@push.rocks/smartmta 9.6.0 → 10.0.0

package/third-party-notices.md

@@ -0,0 +1,176 @@
+# Third-party notices
+
+These notices accompany SmartMTA's prebuilt `dist_rust/mailer-bin_linux_amd64`
+and `dist_rust/mailer-bin_linux_arm64` executables, which ship inside the npm
+package. SmartMTA's own TypeScript and Rust code is MIT-licensed under
+[license](./license.md).
+
+Both executables are statically linked: `pnpm run build:release` runs
+`tsbuild tsfolders && tsrust --configured-targets && tsrust verify`, and
+`@git.zone/tsrust` builds the `.smartconfig.json` targets `linux_amd64` and `linux_arm64` — the
+`x86_64-unknown-linux-gnu` and `aarch64-unknown-linux-gnu` triples — with
+`-C target-feature=+crt-static`, so the Cargo dependency graph, the Rust
+standard library, the GNU C Library and libgcc are all compiled into the
+shipped object code. Anyone redistributing those executables — including
+inside a container image — redistributes those third-party works in binary
+form and must pass these notices on with them.
+
+## Cargo dependencies
+
+[Cargo dependency notices](./notices/cargo-dependencies.html) reproduce the
+selected upstream license and copyright texts for 225 of the 232 third-party
+packages in `rust/Cargo.lock`. The seven remaining packages are locked but
+outside the resolved build graph (WebAssembly-only or feature-inactive), and
+are covered by these supplemental notices:
+
+- [js-sys 0.3.103, wasm-bindgen 0.2.126, wasm-bindgen-macro 0.2.126,
+  wasm-bindgen-macro-support 0.2.126 and wasm-bindgen-shared 0.2.126](./notices/wasm-bindgen-license-mit.txt),
+  from their identical published `LICENSE-MIT` files.
+- [rustversion 1.0.23](./notices/rustversion-1.0.23-license-mit.txt), from the
+  published crate's `LICENSE-MIT`.
+- [zerocopy-derive 0.8.55](./notices/zerocopy-derive-0.8.55-license-mit.txt),
+  from the published crate's `LICENSE-MIT`.
+
+Together these cover all 232 locked external packages, conservatively including
+build-only and target-inactive dependencies. Listing a package does not mean it
+is linked into either executable. MIT is preferred where offered as an
+alternative; other selected terms include Apache-2.0, ISC, 0BSD, BSD-2-Clause,
+BSD-3-Clause, Unicode-3.0, Zlib, CC0-1.0, MIT-0, CDLA-Permissive-2.0 and
+bzip2-1.0.6. The exact package versions and declared license expressions are
+recorded in [inventory.json](./notices/inventory.json).
+
+Several packages vendor or derive from third-party source whose attribution is
+not carried by the crate-level license text. Those notices are reproduced
+verbatim beside the generated inventory:
+
+- ring 0.17.14: [its own ISC terms](./notices/ring-0.17.14-license.txt),
+  [the BoringSSL terms](./notices/ring-0.17.14-license-boringssl.txt),
+  [the ISC text for new files](./notices/ring-0.17.14-license-other-bits.txt),
+  [the fiat-crypto terms](./notices/ring-0.17.14-fiat-license.txt) and the
+  once_cell terms it sourced code from
+  ([Apache-2.0](./notices/ring-0.17.14-once-cell-license-apache.txt),
+  [MIT](./notices/ring-0.17.14-once-cell-license-mit.txt)).
+- aws-lc-sys 0.43.0: the vendored AWS-LC notice — itself covering BoringSSL and
+  OpenSSL/SSLeay — is the crate's `LICENSE` file and is reproduced in the
+  generated inventory; its separately licensed
+  [fiat-crypto component](./notices/aws-lc-sys-0.43.0-fiat-license.txt) is
