/dist_ts/mail/index.js

@@ -10,4 +10,4 @@ export { Core, Delivery };
 import { Email } from './core/classes.email.js';
 // Re-export commonly used classes
 export { Email, };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9tYWlsL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGlEQUFpRDtBQUNqRCxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxxQkFBcUIsQ0FBQztBQUdwQyxnREFBZ0Q7QUFDaEQsT0FBTyxLQUFLLElBQUksTUFBTSxpQkFBaUIsQ0FBQztBQUN4QyxPQUFPLEtBQUssUUFBUSxNQUFNLHFCQUFxQixDQUFDO0FBRWhELE9BQU8sRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLENBQUM7QUFFMUIscUJBQXFCO0FBQ3JCLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUVoRCxrQ0FBa0M7QUFDbEMsT0FBTyxFQUNMLEtBQUssR0FDTixDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9tYWlsL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGlEQUFpRDtBQUNqRCxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxxQkFBcUIsQ0FBQztBQUlwQyxnREFBZ0Q7QUFDaEQsT0FBTyxLQUFLLElBQUksTUFBTSxpQkFBaUIsQ0FBQztBQUN4QyxPQUFPLEtBQUssUUFBUSxNQUFNLHFCQUFxQixDQUFDO0FBRWhELE9BQU8sRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLENBQUM7QUFFMUIscUJBQXFCO0FBQ3JCLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUVoRCxrQ0FBa0M7QUFDbEMsT0FBTyxFQUNMLEtBQUssR0FDTixDQUFDIn0=

package/dist_ts/mail/routing/classes.unified.email.server.d.ts

@@ -2,7 +2,7 @@ import { EventEmitter } from 'events';
 import { DKIMCreator } from '../security/classes.dkimcreator.js';
 import type { IStorageManager } from '../interfaces.storage.js';
 import type { IInboundEmailSecurityResult } from '../../security/classes.rustsecuritybridge.js';
-import type { IEmailRoute, IEmailAction, IEmailDomainConfig, ISmtpAuthAccount } from './interfaces.js';
+import type { IEmailRoute, IEmailAction, IEmailDomainConfig, ISmtpAuthAccount, ISmtpAuthenticateContext, ISmtpAuthenticateDecision } from './interfaces.js';
 import { Email } from '../core/classes.email.js';
 import { DomainRegistry } from './classes.domain.registry.js';
 import { BounceType, BounceCategory } from '../core/classes.bouncemanager.js';
@@ -11,6 +11,8 @@ import { MultiModeDeliverySystem, type IDeliveryStats } from '../delivery/classe
 import { UnifiedDeliveryQueue, type IQueueItem, type IQueueOptions, type IQueueStats } from '../delivery/classes.delivery.queue.js';
 import { UnifiedRateLimiter, type IHierarchicalRateLimits } from '../delivery/classes.unified.rate.limiter.js';
 import type { EmailProcessingMode, ISmtpSession as IBaseSmtpSession } from '../delivery/interfaces.js';
+import { type IRawSmtpEnvelope } from '../delivery/functions.raw-email.js';
+import { kSendOutboundEmailInternal, kSendRawOutboundEmailInternal } from './symbols.unified.email.server.js';
 /** External DcRouter interface shape used by UnifiedEmailServer */
 interface DcRouter {
     storageManager: IStorageManager;
@@ -18,7 +20,7 @@ interface DcRouter {
     options?: any;
 }
 export type TRecipientRouteSource = 'explicit-route' | 'domain-policy' | 'no-route';
-export type TRecipientRejectionReason = 'explicit-route' | 'domain-policy' | 'no-route' | 'domain-not-hosted' | 'relay-denied' | 'recipient-hook' | 'policy-error' | 'sender-scope' | 'recipient-scope' | 'account-disabled';
+export type TRecipientRejectionReason = 'explicit-route' | 'domain-policy' | 'no-route' | 'domain-not-hosted' | 'relay-denied' | 'recipient-hook' | 'policy-error' | 'sender-scope' | 'recipient-scope' | 'account-disabled' | 'auth-scope-expired';
 export interface IResolvedRecipientRoute {
     recipient: string;
     localDomain: string | null;
@@ -252,6 +254,8 @@ export interface IUnifiedEmailServerOptions {
         tlsTerminatedPorts?: number[];
         /** Timeout for RCPT policy callbacks. Defaults to 5000 ms. */
         recipientValidationTimeoutMs?: number;
+        /** Timeout for `hooks.onAuthenticate` callbacks. Defaults to 5000 ms. */
+        authenticationTimeoutMs?: number;
         /** Timeout for message acceptance callbacks. Defaults to 30000 ms. */
         messageAcceptanceTimeoutMs?: number;
         /** Maximum complete messages concurrently held across Rust and TypeScript. */
@@ -263,6 +267,24 @@ export interface IUnifiedEmailServerOptions {
         };
     };
     hooks?: {
+        /**
+         * Async credential verification for PLAIN/LOGIN, letting an embedding
+         * application own dynamic SMTP credentials that no static configuration
+         * can express.
