@push.rocks/smartmta 9.5.0 → 9.6.1

package/notices/rustversion-1.0.23-license-mit.txt

@@ -0,0 +1,23 @@
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

package/notices/source-attributions.txt

@@ -0,0 +1,294 @@
+Additional source attributions for SmartMTA's mailer-bin executables
+===================================================================
+
+Each section below reproduces a copyright or attribution file that the named
+published crate ships next to its license terms. The selected license texts
+themselves are in notices/cargo-dependencies.html; these files carry the
+copyright notices and upstream attributions that the license texts require to
+be retained. Every section is copied verbatim from the published crate.
+
+==============================================================================
+charset 0.1.5 -- COPYRIGHT (COPYRIGHT)
+==============================================================================
+
+charset is copyright 2013-2016 Mozilla Foundation.
+
+Licensed under the Apache License, Version 2.0
+<LICENSE-APACHE or
+https://www.apache.org/licenses/LICENSE-2.0> or the MIT
+license <LICENSE-MIT or https://opensource.org/licenses/MIT>,
+at your option. All files in the project carrying such
+notice may not be copied, modified, or distributed except
+according to those terms.
+
+Test code within encoding_rs is dedicated to the Public Domain when so
+designated (see the individual files for PD/CC0-dedicated sections).
+
+==============================================================================
+enum-as-inner 0.6.1 -- copyright.txt (copyright.txt)
+==============================================================================
+
+// Copyright 2015-2018 Benjamin Fry <benjaminfry@me.com>
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+==============================================================================
+linux-raw-sys 0.12.1 -- COPYRIGHT (COPYRIGHT)
+==============================================================================
+
+Short version for non-lawyers:
+
+`linux-raw-sys` is triple-licensed under Apache 2.0 with the LLVM Exception,
+Apache 2.0, and MIT terms.
+
+
+Longer version:
+
+Copyrights in the `linux-raw-sys` project are retained by their contributors.
+No copyright assignment is required to contribute to the `linux-raw-sys`
+project.
+
+Some files include code derived from Rust's `libstd`; see the comments in
+the code for details.
+
+Except as otherwise noted (below and/or in individual files), `linux-raw-sys`
+is licensed under:
+
+ - the Apache License, Version 2.0, with the LLVM Exception
+   <LICENSE-Apache-2.0_WITH_LLVM-exception> or
+   <http://llvm.org/foundation/relicensing/LICENSE.txt>
+ - the Apache License, Version 2.0
+   <LICENSE-APACHE> or
+   <http://www.apache.org/licenses/LICENSE-2.0>,
+ - or the MIT license
+   <LICENSE-MIT> or
+   <http://opensource.org/licenses/MIT>,
+
+at your option.
+
+==============================================================================
+miniz_oxide 0.8.9 -- LICENSE (LICENSE)
+==============================================================================
+
+MIT License
+
+Copyright 2013-2014 RAD Game Tools and Valve Software
+Copyright 2010-2014 Rich Geldreich and Tenacious Software LLC
+Copyright (c) 2017 Frommi
+Copyright (c) 2017-2024 oyvindln
+
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+==============================================================================
+rand 0.9.5 -- COPYRIGHT (COPYRIGHT)
+==============================================================================
+
+Copyrights in the Rand project are retained by their contributors. No
+copyright assignment is required to contribute to the Rand project.
+
+For full authorship information, see the version control history.
+
+Except as otherwise noted (below and/or in individual files), Rand is
+licensed under the Apache License, Version 2.0 <LICENSE-APACHE> or
+<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+<LICENSE-MIT> or <http://opensource.org/licenses/MIT>, at your option.
+
+The Rand project includes code from the Rust project
+published under these same licenses.
+
+==============================================================================
+rand_chacha 0.9.0 -- COPYRIGHT (COPYRIGHT)
+==============================================================================
+
+Copyrights in the Rand project are retained by their contributors. No
+copyright assignment is required to contribute to the Rand project.
+
+For full authorship information, see the version control history.
+
+Except as otherwise noted (below and/or in individual files), Rand is
+licensed under the Apache License, Version 2.0 <LICENSE-APACHE> or
+<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+<LICENSE-MIT> or <http://opensource.org/licenses/MIT>, at your option.
+
+The Rand project includes code from the Rust project
+published under these same licenses.
+
+==============================================================================
+rand_core 0.9.5 -- COPYRIGHT (COPYRIGHT)
+==============================================================================
+
+Copyrights in the Rand project are retained by their contributors. No
+copyright assignment is required to contribute to the Rand project.
+
+For full authorship information, see the version control history.
+
+Except as otherwise noted (below and/or in individual files), Rand is
+licensed under the Apache License, Version 2.0 <LICENSE-APACHE> or
+<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+<LICENSE-MIT> or <http://opensource.org/licenses/MIT>, at your option.
+
+The Rand project includes code from the Rust project