+  included here.
+- libmimalloc-sys 0.1.49: [the vendored mimalloc terms](./notices/mimalloc-license.txt).
+- zstd-sys 2.0.16+zstd.1.5.7: [the vendored Zstandard terms](./notices/zstd-license.txt)
+  (BSD-3-Clause is selected; upstream also offers GPL-2.0).
+- moka 0.12.15: [its Apache-2.0 NOTICE file](./notices/moka-notice.txt), as
+  required by Apache-2.0 section 4(d).
+- crossbeam-channel 0.5.16:
+  [its third-party notices](./notices/crossbeam-channel-third-party.txt).
+- encoding_rs 0.8.35:
+  [its copyright and WHATWG attribution](./notices/encoding-rs-copyright.txt).
+- [Additional source attributions](./notices/source-attributions.txt) retain the
+  copyright and attribution files shipped by charset, enum-as-inner,
+  linux-raw-sys, miniz_oxide, rand, rand_chacha, rand_core, regex-syntax, rustix
+  and utf8_iter.
+
+## Compiler and static runtime
+
+Components supplied by the Rust compiler and by the C toolchain are outside
+`rust/Cargo.lock` and have separate notices. The exact versions that produced
+the shipped executables are recorded in
+[inventory.json](./notices/inventory.json) under `rustc` and `staticRuntime`,
+and `test/test.notices.node.ts` reads them back out of
+`dist_rust/mailer-bin_linux_amd64` and `dist_rust/mailer-bin_linux_arm64`, so
+these notices go stale loudly rather than silently.
+
+- The Rust toolchain is the one `tsrust` resolves: the system `cargo`/`rustc`
+  when one is installed, otherwise its bundled `stable-<host-triple>` under
+  `/tmp/tsrust_toolchain`. This release was built with rustc 1.95.0
+  (commit `59807616e1fa2540724bfbac14d7976d7e4a3860`), which both executables
+  embed. The [Rust standard-library inventory](./notices/rust-standard-library.html)
+  is that toolchain's `share/doc/rust/COPYRIGHT-library.html`; the upstream
+  inventory covers other targets too.
+- [Compiler-builtins license](./notices/compiler-builtins-license.txt), from
+  [Rust 1.95.0](https://github.com/rust-lang/rust/blob/1.95.0/library/compiler-builtins/LICENSE.txt),
+  retaining MIT and Apache-2.0 WITH LLVM-exception terms.
+- The GNU C Library 2.39 is statically linked into both executables, in the
+  Ubuntu builds that produced them:
+  - amd64: `libc6-dev` 2.39-0ubuntu8.9, from Ubuntu source package
+    `glibc` 2.39-0ubuntu8.9 —
+    `apt-get source glibc=2.39-0ubuntu8.9`, or
+    <https://launchpad.net/ubuntu/+source/glibc/2.39-0ubuntu8.9>.
+  - arm64: `libc6-dev-arm64-cross` 2.39-0ubuntu8cross1, from Ubuntu source
+    package `cross-toolchain-base` 68ubuntu5, which repacks Ubuntu glibc
+    2.39-0ubuntu8 —
+    `apt-get source cross-toolchain-base=68ubuntu5`, or
+    <https://launchpad.net/ubuntu/+source/cross-toolchain-base/68ubuntu5>.
+
+  Its [LGPL-2.1 terms](./notices/glibc-copying-lesser.txt) and the
+  [copying permission notices for its non-FSF parts](./notices/glibc-licenses.txt)
+  are reproduced from the upstream `glibc-2.39` tag, which those Ubuntu source
+  packages patch. The GNU C Library is free software licensed under the GNU
+  Lesser General Public License, version 2.1 or later; because it is linked
+  statically, redistributors must keep this notice and the license text with
+  the executables.
+- libgcc supplies the unwinder and compiler intrinsics linked into both
+  executables: `libgcc-13-dev` 13.3.0-6ubuntu2~24.04.1 (source package `gcc-13`)