+         *
+         * Consulted only for usernames that `auth.accounts` and `auth.users` do
+         * not declare: configuration always owns the usernames it lists, so a
+         * hook can never override or weaken a configured credential. Configuring
+         * the hook enables SMTP AUTH on the listener even with no accounts.
+         *
+         * The returned `scope` is enforced for that session exactly as a
+         * configured account's scope is. A throw or a
+         * `smtp.authenticationTimeoutMs` timeout fails the attempt closed.
+         *
+         * SCRAM cannot be served from this hook — see `onAuthenticate` notes in
+         * the readme. Hook-owned usernames authenticate over PLAIN/LOGIN only.
+         */
+        onAuthenticate?: (context: ISmtpAuthenticateContext) => Promise<ISmtpAuthenticateDecision>;
         /** Async recipient policy hook that may further restrict an accepted built-in decision. */
         onRcptTo?: (context: IRcptToPolicyContext) => Promise<ISmtpDecision>;
         /** Async message acceptance hook for envelopes with no resolved `store` or `deliver` action. */
@@ -373,13 +395,52 @@ export declare class UnifiedEmailServer extends EventEmitter {
     private smtpListenerActive;
     private smtpListenerShutdown;
     private smtpListenerRestartPromise?;
+    private acceptingOutboundWork;
+    private readonly outboundWorkFlights;
+    private readonly outboundAuthenticationFlights;
+    private stopFlight?;
     private static readonly VERIFIER_DERIVATION_CONCURRENCY;
     private static readonly VERIFIER_DERIVATION_MAX_QUEUE;
     private verifierDerivationActive;
     private verifierDerivationWaiters;
     /** Compiled scope patterns; keys are config-supplied, bounded by config size. */
     private scopePatternCache;
+    /**
+     * Scopes granted by `hooks.onAuthenticate`, keyed by the session the
+     * credential authenticated. The SMTP listener reports no session-close
+     * event, so entries are bounded by both a TTL and a hard cap rather than
+     * by session lifetime.
+     *
+     * Losing an entry must never widen a session, so the absence of a grant is
+     * not read as "unrestricted": a session authenticated as a username that
+     * configuration does not declare can only have come from the hook, and is
+     * refused with a temporary failure until it authenticates again.
+     */
+    private hookAuthenticatedSessions;
+    private static readonly hookAuthSessionTtlMs;
+    private static readonly hookAuthSessionMax;
+    private static readonly hookAuthSweepInterval;
+    private hookAuthSweepCountdown;
+    /** The Rust listener's fixed AUTH round-trip deadline. */
+    private static readonly listenerAuthDeadlineMs;
+    /** Leave headroom so a hook answering just in time still beats the listener. */
+    private static readonly authHookMaxTimeoutMs;
+    private static readonly authHookDefaultTimeoutMs;
+    private loggedAuthTimeoutClamp;
     constructor(dcRouter: DcRouter, options: IUnifiedEmailServerOptions);
+    /**
+     * Hand back every event-loop resource a partially completed construction has
+     * already taken ownership of, so a rejected configuration leaves the process
+     * exactly as it found it.
+     *
+     * Only construction-time owners belong here: the delivery queue and the
+     * delivery system arm their timers in `initialize()` and `start()`, which a
+     * failed construction never reaches, and the Rust bridge is an unstarted
+     * singleton until `start()` spawns it.