+published under these same licenses.
+
+==============================================================================
+regex-syntax 0.8.11 -- LICENSE-UNICODE (src/unicode_tables/LICENSE-UNICODE)
+==============================================================================
+
+UNICODE, INC. LICENSE AGREEMENT - DATA FILES AND SOFTWARE
+
+Unicode Data Files include all data files under the directories
+http://www.unicode.org/Public/, http://www.unicode.org/reports/,
+http://www.unicode.org/cldr/data/, http://source.icu-project.org/repos/icu/, and
+http://www.unicode.org/utility/trac/browser/.
+
+Unicode Data Files do not include PDF online code charts under the
+directory http://www.unicode.org/Public/.
+
+Software includes any source code published in the Unicode Standard
+or under the directories
+http://www.unicode.org/Public/, http://www.unicode.org/reports/,
+http://www.unicode.org/cldr/data/, http://source.icu-project.org/repos/icu/, and
+http://www.unicode.org/utility/trac/browser/.
+
+NOTICE TO USER: Carefully read the following legal agreement.
+BY DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING UNICODE INC.'S
+DATA FILES ("DATA FILES"), AND/OR SOFTWARE ("SOFTWARE"),
+YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE
+TERMS AND CONDITIONS OF THIS AGREEMENT.
+IF YOU DO NOT AGREE, DO NOT DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE
+THE DATA FILES OR SOFTWARE.
+
+COPYRIGHT AND PERMISSION NOTICE
+
+Copyright © 1991-2018 Unicode, Inc. All rights reserved.
+Distributed under the Terms of Use in http://www.unicode.org/copyright.html.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Unicode data files and any associated documentation
+(the "Data Files") or Unicode software and any associated documentation
+(the "Software") to deal in the Data Files or Software
+without restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, and/or sell copies of
+the Data Files or Software, and to permit persons to whom the Data Files
+or Software are furnished to do so, provided that either
+(a) this copyright and permission notice appear with all copies
+of the Data Files or Software, or
+(b) this copyright and permission notice appear in associated
+Documentation.
+
+THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS
+NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL
+DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
+DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THE DATA FILES OR SOFTWARE.
+
+Except as contained in this notice, the name of a copyright holder
+shall not be used in advertising or otherwise to promote the sale,
+use or other dealings in these Data Files or Software without prior
+written authorization of the copyright holder.
+
+==============================================================================
+rustix 1.1.4 -- COPYRIGHT (COPYRIGHT)
+==============================================================================
+
+Short version for non-lawyers:
+
+`rustix` is triple-licensed under Apache 2.0 with the LLVM Exception,
+Apache 2.0, and MIT terms.
+
+
+Longer version:
+
+Copyrights in the `rustix` project are retained by their contributors.
+No copyright assignment is required to contribute to the `rustix`
+project.
+
+Some files include code derived from Rust's `libstd`; see the comments in
+the code for details.
+
+Except as otherwise noted (below and/or in individual files), `rustix`
+is licensed under:
+
+ - the Apache License, Version 2.0, with the LLVM Exception
+   <LICENSE-Apache-2.0_WITH_LLVM-exception> or
+   <http://llvm.org/foundation/relicensing/LICENSE.txt>
+ - the Apache License, Version 2.0
+   <LICENSE-APACHE> or
+   <http://www.apache.org/licenses/LICENSE-2.0>,
+ - or the MIT license
+   <LICENSE-MIT> or
+   <http://opensource.org/licenses/MIT>,
+
+at your option.
+
+==============================================================================
+utf8_iter 1.0.4 -- COPYRIGHT (COPYRIGHT)
+==============================================================================
+
+Copyright Mozilla Foundation
+
+Licensed under the Apache License (Version 2.0), or the MIT license,
+(the "Licenses") at your option. You may not use this file except in
+compliance with one of the Licenses. You may obtain copies of the
+Licenses at:
+
+   https://www.apache.org/licenses/LICENSE-2.0
+   https://opensource.org/licenses/MIT
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the Licenses is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the Licenses for the specific language governing permissions and
+limitations under the Licenses.
+
+--
+
+Test code is dedicated to the Public Domain when so designated (see
+the individual files for PD/CC0-dedicated sections).
+
+--
+
+The implementation for Utf8CharIndices was adapted from the
+CharIndices implementation of the Rust standard library at revision
+ab32548539ec38a939c1b58599249f3b54130026
+(https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/library/core/src/str/iter.rs).
+
+Excerpt from https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/COPYRIGHT ,
+which refers to
+https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/LICENSE-APACHE
+and
+https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/LICENSE-MIT
+:
+
+For full authorship information, see the version control history or
+https://thanks.rust-lang.org
+
+Except as otherwise noted (below and/or in individual files), Rust is
+licensed under the Apache License, Version 2.0 <LICENSE-APACHE> or
+<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+<LICENSE-MIT> or <http://opensource.org/licenses/MIT>, at your option.