+  for amd64 and `libgcc-13-dev-arm64-cross` 13.3.0-6ubuntu2~24.04.1cross1
+  (source package `gcc-13-cross` 14ubuntu4.4) for arm64, both GCC 13.3.0. It is
+  distributed under [GPL-3.0-or-later](./notices/libgcc-gpl-3.0.txt) WITH the
+  [GCC Runtime Library Exception 3.1](./notices/libgcc-runtime-exception.txt),
+  which permits distributing the compiled runtime with this executable under
+  the executable's own terms.
+
+## Rebuilding and relinking
+
+The executables are rebuilt from this repository with:
+
+```sh
+pnpm install
+pnpm run build:release  # tsbuild tsfolders && tsrust --configured-targets && tsrust verify
+```
+
+`tsrust --configured-targets` reads the `@git.zone/tsrust` block of
+`.smartconfig.json` (`targets` `linux_amd64` and `linux_arm64`,
+`static: true`), runs
+`RUSTFLAGS='-C target-feature=+crt-static' cargo build --release --target
+<triple>` in `rust/`, and copies the results to `dist_rust/`. The arm64 link
+uses the `aarch64-linux-gnu-gcc` linker configured in `rust/.cargo/config.toml`.
+`tsrust verify` then confirms that `dist_rust/` holds exactly that matrix,
+built from a clean checkout of the current commit; a rebuild from modified
+sources or against a modified library runs `pnpm exec tsrust
+--configured-targets` without it.
+
+That is also the relink route required by LGPL-2.1 section 6: the complete
+corresponding source of the work that uses the library is this package's own
+MIT-licensed source — `rust/` and `ts/` in
+[the package repository](https://code.foss.global/push.rocks/smartmta) at the
+tag matching this release — and glibc's sources are obtained with the
+`apt-get source` commands above, so a recipient can modify the library, rebuild
+it, and relink the executable with the command shown here.
+
+The TypeScript dependency graph is installed independently through the npm
+manifest; its packages are not bundled into these Rust executables.
+
+## Reproduction and review
+
+From the repository root, with cargo-about 0.9.1:
+
+```sh
+cargo about generate --manifest-path rust/Cargo.toml --config rust/about.toml \
+  --locked --fail --output-file notices/cargo-dependencies.html rust/about.hbs
+```
+
+The configuration selects checksum-verified upstream notices when published
+crates omit or misname them; network access is required for the pinned
+`r-efi` Git source. Those commands regenerate the notices only, not the
+executables; rebuilding and relinking is described above.
+`notices/inventory.json` records the SHA-256 of every notice file and notice
+input alongside the locked package list from `cargo metadata --locked`, the
+rustc that built the executables, and the exact Ubuntu glibc and libgcc
+package revisions linked into them; after a Cargo graph, compiler, C toolchain,
+or notice-input change, regenerate the notices, refresh those digests and
+values, and rerun `pnpm test`.
+`test/test.notices.node.ts` rejects stale digests, packages missing from the
+inventory or from the shipped notices, generic copyright placeholders and
+missing npm notice paths.
+
+Keep this index, `license` and the entire `notices/` directory beside any
+separately distributed copy of `mailer-bin_linux_amd64` or
+`mailer-bin_linux_arm64`.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartmta',
-  version: '9.6.0',
+  version: '10.0.0',
   description: 'A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.'
 }