+     */
+    private releaseConstructionOwnedResources;
+    private assertAcceptingOutboundWork;
+    private trackOutboundWork;
     onRecipientRejected(listener: (event: IRecipientRejectedEvent) => Promise<void> | void): this;
     offRecipientRejected(listener: (event: IRecipientRejectedEvent) => Promise<void> | void): this;
     private getAdvertisedHostname;
@@ -410,6 +471,36 @@ export declare class UnifiedEmailServer extends EventEmitter {
         dkimSelector?: string;
         tlsOpportunistic?: boolean;
     }): Promise<ISmtpSendResult>;
+    [kSendOutboundEmailInternal](host: string, port: number, email: Email, options?: {
+        auth?: {
+            user: string;
+            pass: string;
+        };
+        dkimDomain?: string;
+        dkimSelector?: string;
+        tlsOpportunistic?: boolean;
+    }): Promise<ISmtpSendResult>;
+    /** Send exact RFC822 bytes through the same outbound transport path as structured mail. */
+    sendRawOutboundEmail(host: string, port: number, rawMessage: Buffer, envelopeArg: IRawSmtpEnvelope, options: {
+        auth?: {
+            user: string;
+            pass: string;
+        };
+        dkimDomain: string;
+        dkimSelector: string;
+        tlsOpportunistic?: boolean;
+    }): Promise<ISmtpSendResult>;
+    [kSendRawOutboundEmailInternal](host: string, port: number, rawMessage: Buffer, envelopeArg: IRawSmtpEnvelope, options: {
+        auth?: {
+            user: string;
+            pass: string;
+        };
+        dkimDomain: string;
+        dkimSelector: string;
+        tlsOpportunistic?: boolean;
+    }): Promise<ISmtpSendResult>;
+    private resolveOutboundDkim;
+    private sendWithOutboundTransport;
     private createOutboundAuthenticationHandle;
     /**
      * Start the unified email server
@@ -432,7 +523,11 @@ export declare class UnifiedEmailServer extends EventEmitter {
      * rather than degrading silently.
      */
     private resolveTlsTerminatedPorts;
-    /** Whether the current options require SMTP AUTH support on the listener. */
+    /**
+     * Whether the current options require SMTP AUTH support on the listener.
+     * A configured `hooks.onAuthenticate` counts on its own: its whole purpose
+     * is to own credentials that no static account list contains.
+     */
     private isAuthConfigured;
     /**
      * Whether the Rust SMTP listener is currently accepting connections.
@@ -453,6 +548,7 @@ export declare class UnifiedEmailServer extends EventEmitter {
      * Stop the unified email server
      */
     stop(): Promise<void>;
+    private stopOnce;
     private handleRustRcptToRequest;
     private evaluateDefaultRcptToPolicy;
     private resolveRecipientPolicy;
@@ -485,6 +581,47 @@ export declare class UnifiedEmailServer extends EventEmitter {
     private getAddressDomain;
     /** Resolve the configured account for a username. Accounts win over legacy users. */
     private findAuthAccount;
+    /** Whether the legacy `auth.users` array declares this username. */
+    private hasLegacyAuthUser;
+    /**
+     * Whether configuration claims this username, for the purpose of deciding
+     * that `hooks.onAuthenticate` must not see it.
+     *
+     * Deliberately case-insensitive, while credential verification itself stays
+     * exact. Otherwise `Tenant-A` would slip past an operator's configured
+     * `tenant-a` — including a `tenant-a` the operator had set `enabled: false`
+     * — and reach a hook that may well resolve names case-insensitively.
+     * Configuration owning a name means owning every casing of it: a casing that
+     * matches no exact credential simply fails, and never reaches the hook.
+     */
+    private declaresUsername;
+    /**
+     * Hook timeout, clamped below the Rust listener's own AUTH deadline.
+     *
+     * The listener waits a fixed 5 s for the TypeScript answer
+     * (`rust/crates/mailer-smtp/src/connection.rs`), so a larger value here
+     * could never take effect: the listener would already have failed the
+     * attempt and reset the session while the hook was still running. Clamping
+     * keeps the configured number meaningful instead of silently unreachable.