package/notices/wasm-bindgen-license-mit.txt

@@ -0,0 +1,25 @@
+Copyright (c) 2014 Alex Crichton
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

package/notices/zerocopy-derive-0.8.55-license-mit.txt

@@ -0,0 +1,26 @@
+Copyright 2023 The Fuchsia Authors
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+

package/notices/zstd-license.txt

@@ -0,0 +1,30 @@
+BSD License
+
+For Zstandard software
+
+Copyright (c) Meta Platforms, Inc. and affiliates. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+ * Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+ * Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+ * Neither the name Facebook, nor Meta, nor the names of its contributors may
+   be used to endorse or promote products derived from this software without
+   specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartmta",
-  "version": "9.5.0",
+  "version": "9.6.1",
   "description": "A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.",
   "keywords": [
     "mta",
@@ -31,12 +31,12 @@
     ".": "./dist_ts/index.js"
   },
   "devDependencies": {
-    "@git.zone/cli": "^3.0.1",
-    "@git.zone/tsbuild": "4.4.2",
-    "@git.zone/tsrust": "^1.7.0",
-    "@git.zone/tstest": "^3.6.7",
+    "@git.zone/cli": "^6.13.2",
+    "@git.zone/tsbuild": "4.4.3",
+    "@git.zone/tsrust": "^1.13.0",
+    "@git.zone/tstest": "6.1.0",
     "@types/mailparser": "^3.4.6",
-    "@types/node": "^26.1.1",
+    "@types/node": "26.5.0",
     "tsx": "^4.23.1"
   },
   "dependencies": {
@@ -54,7 +54,9 @@
     "ts/**/*",
     "dist_ts/**/*",
     "dist_rust/**/*",
+    "notices/**/*",
     "readme.md",
+    "third-party-notices.md",
     "license",
     "changelog.md"
   ],

package/readme.md

@@ -171,6 +171,11 @@ const emailServer = new UnifiedEmailServer(dcRouterRef, {
     securePort: 465,
     recipientValidationTimeoutMs: 5000,
 
+    // Timeout for hooks.onAuthenticate before failing the attempt closed.
+    // Defaults to 4000. The SMTP listener abandons the AUTH round trip after a
+    // fixed 5000 ms, so larger values are clamped to 4500 with a warning.
+    authenticationTimeoutMs: 4000,
+
     // Timeout for hooks.onMessageData and hooks.onAcceptEnvelope before
     // returning a temporary SMTP failure.
     messageAcceptanceTimeoutMs: 30000,
@@ -183,6 +188,20 @@ const emailServer = new UnifiedEmailServer(dcRouterRef, {
   },
 
   hooks: {
+    async onAuthenticate(context) {
+      // Only reached for usernames auth.accounts and auth.users do not declare.
+      // Verify the credential however the application stores it, and return the
+      // send scope the resulting session must be held to.
+      const binding = await credentialStore.verify(context.username, context.password);
+      if (!binding) {
+        // message is logged server-side; the client always sees a plain 535.
+        return { accepted: false, message: 'Unknown binding' };
+      }
+      return {
+        accepted: true,
+        scope: { senders: [`*@${binding.domain}`] },
+      };
+    },
     async onRcptTo(context) {
       if (context.abortSignal?.aborted) {
         return { accepted: false, smtpCode: 451, smtpMessage: 'Recipient policy timeout' };
@@ -330,6 +349,8 @@ A submission route grants an authenticated client permission to relay. It does n
 
 Without this, an authenticated submission addressed to a domain this server hosts is accepted with `250`, relayed to that domain's MX, and destroyed by the self-MX loop guard. Everything else keeps today's behaviour: recipient-scoped `process` routes still win (consumers use them for local addresses handled by their own acceptance pipeline), `store`/`deliver`/`forward`/`reject` actions always win, and a domain registered for outbound identity only — no `inboundPolicy`, or the send-only `defaultAction: 'reject'` — keeps relaying because its real MX lives elsewhere. Encoding recipient intent in `match.headers` is not recognised for this purpose.
 