package/ts/mail/core/classes.email.ts

@@ -567,72 +567,24 @@ export class Email {
    * Convert this email to a smartmail instance
    * @returns A new Smartmail instance
    */
-  public async toSmartmail(): Promise<plugins.smartmail.Smartmail<any>> {
-    const smartmail = new plugins.smartmail.Smartmail({
+  public async toSmartmail(): Promise<plugins.smartmail.Smartmail<unknown>> {
+    const smartmail = new plugins.smartmail.Smartmail<unknown>({
       from: this.from,
       subject: this.subject,
-      body: this.html || this.text
+      body: this.text,
+      htmlBody: this.html,
     });
-    
-    // Add recipients - ensure we're using the correct format
-    // (newer version of smartmail expects objects with email property)
-    for (const recipient of this.to) {
-      // Use the proper addRecipient method for the current smartmail version
-      if (typeof smartmail.addRecipient === 'function') {
-        smartmail.addRecipient(recipient);
-      } else {
-        // Fallback for older versions or different interface
-        (smartmail.options.to as any[]).push({
-          email: recipient,
-          name: recipient.split('@')[0] // Simple name extraction
-        });
-      }
-    }
-    
-    // Handle CC recipients
-    for (const ccRecipient of this.cc) {
-      if (typeof smartmail.addRecipient === 'function') {
-        smartmail.addRecipient(ccRecipient, 'cc');
-      } else {
-        // Fallback for older versions
-        if (!smartmail.options.cc) smartmail.options.cc = [];
-        (smartmail.options.cc as any[]).push({
-          email: ccRecipient,
-          name: ccRecipient.split('@')[0]
-        });
-      }
-    }
-    
-    // Handle BCC recipients
-    for (const bccRecipient of this.bcc) {
-      if (typeof smartmail.addRecipient === 'function') {
-        smartmail.addRecipient(bccRecipient, 'bcc');
-      } else {
-        // Fallback for older versions
-        if (!smartmail.options.bcc) smartmail.options.bcc = [];
-        (smartmail.options.bcc as any[]).push({
-          email: bccRecipient,
-          name: bccRecipient.split('@')[0]
-        });
-      }
-    }
-    
-    // Add attachments
+    smartmail.addRecipients(this.to, 'to');
+    smartmail.addRecipients(this.cc, 'cc');
+    smartmail.addRecipients(this.bcc, 'bcc');
     for (const attachment of this.attachments) {
-      const smartAttachment = new plugins.smartfile.SmartFile({
-        path: attachment.filename,
-        contentBuffer: attachment.content,
-        base: '.',
+      smartmail.addAttachment({
+        filename: attachment.filename,
+        contentType: attachment.contentType,
+        content: attachment.content,
+        contentId: attachment.contentId,
       });
-      
-      // Set content type if available
-      if (attachment.contentType) {
-        (smartAttachment as any).contentType = attachment.contentType;
-      }
-      
-      smartmail.addAttachment(smartAttachment);
     }
-    
     return smartmail;
   }
 