+     */
+    private getAuthenticationTimeoutMs;
+    /**
+     * Enforce the hard cap oldest-first, and sweep expired grants periodically.
+     *
+     * The cap is what bounds memory, and it is O(1) amortised because Map
+     * preserves insertion order. The TTL sweep is hygiene on top — expiry is
+     * always enforced on read — so it runs every `hookAuthSweepInterval`
+     * insertions rather than walking the whole table on every authentication.
+     */
+    private pruneHookAuthSessions;
+    /** Record the scope a hook granted, replacing any earlier grant for the session. */
+    private rememberHookAuthGrant;
+    /**
+     * Live hook grant for a session, or undefined when none is held. The
+     * username must match the grant: a session may not present one username to
+     * the listener and inherit another's scope.
+     */
+    private findHookAuthGrant;
     private normalizeScopeAddress;
     /**
      * Glob match ('a@b.com' | '*@b.com') against a normalized address, using
@@ -496,9 +633,35 @@ export declare class UnifiedEmailServer extends EventEmitter {
     /**
      * Envelope-level scope decision for an authenticated session. Returns null
      * when the envelope is permitted (unauthenticated sessions, usernames with
-     * no configured account, and accounts without a scope are unrestricted).
+     * no configured account and no `hooks.onAuthenticate`, and accounts without
+     * a scope are unrestricted).
      */
     private resolveAuthAccountScopeDecision;
+    /**
+     * Envelope-level scope decision for a session authenticated by
+     * `hooks.onAuthenticate`. Reached only for usernames no configured account
+     * declares, so when a hook is configured the session must hold a live
+     * grant; a missing grant is refused temporarily rather than treated as
+     * unrestricted. With no hook configured the pre-existing behaviour stands:
+     * legacy users and unknown usernames are unscoped.
+     */
+    private resolveHookAuthScopeDecision;
+    /** Temporary refusal for a session whose hook grant is not available. */
+    private static authScopeUnavailableDecision;
+    /**
+     * Shared sender/recipient scope enforcement. An absent scope is
+     * unrestricted, matching `ISmtpAuthAccount.scope`.
+     */
+    private applyScopeToEnvelope;
+    /**
+     * Sender scope in force for a session.
+     *
+     * The three outcomes are kept distinct on purpose. Collapsing `refused` into
+     * "no scope" would make a session whose hook grant is gone look unrestricted
+     * to any caller that only asks "is there a scope?", which is the opposite of
+     * what a missing grant means.
+     */
+    private resolveSessionSenderScope;
     /**
      * Extract every mailbox address from the parsed From header. The Email
      * abstraction keeps only the first From mailbox, which is not sufficient
@@ -583,10 +746,22 @@ export declare class UnifiedEmailServer extends EventEmitter {
      * always fail.
      */
     private handleRustAuthRequest;
+    /**
+     * Run `hooks.onAuthenticate` under the configured timeout. Any throw, any
+     * timeout and any non-object result fail the attempt closed — an embedder
+     * that cannot answer must never widen access.
+     */
+    private runHookAuthentication;
     /**
      * Handle a SCRAM credential request from the Rust SMTP server.
      * Verifier accounts return their stored fields directly; plaintext
      * credentials (accounts or legacy users) derive fields on the fly.
+     *
+     * Usernames owned by `hooks.onAuthenticate` fall through to `found: false`:
+     * SCRAM requires the server to hold the salt, iteration count, stored key
+     * and server key, and a hook that verifies an opaque credential (argon2id,
+     * a remote authority) cannot produce them. Those usernames authenticate
+     * over PLAIN/LOGIN only, which is why the hook receives the password.
      */
     private handleScramCredentialRequest;
     /**
@@ -644,6 +819,7 @@ export declare class UnifiedEmailServer extends EventEmitter {
     /**
      * Send an email through the delivery system
      */
+    enqueueRawEmail(rawMessage: Buffer, envelope: IRawSmtpEnvelope, idempotencyKey: string): Promise<string>;
     sendEmail(email: Email, mode?: EmailProcessingMode, route?: IEmailRoute, options?: {
         skipSuppressionCheck?: boolean;
         ipAddress?: string;