+`hooks.onAuthenticate` lets the embedding application own SMTP credentials that no static configuration can express — a per-tenant binding store, a remote authority, an opaque hash such as argon2id. See [Dynamic credentials](#dynamic-credentials-hooksonauthenticate).
+
 `hooks.onRcptTo`, `hooks.onMessageData`, and `hooks.onAcceptEnvelope` are awaited asynchronously. If a hook throws or times out, SmartMTA returns a temporary SMTP failure. The hook context includes `abortSignal`; long-running consumers should observe it and stop work promptly. A custom `onRcptTo` hook may accept local recipients using application-specific lookup, but external relay is still blocked unless a matched route explicitly sets `allowRelay: true`.
 
 `hooks.onMessageData` runs after `DATA` and before the final SMTP response — but only for envelopes with **no** resolved `store` or `deliver` action; terminal local deliveries go through `hooks.onAcceptEnvelope` instead and never invoke `onMessageData`. Return `{ accepted: true }` only after your application has accepted responsibility for the message, such as after durable persistence. Set `continueProcessing: false` when the consumer owns all downstream processing.
@@ -413,7 +434,7 @@ Enforcement semantics:
 - **Recipient scope ("send TO who")** — with `recipients.mode: 'patterns'`, every `RCPT TO` matching no pattern is refused with `550`. `mode: 'any'` or an absent `recipients` block leaves recipients unrestricted.
 - **Patterns** are exact addresses (`a@b.com`) or glob patterns (`*@b.com`), matched case-insensitively with identical semantics to route matching. A scoped account sending with an empty `MAIL FROM <>` (null sender) is refused unless a pattern explicitly matches — `senders: ['*']` is the documented escape hatch.
 - **Route binding** — a route with `match.authenticatedUser: 'newsletter-service'` (or an array of usernames) matches only sessions authenticated as that account (exact, case-sensitive username comparison), so dedicated processing or relay routes can be attached per account. Unauthenticated sessions never match such routes.
-- **Rejections** surface through `onRecipientRejected` with the reasons `sender-scope`, `recipient-scope`, and `account-disabled`.
+- **Rejections** surface through `onRecipientRejected` with the reasons `sender-scope`, `recipient-scope`, `account-disabled`, and `auth-scope-expired`.
 - **Live enablement** — when a configuration update transitions between zero and one-or-more accounts/users, `updateOptions` restarts only the Rust SMTP listener so the `AUTH` capability appears or disappears without a process restart. A failed listener restart logs loudly, emits `smtpListenerRestartFailed`, and leaves `isSmtpListenerActive()` false — surface that next to `getBridgeState()` in health endpoints.
 - An account without a `scope` is authenticated but unrestricted — identical to legacy `auth.users` behavior, which itself is unchanged.
 
@@ -423,6 +444,28 @@ Deriving verifiers: `deriveScramVerifier(password, iterations?)` is the canonica
 
 Compatibility probe: `smartMtaCapabilities.smtpAuthAccountsAndScopes`.
 