@@ -869,80 +821,39 @@ export class Email {
    * @param smartmail The Smartmail instance to convert
    * @returns A new Email instance
    */
-  public static fromSmartmail(smartmail: plugins.smartmail.Smartmail<any>): Email {
+  public static fromSmartmail(smartmail: plugins.smartmail.Smartmail<unknown>): Email {
     const options: IEmailOptions = {
       from: smartmail.options.from,
-      to: [],
+      to: smartmail.options.to ?? [],
+      cc: smartmail.options.cc ?? [],
+      bcc: smartmail.options.bcc ?? [],
       subject: smartmail.getSubject(),
-      text: smartmail.getBody(false), // Plain text version
-      html: smartmail.getBody(true),  // HTML version
-      attachments: []
-    };
-    
-    // Function to safely extract email address from recipient
-    const extractEmail = (recipient: any): string => {
-      // Handle string recipients
-      if (typeof recipient === 'string') return recipient;
-      
-      // Handle object recipients
-      if (recipient && typeof recipient === 'object') {
-        const addressObj = recipient as any;
-        // Try different property names that might contain the email address
-        if ('address' in addressObj && typeof addressObj.address === 'string') {
-          return addressObj.address;
-        }
-        if ('email' in addressObj && typeof addressObj.email === 'string') {
-          return addressObj.email;
-        }
-      }
-      
-      // Fallback for invalid input
-      return '';
-    };
-    
-    // Filter out empty strings from the extracted emails
-    const filterValidEmails = (emails: string[]): string[] => {
-      return emails.filter(email => email && email.length > 0);
+      text: smartmail.getBody(),
+      html: smartmail.getHtmlBody() ?? undefined,
+      attachments: smartmail.attachments.map((attachment) => ({
+        filename: attachment.filename,
+        content: Email.attachmentContentToBuffer(attachment),
+        contentType: attachment.contentType || 'application/octet-stream',
+        contentId: attachment.contentId,
+      })),
     };
-    
-    // Convert recipients from Smartmail's optional arrays.
-    const toRecipients = smartmail.options.to;
-    if (toRecipients && toRecipients.length > 0) {
-      options.to = filterValidEmails(toRecipients.map(extractEmail));
-    }
-    
-    const ccRecipients = smartmail.options.cc;
-    if (ccRecipients && ccRecipients.length > 0) {
-      options.cc = filterValidEmails(ccRecipients.map(extractEmail));
-    }
-    
-    const bccRecipients = smartmail.options.bcc;
-    if (bccRecipients && bccRecipients.length > 0) {
-      options.bcc = filterValidEmails(bccRecipients.map(extractEmail));
+    return new Email(options);
+  }
+
+  /**
+   * Email attachments hold their bytes in memory; a streamed Smartmail attachment
+   * (iterable or stream content) cannot be converted synchronously.
+   */
+  private static attachmentContentToBuffer(attachment: plugins.smartmail.IMailAttachment): Buffer {
+    const content = attachment.content;
+    if (typeof content === 'string') {
+      return Buffer.from(content, 'utf8');
     }
-    
-    // Convert attachments (note: this handles the synchronous case only)
-    if (smartmail.attachments?.length > 0) {
-      options.attachments = smartmail.attachments.map(attachment => {
-        // For the test case, if the path is exactly "test.txt", use that as the filename
-        let filename = 'attachment.bin';
-        
-        if (attachment.path === 'test.txt') {
-          filename = 'test.txt';
-        } else if (attachment.parsedPath?.base) {
-          filename = attachment.parsedPath.base;
-        } else if (typeof attachment.path === 'string') {
-          filename = attachment.path.split('/').pop() || 'attachment.bin';
-        }
-        
-        return {
-          filename,
-          content: Buffer.from(attachment.contentBuffer || Buffer.alloc(0)),
-          contentType: (attachment as any)?.contentType || 'application/octet-stream'
-        };
-      });
+    if (content instanceof Uint8Array) {
+      return Buffer.from(content);
     }
-    
-    return new Email(options);
+    throw new Error(
+      `Attachment ${attachment.filename} has streamed content; Email.fromSmartmail() needs string or Uint8Array content`
+    );
   }
 }

package/ts/mail/core/classes.emailvalidator.ts

@@ -22,14 +22,14 @@ export interface IEmailValidationResult {
  * Advanced email validator class using smartmail's capabilities
  */
 export class EmailValidator {
-  private validator: plugins.smartmail.EmailAddressValidator;
+  private validator: plugins.smartmailValidation.EmailAddressValidator;
   private dnsCache: LRUCache<string, string[]>;
   
   constructor(options?: {
     maxCacheSize?: number;
     cacheTTL?: number;
   }) {
-    this.validator = new plugins.smartmail.EmailAddressValidator();
+    this.validator = new plugins.smartmailValidation.EmailAddressValidator();
     
     // Initialize LRU cache for DNS records
     this.dnsCache = new LRUCache<string, string[]>({

package/ts/plugins.ts

@@ -22,13 +22,13 @@ export {
 }
 
 // @push.rocks scope
-import * as smartfile from '@push.rocks/smartfile';
 import * as smartlog from '@push.rocks/smartlog';
 import * as smartmail from '@push.rocks/smartmail';
+import * as smartmailValidation from '@push.rocks/smartmail/validation';
 import * as smartpath from '@push.rocks/smartpath';
 import * as smartrust from '@push.rocks/smartrust';
 
-export { smartfile, smartlog, smartmail, smartpath, smartrust };
+export { smartlog, smartmail, smartmailValidation, smartpath, smartrust };
 
 // Define SmartLog types for use in error handling
 export type TLogLevel = 'error' | 'warn' | 'info' | 'success' | 'debug';