+### Dynamic credentials (`hooks.onAuthenticate`)
+
+`auth.accounts` is a static list. An embedding application that mints SMTP credentials at runtime — one per tenant, per service, per binding — cannot express them that way, and cannot store them as SCRAM verifiers if its credential store is an opaque hash such as argon2id. `hooks.onAuthenticate` hands those attempts to the application instead:
+
+```ts
+hooks: {
+  async onAuthenticate({ username, password, sessionId, remoteAddress, abortSignal }) {
+    const binding = await credentialStore.verify(username, password, { signal: abortSignal });
+    if (!binding) return { accepted: false, message: 'Unknown binding' };
+    return { accepted: true, scope: { senders: [`*@${binding.domain}`] } };
+  },
+}
+```
+
+- **Configuration always wins.** The hook is consulted only for usernames that neither `auth.accounts` nor `auth.users` declares. A hook can never override, weaken or second-guess a credential an operator configured — a configured username that fails its password fails, full stop. Ownership is matched **case-insensitively** while credential verification itself stays exact, so `Tenant-A` cannot slip past a configured (or deliberately `enabled: false`) `tenant-a` by changing case: it matches no exact credential, and it never reaches the hook either.
+- **A configured hook enables `AUTH` on its own.** `isAuthConfigured` counts it alongside `auth.required`, `auth.users` and `auth.accounts`, so a server whose credentials are entirely dynamic still advertises `AUTH` with an empty account list. The same listener-restart behaviour applies when the hook is added or removed through `updateOptions`.
+- **The returned `scope` is enforced identically to an account scope** — both the `RCPT TO` envelope check and the `DATA` header-`From` alignment check — for the lifetime of the session that authenticated. An absent `scope` is unrestricted, matching `ISmtpAuthAccount.scope`; **a hook that authenticates tenants must return one.**
+- **Grants are session-bound.** They are keyed by the SMTP session that authenticated, so one session cannot inherit another's scope, and they are bounded by a hard cap of 4096 (oldest-first eviction) and a one-hour TTL. Because the listener reports no session-close event, a session may outlive its grant: that case is refused with a temporary `451` and `onRecipientRejected` reason `auth-scope-expired`, never silently treated as unrestricted. Both enforcement points refuse independently, so neither relies on the other having run first. Note the capacity edge: above 4096 concurrent hook-authenticated sessions, eviction reaches live grants, and an affected client must reconnect and authenticate again rather than being able to recover in place.
+- **Failure is closed.** A throw, a `smtp.authenticationTimeoutMs` timeout, or a non-object return rejects the attempt. The client always receives the listener's standard `535 5.7.8 Authentication credentials invalid`; a `message` on the decision is recorded in the server log, never sent to the client, so a caller cannot use it to probe which usernames exist.
+- **`PLAIN`/`LOGIN` only.** SCRAM requires the server to hold the salt, iteration count, stored key and server key; a hook that verifies an opaque credential cannot produce them. SCRAM credential lookups for hook-owned usernames report not-found, which is why the hook receives the password directly. Offer SCRAM only for usernames configured as `auth.accounts` verifiers.
+- The hook sits on the SMTP auth path: keep it fast, and keep expensive derivation bounded. `abortSignal` fires on timeout — observe it.
+
 ### 📧 Sending Emails (Automatic MX Discovery)
 
 The recommended way to send email is `sendEmail()`. It defaults to **MTA mode**, which automatically resolves MX records for each recipient domain via DNS — you don't need to know the destination mail server:
@@ -948,9 +991,34 @@ tstest test/test.e2e.outbound-delivery.node.ts --verbose --timeout 60
 | `Core` | `Email`, `EmailValidator`, `TemplateManager`, `BounceManager` |
 | `Delivery` | `UnifiedDeliveryQueue`, `MultiModeDeliverySystem`, `DeliveryStatus`, `UnifiedRateLimiter` |
 
+## Third-Party Notices
+
+The npm package ships prebuilt, statically linked Rust executables
+(`dist_rust/mailer-bin_linux_amd64` and `dist_rust/mailer-bin_linux_arm64`). They
+contain the locked Cargo dependency graph, the Rust standard library, glibc and
+libgcc in object form, so redistributing them — for example inside a container
+image — redistributes those third-party works too.
+
+[third-party-notices.md](./third-party-notices.md) is the index for that
+distribution, and the `notices/` directory holds the generated cargo-about
+inventory (`notices/cargo-dependencies.html`), the per-crate supplemental
+notices, and the compiler and static runtime notices. Both ship inside the npm
+package; keep them beside any separately distributed copy of a `mailer-bin`
+executable. `notices/inventory.json` pins every notice file and notice input by
+SHA-256 together with the locked package list, the rustc that built the
+executables and the exact Ubuntu glibc and libgcc revisions linked into them.
+There is no toolchain pin: `tsrust` builds with the system `cargo`/`rustc` when
+one is installed (rustc 1.95.0 for the current binaries) and with its bundled
+`stable-<host-triple>` otherwise, so `test/test.notices.node.ts` verifies the
+recorded versions against the compiler in use and against the versions embedded
+in `dist_rust/`, and fails when a locked crate is missing from the inventory, a
+notice file is absent or stale, a generic copyright placeholder appears, or the
+toolchain moves. Regenerate the notices after any change to the Cargo graph,
+the compiler or the C toolchain; the commands are in the notice index.
+
 ## License and Legal Information
 
-This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [license](./license) file.
+This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [license](./license) file. That license covers SmartMTA's own code; the third-party works compiled into the shipped Rust executables keep their own terms, reproduced under [third-party-notices.md](./third-party-notices.md).
 
 **Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.